@carrierllc/mcp 0.13.6 → 0.13.9

package/dist/cli.js

@@ -39,7 +39,7 @@ import {
   verifyStorefront,
   walletScreen,
   which
-} from "./chunk-BIZFEVMT.js";
+} from "./chunk-DF2PGR5H.js";
 import {
   copyTree,
   exists,
@@ -272,465 +272,615 @@ async function writeStorefrontLogo(target, brand) {
   return { path: svgPath, source: logo.source };
 }
 
-// src/cli/lib/resend.ts
-import { createHash, randomBytes } from "crypto";
-import { createServer } from "http";
-var RESEND_API = "https://api.resend.com";
-var RESEND_API_KEYS_URL = "https://resend.com/api-keys";
-var RESEND_DOMAINS_URL = "https://resend.com/domains";
-var USER_AGENT = "carrier-cli";
-var CLIENT_NAME = "Carrier storefront setup";
-var OAUTH_SCOPE = "full_access";
-var REDIRECT_PATH = "/oauth/callback";
-var REDIRECT_HOST = "127.0.0.1";
-function looksResendKey(key) {
-  return /^re_[A-Za-z0-9_-]{8,}$/.test(key.trim());
+// src/cli/lib/hosted-publish.ts
+import { readFileSync } from "fs";
+
+// ../../packages/sdk/src/storefront-labels.ts
+var regionNames = new Intl.DisplayNames(["en"], { type: "region" });
+var PREFERRED = /* @__PURE__ */ new Set(["CW", "BF", "BJ", "MM", "CD", "RS", "DE", "FR", "GB", "VU", "ZW", "RU", "TL", "VN", "YE"]);
+var NAME_TO_CODE = /* @__PURE__ */ new Map();
+for (let first = 65; first <= 90; first += 1) {
+  for (let second = 65; second <= 90; second += 1) {
+    const code = String.fromCharCode(first, second);
+    const label = regionLabel(code);
+    if (!label) continue;
+    const key = label.toLowerCase();
+    const current = NAME_TO_CODE.get(key);
+    if (!current || PREFERRED.has(code)) NAME_TO_CODE.set(key, code);
+  }
 }
-function base64url(input) {
-  return input.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+NAME_TO_CODE.set("uk", "GB");
+var CODE_ALIASES = { UK: "GB" };
+function parseDataGb(raw) {
+  if (raw.trim().toLowerCase() === "unlimited") return { ok: true, value: 0 };
+  return parseAmount(raw, /gigabytes?|gbs?|gb/gi, "Enter data like 1, 1 GB, or Unlimited.", 1e4, false);
 }
-function pkcePair() {
-  const verifier = base64url(randomBytes(64));
-  return { verifier, challenge: base64url(createHash("sha256").update(verifier).digest()) };
+function parseValidityDays(raw) {
+  return parseAmount(raw, /days?/gi, "Enter validity like 7 or 7 days.", 3650, true);
 }
-function buildAuthorizeUrl(opts) {
-  const url = new URL(`${RESEND_API}/oauth/authorize`);
-  url.searchParams.set("client_id", opts.clientId);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("redirect_uri", opts.redirectUri);
-  url.searchParams.set("scope", opts.scope ?? OAUTH_SCOPE);
-  url.searchParams.set("state", opts.state);
-  url.searchParams.set("code_challenge", opts.challenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  return url.toString();
+var ZERO_DECIMAL = /* @__PURE__ */ new Set([
+  "BIF",
+  "CLP",
+  "DJF",
+  "GNF",
+  "JPY",
+  "KMF",
+  "KRW",
+  "MGA",
+  "PYG",
+  "RWF",
+  "UGX",
+  "VND",
+  "VUV",
+  "XAF",
+  "XOF",
+  "XPF"
+]);
+function majorToCents(input, currency = "EUR") {
+  const text3 = input.trim();
+  if (ZERO_DECIMAL.has(currency.trim().toUpperCase())) {
+    if (!/^\d+$/.test(text3)) return { ok: false, message: "Enter a whole number, such as 1000." };
+    const cents2 = Number(text3);
+    if (!Number.isSafeInteger(cents2) || cents2 <= 0) return { ok: false, message: "Enter a price above zero." };
+    return { ok: true, cents: cents2 };
+  }
+  const match = /^(\d+)(?:\.(\d{1,2}))?$/.exec(text3);
+  if (!match) return { ok: false, message: "Enter a price like 9.00." };
+  const major = Number(match[1]);
+  const fraction = (match[2] ?? "").padEnd(2, "0");
+  const cents = major * 100 + Number(fraction);
+  if (!Number.isSafeInteger(cents) || cents <= 0) return { ok: false, message: "Enter a price above zero." };
+  return { ok: true, cents };
 }
-async function resendFetch(fetchImpl, path, init = {}) {
-  const headers = { "User-Agent": USER_AGENT, Accept: "application/json" };
-  if (init.token) headers.Authorization = `Bearer ${init.token}`;
-  let body;
-  if (init.form) {
-    headers["Content-Type"] = "application/x-www-form-urlencoded";
-    body = new URLSearchParams(init.form).toString();
-  } else if (init.json !== void 0) {
-    headers["Content-Type"] = "application/json";
-    body = JSON.stringify(init.json);
+function parseCountryInput(raw) {
+  const regions = [];
+  const parts = raw.split(",").map((part) => part.trim()).filter((part) => part !== "");
+  for (const part of parts) {
+    const added = codesFor(part);
+    if (!added) return { ok: false, message: "Countries are names, such as France, or codes such as FR." };
+    for (const code of added) {
+      if (regions.length >= 40) break;
+      if (!regions.includes(code)) regions.push(code);
+    }
+  }
+  return { ok: true, regions };
+}
+function parseAmount(raw, unit, message, max, whole) {
+  const text3 = raw.trim().replace(unit, "").trim();
+  if (text3 === "" || !/^\d+(\.\d+)?$/.test(text3)) return { ok: false, message };
+  const value = Number(text3);
+  if (!Number.isFinite(value) || value < 0 || value > max) return { ok: false, message };
+  if (whole && !Number.isInteger(value)) return { ok: false, message };
+  return { ok: true, value };
+}
+function codesFor(part) {
+  const tokens = part.split(/\s+/).filter((token) => token !== "");
+  if (tokens.length > 1 && tokens.every((token) => /^[A-Za-z]{2}$/.test(token))) {
+    return tokens.map((token) => canonical(token));
+  }
+  if (/^[A-Za-z]{2}$/.test(part)) return [canonical(part)];
+  const code = NAME_TO_CODE.get(part.toLowerCase());
+  return code ? [code] : null;
+}
+function canonical(code) {
+  const upper = code.toUpperCase();
+  return CODE_ALIASES[upper] ?? upper;
+}
+var LOGO_DATA = /^data:image\/(png|jpeg|webp|gif);base64,[A-Za-z0-9+/]+={0,2}$/;
+var LOGO_MAX_CHARS = 1e5;
+var LOGO_MAX_BYTES = 70 * 1024;
+function logoFileDataUrl(bytes) {
+  const mime = logoMime(bytes);
+  if (!mime || bytes.byteLength < 1 || bytes.byteLength > LOGO_MAX_BYTES) {
+    return { ok: false, message: "Use a PNG, JPEG, WebP, or GIF under 70 KB, or an https address." };
+  }
+  const url = `data:${mime};base64,${toBase64(bytes)}`;
+  if (url.length > LOGO_MAX_CHARS || !LOGO_DATA.test(url)) {
+    return { ok: false, message: "Use a PNG, JPEG, WebP, or GIF under 70 KB, or an https address." };
+  }
+  return { ok: true, url };
+}
+function logoReference(value) {
+  const trimmed = value.trim();
+  if (trimmed.startsWith("data:")) {
+    if (trimmed.length <= LOGO_MAX_CHARS && LOGO_DATA.test(trimmed)) return { ok: true, url: trimmed };
+    return { ok: false, message: "Use a PNG, JPEG, WebP, or GIF under 70 KB, or an https address." };
   }
   try {
-    const res = await fetchImpl(`${RESEND_API}${path}`, {
-      method: init.method ?? "GET",
-      headers,
-      body
-    });
-    const text3 = await res.text();
-    let json;
-    try {
-      json = text3 ? JSON.parse(text3) : void 0;
-    } catch {
-      json = void 0;
-    }
-    if (!res.ok) {
-      return { ok: false, status: res.status, json, error: resendError(json) ?? text3.slice(0, 300) };
-    }
-    return { ok: true, status: res.status, json };
-  } catch (e) {
-    return { ok: false, status: 0, error: e instanceof Error ? e.message : String(e) };
+    const url = new URL(trimmed);
+    if (url.protocol === "https:") return { ok: true, url: url.toString() };
+  } catch {
+    return { ok: false, message: "Use a PNG, JPEG, WebP, or GIF under 70 KB, or an https address." };
   }
+  return { ok: false, message: "Use a PNG, JPEG, WebP, or GIF under 70 KB, or an https address." };
 }
-function resendError(json) {
-  if (typeof json !== "object" || json === null) return void 0;
-  const body = json;
-  return body.message ?? body.error_description ?? body.error;
+function toBase64(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
 }
-async function registerOauthClient(fetchImpl) {
-  const registeredRedirect = `http://${REDIRECT_HOST}${REDIRECT_PATH}`;
-  const res = await resendFetch(fetchImpl, "/oauth/register", {
+function logoMime(bytes) {
+  if (bytes.length >= 8 && bytes[0] === 137 && bytes[1] === 80 && bytes[2] === 78 && bytes[3] === 71) {
+    return "image/png";
+  }
+  if (bytes.length >= 3 && bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255) return "image/jpeg";
+  if (bytes.length >= 6 && bytes[0] === 71 && bytes[1] === 73 && bytes[2] === 70) return "image/gif";
+  if (bytes.length >= 12 && bytes[0] === 82 && bytes[1] === 73 && bytes[2] === 70 && bytes[3] === 70 && bytes[8] === 87 && bytes[9] === 69 && bytes[10] === 66 && bytes[11] === 80) {
+    return "image/webp";
+  }
+  return null;
+}
+function regionLabel(code) {
+  if (!/^[A-Z]{2}$/.test(code)) return void 0;
+  try {
+    const label = regionNames.of(code);
+    if (!label || label.toUpperCase() === code) return void 0;
+    return label;
+  } catch {
+    return void 0;
+  }
+}
+
+// ../../packages/sdk/src/storefront-write.ts
+var THEME_FIELDS = [
+  ["accent", "accent"],
+  ["accentDark", "accentDark"],
+  ["bg", "bg"],
+  ["text", "text"],
+  ["logoUrl", "logoUrl"]
+];
+var COPY_FIELDS = [
+  ["hero", "hero"],
+  ["tagline", "tagline"],
+  ["supportEmail", "supportEmail"],
+  ["legalName", "legalName"]
+];
+function storefrontBrandPatch(input, existing) {
+  const theme = overlay(existing?.theme, input, THEME_FIELDS);
+  const copy = overlay(existing?.copy, input, COPY_FIELDS);
+  return {
+    ...theme ? { theme } : {},
+    ...copy ? { copy } : {}
+  };
+}
+function completePlanInput(input, plans) {
+  if ((input.productId?.trim() ?? "") !== "") return input;
+  const touched = [
+    input.slug,
+    input.name,
+    input.priceCents,
+    input.currency,
+    input.templateId,
+    input.dataGb,
+    input.validityDays,
+    input.regions,
+    input.description,
+    input.active
+  ].some((value) => value !== void 0);
+  if (!touched) return input;
+  const slug2 = input.slug?.trim();
+  const match = slug2 ? plans.find((plan) => plan.slug === slug2) : plans.length === 1 ? plans[0] : void 0;
+  if (!match) {
+    const currency = sharedCurrency(plans);
+    if (!input.currency && currency) return { ...input, currency };
+    return input;
+  }
+  return {
+    ...input,
+    slug: input.slug ?? match.slug,
+    name: input.name ?? match.name,
+    currency: input.currency ?? match.currency,
+    templateId: input.templateId ?? match.ocs_package_template_id
+  };
+}
+function sharedCurrency(plans) {
+  const codes = new Set(plans.map((plan) => plan.currency.trim().toUpperCase()).filter((code) => code !== ""));
+  if (codes.size !== 1) return void 0;
+  return [...codes][0];
+}
+function storefrontPlanBody(input) {
+  const productId = input.productId?.trim() ?? "";
+  if (productId !== "") {
+    const body2 = { product_id: productId };
+    if (input.priceCents !== void 0) body2.price_cents = input.priceCents;
+    if (input.active !== void 0) body2.active = input.active;
+    return body2;
+  }
+  const touched = [
+    input.slug,
+    input.name,
+    input.priceCents,
+    input.currency,
+    input.templateId,
+    input.dataGb,
+    input.validityDays,
+    input.regions,
+    input.description,
+    input.active
+  ].some((value) => value !== void 0);
+  if (!touched) return null;
+  if (!input.slug || !input.name || input.priceCents === void 0 || !input.currency || input.templateId === void 0) {
+    return { error: "A plan needs a slug, name, price in minor units, currency, and OCS template id." };
+  }
+  const body = {
+    slug: input.slug,
+    name: input.name,
+    price_cents: input.priceCents,
+    currency: input.currency,
+    ocs_package_template_id: input.templateId
+  };
+  if (input.dataGb !== void 0) body.data_gb = input.dataGb;
+  if (input.validityDays !== void 0) body.validity_days = input.validityDays;
+  if (input.regions !== void 0) body.regions = input.regions;
+  if (input.description !== void 0) body.description = input.description;
+  if (input.active !== void 0) body.active = input.active;
+  return body;
+}
+function isStorefrontPlanError(value) {
+  return value !== null && "error" in value;
+}
+function parseWholeNumber(value, label) {
+  if (value === void 0) return { ok: true, value: void 0 };
+  if (!/^\d+$/.test(value)) return { ok: false, message: `${label} must be a whole number.` };
+  return { ok: true, value: Number(value) };
+}
+function overlay(base, input, fields) {
+  const patch = {};
+  let touched = false;
+  for (const [field, jsonKey] of fields) {
+    const value = input[field];
+    if (typeof value !== "string" || value.trim() === "") continue;
+    patch[jsonKey] = value.trim();
+    touched = true;
+  }
+  if (!touched) return void 0;
+  return { ...base ?? {}, ...patch };
+}
+var RESERVED_SLUGS = /* @__PURE__ */ new Set(["www", "app", "api", "stores", "checkout", "dashboard", "admin", "mail"]);
+function hostedStorefrontUrl(slug2) {
+  return `https://${slug2}.stores.carrier.llc`;
+}
+function storefrontSlugFrom(raw) {
+  const folded = raw.trim().toLowerCase().normalize("NFKD").replace(/[\u0300-\u036f]/g, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  const clipped = folded.slice(0, 40).replace(/-+$/g, "");
+  if (RESERVED_SLUGS.has(clipped)) return "";
+  return /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/.test(clipped) ? clipped : "";
+}
+
+// src/cli/lib/auth.ts
+import { createHash, randomBytes, timingSafeEqual } from "crypto";
+import { createServer } from "http";
+
+// src/cli/lib/credentials.ts
+import { homedir as homedir2 } from "os";
+import { join as join5 } from "path";
+import { chmod, mkdir as mkdir2, readFile as readFile2, rm, writeFile as writeFile3 } from "fs/promises";
+function carrierHome() {
+  return process.env.CARRIER_HOME?.trim() || join5(homedir2(), ".carrier");
+}
+function credentialsPath() {
+  return join5(carrierHome(), "credentials.json");
+}
+async function readCredentials() {
+  try {
+    const raw = await readFile2(credentialsPath(), "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed?.accessToken || typeof parsed.accessToken !== "string") return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+async function writeCredentials(creds) {
+  const dir = carrierHome();
+  await mkdir2(dir, { recursive: true, mode: 448 });
+  await chmod(dir, 448).catch(() => void 0);
+  const file = credentialsPath();
+  await writeFile3(file, `${JSON.stringify(creds, null, 2)}
+`, { mode: 384 });
+  await chmod(file, 384).catch(() => void 0);
+}
+async function clearCredentials() {
+  await rm(credentialsPath(), { force: true });
+}
+function isExpired(creds, skewMs = 6e4) {
+  if (!creds.expiresAt) return false;
+  return Date.now() >= creds.expiresAt - skewMs;
+}
+function redact(text3) {
+  return text3.replace(/\b(ak_|sk_|rt_)[A-Za-z0-9._-]{6,}/g, "$1***").replace(/\bBearer\s+[A-Za-z0-9._-]{8,}/gi, "Bearer ***");
+}
+
+// src/cli/lib/auth.ts
+var DISCOVERY_PATH = "/.well-known/oauth-authorization-server";
+var CLIENT_NAME = "Carrier CLI";
+var DEFAULT_SCOPE = "read write";
+var CALLBACK_PORTS = [3118, 3119, 8976, 8977, 0];
+async function discover(base = MCP_HOME) {
+  const res = await fetch(`${base}${DISCOVERY_PATH}`, {
+    headers: { Accept: "application/json" }
+  });
+  if (!res.ok) throw new Error(`OAuth discovery failed (${res.status}) at ${base}${DISCOVERY_PATH}`);
+  const meta = await res.json();
+  if (!meta.authorization_endpoint || !meta.token_endpoint) {
+    throw new Error("OAuth discovery returned no authorization or token endpoint");
+  }
+  return meta;
+}
+function base64url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function pkcePair() {
+  const verifier = base64url(randomBytes(32));
+  const challenge = base64url(createHash("sha256").update(verifier).digest());
+  return { verifier, challenge };
+}
+function sameState(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  if (left.length !== right.length) return false;
+  return timingSafeEqual(left, right);
+}
+async function registerClient(meta, redirectUri) {
+  if (!meta.registration_endpoint) {
+    throw new Error("This server does not support dynamic client registration");
+  }
+  const res = await fetch(meta.registration_endpoint, {
     method: "POST",
-    json: {
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({
       client_name: CLIENT_NAME,
-      redirect_uris: [registeredRedirect],
+      redirect_uris: [redirectUri],
       grant_types: ["authorization_code", "refresh_token"],
       response_types: ["code"],
+      // Installed apps cannot keep a secret; register as a public client.
       token_endpoint_auth_method: "none",
-      scope: OAUTH_SCOPE
-    }
+      application_type: "native"
+    })
   });
   if (!res.ok) {
-    return { ok: false, reason: `Resend rejected client registration: ${res.error ?? res.status}` };
+    const body = (await res.text().catch(() => "")).slice(0, 200);
+    throw new Error(`Client registration failed (${res.status}). ${body}`);
   }
-  const clientId = res.json?.client_id;
-  if (!clientId) return { ok: false, reason: "Resend registered no client_id." };
-  return { ok: true, clientId };
-}
-async function exchangeCode(fetchImpl, opts) {
-  const res = await resendFetch(fetchImpl, "/oauth/token", {
-    method: "POST",
-    form: {
-      grant_type: "authorization_code",
-      client_id: opts.clientId,
-      code: opts.code,
-      redirect_uri: opts.redirectUri,
-      code_verifier: opts.verifier
-    }
-  });
-  if (!res.ok) return { ok: false, reason: `Token exchange failed: ${res.error ?? res.status}` };
-  const body = res.json;
-  if (!body?.access_token) return { ok: false, reason: "Resend returned no access token." };
-  return { ok: true, accessToken: body.access_token, refreshToken: body.refresh_token };
+  const json = await res.json();
+  if (!json.client_id) throw new Error("Client registration returned no client_id");
+  return json.client_id;
 }
-async function revokeGrant(fetchImpl, opts) {
-  await resendFetch(fetchImpl, "/oauth/revoke", {
-    method: "POST",
-    form: {
-      client_id: opts.clientId,
-      token: opts.refreshToken,
-      token_type_hint: "refresh_token"
-    }
-  }).catch(() => void 0);
+function escapeHtml(text3) {
+  return text3.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
-async function findVerifiedDomainId(fetchImpl, accessToken, domain) {
-  const wanted = domain.trim().replace(/^https?:\/\//, "").replace(/\/+$/, "").toLowerCase();
-  if (!wanted) return void 0;
-  const res = await resendFetch(fetchImpl, "/domains", { token: accessToken });
-  if (!res.ok) return void 0;
-  const list = res.json?.data;
-  const match = list?.find((d) => d.name?.toLowerCase() === wanted && d.status === "verified");
-  return match?.id;
+function page(title, detail) {
+  const safeTitle = escapeHtml(title);
+  const safeDetail = escapeHtml(detail);
+  return `<!doctype html><meta charset="utf-8"><title>${safeTitle}</title>
+<body style="font-family:system-ui,sans-serif;max-width:32rem;margin:20vh auto;text-align:center">
+<h1 style="font-size:1.25rem">${safeTitle}</h1><p style="color:#555">${safeDetail}</p></body>`;
 }
-async function createSendingKey(fetchImpl, accessToken, opts) {
-  const res = await resendFetch(fetchImpl, "/api-keys", {
-    method: "POST",
-    token: accessToken,
-    json: {
-      // Resend caps the name at 50 characters.
-      name: opts.name.slice(0, 50),
-      permission: "sending_access",
-      ...opts.domainId ? { domain_id: opts.domainId } : {}
+async function startCallbackServer() {
+  let resolveCode;
+  let rejectCode;
+  let expected = "";
+  const server = createServer((req, res) => {
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    if (url.pathname !== "/callback") {
+      res.writeHead(404).end();
+      return;
     }
-  });
-  if (!res.ok) return { ok: false, reason: `Could not create an API key: ${res.error ?? res.status}` };
-  const body = res.json;
-  if (!body?.token) return { ok: false, reason: "Resend created a key but returned no token." };
-  return { ok: true, token: body.token, id: body.id };
-}
-async function validateResendKey(fetchImpl, key) {
-  if (!looksResendKey(key)) return { ok: false, reason: "That does not look like a Resend key (re_\u2026)." };
-  const res = await resendFetch(fetchImpl, "/emails", { method: "POST", token: key, json: {} });
-  if (res.status === 401) return { ok: false, reason: "Resend says that key is missing or malformed." };
-  if (res.status === 403) return { ok: false, reason: "Resend rejected that key as invalid." };
-  if (res.status === 0) return { ok: false, reason: `Could not reach Resend: ${res.error ?? "network error"}` };
-  return { ok: true };
-}
-async function startLoopbackServer() {
-  let resolveCode = null;
-  const server = createServer((req, res) => {
-    const url = new URL(req.url ?? "/", `http://${REDIRECT_HOST}`);
-    if (url.pathname !== REDIRECT_PATH) {
-      res.writeHead(404).end();
+    const err = url.searchParams.get("error");
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state") ?? "";
+    if (err) {
+      res.writeHead(400, { "Content-Type": "text/html" });
+      res.end(page("Sign-in failed", err));
+      rejectCode?.(new Error(`Authorization server returned "${err}"`));
       return;
     }
-    const error = url.searchParams.get("error");
-    const code = url.searchParams.get("code");
-    const state = url.searchParams.get("state");
-    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-    res.end(
-      `<!doctype html><meta charset="utf-8"><title>Carrier</title><body style="font-family:system-ui;padding:3rem;text-align:center"><p>${error ? "Authorization was refused." : "Connected. You can close this tab."}</p>`
-    );
-    resolveCode?.(
-      error ? { ok: false, reason: `Resend returned "${error}".` } : code ? { ok: true, code, reason: state ?? void 0 } : { ok: false, reason: "Resend sent no authorization code." }
-    );
-  });
-  await new Promise((resolve3, reject) => {
-    server.once("error", reject);
-    server.listen(0, REDIRECT_HOST, resolve3);
+    if (!code || !expected || !sameState(state, expected)) {
+      res.writeHead(400, { "Content-Type": "text/html" });
+      res.end(page("Sign-in failed", "The redirect did not match this login attempt."));
+      rejectCode?.(new Error("State mismatch \u2014 ignoring the redirect"));
+      return;
+    }
+    res.writeHead(200, { "Content-Type": "text/html" });
+    res.end(page("You're signed in", "Close this tab and return to your terminal."));
+    resolveCode?.(code);
   });
-  const port = server.address().port;
-  const redirectUri = `http://${REDIRECT_HOST}:${port}${REDIRECT_PATH}`;
+  let bound = false;
+  let lastErr;
+  for (const port2 of CALLBACK_PORTS) {
+    try {
+      await new Promise((resolve3, reject) => {
+        server.once("error", reject);
+        server.listen(port2, "127.0.0.1", () => {
+          server.removeListener("error", reject);
+          resolve3();
+        });
+      });
+      bound = true;
+      break;
+    } catch (e) {
+      lastErr = e;
+    }
+  }
+  if (!bound) {
+    throw new Error(
+      `Could not bind a local callback port (tried ${CALLBACK_PORTS.filter(Boolean).join(", ")}): ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`
+    );
+  }
+  const { port } = server.address();
   return {
-    redirectUri,
-    close: () => server.close(),
-    waitForCode(state, timeoutMs) {
-      return new Promise((resolve3) => {
-        const done = (r) => {
-          clearTimeout(timer);
-          resolveCode = null;
-          server.close();
-          resolve3(r);
-        };
+    redirectUri: `http://localhost:${port}/callback`,
+    // `close()` alone only stops new connections; a keep-alive socket from the
+    // browser would hold the event loop open and the CLI would never exit.
+    waitForCode: (expectedState, timeoutMs) => {
+      expected = expectedState;
+      return new Promise((resolve3, reject) => {
         const timer = setTimeout(
-          () => done({ ok: false, reason: "Timed out waiting for the browser." }),
+          () => reject(new Error(`Timed out after ${Math.round(timeoutMs / 1e3)}s waiting for the browser`)),
           timeoutMs
         );
-        resolveCode = (r) => {
-          if (r.ok && r.reason !== state) {
-            done({ ok: false, reason: "The browser callback did not match this request." });
-            return;
-          }
-          done(r.ok ? { ok: true, code: r.code } : r);
+        resolveCode = (code) => {
+          clearTimeout(timer);
+          resolve3(code);
+        };
+        rejectCode = (err) => {
+          clearTimeout(timer);
+          reject(err);
         };
       });
+    },
+    close: () => {
+      server.closeAllConnections();
+      server.close();
     }
   };
 }
-function discoverResendKey(env) {
-  const key = env.RESEND_API_KEY?.trim();
-  if (!key || !looksResendKey(key)) return void 0;
-  return { apiKey: key, tier: "discovered" };
-}
-var MANUAL_STEPS = [
-  `Open ${RESEND_API_KEYS_URL} and create an API key.`,
-  `Give it Sending access, and restrict it to your sending domain if that domain is verified at ${RESEND_DOMAINS_URL}.`,
-  "Put the key in the storefront's .env.local as RESEND_API_KEY.",
-  "Re-run `carrier site deploy` \u2014 the key is pushed to the deploy target automatically."
-];
-async function provisionResend(opts) {
-  const { deps } = opts;
-  const notes = [];
-  const discovered = discoverResendKey(opts.env);
-  if (discovered) {
-    const check = await validateResendKey(deps.fetch, discovered.apiKey);
-    if (check.ok) return { ok: true, tier: "discovered", credentials: discovered };
-    notes.push(`A RESEND_API_KEY was already set but did not work: ${check.reason}`);
-  }
-  if (!opts.noBrowser) {
-    const viaBrowser = await oauthTier(opts);
-    if (viaBrowser.ok) {
-      return { ...viaBrowser, reason: notes.length ? notes.join(" ") : void 0 };
-    }
-    notes.push(viaBrowser.reason ?? "The browser authorization did not complete.");
-  }
-  if (deps.promptForKey) {
-    await deps.openBrowser(RESEND_API_KEYS_URL);
-    const pasted = (await deps.promptForKey(RESEND_API_KEYS_URL))?.trim();
-    if (pasted) {
-      const check = await validateResendKey(deps.fetch, pasted);
-      if (check.ok) {
-        return {
-          ok: true,
-          tier: "paste",
-          credentials: { apiKey: pasted, tier: "paste" },
-          reason: notes.length ? notes.join(" ") : void 0
-        };
-      }
-      notes.push(check.reason ?? "The pasted key did not work.");
-    }
+async function postToken(meta, body) {
+  const res = await fetch(meta.token_endpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: new URLSearchParams(body).toString()
+  });
+  const json = await res.json().catch(() => ({}));
+  if (!res.ok || json.error) {
+    throw new Error(json.error_description || json.error || `Token endpoint returned ${res.status}`);
   }
-  return { ok: false, tier: "manual", reason: notes.join(" "), guidance: MANUAL_STEPS };
+  if (!json.access_token) throw new Error("Token endpoint returned no access_token");
+  return json;
 }
-async function oauthTier(opts) {
-  const { deps } = opts;
-  let server;
-  try {
-    server = await deps.startLoopback();
-  } catch (e) {
-    return {
-      ok: false,
-      tier: "oauth",
-      reason: `Could not open a local callback listener: ${e instanceof Error ? e.message : String(e)}`
-    };
-  }
+function store(meta, token, clientId) {
+  return {
+    issuer: meta.issuer,
+    accessToken: token.access_token,
+    refreshToken: token.refresh_token,
+    expiresAt: Date.now() + (token.expires_in ?? 900) * 1e3,
+    scope: token.scope,
+    clientId
+  };
+}
+async function login(opts) {
+  const meta = await discover();
+  const server = await startCallbackServer();
   try {
-    const registered = await registerOauthClient(deps.fetch);
-    if (!registered.ok) return { ok: false, tier: "oauth", reason: registered.reason };
+    const existing = await readCredentials();
+    const clientId = existing?.clientId && existing.issuer === meta.issuer ? existing.clientId : await registerClient(meta, server.redirectUri);
     const { verifier, challenge } = pkcePair();
-    const state = base64url(randomBytes(24));
-    const authorizeUrl = buildAuthorizeUrl({
-      clientId: registered.clientId,
-      redirectUri: server.redirectUri,
-      state,
-      challenge
-    });
-    const opened = await deps.openBrowser(authorizeUrl);
-    deps.notify(
-      opened.ok ? "Approve the connection in your browser \u2014 this waits for you." : `Open this to approve the connection:
-  ${authorizeUrl}`
-    );
-    const callback = await server.waitForCode(state, opts.timeoutMs ?? 18e4);
-    if (!callback.ok || !callback.code) {
-      return { ok: false, tier: "oauth", reason: callback.reason ?? "No authorization code." };
-    }
-    const token = await exchangeCode(deps.fetch, {
-      clientId: registered.clientId,
-      code: callback.code,
-      redirectUri: server.redirectUri,
-      verifier
-    });
-    if (!token.ok) return { ok: false, tier: "oauth", reason: token.reason };
-    const domainId = opts.domain ? await findVerifiedDomainId(deps.fetch, token.accessToken, opts.domain) : void 0;
-    const created = await createSendingKey(deps.fetch, token.accessToken, {
-      name: `${opts.name} storefront`,
-      domainId
+    const state = base64url(randomBytes(16));
+    const authUrl = new URL(meta.authorization_endpoint);
+    authUrl.searchParams.set("response_type", "code");
+    authUrl.searchParams.set("client_id", clientId);
+    authUrl.searchParams.set("redirect_uri", server.redirectUri);
+    authUrl.searchParams.set("scope", pickScope(meta));
+    authUrl.searchParams.set("state", state);
+    authUrl.searchParams.set("code_challenge", challenge);
+    authUrl.searchParams.set("code_challenge_method", "S256");
+    const pendingCode = server.waitForCode(state, opts.timeoutMs ?? 3e5);
+    pendingCode.catch(() => void 0);
+    opts.onUrl?.(authUrl.toString());
+    await opts.openBrowser(authUrl.toString());
+    const code = await pendingCode;
+    const token = await postToken(meta, {
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: server.redirectUri,
+      client_id: clientId,
+      code_verifier: verifier
     });
-    if (token.refreshToken) {
-      await revokeGrant(deps.fetch, {
-        clientId: registered.clientId,
-        refreshToken: token.refreshToken
-      });
-    }
-    if (!created.ok) return { ok: false, tier: "oauth", reason: created.reason };
-    const check = await validateResendKey(deps.fetch, created.token);
-    if (!check.ok) {
-      return { ok: false, tier: "oauth", reason: `Resend minted a key that it then rejected: ${check.reason}` };
-    }
-    return {
-      ok: true,
-      tier: "oauth",
-      credentials: {
-        apiKey: created.token,
-        tier: "oauth",
-        keyId: created.id,
-        domain: domainId ? opts.domain : void 0
-      }
-    };
+    await writeCredentials(store(meta, token, clientId));
+    return { ok: true, message: "Signed in.", scope: token.scope };
   } finally {
     server.close();
   }
 }
-
-// src/cli/lib/dash.ts
-var DASH_DOMAINS = [
-  "fleet",
-  "subscribers",
-  "usage",
-  "packages",
-  "billing",
-  "wallet",
-  "greenzone",
-  "storefront"
-];
-function isDashDomain(value) {
-  return DASH_DOMAINS.includes(value);
+function pickScope(meta) {
+  const supported = meta.scopes_supported ?? [];
+  if (!supported.length) return DEFAULT_SCOPE;
+  return DEFAULT_SCOPE.split(" ").filter((s) => supported.includes(s)).join(" ") || supported[0];
 }
-var DASH_TOOL = {
-  fleet: "fleet_health_app",
-  subscribers: "list_subscribers",
-  usage: "subscriber_usage",
-  packages: "list_package_templates",
-  billing: "billing_events",
-  wallet: "wallet_balance",
-  greenzone: "greenzone_whitelist_list",
-  storefront: ""
-};
-function screenFromStructured(structured) {
-  const rec = structured;
-  const screen = rec?.screen;
-  if (screen && typeof screen === "object" && Array.isArray(screen.sections) && screen.title) {
-    return screen;
+async function getAccessToken() {
+  const creds = await readCredentials();
+  if (!creds) return null;
+  if (!isExpired(creds)) return creds.accessToken;
+  if (!creds.refreshToken || !creds.clientId) return null;
+  try {
+    const meta = await discover();
+    const token = await postToken(meta, {
+      grant_type: "refresh_token",
+      refresh_token: creds.refreshToken,
+      client_id: creds.clientId
+    });
+    const next = store(meta, token, creds.clientId);
+    if (!next.refreshToken) next.refreshToken = creds.refreshToken;
+    await writeCredentials(next);
+    return next.accessToken;
+  } catch {
+    return null;
   }
-  return void 0;
 }
-var num = (value, fallback = 0) => {
-  const n = Number(value);
-  return Number.isFinite(n) ? n : fallback;
-};
-var str = (value, fallback = "") => value === void 0 || value === null ? fallback : String(value);
-function rows(payload, keys) {
-  if (Array.isArray(payload)) return payload;
-  const rec = payload ?? {};
-  for (const key of keys) {
-    const candidate = rec[key];
-    if (Array.isArray(candidate)) return candidate;
-  }
-  return [];
+async function logout() {
+  await clearCredentials();
 }
-function buildDashScreen(domain, payload) {
-  switch (domain) {
-    case "fleet": {
-      const accounts = rows(payload, ["accounts", "account"]);
-      return fleetScreen({
-        active: num(payload?.active),
-        suspended: num(payload?.suspended),
-        inventory: num(payload?.inventory),
-        other: num(payload?.other),
-        accounts: accounts.map((a) => ({
-          name: str(a.name ?? a.accountId, "?"),
-          balance: num(a.balance),
-          active: num(a.active),
-          suspended: num(a.suspended),
-          inventory: num(a.inventory),
-          other: num(a.other),
-          packageOnly: Boolean(a.packageOnly)
-        }))
-      });
-    }
-    case "subscribers":
-      return subscribersScreen(
-        rows(payload, ["subscribers", "subscriber", "data"]).map((s) => ({
-          iccid: str(s.iccid ?? s.ICCID, "?"),
-          msisdn: s.msisdn ? str(s.msisdn) : void 0,
-          status: str(s.status ?? s.statusStr, "unknown"),
-          account: s.accountName ? str(s.accountName) : void 0,
-          dataUsedBytes: s.dataUsed === void 0 ? void 0 : num(s.dataUsed)
-        }))
-      );
-    case "usage":
-      return usageScreen({
-        subject: str(payload?.subject, "Subscriber"),
-        timeline: rows(payload, ["timeline", "days", "usage"]).map((p4) => ({
-          date: str(p4.date ?? p4.day, "?"),
-          bytes: num(p4.bytes ?? p4.dataUsed)
-        })),
-        countries: rows(payload, ["countries"]).map((c) => ({
-          country: str(c.country ?? c.countryName, "?"),
-          bytes: num(c.bytes ?? c.dataUsed)
-        }))
-      });
-    case "packages":
-      return packagesScreen(
-        rows(payload, ["template", "templates", "data"]).map((t) => ({
-          name: str(t.prepaidpackagetemplatename ?? t.name, "?"),
-          id: str(t.prepaidpackagetemplateid ?? t.id, "?"),
-          dataLimitBytes: t.databyte === void 0 ? void 0 : num(t.databyte),
-          validityDays: t.perioddays === void 0 ? void 0 : num(t.perioddays),
-          price: t.cost === void 0 ? void 0 : num(t.cost),
-          recurring: Boolean(t.recurring)
-        }))
-      );
-    case "billing":
-      return billingScreen({
-        balance: payload?.balance === void 0 ? void 0 : num(payload.balance),
-        currency: str(payload?.currency, ""),
-        events: rows(payload, ["events", "data"]).map((e) => ({
-          date: str(e.date ?? e.timestamp, "?"),
-          description: str(e.description ?? e.type, "\u2014"),
-          amount: num(e.amount)
-        }))
-      });
-    case "wallet": {
-      const p4 = payload ?? {};
-      const eur = (value) => value === void 0 || value === null ? void 0 : num(value) / 100;
-      return walletScreen({
-        balance: eur(p4.balance_eur_cents ?? p4.balance) ?? 0,
-        currency: str(p4.currency, "\u20AC"),
-        autoTopupEnabled: Boolean(p4.autoTopupEnabled ?? p4.auto_topup_enabled),
-        threshold: eur(p4.auto_topup_threshold_cents ?? p4.threshold),
-        credits: p4.credits === void 0 || p4.credits === null ? void 0 : num(p4.credits)
-      });
-    }
-    case "greenzone":
-      return greenzoneScreen(
-        rows(payload, ["entries", "whitelist", "data"]).map((e) => ({
-          value: str(e.value ?? e.prefix ?? e.destination, "?"),
-          note: e.note ? str(e.note) : void 0
-        }))
-      );
-    case "storefront": {
-      const p4 = payload ?? {};
-      return storefrontScreen({
-        brand: str(p4.brand ?? p4.project, "storefront"),
-        url: p4.url ? str(p4.url) : void 0,
-        target: p4.target ? str(p4.target) : void 0,
-        verified: p4.verified === void 0 ? null : Boolean(p4.verified),
-        diagnosis: p4.diagnosis ? str(p4.diagnosis) : void 0,
-        secretsStaged: Array.isArray(p4.secrets_staged) ? p4.secrets_staged : void 0,
-        plans: p4.plans === void 0 ? void 0 : num(p4.plans)
-      });
-    }
-  }
+
+// src/cli/lib/guidance.ts
+import pc from "picocolors";
+var FLEET_NL_EXAMPLES = [
+  { label: "Fleet health", prompt: "Show my fleet health \u2014 accounts, eSIMs, low-balance alerts" },
+  { label: "Subscriber lookup", prompt: "Look up subscriber ICCID 8944\u2026 and diagnose connectivity" },
+  { label: "Usage anomalies", prompt: "Detect usage anomalies and burn-rate risks this week" },
+  { label: "Issue from inventory", prompt: "Issue 3 free eSIMs from inventory on my account and assign the starter package" },
+  { label: "Billing check", prompt: "What's my platform credit balance and Stripe Connect payout status?" },
+  { label: "Wallet balance", prompt: "What's my managed prepaid wallet balance and auto-top-up status?" },
+  { label: "Churn risk", prompt: "List high churn-risk subscribers with retention ideas" }
+];
+function oauthFirstUseNote() {
+  return [
+    "Entry A \u2014 zero credentials up front",
+    `  MCP URL:  ${MCP_URL}`,
+    "  Auth:     OAuth on first use (Clerk \u2014 Google, GitHub, or email)",
+    "  Token:    none required in Claude / Cursor / Windsurf",
+    "",
+    "When you first talk to Carrier in your MCP client, the browser opens",
+    "sign-in/sign-up. After authorize, tools work. Headless? Use an org API key",
+    `(ak_\u2026) from ${CONSOLE_URL} \u2192 Settings \u2192 API Keys.`
+  ].join("\n");
+}
+function formatStatusBlock(st) {
+  const yn = (ok2, yes = "yes", no = "no") => ok2 ? pc.green(yes) : pc.yellow(no);
+  const authLabel = st.authMode === "oauth-first-use" ? pc.cyan("OAuth on first use (no token needed)") : st.authMode === "api-key" ? pc.green("org API key in env (CARRIER_API_KEY)") : st.authMode === "ocs-token" ? pc.green("OCS token in env") : pc.yellow("not ready \u2014 install MCP or open sign-up");
+  return [
+    `Claude Code:   ${yn(st.claudeFound, "found", "not on PATH")}`,
+    `Plugin:        ${st.pluginInstalled ? pc.green(`installed v${st.pluginVersion ?? "?"}`) : pc.yellow("not installed")}`,
+    `MCP registered:${st.mcpRegistered ? pc.green(" yes") : pc.yellow(" no")}${st.mcpDetail ? pc.dim(`  (${st.mcpDetail})`) : ""}`,
+    `MCP URL:       ${st.mcpUrlMatches ? pc.green(MCP_URL) : pc.yellow("not production / missing")}`,
+    `Auth path:     ${authLabel}`,
+    `Headless token:${st.tokenPresent ? pc.green(` ${st.tokenKind}`) : pc.dim(" none (optional)")}`
+  ].join("\n");
+}
+function formatNextSteps(st) {
+  return st.nextSteps.map((s, i) => `  ${i + 1}. ${s}`).join("\n");
+}
+function formatNlExamples() {
+  return FLEET_NL_EXAMPLES.map((e) => `  \u2022 ${pc.bold(e.label)}: "${e.prompt}"`).join("\n");
+}
+function accountLinksNote() {
+  return [
+    `Sign up:     ${SIGN_UP_URL}`,
+    `Sign in:     ${SIGN_IN_URL}`,
+    `Console:     ${CONSOLE_URL}`,
+    `Onboarding:  ${ONBOARDING_URL}`,
+    `MCP home:    https://mcp.carrier.llc`
+  ].join("\n");
+}
+function withNextStep(errorMsg, next) {
+  return [errorMsg, "", "What to do next:", ...next.map((s) => `  \u2192 ${s}`)].join("\n");
 }
 
 // src/cli/lib/status.ts
-import { homedir as homedir2 } from "os";
-import { join as join5 } from "path";
+import { homedir as homedir3 } from "os";
+import { join as join6 } from "path";
 
 // src/cli/lib/mcp-url.ts
 var PRODUCTION_MCP_URL = "https://mcp.carrier.llc/mcp";
@@ -823,10 +973,10 @@ function scanMcpServers(servers) {
 }
 async function probeMcpFromConfig() {
   const candidates = [
-    join5(homedir2(), ".claude.json"),
-    join5(claudeHome(), "settings.json"),
-    join5(claudeHome(), ".mcp.json"),
-    join5(process.cwd(), ".mcp.json")
+    join6(homedir3(), ".claude.json"),
+    join6(claudeHome(), "settings.json"),
+    join6(claudeHome(), ".mcp.json"),
+    join6(process.cwd(), ".mcp.json")
   ];
   let best = null;
   let configSeen = false;
@@ -952,569 +1102,1038 @@ function resolveCliToken() {
   return ocs || null;
 }
 
-// src/cli/lib/guidance.ts
-import pc from "picocolors";
-var FLEET_NL_EXAMPLES = [
-  { label: "Fleet health", prompt: "Show my fleet health \u2014 accounts, eSIMs, low-balance alerts" },
-  { label: "Subscriber lookup", prompt: "Look up subscriber ICCID 8944\u2026 and diagnose connectivity" },
-  { label: "Usage anomalies", prompt: "Detect usage anomalies and burn-rate risks this week" },
-  { label: "Issue from inventory", prompt: "Issue 3 free eSIMs from inventory on my account and assign the starter package" },
-  { label: "Billing check", prompt: "What's my platform credit balance and Stripe Connect payout status?" },
-  { label: "Wallet balance", prompt: "What's my managed prepaid wallet balance and auto-top-up status?" },
-  { label: "Churn risk", prompt: "List high churn-risk subscribers with retention ideas" }
+// src/cli/lib/ask.ts
+var DEFAULT_ERROR_HINTS = [
+  "Re-check the arguments: carrier <domain> <command> --help",
+  "Or open Claude and ask there with full tool routing"
 ];
-function oauthFirstUseNote() {
-  return [
-    "Entry A \u2014 zero credentials up front",
-    `  MCP URL:  ${MCP_URL}`,
-    "  Auth:     OAuth on first use (Clerk \u2014 Google, GitHub, or email)",
-    "  Token:    none required in Claude / Cursor / Windsurf",
-    "",
-    "When you first talk to Carrier in your MCP client, the browser opens",
-    "sign-in/sign-up. After authorize, tools work. Headless? Use an org API key",
-    `(ak_\u2026) from ${CONSOLE_URL} \u2192 Settings \u2192 API Keys.`
-  ].join("\n");
-}
-function formatStatusBlock(st) {
-  const yn = (ok2, yes = "yes", no = "no") => ok2 ? pc.green(yes) : pc.yellow(no);
-  const authLabel = st.authMode === "oauth-first-use" ? pc.cyan("OAuth on first use (no token needed)") : st.authMode === "api-key" ? pc.green("org API key in env (CARRIER_API_KEY)") : st.authMode === "ocs-token" ? pc.green("OCS token in env") : pc.yellow("not ready \u2014 install MCP or open sign-up");
-  return [
-    `Claude Code:   ${yn(st.claudeFound, "found", "not on PATH")}`,
-    `Plugin:        ${st.pluginInstalled ? pc.green(`installed v${st.pluginVersion ?? "?"}`) : pc.yellow("not installed")}`,
-    `MCP registered:${st.mcpRegistered ? pc.green(" yes") : pc.yellow(" no")}${st.mcpDetail ? pc.dim(`  (${st.mcpDetail})`) : ""}`,
-    `MCP URL:       ${st.mcpUrlMatches ? pc.green(MCP_URL) : pc.yellow("not production / missing")}`,
-    `Auth path:     ${authLabel}`,
-    `Headless token:${st.tokenPresent ? pc.green(` ${st.tokenKind}`) : pc.dim(" none (optional)")}`
-  ].join("\n");
+var DEFAULT_MCP_TIMEOUT_MS = 45e3;
+function mcpTimeoutMs() {
+  const parsed = Number(process.env.CARRIER_MCP_TIMEOUT_MS);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_MCP_TIMEOUT_MS;
 }
-function formatNextSteps(st) {
-  return st.nextSteps.map((s, i) => `  ${i + 1}. ${s}`).join("\n");
+var McpTimeoutError = class extends Error {
+  constructor(timeoutMs) {
+    super(`timed out after ${Math.round(timeoutMs / 1e3)}s`);
+    this.timeoutMs = timeoutMs;
+    this.name = "McpTimeoutError";
+  }
+  timeoutMs;
+};
+function isTimeoutish(err) {
+  return err instanceof McpTimeoutError || err instanceof Error && (err.name === "AbortError" || err.name === "TimeoutError");
 }
-function formatNlExamples() {
-  return FLEET_NL_EXAMPLES.map((e) => `  \u2022 ${pc.bold(e.label)}: "${e.prompt}"`).join("\n");
+function parseRpcBody(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) return {};
+  if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+    return JSON.parse(trimmed);
+  }
+  const dataLine = trimmed.split("\n").map((l) => l.trim()).find((l) => l.startsWith("data:"));
+  if (!dataLine) return {};
+  return JSON.parse(dataLine.slice(5).trim());
 }
-function accountLinksNote() {
-  return [
-    `Sign up:     ${SIGN_UP_URL}`,
-    `Sign in:     ${SIGN_IN_URL}`,
-    `Console:     ${CONSOLE_URL}`,
-    `Onboarding:  ${ONBOARDING_URL}`,
-    `MCP home:    https://mcp.carrier.llc`
-  ].join("\n");
+async function callMcpTool(tool, args, opts = {}) {
+  const token = resolveCliToken() ?? await getAccessToken();
+  if (!token) {
+    return {
+      ok: false,
+      text: withNextStep("Not signed in.", [
+        "Sign in from this terminal: carrier login",
+        "No account yet? carrier open signup",
+        "Headless/CI instead: export CARRIER_API_KEY=ak_\u2026 from Console \u2192 Settings \u2192 API Keys"
+      ])
+    };
+  }
+  const headers = {
+    Authorization: `Bearer ${token}`,
+    "Content-Type": "application/json",
+    Accept: "application/json, text/event-stream"
+  };
+  const timeoutMs = mcpTimeoutMs();
+  const controller = new AbortController();
+  let deadlineTimer;
+  const deadline = new Promise((_resolve, reject) => {
+    deadlineTimer = setTimeout(() => {
+      controller.abort();
+      reject(new McpTimeoutError(timeoutMs));
+    }, timeoutMs);
+  });
+  const signal = controller.signal;
+  try {
+    return await Promise.race([
+      (async () => {
+        const initRes = await fetch(MCP_URL, {
+          method: "POST",
+          headers,
+          signal,
+          body: JSON.stringify({
+            jsonrpc: "2.0",
+            id: 1,
+            method: "initialize",
+            params: {
+              protocolVersion: "2024-11-05",
+              capabilities: {},
+              clientInfo: { name: "carrier-cli", version: CARRIER_VERSION }
+            }
+          })
+        });
+        if (initRes.status === 401 || initRes.status === 403) {
+          return {
+            ok: false,
+            text: withNextStep(`MCP returned ${initRes.status} (auth rejected).`, [
+              "Confirm CARRIER_API_KEY is a valid org key (ak_\u2026) from app.carrier.llc",
+              "Or complete OCS onboarding: https://app.carrier.llc/onboarding",
+              "Interactive: use Claude + OAuth instead of a headless key"
+            ])
+          };
+        }
+        const sessionId = initRes.headers.get("mcp-session-id") ?? initRes.headers.get("Mcp-Session-Id");
+        await initRes.arrayBuffer().catch(() => void 0);
+        if (!sessionId) {
+          return {
+            ok: false,
+            text: withNextStep("MCP initialize did not return a session id.", [
+              "Check network access to https://mcp.carrier.llc/mcp",
+              "Retry later, or use Claude with the registered MCP (OAuth path)"
+            ])
+          };
+        }
+        const sessionHeaders = { ...headers, "Mcp-Session-Id": sessionId };
+        await fetch(MCP_URL, {
+          method: "POST",
+          headers: sessionHeaders,
+          signal,
+          body: JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" })
+        }).catch(() => void 0);
+        const res = await fetch(MCP_URL, {
+          method: "POST",
+          headers: sessionHeaders,
+          signal,
+          body: JSON.stringify({
+            jsonrpc: "2.0",
+            id: 2,
+            method: "tools/call",
+            params: { name: tool, arguments: args }
+          })
+        });
+        if (!res.ok) {
+          const snippet = (await res.text().catch(() => "")).slice(0, 240);
+          return {
+            ok: false,
+            text: withNextStep(`MCP call failed (${res.status}). ${snippet}`, [
+              "Check network access to https://mcp.carrier.llc/mcp",
+              "Retry later, or use Claude with the registered MCP (OAuth path)"
+            ])
+          };
+        }
+        const json = parseRpcBody(await res.text());
+        if (json.error?.message) {
+          return {
+            ok: false,
+            text: withNextStep(json.error.message, opts.errorHints ?? DEFAULT_ERROR_HINTS)
+          };
+        }
+        const parts = json.result?.content ?? [];
+        const text3 = parts.map((p4) => p4.text).filter(Boolean).join("\n").trim() || JSON.stringify(json.result ?? json, null, 2);
+        return {
+          ok: !json.result?.isError,
+          text: text3,
+          structured: json.result?.structuredContent
+        };
+      })(),
+      deadline
+    ]);
+  } catch (e) {
+    if (isTimeoutish(e)) {
+      const secs = Math.round(timeoutMs / 1e3);
+      return {
+        ok: false,
+        text: withNextStep(
+          `MCP call to ${tool} timed out after ${secs}s (no response).`,
+          [
+            "The tool is likely returning more data than the MCP transport can deliver \u2014 see issue #663",
+            "Narrow the request (a specific --account-id / --iccid returns far less than a whole-fleet call)",
+            `Raise the deadline for one slow call: CARRIER_MCP_TIMEOUT_MS=${timeoutMs * 2} carrier \u2026`,
+            "Confirm the service is up: check network access to https://mcp.carrier.llc/mcp",
+            "Or open Claude and ask there with full tool routing"
+          ]
+        )
+      };
+    }
+    const msg = e instanceof Error ? e.message : String(e);
+    return {
+      ok: false,
+      text: withNextStep(`Could not reach MCP: ${msg}`, [
+        "Verify outbound HTTPS to mcp.carrier.llc",
+        "Use the interactive Claude path while offline from this machine"
+      ])
+    };
+  } finally {
+    if (deadlineTimer !== void 0) clearTimeout(deadlineTimer);
+  }
 }
-function withNextStep(errorMsg, next) {
-  return [errorMsg, "", "What to do next:", ...next.map((s) => `  \u2192 ${s}`)].join("\n");
+var ASK_ERROR_HINTS = [
+  "Rephrase the intent more specifically (include ICCID / MSISDN if relevant)",
+  "Or use a discrete command: carrier --help lists every domain"
+];
+function parseRouting(text3) {
+  const trimmed = text3.trim();
+  if (!trimmed.startsWith("{")) return void 0;
+  try {
+    const parsed = JSON.parse(trimmed);
+    if (!parsed || typeof parsed !== "object") return void 0;
+    const routes = typeof parsed.resolved_tool === "string" && parsed.resolved_tool;
+    const asksBack = typeof parsed.clarifying_question === "string" || Array.isArray(parsed.candidates);
+    return routes || asksBack ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function carrierAsk(intent) {
+  const routed = await callMcpTool("carrier_ask", { intent }, { errorHints: ASK_ERROR_HINTS });
+  if (!routed.ok) return routed;
+  const routing = parseRouting(routed.text);
+  if (!routing) return routed;
+  if (!routing.resolved_tool) {
+    const candidates = (routing.candidates ?? []).map((c) => c.tool ? `Candidate: ${c.tool}${c.reason ? ` \u2014 ${c.reason}` : ""}` : void 0).filter((s) => Boolean(s));
+    return {
+      ok: false,
+      text: withNextStep(routing.clarifying_question?.trim() || "Carrier could not tell which tool you meant.", [
+        ...candidates,
+        ...ASK_ERROR_HINTS
+      ])
+    };
+  }
+  const tool = routing.resolved_tool;
+  const args = routing.resolved_params ?? {};
+  if (routing.match && routing.match !== "confirmed") {
+    return {
+      ok: false,
+      text: withNextStep(`Carrier could not confirm what you meant (match: ${routing.match}).`, [
+        `Closest tool: ${tool}`,
+        ...ASK_ERROR_HINTS
+      ])
+    };
+  }
+  if (routing.confirm_required) {
+    return {
+      ok: false,
+      text: withNextStep(`"${intent}" resolves to ${tool}, which changes live service or billing.`, [
+        `Params: ${JSON.stringify(args)}`,
+        "Run the matching discrete command so every flag is explicit and reviewable",
+        "carrier --help lists every domain"
+      ])
+    };
+  }
+  return callMcpTool(tool, args, { errorHints: ASK_ERROR_HINTS });
 }
 
-// src/cli/lib/home.ts
-import * as p from "@clack/prompts";
-import pc2 from "picocolors";
-
-// src/cli/lib/auth.ts
-import { createHash as createHash2, randomBytes as randomBytes2, timingSafeEqual } from "crypto";
-import { createServer as createServer2 } from "http";
+// src/cli/lib/rest.ts
+var DEFAULT_ERROR_HINTS2 = [
+  "Re-check the arguments: carrier <domain> <command> --help",
+  "Or open Claude and ask there with full tool routing"
+];
+function resolveApiKey() {
+  return process.env.CARRIER_API_KEY?.trim() || process.env.CARRIER_ORG_API_KEY?.trim() || null;
+}
+function ocsTokenOnly() {
+  return Boolean(
+    process.env.ESIMVAULT_API_TOKEN?.trim() || process.env.CARRIER_OCS_API_TOKEN?.trim()
+  );
+}
+function applyPath(path, args) {
+  const rest = { ...args };
+  const missing = [];
+  const filled = path.replace(/\{(\w+)\}/g, (_match, name) => {
+    const value = rest[name];
+    if (value === void 0 || value === null || value === "") {
+      missing.push(name);
+      return `{${name}}`;
+    }
+    delete rest[name];
+    return encodeURIComponent(String(value));
+  });
+  return { path: filled, rest, missing };
+}
+function queryString(args) {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(args)) {
+    if (value === void 0 || value === null) continue;
+    params.set(key, String(value));
+  }
+  const qs = params.toString();
+  return qs ? `?${qs}` : "";
+}
+function bodyText(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) return "";
+  try {
+    const parsed = JSON.parse(trimmed);
+    if (typeof parsed.error === "string") return parsed.error;
+    if (typeof parsed.message === "string") return parsed.message;
+    return trimmed;
+  } catch {
+    return trimmed;
+  }
+}
+async function callRestEndpoint(method, path, args, opts = {}) {
+  const token = resolveApiKey() ?? await getAccessToken();
+  if (!token) {
+    return {
+      ok: false,
+      text: withNextStep(
+        ocsTokenOnly() ? "Not signed in. An eSIMVault/OCS token is set, but the Carrier API only accepts Carrier credentials." : "Not signed in.",
+        [
+          "Sign in from this terminal: carrier login",
+          "No account yet? carrier open signup",
+          "Headless/CI instead: export CARRIER_API_KEY=ak_\u2026 from Console \u2192 Settings \u2192 API Keys"
+        ]
+      )
+    };
+  }
+  const { path: resolvedPath, rest, missing } = applyPath(path, args);
+  if (missing.length) {
+    return {
+      ok: false,
+      text: withNextStep(`Cannot build ${method} ${path}.`, [
+        `Missing path value(s): ${missing.join(", ")}`,
+        "See every flag: carrier <domain> <command> --help"
+      ])
+    };
+  }
+  const sendsBody = method === "POST" || method === "PUT" || method === "PATCH";
+  const url = `${API_URL}${resolvedPath}${sendsBody ? "" : queryString(rest)}`;
+  const headers = {
+    Authorization: `Bearer ${token}`,
+    Accept: "application/json",
+    "User-Agent": `carrier-cli/${CARRIER_VERSION}`
+  };
+  if (sendsBody) headers["Content-Type"] = "application/json";
+  if (opts.confirmToken) headers["X-Confirm-Token"] = opts.confirmToken;
+  if (opts.idempotencyKey) headers["Idempotency-Key"] = opts.idempotencyKey;
+  const timeoutMs = mcpTimeoutMs();
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const res = await fetch(url, {
+      method,
+      headers,
+      signal: controller.signal,
+      body: sendsBody ? JSON.stringify(rest) : void 0
+    });
+    const raw = await res.text();
+    if (res.status === 202) {
+      let confirmToken;
+      let expires;
+      let message = "";
+      try {
+        const parsed = JSON.parse(raw);
+        confirmToken = parsed.confirm_token;
+        expires = parsed.expires_in_seconds;
+        message = parsed.message ?? "";
+      } catch {
+      }
+      return {
+        ok: false,
+        text: withNextStep(
+          message || `${method} ${path} needs an explicit confirmation.`,
+          confirmToken ? [
+            `Re-run the same command with: --confirm-token ${confirmToken}`,
+            `The token is single-use and expires in ${expires ?? 120}s.`
+          ] : ["The server asked for confirmation but returned no token \u2014 retry the command."]
+        )
+      };
+    }
+    if (res.status === 401 || res.status === 403) {
+      return {
+        ok: false,
+        text: withNextStep(
+          `Carrier API returned ${res.status} (auth rejected).`,
+          [
+            "Confirm CARRIER_API_KEY is a valid org key (ak_\u2026) from app.carrier.llc",
+            "Or sign in from this terminal: carrier login",
+            ...res.status === 403 ? ["A 403 here usually means the key lacks write scope."] : []
+          ]
+        )
+      };
+    }
+    if (!res.ok) {
+      return {
+        ok: false,
+        text: withNextStep(
+          redact(`${method} ${path} failed (${res.status}). ${bodyText(raw).slice(0, 500)}`),
+          opts.errorHints ?? DEFAULT_ERROR_HINTS2
+        )
+      };
+    }
+    return { ok: true, text: raw.trim() || JSON.stringify({ status: res.status }) };
+  } catch (e) {
+    const aborted = e instanceof Error && (e.name === "AbortError" || e.name === "TimeoutError");
+    if (aborted) {
+      const secs = Math.round(timeoutMs / 1e3);
+      return {
+        ok: false,
+        text: withNextStep(`${method} ${path} timed out after ${secs}s (no response).`, [
+          `Raise the deadline for one slow call: CARRIER_MCP_TIMEOUT_MS=${timeoutMs * 2} carrier \u2026`,
+          "Confirm the service is up: check network access to https://api.carrier.llc"
+        ])
+      };
+    }
+    const msg = e instanceof Error ? e.message : String(e);
+    return {
+      ok: false,
+      text: withNextStep(redact(`Could not reach the Carrier API: ${msg}`), [
+        "Verify outbound HTTPS to api.carrier.llc",
+        "Use the interactive Claude path while offline from this machine"
+      ])
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
 
-// src/cli/lib/credentials.ts
-import { homedir as homedir3 } from "os";
-import { join as join6 } from "path";
-import { chmod, mkdir as mkdir2, readFile as readFile2, rm, writeFile as writeFile3 } from "fs/promises";
-function carrierHome() {
-  return process.env.CARRIER_HOME?.trim() || join6(homedir3(), ".carrier");
+// src/cli/lib/hosted-publish.ts
+async function publishHostedStorefront(input) {
+  const slug2 = storefrontSlugFrom(input.slug);
+  if (slug2 === "") return { ok: false, text: "Use a short name, such as acme." };
+  input = { ...input, slug: slug2 };
+  const listed = await callRestEndpoint("GET", "/v1/storefronts", {});
+  if (!listed.ok) return listed;
+  const existing = findStore(listed.text, input.slug);
+  if (!existing && input.status !== "draft") {
+    const missing = firstPublishCopy(input);
+    if (missing) return { ok: false, text: missing };
+  }
+  const filled = completePlanInput(planInput(input), existing?.plans ?? []);
+  const plan = storefrontPlanBody(filled);
+  if (isStorefrontPlanError(plan)) return { ok: false, text: plan.error };
+  const brand = storefrontBrandPatch(input, existing ?? void 0);
+  const record2 = { slug: input.slug, name: input.name, status: input.status, ...brand };
+  const saved = existing ? await callRestEndpoint("PATCH", "/v1/storefronts/{id}", { id: existing.id, ...record2 }) : await callRestEndpoint("POST", "/v1/storefronts", record2, { idempotencyKey: `site-publish:${input.slug}` });
+  if (!saved.ok) return saved;
+  if (!plan) return withShopAddress(saved, input.slug);
+  const id = existing?.id ?? readId(saved.text);
+  if (!id) return { ok: false, text: "The store was saved but its id was missing, so the plan was not written." };
+  const planned = await callRestEndpoint("POST", "/v1/storefronts/{id}/plans", { id, ...plan });
+  return planned.ok ? withShopAddress(planned, input.slug) : planned;
 }
-function credentialsPath() {
-  return join6(carrierHome(), "credentials.json");
+function firstPublishCopy(input) {
+  const hero = input.hero?.trim() ?? "";
+  const tagline = input.tagline?.trim() ?? "";
+  const email = input.supportEmail?.trim() ?? "";
+  const legalName = input.legalName?.trim() ?? "";
+  if (hero === "" || hero === "Data that works the day you land.") return "Enter a hero.";
+  if (tagline === "" || tagline === "Programmable connectivity, on demand.") return "Enter a tagline.";
+  if (email === "" || email === "support@carrier.llc") return "Enter a support email.";
+  if (!/^[^\s@]+@[^\s@]+$/.test(email)) return "Support email must be an email address.";
+  if (legalName === "" || legalName === "Lifecycle Innovations Limited") return "Enter a legal name.";
+  return null;
 }
-async function readCredentials() {
+function withShopAddress(result, slug2) {
+  const address = hostedStorefrontUrl(slug2);
+  if (result.text.includes(address)) return result;
+  return { ...result, text: `${result.text}
+${address}` };
+}
+function hostedPublishInputFromFlags(flags) {
+  const status = flags.status === "draft" || flags.status === "published" ? flags.status : null;
+  if (!status) return { ok: false, text: "Status must be draft or published." };
+  const price = readPrice(flags);
+  if (!price.ok) return { ok: false, text: price.text };
+  const template = parseWholeNumber(flags.templateId, "Template id");
+  if (!template.ok) return { ok: false, text: template.message };
+  const data = readLabel(flags.dataGb, parseDataGb);
+  if (!data.ok) return { ok: false, text: data.text };
+  const validity = readLabel(flags.validityDays, parseValidityDays);
+  if (!validity.ok) return { ok: false, text: validity.text };
+  const countries = readCountries(flags.countries);
+  if (!countries.ok) return { ok: false, text: countries.text };
+  const logo = readLogo(flags.logo);
+  if (!logo.ok) return { ok: false, text: logo.text };
+  return {
+    ok: true,
+    input: {
+      slug: flags.slug,
+      name: flags.name,
+      status,
+      accent: flags.accent,
+      accentDark: flags.accentDark,
+      bg: flags.bg,
+      text: flags.text,
+      logoUrl: logo.value,
+      hero: flags.hero,
+      tagline: flags.tagline,
+      supportEmail: flags.supportEmail,
+      legalName: flags.legalName,
+      productId: flags.product,
+      planSlug: flags.plan,
+      planName: flags.planName,
+      priceCents: price.value,
+      currency: flags.currency,
+      templateId: template.value,
+      dataGb: data.value,
+      validityDays: validity.value,
+      regions: countries.value,
+      description: flags.planText,
+      planActive: flags.inactive ? false : void 0
+    }
+  };
+}
+function readLogo(value) {
+  if (value === void 0 || value.trim() === "") return { ok: true, value: void 0 };
+  const trimmed = value.trim();
+  if (trimmed.startsWith("https://") || trimmed.startsWith("data:")) {
+    const parsed = logoReference(trimmed);
+    return parsed.ok ? { ok: true, value: parsed.url } : { ok: false, text: parsed.message };
+  }
   try {
-    const raw = await readFile2(credentialsPath(), "utf8");
-    const parsed = JSON.parse(raw);
-    if (!parsed?.accessToken || typeof parsed.accessToken !== "string") return null;
-    return parsed;
+    const bytes = readFileSync(trimmed);
+    const parsed = logoFileDataUrl(bytes);
+    return parsed.ok ? { ok: true, value: parsed.url } : { ok: false, text: parsed.message };
   } catch {
-    return null;
+    return { ok: false, text: "Use a PNG, JPEG, WebP, or GIF under 70 KB, or an https address." };
   }
 }
-async function writeCredentials(creds) {
-  const dir = carrierHome();
-  await mkdir2(dir, { recursive: true, mode: 448 });
-  await chmod(dir, 448).catch(() => void 0);
-  const file = credentialsPath();
-  await writeFile3(file, `${JSON.stringify(creds, null, 2)}
-`, { mode: 384 });
-  await chmod(file, 384).catch(() => void 0);
+function readPrice(flags) {
+  if (flags.price !== void 0 && flags.priceCents !== void 0) {
+    return { ok: false, text: "Use either --price 9.00 or --price-cents 900." };
+  }
+  if (flags.price !== void 0) {
+    const parsed2 = majorToCents(flags.price, flags.currency);
+    return parsed2.ok ? { ok: true, value: parsed2.cents } : { ok: false, text: parsed2.message };
+  }
+  const parsed = parseWholeNumber(flags.priceCents, "Price");
+  return parsed.ok ? { ok: true, value: parsed.value } : { ok: false, text: parsed.message };
 }
-async function clearCredentials() {
-  await rm(credentialsPath(), { force: true });
+function readLabel(value, parse) {
+  if (value === void 0) return { ok: true, value: void 0 };
+  const parsed = parse(value);
+  return parsed.ok ? { ok: true, value: parsed.value } : { ok: false, text: parsed.message };
 }
-function isExpired(creds, skewMs = 6e4) {
-  if (!creds.expiresAt) return false;
-  return Date.now() >= creds.expiresAt - skewMs;
+function readCountries(value) {
+  if (value === void 0) return { ok: true, value: void 0 };
+  const parsed = parseCountryInput(value);
+  return parsed.ok ? { ok: true, value: parsed.regions } : { ok: false, text: parsed.message };
 }
-function redact(text3) {
-  return text3.replace(/\b(ak_|sk_|rt_)[A-Za-z0-9._-]{6,}/g, "$1***").replace(/\bBearer\s+[A-Za-z0-9._-]{8,}/gi, "Bearer ***");
+function planInput(input) {
+  return {
+    productId: input.productId,
+    slug: input.planSlug,
+    name: input.planName,
+    priceCents: input.priceCents,
+    currency: input.currency,
+    templateId: input.templateId,
+    dataGb: input.dataGb,
+    validityDays: input.validityDays,
+    regions: input.regions,
+    description: input.description,
+    active: input.planActive
+  };
 }
-
-// src/cli/lib/auth.ts
-var DISCOVERY_PATH = "/.well-known/oauth-authorization-server";
-var CLIENT_NAME2 = "Carrier CLI";
-var DEFAULT_SCOPE = "read write";
-var CALLBACK_PORTS = [3118, 3119, 8976, 8977, 0];
-async function discover(base = MCP_HOME) {
-  const res = await fetch(`${base}${DISCOVERY_PATH}`, {
-    headers: { Accept: "application/json" }
-  });
-  if (!res.ok) throw new Error(`OAuth discovery failed (${res.status}) at ${base}${DISCOVERY_PATH}`);
-  const meta = await res.json();
-  if (!meta.authorization_endpoint || !meta.token_endpoint) {
-    throw new Error("OAuth discovery returned no authorization or token endpoint");
+function findStore(body, slug2) {
+  try {
+    const parsed = JSON.parse(body);
+    const match = parsed.data?.find((row) => row["slug"] === slug2);
+    if (!match || typeof match["id"] !== "string") return null;
+    return {
+      id: match["id"],
+      theme: record(match["theme"]),
+      copy: record(match["copy"]),
+      plans: storedPlans(match["plans"])
+    };
+  } catch {
+    return null;
+  }
+}
+function storedPlans(value) {
+  if (!Array.isArray(value)) return [];
+  const plans = [];
+  for (const item of value) {
+    const row = record(item);
+    if (!row) continue;
+    if (typeof row["slug"] !== "string" || typeof row["name"] !== "string" || typeof row["currency"] !== "string") continue;
+    if (typeof row["ocs_package_template_id"] !== "number") continue;
+    plans.push({
+      slug: row["slug"],
+      name: row["name"],
+      currency: row["currency"],
+      ocs_package_template_id: row["ocs_package_template_id"]
+    });
+  }
+  return plans;
+}
+function readId(body) {
+  try {
+    const parsed = JSON.parse(body);
+    return typeof parsed.id === "string" ? parsed.id : null;
+  } catch {
+    return null;
   }
-  return meta;
 }
-function base64url2(buf) {
-  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+function record(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+
+// src/cli/lib/resend.ts
+import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
+import { createServer as createServer2 } from "http";
+var RESEND_API = "https://api.resend.com";
+var RESEND_API_KEYS_URL = "https://resend.com/api-keys";
+var RESEND_DOMAINS_URL = "https://resend.com/domains";
+var USER_AGENT = "carrier-cli";
+var CLIENT_NAME2 = "Carrier storefront setup";
+var OAUTH_SCOPE = "full_access";
+var REDIRECT_PATH = "/oauth/callback";
+var REDIRECT_HOST = "127.0.0.1";
+function looksResendKey(key) {
+  return /^re_[A-Za-z0-9_-]{8,}$/.test(key.trim());
+}
+function base64url2(input) {
+  return input.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 function pkcePair2() {
-  const verifier = base64url2(randomBytes2(32));
-  const challenge = base64url2(createHash2("sha256").update(verifier).digest());
-  return { verifier, challenge };
+  const verifier = base64url2(randomBytes2(64));
+  return { verifier, challenge: base64url2(createHash2("sha256").update(verifier).digest()) };
 }
-function sameState(a, b) {
-  const left = Buffer.from(a);
-  const right = Buffer.from(b);
-  if (left.length !== right.length) return false;
-  return timingSafeEqual(left, right);
+function buildAuthorizeUrl(opts) {
+  const url = new URL(`${RESEND_API}/oauth/authorize`);
+  url.searchParams.set("client_id", opts.clientId);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("redirect_uri", opts.redirectUri);
+  url.searchParams.set("scope", opts.scope ?? OAUTH_SCOPE);
+  url.searchParams.set("state", opts.state);
+  url.searchParams.set("code_challenge", opts.challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  return url.toString();
 }
-async function registerClient(meta, redirectUri) {
-  if (!meta.registration_endpoint) {
-    throw new Error("This server does not support dynamic client registration");
+async function resendFetch(fetchImpl, path, init = {}) {
+  const headers = { "User-Agent": USER_AGENT, Accept: "application/json" };
+  if (init.token) headers.Authorization = `Bearer ${init.token}`;
+  let body;
+  if (init.form) {
+    headers["Content-Type"] = "application/x-www-form-urlencoded";
+    body = new URLSearchParams(init.form).toString();
+  } else if (init.json !== void 0) {
+    headers["Content-Type"] = "application/json";
+    body = JSON.stringify(init.json);
   }
-  const res = await fetch(meta.registration_endpoint, {
+  try {
+    const res = await fetchImpl(`${RESEND_API}${path}`, {
+      method: init.method ?? "GET",
+      headers,
+      body
+    });
+    const text3 = await res.text();
+    let json;
+    try {
+      json = text3 ? JSON.parse(text3) : void 0;
+    } catch {
+      json = void 0;
+    }
+    if (!res.ok) {
+      return { ok: false, status: res.status, json, error: resendError(json) ?? text3.slice(0, 300) };
+    }
+    return { ok: true, status: res.status, json };
+  } catch (e) {
+    return { ok: false, status: 0, error: e instanceof Error ? e.message : String(e) };
+  }
+}
+function resendError(json) {
+  if (typeof json !== "object" || json === null) return void 0;
+  const body = json;
+  return body.message ?? body.error_description ?? body.error;
+}
+async function registerOauthClient(fetchImpl) {
+  const registeredRedirect = `http://${REDIRECT_HOST}${REDIRECT_PATH}`;
+  const res = await resendFetch(fetchImpl, "/oauth/register", {
     method: "POST",
-    headers: { "Content-Type": "application/json", Accept: "application/json" },
-    body: JSON.stringify({
+    json: {
       client_name: CLIENT_NAME2,
-      redirect_uris: [redirectUri],
+      redirect_uris: [registeredRedirect],
       grant_types: ["authorization_code", "refresh_token"],
       response_types: ["code"],
-      // Installed apps cannot keep a secret; register as a public client.
       token_endpoint_auth_method: "none",
-      application_type: "native"
-    })
+      scope: OAUTH_SCOPE
+    }
   });
   if (!res.ok) {
-    const body = (await res.text().catch(() => "")).slice(0, 200);
-    throw new Error(`Client registration failed (${res.status}). ${body}`);
+    return { ok: false, reason: `Resend rejected client registration: ${res.error ?? res.status}` };
   }
-  const json = await res.json();
-  if (!json.client_id) throw new Error("Client registration returned no client_id");
-  return json.client_id;
+  const clientId = res.json?.client_id;
+  if (!clientId) return { ok: false, reason: "Resend registered no client_id." };
+  return { ok: true, clientId };
 }
-function escapeHtml(text3) {
-  return text3.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+async function exchangeCode(fetchImpl, opts) {
+  const res = await resendFetch(fetchImpl, "/oauth/token", {
+    method: "POST",
+    form: {
+      grant_type: "authorization_code",
+      client_id: opts.clientId,
+      code: opts.code,
+      redirect_uri: opts.redirectUri,
+      code_verifier: opts.verifier
+    }
+  });
+  if (!res.ok) return { ok: false, reason: `Token exchange failed: ${res.error ?? res.status}` };
+  const body = res.json;
+  if (!body?.access_token) return { ok: false, reason: "Resend returned no access token." };
+  return { ok: true, accessToken: body.access_token, refreshToken: body.refresh_token };
 }
-function page(title, detail) {
-  const safeTitle = escapeHtml(title);
-  const safeDetail = escapeHtml(detail);
-  return `<!doctype html><meta charset="utf-8"><title>${safeTitle}</title>
-<body style="font-family:system-ui,sans-serif;max-width:32rem;margin:20vh auto;text-align:center">
-<h1 style="font-size:1.25rem">${safeTitle}</h1><p style="color:#555">${safeDetail}</p></body>`;
+async function revokeGrant(fetchImpl, opts) {
+  await resendFetch(fetchImpl, "/oauth/revoke", {
+    method: "POST",
+    form: {
+      client_id: opts.clientId,
+      token: opts.refreshToken,
+      token_type_hint: "refresh_token"
+    }
+  }).catch(() => void 0);
 }
-async function startCallbackServer() {
-  let resolveCode;
-  let rejectCode;
-  let expected = "";
+async function findVerifiedDomainId(fetchImpl, accessToken, domain) {
+  const wanted = domain.trim().replace(/^https?:\/\//, "").replace(/\/+$/, "").toLowerCase();
+  if (!wanted) return void 0;
+  const res = await resendFetch(fetchImpl, "/domains", { token: accessToken });
+  if (!res.ok) return void 0;
+  const list = res.json?.data;
+  const match = list?.find((d) => d.name?.toLowerCase() === wanted && d.status === "verified");
+  return match?.id;
+}
+async function createSendingKey(fetchImpl, accessToken, opts) {
+  const res = await resendFetch(fetchImpl, "/api-keys", {
+    method: "POST",
+    token: accessToken,
+    json: {
+      // Resend caps the name at 50 characters.
+      name: opts.name.slice(0, 50),
+      permission: "sending_access",
+      ...opts.domainId ? { domain_id: opts.domainId } : {}
+    }
+  });
+  if (!res.ok) return { ok: false, reason: `Could not create an API key: ${res.error ?? res.status}` };
+  const body = res.json;
+  if (!body?.token) return { ok: false, reason: "Resend created a key but returned no token." };
+  return { ok: true, token: body.token, id: body.id };
+}
+async function validateResendKey(fetchImpl, key) {
+  if (!looksResendKey(key)) return { ok: false, reason: "That does not look like a Resend key (re_\u2026)." };
+  const res = await resendFetch(fetchImpl, "/emails", { method: "POST", token: key, json: {} });
+  if (res.status === 401) return { ok: false, reason: "Resend says that key is missing or malformed." };
+  if (res.status === 403) return { ok: false, reason: "Resend rejected that key as invalid." };
+  if (res.status === 0) return { ok: false, reason: `Could not reach Resend: ${res.error ?? "network error"}` };
+  return { ok: true };
+}
+async function startLoopbackServer() {
+  let resolveCode = null;
   const server = createServer2((req, res) => {
-    const url = new URL(req.url ?? "/", "http://127.0.0.1");
-    if (url.pathname !== "/callback") {
+    const url = new URL(req.url ?? "/", `http://${REDIRECT_HOST}`);
+    if (url.pathname !== REDIRECT_PATH) {
       res.writeHead(404).end();
       return;
     }
-    const err = url.searchParams.get("error");
+    const error = url.searchParams.get("error");
     const code = url.searchParams.get("code");
-    const state = url.searchParams.get("state") ?? "";
-    if (err) {
-      res.writeHead(400, { "Content-Type": "text/html" });
-      res.end(page("Sign-in failed", err));
-      rejectCode?.(new Error(`Authorization server returned "${err}"`));
-      return;
-    }
-    if (!code || !expected || !sameState(state, expected)) {
-      res.writeHead(400, { "Content-Type": "text/html" });
-      res.end(page("Sign-in failed", "The redirect did not match this login attempt."));
-      rejectCode?.(new Error("State mismatch \u2014 ignoring the redirect"));
-      return;
-    }
-    res.writeHead(200, { "Content-Type": "text/html" });
-    res.end(page("You're signed in", "Close this tab and return to your terminal."));
-    resolveCode?.(code);
-  });
-  let bound = false;
-  let lastErr;
-  for (const port2 of CALLBACK_PORTS) {
-    try {
-      await new Promise((resolve3, reject) => {
-        server.once("error", reject);
-        server.listen(port2, "127.0.0.1", () => {
-          server.removeListener("error", reject);
-          resolve3();
-        });
-      });
-      bound = true;
-      break;
-    } catch (e) {
-      lastErr = e;
-    }
-  }
-  if (!bound) {
-    throw new Error(
-      `Could not bind a local callback port (tried ${CALLBACK_PORTS.filter(Boolean).join(", ")}): ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`
+    const state = url.searchParams.get("state");
+    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+    res.end(
+      `<!doctype html><meta charset="utf-8"><title>Carrier</title><body style="font-family:system-ui;padding:3rem;text-align:center"><p>${error ? "Authorization was refused." : "Connected. You can close this tab."}</p>`
     );
-  }
-  const { port } = server.address();
+    resolveCode?.(
+      error ? { ok: false, reason: `Resend returned "${error}".` } : code ? { ok: true, code, reason: state ?? void 0 } : { ok: false, reason: "Resend sent no authorization code." }
+    );
+  });
+  await new Promise((resolve3, reject) => {
+    server.once("error", reject);
+    server.listen(0, REDIRECT_HOST, resolve3);
+  });
+  const port = server.address().port;
+  const redirectUri = `http://${REDIRECT_HOST}:${port}${REDIRECT_PATH}`;
   return {
-    redirectUri: `http://localhost:${port}/callback`,
-    // `close()` alone only stops new connections; a keep-alive socket from the
-    // browser would hold the event loop open and the CLI would never exit.
-    waitForCode: (expectedState, timeoutMs) => {
-      expected = expectedState;
-      return new Promise((resolve3, reject) => {
+    redirectUri,
+    close: () => server.close(),
+    waitForCode(state, timeoutMs) {
+      return new Promise((resolve3) => {
+        const done = (r) => {
+          clearTimeout(timer);
+          resolveCode = null;
+          server.close();
+          resolve3(r);
+        };
         const timer = setTimeout(
-          () => reject(new Error(`Timed out after ${Math.round(timeoutMs / 1e3)}s waiting for the browser`)),
+          () => done({ ok: false, reason: "Timed out waiting for the browser." }),
           timeoutMs
         );
-        resolveCode = (code) => {
-          clearTimeout(timer);
-          resolve3(code);
-        };
-        rejectCode = (err) => {
-          clearTimeout(timer);
-          reject(err);
+        resolveCode = (r) => {
+          if (r.ok && r.reason !== state) {
+            done({ ok: false, reason: "The browser callback did not match this request." });
+            return;
+          }
+          done(r.ok ? { ok: true, code: r.code } : r);
         };
       });
-    },
-    close: () => {
-      server.closeAllConnections();
-      server.close();
     }
   };
 }
-async function postToken(meta, body) {
-  const res = await fetch(meta.token_endpoint, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
-    body: new URLSearchParams(body).toString()
-  });
-  const json = await res.json().catch(() => ({}));
-  if (!res.ok || json.error) {
-    throw new Error(json.error_description || json.error || `Token endpoint returned ${res.status}`);
-  }
-  if (!json.access_token) throw new Error("Token endpoint returned no access_token");
-  return json;
-}
-function store(meta, token, clientId) {
-  return {
-    issuer: meta.issuer,
-    accessToken: token.access_token,
-    refreshToken: token.refresh_token,
-    expiresAt: Date.now() + (token.expires_in ?? 900) * 1e3,
-    scope: token.scope,
-    clientId
-  };
-}
-async function login(opts) {
-  const meta = await discover();
-  const server = await startCallbackServer();
-  try {
-    const existing = await readCredentials();
-    const clientId = existing?.clientId && existing.issuer === meta.issuer ? existing.clientId : await registerClient(meta, server.redirectUri);
-    const { verifier, challenge } = pkcePair2();
-    const state = base64url2(randomBytes2(16));
-    const authUrl = new URL(meta.authorization_endpoint);
-    authUrl.searchParams.set("response_type", "code");
-    authUrl.searchParams.set("client_id", clientId);
-    authUrl.searchParams.set("redirect_uri", server.redirectUri);
-    authUrl.searchParams.set("scope", pickScope(meta));
-    authUrl.searchParams.set("state", state);
-    authUrl.searchParams.set("code_challenge", challenge);
-    authUrl.searchParams.set("code_challenge_method", "S256");
-    const pendingCode = server.waitForCode(state, opts.timeoutMs ?? 3e5);
-    pendingCode.catch(() => void 0);
-    opts.onUrl?.(authUrl.toString());
-    await opts.openBrowser(authUrl.toString());
-    const code = await pendingCode;
-    const token = await postToken(meta, {
-      grant_type: "authorization_code",
-      code,
-      redirect_uri: server.redirectUri,
-      client_id: clientId,
-      code_verifier: verifier
-    });
-    await writeCredentials(store(meta, token, clientId));
-    return { ok: true, message: "Signed in.", scope: token.scope };
-  } finally {
-    server.close();
-  }
-}
-function pickScope(meta) {
-  const supported = meta.scopes_supported ?? [];
-  if (!supported.length) return DEFAULT_SCOPE;
-  return DEFAULT_SCOPE.split(" ").filter((s) => supported.includes(s)).join(" ") || supported[0];
-}
-async function getAccessToken() {
-  const creds = await readCredentials();
-  if (!creds) return null;
-  if (!isExpired(creds)) return creds.accessToken;
-  if (!creds.refreshToken || !creds.clientId) return null;
-  try {
-    const meta = await discover();
-    const token = await postToken(meta, {
-      grant_type: "refresh_token",
-      refresh_token: creds.refreshToken,
-      client_id: creds.clientId
-    });
-    const next = store(meta, token, creds.clientId);
-    if (!next.refreshToken) next.refreshToken = creds.refreshToken;
-    await writeCredentials(next);
-    return next.accessToken;
-  } catch {
-    return null;
-  }
-}
-async function logout() {
-  await clearCredentials();
+function discoverResendKey(env) {
+  const key = env.RESEND_API_KEY?.trim();
+  if (!key || !looksResendKey(key)) return void 0;
+  return { apiKey: key, tier: "discovered" };
 }
-
-// src/cli/lib/ask.ts
-var DEFAULT_ERROR_HINTS = [
-  "Re-check the arguments: carrier <domain> <command> --help",
-  "Or open Claude and ask there with full tool routing"
+var MANUAL_STEPS = [
+  `Open ${RESEND_API_KEYS_URL} and create an API key.`,
+  `Give it Sending access, and restrict it to your sending domain if that domain is verified at ${RESEND_DOMAINS_URL}.`,
+  "Put the key in the storefront's .env.local as RESEND_API_KEY.",
+  "Re-run `carrier site deploy` \u2014 the key is pushed to the deploy target automatically."
 ];
-var DEFAULT_MCP_TIMEOUT_MS = 45e3;
-function mcpTimeoutMs() {
-  const parsed = Number(process.env.CARRIER_MCP_TIMEOUT_MS);
-  return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_MCP_TIMEOUT_MS;
-}
-var McpTimeoutError = class extends Error {
-  constructor(timeoutMs) {
-    super(`timed out after ${Math.round(timeoutMs / 1e3)}s`);
-    this.timeoutMs = timeoutMs;
-    this.name = "McpTimeoutError";
-  }
-  timeoutMs;
-};
-function isTimeoutish(err) {
-  return err instanceof McpTimeoutError || err instanceof Error && (err.name === "AbortError" || err.name === "TimeoutError");
-}
-function parseRpcBody(raw) {
-  const trimmed = raw.trim();
-  if (!trimmed) return {};
-  if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
-    return JSON.parse(trimmed);
+async function provisionResend(opts) {
+  const { deps } = opts;
+  const notes = [];
+  const discovered = discoverResendKey(opts.env);
+  if (discovered) {
+    const check = await validateResendKey(deps.fetch, discovered.apiKey);
+    if (check.ok) return { ok: true, tier: "discovered", credentials: discovered };
+    notes.push(`A RESEND_API_KEY was already set but did not work: ${check.reason}`);
   }
-  const dataLine = trimmed.split("\n").map((l) => l.trim()).find((l) => l.startsWith("data:"));
-  if (!dataLine) return {};
-  return JSON.parse(dataLine.slice(5).trim());
-}
-async function callMcpTool(tool, args, opts = {}) {
-  const token = resolveCliToken() ?? await getAccessToken();
-  if (!token) {
-    return {
-      ok: false,
-      text: withNextStep("Not signed in.", [
-        "Sign in from this terminal: carrier login",
-        "No account yet? carrier open signup",
-        "Headless/CI instead: export CARRIER_API_KEY=ak_\u2026 from Console \u2192 Settings \u2192 API Keys"
-      ])
-    };
+  if (!opts.noBrowser) {
+    const viaBrowser = await oauthTier(opts);
+    if (viaBrowser.ok) {
+      return { ...viaBrowser, reason: notes.length ? notes.join(" ") : void 0 };
+    }
+    notes.push(viaBrowser.reason ?? "The browser authorization did not complete.");
   }
-  const headers = {
-    Authorization: `Bearer ${token}`,
-    "Content-Type": "application/json",
-    Accept: "application/json, text/event-stream"
-  };
-  const timeoutMs = mcpTimeoutMs();
-  const controller = new AbortController();
-  let deadlineTimer;
-  const deadline = new Promise((_resolve, reject) => {
-    deadlineTimer = setTimeout(() => {
-      controller.abort();
-      reject(new McpTimeoutError(timeoutMs));
-    }, timeoutMs);
-  });
-  const signal = controller.signal;
-  try {
-    return await Promise.race([
-      (async () => {
-        const initRes = await fetch(MCP_URL, {
-          method: "POST",
-          headers,
-          signal,
-          body: JSON.stringify({
-            jsonrpc: "2.0",
-            id: 1,
-            method: "initialize",
-            params: {
-              protocolVersion: "2024-11-05",
-              capabilities: {},
-              clientInfo: { name: "carrier-cli", version: CARRIER_VERSION }
-            }
-          })
-        });
-        if (initRes.status === 401 || initRes.status === 403) {
-          return {
-            ok: false,
-            text: withNextStep(`MCP returned ${initRes.status} (auth rejected).`, [
-              "Confirm CARRIER_API_KEY is a valid org key (ak_\u2026) from app.carrier.llc",
-              "Or complete OCS onboarding: https://app.carrier.llc/onboarding",
-              "Interactive: use Claude + OAuth instead of a headless key"
-            ])
-          };
-        }
-        const sessionId = initRes.headers.get("mcp-session-id") ?? initRes.headers.get("Mcp-Session-Id");
-        await initRes.arrayBuffer().catch(() => void 0);
-        if (!sessionId) {
-          return {
-            ok: false,
-            text: withNextStep("MCP initialize did not return a session id.", [
-              "Check network access to https://mcp.carrier.llc/mcp",
-              "Retry later, or use Claude with the registered MCP (OAuth path)"
-            ])
-          };
-        }
-        const sessionHeaders = { ...headers, "Mcp-Session-Id": sessionId };
-        await fetch(MCP_URL, {
-          method: "POST",
-          headers: sessionHeaders,
-          signal,
-          body: JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" })
-        }).catch(() => void 0);
-        const res = await fetch(MCP_URL, {
-          method: "POST",
-          headers: sessionHeaders,
-          signal,
-          body: JSON.stringify({
-            jsonrpc: "2.0",
-            id: 2,
-            method: "tools/call",
-            params: { name: tool, arguments: args }
-          })
-        });
-        if (!res.ok) {
-          const snippet = (await res.text().catch(() => "")).slice(0, 240);
-          return {
-            ok: false,
-            text: withNextStep(`MCP call failed (${res.status}). ${snippet}`, [
-              "Check network access to https://mcp.carrier.llc/mcp",
-              "Retry later, or use Claude with the registered MCP (OAuth path)"
-            ])
-          };
-        }
-        const json = parseRpcBody(await res.text());
-        if (json.error?.message) {
-          return {
-            ok: false,
-            text: withNextStep(json.error.message, opts.errorHints ?? DEFAULT_ERROR_HINTS)
-          };
-        }
-        const parts = json.result?.content ?? [];
-        const text3 = parts.map((p4) => p4.text).filter(Boolean).join("\n").trim() || JSON.stringify(json.result ?? json, null, 2);
-        return {
-          ok: !json.result?.isError,
-          text: text3,
-          structured: json.result?.structuredContent
+  if (deps.promptForKey) {
+    await deps.openBrowser(RESEND_API_KEYS_URL);
+    const pasted = (await deps.promptForKey(RESEND_API_KEYS_URL))?.trim();
+    if (pasted) {
+      const check = await validateResendKey(deps.fetch, pasted);
+      if (check.ok) {
+        return {
+          ok: true,
+          tier: "paste",
+          credentials: { apiKey: pasted, tier: "paste" },
+          reason: notes.length ? notes.join(" ") : void 0
         };
-      })(),
-      deadline
-    ]);
-  } catch (e) {
-    if (isTimeoutish(e)) {
-      const secs = Math.round(timeoutMs / 1e3);
-      return {
-        ok: false,
-        text: withNextStep(
-          `MCP call to ${tool} timed out after ${secs}s (no response).`,
-          [
-            "The tool is likely returning more data than the MCP transport can deliver \u2014 see issue #663",
-            "Narrow the request (a specific --account-id / --iccid returns far less than a whole-fleet call)",
-            `Raise the deadline for one slow call: CARRIER_MCP_TIMEOUT_MS=${timeoutMs * 2} carrier \u2026`,
-            "Confirm the service is up: check network access to https://mcp.carrier.llc/mcp",
-            "Or open Claude and ask there with full tool routing"
-          ]
-        )
-      };
+      }
+      notes.push(check.reason ?? "The pasted key did not work.");
     }
-    const msg = e instanceof Error ? e.message : String(e);
-    return {
-      ok: false,
-      text: withNextStep(`Could not reach MCP: ${msg}`, [
-        "Verify outbound HTTPS to mcp.carrier.llc",
-        "Use the interactive Claude path while offline from this machine"
-      ])
-    };
-  } finally {
-    if (deadlineTimer !== void 0) clearTimeout(deadlineTimer);
   }
+  return { ok: false, tier: "manual", reason: notes.join(" "), guidance: MANUAL_STEPS };
 }
-var ASK_ERROR_HINTS = [
-  "Rephrase the intent more specifically (include ICCID / MSISDN if relevant)",
-  "Or use a discrete command: carrier --help lists every domain"
-];
-function parseRouting(text3) {
-  const trimmed = text3.trim();
-  if (!trimmed.startsWith("{")) return void 0;
+async function oauthTier(opts) {
+  const { deps } = opts;
+  let server;
   try {
-    const parsed = JSON.parse(trimmed);
-    if (!parsed || typeof parsed !== "object") return void 0;
-    const routes = typeof parsed.resolved_tool === "string" && parsed.resolved_tool;
-    const asksBack = typeof parsed.clarifying_question === "string" || Array.isArray(parsed.candidates);
-    return routes || asksBack ? parsed : void 0;
-  } catch {
-    return void 0;
-  }
-}
-async function carrierAsk(intent) {
-  const routed = await callMcpTool("carrier_ask", { intent }, { errorHints: ASK_ERROR_HINTS });
-  if (!routed.ok) return routed;
-  const routing = parseRouting(routed.text);
-  if (!routing) return routed;
-  if (!routing.resolved_tool) {
-    const candidates = (routing.candidates ?? []).map((c) => c.tool ? `Candidate: ${c.tool}${c.reason ? ` \u2014 ${c.reason}` : ""}` : void 0).filter((s) => Boolean(s));
+    server = await deps.startLoopback();
+  } catch (e) {
     return {
       ok: false,
-      text: withNextStep(routing.clarifying_question?.trim() || "Carrier could not tell which tool you meant.", [
-        ...candidates,
-        ...ASK_ERROR_HINTS
-      ])
+      tier: "oauth",
+      reason: `Could not open a local callback listener: ${e instanceof Error ? e.message : String(e)}`
     };
   }
-  const tool = routing.resolved_tool;
-  const args = routing.resolved_params ?? {};
-  if (routing.match && routing.match !== "confirmed") {
+  try {
+    const registered = await registerOauthClient(deps.fetch);
+    if (!registered.ok) return { ok: false, tier: "oauth", reason: registered.reason };
+    const { verifier, challenge } = pkcePair2();
+    const state = base64url2(randomBytes2(24));
+    const authorizeUrl = buildAuthorizeUrl({
+      clientId: registered.clientId,
+      redirectUri: server.redirectUri,
+      state,
+      challenge
+    });
+    const opened = await deps.openBrowser(authorizeUrl);
+    deps.notify(
+      opened.ok ? "Approve the connection in your browser \u2014 this waits for you." : `Open this to approve the connection:
+  ${authorizeUrl}`
+    );
+    const callback = await server.waitForCode(state, opts.timeoutMs ?? 18e4);
+    if (!callback.ok || !callback.code) {
+      return { ok: false, tier: "oauth", reason: callback.reason ?? "No authorization code." };
+    }
+    const token = await exchangeCode(deps.fetch, {
+      clientId: registered.clientId,
+      code: callback.code,
+      redirectUri: server.redirectUri,
+      verifier
+    });
+    if (!token.ok) return { ok: false, tier: "oauth", reason: token.reason };
+    const domainId = opts.domain ? await findVerifiedDomainId(deps.fetch, token.accessToken, opts.domain) : void 0;
+    const created = await createSendingKey(deps.fetch, token.accessToken, {
+      name: `${opts.name} storefront`,
+      domainId
+    });
+    if (token.refreshToken) {
+      await revokeGrant(deps.fetch, {
+        clientId: registered.clientId,
+        refreshToken: token.refreshToken
+      });
+    }
+    if (!created.ok) return { ok: false, tier: "oauth", reason: created.reason };
+    const check = await validateResendKey(deps.fetch, created.token);
+    if (!check.ok) {
+      return { ok: false, tier: "oauth", reason: `Resend minted a key that it then rejected: ${check.reason}` };
+    }
     return {
-      ok: false,
-      text: withNextStep(`Carrier could not confirm what you meant (match: ${routing.match}).`, [
-        `Closest tool: ${tool}`,
-        ...ASK_ERROR_HINTS
-      ])
+      ok: true,
+      tier: "oauth",
+      credentials: {
+        apiKey: created.token,
+        tier: "oauth",
+        keyId: created.id,
+        domain: domainId ? opts.domain : void 0
+      }
     };
+  } finally {
+    server.close();
   }
-  if (routing.confirm_required) {
-    return {
-      ok: false,
-      text: withNextStep(`"${intent}" resolves to ${tool}, which changes live service or billing.`, [
-        `Params: ${JSON.stringify(args)}`,
-        "Run the matching discrete command so every flag is explicit and reviewable",
-        "carrier --help lists every domain"
-      ])
-    };
+}
+
+// src/cli/lib/dash.ts
+var DASH_DOMAINS = [
+  "fleet",
+  "subscribers",
+  "usage",
+  "packages",
+  "billing",
+  "wallet",
+  "greenzone",
+  "storefront"
+];
+function isDashDomain(value) {
+  return DASH_DOMAINS.includes(value);
+}
+var DASH_TOOL = {
+  fleet: "fleet_health_app",
+  subscribers: "list_subscribers",
+  usage: "subscriber_usage",
+  packages: "list_package_templates",
+  billing: "billing_events",
+  wallet: "wallet_balance",
+  greenzone: "greenzone_whitelist_list",
+  storefront: ""
+};
+function screenFromStructured(structured) {
+  const rec = structured;
+  const screen = rec?.screen;
+  if (screen && typeof screen === "object" && Array.isArray(screen.sections) && screen.title) {
+    return screen;
+  }
+  return void 0;
+}
+var num = (value, fallback = 0) => {
+  const n = Number(value);
+  return Number.isFinite(n) ? n : fallback;
+};
+var str = (value, fallback = "") => value === void 0 || value === null ? fallback : String(value);
+function rows(payload, keys) {
+  if (Array.isArray(payload)) return payload;
+  const rec = payload ?? {};
+  for (const key of keys) {
+    const candidate = rec[key];
+    if (Array.isArray(candidate)) return candidate;
+  }
+  return [];
+}
+function buildDashScreen(domain, payload) {
+  switch (domain) {
+    case "fleet": {
+      const accounts = rows(payload, ["accounts", "account"]);
+      return fleetScreen({
+        active: num(payload?.active),
+        suspended: num(payload?.suspended),
+        inventory: num(payload?.inventory),
+        other: num(payload?.other),
+        accounts: accounts.map((a) => ({
+          name: str(a.name ?? a.accountId, "?"),
+          balance: num(a.balance),
+          active: num(a.active),
+          suspended: num(a.suspended),
+          inventory: num(a.inventory),
+          other: num(a.other),
+          packageOnly: Boolean(a.packageOnly)
+        }))
+      });
+    }
+    case "subscribers":
+      return subscribersScreen(
+        rows(payload, ["subscribers", "subscriber", "data"]).map((s) => ({
+          iccid: str(s.iccid ?? s.ICCID, "?"),
+          msisdn: s.msisdn ? str(s.msisdn) : void 0,
+          status: str(s.status ?? s.statusStr, "unknown"),
+          account: s.accountName ? str(s.accountName) : void 0,
+          dataUsedBytes: s.dataUsed === void 0 ? void 0 : num(s.dataUsed)
+        }))
+      );
+    case "usage":
+      return usageScreen({
+        subject: str(payload?.subject, "Subscriber"),
+        timeline: rows(payload, ["timeline", "days", "usage"]).map((p4) => ({
+          date: str(p4.date ?? p4.day, "?"),
+          bytes: num(p4.bytes ?? p4.dataUsed)
+        })),
+        countries: rows(payload, ["countries"]).map((c) => ({
+          country: str(c.country ?? c.countryName, "?"),
+          bytes: num(c.bytes ?? c.dataUsed)
+        }))
+      });
+    case "packages":
+      return packagesScreen(
+        rows(payload, ["template", "templates", "data"]).map((t) => ({
+          name: str(t.prepaidpackagetemplatename ?? t.name, "?"),
+          id: str(t.prepaidpackagetemplateid ?? t.id, "?"),
+          dataLimitBytes: t.databyte === void 0 ? void 0 : num(t.databyte),
+          validityDays: t.perioddays === void 0 ? void 0 : num(t.perioddays),
+          price: t.cost === void 0 ? void 0 : num(t.cost),
+          recurring: Boolean(t.recurring)
+        }))
+      );
+    case "billing":
+      return billingScreen({
+        balance: payload?.balance === void 0 ? void 0 : num(payload.balance),
+        currency: str(payload?.currency, ""),
+        events: rows(payload, ["events", "data"]).map((e) => ({
+          date: str(e.date ?? e.timestamp, "?"),
+          description: str(e.description ?? e.type, "\u2014"),
+          amount: num(e.amount)
+        }))
+      });
+    case "wallet": {
+      const p4 = payload ?? {};
+      const eur = (value) => value === void 0 || value === null ? void 0 : num(value) / 100;
+      return walletScreen({
+        balance: eur(p4.balance_eur_cents ?? p4.balance) ?? 0,
+        currency: str(p4.currency, "\u20AC"),
+        autoTopupEnabled: Boolean(p4.autoTopupEnabled ?? p4.auto_topup_enabled),
+        threshold: eur(p4.auto_topup_threshold_cents ?? p4.threshold),
+        credits: p4.credits === void 0 || p4.credits === null ? void 0 : num(p4.credits)
+      });
+    }
+    case "greenzone":
+      return greenzoneScreen(
+        rows(payload, ["entries", "whitelist", "data"]).map((e) => ({
+          value: str(e.value ?? e.prefix ?? e.destination, "?"),
+          note: e.note ? str(e.note) : void 0
+        }))
+      );
+    case "storefront": {
+      const p4 = payload ?? {};
+      return storefrontScreen({
+        brand: str(p4.brand ?? p4.project, "storefront"),
+        url: p4.url ? str(p4.url) : void 0,
+        target: p4.target ? str(p4.target) : void 0,
+        verified: p4.verified === void 0 ? null : Boolean(p4.verified),
+        diagnosis: p4.diagnosis ? str(p4.diagnosis) : void 0,
+        secretsStaged: Array.isArray(p4.secrets_staged) ? p4.secrets_staged : void 0,
+        plans: p4.plans === void 0 ? void 0 : num(p4.plans)
+      });
+    }
   }
-  return callMcpTool(tool, args, { errorHints: ASK_ERROR_HINTS });
 }
 
 // src/cli/lib/home.ts
+import * as p from "@clack/prompts";
+import pc2 from "picocolors";
 function mark(ok2) {
   return ok2 ? pc2.green("\u25CF") : pc2.yellow("\u25CB");
 }
@@ -3441,6 +4060,7 @@ var CLI_DOMAINS = [
         tool: "greenzone_whitelist_remove",
         summary: "Remove a host or IP from the Greenzone whitelist. Needs Kapture running in the operator's own Chrome \u2014 without it the dry run still returns the portal steps to follow by hand.",
         write: true,
+        requireConfirm: true,
         options: [
           {
             flags: "--host <host>",
@@ -3454,8 +4074,7 @@ var CLI_DOMAINS = [
             arg: "ip",
             type: "string"
           }
-        ],
-        requireConfirm: true
+        ]
       }
     ]
   },
@@ -3622,6 +4241,7 @@ var CLI_DOMAINS = [
         tool: "ui_create_account",
         summary: "Creates a new sub-account under the reseller via the OCS web dashboard.",
         write: true,
+        requireConfirm: true,
         options: [
           {
             flags: "--name <name>",
@@ -3642,8 +4262,7 @@ var CLI_DOMAINS = [
             arg: "initial_balance",
             type: "number"
           }
-        ],
-        requireConfirm: true
+        ]
       },
       {
         name: "steering build",
@@ -3823,6 +4442,7 @@ var CLI_DOMAINS = [
         tool: "ui_delete_destination_list",
         summary: "Delete a destination list \u2014 a named set of phone-number prefixes \u2014 by driving the OCS web dashboard.",
         write: true,
+        requireConfirm: true,
         options: [
           {
             flags: "--destination-list-id <n>",
@@ -3831,8 +4451,7 @@ var CLI_DOMAINS = [
             type: "number",
             required: true
           }
-        ],
-        requireConfirm: true
+        ]
       },
       {
         name: "zones edit",
@@ -3872,6 +4491,7 @@ var CLI_DOMAINS = [
         tool: "ui_delete_location_zone",
         summary: "Delete a location zone by driving the OCS web dashboard, because the OCS REST API can create a zone (`create_location_zone`) but not remove one.",
         write: true,
+        requireConfirm: true,
         options: [
           {
             flags: "--zone-id <n>",
@@ -3880,14 +4500,14 @@ var CLI_DOMAINS = [
             type: "number",
             required: true
           }
-        ],
-        requireConfirm: true
+        ]
       },
       {
         name: "templates delete",
         tool: "ui_delete_package_template",
         summary: "Remove a package template from the reseller's product catalogue for good, by driving the OCS web dashboard \u2014 the OCS REST API cannot delete a template.",
         write: true,
+        requireConfirm: true,
         options: [
           {
             flags: "--template-id <n>",
@@ -3896,8 +4516,7 @@ var CLI_DOMAINS = [
             type: "number",
             required: true
           }
-        ],
-        requireConfirm: true
+        ]
       }
     ]
   },
@@ -4191,6 +4810,59 @@ var CLI_DOMAINS = [
         ]
       }
     ]
+  },
+  {
+    name: "atlas",
+    summary: "Carrier Atlas coverage catalog. Configured networks, not live radio telemetry.",
+    commands: [
+      {
+        name: "coverage",
+        tool: "get_atlas_coverage",
+        summary: "List the mobile networks Carrier Atlas has configured for one country.",
+        options: [
+          {
+            flags: "--country <country>",
+            description: "ISO 3166-1 alpha-2 country code, for example JP or NL.",
+            arg: "country",
+            type: "string",
+            required: true
+          },
+          {
+            flags: "--status <status>",
+            description: "Keep only networks whose latest probe has this status. One of: up, degraded, down, unknown.",
+            arg: "status",
+            type: "string"
+          },
+          {
+            flags: "--technology <technology>",
+            description: "Keep only networks of this radio generation. One of: 2G, 3G, 4G, 5G.",
+            arg: "technology",
+            type: "string"
+          }
+        ]
+      },
+      {
+        name: "network",
+        tool: "get_atlas_network_status",
+        summary: "Read one mobile network from Carrier Atlas by MCC and MNC, including the latest status sample and the last 24 hours of probes.",
+        options: [
+          {
+            flags: "--mcc <mcc>",
+            description: "Mobile Country Code.",
+            arg: "mcc",
+            type: "string",
+            required: true
+          },
+          {
+            flags: "--mnc <mnc>",
+            description: "Mobile Network Code.",
+            arg: "mnc",
+            type: "string",
+            required: true
+          }
+        ]
+      }
+    ]
   }
   // </generated:catalog-domains>
 ];
@@ -4201,171 +4873,6 @@ function capabilityTarget(cmd) {
 // src/cli/lib/capability.ts
 import * as p2 from "@clack/prompts";
 import pc3 from "picocolors";
-
-// src/cli/lib/rest.ts
-var DEFAULT_ERROR_HINTS2 = [
-  "Re-check the arguments: carrier <domain> <command> --help",
-  "Or open Claude and ask there with full tool routing"
-];
-function resolveApiKey() {
-  return process.env.CARRIER_API_KEY?.trim() || process.env.CARRIER_ORG_API_KEY?.trim() || null;
-}
-function ocsTokenOnly() {
-  return Boolean(
-    process.env.ESIMVAULT_API_TOKEN?.trim() || process.env.CARRIER_OCS_API_TOKEN?.trim()
-  );
-}
-function applyPath(path, args) {
-  const rest = { ...args };
-  const missing = [];
-  const filled = path.replace(/\{(\w+)\}/g, (_match, name) => {
-    const value = rest[name];
-    if (value === void 0 || value === null || value === "") {
-      missing.push(name);
-      return `{${name}}`;
-    }
-    delete rest[name];
-    return encodeURIComponent(String(value));
-  });
-  return { path: filled, rest, missing };
-}
-function queryString(args) {
-  const params = new URLSearchParams();
-  for (const [key, value] of Object.entries(args)) {
-    if (value === void 0 || value === null) continue;
-    params.set(key, String(value));
-  }
-  const qs = params.toString();
-  return qs ? `?${qs}` : "";
-}
-function bodyText(raw) {
-  const trimmed = raw.trim();
-  if (!trimmed) return "";
-  try {
-    const parsed = JSON.parse(trimmed);
-    if (typeof parsed.error === "string") return parsed.error;
-    if (typeof parsed.message === "string") return parsed.message;
-    return trimmed;
-  } catch {
-    return trimmed;
-  }
-}
-async function callRestEndpoint(method, path, args, opts = {}) {
-  const token = resolveApiKey() ?? await getAccessToken();
-  if (!token) {
-    return {
-      ok: false,
-      text: withNextStep(
-        ocsTokenOnly() ? "Not signed in. An eSIMVault/OCS token is set, but the Carrier API only accepts Carrier credentials." : "Not signed in.",
-        [
-          "Sign in from this terminal: carrier login",
-          "No account yet? carrier open signup",
-          "Headless/CI instead: export CARRIER_API_KEY=ak_\u2026 from Console \u2192 Settings \u2192 API Keys"
-        ]
-      )
-    };
-  }
-  const { path: resolvedPath, rest, missing } = applyPath(path, args);
-  if (missing.length) {
-    return {
-      ok: false,
-      text: withNextStep(`Cannot build ${method} ${path}.`, [
-        `Missing path value(s): ${missing.join(", ")}`,
-        "See every flag: carrier <domain> <command> --help"
-      ])
-    };
-  }
-  const sendsBody = method === "POST" || method === "PUT" || method === "PATCH";
-  const url = `${API_URL}${resolvedPath}${sendsBody ? "" : queryString(rest)}`;
-  const headers = {
-    Authorization: `Bearer ${token}`,
-    Accept: "application/json",
-    "User-Agent": `carrier-cli/${CARRIER_VERSION}`
-  };
-  if (sendsBody) headers["Content-Type"] = "application/json";
-  if (opts.confirmToken) headers["X-Confirm-Token"] = opts.confirmToken;
-  const timeoutMs = mcpTimeoutMs();
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const res = await fetch(url, {
-      method,
-      headers,
-      signal: controller.signal,
-      body: sendsBody ? JSON.stringify(rest) : void 0
-    });
-    const raw = await res.text();
-    if (res.status === 202) {
-      let confirmToken;
-      let expires;
-      let message = "";
-      try {
-        const parsed = JSON.parse(raw);
-        confirmToken = parsed.confirm_token;
-        expires = parsed.expires_in_seconds;
-        message = parsed.message ?? "";
-      } catch {
-      }
-      return {
-        ok: false,
-        text: withNextStep(
-          message || `${method} ${path} needs an explicit confirmation.`,
-          confirmToken ? [
-            `Re-run the same command with: --confirm-token ${confirmToken}`,
-            `The token is single-use and expires in ${expires ?? 120}s.`
-          ] : ["The server asked for confirmation but returned no token \u2014 retry the command."]
-        )
-      };
-    }
-    if (res.status === 401 || res.status === 403) {
-      return {
-        ok: false,
-        text: withNextStep(
-          `Carrier API returned ${res.status} (auth rejected).`,
-          [
-            "Confirm CARRIER_API_KEY is a valid org key (ak_\u2026) from app.carrier.llc",
-            "Or sign in from this terminal: carrier login",
-            ...res.status === 403 ? ["A 403 here usually means the key lacks write scope."] : []
-          ]
-        )
-      };
-    }
-    if (!res.ok) {
-      return {
-        ok: false,
-        text: withNextStep(
-          redact(`${method} ${path} failed (${res.status}). ${bodyText(raw).slice(0, 500)}`),
-          opts.errorHints ?? DEFAULT_ERROR_HINTS2
-        )
-      };
-    }
-    return { ok: true, text: raw.trim() || JSON.stringify({ status: res.status }) };
-  } catch (e) {
-    const aborted = e instanceof Error && (e.name === "AbortError" || e.name === "TimeoutError");
-    if (aborted) {
-      const secs = Math.round(timeoutMs / 1e3);
-      return {
-        ok: false,
-        text: withNextStep(`${method} ${path} timed out after ${secs}s (no response).`, [
-          `Raise the deadline for one slow call: CARRIER_MCP_TIMEOUT_MS=${timeoutMs * 2} carrier \u2026`,
-          "Confirm the service is up: check network access to https://api.carrier.llc"
-        ])
-      };
-    }
-    const msg = e instanceof Error ? e.message : String(e);
-    return {
-      ok: false,
-      text: withNextStep(redact(`Could not reach the Carrier API: ${msg}`), [
-        "Verify outbound HTTPS to api.carrier.llc",
-        "Use the interactive Claude path while offline from this machine"
-      ])
-    };
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-// src/cli/lib/capability.ts
 var MAX_PRETTY_CHARS = 8e3;
 function optionKey(flags) {
   const long = flags.split(/[ ,|]+/).find((t) => t.startsWith("--"));
@@ -5477,6 +5984,22 @@ site.command("deploy [dir]").description("Build + deploy a storefront to whichev
     p3.outro("");
   }
 );
+site.command("publish").description("Publish a Carrier-hosted storefront. Does not deploy a self-hosted copy.").requiredOption("--slug <slug>", "Shop address, such as acme or Acme Mobile").requiredOption("--name <name>", "Brand name").option("--status <status>", "draft or published", "published").option("--accent <hex>", "Accent color, such as #112233").option("--accent-dark <hex>", "Darker accent").option("--bg <hex>", "Page background").option("--text <hex>", "Body text color").option("--logo <url-or-file>", "https logo address, or a PNG, JPEG, WebP, or GIF under 70 KB").option("--hero <text>", "Shop headline").option("--tagline <text>", "Line under the headline").option("--support-email <email>", "Support address").option("--legal-name <name>", "Legal name in the footer").option("--product <id>", "Connectivity plan id. Copies its template, price, and allowance.").option("--plan <slug>", "Plan slug, such as eu-1gb").option("--plan-name <name>", "Plan name on the shop").option("--price <amount>", "Retail price, such as 9.00").option("--price-cents <cents>", "Retail price in minor units").option("--currency <code>", "Three-letter currency code").option("--template-id <id>", "OCS package template id").option("--data-gb <gb>", "Data allowance, such as 1 or 1 GB").option("--validity-days <days>", "Validity, such as 7 or 7 days").option("--countries <names>", "Country names or codes, such as France, DE").option("--plan-text <text>", "Buyer-facing sentence. Omit to leave the saved text unchanged.").option("--inactive", "Keep the plan off the shop").action(async (o) => {
+  header();
+  const built = hostedPublishInputFromFlags(o);
+  if (!built.ok) {
+    fail(built.text, ["Re-run with --status published"]);
+    process.exitCode = 1;
+    return;
+  }
+  const result = await publishHostedStorefront(built.input);
+  if (!result.ok) {
+    fail(result.text, ["Sign in: carrier login", "Or export CARRIER_API_KEY from the console"]);
+    process.exitCode = 1;
+    return;
+  }
+  ok(result.text);
+});
 site.command("targets [dir]").description("Show which deploy hosts are installed, logged in, and ready.").action(async (dir) => {
   header();
   const storefront = resolve2(dir ?? "./storefront");