@carrierllc/mcp 0.13.7 → 0.13.9

package/dist/cli.js

@@ -39,7 +39,7 @@ import {
   verifyStorefront,
   walletScreen,
   which
-} from "./chunk-U2UVUM3D.js";
+} from "./chunk-DF2PGR5H.js";
 import {
   copyTree,
   exists,
@@ -272,465 +272,615 @@ async function writeStorefrontLogo(target, brand) {
   return { path: svgPath, source: logo.source };
 }
 
-// src/cli/lib/resend.ts
-import { createHash, randomBytes } from "crypto";
-import { createServer } from "http";
-var RESEND_API = "https://api.resend.com";
-var RESEND_API_KEYS_URL = "https://resend.com/api-keys";
-var RESEND_DOMAINS_URL = "https://resend.com/domains";
-var USER_AGENT = "carrier-cli";
-var CLIENT_NAME = "Carrier storefront setup";
-var OAUTH_SCOPE = "full_access";
-var REDIRECT_PATH = "/oauth/callback";
-var REDIRECT_HOST = "127.0.0.1";
-function looksResendKey(key) {
-  return /^re_[A-Za-z0-9_-]{8,}$/.test(key.trim());
+// src/cli/lib/hosted-publish.ts
+import { readFileSync } from "fs";
+
+// ../../packages/sdk/src/storefront-labels.ts
+var regionNames = new Intl.DisplayNames(["en"], { type: "region" });
+var PREFERRED = /* @__PURE__ */ new Set(["CW", "BF", "BJ", "MM", "CD", "RS", "DE", "FR", "GB", "VU", "ZW", "RU", "TL", "VN", "YE"]);
+var NAME_TO_CODE = /* @__PURE__ */ new Map();
+for (let first = 65; first <= 90; first += 1) {
+  for (let second = 65; second <= 90; second += 1) {
+    const code = String.fromCharCode(first, second);
+    const label = regionLabel(code);
+    if (!label) continue;
+    const key = label.toLowerCase();
+    const current = NAME_TO_CODE.get(key);
+    if (!current || PREFERRED.has(code)) NAME_TO_CODE.set(key, code);
+  }
 }
-function base64url(input) {
-  return input.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+NAME_TO_CODE.set("uk", "GB");
+var CODE_ALIASES = { UK: "GB" };
+function parseDataGb(raw) {
+  if (raw.trim().toLowerCase() === "unlimited") return { ok: true, value: 0 };
+  return parseAmount(raw, /gigabytes?|gbs?|gb/gi, "Enter data like 1, 1 GB, or Unlimited.", 1e4, false);
 }
-function pkcePair() {
-  const verifier = base64url(randomBytes(64));
-  return { verifier, challenge: base64url(createHash("sha256").update(verifier).digest()) };
+function parseValidityDays(raw) {
+  return parseAmount(raw, /days?/gi, "Enter validity like 7 or 7 days.", 3650, true);
 }
-function buildAuthorizeUrl(opts) {
-  const url = new URL(`${RESEND_API}/oauth/authorize`);
-  url.searchParams.set("client_id", opts.clientId);
-  url.searchParams.set("response_type", "code");
-  url.searchParams.set("redirect_uri", opts.redirectUri);
-  url.searchParams.set("scope", opts.scope ?? OAUTH_SCOPE);
-  url.searchParams.set("state", opts.state);
-  url.searchParams.set("code_challenge", opts.challenge);
-  url.searchParams.set("code_challenge_method", "S256");
-  return url.toString();
+var ZERO_DECIMAL = /* @__PURE__ */ new Set([
+  "BIF",
+  "CLP",
+  "DJF",
+  "GNF",
+  "JPY",
+  "KMF",
+  "KRW",
+  "MGA",
+  "PYG",
+  "RWF",
+  "UGX",
+  "VND",
+  "VUV",
+  "XAF",
+  "XOF",
+  "XPF"
+]);
+function majorToCents(input, currency = "EUR") {
+  const text3 = input.trim();
+  if (ZERO_DECIMAL.has(currency.trim().toUpperCase())) {
+    if (!/^\d+$/.test(text3)) return { ok: false, message: "Enter a whole number, such as 1000." };
+    const cents2 = Number(text3);
+    if (!Number.isSafeInteger(cents2) || cents2 <= 0) return { ok: false, message: "Enter a price above zero." };
+    return { ok: true, cents: cents2 };
+  }
+  const match = /^(\d+)(?:\.(\d{1,2}))?$/.exec(text3);
+  if (!match) return { ok: false, message: "Enter a price like 9.00." };
+  const major = Number(match[1]);
+  const fraction = (match[2] ?? "").padEnd(2, "0");
+  const cents = major * 100 + Number(fraction);
+  if (!Number.isSafeInteger(cents) || cents <= 0) return { ok: false, message: "Enter a price above zero." };
+  return { ok: true, cents };
 }
-async function resendFetch(fetchImpl, path, init = {}) {
-  const headers = { "User-Agent": USER_AGENT, Accept: "application/json" };
-  if (init.token) headers.Authorization = `Bearer ${init.token}`;
-  let body;
-  if (init.form) {
-    headers["Content-Type"] = "application/x-www-form-urlencoded";
-    body = new URLSearchParams(init.form).toString();
-  } else if (init.json !== void 0) {
-    headers["Content-Type"] = "application/json";
-    body = JSON.stringify(init.json);
+function parseCountryInput(raw) {
+  const regions = [];
+  const parts = raw.split(",").map((part) => part.trim()).filter((part) => part !== "");
+  for (const part of parts) {
+    const added = codesFor(part);
+    if (!added) return { ok: false, message: "Countries are names, such as France, or codes such as FR." };
+    for (const code of added) {
+      if (regions.length >= 40) break;
+      if (!regions.includes(code)) regions.push(code);
+    }
+  }
+  return { ok: true, regions };
+}
+function parseAmount(raw, unit, message, max, whole) {
+  const text3 = raw.trim().replace(unit, "").trim();
+  if (text3 === "" || !/^\d+(\.\d+)?$/.test(text3)) return { ok: false, message };
+  const value = Number(text3);
+  if (!Number.isFinite(value) || value < 0 || value > max) return { ok: false, message };
+  if (whole && !Number.isInteger(value)) return { ok: false, message };
+  return { ok: true, value };
+}
+function codesFor(part) {
+  const tokens = part.split(/\s+/).filter((token) => token !== "");
+  if (tokens.length > 1 && tokens.every((token) => /^[A-Za-z]{2}$/.test(token))) {
+    return tokens.map((token) => canonical(token));
+  }
+  if (/^[A-Za-z]{2}$/.test(part)) return [canonical(part)];
+  const code = NAME_TO_CODE.get(part.toLowerCase());
+  return code ? [code] : null;
+}
+function canonical(code) {
+  const upper = code.toUpperCase();
+  return CODE_ALIASES[upper] ?? upper;
+}
+var LOGO_DATA = /^data:image\/(png|jpeg|webp|gif);base64,[A-Za-z0-9+/]+={0,2}$/;
+var LOGO_MAX_CHARS = 1e5;
+var LOGO_MAX_BYTES = 70 * 1024;
+function logoFileDataUrl(bytes) {
+  const mime = logoMime(bytes);
+  if (!mime || bytes.byteLength < 1 || bytes.byteLength > LOGO_MAX_BYTES) {
+    return { ok: false, message: "Use a PNG, JPEG, WebP, or GIF under 70 KB, or an https address." };
+  }
+  const url = `data:${mime};base64,${toBase64(bytes)}`;
+  if (url.length > LOGO_MAX_CHARS || !LOGO_DATA.test(url)) {
+    return { ok: false, message: "Use a PNG, JPEG, WebP, or GIF under 70 KB, or an https address." };
+  }
+  return { ok: true, url };
+}
+function logoReference(value) {
+  const trimmed = value.trim();
+  if (trimmed.startsWith("data:")) {
+    if (trimmed.length <= LOGO_MAX_CHARS && LOGO_DATA.test(trimmed)) return { ok: true, url: trimmed };
+    return { ok: false, message: "Use a PNG, JPEG, WebP, or GIF under 70 KB, or an https address." };
   }
   try {
-    const res = await fetchImpl(`${RESEND_API}${path}`, {
-      method: init.method ?? "GET",
-      headers,
-      body
-    });
-    const text3 = await res.text();
-    let json;
-    try {
-      json = text3 ? JSON.parse(text3) : void 0;
-    } catch {
-      json = void 0;
-    }
-    if (!res.ok) {
-      return { ok: false, status: res.status, json, error: resendError(json) ?? text3.slice(0, 300) };
-    }
-    return { ok: true, status: res.status, json };
-  } catch (e) {
-    return { ok: false, status: 0, error: e instanceof Error ? e.message : String(e) };
+    const url = new URL(trimmed);
+    if (url.protocol === "https:") return { ok: true, url: url.toString() };
+  } catch {
+    return { ok: false, message: "Use a PNG, JPEG, WebP, or GIF under 70 KB, or an https address." };
   }
+  return { ok: false, message: "Use a PNG, JPEG, WebP, or GIF under 70 KB, or an https address." };
 }
-function resendError(json) {
-  if (typeof json !== "object" || json === null) return void 0;
-  const body = json;
-  return body.message ?? body.error_description ?? body.error;
+function toBase64(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
 }
-async function registerOauthClient(fetchImpl) {
-  const registeredRedirect = `http://${REDIRECT_HOST}${REDIRECT_PATH}`;
-  const res = await resendFetch(fetchImpl, "/oauth/register", {
+function logoMime(bytes) {
+  if (bytes.length >= 8 && bytes[0] === 137 && bytes[1] === 80 && bytes[2] === 78 && bytes[3] === 71) {
+    return "image/png";
+  }
+  if (bytes.length >= 3 && bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255) return "image/jpeg";
+  if (bytes.length >= 6 && bytes[0] === 71 && bytes[1] === 73 && bytes[2] === 70) return "image/gif";
+  if (bytes.length >= 12 && bytes[0] === 82 && bytes[1] === 73 && bytes[2] === 70 && bytes[3] === 70 && bytes[8] === 87 && bytes[9] === 69 && bytes[10] === 66 && bytes[11] === 80) {
+    return "image/webp";
+  }
+  return null;
+}
+function regionLabel(code) {
+  if (!/^[A-Z]{2}$/.test(code)) return void 0;
+  try {
+    const label = regionNames.of(code);
+    if (!label || label.toUpperCase() === code) return void 0;
+    return label;
+  } catch {
+    return void 0;
+  }
+}
+
+// ../../packages/sdk/src/storefront-write.ts
+var THEME_FIELDS = [
+  ["accent", "accent"],
+  ["accentDark", "accentDark"],
+  ["bg", "bg"],
+  ["text", "text"],
+  ["logoUrl", "logoUrl"]
+];
+var COPY_FIELDS = [
+  ["hero", "hero"],
+  ["tagline", "tagline"],
+  ["supportEmail", "supportEmail"],
+  ["legalName", "legalName"]
+];
+function storefrontBrandPatch(input, existing) {
+  const theme = overlay(existing?.theme, input, THEME_FIELDS);
+  const copy = overlay(existing?.copy, input, COPY_FIELDS);
+  return {
+    ...theme ? { theme } : {},
+    ...copy ? { copy } : {}
+  };
+}
+function completePlanInput(input, plans) {
+  if ((input.productId?.trim() ?? "") !== "") return input;
+  const touched = [
+    input.slug,
+    input.name,
+    input.priceCents,
+    input.currency,
+    input.templateId,
+    input.dataGb,
+    input.validityDays,
+    input.regions,
+    input.description,
+    input.active
+  ].some((value) => value !== void 0);
+  if (!touched) return input;
+  const slug2 = input.slug?.trim();
+  const match = slug2 ? plans.find((plan) => plan.slug === slug2) : plans.length === 1 ? plans[0] : void 0;
+  if (!match) {
+    const currency = sharedCurrency(plans);
+    if (!input.currency && currency) return { ...input, currency };
+    return input;
+  }
+  return {
+    ...input,
+    slug: input.slug ?? match.slug,
+    name: input.name ?? match.name,
+    currency: input.currency ?? match.currency,
+    templateId: input.templateId ?? match.ocs_package_template_id
+  };
+}
+function sharedCurrency(plans) {
+  const codes = new Set(plans.map((plan) => plan.currency.trim().toUpperCase()).filter((code) => code !== ""));
+  if (codes.size !== 1) return void 0;
+  return [...codes][0];
+}
+function storefrontPlanBody(input) {
+  const productId = input.productId?.trim() ?? "";
+  if (productId !== "") {
+    const body2 = { product_id: productId };
+    if (input.priceCents !== void 0) body2.price_cents = input.priceCents;
+    if (input.active !== void 0) body2.active = input.active;
+    return body2;
+  }
+  const touched = [
+    input.slug,
+    input.name,
+    input.priceCents,
+    input.currency,
+    input.templateId,
+    input.dataGb,
+    input.validityDays,
+    input.regions,
+    input.description,
+    input.active
+  ].some((value) => value !== void 0);
+  if (!touched) return null;
+  if (!input.slug || !input.name || input.priceCents === void 0 || !input.currency || input.templateId === void 0) {
+    return { error: "A plan needs a slug, name, price in minor units, currency, and OCS template id." };
+  }
+  const body = {
+    slug: input.slug,
+    name: input.name,
+    price_cents: input.priceCents,
+    currency: input.currency,
+    ocs_package_template_id: input.templateId
+  };
+  if (input.dataGb !== void 0) body.data_gb = input.dataGb;
+  if (input.validityDays !== void 0) body.validity_days = input.validityDays;
+  if (input.regions !== void 0) body.regions = input.regions;
+  if (input.description !== void 0) body.description = input.description;
+  if (input.active !== void 0) body.active = input.active;
+  return body;
+}
+function isStorefrontPlanError(value) {
+  return value !== null && "error" in value;
+}
+function parseWholeNumber(value, label) {
+  if (value === void 0) return { ok: true, value: void 0 };
+  if (!/^\d+$/.test(value)) return { ok: false, message: `${label} must be a whole number.` };
+  return { ok: true, value: Number(value) };
+}
+function overlay(base, input, fields) {
+  const patch = {};
+  let touched = false;
+  for (const [field, jsonKey] of fields) {
+    const value = input[field];
+    if (typeof value !== "string" || value.trim() === "") continue;
+    patch[jsonKey] = value.trim();
+    touched = true;
+  }
+  if (!touched) return void 0;
+  return { ...base ?? {}, ...patch };
+}
+var RESERVED_SLUGS = /* @__PURE__ */ new Set(["www", "app", "api", "stores", "checkout", "dashboard", "admin", "mail"]);
+function hostedStorefrontUrl(slug2) {
+  return `https://${slug2}.stores.carrier.llc`;
+}
+function storefrontSlugFrom(raw) {
+  const folded = raw.trim().toLowerCase().normalize("NFKD").replace(/[\u0300-\u036f]/g, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+  const clipped = folded.slice(0, 40).replace(/-+$/g, "");
+  if (RESERVED_SLUGS.has(clipped)) return "";
+  return /^[a-z0-9](?:[a-z0-9-]{0,38}[a-z0-9])?$/.test(clipped) ? clipped : "";
+}
+
+// src/cli/lib/auth.ts
+import { createHash, randomBytes, timingSafeEqual } from "crypto";
+import { createServer } from "http";
+
+// src/cli/lib/credentials.ts
+import { homedir as homedir2 } from "os";
+import { join as join5 } from "path";
+import { chmod, mkdir as mkdir2, readFile as readFile2, rm, writeFile as writeFile3 } from "fs/promises";
+function carrierHome() {
+  return process.env.CARRIER_HOME?.trim() || join5(homedir2(), ".carrier");
+}
+function credentialsPath() {
+  return join5(carrierHome(), "credentials.json");
+}
+async function readCredentials() {
+  try {
+    const raw = await readFile2(credentialsPath(), "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed?.accessToken || typeof parsed.accessToken !== "string") return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+async function writeCredentials(creds) {
+  const dir = carrierHome();
+  await mkdir2(dir, { recursive: true, mode: 448 });
+  await chmod(dir, 448).catch(() => void 0);
+  const file = credentialsPath();
+  await writeFile3(file, `${JSON.stringify(creds, null, 2)}
+`, { mode: 384 });
+  await chmod(file, 384).catch(() => void 0);
+}
+async function clearCredentials() {
+  await rm(credentialsPath(), { force: true });
+}
+function isExpired(creds, skewMs = 6e4) {
+  if (!creds.expiresAt) return false;
+  return Date.now() >= creds.expiresAt - skewMs;
+}
+function redact(text3) {
+  return text3.replace(/\b(ak_|sk_|rt_)[A-Za-z0-9._-]{6,}/g, "$1***").replace(/\bBearer\s+[A-Za-z0-9._-]{8,}/gi, "Bearer ***");
+}
+
+// src/cli/lib/auth.ts
+var DISCOVERY_PATH = "/.well-known/oauth-authorization-server";
+var CLIENT_NAME = "Carrier CLI";
+var DEFAULT_SCOPE = "read write";
+var CALLBACK_PORTS = [3118, 3119, 8976, 8977, 0];
+async function discover(base = MCP_HOME) {
+  const res = await fetch(`${base}${DISCOVERY_PATH}`, {
+    headers: { Accept: "application/json" }
+  });
+  if (!res.ok) throw new Error(`OAuth discovery failed (${res.status}) at ${base}${DISCOVERY_PATH}`);
+  const meta = await res.json();
+  if (!meta.authorization_endpoint || !meta.token_endpoint) {
+    throw new Error("OAuth discovery returned no authorization or token endpoint");
+  }
+  return meta;
+}
+function base64url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function pkcePair() {
+  const verifier = base64url(randomBytes(32));
+  const challenge = base64url(createHash("sha256").update(verifier).digest());
+  return { verifier, challenge };
+}
+function sameState(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  if (left.length !== right.length) return false;
+  return timingSafeEqual(left, right);
+}
+async function registerClient(meta, redirectUri) {
+  if (!meta.registration_endpoint) {
+    throw new Error("This server does not support dynamic client registration");
+  }
+  const res = await fetch(meta.registration_endpoint, {
     method: "POST",
-    json: {
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({
       client_name: CLIENT_NAME,
-      redirect_uris: [registeredRedirect],
+      redirect_uris: [redirectUri],
       grant_types: ["authorization_code", "refresh_token"],
       response_types: ["code"],
+      // Installed apps cannot keep a secret; register as a public client.
       token_endpoint_auth_method: "none",
-      scope: OAUTH_SCOPE
-    }
+      application_type: "native"
+    })
   });
   if (!res.ok) {
-    return { ok: false, reason: `Resend rejected client registration: ${res.error ?? res.status}` };
+    const body = (await res.text().catch(() => "")).slice(0, 200);
+    throw new Error(`Client registration failed (${res.status}). ${body}`);
   }
-  const clientId = res.json?.client_id;
-  if (!clientId) return { ok: false, reason: "Resend registered no client_id." };
-  return { ok: true, clientId };
-}
-async function exchangeCode(fetchImpl, opts) {
-  const res = await resendFetch(fetchImpl, "/oauth/token", {
-    method: "POST",
-    form: {
-      grant_type: "authorization_code",
-      client_id: opts.clientId,
-      code: opts.code,
-      redirect_uri: opts.redirectUri,
-      code_verifier: opts.verifier
-    }
-  });
-  if (!res.ok) return { ok: false, reason: `Token exchange failed: ${res.error ?? res.status}` };
-  const body = res.json;
-  if (!body?.access_token) return { ok: false, reason: "Resend returned no access token." };
-  return { ok: true, accessToken: body.access_token, refreshToken: body.refresh_token };
+  const json = await res.json();
+  if (!json.client_id) throw new Error("Client registration returned no client_id");
+  return json.client_id;
 }
-async function revokeGrant(fetchImpl, opts) {
-  await resendFetch(fetchImpl, "/oauth/revoke", {
-    method: "POST",
-    form: {
-      client_id: opts.clientId,
-      token: opts.refreshToken,
-      token_type_hint: "refresh_token"
-    }
-  }).catch(() => void 0);
+function escapeHtml(text3) {
+  return text3.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
-async function findVerifiedDomainId(fetchImpl, accessToken, domain) {
-  const wanted = domain.trim().replace(/^https?:\/\//, "").replace(/\/+$/, "").toLowerCase();
-  if (!wanted) return void 0;
-  const res = await resendFetch(fetchImpl, "/domains", { token: accessToken });
-  if (!res.ok) return void 0;
-  const list = res.json?.data;
-  const match = list?.find((d) => d.name?.toLowerCase() === wanted && d.status === "verified");
-  return match?.id;
+function page(title, detail) {
+  const safeTitle = escapeHtml(title);
+  const safeDetail = escapeHtml(detail);
+  return `<!doctype html><meta charset="utf-8"><title>${safeTitle}</title>
+<body style="font-family:system-ui,sans-serif;max-width:32rem;margin:20vh auto;text-align:center">
+<h1 style="font-size:1.25rem">${safeTitle}</h1><p style="color:#555">${safeDetail}</p></body>`;
 }
-async function createSendingKey(fetchImpl, accessToken, opts) {
-  const res = await resendFetch(fetchImpl, "/api-keys", {
-    method: "POST",
-    token: accessToken,
-    json: {
-      // Resend caps the name at 50 characters.
-      name: opts.name.slice(0, 50),
-      permission: "sending_access",
-      ...opts.domainId ? { domain_id: opts.domainId } : {}
+async function startCallbackServer() {
+  let resolveCode;
+  let rejectCode;
+  let expected = "";
+  const server = createServer((req, res) => {
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    if (url.pathname !== "/callback") {
+      res.writeHead(404).end();
+      return;
     }
-  });
-  if (!res.ok) return { ok: false, reason: `Could not create an API key: ${res.error ?? res.status}` };
-  const body = res.json;
-  if (!body?.token) return { ok: false, reason: "Resend created a key but returned no token." };
-  return { ok: true, token: body.token, id: body.id };
-}
-async function validateResendKey(fetchImpl, key) {
-  if (!looksResendKey(key)) return { ok: false, reason: "That does not look like a Resend key (re_\u2026)." };
-  const res = await resendFetch(fetchImpl, "/emails", { method: "POST", token: key, json: {} });
-  if (res.status === 401) return { ok: false, reason: "Resend says that key is missing or malformed." };
-  if (res.status === 403) return { ok: false, reason: "Resend rejected that key as invalid." };
-  if (res.status === 0) return { ok: false, reason: `Could not reach Resend: ${res.error ?? "network error"}` };
-  return { ok: true };
-}
-async function startLoopbackServer() {
-  let resolveCode = null;
-  const server = createServer((req, res) => {
-    const url = new URL(req.url ?? "/", `http://${REDIRECT_HOST}`);
-    if (url.pathname !== REDIRECT_PATH) {
-      res.writeHead(404).end();
+    const err = url.searchParams.get("error");
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state") ?? "";
+    if (err) {
+      res.writeHead(400, { "Content-Type": "text/html" });
+      res.end(page("Sign-in failed", err));
+      rejectCode?.(new Error(`Authorization server returned "${err}"`));
       return;
     }
-    const error = url.searchParams.get("error");
-    const code = url.searchParams.get("code");
-    const state = url.searchParams.get("state");
-    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
-    res.end(
-      `<!doctype html><meta charset="utf-8"><title>Carrier</title><body style="font-family:system-ui;padding:3rem;text-align:center"><p>${error ? "Authorization was refused." : "Connected. You can close this tab."}</p>`
-    );
-    resolveCode?.(
-      error ? { ok: false, reason: `Resend returned "${error}".` } : code ? { ok: true, code, reason: state ?? void 0 } : { ok: false, reason: "Resend sent no authorization code." }
-    );
-  });
-  await new Promise((resolve3, reject) => {
-    server.once("error", reject);
-    server.listen(0, REDIRECT_HOST, resolve3);
+    if (!code || !expected || !sameState(state, expected)) {
+      res.writeHead(400, { "Content-Type": "text/html" });
+      res.end(page("Sign-in failed", "The redirect did not match this login attempt."));
+      rejectCode?.(new Error("State mismatch \u2014 ignoring the redirect"));
+      return;
+    }
+    res.writeHead(200, { "Content-Type": "text/html" });
+    res.end(page("You're signed in", "Close this tab and return to your terminal."));
+    resolveCode?.(code);
   });
-  const port = server.address().port;
-  const redirectUri = `http://${REDIRECT_HOST}:${port}${REDIRECT_PATH}`;
+  let bound = false;
+  let lastErr;
+  for (const port2 of CALLBACK_PORTS) {
+    try {
+      await new Promise((resolve3, reject) => {
+        server.once("error", reject);
+        server.listen(port2, "127.0.0.1", () => {
+          server.removeListener("error", reject);
+          resolve3();
+        });
+      });
+      bound = true;
+      break;
+    } catch (e) {
+      lastErr = e;
+    }
+  }
+  if (!bound) {
+    throw new Error(
+      `Could not bind a local callback port (tried ${CALLBACK_PORTS.filter(Boolean).join(", ")}): ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`
+    );
+  }
+  const { port } = server.address();
   return {
-    redirectUri,
-    close: () => server.close(),
-    waitForCode(state, timeoutMs) {
-      return new Promise((resolve3) => {
-        const done = (r) => {
-          clearTimeout(timer);
-          resolveCode = null;
-          server.close();
-          resolve3(r);
-        };
+    redirectUri: `http://localhost:${port}/callback`,
+    // `close()` alone only stops new connections; a keep-alive socket from the
+    // browser would hold the event loop open and the CLI would never exit.
+    waitForCode: (expectedState, timeoutMs) => {
+      expected = expectedState;
+      return new Promise((resolve3, reject) => {
         const timer = setTimeout(
-          () => done({ ok: false, reason: "Timed out waiting for the browser." }),
+          () => reject(new Error(`Timed out after ${Math.round(timeoutMs / 1e3)}s waiting for the browser`)),
           timeoutMs
         );
-        resolveCode = (r) => {
-          if (r.ok && r.reason !== state) {
-            done({ ok: false, reason: "The browser callback did not match this request." });
-            return;
-          }
-          done(r.ok ? { ok: true, code: r.code } : r);
+        resolveCode = (code) => {
+          clearTimeout(timer);
+          resolve3(code);
+        };
+        rejectCode = (err) => {
+          clearTimeout(timer);
+          reject(err);
         };
       });
+    },
+    close: () => {
+      server.closeAllConnections();
+      server.close();
     }
   };
 }
-function discoverResendKey(env) {
-  const key = env.RESEND_API_KEY?.trim();
-  if (!key || !looksResendKey(key)) return void 0;
-  return { apiKey: key, tier: "discovered" };
-}
-var MANUAL_STEPS = [
-  `Open ${RESEND_API_KEYS_URL} and create an API key.`,
-  `Give it Sending access, and restrict it to your sending domain if that domain is verified at ${RESEND_DOMAINS_URL}.`,
-  "Put the key in the storefront's .env.local as RESEND_API_KEY.",
-  "Re-run `carrier site deploy` \u2014 the key is pushed to the deploy target automatically."
-];
-async function provisionResend(opts) {
-  const { deps } = opts;
-  const notes = [];
-  const discovered = discoverResendKey(opts.env);
-  if (discovered) {
-    const check = await validateResendKey(deps.fetch, discovered.apiKey);
-    if (check.ok) return { ok: true, tier: "discovered", credentials: discovered };
-    notes.push(`A RESEND_API_KEY was already set but did not work: ${check.reason}`);
-  }
-  if (!opts.noBrowser) {
-    const viaBrowser = await oauthTier(opts);
-    if (viaBrowser.ok) {
-      return { ...viaBrowser, reason: notes.length ? notes.join(" ") : void 0 };
-    }
-    notes.push(viaBrowser.reason ?? "The browser authorization did not complete.");
-  }
-  if (deps.promptForKey) {
-    await deps.openBrowser(RESEND_API_KEYS_URL);
-    const pasted = (await deps.promptForKey(RESEND_API_KEYS_URL))?.trim();
-    if (pasted) {
-      const check = await validateResendKey(deps.fetch, pasted);
-      if (check.ok) {
-        return {
-          ok: true,
-          tier: "paste",
-          credentials: { apiKey: pasted, tier: "paste" },
-          reason: notes.length ? notes.join(" ") : void 0
-        };
-      }
-      notes.push(check.reason ?? "The pasted key did not work.");
-    }
+async function postToken(meta, body) {
+  const res = await fetch(meta.token_endpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: new URLSearchParams(body).toString()
+  });
+  const json = await res.json().catch(() => ({}));
+  if (!res.ok || json.error) {
+    throw new Error(json.error_description || json.error || `Token endpoint returned ${res.status}`);
   }
-  return { ok: false, tier: "manual", reason: notes.join(" "), guidance: MANUAL_STEPS };
+  if (!json.access_token) throw new Error("Token endpoint returned no access_token");
+  return json;
 }
-async function oauthTier(opts) {
-  const { deps } = opts;
-  let server;
-  try {
-    server = await deps.startLoopback();
-  } catch (e) {
-    return {
-      ok: false,
-      tier: "oauth",
-      reason: `Could not open a local callback listener: ${e instanceof Error ? e.message : String(e)}`
-    };
-  }
+function store(meta, token, clientId) {
+  return {
+    issuer: meta.issuer,
+    accessToken: token.access_token,
+    refreshToken: token.refresh_token,
+    expiresAt: Date.now() + (token.expires_in ?? 900) * 1e3,
+    scope: token.scope,
+    clientId
+  };
+}
+async function login(opts) {
+  const meta = await discover();
+  const server = await startCallbackServer();
   try {
-    const registered = await registerOauthClient(deps.fetch);
-    if (!registered.ok) return { ok: false, tier: "oauth", reason: registered.reason };
+    const existing = await readCredentials();
+    const clientId = existing?.clientId && existing.issuer === meta.issuer ? existing.clientId : await registerClient(meta, server.redirectUri);
     const { verifier, challenge } = pkcePair();
-    const state = base64url(randomBytes(24));
-    const authorizeUrl = buildAuthorizeUrl({
-      clientId: registered.clientId,
-      redirectUri: server.redirectUri,
-      state,
-      challenge
-    });
-    const opened = await deps.openBrowser(authorizeUrl);
-    deps.notify(
-      opened.ok ? "Approve the connection in your browser \u2014 this waits for you." : `Open this to approve the connection:
-  ${authorizeUrl}`
-    );
-    const callback = await server.waitForCode(state, opts.timeoutMs ?? 18e4);
-    if (!callback.ok || !callback.code) {
-      return { ok: false, tier: "oauth", reason: callback.reason ?? "No authorization code." };
-    }
-    const token = await exchangeCode(deps.fetch, {
-      clientId: registered.clientId,
-      code: callback.code,
-      redirectUri: server.redirectUri,
-      verifier
-    });
-    if (!token.ok) return { ok: false, tier: "oauth", reason: token.reason };
-    const domainId = opts.domain ? await findVerifiedDomainId(deps.fetch, token.accessToken, opts.domain) : void 0;
-    const created = await createSendingKey(deps.fetch, token.accessToken, {
-      name: `${opts.name} storefront`,
-      domainId
+    const state = base64url(randomBytes(16));
+    const authUrl = new URL(meta.authorization_endpoint);
+    authUrl.searchParams.set("response_type", "code");
+    authUrl.searchParams.set("client_id", clientId);
+    authUrl.searchParams.set("redirect_uri", server.redirectUri);
+    authUrl.searchParams.set("scope", pickScope(meta));
+    authUrl.searchParams.set("state", state);
+    authUrl.searchParams.set("code_challenge", challenge);
+    authUrl.searchParams.set("code_challenge_method", "S256");
+    const pendingCode = server.waitForCode(state, opts.timeoutMs ?? 3e5);
+    pendingCode.catch(() => void 0);
+    opts.onUrl?.(authUrl.toString());
+    await opts.openBrowser(authUrl.toString());
+    const code = await pendingCode;
+    const token = await postToken(meta, {
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: server.redirectUri,
+      client_id: clientId,
+      code_verifier: verifier
     });
-    if (token.refreshToken) {
-      await revokeGrant(deps.fetch, {
-        clientId: registered.clientId,
-        refreshToken: token.refreshToken
-      });
-    }
-    if (!created.ok) return { ok: false, tier: "oauth", reason: created.reason };
-    const check = await validateResendKey(deps.fetch, created.token);
-    if (!check.ok) {
-      return { ok: false, tier: "oauth", reason: `Resend minted a key that it then rejected: ${check.reason}` };
-    }
-    return {
-      ok: true,
-      tier: "oauth",
-      credentials: {
-        apiKey: created.token,
-        tier: "oauth",
-        keyId: created.id,
-        domain: domainId ? opts.domain : void 0
-      }
-    };
+    await writeCredentials(store(meta, token, clientId));
+    return { ok: true, message: "Signed in.", scope: token.scope };
   } finally {
     server.close();
   }
 }
-
-// src/cli/lib/dash.ts
-var DASH_DOMAINS = [
-  "fleet",
-  "subscribers",
-  "usage",
-  "packages",
-  "billing",
-  "wallet",
-  "greenzone",
-  "storefront"
-];
-function isDashDomain(value) {
-  return DASH_DOMAINS.includes(value);
+function pickScope(meta) {
+  const supported = meta.scopes_supported ?? [];
+  if (!supported.length) return DEFAULT_SCOPE;
+  return DEFAULT_SCOPE.split(" ").filter((s) => supported.includes(s)).join(" ") || supported[0];
 }
-var DASH_TOOL = {
-  fleet: "fleet_health_app",
-  subscribers: "list_subscribers",
-  usage: "subscriber_usage",
-  packages: "list_package_templates",
-  billing: "billing_events",
-  wallet: "wallet_balance",
-  greenzone: "greenzone_whitelist_list",
-  storefront: ""
-};
-function screenFromStructured(structured) {
-  const rec = structured;
-  const screen = rec?.screen;
-  if (screen && typeof screen === "object" && Array.isArray(screen.sections) && screen.title) {
-    return screen;
+async function getAccessToken() {
+  const creds = await readCredentials();
+  if (!creds) return null;
+  if (!isExpired(creds)) return creds.accessToken;
+  if (!creds.refreshToken || !creds.clientId) return null;
+  try {
+    const meta = await discover();
+    const token = await postToken(meta, {
+      grant_type: "refresh_token",
+      refresh_token: creds.refreshToken,
+      client_id: creds.clientId
+    });
+    const next = store(meta, token, creds.clientId);
+    if (!next.refreshToken) next.refreshToken = creds.refreshToken;
+    await writeCredentials(next);
+    return next.accessToken;
+  } catch {
+    return null;
   }
-  return void 0;
 }
-var num = (value, fallback = 0) => {
-  const n = Number(value);
-  return Number.isFinite(n) ? n : fallback;
-};
-var str = (value, fallback = "") => value === void 0 || value === null ? fallback : String(value);
-function rows(payload, keys) {
-  if (Array.isArray(payload)) return payload;
-  const rec = payload ?? {};
-  for (const key of keys) {
-    const candidate = rec[key];
-    if (Array.isArray(candidate)) return candidate;
-  }
-  return [];
+async function logout() {
+  await clearCredentials();
 }
-function buildDashScreen(domain, payload) {
-  switch (domain) {
-    case "fleet": {
-      const accounts = rows(payload, ["accounts", "account"]);
-      return fleetScreen({
-        active: num(payload?.active),
-        suspended: num(payload?.suspended),
-        inventory: num(payload?.inventory),
-        other: num(payload?.other),
-        accounts: accounts.map((a) => ({
-          name: str(a.name ?? a.accountId, "?"),
-          balance: num(a.balance),
-          active: num(a.active),
-          suspended: num(a.suspended),
-          inventory: num(a.inventory),
-          other: num(a.other),
-          packageOnly: Boolean(a.packageOnly)
-        }))
-      });
-    }
-    case "subscribers":
-      return subscribersScreen(
-        rows(payload, ["subscribers", "subscriber", "data"]).map((s) => ({
-          iccid: str(s.iccid ?? s.ICCID, "?"),
-          msisdn: s.msisdn ? str(s.msisdn) : void 0,
-          status: str(s.status ?? s.statusStr, "unknown"),
-          account: s.accountName ? str(s.accountName) : void 0,
-          dataUsedBytes: s.dataUsed === void 0 ? void 0 : num(s.dataUsed)
-        }))
-      );
-    case "usage":
-      return usageScreen({
-        subject: str(payload?.subject, "Subscriber"),
-        timeline: rows(payload, ["timeline", "days", "usage"]).map((p4) => ({
-          date: str(p4.date ?? p4.day, "?"),
-          bytes: num(p4.bytes ?? p4.dataUsed)
-        })),
-        countries: rows(payload, ["countries"]).map((c) => ({
-          country: str(c.country ?? c.countryName, "?"),
-          bytes: num(c.bytes ?? c.dataUsed)
-        }))
-      });
-    case "packages":
-      return packagesScreen(
-        rows(payload, ["template", "templates", "data"]).map((t) => ({
-          name: str(t.prepaidpackagetemplatename ?? t.name, "?"),
-          id: str(t.prepaidpackagetemplateid ?? t.id, "?"),
-          dataLimitBytes: t.databyte === void 0 ? void 0 : num(t.databyte),
-          validityDays: t.perioddays === void 0 ? void 0 : num(t.perioddays),
-          price: t.cost === void 0 ? void 0 : num(t.cost),
-          recurring: Boolean(t.recurring)
-        }))
-      );
-    case "billing":
-      return billingScreen({
-        balance: payload?.balance === void 0 ? void 0 : num(payload.balance),
-        currency: str(payload?.currency, ""),
-        events: rows(payload, ["events", "data"]).map((e) => ({
-          date: str(e.date ?? e.timestamp, "?"),
-          description: str(e.description ?? e.type, "\u2014"),
-          amount: num(e.amount)
-        }))
-      });
-    case "wallet": {
-      const p4 = payload ?? {};
-      const eur = (value) => value === void 0 || value === null ? void 0 : num(value) / 100;
-      return walletScreen({
-        balance: eur(p4.balance_eur_cents ?? p4.balance) ?? 0,
-        currency: str(p4.currency, "\u20AC"),
-        autoTopupEnabled: Boolean(p4.autoTopupEnabled ?? p4.auto_topup_enabled),
-        threshold: eur(p4.auto_topup_threshold_cents ?? p4.threshold),
-        credits: p4.credits === void 0 || p4.credits === null ? void 0 : num(p4.credits)
-      });
-    }
-    case "greenzone":
-      return greenzoneScreen(
-        rows(payload, ["entries", "whitelist", "data"]).map((e) => ({
-          value: str(e.value ?? e.prefix ?? e.destination, "?"),
-          note: e.note ? str(e.note) : void 0
-        }))
-      );
-    case "storefront": {
-      const p4 = payload ?? {};
-      return storefrontScreen({
-        brand: str(p4.brand ?? p4.project, "storefront"),
-        url: p4.url ? str(p4.url) : void 0,
-        target: p4.target ? str(p4.target) : void 0,
-        verified: p4.verified === void 0 ? null : Boolean(p4.verified),
-        diagnosis: p4.diagnosis ? str(p4.diagnosis) : void 0,
-        secretsStaged: Array.isArray(p4.secrets_staged) ? p4.secrets_staged : void 0,
-        plans: p4.plans === void 0 ? void 0 : num(p4.plans)
-      });
-    }
-  }
+
+// src/cli/lib/guidance.ts
+import pc from "picocolors";
+var FLEET_NL_EXAMPLES = [
+  { label: "Fleet health", prompt: "Show my fleet health \u2014 accounts, eSIMs, low-balance alerts" },
+  { label: "Subscriber lookup", prompt: "Look up subscriber ICCID 8944\u2026 and diagnose connectivity" },
+  { label: "Usage anomalies", prompt: "Detect usage anomalies and burn-rate risks this week" },
+  { label: "Issue from inventory", prompt: "Issue 3 free eSIMs from inventory on my account and assign the starter package" },
+  { label: "Billing check", prompt: "What's my platform credit balance and Stripe Connect payout status?" },
+  { label: "Wallet balance", prompt: "What's my managed prepaid wallet balance and auto-top-up status?" },
+  { label: "Churn risk", prompt: "List high churn-risk subscribers with retention ideas" }
+];
+function oauthFirstUseNote() {
+  return [
+    "Entry A \u2014 zero credentials up front",
+    `  MCP URL:  ${MCP_URL}`,
+    "  Auth:     OAuth on first use (Clerk \u2014 Google, GitHub, or email)",
+    "  Token:    none required in Claude / Cursor / Windsurf",
+    "",
+    "When you first talk to Carrier in your MCP client, the browser opens",
+    "sign-in/sign-up. After authorize, tools work. Headless? Use an org API key",
+    `(ak_\u2026) from ${CONSOLE_URL} \u2192 Settings \u2192 API Keys.`
+  ].join("\n");
+}
+function formatStatusBlock(st) {
+  const yn = (ok2, yes = "yes", no = "no") => ok2 ? pc.green(yes) : pc.yellow(no);
+  const authLabel = st.authMode === "oauth-first-use" ? pc.cyan("OAuth on first use (no token needed)") : st.authMode === "api-key" ? pc.green("org API key in env (CARRIER_API_KEY)") : st.authMode === "ocs-token" ? pc.green("OCS token in env") : pc.yellow("not ready \u2014 install MCP or open sign-up");
+  return [
+    `Claude Code:   ${yn(st.claudeFound, "found", "not on PATH")}`,
+    `Plugin:        ${st.pluginInstalled ? pc.green(`installed v${st.pluginVersion ?? "?"}`) : pc.yellow("not installed")}`,
+    `MCP registered:${st.mcpRegistered ? pc.green(" yes") : pc.yellow(" no")}${st.mcpDetail ? pc.dim(`  (${st.mcpDetail})`) : ""}`,
+    `MCP URL:       ${st.mcpUrlMatches ? pc.green(MCP_URL) : pc.yellow("not production / missing")}`,
+    `Auth path:     ${authLabel}`,
+    `Headless token:${st.tokenPresent ? pc.green(` ${st.tokenKind}`) : pc.dim(" none (optional)")}`
+  ].join("\n");
+}
+function formatNextSteps(st) {
+  return st.nextSteps.map((s, i) => `  ${i + 1}. ${s}`).join("\n");
+}
+function formatNlExamples() {
+  return FLEET_NL_EXAMPLES.map((e) => `  \u2022 ${pc.bold(e.label)}: "${e.prompt}"`).join("\n");
+}
+function accountLinksNote() {
+  return [
+    `Sign up:     ${SIGN_UP_URL}`,
+    `Sign in:     ${SIGN_IN_URL}`,
+    `Console:     ${CONSOLE_URL}`,
+    `Onboarding:  ${ONBOARDING_URL}`,
+    `MCP home:    https://mcp.carrier.llc`
+  ].join("\n");
+}
+function withNextStep(errorMsg, next) {
+  return [errorMsg, "", "What to do next:", ...next.map((s) => `  \u2192 ${s}`)].join("\n");
 }
 
 // src/cli/lib/status.ts
-import { homedir as homedir2 } from "os";
-import { join as join5 } from "path";
+import { homedir as homedir3 } from "os";
+import { join as join6 } from "path";
 
 // src/cli/lib/mcp-url.ts
 var PRODUCTION_MCP_URL = "https://mcp.carrier.llc/mcp";
@@ -823,10 +973,10 @@ function scanMcpServers(servers) {
 }
 async function probeMcpFromConfig() {
   const candidates = [
-    join5(homedir2(), ".claude.json"),
-    join5(claudeHome(), "settings.json"),
-    join5(claudeHome(), ".mcp.json"),
-    join5(process.cwd(), ".mcp.json")
+    join6(homedir3(), ".claude.json"),
+    join6(claudeHome(), "settings.json"),
+    join6(claudeHome(), ".mcp.json"),
+    join6(process.cwd(), ".mcp.json")
   ];
   let best = null;
   let configSeen = false;
@@ -952,569 +1102,1038 @@ function resolveCliToken() {
   return ocs || null;
 }
 
-// src/cli/lib/guidance.ts
-import pc from "picocolors";
-var FLEET_NL_EXAMPLES = [
-  { label: "Fleet health", prompt: "Show my fleet health \u2014 accounts, eSIMs, low-balance alerts" },
-  { label: "Subscriber lookup", prompt: "Look up subscriber ICCID 8944\u2026 and diagnose connectivity" },
-  { label: "Usage anomalies", prompt: "Detect usage anomalies and burn-rate risks this week" },
-  { label: "Issue from inventory", prompt: "Issue 3 free eSIMs from inventory on my account and assign the starter package" },
-  { label: "Billing check", prompt: "What's my platform credit balance and Stripe Connect payout status?" },
-  { label: "Wallet balance", prompt: "What's my managed prepaid wallet balance and auto-top-up status?" },
-  { label: "Churn risk", prompt: "List high churn-risk subscribers with retention ideas" }
+// src/cli/lib/ask.ts
+var DEFAULT_ERROR_HINTS = [
+  "Re-check the arguments: carrier <domain> <command> --help",
+  "Or open Claude and ask there with full tool routing"
 ];
-function oauthFirstUseNote() {
-  return [
-    "Entry A \u2014 zero credentials up front",
-    `  MCP URL:  ${MCP_URL}`,
-    "  Auth:     OAuth on first use (Clerk \u2014 Google, GitHub, or email)",
-    "  Token:    none required in Claude / Cursor / Windsurf",
-    "",
-    "When you first talk to Carrier in your MCP client, the browser opens",
-    "sign-in/sign-up. After authorize, tools work. Headless? Use an org API key",
-    `(ak_\u2026) from ${CONSOLE_URL} \u2192 Settings \u2192 API Keys.`
-  ].join("\n");
-}
-function formatStatusBlock(st) {
-  const yn = (ok2, yes = "yes", no = "no") => ok2 ? pc.green(yes) : pc.yellow(no);
-  const authLabel = st.authMode === "oauth-first-use" ? pc.cyan("OAuth on first use (no token needed)") : st.authMode === "api-key" ? pc.green("org API key in env (CARRIER_API_KEY)") : st.authMode === "ocs-token" ? pc.green("OCS token in env") : pc.yellow("not ready \u2014 install MCP or open sign-up");
-  return [
-    `Claude Code:   ${yn(st.claudeFound, "found", "not on PATH")}`,
-    `Plugin:        ${st.pluginInstalled ? pc.green(`installed v${st.pluginVersion ?? "?"}`) : pc.yellow("not installed")}`,
-    `MCP registered:${st.mcpRegistered ? pc.green(" yes") : pc.yellow(" no")}${st.mcpDetail ? pc.dim(`  (${st.mcpDetail})`) : ""}`,
-    `MCP URL:       ${st.mcpUrlMatches ? pc.green(MCP_URL) : pc.yellow("not production / missing")}`,
-    `Auth path:     ${authLabel}`,
-    `Headless token:${st.tokenPresent ? pc.green(` ${st.tokenKind}`) : pc.dim(" none (optional)")}`
-  ].join("\n");
+var DEFAULT_MCP_TIMEOUT_MS = 45e3;
+function mcpTimeoutMs() {
+  const parsed = Number(process.env.CARRIER_MCP_TIMEOUT_MS);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_MCP_TIMEOUT_MS;
 }
-function formatNextSteps(st) {
-  return st.nextSteps.map((s, i) => `  ${i + 1}. ${s}`).join("\n");
-}
-function formatNlExamples() {
-  return FLEET_NL_EXAMPLES.map((e) => `  \u2022 ${pc.bold(e.label)}: "${e.prompt}"`).join("\n");
-}
-function accountLinksNote() {
-  return [
-    `Sign up:     ${SIGN_UP_URL}`,
-    `Sign in:     ${SIGN_IN_URL}`,
-    `Console:     ${CONSOLE_URL}`,
-    `Onboarding:  ${ONBOARDING_URL}`,
-    `MCP home:    https://mcp.carrier.llc`
-  ].join("\n");
-}
-function withNextStep(errorMsg, next) {
-  return [errorMsg, "", "What to do next:", ...next.map((s) => `  \u2192 ${s}`)].join("\n");
+var McpTimeoutError = class extends Error {
+  constructor(timeoutMs) {
+    super(`timed out after ${Math.round(timeoutMs / 1e3)}s`);
+    this.timeoutMs = timeoutMs;
+    this.name = "McpTimeoutError";
+  }
+  timeoutMs;
+};
+function isTimeoutish(err) {
+  return err instanceof McpTimeoutError || err instanceof Error && (err.name === "AbortError" || err.name === "TimeoutError");
 }
-
-// src/cli/lib/home.ts
-import * as p from "@clack/prompts";
-import pc2 from "picocolors";
-
-// src/cli/lib/auth.ts
-import { createHash as createHash2, randomBytes as randomBytes2, timingSafeEqual } from "crypto";
-import { createServer as createServer2 } from "http";
-
-// src/cli/lib/credentials.ts
-import { homedir as homedir3 } from "os";
-import { join as join6 } from "path";
-import { chmod, mkdir as mkdir2, readFile as readFile2, rm, writeFile as writeFile3 } from "fs/promises";
-function carrierHome() {
-  return process.env.CARRIER_HOME?.trim() || join6(homedir3(), ".carrier");
+function parseRpcBody(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) return {};
+  if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+    return JSON.parse(trimmed);
+  }
+  const dataLine = trimmed.split("\n").map((l) => l.trim()).find((l) => l.startsWith("data:"));
+  if (!dataLine) return {};
+  return JSON.parse(dataLine.slice(5).trim());
 }
-function credentialsPath() {
-  return join6(carrierHome(), "credentials.json");
+async function callMcpTool(tool, args, opts = {}) {
+  const token = resolveCliToken() ?? await getAccessToken();
+  if (!token) {
+    return {
+      ok: false,
+      text: withNextStep("Not signed in.", [
+        "Sign in from this terminal: carrier login",
+        "No account yet? carrier open signup",
+        "Headless/CI instead: export CARRIER_API_KEY=ak_\u2026 from Console \u2192 Settings \u2192 API Keys"
+      ])
+    };
+  }
+  const headers = {
+    Authorization: `Bearer ${token}`,
+    "Content-Type": "application/json",
+    Accept: "application/json, text/event-stream"
+  };
+  const timeoutMs = mcpTimeoutMs();
+  const controller = new AbortController();
+  let deadlineTimer;
+  const deadline = new Promise((_resolve, reject) => {
+    deadlineTimer = setTimeout(() => {
+      controller.abort();
+      reject(new McpTimeoutError(timeoutMs));
+    }, timeoutMs);
+  });
+  const signal = controller.signal;
+  try {
+    return await Promise.race([
+      (async () => {
+        const initRes = await fetch(MCP_URL, {
+          method: "POST",
+          headers,
+          signal,
+          body: JSON.stringify({
+            jsonrpc: "2.0",
+            id: 1,
+            method: "initialize",
+            params: {
+              protocolVersion: "2024-11-05",
+              capabilities: {},
+              clientInfo: { name: "carrier-cli", version: CARRIER_VERSION }
+            }
+          })
+        });
+        if (initRes.status === 401 || initRes.status === 403) {
+          return {
+            ok: false,
+            text: withNextStep(`MCP returned ${initRes.status} (auth rejected).`, [
+              "Confirm CARRIER_API_KEY is a valid org key (ak_\u2026) from app.carrier.llc",
+              "Or complete OCS onboarding: https://app.carrier.llc/onboarding",
+              "Interactive: use Claude + OAuth instead of a headless key"
+            ])
+          };
+        }
+        const sessionId = initRes.headers.get("mcp-session-id") ?? initRes.headers.get("Mcp-Session-Id");
+        await initRes.arrayBuffer().catch(() => void 0);
+        if (!sessionId) {
+          return {
+            ok: false,
+            text: withNextStep("MCP initialize did not return a session id.", [
+              "Check network access to https://mcp.carrier.llc/mcp",
+              "Retry later, or use Claude with the registered MCP (OAuth path)"
+            ])
+          };
+        }
+        const sessionHeaders = { ...headers, "Mcp-Session-Id": sessionId };
+        await fetch(MCP_URL, {
+          method: "POST",
+          headers: sessionHeaders,
+          signal,
+          body: JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" })
+        }).catch(() => void 0);
+        const res = await fetch(MCP_URL, {
+          method: "POST",
+          headers: sessionHeaders,
+          signal,
+          body: JSON.stringify({
+            jsonrpc: "2.0",
+            id: 2,
+            method: "tools/call",
+            params: { name: tool, arguments: args }
+          })
+        });
+        if (!res.ok) {
+          const snippet = (await res.text().catch(() => "")).slice(0, 240);
+          return {
+            ok: false,
+            text: withNextStep(`MCP call failed (${res.status}). ${snippet}`, [
+              "Check network access to https://mcp.carrier.llc/mcp",
+              "Retry later, or use Claude with the registered MCP (OAuth path)"
+            ])
+          };
+        }
+        const json = parseRpcBody(await res.text());
+        if (json.error?.message) {
+          return {
+            ok: false,
+            text: withNextStep(json.error.message, opts.errorHints ?? DEFAULT_ERROR_HINTS)
+          };
+        }
+        const parts = json.result?.content ?? [];
+        const text3 = parts.map((p4) => p4.text).filter(Boolean).join("\n").trim() || JSON.stringify(json.result ?? json, null, 2);
+        return {
+          ok: !json.result?.isError,
+          text: text3,
+          structured: json.result?.structuredContent
+        };
+      })(),
+      deadline
+    ]);
+  } catch (e) {
+    if (isTimeoutish(e)) {
+      const secs = Math.round(timeoutMs / 1e3);
+      return {
+        ok: false,
+        text: withNextStep(
+          `MCP call to ${tool} timed out after ${secs}s (no response).`,
+          [
+            "The tool is likely returning more data than the MCP transport can deliver \u2014 see issue #663",
+            "Narrow the request (a specific --account-id / --iccid returns far less than a whole-fleet call)",
+            `Raise the deadline for one slow call: CARRIER_MCP_TIMEOUT_MS=${timeoutMs * 2} carrier \u2026`,
+            "Confirm the service is up: check network access to https://mcp.carrier.llc/mcp",
+            "Or open Claude and ask there with full tool routing"
+          ]
+        )
+      };
+    }
+    const msg = e instanceof Error ? e.message : String(e);
+    return {
+      ok: false,
+      text: withNextStep(`Could not reach MCP: ${msg}`, [
+        "Verify outbound HTTPS to mcp.carrier.llc",
+        "Use the interactive Claude path while offline from this machine"
+      ])
+    };
+  } finally {
+    if (deadlineTimer !== void 0) clearTimeout(deadlineTimer);
+  }
 }
-async function readCredentials() {
+var ASK_ERROR_HINTS = [
+  "Rephrase the intent more specifically (include ICCID / MSISDN if relevant)",
+  "Or use a discrete command: carrier --help lists every domain"
+];
+function parseRouting(text3) {
+  const trimmed = text3.trim();
+  if (!trimmed.startsWith("{")) return void 0;
   try {
-    const raw = await readFile2(credentialsPath(), "utf8");
-    const parsed = JSON.parse(raw);
-    if (!parsed?.accessToken || typeof parsed.accessToken !== "string") return null;
-    return parsed;
+    const parsed = JSON.parse(trimmed);
+    if (!parsed || typeof parsed !== "object") return void 0;
+    const routes = typeof parsed.resolved_tool === "string" && parsed.resolved_tool;
+    const asksBack = typeof parsed.clarifying_question === "string" || Array.isArray(parsed.candidates);
+    return routes || asksBack ? parsed : void 0;
   } catch {
-    return null;
+    return void 0;
   }
 }
-async function writeCredentials(creds) {
-  const dir = carrierHome();
-  await mkdir2(dir, { recursive: true, mode: 448 });
-  await chmod(dir, 448).catch(() => void 0);
-  const file = credentialsPath();
-  await writeFile3(file, `${JSON.stringify(creds, null, 2)}
-`, { mode: 384 });
-  await chmod(file, 384).catch(() => void 0);
-}
-async function clearCredentials() {
-  await rm(credentialsPath(), { force: true });
-}
-function isExpired(creds, skewMs = 6e4) {
-  if (!creds.expiresAt) return false;
-  return Date.now() >= creds.expiresAt - skewMs;
-}
-function redact(text3) {
-  return text3.replace(/\b(ak_|sk_|rt_)[A-Za-z0-9._-]{6,}/g, "$1***").replace(/\bBearer\s+[A-Za-z0-9._-]{8,}/gi, "Bearer ***");
-}
-
-// src/cli/lib/auth.ts
-var DISCOVERY_PATH = "/.well-known/oauth-authorization-server";
-var CLIENT_NAME2 = "Carrier CLI";
-var DEFAULT_SCOPE = "read write";
-var CALLBACK_PORTS = [3118, 3119, 8976, 8977, 0];
-async function discover(base = MCP_HOME) {
-  const res = await fetch(`${base}${DISCOVERY_PATH}`, {
-    headers: { Accept: "application/json" }
-  });
-  if (!res.ok) throw new Error(`OAuth discovery failed (${res.status}) at ${base}${DISCOVERY_PATH}`);
-  const meta = await res.json();
-  if (!meta.authorization_endpoint || !meta.token_endpoint) {
-    throw new Error("OAuth discovery returned no authorization or token endpoint");
+async function carrierAsk(intent) {
+  const routed = await callMcpTool("carrier_ask", { intent }, { errorHints: ASK_ERROR_HINTS });
+  if (!routed.ok) return routed;
+  const routing = parseRouting(routed.text);
+  if (!routing) return routed;
+  if (!routing.resolved_tool) {
+    const candidates = (routing.candidates ?? []).map((c) => c.tool ? `Candidate: ${c.tool}${c.reason ? ` \u2014 ${c.reason}` : ""}` : void 0).filter((s) => Boolean(s));
+    return {
+      ok: false,
+      text: withNextStep(routing.clarifying_question?.trim() || "Carrier could not tell which tool you meant.", [
+        ...candidates,
+        ...ASK_ERROR_HINTS
+      ])
+    };
   }
-  return meta;
-}
-function base64url2(buf) {
-  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function pkcePair2() {
-  const verifier = base64url2(randomBytes2(32));
-  const challenge = base64url2(createHash2("sha256").update(verifier).digest());
-  return { verifier, challenge };
-}
-function sameState(a, b) {
-  const left = Buffer.from(a);
-  const right = Buffer.from(b);
-  if (left.length !== right.length) return false;
-  return timingSafeEqual(left, right);
-}
-async function registerClient(meta, redirectUri) {
-  if (!meta.registration_endpoint) {
-    throw new Error("This server does not support dynamic client registration");
+  const tool = routing.resolved_tool;
+  const args = routing.resolved_params ?? {};
+  if (routing.match && routing.match !== "confirmed") {
+    return {
+      ok: false,
+      text: withNextStep(`Carrier could not confirm what you meant (match: ${routing.match}).`, [
+        `Closest tool: ${tool}`,
+        ...ASK_ERROR_HINTS
+      ])
+    };
   }
-  const res = await fetch(meta.registration_endpoint, {
-    method: "POST",
-    headers: { "Content-Type": "application/json", Accept: "application/json" },
-    body: JSON.stringify({
-      client_name: CLIENT_NAME2,
-      redirect_uris: [redirectUri],
-      grant_types: ["authorization_code", "refresh_token"],
-      response_types: ["code"],
-      // Installed apps cannot keep a secret; register as a public client.
-      token_endpoint_auth_method: "none",
-      application_type: "native"
-    })
-  });
-  if (!res.ok) {
-    const body = (await res.text().catch(() => "")).slice(0, 200);
-    throw new Error(`Client registration failed (${res.status}). ${body}`);
+  if (routing.confirm_required) {
+    return {
+      ok: false,
+      text: withNextStep(`"${intent}" resolves to ${tool}, which changes live service or billing.`, [
+        `Params: ${JSON.stringify(args)}`,
+        "Run the matching discrete command so every flag is explicit and reviewable",
+        "carrier --help lists every domain"
+      ])
+    };
   }
-  const json = await res.json();
-  if (!json.client_id) throw new Error("Client registration returned no client_id");
-  return json.client_id;
+  return callMcpTool(tool, args, { errorHints: ASK_ERROR_HINTS });
 }
-function escapeHtml(text3) {
-  return text3.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+
+// src/cli/lib/rest.ts
+var DEFAULT_ERROR_HINTS2 = [
+  "Re-check the arguments: carrier <domain> <command> --help",
+  "Or open Claude and ask there with full tool routing"
+];
+function resolveApiKey() {
+  return process.env.CARRIER_API_KEY?.trim() || process.env.CARRIER_ORG_API_KEY?.trim() || null;
 }
-function page(title, detail) {
-  const safeTitle = escapeHtml(title);
-  const safeDetail = escapeHtml(detail);
-  return `<!doctype html><meta charset="utf-8"><title>${safeTitle}</title>
-<body style="font-family:system-ui,sans-serif;max-width:32rem;margin:20vh auto;text-align:center">
-<h1 style="font-size:1.25rem">${safeTitle}</h1><p style="color:#555">${safeDetail}</p></body>`;
+function ocsTokenOnly() {
+  return Boolean(
+    process.env.ESIMVAULT_API_TOKEN?.trim() || process.env.CARRIER_OCS_API_TOKEN?.trim()
+  );
 }
-async function startCallbackServer() {
-  let resolveCode;
-  let rejectCode;
-  let expected = "";
-  const server = createServer2((req, res) => {
-    const url = new URL(req.url ?? "/", "http://127.0.0.1");
-    if (url.pathname !== "/callback") {
-      res.writeHead(404).end();
-      return;
-    }
-    const err = url.searchParams.get("error");
-    const code = url.searchParams.get("code");
-    const state = url.searchParams.get("state") ?? "";
-    if (err) {
-      res.writeHead(400, { "Content-Type": "text/html" });
-      res.end(page("Sign-in failed", err));
-      rejectCode?.(new Error(`Authorization server returned "${err}"`));
-      return;
-    }
-    if (!code || !expected || !sameState(state, expected)) {
-      res.writeHead(400, { "Content-Type": "text/html" });
-      res.end(page("Sign-in failed", "The redirect did not match this login attempt."));
-      rejectCode?.(new Error("State mismatch \u2014 ignoring the redirect"));
-      return;
-    }
-    res.writeHead(200, { "Content-Type": "text/html" });
-    res.end(page("You're signed in", "Close this tab and return to your terminal."));
-    resolveCode?.(code);
-  });
-  let bound = false;
-  let lastErr;
-  for (const port2 of CALLBACK_PORTS) {
-    try {
-      await new Promise((resolve3, reject) => {
-        server.once("error", reject);
-        server.listen(port2, "127.0.0.1", () => {
-          server.removeListener("error", reject);
-          resolve3();
-        });
-      });
-      bound = true;
-      break;
-    } catch (e) {
-      lastErr = e;
-    }
-  }
-  if (!bound) {
-    throw new Error(
-      `Could not bind a local callback port (tried ${CALLBACK_PORTS.filter(Boolean).join(", ")}): ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`
-    );
-  }
-  const { port } = server.address();
-  return {
-    redirectUri: `http://localhost:${port}/callback`,
-    // `close()` alone only stops new connections; a keep-alive socket from the
-    // browser would hold the event loop open and the CLI would never exit.
-    waitForCode: (expectedState, timeoutMs) => {
-      expected = expectedState;
-      return new Promise((resolve3, reject) => {
-        const timer = setTimeout(
-          () => reject(new Error(`Timed out after ${Math.round(timeoutMs / 1e3)}s waiting for the browser`)),
-          timeoutMs
-        );
-        resolveCode = (code) => {
-          clearTimeout(timer);
-          resolve3(code);
-        };
-        rejectCode = (err) => {
-          clearTimeout(timer);
-          reject(err);
-        };
-      });
-    },
-    close: () => {
-      server.closeAllConnections();
-      server.close();
+function applyPath(path, args) {
+  const rest = { ...args };
+  const missing = [];
+  const filled = path.replace(/\{(\w+)\}/g, (_match, name) => {
+    const value = rest[name];
+    if (value === void 0 || value === null || value === "") {
+      missing.push(name);
+      return `{${name}}`;
     }
-  };
-}
-async function postToken(meta, body) {
-  const res = await fetch(meta.token_endpoint, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/x-www-form-urlencoded",
-      Accept: "application/json"
-    },
-    body: new URLSearchParams(body).toString()
+    delete rest[name];
+    return encodeURIComponent(String(value));
   });
-  const json = await res.json().catch(() => ({}));
-  if (!res.ok || json.error) {
-    throw new Error(json.error_description || json.error || `Token endpoint returned ${res.status}`);
-  }
-  if (!json.access_token) throw new Error("Token endpoint returned no access_token");
-  return json;
-}
-function store(meta, token, clientId) {
-  return {
-    issuer: meta.issuer,
-    accessToken: token.access_token,
-    refreshToken: token.refresh_token,
-    expiresAt: Date.now() + (token.expires_in ?? 900) * 1e3,
-    scope: token.scope,
-    clientId
-  };
+  return { path: filled, rest, missing };
 }
-async function login(opts) {
-  const meta = await discover();
-  const server = await startCallbackServer();
-  try {
-    const existing = await readCredentials();
-    const clientId = existing?.clientId && existing.issuer === meta.issuer ? existing.clientId : await registerClient(meta, server.redirectUri);
-    const { verifier, challenge } = pkcePair2();
-    const state = base64url2(randomBytes2(16));
-    const authUrl = new URL(meta.authorization_endpoint);
-    authUrl.searchParams.set("response_type", "code");
-    authUrl.searchParams.set("client_id", clientId);
-    authUrl.searchParams.set("redirect_uri", server.redirectUri);
-    authUrl.searchParams.set("scope", pickScope(meta));
-    authUrl.searchParams.set("state", state);
-    authUrl.searchParams.set("code_challenge", challenge);
-    authUrl.searchParams.set("code_challenge_method", "S256");
-    const pendingCode = server.waitForCode(state, opts.timeoutMs ?? 3e5);
-    pendingCode.catch(() => void 0);
-    opts.onUrl?.(authUrl.toString());
-    await opts.openBrowser(authUrl.toString());
-    const code = await pendingCode;
-    const token = await postToken(meta, {
-      grant_type: "authorization_code",
-      code,
-      redirect_uri: server.redirectUri,
-      client_id: clientId,
-      code_verifier: verifier
-    });
-    await writeCredentials(store(meta, token, clientId));
-    return { ok: true, message: "Signed in.", scope: token.scope };
-  } finally {
-    server.close();
+function queryString(args) {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(args)) {
+    if (value === void 0 || value === null) continue;
+    params.set(key, String(value));
   }
+  const qs = params.toString();
+  return qs ? `?${qs}` : "";
 }
-function pickScope(meta) {
-  const supported = meta.scopes_supported ?? [];
-  if (!supported.length) return DEFAULT_SCOPE;
-  return DEFAULT_SCOPE.split(" ").filter((s) => supported.includes(s)).join(" ") || supported[0];
-}
-async function getAccessToken() {
-  const creds = await readCredentials();
-  if (!creds) return null;
-  if (!isExpired(creds)) return creds.accessToken;
-  if (!creds.refreshToken || !creds.clientId) return null;
+function bodyText(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) return "";
   try {
-    const meta = await discover();
-    const token = await postToken(meta, {
-      grant_type: "refresh_token",
-      refresh_token: creds.refreshToken,
-      client_id: creds.clientId
-    });
-    const next = store(meta, token, creds.clientId);
-    if (!next.refreshToken) next.refreshToken = creds.refreshToken;
-    await writeCredentials(next);
-    return next.accessToken;
+    const parsed = JSON.parse(trimmed);
+    if (typeof parsed.error === "string") return parsed.error;
+    if (typeof parsed.message === "string") return parsed.message;
+    return trimmed;
   } catch {
-    return null;
+    return trimmed;
   }
 }
-async function logout() {
-  await clearCredentials();
-}
-
-// src/cli/lib/ask.ts
-var DEFAULT_ERROR_HINTS = [
-  "Re-check the arguments: carrier <domain> <command> --help",
-  "Or open Claude and ask there with full tool routing"
-];
-var DEFAULT_MCP_TIMEOUT_MS = 45e3;
-function mcpTimeoutMs() {
-  const parsed = Number(process.env.CARRIER_MCP_TIMEOUT_MS);
-  return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_MCP_TIMEOUT_MS;
-}
-var McpTimeoutError = class extends Error {
-  constructor(timeoutMs) {
-    super(`timed out after ${Math.round(timeoutMs / 1e3)}s`);
-    this.timeoutMs = timeoutMs;
-    this.name = "McpTimeoutError";
-  }
-  timeoutMs;
-};
-function isTimeoutish(err) {
-  return err instanceof McpTimeoutError || err instanceof Error && (err.name === "AbortError" || err.name === "TimeoutError");
-}
-function parseRpcBody(raw) {
-  const trimmed = raw.trim();
-  if (!trimmed) return {};
-  if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
-    return JSON.parse(trimmed);
-  }
-  const dataLine = trimmed.split("\n").map((l) => l.trim()).find((l) => l.startsWith("data:"));
-  if (!dataLine) return {};
-  return JSON.parse(dataLine.slice(5).trim());
-}
-async function callMcpTool(tool, args, opts = {}) {
-  const token = resolveCliToken() ?? await getAccessToken();
+async function callRestEndpoint(method, path, args, opts = {}) {
+  const token = resolveApiKey() ?? await getAccessToken();
   if (!token) {
     return {
       ok: false,
-      text: withNextStep("Not signed in.", [
-        "Sign in from this terminal: carrier login",
-        "No account yet? carrier open signup",
-        "Headless/CI instead: export CARRIER_API_KEY=ak_\u2026 from Console \u2192 Settings \u2192 API Keys"
+      text: withNextStep(
+        ocsTokenOnly() ? "Not signed in. An eSIMVault/OCS token is set, but the Carrier API only accepts Carrier credentials." : "Not signed in.",
+        [
+          "Sign in from this terminal: carrier login",
+          "No account yet? carrier open signup",
+          "Headless/CI instead: export CARRIER_API_KEY=ak_\u2026 from Console \u2192 Settings \u2192 API Keys"
+        ]
+      )
+    };
+  }
+  const { path: resolvedPath, rest, missing } = applyPath(path, args);
+  if (missing.length) {
+    return {
+      ok: false,
+      text: withNextStep(`Cannot build ${method} ${path}.`, [
+        `Missing path value(s): ${missing.join(", ")}`,
+        "See every flag: carrier <domain> <command> --help"
       ])
     };
   }
+  const sendsBody = method === "POST" || method === "PUT" || method === "PATCH";
+  const url = `${API_URL}${resolvedPath}${sendsBody ? "" : queryString(rest)}`;
   const headers = {
     Authorization: `Bearer ${token}`,
-    "Content-Type": "application/json",
-    Accept: "application/json, text/event-stream"
+    Accept: "application/json",
+    "User-Agent": `carrier-cli/${CARRIER_VERSION}`
   };
+  if (sendsBody) headers["Content-Type"] = "application/json";
+  if (opts.confirmToken) headers["X-Confirm-Token"] = opts.confirmToken;
+  if (opts.idempotencyKey) headers["Idempotency-Key"] = opts.idempotencyKey;
   const timeoutMs = mcpTimeoutMs();
   const controller = new AbortController();
-  let deadlineTimer;
-  const deadline = new Promise((_resolve, reject) => {
-    deadlineTimer = setTimeout(() => {
-      controller.abort();
-      reject(new McpTimeoutError(timeoutMs));
-    }, timeoutMs);
-  });
-  const signal = controller.signal;
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    return await Promise.race([
-      (async () => {
-        const initRes = await fetch(MCP_URL, {
-          method: "POST",
-          headers,
-          signal,
-          body: JSON.stringify({
-            jsonrpc: "2.0",
-            id: 1,
-            method: "initialize",
-            params: {
-              protocolVersion: "2024-11-05",
-              capabilities: {},
-              clientInfo: { name: "carrier-cli", version: CARRIER_VERSION }
-            }
-          })
-        });
-        if (initRes.status === 401 || initRes.status === 403) {
-          return {
-            ok: false,
-            text: withNextStep(`MCP returned ${initRes.status} (auth rejected).`, [
-              "Confirm CARRIER_API_KEY is a valid org key (ak_\u2026) from app.carrier.llc",
-              "Or complete OCS onboarding: https://app.carrier.llc/onboarding",
-              "Interactive: use Claude + OAuth instead of a headless key"
-            ])
-          };
-        }
-        const sessionId = initRes.headers.get("mcp-session-id") ?? initRes.headers.get("Mcp-Session-Id");
-        await initRes.arrayBuffer().catch(() => void 0);
-        if (!sessionId) {
-          return {
-            ok: false,
-            text: withNextStep("MCP initialize did not return a session id.", [
-              "Check network access to https://mcp.carrier.llc/mcp",
-              "Retry later, or use Claude with the registered MCP (OAuth path)"
-            ])
-          };
-        }
-        const sessionHeaders = { ...headers, "Mcp-Session-Id": sessionId };
-        await fetch(MCP_URL, {
-          method: "POST",
-          headers: sessionHeaders,
-          signal,
-          body: JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" })
-        }).catch(() => void 0);
-        const res = await fetch(MCP_URL, {
-          method: "POST",
-          headers: sessionHeaders,
-          signal,
-          body: JSON.stringify({
-            jsonrpc: "2.0",
-            id: 2,
-            method: "tools/call",
-            params: { name: tool, arguments: args }
-          })
-        });
-        if (!res.ok) {
-          const snippet = (await res.text().catch(() => "")).slice(0, 240);
-          return {
-            ok: false,
-            text: withNextStep(`MCP call failed (${res.status}). ${snippet}`, [
-              "Check network access to https://mcp.carrier.llc/mcp",
-              "Retry later, or use Claude with the registered MCP (OAuth path)"
-            ])
-          };
-        }
-        const json = parseRpcBody(await res.text());
-        if (json.error?.message) {
-          return {
-            ok: false,
-            text: withNextStep(json.error.message, opts.errorHints ?? DEFAULT_ERROR_HINTS)
-          };
-        }
-        const parts = json.result?.content ?? [];
-        const text3 = parts.map((p4) => p4.text).filter(Boolean).join("\n").trim() || JSON.stringify(json.result ?? json, null, 2);
-        return {
-          ok: !json.result?.isError,
-          text: text3,
-          structured: json.result?.structuredContent
-        };
-      })(),
-      deadline
-    ]);
-  } catch (e) {
-    if (isTimeoutish(e)) {
-      const secs = Math.round(timeoutMs / 1e3);
+    const res = await fetch(url, {
+      method,
+      headers,
+      signal: controller.signal,
+      body: sendsBody ? JSON.stringify(rest) : void 0
+    });
+    const raw = await res.text();
+    if (res.status === 202) {
+      let confirmToken;
+      let expires;
+      let message = "";
+      try {
+        const parsed = JSON.parse(raw);
+        confirmToken = parsed.confirm_token;
+        expires = parsed.expires_in_seconds;
+        message = parsed.message ?? "";
+      } catch {
+      }
       return {
         ok: false,
         text: withNextStep(
-          `MCP call to ${tool} timed out after ${secs}s (no response).`,
+          message || `${method} ${path} needs an explicit confirmation.`,
+          confirmToken ? [
+            `Re-run the same command with: --confirm-token ${confirmToken}`,
+            `The token is single-use and expires in ${expires ?? 120}s.`
+          ] : ["The server asked for confirmation but returned no token \u2014 retry the command."]
+        )
+      };
+    }
+    if (res.status === 401 || res.status === 403) {
+      return {
+        ok: false,
+        text: withNextStep(
+          `Carrier API returned ${res.status} (auth rejected).`,
           [
-            "The tool is likely returning more data than the MCP transport can deliver \u2014 see issue #663",
-            "Narrow the request (a specific --account-id / --iccid returns far less than a whole-fleet call)",
-            `Raise the deadline for one slow call: CARRIER_MCP_TIMEOUT_MS=${timeoutMs * 2} carrier \u2026`,
-            "Confirm the service is up: check network access to https://mcp.carrier.llc/mcp",
-            "Or open Claude and ask there with full tool routing"
+            "Confirm CARRIER_API_KEY is a valid org key (ak_\u2026) from app.carrier.llc",
+            "Or sign in from this terminal: carrier login",
+            ...res.status === 403 ? ["A 403 here usually means the key lacks write scope."] : []
           ]
         )
       };
     }
-    const msg = e instanceof Error ? e.message : String(e);
-    return {
-      ok: false,
-      text: withNextStep(`Could not reach MCP: ${msg}`, [
-        "Verify outbound HTTPS to mcp.carrier.llc",
-        "Use the interactive Claude path while offline from this machine"
-      ])
-    };
-  } finally {
-    if (deadlineTimer !== void 0) clearTimeout(deadlineTimer);
-  }
-}
-var ASK_ERROR_HINTS = [
-  "Rephrase the intent more specifically (include ICCID / MSISDN if relevant)",
-  "Or use a discrete command: carrier --help lists every domain"
-];
-function parseRouting(text3) {
-  const trimmed = text3.trim();
-  if (!trimmed.startsWith("{")) return void 0;
-  try {
-    const parsed = JSON.parse(trimmed);
-    if (!parsed || typeof parsed !== "object") return void 0;
-    const routes = typeof parsed.resolved_tool === "string" && parsed.resolved_tool;
-    const asksBack = typeof parsed.clarifying_question === "string" || Array.isArray(parsed.candidates);
-    return routes || asksBack ? parsed : void 0;
-  } catch {
-    return void 0;
-  }
-}
-async function carrierAsk(intent) {
-  const routed = await callMcpTool("carrier_ask", { intent }, { errorHints: ASK_ERROR_HINTS });
-  if (!routed.ok) return routed;
-  const routing = parseRouting(routed.text);
-  if (!routing) return routed;
-  if (!routing.resolved_tool) {
-    const candidates = (routing.candidates ?? []).map((c) => c.tool ? `Candidate: ${c.tool}${c.reason ? ` \u2014 ${c.reason}` : ""}` : void 0).filter((s) => Boolean(s));
-    return {
-      ok: false,
-      text: withNextStep(routing.clarifying_question?.trim() || "Carrier could not tell which tool you meant.", [
-        ...candidates,
-        ...ASK_ERROR_HINTS
-      ])
-    };
-  }
-  const tool = routing.resolved_tool;
-  const args = routing.resolved_params ?? {};
-  if (routing.match && routing.match !== "confirmed") {
-    return {
-      ok: false,
-      text: withNextStep(`Carrier could not confirm what you meant (match: ${routing.match}).`, [
-        `Closest tool: ${tool}`,
-        ...ASK_ERROR_HINTS
-      ])
-    };
-  }
-  if (routing.confirm_required) {
-    return {
-      ok: false,
-      text: withNextStep(`"${intent}" resolves to ${tool}, which changes live service or billing.`, [
-        `Params: ${JSON.stringify(args)}`,
-        "Run the matching discrete command so every flag is explicit and reviewable",
-        "carrier --help lists every domain"
-      ])
-    };
+    if (!res.ok) {
+      return {
+        ok: false,
+        text: withNextStep(
+          redact(`${method} ${path} failed (${res.status}). ${bodyText(raw).slice(0, 500)}`),
+          opts.errorHints ?? DEFAULT_ERROR_HINTS2
+        )
+      };
+    }
+    return { ok: true, text: raw.trim() || JSON.stringify({ status: res.status }) };
+  } catch (e) {
+    const aborted = e instanceof Error && (e.name === "AbortError" || e.name === "TimeoutError");
+    if (aborted) {
+      const secs = Math.round(timeoutMs / 1e3);
+      return {
+        ok: false,
+        text: withNextStep(`${method} ${path} timed out after ${secs}s (no response).`, [
+          `Raise the deadline for one slow call: CARRIER_MCP_TIMEOUT_MS=${timeoutMs * 2} carrier \u2026`,
+          "Confirm the service is up: check network access to https://api.carrier.llc"
+        ])
+      };
+    }
+    const msg = e instanceof Error ? e.message : String(e);
+    return {
+      ok: false,
+      text: withNextStep(redact(`Could not reach the Carrier API: ${msg}`), [
+        "Verify outbound HTTPS to api.carrier.llc",
+        "Use the interactive Claude path while offline from this machine"
+      ])
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/cli/lib/hosted-publish.ts
+async function publishHostedStorefront(input) {
+  const slug2 = storefrontSlugFrom(input.slug);
+  if (slug2 === "") return { ok: false, text: "Use a short name, such as acme." };
+  input = { ...input, slug: slug2 };
+  const listed = await callRestEndpoint("GET", "/v1/storefronts", {});
+  if (!listed.ok) return listed;
+  const existing = findStore(listed.text, input.slug);
+  if (!existing && input.status !== "draft") {
+    const missing = firstPublishCopy(input);
+    if (missing) return { ok: false, text: missing };
+  }
+  const filled = completePlanInput(planInput(input), existing?.plans ?? []);
+  const plan = storefrontPlanBody(filled);
+  if (isStorefrontPlanError(plan)) return { ok: false, text: plan.error };
+  const brand = storefrontBrandPatch(input, existing ?? void 0);
+  const record2 = { slug: input.slug, name: input.name, status: input.status, ...brand };
+  const saved = existing ? await callRestEndpoint("PATCH", "/v1/storefronts/{id}", { id: existing.id, ...record2 }) : await callRestEndpoint("POST", "/v1/storefronts", record2, { idempotencyKey: `site-publish:${input.slug}` });
+  if (!saved.ok) return saved;
+  if (!plan) return withShopAddress(saved, input.slug);
+  const id = existing?.id ?? readId(saved.text);
+  if (!id) return { ok: false, text: "The store was saved but its id was missing, so the plan was not written." };
+  const planned = await callRestEndpoint("POST", "/v1/storefronts/{id}/plans", { id, ...plan });
+  return planned.ok ? withShopAddress(planned, input.slug) : planned;
+}
+function firstPublishCopy(input) {
+  const hero = input.hero?.trim() ?? "";
+  const tagline = input.tagline?.trim() ?? "";
+  const email = input.supportEmail?.trim() ?? "";
+  const legalName = input.legalName?.trim() ?? "";
+  if (hero === "" || hero === "Data that works the day you land.") return "Enter a hero.";
+  if (tagline === "" || tagline === "Programmable connectivity, on demand.") return "Enter a tagline.";
+  if (email === "" || email === "support@carrier.llc") return "Enter a support email.";
+  if (!/^[^\s@]+@[^\s@]+$/.test(email)) return "Support email must be an email address.";
+  if (legalName === "" || legalName === "Lifecycle Innovations Limited") return "Enter a legal name.";
+  return null;
+}
+function withShopAddress(result, slug2) {
+  const address = hostedStorefrontUrl(slug2);
+  if (result.text.includes(address)) return result;
+  return { ...result, text: `${result.text}
+${address}` };
+}
+function hostedPublishInputFromFlags(flags) {
+  const status = flags.status === "draft" || flags.status === "published" ? flags.status : null;
+  if (!status) return { ok: false, text: "Status must be draft or published." };
+  const price = readPrice(flags);
+  if (!price.ok) return { ok: false, text: price.text };
+  const template = parseWholeNumber(flags.templateId, "Template id");
+  if (!template.ok) return { ok: false, text: template.message };
+  const data = readLabel(flags.dataGb, parseDataGb);
+  if (!data.ok) return { ok: false, text: data.text };
+  const validity = readLabel(flags.validityDays, parseValidityDays);
+  if (!validity.ok) return { ok: false, text: validity.text };
+  const countries = readCountries(flags.countries);
+  if (!countries.ok) return { ok: false, text: countries.text };
+  const logo = readLogo(flags.logo);
+  if (!logo.ok) return { ok: false, text: logo.text };
+  return {
+    ok: true,
+    input: {
+      slug: flags.slug,
+      name: flags.name,
+      status,
+      accent: flags.accent,
+      accentDark: flags.accentDark,
+      bg: flags.bg,
+      text: flags.text,
+      logoUrl: logo.value,
+      hero: flags.hero,
+      tagline: flags.tagline,
+      supportEmail: flags.supportEmail,
+      legalName: flags.legalName,
+      productId: flags.product,
+      planSlug: flags.plan,
+      planName: flags.planName,
+      priceCents: price.value,
+      currency: flags.currency,
+      templateId: template.value,
+      dataGb: data.value,
+      validityDays: validity.value,
+      regions: countries.value,
+      description: flags.planText,
+      planActive: flags.inactive ? false : void 0
+    }
+  };
+}
+function readLogo(value) {
+  if (value === void 0 || value.trim() === "") return { ok: true, value: void 0 };
+  const trimmed = value.trim();
+  if (trimmed.startsWith("https://") || trimmed.startsWith("data:")) {
+    const parsed = logoReference(trimmed);
+    return parsed.ok ? { ok: true, value: parsed.url } : { ok: false, text: parsed.message };
+  }
+  try {
+    const bytes = readFileSync(trimmed);
+    const parsed = logoFileDataUrl(bytes);
+    return parsed.ok ? { ok: true, value: parsed.url } : { ok: false, text: parsed.message };
+  } catch {
+    return { ok: false, text: "Use a PNG, JPEG, WebP, or GIF under 70 KB, or an https address." };
+  }
+}
+function readPrice(flags) {
+  if (flags.price !== void 0 && flags.priceCents !== void 0) {
+    return { ok: false, text: "Use either --price 9.00 or --price-cents 900." };
+  }
+  if (flags.price !== void 0) {
+    const parsed2 = majorToCents(flags.price, flags.currency);
+    return parsed2.ok ? { ok: true, value: parsed2.cents } : { ok: false, text: parsed2.message };
+  }
+  const parsed = parseWholeNumber(flags.priceCents, "Price");
+  return parsed.ok ? { ok: true, value: parsed.value } : { ok: false, text: parsed.message };
+}
+function readLabel(value, parse) {
+  if (value === void 0) return { ok: true, value: void 0 };
+  const parsed = parse(value);
+  return parsed.ok ? { ok: true, value: parsed.value } : { ok: false, text: parsed.message };
+}
+function readCountries(value) {
+  if (value === void 0) return { ok: true, value: void 0 };
+  const parsed = parseCountryInput(value);
+  return parsed.ok ? { ok: true, value: parsed.regions } : { ok: false, text: parsed.message };
+}
+function planInput(input) {
+  return {
+    productId: input.productId,
+    slug: input.planSlug,
+    name: input.planName,
+    priceCents: input.priceCents,
+    currency: input.currency,
+    templateId: input.templateId,
+    dataGb: input.dataGb,
+    validityDays: input.validityDays,
+    regions: input.regions,
+    description: input.description,
+    active: input.planActive
+  };
+}
+function findStore(body, slug2) {
+  try {
+    const parsed = JSON.parse(body);
+    const match = parsed.data?.find((row) => row["slug"] === slug2);
+    if (!match || typeof match["id"] !== "string") return null;
+    return {
+      id: match["id"],
+      theme: record(match["theme"]),
+      copy: record(match["copy"]),
+      plans: storedPlans(match["plans"])
+    };
+  } catch {
+    return null;
+  }
+}
+function storedPlans(value) {
+  if (!Array.isArray(value)) return [];
+  const plans = [];
+  for (const item of value) {
+    const row = record(item);
+    if (!row) continue;
+    if (typeof row["slug"] !== "string" || typeof row["name"] !== "string" || typeof row["currency"] !== "string") continue;
+    if (typeof row["ocs_package_template_id"] !== "number") continue;
+    plans.push({
+      slug: row["slug"],
+      name: row["name"],
+      currency: row["currency"],
+      ocs_package_template_id: row["ocs_package_template_id"]
+    });
+  }
+  return plans;
+}
+function readId(body) {
+  try {
+    const parsed = JSON.parse(body);
+    return typeof parsed.id === "string" ? parsed.id : null;
+  } catch {
+    return null;
+  }
+}
+function record(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+
+// src/cli/lib/resend.ts
+import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
+import { createServer as createServer2 } from "http";
+var RESEND_API = "https://api.resend.com";
+var RESEND_API_KEYS_URL = "https://resend.com/api-keys";
+var RESEND_DOMAINS_URL = "https://resend.com/domains";
+var USER_AGENT = "carrier-cli";
+var CLIENT_NAME2 = "Carrier storefront setup";
+var OAUTH_SCOPE = "full_access";
+var REDIRECT_PATH = "/oauth/callback";
+var REDIRECT_HOST = "127.0.0.1";
+function looksResendKey(key) {
+  return /^re_[A-Za-z0-9_-]{8,}$/.test(key.trim());
+}
+function base64url2(input) {
+  return input.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function pkcePair2() {
+  const verifier = base64url2(randomBytes2(64));
+  return { verifier, challenge: base64url2(createHash2("sha256").update(verifier).digest()) };
+}
+function buildAuthorizeUrl(opts) {
+  const url = new URL(`${RESEND_API}/oauth/authorize`);
+  url.searchParams.set("client_id", opts.clientId);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("redirect_uri", opts.redirectUri);
+  url.searchParams.set("scope", opts.scope ?? OAUTH_SCOPE);
+  url.searchParams.set("state", opts.state);
+  url.searchParams.set("code_challenge", opts.challenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  return url.toString();
+}
+async function resendFetch(fetchImpl, path, init = {}) {
+  const headers = { "User-Agent": USER_AGENT, Accept: "application/json" };
+  if (init.token) headers.Authorization = `Bearer ${init.token}`;
+  let body;
+  if (init.form) {
+    headers["Content-Type"] = "application/x-www-form-urlencoded";
+    body = new URLSearchParams(init.form).toString();
+  } else if (init.json !== void 0) {
+    headers["Content-Type"] = "application/json";
+    body = JSON.stringify(init.json);
+  }
+  try {
+    const res = await fetchImpl(`${RESEND_API}${path}`, {
+      method: init.method ?? "GET",
+      headers,
+      body
+    });
+    const text3 = await res.text();
+    let json;
+    try {
+      json = text3 ? JSON.parse(text3) : void 0;
+    } catch {
+      json = void 0;
+    }
+    if (!res.ok) {
+      return { ok: false, status: res.status, json, error: resendError(json) ?? text3.slice(0, 300) };
+    }
+    return { ok: true, status: res.status, json };
+  } catch (e) {
+    return { ok: false, status: 0, error: e instanceof Error ? e.message : String(e) };
+  }
+}
+function resendError(json) {
+  if (typeof json !== "object" || json === null) return void 0;
+  const body = json;
+  return body.message ?? body.error_description ?? body.error;
+}
+async function registerOauthClient(fetchImpl) {
+  const registeredRedirect = `http://${REDIRECT_HOST}${REDIRECT_PATH}`;
+  const res = await resendFetch(fetchImpl, "/oauth/register", {
+    method: "POST",
+    json: {
+      client_name: CLIENT_NAME2,
+      redirect_uris: [registeredRedirect],
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      token_endpoint_auth_method: "none",
+      scope: OAUTH_SCOPE
+    }
+  });
+  if (!res.ok) {
+    return { ok: false, reason: `Resend rejected client registration: ${res.error ?? res.status}` };
+  }
+  const clientId = res.json?.client_id;
+  if (!clientId) return { ok: false, reason: "Resend registered no client_id." };
+  return { ok: true, clientId };
+}
+async function exchangeCode(fetchImpl, opts) {
+  const res = await resendFetch(fetchImpl, "/oauth/token", {
+    method: "POST",
+    form: {
+      grant_type: "authorization_code",
+      client_id: opts.clientId,
+      code: opts.code,
+      redirect_uri: opts.redirectUri,
+      code_verifier: opts.verifier
+    }
+  });
+  if (!res.ok) return { ok: false, reason: `Token exchange failed: ${res.error ?? res.status}` };
+  const body = res.json;
+  if (!body?.access_token) return { ok: false, reason: "Resend returned no access token." };
+  return { ok: true, accessToken: body.access_token, refreshToken: body.refresh_token };
+}
+async function revokeGrant(fetchImpl, opts) {
+  await resendFetch(fetchImpl, "/oauth/revoke", {
+    method: "POST",
+    form: {
+      client_id: opts.clientId,
+      token: opts.refreshToken,
+      token_type_hint: "refresh_token"
+    }
+  }).catch(() => void 0);
+}
+async function findVerifiedDomainId(fetchImpl, accessToken, domain) {
+  const wanted = domain.trim().replace(/^https?:\/\//, "").replace(/\/+$/, "").toLowerCase();
+  if (!wanted) return void 0;
+  const res = await resendFetch(fetchImpl, "/domains", { token: accessToken });
+  if (!res.ok) return void 0;
+  const list = res.json?.data;
+  const match = list?.find((d) => d.name?.toLowerCase() === wanted && d.status === "verified");
+  return match?.id;
+}
+async function createSendingKey(fetchImpl, accessToken, opts) {
+  const res = await resendFetch(fetchImpl, "/api-keys", {
+    method: "POST",
+    token: accessToken,
+    json: {
+      // Resend caps the name at 50 characters.
+      name: opts.name.slice(0, 50),
+      permission: "sending_access",
+      ...opts.domainId ? { domain_id: opts.domainId } : {}
+    }
+  });
+  if (!res.ok) return { ok: false, reason: `Could not create an API key: ${res.error ?? res.status}` };
+  const body = res.json;
+  if (!body?.token) return { ok: false, reason: "Resend created a key but returned no token." };
+  return { ok: true, token: body.token, id: body.id };
+}
+async function validateResendKey(fetchImpl, key) {
+  if (!looksResendKey(key)) return { ok: false, reason: "That does not look like a Resend key (re_\u2026)." };
+  const res = await resendFetch(fetchImpl, "/emails", { method: "POST", token: key, json: {} });
+  if (res.status === 401) return { ok: false, reason: "Resend says that key is missing or malformed." };
+  if (res.status === 403) return { ok: false, reason: "Resend rejected that key as invalid." };
+  if (res.status === 0) return { ok: false, reason: `Could not reach Resend: ${res.error ?? "network error"}` };
+  return { ok: true };
+}
+async function startLoopbackServer() {
+  let resolveCode = null;
+  const server = createServer2((req, res) => {
+    const url = new URL(req.url ?? "/", `http://${REDIRECT_HOST}`);
+    if (url.pathname !== REDIRECT_PATH) {
+      res.writeHead(404).end();
+      return;
+    }
+    const error = url.searchParams.get("error");
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state");
+    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
+    res.end(
+      `<!doctype html><meta charset="utf-8"><title>Carrier</title><body style="font-family:system-ui;padding:3rem;text-align:center"><p>${error ? "Authorization was refused." : "Connected. You can close this tab."}</p>`
+    );
+    resolveCode?.(
+      error ? { ok: false, reason: `Resend returned "${error}".` } : code ? { ok: true, code, reason: state ?? void 0 } : { ok: false, reason: "Resend sent no authorization code." }
+    );
+  });
+  await new Promise((resolve3, reject) => {
+    server.once("error", reject);
+    server.listen(0, REDIRECT_HOST, resolve3);
+  });
+  const port = server.address().port;
+  const redirectUri = `http://${REDIRECT_HOST}:${port}${REDIRECT_PATH}`;
+  return {
+    redirectUri,
+    close: () => server.close(),
+    waitForCode(state, timeoutMs) {
+      return new Promise((resolve3) => {
+        const done = (r) => {
+          clearTimeout(timer);
+          resolveCode = null;
+          server.close();
+          resolve3(r);
+        };
+        const timer = setTimeout(
+          () => done({ ok: false, reason: "Timed out waiting for the browser." }),
+          timeoutMs
+        );
+        resolveCode = (r) => {
+          if (r.ok && r.reason !== state) {
+            done({ ok: false, reason: "The browser callback did not match this request." });
+            return;
+          }
+          done(r.ok ? { ok: true, code: r.code } : r);
+        };
+      });
+    }
+  };
+}
+function discoverResendKey(env) {
+  const key = env.RESEND_API_KEY?.trim();
+  if (!key || !looksResendKey(key)) return void 0;
+  return { apiKey: key, tier: "discovered" };
+}
+var MANUAL_STEPS = [
+  `Open ${RESEND_API_KEYS_URL} and create an API key.`,
+  `Give it Sending access, and restrict it to your sending domain if that domain is verified at ${RESEND_DOMAINS_URL}.`,
+  "Put the key in the storefront's .env.local as RESEND_API_KEY.",
+  "Re-run `carrier site deploy` \u2014 the key is pushed to the deploy target automatically."
+];
+async function provisionResend(opts) {
+  const { deps } = opts;
+  const notes = [];
+  const discovered = discoverResendKey(opts.env);
+  if (discovered) {
+    const check = await validateResendKey(deps.fetch, discovered.apiKey);
+    if (check.ok) return { ok: true, tier: "discovered", credentials: discovered };
+    notes.push(`A RESEND_API_KEY was already set but did not work: ${check.reason}`);
+  }
+  if (!opts.noBrowser) {
+    const viaBrowser = await oauthTier(opts);
+    if (viaBrowser.ok) {
+      return { ...viaBrowser, reason: notes.length ? notes.join(" ") : void 0 };
+    }
+    notes.push(viaBrowser.reason ?? "The browser authorization did not complete.");
+  }
+  if (deps.promptForKey) {
+    await deps.openBrowser(RESEND_API_KEYS_URL);
+    const pasted = (await deps.promptForKey(RESEND_API_KEYS_URL))?.trim();
+    if (pasted) {
+      const check = await validateResendKey(deps.fetch, pasted);
+      if (check.ok) {
+        return {
+          ok: true,
+          tier: "paste",
+          credentials: { apiKey: pasted, tier: "paste" },
+          reason: notes.length ? notes.join(" ") : void 0
+        };
+      }
+      notes.push(check.reason ?? "The pasted key did not work.");
+    }
+  }
+  return { ok: false, tier: "manual", reason: notes.join(" "), guidance: MANUAL_STEPS };
+}
+async function oauthTier(opts) {
+  const { deps } = opts;
+  let server;
+  try {
+    server = await deps.startLoopback();
+  } catch (e) {
+    return {
+      ok: false,
+      tier: "oauth",
+      reason: `Could not open a local callback listener: ${e instanceof Error ? e.message : String(e)}`
+    };
+  }
+  try {
+    const registered = await registerOauthClient(deps.fetch);
+    if (!registered.ok) return { ok: false, tier: "oauth", reason: registered.reason };
+    const { verifier, challenge } = pkcePair2();
+    const state = base64url2(randomBytes2(24));
+    const authorizeUrl = buildAuthorizeUrl({
+      clientId: registered.clientId,
+      redirectUri: server.redirectUri,
+      state,
+      challenge
+    });
+    const opened = await deps.openBrowser(authorizeUrl);
+    deps.notify(
+      opened.ok ? "Approve the connection in your browser \u2014 this waits for you." : `Open this to approve the connection:
+  ${authorizeUrl}`
+    );
+    const callback = await server.waitForCode(state, opts.timeoutMs ?? 18e4);
+    if (!callback.ok || !callback.code) {
+      return { ok: false, tier: "oauth", reason: callback.reason ?? "No authorization code." };
+    }
+    const token = await exchangeCode(deps.fetch, {
+      clientId: registered.clientId,
+      code: callback.code,
+      redirectUri: server.redirectUri,
+      verifier
+    });
+    if (!token.ok) return { ok: false, tier: "oauth", reason: token.reason };
+    const domainId = opts.domain ? await findVerifiedDomainId(deps.fetch, token.accessToken, opts.domain) : void 0;
+    const created = await createSendingKey(deps.fetch, token.accessToken, {
+      name: `${opts.name} storefront`,
+      domainId
+    });
+    if (token.refreshToken) {
+      await revokeGrant(deps.fetch, {
+        clientId: registered.clientId,
+        refreshToken: token.refreshToken
+      });
+    }
+    if (!created.ok) return { ok: false, tier: "oauth", reason: created.reason };
+    const check = await validateResendKey(deps.fetch, created.token);
+    if (!check.ok) {
+      return { ok: false, tier: "oauth", reason: `Resend minted a key that it then rejected: ${check.reason}` };
+    }
+    return {
+      ok: true,
+      tier: "oauth",
+      credentials: {
+        apiKey: created.token,
+        tier: "oauth",
+        keyId: created.id,
+        domain: domainId ? opts.domain : void 0
+      }
+    };
+  } finally {
+    server.close();
+  }
+}
+
+// src/cli/lib/dash.ts
+var DASH_DOMAINS = [
+  "fleet",
+  "subscribers",
+  "usage",
+  "packages",
+  "billing",
+  "wallet",
+  "greenzone",
+  "storefront"
+];
+function isDashDomain(value) {
+  return DASH_DOMAINS.includes(value);
+}
+var DASH_TOOL = {
+  fleet: "fleet_health_app",
+  subscribers: "list_subscribers",
+  usage: "subscriber_usage",
+  packages: "list_package_templates",
+  billing: "billing_events",
+  wallet: "wallet_balance",
+  greenzone: "greenzone_whitelist_list",
+  storefront: ""
+};
+function screenFromStructured(structured) {
+  const rec = structured;
+  const screen = rec?.screen;
+  if (screen && typeof screen === "object" && Array.isArray(screen.sections) && screen.title) {
+    return screen;
+  }
+  return void 0;
+}
+var num = (value, fallback = 0) => {
+  const n = Number(value);
+  return Number.isFinite(n) ? n : fallback;
+};
+var str = (value, fallback = "") => value === void 0 || value === null ? fallback : String(value);
+function rows(payload, keys) {
+  if (Array.isArray(payload)) return payload;
+  const rec = payload ?? {};
+  for (const key of keys) {
+    const candidate = rec[key];
+    if (Array.isArray(candidate)) return candidate;
+  }
+  return [];
+}
+function buildDashScreen(domain, payload) {
+  switch (domain) {
+    case "fleet": {
+      const accounts = rows(payload, ["accounts", "account"]);
+      return fleetScreen({
+        active: num(payload?.active),
+        suspended: num(payload?.suspended),
+        inventory: num(payload?.inventory),
+        other: num(payload?.other),
+        accounts: accounts.map((a) => ({
+          name: str(a.name ?? a.accountId, "?"),
+          balance: num(a.balance),
+          active: num(a.active),
+          suspended: num(a.suspended),
+          inventory: num(a.inventory),
+          other: num(a.other),
+          packageOnly: Boolean(a.packageOnly)
+        }))
+      });
+    }
+    case "subscribers":
+      return subscribersScreen(
+        rows(payload, ["subscribers", "subscriber", "data"]).map((s) => ({
+          iccid: str(s.iccid ?? s.ICCID, "?"),
+          msisdn: s.msisdn ? str(s.msisdn) : void 0,
+          status: str(s.status ?? s.statusStr, "unknown"),
+          account: s.accountName ? str(s.accountName) : void 0,
+          dataUsedBytes: s.dataUsed === void 0 ? void 0 : num(s.dataUsed)
+        }))
+      );
+    case "usage":
+      return usageScreen({
+        subject: str(payload?.subject, "Subscriber"),
+        timeline: rows(payload, ["timeline", "days", "usage"]).map((p4) => ({
+          date: str(p4.date ?? p4.day, "?"),
+          bytes: num(p4.bytes ?? p4.dataUsed)
+        })),
+        countries: rows(payload, ["countries"]).map((c) => ({
+          country: str(c.country ?? c.countryName, "?"),
+          bytes: num(c.bytes ?? c.dataUsed)
+        }))
+      });
+    case "packages":
+      return packagesScreen(
+        rows(payload, ["template", "templates", "data"]).map((t) => ({
+          name: str(t.prepaidpackagetemplatename ?? t.name, "?"),
+          id: str(t.prepaidpackagetemplateid ?? t.id, "?"),
+          dataLimitBytes: t.databyte === void 0 ? void 0 : num(t.databyte),
+          validityDays: t.perioddays === void 0 ? void 0 : num(t.perioddays),
+          price: t.cost === void 0 ? void 0 : num(t.cost),
+          recurring: Boolean(t.recurring)
+        }))
+      );
+    case "billing":
+      return billingScreen({
+        balance: payload?.balance === void 0 ? void 0 : num(payload.balance),
+        currency: str(payload?.currency, ""),
+        events: rows(payload, ["events", "data"]).map((e) => ({
+          date: str(e.date ?? e.timestamp, "?"),
+          description: str(e.description ?? e.type, "\u2014"),
+          amount: num(e.amount)
+        }))
+      });
+    case "wallet": {
+      const p4 = payload ?? {};
+      const eur = (value) => value === void 0 || value === null ? void 0 : num(value) / 100;
+      return walletScreen({
+        balance: eur(p4.balance_eur_cents ?? p4.balance) ?? 0,
+        currency: str(p4.currency, "\u20AC"),
+        autoTopupEnabled: Boolean(p4.autoTopupEnabled ?? p4.auto_topup_enabled),
+        threshold: eur(p4.auto_topup_threshold_cents ?? p4.threshold),
+        credits: p4.credits === void 0 || p4.credits === null ? void 0 : num(p4.credits)
+      });
+    }
+    case "greenzone":
+      return greenzoneScreen(
+        rows(payload, ["entries", "whitelist", "data"]).map((e) => ({
+          value: str(e.value ?? e.prefix ?? e.destination, "?"),
+          note: e.note ? str(e.note) : void 0
+        }))
+      );
+    case "storefront": {
+      const p4 = payload ?? {};
+      return storefrontScreen({
+        brand: str(p4.brand ?? p4.project, "storefront"),
+        url: p4.url ? str(p4.url) : void 0,
+        target: p4.target ? str(p4.target) : void 0,
+        verified: p4.verified === void 0 ? null : Boolean(p4.verified),
+        diagnosis: p4.diagnosis ? str(p4.diagnosis) : void 0,
+        secretsStaged: Array.isArray(p4.secrets_staged) ? p4.secrets_staged : void 0,
+        plans: p4.plans === void 0 ? void 0 : num(p4.plans)
+      });
+    }
   }
-  return callMcpTool(tool, args, { errorHints: ASK_ERROR_HINTS });
 }
 
 // src/cli/lib/home.ts
+import * as p from "@clack/prompts";
+import pc2 from "picocolors";
 function mark(ok2) {
   return ok2 ? pc2.green("\u25CF") : pc2.yellow("\u25CB");
 }
@@ -4254,171 +4873,6 @@ function capabilityTarget(cmd) {
 // src/cli/lib/capability.ts
 import * as p2 from "@clack/prompts";
 import pc3 from "picocolors";
-
-// src/cli/lib/rest.ts
-var DEFAULT_ERROR_HINTS2 = [
-  "Re-check the arguments: carrier <domain> <command> --help",
-  "Or open Claude and ask there with full tool routing"
-];
-function resolveApiKey() {
-  return process.env.CARRIER_API_KEY?.trim() || process.env.CARRIER_ORG_API_KEY?.trim() || null;
-}
-function ocsTokenOnly() {
-  return Boolean(
-    process.env.ESIMVAULT_API_TOKEN?.trim() || process.env.CARRIER_OCS_API_TOKEN?.trim()
-  );
-}
-function applyPath(path, args) {
-  const rest = { ...args };
-  const missing = [];
-  const filled = path.replace(/\{(\w+)\}/g, (_match, name) => {
-    const value = rest[name];
-    if (value === void 0 || value === null || value === "") {
-      missing.push(name);
-      return `{${name}}`;
-    }
-    delete rest[name];
-    return encodeURIComponent(String(value));
-  });
-  return { path: filled, rest, missing };
-}
-function queryString(args) {
-  const params = new URLSearchParams();
-  for (const [key, value] of Object.entries(args)) {
-    if (value === void 0 || value === null) continue;
-    params.set(key, String(value));
-  }
-  const qs = params.toString();
-  return qs ? `?${qs}` : "";
-}
-function bodyText(raw) {
-  const trimmed = raw.trim();
-  if (!trimmed) return "";
-  try {
-    const parsed = JSON.parse(trimmed);
-    if (typeof parsed.error === "string") return parsed.error;
-    if (typeof parsed.message === "string") return parsed.message;
-    return trimmed;
-  } catch {
-    return trimmed;
-  }
-}
-async function callRestEndpoint(method, path, args, opts = {}) {
-  const token = resolveApiKey() ?? await getAccessToken();
-  if (!token) {
-    return {
-      ok: false,
-      text: withNextStep(
-        ocsTokenOnly() ? "Not signed in. An eSIMVault/OCS token is set, but the Carrier API only accepts Carrier credentials." : "Not signed in.",
-        [
-          "Sign in from this terminal: carrier login",
-          "No account yet? carrier open signup",
-          "Headless/CI instead: export CARRIER_API_KEY=ak_\u2026 from Console \u2192 Settings \u2192 API Keys"
-        ]
-      )
-    };
-  }
-  const { path: resolvedPath, rest, missing } = applyPath(path, args);
-  if (missing.length) {
-    return {
-      ok: false,
-      text: withNextStep(`Cannot build ${method} ${path}.`, [
-        `Missing path value(s): ${missing.join(", ")}`,
-        "See every flag: carrier <domain> <command> --help"
-      ])
-    };
-  }
-  const sendsBody = method === "POST" || method === "PUT" || method === "PATCH";
-  const url = `${API_URL}${resolvedPath}${sendsBody ? "" : queryString(rest)}`;
-  const headers = {
-    Authorization: `Bearer ${token}`,
-    Accept: "application/json",
-    "User-Agent": `carrier-cli/${CARRIER_VERSION}`
-  };
-  if (sendsBody) headers["Content-Type"] = "application/json";
-  if (opts.confirmToken) headers["X-Confirm-Token"] = opts.confirmToken;
-  const timeoutMs = mcpTimeoutMs();
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const res = await fetch(url, {
-      method,
-      headers,
-      signal: controller.signal,
-      body: sendsBody ? JSON.stringify(rest) : void 0
-    });
-    const raw = await res.text();
-    if (res.status === 202) {
-      let confirmToken;
-      let expires;
-      let message = "";
-      try {
-        const parsed = JSON.parse(raw);
-        confirmToken = parsed.confirm_token;
-        expires = parsed.expires_in_seconds;
-        message = parsed.message ?? "";
-      } catch {
-      }
-      return {
-        ok: false,
-        text: withNextStep(
-          message || `${method} ${path} needs an explicit confirmation.`,
-          confirmToken ? [
-            `Re-run the same command with: --confirm-token ${confirmToken}`,
-            `The token is single-use and expires in ${expires ?? 120}s.`
-          ] : ["The server asked for confirmation but returned no token \u2014 retry the command."]
-        )
-      };
-    }
-    if (res.status === 401 || res.status === 403) {
-      return {
-        ok: false,
-        text: withNextStep(
-          `Carrier API returned ${res.status} (auth rejected).`,
-          [
-            "Confirm CARRIER_API_KEY is a valid org key (ak_\u2026) from app.carrier.llc",
-            "Or sign in from this terminal: carrier login",
-            ...res.status === 403 ? ["A 403 here usually means the key lacks write scope."] : []
-          ]
-        )
-      };
-    }
-    if (!res.ok) {
-      return {
-        ok: false,
-        text: withNextStep(
-          redact(`${method} ${path} failed (${res.status}). ${bodyText(raw).slice(0, 500)}`),
-          opts.errorHints ?? DEFAULT_ERROR_HINTS2
-        )
-      };
-    }
-    return { ok: true, text: raw.trim() || JSON.stringify({ status: res.status }) };
-  } catch (e) {
-    const aborted = e instanceof Error && (e.name === "AbortError" || e.name === "TimeoutError");
-    if (aborted) {
-      const secs = Math.round(timeoutMs / 1e3);
-      return {
-        ok: false,
-        text: withNextStep(`${method} ${path} timed out after ${secs}s (no response).`, [
-          `Raise the deadline for one slow call: CARRIER_MCP_TIMEOUT_MS=${timeoutMs * 2} carrier \u2026`,
-          "Confirm the service is up: check network access to https://api.carrier.llc"
-        ])
-      };
-    }
-    const msg = e instanceof Error ? e.message : String(e);
-    return {
-      ok: false,
-      text: withNextStep(redact(`Could not reach the Carrier API: ${msg}`), [
-        "Verify outbound HTTPS to api.carrier.llc",
-        "Use the interactive Claude path while offline from this machine"
-      ])
-    };
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-// src/cli/lib/capability.ts
 var MAX_PRETTY_CHARS = 8e3;
 function optionKey(flags) {
   const long = flags.split(/[ ,|]+/).find((t) => t.startsWith("--"));
@@ -5530,6 +5984,22 @@ site.command("deploy [dir]").description("Build + deploy a storefront to whichev
     p3.outro("");
   }
 );
+site.command("publish").description("Publish a Carrier-hosted storefront. Does not deploy a self-hosted copy.").requiredOption("--slug <slug>", "Shop address, such as acme or Acme Mobile").requiredOption("--name <name>", "Brand name").option("--status <status>", "draft or published", "published").option("--accent <hex>", "Accent color, such as #112233").option("--accent-dark <hex>", "Darker accent").option("--bg <hex>", "Page background").option("--text <hex>", "Body text color").option("--logo <url-or-file>", "https logo address, or a PNG, JPEG, WebP, or GIF under 70 KB").option("--hero <text>", "Shop headline").option("--tagline <text>", "Line under the headline").option("--support-email <email>", "Support address").option("--legal-name <name>", "Legal name in the footer").option("--product <id>", "Connectivity plan id. Copies its template, price, and allowance.").option("--plan <slug>", "Plan slug, such as eu-1gb").option("--plan-name <name>", "Plan name on the shop").option("--price <amount>", "Retail price, such as 9.00").option("--price-cents <cents>", "Retail price in minor units").option("--currency <code>", "Three-letter currency code").option("--template-id <id>", "OCS package template id").option("--data-gb <gb>", "Data allowance, such as 1 or 1 GB").option("--validity-days <days>", "Validity, such as 7 or 7 days").option("--countries <names>", "Country names or codes, such as France, DE").option("--plan-text <text>", "Buyer-facing sentence. Omit to leave the saved text unchanged.").option("--inactive", "Keep the plan off the shop").action(async (o) => {
+  header();
+  const built = hostedPublishInputFromFlags(o);
+  if (!built.ok) {
+    fail(built.text, ["Re-run with --status published"]);
+    process.exitCode = 1;
+    return;
+  }
+  const result = await publishHostedStorefront(built.input);
+  if (!result.ok) {
+    fail(result.text, ["Sign in: carrier login", "Or export CARRIER_API_KEY from the console"]);
+    process.exitCode = 1;
+    return;
+  }
+  ok(result.text);
+});
 site.command("targets [dir]").description("Show which deploy hosts are installed, logged in, and ready.").action(async (dir) => {
   header();
   const storefront = resolve2(dir ?? "./storefront");