@carrierllc/mcp 0.2.16 → 0.2.17

package/dist/index.js

@@ -8,8 +8,169 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z } from "zod";
 import * as Sentry from "@sentry/cloudflare";
 
+// ../../packages/ocs-client/dist/chunk-67QO5NVD.js
+var ENDPOINT_LIMITS_PER_MIN = {
+  // Global sentinel (keyed as "__global__")
+  __global__: 600,
+  // 30/min — tightest endpoint
+  subscriberNetworkEventsOverPeriod: 30,
+  // 100/min
+  subscriberUsageOverPeriod: 100,
+  // 150/min
+  listLocationZoneElement: 150,
+  sendMtSms: 150,
+  // 300/min (explicit; also the fallback default)
+  affectPlanToSubscriber: 300,
+  affectRecurringPackageToSubscriber: 300,
+  affectSubscriberFakePhoneNumber: 300,
+  affectSubscriberRealPhoneNumber: 300,
+  esimStatusPerAccount: 300,
+  getSubscriberActivePeriod: 300,
+  hlrGetBitrate: 300,
+  hlrSetBitrate: 300,
+  listSubscriber: 300,
+  listSubscriberPrepaidPackages: 300,
+  moveSubscriberRangeToAccount: 300,
+  pushSteeringToSubs: 300,
+  setSubscriberTrafficRestrictions: 300,
+  getSingleSubscriber: 300,
+  getSubscriberLocationByCellId: 300
+};
+var DEFAULT_LIMIT_PER_MIN = 300;
+var WINDOW_MS2 = 6e4;
+var METRIC_EMIT_MIN_INTERVAL_MS = 1e4;
+var BATCH_FRACTION = 0.2;
+function resellerKeyHash(resellerKey) {
+  if (!resellerKey) return "00000000";
+  let h = 5381;
+  for (let i = 0; i < resellerKey.length; i++) {
+    h = ((h << 5) + h ^ resellerKey.charCodeAt(i)) >>> 0;
+  }
+  return h.toString(16).padStart(8, "0");
+}
+function emitMetric(endpoint, resellerKey, callsInWindow, limitPerMin) {
+  const pct = Math.round(callsInWindow / limitPerMin * 100);
+  const reseller_hash = resellerKeyHash(resellerKey);
+  console.log(
+    JSON.stringify({
+      metric: "carrier_ocs_calls_per_min",
+      endpoint,
+      reseller_hash,
+      calls_in_window: callsInWindow,
+      limit_per_min: limitPerMin,
+      utilisation_pct: pct,
+      alert: pct >= 80,
+      ts: Date.now()
+    })
+  );
+  if (pct >= 80) {
+    console.warn(
+      `[rate-governor] ALERT: ${endpoint} at ${pct}% capacity (${callsInWindow}/${limitPerMin} per min) reseller=${reseller_hash}`
+    );
+  }
+}
+var _endpointWindows = /* @__PURE__ */ new Map();
+function _getEndpointState(key) {
+  let s = _endpointWindows.get(key);
+  if (!s) {
+    s = {
+      log: [],
+      batchLog: [],
+      gate: Promise.resolve(),
+      lastMetricEmitAt: 0,
+      metricBelowHighUtil: true
+    };
+    _endpointWindows.set(key, s);
+  }
+  return s;
+}
+function _prune(log, windowStart) {
+  let i = 0;
+  while (i < log.length && log[i] <= windowStart) i++;
+  return i > 0 ? log.slice(i) : log;
+}
+async function acquireEndpointSlot(resellerId, endpoint, priority = "interactive") {
+  const proc = globalThis["process"];
+  if (proc?.env?.["RATE_FLOOR_DISABLED"] === "true" || globalThis["RATE_FLOOR_DISABLED"] === "true") {
+    return;
+  }
+  await _acquireOneSlot(resellerId, "__global__", priority);
+  await _acquireOneSlot(resellerId, endpoint, priority);
+}
+async function _acquireOneSlot(resellerId, endpoint, priority) {
+  const bucketKey = `${resellerId}:${endpoint}`;
+  const limitPerMin = ENDPOINT_LIMITS_PER_MIN[endpoint] ?? DEFAULT_LIMIT_PER_MIN;
+  const batchCap = Math.floor(limitPerMin * BATCH_FRACTION);
+  const state = _getEndpointState(bucketKey);
+  const ticket = state.gate.then(async () => {
+    while (true) {
+      const now = Date.now();
+      const windowStart = now - WINDOW_MS2;
+      state.log = _prune(state.log, windowStart);
+      state.batchLog = _prune(state.batchLog, windowStart);
+      const totalInWindow = state.log.length;
+      const batchInWindow = state.batchLog.length;
+      if (totalInWindow > 0 && endpoint !== "__global__") {
+        const utilPct = Math.round(totalInWindow / limitPerMin * 100);
+        const intervalOk = now - state.lastMetricEmitAt >= METRIC_EMIT_MIN_INTERVAL_MS;
+        const enteredHighUtil = utilPct >= 80 && state.metricBelowHighUtil;
+        if (intervalOk || enteredHighUtil) {
+          emitMetric(endpoint, resellerId, totalInWindow, limitPerMin);
+          state.lastMetricEmitAt = now;
+          if (utilPct >= 80) {
+            state.metricBelowHighUtil = false;
+          }
+        }
+        if (utilPct < 80) {
+          state.metricBelowHighUtil = true;
+        }
+      }
+      const globalFull = totalInWindow >= limitPerMin;
+      const batchFull = priority === "batch" && batchInWindow >= batchCap;
+      if (!globalFull && !batchFull) {
+        state.log.push(now);
+        if (priority === "batch") {
+          state.batchLog.push(now);
+        }
+        return;
+      }
+      let waitMs;
+      if (globalFull) {
+        const oldest = state.log[0];
+        waitMs = WINDOW_MS2 - (now - oldest) + 1;
+      } else {
+        const oldestBatch = state.batchLog[0];
+        waitMs = WINDOW_MS2 - (now - oldestBatch) + 1;
+      }
+      await new Promise((r) => setTimeout(r, waitMs));
+    }
+  });
+  state.gate = ticket;
+  return ticket;
+}
+function getLimitForEndpoint(endpoint) {
+  return ENDPOINT_LIMITS_PER_MIN[endpoint] ?? DEFAULT_LIMIT_PER_MIN;
+}
+function getRateLimitWindowCounts(resellerKey, endpoint) {
+  const bucketKey = `${resellerKey}:${endpoint}`;
+  const state = _endpointWindows.get(bucketKey);
+  if (!state) {
+    return { calls_in_window: 0, batch_calls_in_window: 0 };
+  }
+  const windowStart = Date.now() - WINDOW_MS2;
+  let calls_in_window = 0;
+  for (const ts of state.log) {
+    if (ts > windowStart) calls_in_window++;
+  }
+  let batch_calls_in_window = 0;
+  for (const ts of state.batchLog) {
+    if (ts > windowStart) batch_calls_in_window++;
+  }
+  return { calls_in_window, batch_calls_in_window };
+}
+
 // src/client.ts
-var OcsApiError = class extends Error {
+var OcsApiError2 = class extends Error {
   constructor(code, message, method) {
     super(`[${method}] OCS error ${code}: ${message}`);
     this.code = code;
@@ -19,7 +180,7 @@ var OcsApiError = class extends Error {
   code;
   method;
 };
-var OcsClient = class {
+var OcsClient2 = class {
   baseUrl;
   token;
   constructor(baseUrl2, token2) {
@@ -27,6 +188,7 @@ var OcsClient = class {
     this.token = token2;
   }
   async call(method, params = {}) {
+    await acquireEndpointSlot(this.token, method, "interactive");
     const url = `${this.baseUrl}/v1?token=${this.token}`;
     const body = JSON.stringify({ [method]: params });
     const res = await fetch(url, {
@@ -35,11 +197,11 @@ var OcsClient = class {
       body
     });
     if (!res.ok) {
-      throw new OcsApiError(res.status, `HTTP ${res.status} ${res.statusText}`, method);
+      throw new OcsApiError2(res.status, `HTTP ${res.status} ${res.statusText}`, method);
     }
     const json = await res.json();
     if (json.status?.code !== 0) {
-      throw new OcsApiError(json.status?.code ?? -1, json.status?.msg ?? "Unknown error", method);
+      throw new OcsApiError2(json.status?.code ?? -1, json.status?.msg ?? "Unknown error", method);
     }
     if (method === "getCustomerTariff" && json["listTariffRule"] !== void 0) {
       return json["listTariffRule"];
@@ -295,9 +457,9 @@ function wrapHandler(toolName, ocsMethod, requiredScope, ctx, handler) {
     try {
       const token2 = await ctx.getUserToken(ctx.props.sub);
       result2 = await handler(args, token2);
-    } catch (err2) {
+    } catch (err4) {
       try {
-        Sentry.captureException(err2, {
+        Sentry.captureException(err4, {
           tags: {
             tool: toolName,
             feature: "mcp",
@@ -306,8 +468,8 @@ function wrapHandler(toolName, ocsMethod, requiredScope, ctx, handler) {
         });
       } catch {
       }
-      const message = err2 instanceof Error ? err2.message : String(err2);
-      const ocsCode = err2 instanceof OcsApiError ? err2.code : void 0;
+      const message = err4 instanceof Error ? err4.message : String(err4);
+      const ocsCode = err4 instanceof OcsApiError2 ? err4.code : void 0;
       ctx.audit({
         tool_name: toolName,
         ocs_method: ocsMethod,
@@ -335,7 +497,7 @@ function wrapHandler(toolName, ocsMethod, requiredScope, ctx, handler) {
   };
 }
 async function ocsCall(env, token2, method, params = {}) {
-  const client = new OcsClient(env.CARRIER_OCS_BASE_URL, token2);
+  const client = new OcsClient2(env.CARRIER_OCS_BASE_URL, token2);
   const result2 = await client.call(method, params);
   return {
     content: [{ type: "text", text: JSON.stringify(result2, null, 2) }]
@@ -344,13 +506,13 @@ async function ocsCall(env, token2, method, params = {}) {
 async function resolveSubscriberByIccid(env, token2, iccid, cache) {
   const hit = cache.get(iccid);
   if (hit) return hit;
-  const client = new OcsClient(env.CARRIER_OCS_BASE_URL, token2);
+  const client = new OcsClient2(env.CARRIER_OCS_BASE_URL, token2);
   const record = await client.call("getSingleSubscriber", { iccid });
   cache.set(iccid, record);
   return record;
 }
 async function getDefaultResellerId(env, token2) {
-  const client = new OcsClient(env.CARRIER_OCS_BASE_URL, token2);
+  const client = new OcsClient2(env.CARRIER_OCS_BASE_URL, token2);
   const info = await client.call("getResellerInfo", {});
   const id = info?.id;
   if (typeof id !== "number") {
@@ -567,7 +729,7 @@ function registerAllTools(server2, ctx) {
         if (args.msisdn) params.msisdn = args.msisdn;
         if (args.status) params.status = args.status;
         if (args.offset !== void 0) params.offset = args.offset;
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
         const raw = await client.call("listSubscriber", params);
         const limit = args.limit;
         const payload = Array.isArray(raw) && typeof limit === "number" && limit >= 0 ? raw.slice(0, limit) : raw;
@@ -2968,11 +3130,11 @@ var ocsAppMethods = ocsSpec.v1_app_methods;
 // src/intelligence.ts
 async function safeCall(env, token2, method, params = {}) {
   try {
-    const client = new OcsClient(env.CARRIER_OCS_BASE_URL, token2);
+    const client = new OcsClient2(env.CARRIER_OCS_BASE_URL, token2);
     const data = await client.call(method, params);
     return { data, error: null };
-  } catch (err2) {
-    return { data: null, error: err2 instanceof Error ? err2.message : String(err2) };
+  } catch (err4) {
+    return { data: null, error: err4 instanceof Error ? err4.message : String(err4) };
   }
 }
 async function fetchActiveSubscribers(env, token2, accountId, resellerId) {
@@ -3972,6 +4134,11 @@ var DRY_RUN_FIELD2 = {
     "If true, do not call OCS \u2014 return the would-be request for confirmation"
   )
 };
+function normalizeRadioType(value) {
+  if (/^nb-?iot$/i.test(value)) return "NB-IoT";
+  return value;
+}
+var VALID_RADIO_TYPES = /* @__PURE__ */ new Set(["2G", "3G", "4G", "5G", "NB-IoT"]);
 var BACKLOG_TOOL_SCOPES = {
   affect_subscriber_phone_number: "write",
   carrier_webhook_config: "read",
@@ -4006,7 +4173,7 @@ function registerAllBacklogTools(server2, ctx) {
       ctx,
       async ({ iccid, phone_number, phone_type }, token2) => {
         const ocsMethod = phone_type === "fake" ? "affectSubscriberFakePhoneNumber" : "affectSubscriberRealPhoneNumber";
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
         const result2 = await client.call(ocsMethod, { subscriber: iccid, phoneNumber: phone_number });
         return {
           content: [{ type: "text", text: JSON.stringify(result2, null, 2) }]
@@ -4018,9 +4185,11 @@ function registerAllBacklogTools(server2, ctx) {
     "get_subscriber_location_by_cell_id",
     {
       title: "Get Location by Cell ID (GeoSense)",
-      description: "Powered by Bridge4IP GeoSense \u2014 cell-level location resolution with sub-cell accuracy where available. Use this to resolve a cell tower tuple (radio type + MCC + MNC + LAC + optional cellId) to a latitude/longitude estimate. No subscriber identifier required \u2014 caller supplies cell parameters directly. Useful for fraud detection, roaming cost attribution, and network troubleshooting when you have raw cell info from an external source (e.g. a Relay LU webhook event). Params: `radio_type` ('2G'|'3G'|'4G'|'5G'|'NB-IoT'), `mcc` (int), `mnc` (int), `lac` (int), `cell_id` (int, optional but strongly recommended for accuracy), `signal_strength` (number dBm, optional). Returns: { latitude, longitude, accuracy } \u2014 accuracy is median error in meters at 50% confidence. Without cell_id accuracy degrades significantly (>10 km). Do NOT use this for bulk fleet location sweeps \u2014 one OCS call per cell tower; use `audit_network_coverage` for fleet-level analysis instead.",
+      description: "Powered by Bridge4IP GeoSense \u2014 cell-level location resolution with sub-cell accuracy where available. Use this to resolve a cell tower tuple (radio type + MCC + MNC + LAC + optional cellId) to a latitude/longitude estimate. No subscriber identifier required \u2014 caller supplies cell parameters directly. Useful for fraud detection, roaming cost attribution, and network troubleshooting when you have raw cell info from an external source (e.g. a Relay LU webhook event). Params: `radio_type` ('2G'|'3G'|'4G'|'5G'|'NB-IoT'; also accepts 'NBIOT'|'nb-iot'|'nbiot' \u2014 normalised to 'NB-IoT'), `mcc` (int), `mnc` (int), `lac` (int), `cell_id` (int, optional but strongly recommended for accuracy), `signal_strength` (number dBm, optional). Returns: { latitude, longitude, accuracy } \u2014 accuracy is median error in meters at 50% confidence. Without cell_id accuracy degrades significantly (>10 km). Do NOT use this for bulk fleet location sweeps \u2014 one OCS call per cell tower; use `audit_network_coverage` for fleet-level analysis instead.",
       inputSchema: {
-        radio_type: z3.enum(["2G", "3G", "4G", "5G", "NB-IoT"]).describe("Radio access technology type"),
+        radio_type: z3.string().transform(normalizeRadioType).refine((v) => VALID_RADIO_TYPES.has(v), {
+          message: "radio_type must be one of: 2G, 3G, 4G, 5G, NB-IoT (also accepts NBIOT, nb-iot, nbiot)"
+        }).describe("Radio access technology type: '2G'|'3G'|'4G'|'5G'|'NB-IoT'. Also accepts 'NBIOT'|'nb-iot'|'nbiot' \u2014 normalised to 'NB-IoT'."),
         mcc: z3.number().int().describe("Mobile Country Code (e.g. 250 for Russia, 234 for UK)"),
         mnc: z3.number().int().describe("Mobile Network Code"),
         lac: z3.number().int().describe("Location Area Code"),
@@ -4042,7 +4211,7 @@ function registerAllBacklogTools(server2, ctx) {
         cell_id,
         signal_strength
       }, token2) => {
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
         const params = { radioType: radio_type, mcc, mnc, lac };
         if (cell_id !== void 0) params.cellId = cell_id;
         if (signal_strength !== void 0) params.signalStrength = signal_strength;
@@ -4070,7 +4239,7 @@ function registerAllBacklogTools(server2, ctx) {
       ctx,
       async ({ resellerId }, token2) => {
         const id = resellerId ?? await (async () => {
-          const client2 = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+          const client2 = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
           const info = await client2.call("getResellerInfo", {});
           const resolvedId = info?.id;
           if (typeof resolvedId !== "number") {
@@ -4078,7 +4247,7 @@ function registerAllBacklogTools(server2, ctx) {
           }
           return resolvedId;
         })();
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
         const result2 = await client.call("listDetailedDestinationList", id);
         return {
           content: [{ type: "text", text: JSON.stringify(result2, null, 2) }]
@@ -4104,7 +4273,7 @@ function registerAllBacklogTools(server2, ctx) {
       BACKLOG_TOOL_SCOPES["modify_subscriber_mobile_plan"],
       ctx,
       async ({ iccid, mobile_plan_id }, token2) => {
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
         const result2 = await client.call(
           "modifySubscriberMobilePlan",
           { subscriber: iccid, mobilePlanId: mobile_plan_id }
@@ -4138,7 +4307,7 @@ function registerAllBacklogTools(server2, ctx) {
         const params = { subscriber: iccid, packageId: package_id };
         if (start_date !== void 0) params.startDate = start_date;
         if (end_date !== void 0) params.endDate = end_date;
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
         const result2 = await client.call(
           "modifySubscriberPrepaidPackageActivePeriod",
           params
@@ -4167,7 +4336,7 @@ function registerAllBacklogTools(server2, ctx) {
       BACKLOG_TOOL_SCOPES["modify_subscriber_voip_plan"],
       ctx,
       async ({ iccid, voip_plan_id }, token2) => {
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
         const result2 = await client.call(
           "modifySubscriberVoipPlan",
           { subscriber: iccid, voipPlanId: voip_plan_id }
@@ -4198,7 +4367,7 @@ function registerAllBacklogTools(server2, ctx) {
         const cache = /* @__PURE__ */ new Map();
         const sub = await resolveSubscriberByIccid(ctx.env, token2, iccid, cache);
         const subscriberId = sub.id ?? sub.subscriberId ?? iccid;
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
         const result2 = await client.call(
           "pushSteeringToSubs",
           { subscriber: subscriberId }
@@ -4226,7 +4395,7 @@ function registerAllBacklogTools(server2, ctx) {
       BACKLOG_TOOL_SCOPES["reset_subscriber_gz_counter"],
       ctx,
       async ({ iccid }, token2) => {
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
         const result2 = await client.call("resetSubsGzCounter", { subscriber: iccid });
         return {
           content: [{ type: "text", text: JSON.stringify(result2, null, 2) }]
@@ -4250,7 +4419,7 @@ function registerAllBacklogTools(server2, ctx) {
       BACKLOG_TOOL_SCOPES["carrier_webhook_config"],
       ctx,
       async ({ reseller_id }, token2) => {
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
         let resellerId = reseller_id;
         if (resellerId === void 0) {
           resellerId = await getDefaultResellerId(ctx.env, token2);
@@ -4299,10 +4468,20 @@ var TOOL_REGISTRY = /* @__PURE__ */ new Set([
   "high_cost_subscribers",
   // event ring buffer (1)
   "list_recent_ocs_events",
+  // CAR-39: rate-limit governor (1)
+  "rate_limit_status",
+  // CAR-38: Relay LU country history (1)
+  "subscriber_country_history",
+  // bundle depletion events (1) — CAR-42 wave-2
+  "subscriber_depletion_events",
   // MCP App tools (3)
   "fleet_health_app",
   "provision_esim_wizard",
   "balance_topup_form",
+  // greenzone whitelist tools (3) — portal-only, executed via Kapture browser automation
+  "greenzone_whitelist_add",
+  "greenzone_whitelist_remove",
+  "greenzone_whitelist_list",
   // router tools (self-reference)
   "carrier_ask",
   "carrier_ask_describe"
@@ -4517,8 +4696,22 @@ var ROUTER_TOOLS = [
   },
   {
     name: "get_subscriber_location_by_cell_id",
-    description: "Get granular subscriber location by cell tower. Intent: 'cell-level location', 'cell tower for subscriber', 'exact location'.",
-    input_schema: { type: "object", properties: { iccid: { type: "string" } } }
+    description: "Get granular cell-tower location via GeoSense using radio_type, mcc, mnc, lac, and optional cell_id. Use radio_type '4G' when the user means LTE \u2014 the literal 'LTE' is not valid for the underlying API. NB-IoT aliases NBIOT, nbiot, nb-iot normalise to NB-IoT. Intent: 'cell-level location', 'cell tower for subscriber', 'exact location', 'find subscriber by cell id', 'locate SIM by cell tower', 'NB-IoT subscriber location', 'which cell is this SIM on'.",
+    input_schema: {
+      type: "object",
+      required: ["radio_type", "mcc", "mnc", "lac"],
+      properties: {
+        iccid: { type: "string" },
+        radio_type: {
+          type: "string",
+          description: "One of 2G, 3G, 4G, 5G, NB-IoT. Use 4G for LTE networks. NB-IoT also accepts NBIOT, nbiot, nb-iot."
+        },
+        mcc: { type: "number", description: "Mobile Country Code" },
+        mnc: { type: "number", description: "Mobile Network Code" },
+        lac: { type: "number", description: "Location Area Code" },
+        cell_id: { type: "number", description: "Cell tower ID (optional but recommended)" }
+      }
+    }
   },
   {
     name: "list_steering_lists",
@@ -4595,6 +4788,26 @@ var ROUTER_TOOLS = [
     description: "List recent OCS events for a subscriber (last 50, 24h window). Intent: 'recent events', 'event history', 'OCS log'.",
     input_schema: { type: "object", properties: { iccid: { type: "string" } } }
   },
+  {
+    name: "rate_limit_status",
+    description: "Inspect Bridge4IP OCS rate-limit governor state \u2014 bucket fill levels and reseller quota per endpoint. Intent: 'are we rate limited', 'ocs quota', 'rate limit status', 'how full is the api bucket', 'check rate limit', 'api capacity'.",
+    input_schema: {
+      type: "object",
+      properties: { endpoint: { type: "string" } }
+    }
+  },
+  {
+    name: "subscriber_country_history",
+    description: "Return cross-border movement history for a subscriber from Relay LU events. Intent: 'where has subscriber X traveled', 'country history for ICCID', 'border crossings', 'which countries did this SIM visit', 'travel history'.",
+    input_schema: {
+      type: "object",
+      properties: {
+        subscriberId: { type: "string" },
+        limit: { type: "number" }
+      },
+      required: ["subscriberId"]
+    }
+  },
   {
     name: "affect_subscriber_phone_number",
     description: "Assign or unassign a phone number to a subscriber. Intent: 'assign phone number', 'give SIM a number', 'remove number'.",
@@ -4679,6 +4892,44 @@ var ROUTER_TOOLS = [
     name: "carrier_ask_describe",
     description: "Get documentation for a specific carrier tool. Intent: 'describe tool X', 'how does assign_package work', 'tool documentation'.",
     input_schema: { type: "object", properties: { tool_name: { type: "string" } } }
+  },
+  {
+    name: "greenzone_whitelist_add",
+    description: "Add a host and/or IP to the GreenZone whitelist. Operates via portal-only Kapture browser automation \u2014 no direct REST API. Intent: 'add to greenzone whitelist', 'whitelist this host in greenzone', 'allow host in greenzone', 'greenzone add host', 'add IP to greenzone'.",
+    input_schema: {
+      type: "object",
+      properties: {
+        host: { type: "string", description: "Hostname to whitelist (e.g. api.example.com)" },
+        ip: { type: "string", description: "IP address to whitelist (optional)" }
+      }
+    }
+  },
+  {
+    name: "greenzone_whitelist_remove",
+    description: "Remove a host and/or IP from the GreenZone whitelist. Operates via portal-only Kapture browser automation \u2014 no direct REST API. Intent: 'remove from greenzone whitelist', 'de-whitelist host in greenzone', 'block host in greenzone', 'greenzone remove host'.",
+    input_schema: {
+      type: "object",
+      properties: {
+        host: { type: "string", description: "Hostname to remove" },
+        ip: { type: "string", description: "IP address to remove (optional)" }
+      }
+    }
+  },
+  {
+    name: "greenzone_whitelist_list",
+    description: "List all hosts and IPs in the GreenZone whitelist (reads from KV cache populated by last portal sync). Intent: 'show greenzone whitelist', 'list greenzone hosts', 'what hosts are in greenzone', 'greenzone whitelist', 'show greenzone entries', 'which IPs are whitelisted in greenzone'.",
+    input_schema: { type: "object", properties: {} }
+  },
+  {
+    name: "subscriber_depletion_events",
+    description: "Look up bundle depletion events from prepaid-usage webhooks (last_slice notifications, 7-day retention). Intent: 'did subscriber X run out of data', 'depletion history for ICCID', 'bundle depleted events', 'which subscribers ran out of data', 'recent depletions', 'show data exhaustion events', 'has this SIM hit its data cap', 'list depleted subscribers'.",
+    input_schema: {
+      type: "object",
+      properties: {
+        subscriberId: { type: "string", description: "OCS subscriber ID \u2014 omit to list fleet-wide depletions" },
+        since: { type: "string", description: "ISO-8601 timestamp \u2014 filter to events at or after this time" }
+      }
+    }
   }
 ];
 var ROUTER_SYSTEM_PROMPT = `You are a carrier fleet operations router. Your job is to map a user's natural-language intent to exactly ONE tool from the Carrier MCP tool registry.
@@ -4711,10 +4962,10 @@ async function callBedrock(env, payload) {
     const body = await resp.text();
     if (resp.status === 429) {
       const retryAfter = resp.headers.get("retry-after");
-      const err2 = new Error(`Bedrock rate limit: ${body}`);
-      err2.isRateLimit = true;
-      err2.retryAfter = retryAfter;
-      throw err2;
+      const err4 = new Error(`Bedrock rate limit: ${body}`);
+      err4.isRateLimit = true;
+      err4.retryAfter = retryAfter;
+      throw err4;
     }
     throw new Error(`Bedrock invoke failed: ${resp.status} ${body}`);
   }
@@ -4752,9 +5003,9 @@ Pre-resolved context: ${JSON.stringify(definedContext)}` : "";
       AWS_REGION: env.AWS_REGION,
       BEDROCK_MODEL_ID: env.BEDROCK_MODEL_ID
     }, payload);
-  } catch (err2) {
-    if (err2 instanceof Error && err2.isRateLimit) {
-      const retryAfter = err2.retryAfter;
+  } catch (err4) {
+    if (err4 instanceof Error && err4.isRateLimit) {
+      const retryAfter = err4.retryAfter;
       const parsedSeconds = retryAfter ? parseInt(retryAfter, 10) : 60;
       return {
         match: "rate_limited",
@@ -4762,7 +5013,7 @@ Pre-resolved context: ${JSON.stringify(definedContext)}` : "";
         suggestion: "Bedrock rate limit reached. Please retry after the indicated delay."
       };
     }
-    throw err2;
+    throw err4;
   }
   const toolUseBlock = response.content.find(
     (block) => block.type === "tool_use"
@@ -4936,7 +5187,7 @@ function registerAllCarrierAskTools(server2, ctx) {
         let route;
         try {
           route = await _routeIntent(intent, context, ctx.env);
-        } catch (err2) {
+        } catch (err4) {
           writeCarrierAskAudit(ctx.env, {
             intent_hash: intentHash,
             match: "error",
@@ -4953,7 +5204,7 @@ function registerAllCarrierAskTools(server2, ctx) {
                 type: "text",
                 text: JSON.stringify({
                   error: "routing_error",
-                  message: err2 instanceof Error ? err2.message : "An unexpected error occurred during routing."
+                  message: err4 instanceof Error ? err4.message : "An unexpected error occurred during routing."
                 })
               }
             ],
@@ -5095,24 +5346,10 @@ function buildExamples(toolName) {
 
 // src/list-recent-ocs-events.ts
 import { z as z5 } from "zod";
-var ALLOWED_EVENT_TYPES = [
-  "esim.activated",
-  "esim.disabled",
-  "package.expiry_warning",
-  "location.changed",
-  "balance.low"
-];
-var listRecentOcsEventsSchema = {
-  iccid: z5.string().regex(/^\d{19,20}$/).describe("ICCID, 19 or 20 digits, ITU-T E.118 format"),
-  limit: z5.number().int().min(1).max(50).default(20).describe("Max events to return, newest first"),
-  event_types: z5.array(z5.enum(ALLOWED_EVENT_TYPES)).optional().describe("Filter to specific event types"),
-  since: z5.string().datetime().optional().describe("ISO-8601 timestamp; only events after this point")
-};
+
+// ../../packages/ocs-spec/src/ocs-event-buffer-read.ts
 async function listRecentOcsEvents(iccid, limit, eventTypes, since, kv) {
-  const routingRaw = await kv.get(
-    `iccid:${iccid}`,
-    "json"
-  );
+  const routingRaw = await kv.get(`iccid:${iccid}`, "json");
   const resellerId = routingRaw?.reseller_id ?? 0;
   const ringKey = `events:${resellerId}:${iccid}`;
   const itemPrefix = `${ringKey}:evt:`;
@@ -5148,8 +5385,7 @@ async function listRecentOcsEvents(iccid, limit, eventTypes, since, kv) {
   const sinceMs = since ? new Date(since).getTime() : null;
   const filtered = allSorted.filter((e) => {
     if (sinceMs !== null && e.occurred_at * 1e3 <= sinceMs) return false;
-    if (eventTypes && eventTypes.length > 0 && !eventTypes.includes(e.event_type))
-      return false;
+    if (eventTypes && eventTypes.length > 0 && !eventTypes.includes(e.event_type)) return false;
     return true;
   });
   const filteredCount = filtered.length;
@@ -5175,6 +5411,25 @@ async function listRecentOcsEvents(iccid, limit, eventTypes, since, kv) {
     buffer_newest_event_timestamp: bufferNewest
   };
 }
+
+// src/list-recent-ocs-events.ts
+var ALLOWED_EVENT_TYPES = [
+  "esim.activated",
+  "esim.disabled",
+  "package.expiry_warning",
+  "location.changed",
+  "country.entered",
+  "balance.low"
+];
+var listRecentOcsEventsSchema = {
+  iccid: z5.string().regex(/^\d{19,20}$/).describe("ICCID, 19 or 20 digits, ITU-T E.118 format"),
+  limit: z5.number().int().min(1).max(50).default(20).describe("Max events to return, newest first"),
+  event_types: z5.array(z5.enum(ALLOWED_EVENT_TYPES)).optional().describe("Filter to specific event types"),
+  since: z5.string().datetime().optional().describe("ISO-8601 timestamp; only events after this point")
+};
+async function listRecentOcsEvents2(iccid, limit, eventTypes, since, kv) {
+  return listRecentOcsEvents(iccid, limit, eventTypes, since, kv);
+}
 function registerListRecentOcsEventsTool(server2, env) {
   server2.registerTool(
     "list_recent_ocs_events",
@@ -5191,7 +5446,7 @@ function registerListRecentOcsEventsTool(server2, env) {
     async (args) => {
       const { iccid, limit, event_types, since } = args;
       try {
-        const result2 = await listRecentOcsEvents(
+        const result2 = await listRecentOcsEvents2(
           iccid,
           limit,
           event_types,
@@ -5201,8 +5456,8 @@ function registerListRecentOcsEventsTool(server2, env) {
         return {
           content: [{ type: "text", text: JSON.stringify(result2, null, 2) }]
         };
-      } catch (err2) {
-        const message = err2 instanceof Error ? err2.message : String(err2);
+      } catch (err4) {
+        const message = err4 instanceof Error ? err4.message : String(err4);
         return {
           isError: true,
           content: [{ type: "text", text: `Error reading OCS event buffer: ${message}` }]
@@ -5212,8 +5467,271 @@ function registerListRecentOcsEventsTool(server2, env) {
   );
 }
 
-// src/apps/fleet-health-app.ts
+// src/tools-rate-governor.ts
 import { z as z6 } from "zod";
+var MONITORED_ENDPOINTS = [
+  "subscriberNetworkEventsOverPeriod",
+  // 30/min
+  "subscriberUsageOverPeriod",
+  // 100/min
+  "listLocationZoneElement",
+  // 150/min
+  "sendMtSms",
+  // 150/min
+  "affectPlanToSubscriber",
+  // 300/min
+  "affectRecurringPackageToSubscriber",
+  // 300/min
+  "listSubscriber",
+  // 300/min
+  "listSubscriberPrepaidPackages",
+  // 300/min
+  "getSingleSubscriber",
+  // 300/min
+  "getSubscriberLocationByCellId",
+  // 300/min
+  "__global__"
+  // 600/min
+];
+function registerRateLimitStatusTool(server2, ctx) {
+  server2.registerTool(
+    "rate_limit_status",
+    {
+      title: "API Rate-Limit Governor Status",
+      description: "Inspect Bridge4IP OCS rate-limit governor state \u2014 bucket fill levels, per-endpoint limits, and 80% alert thresholds. Use this to answer: 'are we rate limited', 'check ocs quota', 'how full is the rate limit bucket', 'rate limit status'. Params: `endpoint` (optional \u2014 OCS camelCase method name to inspect a single bucket, e.g. 'subscriberUsageOverPeriod'; omit for all monitored endpoints). Returns: per-endpoint { limit_per_min, batch_cap_per_min, calls_in_window, batch_calls_in_window, utilisation_pct, alert (true when \u226580% of limit) }. Note: counts come from the in-process sliding-window log (same key as OCS calls: API token + endpoint) \u2014 they reset when the Worker isolate recycles. Use as a relative signal, not an exact counter. Do NOT use this to adjust limits \u2014 limits are set by Bridge4IP contract and cannot be changed via MCP.",
+      inputSchema: {
+        endpoint: z6.string().optional().describe(
+          "OCS method name in camelCase (e.g. 'subscriberUsageOverPeriod'). Omit to return status for all monitored endpoints."
+        )
+      },
+      annotations: { readOnlyHint: true, idempotentHint: true }
+    },
+    wrapHandler(
+      "rate_limit_status",
+      "[rate-governor:in-process]",
+      "read",
+      ctx,
+      async ({ endpoint }, token2) => {
+        const targets = endpoint ? [endpoint] : MONITORED_ENDPOINTS;
+        const rows = targets.map((ep) => {
+          const limit = getLimitForEndpoint(ep);
+          const batch_cap_per_min = Math.floor(limit * 0.2);
+          const { calls_in_window, batch_calls_in_window } = getRateLimitWindowCounts(token2, ep);
+          const utilisation_pct = limit > 0 ? Math.round(calls_in_window / limit * 100) : 0;
+          const alert = utilisation_pct >= 80;
+          return {
+            endpoint: ep,
+            limit_per_min: limit,
+            batch_cap_per_min,
+            calls_in_window,
+            batch_calls_in_window,
+            utilisation_pct,
+            alert
+          };
+        });
+        const resellerId = String(ctx.props.reseller_id);
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(
+                {
+                  reseller_id: resellerId,
+                  window_seconds: 60,
+                  batch_fraction: 0.2,
+                  endpoints: rows,
+                  alert_threshold_pct: 80,
+                  metric_name: "carrier_ocs_calls_per_min",
+                  metric_location: "CF Workers Tail / BetterStack \u2014 structured JSON log lines with metric='carrier_ocs_calls_per_min'"
+                },
+                null,
+                2
+              )
+            }
+          ]
+        };
+      }
+    )
+  );
+}
+
+// src/tools-depletion-events.ts
+import { z as z7 } from "zod";
+function ok(payload) {
+  return { content: [{ type: "text", text: JSON.stringify(payload, null, 2) }] };
+}
+function err(message) {
+  return { isError: true, content: [{ type: "text", text: message }] };
+}
+function registerDepletionEventsTool(server2, ctx) {
+  server2.registerTool(
+    "subscriber_depletion_events",
+    {
+      title: "Subscriber Bundle Depletion Events",
+      description: "Look up bundle depletion events for a subscriber (or list recent fleet-wide depletions). Returns the most recent bundle.depleted event stored when the prepaid usage webhook received a last_slice notification. Events are retained for 7 days. Use subscriberId to check a specific subscriber, or omit to list the 20 most recent fleet-wide depletions. Requires 'read' scope.",
+      inputSchema: {
+        subscriberId: z7.string().optional().describe(
+          "OCS subscriber ID to look up. Omit to list the 20 most recent fleet-wide depletions."
+        ),
+        since: z7.string().optional().describe(
+          "ISO-8601 timestamp \u2014 only return events at or after this time (for single-subscriber lookup)."
+        )
+      },
+      annotations: { readOnlyHint: true }
+    },
+    async (args) => {
+      if (!ctx.props.scope.includes("read")) {
+        return err(
+          `Scope denied: subscriber_depletion_events requires 'read' scope. Your token has: [${ctx.props.scope.join(", ")}].`
+        );
+      }
+      const kv = ctx.env.RATE_LIMIT_KV;
+      if (!kv) {
+        return err(
+          "RATE_LIMIT_KV binding is not available in this environment. Add the binding to wrangler.jsonc and redeploy."
+        );
+      }
+      const { subscriberId, since } = args;
+      if (subscriberId) {
+        const raw = await kv.get(`bundle-depleted:${subscriberId}`, "text");
+        if (!raw) {
+          return ok({
+            subscriber_id: subscriberId,
+            depleted: false,
+            event: null,
+            note: "No bundle depletion event found in the last 7 days."
+          });
+        }
+        let event;
+        try {
+          event = JSON.parse(raw);
+        } catch {
+          return ok({
+            subscriber_id: subscriberId,
+            depleted: false,
+            event: null,
+            note: "Stored depletion entry was invalid JSON and was ignored."
+          });
+        }
+        if (since && event.depletedAt < since) {
+          return ok({
+            subscriber_id: subscriberId,
+            depleted: false,
+            event: null,
+            note: `No bundle depletion after ${since}.`
+          });
+        }
+        return ok({
+          subscriber_id: subscriberId,
+          depleted: true,
+          event: {
+            subscriber_id: event.subscriberId,
+            iccid: event.iccid,
+            msisdn: event.msisdn,
+            plan_id: event.planId,
+            depleted_at: event.depletedAt
+          }
+        });
+      }
+      const listResult = await kv.list({ prefix: "bundle-depleted:", limit: 20 });
+      if (listResult.keys.length === 0) {
+        return ok({
+          depletions: [],
+          total: 0,
+          note: "No bundle depletion events in the last 7 days."
+        });
+      }
+      const events = [];
+      await Promise.all(
+        listResult.keys.map(async (k) => {
+          const raw = await kv.get(k.name, "text");
+          if (!raw) return;
+          try {
+            const ev = JSON.parse(raw);
+            if (since && ev.depletedAt < since) return;
+            events.push({
+              subscriber_id: ev.subscriberId,
+              iccid: ev.iccid,
+              msisdn: ev.msisdn,
+              plan_id: ev.planId,
+              depleted_at: ev.depletedAt
+            });
+          } catch {
+          }
+        })
+      );
+      events.sort((a, b) => b.depleted_at.localeCompare(a.depleted_at));
+      return ok({
+        depletions: events,
+        total: events.length,
+        list_truncated: !listResult.list_complete
+      });
+    }
+  );
+}
+
+// src/tools-country-history.ts
+import { z as z8 } from "zod";
+function registerCountryHistoryTool(server2, ctx) {
+  server2.registerTool(
+    "subscriber_country_history",
+    {
+      title: "Subscriber Country History",
+      description: "Return cross-border movement history for a subscriber from Relay LU events. Reads country.entered events from the OCS ring-buffer (24h window, up to `limit` entries per request) written by the Bridge4IP Relay LU webhook. Each entry includes the new country, previous country, MCC/MNC, and timestamp. Use this to answer: 'where has subscriber X traveled', 'show country history for ICCID', 'border crossings for this SIM'. Params: `subscriberId` (ICCID, 19\u201320 digits), `limit` (1\u201350, default 20, newest first). Returns: ordered list of country.entered events with { new_country, previous_country, mcc, mnc, timestamp, source }. Empty list when no cross-border events recorded. Do NOT use this for raw location events \u2014 use `list_recent_ocs_events` with event_types=['location.changed'] for finer-grained location data.",
+      inputSchema: {
+        subscriberId: z8.string().regex(/^\d{19,20}$/, "subscriberId must be a 19\u201320 digit ICCID").describe("Subscriber ICCID (19\u201320 digits, ITU-T E.118)"),
+        limit: z8.number().int().min(1).max(50).default(20).optional().describe("Maximum number of events to return, newest first (default 20, max 50)")
+      },
+      annotations: { readOnlyHint: true, idempotentHint: true }
+    },
+    wrapHandler(
+      "subscriber_country_history",
+      "[country-history:kv]",
+      "read",
+      ctx,
+      async ({ subscriberId, limit }) => {
+        const effectiveLimit = limit ?? 20;
+        const result2 = await listRecentOcsEvents2(
+          subscriberId,
+          effectiveLimit,
+          ["country.entered"],
+          void 0,
+          ctx.env.OCS_EVENT_ROUTING
+        );
+        const countryEvents = result2.events;
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(
+                {
+                  subscriber_id: subscriberId,
+                  country_events: countryEvents.map((e) => ({
+                    event_id: e.event_id,
+                    new_country: e.data["new_country"] ?? null,
+                    previous_country: e.data["previous_country"] ?? null,
+                    mcc: e.data["mcc"] ?? null,
+                    mnc: e.data["mnc"] ?? null,
+                    timestamp: e.timestamp,
+                    source: e.data["source"] ?? "relay-lu"
+                  })),
+                  total_country_events: countryEvents.length,
+                  total_in_buffer: result2.total_in_buffer,
+                  note: countryEvents.length === 0 ? "No cross-border events recorded in the 24h ring-buffer for this subscriber." : void 0
+                },
+                null,
+                2
+              )
+            }
+          ]
+        };
+      }
+    )
+  );
+}
+
+// src/apps/fleet-health-app.ts
+import { z as z9 } from "zod";
 import {
   registerAppTool,
   registerAppResource,
@@ -5222,10 +5740,10 @@ import {
 async function safeCallWithToken(client, _token, method, params = {}) {
   try {
     return { data: await client.call(method, params), error: null };
-  } catch (err2) {
+  } catch (err4) {
     return {
       data: null,
-      error: err2 instanceof Error ? err2.message : String(err2)
+      error: err4 instanceof Error ? err4.message : String(err4)
     };
   }
 }
@@ -5272,7 +5790,7 @@ function registerFleetHealthApp(server2, ctx) {
       title: "Fleet Health Dashboard",
       description: "Renders an interactive Fleet Health Dashboard with eSIM status charts, top-10 account breakdown, and low-balance alerts. Returns structuredContent for the chart panel.",
       inputSchema: {
-        accountId: z6.number().optional().describe("Filter to a specific account (omit for all)")
+        accountId: z9.number().optional().describe("Filter to a specific account (omit for all)")
       },
       annotations: { readOnlyHint: true },
       _meta: {
@@ -5284,7 +5802,7 @@ function registerFleetHealthApp(server2, ctx) {
     },
     async ({ accountId }) => {
       const token2 = await ctx.getUserToken(ctx.props.sub);
-      const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+      const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
       const [statusResult, accountsResult] = await Promise.all([
         safeCallWithToken(
           client,
@@ -5370,7 +5888,7 @@ function registerFleetHealthApp(server2, ctx) {
 }
 
 // src/apps/provisioning-wizard.ts
-import { z as z7 } from "zod";
+import { z as z10 } from "zod";
 import {
   registerAppTool as registerAppTool2,
   registerAppResource as registerAppResource2,
@@ -5423,10 +5941,10 @@ async function deleteWizardSession(env, sub, wizardId) {
 async function safeCallWithToken2(client, _token, method, params = {}) {
   try {
     return { data: await client.call(method, params), error: null };
-  } catch (err2) {
+  } catch (err4) {
     return {
       data: null,
-      error: err2 instanceof Error ? err2.message : String(err2)
+      error: err4 instanceof Error ? err4.message : String(err4)
     };
   }
 }
@@ -5475,10 +5993,10 @@ function registerProvisioningWizard(server2, ctx) {
       title: "eSIM Provisioning Wizard",
       description: "Interactive 3-step wizard to provision an eSIM: select subscriber, choose package template, preview (dry_run) and confirm execution.",
       inputSchema: {
-        step: z7.enum(["init", "select-package", "preview", "confirm"]).describe("Current wizard step"),
-        wizardId: z7.string().optional().describe("Wizard session ID (absent on init)"),
-        subscriber_iccid: z7.string().optional().describe("Subscriber ICCID (required for select-package)"),
-        package_template_id: z7.number().optional().describe("Package template ID (required for preview)")
+        step: z10.enum(["init", "select-package", "preview", "confirm"]).describe("Current wizard step"),
+        wizardId: z10.string().optional().describe("Wizard session ID (absent on init)"),
+        subscriber_iccid: z10.string().optional().describe("Subscriber ICCID (required for select-package)"),
+        package_template_id: z10.number().optional().describe("Package template ID (required for preview)")
       },
       _meta: {
         ui: {
@@ -5489,7 +6007,7 @@ function registerProvisioningWizard(server2, ctx) {
     },
     async ({ step, wizardId, subscriber_iccid, package_template_id }) => {
       const token2 = await ctx.getUserToken(ctx.props.sub);
-      const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+      const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
       if (step === "init") {
         const newWizardId = generateWizardId();
         const subscribersResult = await safeCallWithToken2(
@@ -5777,7 +6295,7 @@ function registerProvisioningWizard(server2, ctx) {
 }
 
 // src/apps/balance-topup.ts
-import { z as z8 } from "zod";
+import { z as z11 } from "zod";
 import {
   registerAppTool as registerAppTool3,
   registerAppResource as registerAppResource3,
@@ -5786,10 +6304,10 @@ import {
 async function safeCallWithToken3(client, _token, method, params = {}) {
   try {
     return { data: await client.call(method, params), error: null };
-  } catch (err2) {
+  } catch (err4) {
     return {
       data: null,
-      error: err2 instanceof Error ? err2.message : String(err2)
+      error: err4 instanceof Error ? err4.message : String(err4)
     };
   }
 }
@@ -5830,9 +6348,9 @@ function registerBalanceTopupApp(server2, ctx) {
       title: "Balance Top-up Form",
       description: "Enterprise admin tool: preview or commit an account balance adjustment. Set preview=true to fetch projection (no OCS write); preview=false (default) to execute. Requires admin scope + recent MFA.",
       inputSchema: {
-        iccid: z8.string().describe("The subscriber ICCID for the account lookup"),
-        delta: z8.number().describe("Amount to add (positive) or deduct (negative) from the account balance"),
-        preview: z8.boolean().default(true).describe("If true, return preview without writing. If false, execute the balance change.")
+        iccid: z11.string().describe("The subscriber ICCID for the account lookup"),
+        delta: z11.number().describe("Amount to add (positive) or deduct (negative) from the account balance"),
+        preview: z11.boolean().default(true).describe("If true, return preview without writing. If false, execute the balance change.")
       },
       annotations: { destructiveHint: true },
       _meta: {
@@ -5849,7 +6367,7 @@ function registerBalanceTopupApp(server2, ctx) {
       ctx,
       async ({ iccid, delta, preview }) => {
         const token2 = await ctx.getUserToken(ctx.props.sub);
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
         if (preview === true) {
           const result2 = await safeCallWithToken3(
             client,
@@ -5913,7 +6431,7 @@ function registerAllApps(server2, ctx) {
 }
 
 // src/prompts.ts
-import { z as z9 } from "zod";
+import { z as z12 } from "zod";
 function registerAllPrompts(server2) {
   server2.registerPrompt(
     "fleet_health_report",
@@ -5949,7 +6467,7 @@ Format as a structured report with sections, tables, and actionable recommendati
     {
       title: "Subscriber Deep Dive",
       description: "Comprehensive analysis of a single subscriber: profile, packages, usage patterns, location history, recommendations.",
-      argsSchema: { iccid: z9.string().describe("The subscriber ICCID to analyse") }
+      argsSchema: { iccid: z12.string().describe("The subscriber ICCID to analyse") }
     },
     async ({ iccid }) => ({
       messages: [
@@ -6048,7 +6566,7 @@ Analyze and present:
     {
       title: "Bulk Operations Planner",
       description: "Plan bulk operations safely: mass package assignments, account migrations, balance adjustments, or status changes.",
-      argsSchema: { operation: z9.string().describe("Describe the bulk operation you want to perform") }
+      argsSchema: { operation: z12.string().describe("Describe the bulk operation you want to perform") }
     },
     async ({ operation }) => ({
       messages: [
@@ -6081,7 +6599,7 @@ NEVER execute destructive operations without confirmation.`
 }
 
 // src/tools-pricing.ts
-import { z as z10 } from "zod";
+import { z as z13 } from "zod";
 
 // src/credits.ts
 var TIER_CREDIT_ALLOTMENTS = {
@@ -7448,8 +7966,8 @@ function buildPricingHandler(tool, ctx) {
           }
         ]
       };
-    } catch (err2) {
-      const message = err2 instanceof Error ? err2.message : String(err2);
+    } catch (err4) {
+      const message = err4 instanceof Error ? err4.message : String(err4);
       ctx.audit({
         tool_name: tool.name,
         ocs_method: "billing",
@@ -7473,19 +7991,19 @@ function buildZodSchema(schema) {
   for (const [key, prop] of Object.entries(properties)) {
     let field;
     if (prop.enum) {
-      field = z10.enum(prop.enum);
+      field = z13.enum(prop.enum);
     } else if (prop.type === "number") {
-      field = z10.number();
+      field = z13.number();
     } else if (prop.type === "boolean") {
-      field = z10.boolean();
+      field = z13.boolean();
     } else if (prop.type === "array") {
       if (prop.items?.type === "number") {
-        field = z10.array(z10.number());
+        field = z13.array(z13.number());
       } else {
-        field = z10.array(z10.string());
+        field = z13.array(z13.string());
       }
     } else {
-      field = z10.string();
+      field = z13.string();
     }
     const required = schema.required ?? [];
     if (!required.includes(key)) {
@@ -7500,7 +8018,7 @@ function buildZodSchema(schema) {
 }
 
 // src/tools-ui-agent-schedule.ts
-import { z as z11 } from "zod";
+import { z as z14 } from "zod";
 
 // src/manus-common.ts
 var MANUS_API_BASE = "https://api.manus.ai/v2";
@@ -7769,8 +8287,8 @@ function writeUsageThresholdAudit(env, severity, remainingCredits, month, taskCo
       doubles: [remainingCredits],
       indexes: ["manus_usage"]
     });
-  } catch (err2) {
-    console.error(`[manus-usage] threshold audit write failed: ${err2.message}`);
+  } catch (err4) {
+    console.error(`[manus-usage] threshold audit write failed: ${err4.message}`);
   }
 }
 
@@ -7807,12 +8325,12 @@ function registerScheduleAndUsageTools(server2, ctx) {
       title: "Create Manus Schedule (UI Agent)",
       description: "Creates a recurring Manus agent run on a cron schedule. Use this to automate periodic OCS audits, fleet health checks, or any recurring browser-automation task. Minimum interval: 5 minutes (*/1, */2, */3, */4 and '* * * * *' are rejected). Requires admin scope. Returns schedule_id.",
       inputSchema: {
-        name: z11.string().describe("Human-readable name for this schedule"),
-        cron: z11.string().describe(
+        name: z14.string().describe("Human-readable name for this schedule"),
+        cron: z14.string().describe(
           "Standard 5-field cron expression (minute hour day month weekday). Minimum interval: 5 minutes. Example: '0 */6 * * *' = every 6 hours."
         ),
-        prompt_template: z11.string().describe("Agent prompt/task template the Manus agent will execute on each run"),
-        profile: z11.string().optional().describe("Manus agent profile to use. Defaults to 'manus-1.6-lite'.")
+        prompt_template: z14.string().describe("Agent prompt/task template the Manus agent will execute on each run"),
+        profile: z14.string().optional().describe("Manus agent profile to use. Defaults to 'manus-1.6-lite'.")
       }
     },
     async (args) => {
@@ -7880,7 +8398,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err2) {
+      } catch (err4) {
         ctx.audit({
           tool_name: "ui_agent_schedule_create",
           ocs_method: "[manus:schedule.create]",
@@ -7889,7 +8407,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           duration_ms: Date.now() - start,
           event_type: "ui_agent_dispatch"
         });
-        const msg = err2 instanceof ManusScheduleError ? `Manus API error (HTTP ${err2.statusCode}): ${err2.message}` : err2 instanceof Error ? err2.message : String(err2);
+        const msg = err4 instanceof ManusScheduleError ? `Manus API error (HTTP ${err4.statusCode}): ${err4.message}` : err4 instanceof Error ? err4.message : String(err4);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -7947,7 +8465,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err2) {
+      } catch (err4) {
         ctx.audit({
           tool_name: "ui_agent_schedule_list",
           ocs_method: "[manus:schedule.list]",
@@ -7955,7 +8473,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           dry_run: false,
           duration_ms: Date.now() - start
         });
-        const msg = err2 instanceof ManusScheduleError ? `Manus API error (HTTP ${err2.statusCode}): ${err2.message}` : err2 instanceof Error ? err2.message : String(err2);
+        const msg = err4 instanceof ManusScheduleError ? `Manus API error (HTTP ${err4.statusCode}): ${err4.message}` : err4 instanceof Error ? err4.message : String(err4);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -7966,7 +8484,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
       title: "Delete Manus Schedule",
       description: "Permanently deletes a Manus recurring schedule. This cannot be undone. Use ui_agent_schedule_pause to temporarily suspend instead. Requires admin scope.",
       inputSchema: {
-        schedule_id: z11.string().describe("ID of the schedule to delete")
+        schedule_id: z14.string().describe("ID of the schedule to delete")
       }
     },
     async (args) => {
@@ -8016,7 +8534,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err2) {
+      } catch (err4) {
         ctx.audit({
           tool_name: "ui_agent_schedule_delete",
           ocs_method: "[manus:schedule.delete]",
@@ -8025,7 +8543,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           duration_ms: Date.now() - start,
           event_type: "ui_agent_dispatch"
         });
-        const msg = err2 instanceof ManusScheduleError ? `Manus API error (HTTP ${err2.statusCode}): ${err2.message}` : err2 instanceof Error ? err2.message : String(err2);
+        const msg = err4 instanceof ManusScheduleError ? `Manus API error (HTTP ${err4.statusCode}): ${err4.message}` : err4 instanceof Error ? err4.message : String(err4);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -8036,7 +8554,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
       title: "Pause Manus Schedule",
       description: "Pauses an active Manus recurring schedule. The schedule is preserved and can be resumed later with ui_agent_schedule_resume. Requires admin scope.",
       inputSchema: {
-        schedule_id: z11.string().describe("ID of the schedule to pause")
+        schedule_id: z14.string().describe("ID of the schedule to pause")
       }
     },
     async (args) => {
@@ -8086,7 +8604,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err2) {
+      } catch (err4) {
         ctx.audit({
           tool_name: "ui_agent_schedule_pause",
           ocs_method: "[manus:schedule.pause]",
@@ -8095,7 +8613,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           duration_ms: Date.now() - start,
           event_type: "ui_agent_dispatch"
         });
-        const msg = err2 instanceof ManusScheduleError ? `Manus API error (HTTP ${err2.statusCode}): ${err2.message}` : err2 instanceof Error ? err2.message : String(err2);
+        const msg = err4 instanceof ManusScheduleError ? `Manus API error (HTTP ${err4.statusCode}): ${err4.message}` : err4 instanceof Error ? err4.message : String(err4);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -8106,7 +8624,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
       title: "Resume Manus Schedule",
       description: "Resumes a paused Manus recurring schedule. Requires admin scope.",
       inputSchema: {
-        schedule_id: z11.string().describe("ID of the schedule to resume")
+        schedule_id: z14.string().describe("ID of the schedule to resume")
       }
     },
     async (args) => {
@@ -8156,7 +8674,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err2) {
+      } catch (err4) {
         ctx.audit({
           tool_name: "ui_agent_schedule_resume",
           ocs_method: "[manus:schedule.resume]",
@@ -8165,7 +8683,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           duration_ms: Date.now() - start,
           event_type: "ui_agent_dispatch"
         });
-        const msg = err2 instanceof ManusScheduleError ? `Manus API error (HTTP ${err2.statusCode}): ${err2.message}` : err2 instanceof Error ? err2.message : String(err2);
+        const msg = err4 instanceof ManusScheduleError ? `Manus API error (HTTP ${err4.statusCode}): ${err4.message}` : err4 instanceof Error ? err4.message : String(err4);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -8210,7 +8728,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err2) {
+      } catch (err4) {
         ctx.audit({
           tool_name: "ui_agent_usage",
           ocs_method: "[manus:usage.get]",
@@ -8218,7 +8736,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           dry_run: false,
           duration_ms: Date.now() - start
         });
-        const msg = err2 instanceof Error ? err2.message : String(err2);
+        const msg = err4 instanceof Error ? err4.message : String(err4);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -8226,7 +8744,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
 }
 
 // src/tools-ui-agent.ts
-import { z as z12 } from "zod";
+import { z as z15 } from "zod";
 
 // src/clerk.ts
 import { createClerkClient } from "@clerk/backend";
@@ -8461,7 +8979,7 @@ Report success or failure with a clear summary.`;
           }
         ]
       };
-    } catch (err2) {
+    } catch (err4) {
       ctx.audit({
         tool_name: toolName,
         ocs_method: `[ui-agent:${gapId}]`,
@@ -8475,7 +8993,7 @@ Report success or failure with a clear summary.`;
         content: [
           {
             type: "text",
-            text: `Error dispatching UI agent: ${err2 instanceof Error ? err2.message : String(err2)}`
+            text: `Error dispatching UI agent: ${err4 instanceof Error ? err4.message : String(err4)}`
           }
         ]
       };
@@ -8489,9 +9007,9 @@ function registerAllUiAgentTools(server2, ctx) {
       title: "Create Steering List (UI Agent)",
       description: "Creates a new network steering list (OPLMN preference configuration) via the OCS web dashboard. This operation is not available via the OCS REST API. A Manus browser agent will be dispatched to perform the operation. Params: `name` (steering list name), `description` (optional). Returns: dispatch confirmation with Manus task ID for tracking.",
       inputSchema: {
-        name: z12.string().describe("Name for the new steering list"),
-        description: z12.string().optional().describe("Optional description for the steering list"),
-        dry_run: z12.boolean().optional().describe("Preview the agent prompt without dispatching")
+        name: z15.string().describe("Name for the new steering list"),
+        description: z15.string().optional().describe("Optional description for the steering list"),
+        dry_run: z15.boolean().optional().describe("Preview the agent prompt without dispatching")
       }
     },
     wrapUiAgentHandler(
@@ -8514,11 +9032,11 @@ After creation, note the new steering list ID from the dashboard.
       title: "Build Steering List (UI Agent)",
       description: "Adds or removes operators (MCC-MNC) from an existing steering list via the OCS web dashboard. This operation is not available via the OCS REST API. Params: `steering_list_id`, `add_operators` (array of MCC-MNC to add), `remove_operators` (array to remove), `operator_type` ('priority' or 'excluded').",
       inputSchema: {
-        steering_list_id: z12.number().describe("ID of the steering list to modify"),
-        add_operators: z12.array(z12.string()).optional().describe("MCC-MNC codes to add (e.g. ['20801', '26201'])"),
-        remove_operators: z12.array(z12.string()).optional().describe("MCC-MNC codes to remove"),
-        operator_type: z12.enum(["priority", "excluded"]).default("priority").describe("Whether operators are priority or excluded"),
-        dry_run: z12.boolean().optional().describe("Preview the agent prompt without dispatching")
+        steering_list_id: z15.number().describe("ID of the steering list to modify"),
+        add_operators: z15.array(z15.string()).optional().describe("MCC-MNC codes to add (e.g. ['20801', '26201'])"),
+        remove_operators: z15.array(z15.string()).optional().describe("MCC-MNC codes to remove"),
+        operator_type: z15.enum(["priority", "excluded"]).default("priority").describe("Whether operators are priority or excluded"),
+        dry_run: z15.boolean().optional().describe("Preview the agent prompt without dispatching")
       }
     },
     wrapUiAgentHandler(
@@ -8541,9 +9059,9 @@ Operator type: ${args.operator_type ?? "priority"}
       title: "Set Account Steering List (UI Agent)",
       description: "Assigns or removes a steering list at the account level via the OCS web dashboard. The subscriber-level counterpart `modify_subscriber_steering_list` is available via API; this account-level operation is UI-only. Params: `account_id`, `steering_list_id` (0 to remove).",
       inputSchema: {
-        account_id: z12.number().describe("Account ID to assign the steering list to"),
-        steering_list_id: z12.number().describe("Steering list ID to assign (0 to remove/unset)"),
-        dry_run: z12.boolean().optional().describe("Preview the agent prompt without dispatching")
+        account_id: z15.number().describe("Account ID to assign the steering list to"),
+        steering_list_id: z15.number().describe("Steering list ID to assign (0 to remove/unset)"),
+        dry_run: z15.boolean().optional().describe("Preview the agent prompt without dispatching")
       }
     },
     wrapUiAgentHandler(
@@ -8565,10 +9083,10 @@ Open account ID ${args.account_id}.
       title: "Create Account (UI Agent)",
       description: "Creates a new sub-account under the reseller via the OCS web dashboard. This operation is not available via the OCS REST API. Params: `name` (account name), `description` (optional), `initial_balance` (optional, default 0).",
       inputSchema: {
-        name: z12.string().describe("Name for the new account"),
-        description: z12.string().optional().describe("Optional description"),
-        initial_balance: z12.number().optional().describe("Initial balance in account currency (default 0)"),
-        dry_run: z12.boolean().optional().describe("Preview the agent prompt without dispatching")
+        name: z15.string().describe("Name for the new account"),
+        description: z15.string().optional().describe("Optional description"),
+        initial_balance: z15.number().optional().describe("Initial balance in account currency (default 0)"),
+        dry_run: z15.boolean().optional().describe("Preview the agent prompt without dispatching")
       }
     },
     wrapUiAgentHandler(
@@ -8592,10 +9110,10 @@ After creation, note the new account ID from the dashboard.
       title: "Create Destination List (UI Agent)",
       description: "Creates a new destination list (named set of phone number prefixes for MOC call permissions) via the OCS web dashboard. Params: `name`, `prefixes` (array of prefix strings), `description`.",
       inputSchema: {
-        name: z12.string().describe("Name for the new destination list"),
-        prefixes: z12.array(z12.string()).optional().describe("Phone number prefixes to include (e.g. ['+31', '+49'])"),
-        description: z12.string().optional().describe("Optional description"),
-        dry_run: z12.boolean().optional().describe("Preview the agent prompt without dispatching")
+        name: z15.string().describe("Name for the new destination list"),
+        prefixes: z15.array(z15.string()).optional().describe("Phone number prefixes to include (e.g. ['+31', '+49'])"),
+        description: z15.string().optional().describe("Optional description"),
+        dry_run: z15.boolean().optional().describe("Preview the agent prompt without dispatching")
       }
     },
     wrapUiAgentHandler(
@@ -8618,11 +9136,11 @@ Create a new destination list with the following details:
       title: "Edit Destination List (UI Agent)",
       description: "Edits an existing destination list via the OCS web dashboard. Params: `destination_list_id`, `add_prefixes`, `remove_prefixes`, `new_name`.",
       inputSchema: {
-        destination_list_id: z12.number().describe("ID of the destination list to edit"),
-        add_prefixes: z12.array(z12.string()).optional().describe("Prefixes to add"),
-        remove_prefixes: z12.array(z12.string()).optional().describe("Prefixes to remove"),
-        new_name: z12.string().optional().describe("Rename the destination list"),
-        dry_run: z12.boolean().optional().describe("Preview the agent prompt without dispatching")
+        destination_list_id: z15.number().describe("ID of the destination list to edit"),
+        add_prefixes: z15.array(z15.string()).optional().describe("Prefixes to add"),
+        remove_prefixes: z15.array(z15.string()).optional().describe("Prefixes to remove"),
+        new_name: z15.string().optional().describe("Rename the destination list"),
+        dry_run: z15.boolean().optional().describe("Preview the agent prompt without dispatching")
       }
     },
     wrapUiAgentHandler(
@@ -8645,8 +9163,8 @@ Open destination list ID ${args.destination_list_id} for editing.
       title: "Delete Destination List (UI Agent)",
       description: "Deletes a destination list via the OCS web dashboard. Params: `destination_list_id`. WARNING: This is destructive and cannot be undone.",
       inputSchema: {
-        destination_list_id: z12.number().describe("ID of the destination list to delete"),
-        dry_run: z12.boolean().optional().describe("Preview the agent prompt without dispatching")
+        destination_list_id: z15.number().describe("ID of the destination list to delete"),
+        dry_run: z15.boolean().optional().describe("Preview the agent prompt without dispatching")
       }
     },
     wrapUiAgentHandler(
@@ -8667,8 +9185,8 @@ Verify the list no longer appears in the dashboard.
       title: "Delete Package Template (UI Agent)",
       description: "Deletes a package template from the product catalog via the OCS web dashboard. This operation is not available via the OCS REST API. Params: `template_id`. WARNING: This is destructive.",
       inputSchema: {
-        template_id: z12.number().describe("ID of the package template to delete"),
-        dry_run: z12.boolean().optional().describe("Preview the agent prompt without dispatching")
+        template_id: z15.number().describe("ID of the package template to delete"),
+        dry_run: z15.boolean().optional().describe("Preview the agent prompt without dispatching")
       }
     },
     wrapUiAgentHandler(
@@ -8689,11 +9207,11 @@ Verify the template no longer appears in the template list.
       title: "Edit Location Zone (UI Agent)",
       description: "Edits an existing location zone via the OCS web dashboard. `create_location_zone` is available via API; edit is UI-only. Params: `zone_id`, `new_name`, `add_countries`, `remove_countries`.",
       inputSchema: {
-        zone_id: z12.number().describe("ID of the location zone to edit"),
-        new_name: z12.string().optional().describe("Rename the location zone"),
-        add_countries: z12.array(z12.string()).optional().describe("ISO country codes to add (e.g. ['NL', 'DE'])"),
-        remove_countries: z12.array(z12.string()).optional().describe("ISO country codes to remove"),
-        dry_run: z12.boolean().optional().describe("Preview the agent prompt without dispatching")
+        zone_id: z15.number().describe("ID of the location zone to edit"),
+        new_name: z15.string().optional().describe("Rename the location zone"),
+        add_countries: z15.array(z15.string()).optional().describe("ISO country codes to add (e.g. ['NL', 'DE'])"),
+        remove_countries: z15.array(z15.string()).optional().describe("ISO country codes to remove"),
+        dry_run: z15.boolean().optional().describe("Preview the agent prompt without dispatching")
       }
     },
     wrapUiAgentHandler(
@@ -8716,8 +9234,8 @@ Open location zone ID ${args.zone_id} for editing.
       title: "Delete Location Zone (UI Agent)",
       description: "Deletes a location zone via the OCS web dashboard. `create_location_zone` is available via API; delete is UI-only. Params: `zone_id`. WARNING: Zones in use by active templates may not be deletable.",
       inputSchema: {
-        zone_id: z12.number().describe("ID of the location zone to delete"),
-        dry_run: z12.boolean().optional().describe("Preview the agent prompt without dispatching")
+        zone_id: z15.number().describe("ID of the location zone to delete"),
+        dry_run: z15.boolean().optional().describe("Preview the agent prompt without dispatching")
       }
     },
     wrapUiAgentHandler(
@@ -8736,7 +9254,7 @@ Verify the zone no longer appears in the zone list.
 }
 
 // src/tools-ui-agent-ask.ts
-import { z as z13 } from "zod";
+import { z as z16 } from "zod";
 
 // src/manus-webhook.ts
 var MAX_ATTACHMENT_BYTES = 25 * 1024 * 1024;
@@ -8839,8 +9357,8 @@ function registerUiAgentAskTools(server2, ctx) {
       title: "Reply to Paused UI Agent Task",
       description: "Resumes a Manus browser automation task that paused with stop_reason 'ask'. Use ui_agent_list_pending to find tasks waiting for input. Provide the task_id and your reply (e.g. a 2FA code, a field value, or a yes/no answer). The reply content is never recorded in audit logs \u2014 only its length is logged.",
       inputSchema: {
-        task_id: z13.string().describe("Manus task ID to resume (from ui_agent_list_pending)"),
-        reply: z13.string().describe("Your answer to the agent's question (e.g. a 2FA code or confirmation)")
+        task_id: z16.string().describe("Manus task ID to resume (from ui_agent_list_pending)"),
+        reply: z16.string().describe("Your answer to the agent's question (e.g. a 2FA code or confirmation)")
       }
     },
     async (args) => {
@@ -8899,7 +9417,7 @@ function registerUiAgentAskTools(server2, ctx) {
       try {
         const replyOutcome = await askReply(keys, task_id, reply);
         result2 = replyOutcome.data;
-      } catch (err2) {
+      } catch (err4) {
         ctx.audit({
           tool_name: "ui_agent_reply",
           ocs_method: "[ui-agent:ask-reply]",
@@ -8914,7 +9432,7 @@ function registerUiAgentAskTools(server2, ctx) {
           content: [
             {
               type: "text",
-              text: `Error calling Manus task.reply: ${err2 instanceof Error ? err2.message : String(err2)}`
+              text: `Error calling Manus task.reply: ${err4 instanceof Error ? err4.message : String(err4)}`
             }
           ]
         };
@@ -8992,13 +9510,13 @@ function registerUiAgentAskTools(server2, ctx) {
       try {
         const listing = await ctx.env.CARRIER_USERS.list({ prefix: PENDING_ASK_PREFIX });
         keys = listing.keys;
-      } catch (err2) {
+      } catch (err4) {
         return {
           isError: true,
           content: [
             {
               type: "text",
-              text: `Error listing pending tasks: ${err2 instanceof Error ? err2.message : String(err2)}`
+              text: `Error listing pending tasks: ${err4 instanceof Error ? err4.message : String(err4)}`
             }
           ]
         };
@@ -9049,7 +9567,7 @@ function registerUiAgentAskTools(server2, ctx) {
 }
 
 // src/stripe-connect-tools.ts
-import { z as z14 } from "zod";
+import { z as z17 } from "zod";
 import * as Sentry2 from "@sentry/cloudflare";
 
 // src/audit.ts
@@ -9085,10 +9603,10 @@ async function issueConfirmToken(env, sub, toolName) {
   await env.OAUTH_KV.put(key, token2, { expirationTtl: 300 });
   return token2;
 }
-function ok(text) {
+function ok2(text) {
   return { content: [{ type: "text", text }] };
 }
-function err(text) {
+function err2(text) {
   return { isError: true, content: [{ type: "text", text }] };
 }
 async function stripeGet(stripeKey, path, connectedAccountId) {
@@ -9123,7 +9641,7 @@ function registerStripeConnectTools(server2, ctx) {
     "stripe_connect_status",
     "Read-only: returns the Stripe Connect account status, capabilities, and requirements for the authenticated operator.",
     {
-      operator_id: z14.string().optional().describe("Override operator_id (admin use). Defaults to caller's org/user.")
+      operator_id: z17.string().optional().describe("Override operator_id (admin use). Defaults to caller's org/user.")
     },
     async ({ operator_id }) => {
       const opId = operator_id ?? operatorId;
@@ -9131,13 +9649,13 @@ function registerStripeConnectTools(server2, ctx) {
       const start = Date.now();
       try {
         const stripeKey = env.STRIPE_SECRET_KEY;
-        if (!stripeKey) return err("Stripe not configured");
+        if (!stripeKey) return err2("Stripe not configured");
         const accountId = await env.CARRIER_USERS.get(opKvKey);
         if (!accountId) {
-          return ok(JSON.stringify({ status: "not_connected", operator_id: opId }));
+          return ok2(JSON.stringify({ status: "not_connected", operator_id: opId }));
         }
         const result2 = await stripeGet(stripeKey, `/v1/accounts/${accountId}`);
-        if (!result2.ok) return err(`Stripe error: ${JSON.stringify(result2.data)}`);
+        if (!result2.ok) return err2(`Stripe error: ${JSON.stringify(result2.data)}`);
         const a = result2.data;
         const status = a.charges_enabled && a.details_submitted ? "active" : "pending";
         writeAudit(env, {
@@ -9149,7 +9667,7 @@ function registerStripeConnectTools(server2, ctx) {
           sub: props2.sub,
           reseller_id: props2.reseller_id
         });
-        return ok(JSON.stringify({
+        return ok2(JSON.stringify({
           status,
           operator_id: opId,
           account_id: accountId,
@@ -9163,7 +9681,7 @@ function registerStripeConnectTools(server2, ctx) {
         }));
       } catch (e) {
         Sentry2.captureException(e);
-        return err(`Error: ${e instanceof Error ? e.message : "unknown"}`);
+        return err2(`Error: ${e instanceof Error ? e.message : "unknown"}`);
       }
     }
   );
@@ -9171,20 +9689,20 @@ function registerStripeConnectTools(server2, ctx) {
     "stripe_connect_payouts",
     "Read-only: list recent payouts for the operator's connected Stripe account.",
     {
-      limit: z14.number().int().min(1).max(50).default(10).describe("Number of payouts to return."),
-      status: z14.enum(["pending", "paid", "failed", "canceled", "in_transit"]).optional().describe("Filter by payout status.")
+      limit: z17.number().int().min(1).max(50).default(10).describe("Number of payouts to return."),
+      status: z17.enum(["pending", "paid", "failed", "canceled", "in_transit"]).optional().describe("Filter by payout status.")
     },
     async ({ limit, status }) => {
       const start = Date.now();
       try {
         const stripeKey = env.STRIPE_SECRET_KEY;
-        if (!stripeKey) return err("Stripe not configured");
+        if (!stripeKey) return err2("Stripe not configured");
         const accountId = await getAccountId();
-        if (!accountId) return err("No connected Stripe account found.");
+        if (!accountId) return err2("No connected Stripe account found.");
         const params = new URLSearchParams({ limit: String(limit) });
         if (status) params.set("status", status);
         const result2 = await stripeGet(stripeKey, `/v1/payouts?${params.toString()}`, accountId);
-        if (!result2.ok) return err(`Stripe error: ${JSON.stringify(result2.data)}`);
+        if (!result2.ok) return err2(`Stripe error: ${JSON.stringify(result2.data)}`);
         writeAudit(env, {
           tool_name: "stripe_connect_payouts",
           ocs_method: "stripe.payouts.list",
@@ -9194,10 +9712,10 @@ function registerStripeConnectTools(server2, ctx) {
           sub: props2.sub,
           reseller_id: props2.reseller_id
         });
-        return ok(JSON.stringify({ payouts: result2.data.data, has_more: result2.data.has_more }));
+        return ok2(JSON.stringify({ payouts: result2.data.data, has_more: result2.data.has_more }));
       } catch (e) {
         Sentry2.captureException(e);
-        return err(`Error: ${e instanceof Error ? e.message : "unknown"}`);
+        return err2(`Error: ${e instanceof Error ? e.message : "unknown"}`);
       }
     }
   );
@@ -9209,11 +9727,11 @@ function registerStripeConnectTools(server2, ctx) {
       const start = Date.now();
       try {
         const stripeKey = env.STRIPE_SECRET_KEY;
-        if (!stripeKey) return err("Stripe not configured");
+        if (!stripeKey) return err2("Stripe not configured");
         const accountId = await getAccountId();
-        if (!accountId) return err("No connected Stripe account found.");
+        if (!accountId) return err2("No connected Stripe account found.");
         const result2 = await stripeGet(stripeKey, `/v1/balance`, accountId);
-        if (!result2.ok) return err(`Stripe error: ${JSON.stringify(result2.data)}`);
+        if (!result2.ok) return err2(`Stripe error: ${JSON.stringify(result2.data)}`);
         writeAudit(env, {
           tool_name: "stripe_connect_balance",
           ocs_method: "stripe.balance.read",
@@ -9223,14 +9741,14 @@ function registerStripeConnectTools(server2, ctx) {
           sub: props2.sub,
           reseller_id: props2.reseller_id
         });
-        return ok(JSON.stringify({
+        return ok2(JSON.stringify({
           account_id: accountId,
           available: result2.data.available ?? [],
           pending: result2.data.pending ?? []
         }));
       } catch (e) {
         Sentry2.captureException(e);
-        return err(`Error: ${e instanceof Error ? e.message : "unknown"}`);
+        return err2(`Error: ${e instanceof Error ? e.message : "unknown"}`);
       }
     }
   );
@@ -9238,17 +9756,17 @@ function registerStripeConnectTools(server2, ctx) {
     "stripe_connect_refund",
     "Admin: issue a refund on a charge via the operator's connected Stripe account. Requires confirm_token (call without token first to get one).",
     {
-      charge_id: z14.string().min(1).describe("Stripe charge ID (ch_...)."),
-      amount_cents: z14.number().int().min(1).optional().describe("Partial refund amount in cents. Omit for full refund."),
-      reason: z14.enum(["duplicate", "fraudulent", "requested_by_customer"]).optional(),
-      confirm_token: z14.string().optional().describe("Confirmation token from previous call. Required to execute.")
+      charge_id: z17.string().min(1).describe("Stripe charge ID (ch_...)."),
+      amount_cents: z17.number().int().min(1).optional().describe("Partial refund amount in cents. Omit for full refund."),
+      reason: z17.enum(["duplicate", "fraudulent", "requested_by_customer"]).optional(),
+      confirm_token: z17.string().optional().describe("Confirmation token from previous call. Required to execute.")
     },
     async ({ charge_id, amount_cents, reason, confirm_token }) => {
       const start = Date.now();
       const toolName = "stripe_connect_refund";
       if (!confirm_token) {
         const token2 = await issueConfirmToken(env, props2.sub, toolName);
-        return ok(
+        return ok2(
           `HARD_BLOCK: Refund ${amount_cents ? `${amount_cents} cents on` : "(full) on"} charge ${charge_id} requires confirmation.
 confirm_token: ${token2}
 Call again with confirm_token="${token2}" to execute. Token expires in 5 minutes.`
@@ -9256,18 +9774,18 @@ Call again with confirm_token="${token2}" to execute. Token expires in 5 minutes
       }
       const valid = await verifyConfirmToken(env, props2.sub, toolName, confirm_token);
       if (!valid) {
-        return err("Invalid or expired confirm_token. Call without token to get a new one.");
+        return err2("Invalid or expired confirm_token. Call without token to get a new one.");
       }
       try {
         const stripeKey = env.STRIPE_SECRET_KEY;
-        if (!stripeKey) return err("Stripe not configured");
+        if (!stripeKey) return err2("Stripe not configured");
         const accountId = await getAccountId();
-        if (!accountId) return err("No connected Stripe account found.");
+        if (!accountId) return err2("No connected Stripe account found.");
         const params = { charge: charge_id };
         if (amount_cents) params.amount = String(amount_cents);
         if (reason) params.reason = reason;
         const result2 = await stripePost(stripeKey, "/v1/refunds", params, accountId);
-        if (!result2.ok) return err(`Stripe error: ${JSON.stringify(result2.data)}`);
+        if (!result2.ok) return err2(`Stripe error: ${JSON.stringify(result2.data)}`);
         writeAudit(env, {
           tool_name: toolName,
           ocs_method: "stripe.refund.create",
@@ -9277,10 +9795,10 @@ Call again with confirm_token="${token2}" to execute. Token expires in 5 minutes
           sub: props2.sub,
           reseller_id: props2.reseller_id
         });
-        return ok(`Refund issued: ${result2.data.id} \u2014 status: ${result2.data.status}`);
+        return ok2(`Refund issued: ${result2.data.id} \u2014 status: ${result2.data.status}`);
       } catch (e) {
         Sentry2.captureException(e);
-        return err(`Error: ${e instanceof Error ? e.message : "unknown"}`);
+        return err2(`Error: ${e instanceof Error ? e.message : "unknown"}`);
       }
     }
   );
@@ -9288,20 +9806,20 @@ Call again with confirm_token="${token2}" to execute. Token expires in 5 minutes
     "stripe_connect_dispute_list",
     "Read-only: list active disputes for the operator's connected Stripe account.",
     {
-      limit: z14.number().int().min(1).max(50).default(10),
-      status: z14.string().optional().describe("Filter by dispute status (e.g. needs_response, under_review).")
+      limit: z17.number().int().min(1).max(50).default(10),
+      status: z17.string().optional().describe("Filter by dispute status (e.g. needs_response, under_review).")
     },
     async ({ limit, status }) => {
       const start = Date.now();
       try {
         const stripeKey = env.STRIPE_SECRET_KEY;
-        if (!stripeKey) return err("Stripe not configured");
+        if (!stripeKey) return err2("Stripe not configured");
         const accountId = await getAccountId();
-        if (!accountId) return err("No connected Stripe account found.");
+        if (!accountId) return err2("No connected Stripe account found.");
         const params = new URLSearchParams({ limit: String(limit) });
         if (status) params.set("status", status);
         const result2 = await stripeGet(stripeKey, `/v1/disputes?${params.toString()}`, accountId);
-        if (!result2.ok) return err(`Stripe error: ${JSON.stringify(result2.data)}`);
+        if (!result2.ok) return err2(`Stripe error: ${JSON.stringify(result2.data)}`);
         writeAudit(env, {
           tool_name: "stripe_connect_dispute_list",
           ocs_method: "stripe.disputes.list",
@@ -9311,10 +9829,10 @@ Call again with confirm_token="${token2}" to execute. Token expires in 5 minutes
           sub: props2.sub,
           reseller_id: props2.reseller_id
         });
-        return ok(JSON.stringify({ disputes: result2.data.data, has_more: result2.data.has_more }));
+        return ok2(JSON.stringify({ disputes: result2.data.data, has_more: result2.data.has_more }));
       } catch (e) {
         Sentry2.captureException(e);
-        return err(`Error: ${e instanceof Error ? e.message : "unknown"}`);
+        return err2(`Error: ${e instanceof Error ? e.message : "unknown"}`);
       }
     }
   );
@@ -9322,18 +9840,18 @@ Call again with confirm_token="${token2}" to execute. Token expires in 5 minutes
     "radar_review_list",
     "Read-only: list pending Radar reviews requiring manual platform decision.",
     {
-      open_only: z14.boolean().default(true).describe("If true, only returns open (undecided) reviews."),
-      limit: z14.number().int().min(1).max(50).default(10)
+      open_only: z17.boolean().default(true).describe("If true, only returns open (undecided) reviews."),
+      limit: z17.number().int().min(1).max(50).default(10)
     },
     async ({ open_only, limit }) => {
       const start = Date.now();
       try {
         const stripeKey = env.STRIPE_SECRET_KEY;
-        if (!stripeKey) return err("Stripe not configured");
+        if (!stripeKey) return err2("Stripe not configured");
         const params = new URLSearchParams({ limit: String(limit) });
         if (open_only) params.set("open", "true");
         const result2 = await stripeGet(stripeKey, `/v1/radar/reviews?${params.toString()}`);
-        if (!result2.ok) return err(`Stripe error: ${JSON.stringify(result2.data)}`);
+        if (!result2.ok) return err2(`Stripe error: ${JSON.stringify(result2.data)}`);
         writeAudit(env, {
           tool_name: "radar_review_list",
           ocs_method: "stripe.radar.reviews.list",
@@ -9343,10 +9861,10 @@ Call again with confirm_token="${token2}" to execute. Token expires in 5 minutes
           sub: props2.sub,
           reseller_id: props2.reseller_id
         });
-        return ok(JSON.stringify({ reviews: result2.data.data, has_more: result2.data.has_more }));
+        return ok2(JSON.stringify({ reviews: result2.data.data, has_more: result2.data.has_more }));
       } catch (e) {
         Sentry2.captureException(e);
-        return err(`Error: ${e instanceof Error ? e.message : "unknown"}`);
+        return err2(`Error: ${e instanceof Error ? e.message : "unknown"}`);
       }
     }
   );
@@ -9354,31 +9872,31 @@ Call again with confirm_token="${token2}" to execute. Token expires in 5 minutes
     "radar_review_approve",
     "Admin: approve a Radar review, allowing the charge to proceed. Requires confirm_token.",
     {
-      review_id: z14.string().min(1).describe("Stripe Radar review ID (prv_...)."),
-      confirm_token: z14.string().optional()
+      review_id: z17.string().min(1).describe("Stripe Radar review ID (prv_...)."),
+      confirm_token: z17.string().optional()
     },
     async ({ review_id, confirm_token }) => {
       const toolName = "radar_review_approve";
       const start = Date.now();
       if (!confirm_token) {
         const token2 = await issueConfirmToken(env, props2.sub, toolName);
-        return ok(
+        return ok2(
           `HARD_BLOCK: Approving review ${review_id} allows the charge to proceed.
 confirm_token: ${token2}
 Call again with confirm_token="${token2}" to execute. Expires in 5 minutes.`
         );
       }
       const valid = await verifyConfirmToken(env, props2.sub, toolName, confirm_token);
-      if (!valid) return err("Invalid or expired confirm_token.");
+      if (!valid) return err2("Invalid or expired confirm_token.");
       try {
         const stripeKey = env.STRIPE_SECRET_KEY;
-        if (!stripeKey) return err("Stripe not configured");
+        if (!stripeKey) return err2("Stripe not configured");
         const result2 = await stripePost(
           stripeKey,
           `/v1/radar/reviews/${review_id}/approve`,
           {}
         );
-        if (!result2.ok) return err(`Stripe error: ${JSON.stringify(result2.data)}`);
+        if (!result2.ok) return err2(`Stripe error: ${JSON.stringify(result2.data)}`);
         writeAudit(env, {
           tool_name: toolName,
           ocs_method: "stripe.radar.review.approve",
@@ -9388,10 +9906,10 @@ Call again with confirm_token="${token2}" to execute. Expires in 5 minutes.`
           sub: props2.sub,
           reseller_id: props2.reseller_id
         });
-        return ok(`Review ${review_id} approved. Charge will proceed.`);
+        return ok2(`Review ${review_id} approved. Charge will proceed.`);
       } catch (e) {
         Sentry2.captureException(e);
-        return err(`Error: ${e instanceof Error ? e.message : "unknown"}`);
+        return err2(`Error: ${e instanceof Error ? e.message : "unknown"}`);
       }
     }
   );
@@ -9399,31 +9917,31 @@ Call again with confirm_token="${token2}" to execute. Expires in 5 minutes.`
     "radar_review_decline",
     "Admin: decline a Radar review, blocking/closing the charge. Requires confirm_token.",
     {
-      review_id: z14.string().min(1),
-      confirm_token: z14.string().optional()
+      review_id: z17.string().min(1),
+      confirm_token: z17.string().optional()
     },
     async ({ review_id, confirm_token }) => {
       const toolName = "radar_review_decline";
       const start = Date.now();
       if (!confirm_token) {
         const token2 = await issueConfirmToken(env, props2.sub, toolName);
-        return ok(
+        return ok2(
           `HARD_BLOCK: Declining review ${review_id} will close/block the charge.
 confirm_token: ${token2}
 Expires in 5 minutes.`
         );
       }
       const valid = await verifyConfirmToken(env, props2.sub, toolName, confirm_token);
-      if (!valid) return err("Invalid or expired confirm_token.");
+      if (!valid) return err2("Invalid or expired confirm_token.");
       try {
         const stripeKey = env.STRIPE_SECRET_KEY;
-        if (!stripeKey) return err("Stripe not configured");
+        if (!stripeKey) return err2("Stripe not configured");
         const result2 = await stripePost(
           stripeKey,
           `/v1/radar/reviews/${review_id}/approve`,
           { reason: "fraudulent" }
         );
-        if (!result2.ok) return err(`Stripe error: ${JSON.stringify(result2.data)}`);
+        if (!result2.ok) return err2(`Stripe error: ${JSON.stringify(result2.data)}`);
         writeAudit(env, {
           tool_name: toolName,
           ocs_method: "stripe.radar.review.decline",
@@ -9433,10 +9951,10 @@ Expires in 5 minutes.`
           sub: props2.sub,
           reseller_id: props2.reseller_id
         });
-        return ok(`Review ${review_id} declined.`);
+        return ok2(`Review ${review_id} declined.`);
       } catch (e) {
         Sentry2.captureException(e);
-        return err(`Error: ${e instanceof Error ? e.message : "unknown"}`);
+        return err2(`Error: ${e instanceof Error ? e.message : "unknown"}`);
       }
     }
   );
@@ -9444,32 +9962,32 @@ Expires in 5 minutes.`
     "radar_value_list_add",
     "Admin: add an item (email, IP, card fingerprint, country code) to a Stripe Radar block/allow list. Requires confirm_token.",
     {
-      value_list_id: z14.string().min(1).describe("Stripe Radar value list ID (rsl_...)."),
-      value: z14.string().min(1).describe("The value to add (email, IP address, country code, etc.)."),
-      confirm_token: z14.string().optional()
+      value_list_id: z17.string().min(1).describe("Stripe Radar value list ID (rsl_...)."),
+      value: z17.string().min(1).describe("The value to add (email, IP address, country code, etc.)."),
+      confirm_token: z17.string().optional()
     },
     async ({ value_list_id, value, confirm_token }) => {
       const toolName = "radar_value_list_add";
       const start = Date.now();
       if (!confirm_token) {
         const token2 = await issueConfirmToken(env, props2.sub, toolName);
-        return ok(
+        return ok2(
           `HARD_BLOCK: Adding "${value}" to list ${value_list_id} will affect future charge decisions.
 confirm_token: ${token2}
 Expires in 5 minutes.`
         );
       }
       const valid = await verifyConfirmToken(env, props2.sub, toolName, confirm_token);
-      if (!valid) return err("Invalid or expired confirm_token.");
+      if (!valid) return err2("Invalid or expired confirm_token.");
       try {
         const stripeKey = env.STRIPE_SECRET_KEY;
-        if (!stripeKey) return err("Stripe not configured");
+        if (!stripeKey) return err2("Stripe not configured");
         const result2 = await stripePost(
           stripeKey,
           "/v1/radar/value_list_items",
           { value_list: value_list_id, value }
         );
-        if (!result2.ok) return err(`Stripe error: ${JSON.stringify(result2.data)}`);
+        if (!result2.ok) return err2(`Stripe error: ${JSON.stringify(result2.data)}`);
         writeAudit(env, {
           tool_name: toolName,
           ocs_method: "stripe.radar.value_list.add",
@@ -9479,10 +9997,10 @@ Expires in 5 minutes.`
           sub: props2.sub,
           reseller_id: props2.reseller_id
         });
-        return ok(`Added "${value}" to Radar list ${value_list_id}.`);
+        return ok2(`Added "${value}" to Radar list ${value_list_id}.`);
       } catch (e) {
         Sentry2.captureException(e);
-        return err(`Error: ${e instanceof Error ? e.message : "unknown"}`);
+        return err2(`Error: ${e instanceof Error ? e.message : "unknown"}`);
       }
     }
   );
@@ -9490,11 +10008,11 @@ Expires in 5 minutes.`
     "radar_rule_toggle",
     "Admin: enable or disable a Stripe Radar rule. NOTE: Stripe does not expose rule CRUD via the public API \u2014 this tool returns Dashboard instructions.",
     {
-      rule_id: z14.string().min(1).describe("Stripe Radar rule ID."),
-      enabled: z14.boolean().describe("true = enable, false = disable.")
+      rule_id: z17.string().min(1).describe("Stripe Radar rule ID."),
+      enabled: z17.boolean().describe("true = enable, false = disable.")
     },
     async ({ rule_id, enabled }) => {
-      return ok(
+      return ok2(
         `Stripe Radar does not expose rule enable/disable via the public API.
 To ${enabled ? "enable" : "disable"} rule ${rule_id}:
 1. Open https://dashboard.stripe.com/radar/rules
@@ -9506,6 +10024,513 @@ Note: If you need this automated, use the Radar for Platforms beta \u2014 contac
   );
 }
 
+// src/tools-greenzone.ts
+import { z as z18 } from "zod";
+
+// src/greenzone-whitelist.ts
+var STATE_KEY = "greenzone:state";
+var GREENZONE_PORTAL_PATH = "/greenzone";
+var MANAGE_HOSTS_PATH = "/greenzone/hosts";
+var MANAGE_IPS_PATH = "/greenzone/ips";
+async function readState(kv) {
+  const raw = await kv.get(STATE_KEY, "json");
+  if (!raw) {
+    return {
+      hosts: [],
+      ips: [],
+      last_synced_at: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  return raw;
+}
+async function writeState(kv, state) {
+  await kv.put(STATE_KEY, JSON.stringify(state), {
+    expirationTtl: 60 * 60 * 24 * 7
+    // 7 days
+  });
+}
+function stateAddHost(state, host) {
+  const normalised = host.toLowerCase().trim();
+  if (state.hosts.includes(normalised)) return state;
+  return {
+    ...state,
+    hosts: [...state.hosts, normalised].sort(),
+    last_synced_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function stateRemoveHost(state, host) {
+  const normalised = host.toLowerCase().trim();
+  return {
+    ...state,
+    hosts: state.hosts.filter((h) => h !== normalised),
+    last_synced_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function stateAddIp(state, ip) {
+  const normalised = ip.trim();
+  if (state.ips.includes(normalised)) return state;
+  return {
+    ...state,
+    ips: [...state.ips, normalised].sort(),
+    last_synced_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function stateRemoveIp(state, ip) {
+  const normalised = ip.trim();
+  return {
+    ...state,
+    ips: state.ips.filter((i) => i !== normalised),
+    last_synced_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function escapeForHasTextDoubleQuoted(fragment) {
+  return fragment.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+}
+function buildAddHostSteps(portalBaseUrl, host) {
+  return [
+    {
+      tool: "new_tab",
+      description: "Open a dedicated tab for Greenzone host whitelist operation"
+    },
+    {
+      tool: "navigate",
+      args: { url: `${portalBaseUrl}${MANAGE_HOSTS_PATH}` },
+      description: `Navigate to Manage hosts page at ${portalBaseUrl}${MANAGE_HOSTS_PATH}`
+    },
+    {
+      tool: "find",
+      args: { query: "Add host button or input field" },
+      description: "Find the 'Add host' button or input in Manage hosts menu"
+    },
+    {
+      tool: "click",
+      args: { selector: "[data-action='add-host'], button:has-text('Add'), a:has-text('Add host')" },
+      description: "Click Add host to open the entry form"
+    },
+    {
+      tool: "fill",
+      args: { selector: "input[name='host'], input[placeholder*='host'], input[type='text']", value: host },
+      description: `Fill in host value: ${host}`
+    },
+    {
+      tool: "click",
+      args: { selector: "button[type='submit'], button:has-text('Save'), button:has-text('Confirm')" },
+      description: "Submit the form to save the host"
+    },
+    {
+      tool: "screenshot",
+      description: "Screenshot to verify host was added successfully"
+    },
+    {
+      tool: "close",
+      description: "Close the tab (always runs \u2014 success or error)"
+    }
+  ];
+}
+function buildRemoveHostSteps(portalBaseUrl, host) {
+  const hostKey = host.toLowerCase().trim();
+  const hostText = escapeForHasTextDoubleQuoted(hostKey);
+  return [
+    {
+      tool: "new_tab",
+      description: "Open a dedicated tab for Greenzone host removal operation"
+    },
+    {
+      tool: "navigate",
+      args: { url: `${portalBaseUrl}${MANAGE_HOSTS_PATH}` },
+      description: `Navigate to Manage hosts page at ${portalBaseUrl}${MANAGE_HOSTS_PATH}`
+    },
+    {
+      tool: "find",
+      args: { query: `row containing host ${hostKey}` },
+      description: `Find the row for host: ${hostKey}`
+    },
+    {
+      tool: "click",
+      args: {
+        selector: `tr:has-text("${hostText}") [data-action='delete'], tr:has-text("${hostText}") button:has-text('Remove'), tr:has-text("${hostText}") button:has-text('Delete')`
+      },
+      description: `Click Remove/Delete for host: ${hostKey}`
+    },
+    {
+      tool: "click",
+      args: { selector: "button:has-text('Confirm'), button:has-text('Yes'), [data-action='confirm']" },
+      description: "Confirm the deletion in the confirmation dialog"
+    },
+    {
+      tool: "screenshot",
+      description: "Screenshot to verify host was removed"
+    },
+    {
+      tool: "close",
+      description: "Close the tab (always runs \u2014 success or error)"
+    }
+  ];
+}
+function buildAddIpSteps(portalBaseUrl, ip) {
+  return [
+    {
+      tool: "new_tab",
+      description: "Open a dedicated tab for Greenzone IP whitelist operation"
+    },
+    {
+      tool: "navigate",
+      args: { url: `${portalBaseUrl}${MANAGE_IPS_PATH}` },
+      description: `Navigate to Manage IPs page at ${portalBaseUrl}${MANAGE_IPS_PATH}`
+    },
+    {
+      tool: "find",
+      args: { query: "Add IP button or input field" },
+      description: "Find the 'Add IP' button or input in Manage IPs menu"
+    },
+    {
+      tool: "click",
+      args: { selector: "[data-action='add-ip'], button:has-text('Add'), a:has-text('Add IP')" },
+      description: "Click Add IP to open the entry form"
+    },
+    {
+      tool: "fill",
+      args: { selector: "input[name='ip'], input[placeholder*='IP'], input[placeholder*='ip'], input[type='text']", value: ip },
+      description: `Fill in IP value: ${ip}`
+    },
+    {
+      tool: "click",
+      args: { selector: "button[type='submit'], button:has-text('Save'), button:has-text('Confirm')" },
+      description: "Submit the form to save the IP"
+    },
+    {
+      tool: "screenshot",
+      description: "Screenshot to verify IP was added successfully"
+    },
+    {
+      tool: "close",
+      description: "Close the tab (always runs \u2014 success or error)"
+    }
+  ];
+}
+function buildRemoveIpSteps(portalBaseUrl, ip) {
+  const ipKey = ip.trim();
+  const ipText = escapeForHasTextDoubleQuoted(ipKey);
+  return [
+    {
+      tool: "new_tab",
+      description: "Open a dedicated tab for Greenzone IP removal operation"
+    },
+    {
+      tool: "navigate",
+      args: { url: `${portalBaseUrl}${MANAGE_IPS_PATH}` },
+      description: `Navigate to Manage IPs page at ${portalBaseUrl}${MANAGE_IPS_PATH}`
+    },
+    {
+      tool: "find",
+      args: { query: `row containing IP ${ipKey}` },
+      description: `Find the row for IP: ${ipKey}`
+    },
+    {
+      tool: "click",
+      args: {
+        selector: `tr:has-text("${ipText}") [data-action='delete'], tr:has-text("${ipText}") button:has-text('Remove'), tr:has-text("${ipText}") button:has-text('Delete')`
+      },
+      description: `Click Remove/Delete for IP: ${ipKey}`
+    },
+    {
+      tool: "click",
+      args: { selector: "button:has-text('Confirm'), button:has-text('Yes'), [data-action='confirm']" },
+      description: "Confirm the deletion in the confirmation dialog"
+    },
+    {
+      tool: "screenshot",
+      description: "Screenshot to verify IP was removed"
+    },
+    {
+      tool: "close",
+      description: "Close the tab (always runs \u2014 success or error)"
+    }
+  ];
+}
+function buildListSteps(portalBaseUrl) {
+  return [
+    {
+      tool: "new_tab",
+      description: "Open a dedicated tab for Greenzone whitelist read"
+    },
+    {
+      tool: "navigate",
+      args: { url: `${portalBaseUrl}${GREENZONE_PORTAL_PATH}` },
+      description: `Navigate to Greenzone overview at ${portalBaseUrl}${GREENZONE_PORTAL_PATH}`
+    },
+    {
+      tool: "find",
+      args: { query: "Manage hosts and Manage IPs sections or links" },
+      description: "Find Manage hosts and Manage IPs menu items"
+    },
+    {
+      tool: "screenshot",
+      description: "Screenshot of Greenzone overview for audit"
+    },
+    {
+      tool: "navigate",
+      args: { url: `${portalBaseUrl}${MANAGE_HOSTS_PATH}` },
+      description: "Navigate to Manage hosts to read current host list"
+    },
+    {
+      tool: "find",
+      args: { query: "host entries table or list" },
+      description: "Read all host entries from the page"
+    },
+    {
+      tool: "navigate",
+      args: { url: `${portalBaseUrl}${MANAGE_IPS_PATH}` },
+      description: "Navigate to Manage IPs to read current IP list"
+    },
+    {
+      tool: "find",
+      args: { query: "IP entries table or list" },
+      description: "Read all IP entries from the page"
+    },
+    {
+      tool: "close",
+      description: "Close the tab (always runs)"
+    }
+  ];
+}
+function resolvePortalBaseUrl(env) {
+  return env.GREENZONE_PORTAL_URL ?? env.CARRIER_OCS_PORTAL_URL ?? env.CARRIER_OCS_BASE_URL ?? "https://ocs.esimvault.cloud";
+}
+
+// src/tools-greenzone.ts
+function getGreenzoneKv(env) {
+  return env.GREENZONE_STATE_KV ?? null;
+}
+function ok3(payload) {
+  return { content: [{ type: "text", text: JSON.stringify(payload, null, 2) }] };
+}
+function err3(message) {
+  return { isError: true, content: [{ type: "text", text: message }] };
+}
+var KAPTURE_UNAVAILABLE_MSG = "Execute each Kapture step using mcp__kapture__* tools in sequence. Ensure the Kapture extension is active in Chrome before invoking.";
+function registerGreenzoneTools(server2, ctx) {
+  server2.registerTool(
+    "greenzone_whitelist_add",
+    {
+      title: "Greenzone Whitelist \u2014 Add",
+      description: "Add a hostname and/or IP address to the Bridge4IP Greenzone whitelist. The Greenzone whitelist controls which hosts/IPs are exempt from data charging after a subscriber's bundle is depleted. This operates via browser automation (Kapture) against the OCS portal \u2014 no REST API exists for this surface. Provide `host` (e.g. 'example.com') and/or `ip` (e.g. '203.0.113.0/24'). At least one of host or ip must be provided. Returns Kapture step sequence for Claude Code to execute. Requires 'write' scope and Kapture running in Sam's Chrome.",
+      inputSchema: {
+        host: z18.string().optional().describe("Hostname to whitelist (e.g. 'example.com')"),
+        ip: z18.string().optional().describe("IP address or CIDR to whitelist (e.g. '203.0.113.0/24')"),
+        dry_run: z18.boolean().optional().describe("If true, return the Kapture steps without executing portal automation")
+      },
+      annotations: { destructiveHint: true }
+    },
+    async (args) => {
+      if (!ctx.props.scope.includes("write")) {
+        return err3(
+          `Scope denied: greenzone_whitelist_add requires 'write' scope. Your token has: [${ctx.props.scope.join(", ")}].`
+        );
+      }
+      const { host, ip, dry_run } = args;
+      if (!host && !ip) {
+        return err3("At least one of 'host' or 'ip' must be provided.");
+      }
+      const portalBaseUrl = resolvePortalBaseUrl(ctx.env);
+      const steps = [
+        ...host ? buildAddHostSteps(portalBaseUrl, host) : [],
+        ...ip ? buildAddIpSteps(portalBaseUrl, ip) : []
+      ];
+      if (dry_run) {
+        return ok3({
+          dry_run: true,
+          message: "Would execute the following Kapture steps against the OCS portal:",
+          kapture_steps: steps,
+          host,
+          ip
+        });
+      }
+      const kv = getGreenzoneKv(ctx.env);
+      let state;
+      let kvWarning;
+      if (kv) {
+        try {
+          state = await readState(kv);
+          if (host) state = stateAddHost(state, host);
+          if (ip) state = stateAddIp(state, ip);
+          await writeState(kv, state);
+        } catch (e) {
+          kvWarning = `KV write failed: ${e instanceof Error ? e.message : String(e)}`;
+        }
+      } else {
+        kvWarning = "GREENZONE_STATE_KV not bound in stdio mode \u2014 state not persisted.";
+      }
+      return ok3({
+        requires_kapture: true,
+        message: "Execute the Kapture steps below to apply the change in the OCS portal. " + KAPTURE_UNAVAILABLE_MSG,
+        kapture_steps: steps,
+        kv_state: state ?? null,
+        kv_warning: kvWarning,
+        portal_base_url: portalBaseUrl
+      });
+    }
+  );
+  server2.registerTool(
+    "greenzone_whitelist_remove",
+    {
+      title: "Greenzone Whitelist \u2014 Remove",
+      description: "Remove a hostname and/or IP address from the Bridge4IP Greenzone whitelist. This operates via browser automation (Kapture) against the OCS portal. Provide `host` and/or `ip` to remove \u2014 at least one required. Returns Kapture step sequence for Claude Code to execute. Requires 'write' scope and Kapture running in Sam's Chrome.",
+      inputSchema: {
+        host: z18.string().optional().describe("Hostname to remove from whitelist"),
+        ip: z18.string().optional().describe("IP address or CIDR to remove from whitelist"),
+        dry_run: z18.boolean().optional().describe("If true, return the Kapture steps without executing portal automation")
+      },
+      annotations: { destructiveHint: true }
+    },
+    async (args) => {
+      if (!ctx.props.scope.includes("write")) {
+        return err3(
+          `Scope denied: greenzone_whitelist_remove requires 'write' scope. Your token has: [${ctx.props.scope.join(", ")}].`
+        );
+      }
+      const { host, ip, dry_run } = args;
+      if (!host && !ip) {
+        return err3("At least one of 'host' or 'ip' must be provided.");
+      }
+      const portalBaseUrl = resolvePortalBaseUrl(ctx.env);
+      const steps = [
+        ...host ? buildRemoveHostSteps(portalBaseUrl, host) : [],
+        ...ip ? buildRemoveIpSteps(portalBaseUrl, ip) : []
+      ];
+      if (dry_run) {
+        return ok3({
+          dry_run: true,
+          message: "Would execute the following Kapture steps to remove from OCS portal:",
+          kapture_steps: steps,
+          host,
+          ip
+        });
+      }
+      const kv = getGreenzoneKv(ctx.env);
+      let state;
+      let kvWarning;
+      if (kv) {
+        try {
+          state = await readState(kv);
+          if (host) state = stateRemoveHost(state, host);
+          if (ip) state = stateRemoveIp(state, ip);
+          await writeState(kv, state);
+        } catch (e) {
+          kvWarning = `KV write failed: ${e instanceof Error ? e.message : String(e)}`;
+        }
+      } else {
+        kvWarning = "GREENZONE_STATE_KV not bound in stdio mode \u2014 state not persisted.";
+      }
+      return ok3({
+        requires_kapture: true,
+        message: "Execute the Kapture steps below to apply the removal in the OCS portal. " + KAPTURE_UNAVAILABLE_MSG,
+        kapture_steps: steps,
+        kv_state: state ?? null,
+        kv_warning: kvWarning,
+        portal_base_url: portalBaseUrl
+      });
+    }
+  );
+  server2.registerTool(
+    "greenzone_whitelist_list",
+    {
+      title: "Greenzone Whitelist \u2014 List",
+      description: "List current Greenzone whitelist entries from the KV cache. Returns all whitelisted hosts and IPs, when the state was last synced, and whether the last hourly reconciliation detected drift from the portal. This is a fast read from KV \u2014 no browser automation required. Use `from_portal: true` to trigger a live portal read via Kapture instead of KV. Requires 'read' scope.",
+      inputSchema: {
+        from_portal: z18.boolean().optional().describe(
+          "When true, return Kapture steps to read live portal state instead of KV cache"
+        )
+      },
+      annotations: { readOnlyHint: true }
+    },
+    async (args) => {
+      if (!ctx.props.scope.includes("read")) {
+        return err3(
+          `Scope denied: greenzone_whitelist_list requires 'read' scope. Your token has: [${ctx.props.scope.join(", ")}].`
+        );
+      }
+      const { from_portal } = args;
+      if (from_portal) {
+        const portalBaseUrl = resolvePortalBaseUrl(ctx.env);
+        return ok3({
+          requires_kapture: true,
+          message: "Execute the Kapture steps below to read live Greenzone whitelist state from the OCS portal.",
+          kapture_steps: buildListSteps(portalBaseUrl),
+          portal_base_url: portalBaseUrl
+        });
+      }
+      const kv = getGreenzoneKv(ctx.env);
+      if (!kv) {
+        return ok3({
+          source: "kv_cache",
+          hosts: [],
+          ips: [],
+          last_synced_at: null,
+          last_reconciled_at: null,
+          reconcile_drift: false,
+          warning: "GREENZONE_STATE_KV not bound in stdio mode. Use from_portal: true to read live portal state."
+        });
+      }
+      try {
+        const state = await readState(kv);
+        return ok3({
+          source: "kv_cache",
+          hosts: state.hosts,
+          ips: state.ips,
+          last_synced_at: state.last_synced_at,
+          last_reconciled_at: state.last_reconciled_at ?? null,
+          reconcile_drift: state.reconcile_drift ?? false
+        });
+      } catch (e) {
+        return err3(`Failed to read Greenzone state from KV: ${e instanceof Error ? e.message : String(e)}`);
+      }
+    }
+  );
+}
+
+// src/tools-ui-agent-generic.ts
+import { z as z19 } from "zod";
+var STDIO_ERROR = {
+  isError: true,
+  content: [
+    {
+      type: "text",
+      text: JSON.stringify({
+        error: "requires_worker_runtime",
+        message: "ui_agent_ask and ui_agent_status require the remote Carrier MCP Worker deployment (mcp.carrier.llc/mcp) \u2014 they cannot run in stdio/local mode because Steel browser sessions and KV task state require Cloudflare Workers runtime bindings. Connect to the remote MCP endpoint to use these tools.",
+        remote_url: "https://mcp.carrier.llc/mcp"
+      })
+    }
+  ]
+};
+function registerUiAgentGenericTools(server2, _ctx) {
+  server2.registerTool(
+    "ui_agent_ask",
+    {
+      title: "Dispatch Generic Steel Browsing Agent",
+      description: "Dispatch a Steel browsing agent task with a natural-language prompt. The agent will navigate the web, use Tavily web search if needed, and return the result. Use for ad-hoc research, page extraction, form filling outside the OCS portal. Pro/Enterprise scope required. Cost ~$0.20-1.00 per task depending on complexity. Returns task_id immediately \u2014 poll with ui_agent_status for completion. Set dry_run=true to preview cost estimate without executing. NOTE: requires remote Worker deployment (mcp.carrier.llc/mcp) \u2014 not available in stdio mode.",
+      inputSchema: {
+        prompt: z19.string().min(1).max(4e3).describe("Natural-language task description for the Steel browsing agent."),
+        max_steps: z19.number().int().min(1).max(30).optional().describe("Maximum agent steps (1\u201330, default 15)."),
+        dry_run: z19.boolean().optional().describe("Preview cost estimate without dispatching.")
+      }
+    },
+    async (_args) => STDIO_ERROR
+  );
+  server2.registerTool(
+    "ui_agent_status",
+    {
+      title: "Get Steel Agent Task Status",
+      description: "Poll the status of a Steel browser agent task dispatched by ui_agent_ask or any ui_* tool. Returns current status (pending | running | completed | failed) and result when available. NOTE: requires remote Worker deployment (mcp.carrier.llc/mcp) \u2014 not available in stdio mode.",
+      inputSchema: {
+        task_id: z19.string().describe("Steel task ID returned by ui_agent_ask or any ui_* tool dispatch")
+      }
+    },
+    async (_args) => STDIO_ERROR
+  );
+}
+
 // src/index.ts
 var baseUrl = process.env.CARRIER_OCS_BASE_URL ?? process.env.ESIMVAULT_BASE_URL ?? "https://ocs.esimvault.cloud";
 var token = process.env.CARRIER_OCS_API_TOKEN ?? process.env.ESIMVAULT_API_TOKEN;
@@ -9553,12 +10578,17 @@ registerIntelligenceTools(server, toolCtx);
 registerAllBacklogTools(server, toolCtx);
 registerAllCarrierAskTools(server, toolCtx);
 registerListRecentOcsEventsTool(server, stdioEnv);
+registerRateLimitStatusTool(server, toolCtx);
+registerCountryHistoryTool(server, toolCtx);
+registerDepletionEventsTool(server, toolCtx);
 registerAllApps(server, toolCtx);
 registerAllPricingTools(server, toolCtx);
 registerScheduleAndUsageTools(server, toolCtx);
 registerAllUiAgentTools(server, toolCtx);
 registerUiAgentAskTools(server, toolCtx);
 registerStripeConnectTools(server, { env: stdioEnv, props });
+registerGreenzoneTools(server, toolCtx);
+registerUiAgentGenericTools(server, toolCtx);
 registerAllPrompts(server);
 var transport = new StdioServerTransport();
 await server.connect(transport);