@carrierllc/mcp 0.2.18 → 0.2.20

package/dist/index.js

@@ -1,4 +1,16 @@
 #!/usr/bin/env node
+import {
+  CARRIER_VERSION,
+  acquireEndpointSlot,
+  extractEsimStatusCounts,
+  generateStorefrontLogo,
+  getLimitForEndpoint,
+  getRateLimitWindowCounts,
+  locationParams,
+  networkEventsOverPeriodParams,
+  subscriberIdParams,
+  usageOverPeriodParams
+} from "./chunk-NHQDO2E7.js";
 
 // src/index.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -8,169 +20,8 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { z } from "zod";
 import * as Sentry from "@sentry/cloudflare";
 
-// ../../packages/ocs-client/dist/chunk-PMFMORPK.js
-var ENDPOINT_LIMITS_PER_MIN = {
-  // Global sentinel (keyed as "__global__")
-  __global__: 600,
-  // 30/min — tightest endpoint
-  subscriberNetworkEventsOverPeriod: 30,
-  // 100/min
-  subscriberUsageOverPeriod: 100,
-  // 150/min
-  listLocationZoneElement: 150,
-  sendMtSms: 150,
-  // 300/min (explicit; also the fallback default)
-  modifySubscriberMobilePlan: 300,
-  affectRecurringPackageToSubscriber: 300,
-  affectSubscriberFakePhoneNumber: 300,
-  affectSubscriberRealPhoneNumber: 300,
-  esimStatusPerAccount: 300,
-  getSubscriberActivePeriod: 300,
-  hlrGetBitrate: 300,
-  hlrSetBitrate: 300,
-  listSubscriber: 300,
-  listSubscriberPrepaidPackages: 300,
-  moveSubscriberRangeToAccount: 300,
-  pushSteeringToSubs: 300,
-  setSubscriberTrafficRestrictions: 300,
-  getSingleSubscriber: 300,
-  getSubscriberLocationByCellId: 300
-};
-var DEFAULT_LIMIT_PER_MIN = 300;
-var WINDOW_MS2 = 6e4;
-var METRIC_EMIT_MIN_INTERVAL_MS = 1e4;
-var BATCH_FRACTION = 0.2;
-function resellerKeyHash(resellerKey) {
-  if (!resellerKey) return "00000000";
-  let h = 5381;
-  for (let i = 0; i < resellerKey.length; i++) {
-    h = ((h << 5) + h ^ resellerKey.charCodeAt(i)) >>> 0;
-  }
-  return h.toString(16).padStart(8, "0");
-}
-function emitMetric(endpoint, resellerKey, callsInWindow, limitPerMin) {
-  const pct = Math.round(callsInWindow / limitPerMin * 100);
-  const reseller_hash = resellerKeyHash(resellerKey);
-  console.log(
-    JSON.stringify({
-      metric: "carrier_ocs_calls_per_min",
-      endpoint,
-      reseller_hash,
-      calls_in_window: callsInWindow,
-      limit_per_min: limitPerMin,
-      utilisation_pct: pct,
-      alert: pct >= 80,
-      ts: Date.now()
-    })
-  );
-  if (pct >= 80) {
-    console.warn(
-      `[rate-governor] ALERT: ${endpoint} at ${pct}% capacity (${callsInWindow}/${limitPerMin} per min) reseller=${reseller_hash}`
-    );
-  }
-}
-var _endpointWindows = /* @__PURE__ */ new Map();
-function _getEndpointState(key) {
-  let s = _endpointWindows.get(key);
-  if (!s) {
-    s = {
-      log: [],
-      batchLog: [],
-      gate: Promise.resolve(),
-      lastMetricEmitAt: 0,
-      metricBelowHighUtil: true
-    };
-    _endpointWindows.set(key, s);
-  }
-  return s;
-}
-function _prune(log, windowStart) {
-  let i = 0;
-  while (i < log.length && log[i] <= windowStart) i++;
-  return i > 0 ? log.slice(i) : log;
-}
-async function acquireEndpointSlot(resellerId, endpoint, priority = "interactive") {
-  const proc = globalThis["process"];
-  if (proc?.env?.["RATE_FLOOR_DISABLED"] === "true" || globalThis["RATE_FLOOR_DISABLED"] === "true") {
-    return;
-  }
-  await _acquireOneSlot(resellerId, "__global__", priority);
-  await _acquireOneSlot(resellerId, endpoint, priority);
-}
-async function _acquireOneSlot(resellerId, endpoint, priority) {
-  const bucketKey = `${resellerId}:${endpoint}`;
-  const limitPerMin = ENDPOINT_LIMITS_PER_MIN[endpoint] ?? DEFAULT_LIMIT_PER_MIN;
-  const batchCap = Math.floor(limitPerMin * BATCH_FRACTION);
-  const state = _getEndpointState(bucketKey);
-  const ticket = state.gate.then(async () => {
-    while (true) {
-      const now = Date.now();
-      const windowStart = now - WINDOW_MS2;
-      state.log = _prune(state.log, windowStart);
-      state.batchLog = _prune(state.batchLog, windowStart);
-      const totalInWindow = state.log.length;
-      const batchInWindow = state.batchLog.length;
-      if (totalInWindow > 0 && endpoint !== "__global__") {
-        const utilPct = Math.round(totalInWindow / limitPerMin * 100);
-        const intervalOk = now - state.lastMetricEmitAt >= METRIC_EMIT_MIN_INTERVAL_MS;
-        const enteredHighUtil = utilPct >= 80 && state.metricBelowHighUtil;
-        if (intervalOk || enteredHighUtil) {
-          emitMetric(endpoint, resellerId, totalInWindow, limitPerMin);
-          state.lastMetricEmitAt = now;
-          if (utilPct >= 80) {
-            state.metricBelowHighUtil = false;
-          }
-        }
-        if (utilPct < 80) {
-          state.metricBelowHighUtil = true;
-        }
-      }
-      const globalFull = totalInWindow >= limitPerMin;
-      const batchFull = priority === "batch" && batchInWindow >= batchCap;
-      if (!globalFull && !batchFull) {
-        state.log.push(now);
-        if (priority === "batch") {
-          state.batchLog.push(now);
-        }
-        return;
-      }
-      let waitMs;
-      if (globalFull) {
-        const oldest = state.log[0];
-        waitMs = WINDOW_MS2 - (now - oldest) + 1;
-      } else {
-        const oldestBatch = state.batchLog[0];
-        waitMs = WINDOW_MS2 - (now - oldestBatch) + 1;
-      }
-      await new Promise((r) => setTimeout(r, waitMs));
-    }
-  });
-  state.gate = ticket;
-  return ticket;
-}
-function getLimitForEndpoint(endpoint) {
-  return ENDPOINT_LIMITS_PER_MIN[endpoint] ?? DEFAULT_LIMIT_PER_MIN;
-}
-function getRateLimitWindowCounts(resellerKey, endpoint) {
-  const bucketKey = `${resellerKey}:${endpoint}`;
-  const state = _endpointWindows.get(bucketKey);
-  if (!state) {
-    return { calls_in_window: 0, batch_calls_in_window: 0 };
-  }
-  const windowStart = Date.now() - WINDOW_MS2;
-  let calls_in_window = 0;
-  for (const ts of state.log) {
-    if (ts > windowStart) calls_in_window++;
-  }
-  let batch_calls_in_window = 0;
-  for (const ts of state.batchLog) {
-    if (ts > windowStart) batch_calls_in_window++;
-  }
-  return { calls_in_window, batch_calls_in_window };
-}
-
 // src/client.ts
-var OcsApiError2 = class extends Error {
+var OcsApiError = class extends Error {
   constructor(code, message, method) {
     super(`[${method}] OCS error ${code}: ${message}`);
     this.code = code;
@@ -180,7 +31,7 @@ var OcsApiError2 = class extends Error {
   code;
   method;
 };
-var OcsClient2 = class {
+var OcsClient = class {
   baseUrl;
   token;
   constructor(baseUrl2, token2) {
@@ -197,11 +48,11 @@ var OcsClient2 = class {
       body
     });
     if (!res.ok) {
-      throw new OcsApiError2(res.status, `HTTP ${res.status} ${res.statusText}`, method);
+      throw new OcsApiError(res.status, `HTTP ${res.status} ${res.statusText}`, method);
     }
     const json = await res.json();
     if (json.status?.code !== 0) {
-      throw new OcsApiError2(json.status?.code ?? -1, json.status?.msg ?? "Unknown error", method);
+      throw new OcsApiError(json.status?.code ?? -1, json.status?.msg ?? "Unknown error", method);
     }
     if (method === "getCustomerTariff" && json["listTariffRule"] !== void 0) {
       return json["listTariffRule"];
@@ -459,9 +310,9 @@ function wrapHandler(toolName, ocsMethod, requiredScope, ctx, handler) {
     try {
       const token2 = await ctx.getUserToken(ctx.props.sub);
       result2 = await handler(args, token2);
-    } catch (err4) {
+    } catch (err5) {
       try {
-        Sentry.captureException(err4, {
+        Sentry.captureException(err5, {
           tags: {
             tool: toolName,
             feature: "mcp",
@@ -470,8 +321,8 @@ function wrapHandler(toolName, ocsMethod, requiredScope, ctx, handler) {
         });
       } catch {
       }
-      const message = err4 instanceof Error ? err4.message : String(err4);
-      const ocsCode = err4 instanceof OcsApiError2 ? err4.code : void 0;
+      const message = err5 instanceof Error ? err5.message : String(err5);
+      const ocsCode = err5 instanceof OcsApiError ? err5.code : void 0;
       ctx.audit({
         tool_name: toolName,
         ocs_method: ocsMethod,
@@ -499,7 +350,7 @@ function wrapHandler(toolName, ocsMethod, requiredScope, ctx, handler) {
   };
 }
 async function ocsCall(env, token2, method, params = {}) {
-  const client = new OcsClient2(env.CARRIER_OCS_BASE_URL, token2);
+  const client = new OcsClient(env.CARRIER_OCS_BASE_URL, token2);
   const result2 = await client.call(method, params);
   return {
     content: [{ type: "text", text: JSON.stringify(result2, null, 2) }]
@@ -508,13 +359,13 @@ async function ocsCall(env, token2, method, params = {}) {
 async function resolveSubscriberByIccid(env, token2, iccid, cache) {
   const hit = cache.get(iccid);
   if (hit) return hit;
-  const client = new OcsClient2(env.CARRIER_OCS_BASE_URL, token2);
+  const client = new OcsClient(env.CARRIER_OCS_BASE_URL, token2);
   const record = await client.call("getSingleSubscriber", { iccid });
   cache.set(iccid, record);
   return record;
 }
 async function getDefaultResellerId(env, token2) {
-  const client = new OcsClient2(env.CARRIER_OCS_BASE_URL, token2);
+  const client = new OcsClient(env.CARRIER_OCS_BASE_URL, token2);
   const info = await client.call("getResellerInfo", {});
   const id = info?.id;
   if (typeof id !== "number") {
@@ -729,7 +580,7 @@ function registerAllTools(server2, ctx) {
         if (args.msisdn) params.msisdn = args.msisdn;
         if (args.status) params.status = args.status;
         if (args.offset !== void 0) params.offset = args.offset;
-        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
         const raw = await client.call("listSubscriber", params);
         const limit = args.limit;
         const payload = Array.isArray(raw) && typeof limit === "number" && limit >= 0 ? raw.slice(0, limit) : raw;
@@ -864,7 +715,7 @@ function registerAllTools(server2, ctx) {
       "getSubscriberLocation",
       TOOL_SCOPES["get_subscriber_location"],
       ctx,
-      async ({ iccid }, token2) => ocsCall(ctx.env, token2, "getSubscriberLocation", { iccid })
+      async ({ iccid }, token2) => ocsCall(ctx.env, token2, "getSubscriberLocation", locationParams(iccid))
     )
   );
   server2.registerTool(
@@ -1530,10 +1381,7 @@ function registerAllTools(server2, ctx) {
       "subscriberUsageOverPeriod",
       TOOL_SCOPES["subscriber_usage"],
       ctx,
-      async ({ iccid, startDate, endDate }, token2) => ocsCall(ctx.env, token2, "subscriberUsageOverPeriod", {
-        subscriber: { iccid },
-        period: { start: startDate, end: endDate }
-      })
+      async ({ iccid, startDate, endDate }, token2) => ocsCall(ctx.env, token2, "subscriberUsageOverPeriod", usageOverPeriodParams(iccid, startDate, endDate))
     )
   );
   server2.registerTool(
@@ -1553,10 +1401,7 @@ function registerAllTools(server2, ctx) {
       "subscriberNetworkEventsOverPeriod",
       TOOL_SCOPES["subscriber_network_events"],
       ctx,
-      async ({ iccid, startDate, endDate }, token2) => ocsCall(ctx.env, token2, "subscriberNetworkEventsOverPeriod", {
-        subscriber: { iccid },
-        period: { start: startDate, end: endDate }
-      })
+      async ({ iccid, startDate, endDate }, token2) => ocsCall(ctx.env, token2, "subscriberNetworkEventsOverPeriod", networkEventsOverPeriodParams(iccid, startDate, endDate))
     )
   );
   server2.registerTool(
@@ -1572,7 +1417,7 @@ function registerAllTools(server2, ctx) {
       "getSubscriberActivePeriod",
       TOOL_SCOPES["subscriber_active_period"],
       ctx,
-      async ({ iccid }, token2) => ocsCall(ctx.env, token2, "getSubscriberActivePeriod", { iccid })
+      async ({ iccid }, token2) => ocsCall(ctx.env, token2, "getSubscriberActivePeriod", subscriberIdParams(iccid))
     )
   );
   server2.registerTool(
@@ -3194,11 +3039,11 @@ var ocsAppMethods = ocsSpec.v1_app_methods;
 // src/intelligence.ts
 async function safeCall(env, token2, method, params = {}) {
   try {
-    const client = new OcsClient2(env.CARRIER_OCS_BASE_URL, token2);
+    const client = new OcsClient(env.CARRIER_OCS_BASE_URL, token2);
     const data = await client.call(method, params);
     return { data, error: null };
-  } catch (err4) {
-    return { data: null, error: err4 instanceof Error ? err4.message : String(err4) };
+  } catch (err5) {
+    return { data: null, error: err5 instanceof Error ? err5.message : String(err5) };
   }
 }
 async function fetchActiveSubscribers(env, token2, accountId, resellerId) {
@@ -3398,52 +3243,16 @@ function registerIntelligenceTools(server2, ctx) {
       )
     ]);
     const sections = ["# Fleet Health Dashboard\n"];
+    const counts = extractEsimStatusCounts(statusResult.data);
+    const statusOk = statusResult.data !== null && (counts.total > 0 || statusResult.error === null);
     const statusRaw = statusResult.data;
     const statusAccounts = Array.isArray(statusRaw) ? statusRaw : statusRaw?.account ?? [];
-    const statusOk = statusResult.data !== null && (statusAccounts.length > 0 || statusResult.error === null);
-    const countByState = (account) => {
-      const sponsors = account.sponsor ?? [];
-      let active = 0, suspended = 0, inventory = 0, other = 0;
-      for (const sp of sponsors) {
-        const esim = sp.esim ?? {};
-        const statuses = esim.status ?? [];
-        for (const s of statuses) {
-          const count = Number(s.count ?? 0);
-          const num = s.statusNum;
-          if (typeof num === "number") {
-            if (num === 1) active += count;
-            else if (num === 2) suspended += count;
-            else if (num === 0) inventory += count;
-            else other += count;
-            continue;
-          }
-          const str = String(s.statusStr ?? s.name ?? "").toUpperCase();
-          if (str === "ACTIVATED" || str === "ACTIVE") active += count;
-          else if (str === "SUSPENDED") suspended += count;
-          else if (str === "FREE" || str === "INVENTORY" || str === "NOT_ACTIVATED" || str === "AVAILABLE") inventory += count;
-          else other += count;
-        }
-      }
-      return { active, suspended, inventory, other };
-    };
-    let totalActive = 0, totalSuspended = 0, totalInventory = 0, totalOther = 0;
     if (statusOk) {
-      for (const account of statusAccounts) {
-        const hasSponsors = Array.isArray(account.sponsor);
-        if (hasSponsors) {
-          const c = countByState(account);
-          totalActive += c.active;
-          totalSuspended += c.suspended;
-          totalInventory += c.inventory;
-          totalOther += c.other;
-        } else {
-          totalActive += Number(account.active ?? 0);
-          totalSuspended += Number(account.suspended ?? 0);
-          totalInventory += Number(account.inventory ?? account.notActivated ?? 0);
-          totalOther += Number(account.other ?? account.terminated ?? 0);
-        }
-      }
-      const total = totalActive + totalSuspended + totalInventory + totalOther;
+      const totalActive = counts.active;
+      const totalSuspended = counts.suspended;
+      const totalInventory = counts.inventory;
+      const totalOther = counts.other;
+      const total = counts.total;
       const utilization = total > 0 ? (totalActive / total * 100).toFixed(1) : "0";
       sections.push(`## eSIM Fleet Status`);
       if (total === 0) {
@@ -4240,7 +4049,7 @@ function registerAllBacklogTools(server2, ctx) {
       ctx,
       async ({ iccid, phone_number, phone_type }, token2) => {
         const ocsMethod = phone_type === "fake" ? "affectSubscriberFakePhoneNumber" : "affectSubscriberRealPhoneNumber";
-        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
         const result2 = await client.call(ocsMethod, { subscriber: iccid, phoneNumber: phone_number });
         return {
           content: [{ type: "text", text: JSON.stringify(result2, null, 2) }]
@@ -4278,7 +4087,7 @@ function registerAllBacklogTools(server2, ctx) {
         cell_id,
         signal_strength
       }, token2) => {
-        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
         const params = { radioType: radio_type, mcc, mnc, lac };
         if (cell_id !== void 0) params.cellId = cell_id;
         if (signal_strength !== void 0) params.signalStrength = signal_strength;
@@ -4306,7 +4115,7 @@ function registerAllBacklogTools(server2, ctx) {
       ctx,
       async ({ resellerId }, token2) => {
         const id = resellerId ?? await (async () => {
-          const client2 = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
+          const client2 = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
           const info = await client2.call("getResellerInfo", {});
           const resolvedId = info?.id;
           if (typeof resolvedId !== "number") {
@@ -4314,7 +4123,7 @@ function registerAllBacklogTools(server2, ctx) {
           }
           return resolvedId;
         })();
-        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
         const result2 = await client.call("listDetailedDestinationList", id);
         return {
           content: [{ type: "text", text: JSON.stringify(result2, null, 2) }]
@@ -4340,7 +4149,7 @@ function registerAllBacklogTools(server2, ctx) {
       BACKLOG_TOOL_SCOPES["modify_subscriber_mobile_plan"],
       ctx,
       async ({ iccid, mobile_plan_id }, token2) => {
-        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
         const result2 = await client.call(
           "modifySubscriberMobilePlan",
           { subscriber: iccid, mobilePlanId: mobile_plan_id }
@@ -4374,7 +4183,7 @@ function registerAllBacklogTools(server2, ctx) {
         const params = { subscriber: iccid, packageId: package_id };
         if (start_date !== void 0) params.startDate = start_date;
         if (end_date !== void 0) params.endDate = end_date;
-        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
         const result2 = await client.call(
           "modifySubscriberPrepaidPackageActivePeriod",
           params
@@ -4403,7 +4212,7 @@ function registerAllBacklogTools(server2, ctx) {
       BACKLOG_TOOL_SCOPES["modify_subscriber_voip_plan"],
       ctx,
       async ({ iccid, voip_plan_id }, token2) => {
-        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
         const result2 = await client.call(
           "modifySubscriberVoipPlan",
           { subscriber: iccid, voipPlanId: voip_plan_id }
@@ -4434,7 +4243,7 @@ function registerAllBacklogTools(server2, ctx) {
         const cache = /* @__PURE__ */ new Map();
         const sub = await resolveSubscriberByIccid(ctx.env, token2, iccid, cache);
         const subscriberId = sub.id ?? sub.subscriberId ?? iccid;
-        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
         const result2 = await client.call(
           "pushSteeringToSubs",
           { subscriber: subscriberId }
@@ -4462,7 +4271,7 @@ function registerAllBacklogTools(server2, ctx) {
       BACKLOG_TOOL_SCOPES["reset_subscriber_gz_counter"],
       ctx,
       async ({ iccid }, token2) => {
-        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
         const result2 = await client.call("resetSubsGzCounter", { subscriber: iccid });
         return {
           content: [{ type: "text", text: JSON.stringify(result2, null, 2) }]
@@ -4486,7 +4295,7 @@ function registerAllBacklogTools(server2, ctx) {
       BACKLOG_TOOL_SCOPES["carrier_webhook_config"],
       ctx,
       async ({ reseller_id }, token2) => {
-        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
         let resellerId = reseller_id;
         if (resellerId === void 0) {
           resellerId = await getDefaultResellerId(ctx.env, token2);
@@ -4528,7 +4337,7 @@ function registerAllBacklogTools(server2, ctx) {
       BACKLOG_TOOL_SCOPES["list_subscriber_voip_tariff"],
       ctx,
       async ({ reseller_id }, token2) => {
-        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
         const params = {};
         if (reseller_id !== void 0) {
           params.resellerId = reseller_id;
@@ -4558,7 +4367,7 @@ function registerAllBacklogTools(server2, ctx) {
       BACKLOG_TOOL_SCOPES["list_voip_tariff_rule"],
       ctx,
       async ({ voip_plan_id }, token2) => {
-        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
         const result2 = await client.call("listVoipTariffRule", voip_plan_id);
         return {
           content: [{ type: "text", text: JSON.stringify(result2, null, 2) }]
@@ -4587,7 +4396,7 @@ function registerAllBacklogTools(server2, ctx) {
         location_zone_id,
         network_profile_id
       }, token2) => {
-        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
         const result2 = await client.call("changeNetworkProfileOfLocationZone", {
           locationZoneId: location_zone_id,
           networkProfileId: network_profile_id
@@ -4637,7 +4446,8 @@ var TOOL_REGISTRY = /* @__PURE__ */ new Set([
   "greenzone_whitelist_list",
   // router tools (self-reference)
   "carrier_ask",
-  "carrier_ask_describe"
+  "carrier_ask_describe",
+  "generate_storefront_logo"
 ]);
 var HARD_BLOCK_TOOLS = /* @__PURE__ */ new Set([
   "clean_all_packages",
@@ -5115,10 +4925,10 @@ async function callBedrock(env, payload) {
     const body = await resp.text();
     if (resp.status === 429) {
       const retryAfter = resp.headers.get("retry-after");
-      const err4 = new Error(`Bedrock rate limit: ${body}`);
-      err4.isRateLimit = true;
-      err4.retryAfter = retryAfter;
-      throw err4;
+      const err5 = new Error(`Bedrock rate limit: ${body}`);
+      err5.isRateLimit = true;
+      err5.retryAfter = retryAfter;
+      throw err5;
     }
     throw new Error(`Bedrock invoke failed: ${resp.status} ${body}`);
   }
@@ -5156,9 +4966,9 @@ Pre-resolved context: ${JSON.stringify(definedContext)}` : "";
       AWS_REGION: env.AWS_REGION,
       BEDROCK_MODEL_ID: env.BEDROCK_MODEL_ID
     }, payload);
-  } catch (err4) {
-    if (err4 instanceof Error && err4.isRateLimit) {
-      const retryAfter = err4.retryAfter;
+  } catch (err5) {
+    if (err5 instanceof Error && err5.isRateLimit) {
+      const retryAfter = err5.retryAfter;
       const parsedSeconds = retryAfter ? parseInt(retryAfter, 10) : 60;
       return {
         match: "rate_limited",
@@ -5166,7 +4976,7 @@ Pre-resolved context: ${JSON.stringify(definedContext)}` : "";
         suggestion: "Bedrock rate limit reached. Please retry after the indicated delay."
       };
     }
-    throw err4;
+    throw err5;
   }
   const toolUseBlock = response.content.find(
     (block) => block.type === "tool_use"
@@ -5340,7 +5150,7 @@ function registerAllCarrierAskTools(server2, ctx) {
         let route;
         try {
           route = await _routeIntent(intent, context, ctx.env);
-        } catch (err4) {
+        } catch (err5) {
           writeCarrierAskAudit(ctx.env, {
             intent_hash: intentHash,
             match: "error",
@@ -5357,7 +5167,7 @@ function registerAllCarrierAskTools(server2, ctx) {
                 type: "text",
                 text: JSON.stringify({
                   error: "routing_error",
-                  message: err4 instanceof Error ? err4.message : "An unexpected error occurred during routing."
+                  message: err5 instanceof Error ? err5.message : "An unexpected error occurred during routing."
                 })
               }
             ],
@@ -5609,8 +5419,8 @@ function registerListRecentOcsEventsTool(server2, env) {
         return {
           content: [{ type: "text", text: JSON.stringify(result2, null, 2) }]
         };
-      } catch (err4) {
-        const message = err4 instanceof Error ? err4.message : String(err4);
+      } catch (err5) {
+        const message = err5 instanceof Error ? err5.message : String(err5);
         return {
           isError: true,
           content: [{ type: "text", text: `Error reading OCS event buffer: ${message}` }]
@@ -5893,10 +5703,10 @@ import {
 async function safeCallWithToken(client, _token, method, params = {}) {
   try {
     return { data: await client.call(method, params), error: null };
-  } catch (err4) {
+  } catch (err5) {
     return {
       data: null,
-      error: err4 instanceof Error ? err4.message : String(err4)
+      error: err5 instanceof Error ? err5.message : String(err5)
     };
   }
 }
@@ -5955,7 +5765,7 @@ function registerFleetHealthApp(server2, ctx) {
     },
     async ({ accountId }) => {
       const token2 = await ctx.getUserToken(ctx.props.sub);
-      const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
+      const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
       const [statusResult, accountsResult] = await Promise.all([
         safeCallWithToken(
           client,
@@ -6094,10 +5904,10 @@ async function deleteWizardSession(env, sub, wizardId) {
 async function safeCallWithToken2(client, _token, method, params = {}) {
   try {
     return { data: await client.call(method, params), error: null };
-  } catch (err4) {
+  } catch (err5) {
     return {
       data: null,
-      error: err4 instanceof Error ? err4.message : String(err4)
+      error: err5 instanceof Error ? err5.message : String(err5)
     };
   }
 }
@@ -6160,7 +5970,7 @@ function registerProvisioningWizard(server2, ctx) {
     },
     async ({ step, wizardId, subscriber_iccid, package_template_id }) => {
       const token2 = await ctx.getUserToken(ctx.props.sub);
-      const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
+      const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
       if (step === "init") {
         const newWizardId = generateWizardId();
         const subscribersResult = await safeCallWithToken2(
@@ -6457,10 +6267,10 @@ import {
 async function safeCallWithToken3(client, _token, method, params = {}) {
   try {
     return { data: await client.call(method, params), error: null };
-  } catch (err4) {
+  } catch (err5) {
     return {
       data: null,
-      error: err4 instanceof Error ? err4.message : String(err4)
+      error: err5 instanceof Error ? err5.message : String(err5)
     };
   }
 }
@@ -6499,7 +6309,7 @@ function registerBalanceTopupApp(server2, ctx) {
     "balance_topup_form",
     {
       title: "Balance Top-up Form",
-      description: "Enterprise admin tool: preview or commit an account balance adjustment. Set preview=true to fetch projection (no OCS write); preview=false (default) to execute. Requires admin scope + recent MFA.",
+      description: "Adjust the OCS reseller-account balance behind one subscriber, through a form panel the user can review before it commits. Defaults to preview: a call that omits `preview` returns a projection and writes nothing. Only `preview: false` performs the OCS write. Params: `iccid` (subscriber identifier used to find the account), `delta` (amount to add when positive, deduct when negative), `preview` (boolean, default true). Requires `admin` scope plus recent MFA, and a client that can render UI panels. Do NOT use this in a headless or scripted context \u2014 call `modify_account_balance` directly, which takes an `accountId` and needs no panel. Do NOT use this for a subscriber's own balance \u2014 the `iccid` here only locates the account; per-subscriber money is `modify_subscriber_balance`. Do NOT use this for the Carrier prepaid wallet or MCP credits \u2014 see `wallet_topup_checkout` and `credit_balance`.",
       inputSchema: {
         iccid: z11.string().describe("The subscriber ICCID for the account lookup"),
         delta: z11.number().describe("Amount to add (positive) or deduct (negative) from the account balance"),
@@ -6520,7 +6330,7 @@ function registerBalanceTopupApp(server2, ctx) {
       ctx,
       async ({ iccid, delta, preview }) => {
         const token2 = await ctx.getUserToken(ctx.props.sub);
-        const client = new OcsClient2(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
         if (preview === true) {
           const result2 = await safeCallWithToken3(
             client,
@@ -8121,8 +7931,8 @@ function buildPricingHandler(tool, ctx) {
           }
         ]
       };
-    } catch (err4) {
-      const message = err4 instanceof Error ? err4.message : String(err4);
+    } catch (err5) {
+      const message = err5 instanceof Error ? err5.message : String(err5);
       ctx.audit({
         tool_name: tool.name,
         ocs_method: "billing",
@@ -8442,8 +8252,8 @@ function writeUsageThresholdAudit(env, severity, remainingCredits, month, taskCo
       doubles: [remainingCredits],
       indexes: ["manus_usage"]
     });
-  } catch (err4) {
-    console.error(`[manus-usage] threshold audit write failed: ${err4.message}`);
+  } catch (err5) {
+    console.error(`[manus-usage] threshold audit write failed: ${err5.message}`);
   }
 }
 
@@ -8553,7 +8363,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err4) {
+      } catch (err5) {
         ctx.audit({
           tool_name: "ui_agent_schedule_create",
           ocs_method: "[manus:schedule.create]",
@@ -8562,7 +8372,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           duration_ms: Date.now() - start,
           event_type: "ui_agent_dispatch"
         });
-        const msg = err4 instanceof ManusScheduleError ? `Manus API error (HTTP ${err4.statusCode}): ${err4.message}` : err4 instanceof Error ? err4.message : String(err4);
+        const msg = err5 instanceof ManusScheduleError ? `Manus API error (HTTP ${err5.statusCode}): ${err5.message}` : err5 instanceof Error ? err5.message : String(err5);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -8620,7 +8430,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err4) {
+      } catch (err5) {
         ctx.audit({
           tool_name: "ui_agent_schedule_list",
           ocs_method: "[manus:schedule.list]",
@@ -8628,7 +8438,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           dry_run: false,
           duration_ms: Date.now() - start
         });
-        const msg = err4 instanceof ManusScheduleError ? `Manus API error (HTTP ${err4.statusCode}): ${err4.message}` : err4 instanceof Error ? err4.message : String(err4);
+        const msg = err5 instanceof ManusScheduleError ? `Manus API error (HTTP ${err5.statusCode}): ${err5.message}` : err5 instanceof Error ? err5.message : String(err5);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -8689,7 +8499,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err4) {
+      } catch (err5) {
         ctx.audit({
           tool_name: "ui_agent_schedule_delete",
           ocs_method: "[manus:schedule.delete]",
@@ -8698,7 +8508,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           duration_ms: Date.now() - start,
           event_type: "ui_agent_dispatch"
         });
-        const msg = err4 instanceof ManusScheduleError ? `Manus API error (HTTP ${err4.statusCode}): ${err4.message}` : err4 instanceof Error ? err4.message : String(err4);
+        const msg = err5 instanceof ManusScheduleError ? `Manus API error (HTTP ${err5.statusCode}): ${err5.message}` : err5 instanceof Error ? err5.message : String(err5);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -8759,7 +8569,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err4) {
+      } catch (err5) {
         ctx.audit({
           tool_name: "ui_agent_schedule_pause",
           ocs_method: "[manus:schedule.pause]",
@@ -8768,7 +8578,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           duration_ms: Date.now() - start,
           event_type: "ui_agent_dispatch"
         });
-        const msg = err4 instanceof ManusScheduleError ? `Manus API error (HTTP ${err4.statusCode}): ${err4.message}` : err4 instanceof Error ? err4.message : String(err4);
+        const msg = err5 instanceof ManusScheduleError ? `Manus API error (HTTP ${err5.statusCode}): ${err5.message}` : err5 instanceof Error ? err5.message : String(err5);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -8829,7 +8639,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err4) {
+      } catch (err5) {
         ctx.audit({
           tool_name: "ui_agent_schedule_resume",
           ocs_method: "[manus:schedule.resume]",
@@ -8838,7 +8648,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           duration_ms: Date.now() - start,
           event_type: "ui_agent_dispatch"
         });
-        const msg = err4 instanceof ManusScheduleError ? `Manus API error (HTTP ${err4.statusCode}): ${err4.message}` : err4 instanceof Error ? err4.message : String(err4);
+        const msg = err5 instanceof ManusScheduleError ? `Manus API error (HTTP ${err5.statusCode}): ${err5.message}` : err5 instanceof Error ? err5.message : String(err5);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -8883,7 +8693,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err4) {
+      } catch (err5) {
         ctx.audit({
           tool_name: "ui_agent_usage",
           ocs_method: "[manus:usage.get]",
@@ -8891,7 +8701,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           dry_run: false,
           duration_ms: Date.now() - start
         });
-        const msg = err4 instanceof Error ? err4.message : String(err4);
+        const msg = err5 instanceof Error ? err5.message : String(err5);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -9134,7 +8944,7 @@ Report success or failure with a clear summary.`;
           }
         ]
       };
-    } catch (err4) {
+    } catch (err5) {
       ctx.audit({
         tool_name: toolName,
         ocs_method: `[ui-agent:${gapId}]`,
@@ -9148,7 +8958,7 @@ Report success or failure with a clear summary.`;
         content: [
           {
             type: "text",
-            text: `Error dispatching UI agent: ${err4 instanceof Error ? err4.message : String(err4)}`
+            text: `Error dispatching UI agent: ${err5 instanceof Error ? err5.message : String(err5)}`
           }
         ]
       };
@@ -9572,7 +9382,7 @@ function registerUiAgentAskTools(server2, ctx) {
       try {
         const replyOutcome = await askReply(keys, task_id, reply);
         result2 = replyOutcome.data;
-      } catch (err4) {
+      } catch (err5) {
         ctx.audit({
           tool_name: "ui_agent_reply",
           ocs_method: "[ui-agent:ask-reply]",
@@ -9587,7 +9397,7 @@ function registerUiAgentAskTools(server2, ctx) {
           content: [
             {
               type: "text",
-              text: `Error calling Manus task.reply: ${err4 instanceof Error ? err4.message : String(err4)}`
+              text: `Error calling Manus task.reply: ${err5 instanceof Error ? err5.message : String(err5)}`
             }
           ]
         };
@@ -9665,13 +9475,13 @@ function registerUiAgentAskTools(server2, ctx) {
       try {
         const listing = await ctx.env.CARRIER_USERS.list({ prefix: PENDING_ASK_PREFIX });
         keys = listing.keys;
-      } catch (err4) {
+      } catch (err5) {
         return {
           isError: true,
           content: [
             {
               type: "text",
-              text: `Error listing pending tasks: ${err4 instanceof Error ? err4.message : String(err4)}`
+              text: `Error listing pending tasks: ${err5 instanceof Error ? err5.message : String(err5)}`
             }
           ]
         };
@@ -9842,7 +9652,7 @@ function registerStripeConnectTools(server2, ctx) {
   );
   server2.tool(
     "stripe_connect_payouts",
-    "Read-only: list recent payouts for the operator's connected Stripe account.",
+    "List money Stripe has already sent from the operator's connected account to their bank, newest first. Read-only. Params: `limit` (1-50, default 10). Returns: payouts with amount (smallest currency unit), currency, status, and arrival date. Do NOT use this for money still sitting at Stripe and not yet paid out \u2014 use `stripe_connect_balance`.",
     {
       limit: z17.number().int().min(1).max(50).default(10).describe("Number of payouts to return."),
       status: z17.enum(["pending", "paid", "failed", "canceled", "in_transit"]).optional().describe("Filter by payout status.")
@@ -9876,7 +9686,7 @@ function registerStripeConnectTools(server2, ctx) {
   );
   server2.tool(
     "stripe_connect_balance",
-    "Read-only: returns the current available and pending balance per currency for the operator's connected Stripe account.",
+    "Read the money sitting in the operator's connected Stripe account: available and pending, split per currency. Params: none (the connected account is resolved from the session). Returns: { account_id, available: [{ amount, currency }], pending: [{ amount, currency }] } \u2014 amounts in the currency's smallest unit (cents for EUR/USD). Do NOT use this for the Carrier prepaid wallet \u2014 use `wallet_balance`. Do NOT use this for money already paid out to the bank \u2014 use `stripe_connect_payouts`.",
     {},
     async () => {
       const start = Date.now();
@@ -9909,7 +9719,7 @@ function registerStripeConnectTools(server2, ctx) {
   );
   server2.tool(
     "stripe_connect_refund",
-    "Admin: issue a refund on a charge via the operator's connected Stripe account. Requires confirm_token (call without token first to get one).",
+    "Refund money to a customer on one charge in the operator's connected Stripe account. This returns real funds and Stripe cannot reverse a refund once issued. Two-step by design: call without `confirm_token` to get a token and a summary of what would be refunded, then call again with that token to execute. The token expires in 5 minutes. Params: `charge_id` (Stripe charge id, `ch_...`), `amount_cents` (optional integer in the charge's smallest currency unit \u2014 omit for a full refund), `reason` ('duplicate' | 'fraudulent' | 'requested_by_customer', optional), `confirm_token`. Returns: the refund id and status. Requires `write` scope. Do NOT use this to stop a charge that has not settled yet \u2014 decline it with `radar_review_decline`. Do NOT use this to contest a chargeback \u2014 read the case with `stripe_connect_dispute_list` first, since refunding a disputed charge can cost the operator twice.",
     {
       charge_id: z17.string().min(1).describe("Stripe charge ID (ch_...)."),
       amount_cents: z17.number().int().min(1).optional().describe("Partial refund amount in cents. Omit for full refund."),
@@ -9959,7 +9769,7 @@ Call again with confirm_token="${token2}" to execute. Token expires in 5 minutes
   );
   server2.tool(
     "stripe_connect_dispute_list",
-    "Read-only: list active disputes for the operator's connected Stripe account.",
+    "List chargebacks customers have raised with their bank against the operator's connected Stripe account. Read-only \u2014 responding to one is Dashboard work. Params: `limit` (1-50, default 10), `status` (optional Stripe dispute status, e.g. 'needs_response', 'under_review'). Returns: disputes with amount, reason, status, and the evidence deadline. Do NOT use this for charges Stripe is holding for fraud review before they settle \u2014 those are `radar_review_list`. Check this before refunding: refunding a disputed charge can cost the operator the amount twice.",
     {
       limit: z17.number().int().min(1).max(50).default(10),
       status: z17.string().optional().describe("Filter by dispute status (e.g. needs_response, under_review).")
@@ -9993,7 +9803,7 @@ Call again with confirm_token="${token2}" to execute. Token expires in 5 minutes
   );
   server2.tool(
     "radar_review_list",
-    "Read-only: list pending Radar reviews requiring manual platform decision.",
+    "List the Stripe Radar fraud reviews waiting on a manual approve/decline decision, newest first. Reads only \u2014 deciding a review is a separate call. Params: `open_only` (boolean, default true \u2014 false also returns already-decided reviews), `limit` (1-50, default 10). Returns: { reviews: [{ id (`prv_...`), charge, reason, opened_reason, closed_reason, created, closed }], has_more }. Call this first to get the `review_id` that `radar_review_approve` and `radar_review_decline` require. Do NOT use this for chargebacks the customer has already raised with their bank \u2014 use `stripe_connect_dispute_list`.",
     {
       open_only: z17.boolean().default(true).describe("If true, only returns open (undecided) reviews."),
       limit: z17.number().int().min(1).max(50).default(10)
@@ -10025,7 +9835,7 @@ Call again with confirm_token="${token2}" to execute. Token expires in 5 minutes
   );
   server2.tool(
     "radar_review_approve",
-    "Admin: approve a Radar review, allowing the charge to proceed. Requires confirm_token.",
+    "Clear a Stripe Radar fraud review so the held charge is captured and the money is taken. Approving overrides Radar's fraud signal, so a genuinely fraudulent charge approved here usually returns later as a chargeback plus a fee. Two-step by design: call without `confirm_token` to get a token, then call again with it to execute. Params: `review_id` (`prv_...`, from `radar_review_list`), `confirm_token`. Requires `admin` scope. Do NOT call this to block a suspicious charge \u2014 that is `radar_review_decline`, the opposite outcome. Do NOT call this to return money on a charge that already went through \u2014 that is `stripe_connect_refund`.",
     {
       review_id: z17.string().min(1).describe("Stripe Radar review ID (prv_...)."),
       confirm_token: z17.string().optional()
@@ -10070,7 +9880,7 @@ Call again with confirm_token="${token2}" to execute. Expires in 5 minutes.`
   );
   server2.tool(
     "radar_review_decline",
-    "Admin: decline a Radar review, blocking/closing the charge. Requires confirm_token.",
+    "Close a Stripe Radar fraud review as fraudulent, so the held charge is blocked and the customer is never billed. The customer sees a failed payment; if they were legitimate, they have to pay again. Two-step by design: call without `confirm_token` to get a token, then call again with it to execute. Params: `review_id` (`prv_...`, from `radar_review_list`), `confirm_token`. Requires `admin` scope. Do NOT call this to let a charge through \u2014 that is `radar_review_approve`, the opposite outcome. Do NOT call this on a charge that already succeeded; a review only exists while the charge is held, and returning settled money is `stripe_connect_refund`.",
     {
       review_id: z17.string().min(1),
       confirm_token: z17.string().optional()
@@ -10115,7 +9925,7 @@ Expires in 5 minutes.`
   );
   server2.tool(
     "radar_value_list_add",
-    "Admin: add an item (email, IP, card fingerprint, country code) to a Stripe Radar block/allow list. Requires confirm_token.",
+    "Add one value to an existing Stripe Radar value list, changing how every future charge is scored. Whether the value ends up blocked or allowed depends entirely on which list you name in `value_list_id` \u2014 this tool does not choose, and putting a value on the allow list when you meant the block list silently lets fraud through. Confirm the list's purpose before calling. Two-step by design: call without `confirm_token` to get a token, then call again with it to execute. Params: `value_list_id` (`rsl_...`, an existing list), `value` (one email, IP address, card fingerprint, or ISO country code \u2014 one item per call), `confirm_token`. Requires `admin` scope. Do NOT use this to decide a single charge that is already under review \u2014 use `radar_review_approve` or `radar_review_decline`. Do NOT use this to create a list or a rule: only `value` is added, and rules cannot be edited through this API at all (see `radar_rule_toggle`).",
     {
       value_list_id: z17.string().min(1).describe("Stripe Radar value list ID (rsl_...)."),
       value: z17.string().min(1).describe("The value to add (email, IP address, country code, etc.)."),
@@ -10161,7 +9971,7 @@ Expires in 5 minutes.`
   );
   server2.tool(
     "radar_rule_toggle",
-    "Admin: enable or disable a Stripe Radar rule. NOTE: Stripe does not expose rule CRUD via the public API \u2014 this tool returns Dashboard instructions.",
+    "Return the Stripe Dashboard steps for enabling or disabling a Radar rule. This tool changes nothing: Stripe has no public API for rule state, so the call always succeeds and the rule stays exactly as it was. Never report the rule as toggled. Params: `rule_id` (Stripe Radar rule id), `enabled` (true for the enable instructions, false for disable). Returns: the Dashboard URL and steps for a human to follow. Requires `admin` scope. Do NOT use this when a change must actually take effect from an agent \u2014 the only Radar state reachable through this API is value-list membership, via `radar_value_list_add`.",
     {
       rule_id: z17.string().min(1).describe("Stripe Radar rule ID."),
       enabled: z17.boolean().describe("true = enable, false = disable.")
@@ -10686,6 +10496,46 @@ function registerUiAgentGenericTools(server2, _ctx) {
   );
 }
 
+// src/tools-storefront-logo.ts
+import { z as z20 } from "zod";
+var ok4 = (text) => ({ content: [{ type: "text", text }] });
+var err4 = (text) => ({ isError: true, content: [{ type: "text", text }] });
+function registerStorefrontLogoTools(server2, env = {}) {
+  server2.tool(
+    "generate_storefront_logo",
+    "Generate a storefront logo (SVG always; PNG when an image key is configured on the Carrier worker). Works for any authenticated Carrier MCP user \u2014 no local image-API key required. Write the SVG to public/brand/logo.svg in the storefront.",
+    {
+      name: z20.string().min(1).describe("Brand / shop name, e.g. Bananas"),
+      accent: z20.string().regex(/^#?[0-9A-Fa-f]{6}$/).optional().describe("Accent hex, e.g. #FF8A00"),
+      tagline: z20.string().optional().describe("Optional tagline for AI-enhanced marks")
+    },
+    async ({ name, accent, tagline }) => {
+      try {
+        const hex = accent ? accent.startsWith("#") ? accent : `#${accent}` : void 0;
+        const logo = await generateStorefrontLogo({
+          name,
+          accent: hex,
+          tagline,
+          env: { ...env, ...process.env }
+        });
+        return ok4(
+          JSON.stringify({
+            brand: name,
+            source: logo.source,
+            filename: "public/brand/logo.svg",
+            png_filename: logo.pngBase64 ? "public/brand/logo.png" : null,
+            svg: logo.svg,
+            png_base64: logo.pngBase64 ?? null,
+            next: "Write svg to the storefront public/brand/logo.svg (and png if present). Nav and icons read that path."
+          })
+        );
+      } catch (e) {
+        return err4(e instanceof Error ? e.message : "logo generation failed");
+      }
+    }
+  );
+}
+
 // src/index.ts
 var baseUrl = process.env.CARRIER_OCS_BASE_URL ?? process.env.ESIMVAULT_BASE_URL ?? "https://ocs.esimvault.cloud";
 var token = process.env.CARRIER_OCS_API_TOKEN ?? process.env.ESIMVAULT_API_TOKEN;
@@ -10723,7 +10573,7 @@ var audit = (_row) => {
 var getUserToken = async (_sub) => token;
 var toolCtx = { env: stdioEnv, props, audit, getUserToken };
 var server = new McpServer(
-  { name: "carrier-mcp", version: "0.2.18" },
+  { name: "carrier-mcp", version: CARRIER_VERSION },
   {
     instructions: "Carrier MCP \u2014 single-user stdio mode. Full tool registry (mirrors the deployed Worker)."
   }
@@ -10744,6 +10594,7 @@ registerUiAgentAskTools(server, toolCtx);
 registerStripeConnectTools(server, { env: stdioEnv, props });
 registerGreenzoneTools(server, toolCtx);
 registerUiAgentGenericTools(server, toolCtx);
+registerStorefrontLogoTools(server, stdioEnv);
 registerAllPrompts(server);
 var transport = new StdioServerTransport();
 await server.connect(transport);