@carrierllc/mcp 0.2.20 → 0.3.1

package/dist/index.js

@@ -10,7 +10,7 @@ import {
   networkEventsOverPeriodParams,
   subscriberIdParams,
   usageOverPeriodParams
-} from "./chunk-NHQDO2E7.js";
+} from "./chunk-TABEJ7SM.js";
 
 // src/index.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -310,9 +310,9 @@ function wrapHandler(toolName, ocsMethod, requiredScope, ctx, handler) {
     try {
       const token2 = await ctx.getUserToken(ctx.props.sub);
       result2 = await handler(args, token2);
-    } catch (err5) {
+    } catch (err6) {
       try {
-        Sentry.captureException(err5, {
+        Sentry.captureException(err6, {
           tags: {
             tool: toolName,
             feature: "mcp",
@@ -321,8 +321,8 @@ function wrapHandler(toolName, ocsMethod, requiredScope, ctx, handler) {
         });
       } catch {
       }
-      const message = err5 instanceof Error ? err5.message : String(err5);
-      const ocsCode = err5 instanceof OcsApiError ? err5.code : void 0;
+      const message = err6 instanceof Error ? err6.message : String(err6);
+      const ocsCode = err6 instanceof OcsApiError ? err6.code : void 0;
       ctx.audit({
         tool_name: toolName,
         ocs_method: ocsMethod,
@@ -3042,8 +3042,8 @@ async function safeCall(env, token2, method, params = {}) {
     const client = new OcsClient(env.CARRIER_OCS_BASE_URL, token2);
     const data = await client.call(method, params);
     return { data, error: null };
-  } catch (err5) {
-    return { data: null, error: err5 instanceof Error ? err5.message : String(err5) };
+  } catch (err6) {
+    return { data: null, error: err6 instanceof Error ? err6.message : String(err6) };
   }
 }
 async function fetchActiveSubscribers(env, token2, accountId, resellerId) {
@@ -4925,10 +4925,10 @@ async function callBedrock(env, payload) {
     const body = await resp.text();
     if (resp.status === 429) {
       const retryAfter = resp.headers.get("retry-after");
-      const err5 = new Error(`Bedrock rate limit: ${body}`);
-      err5.isRateLimit = true;
-      err5.retryAfter = retryAfter;
-      throw err5;
+      const err6 = new Error(`Bedrock rate limit: ${body}`);
+      err6.isRateLimit = true;
+      err6.retryAfter = retryAfter;
+      throw err6;
     }
     throw new Error(`Bedrock invoke failed: ${resp.status} ${body}`);
   }
@@ -4966,9 +4966,9 @@ Pre-resolved context: ${JSON.stringify(definedContext)}` : "";
       AWS_REGION: env.AWS_REGION,
       BEDROCK_MODEL_ID: env.BEDROCK_MODEL_ID
     }, payload);
-  } catch (err5) {
-    if (err5 instanceof Error && err5.isRateLimit) {
-      const retryAfter = err5.retryAfter;
+  } catch (err6) {
+    if (err6 instanceof Error && err6.isRateLimit) {
+      const retryAfter = err6.retryAfter;
       const parsedSeconds = retryAfter ? parseInt(retryAfter, 10) : 60;
       return {
         match: "rate_limited",
@@ -4976,7 +4976,7 @@ Pre-resolved context: ${JSON.stringify(definedContext)}` : "";
         suggestion: "Bedrock rate limit reached. Please retry after the indicated delay."
       };
     }
-    throw err5;
+    throw err6;
   }
   const toolUseBlock = response.content.find(
     (block) => block.type === "tool_use"
@@ -5150,7 +5150,7 @@ function registerAllCarrierAskTools(server2, ctx) {
         let route;
         try {
           route = await _routeIntent(intent, context, ctx.env);
-        } catch (err5) {
+        } catch (err6) {
           writeCarrierAskAudit(ctx.env, {
             intent_hash: intentHash,
             match: "error",
@@ -5167,7 +5167,7 @@ function registerAllCarrierAskTools(server2, ctx) {
                 type: "text",
                 text: JSON.stringify({
                   error: "routing_error",
-                  message: err5 instanceof Error ? err5.message : "An unexpected error occurred during routing."
+                  message: err6 instanceof Error ? err6.message : "An unexpected error occurred during routing."
                 })
               }
             ],
@@ -5419,8 +5419,8 @@ function registerListRecentOcsEventsTool(server2, env) {
         return {
           content: [{ type: "text", text: JSON.stringify(result2, null, 2) }]
         };
-      } catch (err5) {
-        const message = err5 instanceof Error ? err5.message : String(err5);
+      } catch (err6) {
+        const message = err6 instanceof Error ? err6.message : String(err6);
         return {
           isError: true,
           content: [{ type: "text", text: `Error reading OCS event buffer: ${message}` }]
@@ -5703,10 +5703,10 @@ import {
 async function safeCallWithToken(client, _token, method, params = {}) {
   try {
     return { data: await client.call(method, params), error: null };
-  } catch (err5) {
+  } catch (err6) {
     return {
       data: null,
-      error: err5 instanceof Error ? err5.message : String(err5)
+      error: err6 instanceof Error ? err6.message : String(err6)
     };
   }
 }
@@ -5904,10 +5904,10 @@ async function deleteWizardSession(env, sub, wizardId) {
 async function safeCallWithToken2(client, _token, method, params = {}) {
   try {
     return { data: await client.call(method, params), error: null };
-  } catch (err5) {
+  } catch (err6) {
     return {
       data: null,
-      error: err5 instanceof Error ? err5.message : String(err5)
+      error: err6 instanceof Error ? err6.message : String(err6)
     };
   }
 }
@@ -6267,10 +6267,10 @@ import {
 async function safeCallWithToken3(client, _token, method, params = {}) {
   try {
     return { data: await client.call(method, params), error: null };
-  } catch (err5) {
+  } catch (err6) {
     return {
       data: null,
-      error: err5 instanceof Error ? err5.message : String(err5)
+      error: err6 instanceof Error ? err6.message : String(err6)
     };
   }
 }
@@ -7931,8 +7931,8 @@ function buildPricingHandler(tool, ctx) {
           }
         ]
       };
-    } catch (err5) {
-      const message = err5 instanceof Error ? err5.message : String(err5);
+    } catch (err6) {
+      const message = err6 instanceof Error ? err6.message : String(err6);
       ctx.audit({
         tool_name: tool.name,
         ocs_method: "billing",
@@ -8252,8 +8252,8 @@ function writeUsageThresholdAudit(env, severity, remainingCredits, month, taskCo
       doubles: [remainingCredits],
       indexes: ["manus_usage"]
     });
-  } catch (err5) {
-    console.error(`[manus-usage] threshold audit write failed: ${err5.message}`);
+  } catch (err6) {
+    console.error(`[manus-usage] threshold audit write failed: ${err6.message}`);
   }
 }
 
@@ -8363,7 +8363,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err5) {
+      } catch (err6) {
         ctx.audit({
           tool_name: "ui_agent_schedule_create",
           ocs_method: "[manus:schedule.create]",
@@ -8372,7 +8372,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           duration_ms: Date.now() - start,
           event_type: "ui_agent_dispatch"
         });
-        const msg = err5 instanceof ManusScheduleError ? `Manus API error (HTTP ${err5.statusCode}): ${err5.message}` : err5 instanceof Error ? err5.message : String(err5);
+        const msg = err6 instanceof ManusScheduleError ? `Manus API error (HTTP ${err6.statusCode}): ${err6.message}` : err6 instanceof Error ? err6.message : String(err6);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -8430,7 +8430,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err5) {
+      } catch (err6) {
         ctx.audit({
           tool_name: "ui_agent_schedule_list",
           ocs_method: "[manus:schedule.list]",
@@ -8438,7 +8438,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           dry_run: false,
           duration_ms: Date.now() - start
         });
-        const msg = err5 instanceof ManusScheduleError ? `Manus API error (HTTP ${err5.statusCode}): ${err5.message}` : err5 instanceof Error ? err5.message : String(err5);
+        const msg = err6 instanceof ManusScheduleError ? `Manus API error (HTTP ${err6.statusCode}): ${err6.message}` : err6 instanceof Error ? err6.message : String(err6);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -8499,7 +8499,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err5) {
+      } catch (err6) {
         ctx.audit({
           tool_name: "ui_agent_schedule_delete",
           ocs_method: "[manus:schedule.delete]",
@@ -8508,7 +8508,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           duration_ms: Date.now() - start,
           event_type: "ui_agent_dispatch"
         });
-        const msg = err5 instanceof ManusScheduleError ? `Manus API error (HTTP ${err5.statusCode}): ${err5.message}` : err5 instanceof Error ? err5.message : String(err5);
+        const msg = err6 instanceof ManusScheduleError ? `Manus API error (HTTP ${err6.statusCode}): ${err6.message}` : err6 instanceof Error ? err6.message : String(err6);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -8569,7 +8569,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err5) {
+      } catch (err6) {
         ctx.audit({
           tool_name: "ui_agent_schedule_pause",
           ocs_method: "[manus:schedule.pause]",
@@ -8578,7 +8578,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           duration_ms: Date.now() - start,
           event_type: "ui_agent_dispatch"
         });
-        const msg = err5 instanceof ManusScheduleError ? `Manus API error (HTTP ${err5.statusCode}): ${err5.message}` : err5 instanceof Error ? err5.message : String(err5);
+        const msg = err6 instanceof ManusScheduleError ? `Manus API error (HTTP ${err6.statusCode}): ${err6.message}` : err6 instanceof Error ? err6.message : String(err6);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -8639,7 +8639,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err5) {
+      } catch (err6) {
         ctx.audit({
           tool_name: "ui_agent_schedule_resume",
           ocs_method: "[manus:schedule.resume]",
@@ -8648,7 +8648,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           duration_ms: Date.now() - start,
           event_type: "ui_agent_dispatch"
         });
-        const msg = err5 instanceof ManusScheduleError ? `Manus API error (HTTP ${err5.statusCode}): ${err5.message}` : err5 instanceof Error ? err5.message : String(err5);
+        const msg = err6 instanceof ManusScheduleError ? `Manus API error (HTTP ${err6.statusCode}): ${err6.message}` : err6 instanceof Error ? err6.message : String(err6);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -8693,7 +8693,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err5) {
+      } catch (err6) {
         ctx.audit({
           tool_name: "ui_agent_usage",
           ocs_method: "[manus:usage.get]",
@@ -8701,7 +8701,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           dry_run: false,
           duration_ms: Date.now() - start
         });
-        const msg = err5 instanceof Error ? err5.message : String(err5);
+        const msg = err6 instanceof Error ? err6.message : String(err6);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -8944,7 +8944,7 @@ Report success or failure with a clear summary.`;
           }
         ]
       };
-    } catch (err5) {
+    } catch (err6) {
       ctx.audit({
         tool_name: toolName,
         ocs_method: `[ui-agent:${gapId}]`,
@@ -8958,7 +8958,7 @@ Report success or failure with a clear summary.`;
         content: [
           {
             type: "text",
-            text: `Error dispatching UI agent: ${err5 instanceof Error ? err5.message : String(err5)}`
+            text: `Error dispatching UI agent: ${err6 instanceof Error ? err6.message : String(err6)}`
           }
         ]
       };
@@ -9382,7 +9382,7 @@ function registerUiAgentAskTools(server2, ctx) {
       try {
         const replyOutcome = await askReply(keys, task_id, reply);
         result2 = replyOutcome.data;
-      } catch (err5) {
+      } catch (err6) {
         ctx.audit({
           tool_name: "ui_agent_reply",
           ocs_method: "[ui-agent:ask-reply]",
@@ -9397,7 +9397,7 @@ function registerUiAgentAskTools(server2, ctx) {
           content: [
             {
               type: "text",
-              text: `Error calling Manus task.reply: ${err5 instanceof Error ? err5.message : String(err5)}`
+              text: `Error calling Manus task.reply: ${err6 instanceof Error ? err6.message : String(err6)}`
             }
           ]
         };
@@ -9475,13 +9475,13 @@ function registerUiAgentAskTools(server2, ctx) {
       try {
         const listing = await ctx.env.CARRIER_USERS.list({ prefix: PENDING_ASK_PREFIX });
         keys = listing.keys;
-      } catch (err5) {
+      } catch (err6) {
         return {
           isError: true,
           content: [
             {
               type: "text",
-              text: `Error listing pending tasks: ${err5 instanceof Error ? err5.message : String(err5)}`
+              text: `Error listing pending tasks: ${err6 instanceof Error ? err6.message : String(err6)}`
             }
           ]
         };
@@ -9652,7 +9652,7 @@ function registerStripeConnectTools(server2, ctx) {
   );
   server2.tool(
     "stripe_connect_payouts",
-    "List money Stripe has already sent from the operator's connected account to their bank, newest first. Read-only. Params: `limit` (1-50, default 10). Returns: payouts with amount (smallest currency unit), currency, status, and arrival date. Do NOT use this for money still sitting at Stripe and not yet paid out \u2014 use `stripe_connect_balance`.",
+    "List money Stripe has already sent from the operator's connected account to their bank, newest first. Read-only. Params: `limit` (1-50, default 10), `status` (optional Stripe payout status, e.g. 'paid', 'pending', 'failed'). Returns: { payouts: [{ id, amount, currency, status, arrival_date, automatic, created }], has_more } \u2014 amount in the currency's smallest unit. Do NOT use this for money still sitting at Stripe and not yet paid out \u2014 use `stripe_connect_balance`.",
     {
       limit: z17.number().int().min(1).max(50).default(10).describe("Number of payouts to return."),
       status: z17.enum(["pending", "paid", "failed", "canceled", "in_transit"]).optional().describe("Filter by payout status.")
@@ -9769,7 +9769,7 @@ Call again with confirm_token="${token2}" to execute. Token expires in 5 minutes
   );
   server2.tool(
     "stripe_connect_dispute_list",
-    "List chargebacks customers have raised with their bank against the operator's connected Stripe account. Read-only \u2014 responding to one is Dashboard work. Params: `limit` (1-50, default 10), `status` (optional Stripe dispute status, e.g. 'needs_response', 'under_review'). Returns: disputes with amount, reason, status, and the evidence deadline. Do NOT use this for charges Stripe is holding for fraud review before they settle \u2014 those are `radar_review_list`. Check this before refunding: refunding a disputed charge can cost the operator the amount twice.",
+    "List chargebacks customers have raised with their bank against the operator's connected Stripe account. Read-only \u2014 responding to one is Dashboard work. Params: `limit` (1-50, default 10), `status` (optional Stripe dispute status, e.g. 'needs_response', 'under_review'). Returns: { disputes: [{ id, charge, amount, currency, status, reason, evidence_details.due_by }], has_more } \u2014 amount in the currency's smallest unit, `due_by` a Unix timestamp or null. Do NOT use this for charges Stripe is holding for fraud review before they settle \u2014 those are `radar_review_list`. Check this before refunding: refunding a disputed charge can cost the operator the amount twice.",
     {
       limit: z17.number().int().min(1).max(50).default(10),
       status: z17.string().optional().describe("Filter by dispute status (e.g. needs_response, under_review).")
@@ -9989,8 +9989,407 @@ Note: If you need this automated, use the Radar for Platforms beta \u2014 contac
   );
 }
 
-// src/tools-greenzone.ts
+// src/wallet-tools.ts
 import { z as z18 } from "zod";
+import * as Sentry3 from "@sentry/cloudflare";
+
+// src/wallet-client.ts
+var DEFAULT_ATLAS_BASE_URL = "https://atlas.carrier.llc";
+var WalletClientError = class extends Error {
+  status;
+  constructor(message, status) {
+    super(message);
+    this.name = "WalletClientError";
+    this.status = status;
+  }
+};
+function resolveConfig(env) {
+  const key = env.CARRIER_INTERNAL_API_KEY;
+  if (!key) {
+    throw new WalletClientError(
+      "CARRIER_INTERNAL_API_KEY not configured \u2014 cannot reach ATLAS wallet",
+      0
+    );
+  }
+  const baseUrl2 = (env.ATLAS_BASE_URL ?? DEFAULT_ATLAS_BASE_URL).replace(
+    /\/+$/,
+    ""
+  );
+  return { baseUrl: baseUrl2, key };
+}
+async function atlasFetch(env, path, init) {
+  const { baseUrl: baseUrl2, key } = resolveConfig(env);
+  const headers = { "X-Carrier-Internal-Key": key };
+  let body;
+  if (init.body !== void 0) {
+    headers["Content-Type"] = "application/json";
+    body = JSON.stringify(init.body);
+  }
+  let res;
+  try {
+    res = await fetch(`${baseUrl2}${path}`, { method: init.method, headers, body });
+  } catch (e) {
+    throw new WalletClientError(
+      `ATLAS wallet request failed: ${e instanceof Error ? e.message : "network error"}`,
+      0
+    );
+  }
+  if (!res.ok) {
+    const detail = await res.text().catch(() => "");
+    throw new WalletClientError(
+      `ATLAS wallet ${init.method} ${path} -> HTTP ${res.status}${detail ? `: ${detail}` : ""}`,
+      res.status
+    );
+  }
+  return await res.json();
+}
+async function walletTopup(env, orgId, args) {
+  return atlasFetch(
+    env,
+    `/internal/wallet/${encodeURIComponent(orgId)}/topup`,
+    {
+      method: "POST",
+      body: {
+        eur_cents: args.eurCents,
+        ref: args.ref,
+        ...args.type ? { type: args.type } : {}
+      }
+    }
+  );
+}
+async function getWallet(env, orgId) {
+  return atlasFetch(env, `/internal/wallet/${encodeURIComponent(orgId)}`, {
+    method: "GET"
+  });
+}
+
+// src/billing-sub.ts
+async function resolveBillingSub(env, orgId) {
+  if (!env.CARRIER_USERS) return orgId;
+  const pointer = await env.CARRIER_USERS.get(
+    `org:${orgId}:billing_owner_sub`
+  ).catch(() => null);
+  return pointer ?? orgId;
+}
+
+// src/wallet-tools.ts
+var PACKS = [
+  { id: "pack_500", eurCents: 5e4, bonusPct: 0 },
+  { id: "pack_1000", eurCents: 1e5, bonusPct: 3 },
+  { id: "pack_2500", eurCents: 25e4, bonusPct: 6 },
+  { id: "pack_5000", eurCents: 5e5, bonusPct: 10 }
+];
+function bonusCentsFor(pack) {
+  return Math.floor(pack.eurCents * pack.bonusPct / 100);
+}
+function resolvePack(idOrCents) {
+  if (typeof idOrCents === "number") {
+    return PACKS.find((p) => p.eurCents === idOrCents);
+  }
+  return PACKS.find((p) => p.id === idOrCents) ?? PACKS.find((p) => String(p.eurCents) === idOrCents);
+}
+var STRIPE_API = "https://api.stripe.com";
+async function stripePostForm(stripeKey, path, params, opts) {
+  const headers = {
+    Authorization: `Bearer ${stripeKey}`,
+    "Content-Type": "application/x-www-form-urlencoded"
+  };
+  if (opts?.idempotencyKey) {
+    headers["Idempotency-Key"] = opts.idempotencyKey;
+  }
+  const res = await fetch(`${STRIPE_API}${path}`, {
+    method: "POST",
+    headers,
+    body: params.toString()
+  });
+  const data = await res.json();
+  return { ok: res.ok, status: res.status, data };
+}
+var DEFAULT_SUCCESS_URL = "https://app.carrier.llc/billing?topup=success";
+var DEFAULT_CANCEL_URL = "https://app.carrier.llc/billing?topup=cancelled";
+async function createTopupCheckout(env, args) {
+  const stripeKey = env.STRIPE_SECRET_KEY;
+  if (!stripeKey) throw new Error("Stripe not configured (STRIPE_SECRET_KEY absent)");
+  const bonusCents = bonusCentsFor(args.pack);
+  const successUrl = args.successUrl ?? env.WALLET_CHECKOUT_SUCCESS_URL ?? DEFAULT_SUCCESS_URL;
+  const cancelUrl = args.cancelUrl ?? env.WALLET_CHECKOUT_CANCEL_URL ?? DEFAULT_CANCEL_URL;
+  const bonusLabel = bonusCents > 0 ? ` (+\u20AC${(bonusCents / 100).toFixed(2)} bonus)` : "";
+  const billingSub = await resolveBillingSub(env, args.orgId);
+  const existingCustomer = await env.CARRIER_USERS.get(`stripe_customer_id:${billingSub}`).catch(() => null);
+  const params = new URLSearchParams({
+    mode: "payment",
+    success_url: successUrl,
+    cancel_url: cancelUrl,
+    "line_items[0][quantity]": "1",
+    "line_items[0][price_data][currency]": "eur",
+    "line_items[0][price_data][unit_amount]": String(args.pack.eurCents),
+    "line_items[0][price_data][product_data][name]": `Carrier wallet top-up \u2014 \u20AC${(args.pack.eurCents / 100).toFixed(2)}${bonusLabel}`,
+    client_reference_id: args.orgId,
+    "metadata[kind]": "wallet_topup",
+    "metadata[org_id]": args.orgId,
+    "metadata[pack_id]": args.pack.id,
+    "metadata[pack_eur_cents]": String(args.pack.eurCents),
+    "metadata[bonus_eur_cents]": String(bonusCents),
+    // Save the payment method for reuse so subsequent off-session auto-top-up
+    // charges (runAutoTopup) can charge it without the customer present.
+    "payment_intent_data[setup_future_usage]": "off_session",
+    // Mirror metadata onto the resulting PaymentIntent so the
+    // payment_intent.succeeded webhook can also credit idempotently.
+    "payment_intent_data[metadata][kind]": "wallet_topup",
+    "payment_intent_data[metadata][org_id]": args.orgId,
+    "payment_intent_data[metadata][pack_eur_cents]": String(args.pack.eurCents),
+    "payment_intent_data[metadata][bonus_eur_cents]": String(bonusCents)
+  });
+  if (existingCustomer) {
+    params.set("customer", existingCustomer);
+  } else {
+    params.set("customer_creation", "always");
+  }
+  const result2 = await stripePostForm(
+    stripeKey,
+    "/v1/checkout/sessions",
+    params
+  );
+  if (!result2.ok) {
+    throw new Error(`Stripe checkout session create failed: ${JSON.stringify(result2.data)}`);
+  }
+  return { id: result2.data.id, url: result2.data.url };
+}
+async function runAutoTopup(env, args) {
+  const stripeKey = env.STRIPE_SECRET_KEY;
+  if (!stripeKey) {
+    return { charged: false, creditedCents: 0, reason: "stripe_not_configured" };
+  }
+  let packCents = args.packCents;
+  try {
+    const wallet = await getWallet(env, args.orgId);
+    if (packCents === void 0) packCents = wallet.auto_topup_pack_cents;
+  } catch (e) {
+    if (e instanceof WalletClientError) {
+      return { charged: false, creditedCents: 0, reason: `wallet_unreachable: ${e.message}` };
+    }
+    throw e;
+  }
+  if (!packCents || packCents <= 0) {
+    return { charged: false, creditedCents: 0, reason: "no_pack_configured" };
+  }
+  const pack = resolvePack(packCents);
+  if (!pack) {
+    return { charged: false, creditedCents: 0, reason: `unknown_pack: ${packCents}` };
+  }
+  if (!env.CARRIER_USERS) {
+    return { charged: false, creditedCents: 0, reason: "no_payment_method" };
+  }
+  const customerId = await env.CARRIER_USERS.get(`stripe_customer_id:${args.sub}`).catch(
+    () => null
+  );
+  const pmId = await env.CARRIER_USERS.get(`stripe_pm_id:${args.sub}`).catch(() => null);
+  if (!customerId || !pmId) {
+    return { charged: false, creditedCents: 0, reason: "no_payment_method" };
+  }
+  const bonusCents = bonusCentsFor(pack);
+  const body = new URLSearchParams({
+    amount: String(pack.eurCents),
+    currency: "eur",
+    customer: customerId,
+    payment_method: pmId,
+    confirm: "true",
+    off_session: "true",
+    description: `Carrier wallet auto-top-up \u2014 \u20AC${(pack.eurCents / 100).toFixed(2)}`,
+    "metadata[kind]": "wallet_topup",
+    "metadata[org_id]": args.orgId,
+    "metadata[pack_eur_cents]": String(pack.eurCents),
+    "metadata[bonus_eur_cents]": String(bonusCents),
+    "metadata[auto_topup]": "true"
+  });
+  const resp = await stripePostForm(
+    stripeKey,
+    "/v1/payment_intents",
+    body
+  );
+  if (!resp.ok) {
+    return {
+      charged: false,
+      creditedCents: 0,
+      reason: `stripe_error: ${JSON.stringify(resp.data)}`
+    };
+  }
+  if (resp.data.status !== "succeeded") {
+    return {
+      charged: false,
+      creditedCents: 0,
+      reason: `payment_status: ${resp.data.status}`,
+      paymentIntentId: resp.data.id
+    };
+  }
+  const creditedCents = pack.eurCents + bonusCents;
+  try {
+    const topup = await walletTopup(env, args.orgId, {
+      eurCents: creditedCents,
+      ref: resp.data.id,
+      type: "auto_topup"
+    });
+    return {
+      charged: true,
+      creditedCents,
+      balanceAfterCents: topup.balance_after_cents,
+      paymentIntentId: resp.data.id
+    };
+  } catch (e) {
+    Sentry3.captureException(e);
+    return {
+      charged: true,
+      creditedCents,
+      paymentIntentId: resp.data.id,
+      reason: `credited_via_webhook_pending: ${e instanceof Error ? e.message : "atlas error"}`
+    };
+  }
+}
+function ok3(text) {
+  return { content: [{ type: "text", text }] };
+}
+function err3(text) {
+  return { isError: true, content: [{ type: "text", text }] };
+}
+function registerWalletTools(server2, ctx) {
+  const { env, props: props2 } = ctx;
+  const defaultOrgId = props2.org_id ?? props2.sub;
+  server2.tool(
+    "wallet_balance",
+    "Read the caller organisation's Carrier prepaid wallet: current balance and auto-top-up settings. The wallet is what Carrier bills your own eSIM spend against \u2014 it is not an OCS balance and not your MCP plan credits. Params: none (the organisation is taken from the session). Returns: { org_id, balance_eur_cents, auto_topup_enabled, auto_topup_threshold_cents, auto_topup_pack_cents } \u2014 all amounts in EUR cents, not euros. Do NOT use this for a reseller account balance in OCS \u2014 use `get_reseller_info` or `list_reseller_accounts`. Do NOT use this for a subscriber's OCS balance \u2014 use `get_subscriber`. Do NOT use this for MCP plan credits \u2014 use `credit_balance`. Do NOT use this for money held at Stripe \u2014 use `stripe_connect_balance`.",
+    {},
+    async () => {
+      const orgId = defaultOrgId;
+      const start = Date.now();
+      try {
+        const wallet = await getWallet(env, orgId);
+        writeAudit(env, {
+          tool_name: "wallet_balance",
+          ocs_method: "atlas.wallet.read",
+          status: "ok",
+          dry_run: false,
+          duration_ms: Date.now() - start,
+          sub: props2.sub,
+          reseller_id: props2.reseller_id
+        });
+        return ok3(
+          JSON.stringify({
+            org_id: orgId,
+            balance_eur_cents: wallet.balance_eur_cents,
+            auto_topup_enabled: wallet.auto_topup_enabled,
+            auto_topup_threshold_cents: wallet.auto_topup_threshold_cents,
+            auto_topup_pack_cents: wallet.auto_topup_pack_cents
+          })
+        );
+      } catch (e) {
+        if (e instanceof WalletClientError) return err3(`Wallet error: ${e.message}`);
+        Sentry3.captureException(e);
+        return err3(`Error: ${e instanceof Error ? e.message : "unknown"}`);
+      }
+    }
+  );
+  server2.tool(
+    "wallet_topup_checkout",
+    "Create a Stripe Checkout link so a human can top up the Carrier prepaid wallet by card. This tool charges nothing itself: it returns a hosted URL, and the wallet is credited (pack amount + bonus) only after someone completes the payment in a browser. Params: `pack` (optional \u2014 pack id `pack_500`/`pack_1000`/`pack_2500`/`pack_5000`, or an exact EUR-cents amount matching a catalog pack; omit to list the packs and their bonuses without creating a session). Returns: { pack_id, pack_eur_cents, bonus_eur_cents, checkout_session_id, checkout_url } \u2014 amounts in EUR cents. Do NOT use this when the wallet must be funded now with no human in the loop \u2014 use `wallet_auto_topup`, which charges the saved card immediately. Do NOT use this to move money in OCS \u2014 `modify_account_balance` and `modify_subscriber_balance` are unrelated ledgers.",
+    {
+      pack: z18.string().optional().describe(
+        "Pack id (pack_500/pack_1000/pack_2500/pack_5000) or exact EUR-cents amount. Omit to list packs."
+      )
+    },
+    async ({ pack }) => {
+      const orgId = defaultOrgId;
+      const start = Date.now();
+      if (!pack) {
+        return ok3(
+          JSON.stringify({
+            packs: PACKS.map((p) => ({
+              id: p.id,
+              eur_cents: p.eurCents,
+              bonus_pct: p.bonusPct,
+              bonus_eur_cents: bonusCentsFor(p),
+              credited_eur_cents: p.eurCents + bonusCentsFor(p)
+            }))
+          })
+        );
+      }
+      const selected = resolvePack(pack);
+      if (!selected) {
+        return err3(
+          `Unknown pack "${pack}". Valid: ${PACKS.map((p) => p.id).join(", ")}.`
+        );
+      }
+      try {
+        const session = await createTopupCheckout(env, { orgId, pack: selected });
+        writeAudit(env, {
+          tool_name: "wallet_topup_checkout",
+          ocs_method: "stripe.checkout.session.create",
+          status: "ok",
+          dry_run: false,
+          duration_ms: Date.now() - start,
+          sub: props2.sub,
+          reseller_id: props2.reseller_id
+        });
+        return ok3(
+          JSON.stringify({
+            org_id: orgId,
+            pack_id: selected.id,
+            pack_eur_cents: selected.eurCents,
+            bonus_eur_cents: bonusCentsFor(selected),
+            checkout_session_id: session.id,
+            checkout_url: session.url
+          })
+        );
+      } catch (e) {
+        Sentry3.captureException(e);
+        return err3(`Error: ${e instanceof Error ? e.message : "unknown"}`);
+      }
+    }
+  );
+  server2.tool(
+    "wallet_auto_topup",
+    "Charge the organisation's saved card off-session, right now, and credit the Carrier prepaid wallet with the pack. This spends real money without any browser step or human confirmation, so only call it when the user has asked to be charged. Params: `pack_cents` (optional integer, EUR cents \u2014 must match a catalog pack; omit to use the organisation's configured auto-top-up pack). Returns on success: { org_id, charged: true, credited_eur_cents, balance_after_cents, payment_intent_id } \u2014 amounts in EUR cents. Returns { charged: false, reason } as an error when the card declines or no payment method is saved. Do NOT use this to let a human pay in a browser \u2014 use `wallet_topup_checkout`, which only returns a link. Do NOT use this to change the threshold that triggers automatic top-ups; this tool performs one charge and does not edit the configuration. Do NOT use this to credit an OCS reseller account or subscriber \u2014 see `modify_account_balance` and `modify_subscriber_balance`.",
+    {
+      pack_cents: z18.number().int().positive().optional().describe("Override pack amount in EUR cents (must match a catalog pack).")
+    },
+    async ({ pack_cents }) => {
+      const orgId = defaultOrgId;
+      const start = Date.now();
+      try {
+        const result2 = await runAutoTopup(env, { orgId, sub: props2.sub, packCents: pack_cents });
+        writeAudit(env, {
+          tool_name: "wallet_auto_topup",
+          ocs_method: "stripe.payment_intent.off_session",
+          status: result2.charged ? "ok" : "error",
+          dry_run: false,
+          duration_ms: Date.now() - start,
+          sub: props2.sub,
+          reseller_id: props2.reseller_id
+        });
+        if (!result2.charged) {
+          return err3(
+            JSON.stringify({ org_id: orgId, charged: false, reason: result2.reason })
+          );
+        }
+        return ok3(
+          JSON.stringify({
+            org_id: orgId,
+            charged: true,
+            credited_eur_cents: result2.creditedCents,
+            balance_after_cents: result2.balanceAfterCents,
+            payment_intent_id: result2.paymentIntentId,
+            ...result2.reason ? { note: result2.reason } : {}
+          })
+        );
+      } catch (e) {
+        Sentry3.captureException(e);
+        return err3(`Error: ${e instanceof Error ? e.message : "unknown"}`);
+      }
+    }
+  );
+}
+
+// src/tools-greenzone.ts
+import { z as z19 } from "zod";
 
 // src/greenzone-whitelist.ts
 var STATE_KEY = "greenzone:state";
@@ -10267,10 +10666,10 @@ function resolvePortalBaseUrl(env) {
 function getGreenzoneKv(env) {
   return env.GREENZONE_STATE_KV ?? null;
 }
-function ok3(payload) {
+function ok4(payload) {
   return { content: [{ type: "text", text: JSON.stringify(payload, null, 2) }] };
 }
-function err3(message) {
+function err4(message) {
   return { isError: true, content: [{ type: "text", text: message }] };
 }
 var KAPTURE_UNAVAILABLE_MSG = "Execute each Kapture step using mcp__kapture__* tools in sequence. Ensure the Kapture extension is active in Chrome before invoking.";
@@ -10281,21 +10680,21 @@ function registerGreenzoneTools(server2, ctx) {
       title: "Greenzone Whitelist \u2014 Add",
       description: "Add a hostname and/or IP address to the Bridge4IP Greenzone whitelist. The Greenzone whitelist controls which hosts/IPs are exempt from data charging after a subscriber's bundle is depleted. This operates via browser automation (Kapture) against the OCS portal \u2014 no REST API exists for this surface. Provide `host` (e.g. 'example.com') and/or `ip` (e.g. '203.0.113.0/24'). At least one of host or ip must be provided. Returns Kapture step sequence for Claude Code to execute. Requires 'write' scope and Kapture running in Sam's Chrome.",
       inputSchema: {
-        host: z18.string().optional().describe("Hostname to whitelist (e.g. 'example.com')"),
-        ip: z18.string().optional().describe("IP address or CIDR to whitelist (e.g. '203.0.113.0/24')"),
-        dry_run: z18.boolean().optional().describe("If true, return the Kapture steps without executing portal automation")
+        host: z19.string().optional().describe("Hostname to whitelist (e.g. 'example.com')"),
+        ip: z19.string().optional().describe("IP address or CIDR to whitelist (e.g. '203.0.113.0/24')"),
+        dry_run: z19.boolean().optional().describe("If true, return the Kapture steps without executing portal automation")
       },
       annotations: { destructiveHint: true }
     },
     async (args) => {
       if (!ctx.props.scope.includes("write")) {
-        return err3(
+        return err4(
           `Scope denied: greenzone_whitelist_add requires 'write' scope. Your token has: [${ctx.props.scope.join(", ")}].`
         );
       }
       const { host, ip, dry_run } = args;
       if (!host && !ip) {
-        return err3("At least one of 'host' or 'ip' must be provided.");
+        return err4("At least one of 'host' or 'ip' must be provided.");
       }
       const portalBaseUrl = resolvePortalBaseUrl(ctx.env);
       const steps = [
@@ -10303,7 +10702,7 @@ function registerGreenzoneTools(server2, ctx) {
         ...ip ? buildAddIpSteps(portalBaseUrl, ip) : []
       ];
       if (dry_run) {
-        return ok3({
+        return ok4({
           dry_run: true,
           message: "Would execute the following Kapture steps against the OCS portal:",
           kapture_steps: steps,
@@ -10326,7 +10725,7 @@ function registerGreenzoneTools(server2, ctx) {
       } else {
         kvWarning = "GREENZONE_STATE_KV not bound in stdio mode \u2014 state not persisted.";
       }
-      return ok3({
+      return ok4({
         requires_kapture: true,
         message: "Execute the Kapture steps below to apply the change in the OCS portal. " + KAPTURE_UNAVAILABLE_MSG,
         kapture_steps: steps,
@@ -10342,21 +10741,21 @@ function registerGreenzoneTools(server2, ctx) {
       title: "Greenzone Whitelist \u2014 Remove",
       description: "Remove a hostname and/or IP address from the Bridge4IP Greenzone whitelist. This operates via browser automation (Kapture) against the OCS portal. Provide `host` and/or `ip` to remove \u2014 at least one required. Returns Kapture step sequence for Claude Code to execute. Requires 'write' scope and Kapture running in Sam's Chrome.",
       inputSchema: {
-        host: z18.string().optional().describe("Hostname to remove from whitelist"),
-        ip: z18.string().optional().describe("IP address or CIDR to remove from whitelist"),
-        dry_run: z18.boolean().optional().describe("If true, return the Kapture steps without executing portal automation")
+        host: z19.string().optional().describe("Hostname to remove from whitelist"),
+        ip: z19.string().optional().describe("IP address or CIDR to remove from whitelist"),
+        dry_run: z19.boolean().optional().describe("If true, return the Kapture steps without executing portal automation")
       },
       annotations: { destructiveHint: true }
     },
     async (args) => {
       if (!ctx.props.scope.includes("write")) {
-        return err3(
+        return err4(
           `Scope denied: greenzone_whitelist_remove requires 'write' scope. Your token has: [${ctx.props.scope.join(", ")}].`
         );
       }
       const { host, ip, dry_run } = args;
       if (!host && !ip) {
-        return err3("At least one of 'host' or 'ip' must be provided.");
+        return err4("At least one of 'host' or 'ip' must be provided.");
       }
       const portalBaseUrl = resolvePortalBaseUrl(ctx.env);
       const steps = [
@@ -10364,7 +10763,7 @@ function registerGreenzoneTools(server2, ctx) {
         ...ip ? buildRemoveIpSteps(portalBaseUrl, ip) : []
       ];
       if (dry_run) {
-        return ok3({
+        return ok4({
           dry_run: true,
           message: "Would execute the following Kapture steps to remove from OCS portal:",
           kapture_steps: steps,
@@ -10387,7 +10786,7 @@ function registerGreenzoneTools(server2, ctx) {
       } else {
         kvWarning = "GREENZONE_STATE_KV not bound in stdio mode \u2014 state not persisted.";
       }
-      return ok3({
+      return ok4({
         requires_kapture: true,
         message: "Execute the Kapture steps below to apply the removal in the OCS portal. " + KAPTURE_UNAVAILABLE_MSG,
         kapture_steps: steps,
@@ -10403,7 +10802,7 @@ function registerGreenzoneTools(server2, ctx) {
       title: "Greenzone Whitelist \u2014 List",
       description: "List current Greenzone whitelist entries from the KV cache. Returns all whitelisted hosts and IPs, when the state was last synced, and whether the last hourly reconciliation detected drift from the portal. This is a fast read from KV \u2014 no browser automation required. Use `from_portal: true` to trigger a live portal read via Kapture instead of KV. Requires 'read' scope.",
       inputSchema: {
-        from_portal: z18.boolean().optional().describe(
+        from_portal: z19.boolean().optional().describe(
           "When true, return Kapture steps to read live portal state instead of KV cache"
         )
       },
@@ -10411,14 +10810,14 @@ function registerGreenzoneTools(server2, ctx) {
     },
     async (args) => {
       if (!ctx.props.scope.includes("read")) {
-        return err3(
+        return err4(
           `Scope denied: greenzone_whitelist_list requires 'read' scope. Your token has: [${ctx.props.scope.join(", ")}].`
         );
       }
       const { from_portal } = args;
       if (from_portal) {
         const portalBaseUrl = resolvePortalBaseUrl(ctx.env);
-        return ok3({
+        return ok4({
           requires_kapture: true,
           message: "Execute the Kapture steps below to read live Greenzone whitelist state from the OCS portal.",
           kapture_steps: buildListSteps(portalBaseUrl),
@@ -10427,7 +10826,7 @@ function registerGreenzoneTools(server2, ctx) {
       }
       const kv = getGreenzoneKv(ctx.env);
       if (!kv) {
-        return ok3({
+        return ok4({
           source: "kv_cache",
           hosts: [],
           ips: [],
@@ -10439,7 +10838,7 @@ function registerGreenzoneTools(server2, ctx) {
       }
       try {
         const state = await readState(kv);
-        return ok3({
+        return ok4({
           source: "kv_cache",
           hosts: state.hosts,
           ips: state.ips,
@@ -10448,14 +10847,14 @@ function registerGreenzoneTools(server2, ctx) {
           reconcile_drift: state.reconcile_drift ?? false
         });
       } catch (e) {
-        return err3(`Failed to read Greenzone state from KV: ${e instanceof Error ? e.message : String(e)}`);
+        return err4(`Failed to read Greenzone state from KV: ${e instanceof Error ? e.message : String(e)}`);
       }
     }
   );
 }
 
 // src/tools-ui-agent-generic.ts
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 var STDIO_ERROR = {
   isError: true,
   content: [
@@ -10476,9 +10875,9 @@ function registerUiAgentGenericTools(server2, _ctx) {
       title: "Dispatch Generic Steel Browsing Agent",
       description: "Dispatch a Steel browsing agent task with a natural-language prompt. The agent will navigate the web, use Tavily web search if needed, and return the result. Use for ad-hoc research, page extraction, form filling outside the OCS portal. Pro/Enterprise scope required. Cost ~$0.20-1.00 per task depending on complexity. Returns task_id immediately \u2014 poll with ui_agent_status for completion. Set dry_run=true to preview cost estimate without executing. NOTE: requires remote Worker deployment (mcp.carrier.llc/mcp) \u2014 not available in stdio mode.",
       inputSchema: {
-        prompt: z19.string().min(1).max(4e3).describe("Natural-language task description for the Steel browsing agent."),
-        max_steps: z19.number().int().min(1).max(30).optional().describe("Maximum agent steps (1\u201330, default 15)."),
-        dry_run: z19.boolean().optional().describe("Preview cost estimate without dispatching.")
+        prompt: z20.string().min(1).max(4e3).describe("Natural-language task description for the Steel browsing agent."),
+        max_steps: z20.number().int().min(1).max(30).optional().describe("Maximum agent steps (1\u201330, default 15)."),
+        dry_run: z20.boolean().optional().describe("Preview cost estimate without dispatching.")
       }
     },
     async (_args) => STDIO_ERROR
@@ -10489,7 +10888,7 @@ function registerUiAgentGenericTools(server2, _ctx) {
       title: "Get Steel Agent Task Status",
       description: "Poll the status of a Steel browser agent task dispatched by ui_agent_ask or any ui_* tool. Returns current status (pending | running | completed | failed) and result when available. NOTE: requires remote Worker deployment (mcp.carrier.llc/mcp) \u2014 not available in stdio mode.",
       inputSchema: {
-        task_id: z19.string().describe("Steel task ID returned by ui_agent_ask or any ui_* tool dispatch")
+        task_id: z20.string().describe("Steel task ID returned by ui_agent_ask or any ui_* tool dispatch")
       }
     },
     async (_args) => STDIO_ERROR
@@ -10497,17 +10896,17 @@ function registerUiAgentGenericTools(server2, _ctx) {
 }
 
 // src/tools-storefront-logo.ts
-import { z as z20 } from "zod";
-var ok4 = (text) => ({ content: [{ type: "text", text }] });
-var err4 = (text) => ({ isError: true, content: [{ type: "text", text }] });
+import { z as z21 } from "zod";
+var ok5 = (text) => ({ content: [{ type: "text", text }] });
+var err5 = (text) => ({ isError: true, content: [{ type: "text", text }] });
 function registerStorefrontLogoTools(server2, env = {}) {
   server2.tool(
     "generate_storefront_logo",
     "Generate a storefront logo (SVG always; PNG when an image key is configured on the Carrier worker). Works for any authenticated Carrier MCP user \u2014 no local image-API key required. Write the SVG to public/brand/logo.svg in the storefront.",
     {
-      name: z20.string().min(1).describe("Brand / shop name, e.g. Bananas"),
-      accent: z20.string().regex(/^#?[0-9A-Fa-f]{6}$/).optional().describe("Accent hex, e.g. #FF8A00"),
-      tagline: z20.string().optional().describe("Optional tagline for AI-enhanced marks")
+      name: z21.string().min(1).describe("Brand / shop name, e.g. Bananas"),
+      accent: z21.string().regex(/^#?[0-9A-Fa-f]{6}$/).optional().describe("Accent hex, e.g. #FF8A00"),
+      tagline: z21.string().optional().describe("Optional tagline for AI-enhanced marks")
     },
     async ({ name, accent, tagline }) => {
       try {
@@ -10518,7 +10917,7 @@ function registerStorefrontLogoTools(server2, env = {}) {
           tagline,
           env: { ...env, ...process.env }
         });
-        return ok4(
+        return ok5(
           JSON.stringify({
             brand: name,
             source: logo.source,
@@ -10530,7 +10929,7 @@ function registerStorefrontLogoTools(server2, env = {}) {
           })
         );
       } catch (e) {
-        return err4(e instanceof Error ? e.message : "logo generation failed");
+        return err5(e instanceof Error ? e.message : "logo generation failed");
       }
     }
   );
@@ -10559,7 +10958,15 @@ var stdioEnv = {
   CARRIER_USERS: null,
   DOWNLOADS: null,
   MANUS_API_KEY: "",
-  STRIPE_SECRET_KEY: ""
+  STRIPE_SECRET_KEY: process.env.STRIPE_SECRET_KEY ?? "",
+  // Prepaid-wallet configuration. Read from the environment so a local operator
+  // who holds these values gets working wallet tools; when absent the tools stay
+  // registered (catalog parity with the Worker) and return an explicit
+  // configuration error instead of silently disappearing from tools/list.
+  ATLAS_BASE_URL: process.env.ATLAS_BASE_URL,
+  CARRIER_INTERNAL_API_KEY: process.env.CARRIER_INTERNAL_API_KEY,
+  WALLET_CHECKOUT_SUCCESS_URL: process.env.WALLET_CHECKOUT_SUCCESS_URL,
+  WALLET_CHECKOUT_CANCEL_URL: process.env.WALLET_CHECKOUT_CANCEL_URL
 };
 var props = {
   sub: "stdio@local",
@@ -10592,6 +10999,7 @@ registerScheduleAndUsageTools(server, toolCtx);
 registerAllUiAgentTools(server, toolCtx);
 registerUiAgentAskTools(server, toolCtx);
 registerStripeConnectTools(server, { env: stdioEnv, props });
+registerWalletTools(server, { env: stdioEnv, props });
 registerGreenzoneTools(server, toolCtx);
 registerUiAgentGenericTools(server, toolCtx);
 registerStorefrontLogoTools(server, stdioEnv);