@carrierllc/mcp 0.3.1 → 0.4.0

package/dist/index.js

@@ -1,16 +1,38 @@
 #!/usr/bin/env node
 import {
   CARRIER_VERSION,
+  TARGET_IDS,
   acquireEndpointSlot,
+  buildSite,
+  clerkCliDeps,
+  configureClerkInstance,
+  deploySite,
+  esimStatusPerAccountParams,
   extractEsimStatusCounts,
+  fleetScreen,
+  formatProbes,
   generateStorefrontLogo,
   getLimitForEndpoint,
   getRateLimitWindowCounts,
+  imsiFromSubscriberRecord,
+  isTargetId,
+  loadStorefrontBrand,
   locationParams,
+  mergeEnvLocal,
   networkEventsOverPeriodParams,
+  normalizePackageTemplate,
+  normalizePackageTemplateChanges,
+  probeAll,
+  provisionClerk,
+  rankTargets,
+  renderHtml,
+  repairPlanFor,
+  storefrontClerkUrls,
   subscriberIdParams,
-  usageOverPeriodParams
-} from "./chunk-TABEJ7SM.js";
+  usageOverPeriodParams,
+  verifyStorefront
+} from "./chunk-RBG4MKMW.js";
+import "./chunk-SHKKVIIA.js";
 
 // src/index.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -158,6 +180,212 @@ function firstDayNextMonth() {
   return new Date(Date.UTC(y, m, 1)).toISOString();
 }
 
+// src/bounded-results.ts
+var TARIFF_MAX_RULES = 3e3;
+var TARIFF_VERBOSE_MAX_RULES = 250;
+var ZONES_MAX_ZONES = 100;
+var ZONES_MAX_OPERATORS = 2e3;
+var ZONES_VERBOSE_MAX_OPERATORS = 400;
+function extractTariffRules(raw) {
+  if (Array.isArray(raw)) return raw;
+  if (raw && typeof raw === "object") {
+    const obj = raw;
+    for (const key of ["rule", "listTariffRule", "rules"]) {
+      const v = obj[key];
+      if (Array.isArray(v)) return v;
+      if (v && typeof v === "object" && Array.isArray(v.rule)) {
+        return v.rule;
+      }
+    }
+  }
+  return [];
+}
+function extractZones(raw) {
+  if (Array.isArray(raw)) return raw;
+  if (raw && typeof raw === "object") {
+    const obj = raw;
+    for (const key of ["listDetailedLocationZone", "locationZone", "zone", "zones"]) {
+      const v = obj[key];
+      if (Array.isArray(v)) return v;
+    }
+  }
+  return [];
+}
+function matchesCountry(op, country) {
+  const want = country.trim().toLowerCase();
+  if (!want) return true;
+  const iso = (op?.countryIso2 ?? "").trim().toLowerCase();
+  const name = (op?.countryName ?? "").trim().toLowerCase();
+  return iso === want || name === want;
+}
+function matchesTrafficType(rule, trafficType) {
+  const gt0 = (v) => typeof v === "number" && v > 0;
+  switch (trafficType) {
+    case "data":
+      return gt0(rule.datarate);
+    case "voice":
+      return gt0(rule.mocallrate) || gt0(rule.mtcallrate);
+    case "sms":
+      return gt0(rule.mosmsrate) || gt0(rule.mtsmsrate);
+  }
+}
+var RATE_COLUMNS = {
+  data: [["datarate", "data"]],
+  voice: [
+    ["mocallrate", "moCall"],
+    ["mtcallrate", "mtCall"]
+  ],
+  sms: [
+    ["mosmsrate", "moSms"],
+    ["mtsmsrate", "mtSms"]
+  ]
+};
+var ALL_RATE_COLUMNS = [
+  ["datarate", "data"],
+  ["mocallrate", "moCall"],
+  ["mtcallrate", "mtCall"],
+  ["mosmsrate", "moSms"],
+  ["mtsmsrate", "mtSms"]
+];
+var FIELD_LEGEND = {
+  iso: "ISO-3166 alpha-2 country code",
+  op: "operator / network name",
+  data: "data rate per MB",
+  moCall: "mobile-originated call rate per minute",
+  mtCall: "mobile-terminated call rate per minute",
+  moSms: "mobile-originated SMS rate",
+  mtSms: "mobile-terminated SMS rate",
+  active: "present only when the rule is active; absent means inactive"
+};
+function truncationNote(kind, returned, matched) {
+  if (kind === "tariff") {
+    return `TRUNCATED: showing ${returned.toLocaleString("en-US")} of ${matched.toLocaleString("en-US")} matching tariff rules (cap ${TARIFF_MAX_RULES.toLocaleString("en-US")} rows, imposed so the result fits the MCP transport \u2014 see issue #663). Narrow the request to see the rest: pass 'country' (ISO2 such as "nl" or a full name such as "Netherlands") and/or 'trafficType' ("data" | "voice" | "sms"). These filters are applied server-side to the complete OCS table, so a filtered call sees every matching rule, not just the rules in this sample.`;
+  }
+  return `TRUNCATED: showing ${returned.toLocaleString("en-US")} of ${matched.toLocaleString("en-US")} operator entries across the returned zones (cap ${ZONES_MAX_OPERATORS.toLocaleString("en-US")} entries, imposed so the result fits the MCP transport \u2014 see issue #663). Pass 'locationZoneId' to retrieve a single zone in full.`;
+}
+function boundTariffResult(raw, opts = {}) {
+  const all = extractTariffRules(raw);
+  const { country, trafficType, verbose = false, resellerId } = opts;
+  const matched = all.filter(
+    (r) => (country === void 0 || matchesCountry(r.operator, country)) && (trafficType === void 0 || matchesTrafficType(r, trafficType))
+  );
+  const cap = opts.maxRules ?? (verbose ? TARIFF_VERBOSE_MAX_RULES : TARIFF_MAX_RULES);
+  const kept = matched.slice(0, cap);
+  const truncated = kept.length < matched.length;
+  const result2 = {
+    resellerId,
+    totalRules: all.length,
+    matchedRules: matched.length,
+    returnedRules: kept.length,
+    truncated,
+    projection: verbose ? "verbose" : "compact",
+    rules: []
+  };
+  if (country !== void 0 || trafficType !== void 0) {
+    result2.filters = {};
+    if (country !== void 0) result2.filters.country = country;
+    if (trafficType !== void 0) result2.filters.trafficType = trafficType;
+  }
+  if (verbose) {
+    result2.rules = kept;
+    if (truncated) result2.note = truncationNote("tariff", kept.length, matched.length);
+    return result2;
+  }
+  const currencies = new Set(
+    kept.map((r) => r.currency?.currencycode).filter((c) => typeof c === "string")
+  );
+  const hoistCurrency = currencies.size === 1;
+  if (hoistCurrency) result2.currency = [...currencies][0];
+  const columns = trafficType ? RATE_COLUMNS[trafficType] : ALL_RATE_COLUMNS;
+  result2.rules = kept.map((r) => {
+    const op = r.operator ?? {};
+    const row = {};
+    if (op.countryIso2 !== void 0) row.iso = op.countryIso2;
+    if (op.operatorName !== void 0) row.op = op.operatorName;
+    for (const [src, dst] of columns) {
+      const v = r[src];
+      if (typeof v === "number" && v !== 0) row[dst] = v;
+    }
+    if (!hoistCurrency && typeof r.currency?.currencycode === "string") {
+      row.cur = r.currency.currencycode;
+    }
+    if (r.active === true) row.active = true;
+    return row;
+  });
+  const legend = { ...FIELD_LEGEND };
+  if (trafficType) {
+    for (const key of ["data", "moCall", "mtCall", "moSms", "mtSms"]) {
+      if (!columns.some(([, dst]) => dst === key)) delete legend[key];
+    }
+  }
+  if (!hoistCurrency) legend.cur = "ISO-4217 currency code";
+  result2.fields = legend;
+  const notes = [];
+  if (truncated) notes.push(truncationNote("tariff", kept.length, matched.length));
+  notes.push(
+    `Projected result: nested operator detail (mccMncs, tadigs, continent, countryCode, utcOffset), the sponsor object, plan ids (roamingplanruleid, roamingplanid, sponsoridx) and the validity/discount flags (startdate, enddate, isDiscounted, hidden, dailyCap) are omitted. Pass verbose=true for the full untouched rule shape (capped at ${TARIFF_VERBOSE_MAX_RULES} rows \u2014 use 'country'/'trafficType' with it).`
+  );
+  result2.note = notes.join(" ");
+  return result2;
+}
+var ZONE_FIELD_LEGEND = {
+  zoneId: "location zone id \u2014 pass to package-template tools",
+  zoneName: "human-readable zone name",
+  operatorCount: "total operator entries in this zone upstream",
+  operators: "projected operator entries: net (networkId), iso (country ISO2), op (operator name)"
+};
+function boundZonesResult(raw, opts = {}) {
+  const all = extractZones(raw);
+  const { verbose = false, resellerId } = opts;
+  const maxZones = opts.maxZones ?? ZONES_MAX_ZONES;
+  const maxOperators = opts.maxOperators ?? (verbose ? ZONES_VERBOSE_MAX_OPERATORS : ZONES_MAX_OPERATORS);
+  const totalOperators = all.reduce((n, z23) => n + (z23.operators?.length ?? 0), 0);
+  const keptZones = all.slice(0, maxZones);
+  let budget = maxOperators;
+  let returnedOperators = 0;
+  const zones = keptZones.map((z23) => {
+    const ops = z23.operators ?? [];
+    const take = Math.max(0, Math.min(ops.length, budget));
+    budget -= take;
+    returnedOperators += take;
+    const sliced = ops.slice(0, take);
+    if (verbose) {
+      return { ...z23, operators: sliced, operatorCount: ops.length };
+    }
+    return {
+      zoneId: z23.zoneId,
+      zoneName: z23.zoneName,
+      operatorCount: ops.length,
+      operators: sliced.map((o) => ({
+        net: o.networkId,
+        iso: o.countryIso2,
+        op: o.operatorName
+      }))
+    };
+  });
+  const truncated = keptZones.length < all.length || returnedOperators < totalOperators;
+  const result2 = {
+    resellerId,
+    totalZones: all.length,
+    returnedZones: keptZones.length,
+    totalOperators,
+    returnedOperators,
+    truncated,
+    projection: verbose ? "verbose" : "compact",
+    zones
+  };
+  const notes = [];
+  if (truncated) notes.push(truncationNote("zones", returnedOperators, totalOperators));
+  if (!verbose) {
+    result2.fields = ZONE_FIELD_LEGEND;
+    notes.push(
+      `Projected result: per-operator mccMncs, tadigs, continent, countryCode, countryName and utcOffset are omitted, as is the repeated reseller object. Pass verbose=true for the full untouched zone shape (capped at ${ZONES_VERBOSE_MAX_OPERATORS} operator entries).`
+    );
+  }
+  if (notes.length) result2.note = notes.join(" ");
+  return result2;
+}
+
 // src/tools.ts
 var TOOL_SCOPES = {
   // --- read ---
@@ -203,7 +431,12 @@ var TOOL_SCOPES = {
   modify_account_balance: "admin",
   // corrected per ocs-spec PR #6
   change_sim_status: "admin",
-  delete_subscriber_package: "admin",
+  // Removing ONE package from ONE subscriber is a write, not an admin
+  // action. Admin-gating it made package lifecycle write-once for any
+  // operator on a read/write token: they could assign a package but had no
+  // way to remove one, including one assigned in error. clean_all_packages
+  // stays admin — wiping every package is a different blast radius.
+  delete_subscriber_package: "write",
   clean_all_packages: "admin",
   modify_template_core: "admin",
   modify_template_recurring: "admin",
@@ -310,9 +543,9 @@ function wrapHandler(toolName, ocsMethod, requiredScope, ctx, handler) {
     try {
       const token2 = await ctx.getUserToken(ctx.props.sub);
       result2 = await handler(args, token2);
-    } catch (err6) {
+    } catch (err7) {
       try {
-        Sentry.captureException(err6, {
+        Sentry.captureException(err7, {
           tags: {
             tool: toolName,
             feature: "mcp",
@@ -321,8 +554,8 @@ function wrapHandler(toolName, ocsMethod, requiredScope, ctx, handler) {
         });
       } catch {
       }
-      const message = err6 instanceof Error ? err6.message : String(err6);
-      const ocsCode = err6 instanceof OcsApiError ? err6.code : void 0;
+      const message = err7 instanceof Error ? err7.message : String(err7);
+      const ocsCode = err7 instanceof OcsApiError ? err7.code : void 0;
       ctx.audit({
         tool_name: toolName,
         ocs_method: ocsMethod,
@@ -464,12 +697,9 @@ function registerAllTools(server2, ctx) {
       TOOL_SCOPES["esim_status_per_account"],
       ctx,
       async ({ accountId, resellerId }, token2) => {
-        const params = {};
-        if (accountId !== void 0) {
-          params.accountId = accountId;
-        } else {
-          params.resellerId = resellerId ?? await getDefaultResellerId(ctx.env, token2);
-        }
+        const params = esimStatusPerAccountParams(
+          accountId !== void 0 ? { accountId } : { resellerId: resellerId ?? await getDefaultResellerId(ctx.env, token2) }
+        );
         return ocsCall(ctx.env, token2, "esimStatusPerAccount", params);
       }
     )
@@ -869,7 +1099,7 @@ function registerAllTools(server2, ctx) {
       async ({ iccid, bitrate, bitrate_string }, token2) => {
         const cache = /* @__PURE__ */ new Map();
         const sub = await resolveSubscriberByIccid(ctx.env, token2, iccid, cache);
-        const imsi = sub.imsi;
+        const imsi = imsiFromSubscriberRecord(sub);
         if (typeof imsi !== "string" || imsi.length === 0) {
           return {
             isError: true,
@@ -897,7 +1127,7 @@ function registerAllTools(server2, ctx) {
       async ({ iccid }, token2) => {
         const cache = /* @__PURE__ */ new Map();
         const sub = await resolveSubscriberByIccid(ctx.env, token2, iccid, cache);
-        const imsi = sub.imsi;
+        const imsi = imsiFromSubscriberRecord(sub);
         if (typeof imsi !== "string" || imsi.length === 0) {
           return {
             isError: true,
@@ -1124,8 +1354,8 @@ function registerAllTools(server2, ctx) {
       title: "Delete Subscriber Package",
       description: "Use this to permanently remove a single prepaid package from a subscriber. This is irreversible \u2014 the package record and any unused allowance are deleted. Always call `list_subscriber_packages` first to confirm the correct packageId and snapshot the current state. Use `dry_run=true` on the first call. Params: `iccid` (subscriber identifier), `packageId` (integer from `list_subscriber_packages`). Returns: OCS confirmation of deletion. Do NOT use this to remove ALL packages at once \u2014 use `clean_all_packages` for that (requires separate confirm). Do NOT use this to pause a package \u2014 use `modify_package_status` to deactivate it instead.",
       inputSchema: {
-        iccid: z.string().describe("The subscriber ICCID"),
-        packageId: z.number().describe("The package ID to delete"),
+        iccid: z.string().describe("The subscriber ICCID (for audit logging; OCS itself does not take it \u2014 see below)"),
+        packageId: z.number().describe("The package ID to delete (OCS's sole parameter \u2014 a bare integer)"),
         ...DRY_RUN_FIELD
       },
       annotations: { destructiveHint: true }
@@ -1135,7 +1365,11 @@ function registerAllTools(server2, ctx) {
       "deleteSubscriberPackage",
       TOOL_SCOPES["delete_subscriber_package"],
       ctx,
-      async ({ iccid, packageId }, token2) => ocsCall(ctx.env, token2, "deleteSubscriberPackage", { iccid, packageId })
+      // OCS deleteSubscriberPackage takes a BARE INTEGER package id
+      // (endpoints-full.md 3.8, "Numeric value = package ID") — not an
+      // { iccid, packageId } object. iccid is kept in the tool's input schema
+      // for audit/description purposes only; it is not an OCS parameter.
+      async ({ packageId }, token2) => ocsCall(ctx.env, token2, "deleteSubscriberPackage", packageId)
     )
   );
   server2.registerTool(
@@ -1183,7 +1417,7 @@ function registerAllTools(server2, ctx) {
     "create_package_template",
     {
       title: "Create Package Template",
-      description: "Use this to create a new prepaid package template in the product catalog. Templates define allowances, pricing, location zones, validity, and throttling thresholds that are reused each time the template is assigned to a subscriber. Params: `template` (full template configuration as a JSON string \u2014 fields include `name`, `dataLimit` in bytes, `price`, `validityDays`, `locationZoneId`, `recurring`, `throttlingActive`). Returns: created template record with the new `templateId`. Do NOT use this to modify an existing template \u2014 use `modify_template_core`. After creation, call `list_package_templates` to confirm the template is visible.",
+      description: 'Use this to create a new prepaid package template in the product catalog. Templates define allowances, pricing, location zones, validity, and throttling thresholds that are reused each time the template is assigned to a subscriber. Params: `template` (full template configuration as a JSON string \u2014 fields include `name`, `dataLimit` in bytes, `price`, `validityDays`, `locationZoneId`, `recurring`, `throttlingActive`). NEVER express an unlimited plan as a zero data allowance: OCS reads 0 as a literal zero, and because `throttlingThreshold1Perc` is a percentage OF THE BUNDLE, a zero bundle leaves the throttle trigger uncomputable and every storefront renders "0 MB". Describe the plan as it is sold and the OCS fields are derived for you: `unlimited: true`, `throttleAfterMb` (the full-speed window, e.g. 500 for "500 MB/day"), `throttleKbps` (the speed AFTER that window) and `perioddays` (1 for a daily bucket). The bundle ceiling is sized so the window is a whole trigger percentage and the bundle cannot be drained even at the throttled rate for the whole period, because a plan sold as unlimited must not run out. `throttleKbps` is a SPEED and must be an OCS bitrate (128, 256, 384, 512, 1024, 3072, 5120, 7680, 10240, 20480, 51200, 102400); passing megabytes here is rejected. Returns: created template record with the new `templateId`. Do NOT use this to modify an existing template \u2014 use `modify_template_core`. After creation, call `list_package_templates` to confirm the template is visible.',
       inputSchema: {
         template: z.string().describe("Full template configuration as JSON string"),
         ...DRY_RUN_FIELD
@@ -1199,7 +1433,7 @@ function registerAllTools(server2, ctx) {
         ctx.env,
         token2,
         "createPrepaidPackageTemplate",
-        JSON.parse(template)
+        normalizePackageTemplate(JSON.parse(template))
       )
     )
   );
@@ -1222,7 +1456,7 @@ function registerAllTools(server2, ctx) {
       ctx,
       async ({ templateId, changes }, token2) => ocsCall(ctx.env, token2, "modifyPPTCore", {
         templateId,
-        ...JSON.parse(changes)
+        ...normalizePackageTemplateChanges(JSON.parse(changes))
       })
     )
   );
@@ -1276,9 +1510,9 @@ function registerAllTools(server2, ctx) {
     "list_location_zones",
     {
       title: "List Location Zone Elements",
-      description: "Use this to list countries and networks within a specific location zone. WARNING: this method has a known Jackson deserialization bug in the upstream OCS API that may return malformed responses. Prefer `list_detailed_location_zones` for reliable results. Params: `locationZoneId` (integer, optional \u2014 filter to a specific zone). Returns: array of zone element records with country and operator entries. Do NOT use this for reliable zone data \u2014 use `list_detailed_location_zones` instead. Do NOT use this to create zones \u2014 use `create_location_zone`.",
+      description: "Use this to list countries and networks within a specific location zone. WARNING: this method has a known Jackson deserialization bug in the upstream OCS API that may return malformed responses. Prefer `list_detailed_location_zones` for reliable results. Params: `locationZoneId` (integer, REQUIRED \u2014 OCS takes a bare zone id, not an object; there is no unfiltered call). Returns: array of zone element records with country and operator entries. Do NOT use this for reliable zone data \u2014 use `list_detailed_location_zones` instead. Do NOT use this to create zones \u2014 use `create_location_zone`.",
       inputSchema: {
-        locationZoneId: z.number().optional().describe("Filter by zone ID")
+        locationZoneId: z.number().describe("Zone ID (required \u2014 OCS has no unfiltered call for this method)")
       },
       annotations: { readOnlyHint: true }
     },
@@ -1288,9 +1522,7 @@ function registerAllTools(server2, ctx) {
       TOOL_SCOPES["list_location_zones"],
       ctx,
       async ({ locationZoneId }, token2) => {
-        const params = {};
-        if (locationZoneId !== void 0) params.locationZoneId = locationZoneId;
-        return ocsCall(ctx.env, token2, "listLocationZoneElement", params);
+        return ocsCall(ctx.env, token2, "listLocationZoneElement", locationZoneId);
       }
     )
   );
@@ -1298,9 +1530,12 @@ function registerAllTools(server2, ctx) {
     "list_detailed_location_zones",
     {
       title: "List Detailed Location Zones",
-      description: "Use this as the preferred way to list location zones with full detail: included countries, operator networks, zone IDs, and names. This is the working alternative to `list_location_zones` which has a known upstream deserialization bug. Use `locationZoneId` values from this response when creating or editing package templates. Params: `resellerId` (integer, optional \u2014 omit to use the token owner's reseller). Returns: array of zone objects each containing `locationZoneId`, `name`, `countries`, and `operators`. Do NOT use `list_location_zones` when you need reliable data \u2014 always use this tool instead.",
+      description: `Use this as the preferred way to list location zones with full detail: included countries, operator networks, zone IDs, and names. This is the working alternative to \`list_location_zones\` which has a known upstream deserialization bug. Use \`locationZoneId\` values from this response when creating or editing package templates. Params: \`resellerId\` (integer, optional \u2014 omit to use the token owner's reseller); \`verbose\` (optional boolean, default false \u2014 returns the full untouched zone shape with a smaller operator-entry budget). Returns BY DEFAULT a projected result: \`totalZones\`, \`returnedZones\`, \`totalOperators\`, \`returnedOperators\`, \`truncated\`, a \`fields\` legend, and \`zones[]\` each with \`zoneId\`, \`zoneName\`, \`operatorCount\` and short-keyed \`operators[]\` (\`net\`, \`iso\`, \`op\`). Per-operator mccMncs, tadigs, continent, countryCode, countryName, utcOffset and the repeated reseller object are dropped unless \`verbose\` is true. Operator entries are capped at ${ZONES_MAX_OPERATORS} so the result fits the MCP transport (issue #663); when the cap bites, \`truncated\` is true and \`note\` says so \u2014 never silently. Do NOT use \`list_location_zones\` when you need reliable data \u2014 always use this tool instead.`,
       inputSchema: {
-        resellerId: z.number().optional().describe("Reseller ID (omit to use token owner's reseller)")
+        resellerId: z.number().optional().describe("Reseller ID (omit to use token owner's reseller)"),
+        verbose: z.boolean().optional().describe(
+          "Return the full untouched OCS zone shape instead of the projected zones (smaller operator budget)"
+        )
       },
       annotations: { readOnlyHint: true }
     },
@@ -1309,9 +1544,16 @@ function registerAllTools(server2, ctx) {
       "listDetailedLocationZone",
       TOOL_SCOPES["list_detailed_location_zones"],
       ctx,
-      async ({ resellerId }, token2) => {
+      async ({ resellerId, verbose }, token2) => {
         const id = resellerId ?? await getDefaultResellerId(ctx.env, token2);
-        return ocsCall(ctx.env, token2, "listDetailedLocationZone", id);
+        const raw = await new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2).call(
+          "listDetailedLocationZone",
+          id
+        );
+        const bounded = boundZonesResult(raw, { resellerId: id, verbose });
+        return {
+          content: [{ type: "text", text: JSON.stringify(bounded) }]
+        };
       }
     )
   );
@@ -1319,9 +1561,9 @@ function registerAllTools(server2, ctx) {
     "list_destination_prefixes",
     {
       title: "List Destination List Prefixes",
-      description: "Use this to list the phone number prefixes (country dialling codes) within a specific named destination list. Destination lists control which countries a subscriber may call on voice/SMS packages. You must already know the `destinationListId` to use this tool. Params: `destinationListId` (integer, optional \u2014 omit to list all known prefixes). Returns: array of prefix records with country code and E.164 prefix. Do NOT use this to discover the destination list catalog \u2014 use `list_destination_lists` for that. For data-only eSIM products without MOC voice, destination lists are irrelevant.",
+      description: "Use this to list the phone number prefixes (country dialling codes) within a specific named destination list. Destination lists control which countries a subscriber may call on voice/SMS packages. You must already know the `destinationListId` to use this tool. Params: `destinationListId` (integer, REQUIRED \u2014 OCS takes a bare list id, not an object; there is no unfiltered call). Returns: array of prefix records with country code and E.164 prefix. Do NOT use this to discover the destination list catalog \u2014 use `list_destination_lists` for that. For data-only eSIM products without MOC voice, destination lists are irrelevant.",
       inputSchema: {
-        destinationListId: z.number().optional().describe("Filter by destination list ID")
+        destinationListId: z.number().describe("Destination list ID (required \u2014 OCS has no unfiltered call for this method)")
       },
       annotations: { readOnlyHint: true }
     },
@@ -1331,10 +1573,7 @@ function registerAllTools(server2, ctx) {
       TOOL_SCOPES["list_destination_prefixes"],
       ctx,
       async ({ destinationListId }, token2) => {
-        const params = {};
-        if (destinationListId !== void 0)
-          params.destinationListId = destinationListId;
-        return ocsCall(ctx.env, token2, "listDestinationListPrefix", params);
+        return ocsCall(ctx.env, token2, "listDestinationListPrefix", destinationListId);
       }
     )
   );
@@ -1424,9 +1663,18 @@ function registerAllTools(server2, ctx) {
     "get_tariff",
     {
       title: "Get Customer Tariff",
-      description: "Use this to retrieve the complete tariff table for a reseller: per-country, per-traffic-type (data/voice/SMS) wholesale rates. Useful for cost analysis, margin calculations, and identifying expensive roaming countries before steering decisions. Params: `resellerId` (integer, optional \u2014 omit to use the token owner's reseller). Returns: array of tariff rules, each with `country`, `trafficType`, `rate`, and `currency`. Response key in OCS is `listTariffRule`. Do NOT use this to assign a pricing plan to a subscriber \u2014 use `modify_subscriber_mobile_plan`. This shows the RESELLER's wholesale cost, not what end-users are charged.",
+      description: `Use this to retrieve the tariff table for a reseller: per-country, per-operator wholesale data/voice/SMS rates. Useful for cost analysis, margin calculations, and identifying expensive roaming countries before steering decisions. Params: \`resellerId\` (integer, optional \u2014 omit to use the token owner's reseller); \`country\` (optional, ISO-3166 alpha-2 such as "nl" OR a full country name such as "Netherlands", case-insensitive); \`trafficType\` (optional, "data" | "voice" | "sms" \u2014 keeps only rules whose corresponding rate is greater than zero); \`verbose\` (optional boolean, default false \u2014 returns the full untouched OCS rule shape, capped at ${TARIFF_VERBOSE_MAX_RULES} rows, so combine it with the filters). Returns BY DEFAULT a projected result: \`totalRules\`, \`matchedRules\`, \`returnedRules\`, \`truncated\`, a hoisted \`currency\`, a \`fields\` legend and \`rules[]\` of short-keyed rows (\`iso\`, \`op\`, \`data\`, \`moCall\`, \`mtCall\`, \`moSms\`, \`mtSms\`, \`active\`). Zero rates and inactive flags are omitted per row. Nested operator detail (mccMncs, tadigs, continent, countryCode, utcOffset), the sponsor object, plan ids and the validity/discount flags are dropped unless \`verbose\` is true. Rows are capped at ${TARIFF_MAX_RULES}; when the cap bites, \`truncated\` is true and \`note\` says so explicitly and names the filter params \u2014 the result is never silently shortened. Filtering happens server-side on the complete OCS table, so a filtered call sees every matching rule. Response key in OCS is \`listTariffRule\`. Do NOT use this to assign a pricing plan to a subscriber \u2014 use \`modify_subscriber_mobile_plan\`. This shows the RESELLER's wholesale cost, not what end-users are charged.`,
       inputSchema: {
-        resellerId: z.number().optional().describe("Reseller ID (omit to use token owner's reseller)")
+        resellerId: z.number().optional().describe("Reseller ID (omit to use token owner's reseller)"),
+        country: z.string().optional().describe(
+          'Filter by country \u2014 ISO-3166 alpha-2 ("nl") or full name ("Netherlands"), case-insensitive'
+        ),
+        trafficType: z.enum(["data", "voice", "sms"]).optional().describe(
+          'Filter to rules whose rate for this traffic type is greater than zero ("data" | "voice" | "sms")'
+        ),
+        verbose: z.boolean().optional().describe(
+          `Return the full untouched OCS rule shape instead of the projected rows (capped at ${TARIFF_VERBOSE_MAX_RULES} rows)`
+        )
       },
       annotations: { readOnlyHint: true }
     },
@@ -1435,9 +1683,21 @@ function registerAllTools(server2, ctx) {
       "getCustomerTariff",
       TOOL_SCOPES["get_tariff"],
       ctx,
-      async ({ resellerId }, token2) => {
+      async ({ resellerId, country, trafficType, verbose }, token2) => {
         const id = resellerId ?? await getDefaultResellerId(ctx.env, token2);
-        return ocsCall(ctx.env, token2, "getCustomerTariff", id);
+        const raw = await new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2).call(
+          "getCustomerTariff",
+          id
+        );
+        const bounded = boundTariffResult(raw, {
+          resellerId: id,
+          country,
+          trafficType,
+          verbose
+        });
+        return {
+          content: [{ type: "text", text: JSON.stringify(bounded) }]
+        };
       }
     )
   );
@@ -1463,7 +1723,7 @@ function registerAllTools(server2, ctx) {
       async ({ iccid, msisdn, message, sender }, token2) => {
         const cache = /* @__PURE__ */ new Map();
         const sub = await resolveSubscriberByIccid(ctx.env, token2, iccid, cache);
-        const imsi = sub.imsi;
+        const imsi = imsiFromSubscriberRecord(sub);
         if (typeof imsi !== "string" || imsi.length === 0) {
           return {
             isError: true,
@@ -3042,8 +3302,8 @@ async function safeCall(env, token2, method, params = {}) {
     const client = new OcsClient(env.CARRIER_OCS_BASE_URL, token2);
     const data = await client.call(method, params);
     return { data, error: null };
-  } catch (err6) {
-    return { data: null, error: err6 instanceof Error ? err6.message : String(err6) };
+  } catch (err7) {
+    return { data: null, error: err7 instanceof Error ? err7.message : String(err7) };
   }
 }
 async function fetchActiveSubscribers(env, token2, accountId, resellerId) {
@@ -4925,10 +5185,10 @@ async function callBedrock(env, payload) {
     const body = await resp.text();
     if (resp.status === 429) {
       const retryAfter = resp.headers.get("retry-after");
-      const err6 = new Error(`Bedrock rate limit: ${body}`);
-      err6.isRateLimit = true;
-      err6.retryAfter = retryAfter;
-      throw err6;
+      const err7 = new Error(`Bedrock rate limit: ${body}`);
+      err7.isRateLimit = true;
+      err7.retryAfter = retryAfter;
+      throw err7;
     }
     throw new Error(`Bedrock invoke failed: ${resp.status} ${body}`);
   }
@@ -4966,9 +5226,9 @@ Pre-resolved context: ${JSON.stringify(definedContext)}` : "";
       AWS_REGION: env.AWS_REGION,
       BEDROCK_MODEL_ID: env.BEDROCK_MODEL_ID
     }, payload);
-  } catch (err6) {
-    if (err6 instanceof Error && err6.isRateLimit) {
-      const retryAfter = err6.retryAfter;
+  } catch (err7) {
+    if (err7 instanceof Error && err7.isRateLimit) {
+      const retryAfter = err7.retryAfter;
       const parsedSeconds = retryAfter ? parseInt(retryAfter, 10) : 60;
       return {
         match: "rate_limited",
@@ -4976,7 +5236,7 @@ Pre-resolved context: ${JSON.stringify(definedContext)}` : "";
         suggestion: "Bedrock rate limit reached. Please retry after the indicated delay."
       };
     }
-    throw err6;
+    throw err7;
   }
   const toolUseBlock = response.content.find(
     (block) => block.type === "tool_use"
@@ -5150,7 +5410,7 @@ function registerAllCarrierAskTools(server2, ctx) {
         let route;
         try {
           route = await _routeIntent(intent, context, ctx.env);
-        } catch (err6) {
+        } catch (err7) {
           writeCarrierAskAudit(ctx.env, {
             intent_hash: intentHash,
             match: "error",
@@ -5167,7 +5427,7 @@ function registerAllCarrierAskTools(server2, ctx) {
                 type: "text",
                 text: JSON.stringify({
                   error: "routing_error",
-                  message: err6 instanceof Error ? err6.message : "An unexpected error occurred during routing."
+                  message: err7 instanceof Error ? err7.message : "An unexpected error occurred during routing."
                 })
               }
             ],
@@ -5419,8 +5679,8 @@ function registerListRecentOcsEventsTool(server2, env) {
         return {
           content: [{ type: "text", text: JSON.stringify(result2, null, 2) }]
         };
-      } catch (err6) {
-        const message = err6 instanceof Error ? err6.message : String(err6);
+      } catch (err7) {
+        const message = err7 instanceof Error ? err7.message : String(err7);
         return {
           isError: true,
           content: [{ type: "text", text: `Error reading OCS event buffer: ${message}` }]
@@ -5700,47 +5960,100 @@ import {
   registerAppResource,
   RESOURCE_MIME_TYPE
 } from "@modelcontextprotocol/ext-apps/server";
-async function safeCallWithToken(client, _token, method, params = {}) {
+
+// src/apps/fleet-data.ts
+function extractAccounts(json) {
+  const raw = json;
+  if (Array.isArray(raw)) return raw;
+  return (raw?.reseller ?? []).flatMap((r) => r.account ?? []);
+}
+function toFleetInput(raw) {
+  const counts = extractEsimStatusCounts(raw.status);
+  const accountRecords = extractAccounts(raw.accounts);
+  const accounts = accountRecords.map((a) => ({
+    name: String(a.name ?? a.accountId ?? "?"),
+    balance: Number(a.balance ?? 0),
+    // Per-account status breakdown is not in listResellerAccount; the fleet
+    // totals come from the status call. Showing 0 here would read as "this
+    // account has no eSIMs", so the per-account columns stay at the balance
+    // and flags this call actually carries.
+    active: 0,
+    suspended: 0,
+    inventory: 0,
+    other: 0,
+    packageOnly: Boolean(a.packageOnly)
+  }));
+  const unavailable = [];
+  if (raw.statusError) unavailable.push(`esimStatusPerAccount: ${raw.statusError}`);
+  if (raw.accountsError) unavailable.push(`listResellerAccount: ${raw.accountsError}`);
+  return {
+    active: counts.active,
+    suspended: counts.suspended,
+    inventory: counts.inventory,
+    other: counts.other,
+    accounts,
+    unavailable: unavailable.length ? unavailable : void 0
+  };
+}
+
+// src/apps/fleet-health-app.ts
+var FLEET_APP_RESOURCE_URI = "ui://fleet-health-dashboard";
+async function safeCall2(client, method, params) {
   try {
     return { data: await client.call(method, params), error: null };
-  } catch (err6) {
-    return {
-      data: null,
-      error: err6 instanceof Error ? err6.message : String(err6)
-    };
+  } catch (err7) {
+    return { data: null, error: err7 instanceof Error ? err7.message : String(err7) };
   }
 }
+async function loadFleet(ctx, accountId) {
+  const token2 = await ctx.getUserToken(ctx.props.sub);
+  const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+  const resellerId = await getDefaultResellerId(ctx.env, token2).catch(() => void 0);
+  const statusParams = accountId !== void 0 ? { accountId } : resellerId !== void 0 ? { resellerId } : {};
+  const accountParams = resellerId !== void 0 ? { resellerId } : {};
+  const [status, accounts] = await Promise.all([
+    safeCall2(client, "esimStatusPerAccount", statusParams),
+    safeCall2(client, "listResellerAccount", accountParams)
+  ]);
+  return toFleetInput({
+    status: status.data,
+    accounts: accounts.data,
+    statusError: status.error,
+    accountsError: accounts.error
+  });
+}
 function registerFleetHealthApp(server2, ctx) {
   registerAppResource(
     server2,
     "Fleet Health Dashboard",
-    "ui://fleet-health-dashboard",
+    FLEET_APP_RESOURCE_URI,
     {
-      description: "Interactive Fleet Health Dashboard \u2014 eSIM status charts, account breakdown, low-balance alerts."
+      description: "Fleet overview panel \u2014 eSIM status, per-account breakdown and low-balance alerts."
     },
     async () => {
       let html;
       try {
-        const resp = await ctx.env.ASSETS.fetch(
-          new Request("https://internal/views/fleet-health/index.html")
-        );
-        html = await resp.text();
-      } catch {
-        html = "<html><body><p>Dashboard unavailable.</p></body></html>";
+        html = renderHtml(fleetScreen(await loadFleet(ctx)));
+      } catch (err7) {
+        html = renderHtml({
+          id: "fleet-health",
+          title: "Fleet health",
+          sections: [
+            {
+              kind: "note",
+              tone: "critical",
+              text: `Could not load fleet data: ${err7 instanceof Error ? err7.message : String(err7)}`
+            }
+          ]
+        });
       }
       return {
         contents: [
           {
-            uri: "ui://fleet-health-dashboard",
+            uri: FLEET_APP_RESOURCE_URI,
             mimeType: RESOURCE_MIME_TYPE,
-            text: html,
-            _meta: {
-              ui: {
-                csp: {
-                  resourceDomains: ["https://cdn.jsdelivr.net"]
-                }
-              }
-            }
+            text: html
+            // Self-contained: no external origins, so no CSP exceptions.
           }
         ]
       };
@@ -5751,100 +6064,45 @@ function registerFleetHealthApp(server2, ctx) {
     "fleet_health_app",
     {
       title: "Fleet Health Dashboard",
-      description: "Renders an interactive Fleet Health Dashboard with eSIM status charts, top-10 account breakdown, and low-balance alerts. Returns structuredContent for the chart panel.",
+      description: "Draw the fleet overview as an interactive panel: eSIM status, per-account breakdown and low-balance alerts. Returns structuredContent for the panel, so it only helps a client that can render MCP UI resources. Do NOT use this when the answer has to be readable text, or in any headless or scripted context \u2014 `fleet_health` returns the same data as prose.",
       inputSchema: {
         accountId: z9.number().optional().describe("Filter to a specific account (omit for all)")
       },
       annotations: { readOnlyHint: true },
       _meta: {
         ui: {
-          resourceUri: "ui://fleet-health-dashboard",
+          resourceUri: FLEET_APP_RESOURCE_URI,
           visibility: ["model", "app"]
         }
       }
     },
     async ({ accountId }) => {
-      const token2 = await ctx.getUserToken(ctx.props.sub);
-      const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
-      const [statusResult, accountsResult] = await Promise.all([
-        safeCallWithToken(
-          client,
-          token2,
-          "esimStatusPerAccount",
-          accountId !== void 0 ? { accountId } : {}
-        ),
-        safeCallWithToken(
-          client,
-          token2,
-          "listResellerAccount",
-          {}
-        )
-      ]);
-      let totalActive = 0;
-      let totalSuspended = 0;
-      let totalInventory = 0;
-      let totalOther = 0;
-      const accountList = [];
-      if (statusResult.data && Array.isArray(statusResult.data)) {
-        for (const account of statusResult.data) {
-          const active = Number(account["active"] ?? 0);
-          const suspended = Number(account["suspended"] ?? 0);
-          const inventory = Number(
-            account["inventory"] ?? account["notActivated"] ?? 0
-          );
-          const other = Number(
-            account["other"] ?? account["terminated"] ?? 0
-          );
-          totalActive += active;
-          totalSuspended += suspended;
-          totalInventory += inventory;
-          totalOther += other;
-          accountList.push({
-            name: String(account["name"] ?? account["accountId"] ?? "?"),
-            balance: 0,
-            active,
-            suspended,
-            inventory,
-            other
-          });
-        }
-      }
-      if (accountsResult.data && Array.isArray(accountsResult.data)) {
-        for (const a of accountsResult.data) {
-          const aName = String(a["name"] ?? a["accountId"] ?? "?");
-          const entry = accountList.find((e) => e.name === aName);
-          if (entry) {
-            entry.balance = Number(a["balance"] ?? 0);
+      const input = await loadFleet(ctx, accountId);
+      const screen = fleetScreen(input);
+      const total = input.active + input.suspended + input.inventory + input.other;
+      const lowBalanceCount = input.accounts.filter((a) => a.balance < 10).length;
+      return {
+        content: [
+          {
+            type: "text",
+            text: total === 0 && input.accounts.length === 0 ? "Fleet view returned no eSIMs and no accounts \u2014 check the account scope and credentials." : `${total} eSIMs across ${input.accounts.length} account(s); ${input.active} active. Fleet Utilization: ${total > 0 ? (input.active / total * 100).toFixed(1) : "0"}%`
           }
+        ],
+        structuredContent: {
+          // `screen` is the shared model — the panel and `carrier dash` both
+          // render this exact object, so the two cannot disagree.
+          screen,
+          // Flat fields are the original published contract. Kept so anything
+          // already reading them keeps working; the fix was the data, not the shape.
+          utilization: total > 0 ? Math.round(input.active / total * 1e3) / 10 : 0,
+          totalActive: input.active,
+          totalSuspended: input.suspended,
+          totalInventory: input.inventory,
+          totalOther: input.other,
+          totalAccounts: input.accounts.length,
+          lowBalanceCount,
+          accountList: input.accounts
         }
-      }
-      const total = totalActive + totalSuspended + totalInventory + totalOther;
-      const utilization = total > 0 ? Math.round(totalActive / total * 1e3) / 10 : 0;
-      const totalAccounts = accountsResult.data && Array.isArray(accountsResult.data) ? accountsResult.data.length : accountList.length;
-      const lowBalanceCount = accountsResult.data && Array.isArray(accountsResult.data) ? accountsResult.data.filter((a) => Number(a["balance"] ?? 0) < 10).length : 0;
-      const sortedAccounts = [...accountList].sort(
-        (a, b) => b.active + b.suspended + b.inventory + b.other - (a.active + a.suspended + a.inventory + a.other)
-      ).slice(0, 10);
-      const errors = [statusResult.error, accountsResult.error].filter(Boolean).join("; ");
-      const summaryLines = [
-        `Fleet Utilization: ${utilization}%`,
-        `Active: ${totalActive} | Suspended: ${totalSuspended} | Inventory: ${totalInventory} | Other: ${totalOther}`,
-        `Total Accounts: ${totalAccounts} | Low Balance (<10): ${lowBalanceCount}`,
-        ...errors ? [`Errors: ${errors}`] : []
-      ];
-      const structuredContent = {
-        utilization,
-        totalActive,
-        totalSuspended,
-        totalInventory,
-        totalOther,
-        totalAccounts,
-        lowBalanceCount,
-        accountList: sortedAccounts
-      };
-      return {
-        content: [{ type: "text", text: summaryLines.join("\n") }],
-        structuredContent
       };
     }
   );
@@ -5901,13 +6159,13 @@ async function deleteWizardSession(env, sub, wizardId) {
 }
 
 // src/apps/provisioning-wizard.ts
-async function safeCallWithToken2(client, _token, method, params = {}) {
+async function safeCallWithToken(client, _token, method, params = {}) {
   try {
     return { data: await client.call(method, params), error: null };
-  } catch (err6) {
+  } catch (err7) {
     return {
       data: null,
-      error: err6 instanceof Error ? err6.message : String(err6)
+      error: err7 instanceof Error ? err7.message : String(err7)
     };
   }
 }
@@ -5973,7 +6231,7 @@ function registerProvisioningWizard(server2, ctx) {
       const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
       if (step === "init") {
         const newWizardId = generateWizardId();
-        const subscribersResult = await safeCallWithToken2(
+        const subscribersResult = await safeCallWithToken(
           client,
           token2,
           "listResellerAccount",
@@ -6051,7 +6309,7 @@ function registerProvisioningWizard(server2, ctx) {
           };
         }
         const resellerIdForTemplates = await getDefaultResellerId(ctx.env, token2);
-        const packagesResult = await safeCallWithToken2(
+        const packagesResult = await safeCallWithToken(
           client,
           token2,
           "listPrepaidPackageTemplate",
@@ -6118,7 +6376,7 @@ function registerProvisioningWizard(server2, ctx) {
             isError: true
           };
         }
-        const previewResult = await safeCallWithToken2(
+        const previewResult = await safeCallWithToken(
           client,
           token2,
           "listPrepaidPackageTemplate",
@@ -6190,7 +6448,7 @@ function registerProvisioningWizard(server2, ctx) {
             isError: true
           };
         }
-        const subRecord = await safeCallWithToken2(
+        const subRecord = await safeCallWithToken(
           client,
           token2,
           "getSingleSubscriber",
@@ -6219,7 +6477,7 @@ function registerProvisioningWizard(server2, ctx) {
             isError: true
           };
         }
-        const result2 = await safeCallWithToken2(
+        const result2 = await safeCallWithToken(
           client,
           token2,
           "affectPackageToSubscriber",
@@ -6264,13 +6522,13 @@ import {
   registerAppResource as registerAppResource3,
   RESOURCE_MIME_TYPE as RESOURCE_MIME_TYPE3
 } from "@modelcontextprotocol/ext-apps/server";
-async function safeCallWithToken3(client, _token, method, params = {}) {
+async function safeCallWithToken2(client, _token, method, params = {}) {
   try {
     return { data: await client.call(method, params), error: null };
-  } catch (err6) {
+  } catch (err7) {
     return {
       data: null,
-      error: err6 instanceof Error ? err6.message : String(err6)
+      error: err7 instanceof Error ? err7.message : String(err7)
     };
   }
 }
@@ -6332,7 +6590,7 @@ function registerBalanceTopupApp(server2, ctx) {
         const token2 = await ctx.getUserToken(ctx.props.sub);
         const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
         if (preview === true) {
-          const result2 = await safeCallWithToken3(
+          const result2 = await safeCallWithToken2(
             client,
             token2,
             "getSingleSubscriber",
@@ -6357,7 +6615,7 @@ function registerBalanceTopupApp(server2, ctx) {
             structuredContent: structured2
           };
         }
-        const execResult = await safeCallWithToken3(
+        const execResult = await safeCallWithToken2(
           client,
           token2,
           // CAR-78: subscriber top-up uses modifySubscriberBalance with { subscriber, amount }
@@ -7931,8 +8189,8 @@ function buildPricingHandler(tool, ctx) {
           }
         ]
       };
-    } catch (err6) {
-      const message = err6 instanceof Error ? err6.message : String(err6);
+    } catch (err7) {
+      const message = err7 instanceof Error ? err7.message : String(err7);
       ctx.audit({
         tool_name: tool.name,
         ocs_method: "billing",
@@ -8252,8 +8510,8 @@ function writeUsageThresholdAudit(env, severity, remainingCredits, month, taskCo
       doubles: [remainingCredits],
       indexes: ["manus_usage"]
     });
-  } catch (err6) {
-    console.error(`[manus-usage] threshold audit write failed: ${err6.message}`);
+  } catch (err7) {
+    console.error(`[manus-usage] threshold audit write failed: ${err7.message}`);
   }
 }
 
@@ -8363,7 +8621,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err6) {
+      } catch (err7) {
         ctx.audit({
           tool_name: "ui_agent_schedule_create",
           ocs_method: "[manus:schedule.create]",
@@ -8372,7 +8630,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           duration_ms: Date.now() - start,
           event_type: "ui_agent_dispatch"
         });
-        const msg = err6 instanceof ManusScheduleError ? `Manus API error (HTTP ${err6.statusCode}): ${err6.message}` : err6 instanceof Error ? err6.message : String(err6);
+        const msg = err7 instanceof ManusScheduleError ? `Manus API error (HTTP ${err7.statusCode}): ${err7.message}` : err7 instanceof Error ? err7.message : String(err7);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -8430,7 +8688,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err6) {
+      } catch (err7) {
         ctx.audit({
           tool_name: "ui_agent_schedule_list",
           ocs_method: "[manus:schedule.list]",
@@ -8438,7 +8696,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           dry_run: false,
           duration_ms: Date.now() - start
         });
-        const msg = err6 instanceof ManusScheduleError ? `Manus API error (HTTP ${err6.statusCode}): ${err6.message}` : err6 instanceof Error ? err6.message : String(err6);
+        const msg = err7 instanceof ManusScheduleError ? `Manus API error (HTTP ${err7.statusCode}): ${err7.message}` : err7 instanceof Error ? err7.message : String(err7);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -8499,7 +8757,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err6) {
+      } catch (err7) {
         ctx.audit({
           tool_name: "ui_agent_schedule_delete",
           ocs_method: "[manus:schedule.delete]",
@@ -8508,7 +8766,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           duration_ms: Date.now() - start,
           event_type: "ui_agent_dispatch"
         });
-        const msg = err6 instanceof ManusScheduleError ? `Manus API error (HTTP ${err6.statusCode}): ${err6.message}` : err6 instanceof Error ? err6.message : String(err6);
+        const msg = err7 instanceof ManusScheduleError ? `Manus API error (HTTP ${err7.statusCode}): ${err7.message}` : err7 instanceof Error ? err7.message : String(err7);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -8569,7 +8827,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err6) {
+      } catch (err7) {
         ctx.audit({
           tool_name: "ui_agent_schedule_pause",
           ocs_method: "[manus:schedule.pause]",
@@ -8578,7 +8836,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           duration_ms: Date.now() - start,
           event_type: "ui_agent_dispatch"
         });
-        const msg = err6 instanceof ManusScheduleError ? `Manus API error (HTTP ${err6.statusCode}): ${err6.message}` : err6 instanceof Error ? err6.message : String(err6);
+        const msg = err7 instanceof ManusScheduleError ? `Manus API error (HTTP ${err7.statusCode}): ${err7.message}` : err7 instanceof Error ? err7.message : String(err7);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -8639,7 +8897,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err6) {
+      } catch (err7) {
         ctx.audit({
           tool_name: "ui_agent_schedule_resume",
           ocs_method: "[manus:schedule.resume]",
@@ -8648,7 +8906,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           duration_ms: Date.now() - start,
           event_type: "ui_agent_dispatch"
         });
-        const msg = err6 instanceof ManusScheduleError ? `Manus API error (HTTP ${err6.statusCode}): ${err6.message}` : err6 instanceof Error ? err6.message : String(err6);
+        const msg = err7 instanceof ManusScheduleError ? `Manus API error (HTTP ${err7.statusCode}): ${err7.message}` : err7 instanceof Error ? err7.message : String(err7);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -8693,7 +8951,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
             }
           ]
         };
-      } catch (err6) {
+      } catch (err7) {
         ctx.audit({
           tool_name: "ui_agent_usage",
           ocs_method: "[manus:usage.get]",
@@ -8701,7 +8959,7 @@ function registerScheduleAndUsageTools(server2, ctx) {
           dry_run: false,
           duration_ms: Date.now() - start
         });
-        const msg = err6 instanceof Error ? err6.message : String(err6);
+        const msg = err7 instanceof Error ? err7.message : String(err7);
         return { isError: true, content: [{ type: "text", text: msg }] };
       }
     }
@@ -8944,7 +9202,7 @@ Report success or failure with a clear summary.`;
           }
         ]
       };
-    } catch (err6) {
+    } catch (err7) {
       ctx.audit({
         tool_name: toolName,
         ocs_method: `[ui-agent:${gapId}]`,
@@ -8958,7 +9216,7 @@ Report success or failure with a clear summary.`;
         content: [
           {
             type: "text",
-            text: `Error dispatching UI agent: ${err6 instanceof Error ? err6.message : String(err6)}`
+            text: `Error dispatching UI agent: ${err7 instanceof Error ? err7.message : String(err7)}`
           }
         ]
       };
@@ -9382,7 +9640,7 @@ function registerUiAgentAskTools(server2, ctx) {
       try {
         const replyOutcome = await askReply(keys, task_id, reply);
         result2 = replyOutcome.data;
-      } catch (err6) {
+      } catch (err7) {
         ctx.audit({
           tool_name: "ui_agent_reply",
           ocs_method: "[ui-agent:ask-reply]",
@@ -9397,7 +9655,7 @@ function registerUiAgentAskTools(server2, ctx) {
           content: [
             {
               type: "text",
-              text: `Error calling Manus task.reply: ${err6 instanceof Error ? err6.message : String(err6)}`
+              text: `Error calling Manus task.reply: ${err7 instanceof Error ? err7.message : String(err7)}`
             }
           ]
         };
@@ -9475,13 +9733,13 @@ function registerUiAgentAskTools(server2, ctx) {
       try {
         const listing = await ctx.env.CARRIER_USERS.list({ prefix: PENDING_ASK_PREFIX });
         keys = listing.keys;
-      } catch (err6) {
+      } catch (err7) {
         return {
           isError: true,
           content: [
             {
               type: "text",
-              text: `Error listing pending tasks: ${err6 instanceof Error ? err6.message : String(err6)}`
+              text: `Error listing pending tasks: ${err7 instanceof Error ? err7.message : String(err7)}`
             }
           ]
         };
@@ -10935,6 +11193,138 @@ function registerStorefrontLogoTools(server2, env = {}) {
   );
 }
 
+// src/tools-storefront-deploy.ts
+import { z as z22 } from "zod";
+var ok6 = (value) => ({
+  content: [{ type: "text", text: JSON.stringify(value) }]
+});
+var err6 = (text) => ({ isError: true, content: [{ type: "text", text }] });
+function registerStorefrontDeployTools(server2) {
+  server2.tool(
+    "list_deploy_targets",
+    "Report which storefront deploy hosts (Cloudflare, Vercel, Netlify, Fly) are installed, logged in, and ready on this machine, and which one a deploy would pick.",
+    {
+      dir: z22.string().min(1).describe("Path to the scaffolded storefront directory")
+    },
+    async ({ dir }) => {
+      try {
+        const statuses = await probeAll(dir);
+        const ranked = rankTargets(statuses);
+        return ok6({
+          targets: statuses,
+          default: ranked[0]?.id ?? null,
+          reason: ranked.length ? void 0 : "No host is installed and logged in."
+        });
+      } catch (e) {
+        return err6(e instanceof Error ? e.message : "target probe failed");
+      }
+    }
+  );
+  server2.tool(
+    "deploy_storefront",
+    "Build and deploy a scaffolded storefront to whichever host is available on this machine, then push its runtime secrets (CARRIER_API_KEY, CLERK_SECRET_KEY) to that host.",
+    {
+      dir: z22.string().min(1).describe("Path to the scaffolded storefront directory"),
+      target: z22.enum(TARGET_IDS).optional().describe("Force a host instead of auto-detecting"),
+      name: z22.string().optional().describe("Project/worker name (defaults from brand)"),
+      skip_build: z22.boolean().optional().describe("Deploy the existing build without rebuilding"),
+      push_secrets: z22.boolean().optional().describe("Stage runtime secrets on the host before deploy (default true)"),
+      verify: z22.boolean().optional().describe("Probe the deployed URL and report whether it actually serves (default true)"),
+      domain: z22.boolean().optional().describe("Route the brand domain to the deployment (Cloudflare provisions DNS + cert)")
+    },
+    async ({ dir, target, name, skip_build, push_secrets, verify, domain }) => {
+      try {
+        if (target && !isTargetId(target)) return err6(`Unknown target "${target}".`);
+        const brand = await loadStorefrontBrand(dir, name ? { name } : void 0);
+        const preferred = target;
+        if (!skip_build) {
+          const ranked = rankTargets(await probeAll(dir));
+          const buildFor = preferred ?? ranked[0]?.id ?? "cloudflare";
+          const built = await buildSite(dir, buildFor);
+          if (!built) return err6(`Build failed for ${buildFor}. Run the build locally to see why.`);
+        }
+        const result2 = await deploySite(dir, brand, {
+          preferred,
+          pushSecrets: push_secrets !== false,
+          customDomain: domain === true
+        });
+        if (!result2.ok) {
+          return err6(result2.reason ?? "Deploy failed.");
+        }
+        const verification = verify !== false && result2.url ? await verifyStorefront(result2.url, dir, process.env) : void 0;
+        return ok6({
+          deployed: true,
+          target: result2.target,
+          project: result2.projectName,
+          url: result2.url ?? null,
+          secrets_staged: result2.secrets?.pushed ?? [],
+          secrets_failed: result2.secrets?.failed ?? [],
+          verified: verification ? verification.ok : null,
+          diagnosis: verification?.ok === false ? verification.diagnosis : void 0,
+          probes: verification ? formatProbes(verification.probes) : void 0,
+          repair_hint: verification && !verification.ok ? repairPlanFor(verification.diagnosis)?.note ?? verification.summary : void 0,
+          warning: result2.secrets?.pushed.includes("CARRIER_API_KEY") ? void 0 : "CARRIER_API_KEY was not staged \u2014 / and /shop will return 500 until it is set."
+        });
+      } catch (e) {
+        return err6(e instanceof Error ? e.message : "deploy failed");
+      }
+    }
+  );
+  server2.tool(
+    "provision_storefront_clerk",
+    "Create a Clerk application (Platform API) or reuse Clerk keys already on this machine, write them into the storefront .env.local, and configure allowed origins and redirect URLs on the instance.",
+    {
+      dir: z22.string().min(1).describe("Path to the scaffolded storefront directory"),
+      name: z22.string().optional().describe("Clerk application name (defaults from brand)"),
+      production: z22.boolean().optional().describe("Also create a production instance (Platform API only)"),
+      no_create: z22.boolean().optional().describe("Never create a new application; only reuse existing keys"),
+      url: z22.string().optional().describe("Deployed URL to whitelist as origin and redirect")
+    },
+    async ({ dir, name, production, no_create, url }) => {
+      try {
+        const brand = await loadStorefrontBrand(dir, name ? { name } : void 0);
+        const result2 = await provisionClerk({
+          name: name ?? brand.name,
+          domain: brand.domain,
+          production: production === true,
+          noCreate: no_create === true,
+          env: process.env,
+          storefront: dir,
+          cli: clerkCliDeps()
+        });
+        if (!result2.ok || !result2.credentials) {
+          return ok6({
+            provisioned: false,
+            tier: result2.tier,
+            reason: result2.reason,
+            guidance: result2.guidance ?? []
+          });
+        }
+        const written = await mergeEnvLocal(dir, {
+          NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: result2.credentials.publishableKey,
+          CLERK_SECRET_KEY: result2.credentials.secretKey
+        });
+        const { allowedOrigins, redirectUrls } = storefrontClerkUrls(url, brand.domain);
+        const configured = await configureClerkInstance(result2.credentials.secretKey, {
+          allowedOrigins,
+          redirectUrls
+        });
+        return ok6({
+          provisioned: true,
+          tier: result2.tier,
+          application_id: result2.credentials.applicationId ?? null,
+          instance_id: result2.credentials.instanceId ?? null,
+          env_written: written,
+          configured: configured.applied,
+          configure_failures: configured.failed
+        });
+      } catch (e) {
+        return err6(e instanceof Error ? e.message : "clerk provisioning failed");
+      }
+    }
+  );
+}
+
 // src/index.ts
 var baseUrl = process.env.CARRIER_OCS_BASE_URL ?? process.env.ESIMVAULT_BASE_URL ?? "https://ocs.esimvault.cloud";
 var token = process.env.CARRIER_OCS_API_TOKEN ?? process.env.ESIMVAULT_API_TOKEN;
@@ -11003,6 +11393,7 @@ registerWalletTools(server, { env: stdioEnv, props });
 registerGreenzoneTools(server, toolCtx);
 registerUiAgentGenericTools(server, toolCtx);
 registerStorefrontLogoTools(server, stdioEnv);
+registerStorefrontDeployTools(server);
 registerAllPrompts(server);
 var transport = new StdioServerTransport();
 await server.connect(transport);