@carrierllc/mcp 0.3.2 → 0.4.0

package/dist/cli.js

@@ -1,11 +1,53 @@
 #!/usr/bin/env node
 import {
+  CARRIER_BRAND,
   CARRIER_VERSION,
   OCS_MAX_USAGE_WINDOW_DAYS,
+  TARGET_IDS,
+  billingScreen,
+  buildSite,
   clampUsagePeriod,
+  clerkCliDeps,
+  configureClerkInstance,
+  deploySite,
+  deriveAccentDark,
+  deriveAccentLight,
+  deriveAccentPaletteSubs,
+  fleetScreen,
+  formatProbes,
   generateStorefrontLogo,
-  lastNDaysPeriod
-} from "./chunk-IYCGWBQU.js";
+  greenzoneScreen,
+  installDeps,
+  isTargetId,
+  lastNDaysPeriod,
+  loadStorefrontBrand,
+  mergeEnvLocal,
+  packagesScreen,
+  probeAll,
+  provisionClerk,
+  rankTargets,
+  renderEnv,
+  renderTui,
+  repairPlanFor,
+  rollback,
+  run,
+  slug,
+  storefrontClerkUrls,
+  storefrontScreen,
+  subscribersScreen,
+  usageScreen,
+  verifyStorefront,
+  walletScreen,
+  which
+} from "./chunk-RBG4MKMW.js";
+import {
+  copyTree,
+  exists,
+  pruneTree,
+  readFile,
+  replaceInTree,
+  writeFile
+} from "./chunk-SHKKVIIA.js";
 
 // src/cli/index.ts
 import { Command } from "commander";
@@ -13,101 +55,8 @@ import * as p3 from "@clack/prompts";
 import pc4 from "picocolors";
 import { resolve as resolve2 } from "path";
 
-// src/cli/lib/brand.ts
-var CARRIER_BRAND = {
-  name: "Carrier",
-  legalName: "Lifecycle Innovations Limited",
-  tagline: "Programmable connectivity, on demand.",
-  domain: "carrier.llc",
-  supportEmail: "support@carrier.llc",
-  supportUrl: "https://carrier.llc/help",
-  supportWhatsapp: "+17864604829",
-  colors: {
-    bg: "#080C16",
-    accent: "#FF6B35",
-    accentDark: "#D9461C",
-    text: "#F5F1EA"
-  },
-  social: {
-    x: "@carrier_llc",
-    instagram: "@carrier.llc",
-    tiktok: "@carrier.llc"
-  },
-  carrierApiUrl: "https://api.carrier.llc"
-};
-var CARRIER_ACCENT_LIGHT = "#FFB088";
-var CARRIER_ACCENT_GRADIENT_START = "#FF7A45";
-function hexToRgb(hex) {
-  const h = hex.replace(/^#/, "");
-  if (!/^[0-9a-fA-F]{6}$/.test(h)) return null;
-  return [parseInt(h.slice(0, 2), 16), parseInt(h.slice(2, 4), 16), parseInt(h.slice(4, 6), 16)];
-}
-function rgbToHex(r, g, b, lower = false) {
-  const fmt = (n) => Math.max(0, Math.min(255, Math.round(n))).toString(16).padStart(2, "0");
-  const out = `#${fmt(r)}${fmt(g)}${fmt(b)}`;
-  return lower ? out : out.toUpperCase();
-}
-function mixHexWithWhite(hex, whiteRatio) {
-  const rgb = hexToRgb(hex);
-  if (!rgb) return hex;
-  const mix = (n) => n + (255 - n) * whiteRatio;
-  return rgbToHex(mix(rgb[0]), mix(rgb[1]), mix(rgb[2]));
-}
-function darkenHex(hex, factor) {
-  const rgb = hexToRgb(hex);
-  if (!rgb) return hex;
-  const scale = (n) => n * factor;
-  return rgbToHex(scale(rgb[0]), scale(rgb[1]), scale(rgb[2]), true);
-}
-function deriveAccentDark(accent, seed = CARRIER_BRAND) {
-  if (accent.toUpperCase() === seed.colors.accent.toUpperCase()) return seed.colors.accentDark;
-  const rgb = hexToRgb(accent);
-  if (!rgb) return accent;
-  const scale = (n) => Math.max(0, Math.min(255, Math.round(n * 0.75)));
-  return rgbToHex(scale(rgb[0]), scale(rgb[1]), scale(rgb[2]));
-}
-function deriveAccentLight(accent, seed = CARRIER_BRAND) {
-  if (accent.toUpperCase() === seed.colors.accent.toUpperCase()) return CARRIER_ACCENT_LIGHT;
-  return mixHexWithWhite(accent, 0.45);
-}
-function deriveAccentGradientStart(accent, seed = CARRIER_BRAND) {
-  if (accent.toUpperCase() === seed.colors.accent.toUpperCase()) return CARRIER_ACCENT_GRADIENT_START;
-  return mixHexWithWhite(accent, 0.08);
-}
-function deriveAccentPaletteSubs(accent, accentDark) {
-  if (accent.toUpperCase() === CARRIER_BRAND.colors.accent.toUpperCase()) return [];
-  const accentLight = deriveAccentLight(accent);
-  const gradientStart = deriveAccentGradientStart(accent);
-  return [
-    ["#FF6B35", accent],
-    ["#D9461C", accentDark],
-    ["#FFB088", accentLight],
-    ["#FF7A45", gradientStart],
-    ["#fff4ef", mixHexWithWhite(accent, 0.94).toLowerCase()],
-    ["#ffe0d0", mixHexWithWhite(accent, 0.85).toLowerCase()],
-    ["#ffbfa0", mixHexWithWhite(accent, 0.7).toLowerCase()],
-    ["#ff9970", mixHexWithWhite(accent, 0.55).toLowerCase()],
-    ["#ff7d4d", mixHexWithWhite(accent, 0.4).toLowerCase()],
-    ["#b33a17", darkenHex(accentDark, 0.75)],
-    ["#8a2d12", darkenHex(accentDark, 0.58)],
-    ["#5e1e0c", darkenHex(accentDark, 0.4)],
-    ["#3a1107", darkenHex(accentDark, 0.25)]
-  ];
-}
-function renderEnv(brand) {
-  return [
-    `# Generated by @carrierllc/mcp`,
-    `NEXT_PUBLIC_BRAND_NAME=${JSON.stringify(brand.name)}`,
-    `NEXT_PUBLIC_CARRIER_API_URL=${JSON.stringify(brand.carrierApiUrl)}`,
-    `# Clerk (fill in from your Clerk dashboard to enable auth + checkout)`,
-    `NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=`,
-    `CLERK_SECRET_KEY=`,
-    ``
-  ].join("\n");
-}
-
 // src/cli/lib/plugin.ts
-import { join as join3 } from "path";
+import { join as join2 } from "path";
 
 // src/cli/lib/paths.ts
 import { fileURLToPath } from "url";
@@ -142,161 +91,8 @@ function installedPluginDir() {
   return join(claudePluginsDir(), "carrier");
 }
 
-// src/cli/lib/fsx.ts
-import { cp, mkdir, readdir, readFile, rm, stat, writeFile } from "fs/promises";
-import { existsSync as existsSync2 } from "fs";
-import { join as join2 } from "path";
-var SKIP = /* @__PURE__ */ new Set([
-  "node_modules",
-  ".next",
-  ".turbo",
-  ".vercel",
-  "dist",
-  ".git",
-  "test-results",
-  "playwright-report"
-]);
-var cpFilter = (s) => {
-  const base = s.split("/").pop() ?? "";
-  return !SKIP.has(base);
-};
-async function copyTree(src, dest) {
-  await mkdir(dest, { recursive: true });
-  for (const entry of await readdir(src, { withFileTypes: true })) {
-    if (SKIP.has(entry.name)) continue;
-    await cp(join2(src, entry.name), join2(dest, entry.name), {
-      recursive: true,
-      filter: cpFilter
-    });
-  }
-}
-async function pruneTree(src, dest) {
-  if (!await isDir(dest)) return;
-  for (const entry of await readdir(dest, { withFileTypes: true })) {
-    if (SKIP.has(entry.name)) continue;
-    const srcPath = join2(src, entry.name);
-    const destPath = join2(dest, entry.name);
-    if (!existsSync2(srcPath)) {
-      await rm(destPath, { recursive: true, force: true });
-      continue;
-    }
-    if (entry.isDirectory() && await isDir(srcPath)) await pruneTree(srcPath, destPath);
-  }
-}
-async function* walk(dir) {
-  for (const entry of await readdir(dir, { withFileTypes: true })) {
-    if (SKIP.has(entry.name)) continue;
-    const full = join2(dir, entry.name);
-    if (entry.isDirectory()) yield* walk(full);
-    else yield full;
-  }
-}
-var TEXT_EXT = /* @__PURE__ */ new Set([
-  ".ts",
-  ".tsx",
-  ".js",
-  ".jsx",
-  ".mjs",
-  ".cjs",
-  ".json",
-  ".css",
-  ".md",
-  ".mdx",
-  ".html",
-  ".txt",
-  ".env",
-  ".example",
-  ".yml",
-  ".yaml",
-  ".toml"
-]);
-function isTextFile(path) {
-  const dot = path.lastIndexOf(".");
-  if (dot === -1) return false;
-  return TEXT_EXT.has(path.slice(dot));
-}
-async function replaceInTree(dir, subs) {
-  let touched = 0;
-  for await (const file of walk(dir)) {
-    if (!isTextFile(file)) continue;
-    const before = await readFile(file, "utf8");
-    let after = before;
-    for (const [from, to] of subs) {
-      after = typeof from === "string" ? after.split(from).join(to) : after.replace(from, to);
-    }
-    if (after !== before) {
-      await writeFile(file, after);
-      touched++;
-    }
-  }
-  return touched;
-}
-async function exists(p4) {
-  return existsSync2(p4);
-}
-async function isDir(p4) {
-  try {
-    return (await stat(p4)).isDirectory();
-  } catch {
-    return false;
-  }
-}
-
-// src/cli/lib/exec.ts
-import { spawn } from "child_process";
-function run(cmd, args, opts = {}) {
-  return new Promise((resolve3) => {
-    const child = spawn(cmd, args, { cwd: opts.cwd, shell: false });
-    let stdout = "";
-    let stderr = "";
-    let settled = false;
-    const finish = (result) => {
-      if (settled) return;
-      settled = true;
-      resolve3(result);
-    };
-    let timer;
-    if (opts.timeoutMs && opts.timeoutMs > 0) {
-      timer = setTimeout(() => {
-        try {
-          child.kill("SIGTERM");
-        } catch {
-        }
-        finish({
-          ok: false,
-          code: null,
-          stdout,
-          stderr: stderr || `timeout after ${opts.timeoutMs}ms`
-        });
-      }, opts.timeoutMs);
-    }
-    child.stdout?.on("data", (d) => stdout += d.toString());
-    child.stderr?.on("data", (d) => stderr += d.toString());
-    child.on("error", () => {
-      if (timer) clearTimeout(timer);
-      finish({ ok: false, code: null, stdout, stderr });
-    });
-    child.on("close", (code) => {
-      if (timer) clearTimeout(timer);
-      finish({ ok: code === 0, code, stdout, stderr });
-    });
-  });
-}
-function runInherit(cmd, args, opts = {}) {
-  return new Promise((resolve3) => {
-    const child = spawn(cmd, args, { cwd: opts.cwd, shell: false, stdio: "inherit" });
-    child.on("error", () => resolve3({ ok: false, code: null, stdout: "", stderr: "" }));
-    child.on("close", (code) => resolve3({ ok: code === 0, code, stdout: "", stderr: "" }));
-  });
-}
-async function which(bin) {
-  const probe = process.platform === "win32" ? "where" : "which";
-  const r = await run(probe, [bin]);
-  return r.ok && r.stdout.trim().length > 0;
-}
-
 // src/cli/lib/urls.ts
-import { spawn as spawn2 } from "child_process";
+import { spawn } from "child_process";
 var MCP_URL = "https://mcp.carrier.llc/mcp";
 var MCP_HOME = "https://mcp.carrier.llc";
 var SIGN_UP_URL = "https://accounts.carrier.llc/sign-up";
@@ -320,7 +116,7 @@ async function openUrl(url) {
     if (r.ok) return { ok: true, hint: `Opened ${url}` };
   }
   try {
-    spawn2("xdg-open", [url], { detached: true, stdio: "ignore" }).unref();
+    spawn("xdg-open", [url], { detached: true, stdio: "ignore" }).unref();
     return { ok: true, hint: `Launched browser for ${url}` };
   } catch {
     return { ok: false, hint: `Could not open browser. Visit:
@@ -361,7 +157,7 @@ async function installPlugin() {
 }
 async function pluginStatus() {
   const dir = installedPluginDir();
-  const manifest = join3(dir, ".claude-plugin", "plugin.json");
+  const manifest = join2(dir, ".claude-plugin", "plugin.json");
   if (!await exists(manifest)) return { installed: false, dir };
   try {
     const json = JSON.parse(await readFile(manifest, "utf8"));
@@ -388,7 +184,7 @@ function installAuthGuidance() {
 }
 
 // src/cli/lib/whitelabel.ts
-import { join as join4 } from "path";
+import { join as join3 } from "path";
 function preserveClerkFromEnv(existing, fresh) {
   let out = fresh;
   for (const key of ["NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY", "CLERK_SECRET_KEY"]) {
@@ -407,7 +203,7 @@ async function scaffoldStorefront(target, brand) {
       `Storefront template not found at ${template}. The @carrierllc/mcp package may be corrupt \u2014 reinstall it.`
     );
   }
-  const envPath = join4(target, ".env.local");
+  const envPath = join3(target, ".env.local");
   const existingEnv = await exists(envPath) ? await readFile(envPath, "utf8") : void 0;
   await copyTree(template, target);
   await pruneTree(template, target);
@@ -419,10 +215,10 @@ async function scaffoldStorefront(target, brand) {
   if (brand.colors.bg.toUpperCase() !== "#080C16") subs.push(["#080C16", brand.colors.bg]);
   if (brand.colors.text.toUpperCase() !== "#F5F1EA") subs.push(["#F5F1EA", brand.colors.text]);
   await replaceInTree(target, subs);
-  await patchBrandConfig(join4(target, "src", "brand.config.ts"), brand);
+  await patchBrandConfig(join3(target, "src", "brand.config.ts"), brand);
   const envBody = existingEnv ? preserveClerkFromEnv(existingEnv, renderEnv(brand)) : renderEnv(brand);
   await writeFile(envPath, envBody);
-  await writeFile(join4(target, ".npmrc"), "ignore-workspace-root-check=true\n");
+  await writeFile(join3(target, ".npmrc"), "ignore-workspace-root-check=true\n");
 }
 async function patchBrandConfig(path, brand) {
   if (!await exists(path)) return;
@@ -454,89 +250,168 @@ ${socialBody}
 }
 
 // src/cli/lib/logo.ts
-import { mkdir as mkdir2, writeFile as writeFile2 } from "fs/promises";
-import { join as join5 } from "path";
+import { mkdir, writeFile as writeFile2 } from "fs/promises";
+import { join as join4 } from "path";
 async function writeStorefrontLogo(target, brand) {
   const logo = await generateStorefrontLogo({
     name: brand.name,
     accent: brand.colors.accent,
     tagline: brand.tagline
   });
-  const dir = join5(target, "public", "brand");
-  await mkdir2(dir, { recursive: true });
-  const svgPath = join5(dir, "logo.svg");
+  const dir = join4(target, "public", "brand");
+  await mkdir(dir, { recursive: true });
+  const svgPath = join4(dir, "logo.svg");
   await writeFile2(svgPath, logo.svg, "utf8");
   if (logo.pngBase64) {
-    await writeFile2(join5(dir, "logo.png"), Buffer.from(logo.pngBase64, "base64"));
+    await writeFile2(join4(dir, "logo.png"), Buffer.from(logo.pngBase64, "base64"));
   }
   return { path: svgPath, source: logo.source };
 }
 
-// src/cli/lib/site.ts
-import { join as join6 } from "path";
-function slug(s) {
-  return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "storefront";
-}
-async function installDeps(target) {
-  const pkgMgr = await which("pnpm") ? "pnpm" : "npm";
-  const r = await runInherit(pkgMgr, ["install"], { cwd: target });
-  return r.ok;
-}
-async function buildSite(target) {
-  const pkgMgr = await which("pnpm") ? "pnpm" : "npm";
-  const r = await runInherit(pkgMgr, ["run", "cf:build"], { cwd: target });
-  return r.ok;
-}
-async function loadStorefrontBrand(target, overrides) {
-  const configPath = join6(target, "src", "brand.config.ts");
-  if (!await exists(configPath)) {
-    return { ...CARRIER_BRAND, ...overrides };
-  }
-  const src = await readFile(configPath, "utf8");
-  const pick = (field, fallback) => {
-    const m = src.match(new RegExp(`\\b${field}:\\s*(?:[^"\\n]*\\?\\?\\s*)?"([^"]*)"`));
-    return m?.[1] ?? fallback;
-  };
-  return {
-    ...CARRIER_BRAND,
-    name: overrides?.name ?? pick("name", CARRIER_BRAND.name),
-    domain: pick("domain", CARRIER_BRAND.domain),
-    supportEmail: pick("supportEmail", CARRIER_BRAND.supportEmail),
-    supportUrl: pick("supportUrl", CARRIER_BRAND.supportUrl),
-    tagline: pick("tagline", CARRIER_BRAND.tagline),
-    legalName: pick("legalName", CARRIER_BRAND.legalName),
-    colors: {
-      ...CARRIER_BRAND.colors,
-      accent: pick("accent", CARRIER_BRAND.colors.accent),
-      accentDark: pick("accentDark", CARRIER_BRAND.colors.accentDark),
-      bg: pick("bg", CARRIER_BRAND.colors.bg),
-      text: pick("text", CARRIER_BRAND.colors.text)
-    },
-    carrierApiUrl: CARRIER_BRAND.carrierApiUrl
-  };
-}
-async function deploySite(target, brand) {
-  const projectName = slug(brand.name);
-  const workerBundle = join6(target, ".open-next", "worker.js");
-  if (!await exists(workerBundle)) {
-    return {
-      ok: false,
-      projectName,
-      reason: "No OpenNext build found \u2014 run `carrier site deploy` (build step) or `pnpm run build` in the storefront first."
-    };
+// src/cli/lib/dash.ts
+var DASH_DOMAINS = [
+  "fleet",
+  "subscribers",
+  "usage",
+  "packages",
+  "billing",
+  "wallet",
+  "greenzone",
+  "storefront"
+];
+function isDashDomain(value) {
+  return DASH_DOMAINS.includes(value);
+}
+var DASH_TOOL = {
+  fleet: "fleet_health_app",
+  subscribers: "list_subscribers",
+  usage: "subscriber_usage",
+  packages: "list_package_templates",
+  billing: "billing_events",
+  wallet: "wallet_balance",
+  greenzone: "greenzone_whitelist_list",
+  storefront: ""
+};
+function screenFromStructured(structured) {
+  const rec = structured;
+  const screen = rec?.screen;
+  if (screen && typeof screen === "object" && Array.isArray(screen.sections) && screen.title) {
+    return screen;
   }
-  if (!await which("wrangler") && !await which("npx")) {
-    return { ok: false, projectName, reason: "wrangler/npx not found \u2014 install wrangler to deploy." };
+  return void 0;
+}
+var num = (value, fallback = 0) => {
+  const n = Number(value);
+  return Number.isFinite(n) ? n : fallback;
+};
+var str = (value, fallback = "") => value === void 0 || value === null ? fallback : String(value);
+function rows(payload, keys) {
+  if (Array.isArray(payload)) return payload;
+  const rec = payload ?? {};
+  for (const key of keys) {
+    const candidate = rec[key];
+    if (Array.isArray(candidate)) return candidate;
+  }
+  return [];
+}
+function buildDashScreen(domain, payload) {
+  switch (domain) {
+    case "fleet": {
+      const accounts = rows(payload, ["accounts", "account"]);
+      return fleetScreen({
+        active: num(payload?.active),
+        suspended: num(payload?.suspended),
+        inventory: num(payload?.inventory),
+        other: num(payload?.other),
+        accounts: accounts.map((a) => ({
+          name: str(a.name ?? a.accountId, "?"),
+          balance: num(a.balance),
+          active: num(a.active),
+          suspended: num(a.suspended),
+          inventory: num(a.inventory),
+          other: num(a.other),
+          packageOnly: Boolean(a.packageOnly)
+        }))
+      });
+    }
+    case "subscribers":
+      return subscribersScreen(
+        rows(payload, ["subscribers", "subscriber", "data"]).map((s) => ({
+          iccid: str(s.iccid ?? s.ICCID, "?"),
+          msisdn: s.msisdn ? str(s.msisdn) : void 0,
+          status: str(s.status ?? s.statusStr, "unknown"),
+          account: s.accountName ? str(s.accountName) : void 0,
+          dataUsedBytes: s.dataUsed === void 0 ? void 0 : num(s.dataUsed)
+        }))
+      );
+    case "usage":
+      return usageScreen({
+        subject: str(payload?.subject, "Subscriber"),
+        timeline: rows(payload, ["timeline", "days", "usage"]).map((p4) => ({
+          date: str(p4.date ?? p4.day, "?"),
+          bytes: num(p4.bytes ?? p4.dataUsed)
+        })),
+        countries: rows(payload, ["countries"]).map((c) => ({
+          country: str(c.country ?? c.countryName, "?"),
+          bytes: num(c.bytes ?? c.dataUsed)
+        }))
+      });
+    case "packages":
+      return packagesScreen(
+        rows(payload, ["template", "templates", "data"]).map((t) => ({
+          name: str(t.prepaidpackagetemplatename ?? t.name, "?"),
+          id: str(t.prepaidpackagetemplateid ?? t.id, "?"),
+          dataLimitBytes: t.databyte === void 0 ? void 0 : num(t.databyte),
+          validityDays: t.perioddays === void 0 ? void 0 : num(t.perioddays),
+          price: t.cost === void 0 ? void 0 : num(t.cost),
+          recurring: Boolean(t.recurring)
+        }))
+      );
+    case "billing":
+      return billingScreen({
+        balance: payload?.balance === void 0 ? void 0 : num(payload.balance),
+        currency: str(payload?.currency, ""),
+        events: rows(payload, ["events", "data"]).map((e) => ({
+          date: str(e.date ?? e.timestamp, "?"),
+          description: str(e.description ?? e.type, "\u2014"),
+          amount: num(e.amount)
+        }))
+      });
+    case "wallet": {
+      const p4 = payload ?? {};
+      return walletScreen({
+        balance: num(p4.balance),
+        currency: str(p4.currency, ""),
+        autoTopupEnabled: Boolean(p4.autoTopupEnabled ?? p4.auto_topup_enabled),
+        threshold: p4.threshold === void 0 ? void 0 : num(p4.threshold),
+        credits: p4.credits === void 0 ? void 0 : num(p4.credits)
+      });
+    }
+    case "greenzone":
+      return greenzoneScreen(
+        rows(payload, ["entries", "whitelist", "data"]).map((e) => ({
+          value: str(e.value ?? e.prefix ?? e.destination, "?"),
+          note: e.note ? str(e.note) : void 0
+        }))
+      );
+    case "storefront": {
+      const p4 = payload ?? {};
+      return storefrontScreen({
+        brand: str(p4.brand ?? p4.project, "storefront"),
+        url: p4.url ? str(p4.url) : void 0,
+        target: p4.target ? str(p4.target) : void 0,
+        verified: p4.verified === void 0 ? null : Boolean(p4.verified),
+        diagnosis: p4.diagnosis ? str(p4.diagnosis) : void 0,
+        secretsStaged: Array.isArray(p4.secrets_staged) ? p4.secrets_staged : void 0,
+        plans: p4.plans === void 0 ? void 0 : num(p4.plans)
+      });
+    }
   }
-  const bin = await which("wrangler") ? "wrangler" : "npx";
-  const args = bin === "wrangler" ? ["deploy", "--name", projectName] : ["wrangler", "deploy", "--name", projectName];
-  const r = await runInherit(bin, args, { cwd: target });
-  return r.ok ? { ok: true, projectName } : { ok: false, projectName, reason: "wrangler deploy failed \u2014 run `wrangler login` then retry `carrier site deploy`." };
 }
 
 // src/cli/lib/status.ts
 import { homedir as homedir2 } from "os";
-import { join as join7 } from "path";
+import { join as join5 } from "path";
 function detectEnvToken() {
   const api = process.env.CARRIER_API_KEY?.trim() || process.env.CARRIER_ORG_API_KEY?.trim() || "";
   if (api.startsWith("ak_") || api.length > 0) {
@@ -581,10 +456,10 @@ function scanMcpServers(servers) {
 }
 async function probeMcpFromConfig() {
   const candidates = [
-    join7(homedir2(), ".claude.json"),
-    join7(claudeHome(), "settings.json"),
-    join7(claudeHome(), ".mcp.json"),
-    join7(process.cwd(), ".mcp.json")
+    join5(homedir2(), ".claude.json"),
+    join5(claudeHome(), "settings.json"),
+    join5(claudeHome(), ".mcp.json"),
+    join5(process.cwd(), ".mcp.json")
   ];
   let best = null;
   let configSeen = false;
@@ -768,6 +643,280 @@ function withNextStep(errorMsg, next) {
 import * as p from "@clack/prompts";
 import pc2 from "picocolors";
 
+// src/cli/lib/auth.ts
+import { createHash, randomBytes, timingSafeEqual } from "crypto";
+import { createServer } from "http";
+
+// src/cli/lib/credentials.ts
+import { homedir as homedir3 } from "os";
+import { join as join6 } from "path";
+import { chmod, mkdir as mkdir2, readFile as readFile2, rm, writeFile as writeFile3 } from "fs/promises";
+function carrierHome() {
+  return process.env.CARRIER_HOME?.trim() || join6(homedir3(), ".carrier");
+}
+function credentialsPath() {
+  return join6(carrierHome(), "credentials.json");
+}
+async function readCredentials() {
+  try {
+    const raw = await readFile2(credentialsPath(), "utf8");
+    const parsed = JSON.parse(raw);
+    if (!parsed?.accessToken || typeof parsed.accessToken !== "string") return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+async function writeCredentials(creds) {
+  const dir = carrierHome();
+  await mkdir2(dir, { recursive: true, mode: 448 });
+  await chmod(dir, 448).catch(() => void 0);
+  const file = credentialsPath();
+  await writeFile3(file, `${JSON.stringify(creds, null, 2)}
+`, { mode: 384 });
+  await chmod(file, 384).catch(() => void 0);
+}
+async function clearCredentials() {
+  await rm(credentialsPath(), { force: true });
+}
+function isExpired(creds, skewMs = 6e4) {
+  if (!creds.expiresAt) return false;
+  return Date.now() >= creds.expiresAt - skewMs;
+}
+
+// src/cli/lib/auth.ts
+var DISCOVERY_PATH = "/.well-known/oauth-authorization-server";
+var CLIENT_NAME = "Carrier CLI";
+var DEFAULT_SCOPE = "read write";
+var CALLBACK_PORTS = [3118, 3119, 8976, 8977, 0];
+async function discover(base = MCP_HOME) {
+  const res = await fetch(`${base}${DISCOVERY_PATH}`, {
+    headers: { Accept: "application/json" }
+  });
+  if (!res.ok) throw new Error(`OAuth discovery failed (${res.status}) at ${base}${DISCOVERY_PATH}`);
+  const meta = await res.json();
+  if (!meta.authorization_endpoint || !meta.token_endpoint) {
+    throw new Error("OAuth discovery returned no authorization or token endpoint");
+  }
+  return meta;
+}
+function base64url(buf) {
+  return buf.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function pkcePair() {
+  const verifier = base64url(randomBytes(32));
+  const challenge = base64url(createHash("sha256").update(verifier).digest());
+  return { verifier, challenge };
+}
+function sameState(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  if (left.length !== right.length) return false;
+  return timingSafeEqual(left, right);
+}
+async function registerClient(meta, redirectUri) {
+  if (!meta.registration_endpoint) {
+    throw new Error("This server does not support dynamic client registration");
+  }
+  const res = await fetch(meta.registration_endpoint, {
+    method: "POST",
+    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    body: JSON.stringify({
+      client_name: CLIENT_NAME,
+      redirect_uris: [redirectUri],
+      grant_types: ["authorization_code", "refresh_token"],
+      response_types: ["code"],
+      // Installed apps cannot keep a secret; register as a public client.
+      token_endpoint_auth_method: "none",
+      application_type: "native"
+    })
+  });
+  if (!res.ok) {
+    const body = (await res.text().catch(() => "")).slice(0, 200);
+    throw new Error(`Client registration failed (${res.status}). ${body}`);
+  }
+  const json = await res.json();
+  if (!json.client_id) throw new Error("Client registration returned no client_id");
+  return json.client_id;
+}
+function escapeHtml(text3) {
+  return text3.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function page(title, detail) {
+  const safeTitle = escapeHtml(title);
+  const safeDetail = escapeHtml(detail);
+  return `<!doctype html><meta charset="utf-8"><title>${safeTitle}</title>
+<body style="font-family:system-ui,sans-serif;max-width:32rem;margin:20vh auto;text-align:center">
+<h1 style="font-size:1.25rem">${safeTitle}</h1><p style="color:#555">${safeDetail}</p></body>`;
+}
+async function startCallbackServer() {
+  let resolveCode;
+  let rejectCode;
+  let expected = "";
+  const server = createServer((req, res) => {
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    if (url.pathname !== "/callback") {
+      res.writeHead(404).end();
+      return;
+    }
+    const err = url.searchParams.get("error");
+    const code = url.searchParams.get("code");
+    const state = url.searchParams.get("state") ?? "";
+    if (err) {
+      res.writeHead(400, { "Content-Type": "text/html" });
+      res.end(page("Sign-in failed", err));
+      rejectCode?.(new Error(`Authorization server returned "${err}"`));
+      return;
+    }
+    if (!code || !expected || !sameState(state, expected)) {
+      res.writeHead(400, { "Content-Type": "text/html" });
+      res.end(page("Sign-in failed", "The redirect did not match this login attempt."));
+      rejectCode?.(new Error("State mismatch \u2014 ignoring the redirect"));
+      return;
+    }
+    res.writeHead(200, { "Content-Type": "text/html" });
+    res.end(page("You're signed in", "Close this tab and return to your terminal."));
+    resolveCode?.(code);
+  });
+  let bound = false;
+  let lastErr;
+  for (const port2 of CALLBACK_PORTS) {
+    try {
+      await new Promise((resolve3, reject) => {
+        server.once("error", reject);
+        server.listen(port2, "127.0.0.1", () => {
+          server.removeListener("error", reject);
+          resolve3();
+        });
+      });
+      bound = true;
+      break;
+    } catch (e) {
+      lastErr = e;
+    }
+  }
+  if (!bound) {
+    throw new Error(
+      `Could not bind a local callback port (tried ${CALLBACK_PORTS.filter(Boolean).join(", ")}): ${lastErr instanceof Error ? lastErr.message : String(lastErr)}`
+    );
+  }
+  const { port } = server.address();
+  return {
+    redirectUri: `http://localhost:${port}/callback`,
+    // `close()` alone only stops new connections; a keep-alive socket from the
+    // browser would hold the event loop open and the CLI would never exit.
+    waitForCode: (expectedState, timeoutMs) => {
+      expected = expectedState;
+      return new Promise((resolve3, reject) => {
+        const timer = setTimeout(
+          () => reject(new Error(`Timed out after ${Math.round(timeoutMs / 1e3)}s waiting for the browser`)),
+          timeoutMs
+        );
+        resolveCode = (code) => {
+          clearTimeout(timer);
+          resolve3(code);
+        };
+        rejectCode = (err) => {
+          clearTimeout(timer);
+          reject(err);
+        };
+      });
+    },
+    close: () => {
+      server.closeAllConnections();
+      server.close();
+    }
+  };
+}
+async function postToken(meta, body) {
+  const res = await fetch(meta.token_endpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    },
+    body: new URLSearchParams(body).toString()
+  });
+  const json = await res.json().catch(() => ({}));
+  if (!res.ok || json.error) {
+    throw new Error(json.error_description || json.error || `Token endpoint returned ${res.status}`);
+  }
+  if (!json.access_token) throw new Error("Token endpoint returned no access_token");
+  return json;
+}
+function store(meta, token, clientId) {
+  return {
+    issuer: meta.issuer,
+    accessToken: token.access_token,
+    refreshToken: token.refresh_token,
+    expiresAt: Date.now() + (token.expires_in ?? 900) * 1e3,
+    scope: token.scope,
+    clientId
+  };
+}
+async function login(opts) {
+  const meta = await discover();
+  const server = await startCallbackServer();
+  try {
+    const existing = await readCredentials();
+    const clientId = existing?.clientId && existing.issuer === meta.issuer ? existing.clientId : await registerClient(meta, server.redirectUri);
+    const { verifier, challenge } = pkcePair();
+    const state = base64url(randomBytes(16));
+    const authUrl = new URL(meta.authorization_endpoint);
+    authUrl.searchParams.set("response_type", "code");
+    authUrl.searchParams.set("client_id", clientId);
+    authUrl.searchParams.set("redirect_uri", server.redirectUri);
+    authUrl.searchParams.set("scope", pickScope(meta));
+    authUrl.searchParams.set("state", state);
+    authUrl.searchParams.set("code_challenge", challenge);
+    authUrl.searchParams.set("code_challenge_method", "S256");
+    const pendingCode = server.waitForCode(state, opts.timeoutMs ?? 3e5);
+    pendingCode.catch(() => void 0);
+    opts.onUrl?.(authUrl.toString());
+    await opts.openBrowser(authUrl.toString());
+    const code = await pendingCode;
+    const token = await postToken(meta, {
+      grant_type: "authorization_code",
+      code,
+      redirect_uri: server.redirectUri,
+      client_id: clientId,
+      code_verifier: verifier
+    });
+    await writeCredentials(store(meta, token, clientId));
+    return { ok: true, message: "Signed in.", scope: token.scope };
+  } finally {
+    server.close();
+  }
+}
+function pickScope(meta) {
+  const supported = meta.scopes_supported ?? [];
+  if (!supported.length) return DEFAULT_SCOPE;
+  return DEFAULT_SCOPE.split(" ").filter((s) => supported.includes(s)).join(" ") || supported[0];
+}
+async function getAccessToken() {
+  const creds = await readCredentials();
+  if (!creds) return null;
+  if (!isExpired(creds)) return creds.accessToken;
+  if (!creds.refreshToken || !creds.clientId) return null;
+  try {
+    const meta = await discover();
+    const token = await postToken(meta, {
+      grant_type: "refresh_token",
+      refresh_token: creds.refreshToken,
+      client_id: creds.clientId
+    });
+    const next = store(meta, token, creds.clientId);
+    if (!next.refreshToken) next.refreshToken = creds.refreshToken;
+    await writeCredentials(next);
+    return next.accessToken;
+  } catch {
+    return null;
+  }
+}
+async function logout() {
+  await clearCredentials();
+}
+
 // src/cli/lib/ask.ts
 var DEFAULT_ERROR_HINTS = [
   "Re-check the arguments: carrier <domain> <command> --help",
@@ -800,15 +949,14 @@ function parseRpcBody(raw) {
   return JSON.parse(dataLine.slice(5).trim());
 }
 async function callMcpTool(tool, args, opts = {}) {
-  const token = resolveCliToken();
+  const token = resolveCliToken() ?? await getAccessToken();
   if (!token) {
     return {
       ok: false,
-      text: withNextStep("No headless token in the environment.", [
-        "Interactive path: open Claude and say your intent \u2014 OAuth runs on first use.",
-        "Or export CARRIER_API_KEY=ak_\u2026 from Console \u2192 Settings \u2192 API Keys.",
-        'Then retry: carrier ask "show fleet health"',
-        "Or run a discrete command: carrier subscribers list --account-id 123"
+      text: withNextStep("Not signed in.", [
+        "Sign in from this terminal: carrier login",
+        "No account yet? carrier open signup",
+        "Headless/CI instead: export CARRIER_API_KEY=ak_\u2026 from Console \u2192 Settings \u2192 API Keys"
       ])
     };
   }
@@ -903,7 +1051,11 @@ async function callMcpTool(tool, args, opts = {}) {
         }
         const parts = json.result?.content ?? [];
         const text3 = parts.map((p4) => p4.text).filter(Boolean).join("\n").trim() || JSON.stringify(json.result ?? json, null, 2);
-        return { ok: !json.result?.isError, text: text3 };
+        return {
+          ok: !json.result?.isError,
+          text: text3,
+          structured: json.result?.structuredContent
+        };
       })(),
       deadline
     ]);
@@ -936,17 +1088,60 @@ async function callMcpTool(tool, args, opts = {}) {
     if (deadlineTimer !== void 0) clearTimeout(deadlineTimer);
   }
 }
+var ASK_ERROR_HINTS = [
+  "Rephrase the intent more specifically (include ICCID / MSISDN if relevant)",
+  "Or use a discrete command: carrier --help lists every domain"
+];
+function parseRouting(text3) {
+  const trimmed = text3.trim();
+  if (!trimmed.startsWith("{")) return void 0;
+  try {
+    const parsed = JSON.parse(trimmed);
+    if (!parsed || typeof parsed !== "object") return void 0;
+    const routes = typeof parsed.resolved_tool === "string" && parsed.resolved_tool;
+    const asksBack = typeof parsed.clarifying_question === "string" || Array.isArray(parsed.candidates);
+    return routes || asksBack ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
 async function carrierAsk(intent) {
-  return callMcpTool(
-    "carrier_ask",
-    { intent },
-    {
-      errorHints: [
-        "Rephrase the intent more specifically (include ICCID / MSISDN if relevant)",
-        "Or use a discrete command: carrier --help lists every domain"
-      ]
-    }
-  );
+  const routed = await callMcpTool("carrier_ask", { intent }, { errorHints: ASK_ERROR_HINTS });
+  if (!routed.ok) return routed;
+  const routing = parseRouting(routed.text);
+  if (!routing) return routed;
+  if (!routing.resolved_tool) {
+    const candidates = (routing.candidates ?? []).map((c) => c.tool ? `Candidate: ${c.tool}${c.reason ? ` \u2014 ${c.reason}` : ""}` : void 0).filter((s) => Boolean(s));
+    return {
+      ok: false,
+      text: withNextStep(routing.clarifying_question?.trim() || "Carrier could not tell which tool you meant.", [
+        ...candidates,
+        ...ASK_ERROR_HINTS
+      ])
+    };
+  }
+  const tool = routing.resolved_tool;
+  const args = routing.resolved_params ?? {};
+  if (routing.match && routing.match !== "confirmed") {
+    return {
+      ok: false,
+      text: withNextStep(`Carrier could not confirm what you meant (match: ${routing.match}).`, [
+        `Closest tool: ${tool}`,
+        ...ASK_ERROR_HINTS
+      ])
+    };
+  }
+  if (routing.confirm_required) {
+    return {
+      ok: false,
+      text: withNextStep(`"${intent}" resolves to ${tool}, which changes live service or billing.`, [
+        `Params: ${JSON.stringify(args)}`,
+        "Run the matching discrete command so every flag is explicit and reviewable",
+        "carrier --help lists every domain"
+      ])
+    };
+  }
+  return callMcpTool(tool, args, { errorHints: ASK_ERROR_HINTS });
 }
 
 // src/cli/lib/home.ts
@@ -1159,7 +1354,10 @@ var CLI_DOMAINS = [
           { flags: "--status <status>", description: "Filter by status, e.g. ACTIVE", arg: "status", type: "string" },
           { flags: "--limit <n>", description: "Max rows to return", arg: "limit", type: "number" },
           { flags: "--offset <n>", description: "Pagination offset", arg: "offset", type: "number" }
-        ]
+        ],
+        // OCS rejects an unfiltered list. Catch it here so the user gets the
+        // flags to pass instead of a raw schema-validation dump from the tool.
+        requireOneOf: ["accountId", "iccid", "msisdn", "imsi", "activationCode"]
       },
       {
         name: "get",
@@ -1693,7 +1891,8 @@ var CLI_DOMAINS = [
             flags: "--zone-id <id>",
             description: "Filter to one location zone",
             arg: "locationZoneId",
-            type: "number"
+            type: "number",
+            required: true
           }
         ]
       },
@@ -1749,7 +1948,8 @@ var CLI_DOMAINS = [
             flags: "--destination-list-id <id>",
             description: "Destination list ID from `carrier zones destinations`",
             arg: "destinationListId",
-            type: "number"
+            type: "number",
+            required: true
           }
         ]
       }
@@ -2155,6 +2355,14 @@ function buildToolArgs(cmd, opts) {
   if (cmd.write) args.dry_run = true;
   return { args, errors, notes };
 }
+function formatJsonOutput(text3) {
+  try {
+    JSON.parse(text3);
+    return text3;
+  } catch {
+    return JSON.stringify(text3);
+  }
+}
 async function runCapability(domain, cmd, opts) {
   const label = `${domain.name} ${cmd.name}`;
   const quiet = opts.json === true;
@@ -2192,7 +2400,7 @@ async function runCapability(domain, cmd, opts) {
     return;
   }
   if (quiet) {
-    process.stdout.write(`${result.text}
+    process.stdout.write(`${formatJsonOutput(result.text)}
 `);
     return;
   }
@@ -2328,6 +2536,11 @@ async function doSiteCreate(target, brand) {
     info(pc4.yellow(String(e instanceof Error ? e.message : e)));
   }
 }
+async function resolveBuildTarget(storefront, preferred) {
+  if (preferred) return preferred;
+  const ranked = rankTargets(await probeAll(storefront));
+  return ranked[0]?.id ?? "cloudflare";
+}
 async function maybeBuildDeploy(target, brand, opts) {
   if (opts.install) {
     const s = p3.spinner();
@@ -2345,10 +2558,12 @@ async function maybeBuildDeploy(target, brand, opts) {
       return;
     }
   }
+  const buildTarget = await resolveBuildTarget(target, opts.preferred);
+  if (opts.clerk) await runClerkStep(target, brand);
   if (opts.build) {
     const s = p3.spinner();
-    s.start("Building storefront (next build)");
-    const okb = await buildSite(target);
+    s.start(`Building storefront for ${buildTarget}`);
+    const okb = await buildSite(target, buildTarget);
     s.stop(okb ? "Build succeeded" : "Build failed \u2014 see output above");
     if (!okb) {
       p3.note(
@@ -2360,20 +2575,145 @@ async function maybeBuildDeploy(target, brand, opts) {
   }
   if (opts.deploy) {
     const s = p3.spinner();
-    s.start("Deploying to Cloudflare Workers");
-    const r = await deploySite(target, brand);
-    s.stop(r.ok ? `Deployed: ${r.projectName}` : "Deploy skipped");
-    if (!r.ok && r.reason) {
-      info(pc4.yellow(r.reason));
+    s.start("Deploying");
+    const r = await deploySite(target, brand, {
+      preferred: opts.preferred,
+      pushSecrets: opts.pushSecrets,
+      customDomain: opts.customDomain
+    });
+    s.stop(r.ok ? `Deployed to ${r.target}: ${r.url ?? r.projectName}` : "Deploy skipped");
+    if (!r.ok) {
+      if (r.reason) info(pc4.yellow(r.reason));
+      const hints = r.statuses.filter((t) => !t.ready && t.reason).map((t) => `${t.label}: ${t.reason}`);
+      p3.note(
+        [...hints.length ? hints : ["Log in to a supported host, then retry."], `Then: carrier site deploy ${target}`].join("\n"),
+        "Next"
+      );
+      return;
+    }
+    if (r.secrets) {
+      if (r.secrets.pushed.length) info(pc4.dim(`Secrets staged: ${r.secrets.pushed.join(", ")}`));
+      if (r.secrets.failed.length) {
+        info(pc4.yellow(`Secrets that failed to stage: ${r.secrets.failed.join(", ")}`));
+      }
+    }
+    if (!r.secrets?.pushed.includes("CARRIER_API_KEY")) {
+      info(
+        pc4.yellow(
+          "CARRIER_API_KEY was not staged \u2014 / and /shop will return 500. Set it in .env.local and redeploy."
+        )
+      );
+    }
+    if (r.url) info(pc4.green(r.url));
+    if (opts.clerk && r.url) {
+      const secretKey = process.env.CLERK_SECRET_KEY?.trim();
+      if (secretKey) {
+        const { allowedOrigins, redirectUrls } = storefrontClerkUrls(r.url, brand.domain);
+        const configured = await configureClerkInstance(secretKey, { allowedOrigins, redirectUrls });
+        if (configured.applied.length) {
+          info(pc4.dim(`Clerk now allows the deployed origin (${configured.applied.length} settings)`));
+        }
+        for (const f of configured.failed) info(pc4.yellow(`Clerk ${f.step}: ${f.reason}`));
+      }
+    }
+    if (opts.verify !== false && r.url && r.target) {
+      await verifyAndRepair(target, brand, r.url, r.target, r.projectName, opts);
+    }
+  }
+}
+async function verifyAndRepair(storefront, brand, url, targetId, projectName, opts) {
+  const s = p3.spinner();
+  s.start("Verifying the deployed storefront");
+  let result = await verifyStorefront(url, storefront, process.env);
+  s.stop(result.ok ? "Storefront is serving" : `Storefront is not serving \u2014 ${result.diagnosis}`);
+  info(pc4.dim(formatProbes(result.probes)));
+  if (result.ok) return;
+  info(pc4.yellow(result.summary));
+  const plan = repairPlanFor(result.diagnosis);
+  if (!plan) {
+    if (result.diagnosis === "unclassified" && opts.autofixAgent) {
       p3.note(
         [
-          "Install wrangler and login: npx wrangler login",
-          `Then: carrier site deploy ${target}`
+          "No deterministic repair matches this symptom.",
+          `Probes: ${formatProbes(result.probes)}`,
+          `URL: ${url}`,
+          "Re-run with an agent that can read the host logs, or inspect manually."
         ].join("\n"),
-        "Next"
+        "Needs investigation"
       );
     }
+    process.exitCode = 1;
+    return;
+  }
+  const rs = p3.spinner();
+  rs.start(`Repairing: ${plan.note}`);
+  if (plan.runClerk) await runClerkStep(storefront, brand, url);
+  if (plan.rebuild) {
+    const rebuilt = await buildSite(storefront, targetId);
+    if (!rebuilt) {
+      rs.stop("Repair failed at the rebuild step");
+      process.exitCode = 1;
+      return;
+    }
+  }
+  const redeploy = await deploySite(storefront, brand, {
+    preferred: targetId,
+    pushSecrets: opts.pushSecrets !== false
+  });
+  rs.stop(redeploy.ok ? "Repaired and redeployed" : "Redeploy failed");
+  if (!redeploy.ok) {
+    info(pc4.yellow(redeploy.reason ?? "Redeploy failed."));
+    process.exitCode = 1;
+    return;
+  }
+  result = await verifyStorefront(redeploy.url ?? url, storefront, process.env);
+  info(pc4.dim(formatProbes(result.probes)));
+  if (result.ok) {
+    info(pc4.green("Storefront is serving after repair."));
+    return;
+  }
+  info(pc4.yellow(`Still failing after one repair: ${result.summary}`));
+  const rb = await rollback(targetId, storefront, projectName);
+  info(rb.ok ? pc4.yellow("Rolled back to the previous version.") : pc4.yellow(rb.reason ?? "No rollback available."));
+  process.exitCode = 1;
+}
+async function runClerkStep(storefront, brand, deployedUrl) {
+  const s = p3.spinner();
+  s.start("Provisioning Clerk");
+  const result = await provisionClerk({
+    name: brand.name,
+    domain: brand.domain,
+    env: process.env,
+    storefront,
+    cli: clerkCliDeps()
+  });
+  if (!result.ok || !result.credentials) {
+    s.stop("Clerk not configured");
+    if (result.reason) info(pc4.yellow(result.reason));
+    if (result.guidance) p3.note(result.guidance.join("\n"), "Set up Clerk");
+    return;
   }
+  const { credentials } = result;
+  s.stop(
+    {
+      platform: `Clerk application created (${credentials.applicationId ?? "new"})`,
+      "cli-keyless": "Clerk keyless application minted \u2014 claim it at dashboard.clerk.com to keep it",
+      discovered: "Clerk keys found on this machine",
+      manual: "Clerk not configured"
+    }[result.tier]
+  );
+  const written = await mergeEnvLocal(storefront, {
+    NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: credentials.publishableKey,
+    CLERK_SECRET_KEY: credentials.secretKey
+  });
+  if (written.length) info(pc4.dim(`Wrote to .env.local: ${written.join(", ")}`));
+  const { allowedOrigins, redirectUrls } = storefrontClerkUrls(deployedUrl, brand.domain);
+  const configured = await configureClerkInstance(credentials.secretKey, {
+    allowedOrigins,
+    redirectUrls
+  });
+  if (configured.applied.length) info(pc4.dim(`Clerk configured: ${configured.applied.length} settings`));
+  for (const f of configured.failed) info(pc4.yellow(`Clerk ${f.step}: ${f.reason}`));
 }
 async function interactiveSiteCreate() {
   const brand = await promptBrand(CARRIER_BRAND);
@@ -2539,6 +2879,65 @@ program.command("status").description("Show MCP / plugin / auth status and next
   p3.note(oauthFirstUseNote(), "Auth");
   p3.outro("");
 });
+program.command("login").description("Sign in from this terminal. Opens a browser once, then refreshes silently.").action(async () => {
+  header();
+  const s = p3.spinner();
+  s.start("Waiting for browser sign-in");
+  try {
+    const r = await login({
+      openBrowser: (url) => openUrl(url),
+      onUrl: (url) => s.message(`Sign in at ${url.slice(0, 60)}\u2026`)
+    });
+    s.stop(r.ok ? "Signed in" : "Failed");
+    if (!r.ok) {
+      p3.log.error(r.message);
+      process.exitCode = 1;
+      return;
+    }
+    p3.note(
+      [`Scope: ${r.scope ?? "read write"}`, "", "Try it: carrier intelligence fleet-health"].join("\n"),
+      "Signed in"
+    );
+  } catch (e) {
+    s.stop("Failed");
+    p3.log.error(
+      withNextStep(e instanceof Error ? e.message : String(e), [
+        "Check outbound HTTPS to mcp.carrier.llc",
+        "Headless/CI instead: export CARRIER_API_KEY=ak_\u2026"
+      ])
+    );
+    process.exitCode = 1;
+  }
+  p3.outro("");
+});
+program.command("logout").description("Forget the stored sign-in on this machine.").action(async () => {
+  header();
+  await logout();
+  p3.log.success("Signed out.");
+  p3.outro("");
+});
+program.command("whoami").description("Show the account, org and scopes the current credential resolves to.").option("--json", "Print the raw response on stdout and nothing else").action(async (opts) => {
+  if (!opts.json) header();
+  const s = opts.json ? null : p3.spinner();
+  s?.start("Calling environment_info");
+  const r = await callMcpTool("environment_info", {}, {
+    errorHints: ["Sign in first: carrier login", "Or export CARRIER_API_KEY=ak_\u2026"]
+  });
+  s?.stop(r.ok ? "Done" : "Failed");
+  if (!r.ok) {
+    if (opts.json) console.error(r.text);
+    else p3.log.error(r.text);
+    process.exitCode = 1;
+    return;
+  }
+  if (opts.json) {
+    process.stdout.write(`${r.text}
+`);
+    return;
+  }
+  p3.note(r.text, "environment_info");
+  p3.outro("");
+});
 var openCmd = program.command("open").description("Open Carrier account / product URLs in your browser.");
 for (const [name, url, desc] of [
   ["signup", SIGN_UP_URL, "Create a Carrier account (Clerk sign-up)"],
@@ -2638,6 +3037,50 @@ for (const domain of CLI_DOMAINS) {
     });
   }
 }
+program.command("dash [domain]").description(`Render a status screen in the terminal: ${DASH_DOMAINS.join(" | ")}`).option("--json", "Emit the screen model as JSON instead of drawing it").option("--no-color", "Plain text, safe to pipe").option("--width <n>", "Terminal width override").action(async (domain, o) => {
+  const target = domain ?? "fleet";
+  if (!isDashDomain(target)) {
+    fail(`Unknown dashboard "${target}".`, [`Available: ${DASH_DOMAINS.join(", ")}`]);
+    process.exitCode = 1;
+    return;
+  }
+  const tool = DASH_TOOL[target];
+  if (!tool) {
+    fail(`\`carrier dash ${target}\` reads local state, not a tool.`, [
+      "Run it from a storefront directory: carrier site deploy --no-secrets"
+    ]);
+    process.exitCode = 1;
+    return;
+  }
+  if (!o.json) header();
+  const result = await callMcpTool(tool, {}, {
+    errorHints: [`Check auth: carrier status`, `Or ask in words: carrier ask "\u2026"`]
+  });
+  if (!result.ok) {
+    fail(result.text, ["carrier status"]);
+    process.exitCode = 1;
+    return;
+  }
+  let payload;
+  try {
+    payload = JSON.parse(result.text);
+  } catch {
+    payload = void 0;
+  }
+  const screen = screenFromStructured(result.structured) ?? buildDashScreen(target, payload);
+  if (o.json) {
+    process.stdout.write(`${JSON.stringify(screen, null, 2)}
+`);
+    return;
+  }
+  process.stdout.write(
+    `${renderTui(screen, {
+      color: o.color !== false,
+      width: o.width ? Number(o.width) : process.stdout.columns
+    })}
+`
+  );
+});
 var site = program.command("site").description("Scaffold and deploy a white-labeled storefront.");
 site.command("create [dir]").description("Scaffold a white-labeled storefront from the Mango template.").option("--name <name>", "Brand name").option("--domain <domain>", "Domain").option("--accent <hex>", "Accent color").option("--yes", "Carrier defaults, no prompts").action(async (dir, o) => {
   header();
@@ -2681,22 +3124,101 @@ site.command("create [dir]").description("Scaffold a white-labeled storefront fr
   }
   p3.outro(pc4.green(`Scaffolded. cd ${dir ?? "storefront"} && pnpm install && pnpm dev`));
 });
-site.command("deploy [dir]").description("Build + deploy a storefront to Cloudflare Workers.").option("--name <name>", "Cloudflare Worker name (defaults from brand)").action(async (dir, o) => {
-  header();
-  const target = resolve2(dir ?? "./storefront");
-  try {
-    const brand = await loadStorefrontBrand(target, o.name ? { name: o.name } : void 0);
-    await maybeBuildDeploy(target, brand, { install: true, build: true, deploy: true });
-  } catch (e) {
-    fail(String(e instanceof Error ? e.message : e), [
-      "Scaffold first: carrier site create",
-      "Ensure wrangler is logged in for deploy"
-    ]);
-    process.exitCode = 1;
-    return;
+site.command("deploy [dir]").description("Build + deploy a storefront to whichever host is available on this box.").option("--name <name>", "Project/worker name (defaults from brand)").option(`--target <target>`, `Force a host: ${TARGET_IDS.join(" | ")}`).option("--no-secrets", "Skip staging runtime secrets on the host").option("--clerk", "Provision and configure Clerk before building").option("--no-verify", "Skip the post-deploy check that the site actually serves").option("--autofix-agent", "On an unrecognised failure, print an agent-ready diagnosis bundle").option("--domain", "Route the brand domain to the deployment (Cloudflare provisions DNS + cert)").action(
+  async (dir, o) => {
+    header();
+    const target = resolve2(dir ?? "./storefront");
+    if (o.target && !isTargetId(o.target)) {
+      fail(`Unknown target "${o.target}".`, [`Supported: ${TARGET_IDS.join(", ")}`]);
+      process.exitCode = 1;
+      return;
+    }
+    try {
+      const brand = await loadStorefrontBrand(target, o.name ? { name: o.name } : void 0);
+      await maybeBuildDeploy(target, brand, {
+        install: true,
+        build: true,
+        deploy: true,
+        preferred: o.target,
+        pushSecrets: o.secrets !== false,
+        clerk: o.clerk === true,
+        verify: o.verify !== false,
+        autofixAgent: o.autofixAgent === true,
+        customDomain: o.domain === true
+      });
+    } catch (e) {
+      fail(String(e instanceof Error ? e.message : e), [
+        "Scaffold first: carrier site create",
+        "Check host logins: carrier site targets"
+      ]);
+      process.exitCode = 1;
+      return;
+    }
+    p3.outro("");
   }
+);
+site.command("targets [dir]").description("Show which deploy hosts are installed, logged in, and ready.").action(async (dir) => {
+  header();
+  const storefront = resolve2(dir ?? "./storefront");
+  const statuses = await probeAll(storefront);
+  const ranked = rankTargets(statuses);
+  const rows2 = statuses.map((s) => {
+    const mark2 = s.ready ? pc4.green("ready") : pc4.dim("not ready");
+    const detail = s.ready ? [s.account, s.configured ? "configured" : void 0].filter(Boolean).join(", ") : s.reason ?? "";
+    return `${s.label.padEnd(20)} ${mark2}  ${pc4.dim(detail)}`;
+  });
+  p3.note(rows2.join("\n"), "Deploy hosts");
+  info(
+    ranked.length ? pc4.green(`Default on this box: ${ranked[0].label}`) : pc4.yellow("No host is ready \u2014 log in to one, then re-run.")
+  );
   p3.outro("");
 });
+site.command("clerk [dir]").description("Create or discover a Clerk instance and configure it for the storefront.").option("--name <name>", "Application name (defaults from brand)").option("--production", "Also create a production instance (Platform API only)").option("--no-create", "Never create a new application; only reuse existing keys").option("--url <url>", "Deployed URL to whitelist as an origin/redirect").action(
+  async (dir, o) => {
+    header();
+    const storefront = resolve2(dir ?? "./storefront");
+    try {
+      const brand = await loadStorefrontBrand(storefront, o.name ? { name: o.name } : void 0);
+      const result = await provisionClerk({
+        name: o.name ?? brand.name,
+        domain: brand.domain,
+        production: o.production === true,
+        noCreate: o.create === false,
+        env: process.env,
+        storefront,
+        cli: clerkCliDeps()
+      });
+      if (!result.ok || !result.credentials) {
+        if (result.reason) info(pc4.yellow(result.reason));
+        p3.note((result.guidance ?? []).join("\n"), "Set up Clerk");
+        process.exitCode = 1;
+        return;
+      }
+      const written = await mergeEnvLocal(storefront, {
+        NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: result.credentials.publishableKey,
+        CLERK_SECRET_KEY: result.credentials.secretKey
+      });
+      info(
+        result.tier === "platform" ? pc4.green(`Created Clerk application ${result.credentials.applicationId ?? ""}`.trim()) : pc4.green("Reused Clerk keys already on this machine")
+      );
+      if (written.length) info(pc4.dim(`Wrote to .env.local: ${written.join(", ")}`));
+      const { allowedOrigins, redirectUrls } = storefrontClerkUrls(o.url, brand.domain);
+      const configured = await configureClerkInstance(result.credentials.secretKey, {
+        allowedOrigins,
+        redirectUrls
+      });
+      if (configured.applied.length) {
+        p3.note(configured.applied.join("\n"), "Applied to the Clerk instance");
+      }
+      for (const f of configured.failed) info(pc4.yellow(`${f.step}: ${f.reason}`));
+    } catch (e) {
+      fail(String(e instanceof Error ? e.message : e), ["Scaffold first: carrier site create"]);
+      process.exitCode = 1;
+      return;
+    }
+    p3.outro("");
+  }
+);
 site.command("logo [dir]").description("Generate a storefront logo (SVG always; PNG if an image key is on this box or Carrier).").action(async (dir) => {
   header();
   const target = resolve2(dir ?? "./storefront");