@carrierllc/mcp 0.5.0 → 0.7.0

package/dist/{chunk-QZBALDKD.js → chunk-CQ6EOLA7.js}

@@ -4,1795 +4,1795 @@ import {
   writeFile
 } from "./chunk-SHKKVIIA.js";
 
-// ../../packages/screens/dist/index.js
-function isBlankValue(value) {
-  const text = String(value).trim();
-  return text === "" || text === "\u2014" || text === "-" || Number(text) === 0;
+// src/cli/lib/deploy-targets.ts
+import { join } from "path";
+import { tmpdir } from "os";
+import { mkdtemp, rm, writeFile as writeFileMode } from "fs/promises";
+
+// src/cli/lib/exec.ts
+import { spawn } from "child_process";
+var SAFE_COMMAND = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
+function isSafeCommand(cmd) {
+  return SAFE_COMMAND.test(cmd);
 }
-function isEmptyScreen(screen) {
-  return screen.sections.every((section) => {
-    switch (section.kind) {
-      case "metrics":
-        return section.items.every((m) => isBlankValue(m.value));
-      case "bars":
-        return section.items.every((b) => b.value === 0);
-      case "keyvalue":
-        return section.items.every((kv) => isBlankValue(kv.value));
-      case "table":
-        return section.rows.length === 0;
-      case "note":
-        return false;
+function run(cmd, args, opts = {}) {
+  if (!isSafeCommand(cmd)) {
+    return Promise.resolve({
+      ok: false,
+      code: null,
+      stdout: "",
+      stderr: `refusing to run unsafe command: ${cmd}`
+    });
+  }
+  return new Promise((resolve) => {
+    const child = spawn(cmd, args, { cwd: opts.cwd, shell: false });
+    if (opts.stdin !== void 0) {
+      child.stdin?.on("error", () => {
+      });
+      child.stdin?.end(opts.stdin);
+    }
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      resolve(result);
+    };
+    let timer;
+    if (opts.timeoutMs && opts.timeoutMs > 0) {
+      timer = setTimeout(() => {
+        try {
+          child.kill("SIGTERM");
+        } catch {
+        }
+        finish({
+          ok: false,
+          code: null,
+          stdout,
+          stderr: stderr || `timeout after ${opts.timeoutMs}ms`
+        });
+      }, opts.timeoutMs);
     }
+    child.stdout?.on("data", (d) => stdout += d.toString());
+    child.stderr?.on("data", (d) => stderr += d.toString());
+    child.on("error", () => {
+      if (timer) clearTimeout(timer);
+      finish({ ok: false, code: null, stdout, stderr });
+    });
+    child.on("close", (code) => {
+      if (timer) clearTimeout(timer);
+      finish({ ok: code === 0, code, stdout, stderr });
+    });
   });
 }
-var colors = {
-  /** Base page background — deepest ink */
-  backgroundDark: "#080C16",
-  backgroundDarkOklch: "oklch(0.09 0.02 260)",
-  /** Surface elevation ladder — alpha blends, no drop-shadows */
-  surface0: "#080C16",
-  surface1: "rgba(15, 20, 34, 0.80)",
-  surface2: "rgba(22, 28, 46, 0.90)",
-  surface3: "rgba(31, 38, 56, 0.95)",
-  /** Legacy alias — kept for backward compat */
-  surfaceDark: "#0F1422",
-  surfaceCard: "rgba(15, 20, 34, 0.75)",
-  /** Borders */
-  borderCard: "#1F2638",
-  borderMuted: "rgba(255, 255, 255, 0.07)",
-  borderSubtle: "rgba(255, 255, 255, 0.04)",
-  /** Brand accent — Carrier Flame orange (do not replace with violet) */
-  accentFlame: "#FF6B35",
-  accentEmber: "#D9461C",
-  accentSpark: "#FFB088",
-  /** Legacy violet/fuchsia — used on esimmcp co-brand surface only */
-  accentViolet: "#a78bfa",
-  accentFuchsia: "#e879f9",
-  /** Text hierarchy — tight ratio, generous contrast */
-  textPrimary: "#F5F1EA",
-  textSecondary: "#C9CCD6",
-  textMuted: "#8A92A8",
-  textFaint: "#5A6278",
-  /** Status — do not deviate */
-  statusSuccess: "#10b981",
-  statusWarning: "#f59e0b",
-  statusError: "#ef4444",
-  /** Light mode equivalents */
-  light: {
-    background: "#ffffff",
-    backgroundSecondary: "#f8fafc",
-    surfaceCard: "rgba(248, 250, 252, 0.9)",
-    borderCard: "#e2e8f0",
-    textPrimary: "#0f172a",
-    textSecondary: "#475569",
-    textMuted: "#94a3b8"
-  }
-};
-var typography = {
-  fontSans: "var(--font-sans, Inter), system-ui, -apple-system, sans-serif",
-  fontMono: "var(--font-mono, 'JetBrains Mono'), ui-monospace, monospace",
-  fontSerif: "var(--font-serif, Georgia), 'Times New Roman', serif",
-  /** Weights — only these three, per brand guide */
-  weightRegular: "400",
-  weightBold: "700",
-  weightBlack: "900",
-  /** Line heights */
-  lineHeightHeadline: "1.05",
-  lineHeightSubheading: "1.2",
-  lineHeightBody: "1.5",
-  /** Letter spacing — tight on big headlines */
-  trackingTight: "-0.04em",
-  trackingNormal: "0em",
-  trackingWide: "0.05em",
-  /** Type scale (rem) */
-  scale: {
-    xs: "0.75rem",
-    sm: "0.875rem",
-    base: "1rem",
-    lg: "1.125rem",
-    xl: "1.25rem",
-    "2xl": "1.5rem",
-    "3xl": "1.875rem",
-    "4xl": "2.25rem",
-    "5xl": "3rem",
-    "6xl": "3.75rem",
-    "7xl": "4.5rem"
+function runInherit(cmd, args, opts = {}) {
+  if (!isSafeCommand(cmd)) {
+    return Promise.resolve({
+      ok: false,
+      code: null,
+      stdout: "",
+      stderr: `refusing to run unsafe command: ${cmd}`
+    });
   }
-};
-var radius = {
-  sm: "0.375rem",
-  md: "0.5rem",
-  lg: "0.75rem",
-  xl: "1rem",
-  "2xl": "1.5rem",
-  full: "9999px"
-};
-var TONE_COLOR = {
-  ok: colors.statusSuccess,
-  info: colors.accentFlame,
-  warn: colors.statusWarning,
-  critical: colors.statusError,
-  muted: colors.textMuted
-};
-function esc(value) {
-  return String(value).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
-}
-function toneColor(tone, fallback = colors.textPrimary) {
-  return tone ? TONE_COLOR[tone] : fallback;
-}
-function metricsHtml(items) {
-  const cards = items.map(
-    (m) => `
-      <div style="background:${colors.surface1};border:1px solid ${colors.borderCard};border-radius:${radius.lg};padding:16px 18px;min-width:0">
-        <div style="font-size:11px;letter-spacing:.08em;text-transform:uppercase;color:${colors.textMuted}">${esc(m.label)}</div>
-        <div style="font-size:28px;font-weight:600;margin-top:6px;color:${toneColor(m.tone)};line-height:1.1">${esc(m.value)}</div>
-        ${m.hint ? `<div style="font-size:12px;color:${colors.textFaint};margin-top:4px">${esc(m.hint)}</div>` : ""}
-      </div>`
-  ).join("");
-  return `<div style="display:grid;grid-template-columns:repeat(auto-fit,minmax(160px,1fr));gap:12px">${cards}</div>`;
-}
-function barsHtml(items, empty) {
-  if (items.length === 0) return emptyHtml(empty ?? "Nothing to show.");
-  const ceiling = Math.max(...items.map((b) => b.max ?? b.value), 1);
-  const rows = items.map((b) => {
-    const pct2 = Math.max(0, Math.min(100, (b.value / (b.max ?? ceiling) || 0) * 100));
-    return `
-      <div style="margin-bottom:10px">
-        <div style="display:flex;justify-content:space-between;font-size:13px;color:${colors.textSecondary};margin-bottom:4px">
-          <span>${esc(b.label)}</span>
-          <span style="color:${colors.textMuted}">${esc(b.hint ?? b.value)}</span>
-        </div>
-        <div style="height:8px;background:${colors.surface2};border-radius:${radius.full};overflow:hidden">
-          <div style="height:100%;width:${pct2.toFixed(1)}%;background:${toneColor(b.tone, colors.accentFlame)}"></div>
-        </div>
-      </div>`;
-  }).join("");
-  return `<div>${rows}</div>`;
-}
-function tableHtml(section) {
-  if (section.rows.length === 0) return emptyHtml(section.empty ?? "No rows.");
-  const numeric = new Set(section.numeric ?? []);
-  const head = section.columns.map(
-    (c, i) => `<th style="text-align:${numeric.has(i) ? "right" : "left"};padding:8px 12px;font-size:11px;letter-spacing:.08em;text-transform:uppercase;color:${colors.textMuted};border-bottom:1px solid ${colors.borderCard};white-space:nowrap">${esc(c)}</th>`
-  ).join("");
-  const body = section.rows.map(
-    (row) => `<tr>${row.map(
-      (cell, i) => `<td style="text-align:${numeric.has(i) ? "right" : "left"};padding:8px 12px;font-size:13px;color:${colors.textSecondary};border-bottom:1px solid ${colors.borderSubtle};white-space:nowrap">${esc(cell)}</td>`
-    ).join("")}</tr>`
-  ).join("");
-  return `<div style="overflow-x:auto"><table style="width:100%;border-collapse:collapse">${`<thead><tr>${head}</tr></thead>`}<tbody>${body}</tbody></table></div>`;
-}
-function keyValueHtml(items) {
-  const rows = items.map(
-    (kv) => `
-      <div style="display:flex;justify-content:space-between;gap:16px;padding:7px 0;border-bottom:1px solid ${colors.borderSubtle}">
-        <span style="font-size:13px;color:${colors.textMuted}">${esc(kv.label)}</span>
-        <span style="font-size:13px;color:${toneColor(kv.tone, colors.textPrimary)};text-align:right">${esc(kv.value)}</span>
-      </div>`
-  ).join("");
-  return `<div>${rows}</div>`;
+  return new Promise((resolve) => {
+    const child = spawn(cmd, args, { cwd: opts.cwd, shell: false, stdio: "inherit" });
+    child.on("error", () => resolve({ ok: false, code: null, stdout: "", stderr: "" }));
+    child.on("close", (code) => resolve({ ok: code === 0, code, stdout: "", stderr: "" }));
+  });
 }
-function noteHtml(tone, text) {
-  const c = toneColor(tone, colors.accentFlame);
-  return `<div style="border-left:3px solid ${c};background:${colors.surface1};padding:10px 14px;border-radius:${radius.md};font-size:13px;color:${colors.textSecondary}">${esc(text)}</div>`;
+async function which(bin) {
+  const probe2 = process.platform === "win32" ? "where" : "which";
+  const r = await run(probe2, [bin]);
+  return r.ok && r.stdout.trim().length > 0;
 }
-function emptyHtml(text) {
-  return `<div style="padding:14px;border:1px dashed ${colors.borderCard};border-radius:${radius.md};font-size:13px;color:${colors.textMuted}">${esc(text)}</div>`;
+
+// src/cli/lib/deploy-targets.ts
+var TARGET_IDS = ["cloudflare", "vercel", "netlify", "fly"];
+function isTargetId(v) {
+  return TARGET_IDS.includes(v);
 }
-function sectionHtml(section) {
-  const title = "title" in section && section.title ? `<h2 style="font-size:13px;font-weight:600;letter-spacing:.04em;color:${colors.textPrimary};margin:0 0 10px">${esc(section.title)}</h2>` : "";
-  let body;
-  switch (section.kind) {
-    case "metrics":
-      body = metricsHtml(section.items);
-      break;
-    case "bars":
-      body = barsHtml(section.items, section.empty);
-      break;
-    case "table":
-      body = tableHtml(section);
-      break;
-    case "keyvalue":
-      body = keyValueHtml(section.items);
-      break;
-    case "note":
-      body = noteHtml(section.tone, section.text);
-      break;
+var DEFS = {
+  cloudflare: {
+    id: "cloudflare",
+    label: "Cloudflare Workers",
+    bin: "wrangler",
+    npxPkg: "wrangler",
+    markers: ["wrangler.jsonc", "wrangler.json", "wrangler.toml"],
+    buildScript: "cf:build",
+    artifact: join(".open-next", "worker.js"),
+    whoami: ["whoami"],
+    loginHint: "wrangler login",
+    // wrangler writes this mid-sentence, so the trailing period is not part of it.
+    parseAccount: (stdout, stderr) => `${stdout}${stderr}`.match(/associated with the email\s+(\S+?)[.,]?(?:\s|$)/)?.[1],
+    deployArgs: (name) => ["deploy", "--name", name],
+    secretArgs: (key, value, name) => ({ args: ["secret", "put", key, "--name", name], stdin: value })
+  },
+  vercel: {
+    id: "vercel",
+    label: "Vercel",
+    bin: "vercel",
+    npxPkg: "vercel",
+    markers: ["vercel.json", ".vercel"],
+    buildScript: "build",
+    whoami: ["whoami"],
+    loginHint: "vercel login",
+    // The username is the only thing on stdout; the version banner goes to stderr.
+    parseAccount: (stdout) => stdout.trim().split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith(">") && !/^Vercel CLI/i.test(l)).pop(),
+    deployArgs: () => ["deploy", "--prod", "--yes"],
+    secretArgs: (key, value) => ({ args: ["env", "add", key, "production", "--force"], stdin: value })
+  },
+  netlify: {
+    id: "netlify",
+    label: "Netlify",
+    bin: "netlify",
+    npxPkg: "netlify-cli",
+    markers: ["netlify.toml"],
+    buildScript: "build",
+    whoami: ["status"],
+    loginHint: "netlify login",
+    parseAccount: (stdout, stderr) => `${stdout}${stderr}`.match(/Email:\s*(\S+)/)?.[1],
+    deployArgs: () => ["deploy", "--build", "--prod"],
+    ensureConfig: async (storefront) => {
+      const path = join(storefront, "netlify.toml");
+      if (await exists(path)) return;
+      await writeFile(
+        path,
+        [
+          "# Written by @carrierllc/mcp",
+          "[build]",
+          '  command = "npm run build"',
+          '  publish = ".next"',
+          "",
+          "[[plugins]]",
+          '  package = "@netlify/plugin-nextjs"',
+          ""
+        ].join("\n")
+      );
+    },
+    secretArgs: (key, value) => ({ args: ["env:set", key, value] })
+  },
+  fly: {
+    id: "fly",
+    label: "Fly.io",
+    bin: "flyctl",
+    npxPkg: "",
+    markers: ["fly.toml"],
+    buildScript: "build",
+    whoami: ["auth", "whoami"],
+    loginHint: "flyctl auth login",
+    parseAccount: (out) => out.trim().split("\n").pop()?.trim(),
+    deployArgs: () => ["deploy", "--now"],
+    ensureConfig: async (storefront, projectName) => {
+      const toml = join(storefront, "fly.toml");
+      if (!await exists(toml)) {
+        await writeFile(
+          toml,
+          [
+            "# Written by @carrierllc/mcp",
+            `app = "${projectName}"`,
+            "",
+            "[build]",
+            '  dockerfile = "Dockerfile"',
+            "",
+            "[http_service]",
+            "  internal_port = 3000",
+            "  force_https = true",
+            "  auto_stop_machines = true",
+            "  auto_start_machines = true",
+            ""
+          ].join("\n")
+        );
+      }
+      const dockerfile = join(storefront, "Dockerfile");
+      if (!await exists(dockerfile)) {
+        await writeFile(
+          dockerfile,
+          [
+            "# Written by @carrierllc/mcp",
+            "FROM node:22-slim AS build",
+            "WORKDIR /app",
+            "COPY package*.json ./",
+            "RUN npm install",
+            "COPY . .",
+            "RUN npm run build",
+            "",
+            "FROM node:22-slim",
+            "WORKDIR /app",
+            "ENV NODE_ENV=production PORT=3000",
+            "COPY --from=build /app ./",
+            "EXPOSE 3000",
+            'CMD ["npm", "run", "start"]',
+            ""
+          ].join("\n")
+        );
+      }
+    },
+    secretArgs: (key, value) => ({ args: ["secrets", "set", `${key}=${value}`] })
   }
-  return `<section style="margin-bottom:22px">${title}${body}</section>`;
-}
-function renderHtml(screen) {
-  const sections = isEmptyScreen(screen) ? emptyHtml(
-    "No data came back for this view. That is a real result, not a loading state \u2014 check the account scope and credentials."
-  ) : screen.sections.map(sectionHtml).join("");
-  const actions = screen.actions?.length ? `<section style="margin-top:6px;display:flex;flex-wrap:wrap;gap:8px">${screen.actions.map(
-    (a) => `<span title="${esc(a.description ?? a.command)}" style="font-size:12px;color:${colors.textSecondary};background:${colors.surface2};border:1px solid ${colors.borderCard};border-radius:${radius.full};padding:6px 12px">${esc(a.label)} <code style="color:${colors.textFaint}">${esc(a.command)}</code></span>`
-  ).join("")}</section>` : "";
-  return `<!doctype html>
-<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
-<title>${esc(screen.title)}</title></head>
-<body style="margin:0;background:${colors.surface0};color:${colors.textPrimary};font-family:${typography.fontSans};padding:20px">
-  <header style="margin-bottom:20px">
-    <h1 style="font-size:18px;font-weight:600;margin:0;letter-spacing:-.01em">${esc(screen.title)}</h1>
-    ${screen.subtitle ? `<p style="margin:4px 0 0;font-size:13px;color:${colors.textMuted}">${esc(screen.subtitle)}</p>` : ""}
-  </header>
-  ${sections}
-  ${actions}
-  ${screen.footer ? `<footer style="margin-top:18px;font-size:11px;color:${colors.textFaint}">${esc(screen.footer)}</footer>` : ""}
-</body></html>`;
-}
-var ANSI = {
-  ok: "\x1B[32m",
-  info: "\x1B[38;5;209m",
-  // Carrier flame, nearest 256-colour
-  warn: "\x1B[33m",
-  critical: "\x1B[31m",
-  muted: "\x1B[90m",
-  reset: "\x1B[0m",
-  bold: "\x1B[1m",
-  dim: "\x1B[2m"
 };
-function paint(text, code, color) {
-  return color ? `${code}${text}${ANSI.reset}` : text;
-}
-function displayWidth(text) {
-  return text.replace(/\[[0-9;]*m/g, "").length;
+async function configuredProjectName(id, storefront) {
+  if (id !== "cloudflare") return void 0;
+  for (const marker of DEFS.cloudflare.markers) {
+    const path = join(storefront, marker);
+    if (!await exists(path)) continue;
+    const body = await readFileText(path);
+    const name = body.match(/^\s*"?name"?\s*:\s*"([^"]+)"/m)?.[1];
+    if (name) return name;
+  }
+  return void 0;
 }
-function pad(text, width, align) {
-  const gap = Math.max(0, width - displayWidth(text));
-  return align === "right" ? " ".repeat(gap) + text : text + " ".repeat(gap);
+async function setCustomDomain(storefront, domain) {
+  const clean = domain.replace(/^https?:\/\//, "").replace(/\/$/, "");
+  if (!clean || !clean.includes(".")) return false;
+  const path = join(storefront, "wrangler.jsonc");
+  if (!await exists(path)) return false;
+  const body = await readFileText(path);
+  if (body.includes(`"pattern": "${clean}"`)) return true;
+  const routes = `  "routes": [
+    { "pattern": "${clean}", "custom_domain": true }
+  ],
+`;
+  const anchor = body.indexOf(`"main"`);
+  if (anchor === -1) return false;
+  const lineStart = body.lastIndexOf("\n", anchor) + 1;
+  const patched = body.slice(0, lineStart) + routes + body.slice(lineStart);
+  await writeFile(path, patched);
+  return true;
 }
-function heading(text, color) {
-  return paint(text.toUpperCase(), ANSI.bold, color);
+async function readFileText(path) {
+  const { readFile: readFile2 } = await import("./fsx-BDDIQ3Y7.js");
+  return readFile2(path, "utf8");
 }
-function metricsTui(items, width, color) {
-  if (items.length === 0) return [];
-  const labelWidth = Math.min(
-    28,
-    Math.max(...items.map((m) => m.label.length))
+async function rollback(id, storefront, projectName) {
+  if (id !== "cloudflare") {
+    return { ok: false, reason: `${DEFS[id].label} has no one-command rollback \u2014 revert manually.` };
+  }
+  const def = DEFS[id];
+  const resolved = await resolveBin(def);
+  if (!resolved) return { ok: false, reason: "wrangler not found." };
+  const r = await run(
+    resolved.bin,
+    [...resolved.prefix, "rollback", "--name", projectName, "--yes"],
+    { cwd: storefront, timeoutMs: 3e5 }
   );
-  return items.map((m) => {
-    const label = paint(pad(m.label, labelWidth, "left"), ANSI.muted, color);
-    const value = paint(String(m.value), m.tone ? ANSI[m.tone] : ANSI.bold, color);
-    const hint = m.hint ? paint(`  ${m.hint}`, ANSI.dim, color) : "";
-    return `  ${label}  ${value}${hint}`.slice(0, width + 64);
-  });
+  return r.ok ? { ok: true } : { ok: false, reason: `${r.stderr || r.stdout}`.trim().split("\n").slice(-2).join(" ").slice(0, 300) };
 }
-function barsTui(items, width, color, empty) {
-  if (items.length === 0) return [`  ${paint(empty ?? "Nothing to show.", ANSI.muted, color)}`];
-  const ceiling = Math.max(...items.map((b) => b.max ?? b.value), 1);
-  const labelWidth = Math.min(24, Math.max(...items.map((b) => b.label.length)));
-  const barWidth = Math.max(10, Math.min(40, width - labelWidth - 22));
-  return items.map((b) => {
-    const ratio = b.value / (b.max ?? ceiling) || 0;
-    const filled = Math.max(0, Math.min(barWidth, Math.round(ratio * barWidth)));
-    const bar = paint("\u2588".repeat(filled), b.tone ? ANSI[b.tone] : ANSI.info, color) + paint("\u2591".repeat(barWidth - filled), ANSI.dim, color);
-    const label = paint(pad(b.label, labelWidth, "left"), ANSI.muted, color);
-    const value = paint(String(b.hint ?? b.value), ANSI.dim, color);
-    return `  ${label}  ${bar}  ${value}`;
-  });
+async function resolveBin(def) {
+  if (await which(def.bin)) return { bin: def.bin, prefix: [] };
+  if (def.npxPkg && await which("npx")) return { bin: "npx", prefix: [def.npxPkg] };
+  return void 0;
 }
-function tableTui(section, width, color) {
-  if (section.rows.length === 0) {
-    return [`  ${paint(section.empty ?? "No rows.", ANSI.muted, color)}`];
+async function probeTarget(id, storefront) {
+  const def = DEFS[id];
+  let configured = false;
+  for (const marker of def.markers) {
+    if (await exists(join(storefront, marker))) {
+      configured = true;
+      break;
+    }
   }
-  const numeric = new Set(section.numeric ?? []);
-  const cols = section.columns.length;
-  const widths = Array.from(
-    { length: cols },
-    (_, i) => Math.max(
-      section.columns[i]?.length ?? 0,
-      ...section.rows.map((r) => String(r[i] ?? "").length)
-    )
-  );
-  let total = widths.reduce((a, b) => a + b + 2, 2);
-  while (total > width && Math.max(...widths) > 8) {
-    const widest = widths.indexOf(Math.max(...widths));
-    widths[widest] -= 1;
-    total -= 1;
+  const resolved = await resolveBin(def);
+  if (!resolved) {
+    return {
+      id,
+      label: def.label,
+      installed: false,
+      authenticated: false,
+      configured,
+      ready: false,
+      reason: def.npxPkg ? `${def.bin} not found \u2014 install it, or make npx available.` : `${def.bin} not found \u2014 install the Fly CLI (brew install flyctl).`
+    };
   }
-  const clip = (cell, i) => {
-    const text = String(cell ?? "");
-    return text.length > widths[i] ? `${text.slice(0, Math.max(1, widths[i] - 1))}\u2026` : text;
+  const who = await run(resolved.bin, [...resolved.prefix, ...def.whoami], {
+    cwd: storefront,
+    timeoutMs: 6e4
+  });
+  if (!who.ok) {
+    return {
+      id,
+      label: def.label,
+      installed: true,
+      authenticated: false,
+      configured,
+      ready: false,
+      reason: `${def.bin} is not logged in \u2014 run \`${def.loginHint}\`.`
+    };
+  }
+  return {
+    id,
+    label: def.label,
+    installed: true,
+    authenticated: true,
+    configured,
+    ready: true,
+    account: def.parseAccount?.(who.stdout, who.stderr)
   };
-  const header = "  " + section.columns.map((c, i) => paint(pad(clip(c, i), widths[i], numeric.has(i) ? "right" : "left"), ANSI.muted, color)).join("  ");
-  const rule = "  " + paint(widths.map((w) => "\u2500".repeat(w)).join("  "), ANSI.dim, color);
-  const body = section.rows.map(
-    (row) => "  " + row.map((cell, i) => pad(clip(cell, i), widths[i], numeric.has(i) ? "right" : "left")).join("  ")
-  );
-  return [header, rule, ...body];
 }
-function keyValueTui(items, color) {
-  if (items.length === 0) return [];
-  const labelWidth = Math.min(30, Math.max(...items.map((kv) => kv.label.length)));
-  return items.map(
-    (kv) => `  ${paint(pad(kv.label, labelWidth, "left"), ANSI.muted, color)}  ${paint(kv.value, kv.tone ? ANSI[kv.tone] : ANSI.reset, color)}`
-  );
+async function probeAll(storefront) {
+  return Promise.all(TARGET_IDS.map((id) => probeTarget(id, storefront)));
 }
-var NOTE_PREFIX = {
-  ok: "ok",
-  info: "note",
-  warn: "warning",
-  critical: "critical",
-  muted: "note"
-};
-function sectionTui(section, width, color) {
-  const lines = [];
-  if ("title" in section && section.title) lines.push(heading(section.title, color));
-  switch (section.kind) {
-    case "metrics":
-      lines.push(...metricsTui(section.items, width, color));
-      break;
-    case "bars":
-      lines.push(...barsTui(section.items, width, color, section.empty));
-      break;
-    case "table":
-      lines.push(...tableTui(section, width, color));
-      break;
-    case "keyvalue":
-      lines.push(...keyValueTui(section.items, color));
-      break;
-    case "note":
-      lines.push(
-        `  ${paint(`${NOTE_PREFIX[section.tone]}:`, ANSI[section.tone], color)} ${section.text}`
-      );
-      break;
-  }
-  lines.push("");
-  return lines;
+function rankTargets(statuses) {
+  return statuses.filter((s) => s.ready).sort((a, b) => {
+    if (a.configured !== b.configured) return a.configured ? -1 : 1;
+    return TARGET_IDS.indexOf(a.id) - TARGET_IDS.indexOf(b.id);
+  });
 }
-function renderTui(screen, opts = {}) {
-  const width = Math.max(40, Math.min(160, opts.width ?? 80));
-  const color = opts.color ?? true;
-  const lines = [];
-  lines.push(paint(screen.title, ANSI.bold, color));
-  if (screen.subtitle) lines.push(paint(screen.subtitle, ANSI.muted, color));
-  lines.push(paint("\u2500".repeat(width), ANSI.dim, color));
-  lines.push("");
-  if (isEmptyScreen(screen)) {
-    lines.push(
-      `  ${paint("No data came back for this view.", ANSI.warn, color)} That is a real result, not a`,
-      "  loading state \u2014 check the account scope and credentials.",
-      ""
-    );
-  } else {
-    for (const section of screen.sections) lines.push(...sectionTui(section, width, color));
-  }
-  if (screen.actions?.length) {
-    lines.push(heading("next", color));
-    for (const a of screen.actions) {
-      lines.push(`  ${paint(a.command, ANSI.info, color)}  ${paint(a.label, ANSI.dim, color)}`);
-    }
-    lines.push("");
-  }
-  if (screen.footer) lines.push(paint(screen.footer, ANSI.dim, color));
-  return lines.join("\n");
+function buildScriptFor(id) {
+  return DEFS[id].buildScript;
 }
-var pct = (part, total) => total > 0 ? `${(part / total * 100).toFixed(1)}%` : "0%";
-var money = (value, currency = "") => `${currency}${value.toFixed(2)}`.trim();
-function humanBytes(bytes) {
-  if (!Number.isFinite(bytes) || bytes <= 0) return "0 MB";
-  const gb = bytes / 1073741824;
-  if (gb >= 1) return `${gb.toFixed(gb >= 10 ? 0 : 1)} GB`;
-  return `${(bytes / 1048576).toFixed(0)} MB`;
+async function artifactMissing(id, storefront) {
+  const artifact = DEFS[id].artifact;
+  if (!artifact) return false;
+  return !await exists(join(storefront, artifact));
 }
-function fleetScreen(input) {
-  const total = input.active + input.suspended + input.inventory + input.other;
-  const lowBalance = input.accounts.filter((a) => a.balance < 10);
-  const criticals = lowBalance.filter((a) => a.packageOnly && a.balance === 0);
-  const sections = [
-    {
-      kind: "metrics",
-      items: [
-        { label: "Total eSIMs", value: total },
-        { label: "Active", value: input.active, hint: pct(input.active, total), tone: "ok" },
-        { label: "Inventory", value: input.inventory, hint: pct(input.inventory, total) },
-        {
-          label: "Suspended",
-          value: input.suspended,
-          hint: pct(input.suspended, total),
-          tone: input.suspended > input.active * 0.1 ? "warn" : void 0
-        },
-        { label: "Accounts", value: input.accounts.length },
-        {
-          label: "Low balance",
-          value: lowBalance.length,
-          tone: lowBalance.length > 0 ? "warn" : "ok"
-        }
-      ]
-    }
-  ];
-  const hasPerAccountCounts = input.accounts.some(
-    (a) => a.active + a.suspended + a.inventory + a.other > 0
-  );
-  if (hasPerAccountCounts) {
-    sections.push({
-      kind: "bars",
-      title: "eSIMs by account",
-      items: [...input.accounts].sort((a, b) => b.active + b.inventory - (a.active + a.inventory)).slice(0, 10).map((a) => ({
-        label: a.name,
-        value: a.active + a.suspended + a.inventory + a.other,
-        hint: `${a.active} active`,
-        tone: a.active > 0 ? "ok" : "muted"
-      }))
-    });
-  }
-  sections.push({
-    kind: "table",
-    title: "Accounts",
-    columns: ["Account", "Balance", "Active", "Inventory"],
-    numeric: [1, 2, 3],
-    empty: "No accounts under this reseller.",
-    rows: input.accounts.map((a) => [a.name, money(a.balance), a.active, a.inventory])
+function parseDeployedUrl(output) {
+  return output.match(
+    /https:\/\/[^\s"']+\.(?:workers\.dev|vercel\.app|netlify\.app|fly\.dev)[^\s"']*/
+  )?.[0];
+}
+async function putSecret(id, storefront, projectName, key, value) {
+  const def = DEFS[id];
+  const resolved = await resolveBin(def);
+  if (!resolved) return false;
+  const { args, stdin } = def.secretArgs(key, value, projectName);
+  const r = await run(resolved.bin, [...resolved.prefix, ...args], {
+    cwd: storefront,
+    timeoutMs: 12e4,
+    stdin
   });
-  if (criticals.length > 0) {
-    sections.push({
-      kind: "note",
-      tone: "critical",
-      text: `${criticals.length} package-only account(s) at zero balance \u2014 packages cannot be assigned until topped up: ${criticals.map((a) => a.name).join(", ")}.`
+  return r.ok;
+}
+async function stageSecrets(id, storefront, projectName, secrets) {
+  const entries = Object.entries(secrets).filter(([, v]) => v?.trim());
+  const noop = { staged: [], failed: [], cleanup: async () => {
+  } };
+  if (entries.length === 0) return noop;
+  const def = DEFS[id];
+  const resolved = await resolveBin(def);
+  if (!resolved) return { staged: [], failed: entries.map(([k]) => k), cleanup: async () => {
+  } };
+  if (id === "cloudflare") {
+    const dir = await mkdtemp(join(tmpdir(), "carrier-secrets-"));
+    const file = join(dir, ".env");
+    const body = entries.map(([k, v]) => `${k}=${v}`).join("\n");
+    await writeFileMode(file, `${body}
+`, { mode: 384 });
+    return {
+      staged: entries.map(([k]) => k),
+      failed: [],
+      secretsFile: file,
+      cleanup: async () => {
+        await rm(dir, { recursive: true, force: true });
+      }
+    };
+  }
+  if (id === "fly") {
+    const args = ["secrets", "set", "--stage", ...entries.map(([k, v]) => `${k}=${v}`)];
+    const r = await run(resolved.bin, [...resolved.prefix, ...args], {
+      cwd: storefront,
+      timeoutMs: 18e4
     });
+    return {
+      staged: r.ok ? entries.map(([k]) => k) : [],
+      failed: r.ok ? [] : entries.map(([k]) => k),
+      cleanup: async () => {
+      }
+    };
   }
-  for (const missing of input.unavailable ?? []) {
-    sections.push({ kind: "note", tone: "warn", text: `Unavailable: ${missing}` });
+  const staged = [];
+  const failed = [];
+  for (const [key, value] of entries) {
+    const ok = await putSecret(id, storefront, projectName, key, value);
+    (ok ? staged : failed).push(key);
   }
-  return {
-    id: "fleet-health",
-    title: "Fleet health",
-    subtitle: `${total} eSIMs across ${input.accounts.length} account(s) \xB7 ${pct(input.active, total)} utilisation`,
-    sections,
-    actions: [
-      { label: "Top up an account", command: "wallet_topup_checkout" },
-      { label: "Per-account eSIM status", command: "esim_status_per_account" }
-    ]
-  };
-}
-function subscribersScreen(rows, opts = {}) {
-  const byStatus = /* @__PURE__ */ new Map();
-  for (const r of rows) byStatus.set(r.status, (byStatus.get(r.status) ?? 0) + 1);
-  return {
-    id: "subscribers",
-    title: "Subscribers",
-    subtitle: opts.account ? `Account ${opts.account} \xB7 ${rows.length} shown` : `${rows.length} shown`,
-    sections: [
-      {
-        kind: "metrics",
-        items: [
-          { label: "Listed", value: rows.length },
-          ...[...byStatus.entries()].map(([status, count]) => ({
-            label: status,
-            value: count,
-            tone: status.toLowerCase() === "active" ? "ok" : void 0
-          }))
-        ]
-      },
-      {
-        kind: "table",
-        title: "Records",
-        columns: ["ICCID", "MSISDN", "Status", "Account", "Data used"],
-        numeric: [4],
-        empty: "No subscribers matched. Widen the filter or check the account scope.",
-        rows: rows.map((r) => [
-          r.iccid,
-          r.msisdn ?? "\u2014",
-          r.status,
-          r.account ?? "\u2014",
-          r.dataUsedBytes === void 0 ? "\u2014" : humanBytes(r.dataUsedBytes)
-        ])
-      }
-    ],
-    actions: [
-      { label: "Diagnose one", command: "diagnose_subscriber" },
-      { label: "Usage detail", command: "subscriber_usage" }
-    ]
-  };
+  return { staged, failed, cleanup: async () => {
+  } };
 }
-function usageScreen(input) {
-  const total = input.totalBytes ?? input.timeline.reduce((sum, p) => sum + p.bytes, 0);
-  const peak = input.timeline.reduce(
-    (best, p) => p.bytes > best.bytes ? p : best,
-    { date: "\u2014", bytes: 0 }
-  );
-  const sections = [
-    {
-      kind: "metrics",
-      items: [
-        { label: "Total", value: humanBytes(total) },
-        { label: "Days", value: input.timeline.length },
-        { label: "Peak day", value: humanBytes(peak.bytes), hint: peak.date },
-        {
-          label: "Daily average",
-          value: humanBytes(input.timeline.length ? total / input.timeline.length : 0)
-        }
-      ]
-    },
-    {
-      kind: "bars",
-      title: "Daily usage",
-      empty: "No usage recorded in this window.",
-      items: input.timeline.map((p) => ({
-        label: p.date,
-        value: p.bytes,
-        hint: humanBytes(p.bytes)
-      }))
-    }
-  ];
-  if (input.countries?.length) {
-    sections.push({
-      kind: "bars",
-      title: "By country",
-      items: input.countries.slice(0, 10).map((c) => ({ label: c.country, value: c.bytes, hint: humanBytes(c.bytes) }))
-    });
+async function deployTo(id, storefront, projectName, opts = {}) {
+  const def = DEFS[id];
+  const resolved = await resolveBin(def);
+  if (!resolved) {
+    return { ok: false, target: id, projectName, reason: `${def.bin} not found.` };
   }
-  return {
-    id: "usage",
-    title: "Usage",
-    subtitle: input.subject,
-    sections,
-    actions: [{ label: "Project depletion", command: "usage_projection" }]
-  };
+  await def.ensureConfig?.(storefront, projectName);
+  if (await artifactMissing(id, storefront)) {
+    return {
+      ok: false,
+      target: id,
+      projectName,
+      reason: `No ${def.artifact} build found \u2014 run the build step first.`
+    };
+  }
+  const args = [...resolved.prefix, ...def.deployArgs(projectName)];
+  if (id === "cloudflare" && opts.secretsFile) args.push("--secrets-file", opts.secretsFile);
+  const r = await run(resolved.bin, args, {
+    cwd: storefront,
+    timeoutMs: 9e5
+  });
+  const combined = `${r.stdout}${r.stderr}`;
+  if (!r.ok) {
+    const tail = combined.trim().split("\n").slice(-3).join(" ").slice(0, 400);
+    return { ok: false, target: id, projectName, reason: tail || `${def.bin} deploy failed.` };
+  }
+  return { ok: true, target: id, projectName, url: parseDeployedUrl(combined) };
 }
-function packagesScreen(rows) {
-  return {
-    id: "packages",
-    title: "Package catalog",
-    subtitle: `${rows.length} template(s)`,
-    sections: [
-      {
-        kind: "metrics",
-        items: [
-          { label: "Templates", value: rows.length },
-          { label: "Recurring", value: rows.filter((r) => r.recurring).length }
-        ]
-      },
-      {
-        kind: "table",
-        title: "Templates",
-        columns: ["Name", "ID", "Data", "Validity", "Price"],
-        numeric: [2, 3, 4],
-        empty: "No package templates visible to this account.",
-        rows: rows.map((r) => [
-          r.name,
-          String(r.id),
-          r.dataLimitBytes === void 0 ? "\u2014" : humanBytes(r.dataLimitBytes),
-          r.validityDays === void 0 ? "\u2014" : `${r.validityDays}d`,
-          r.price === void 0 ? "\u2014" : money(r.price)
-        ])
-      }
-    ],
-    actions: [{ label: "Assign to a subscriber", command: "assign_package" }]
-  };
+
+// src/cli/lib/brand.ts
+var CARRIER_BRAND = {
+  name: "Carrier",
+  legalName: "Lifecycle Innovations Limited",
+  tagline: "Programmable connectivity, on demand.",
+  domain: "carrier.llc",
+  supportEmail: "support@carrier.llc",
+  supportUrl: "https://carrier.llc/help",
+  supportWhatsapp: "+17864604829",
+  colors: {
+    bg: "#080C16",
+    accent: "#FF6B35",
+    accentDark: "#D9461C",
+    text: "#F5F1EA"
+  },
+  social: {
+    x: "@carrier_llc",
+    instagram: "@carrier.llc",
+    tiktok: "@carrier.llc"
+  },
+  carrierApiUrl: "https://api.carrier.llc"
+};
+var CARRIER_ACCENT_LIGHT = "#FFB088";
+var CARRIER_ACCENT_GRADIENT_START = "#FF7A45";
+function hexToRgb(hex) {
+  const h = hex.replace(/^#/, "");
+  if (!/^[0-9a-fA-F]{6}$/.test(h)) return null;
+  return [parseInt(h.slice(0, 2), 16), parseInt(h.slice(2, 4), 16), parseInt(h.slice(4, 6), 16)];
 }
-function billingScreen(input) {
-  const spend = input.events.reduce((sum, e) => sum + (e.amount > 0 ? e.amount : 0), 0);
-  return {
-    id: "billing",
-    title: "Billing",
-    subtitle: `${input.events.length} recent event(s)`,
-    sections: [
-      {
-        kind: "metrics",
-        items: [
-          {
-            label: "Balance",
-            value: input.balance === void 0 ? "\u2014" : money(input.balance, input.currency),
-            tone: (input.balance ?? 0) < 10 ? "warn" : "ok"
-          },
-          {
-            label: "Pending",
-            value: input.pending === void 0 ? "\u2014" : money(input.pending, input.currency)
-          },
-          { label: "Recent spend", value: money(spend, input.currency) }
-        ]
-      },
-      {
-        kind: "table",
-        title: "Recent events",
-        columns: ["Date", "Description", "Amount"],
-        numeric: [2],
-        empty: "No billing events in this window.",
-        rows: input.events.map((e) => [e.date, e.description, money(e.amount, input.currency)])
-      }
-    ],
-    actions: [{ label: "Check payouts", command: "stripe_connect_payouts" }]
-  };
+function rgbToHex(r, g, b, lower = false) {
+  const fmt = (n) => Math.max(0, Math.min(255, Math.round(n))).toString(16).padStart(2, "0");
+  const out = `#${fmt(r)}${fmt(g)}${fmt(b)}`;
+  return lower ? out : out.toUpperCase();
 }
-function walletScreen(input) {
-  const low = input.balance < (input.threshold ?? 10);
-  return {
-    id: "wallet",
-    title: "Wallet",
-    subtitle: input.autoTopupEnabled ? "Auto top-up is on" : "Auto top-up is off",
-    sections: [
-      {
-        kind: "metrics",
-        items: [
-          {
-            label: "Balance",
-            value: money(input.balance, input.currency),
-            tone: low ? "warn" : "ok"
-          },
-          ...input.credits === void 0 ? [] : [{ label: "Credits", value: input.credits }]
-        ]
-      },
-      {
-        kind: "keyvalue",
-        title: "Settings",
-        items: [
-          { label: "Auto top-up", value: input.autoTopupEnabled ? "enabled" : "disabled" },
-          {
-            label: "Threshold",
-            value: input.threshold === void 0 ? "\u2014" : money(input.threshold, input.currency)
-          }
-        ]
-      },
-      ...low ? [
-        {
-          kind: "note",
-          tone: "warn",
-          text: "Balance is under the top-up threshold. Package assignment fails at zero on package-only accounts."
-        }
-      ] : []
-    ],
-    actions: [
-      { label: "Top up", command: "wallet_topup_checkout" },
-      { label: "Configure auto top-up", command: "wallet_auto_topup" }
-    ]
-  };
+function mixHexWithWhite(hex, whiteRatio) {
+  const rgb = hexToRgb(hex);
+  if (!rgb) return hex;
+  const mix2 = (n) => n + (255 - n) * whiteRatio;
+  return rgbToHex(mix2(rgb[0]), mix2(rgb[1]), mix2(rgb[2]));
+}
+function darkenHex(hex, factor) {
+  const rgb = hexToRgb(hex);
+  if (!rgb) return hex;
+  const scale = (n) => n * factor;
+  return rgbToHex(scale(rgb[0]), scale(rgb[1]), scale(rgb[2]), true);
+}
+function deriveAccentDark(accent, seed = CARRIER_BRAND) {
+  if (accent.toUpperCase() === seed.colors.accent.toUpperCase()) return seed.colors.accentDark;
+  const rgb = hexToRgb(accent);
+  if (!rgb) return accent;
+  const scale = (n) => Math.max(0, Math.min(255, Math.round(n * 0.75)));
+  return rgbToHex(scale(rgb[0]), scale(rgb[1]), scale(rgb[2]));
 }
-function greenzoneScreen(entries) {
-  return {
-    id: "greenzone",
-    title: "Greenzone whitelist",
-    subtitle: `${entries.length} entr${entries.length === 1 ? "y" : "ies"}`,
-    sections: [
-      { kind: "metrics", items: [{ label: "Entries", value: entries.length }] },
-      {
-        kind: "table",
-        title: "Whitelisted",
-        columns: ["Value", "Note"],
-        empty: "Whitelist is empty \u2014 every destination follows the default policy.",
-        rows: entries.map((e) => [e.value, e.note ?? "\u2014"])
-      }
-    ],
-    actions: [
-      { label: "Add an entry", command: "greenzone_whitelist_add" },
-      { label: "Remove an entry", command: "greenzone_whitelist_remove" }
-    ]
-  };
+function deriveAccentLight(accent, seed = CARRIER_BRAND) {
+  if (accent.toUpperCase() === seed.colors.accent.toUpperCase()) return CARRIER_ACCENT_LIGHT;
+  return mixHexWithWhite(accent, 0.45);
 }
-function storefrontScreen(input) {
-  const sections = [
-    {
-      kind: "metrics",
-      items: [
-        {
-          label: "Status",
-          value: input.verified === true ? "serving" : input.verified === false ? "broken" : "unknown",
-          tone: input.verified === true ? "ok" : input.verified === false ? "critical" : "muted"
-        },
-        { label: "Host", value: input.target ?? "\u2014" },
-        { label: "Plans", value: input.plans ?? "\u2014" },
-        { label: "Secrets", value: input.secretsStaged?.length ?? 0 }
-      ]
-    },
-    {
-      kind: "keyvalue",
-      title: "Deployment",
-      items: [
-        { label: "Brand", value: input.brand },
-        { label: "URL", value: input.url ?? "not deployed" },
-        ...input.diagnosis ? [{ label: "Diagnosis", value: input.diagnosis, tone: "warn" }] : []
-      ]
-    }
+function deriveAccentGradientStart(accent, seed = CARRIER_BRAND) {
+  if (accent.toUpperCase() === seed.colors.accent.toUpperCase()) return CARRIER_ACCENT_GRADIENT_START;
+  return mixHexWithWhite(accent, 0.08);
+}
+function deriveAccentPaletteSubs(accent, accentDark) {
+  if (accent.toUpperCase() === CARRIER_BRAND.colors.accent.toUpperCase()) return [];
+  const accentLight = deriveAccentLight(accent);
+  const gradientStart = deriveAccentGradientStart(accent);
+  return [
+    ["#FF6B35", accent],
+    ["#D9461C", accentDark],
+    ["#FFB088", accentLight],
+    ["#FF7A45", gradientStart],
+    ["#fff4ef", mixHexWithWhite(accent, 0.94).toLowerCase()],
+    ["#ffe0d0", mixHexWithWhite(accent, 0.85).toLowerCase()],
+    ["#ffbfa0", mixHexWithWhite(accent, 0.7).toLowerCase()],
+    ["#ff9970", mixHexWithWhite(accent, 0.55).toLowerCase()],
+    ["#ff7d4d", mixHexWithWhite(accent, 0.4).toLowerCase()],
+    ["#b33a17", darkenHex(accentDark, 0.75)],
+    ["#8a2d12", darkenHex(accentDark, 0.58)],
+    ["#5e1e0c", darkenHex(accentDark, 0.4)],
+    ["#3a1107", darkenHex(accentDark, 0.25)]
   ];
-  if (input.probes?.length) {
-    sections.push({
-      kind: "table",
-      title: "Probes",
-      columns: ["Path", "Status"],
-      numeric: [1],
-      rows: input.probes.map((p) => [p.path, p.status === 0 ? "unreachable" : p.status])
-    });
-  }
-  if (input.secretsMissing?.length) {
-    sections.push({
-      kind: "note",
-      tone: "critical",
-      text: `Missing runtime secret(s): ${input.secretsMissing.join(", ")}. The build and deploy both succeed without them and the site fails at request time.`
-    });
-  }
-  return {
-    id: "storefront",
-    title: "Storefront",
-    subtitle: input.url ?? input.brand,
-    sections,
-    actions: [
-      { label: "Deploy", command: "carrier site deploy" },
-      { label: "Check hosts", command: "carrier site targets" }
-    ]
-  };
+}
+function renderEnv(brand) {
+  return [
+    `# Generated by @carrierllc/mcp`,
+    `NEXT_PUBLIC_BRAND_NAME=${JSON.stringify(brand.name)}`,
+    `NEXT_PUBLIC_CARRIER_API_URL=${JSON.stringify(brand.carrierApiUrl)}`,
+    `# Public site origin. Used to build absolute URLs for guest checkout.`,
+    `# \`carrier site deploy\` writes the deployed URL back here.`,
+    `NEXT_PUBLIC_APP_URL=`,
+    `# Required whenever NEXT_PUBLIC_CARRIER_API_URL points at a live origin:`,
+    `# the catalog client throws without it, so / and /shop return 500.`,
+    `# \`carrier site deploy\` fills this in and pushes it to the deploy target.`,
+    `CARRIER_API_KEY=`,
+    `# Guest checkout calls Stripe server-side. Without this, checkout fails at`,
+    `# request time while every other page keeps working.`,
+    `STRIPE_SECRET_KEY=`,
+    `# Clerk \u2014 \`carrier site clerk\` fills these in, or paste them from dashboard.clerk.com`,
+    `NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=`,
+    `CLERK_SECRET_KEY=`,
+    ``
+  ].join("\n");
 }
 
-// src/cli/lib/deploy-targets.ts
-import { join } from "path";
-import { tmpdir } from "os";
-import { mkdtemp, rm, writeFile as writeFileMode } from "fs/promises";
-
-// src/cli/lib/exec.ts
-import { spawn } from "child_process";
-var SAFE_COMMAND = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
-function isSafeCommand(cmd) {
-  return SAFE_COMMAND.test(cmd);
+// src/cli/lib/storefront-secrets.ts
+import { homedir } from "os";
+import { join as join2 } from "path";
+var TEMPLATE_ENV_KEYS = {
+  NEXT_PUBLIC_BRAND_NAME: "public",
+  NEXT_PUBLIC_CARRIER_API_URL: "public",
+  NEXT_PUBLIC_APP_URL: "public",
+  NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: "public",
+  CARRIER_API_KEY: "secret",
+  CLERK_SECRET_KEY: "secret",
+  STRIPE_SECRET_KEY: "secret"
+};
+function keysOfKind(kind) {
+  return Object.keys(TEMPLATE_ENV_KEYS).filter(
+    (k) => TEMPLATE_ENV_KEYS[k] === kind
+  );
 }
-function run(cmd, args, opts = {}) {
-  if (!isSafeCommand(cmd)) {
-    return Promise.resolve({
-      ok: false,
-      code: null,
-      stdout: "",
-      stderr: `refusing to run unsafe command: ${cmd}`
-    });
-  }
-  return new Promise((resolve) => {
-    const child = spawn(cmd, args, { cwd: opts.cwd, shell: false });
-    if (opts.stdin !== void 0) {
-      child.stdin?.on("error", () => {
-      });
-      child.stdin?.end(opts.stdin);
-    }
-    let stdout = "";
-    let stderr = "";
-    let settled = false;
-    const finish = (result) => {
-      if (settled) return;
-      settled = true;
-      resolve(result);
-    };
-    let timer;
-    if (opts.timeoutMs && opts.timeoutMs > 0) {
-      timer = setTimeout(() => {
-        try {
-          child.kill("SIGTERM");
-        } catch {
-        }
-        finish({
-          ok: false,
-          code: null,
-          stdout,
-          stderr: stderr || `timeout after ${opts.timeoutMs}ms`
-        });
-      }, opts.timeoutMs);
+var RUNTIME_SECRET_KEYS = keysOfKind("secret");
+var PUBLIC_ENV_KEYS = keysOfKind("public");
+function parseEnvFile(body) {
+  const out = {};
+  for (const raw of body.split("\n")) {
+    const line = raw.trim();
+    if (!line || line.startsWith("#")) continue;
+    const eq = line.indexOf("=");
+    if (eq <= 0) continue;
+    const key = line.slice(0, eq).trim();
+    let value = line.slice(eq + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') && value.length > 1 || value.startsWith("'") && value.endsWith("'") && value.length > 1) {
+      value = value.slice(1, -1);
     }
-    child.stdout?.on("data", (d) => stdout += d.toString());
-    child.stderr?.on("data", (d) => stderr += d.toString());
-    child.on("error", () => {
-      if (timer) clearTimeout(timer);
-      finish({ ok: false, code: null, stdout, stderr });
-    });
-    child.on("close", (code) => {
-      if (timer) clearTimeout(timer);
-      finish({ ok: code === 0, code, stdout, stderr });
-    });
-  });
+    if (value) out[key] = value;
+  }
+  return out;
 }
-function runInherit(cmd, args, opts = {}) {
-  if (!isSafeCommand(cmd)) {
-    return Promise.resolve({
-      ok: false,
-      code: null,
-      stdout: "",
-      stderr: `refusing to run unsafe command: ${cmd}`
-    });
+async function readEnvFile(path) {
+  if (!await exists(path)) return {};
+  try {
+    return parseEnvFile(await readFile(path, "utf8"));
+  } catch {
+    return {};
+  }
+}
+async function discoverSecrets(storefront, env = process.env, home = homedir()) {
+  const local = await readEnvFile(join2(storefront, ".env.local"));
+  const global = await readEnvFile(join2(home, ".env"));
+  const merged = {};
+  const keys = [...RUNTIME_SECRET_KEYS, ...PUBLIC_ENV_KEYS];
+  for (const key of keys) {
+    const value = local[key]?.trim() || env[key]?.trim() || global[key]?.trim();
+    if (value) merged[key] = value;
+  }
+  return merged;
+}
+async function mergeEnvLocal(storefront, updates, opts = {}) {
+  const path = join2(storefront, ".env.local");
+  const overwrite = new Set(opts.overwrite ?? []);
+  const original = await exists(path) ? await readFile(path, "utf8") : "";
+  const lines = original ? original.split("\n") : [];
+  const written = [];
+  for (const [key, value] of Object.entries(updates)) {
+    if (!value) continue;
+    const index = lines.findIndex((l) => l.trim().startsWith(`${key}=`));
+    if (index === -1) {
+      lines.push(`${key}=${value}`);
+      written.push(key);
+      continue;
+    }
+    const current = lines[index].slice(lines[index].indexOf("=") + 1).trim();
+    const isEmpty = current === "" || current === '""' || current === "''";
+    if (isEmpty || overwrite.has(key)) {
+      lines[index] = `${key}=${value}`;
+      written.push(key);
+    }
   }
-  return new Promise((resolve) => {
-    const child = spawn(cmd, args, { cwd: opts.cwd, shell: false, stdio: "inherit" });
-    child.on("error", () => resolve({ ok: false, code: null, stdout: "", stderr: "" }));
-    child.on("close", (code) => resolve({ ok: code === 0, code, stdout: "", stderr: "" }));
-  });
+  if (written.length === 0) return [];
+  const body = lines.join("\n").replace(/\n{3,}$/, "\n");
+  await writeFile(path, body.endsWith("\n") ? body : `${body}
+`);
+  return written;
 }
-async function which(bin) {
-  const probe2 = process.platform === "win32" ? "where" : "which";
-  const r = await run(probe2, [bin]);
-  return r.ok && r.stdout.trim().length > 0;
+function needsCarrierKey(secrets) {
+  const url = secrets.NEXT_PUBLIC_CARRIER_API_URL?.trim();
+  return Boolean(url) && !secrets.CARRIER_API_KEY?.trim();
 }
 
-// src/cli/lib/deploy-targets.ts
-var TARGET_IDS = ["cloudflare", "vercel", "netlify", "fly"];
-function isTargetId(v) {
-  return TARGET_IDS.includes(v);
+// src/cli/lib/site.ts
+import { join as join3 } from "path";
+function slug(s) {
+  return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "storefront";
 }
-var DEFS = {
-  cloudflare: {
-    id: "cloudflare",
-    label: "Cloudflare Workers",
-    bin: "wrangler",
-    npxPkg: "wrangler",
-    markers: ["wrangler.jsonc", "wrangler.json", "wrangler.toml"],
-    buildScript: "cf:build",
-    artifact: join(".open-next", "worker.js"),
-    whoami: ["whoami"],
-    loginHint: "wrangler login",
-    // wrangler writes this mid-sentence, so the trailing period is not part of it.
-    parseAccount: (stdout, stderr) => `${stdout}${stderr}`.match(/associated with the email\s+(\S+?)[.,]?(?:\s|$)/)?.[1],
-    deployArgs: (name) => ["deploy", "--name", name],
-    secretArgs: (key, value, name) => ({ args: ["secret", "put", key, "--name", name], stdin: value })
-  },
-  vercel: {
-    id: "vercel",
-    label: "Vercel",
-    bin: "vercel",
-    npxPkg: "vercel",
-    markers: ["vercel.json", ".vercel"],
-    buildScript: "build",
-    whoami: ["whoami"],
-    loginHint: "vercel login",
-    // The username is the only thing on stdout; the version banner goes to stderr.
-    parseAccount: (stdout) => stdout.trim().split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith(">") && !/^Vercel CLI/i.test(l)).pop(),
-    deployArgs: () => ["deploy", "--prod", "--yes"],
-    secretArgs: (key, value) => ({ args: ["env", "add", key, "production", "--force"], stdin: value })
-  },
-  netlify: {
-    id: "netlify",
-    label: "Netlify",
-    bin: "netlify",
-    npxPkg: "netlify-cli",
-    markers: ["netlify.toml"],
-    buildScript: "build",
-    whoami: ["status"],
-    loginHint: "netlify login",
-    parseAccount: (stdout, stderr) => `${stdout}${stderr}`.match(/Email:\s*(\S+)/)?.[1],
-    deployArgs: () => ["deploy", "--build", "--prod"],
-    ensureConfig: async (storefront) => {
-      const path = join(storefront, "netlify.toml");
-      if (await exists(path)) return;
-      await writeFile(
-        path,
-        [
-          "# Written by @carrierllc/mcp",
-          "[build]",
-          '  command = "npm run build"',
-          '  publish = ".next"',
-          "",
-          "[[plugins]]",
-          '  package = "@netlify/plugin-nextjs"',
-          ""
-        ].join("\n")
-      );
-    },
-    secretArgs: (key, value) => ({ args: ["env:set", key, value] })
-  },
-  fly: {
-    id: "fly",
-    label: "Fly.io",
-    bin: "flyctl",
-    npxPkg: "",
-    markers: ["fly.toml"],
-    buildScript: "build",
-    whoami: ["auth", "whoami"],
-    loginHint: "flyctl auth login",
-    parseAccount: (out) => out.trim().split("\n").pop()?.trim(),
-    deployArgs: () => ["deploy", "--now"],
-    ensureConfig: async (storefront, projectName) => {
-      const toml = join(storefront, "fly.toml");
-      if (!await exists(toml)) {
-        await writeFile(
-          toml,
-          [
-            "# Written by @carrierllc/mcp",
-            `app = "${projectName}"`,
-            "",
-            "[build]",
-            '  dockerfile = "Dockerfile"',
-            "",
-            "[http_service]",
-            "  internal_port = 3000",
-            "  force_https = true",
-            "  auto_stop_machines = true",
-            "  auto_start_machines = true",
-            ""
-          ].join("\n")
-        );
-      }
-      const dockerfile = join(storefront, "Dockerfile");
-      if (!await exists(dockerfile)) {
-        await writeFile(
-          dockerfile,
-          [
-            "# Written by @carrierllc/mcp",
-            "FROM node:22-slim AS build",
-            "WORKDIR /app",
-            "COPY package*.json ./",
-            "RUN npm install",
-            "COPY . .",
-            "RUN npm run build",
-            "",
-            "FROM node:22-slim",
-            "WORKDIR /app",
-            "ENV NODE_ENV=production PORT=3000",
-            "COPY --from=build /app ./",
-            "EXPOSE 3000",
-            'CMD ["npm", "run", "start"]',
-            ""
-          ].join("\n")
-        );
-      }
+async function installDeps(target) {
+  const pkgMgr = await which("pnpm") ? "pnpm" : "npm";
+  const r = await runInherit(pkgMgr, ["install"], { cwd: target });
+  return r.ok;
+}
+async function buildSite(target, forTarget = "cloudflare") {
+  const pkgMgr = await which("pnpm") ? "pnpm" : "npm";
+  const r = await runInherit(pkgMgr, ["run", buildScriptFor(forTarget)], { cwd: target });
+  return r.ok;
+}
+async function loadStorefrontBrand(target, overrides) {
+  const configPath = join3(target, "src", "brand.config.ts");
+  if (!await exists(configPath)) {
+    return { ...CARRIER_BRAND, ...overrides };
+  }
+  const src = await readFile(configPath, "utf8");
+  const pick = (field, fallback) => {
+    const m = src.match(new RegExp(`\\b${field}:\\s*(?:[^"\\n]*\\?\\?\\s*)?"([^"]*)"`));
+    return m?.[1] ?? fallback;
+  };
+  return {
+    ...CARRIER_BRAND,
+    name: overrides?.name ?? pick("name", CARRIER_BRAND.name),
+    domain: pick("domain", CARRIER_BRAND.domain),
+    supportEmail: pick("supportEmail", CARRIER_BRAND.supportEmail),
+    supportUrl: pick("supportUrl", CARRIER_BRAND.supportUrl),
+    tagline: pick("tagline", CARRIER_BRAND.tagline),
+    legalName: pick("legalName", CARRIER_BRAND.legalName),
+    colors: {
+      ...CARRIER_BRAND.colors,
+      accent: pick("accent", CARRIER_BRAND.colors.accent),
+      accentDark: pick("accentDark", CARRIER_BRAND.colors.accentDark),
+      bg: pick("bg", CARRIER_BRAND.colors.bg),
+      text: pick("text", CARRIER_BRAND.colors.text)
     },
-    secretArgs: (key, value) => ({ args: ["secrets", "set", `${key}=${value}`] })
+    carrierApiUrl: CARRIER_BRAND.carrierApiUrl
+  };
+}
+async function deploySite(target, brand, opts = {}) {
+  const statuses = await probeAll(target);
+  let chosen;
+  if (opts.preferred) {
+    const wanted = statuses.find((s) => s.id === opts.preferred);
+    if (!wanted?.ready) {
+      return {
+        ok: false,
+        projectName: slug(brand.name),
+        statuses,
+        reason: wanted?.reason ?? `${opts.preferred} is not available on this machine.`
+      };
+    }
+    chosen = wanted;
+  } else {
+    chosen = rankTargets(statuses)[0];
   }
-};
-async function configuredProjectName(id, storefront) {
-  if (id !== "cloudflare") return void 0;
-  for (const marker of DEFS.cloudflare.markers) {
-    const path = join(storefront, marker);
-    if (!await exists(path)) continue;
-    const body = await readFileText(path);
-    const name = body.match(/^\s*"?name"?\s*:\s*"([^"]+)"/m)?.[1];
-    if (name) return name;
+  if (!chosen) {
+    return {
+      ok: false,
+      projectName: slug(brand.name),
+      statuses,
+      reason: "No deploy target is ready. " + statuses.map((s) => `${s.label}: ${s.reason ?? "unavailable"}`).join(" | ")
+    };
+  }
+  const projectName = await configuredProjectName(chosen.id, target) ?? slug(brand.name);
+  if (opts.customDomain && chosen.id === "cloudflare" && brand.domain) {
+    await setCustomDomain(target, brand.domain);
+  }
+  let staged = { staged: [], failed: [], cleanup: async () => {
+  } };
+  if (opts.pushSecrets !== false) {
+    const discovered = await discoverSecrets(target, opts.env ?? process.env);
+    const runtime = {};
+    for (const key of RUNTIME_SECRET_KEYS) {
+      const value = discovered[key];
+      if (value) runtime[key] = value;
+    }
+    staged = await stageSecrets(chosen.id, target, projectName, runtime);
+  }
+  try {
+    const outcome = await deployTo(chosen.id, target, projectName, {
+      secretsFile: staged.secretsFile
+    });
+    if (!outcome.ok) {
+      return { ok: false, projectName, statuses, target: chosen.id, reason: outcome.reason };
+    }
+    return {
+      ok: true,
+      projectName,
+      statuses,
+      target: chosen.id,
+      url: outcome.url,
+      secrets: { pushed: staged.staged, failed: staged.failed }
+    };
+  } finally {
+    await staged.cleanup();
+  }
+}
+
+// src/cli/lib/clerk.ts
+var CLERK_API_BASE = "https://api.clerk.com/v1";
+var PUBLISHABLE_KEYS = [
+  "CLERK_PUBLISHABLE_KEY",
+  "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY"
+];
+var SECRET_KEYS = ["CLERK_SECRET_KEY"];
+function firstNonEmpty(env, names) {
+  for (const name of names) {
+    const value = env[name]?.trim();
+    if (value) return value;
   }
   return void 0;
 }
-async function setCustomDomain(storefront, domain) {
-  const clean = domain.replace(/^https?:\/\//, "").replace(/\/$/, "");
-  if (!clean || !clean.includes(".")) return false;
-  const path = join(storefront, "wrangler.jsonc");
-  if (!await exists(path)) return false;
-  const body = await readFileText(path);
-  if (body.includes(`"pattern": "${clean}"`)) return true;
-  const routes = `  "routes": [
-    { "pattern": "${clean}", "custom_domain": true }
-  ],
-`;
-  const anchor = body.indexOf(`"main"`);
-  if (anchor === -1) return false;
-  const lineStart = body.lastIndexOf("\n", anchor) + 1;
-  const patched = body.slice(0, lineStart) + routes + body.slice(lineStart);
-  await writeFile(path, patched);
-  return true;
+function looksPublishable(key) {
+  return /^pk_(test|live)_/.test(key);
 }
-async function readFileText(path) {
-  const { readFile: readFile2 } = await import("./fsx-BDDIQ3Y7.js");
-  return readFile2(path, "utf8");
+function looksSecret(key) {
+  return /^sk_(test|live)_/.test(key);
 }
-async function rollback(id, storefront, projectName) {
-  if (id !== "cloudflare") {
-    return { ok: false, reason: `${DEFS[id].label} has no one-command rollback \u2014 revert manually.` };
+async function clerkFetch(path, token, init = {}) {
+  try {
+    const res = await fetch(`${CLERK_API_BASE}${path}`, {
+      method: init.method ?? "GET",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json"
+      },
+      body: init.body === void 0 ? void 0 : JSON.stringify(init.body)
+    });
+    const text = await res.text();
+    let json;
+    try {
+      json = text ? JSON.parse(text) : void 0;
+    } catch {
+      json = void 0;
+    }
+    if (!res.ok) {
+      return { ok: false, status: res.status, json, error: clerkError(json) ?? text.slice(0, 300) };
+    }
+    return { ok: true, status: res.status, json };
+  } catch (e) {
+    return { ok: false, status: 0, error: e instanceof Error ? e.message : String(e) };
   }
-  const def = DEFS[id];
-  const resolved = await resolveBin(def);
-  if (!resolved) return { ok: false, reason: "wrangler not found." };
-  const r = await run(
-    resolved.bin,
-    [...resolved.prefix, "rollback", "--name", projectName, "--yes"],
-    { cwd: storefront, timeoutMs: 3e5 }
-  );
-  return r.ok ? { ok: true } : { ok: false, reason: `${r.stderr || r.stdout}`.trim().split("\n").slice(-2).join(" ").slice(0, 300) };
 }
-async function resolveBin(def) {
-  if (await which(def.bin)) return { bin: def.bin, prefix: [] };
-  if (def.npxPkg && await which("npx")) return { bin: "npx", prefix: [def.npxPkg] };
-  return void 0;
+function clerkError(json) {
+  if (typeof json !== "object" || json === null) return void 0;
+  const errors = json.errors;
+  if (!Array.isArray(errors) || errors.length === 0) return void 0;
+  const first = errors[0];
+  return first.long_message ?? first.message;
 }
-async function probeTarget(id, storefront) {
-  const def = DEFS[id];
-  let configured = false;
-  for (const marker of def.markers) {
-    if (await exists(join(storefront, marker))) {
-      configured = true;
-      break;
-    }
-  }
-  const resolved = await resolveBin(def);
-  if (!resolved) {
+async function createClerkApplication(platformToken, opts) {
+  const body = {
+    name: opts.name,
+    environment_types: opts.production ? ["development", "production"] : ["development"]
+  };
+  if (opts.domain) body.domain = opts.domain;
+  const res = await clerkFetch("/platform/applications", platformToken, {
+    method: "POST",
+    body
+  });
+  if (!res.ok) {
     return {
-      id,
-      label: def.label,
-      installed: false,
-      authenticated: false,
-      configured,
-      ready: false,
-      reason: def.npxPkg ? `${def.bin} not found \u2014 install it, or make npx available.` : `${def.bin} not found \u2014 install the Fly CLI (brew install flyctl).`
+      ok: false,
+      tier: "platform",
+      reason: res.status === 401 || res.status === 403 ? `Clerk Platform API rejected the token (HTTP ${res.status}). Check CLERK_PLATFORM_API_KEY.` : `Clerk Platform API error: ${res.error ?? `HTTP ${res.status}`}`
     };
   }
-  const who = await run(resolved.bin, [...resolved.prefix, ...def.whoami], {
-    cwd: storefront,
-    timeoutMs: 6e4
-  });
-  if (!who.ok) {
+  const payload = res.json;
+  const instances = payload?.instances ?? [];
+  const wanted = opts.production ? "production" : "development";
+  const instance = instances.find((i) => i.environment_type === wanted && i.secret_key && i.publishable_key) ?? instances.find((i) => i.secret_key && i.publishable_key);
+  if (!instance?.secret_key || !instance.publishable_key) {
     return {
-      id,
-      label: def.label,
-      installed: true,
-      authenticated: false,
-      configured,
-      ready: false,
-      reason: `${def.bin} is not logged in \u2014 run \`${def.loginHint}\`.`
+      ok: false,
+      tier: "platform",
+      reason: "Clerk created the application but returned no instance keys. Read them with GET /platform/applications?include_secret_keys=true."
     };
   }
   return {
-    id,
-    label: def.label,
-    installed: true,
-    authenticated: true,
-    configured,
-    ready: true,
-    account: def.parseAccount?.(who.stdout, who.stderr)
+    ok: true,
+    tier: "platform",
+    credentials: {
+      publishableKey: instance.publishable_key,
+      secretKey: instance.secret_key,
+      tier: "platform",
+      applicationId: payload?.application_id,
+      instanceId: instance.instance_id
+    }
   };
 }
-async function probeAll(storefront) {
-  return Promise.all(TARGET_IDS.map((id) => probeTarget(id, storefront)));
-}
-function rankTargets(statuses) {
-  return statuses.filter((s) => s.ready).sort((a, b) => {
-    if (a.configured !== b.configured) return a.configured ? -1 : 1;
-    return TARGET_IDS.indexOf(a.id) - TARGET_IDS.indexOf(b.id);
-  });
-}
-function buildScriptFor(id) {
-  return DEFS[id].buildScript;
-}
-async function artifactMissing(id, storefront) {
-  const artifact = DEFS[id].artifact;
-  if (!artifact) return false;
-  return !await exists(join(storefront, artifact));
-}
-function parseDeployedUrl(output) {
-  return output.match(
-    /https:\/\/[^\s"']+\.(?:workers\.dev|vercel\.app|netlify\.app|fly\.dev)[^\s"']*/
-  )?.[0];
-}
-async function putSecret(id, storefront, projectName, key, value) {
-  const def = DEFS[id];
-  const resolved = await resolveBin(def);
-  if (!resolved) return false;
-  const { args, stdin } = def.secretArgs(key, value, projectName);
-  const r = await run(resolved.bin, [...resolved.prefix, ...args], {
-    cwd: storefront,
-    timeoutMs: 12e4,
-    stdin
-  });
-  return r.ok;
-}
-async function stageSecrets(id, storefront, projectName, secrets) {
-  const entries = Object.entries(secrets).filter(([, v]) => v?.trim());
-  const noop = { staged: [], failed: [], cleanup: async () => {
-  } };
-  if (entries.length === 0) return noop;
-  const def = DEFS[id];
-  const resolved = await resolveBin(def);
-  if (!resolved) return { staged: [], failed: entries.map(([k]) => k), cleanup: async () => {
-  } };
-  if (id === "cloudflare") {
-    const dir = await mkdtemp(join(tmpdir(), "carrier-secrets-"));
-    const file = join(dir, ".env");
-    const body = entries.map(([k, v]) => `${k}=${v}`).join("\n");
-    await writeFileMode(file, `${body}
-`, { mode: 384 });
+async function mintKeylessClerkApp(storefront, deps) {
+  if (!await deps.which("npx")) {
+    return { ok: false, tier: "cli-keyless", reason: "npx not found \u2014 cannot run the Clerk CLI." };
+  }
+  const restore = await deps.snapshot(storefront);
+  try {
+    const r = await deps.run(
+      "npx",
+      ["--yes", "clerk@latest", "init", "--framework", "next", "--keyless", "--no-skills", "-y"],
+      { cwd: storefront, timeoutMs: 6e5 }
+    );
+    const envPath = `${storefront}/.env.local`;
+    const body = await deps.readFileIfExists(envPath) ?? "";
+    const publishableKey = matchEnv(body, "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY");
+    const secretKey = matchEnv(body, "CLERK_SECRET_KEY");
+    if (!publishableKey || !secretKey) {
+      const tail = `${r.stdout}${r.stderr}`.trim().split("\n").slice(-2).join(" ").slice(0, 300);
+      return {
+        ok: false,
+        tier: "cli-keyless",
+        reason: `Clerk CLI did not produce keys${tail ? `: ${tail}` : "."}`
+      };
+    }
+    if (!looksPublishable(publishableKey) || !looksSecret(secretKey)) {
+      return { ok: false, tier: "cli-keyless", reason: "Clerk CLI wrote keys in an unexpected format." };
+    }
     return {
-      staged: entries.map(([k]) => k),
-      failed: [],
-      secretsFile: file,
-      cleanup: async () => {
-        await rm(dir, { recursive: true, force: true });
-      }
+      ok: true,
+      tier: "cli-keyless",
+      credentials: { publishableKey, secretKey, tier: "cli-keyless" }
     };
+  } finally {
+    await restore();
   }
-  if (id === "fly") {
-    const args = ["secrets", "set", "--stage", ...entries.map(([k, v]) => `${k}=${v}`)];
-    const r = await run(resolved.bin, [...resolved.prefix, ...args], {
-      cwd: storefront,
-      timeoutMs: 18e4
+}
+function matchEnv(body, key) {
+  const line = body.split("\n").find((l) => l.trim().startsWith(`${key}=`));
+  const value = line?.slice(line.indexOf("=") + 1).trim();
+  return value || void 0;
+}
+function discoverClerkCredentials(env) {
+  const publishableKey = firstNonEmpty(env, PUBLISHABLE_KEYS);
+  const secretKey = firstNonEmpty(env, SECRET_KEYS);
+  if (!publishableKey || !secretKey) return void 0;
+  if (!looksPublishable(publishableKey) || !looksSecret(secretKey)) return void 0;
+  return { publishableKey, secretKey, tier: "discovered" };
+}
+var MANUAL_STEPS = [
+  "Open https://dashboard.clerk.com and create an application.",
+  "Copy the Publishable key (pk_...) and Secret key (sk_...) from API keys.",
+  "Put them in the storefront's .env.local as NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY and CLERK_SECRET_KEY.",
+  "Re-run `carrier site deploy` \u2014 the keys are pushed to the deploy target automatically."
+];
+async function provisionClerk(opts) {
+  const platformToken = firstNonEmpty(opts.env, [
+    "CLERK_PLATFORM_API_KEY",
+    "CLERK_PLATFORM_TOKEN"
+  ]);
+  const notes = [];
+  if (platformToken && !opts.noCreate) {
+    const created = await createClerkApplication(platformToken, {
+      name: opts.name,
+      domain: opts.domain,
+      production: opts.production
     });
+    if (created.ok) return created;
+    notes.push(created.reason ?? "Clerk Platform API call failed.");
+  }
+  const discovered = discoverClerkCredentials(opts.env);
+  if (discovered) {
     return {
-      staged: r.ok ? entries.map(([k]) => k) : [],
-      failed: r.ok ? [] : entries.map(([k]) => k),
-      cleanup: async () => {
-      }
+      ok: true,
+      tier: "discovered",
+      credentials: discovered,
+      reason: notes.length ? notes.join(" ") : void 0
     };
   }
-  const staged = [];
-  const failed = [];
-  for (const [key, value] of entries) {
-    const ok = await putSecret(id, storefront, projectName, key, value);
-    (ok ? staged : failed).push(key);
+  if (opts.cli && opts.storefront && !opts.noCreate) {
+    const minted = await mintKeylessClerkApp(opts.storefront, opts.cli);
+    if (minted.ok) {
+      return { ...minted, reason: notes.length ? notes.join(" ") : void 0 };
+    }
+    notes.push(minted.reason ?? "Clerk CLI keyless provisioning failed.");
   }
-  return { staged, failed, cleanup: async () => {
-  } };
-}
-async function deployTo(id, storefront, projectName, opts = {}) {
-  const def = DEFS[id];
-  const resolved = await resolveBin(def);
-  if (!resolved) {
-    return { ok: false, target: id, projectName, reason: `${def.bin} not found.` };
+  if (!platformToken) {
+    notes.push(
+      "No CLERK_PLATFORM_API_KEY set, so a new Clerk application cannot be created through the Platform API (it is a partner surface, not self-serve)."
+    );
   }
-  await def.ensureConfig?.(storefront, projectName);
-  if (await artifactMissing(id, storefront)) {
-    return {
-      ok: false,
-      target: id,
-      projectName,
-      reason: `No ${def.artifact} build found \u2014 run the build step first.`
-    };
+  return {
+    ok: false,
+    tier: "manual",
+    reason: notes.join(" "),
+    guidance: MANUAL_STEPS
+  };
+}
+async function configureClerkInstance(secretKey, opts) {
+  const applied = [];
+  const failed = [];
+  const origins = dedupe(opts.allowedOrigins ?? []);
+  if (origins.length > 0) {
+    const res = await clerkFetch("/instance", secretKey, {
+      method: "PATCH",
+      body: { allowed_origins: origins }
+    });
+    if (res.ok) applied.push(`allowed_origins (${origins.length})`);
+    else failed.push({ step: "allowed_origins", reason: res.error ?? `HTTP ${res.status}` });
   }
-  const args = [...resolved.prefix, ...def.deployArgs(projectName)];
-  if (id === "cloudflare" && opts.secretsFile) args.push("--secrets-file", opts.secretsFile);
-  const r = await run(resolved.bin, args, {
-    cwd: storefront,
-    timeoutMs: 9e5
-  });
-  const combined = `${r.stdout}${r.stderr}`;
-  if (!r.ok) {
-    const tail = combined.trim().split("\n").slice(-3).join(" ").slice(0, 400);
-    return { ok: false, target: id, projectName, reason: tail || `${def.bin} deploy failed.` };
+  for (const url of dedupe(opts.redirectUrls ?? [])) {
+    const res = await clerkFetch("/redirect_urls", secretKey, { method: "POST", body: { url } });
+    if (res.ok) applied.push(`redirect_url ${url}`);
+    else failed.push({ step: `redirect_url ${url}`, reason: res.error ?? `HTTP ${res.status}` });
   }
-  return { ok: true, target: id, projectName, url: parseDeployedUrl(combined) };
-}
-
-// src/cli/lib/brand.ts
-var CARRIER_BRAND = {
-  name: "Carrier",
-  legalName: "Lifecycle Innovations Limited",
-  tagline: "Programmable connectivity, on demand.",
-  domain: "carrier.llc",
-  supportEmail: "support@carrier.llc",
-  supportUrl: "https://carrier.llc/help",
-  supportWhatsapp: "+17864604829",
-  colors: {
-    bg: "#080C16",
-    accent: "#FF6B35",
-    accentDark: "#D9461C",
-    text: "#F5F1EA"
-  },
-  social: {
-    x: "@carrier_llc",
-    instagram: "@carrier.llc",
-    tiktok: "@carrier.llc"
-  },
-  carrierApiUrl: "https://api.carrier.llc"
-};
-var CARRIER_ACCENT_LIGHT = "#FFB088";
-var CARRIER_ACCENT_GRADIENT_START = "#FF7A45";
-function hexToRgb(hex) {
-  const h = hex.replace(/^#/, "");
-  if (!/^[0-9a-fA-F]{6}$/.test(h)) return null;
-  return [parseInt(h.slice(0, 2), 16), parseInt(h.slice(2, 4), 16), parseInt(h.slice(4, 6), 16)];
-}
-function rgbToHex(r, g, b, lower = false) {
-  const fmt = (n) => Math.max(0, Math.min(255, Math.round(n))).toString(16).padStart(2, "0");
-  const out = `#${fmt(r)}${fmt(g)}${fmt(b)}`;
-  return lower ? out : out.toUpperCase();
-}
-function mixHexWithWhite(hex, whiteRatio) {
-  const rgb = hexToRgb(hex);
-  if (!rgb) return hex;
-  const mix2 = (n) => n + (255 - n) * whiteRatio;
-  return rgbToHex(mix2(rgb[0]), mix2(rgb[1]), mix2(rgb[2]));
-}
-function darkenHex(hex, factor) {
-  const rgb = hexToRgb(hex);
-  if (!rgb) return hex;
-  const scale = (n) => n * factor;
-  return rgbToHex(scale(rgb[0]), scale(rgb[1]), scale(rgb[2]), true);
-}
-function deriveAccentDark(accent, seed = CARRIER_BRAND) {
-  if (accent.toUpperCase() === seed.colors.accent.toUpperCase()) return seed.colors.accentDark;
-  const rgb = hexToRgb(accent);
-  if (!rgb) return accent;
-  const scale = (n) => Math.max(0, Math.min(255, Math.round(n * 0.75)));
-  return rgbToHex(scale(rgb[0]), scale(rgb[1]), scale(rgb[2]));
-}
-function deriveAccentLight(accent, seed = CARRIER_BRAND) {
-  if (accent.toUpperCase() === seed.colors.accent.toUpperCase()) return CARRIER_ACCENT_LIGHT;
-  return mixHexWithWhite(accent, 0.45);
-}
-function deriveAccentGradientStart(accent, seed = CARRIER_BRAND) {
-  if (accent.toUpperCase() === seed.colors.accent.toUpperCase()) return CARRIER_ACCENT_GRADIENT_START;
-  return mixHexWithWhite(accent, 0.08);
+  return { ok: failed.length === 0, applied, failed };
 }
-function deriveAccentPaletteSubs(accent, accentDark) {
-  if (accent.toUpperCase() === CARRIER_BRAND.colors.accent.toUpperCase()) return [];
-  const accentLight = deriveAccentLight(accent);
-  const gradientStart = deriveAccentGradientStart(accent);
-  return [
-    ["#FF6B35", accent],
-    ["#D9461C", accentDark],
-    ["#FFB088", accentLight],
-    ["#FF7A45", gradientStart],
-    ["#fff4ef", mixHexWithWhite(accent, 0.94).toLowerCase()],
-    ["#ffe0d0", mixHexWithWhite(accent, 0.85).toLowerCase()],
-    ["#ffbfa0", mixHexWithWhite(accent, 0.7).toLowerCase()],
-    ["#ff9970", mixHexWithWhite(accent, 0.55).toLowerCase()],
-    ["#ff7d4d", mixHexWithWhite(accent, 0.4).toLowerCase()],
-    ["#b33a17", darkenHex(accentDark, 0.75)],
-    ["#8a2d12", darkenHex(accentDark, 0.58)],
-    ["#5e1e0c", darkenHex(accentDark, 0.4)],
-    ["#3a1107", darkenHex(accentDark, 0.25)]
-  ];
+function dedupe(values) {
+  return [...new Set(values.map((v) => v.trim()).filter(Boolean))];
 }
-function renderEnv(brand) {
-  return [
-    `# Generated by @carrierllc/mcp`,
-    `NEXT_PUBLIC_BRAND_NAME=${JSON.stringify(brand.name)}`,
-    `NEXT_PUBLIC_CARRIER_API_URL=${JSON.stringify(brand.carrierApiUrl)}`,
-    `# Public site origin. Used to build absolute URLs for guest checkout.`,
-    `# \`carrier site deploy\` writes the deployed URL back here.`,
-    `NEXT_PUBLIC_APP_URL=`,
-    `# Required whenever NEXT_PUBLIC_CARRIER_API_URL points at a live origin:`,
-    `# the catalog client throws without it, so / and /shop return 500.`,
-    `# \`carrier site deploy\` fills this in and pushes it to the deploy target.`,
-    `CARRIER_API_KEY=`,
-    `# Guest checkout calls Stripe server-side. Without this, checkout fails at`,
-    `# request time while every other page keeps working.`,
-    `STRIPE_SECRET_KEY=`,
-    `# Clerk \u2014 \`carrier site clerk\` fills these in, or paste them from dashboard.clerk.com`,
-    `NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY=`,
-    `CLERK_SECRET_KEY=`,
-    ``
-  ].join("\n");
+function storefrontClerkUrls(deployedUrl, domain) {
+  const bases = dedupe([
+    deployedUrl?.replace(/\/$/, "") ?? "",
+    domain ? `https://${domain.replace(/^https?:\/\//, "").replace(/\/$/, "")}` : "",
+    "http://localhost:3000"
+  ]);
+  return {
+    allowedOrigins: bases,
+    redirectUrls: bases.flatMap((b) => [b, `${b}/checkout/success`, `${b}/dashboard`])
+  };
 }
 
-// src/cli/lib/storefront-secrets.ts
-import { homedir } from "os";
-import { join as join2 } from "path";
-var TEMPLATE_ENV_KEYS = {
-  NEXT_PUBLIC_BRAND_NAME: "public",
-  NEXT_PUBLIC_CARRIER_API_URL: "public",
-  NEXT_PUBLIC_APP_URL: "public",
-  NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY: "public",
-  CARRIER_API_KEY: "secret",
-  CLERK_SECRET_KEY: "secret",
-  STRIPE_SECRET_KEY: "secret"
-};
-function keysOfKind(kind) {
-  return Object.keys(TEMPLATE_ENV_KEYS).filter(
-    (k) => TEMPLATE_ENV_KEYS[k] === kind
-  );
-}
-var RUNTIME_SECRET_KEYS = keysOfKind("secret");
-var PUBLIC_ENV_KEYS = keysOfKind("public");
-function parseEnvFile(body) {
-  const out = {};
-  for (const raw of body.split("\n")) {
-    const line = raw.trim();
-    if (!line || line.startsWith("#")) continue;
-    const eq = line.indexOf("=");
-    if (eq <= 0) continue;
-    const key = line.slice(0, eq).trim();
-    let value = line.slice(eq + 1).trim();
-    if (value.startsWith('"') && value.endsWith('"') && value.length > 1 || value.startsWith("'") && value.endsWith("'") && value.length > 1) {
-      value = value.slice(1, -1);
+// src/cli/lib/clerk-cli.ts
+import { join as join4 } from "path";
+import { cp, mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
+import { tmpdir as tmpdir2 } from "os";
+var SNAPSHOT_PATHS = ["src", "package.json", "next.config.mjs", "middleware.ts"];
+function clerkCliDeps() {
+  return {
+    which,
+    run: async (cmd, args, opts) => {
+      const r = await run(cmd, args, opts);
+      return { ok: r.ok, stdout: r.stdout, stderr: r.stderr };
+    },
+    readFileIfExists: async (path) => {
+      if (!await exists(path)) return void 0;
+      try {
+        return await readFile(path, "utf8");
+      } catch {
+        return void 0;
+      }
+    },
+    snapshot: async (storefront) => {
+      const backup = await mkdtemp2(join4(tmpdir2(), "carrier-clerk-snap-"));
+      const saved = [];
+      for (const rel of SNAPSHOT_PATHS) {
+        const src = join4(storefront, rel);
+        if (!await exists(src)) continue;
+        await cp(src, join4(backup, rel), { recursive: true });
+        saved.push(rel);
+      }
+      return async () => {
+        try {
+          for (const rel of saved) {
+            const target = join4(storefront, rel);
+            await rm2(target, { recursive: true, force: true });
+            await cp(join4(backup, rel), target, { recursive: true });
+          }
+        } finally {
+          await rm2(backup, { recursive: true, force: true });
+        }
+      };
     }
-    if (value) out[key] = value;
-  }
-  return out;
+  };
 }
-async function readEnvFile(path) {
-  if (!await exists(path)) return {};
+
+// src/cli/lib/verify-storefront.ts
+var PROBES = [
+  { path: "/" },
+  { path: "/shop", expectBody: /·/ },
+  // plan names render as "Visit · Calm"
+  { path: "/help" }
+];
+async function probe(base, path, expectBody) {
+  const url = `${base.replace(/\/$/, "")}${path}${path.includes("?") ? "&" : "?"}_v=${Date.now()}`;
   try {
-    return parseEnvFile(await readFile(path, "utf8"));
-  } catch {
-    return {};
+    const res = await fetch(url, { redirect: "manual" });
+    const status = res.status;
+    const ok = status < 400;
+    if (!expectBody || !ok) return { path, status, ok };
+    const body = await res.text();
+    return { path, status, ok, bodyOk: expectBody.test(body) };
+  } catch (e) {
+    return { path, status: 0, ok: false, error: e instanceof Error ? e.message : String(e) };
   }
 }
-async function discoverSecrets(storefront, env = process.env, home = homedir()) {
-  const local = await readEnvFile(join2(storefront, ".env.local"));
-  const global = await readEnvFile(join2(home, ".env"));
-  const merged = {};
-  const keys = [...RUNTIME_SECRET_KEYS, ...PUBLIC_ENV_KEYS];
-  for (const key of keys) {
-    const value = local[key]?.trim() || env[key]?.trim() || global[key]?.trim();
-    if (value) merged[key] = value;
+function diagnose(probes, secrets) {
+  const by = (p) => probes.find((x) => x.path === p);
+  const root = by("/");
+  const shop = by("/shop");
+  const help = by("/help");
+  if (probes.every((p) => p.ok && p.bodyOk !== false)) return "healthy";
+  if (probes.every((p) => p.status === 0)) return "not-deployed";
+  const catalogDown = root?.status === 500 && shop?.status === 500;
+  if (catalogDown && help?.ok) {
+    return needsCarrierKey(secrets) ? "carrier-key-missing" : "unclassified";
   }
-  return merged;
+  if (shop?.ok && shop.bodyOk === false) return "empty-catalog";
+  if (root?.ok && shop?.ok && probes.some((p) => p.status >= 500)) return "clerk-keys-missing";
+  if (probes.every((p) => p.status === 404)) return "not-deployed";
+  return "unclassified";
 }
-async function mergeEnvLocal(storefront, updates, opts = {}) {
-  const path = join2(storefront, ".env.local");
-  const overwrite = new Set(opts.overwrite ?? []);
-  const original = await exists(path) ? await readFile(path, "utf8") : "";
-  const lines = original ? original.split("\n") : [];
-  const written = [];
-  for (const [key, value] of Object.entries(updates)) {
-    if (!value) continue;
-    const index = lines.findIndex((l) => l.trim().startsWith(`${key}=`));
-    if (index === -1) {
-      lines.push(`${key}=${value}`);
-      written.push(key);
-      continue;
+var SUMMARIES = {
+  healthy: "All probes returned a working page.",
+  "carrier-key-missing": "Catalog pages return 500 while non-catalog pages work \u2014 CARRIER_API_KEY is missing or invalid on the host.",
+  "clerk-keys-missing": "Public pages work but auth routes error \u2014 Clerk keys are missing on the host.",
+  "empty-catalog": "/shop renders but no plans are in it \u2014 the Carrier catalog returned nothing sellable. Not a deploy problem.",
+  "not-deployed": "Nothing served at the deployed URL \u2014 the deploy did not land, or the URL is wrong.",
+  unclassified: "The storefront is not serving correctly and the symptom matches no known cause."
+};
+var REPAIRABLE = /* @__PURE__ */ new Set([
+  "carrier-key-missing",
+  "clerk-keys-missing"
+]);
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function verifyStorefront(url, storefront, env = process.env, opts = {}) {
+  const attempts = Math.max(1, opts.attempts ?? 4);
+  const delayMs = opts.delayMs ?? 5e3;
+  const secrets = await discoverSecrets(storefront, env);
+  let probes = [];
+  let diagnosis = "unclassified";
+  for (let attempt = 1; attempt <= attempts; attempt++) {
+    probes = [];
+    for (const { path, expectBody } of PROBES) {
+      probes.push(await probe(url, path, expectBody));
     }
-    const current = lines[index].slice(lines[index].indexOf("=") + 1).trim();
-    const isEmpty = current === "" || current === '""' || current === "''";
-    if (isEmpty || overwrite.has(key)) {
-      lines[index] = `${key}=${value}`;
-      written.push(key);
+    diagnosis = diagnose(probes, secrets);
+    if (diagnosis !== "not-deployed" || attempt === attempts) break;
+    await sleep(delayMs);
+  }
+  const ok = diagnosis === "healthy";
+  return {
+    ok,
+    url,
+    probes,
+    diagnosis,
+    summary: SUMMARIES[diagnosis],
+    repairable: !ok && REPAIRABLE.has(diagnosis)
+  };
+}
+function formatProbes(probes) {
+  return probes.map((p) => {
+    const status = p.status === 0 ? "unreachable" : String(p.status);
+    const body = p.bodyOk === false ? " (no plans)" : "";
+    return `${p.path} ${status}${body}`;
+  }).join("  ");
+}
+function repairPlanFor(diagnosis) {
+  if (diagnosis === "carrier-key-missing") {
+    return {
+      diagnosis,
+      runClerk: false,
+      // CARRIER_API_KEY is read at request time, so re-staging and redeploying
+      // is enough; no rebuild needed.
+      rebuild: false,
+      note: "Re-resolve CARRIER_API_KEY, stage it, and redeploy."
+    };
+  }
+  if (diagnosis === "clerk-keys-missing") {
+    return {
+      diagnosis,
+      runClerk: true,
+      // The publishable key is inlined at build time, so this one must rebuild.
+      rebuild: true,
+      note: "Provision Clerk, rebuild so the publishable key is inlined, and redeploy."
+    };
+  }
+  return void 0;
+}
+
+// ../../packages/screens/dist/index.js
+function isBlankValue(value) {
+  const text = String(value).trim();
+  return text === "" || text === "\u2014" || text === "-" || Number(text) === 0;
+}
+function isEmptyScreen(screen) {
+  return screen.sections.every((section) => {
+    switch (section.kind) {
+      case "metrics":
+        return section.items.every((m) => isBlankValue(m.value));
+      case "bars":
+        return section.items.every((b) => b.value === 0);
+      case "keyvalue":
+        return section.items.every((kv) => isBlankValue(kv.value));
+      case "table":
+        return section.rows.length === 0;
+      case "note":
+        return false;
     }
+  });
+}
+var colors = {
+  /** Base page background — deepest ink */
+  backgroundDark: "#080C16",
+  backgroundDarkOklch: "oklch(0.09 0.02 260)",
+  /** Surface elevation ladder — alpha blends, no drop-shadows */
+  surface0: "#080C16",
+  surface1: "rgba(15, 20, 34, 0.80)",
+  surface2: "rgba(22, 28, 46, 0.90)",
+  surface3: "rgba(31, 38, 56, 0.95)",
+  /** Legacy alias — kept for backward compat */
+  surfaceDark: "#0F1422",
+  surfaceCard: "rgba(15, 20, 34, 0.75)",
+  /** Borders */
+  borderCard: "#1F2638",
+  borderMuted: "rgba(255, 255, 255, 0.07)",
+  borderSubtle: "rgba(255, 255, 255, 0.04)",
+  /** Brand accent — Carrier Flame orange (do not replace with violet) */
+  accentFlame: "#FF6B35",
+  accentEmber: "#D9461C",
+  accentSpark: "#FFB088",
+  /** Legacy violet/fuchsia — used on esimmcp co-brand surface only */
+  accentViolet: "#a78bfa",
+  accentFuchsia: "#e879f9",
+  /** Text hierarchy — tight ratio, generous contrast */
+  textPrimary: "#F5F1EA",
+  textSecondary: "#C9CCD6",
+  textMuted: "#8A92A8",
+  textFaint: "#5A6278",
+  /** Status — do not deviate */
+  statusSuccess: "#10b981",
+  statusWarning: "#f59e0b",
+  statusError: "#ef4444",
+  /** Light mode equivalents */
+  light: {
+    background: "#ffffff",
+    backgroundSecondary: "#f8fafc",
+    surfaceCard: "rgba(248, 250, 252, 0.9)",
+    borderCard: "#e2e8f0",
+    textPrimary: "#0f172a",
+    textSecondary: "#475569",
+    textMuted: "#94a3b8"
   }
-  if (written.length === 0) return [];
-  const body = lines.join("\n").replace(/\n{3,}$/, "\n");
-  await writeFile(path, body.endsWith("\n") ? body : `${body}
-`);
-  return written;
+};
+var typography = {
+  fontSans: "var(--font-sans, Inter), system-ui, -apple-system, sans-serif",
+  fontMono: "var(--font-mono, 'JetBrains Mono'), ui-monospace, monospace",
+  fontSerif: "var(--font-serif, Georgia), 'Times New Roman', serif",
+  /** Weights — only these three, per brand guide */
+  weightRegular: "400",
+  weightBold: "700",
+  weightBlack: "900",
+  /** Line heights */
+  lineHeightHeadline: "1.05",
+  lineHeightSubheading: "1.2",
+  lineHeightBody: "1.5",
+  /** Letter spacing — tight on big headlines */
+  trackingTight: "-0.04em",
+  trackingNormal: "0em",
+  trackingWide: "0.05em",
+  /** Type scale (rem) */
+  scale: {
+    xs: "0.75rem",
+    sm: "0.875rem",
+    base: "1rem",
+    lg: "1.125rem",
+    xl: "1.25rem",
+    "2xl": "1.5rem",
+    "3xl": "1.875rem",
+    "4xl": "2.25rem",
+    "5xl": "3rem",
+    "6xl": "3.75rem",
+    "7xl": "4.5rem"
+  }
+};
+var radius = {
+  sm: "0.375rem",
+  md: "0.5rem",
+  lg: "0.75rem",
+  xl: "1rem",
+  "2xl": "1.5rem",
+  full: "9999px"
+};
+var TONE_COLOR = {
+  ok: colors.statusSuccess,
+  info: colors.accentFlame,
+  warn: colors.statusWarning,
+  critical: colors.statusError,
+  muted: colors.textMuted
+};
+function esc(value) {
+  return String(value).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
 }
-function needsCarrierKey(secrets) {
-  const url = secrets.NEXT_PUBLIC_CARRIER_API_URL?.trim();
-  return Boolean(url) && !secrets.CARRIER_API_KEY?.trim();
+function toneColor(tone, fallback = colors.textPrimary) {
+  return tone ? TONE_COLOR[tone] : fallback;
 }
-
-// src/cli/lib/site.ts
-import { join as join3 } from "path";
-function slug(s) {
-  return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || "storefront";
+function metricsHtml(items) {
+  const cards = items.map(
+    (m) => `
+      <div style="background:${colors.surface1};border:1px solid ${colors.borderCard};border-radius:${radius.lg};padding:16px 18px;min-width:0">
+        <div style="font-size:11px;letter-spacing:.08em;text-transform:uppercase;color:${colors.textMuted}">${esc(m.label)}</div>
+        <div style="font-size:28px;font-weight:600;margin-top:6px;color:${toneColor(m.tone)};line-height:1.1">${esc(m.value)}</div>
+        ${m.hint ? `<div style="font-size:12px;color:${colors.textFaint};margin-top:4px">${esc(m.hint)}</div>` : ""}
+      </div>`
+  ).join("");
+  return `<div style="display:grid;grid-template-columns:repeat(auto-fit,minmax(160px,1fr));gap:12px">${cards}</div>`;
 }
-async function installDeps(target) {
-  const pkgMgr = await which("pnpm") ? "pnpm" : "npm";
-  const r = await runInherit(pkgMgr, ["install"], { cwd: target });
-  return r.ok;
+function barsHtml(items, empty) {
+  if (items.length === 0) return emptyHtml(empty ?? "Nothing to show.");
+  const ceiling = Math.max(...items.map((b) => b.max ?? b.value), 1);
+  const rows = items.map((b) => {
+    const pct2 = Math.max(0, Math.min(100, (b.value / (b.max ?? ceiling) || 0) * 100));
+    return `
+      <div style="margin-bottom:10px">
+        <div style="display:flex;justify-content:space-between;font-size:13px;color:${colors.textSecondary};margin-bottom:4px">
+          <span>${esc(b.label)}</span>
+          <span style="color:${colors.textMuted}">${esc(b.hint ?? b.value)}</span>
+        </div>
+        <div style="height:8px;background:${colors.surface2};border-radius:${radius.full};overflow:hidden">
+          <div style="height:100%;width:${pct2.toFixed(1)}%;background:${toneColor(b.tone, colors.accentFlame)}"></div>
+        </div>
+      </div>`;
+  }).join("");
+  return `<div>${rows}</div>`;
 }
-async function buildSite(target, forTarget = "cloudflare") {
-  const pkgMgr = await which("pnpm") ? "pnpm" : "npm";
-  const r = await runInherit(pkgMgr, ["run", buildScriptFor(forTarget)], { cwd: target });
-  return r.ok;
+function tableHtml(section) {
+  if (section.rows.length === 0) return emptyHtml(section.empty ?? "No rows.");
+  const numeric = new Set(section.numeric ?? []);
+  const head = section.columns.map(
+    (c, i) => `<th style="text-align:${numeric.has(i) ? "right" : "left"};padding:8px 12px;font-size:11px;letter-spacing:.08em;text-transform:uppercase;color:${colors.textMuted};border-bottom:1px solid ${colors.borderCard};white-space:nowrap">${esc(c)}</th>`
+  ).join("");
+  const body = section.rows.map(
+    (row) => `<tr>${row.map(
+      (cell, i) => `<td style="text-align:${numeric.has(i) ? "right" : "left"};padding:8px 12px;font-size:13px;color:${colors.textSecondary};border-bottom:1px solid ${colors.borderSubtle};white-space:nowrap">${esc(cell)}</td>`
+    ).join("")}</tr>`
+  ).join("");
+  return `<div style="overflow-x:auto"><table style="width:100%;border-collapse:collapse">${`<thead><tr>${head}</tr></thead>`}<tbody>${body}</tbody></table></div>`;
 }
-async function loadStorefrontBrand(target, overrides) {
-  const configPath = join3(target, "src", "brand.config.ts");
-  if (!await exists(configPath)) {
-    return { ...CARRIER_BRAND, ...overrides };
-  }
-  const src = await readFile(configPath, "utf8");
-  const pick = (field, fallback) => {
-    const m = src.match(new RegExp(`\\b${field}:\\s*(?:[^"\\n]*\\?\\?\\s*)?"([^"]*)"`));
-    return m?.[1] ?? fallback;
-  };
-  return {
-    ...CARRIER_BRAND,
-    name: overrides?.name ?? pick("name", CARRIER_BRAND.name),
-    domain: pick("domain", CARRIER_BRAND.domain),
-    supportEmail: pick("supportEmail", CARRIER_BRAND.supportEmail),
-    supportUrl: pick("supportUrl", CARRIER_BRAND.supportUrl),
-    tagline: pick("tagline", CARRIER_BRAND.tagline),
-    legalName: pick("legalName", CARRIER_BRAND.legalName),
-    colors: {
-      ...CARRIER_BRAND.colors,
-      accent: pick("accent", CARRIER_BRAND.colors.accent),
-      accentDark: pick("accentDark", CARRIER_BRAND.colors.accentDark),
-      bg: pick("bg", CARRIER_BRAND.colors.bg),
-      text: pick("text", CARRIER_BRAND.colors.text)
-    },
-    carrierApiUrl: CARRIER_BRAND.carrierApiUrl
-  };
+function keyValueHtml(items) {
+  const rows = items.map(
+    (kv) => `
+      <div style="display:flex;justify-content:space-between;gap:16px;padding:7px 0;border-bottom:1px solid ${colors.borderSubtle}">
+        <span style="font-size:13px;color:${colors.textMuted}">${esc(kv.label)}</span>
+        <span style="font-size:13px;color:${toneColor(kv.tone, colors.textPrimary)};text-align:right">${esc(kv.value)}</span>
+      </div>`
+  ).join("");
+  return `<div>${rows}</div>`;
 }
-async function deploySite(target, brand, opts = {}) {
-  const statuses = await probeAll(target);
-  let chosen;
-  if (opts.preferred) {
-    const wanted = statuses.find((s) => s.id === opts.preferred);
-    if (!wanted?.ready) {
-      return {
-        ok: false,
-        projectName: slug(brand.name),
-        statuses,
-        reason: wanted?.reason ?? `${opts.preferred} is not available on this machine.`
-      };
-    }
-    chosen = wanted;
-  } else {
-    chosen = rankTargets(statuses)[0];
-  }
-  if (!chosen) {
-    return {
-      ok: false,
-      projectName: slug(brand.name),
-      statuses,
-      reason: "No deploy target is ready. " + statuses.map((s) => `${s.label}: ${s.reason ?? "unavailable"}`).join(" | ")
-    };
-  }
-  const projectName = await configuredProjectName(chosen.id, target) ?? slug(brand.name);
-  if (opts.customDomain && chosen.id === "cloudflare" && brand.domain) {
-    await setCustomDomain(target, brand.domain);
-  }
-  let staged = { staged: [], failed: [], cleanup: async () => {
-  } };
-  if (opts.pushSecrets !== false) {
-    const discovered = await discoverSecrets(target, opts.env ?? process.env);
-    const runtime = {};
-    for (const key of RUNTIME_SECRET_KEYS) {
-      const value = discovered[key];
-      if (value) runtime[key] = value;
-    }
-    staged = await stageSecrets(chosen.id, target, projectName, runtime);
-  }
-  try {
-    const outcome = await deployTo(chosen.id, target, projectName, {
-      secretsFile: staged.secretsFile
-    });
-    if (!outcome.ok) {
-      return { ok: false, projectName, statuses, target: chosen.id, reason: outcome.reason };
-    }
-    return {
-      ok: true,
-      projectName,
-      statuses,
-      target: chosen.id,
-      url: outcome.url,
-      secrets: { pushed: staged.staged, failed: staged.failed }
-    };
-  } finally {
-    await staged.cleanup();
-  }
+function noteHtml(tone, text) {
+  const c = toneColor(tone, colors.accentFlame);
+  return `<div style="border-left:3px solid ${c};background:${colors.surface1};padding:10px 14px;border-radius:${radius.md};font-size:13px;color:${colors.textSecondary}">${esc(text)}</div>`;
 }
-
-// src/cli/lib/clerk.ts
-var CLERK_API_BASE = "https://api.clerk.com/v1";
-var PUBLISHABLE_KEYS = [
-  "CLERK_PUBLISHABLE_KEY",
-  "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY"
-];
-var SECRET_KEYS = ["CLERK_SECRET_KEY"];
-function firstNonEmpty(env, names) {
-  for (const name of names) {
-    const value = env[name]?.trim();
-    if (value) return value;
+function emptyHtml(text) {
+  return `<div style="padding:14px;border:1px dashed ${colors.borderCard};border-radius:${radius.md};font-size:13px;color:${colors.textMuted}">${esc(text)}</div>`;
+}
+function sectionHtml(section) {
+  const title = "title" in section && section.title ? `<h2 style="font-size:13px;font-weight:600;letter-spacing:.04em;color:${colors.textPrimary};margin:0 0 10px">${esc(section.title)}</h2>` : "";
+  let body;
+  switch (section.kind) {
+    case "metrics":
+      body = metricsHtml(section.items);
+      break;
+    case "bars":
+      body = barsHtml(section.items, section.empty);
+      break;
+    case "table":
+      body = tableHtml(section);
+      break;
+    case "keyvalue":
+      body = keyValueHtml(section.items);
+      break;
+    case "note":
+      body = noteHtml(section.tone, section.text);
+      break;
   }
-  return void 0;
+  return `<section style="margin-bottom:22px">${title}${body}</section>`;
 }
-function looksPublishable(key) {
-  return /^pk_(test|live)_/.test(key);
+function renderHtml(screen) {
+  const sections = isEmptyScreen(screen) ? emptyHtml(
+    "No data came back for this view. That is a real result, not a loading state \u2014 check the account scope and credentials."
+  ) : screen.sections.map(sectionHtml).join("");
+  const actions = screen.actions?.length ? `<section style="margin-top:6px;display:flex;flex-wrap:wrap;gap:8px">${screen.actions.map(
+    (a) => `<span title="${esc(a.description ?? a.command)}" style="font-size:12px;color:${colors.textSecondary};background:${colors.surface2};border:1px solid ${colors.borderCard};border-radius:${radius.full};padding:6px 12px">${esc(a.label)} <code style="color:${colors.textFaint}">${esc(a.command)}</code></span>`
+  ).join("")}</section>` : "";
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${esc(screen.title)}</title></head>
+<body style="margin:0;background:${colors.surface0};color:${colors.textPrimary};font-family:${typography.fontSans};padding:20px">
+  <header style="margin-bottom:20px">
+    <h1 style="font-size:18px;font-weight:600;margin:0;letter-spacing:-.01em">${esc(screen.title)}</h1>
+    ${screen.subtitle ? `<p style="margin:4px 0 0;font-size:13px;color:${colors.textMuted}">${esc(screen.subtitle)}</p>` : ""}
+  </header>
+  ${sections}
+  ${actions}
+  ${screen.footer ? `<footer style="margin-top:18px;font-size:11px;color:${colors.textFaint}">${esc(screen.footer)}</footer>` : ""}
+</body></html>`;
 }
-function looksSecret(key) {
-  return /^sk_(test|live)_/.test(key);
+var ANSI = {
+  ok: "\x1B[32m",
+  info: "\x1B[38;5;209m",
+  // Carrier flame, nearest 256-colour
+  warn: "\x1B[33m",
+  critical: "\x1B[31m",
+  muted: "\x1B[90m",
+  reset: "\x1B[0m",
+  bold: "\x1B[1m",
+  dim: "\x1B[2m"
+};
+function paint(text, code, color) {
+  return color ? `${code}${text}${ANSI.reset}` : text;
 }
-async function clerkFetch(path, token, init = {}) {
-  try {
-    const res = await fetch(`${CLERK_API_BASE}${path}`, {
-      method: init.method ?? "GET",
-      headers: {
-        Authorization: `Bearer ${token}`,
-        "Content-Type": "application/json"
-      },
-      body: init.body === void 0 ? void 0 : JSON.stringify(init.body)
-    });
-    const text = await res.text();
-    let json;
-    try {
-      json = text ? JSON.parse(text) : void 0;
-    } catch {
-      json = void 0;
-    }
-    if (!res.ok) {
-      return { ok: false, status: res.status, json, error: clerkError(json) ?? text.slice(0, 300) };
-    }
-    return { ok: true, status: res.status, json };
-  } catch (e) {
-    return { ok: false, status: 0, error: e instanceof Error ? e.message : String(e) };
-  }
+function displayWidth(text) {
+  return text.replace(/\[[0-9;]*m/g, "").length;
+}
+function pad(text, width, align) {
+  const gap = Math.max(0, width - displayWidth(text));
+  return align === "right" ? " ".repeat(gap) + text : text + " ".repeat(gap);
 }
-function clerkError(json) {
-  if (typeof json !== "object" || json === null) return void 0;
-  const errors = json.errors;
-  if (!Array.isArray(errors) || errors.length === 0) return void 0;
-  const first = errors[0];
-  return first.long_message ?? first.message;
+function heading(text, color) {
+  return paint(text.toUpperCase(), ANSI.bold, color);
 }
-async function createClerkApplication(platformToken, opts) {
-  const body = {
-    name: opts.name,
-    environment_types: opts.production ? ["development", "production"] : ["development"]
-  };
-  if (opts.domain) body.domain = opts.domain;
-  const res = await clerkFetch("/platform/applications", platformToken, {
-    method: "POST",
-    body
+function metricsTui(items, width, color) {
+  if (items.length === 0) return [];
+  const labelWidth = Math.min(
+    28,
+    Math.max(...items.map((m) => m.label.length))
+  );
+  return items.map((m) => {
+    const label = paint(pad(m.label, labelWidth, "left"), ANSI.muted, color);
+    const value = paint(String(m.value), m.tone ? ANSI[m.tone] : ANSI.bold, color);
+    const hint = m.hint ? paint(`  ${m.hint}`, ANSI.dim, color) : "";
+    return `  ${label}  ${value}${hint}`.slice(0, width + 64);
   });
-  if (!res.ok) {
-    return {
-      ok: false,
-      tier: "platform",
-      reason: res.status === 401 || res.status === 403 ? `Clerk Platform API rejected the token (HTTP ${res.status}). Check CLERK_PLATFORM_API_KEY.` : `Clerk Platform API error: ${res.error ?? `HTTP ${res.status}`}`
-    };
+}
+function barsTui(items, width, color, empty) {
+  if (items.length === 0) return [`  ${paint(empty ?? "Nothing to show.", ANSI.muted, color)}`];
+  const ceiling = Math.max(...items.map((b) => b.max ?? b.value), 1);
+  const labelWidth = Math.min(24, Math.max(...items.map((b) => b.label.length)));
+  const barWidth = Math.max(10, Math.min(40, width - labelWidth - 22));
+  return items.map((b) => {
+    const ratio = b.value / (b.max ?? ceiling) || 0;
+    const filled = Math.max(0, Math.min(barWidth, Math.round(ratio * barWidth)));
+    const bar = paint("\u2588".repeat(filled), b.tone ? ANSI[b.tone] : ANSI.info, color) + paint("\u2591".repeat(barWidth - filled), ANSI.dim, color);
+    const label = paint(pad(b.label, labelWidth, "left"), ANSI.muted, color);
+    const value = paint(String(b.hint ?? b.value), ANSI.dim, color);
+    return `  ${label}  ${bar}  ${value}`;
+  });
+}
+function tableTui(section, width, color) {
+  if (section.rows.length === 0) {
+    return [`  ${paint(section.empty ?? "No rows.", ANSI.muted, color)}`];
   }
-  const payload = res.json;
-  const instances = payload?.instances ?? [];
-  const wanted = opts.production ? "production" : "development";
-  const instance = instances.find((i) => i.environment_type === wanted && i.secret_key && i.publishable_key) ?? instances.find((i) => i.secret_key && i.publishable_key);
-  if (!instance?.secret_key || !instance.publishable_key) {
-    return {
-      ok: false,
-      tier: "platform",
-      reason: "Clerk created the application but returned no instance keys. Read them with GET /platform/applications?include_secret_keys=true."
-    };
+  const numeric = new Set(section.numeric ?? []);
+  const cols = section.columns.length;
+  const widths = Array.from(
+    { length: cols },
+    (_, i) => Math.max(
+      section.columns[i]?.length ?? 0,
+      ...section.rows.map((r) => String(r[i] ?? "").length)
+    )
+  );
+  let total = widths.reduce((a, b) => a + b + 2, 2);
+  while (total > width && Math.max(...widths) > 8) {
+    const widest = widths.indexOf(Math.max(...widths));
+    widths[widest] -= 1;
+    total -= 1;
   }
-  return {
-    ok: true,
-    tier: "platform",
-    credentials: {
-      publishableKey: instance.publishable_key,
-      secretKey: instance.secret_key,
-      tier: "platform",
-      applicationId: payload?.application_id,
-      instanceId: instance.instance_id
-    }
+  const clip = (cell, i) => {
+    const text = String(cell ?? "");
+    return text.length > widths[i] ? `${text.slice(0, Math.max(1, widths[i] - 1))}\u2026` : text;
   };
+  const header = "  " + section.columns.map((c, i) => paint(pad(clip(c, i), widths[i], numeric.has(i) ? "right" : "left"), ANSI.muted, color)).join("  ");
+  const rule = "  " + paint(widths.map((w) => "\u2500".repeat(w)).join("  "), ANSI.dim, color);
+  const body = section.rows.map(
+    (row) => "  " + row.map((cell, i) => pad(clip(cell, i), widths[i], numeric.has(i) ? "right" : "left")).join("  ")
+  );
+  return [header, rule, ...body];
 }
-async function mintKeylessClerkApp(storefront, deps) {
-  if (!await deps.which("npx")) {
-    return { ok: false, tier: "cli-keyless", reason: "npx not found \u2014 cannot run the Clerk CLI." };
+function keyValueTui(items, color) {
+  if (items.length === 0) return [];
+  const labelWidth = Math.min(30, Math.max(...items.map((kv) => kv.label.length)));
+  return items.map(
+    (kv) => `  ${paint(pad(kv.label, labelWidth, "left"), ANSI.muted, color)}  ${paint(kv.value, kv.tone ? ANSI[kv.tone] : ANSI.reset, color)}`
+  );
+}
+var NOTE_PREFIX = {
+  ok: "ok",
+  info: "note",
+  warn: "warning",
+  critical: "critical",
+  muted: "note"
+};
+function sectionTui(section, width, color) {
+  const lines = [];
+  if ("title" in section && section.title) lines.push(heading(section.title, color));
+  switch (section.kind) {
+    case "metrics":
+      lines.push(...metricsTui(section.items, width, color));
+      break;
+    case "bars":
+      lines.push(...barsTui(section.items, width, color, section.empty));
+      break;
+    case "table":
+      lines.push(...tableTui(section, width, color));
+      break;
+    case "keyvalue":
+      lines.push(...keyValueTui(section.items, color));
+      break;
+    case "note":
+      lines.push(
+        `  ${paint(`${NOTE_PREFIX[section.tone]}:`, ANSI[section.tone], color)} ${section.text}`
+      );
+      break;
   }
-  const restore = await deps.snapshot(storefront);
-  try {
-    const r = await deps.run(
-      "npx",
-      ["--yes", "clerk@latest", "init", "--framework", "next", "--keyless", "--no-skills", "-y"],
-      { cwd: storefront, timeoutMs: 6e5 }
+  lines.push("");
+  return lines;
+}
+function renderTui(screen, opts = {}) {
+  const width = Math.max(40, Math.min(160, opts.width ?? 80));
+  const color = opts.color ?? true;
+  const lines = [];
+  lines.push(paint(screen.title, ANSI.bold, color));
+  if (screen.subtitle) lines.push(paint(screen.subtitle, ANSI.muted, color));
+  lines.push(paint("\u2500".repeat(width), ANSI.dim, color));
+  lines.push("");
+  if (isEmptyScreen(screen)) {
+    lines.push(
+      `  ${paint("No data came back for this view.", ANSI.warn, color)} That is a real result, not a`,
+      "  loading state \u2014 check the account scope and credentials.",
+      ""
     );
-    const envPath = `${storefront}/.env.local`;
-    const body = await deps.readFileIfExists(envPath) ?? "";
-    const publishableKey = matchEnv(body, "NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY");
-    const secretKey = matchEnv(body, "CLERK_SECRET_KEY");
-    if (!publishableKey || !secretKey) {
-      const tail = `${r.stdout}${r.stderr}`.trim().split("\n").slice(-2).join(" ").slice(0, 300);
-      return {
-        ok: false,
-        tier: "cli-keyless",
-        reason: `Clerk CLI did not produce keys${tail ? `: ${tail}` : "."}`
-      };
-    }
-    if (!looksPublishable(publishableKey) || !looksSecret(secretKey)) {
-      return { ok: false, tier: "cli-keyless", reason: "Clerk CLI wrote keys in an unexpected format." };
+  } else {
+    for (const section of screen.sections) lines.push(...sectionTui(section, width, color));
+  }
+  if (screen.actions?.length) {
+    lines.push(heading("next", color));
+    for (const a of screen.actions) {
+      lines.push(`  ${paint(a.command, ANSI.info, color)}  ${paint(a.label, ANSI.dim, color)}`);
     }
-    return {
-      ok: true,
-      tier: "cli-keyless",
-      credentials: { publishableKey, secretKey, tier: "cli-keyless" }
-    };
-  } finally {
-    await restore();
+    lines.push("");
   }
+  if (screen.footer) lines.push(paint(screen.footer, ANSI.dim, color));
+  return lines.join("\n");
 }
-function matchEnv(body, key) {
-  const line = body.split("\n").find((l) => l.trim().startsWith(`${key}=`));
-  const value = line?.slice(line.indexOf("=") + 1).trim();
-  return value || void 0;
-}
-function discoverClerkCredentials(env) {
-  const publishableKey = firstNonEmpty(env, PUBLISHABLE_KEYS);
-  const secretKey = firstNonEmpty(env, SECRET_KEYS);
-  if (!publishableKey || !secretKey) return void 0;
-  if (!looksPublishable(publishableKey) || !looksSecret(secretKey)) return void 0;
-  return { publishableKey, secretKey, tier: "discovered" };
+var pct = (part, total) => total > 0 ? `${(part / total * 100).toFixed(1)}%` : "0%";
+var money = (value, currency = "") => `${currency}${value.toFixed(2)}`.trim();
+function humanBytes(bytes) {
+  if (!Number.isFinite(bytes) || bytes <= 0) return "0 MB";
+  const gb = bytes / 1073741824;
+  if (gb >= 1) return `${gb.toFixed(gb >= 10 ? 0 : 1)} GB`;
+  return `${(bytes / 1048576).toFixed(0)} MB`;
 }
-var MANUAL_STEPS = [
-  "Open https://dashboard.clerk.com and create an application.",
-  "Copy the Publishable key (pk_...) and Secret key (sk_...) from API keys.",
-  "Put them in the storefront's .env.local as NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY and CLERK_SECRET_KEY.",
-  "Re-run `carrier site deploy` \u2014 the keys are pushed to the deploy target automatically."
-];
-async function provisionClerk(opts) {
-  const platformToken = firstNonEmpty(opts.env, [
-    "CLERK_PLATFORM_API_KEY",
-    "CLERK_PLATFORM_TOKEN"
-  ]);
-  const notes = [];
-  if (platformToken && !opts.noCreate) {
-    const created = await createClerkApplication(platformToken, {
-      name: opts.name,
-      domain: opts.domain,
-      production: opts.production
+function fleetScreen(input) {
+  const total = input.active + input.suspended + input.inventory + input.other;
+  const lowBalance = input.accounts.filter((a) => a.balance < 10);
+  const criticals = lowBalance.filter((a) => a.packageOnly && a.balance === 0);
+  const sections = [
+    {
+      kind: "metrics",
+      items: [
+        { label: "Total eSIMs", value: total },
+        { label: "Active", value: input.active, hint: pct(input.active, total), tone: "ok" },
+        { label: "Inventory", value: input.inventory, hint: pct(input.inventory, total) },
+        {
+          label: "Suspended",
+          value: input.suspended,
+          hint: pct(input.suspended, total),
+          tone: input.suspended > input.active * 0.1 ? "warn" : void 0
+        },
+        { label: "Accounts", value: input.accounts.length },
+        {
+          label: "Low balance",
+          value: lowBalance.length,
+          tone: lowBalance.length > 0 ? "warn" : "ok"
+        }
+      ]
+    }
+  ];
+  const hasPerAccountCounts = input.accounts.some(
+    (a) => a.active + a.suspended + a.inventory + a.other > 0
+  );
+  if (hasPerAccountCounts) {
+    sections.push({
+      kind: "bars",
+      title: "eSIMs by account",
+      items: [...input.accounts].sort((a, b) => b.active + b.inventory - (a.active + a.inventory)).slice(0, 10).map((a) => ({
+        label: a.name,
+        value: a.active + a.suspended + a.inventory + a.other,
+        hint: `${a.active} active`,
+        tone: a.active > 0 ? "ok" : "muted"
+      }))
     });
-    if (created.ok) return created;
-    notes.push(created.reason ?? "Clerk Platform API call failed.");
-  }
-  const discovered = discoverClerkCredentials(opts.env);
-  if (discovered) {
-    return {
-      ok: true,
-      tier: "discovered",
-      credentials: discovered,
-      reason: notes.length ? notes.join(" ") : void 0
-    };
   }
-  if (opts.cli && opts.storefront && !opts.noCreate) {
-    const minted = await mintKeylessClerkApp(opts.storefront, opts.cli);
-    if (minted.ok) {
-      return { ...minted, reason: notes.length ? notes.join(" ") : void 0 };
-    }
-    notes.push(minted.reason ?? "Clerk CLI keyless provisioning failed.");
+  sections.push({
+    kind: "table",
+    title: "Accounts",
+    columns: ["Account", "Balance", "Active", "Inventory"],
+    numeric: [1, 2, 3],
+    empty: "No accounts under this reseller.",
+    rows: input.accounts.map((a) => [a.name, money(a.balance), a.active, a.inventory])
+  });
+  if (criticals.length > 0) {
+    sections.push({
+      kind: "note",
+      tone: "critical",
+      text: `${criticals.length} package-only account(s) at zero balance \u2014 packages cannot be assigned until topped up: ${criticals.map((a) => a.name).join(", ")}.`
+    });
   }
-  if (!platformToken) {
-    notes.push(
-      "No CLERK_PLATFORM_API_KEY set, so a new Clerk application cannot be created through the Platform API (it is a partner surface, not self-serve)."
-    );
+  for (const missing of input.unavailable ?? []) {
+    sections.push({ kind: "note", tone: "warn", text: `Unavailable: ${missing}` });
   }
   return {
-    ok: false,
-    tier: "manual",
-    reason: notes.join(" "),
-    guidance: MANUAL_STEPS
+    id: "fleet-health",
+    title: "Fleet health",
+    subtitle: `${total} eSIMs across ${input.accounts.length} account(s) \xB7 ${pct(input.active, total)} utilisation`,
+    sections,
+    actions: [
+      { label: "Top up an account", command: "wallet_topup_checkout" },
+      { label: "Per-account eSIM status", command: "esim_status_per_account" }
+    ]
   };
 }
-async function configureClerkInstance(secretKey, opts) {
-  const applied = [];
-  const failed = [];
-  const origins = dedupe(opts.allowedOrigins ?? []);
-  if (origins.length > 0) {
-    const res = await clerkFetch("/instance", secretKey, {
-      method: "PATCH",
-      body: { allowed_origins: origins }
+function subscribersScreen(rows, opts = {}) {
+  const byStatus = /* @__PURE__ */ new Map();
+  for (const r of rows) byStatus.set(r.status, (byStatus.get(r.status) ?? 0) + 1);
+  return {
+    id: "subscribers",
+    title: "Subscribers",
+    subtitle: opts.account ? `Account ${opts.account} \xB7 ${rows.length} shown` : `${rows.length} shown`,
+    sections: [
+      {
+        kind: "metrics",
+        items: [
+          { label: "Listed", value: rows.length },
+          ...[...byStatus.entries()].map(([status, count]) => ({
+            label: status,
+            value: count,
+            tone: status.toLowerCase() === "active" ? "ok" : void 0
+          }))
+        ]
+      },
+      {
+        kind: "table",
+        title: "Records",
+        columns: ["ICCID", "MSISDN", "Status", "Account", "Data used"],
+        numeric: [4],
+        empty: "No subscribers matched. Widen the filter or check the account scope.",
+        rows: rows.map((r) => [
+          r.iccid,
+          r.msisdn ?? "\u2014",
+          r.status,
+          r.account ?? "\u2014",
+          r.dataUsedBytes === void 0 ? "\u2014" : humanBytes(r.dataUsedBytes)
+        ])
+      }
+    ],
+    actions: [
+      { label: "Diagnose one", command: "diagnose_subscriber" },
+      { label: "Usage detail", command: "subscriber_usage" }
+    ]
+  };
+}
+function usageScreen(input) {
+  const total = input.totalBytes ?? input.timeline.reduce((sum, p) => sum + p.bytes, 0);
+  const peak = input.timeline.reduce(
+    (best, p) => p.bytes > best.bytes ? p : best,
+    { date: "\u2014", bytes: 0 }
+  );
+  const sections = [
+    {
+      kind: "metrics",
+      items: [
+        { label: "Total", value: humanBytes(total) },
+        { label: "Days", value: input.timeline.length },
+        { label: "Peak day", value: humanBytes(peak.bytes), hint: peak.date },
+        {
+          label: "Daily average",
+          value: humanBytes(input.timeline.length ? total / input.timeline.length : 0)
+        }
+      ]
+    },
+    {
+      kind: "bars",
+      title: "Daily usage",
+      empty: "No usage recorded in this window.",
+      items: input.timeline.map((p) => ({
+        label: p.date,
+        value: p.bytes,
+        hint: humanBytes(p.bytes)
+      }))
+    }
+  ];
+  if (input.countries?.length) {
+    sections.push({
+      kind: "bars",
+      title: "By country",
+      items: input.countries.slice(0, 10).map((c) => ({ label: c.country, value: c.bytes, hint: humanBytes(c.bytes) }))
     });
-    if (res.ok) applied.push(`allowed_origins (${origins.length})`);
-    else failed.push({ step: "allowed_origins", reason: res.error ?? `HTTP ${res.status}` });
-  }
-  for (const url of dedupe(opts.redirectUrls ?? [])) {
-    const res = await clerkFetch("/redirect_urls", secretKey, { method: "POST", body: { url } });
-    if (res.ok) applied.push(`redirect_url ${url}`);
-    else failed.push({ step: `redirect_url ${url}`, reason: res.error ?? `HTTP ${res.status}` });
   }
-  return { ok: failed.length === 0, applied, failed };
+  return {
+    id: "usage",
+    title: "Usage",
+    subtitle: input.subject,
+    sections,
+    actions: [{ label: "Project depletion", command: "usage_projection" }]
+  };
 }
-function dedupe(values) {
-  return [...new Set(values.map((v) => v.trim()).filter(Boolean))];
+function packagesScreen(rows) {
+  return {
+    id: "packages",
+    title: "Package catalog",
+    subtitle: `${rows.length} template(s)`,
+    sections: [
+      {
+        kind: "metrics",
+        items: [
+          { label: "Templates", value: rows.length },
+          { label: "Recurring", value: rows.filter((r) => r.recurring).length }
+        ]
+      },
+      {
+        kind: "table",
+        title: "Templates",
+        columns: ["Name", "ID", "Data", "Validity", "Price"],
+        numeric: [2, 3, 4],
+        empty: "No package templates visible to this account.",
+        rows: rows.map((r) => [
+          r.name,
+          String(r.id),
+          r.dataLimitBytes === void 0 ? "\u2014" : humanBytes(r.dataLimitBytes),
+          r.validityDays === void 0 ? "\u2014" : `${r.validityDays}d`,
+          r.price === void 0 ? "\u2014" : money(r.price)
+        ])
+      }
+    ],
+    actions: [{ label: "Assign to a subscriber", command: "assign_package" }]
+  };
 }
-function storefrontClerkUrls(deployedUrl, domain) {
-  const bases = dedupe([
-    deployedUrl?.replace(/\/$/, "") ?? "",
-    domain ? `https://${domain.replace(/^https?:\/\//, "").replace(/\/$/, "")}` : "",
-    "http://localhost:3000"
-  ]);
+function billingScreen(input) {
+  const spend = input.events.reduce((sum, e) => sum + (e.amount > 0 ? e.amount : 0), 0);
   return {
-    allowedOrigins: bases,
-    redirectUrls: bases.flatMap((b) => [b, `${b}/checkout/success`, `${b}/dashboard`])
+    id: "billing",
+    title: "Billing",
+    subtitle: `${input.events.length} recent event(s)`,
+    sections: [
+      {
+        kind: "metrics",
+        items: [
+          {
+            label: "Balance",
+            value: input.balance === void 0 ? "\u2014" : money(input.balance, input.currency),
+            tone: (input.balance ?? 0) < 10 ? "warn" : "ok"
+          },
+          {
+            label: "Pending",
+            value: input.pending === void 0 ? "\u2014" : money(input.pending, input.currency)
+          },
+          { label: "Recent spend", value: money(spend, input.currency) }
+        ]
+      },
+      {
+        kind: "table",
+        title: "Recent events",
+        columns: ["Date", "Description", "Amount"],
+        numeric: [2],
+        empty: "No billing events in this window.",
+        rows: input.events.map((e) => [e.date, e.description, money(e.amount, input.currency)])
+      }
+    ],
+    actions: [{ label: "Check payouts", command: "stripe_connect_payouts" }]
+  };
+}
+function walletScreen(input) {
+  const low = input.balance < (input.threshold ?? 10);
+  return {
+    id: "wallet",
+    title: "Wallet",
+    subtitle: input.autoTopupEnabled ? "Auto top-up is on" : "Auto top-up is off",
+    sections: [
+      {
+        kind: "metrics",
+        items: [
+          {
+            label: "Balance",
+            value: money(input.balance, input.currency),
+            tone: low ? "warn" : "ok"
+          },
+          ...input.credits === void 0 ? [] : [{ label: "Credits", value: input.credits }]
+        ]
+      },
+      {
+        kind: "keyvalue",
+        title: "Settings",
+        items: [
+          { label: "Auto top-up", value: input.autoTopupEnabled ? "enabled" : "disabled" },
+          {
+            label: "Threshold",
+            value: input.threshold === void 0 ? "\u2014" : money(input.threshold, input.currency)
+          }
+        ]
+      },
+      ...low ? [
+        {
+          kind: "note",
+          tone: "warn",
+          text: "Balance is under the top-up threshold. Package assignment fails at zero on package-only accounts."
+        }
+      ] : []
+    ],
+    actions: [
+      { label: "Top up", command: "wallet_topup_checkout" },
+      { label: "Configure auto top-up", command: "wallet_auto_topup" }
+    ]
   };
 }
-
-// src/cli/lib/clerk-cli.ts
-import { join as join4 } from "path";
-import { cp, mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
-import { tmpdir as tmpdir2 } from "os";
-var SNAPSHOT_PATHS = ["src", "package.json", "next.config.mjs", "middleware.ts"];
-function clerkCliDeps() {
+function greenzoneScreen(entries) {
   return {
-    which,
-    run: async (cmd, args, opts) => {
-      const r = await run(cmd, args, opts);
-      return { ok: r.ok, stdout: r.stdout, stderr: r.stderr };
-    },
-    readFileIfExists: async (path) => {
-      if (!await exists(path)) return void 0;
-      try {
-        return await readFile(path, "utf8");
-      } catch {
-        return void 0;
-      }
-    },
-    snapshot: async (storefront) => {
-      const backup = await mkdtemp2(join4(tmpdir2(), "carrier-clerk-snap-"));
-      const saved = [];
-      for (const rel of SNAPSHOT_PATHS) {
-        const src = join4(storefront, rel);
-        if (!await exists(src)) continue;
-        await cp(src, join4(backup, rel), { recursive: true });
-        saved.push(rel);
+    id: "greenzone",
+    title: "Greenzone whitelist",
+    subtitle: `${entries.length} entr${entries.length === 1 ? "y" : "ies"}`,
+    sections: [
+      { kind: "metrics", items: [{ label: "Entries", value: entries.length }] },
+      {
+        kind: "table",
+        title: "Whitelisted",
+        columns: ["Value", "Note"],
+        empty: "Whitelist is empty \u2014 every destination follows the default policy.",
+        rows: entries.map((e) => [e.value, e.note ?? "\u2014"])
       }
-      return async () => {
-        try {
-          for (const rel of saved) {
-            const target = join4(storefront, rel);
-            await rm2(target, { recursive: true, force: true });
-            await cp(join4(backup, rel), target, { recursive: true });
-          }
-        } finally {
-          await rm2(backup, { recursive: true, force: true });
-        }
-      };
-    }
+    ],
+    actions: [
+      { label: "Add an entry", command: "greenzone_whitelist_add" },
+      { label: "Remove an entry", command: "greenzone_whitelist_remove" }
+    ]
   };
 }
-
-// src/cli/lib/verify-storefront.ts
-var PROBES = [
-  { path: "/" },
-  { path: "/shop", expectBody: /·/ },
-  // plan names render as "Visit · Calm"
-  { path: "/help" }
-];
-async function probe(base, path, expectBody) {
-  const url = `${base.replace(/\/$/, "")}${path}${path.includes("?") ? "&" : "?"}_v=${Date.now()}`;
-  try {
-    const res = await fetch(url, { redirect: "manual" });
-    const status = res.status;
-    const ok = status < 400;
-    if (!expectBody || !ok) return { path, status, ok };
-    const body = await res.text();
-    return { path, status, ok, bodyOk: expectBody.test(body) };
-  } catch (e) {
-    return { path, status: 0, ok: false, error: e instanceof Error ? e.message : String(e) };
-  }
-}
-function diagnose(probes, secrets) {
-  const by = (p) => probes.find((x) => x.path === p);
-  const root = by("/");
-  const shop = by("/shop");
-  const help = by("/help");
-  if (probes.every((p) => p.ok && p.bodyOk !== false)) return "healthy";
-  if (probes.every((p) => p.status === 0)) return "not-deployed";
-  const catalogDown = root?.status === 500 && shop?.status === 500;
-  if (catalogDown && help?.ok) {
-    return needsCarrierKey(secrets) ? "carrier-key-missing" : "unclassified";
-  }
-  if (shop?.ok && shop.bodyOk === false) return "empty-catalog";
-  if (root?.ok && shop?.ok && probes.some((p) => p.status >= 500)) return "clerk-keys-missing";
-  if (probes.every((p) => p.status === 404)) return "not-deployed";
-  return "unclassified";
-}
-var SUMMARIES = {
-  healthy: "All probes returned a working page.",
-  "carrier-key-missing": "Catalog pages return 500 while non-catalog pages work \u2014 CARRIER_API_KEY is missing or invalid on the host.",
-  "clerk-keys-missing": "Public pages work but auth routes error \u2014 Clerk keys are missing on the host.",
-  "empty-catalog": "/shop renders but no plans are in it \u2014 the Carrier catalog returned nothing sellable. Not a deploy problem.",
-  "not-deployed": "Nothing served at the deployed URL \u2014 the deploy did not land, or the URL is wrong.",
-  unclassified: "The storefront is not serving correctly and the symptom matches no known cause."
-};
-var REPAIRABLE = /* @__PURE__ */ new Set([
-  "carrier-key-missing",
-  "clerk-keys-missing"
-]);
-var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-async function verifyStorefront(url, storefront, env = process.env, opts = {}) {
-  const attempts = Math.max(1, opts.attempts ?? 4);
-  const delayMs = opts.delayMs ?? 5e3;
-  const secrets = await discoverSecrets(storefront, env);
-  let probes = [];
-  let diagnosis = "unclassified";
-  for (let attempt = 1; attempt <= attempts; attempt++) {
-    probes = [];
-    for (const { path, expectBody } of PROBES) {
-      probes.push(await probe(url, path, expectBody));
+function storefrontScreen(input) {
+  const sections = [
+    {
+      kind: "metrics",
+      items: [
+        {
+          label: "Status",
+          value: input.verified === true ? "serving" : input.verified === false ? "broken" : "unknown",
+          tone: input.verified === true ? "ok" : input.verified === false ? "critical" : "muted"
+        },
+        { label: "Host", value: input.target ?? "\u2014" },
+        { label: "Plans", value: input.plans ?? "\u2014" },
+        { label: "Secrets", value: input.secretsStaged?.length ?? 0 }
+      ]
+    },
+    {
+      kind: "keyvalue",
+      title: "Deployment",
+      items: [
+        { label: "Brand", value: input.brand },
+        { label: "URL", value: input.url ?? "not deployed" },
+        ...input.diagnosis ? [{ label: "Diagnosis", value: input.diagnosis, tone: "warn" }] : []
+      ]
     }
-    diagnosis = diagnose(probes, secrets);
-    if (diagnosis !== "not-deployed" || attempt === attempts) break;
-    await sleep(delayMs);
+  ];
+  if (input.probes?.length) {
+    sections.push({
+      kind: "table",
+      title: "Probes",
+      columns: ["Path", "Status"],
+      numeric: [1],
+      rows: input.probes.map((p) => [p.path, p.status === 0 ? "unreachable" : p.status])
+    });
+  }
+  if (input.secretsMissing?.length) {
+    sections.push({
+      kind: "note",
+      tone: "critical",
+      text: `Missing runtime secret(s): ${input.secretsMissing.join(", ")}. The build and deploy both succeed without them and the site fails at request time.`
+    });
   }
-  const ok = diagnosis === "healthy";
   return {
-    ok,
-    url,
-    probes,
-    diagnosis,
-    summary: SUMMARIES[diagnosis],
-    repairable: !ok && REPAIRABLE.has(diagnosis)
+    id: "storefront",
+    title: "Storefront",
+    subtitle: input.url ?? input.brand,
+    sections,
+    actions: [
+      { label: "Deploy", command: "carrier site deploy" },
+      { label: "Check hosts", command: "carrier site targets" }
+    ]
   };
 }
-function formatProbes(probes) {
-  return probes.map((p) => {
-    const status = p.status === 0 ? "unreachable" : String(p.status);
-    const body = p.bodyOk === false ? " (no plans)" : "";
-    return `${p.path} ${status}${body}`;
-  }).join("  ");
-}
-function repairPlanFor(diagnosis) {
-  if (diagnosis === "carrier-key-missing") {
-    return {
-      diagnosis,
-      runClerk: false,
-      // CARRIER_API_KEY is read at request time, so re-staging and redeploying
-      // is enough; no rebuild needed.
-      rebuild: false,
-      note: "Re-resolve CARRIER_API_KEY, stage it, and redeploy."
-    };
-  }
-  if (diagnosis === "clerk-keys-missing") {
-    return {
-      diagnosis,
-      runClerk: true,
-      // The publishable key is inlined at build time, so this one must rebuild.
-      rebuild: true,
-      note: "Provision Clerk, rebuild so the publishable key is inlined, and redeploy."
-    };
-  }
-  return void 0;
-}
 
 // package.json
 var package_default = {
   name: "@carrierllc/mcp",
-  version: "0.5.0",
+  version: "0.7.0",
   description: "Carrier MCP \u2014 natural-language control of MVNO/eSIM fleets via eSIMVault OCS. Stdio mode for direct integration with Claude Desktop, Cursor, Windsurf, and MCP-compatible clients. Ships the `carrier` CLI (plugin install + white-label eSIM storefront scaffold).",
   license: "MIT",
   author: "Carrier (Lifecycle Innovations Limited)",
@@ -1823,7 +1823,8 @@ var package_default = {
     lint: "eslint src",
     prepublishOnly: "pnpm run build",
     test: "pnpm run build && node --test test/*.test.js",
-    "check:pack": "node scripts/check-pack-size.mjs"
+    "check:pack": "node scripts/check-pack-size.mjs",
+    "generate:domains": "node scripts/generate-domains.mjs"
   },
   dependencies: {
     "@clack/prompts": "^0.7.0",
@@ -2274,6 +2275,118 @@ function normalizePackageTemplateChanges(changes) {
   return out;
 }
 
+// ../../packages/ocs-client/dist/index.js
+function buildListSubscriberParams(args) {
+  const params = {};
+  if (args.imsi) params.imsiPrefix = args.imsi;
+  if (args.iccid) params.iccidPrefix = args.iccid;
+  if (args.activationCode) params.activationCode = args.activationCode;
+  if (args.accountId !== void 0) params.accountId = args.accountId;
+  if (args.msisdn) params.msisdnPrefix = args.msisdn;
+  return params;
+}
+function extractSubscriberStatus(row) {
+  if (row === null || typeof row !== "object") return null;
+  const raw = row.status;
+  if (typeof raw === "string" && raw.length > 0) return raw;
+  if (Array.isArray(raw)) {
+    for (const entry of raw) {
+      if (entry && typeof entry === "object") {
+        const name = entry.status;
+        if (typeof name === "string" && name.length > 0) return name;
+      }
+    }
+  }
+  return null;
+}
+function unwrapSubscriberList(raw) {
+  if (Array.isArray(raw)) return { rows: raw, envelope: null };
+  if (raw !== null && typeof raw === "object") {
+    const obj = raw;
+    if (Array.isArray(obj.subscriberList)) {
+      return { rows: obj.subscriberList, envelope: obj };
+    }
+  }
+  return { rows: null, envelope: null };
+}
+function rewrapSubscriberList(raw, envelope, rows, filtered, matched) {
+  if (rows === null || filtered === null) return raw;
+  const total = matched ?? filtered.length;
+  const dropped = total - filtered.length;
+  if (envelope === null) return filtered;
+  const out = {
+    ...envelope,
+    subscriberList: filtered,
+    nbFound: total,
+    hasMore: filtered.length < total
+  };
+  if (dropped > 0) {
+    out.truncated = true;
+    out.note = `${dropped} of ${total} matching subscribers omitted by offset/limit. Narrow with \`status\`, \`accountId\` or \`iccid\`, or page with \`offset\`.`;
+  }
+  return out;
+}
+function applySubscriberFilters(raw, args) {
+  const { rows, envelope } = unwrapSubscriberList(raw);
+  let filtered = rows;
+  if (filtered && args.status) {
+    const wanted = String(args.status).trim().toLowerCase();
+    filtered = filtered.filter((row) => {
+      const status = extractSubscriberStatus(row);
+      return status !== null && status.toLowerCase() === wanted;
+    });
+  }
+  const matched = filtered?.length;
+  if (filtered && typeof args.offset === "number" && args.offset > 0) {
+    filtered = filtered.slice(args.offset);
+  }
+  if (filtered && typeof args.limit === "number" && args.limit >= 0) {
+    filtered = filtered.slice(0, args.limit);
+  }
+  return rewrapSubscriberList(raw, envelope, rows, filtered, matched);
+}
+var descriptions = /* @__PURE__ */ new Map();
+function recordToolDescription(name, description) {
+  if (description) descriptions.set(name, description);
+}
+function getToolDescription(name) {
+  return descriptions.get(name);
+}
+function routerDescription(full) {
+  if (!full) return void 0;
+  const sentences = full.split(/(?<=\.)\s+(?=[A-Z`'"])/).map((s) => s.trim()).filter(Boolean);
+  const kept = [
+    ...sentences.slice(0, 2),
+    ...sentences.slice(2).filter((s) => /\bDo NOT\b/i.test(s))
+  ];
+  return kept.length ? kept.join(" ") : full;
+}
+function buildRouterCatalog(opts) {
+  const curatedByName = new Map(opts.curated.map((t) => [t.name, t]));
+  const tools = [];
+  for (const name of [...opts.toolNames].sort()) {
+    if (name === "carrier_ask" || name === "carrier_clarify") continue;
+    const curated = curatedByName.get(name);
+    const real = routerDescription(getToolDescription(name));
+    tools.push({
+      name,
+      description: real ?? curated?.description ?? `Carrier MCP tool \`${name}\`. Required scope: ${opts.getScope(name)}. Use when the user intent clearly matches this tool name or its domain.`,
+      input_schema: curated?.input_schema ?? { type: "object", properties: {} }
+    });
+  }
+  return [opts.clarifyTool, ...tools];
+}
+var ROUTER_RULES = `Rules:
+1. Pick the single best-matching tool. Never pick carrier_ask (the router itself).
+2. Extract any parameters mentioned in the intent (ICCID, account IDs, amounts, etc.) as the tool's input.
+3. Use carrier_clarify when the intent is ambiguous between several tools, AND when no tool actually answers the question. Returning nothing useful is correct and expected; a near-miss is not.
+4. DESTRUCTIVE tools are flagged in their descriptions \u2014 still pick them if they match; the safety layer handles the confirm flow.
+5. Only include params explicitly mentioned in the intent.
+6. Context fields (iccid, account_id, reseller_id) from the routing context take precedence.
+7. A tool answers the question only if its description says it does. Do not infer capability from the tool's NAME: several names share words with unrelated questions, and picking on the name alone has produced confidently wrong answers.
+8. Read the "Do NOT use this to \u2026" steers in a description as hard exclusions. They exist because that tool is the common wrong answer for a neighbouring question, and they name the tool to use instead.
+9. Prefer carrier_clarify over a tool that would return real data about a different question. Answering "which subscribers erode margin" when the user asked "what do my users' megabytes cost in total" is worse than admitting the gap, because the output looks like an answer.`;
+
 // src/lib/storefront-logo.ts
 var OPENAI_KEY_NAMES = [
   "OPENAI_API_KEY",
@@ -2411,16 +2524,11 @@ export {
   esimStatusPerAccountParams,
   normalizePackageTemplate,
   normalizePackageTemplateChanges,
-  renderHtml,
-  renderTui,
-  fleetScreen,
-  subscribersScreen,
-  usageScreen,
-  packagesScreen,
-  billingScreen,
-  walletScreen,
-  greenzoneScreen,
-  storefrontScreen,
+  buildListSubscriberParams,
+  applySubscriberFilters,
+  recordToolDescription,
+  buildRouterCatalog,
+  ROUTER_RULES,
   generateStorefrontLogo,
   run,
   which,
@@ -2447,6 +2555,16 @@ export {
   verifyStorefront,
   formatProbes,
   repairPlanFor,
+  renderHtml,
+  renderTui,
+  fleetScreen,
+  subscribersScreen,
+  usageScreen,
+  packagesScreen,
+  billingScreen,
+  walletScreen,
+  greenzoneScreen,
+  storefrontScreen,
   CARRIER_VERSION
 };
-//# sourceMappingURL=chunk-QZBALDKD.js.map
+//# sourceMappingURL=chunk-CQ6EOLA7.js.map