@carrierllc/mcp 0.8.0 → 0.9.0

package/dist/index.js

@@ -37,7 +37,7 @@ import {
   subscriberIdParams,
   usageOverPeriodParams,
   verifyStorefront
-} from "./chunk-JROD4YAU.js";
+} from "./chunk-VACB3Z5V.js";
 import "./chunk-SHKKVIIA.js";
 
 // src/index.ts
@@ -69,11 +69,11 @@ var OcsClient = class {
   async call(method, params = {}) {
     await acquireEndpointSlot(this.token, method, "interactive");
     const url = `${this.baseUrl}/v1?token=${this.token}`;
-    const body = JSON.stringify({ [method]: params });
+    const body2 = JSON.stringify({ [method]: params });
     const res = await fetch(url, {
       method: "POST",
       headers: { "Content-Type": "application/json" },
-      body
+      body: body2
     });
     if (!res.ok) {
       throw new OcsApiError(res.status, `HTTP ${res.status} ${res.statusText}`, method);
@@ -109,6 +109,17 @@ function getBillingPrimary(env) {
   const raw = env.BILLING_PRIMARY;
   return raw === "clerk" ? "clerk" : "stripe";
 }
+function platformOrgId(env) {
+  const raw = env.CARRIER_PLATFORM_ORG_ID;
+  if (typeof raw !== "string") return null;
+  const trimmed = raw.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function isPlatformOperator(env, orgId) {
+  const platform = platformOrgId(env);
+  if (!platform) return false;
+  return Boolean(orgId) && orgId === platform;
+}
 async function checkCallQuota(env, sub, tier) {
   const limit = TIER_CALL_LIMITS[tier];
   const resetAt = firstDayNextMonth();
@@ -155,7 +166,7 @@ async function pushStripeUsageRecord(env, sub, quantity) {
   if (!env.CARRIER_USERS) return;
   const subItemId = await env.CARRIER_USERS.get(`stripe_sub_item_id:${sub}`);
   if (!subItemId) return;
-  const body = new URLSearchParams({
+  const body2 = new URLSearchParams({
     quantity: String(quantity),
     timestamp: String(Math.floor(Date.now() / 1e3)),
     action: "increment"
@@ -168,7 +179,7 @@ async function pushStripeUsageRecord(env, sub, quantity) {
         Authorization: `Bearer ${stripeKey}`,
         "Content-Type": "application/x-www-form-urlencoded"
       },
-      body: body.toString()
+      body: body2.toString()
     }
   );
 }
@@ -589,8 +600,8 @@ function wrapHandler(toolName, ocsMethod, requiredScope, ctx, handler) {
   };
 }
 async function ocsCall(env, token2, method, params = {}) {
-  const client = new OcsClient(env.CARRIER_OCS_BASE_URL, token2);
-  const result2 = await client.call(method, params);
+  const client2 = new OcsClient(env.CARRIER_OCS_BASE_URL, token2);
+  const result2 = await client2.call(method, params);
   return {
     content: [{ type: "text", text: JSON.stringify(result2, null, 2) }]
   };
@@ -598,14 +609,14 @@ async function ocsCall(env, token2, method, params = {}) {
 async function resolveSubscriberByIccid(env, token2, iccid, cache) {
   const hit = cache.get(iccid);
   if (hit) return hit;
-  const client = new OcsClient(env.CARRIER_OCS_BASE_URL, token2);
-  const record = await client.call("getSingleSubscriber", { iccid });
+  const client2 = new OcsClient(env.CARRIER_OCS_BASE_URL, token2);
+  const record = await client2.call("getSingleSubscriber", { iccid });
   cache.set(iccid, record);
   return record;
 }
 async function getDefaultResellerId(env, token2) {
-  const client = new OcsClient(env.CARRIER_OCS_BASE_URL, token2);
-  const info = await client.call("getResellerInfo", {});
+  const client2 = new OcsClient(env.CARRIER_OCS_BASE_URL, token2);
+  const info = await client2.call("getResellerInfo", {});
   const id = info?.id;
   if (typeof id !== "number") {
     throw new Error("Could not determine resellerId from getResellerInfo");
@@ -809,8 +820,8 @@ function registerAllTools(server2, ctx) {
       ctx,
       async (args, token2) => {
         const params = buildListSubscriberParams(args);
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
-        const raw = await client.call("listSubscriber", params);
+        const client2 = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const raw = await client2.call("listSubscriber", params);
         const payload = applySubscriberFilters(raw, args);
         return {
           content: [{ type: "text", text: JSON.stringify(payload, null, 2) }]
@@ -3286,8 +3297,8 @@ var ocsAppMethods = ocsSpec.v1_app_methods;
 // src/intelligence.ts
 async function safeCall(env, token2, method, params = {}) {
   try {
-    const client = new OcsClient(env.CARRIER_OCS_BASE_URL, token2);
-    const data = await client.call(method, params);
+    const client2 = new OcsClient(env.CARRIER_OCS_BASE_URL, token2);
+    const data = await client2.call(method, params);
     return { data, error: null };
   } catch (err7) {
     return { data: null, error: err7 instanceof Error ? err7.message : String(err7) };
@@ -4304,8 +4315,8 @@ function registerAllBacklogTools(server2, ctx) {
       ctx,
       async ({ iccid, phone_number, phone_type }, token2) => {
         const ocsMethod = phone_type === "fake" ? "affectSubscriberFakePhoneNumber" : "affectSubscriberRealPhoneNumber";
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
-        const result2 = await client.call(ocsMethod, { subscriber: iccid, phoneNumber: phone_number });
+        const client2 = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const result2 = await client2.call(ocsMethod, { subscriber: iccid, phoneNumber: phone_number });
         return {
           content: [{ type: "text", text: JSON.stringify(result2, null, 2) }]
         };
@@ -4342,11 +4353,11 @@ function registerAllBacklogTools(server2, ctx) {
         cell_id,
         signal_strength
       }, token2) => {
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client2 = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
         const params = { radioType: radio_type, mcc, mnc, lac };
         if (cell_id !== void 0) params.cellId = cell_id;
         if (signal_strength !== void 0) params.signalStrength = signal_strength;
-        const result2 = await client.call("getSubscriberLocationByCellId", params);
+        const result2 = await client2.call("getSubscriberLocationByCellId", params);
         return {
           content: [{ type: "text", text: JSON.stringify(result2, null, 2) }]
         };
@@ -4370,16 +4381,16 @@ function registerAllBacklogTools(server2, ctx) {
       ctx,
       async ({ resellerId }, token2) => {
         const id = resellerId ?? await (async () => {
-          const client2 = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
-          const info = await client2.call("getResellerInfo", {});
+          const client3 = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+          const info = await client3.call("getResellerInfo", {});
           const resolvedId = info?.id;
           if (typeof resolvedId !== "number") {
             throw new Error("Could not determine resellerId from getResellerInfo");
           }
           return resolvedId;
         })();
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
-        const result2 = await client.call("listDetailedDestinationList", id);
+        const client2 = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const result2 = await client2.call("listDetailedDestinationList", id);
         return {
           content: [{ type: "text", text: JSON.stringify(result2, null, 2) }]
         };
@@ -4404,8 +4415,8 @@ function registerAllBacklogTools(server2, ctx) {
       BACKLOG_TOOL_SCOPES["modify_subscriber_mobile_plan"],
       ctx,
       async ({ iccid, mobile_plan_id }, token2) => {
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
-        const result2 = await client.call(
+        const client2 = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const result2 = await client2.call(
           "modifySubscriberMobilePlan",
           { subscriber: iccid, mobilePlanId: mobile_plan_id }
         );
@@ -4438,8 +4449,8 @@ function registerAllBacklogTools(server2, ctx) {
         const params = { subscriber: iccid, packageId: package_id };
         if (start_date !== void 0) params.startDate = start_date;
         if (end_date !== void 0) params.endDate = end_date;
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
-        const result2 = await client.call(
+        const client2 = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const result2 = await client2.call(
           "modifySubscriberPrepaidPackageActivePeriod",
           params
         );
@@ -4467,8 +4478,8 @@ function registerAllBacklogTools(server2, ctx) {
       BACKLOG_TOOL_SCOPES["modify_subscriber_voip_plan"],
       ctx,
       async ({ iccid, voip_plan_id }, token2) => {
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
-        const result2 = await client.call(
+        const client2 = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const result2 = await client2.call(
           "modifySubscriberVoipPlan",
           { subscriber: iccid, voipPlanId: voip_plan_id }
         );
@@ -4498,8 +4509,8 @@ function registerAllBacklogTools(server2, ctx) {
         const cache = /* @__PURE__ */ new Map();
         const sub = await resolveSubscriberByIccid(ctx.env, token2, iccid, cache);
         const subscriberId = sub.id ?? sub.subscriberId ?? iccid;
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
-        const result2 = await client.call(
+        const client2 = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const result2 = await client2.call(
           "pushSteeringToSubs",
           { subscriber: subscriberId }
         );
@@ -4526,8 +4537,8 @@ function registerAllBacklogTools(server2, ctx) {
       BACKLOG_TOOL_SCOPES["reset_subscriber_gz_counter"],
       ctx,
       async ({ iccid }, token2) => {
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
-        const result2 = await client.call("resetSubsGzCounter", { subscriber: iccid });
+        const client2 = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const result2 = await client2.call("resetSubsGzCounter", { subscriber: iccid });
         return {
           content: [{ type: "text", text: JSON.stringify(result2, null, 2) }]
         };
@@ -4550,14 +4561,14 @@ function registerAllBacklogTools(server2, ctx) {
       BACKLOG_TOOL_SCOPES["carrier_webhook_config"],
       ctx,
       async ({ reseller_id }, token2) => {
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client2 = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
         let resellerId = reseller_id;
         if (resellerId === void 0) {
           resellerId = await getDefaultResellerId(ctx.env, token2);
         }
         const params = {};
         if (resellerId !== void 0) params.id = resellerId;
-        const raw = await client.call("getResellerInfo", params);
+        const raw = await client2.call("getResellerInfo", params);
         const traffic = raw.trafficInfo ?? {};
         const notification = raw.notificationInfo ?? {};
         const result2 = {
@@ -4592,12 +4603,12 @@ function registerAllBacklogTools(server2, ctx) {
       BACKLOG_TOOL_SCOPES["list_subscriber_voip_tariff"],
       ctx,
       async ({ reseller_id }, token2) => {
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client2 = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
         const params = {};
         if (reseller_id !== void 0) {
           params.resellerId = reseller_id;
         }
-        const result2 = await client.call("listSubscriberVoipTariff", params);
+        const result2 = await client2.call("listSubscriberVoipTariff", params);
         return {
           content: [{ type: "text", text: JSON.stringify(result2, null, 2) }]
         };
@@ -4622,8 +4633,8 @@ function registerAllBacklogTools(server2, ctx) {
       BACKLOG_TOOL_SCOPES["list_voip_tariff_rule"],
       ctx,
       async ({ voip_plan_id }, token2) => {
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
-        const result2 = await client.call("listVoipTariffRule", voip_plan_id);
+        const client2 = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const result2 = await client2.call("listVoipTariffRule", voip_plan_id);
         return {
           content: [{ type: "text", text: JSON.stringify(result2, null, 2) }]
         };
@@ -4651,8 +4662,8 @@ function registerAllBacklogTools(server2, ctx) {
         location_zone_id,
         network_profile_id
       }, token2) => {
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
-        const result2 = await client.call("changeNetworkProfileOfLocationZone", {
+        const client2 = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const result2 = await client2.call("changeNetworkProfileOfLocationZone", {
           locationZoneId: location_zone_id,
           networkProfileId: network_profile_id
         });
@@ -4664,8 +4675,197 @@ function registerAllBacklogTools(server2, ctx) {
   );
 }
 
-// src/tools-carrier-ask.ts
+// ../../packages/carrier-ai/dist/index.js
 import { AwsClient } from "aws4fetch";
+var AI_TIER_POLICY = {
+  free: { limit: 5, window: "day" },
+  pro: { limit: 1e3, window: "month" },
+  enterprise: { limit: 1e4, window: "month" },
+  // Finite, deliberately. This was `Infinity` when the tier was introduced in
+  // #762, and Infinity breaks in two ways that both hide themselves:
+  //
+  //   1. JSON.stringify(Infinity) is "null". The quota endpoint returned
+  //      {"limit":null,"remaining":null} and the console badge rendered
+  //      "1 of null used". That is the whole reason this was investigated.
+  //   2. An infinite allowance is unmetered Bedrock. A staff account could
+  //      spend without bound and nothing would refuse it or show a number.
+  //
+  // 100,000 is roughly $580 of Haiku at the measured $0.0058/call. Nobody on
+  // staff will reach it by using the product, and a runaway loop stops.
+  superadmin: { limit: 1e5, window: "month" }
+};
+for (const [tier, policy] of Object.entries(AI_TIER_POLICY)) {
+  if (!Number.isFinite(policy.limit) || policy.limit <= 0) {
+    throw new Error(
+      `AI_TIER_POLICY.${tier}.limit must be a positive finite number, got ${policy.limit}. A non-finite limit serialises to null in JSON and leaves spend unmetered.`
+    );
+  }
+}
+var PRELUDE_BYTES = 12;
+var MESSAGE_CRC_BYTES = 4;
+var MIN_FRAME_BYTES = PRELUDE_BYTES + MESSAGE_CRC_BYTES;
+var MAX_FRAME_BYTES = 16 * 1024 * 1024;
+var MAX_ENTRIES = 16;
+var MAX_KEY_LEN = 256;
+var MAX_VALUE_LEN = 256;
+var ALLOWED = /[^a-zA-Z0-9\s:_@$#=/+,\-.]/g;
+function clean(value, max) {
+  return value.replace(ALLOWED, "").slice(0, max);
+}
+var REQUEST_METADATA_HEADER = "X-Amzn-Bedrock-Request-Metadata";
+function requestMetadata(attr2) {
+  const out = {};
+  const pairs = [
+    ["product", "carrier"],
+    ["org", attr2.orgId],
+    ["subaccount", attr2.subAccountId],
+    ["surface", attr2.surface],
+    ["tier", attr2.tier]
+  ];
+  for (const [k, v] of pairs) {
+    if (v === void 0 || v === "") continue;
+    const key = clean(k, MAX_KEY_LEN);
+    const value = clean(v, MAX_VALUE_LEN);
+    if (key && value && Object.keys(out).length < MAX_ENTRIES) out[key] = value;
+  }
+  return Object.keys(out).length > 0 ? out : null;
+}
+var ZERO_USAGE = {
+  inputTokens: 0,
+  outputTokens: 0,
+  cacheReadTokens: 0,
+  cacheWriteTokens: 0
+};
+function extractUsage(payload) {
+  if (!payload || typeof payload !== "object") return ZERO_USAGE;
+  const root = payload;
+  const holder = root.usage ?? root.message?.usage;
+  if (!holder) return ZERO_USAGE;
+  const num = (v) => {
+    const n = Number(v);
+    return Number.isFinite(n) && n > 0 ? n : 0;
+  };
+  return {
+    inputTokens: num(holder.input_tokens),
+    outputTokens: num(holder.output_tokens),
+    cacheReadTokens: num(holder.cache_read_input_tokens),
+    cacheWriteTokens: num(holder.cache_creation_input_tokens)
+  };
+}
+var HAIKU_RATES = {
+  inputPerMTok: 1,
+  outputPerMTok: 5,
+  cacheReadPerMTok: 0.1,
+  cacheWritePerMTok: 1.25,
+  asOf: "2026-08-22"
+};
+function estimateCostUsd(u, rates = HAIKU_RATES) {
+  const perTok = (mtok) => mtok / 1e6;
+  return u.inputTokens * perTok(rates.inputPerMTok) + u.outputTokens * perTok(rates.outputPerMTok) + u.cacheReadTokens * perTok(rates.cacheReadPerMTok) + u.cacheWriteTokens * perTok(rates.cacheWritePerMTok);
+}
+var DEFAULT_BEDROCK_REGION = "us-east-1";
+var DEFAULT_MODEL_ID = "us.anthropic.claude-haiku-4-5-20251001-v1:0";
+var BEDROCK_TIMEOUT_MS = 3e4;
+var BedrockRateLimitError = class extends Error {
+  isRateLimit = true;
+  /**
+   * The raw `retry-after` header, when Bedrock sent one. Callers surface it as
+   * the delay they tell the user to wait; without it they have to guess.
+   */
+  retryAfter;
+  constructor(message, retryAfter = null) {
+    super(message);
+    this.name = "BedrockRateLimitError";
+    this.retryAfter = retryAfter;
+  }
+};
+var BedrockError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "BedrockError";
+  }
+  status;
+};
+function client(creds) {
+  const region = creds.region ?? DEFAULT_BEDROCK_REGION;
+  return {
+    aws: new AwsClient({
+      accessKeyId: creds.accessKeyId,
+      secretAccessKey: creds.secretAccessKey,
+      ...creds.sessionToken ? { sessionToken: creds.sessionToken } : {},
+      region,
+      service: "bedrock"
+    }),
+    region,
+    modelId: creds.modelId ?? DEFAULT_MODEL_ID
+  };
+}
+function body(req) {
+  return {
+    anthropic_version: "bedrock-2023-05-31",
+    max_tokens: req.maxTokens,
+    ...req.temperature !== void 0 ? { temperature: req.temperature } : {},
+    system: [{ type: "text", text: req.system, cache_control: { type: "ephemeral" } }],
+    messages: req.messages.map((m) => ({ role: m.role, content: m.content })),
+    ...req.tools ? { tools: req.tools, tool_choice: { type: "any" } } : {}
+  };
+}
+function headersFor(req, accept) {
+  const headers = {
+    "Content-Type": "application/json",
+    Accept: accept
+  };
+  const meta = req.attribution ? requestMetadata(req.attribution) : null;
+  if (meta) headers[REQUEST_METADATA_HEADER] = JSON.stringify(meta);
+  return headers;
+}
+function reportUsage(req, usage) {
+  if (!req.onUsage) return;
+  try {
+    req.onUsage(usage);
+  } catch {
+  }
+}
+async function fail(resp) {
+  const text = await resp.text().catch(() => "");
+  if (resp.status === 429 || /throttl/i.test(text)) {
+    throw new BedrockRateLimitError(
+      text || "Bedrock throttled the request",
+      resp.headers.get("retry-after")
+    );
+  }
+  throw new BedrockError(text || `Bedrock returned HTTP ${resp.status}`, resp.status);
+}
+async function invokeTool(creds, req, signal) {
+  const { aws, region, modelId } = client(creds);
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), req.timeoutMs ?? BEDROCK_TIMEOUT_MS);
+  const onAbort = () => controller.abort();
+  signal?.addEventListener("abort", onAbort, { once: true });
+  try {
+    const headers = headersFor(req, "application/json");
+    const resp = await aws.fetch(
+      `https://bedrock-runtime.${region}.amazonaws.com/model/${encodeURIComponent(modelId)}/invoke`,
+      {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body(req)),
+        signal: controller.signal
+      }
+    );
+    if (!resp.ok) await fail(resp);
+    const json = await resp.json();
+    reportUsage(req, extractUsage(json));
+    const block = json.content?.find((b) => b.type === "tool_use");
+    return block?.name ? { name: block.name, input: block.input ?? {} } : null;
+  } finally {
+    clearTimeout(timer);
+    signal?.removeEventListener("abort", onAbort);
+  }
+}
+
+// src/tools-carrier-ask.ts
 import { z as z11 } from "zod";
 
 // src/tools-ui-agent.ts
@@ -4711,7 +4911,7 @@ var MANUS_API_BASE = "https://api.manus.ai/v2";
 
 // src/tools-ui-agent.ts
 async function createManusTask(apiKey, prompt, title, outputSchema) {
-  const body = {
+  const body2 = {
     message: { content: prompt },
     agent_profile: "manus-1.6-lite",
     hide_in_task_list: true,
@@ -4719,7 +4919,7 @@ async function createManusTask(apiKey, prompt, title, outputSchema) {
     title
   };
   if (outputSchema) {
-    body.structured_output_schema = outputSchema;
+    body2.structured_output_schema = outputSchema;
   }
   const res = await fetch(`${MANUS_API_BASE}/task.create`, {
     method: "POST",
@@ -4727,7 +4927,7 @@ async function createManusTask(apiKey, prompt, title, outputSchema) {
       "x-manus-api-key": apiKey,
       "Content-Type": "application/json"
     },
-    body: JSON.stringify(body)
+    body: JSON.stringify(body2)
   });
   return await res.json();
 }
@@ -5252,14 +5452,14 @@ async function withFallback(fn, keys) {
     true
   );
 }
-async function manusPost(path, apiKey, body) {
+async function manusPost(path, apiKey, body2) {
   const res = await fetch(`${MANUS_API_BASE2}/${path}`, {
     method: "POST",
     headers: {
       "x-manus-api-key": apiKey,
       "Content-Type": "application/json"
     },
-    body: JSON.stringify(body)
+    body: JSON.stringify(body2)
   });
   const data = await res.json();
   return { _httpStatus: res.status, data, key_used: "primary" };
@@ -5269,14 +5469,14 @@ async function sendMessage(keys, taskId, content, opts) {
   if (opts?.connectors?.length) message.connectors = opts.connectors;
   if (opts?.enableSkills?.length) message.enable_skills = opts.enableSkills;
   if (opts?.forceSkills?.length) message.force_skills = opts.forceSkills;
-  const body = {
+  const body2 = {
     task_id: taskId,
     message
   };
-  if (opts?.agentProfile) body.agent_profile = opts.agentProfile;
-  if (opts?.outputSchema) body.structured_output_schema = opts.outputSchema;
+  if (opts?.agentProfile) body2.agent_profile = opts.agentProfile;
+  if (opts?.outputSchema) body2.structured_output_schema = opts.outputSchema;
   return withFallback(
-    (apiKey) => manusPost("task.sendMessage", apiKey, body),
+    (apiKey) => manusPost("task.sendMessage", apiKey, body2),
     keys
   );
 }
@@ -5601,7 +5801,7 @@ function validateCron(cron) {
   return minuteFieldViolatesFiveMinuteRule(minuteField ?? "", cron);
 }
 async function createSchedule(apiKey, params) {
-  const body = {
+  const body2 = {
     name: params.name,
     cron: params.cron,
     prompt_template: params.prompt_template,
@@ -5615,7 +5815,7 @@ async function createSchedule(apiKey, params) {
       "x-manus-api-key": apiKey,
       "Content-Type": "application/json"
     },
-    body: JSON.stringify(body)
+    body: JSON.stringify(body2)
   });
   if (!res.ok) {
     throw new ManusScheduleError(
@@ -6245,19 +6445,33 @@ function registerScheduleAndUsageTools(server2, ctx) {
 import { z as z7 } from "zod";
 import * as Sentry2 from "@sentry/cloudflare";
 
+// src/audit-schema.ts
+var MARKER_INDEX = 11;
+var SCHEMA_GENERIC = "v1-generic";
+var SCHEMA_CARRIER_ASK = "v1-carrier-ask";
+function withSchemaMarker(blobs, marker) {
+  const out = [...blobs];
+  while (out.length < MARKER_INDEX) out.push("");
+  out.push(marker);
+  return out;
+}
+
 // src/audit.ts
 function writeAudit(env, row) {
   env.AUDIT_LOG.writeDataPoint({
-    blobs: [
-      row.tool_name,
-      row.ocs_method,
-      row.status,
-      row.dry_run ? "1" : "0",
-      row.sub,
-      row.manus_task_id ?? "",
-      row.manus_profile ?? "",
-      row.manus_key_used ?? ""
-    ],
+    blobs: withSchemaMarker(
+      [
+        row.tool_name,
+        row.ocs_method,
+        row.status,
+        row.dry_run ? "1" : "0",
+        row.sub,
+        row.manus_task_id ?? "",
+        row.manus_profile ?? "",
+        row.manus_key_used ?? ""
+      ],
+      SCHEMA_GENERIC
+    ),
     doubles: [row.duration_ms, row.ocs_status_code ?? 0],
     indexes: [String(row.reseller_id)]
   });
@@ -6396,14 +6610,14 @@ function resolveConfig(env) {
 async function atlasFetch(env, path, init) {
   const { baseUrl: baseUrl2, key } = resolveConfig(env);
   const headers = { "X-Carrier-Internal-Key": key };
-  let body;
+  let body2;
   if (init.body !== void 0) {
     headers["Content-Type"] = "application/json";
-    body = JSON.stringify(init.body);
+    body2 = JSON.stringify(init.body);
   }
   let res;
   try {
-    res = await fetch(`${baseUrl2}${path}`, { method: init.method, headers, body });
+    res = await fetch(`${baseUrl2}${path}`, { method: init.method, headers, body: body2 });
   } catch (e) {
     throw new WalletClientError(
       `ATLAS wallet request failed: ${e instanceof Error ? e.message : "network error"}`,
@@ -6564,7 +6778,7 @@ async function runAutoTopup(env, args) {
     return { charged: false, creditedCents: 0, reason: "no_payment_method" };
   }
   const bonusCents = bonusCentsFor(pack);
-  const body = new URLSearchParams({
+  const body2 = new URLSearchParams({
     amount: String(pack.eurCents),
     currency: "eur",
     customer: customerId,
@@ -6581,7 +6795,7 @@ async function runAutoTopup(env, args) {
   const resp = await stripePostForm(
     stripeKey,
     "/v1/payment_intents",
-    body
+    body2
   );
   if (!resp.ok) {
     return {
@@ -6855,6 +7069,13 @@ function registerStripeConnectTools(server2, ctx) {
       annotations: annotationsFor("stripe_connect_status", "read")
     },
     async ({ operator_id }) => {
+      if (operator_id !== void 0 && operator_id !== operatorId) {
+        if (!isPlatformOperator(env, props2.org_id)) {
+          return err2(
+            "operator_id may only be overridden by Carrier's own organization. Omit it to read your own Stripe Connect status."
+          );
+        }
+      }
       const opId = operator_id ?? operatorId;
       const opKvKey = operator_id ? `stripe_account:${operator_id}` : kvKey;
       const start = Date.now();
@@ -7593,7 +7814,7 @@ async function triggerBillingThreshold(env, sub, amountCents) {
   if (!stripeKey) return;
   const customerId = await env.CARRIER_USERS.get(`stripe_customer_id:${sub}`);
   if (!customerId) return;
-  const body = new URLSearchParams({
+  const body2 = new URLSearchParams({
     customer: customerId,
     amount: String(Math.round(amountCents)),
     currency: "usd",
@@ -7605,7 +7826,7 @@ async function triggerBillingThreshold(env, sub, amountCents) {
       Authorization: `Bearer ${stripeKey}`,
       "Content-Type": "application/x-www-form-urlencoded"
     },
-    body: body.toString()
+    body: body2.toString()
   });
   if (!resp.ok) return;
   const invoiceBody = new URLSearchParams({
@@ -7629,7 +7850,7 @@ async function pushOverageToStripe(env, sub, quantity, ratePerCredit) {
   if (!stripeKey) return;
   const subItemId = await env.CARRIER_USERS.get(`stripe_sub_item_id:${sub}`);
   if (!subItemId) return;
-  const body = new URLSearchParams({
+  const body2 = new URLSearchParams({
     quantity: String(quantity),
     timestamp: String(Math.floor(Date.now() / 1e3)),
     action: "increment"
@@ -7642,7 +7863,7 @@ async function pushOverageToStripe(env, sub, quantity, ratePerCredit) {
         Authorization: `Bearer ${stripeKey}`,
         "Content-Type": "application/x-www-form-urlencoded"
       },
-      body: body.toString()
+      body: body2.toString()
     }
   );
   await env.CARRIER_USERS.put(
@@ -9316,37 +9537,9 @@ function routerTools() {
 var ROUTER_SYSTEM_PROMPT = `You are a carrier fleet operations router. Your job is to map a user's natural-language intent to exactly ONE tool from the Carrier MCP tool registry.
 
 ${ROUTER_RULES}`;
-var DEFAULT_REGION = "us-east-1";
-var DEFAULT_MODEL_ID = "us.anthropic.claude-haiku-4-5-20251001-v1:0";
-async function callBedrock(env, payload) {
-  const region = env.AWS_REGION ?? DEFAULT_REGION;
-  const modelId = env.BEDROCK_MODEL_ID ?? DEFAULT_MODEL_ID;
-  const aws = new AwsClient({
-    accessKeyId: env.AWS_ACCESS_KEY_ID,
-    secretAccessKey: env.AWS_SECRET_ACCESS_KEY,
-    region,
-    service: "bedrock"
-  });
-  const url = `https://bedrock-runtime.${region}.amazonaws.com/model/${encodeURIComponent(modelId)}/invoke`;
-  const resp = await aws.fetch(url, {
-    method: "POST",
-    headers: { "Content-Type": "application/json", Accept: "application/json" },
-    body: JSON.stringify(payload)
-  });
-  if (!resp.ok) {
-    const body = await resp.text();
-    if (resp.status === 429) {
-      const retryAfter = resp.headers.get("retry-after");
-      const err7 = new Error(`Bedrock rate limit: ${body}`);
-      err7.isRateLimit = true;
-      err7.retryAfter = retryAfter;
-      throw err7;
-    }
-    throw new Error(`Bedrock invoke failed: ${resp.status} ${body}`);
-  }
-  return await resp.json();
-}
-async function _routeIntent(intent, context, env) {
+var ROUTER_TIMEOUT_MS = 12e3;
+async function _routeIntent(intent, context, env, opts = {}) {
+  const { attribution, onUsage } = opts;
   if (env.CARRIER_ASK_ENABLED !== "true" || !env.AWS_ACCESS_KEY_ID || !env.AWS_SECRET_ACCESS_KEY) {
     return {
       match: "routing_pending",
@@ -9362,26 +9555,32 @@ async function _routeIntent(intent, context, env) {
 
 Pre-resolved context: ${JSON.stringify(definedContext)}` : "";
   const userMessage = `${intent}${contextNote}`;
-  const payload = {
-    anthropic_version: "bedrock-2023-05-31",
-    max_tokens: 512,
-    system: ROUTER_SYSTEM_PROMPT,
-    messages: [{ role: "user", content: userMessage }],
-    tools: routerTools(),
-    tool_choice: { type: "any" }
-  };
-  let response;
+  const routerToolList = routerTools();
+  const tools = routerToolList.map(
+    (tool, idx) => idx === routerToolList.length - 1 ? { ...tool, cache_control: { type: "ephemeral" } } : tool
+  );
+  let toolCall;
   try {
-    response = await callBedrock({
-      AWS_ACCESS_KEY_ID: env.AWS_ACCESS_KEY_ID,
-      AWS_SECRET_ACCESS_KEY: env.AWS_SECRET_ACCESS_KEY,
-      AWS_REGION: env.AWS_REGION,
-      BEDROCK_MODEL_ID: env.BEDROCK_MODEL_ID
-    }, payload);
+    toolCall = await invokeTool(
+      {
+        accessKeyId: env.AWS_ACCESS_KEY_ID,
+        secretAccessKey: env.AWS_SECRET_ACCESS_KEY,
+        ...env.AWS_REGION ? { region: env.AWS_REGION } : {},
+        ...env.BEDROCK_MODEL_ID ? { modelId: env.BEDROCK_MODEL_ID } : {}
+      },
+      {
+        system: ROUTER_SYSTEM_PROMPT,
+        messages: [{ role: "user", content: userMessage }],
+        maxTokens: 512,
+        tools,
+        timeoutMs: ROUTER_TIMEOUT_MS,
+        ...attribution ? { attribution } : {},
+        ...onUsage ? { onUsage } : {}
+      }
+    );
   } catch (err7) {
-    if (err7 instanceof Error && err7.isRateLimit) {
-      const retryAfter = err7.retryAfter;
-      const parsedSeconds = retryAfter ? parseInt(retryAfter, 10) : 60;
+    if (err7 instanceof BedrockRateLimitError) {
+      const parsedSeconds = err7.retryAfter ? parseInt(err7.retryAfter, 10) : 60;
       return {
         match: "rate_limited",
         retry_after_seconds: Number.isFinite(parsedSeconds) ? parsedSeconds : 60,
@@ -9390,17 +9589,14 @@ Pre-resolved context: ${JSON.stringify(definedContext)}` : "";
     }
     throw err7;
   }
-  const toolUseBlock = response.content.find(
-    (block) => block.type === "tool_use"
-  );
-  if (!toolUseBlock) {
+  if (!toolCall) {
     return {
       match: "none",
       closest: [],
       suggestion: "Could not determine the right tool for this intent. Try rephrasing or use carrier_ask_describe to explore available tools."
     };
   }
-  const { name: resolvedTool, input } = toolUseBlock;
+  const { name: resolvedTool, input } = toolCall;
   const resolvedParams = input ?? {};
   if (resolvedTool === "carrier_clarify") {
     const candidates = resolvedParams.candidates ?? [];
@@ -9443,23 +9639,47 @@ Pre-resolved context: ${JSON.stringify(definedContext)}` : "";
 function writeCarrierAskAudit(env, row) {
   try {
     env.AUDIT_LOG.writeDataPoint({
-      blobs: [
-        "carrier_ask",
-        // blob[0] tool_name
-        row.resolved_tool,
-        // blob[1] resolved tool (or "none")
-        row.status,
-        // blob[2] ok | error
-        row.match,
-        // blob[3] match type
-        row.intent_hash,
-        // blob[4] SHA-256 of intent
-        row.confirm_token_state,
-        // blob[5] confirm token state
-        row.sub
-        // blob[6] user subject
+      // The marker at blob[11] is what separates these rows from writeAudit's,
+      // which writes a different layout to this same dataset — its blob[4] is
+      // `sub` where this one's is an intent hash. Filter on it before reading
+      // any other position.
+      blobs: withSchemaMarker(
+        [
+          "carrier_ask",
+          // blob[0] tool_name
+          row.resolved_tool,
+          // blob[1] resolved tool (or "none")
+          row.status,
+          // blob[2] ok | error
+          row.match,
+          // blob[3] match type
+          row.intent_hash,
+          // blob[4] SHA-256 of intent
+          row.confirm_token_state,
+          // blob[5] confirm token state
+          row.sub,
+          // blob[6] user subject
+          // Appended, never reordered: blob positions are the query contract and
+          // an existing dashboard reading blob[3] must keep reading match.
+          row.model_id,
+          // blob[7] model id, or "none"
+          row.tier
+          // blob[8] tier at call time
+        ],
+        SCHEMA_CARRIER_ASK
+      ),
+      // Same rule for doubles. latency stays at [0].
+      doubles: [
+        row.latency_ms,
+        row.usage.inputTokens,
+        row.usage.outputTokens,
+        row.usage.cacheReadTokens,
+        row.usage.cacheWriteTokens,
+        // An estimate from a rate card we maintain, not a billed figure. It is
+        // here so a per-tenant cost query is one SQL statement rather than a
+        // join against a rate table that lives in another package.
+        estimateCostUsd(row.usage)
       ],
-      doubles: [row.latency_ms],
       indexes: [String(row.reseller_id)]
     });
   } catch {
@@ -9505,7 +9725,10 @@ function registerAllCarrierAskTools(server2, ctx) {
               status: "error",
               latency_ms: Date.now() - start,
               sub: ctx.props.sub,
-              reseller_id: ctx.props.reseller_id
+              reseller_id: ctx.props.reseller_id,
+              model_id: "none",
+              tier: ctx.props.tier,
+              usage: ZERO_USAGE
             });
             return {
               content: [
@@ -9543,7 +9766,10 @@ function registerAllCarrierAskTools(server2, ctx) {
             status: "ok",
             latency_ms: Date.now() - start,
             sub: ctx.props.sub,
-            reseller_id: ctx.props.reseller_id
+            reseller_id: ctx.props.reseller_id,
+            model_id: "none",
+            tier: ctx.props.tier,
+            usage: ZERO_USAGE
           });
           return {
             content: [
@@ -9560,8 +9786,21 @@ function registerAllCarrierAskTools(server2, ctx) {
           };
         }
         let route;
+        let routeUsage = ZERO_USAGE;
+        let modelRan = false;
         try {
-          route = await _routeIntent(intent, context, ctx.env);
+          route = await _routeIntent(intent, context, ctx.env, {
+            attribution: {
+              ...ctx.props.org_id ? { orgId: ctx.props.org_id } : {},
+              ...ctx.props.reseller_id ? { subAccountId: String(ctx.props.reseller_id) } : {},
+              surface: "carrier_ask",
+              tier: ctx.props.tier
+            },
+            onUsage: (u) => {
+              routeUsage = u;
+              modelRan = true;
+            }
+          });
         } catch (err7) {
           writeCarrierAskAudit(ctx.env, {
             intent_hash: intentHash,
@@ -9571,7 +9810,14 @@ function registerAllCarrierAskTools(server2, ctx) {
             status: "error",
             latency_ms: Date.now() - start,
             sub: ctx.props.sub,
-            reseller_id: ctx.props.reseller_id
+            reseller_id: ctx.props.reseller_id,
+            model_id: modelRan ? ctx.env.BEDROCK_MODEL_ID ?? DEFAULT_MODEL_ID : "none",
+            tier: ctx.props.tier,
+            // Not ZERO_USAGE: a call can throw AFTER the model answered, and
+            // those tokens were billed regardless. Recording zero here is how
+            // measured spend drifts below real spend in exactly the rows used
+            // to check it.
+            usage: routeUsage
           });
           return {
             content: [
@@ -9608,7 +9854,10 @@ function registerAllCarrierAskTools(server2, ctx) {
           status: "ok",
           latency_ms: Date.now() - start,
           sub: ctx.props.sub,
-          reseller_id: ctx.props.reseller_id
+          reseller_id: ctx.props.reseller_id,
+          model_id: modelRan ? ctx.env.BEDROCK_MODEL_ID ?? DEFAULT_MODEL_ID : "none",
+          tier: ctx.props.tier,
+          usage: routeUsage
         });
         return {
           content: [
@@ -10150,22 +10399,22 @@ function toFleetInput(raw) {
 
 // src/apps/fleet-health-app.ts
 var FLEET_APP_RESOURCE_URI = "ui://fleet-health-dashboard";
-async function safeCall2(client, method, params) {
+async function safeCall2(client2, method, params) {
   try {
-    return { data: await client.call(method, params), error: null };
+    return { data: await client2.call(method, params), error: null };
   } catch (err7) {
     return { data: null, error: err7 instanceof Error ? err7.message : String(err7) };
   }
 }
 async function loadFleet(ctx, accountId) {
   const token2 = await ctx.getUserToken(ctx.props.sub);
-  const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+  const client2 = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
   const resellerId = await getDefaultResellerId(ctx.env, token2).catch(() => void 0);
   const statusParams = accountId !== void 0 ? { accountId } : resellerId !== void 0 ? { resellerId } : {};
   const accountParams = resellerId !== void 0 ? { resellerId } : {};
   const [status, accounts] = await Promise.all([
-    safeCall2(client, "esimStatusPerAccount", statusParams),
-    safeCall2(client, "listResellerAccount", accountParams)
+    safeCall2(client2, "esimStatusPerAccount", statusParams),
+    safeCall2(client2, "listResellerAccount", accountParams)
   ]);
   return toFleetInput({
     status: status.data,
@@ -10311,9 +10560,9 @@ async function deleteWizardSession(env, sub, wizardId) {
 }
 
 // src/apps/provisioning-wizard.ts
-async function safeCallWithToken(client, _token, method, params = {}) {
+async function safeCallWithToken(client2, _token, method, params = {}) {
   try {
-    return { data: await client.call(method, params), error: null };
+    return { data: await client2.call(method, params), error: null };
   } catch (err7) {
     return {
       data: null,
@@ -10380,11 +10629,11 @@ function registerProvisioningWizard(server2, ctx) {
     },
     async ({ step, wizardId, subscriber_iccid, package_template_id }) => {
       const token2 = await ctx.getUserToken(ctx.props.sub);
-      const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+      const client2 = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
       if (step === "init") {
         const newWizardId = generateWizardId();
         const subscribersResult = await safeCallWithToken(
-          client,
+          client2,
           token2,
           "listResellerAccount",
           {}
@@ -10462,7 +10711,7 @@ function registerProvisioningWizard(server2, ctx) {
         }
         const resellerIdForTemplates = await getDefaultResellerId(ctx.env, token2);
         const packagesResult = await safeCallWithToken(
-          client,
+          client2,
           token2,
           "listPrepaidPackageTemplate",
           { resellerId: resellerIdForTemplates }
@@ -10529,7 +10778,7 @@ function registerProvisioningWizard(server2, ctx) {
           };
         }
         const previewResult = await safeCallWithToken(
-          client,
+          client2,
           token2,
           "listPrepaidPackageTemplate",
           {}
@@ -10601,7 +10850,7 @@ function registerProvisioningWizard(server2, ctx) {
           };
         }
         const subRecord = await safeCallWithToken(
-          client,
+          client2,
           token2,
           "getSingleSubscriber",
           { iccid: session.subscriber_iccid }
@@ -10630,7 +10879,7 @@ function registerProvisioningWizard(server2, ctx) {
           };
         }
         const result2 = await safeCallWithToken(
-          client,
+          client2,
           token2,
           "affectPackageToSubscriber",
           {
@@ -10674,9 +10923,9 @@ import {
   registerAppResource as registerAppResource3,
   RESOURCE_MIME_TYPE as RESOURCE_MIME_TYPE3
 } from "@modelcontextprotocol/ext-apps/server";
-async function safeCallWithToken2(client, _token, method, params = {}) {
+async function safeCallWithToken2(client2, _token, method, params = {}) {
   try {
-    return { data: await client.call(method, params), error: null };
+    return { data: await client2.call(method, params), error: null };
   } catch (err7) {
     return {
       data: null,
@@ -10740,10 +10989,10 @@ function registerBalanceTopupApp(server2, ctx) {
       ctx,
       async ({ iccid, delta, preview }) => {
         const token2 = await ctx.getUserToken(ctx.props.sub);
-        const client = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
+        const client2 = new OcsClient(ctx.env.CARRIER_OCS_BASE_URL, token2);
         if (preview === true) {
           const result2 = await safeCallWithToken2(
-            client,
+            client2,
             token2,
             "getSingleSubscriber",
             { iccid }
@@ -10768,7 +11017,7 @@ function registerBalanceTopupApp(server2, ctx) {
           };
         }
         const execResult = await safeCallWithToken2(
-          client,
+          client2,
           token2,
           // CAR-78: subscriber top-up uses modifySubscriberBalance with { subscriber, amount }
           // (delta). modifyAccountBalance is account-level and expects { accountId, amount, mode }.