@layers/amba-mcp 1.0.1 → 4.0.2

package/dist/tools/functions.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Function-deployment MCP tools (#38).
+ *
+ * Surfaces every operation `amba functions ...` exposes through the CLI:
+ * deploy a bundled script, list deployments, describe one, delete a
+ * function (cascade), and full schedule lifecycle (create, pause,
+ * resume, trigger now). Logs read is the last operation in the set —
+ * Workers Logpush events for a single function over a bounded time
+ * range.
+ *
+ * Wire details:
+ *   - All routes mount under `/projects/:projectId/functions/*` on the
+ *     admin API. The `ApiClient` base already includes `/admin`. Every
+ *     interpolation goes through `encodeURIComponent` so a malformed
+ *     `project_id`, function `name`, etc. cannot escape the path
+ *     segment.
+ *   - `amba_functions_deploy` hits the server-side dispatch upload
+ *     route (`POST /functions/deploy`, multipart). The CLI used to
+ *     POST direct to the CDN with the customer's API token; the
+ *     server-side route landed in UNBURY-10 / S-301 so amba owns the
+ *     upstream credential. Same upload here from MCP. Client-side
+ *     bundle size guard mirrors the API's 10 MiB cap to fail fast
+ *     instead of wasting an upload.
+ *   - `amba_functions_delete` requires `?confirm=<name>` per the API's
+ *     guard against typo'd deletes. The tool sets it automatically
+ *     from the validated input.
+ *
+ * Authentication: every tool accepts an optional inline `pat` arg.
+ * Resolution order is `args.pat ?? inbound-Authorization-Bearer`
+ * (see `_pat.ts`).
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { ApiClient } from '../api-client.js';
+export declare function registerTools(server: McpServer, apiClient: ApiClient): void;

package/dist/tools/invites.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Project membership + invite tools — agentic collaboration.
+ *
+ * Per the wave-2 schema (`infra/neon/control/027_project_billing.sql`),
+ * a project is owned by one developer (the existing `projects.developer_id`
+ * column) but can have additional members invited by email. Roles:
+ *
+ *   - admin: manage members + integrations
+ *   - member: write data
+ *   - viewer: read-only
+ *
+ * Owners cannot be removed; transfer ownership first (transfer-owner tool
+ * not yet implemented). Members can remove themselves.
+ *
+ * The REST endpoints these tools call are shipped by W2-C in parallel
+ * (`/v1/admin/projects/:id/invites`, `.../members`, `.../members/:dev_id`).
+ * If those aren't live yet, calls surface as 404 via `AmbaApiError`.
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { ApiClient } from '../api-client.js';
+export declare function registerTools(server: McpServer, apiClient: ApiClient): void;

package/dist/tools/secrets.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Function-secret MCP tools (#38).
+ *
+ * Wraps the customer-function secrets proxy (UNBURY-10 / S-401). Every
+ * secret is scoped to a single function — the API enforces this with
+ * the `function` field on POST and the `?function=` query param on
+ * DELETE. The previous customer-shoes dogfood hit
+ * `INVALID_FUNCTION: function must match …` because the CLI initially
+ * didn't pass `function`; this tool surfaces the constraint clearly in
+ * the description + makes the `function` arg required.
+ *
+ * Naming:
+ *   - Secret name: /^[A-Z][A-Z0-9_]{0,62}$/ (uppercase env-var shape).
+ *   - Function name: /^[a-z][a-z0-9_-]{0,57}$/ (matches the function
+ *     deploy validator one-for-one).
+ *
+ * Reserved binding names (AMBA_INTERNAL_TOKEN, EDGE_HEADER_SIGNING_SECRET,
+ * STORAGE, EDGE_DB_PROXY, AMBA_API_URL, AMBA_AI_GATEWAY_URL,
+ * AMBA_PROJECT_ID) are blocked at the API layer — the proxy returns
+ * 400 RESERVED_BINDING. Don't try to shadow them.
+ *
+ * Plaintext values are NEVER returned. `amba_secrets_list` returns
+ * name + version + sync_status (pending/syncing/synced/failed) only.
+ *
+ * Authentication: every tool accepts an optional inline `pat` arg via the
+ * `registerTool` helper in `../lib/with-pat.ts`. Resolution: `args.pat ??
+ * inbound-Authorization-Bearer`, with `MISSING_PAT` short-circuit if neither.
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { ApiClient } from '../api-client.js';
+export declare function registerTools(server: McpServer, apiClient: ApiClient): void;

package/dist/tools/setup.d.ts

@@ -1,3 +1,3 @@
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { ApiClient } from '../api-client.js';
-export declare function registerTools(server: McpServer, _apiClient: ApiClient): void;
+export declare function registerTools(server: McpServer, apiClient: ApiClient): void;

package/dist/tools/sites.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Static-site MCP tools (#38).
+ *
+ * Mirrors the CLI's `amba sites ...` surface so an agent can register a
+ * static site, deploy files, attach custom domains, and tear everything
+ * down — all through MCP, no human-in-loop.
+ *
+ * Wire details:
+ *   - `amba_sites_deploy` is create-or-deploy in one shot: it POSTs `/sites`
+ *     to mint the row (tolerating `ALREADY_EXISTS`), then POSTs the
+ *     per-file multipart bundle to `/sites/:name/deployments`. The two-call
+ *     pattern matches the CLI's flow exactly, just collapsed for agent
+ *     ergonomics — one tool call, one canonical public URL out. The
+ *     409-tolerance branch is now driven by the upstream `error.code`
+ *     (via `AmbaApiError`), not regex over the prose, so an unrelated
+ *     409 (e.g. quota) is NOT silently swallowed.
+ *   - `amba_sites_add_domain` runs the upstream custom hostname
+ *     registration server-side (Wave-3 / #100); customers no longer
+ *     need a direct upstream API token client-side.
+ *   - `amba_sites_remove_domain` is idempotent — a 404 from the API is
+ *     treated as success (the row was already gone).
+ *
+ * Files: pass an object keyed by repo-relative path
+ * (e.g. {"index.html": "<!doctype html>...", "assets/main.css": "..."}).
+ * Each value is the file content as a string. Per-file cap is 25 MiB.
+ *
+ * Hostname inputs are lowercased at the tool boundary (HTTP semantics
+ * + matches the API's storage normalisation) so a customer typing
+ * "App.Example.com" doesn't end up with an unfindable binding.
+ *
+ * Authentication: every tool accepts an optional inline `pat` arg via the
+ * `registerTool` helper in `../lib/with-pat.ts`. Resolution: `args.pat ??
+ * inbound-Authorization-Bearer`, with `MISSING_PAT` short-circuit if neither.
+ */
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { ApiClient } from '../api-client.js';
+export declare function registerTools(server: McpServer, apiClient: ApiClient): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@layers/amba-mcp",
-  "version": "1.0.1",
+  "version": "4.0.2",
   "license": "Apache-2.0",
   "engines": {
     "node": ">=22"
@@ -12,6 +12,10 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./prompts": {
+      "types": "./dist/resources/prompts.d.ts",
+      "import": "./dist/resources/prompts.js"
     }
   },
   "files": [
@@ -22,12 +26,13 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.1",
     "zod": "^3.25.0",
-    "@layers/amba-shared": "1.0.0"
+    "@layers/amba-shared": "4.0.2"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",
     "tsdown": "^0.12.5",
-    "typescript": "^5.8.3"
+    "typescript": "^5.8.3",
+    "vitest": "^3.2.4"
   },
   "repository": {
     "type": "git",
@@ -43,9 +48,10 @@
   },
   "description": "MCP server tools for amba — agentic developer onboarding, project provisioning, and SDK introspection over the Model Context Protocol.",
   "scripts": {
-    "build": "tsdown && tsc --emitDeclarationOnly",
+    "build": "tsdown && tsc --emitDeclarationOnly --project tsconfig.build.json",
     "dev": "tsdown --watch",
     "typecheck": "tsc --noEmit",
+    "test": "vitest run",
     "clean": "rm -rf dist"
   }
 }