@layers/amba-mcp 4.0.10 → 4.0.11

package/dist/api-client.d.ts

@@ -34,11 +34,19 @@ export interface ApiClientOptions {
      * tokens transparently. Sync values should be wrapped in `() => Promise.resolve(token)`.
      */
     getToken?: () => Promise<string>;
+    /**
+     * Signup token forwarded on `/auth/developer/signup` as
+     * `X-Amba-Signup-Token`. The hosted MCP server copies it from the inbound
+     * request header of the same name so Amba's CI can sign up through MCP
+     * while public signup is closed. Unset for every other caller.
+     */
+    signupToken?: string;
 }
 export declare class ApiClient {
     private baseUrl;
     private apiRoot;
     private tokenProvider?;
+    private signupToken?;
     constructor(options?: ApiClientOptions);
     /**
      * Return a sibling `ApiClient` bound to a different Bearer token.
@@ -54,6 +62,8 @@ export declare class ApiClient {
      * routing stays identical — only the token provider differs.
      */
     withToken(token: string): ApiClient;
+    /** The signup token to forward on `/auth/developer/signup`, if any. */
+    getSignupToken(): string | undefined;
     /**
      * Returns the configured admin-prefixed base URL (e.g.
      * `https://api.amba.dev/admin`). Auth tools (`amba_developer_signup`,

package/dist/index.d.ts

@@ -38,6 +38,7 @@ export declare function registerAllTools(server: McpServer, apiClient: ApiClient
 export declare function createApiClient(options: {
     baseUrl?: string;
     token?: string;
+    signupToken?: string;
 }): ApiClient;
 export { ApiClient } from './api-client.js';
 export type { ApiClientOptions } from './api-client.js';

package/dist/index.js

@@ -60,12 +60,15 @@ var ApiClient = class ApiClient {
 	baseUrl;
 	apiRoot;
 	tokenProvider;
+	signupToken;
 	constructor(options) {
 		const raw = (options?.baseUrl ?? BASE_URL).replace(/\/+$/, "");
 		if (!/\/admin$/.test(raw)) throw new Error(`ApiClient baseUrl must end in /admin (got ${JSON.stringify(raw)}). Set AMBA_API_URL=https://api.amba.dev/v1/admin (or your equivalent versioned host).`);
 		this.baseUrl = raw;
 		this.apiRoot = raw.replace(/\/admin$/, "");
 		this.tokenProvider = options?.getToken;
+		const signupToken = options?.signupToken?.trim();
+		if (signupToken) this.signupToken = signupToken;
 	}
 	/**
 	* Return a sibling `ApiClient` bound to a different Bearer token.
@@ -81,10 +84,16 @@ var ApiClient = class ApiClient {
 	* routing stays identical — only the token provider differs.
 	*/
 	withToken(token) {
-		return new ApiClient({
+		const opts = {
 			baseUrl: this.baseUrl,
 			getToken: async () => token
-		});
+		};
+		if (this.signupToken !== void 0) opts.signupToken = this.signupToken;
+		return new ApiClient(opts);
+	}
+	/** The signup token to forward on `/auth/developer/signup`, if any. */
+	getSignupToken() {
+		return this.signupToken;
 	}
 	/**
 	* Returns the configured admin-prefixed base URL (e.g.
@@ -4562,6 +4571,7 @@ async function authFetch(apiClient, options) {
 	const headers = { Accept: "application/json" };
 	if (options.body !== void 0) headers["Content-Type"] = "application/json";
 	if (options.bearer) headers["Authorization"] = `Bearer ${options.bearer}`;
+	if (options.signupToken) headers["X-Amba-Signup-Token"] = options.signupToken;
 	const res = await fetch(url, {
 		method: options.method,
 		headers,
@@ -4705,10 +4715,12 @@ function registerTools$20(server, apiClient) {
 		};
 		if (name !== void 0) body.name = name;
 		if (referral_code !== void 0) body.referral_code = referral_code;
+		const signupToken = apiClient.getSignupToken();
 		return enrichedAuthResult(await authFetch(apiClient, {
 			method: "POST",
 			path: "/auth/developer/signup",
-			body
+			body,
+			...signupToken ? { signupToken } : {}
 		}), SIGNUP_AGENT_INSTRUCTIONS);
 	});
 	registerPublicTool(server, "amba_affiliate_signup", [
@@ -4730,10 +4742,12 @@ function registerTools$20(server, apiClient) {
 			password
 		};
 		if (name !== void 0) body.name = name;
+		const signupToken = apiClient.getSignupToken();
 		return enrichedAuthResult(await authFetch(apiClient, {
 			method: "POST",
 			path: "/auth/developer/signup",
-			body
+			body,
+			...signupToken ? { signupToken } : {}
 		}), SIGNUP_AGENT_INSTRUCTIONS);
 	});
 	registerPublicTool(server, "amba_developer_login", [
@@ -5946,6 +5960,7 @@ function registerTools$17(server, apiClient) {
 		"Deploy a static site to an Amba project. Creates the site if it does not yet exist, then uploads the supplied files as a new deployment.",
 		"The deployment is immutable — its files live forever under the site's storage prefix — and the site flips to serve the new deployment atomically. Older deployments are kept for rollback via `amba_sites_list`.",
 		"Site name must match /^[a-z][a-z0-9_-]{0,49}$/. Per-file cap: 25 MiB. The site's public URL is `https://{slug}.app.amba.host` where `slug` is `{first 8 chars of project_id}-{name}`.",
+		"Routing follows common static-host conventions, so directory-style exports work as-is: `/a/` serves `a/index.html`; `/a` serves the exact file, then `a.html`, then 308-redirects to `/a/` when only `a/index.html` exists. Include a top-level `404.html` to answer unknown paths with status 404; without one, extensionless paths fall back to `index.html` (single-page-app mode).",
 		"Returns the deployment record + public URL + file/byte counts."
 	].join(" "), {
 		project_id: z.string().describe("The Amba project ID."),
@@ -6197,11 +6212,12 @@ function registerTools$14(server, apiClient) {
 		"Writes a new version to the backing secret store and enqueues the sync. Subsequent function invocations see the new value once sync_status flips to \"synced\" (typically <30s).",
 		"Secret name must match /^[A-Z][A-Z0-9_]{0,62}$/. Function name (when given) must match /^[a-z][a-z0-9_-]{0,57}$/.",
 		"The complete AMBA_ and EDGE_ namespaces, plus the exact names STORAGE and EDGE_DB_PROXY, are platform-managed. MCP rejects them before an API/provider call; the API also returns 400 RESERVED_BINDING.",
+		"Every function already receives AMBA_API_URL, AMBA_PROJECT_ID, AMBA_INTERNAL_TOKEN (project-scoped admin token), and AMBA_AI_GATEWAY_URL in `env`, so never set those. For your own values, use an app prefix: store the project client key as APP_CLIENT_KEY, for example.",
 		"Secrets may be set BEFORE deploying the function — the sync drains once a deployment lands, so you can set every secret first and deploy once.",
 		"Value cap: 64 KiB. Plaintext is never returned afterwards."
 	].join(" "), {
 		project_id: z.string().describe("The Amba project ID."),
-		name: SET_SECRET_NAME.describe("Secret name. UPPER_SNAKE_CASE. The AMBA_ and EDGE_ prefixes and exact names STORAGE and EDGE_DB_PROXY are reserved."),
+		name: SET_SECRET_NAME.describe("Secret name. UPPER_SNAKE_CASE. The AMBA_ and EDGE_ prefixes and exact names STORAGE and EDGE_DB_PROXY are reserved; use an app prefix such as APP_ (APP_CLIENT_KEY)."),
 		value: z.string().describe("Secret value. Stored encrypted at rest; never returned in plaintext afterwards."),
 		function: z.string().optional().describe("Function this secret binds to. OMIT for a project-wide secret (applied to every function in the project).")
 	}, async ({ project_id, name, value, function: functionName }, { pat }) => {
@@ -11320,6 +11336,7 @@ function registerAllTools(server, apiClient) {
 function createApiClient(options) {
 	const opts = {};
 	if (options.baseUrl !== void 0) opts.baseUrl = options.baseUrl;
+	if (options.signupToken !== void 0) opts.signupToken = options.signupToken;
 	if (options.token !== void 0) {
 		const token = options.token;
 		opts.getToken = async () => token;

package/dist/tools/secrets.d.ts

@@ -17,6 +17,8 @@
  * The complete AMBA_ and EDGE_ namespaces, plus the exact names STORAGE
  * and EDGE_DB_PROXY, are platform-reserved. MCP rejects these before an
  * API/provider call; the API independently enforces the same shared rule.
+ * The shared helper's message names the rule, lists the bindings every
+ * function already receives, and suggests an `APP_`-prefixed name.
  *
  * Plaintext values are NEVER returned. `amba_secrets_list` returns
  * name + version + sync_status (pending/syncing/synced/failed) only.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@layers/amba-mcp",
-  "version": "4.0.10",
+  "version": "4.0.11",
   "license": "Apache-2.0",
   "engines": {
     "node": ">=22"
@@ -26,7 +26,7 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.12.1",
     "zod": "^3.25.0",
-    "@layers/amba-shared": "4.0.5"
+    "@layers/amba-shared": "4.0.6"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",