@layers/amba-mcp 4.0.6 → 4.0.7

package/dist/index.js

@@ -3,7 +3,7 @@ import { readFile } from "node:fs/promises";
 import { join } from "node:path";
 import { homedir } from "node:os";
 import { z } from "zod";
-import { INTEGRATION_PROVIDERS, integrationConfigSummary } from "@layers/amba-shared";
+import { INTEGRATION_PROVIDERS, getBindingReservationReason, integrationConfigSummary } from "@layers/amba-shared";
 //#region src/auth.ts
 const CREDENTIALS_PATH = join(homedir(), ".amba", "credentials.json");
 async function loadCredentials() {
@@ -316,7 +316,8 @@ const READ_VERBS = new Set([
 	"diff",
 	"drift",
 	"balance",
-	"payouts"
+	"payouts",
+	"capabilities"
 ]);
 /**
 * Destructive verbs. A tool whose name contains one of these MAY perform
@@ -329,7 +330,8 @@ const DESTRUCTIVE_VERBS = new Set([
 	"remove",
 	"revoke",
 	"drop",
-	"reset"
+	"reset",
+	"ban"
 ]);
 /**
 * Write verbs — mutations that are additive / non-destructive (create a
@@ -351,6 +353,7 @@ const WRITE_VERBS = new Set([
 	"deploy",
 	"send",
 	"add",
+	"attach",
 	"configure",
 	"invoke",
 	"schedule",
@@ -358,6 +361,8 @@ const WRITE_VERBS = new Set([
 	"upload",
 	"rotate",
 	"reprovision",
+	"provision",
+	"payout",
 	"transfer",
 	"pause",
 	"resume",
@@ -376,12 +381,20 @@ const WRITE_VERBS = new Set([
 	"define",
 	"map",
 	"adopt",
+	"apply",
 	"purchase",
 	"signup",
 	"login",
 	"refresh",
 	"track",
-	"charge"
+	"charge",
+	"refund",
+	"enable",
+	"accept",
+	"generate",
+	"enroll",
+	"request",
+	"clawback"
 ]);
 /**
 * Split a tool name into lowercase verb-candidate tokens, dropping the
@@ -445,7 +458,8 @@ const NOUN_LIKE_VERBS = new Set([
 	"schedule",
 	"me",
 	"balance",
-	"payouts"
+	"payouts",
+	"capabilities"
 ]);
 /**
 * The verbs eligible to be a title's leading word: every classification
@@ -636,15 +650,15 @@ function registerPublicTool(server, name, description, schema, handler, aliases
 }
 //#endregion
 //#region src/tools/projects.ts
-function registerTools$37(server, apiClient) {
-	registerTool(server, apiClient, "amba_projects_list", "List all Amba projects owned by the authenticated developer. Returns project id, name, bundle_id, platform, and environment.", {}, async (_, { client }) => {
+function registerTools$42(server, apiClient) {
+	registerTool(server, apiClient, "amba_projects_list", "List all Amba projects owned by the authenticated developer. Returns project id, name, bundle_id, platform, environment, the persisted billing `tier`, and `effective_tier` (the runtime entitlement tier; comped projects are effectively enterprise).", {}, async (_, { client }) => {
 		const result = await client.get("/projects");
 		return { content: [{
 			type: "text",
 			text: JSON.stringify(result, null, 2)
 		}] };
 	}, ["amba_list_projects"]);
-	registerTool(server, apiClient, "amba_projects_get", "Get detailed information about a specific Amba project by its ID, including API keys, integrations, and configuration.", { project_id: z.string().describe("The project ID") }, async ({ project_id }, { client }) => {
+	registerTool(server, apiClient, "amba_projects_get", "Get detailed information about a specific Amba project by its ID, including API keys, integrations, configuration, persisted billing `tier`, and runtime `effective_tier`. Use `effective_tier` for quota/feature decisions; `tier` remains the stored subscription classification.", { project_id: z.string().describe("The project ID") }, async ({ project_id }, { client }) => {
 		const result = await client.get(`/projects/${project_id}`);
 		return { content: [{
 			type: "text",
@@ -743,7 +757,7 @@ function registerTools$37(server, apiClient) {
 }
 //#endregion
 //#region src/tools/push.ts
-function registerTools$36(server, apiClient) {
+function registerTools$41(server, apiClient) {
 	registerTool(server, apiClient, "amba_push_campaigns_create", "Create a new push notification campaign for a project. The campaign starts in \"draft\" status. You can optionally target a segment and schedule delivery.", {
 		project_id: z.string().describe("The project ID"),
 		title: z.string().describe("Push notification title shown to the user"),
@@ -873,7 +887,7 @@ const segmentRulesSchema = z.object({
 	operator: z.enum(["AND", "OR"]).describe("Logical operator combining conditions"),
 	conditions: z.array(segmentConditionSchema).describe("Array of filter conditions")
 });
-function registerTools$35(server, apiClient) {
+function registerTools$40(server, apiClient) {
 	registerTool(server, apiClient, "amba_segments_list", "List user segments for a project. Segments define groups of users based on rules (e.g. \"active in last 7 days\", \"premium users\"). Returns only project-custom segments by default. Pass include_system: true to also include the built-in system segments (e.g. \"all\", \"active_7d\", \"premium\").", {
 		project_id: z.string().describe("The project ID"),
 		include_system: z.boolean().optional().describe("Include built-in system segments in the result. Defaults to false.")
@@ -958,7 +972,7 @@ const configConditionSchema = z.object({
 	percentage: z.number().optional().describe("Percentage rollout (0-100)"),
 	value: z.unknown().describe("Override value for this condition")
 });
-function registerTools$34(server, apiClient) {
+function registerTools$39(server, apiClient) {
 	registerTool(server, apiClient, "amba_remote_configs_list", "List remote-config keys for a project. Returns key, value, value_type, description, conditions, and version per active row. Remote config lets you change app behavior without deploying an update. Returns only project-created config keys by default. Pass include_system: true to also include platform-provided defaults (e.g. app_version_min, maintenance_mode).", {
 		project_id: z.string().describe("The project ID"),
 		include_system: z.boolean().optional().describe("Include platform-provided default config keys in the result. Defaults to false.")
@@ -1036,7 +1050,7 @@ const contentItemSchema = z.object({
 	metadata: z.record(z.unknown()).optional().describe("Arbitrary metadata key-value pairs"),
 	is_premium: z.boolean().optional().describe("Whether this content requires a premium entitlement")
 });
-function registerTools$33(server, apiClient) {
+function registerTools$38(server, apiClient) {
 	registerTool(server, apiClient, "amba_content_libraries_create", "Create a content library for a project. A content library is a collection of content items (tips, quotes, articles) that can be delivered on a schedule to keep users engaged. The library `name` IS the channel handle the in-app SDK uses: `Amba.content.library(name)` reads this library (names are unique). The response echoes it as `channel`.", {
 		project_id: z.string().describe("The project ID"),
 		name: z.string().describe("Library name (e.g. \"Daily Motivation\", \"Workout Tips\")"),
@@ -1254,7 +1268,7 @@ function registerTools$33(server, apiClient) {
 }
 //#endregion
 //#region src/tools/streaks.ts
-function registerTools$32(server, apiClient) {
+function registerTools$37(server, apiClient) {
 	registerTool(server, apiClient, "amba_streaks_create", "Create a streak definition for a project. Streaks track consecutive user engagement (e.g. daily logins, workout completions). Supports configurable periods, grace periods, and freeze mechanics.", {
 		project_id: z.string().describe("The project ID"),
 		key: z.string().regex(/^[a-z0-9_-]{1,64}$/).optional().describe("Stable identifier used by the SDK to qualify a streak without knowing its UUID: `Amba.streaks.qualify(\"daily_login\")`. Lowercase letters, digits, underscore, hyphen, 1-64 characters. Immutable after creation — changing it breaks live SDK calls. When omitted the server derives one from `name`."),
@@ -1346,8 +1360,8 @@ function registerTools$32(server, apiClient) {
 //#endregion
 //#region src/tools/integrations.ts
 const providerEnum = z.enum(INTEGRATION_PROVIDERS);
-function registerTools$31(server, apiClient) {
-	registerTool(server, apiClient, "amba_integrations_configure", "Configure (create or replace) a third-party integration for a project. Supported providers: \"apns\" (Apple Push), \"fcm\" (Firebase Cloud Messaging), \"revenuecat\" (subscription management), \"superwall\" (paywall management). Each provider requires specific config fields. Push credentials (.p8 / service-account JSON) are passed inline here and stored server-side automatically — no separate secrets step.", {
+function registerTools$36(server, apiClient) {
+	registerTool(server, apiClient, "amba_integrations_configure", "Configure (create or replace) a third-party integration for a project. Supported providers: \"apns\" (Apple Push), \"fcm\" (Firebase Cloud Messaging), \"revenuecat\" (subscription management), \"superwall\" (paywall management), \"stripe_billing\" (web subscriptions through the app's own Stripe Billing account — web purchases grant the same Amba entitlements as mobile ones; the response includes the webhook_url to register in the Stripe dashboard), \"google_play\" (a Play Console service account with the Android Publisher permission — lets `amba_monetization_apply` create one-time Play products directly, price included). Each provider requires specific config fields. Push credentials (.p8 / service-account JSON) are passed inline here and stored server-side automatically — no separate secrets step.", {
 		project_id: z.string().describe("The project ID"),
 		provider: providerEnum.describe("Integration provider name"),
 		config: z.record(z.unknown()).describe("Provider-specific configuration. " + integrationConfigSummary())
@@ -1416,7 +1430,7 @@ const PERIOD_DAYS = {
 	"30d": "30",
 	"90d": "90"
 };
-function registerTools$30(server, apiClient) {
+function registerTools$35(server, apiClient) {
 	registerTool(server, apiClient, "amba_analytics_get", "Get daily analytics for a project. Returns per-day event counts and unique-user counts for the requested window, plus totals. Use this to verify that end-to-end event tracking is working after seeding and testing.", {
 		project_id: z.string().describe("The project ID"),
 		period: z.enum([
@@ -1489,7 +1503,7 @@ function passthroughResult(result) {
 }
 //#endregion
 //#region src/tools/users.ts
-function registerTools$29(server, apiClient) {
+function registerTools$34(server, apiClient) {
 	registerTool(server, apiClient, "amba_users_list", "List app users for a project. Supports pagination with offset and limit, plus optional search (matches email / external_id / display_name with ILIKE) and segment filter. Returns user profiles including external_id, email, display_name, properties, and activity timestamps.", {
 		project_id: z.string().describe("The project ID"),
 		limit: z.number().optional().describe("Maximum number of users to return (default 50)"),
@@ -1936,7 +1950,7 @@ final dailyLimit = await Amba.config.get<int>('daily_limit', defaultValue: 10);
 final streak = await Amba.streaks.get('daily_login');
 print('Current streak: \${streak.currentCount}');`
 };
-function registerTools$28(server, apiClient) {
+function registerTools$33(server, apiClient) {
 	registerTool(server, apiClient, "amba_sdk_get_setup_instructions", "Get platform-specific code snippets and setup instructions for integrating the Amba client SDK into a mobile app. Supports iOS (Swift), Android (Kotlin), React Native, Expo, and Flutter.", { platform: z.enum([
 		"ios",
 		"android",
@@ -2021,7 +2035,7 @@ const criteriaSchema = z.object({
 	property_key: z.string().optional().describe("User property key (required for property_value type)"),
 	target_value: z.number().describe("Target value to unlock the achievement")
 });
-function registerTools$27(server, apiClient) {
+function registerTools$32(server, apiClient) {
 	registerTool(server, apiClient, "amba_achievements_create", "Create an achievement/badge definition. Achievements unlock automatically when users meet the criteria (e.g. track 5 workouts, reach a 7-day streak, earn 5000 XP). Can optionally award bonus XP on unlock.", {
 		project_id: z.string().describe("The project ID"),
 		key: z.string().describe("Unique key for this achievement (e.g. \"first_workout\", \"streak_master_7\")"),
@@ -2126,7 +2140,7 @@ function registerTools$27(server, apiClient) {
 }
 //#endregion
 //#region src/tools/challenges.ts
-function registerTools$26(server, apiClient) {
+function registerTools$31(server, apiClient) {
 	registerTool(server, apiClient, "amba_challenges_create", "Create a time-limited challenge. Challenges are events that run between start_at and end_at, where users try to reach a goal (e.g. track 10 workouts this week, earn 500 XP in 3 days). Can reward XP and/or unlock an achievement on completion.", {
 		project_id: z.string().describe("The project ID"),
 		name: z.string().describe("Challenge name (e.g. \"7-Day Fitness Sprint\", \"XP Weekend Blitz\")"),
@@ -2237,7 +2251,7 @@ function registerTools$26(server, apiClient) {
 }
 //#endregion
 //#region src/tools/economy.ts
-function registerTools$25(server, apiClient) {
+function registerTools$30(server, apiClient) {
 	registerTool(server, apiClient, "amba_currencies_create", "Create a virtual currency for a project. Currencies can be soft (earned through gameplay) or premium (purchased with real money). Supports auto-recharge for time-gated mechanics like hearts/energy.", {
 		project_id: z.string().describe("The project ID"),
 		code: z.string().describe("Unique currency code (e.g. \"gold\", \"gems\", \"hearts\")"),
@@ -2540,7 +2554,7 @@ function registerTools$25(server, apiClient) {
 			text: JSON.stringify(result, null, 2)
 		}] };
 	});
-	registerTool(server, apiClient, "amba_products_create", ["Declare a sellable subscription product and the entitlement it grants. `store_product_refs` maps each store to its own identifier ({ \"app_store\": \"com.app.pro.yearly\", \"play_store\": \"pro_yearly\", \"web\": \"price_123\" }) so one Amba product resolves on whichever store a purchase came from.", "When `grants_entitlement_id` is set, an in-app purchase OR a server grant carrying this product unlocks that entitlement automatically — that resolution is what makes the payment engine swappable."].join(" "), {
+	registerTool(server, apiClient, "amba_products_create", ["Declare a sellable subscription product and the entitlement it grants. `store_product_refs` maps each store to its own identifier ({ \"app_store\": \"com.app.pro.yearly\", \"play_store\": \"pro_yearly\", \"web\": \"price_123\" }) so one Amba product resolves on whichever store a purchase came from.", "When `grants_entitlement_id` is set, an in-app purchase OR a server grant carrying this product unlocks that entitlement automatically — that resolution is what lets every purchase path (mobile stores, web billing, server grants) land on the same entitlement set."].join(" "), {
 		project_id: z.string().describe("The project ID"),
 		product_id: z.string().describe("Stable, neutral product key (e.g. \"pro_yearly\"). Required."),
 		grants_entitlement_id: z.string().optional().describe("The entitlement key this product unlocks (must be defined first)."),
@@ -2928,8 +2942,8 @@ const objectTypeSchema = z.enum([
 	"package",
 	"paywall"
 ]);
-function registerTools$24(server, apiClient) {
-	registerTool(server, apiClient, "amba_monetization_plan", "Preview the monetization plan for a project: a three-way diff between the declared subscription config (entitlements, products, offerings, packages, paywalls), the last-adopted baseline, and the live config in the connected provider (RevenueCat). Returns the op-list an apply WOULD perform (create/update/archive/attach/detach/set-current), a store-floor preflight (referenced store product identifiers not yet present upstream), and any out-of-band drift. READ-ONLY — computes the plan; applies nothing. Use this before changing monetization so you can see exactly what differs.", { project_id: z.string().describe("The project ID") }, async ({ project_id }, { client }) => {
+function registerTools$29(server, apiClient) {
+	registerTool(server, apiClient, "amba_monetization_plan", "Preview the monetization plan for a project: a three-way diff between the declared subscription config (entitlements, products, offerings, packages, paywalls), the last-adopted baseline, and the live config in the connected provider (RevenueCat). Returns the op-list an apply WOULD perform (create/update/archive/attach/detach/set-current — including store-product creation steps for declared products that do not exist upstream yet), a store-floor preflight (blocking gaps: dangling product references, or no provider app connected for a store), a `human_floor` checklist (store-side steps no API can do — store SKUs outside the App Store, pricing, agreements/banking/tax, review — each with its exact console location, ready to relay to the developer), and any out-of-band drift. READ-ONLY — computes the plan; applies nothing. Use this before changing monetization so you can see exactly what differs.", { project_id: z.string().describe("The project ID") }, async ({ project_id }, { client }) => {
 		const result = await client.get(`/projects/${project_id}/monetization/plan`);
 		return { content: [{
 			type: "text",
@@ -2957,10 +2971,10 @@ function registerTools$24(server, apiClient) {
 			text: JSON.stringify(result, null, 2)
 		}] };
 	});
-	registerTool(server, apiClient, "amba_monetization_apply", "Apply the declared monetization config to the connected provider (RevenueCat). Additive ops apply automatically: CREATE entitlements/offerings/packages/paywall-DRAFTS, ATTACH products to new packages/entitlements, update display metadata. DESTRUCTIVE ops (detach a product, archive an entitlement/offering, remove a package) are GATED: they apply ONLY when you re-call with `confirm` set to the plan_hash — otherwise the apply refuses with MONETIZATION_CONFIRM_REQUIRED and lists the gated ops (nothing is written). Setting the current/default offering and publishing a paywall live are NOT API-driven — they're returned in `refused` with the exact dashboard step. Pass the `plan_hash` from a fresh `amba_monetization_plan`; apply refuses a stale plan_hash (re-plan), hard-fails on a missing store product, enforces the ordering invariant (never archives the live current offering; never detaches a product a live customer resolves unless `allow_detach_live`), reads back every write, and STOPS on the first failure without rolling back. To execute gated ops, first review the plan, then call again with confirm = plan_hash.", {
+	registerTool(server, apiClient, "amba_monetization_apply", "Apply the declared monetization config to the connected provider (RevenueCat). DURABLE + ASYNC: this starts the apply and returns an `operation_id` — poll it with `amba_operations_get` until `succeeded` | `failed` (writes are paced against the provider's rate limits, so large plans take a few minutes; the apply survives restarts and retries safely via per-op idempotency keys). Additive ops apply automatically: CREATE entitlements/offerings/packages/paywall-DRAFTS, ATTACH products to new packages/entitlements, update display metadata. DESTRUCTIVE ops (detach a product, archive an entitlement/offering/product, remove a package) are GATED behind a confirmation of the exact plan_hash: pass `confirm` = plan_hash up front, or call apply without it to get `confirm_required: true` (the apply then WAITS for confirmation — re-call apply with `confirm` to approve that pending apply; a confirmation that no longer matches the plan is rejected and nothing destructive runs). STORE-PRODUCT steps go further: declared products missing upstream are CREATED through the provider (registered with RevenueCat, and — with store_metadata.push_to_store — created as REAL store products: App Store products in App Store Connect when they declare duration + subscription_group_name; Google Play ONE-TIME products in Google Play directly when they declare play_price_micros + play_currency, with the price set as part of the create — connect a `google_play` integration first), but these store catalog writes NEVER run off an up-front `confirm`: the apply always waits, you review the pending store steps plus the returned `human_floor` checklist (App Store pricing, agreements/banking/tax, review — with exact console locations), then approve by re-calling apply with `confirm`. Setting the current/default offering, publishing a paywall live, store SKUs apply can't create (Play subscriptions + other stores), and App Store pricing are NOT API-driven — they're returned in `refused`/`human_floor` with the exact dashboard step. Pass the `plan_hash` from a fresh `amba_monetization_plan`; apply refuses a stale plan_hash (re-plan), hard-fails on an unresolvable store reference, enforces the ordering invariant (never archives the live current offering; never detaches a product a live customer resolves unless `allow_detach_live`), reads back every write, and STOPS on the first failure without rolling back.", {
 		project_id: z.string().describe("The project ID"),
 		plan_hash: z.string().describe("The plan_hash returned by a fresh amba_monetization_plan. Apply refuses if the provider drifted off this hash."),
-		confirm: z.string().optional().describe("Set to the SAME plan_hash to confirm and EXECUTE the gated destructive ops (detach/archive/remove). Omit for an additive-only apply — gated ops are then reported but not run."),
+		confirm: z.string().optional().describe("Set to the SAME plan_hash to confirm and EXECUTE the gated destructive ops (detach/archive/remove). When a plan has gated ops and confirm is omitted, the apply waits for confirmation (re-call apply with confirm to approve it); plans without gated ops apply without confirmation. Store-product creation steps ALWAYS wait — an up-front confirm never auto-runs a store catalog write; approve the started apply by re-calling with confirm."),
 		allow_detach_live: z.boolean().optional().describe("Accept detaching a product a live customer currently resolves. Off by default (the apply refuses such a detach to protect live purchases)."),
 		reconcile: z.enum(["amba", "adopt"]).optional().describe("Out-of-band drift mode: 'amba' (default) reverts the provider to the declared config on confirm; 'adopt' pulls the live change back into the declared config instead.")
 	}, async ({ project_id, plan_hash, confirm, allow_detach_live, reconcile }, { client }) => {
@@ -2994,7 +3008,7 @@ function registerTools$24(server, apiClient) {
 }
 //#endregion
 //#region src/tools/leaderboards.ts
-function registerTools$23(server, apiClient) {
+function registerTools$28(server, apiClient) {
 	registerTool(server, apiClient, "amba_leaderboards_create", "Create a leaderboard definition. Leaderboards rank users by XP, streak length, or a custom metric. Supports all-time, daily, weekly, and monthly periods with configurable max entries. The returned `key` (which equals `name`) is the exact value the in-app SDK passes to `Amba.leaderboards.getEntries(key)` / `getRank(key)`.", {
 		project_id: z.string().describe("The project ID"),
 		name: z.string().describe("Leaderboard name (e.g. \"Top XP Earners\", \"Weekly Streak Leaders\")"),
@@ -3109,7 +3123,7 @@ function registerTools$23(server, apiClient) {
 * rollover (the scheduled weekly rollover) and score live off `xp_awarded`
 * engagement events.
 */
-function registerTools$22(server, apiClient) {
+function registerTools$27(server, apiClient) {
 	registerTool(server, apiClient, "amba_leagues_create", "Create a league tier (e.g. \"Bronze\", tier_order=1). Leagues are the promote/demote ladder: each week users are grouped into cohorts of `cohort_size`, the top `promote_count` move up a tier and the bottom `demote_count` move down. Create one league per tier (lowest tier_order = entry tier). Members are assigned by the weekly rollover, not at create time.", {
 		project_id: z.string().describe("The project ID"),
 		name: z.string().describe("League tier name, e.g. \"Bronze\", \"Silver\", \"Gold\""),
@@ -3172,7 +3186,7 @@ function registerTools$22(server, apiClient) {
 }
 //#endregion
 //#region src/tools/platform.ts
-function registerTools$21(server, apiClient) {
+function registerTools$26(server, apiClient) {
 	registerTool(server, apiClient, "amba_onboarding_create", "Create an onboarding flow for a project. Onboarding flows define step-by-step experiences for new users (e.g. welcome screens, permission prompts, feature tours).", {
 		project_id: z.string().describe("The project ID"),
 		name: z.string().describe("Flow name (e.g. \"Welcome Flow\", \"Premium Onboarding\")"),
@@ -3825,7 +3839,7 @@ function registerTools$21(server, apiClient) {
 }
 //#endregion
 //#region src/tools/social.ts
-function registerTools$20(server, apiClient) {
+function registerTools$25(server, apiClient) {
 	registerTool(server, apiClient, "amba_friendships_get_stats", "Get friendship statistics for a project. Returns total friendships, pending requests, accepted friendships, and blocked count.", { project_id: z.string().describe("The project ID") }, async ({ project_id }, { client }) => {
 		const result = await client.get(`/projects/${project_id}/friends/stats`);
 		return { content: [{
@@ -4150,7 +4164,7 @@ function registerTools$20(server, apiClient) {
 }
 //#endregion
 //#region src/tools/xp.ts
-function registerTools$19(server, apiClient) {
+function registerTools$24(server, apiClient) {
 	registerTool(server, apiClient, "amba_xp_rules_create", "Create an XP rule that auto-awards XP when a matching engagement event is tracked. For example, award 50 XP every time a user completes a workout, with optional daily caps and cooldowns.", {
 		project_id: z.string().describe("The project ID"),
 		name: z.string().describe("Rule name (e.g. \"Workout Completed\", \"Daily Login Bonus\")"),
@@ -4273,7 +4287,7 @@ function registerTools$19(server, apiClient) {
 }
 //#endregion
 //#region src/tools/events.ts
-function registerTools$18(server, apiClient) {
+function registerTools$23(server, apiClient) {
 	registerTool(server, apiClient, "amba_events_list", "List engagement events for a project (most recent first) with cursor pagination on (occurred_at, id). Defaults to the last 24 hours when `since` is omitted. Pass `next_cursor` from a previous page back as `cursor` to continue.", {
 		project_id: z.string().describe("The project ID"),
 		since: z.string().optional().describe("ISO-8601 lower bound for occurred_at. Defaults to 24h ago."),
@@ -4364,7 +4378,7 @@ function registerTools$18(server, apiClient) {
 }
 //#endregion
 //#region src/tools/event-catalog.ts
-function registerTools$17(server, apiClient) {
+function registerTools$22(server, apiClient) {
 	registerTool(server, apiClient, "amba_events_catalog", "Discover every event you can subscribe a webhook to — both APP events (inside your app: users, gamification, economy, social, content) and CONTROL-plane lifecycle events (about the project itself: provisioning, deploys, domains, billing). Returns each event's type, plane, payload example, and status (`live` = emitted today, `planned` = catalogued, not yet wired). Production pattern: after standing up a project, call this, then subscribe to the lifecycle events you care about (e.g. `domain.registered`, `site.deploy.completed`) with amba_control_webhooks_create and to app events with amba_webhooks_create. Subscriptions match an exact name, a namespace wildcard (`economy.*`), or all (`*`). Pass plane to filter.", {
 		project_id: z.string().describe("The project ID"),
 		plane: z.enum(["app", "control"]).optional().describe("Filter to one plane. Omit for both.")
@@ -4434,7 +4448,7 @@ const funnelStepSchema = z.object({
 	event: z.string().describe("Event name to match (engagement event_name)."),
 	filters: z.array(funnelFilterSchema).optional().describe("Optional property predicates, ANDed together, that an event must satisfy.")
 });
-function registerTools$16(server, apiClient) {
+function registerTools$21(server, apiClient) {
 	registerTool(server, apiClient, "amba_funnels_list", "List conversion funnels for a project. A funnel is a saved, ordered sequence of steps (event + optional property filters) plus a conversion window. Returns the definitions only — use amba_funnels_query to compute per-step counts.", { project_id: z.string().describe("The project ID") }, async ({ project_id }, { client }) => {
 		const result = await client.get(`/projects/${project_id}/funnels`);
 		return { content: [{
@@ -4650,7 +4664,7 @@ function enrichedAuthResult(result, agentInstructions) {
 		status: result.status
 	});
 }
-function registerTools$15(server, apiClient) {
+function registerTools$20(server, apiClient) {
 	registerPublicTool(server, "amba_developer_signup", [
 		"Create a new Amba developer account. Returns a long-lived Personal Access Token (PAT)",
 		"plus a real isolated Amba project (provisioning asynchronously), plus ready-to-paste",
@@ -4668,7 +4682,34 @@ function registerTools$15(server, apiClient) {
 	].join(" "), {
 		email: z.string().email().describe("Developer email address. Will be lowercased."),
 		password: z.string().min(8).describe("Password, minimum 8 characters."),
-		name: z.string().optional().describe("Optional display name.")
+		name: z.string().optional().describe("Optional display name."),
+		referral_code: z.string().optional().describe("Optional Amba partner referral code the developer arrived with (the `ref` on a partner's link). Attributes a later paid upgrade to that partner; ignored if not a live partner code.")
+	}, async ({ email, password, name, referral_code }) => {
+		const body = {
+			email,
+			password
+		};
+		if (name !== void 0) body.name = name;
+		if (referral_code !== void 0) body.referral_code = referral_code;
+		return enrichedAuthResult(await authFetch(apiClient, {
+			method: "POST",
+			path: "/auth/developer/signup",
+			body
+		}), SIGNUP_AGENT_INSTRUCTIONS);
+	});
+	registerPublicTool(server, "amba_affiliate_signup", [
+		"Join an affiliate program from zero: create an Amba account + org and get a long-lived PAT",
+		"plus ready-to-paste MCP-client config in `mcp_config`. An affiliate IS an Amba org — after",
+		"signing up, give your org id (from amba_orgs_list) to the program owner so they can enroll you",
+		"(amba_affiliate_invite with affiliate_org_id), then set up payouts with",
+		"amba_affiliate_my_payout_account_create. Agent: pass the returned `pat` inline on subsequent calls",
+		"and write the mcp_config snippet to the customer's MCP config for future sessions.",
+		"Email is lowercased; password must be at least 8 characters."
+	].join(" "), {
+		email: z.string().email().describe("Affiliate email address. Will be lowercased."),
+		password: z.string().min(8).describe("Password, minimum 8 characters."),
+		name: z.string().optional().describe("Optional display name."),
+		invite_token: z.string().optional().describe("Optional affiliate invite token (for reference).")
 	}, async ({ email, password, name }) => {
 		const body = {
 			email,
@@ -4765,6 +4806,7 @@ async function adminFetch$1(apiClient, options) {
 		Accept: "application/json"
 	};
 	if (options.body !== void 0) headers["Content-Type"] = "application/json";
+	if (options.idempotencyKey !== void 0) headers["Idempotency-Key"] = options.idempotencyKey;
 	const res = await fetch(url, {
 		method: options.method,
 		headers,
@@ -4796,7 +4838,7 @@ function catalogShapeWarning(row) {
 	const ownership = "user_id" in row ? `attributed to user_id "${String(row["user_id"])}"` : "attributed to the seeding user (or rejected if the collection requires user_id)";
 	return [`⚠️ This row has catalog-shaped column(s) [${hit.join(", ")}] but is being inserted into a per-user collection, so it will be ${ownership} — other users will NOT see it via the client SDK.`, "If this is shared/global content (a catalog, articles, a media library), use a Content Library (amba_content_libraries_create) or create the collection with shared:true so its rows are readable by every user. Proceeding anyway."].join(" ");
 }
-async function clientFetch(apiClient, options) {
+async function clientFetch$1(apiClient, options) {
 	let url = `${apiClient.getApiRoot()}/client${options.path}`;
 	if (options.query && Object.keys(options.query).length > 0) url += `?${new URLSearchParams(options.query).toString()}`;
 	const headers = {
@@ -4805,6 +4847,7 @@ async function clientFetch(apiClient, options) {
 	};
 	if (options.body !== void 0) headers["Content-Type"] = "application/json";
 	if (options.sessionToken) headers["Authorization"] = `Bearer ${options.sessionToken}`;
+	if (options.idempotencyKey !== void 0) headers["Idempotency-Key"] = options.idempotencyKey;
 	const res = await fetch(url, {
 		method: options.method,
 		headers,
@@ -4831,26 +4874,70 @@ const MISSING_API_KEY_ERROR = jsonResult$1({
 		message: "Client tools require `api_key` (the project client X-Api-Key). Mint one via amba_api_keys_create with key_type=\"client\"."
 	}
 });
+const COLLECTION_COLUMN_TYPES = [
+	"uuid",
+	"text",
+	"integer",
+	"bigint",
+	"numeric",
+	"boolean",
+	"timestamptz",
+	"date",
+	"jsonb",
+	"vector",
+	"text[]",
+	"integer[]",
+	"bigint[]",
+	"numeric[]",
+	"boolean[]",
+	"uuid[]"
+];
+const CHANGE_TYPE_TARGET_TYPES = [
+	"uuid",
+	"text",
+	"integer",
+	"bigint",
+	"numeric",
+	"boolean",
+	"timestamptz",
+	"date",
+	"jsonb",
+	"text[]",
+	"integer[]",
+	"bigint[]",
+	"numeric[]",
+	"boolean[]",
+	"uuid[]"
+];
 const columnSchema = z.object({
-	name: z.string().describe("Column name. Must match /^[a-z][a-z0-9_]*$/."),
-	type: z.string().describe("Column type. One of: text, integer, bigint, boolean, jsonb, timestamptz, date, uuid, numeric, vector, or an array type (text[], integer[], bigint[], numeric[], boolean[], uuid[]). Array columns support the contains/containedBy/overlaps query operators. Vector columns require a \"dimensions\" hint."),
-	nullable: z.boolean().optional().describe("Whether the column accepts NULL. Defaults to true."),
-	default: z.unknown().optional().describe("Default SQL literal (e.g. \"NOW()\", 0, \"''\"). Optional."),
-	dimensions: z.number().optional().describe("Required for `vector` columns; ignored otherwise.")
+	name: z.string().describe("Column name. Must match /^[a-z][a-z0-9_]*$/. Server-managed names (id, user_id, created_at, updated_at, deleted_at) and the query keywords and/or/not are reserved."),
+	type: z.enum(COLLECTION_COLUMN_TYPES).describe("Column type. Scalars: text, integer, bigint, numeric, boolean, timestamptz, date, jsonb, uuid. Arrays: text[], integer[], bigint[], numeric[], boolean[], uuid[] — array columns unlock the contains/contained_by/overlaps query operators. `vector` requires `dimension`. Column defaults are not supported — set values at insert time."),
+	nullable: z.boolean().optional().describe("Whether the column accepts NULL. Defaults to false — columns are NOT NULL unless nullable is true."),
+	dimension: z.number().int().min(1).max(4096).optional().describe("Required for `vector` columns: the embedding dimension (1–4096), e.g. 1536 for OpenAI text-embedding-3-small. Rejected on non-vector columns."),
+	references: z.object({
+		table: z.string().describe("Target table, e.g. app_users."),
+		column: z.string().optional().describe("Target column. Defaults to id."),
+		onDelete: z.enum([
+			"CASCADE",
+			"RESTRICT",
+			"SET NULL",
+			"NO ACTION"
+		]).optional().describe("Cascade behavior. Defaults to RESTRICT.")
+	}).optional().describe("Optional foreign key. Not allowed on vector columns. (Every collection already gets a user_id FK to app_users automatically — no need to declare it.)")
 });
 const indexSchema = z.object({
 	name: z.string().optional().describe("Index name. Defaults to a generated value."),
-	columns: z.array(z.string()).describe("Column names included in the index."),
-	unique: z.boolean().optional().describe("Whether the index enforces uniqueness."),
-	using: z.enum([
-		"btree",
-		"hash",
-		"gin",
-		"gist",
-		"brin",
-		"hnsw",
-		"ivfflat"
-	]).optional().describe("Index method. Defaults to btree.")
+	columns: z.array(z.string()).min(1).describe("Column entries — each is \"<col>\" or \"<col> desc\" (ascending is the default). For a vector index, exactly one entry naming the vector column."),
+	unique: z.boolean().optional().describe("Whether the index enforces uniqueness. Not supported on vector indexes."),
+	vector: z.object({
+		method: z.enum(["ivfflat", "hnsw"]).optional().describe("Index method. Default ivfflat (fast build); hnsw trades slower writes for better recall on read-heavy workloads."),
+		distance: z.enum([
+			"cosine",
+			"l2",
+			"inner_product"
+		]).optional().describe("Distance operator the index optimizes for. Default cosine. Must match the `distance` used by find-nearest queries against the column, or the index is skipped."),
+		lists: z.number().int().min(1).max(1e5).optional().describe("ivfflat only: number of inverted lists. Default 100; sqrt(row count) is a good rule of thumb.")
+	}).optional().describe("Vector index spec — set it (even as {}) to build a similarity index on a vector column for find-nearest. Omit for a standard B-tree index; non-vector indexes never need it.")
 });
 const sdkFilterSchema = z.unknown().describe("SDK-shaped filter. Either a leaf `{column, op, value}` (op ∈ eq|ne|gt|gte|lt|lte|in|not_in|like|ilike|is_null|is_not_null) or a combinator `{and: [...]}` / `{or: [...]}` / `{not: {...}}`.");
 const sdkOrderSchema = z.array(z.object({
@@ -4859,9 +4946,10 @@ const sdkOrderSchema = z.array(z.object({
 })).describe("Ordering. `[{column: \"created_at\", direction: \"desc\"}, ...]`.");
 const adminFindWhereSchema = z.unknown().describe("Server WhereClause shape: column-keyed FieldOps, e.g. {tag: {eq: \"x\"}, count: {gte: 5}} plus optional `and|or|not` combinators.");
 const setSchema = z.record(z.unknown()).describe("Column-value map. Server-managed columns (id, created_at, etc.) are rejected.");
-function registerTools$14(server, apiClient) {
+function registerTools$19(server, apiClient) {
 	registerTool(server, apiClient, "amba_collections_create", [
 		"Create a new collection (schema-first Postgres table) in a project.",
+		"Ownership: by default every row is private to the user who created it. For team/org data, pass owner_scope:'group' with read_policy:'member' and write_policy:'member:admin' — rows are owned by a group and any member reads while admins write, enforced server-side via the group's membership so you don't reimplement authorization in app code.",
 		"The schema change is applied server-side via an async workflow.",
 		"Authenticates as the developer/agent — pass `pat` (the Personal Access Token returned by amba_developer_signup) or send it as the inbound Bearer.",
 		"Returns the workflow id + version + status. Failure responses include `details.workflow_id` for debugging.",
@@ -4871,14 +4959,20 @@ function registerTools$14(server, apiClient) {
 		name: z.string().describe("Collection name. Must match /^[a-z][a-z0-9_]*$/. Reserved prefixes (amba_, coll_amba_) are rejected."),
 		columns: z.array(columnSchema).describe("Column definitions. Server adds id/user_id/created_at/updated_at/deleted_at."),
 		indexes: z.array(indexSchema).optional().describe("Optional extra indexes (server creates a primary key + user_id index by default)."),
-		shared: z.boolean().optional().describe("Set true for developer-seeded GLOBAL content not owned by any single user (question banks, content libraries, lookup tables). Makes user_id NULLABLE so rows can be inserted without a user_id. Defaults to false (every row requires a user_id).")
-	}, async ({ project_id, name, columns, indexes, shared }, { pat }) => {
+		shared: z.boolean().optional().describe("Set true for developer-seeded GLOBAL content not owned by any single user (question banks, content libraries, lookup tables). Makes user_id NULLABLE so rows can be inserted without a user_id. Defaults to false (every row requires a user_id)."),
+		owner_scope: z.enum(["user", "group"]).optional().describe("Row ownership model. 'user' (default) — each row is private to the user who created it (profiles, drafts, per-user state). 'group' — rows are owned by a team (a group_id) and shared with its members; pair with read_policy:'member' / write_policy:'member:admin'. Reach for 'group' the moment two users must read or write the same rows (team workspaces, org-shared data) — Amba resolves membership server-side so you can delete your app-side authorization layer."),
+		read_policy: z.string().optional().describe("Who can READ rows — Postgres-grade row security, declared once and enforced on every query. 'owner' (default, private), 'public' (every signed-in user), 'member' (any member of the owning group; requires owner_scope:'group'), 'member:<role>' (members at role >= <role>, where owner>admin>member>viewer)."),
+		write_policy: z.string().optional().describe("Who can WRITE rows. 'owner' (default), 'authenticated' (any signed-in user may insert), 'member' (any member of the owning group), 'member:admin' (the classic 'members read, admins write'; requires owner_scope:'group'). Reads and writes are independent.")
+	}, async ({ project_id, name, columns, indexes, shared, owner_scope, read_policy, write_policy }, { pat }) => {
 		const body = {
 			name,
 			columns
 		};
 		if (indexes !== void 0) body.indexes = indexes;
 		if (shared !== void 0) body.shared = shared;
+		if (owner_scope !== void 0) body.owner_scope = owner_scope;
+		if (read_policy !== void 0) body.read_policy = read_policy;
+		if (write_policy !== void 0) body.write_policy = write_policy;
 		return passthroughResult(await adminFetch$1(apiClient, {
 			method: "POST",
 			path: `/projects/${project_id}/collections`,
@@ -4955,7 +5049,8 @@ function registerTools$14(server, apiClient) {
 		}));
 	});
 	registerTool(server, apiClient, "amba_collections_alter", [
-		"Alter a collection: exactly one of `add_column`, `add_index`, `change_type`, `rename_column`, `drop_column`, or `relax_user_id` per call (the underlying saga is built around one SQL blob per workflow).",
+		"Alter a collection: exactly one of `add_column`, `add_index`, `change_type`, `rename_column`, `drop_column`, `relax_user_id`, or `set_policy` per call (the underlying saga is built around one SQL blob per workflow; set_policy is a metadata-only write applied without the saga).",
+		"set_policy changes an existing collection's access policy: read_policy ('owner'|'public'|'member'|'member:<role>') and/or write_policy ('owner'|'authenticated'|'member'|'member:admin'). A 'member' policy requires the collection to have been created with owner_scope:'group' (owner scope is fixed at create time).",
 		"Drop-column is destructive — requires `confirm` to equal the dropped column name.",
 		"change_type changes an existing column to a new type. It REWRITES THE WHOLE TABLE under an exclusive lock — the collection is briefly unreadable/unwritable while it runs, so prefer low-traffic windows for large collections. Casts that are not trivially safe (e.g. text→integer) require a `using` cast expression; known-safe casts (anything→text, integer→bigint, integer/bigint→numeric) do not. Without a `using` for an unsafe cast you get a 400 up front rather than a mid-migration failure.",
 		"rename_column renames a column (metadata-only, fast). It BREAKS any app code referencing the old name — re-run `amba types generate` and update call sites afterward. The new name can’t collide with a server-managed column (id, user_id, created_at, updated_at, deleted_at) or a reserved query keyword (and, or, not).",
@@ -4969,8 +5064,8 @@ function registerTools$14(server, apiClient) {
 		add_index: indexSchema.optional().describe("Index to add. Mutually exclusive with the other alter operations."),
 		change_type: z.object({
 			column: z.string().describe("Existing column to change."),
-			to_type: z.string().describe("Target type (text, integer, bigint, numeric, boolean, timestamptz, date, jsonb, uuid)."),
-			from_type: z.string().optional().describe("Optional current type. When provided, known-safe widening casts (integer→bigint, integer/bigint→numeric) skip the `using` requirement."),
+			to_type: z.enum(CHANGE_TYPE_TARGET_TYPES).describe("Target type — any column type except vector (text, integer, bigint, numeric, boolean, timestamptz, date, jsonb, uuid, or an array type like text[]). To move a column to vector, add a new vector column instead."),
+			from_type: z.enum(COLLECTION_COLUMN_TYPES).optional().describe("Optional current type. When provided, known-safe widening casts (integer→bigint, integer/bigint→numeric) skip the `using` requirement."),
 			using: z.string().optional().describe("SQL cast expression for the USING clause, e.g. \"score::integer\". Required for casts that are not trivially safe; omit only for anything→text or a known-safe widening cast.")
 		}).optional().describe("Change a column’s type. REWRITES THE WHOLE TABLE under an exclusive lock (briefly unreadable/unwritable). Mutually exclusive with the other alter operations."),
 		rename_column: z.object({
@@ -4979,8 +5074,12 @@ function registerTools$14(server, apiClient) {
 		}).optional().describe("Rename a column (metadata-only, fast). BREAKS code referencing the old name — re-run `amba types generate` afterward. Mutually exclusive with the other alter operations."),
 		drop_column: z.string().optional().describe("Column name to drop. Requires `confirm` query param to match."),
 		relax_user_id: z.boolean().optional().describe("Set true to drop the user_id NOT NULL constraint so this collection can hold shared/global rows (NULL user_id). Mutually exclusive with the other operations."),
+		set_policy: z.object({
+			read_policy: z.string().optional(),
+			write_policy: z.string().optional()
+		}).optional().describe("Change the access policy (metadata-only). read_policy: 'owner'|'public'|'member'|'member:<role>'; write_policy: 'owner'|'authenticated'|'member'|'member:admin'. 'member' policies require a group-owned collection (created with owner_scope:'group'). Mutually exclusive with the other operations."),
 		confirm: z.string().optional().describe("Required when drop_column is set; must equal the column name.")
-	}, async ({ project_id, name, add_column, add_index, change_type, rename_column, drop_column, relax_user_id, confirm }, { pat }) => {
+	}, async ({ project_id, name, add_column, add_index, change_type, rename_column, drop_column, relax_user_id, set_policy, confirm }, { pat }) => {
 		const body = {};
 		if (add_column !== void 0) body.add_column = add_column;
 		if (add_index !== void 0) body.add_index = add_index;
@@ -4988,6 +5087,7 @@ function registerTools$14(server, apiClient) {
 		if (rename_column !== void 0) body.rename_column = rename_column;
 		if (drop_column !== void 0) body.drop_column = drop_column;
 		if (relax_user_id !== void 0) body.relax_user_id = relax_user_id;
+		if (set_policy !== void 0) body.set_policy = set_policy;
 		const query = {};
 		if (drop_column !== void 0 && confirm !== void 0) query.confirm = confirm;
 		return passthroughResult(await adminFetch$1(apiClient, {
@@ -5009,6 +5109,7 @@ function registerTools$14(server, apiClient) {
 		project_id: z.string().describe("The project ID."),
 		name: z.string().describe("Collection name."),
 		row: z.record(z.unknown()).describe("Column-value map for the new row. Server-managed columns are stripped."),
+		idempotency_key: z.string().min(1).max(255).optional().describe("Request-level idempotency key, sent as the Idempotency-Key header. This is separate from any row column named idempotency_key."),
 		as_system: z.boolean().optional().describe("Write a developer-owned GLOBAL row (user_id = NULL) on a shared:true collection — for content the whole app reads (question banks, lookup tables) rather than data owned by one end-user. Mutually exclusive with a row.user_id. Rejected on non-shared collections."),
 		on_conflict: z.enum([
 			"error",
@@ -5017,7 +5118,7 @@ function registerTools$14(server, apiClient) {
 		]).optional().describe("Conflict policy. \"error\" (default) fails on a unique-constraint clash; \"ignore\" returns the existing row (HTTP 200) unchanged; \"update\" merges the provided columns. Requires conflict_target."),
 		conflict_target: z.array(z.string()).optional().describe("Columns that form the unique index to conflict on (e.g. [\"user_id\",\"kind\"]). Required when on_conflict is \"ignore\" or \"update\"."),
 		return_minimal: z.boolean().optional().describe("When true, the response returns only the inserted row id instead of the full row. Use this for rows with large columns (big JSON blobs) to avoid bloating the response — essential for bulk migrations where echoing full rows exhausts the token budget.")
-	}, async ({ project_id, name, row, as_system, on_conflict, conflict_target, return_minimal }, { pat }) => {
+	}, async ({ project_id, name, row, idempotency_key, as_system, on_conflict, conflict_target, return_minimal }, { pat }) => {
 		const query = {};
 		if (on_conflict !== void 0) query.on_conflict = on_conflict;
 		if (conflict_target !== void 0) query.conflict_target = conflict_target.join(",");
@@ -5031,7 +5132,8 @@ function registerTools$14(server, apiClient) {
 			path: `/projects/${project_id}/collections/${encodeURIComponent(name)}/rows`,
 			body: requestBody,
 			query: Object.keys(query).length > 0 ? query : void 0,
-			bearer: pat
+			bearer: pat,
+			...idempotency_key !== void 0 && { idempotencyKey: idempotency_key }
 		});
 		const warning = catalogShapeWarning(row);
 		const base = passthroughResult(result);
@@ -5235,6 +5337,7 @@ function registerTools$14(server, apiClient) {
 	].join(" "), {
 		name: z.string().describe("Collection name."),
 		row: z.record(z.unknown()).describe("Column-value map. Server-managed columns and user_id are stripped/overridden."),
+		idempotency_key: z.string().min(1).max(255).optional().describe("Request-level idempotency key, sent as the Idempotency-Key header. This is separate from any row column named idempotency_key."),
 		on_conflict: z.enum([
 			"error",
 			"ignore",
@@ -5243,18 +5346,19 @@ function registerTools$14(server, apiClient) {
 		conflict_target: z.array(z.string()).optional().describe("Unique-index columns to conflict on (e.g. [\"user_id\",\"kind\"]). Required for ignore/update."),
 		api_key: z.string().describe("Project client X-Api-Key. End-user tools authenticate via this + an optional session token, NOT via a developer PAT."),
 		session_token: z.string().optional().describe("Optional app_user session Bearer token. Required by the route's clientSessionAuth.")
-	}, async ({ name, row, on_conflict, conflict_target, api_key, session_token }) => {
+	}, async ({ name, row, idempotency_key, on_conflict, conflict_target, api_key, session_token }) => {
 		if (!api_key) return MISSING_API_KEY_ERROR;
 		const query = {};
 		if (on_conflict !== void 0) query.on_conflict = on_conflict;
 		if (conflict_target !== void 0) query.conflict_target = conflict_target.join(",");
-		return passthroughResult(await clientFetch(apiClient, {
+		return passthroughResult(await clientFetch$1(apiClient, {
 			method: "POST",
 			path: `/collections/${encodeURIComponent(name)}`,
 			body: row,
 			...Object.keys(query).length > 0 && { query },
 			apiKey: api_key,
-			...session_token !== void 0 && { sessionToken: session_token }
+			...session_token !== void 0 && { sessionToken: session_token },
+			...idempotency_key !== void 0 && { idempotencyKey: idempotency_key }
 		}));
 	});
 	server.tool("amba_client_list_rows", [
@@ -5282,7 +5386,7 @@ function registerTools$14(server, apiClient) {
 		if (cursor !== void 0) findQuery.cursor = cursor;
 		if (select !== void 0) findQuery.select = select;
 		if (include_deleted !== void 0) findQuery.includeDeleted = include_deleted;
-		return passthroughResult(await clientFetch(apiClient, {
+		return passthroughResult(await clientFetch$1(apiClient, {
 			method: "GET",
 			path: `/collections/${encodeURIComponent(name)}`,
 			query: Object.keys(findQuery).length > 0 ? { query: JSON.stringify(findQuery) } : void 0,
@@ -5301,7 +5405,7 @@ function registerTools$14(server, apiClient) {
 		session_token: z.string().optional().describe("App_user session Bearer. Required by the route.")
 	}, async ({ name, id, api_key, session_token }) => {
 		if (!api_key) return MISSING_API_KEY_ERROR;
-		return passthroughResult(await clientFetch(apiClient, {
+		return passthroughResult(await clientFetch$1(apiClient, {
 			method: "GET",
 			path: `/collections/${encodeURIComponent(name)}/${encodeURIComponent(id)}`,
 			apiKey: api_key,
@@ -5328,7 +5432,7 @@ function registerTools$14(server, apiClient) {
 	}, async ({ name, id, where, set, expected, limit, objects, api_key, session_token }) => {
 		if (!api_key) return MISSING_API_KEY_ERROR;
 		const objectsQuery = objects === "replace" ? { objects: "replace" } : void 0;
-		if (id !== void 0) return passthroughResult(await clientFetch(apiClient, {
+		if (id !== void 0) return passthroughResult(await clientFetch$1(apiClient, {
 			method: "PATCH",
 			path: `/collections/${encodeURIComponent(name)}/${encodeURIComponent(id)}`,
 			body: expected !== void 0 ? {
@@ -5344,7 +5448,7 @@ function registerTools$14(server, apiClient) {
 			where: where ?? {}
 		};
 		if (limit !== void 0) body.limit = limit;
-		return passthroughResult(await clientFetch(apiClient, {
+		return passthroughResult(await clientFetch$1(apiClient, {
 			method: "PATCH",
 			path: `/collections/${encodeURIComponent(name)}`,
 			body,
@@ -5366,7 +5470,7 @@ function registerTools$14(server, apiClient) {
 		session_token: z.string().optional().describe("App_user session Bearer. Required by the route.")
 	}, async ({ name, id, where, limit, api_key, session_token }) => {
 		if (!api_key) return MISSING_API_KEY_ERROR;
-		if (id !== void 0) return passthroughResult(await clientFetch(apiClient, {
+		if (id !== void 0) return passthroughResult(await clientFetch$1(apiClient, {
 			method: "DELETE",
 			path: `/collections/${encodeURIComponent(name)}/${encodeURIComponent(id)}`,
 			apiKey: api_key,
@@ -5374,7 +5478,7 @@ function registerTools$14(server, apiClient) {
 		}));
 		const body = { where: where ?? {} };
 		if (limit !== void 0) body.limit = limit;
-		return passthroughResult(await clientFetch(apiClient, {
+		return passthroughResult(await clientFetch$1(apiClient, {
 			method: "DELETE",
 			path: `/collections/${encodeURIComponent(name)}`,
 			body,
@@ -5397,7 +5501,7 @@ function registerTools$14(server, apiClient) {
 		const findQuery = {};
 		if (where !== void 0) findQuery.where = where;
 		if (include_deleted !== void 0) findQuery.includeDeleted = include_deleted;
-		return passthroughResult(await clientFetch(apiClient, {
+		return passthroughResult(await clientFetch$1(apiClient, {
 			method: "GET",
 			path: `/collections/${encodeURIComponent(name)}/count`,
 			query: Object.keys(findQuery).length > 0 ? { query: JSON.stringify(findQuery) } : void 0,
@@ -5437,7 +5541,7 @@ function registerTools$14(server, apiClient) {
 		if (cursor !== void 0) body.cursor = cursor;
 		if (select !== void 0) body.select = select;
 		if (include_deleted !== void 0) body.include_deleted = include_deleted;
-		return passthroughResult(await clientFetch(apiClient, {
+		return passthroughResult(await clientFetch$1(apiClient, {
 			method: "POST",
 			path: `/collections/${encodeURIComponent(name)}/find`,
 			body,
@@ -5481,7 +5585,7 @@ function registerTools$14(server, apiClient) {
 		if (where !== void 0) body.where = where;
 		if (cursor !== void 0) body.cursor = cursor;
 		if (include_deleted !== void 0) body.include_deleted = include_deleted;
-		return passthroughResult(await clientFetch(apiClient, {
+		return passthroughResult(await clientFetch$1(apiClient, {
 			method: "POST",
 			path: `/collections/${encodeURIComponent(name)}/find-nearest`,
 			body,
@@ -5522,7 +5626,7 @@ function registerTools$14(server, apiClient) {
 		if (filter !== void 0) body.filter = filter;
 		if (where !== void 0) body.where = where;
 		if (include_deleted !== void 0) body.include_deleted = include_deleted;
-		return passthroughResult(await clientFetch(apiClient, {
+		return passthroughResult(await clientFetch$1(apiClient, {
 			method: "POST",
 			path: `/collections/${encodeURIComponent(name)}/aggregate`,
 			body,
@@ -5645,7 +5749,7 @@ function jsonResult(payload) {
 * of a generic upstream 400.
 */
 const MAX_BUNDLE_BYTES = 10 * 1024 * 1024;
-function registerTools$13(server, apiClient) {
+function registerTools$18(server, apiClient) {
 	registerTool(server, apiClient, "amba_functions_deploy", [
 		"Deploy a function to an Amba project. The supplied `code` is a fully bundled JavaScript module (one entry file) — the deploy endpoint uploads it server-side and records a new active deployment row, superseding any prior active version for the same `name`.",
 		"Function name must match /^[a-z][a-z0-9_-]*$/ and be ≤58 chars. Bundle size cap: 10 MiB (enforced client-side too — oversize uploads are rejected before the round-trip).",
@@ -5718,6 +5822,42 @@ function registerTools$13(server, apiClient) {
 			throw err;
 		}
 	}, ["amba_delete_function"]);
+	registerTool(server, apiClient, "amba_function_domains_attach", [
+		"Attach one exact custom hostname to one deployed function. The complete incoming path and query string are preserved when the hostname routes to the function.",
+		"MVP constraints: exact lowercase hostnames only; no wildcards or path rewrites. Attaching a subdomain does NOT create a `www` hostname automatically.",
+		"The response contains provider-neutral certificate/ownership status plus DNS validation instructions. Publish the returned CNAME and validation records, then call `amba_function_domains_refresh` until `live=true` (both statuses active and routing reconciliation successful).",
+		"MVP limits use the effective project tier (free 1, pro 5, scale 20, enterprise or comped 50), with five attach attempts per project per hour. An unverified claim becomes eligible for exact-host reclaim after 24 hours; Worker route/KV allocation waits for active ownership.",
+		"Podcast/feed clients cannot supply an Amba API key. Their function must be deployed with `public: true`; validate any application-specific private token in the handler."
+	].join(" "), {
+		project_id: z.string().describe("The Amba project ID."),
+		name: z.string().describe("Deployed function name."),
+		hostname: z.string().describe("One exact lowercase hostname, for example feeds.podpod.host.")
+	}, async ({ project_id, name, hostname }, { pat }) => {
+		return jsonResult(await callWithPat(apiClient, pat, "POST", `/projects/${encodeURIComponent(project_id)}/functions/${encodeURIComponent(name)}/domains`, { body: { hostname } }));
+	});
+	registerTool(server, apiClient, "amba_function_domains_list", "List exact custom hostnames attached to one function. Status is provider-neutral: `live=true` only when `cert_status` and `ownership_status` are active and required routing reconciliation succeeded.", {
+		project_id: z.string().describe("The Amba project ID."),
+		name: z.string().describe("Deployed function name.")
+	}, async ({ project_id, name }, { pat }) => {
+		return jsonResult(await callWithPat(apiClient, pat, "GET", `/projects/${encodeURIComponent(project_id)}/functions/${encodeURIComponent(name)}/domains`));
+	});
+	registerTool(server, apiClient, "amba_function_domains_refresh", "Refresh DNS ownership and certificate state for one exact function hostname. Publish any returned validation records and repeat until `live=true`.", {
+		project_id: z.string().describe("The Amba project ID."),
+		name: z.string().describe("Deployed function name."),
+		hostname: z.string().describe("Exact attached hostname to refresh.")
+	}, async ({ project_id, name, hostname }, { pat }) => {
+		return jsonResult(await callWithPat(apiClient, pat, "POST", `/projects/${encodeURIComponent(project_id)}/functions/${encodeURIComponent(name)}/domains/${encodeURIComponent(hostname)}/refresh`));
+	});
+	registerTool(server, apiClient, "amba_function_domains_remove", "Detach one exact custom hostname from a function. Requests to the detached hostname fail closed after routing propagation.", {
+		project_id: z.string().describe("The Amba project ID."),
+		name: z.string().describe("Deployed function name."),
+		hostname: z.string().describe("Exact attached hostname to detach.")
+	}, async ({ project_id, name, hostname }, { pat }) => {
+		return jsonResult(await callWithPat(apiClient, pat, "DELETE", `/projects/${encodeURIComponent(project_id)}/functions/${encodeURIComponent(name)}/domains/${encodeURIComponent(hostname)}`) ?? {
+			hostname,
+			deleted: true
+		});
+	});
 	registerTool(server, apiClient, "amba_functions_schedule", [
 		"Register a cron Schedule for a function. The schedule is keyed deterministically per (project, function) — re-calling with a different cron/timezone replaces the prior schedule rather than creating a duplicate.",
 		"Cron must be a standard 5- or 6-field whitespace-separated expression. `timezone` defaults to \"UTC\" if omitted. Timezones are IANA strings (e.g. \"America/Los_Angeles\").",
@@ -5756,24 +5896,29 @@ function registerTools$13(server, apiClient) {
 	registerTool(server, apiClient, "amba_functions_get_logs", [
 		"Read function logs for one function over a bounded time range.",
 		"Default range: last 1 hour. Max range: last 24 hours. `since` and `until` are ISO 8601 timestamps.",
-		"Default limit: 100 events. Max: 1000. Larger spans require operator-side queries — this tool is for \"tail my function\" UX."
+		"Default limit: 100 events. Max: 1000. Larger spans require operator-side queries — this tool is for \"tail my function\" UX.",
+		"Debugging one request? `since_request_id` starts the range at the oldest event mentioning that request id (\"everything from this request onward\"); `request_id` instead filters to only events mentioning it. The two compose."
 	].join(" "), {
 		project_id: z.string().describe("The Amba project ID."),
 		name: z.string().describe("Function name to read logs for."),
 		since: z.string().optional().describe("ISO 8601 lower bound (inclusive). Defaults to `until - 1h`."),
 		until: z.string().optional().describe("ISO 8601 upper bound (exclusive). Defaults to now."),
-		limit: z.number().int().min(1).max(1e3).optional().describe("Max events (1-1000, default 100).")
-	}, async ({ project_id, name, since, until, limit }, { pat }) => {
+		limit: z.number().int().min(1).max(1e3).optional().describe("Max events (1-1000, default 100)."),
+		request_id: z.string().optional().describe("Only return events whose log/exception text mentions this request id (r_...)."),
+		since_request_id: z.string().optional().describe("Anchor the range start at the oldest event mentioning this request id (r_...). Searched within the last 24h, or within since/until when given. 404s if no event mentions it.")
+	}, async ({ project_id, name, since, until, limit, request_id, since_request_id }, { pat }) => {
 		const query = {};
 		if (since !== void 0) query.since = since;
 		if (until !== void 0) query.until = until;
 		if (limit !== void 0) query.limit = String(limit);
+		if (request_id !== void 0) query.request_id = request_id;
+		if (since_request_id !== void 0) query.since_request_id = since_request_id;
 		return jsonResult(await callWithPat(apiClient, pat, "GET", `/projects/${encodeURIComponent(project_id)}/functions/${encodeURIComponent(name)}/logs`, { query }));
 	}, ["amba_get_function_logs"]);
 }
 //#endregion
 //#region src/tools/sites.ts
-function registerTools$12(server, apiClient) {
+function registerTools$17(server, apiClient) {
 	registerTool(server, apiClient, "amba_sites_deploy", [
 		"Deploy a static site to an Amba project. Creates the site if it does not yet exist, then uploads the supplied files as a new deployment.",
 		"The deployment is immutable — its files live forever under the site's storage prefix — and the site flips to serve the new deployment atomically. Older deployments are kept for rollback via `amba_sites_list`.",
@@ -5842,6 +5987,14 @@ function registerTools$12(server, apiClient) {
 	}, async ({ project_id, name }, { pat }) => {
 		return jsonResult(await callWithPat(apiClient, pat, "GET", `/projects/${encodeURIComponent(project_id)}/sites/${encodeURIComponent(name)}/domains`));
 	}, ["amba_list_site_domains"]);
+	registerTool(server, apiClient, "amba_sites_refresh_domain", "Force a fresh ownership and certificate lifecycle check for a site hostname. Returns both normalized states plus current validation records.", {
+		project_id: z.string().describe("The Amba project ID."),
+		name: z.string().describe("Site name."),
+		hostname: z.string().describe("Hostname to refresh. Lowercased at the tool boundary.")
+	}, async ({ project_id, name, hostname }, { pat }) => {
+		const normalisedHostname = hostname.toLowerCase();
+		return jsonResult(await callWithPat(apiClient, pat, "POST", `/projects/${encodeURIComponent(project_id)}/sites/${encodeURIComponent(name)}/domains/${encodeURIComponent(normalisedHostname)}/refresh-cert`));
+	}, ["amba_refresh_site_domain"]);
 	registerTool(server, apiClient, "amba_sites_remove_domain", "Detach a custom hostname from a site. The upstream binding is dropped server-side; the DB row is removed; the host:<hostname> KV entry is cleared. Idempotent — removing a hostname that is no longer attached returns success.", {
 		project_id: z.string().describe("The Amba project ID."),
 		name: z.string().describe("Site name."),
@@ -5865,7 +6018,7 @@ function registerTools$12(server, apiClient) {
 }
 //#endregion
 //#region src/tools/domains.ts
-function registerTools$11(server, apiClient) {
+function registerTools$16(server, apiClient) {
 	registerTool(server, apiClient, "amba_domains_search", ["Search for available domains to buy through Amba. Pass a keyword or a full domain; returns candidate domains with availability and first-year price (USD).", "Free — searching never costs anything. Use this to help a user pick a name, then `amba_domains_check` to price specific picks and `amba_domains_purchase` to buy."].join(" "), {
 		project_id: z.string().describe("The Amba project ID."),
 		query: z.string().describe("A keyword (e.g. \"getunbury\") or a full domain (e.g. \"unbury.com\")."),
@@ -5918,10 +6071,63 @@ function registerTools$11(server, apiClient) {
 		if (offset !== void 0) query.offset = String(offset);
 		return jsonResult(await callWithPat(apiClient, pat, "GET", `/projects/${encodeURIComponent(project_id)}/domains`, { query }));
 	});
+	registerTool(server, apiClient, "amba_domains_email_status", "Get inbound email-routing status for a domain purchased through Amba.", {
+		project_id: z.string().describe("The Amba project ID."),
+		domain: z.string().describe("Purchased domain, e.g. \"example.com\".")
+	}, async ({ project_id, domain }, { pat }) => jsonResult(await callWithPat(apiClient, pat, "GET", `/projects/${encodeURIComponent(project_id)}/domains/${encodeURIComponent(domain.toLowerCase())}/email`)));
+	registerTool(server, apiClient, "amba_domains_email_enable", ["Enable free inbound email routing for a domain purchased through Amba.", "This safely refuses when the domain already has MX records for another mail provider, so it cannot silently replace an existing mailbox service."].join(" "), {
+		project_id: z.string().describe("The Amba project ID."),
+		domain: z.string().describe("Purchased domain, e.g. \"example.com\".")
+	}, async ({ project_id, domain }, { pat }) => jsonResult(await callWithPat(apiClient, pat, "POST", `/projects/${encodeURIComponent(project_id)}/domains/${encodeURIComponent(domain.toLowerCase())}/email/enable`, { body: {} })));
+	registerTool(server, apiClient, "amba_domains_email_destinations_add", ["Add a mailbox that can receive forwarded mail for a purchased domain.", "The mailbox owner must click the verification email before a forward can activate; pending results return action_required:true."].join(" "), {
+		project_id: z.string().describe("The Amba project ID."),
+		domain: z.string().describe("Purchased domain."),
+		email: z.string().email().describe("External mailbox that will receive forwarded mail.")
+	}, async ({ project_id, domain, email }, { pat }) => jsonResult(await callWithPat(apiClient, pat, "POST", `/projects/${encodeURIComponent(project_id)}/domains/${encodeURIComponent(domain.toLowerCase())}/email/destinations`, { body: { email: email.toLowerCase() } })));
+	registerTool(server, apiClient, "amba_domains_email_destinations_list", "List only this project’s forwarding destinations associated with a purchased domain.", {
+		project_id: z.string().describe("The Amba project ID."),
+		domain: z.string().describe("Purchased domain.")
+	}, async ({ project_id, domain }, { pat }) => jsonResult(await callWithPat(apiClient, pat, "GET", `/projects/${encodeURIComponent(project_id)}/domains/${encodeURIComponent(domain.toLowerCase())}/email/destinations`)));
+	registerTool(server, apiClient, "amba_domains_email_destinations_get", "Poll a forwarding destination after its owner clicks the verification email.", {
+		project_id: z.string().describe("The Amba project ID."),
+		domain: z.string().describe("Purchased domain."),
+		destination_id: z.string().describe("Destination ID returned by the add/list tool.")
+	}, async ({ project_id, domain, destination_id }, { pat }) => jsonResult(await callWithPat(apiClient, pat, "GET", `/projects/${encodeURIComponent(project_id)}/domains/${encodeURIComponent(domain.toLowerCase())}/email/destinations/${encodeURIComponent(destination_id)}`)));
+	registerTool(server, apiClient, "amba_domains_email_forwards_set", ["Create or update a literal email forward such as support@example.com → owner@gmail.com.", "The tool enables routing if safe and starts destination verification when needed. If action_required:true is returned, have the mailbox owner click the verification email, poll the destination, then repeat this same call."].join(" "), {
+		project_id: z.string().describe("The Amba project ID."),
+		domain: z.string().describe("Purchased domain."),
+		source: z.string().describe("Local part or full address on the domain, e.g. \"support\" or \"support@example.com\"."),
+		destination: z.string().email().describe("Verified external mailbox to forward into.")
+	}, async ({ project_id, domain, source, destination }, { pat }) => jsonResult(await callWithPat(apiClient, pat, "POST", `/projects/${encodeURIComponent(project_id)}/domains/${encodeURIComponent(domain.toLowerCase())}/email/forwards`, { body: {
+		source,
+		destination: destination.toLowerCase()
+	} })));
+	registerTool(server, apiClient, "amba_domains_email_forwards_list", "List literal email forwards configured on a purchased domain.", {
+		project_id: z.string().describe("The Amba project ID."),
+		domain: z.string().describe("Purchased domain.")
+	}, async ({ project_id, domain }, { pat }) => jsonResult(await callWithPat(apiClient, pat, "GET", `/projects/${encodeURIComponent(project_id)}/domains/${encodeURIComponent(domain.toLowerCase())}/email/forwards`)));
+	registerTool(server, apiClient, "amba_domains_email_forwards_delete", "Delete a literal email forward from a purchased domain.", {
+		project_id: z.string().describe("The Amba project ID."),
+		domain: z.string().describe("Purchased domain."),
+		forward_id: z.string().describe("Forward ID returned by the set/list tool.")
+	}, async ({ project_id, domain, forward_id }, { pat }) => jsonResult(await callWithPat(apiClient, pat, "DELETE", `/projects/${encodeURIComponent(project_id)}/domains/${encodeURIComponent(domain.toLowerCase())}/email/forwards/${encodeURIComponent(forward_id)}`)));
+	registerTool(server, apiClient, "amba_domains_email_catch_all_get", "Get the catch-all forwarding rule for a purchased domain.", {
+		project_id: z.string().describe("The Amba project ID."),
+		domain: z.string().describe("Purchased domain.")
+	}, async ({ project_id, domain }, { pat }) => jsonResult(await callWithPat(apiClient, pat, "GET", `/projects/${encodeURIComponent(project_id)}/domains/${encodeURIComponent(domain.toLowerCase())}/email/catch-all`)));
+	registerTool(server, apiClient, "amba_domains_email_catch_all_set", ["Enable, change, or disable catch-all forwarding for every unmatched address on a purchased domain.", "When enabling, destination is required and must be verified. A pending mailbox returns action_required:true."].join(" "), {
+		project_id: z.string().describe("The Amba project ID."),
+		domain: z.string().describe("Purchased domain."),
+		enabled: z.boolean().describe("True to enable/update catch-all; false to disable it."),
+		destination: z.string().email().optional().describe("External mailbox. Required when enabled=true; omit when disabling.")
+	}, async ({ project_id, domain, enabled, destination }, { pat }) => jsonResult(await callWithPat(apiClient, pat, "PUT", `/projects/${encodeURIComponent(project_id)}/domains/${encodeURIComponent(domain.toLowerCase())}/email/catch-all`, { body: {
+		enabled,
+		...destination ? { destination: destination.toLowerCase() } : {}
+	} })));
 }
 //#endregion
 //#region src/tools/operations.ts
-function registerTools$10(server, apiClient) {
+function registerTools$15(server, apiClient) {
 	registerTool(server, apiClient, "amba_operations_get", [
 		"Poll an async operation by its operation_id to see whether it has finished.",
 		"Returns the operation `status` (pending | running | succeeded | failed); on `failed`, `failed_reason` says why, and on `succeeded`, `result` holds the outcome.",
@@ -5954,17 +6160,24 @@ function registerTools$10(server, apiClient) {
 }
 //#endregion
 //#region src/tools/secrets.ts
-function registerTools$9(server, apiClient) {
+const SET_SECRET_NAME = z.string().regex(/^[A-Z][A-Z0-9_]{0,62}$/, "Secret name must match /^[A-Z][A-Z0-9_]{0,62}$/ (uppercase, starts with a letter, max 63 characters)").superRefine((name, ctx) => {
+	const reason = getBindingReservationReason(name);
+	if (reason !== null) ctx.addIssue({
+		code: z.ZodIssueCode.custom,
+		message: reason
+	});
+});
+function registerTools$14(server, apiClient) {
 	registerTool(server, apiClient, "amba_secrets_set", [
 		"Set or rotate a secret. Omit `function` for a PROJECT-WIDE secret (one value visible to every function in the project, including ones deployed later) — set it once instead of repeating per function. Pass `function` to scope the secret to just that function.",
 		"Writes a new version to the backing secret store and enqueues the sync. Subsequent function invocations see the new value once sync_status flips to \"synced\" (typically <30s).",
 		"Secret name must match /^[A-Z][A-Z0-9_]{0,62}$/. Function name (when given) must match /^[a-z][a-z0-9_-]{0,57}$/.",
-		"Reserved binding names (AMBA_INTERNAL_TOKEN, EDGE_HEADER_SIGNING_SECRET, STORAGE, EDGE_DB_PROXY, AMBA_API_URL, AMBA_AI_GATEWAY_URL, AMBA_PROJECT_ID) are platform-managed and rejected with 400 RESERVED_BINDING.",
+		"The complete AMBA_ and EDGE_ namespaces, plus the exact names STORAGE and EDGE_DB_PROXY, are platform-managed. MCP rejects them before an API/provider call; the API also returns 400 RESERVED_BINDING.",
 		"Secrets may be set BEFORE deploying the function — the sync drains once a deployment lands, so you can set every secret first and deploy once.",
 		"Value cap: 64 KiB. Plaintext is never returned afterwards."
 	].join(" "), {
 		project_id: z.string().describe("The Amba project ID."),
-		name: z.string().describe("Secret name. UPPER_SNAKE_CASE. /^[A-Z][A-Z0-9_]{0,62}$/."),
+		name: SET_SECRET_NAME.describe("Secret name. UPPER_SNAKE_CASE. The AMBA_ and EDGE_ prefixes and exact names STORAGE and EDGE_DB_PROXY are reserved."),
 		value: z.string().describe("Secret value. Stored encrypted at rest; never returned in plaintext afterwards."),
 		function: z.string().optional().describe("Function this secret binds to. OMIT for a project-wide secret (applied to every function in the project).")
 	}, async ({ project_id, name, value, function: functionName }, { pat }) => {
@@ -5996,7 +6209,7 @@ function registerTools$9(server, apiClient) {
 		return jsonResult(await callWithPat(apiClient, pat, "GET", `/projects/${encodeURIComponent(project_id)}/secrets`));
 	}, ["amba_list_secrets"]);
 	registerTool(server, apiClient, "amba_secrets_delete", [
-		"Delete a secret. Removes the version from the backing store AND the sync-pending row. The Worker-side binding is reaped on the next deploy of the affected function(s) (the binding list is re-emitted without the secret).",
+		"Delete a secret. Removes the backing-store value and durably queues runtime-binding revocation across every affected Worker script. Provider failures retry automatically; the control row remains visible with a revocation status until cleanup succeeds.",
 		"Pass `function` to delete a function-scoped secret; OMIT it to delete the project-wide secret of this name.",
 		"Idempotent: deleting a secret that no longer exists succeeds."
 	].join(" "), {
@@ -6008,6 +6221,7 @@ function registerTools$9(server, apiClient) {
 		try {
 			return jsonResult(await callWithPat(apiClient, pat, "DELETE", `/projects/${encodeURIComponent(project_id)}/secrets/${encodeURIComponent(name)}`, functionName === void 0 ? {} : { query: { function: functionName } }) ?? {
 				deleted: true,
+				revocation_queued: true,
 				name,
 				function: scope
 			});
@@ -6153,9 +6367,9 @@ function normalizeContentBlocks(content, provider) {
 * Map a registered prompt's `messages` into a single provider-native format AND
 * (optionally) attach extra `images` to the last user message.
 *
-* Because `amba_ai_prompts_invoke` posts through the raw `/ai/messages`
-* passthrough (byte-for-byte to the provider — the gateway does NOT remap this
-* path), any VENDOR-NEUTRAL `{type:'image', url|data}` block — whether it came
+* `amba_ai_prompts_invoke` keeps its provider-shaped admin-test envelope for
+* backwards compatibility. Any VENDOR-NEUTRAL `{type:'image', url|data}` block
+* — whether it came
 * from the `images` convenience param OR was put directly in `messages` by the
 * caller — must be mapped to the provider's native shape HERE.
 *
@@ -6266,7 +6480,7 @@ function geminiContentsFromMessages(messages, images) {
 	}
 	return contents.filter((c) => c.parts.length > 0);
 }
-function registerTools$8(server, apiClient) {
+function registerTools$13(server, apiClient) {
 	registerTool(server, apiClient, "amba_ai_prompts_create", [
 		"Register a new AI prompt template on a project. Returns the persisted prompt row (name, version, provider, model, client_invokable).",
 		"Name must match /^[a-z][a-z0-9_-]{0,127}$/. Provider must be \"anthropic\", \"openai\", \"mistral\", or \"gemini\" and must already be registered via `amba_ai_providers_set`. Model is the provider-native model id (e.g. \"claude-sonnet-4-5-20250929\", \"gpt-4o-2024-08-06\", \"gemini-2.5-flash\").",
@@ -6334,9 +6548,9 @@ function registerTools$8(server, apiClient) {
 	}, ["amba_delete_ai_prompt"]);
 	registerTool(server, apiClient, "amba_ai_prompts_invoke", [
 		"Server-side test invocation of a registered AI prompt. Looks up the prompt's provider + model + system_prompt + max_tokens, then proxies the call through the admin AI gateway using the customer's registered provider key. Works for every provider — Anthropic / OpenAI / Mistral build a Messages-style body; Gemini builds its contents[] body automatically.",
-		"Provide `messages` as a simple `[{role: \"user\", content: \"...\"}]` array (roles: \"user\"/\"assistant\"/\"system\"; for Gemini, \"assistant\" maps to \"model\" and \"system\" is taken from the prompt). For testing — production traffic goes through the SDK or the function-side `ctx.ai.run()` helper.",
+		"Provide `messages` as a simple `[{role: \"user\", content: \"...\"}]` array (roles: \"user\"/\"assistant\"/\"system\"; for Gemini, \"assistant\" maps to \"model\" and \"system\" is taken from the prompt). This server/admin path works even when `client_invokable=false` and enforces the named prompt budget, rate limit, and usage attribution.",
 		"To send IMAGES to a vision-capable model, pass `images` (each `{url}` or `{data, mime}`) — they attach to the last user message, mapped to the provider's native image format for you. The prompt's model must be vision-capable.",
-		"`extra_body` lets you pass additional provider-native parameters (temperature, top_p, response_format, …). These are merged shallow on top of the prompt-derived body — so a `model` override here wins."
+		"`extra_body` lets you pass allowlisted provider-native tuning parameters (temperature, top_p, response_format, …). The registered prompt model and configured max-token cap remain authoritative."
 	].join(" "), {
 		project_id: z.string().describe("The Amba project ID."),
 		name: z.string().describe("Registered prompt name."),
@@ -6418,7 +6632,7 @@ function registerTools$8(server, apiClient) {
 				body.generationConfig = gc;
 			} else for (const [k, v] of Object.entries(extra_body)) body[k] = v;
 		}
-		return jsonResult(await callWithPat(apiClient, pat, "POST", `/projects/${encodeURIComponent(project_id)}/ai/messages`, { body: {
+		return jsonResult(await callWithPat(apiClient, pat, "POST", `/projects/${encodeURIComponent(project_id)}/ai/prompts/${encodeURIComponent(name)}/invoke`, { body: {
 			provider: prompt.provider,
 			body
 		} }));
@@ -6462,7 +6676,7 @@ const PROVIDER_ENUM = z.enum([
 	"mistral",
 	"gemini"
 ]);
-function registerTools$7(server, apiClient) {
+function registerTools$12(server, apiClient) {
 	registerTool(server, apiClient, "amba_ai_providers_set", [
 		"Register or rotate the upstream AI provider API key for a project. This is the key the AI gateway uses to call the model on your behalf when you invoke a prompt or `Amba.ai.*`.",
 		"Call this BEFORE `amba_ai_prompts_create` — a prompt references a registered provider, and invocations fail with `provider_not_configured` (424) until a key is set.",
@@ -6502,7 +6716,7 @@ const STATUS_ENUM = z.enum([
 	"paused",
 	"ended"
 ]).describe("active = assigns + exposes new users; paused = serves existing assignments but issues no new ones; ended = read-only.");
-function registerTools$6(server, apiClient) {
+function registerTools$11(server, apiClient) {
 	registerTool(server, apiClient, "amba_experiments_create", [
 		"Create an A/B experiment: a stable `key`, a display `name`, and >= 2 weighted variants.",
 		"End-users are bucketed into a STICKY variant the first time they request an assignment",
@@ -6605,25 +6819,28 @@ function registerTools$6(server, apiClient) {
 }
 //#endregion
 //#region src/tools/promotion.ts
-function registerTools$5(server, apiClient) {
+function registerTools$10(server, apiClient) {
 	registerTool(server, apiClient, "amba_project_export", [
 		"Export a declarative bundle of a project's reusable configuration so it can be re-created in another project (e.g. promote dev → prod) in one operation.",
-		"The bundle includes (each section only when present): remote configs, collection SCHEMAS (column defs + indexes, no rows), content libraries + their items, and the full gamification set — currencies, achievements, streaks, challenges, leaderboards, and xp rules — as DEFINITIONS only.",
-		"It carries NO secrets, NO per-user data, and NO end-user rows. Pass the returned `bundle` to `amba_project_import` against the target project."
+		"The bundle includes (each section only when present): remote configs, collection SCHEMAS (column defs + indexes, no rows), content libraries + their items, the full gamification set — currencies, achievements, streaks, challenges, leaderboards, and xp rules — as DEFINITIONS only, plus integrations (push providers et al.) as non-secret config: bundle id, team/key ids, environment travel; `.p8` keys, service-account JSON, and API keys are stripped and marked `credentials: \"stripped\"`.",
+		"It carries NO secrets, NO per-user data, and NO end-user rows — safe to save to disk, commit, or diff. Pass the returned `bundle` to `amba_project_import` against the target project; if both projects belong to the same developer, import with `include_integration_credentials: true` and the credentials are copied server-side too, so push works on the target without re-uploading keys."
 	].join(" "), { project_id: z.string().describe("The Amba project ID to export configuration FROM.") }, async ({ project_id }, { pat }) => {
 		return jsonResult(await callWithPat(apiClient, pat, "GET", `/projects/${encodeURIComponent(project_id)}/promotion/export`));
 	});
 	registerTool(server, apiClient, "amba_project_import", [
-		"Import a declarative configuration bundle (from `amba_project_export`) into a project. Idempotently creates remote configs, collections, content libraries + items, and gamification definitions (currencies, achievements, streaks, challenges, leaderboards, xp rules).",
-		"mode=\"skip_existing\" (default) leaves any entity that already exists (by name/key/code) untouched; mode=\"merge\" refreshes the definition of existing entities. Either mode is safe to run twice — re-import never duplicates.",
-		"Returns a per-section summary of { created, skipped, updated }. Collections are create-if-absent only (an existing collection is skipped; alter the schema via the dedicated collection tools)."
+		"Import a declarative configuration bundle (from `amba_project_export`) into a project. Idempotently creates remote configs, collections, content libraries + items, gamification definitions (currencies, achievements, streaks, challenges, leaderboards, xp rules), and integrations.",
+		"mode=\"skip_existing\" (default) leaves any entity that already exists (by name/key/code) untouched; mode=\"merge\" refreshes the definition of existing entities. Either mode is safe to run twice — re-import never duplicates, and merge never clobbers credentials an existing integration already has.",
+		"Integrations: bundles never carry credential material. By default each imported integration lands inactive in a `pending_credentials` state and the response tells you exactly which call uploads the credentials (`amba_integrations_configure`). When the source and target projects belong to the SAME developer, pass `include_integration_credentials: true` instead — the stored credentials are copied server-side between the projects (never through this conversation) and the integrations activate immediately, making dev → prod push promotion a single call. Cross-developer copies are refused with a 403.",
+		"Returns a per-section summary of { created, skipped, updated } plus a per-integration status list. Collections are create-if-absent only (an existing collection is skipped; alter the schema via the dedicated collection tools)."
 	].join(" "), {
 		project_id: z.string().describe("The Amba project ID to import configuration INTO."),
 		bundle: z.record(z.unknown()).describe("The bundle object returned by `amba_project_export` (its `data` field)."),
-		mode: z.enum(["merge", "skip_existing"]).optional().describe("Conflict resolution. \"skip_existing\" (default) no-ops on a name/key/code conflict; \"merge\" updates the existing definition.")
-	}, async ({ project_id, bundle, mode }, { pat }) => {
+		mode: z.enum(["merge", "skip_existing"]).optional().describe("Conflict resolution. \"skip_existing\" (default) no-ops on a name/key/code conflict; \"merge\" updates the existing definition."),
+		include_integration_credentials: z.boolean().optional().describe("Copy integration credentials (push keys, provider API keys) server-side from the bundle's source project and activate the integrations on the target. Only allowed when both projects belong to the same developer; otherwise the import is refused. Omit (default) to create integrations in a pending_credentials state and upload credentials separately via `amba_integrations_configure`.")
+	}, async ({ project_id, bundle, mode, include_integration_credentials }, { pat }) => {
 		const body = { bundle };
 		if (mode !== void 0) body.mode = mode;
+		if (include_integration_credentials !== void 0) body.include_integration_credentials = include_integration_credentials;
 		return jsonResult(await callWithPat(apiClient, pat, "POST", `/projects/${encodeURIComponent(project_id)}/promotion/import`, { body }));
 	});
 }
@@ -6703,7 +6920,11 @@ const TIER_CATALOG = {
 			unit_description: "$0.50 per 10K push"
 		},
 		db_storage_per_gb_month_usd: 1.5,
-		media_storage_per_gb_month_usd: .1
+		media_storage_per_gb_month_usd: .1,
+		app_mcp_tool_calls: {
+			per_unit_usd: .001,
+			unit_description: "$1.00 per 1K agent tool calls"
+		}
 	},
 	telemetry_event_overage: {
 		per_unit_usd: 1e-7,
@@ -6711,8 +6932,8 @@ const TIER_CATALOG = {
 		note: "Use Amba.track(name, props, { telemetry: true }) for high-volume telemetry. Cheaper, no fan-out to segments/workflows/push."
 	}
 };
-function registerTools$4(server, apiClient) {
-	registerTool(server, apiClient, "amba_billing_status", "Get the current billing tier, headroom on each metered axis (MAU, events, push, db_storage, media_storage), projected overage for the current period, spend ceiling, and what (if any) human action is required before the agent can continue safely. Use this BEFORE provisioning new features or running data-heavy workloads so the agent can self-throttle or escalate to the human.", { project_id: z.string().describe("The project ID") }, async ({ project_id }, { client }) => {
+function registerTools$9(server, apiClient) {
+	registerTool(server, apiClient, "amba_billing_status", "Get the persisted billing `tier`, runtime `effective_tier` (use this for quota/feature decisions), comp status, current-period usage by meter (MAU, events, push, db_storage, media_storage, agent tool calls) with per-meter cost, the billing period and its reset date, spend ceiling + percent consumed, a projected end-of-period overage, the live enforcement state (whether the project is in read-only mode — metered writes returning 402 — and which meters are over quota), and what (if any) human action is required before the agent can continue safely. Use this BEFORE provisioning new features or running data-heavy workloads so the agent can self-throttle or escalate to the human.", { project_id: z.string().describe("The project ID") }, async ({ project_id }, { client }) => {
 		const result = await client.get(`/projects/${project_id}/billing/status`);
 		return { content: [{
 			type: "text",
@@ -6725,7 +6946,7 @@ function registerTools$4(server, apiClient) {
 			text: JSON.stringify(TIER_CATALOG, null, 2)
 		}] };
 	});
-	registerTool(server, apiClient, "amba_billing_set_ceiling", "Set or remove the monthly spend ceiling for a project. When usage would push the bill above the ceiling, requests are throttled (returns 429) instead of accruing overage charges. Pass ceiling_usd: null to remove the ceiling (linear overage with no cap). This is a write action — surface to the human before calling.", {
+	registerTool(server, apiClient, "amba_billing_set_ceiling", "Set or remove the monthly spend ceiling for a project. When the current billing period's overage cost reaches the ceiling, the project degrades to read-only mode: metered WRITE operations (tracking events, inserting collection rows, uploads, push sends, new signups) return 402 with a machine-readable payload (code, current usage, ceiling, reset date) while reads keep working. Control-plane webhook events `billing.ceiling_warning` / `billing.ceiling_reached` fire once per period at 80% / 100% so you can alert. The new ceiling takes effect immediately. Pass ceiling_usd: null to remove the ceiling (linear overage with no cap). This is a write action — surface to the human before calling.", {
 		project_id: z.string().describe("The project ID"),
 		ceiling_usd: z.number().min(0).max(1e5).nullable().describe("Maximum monthly bill in USD, or null to disable")
 	}, async ({ project_id, ceiling_usd }, { client }) => {
@@ -6738,7 +6959,7 @@ function registerTools$4(server, apiClient) {
 }
 //#endregion
 //#region src/tools/payments.ts
-function registerTools$3(server, apiClient) {
+function registerTools$8(server, apiClient) {
 	registerTool(server, apiClient, "amba_payments_account_create", "Create the project's connected payments account so the app can accept payments from its users (the app is the seller; Amba takes a platform fee, Stripe carries the money). Idempotent — returns the existing account if one is already set up. After this, call amba_payments_onboarding_link to finish setup. Note: payments must be enabled on the Amba platform by the platform owner before live accounts can be created.", {
 		project_id: z.string().describe("The project ID"),
 		country: z.string().length(2).optional().describe("Two-letter ISO country code for the seller (e.g. \"US\")"),
@@ -6791,6 +7012,23 @@ function registerTools$3(server, apiClient) {
 			text: JSON.stringify(result, null, 2)
 		}] };
 	});
+	registerTool(server, apiClient, "amba_payments_refund", "Refund a payment, in full or in part. Pass the payment id (returned by amba_payments_charge) and optionally an amount in the smallest currency unit (cents) for a partial refund — omit amount to refund the full charge. The customer is refunded and BOTH the platform fee and the seller transfer are reversed proportionally, so neither Amba nor the seller is left funding it. Money-moving and not reversible — surface to the human before calling.", {
+		project_id: z.string().describe("The project ID"),
+		payment_id: z.string().describe("The payment id to refund (returned by amba_payments_charge)"),
+		amount: z.number().int().positive().optional().describe("Partial refund amount in cents; omit to refund the full charge"),
+		reason: z.enum([
+			"duplicate",
+			"fraudulent",
+			"requested_by_customer"
+		]).optional().describe("Optional refund reason"),
+		reference: z.string().optional().describe("Opaque idempotency reference: pass the same value to make a retry safe (returns the same refund); omit it and each call issues a new refund")
+	}, async ({ project_id, payment_id, ...body }, { client }) => {
+		const result = await client.post(`/projects/${project_id}/payments/charges/${payment_id}/refund`, body);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
 	registerTool(server, apiClient, "amba_payments_balance", "Read the seller's available and pending payment balance per currency. Use this to show the developer how much they've earned that hasn't yet been paid out.", { project_id: z.string().describe("The project ID") }, async ({ project_id }, { client }) => {
 		const result = await client.get(`/projects/${project_id}/payments/balance`);
 		return { content: [{
@@ -6811,8 +7049,29 @@ function registerTools$3(server, apiClient) {
 	});
 }
 //#endregion
+//#region src/tools/agent-checkout.ts
+function registerTools$7(server, apiClient) {
+	registerTool(server, apiClient, "amba_agent_checkout_enable", "Turn agent checkout on (or off) for a project, so your users' AI agents can pay inside your app and have entitlements unlock in the same motion. Default-deny: it stays off until you enable it. Requires a connected payments account first (set one up with amba_payments_account_create). Returns the per-rail capabilities so you can see which payment methods the account can settle. Money-affecting setting — surface it to the human before calling.", {
+		project_id: z.string().describe("The project ID"),
+		enabled: z.boolean().describe("true to enable agent checkout, false to disable")
+	}, async ({ project_id, enabled }, { client }) => {
+		const result = await client.post(`/projects/${project_id}/agent-checkout/enable`, { enabled });
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_agent_checkout_capabilities", "Read which agent-checkout settlement rails a project can offer (and, when a rail is unavailable, exactly why). Use this before enabling agent checkout, or to confirm a project is ready to accept agent-initiated payments. Returns enabled plus a per-rail availability list.", { project_id: z.string().describe("The project ID") }, async ({ project_id }, { client }) => {
+		const result = await client.get(`/projects/${project_id}/agent-checkout/capabilities`);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+}
+//#endregion
 //#region src/tools/invites.ts
-function registerTools$2(server, apiClient) {
+function registerTools$6(server, apiClient) {
 	registerTool(server, apiClient, "amba_projects_invite_member", "Invite a teammate by email to collaborate on this project. Returns the invite URL the human should send to their teammate. Roles: admin (can manage members + integrations), member (can write data), viewer (read-only).", {
 		project_id: z.string().describe("The project ID"),
 		email: z.string().describe("Teammate's email address"),
@@ -6861,122 +7120,167 @@ function registerTools$2(server, apiClient) {
 	});
 }
 //#endregion
-//#region src/tools/webhooks.ts
-function registerTools$1(server, apiClient) {
-	registerTool(server, apiClient, "amba_webhooks_create", "Register an outbound webhook subscription. Amba sends an HMAC-signed POST to target_url every time an event named event_name fires. The signing secret is returned ONCE in this response — copy it into your receiver config; later reads never include it. target_url must be https:// (http:// is allowed only for localhost during development).", {
-		project_id: z.string().describe("The project ID"),
-		event_name: z.string().describe("Event name to subscribe to. Must match ^[a-z][a-z0-9_.-]{0,127}$ (case-insensitive)."),
-		target_url: z.string().describe("HTTPS endpoint that receives the signed POST. http:// allowed only for localhost.")
-	}, async ({ project_id, event_name, target_url }, { client }) => {
-		const result = await client.post(`/projects/${project_id}/webhooks/subscriptions`, {
-			event_name,
-			target_url
-		});
+//#region src/tools/orgs.ts
+/**
+* Organization tools (migration 049). Orgs are the ownership + payment-entity
+* boundary; affiliates and app-factory child projects are all orgs. These wrap
+* the `/v1/admin/orgs*` and `/v1/admin/provision` routes.
+*/
+function registerTools$5(server, apiClient) {
+	registerTool(server, apiClient, "amba_orgs_create", "Create an organization. Optionally nest it under a parent org (parent_org_id) — a child org can bill to its parent (payment_source=\"parent\") or hold its own card (payment_source=\"self\").", {
+		name: z.string().describe("Human-readable org name"),
+		parent_org_id: z.string().optional().describe("Parent org UUID to nest under (omit for a top-level org)"),
+		payment_source: z.enum(["self", "parent"]).optional().describe("\"self\" = bill this org's own card; \"parent\" = bill the nearest self-paying ancestor. Default \"self\"."),
+		slug: z.string().optional().describe("Optional unique URL slug (lowercase alphanumeric/hyphen)"),
+		external_ref: z.string().optional().describe("Caller-stable idempotency key (unique per parent)")
+	}, async ({ name, parent_org_id, payment_source, slug, external_ref }, { client }) => {
+		const body = { name };
+		if (parent_org_id !== void 0) body["parent_org_id"] = parent_org_id;
+		if (payment_source !== void 0) body["payment_source"] = payment_source;
+		if (slug !== void 0) body["slug"] = slug;
+		if (external_ref !== void 0) body["external_ref"] = external_ref;
+		const result = await client.post("/orgs", body);
 		return { content: [{
 			type: "text",
 			text: JSON.stringify(result, null, 2)
 		}] };
 	});
-	registerTool(server, apiClient, "amba_webhooks_list", "List all webhook subscriptions for a project (most recent first). Secrets are never included — only id, event_name, target_url, status, and timestamps. status is \"active\", \"degraded\" (the delivery circuit breaker tripped on repeated failures), or \"disabled\".", { project_id: z.string().describe("The project ID") }, async ({ project_id }, { client }) => {
-		const result = await client.get(`/projects/${project_id}/webhooks/subscriptions`);
+	registerTool(server, apiClient, "amba_orgs_list", "List organizations the authenticated developer can access, including descendant orgs in the hierarchy.", {}, async (_, { client }) => {
+		const result = await client.get("/orgs");
 		return { content: [{
 			type: "text",
 			text: JSON.stringify(result, null, 2)
 		}] };
 	});
-	registerTool(server, apiClient, "amba_webhooks_get", "Describe a single webhook subscription by id. Returns event_name, target_url, status, attempt metadata, and timestamps (no secret).", {
-		project_id: z.string().describe("The project ID"),
-		subscription_id: z.string().describe("The subscription UUID")
-	}, async ({ project_id, subscription_id }, { client }) => {
-		const result = await client.get(`/projects/${project_id}/webhooks/subscriptions/${subscription_id}`);
+	registerTool(server, apiClient, "amba_orgs_get", "Get an organization by id, including its child-org and project counts and your effective role.", { org_id: z.string().describe("The org UUID") }, async ({ org_id }, { client }) => {
+		const result = await client.get(`/orgs/${org_id}`);
 		return { content: [{
 			type: "text",
 			text: JSON.stringify(result, null, 2)
 		}] };
 	});
-	registerTool(server, apiClient, "amba_webhooks_update", "Update a webhook subscription. Any of event_name, target_url, or status may be changed; supply at least one. status accepts only \"active\" or \"disabled\" — \"degraded\" is reserved for the automatic failure circuit breaker and cannot be set manually.", {
-		project_id: z.string().describe("The project ID"),
-		subscription_id: z.string().describe("The subscription UUID"),
-		event_name: z.string().optional().describe("New event name. Must match ^[a-z][a-z0-9_.-]{0,127}$ (case-insensitive)."),
-		target_url: z.string().optional().describe("New HTTPS endpoint. http:// allowed only for localhost."),
-		status: z.enum(["active", "disabled"]).optional().describe("Enable or disable delivery. \"degraded\" cannot be set manually.")
-	}, async ({ project_id, subscription_id, event_name, target_url, status }, { client }) => {
+	registerTool(server, apiClient, "amba_orgs_update", "Update an organization: name, slug, or payment_source. Flipping payment_source to \"self\" is the first step of graduating a child org to bill directly.", {
+		org_id: z.string().describe("The org UUID"),
+		name: z.string().optional().describe("New name"),
+		slug: z.string().optional().describe("New slug"),
+		payment_source: z.enum(["self", "parent"]).optional().describe("Billing source toggle")
+	}, async ({ org_id, name, slug, payment_source }, { client }) => {
 		const body = {};
-		if (event_name !== void 0) body.event_name = event_name;
-		if (target_url !== void 0) body.target_url = target_url;
-		if (status !== void 0) body.status = status;
-		const result = await client.patch(`/projects/${project_id}/webhooks/subscriptions/${subscription_id}`, body);
+		if (name !== void 0) body["name"] = name;
+		if (slug !== void 0) body["slug"] = slug;
+		if (payment_source !== void 0) body["payment_source"] = payment_source;
+		const result = await client.patch(`/orgs/${org_id}`, body);
 		return { content: [{
 			type: "text",
 			text: JSON.stringify(result, null, 2)
 		}] };
 	});
-	registerTool(server, apiClient, "amba_webhooks_delete", "Delete a webhook subscription. No further events are delivered to its target_url after this.", {
-		project_id: z.string().describe("The project ID"),
-		subscription_id: z.string().describe("The subscription UUID")
-	}, async ({ project_id, subscription_id }, { client }) => {
-		const result = await client.delete(`/projects/${project_id}/webhooks/subscriptions/${subscription_id}`);
+	registerTool(server, apiClient, "amba_orgs_invite_member", "Invite a developer to an organization by email. Returns an invite URL the recipient accepts to join with the given role.", {
+		org_id: z.string().describe("The org UUID"),
+		email: z.string().describe("Invitee email"),
+		role: z.enum([
+			"admin",
+			"member",
+			"viewer"
+		]).optional().describe("Role to grant on accept (default member)"),
+		expires_in_days: z.number().int().optional().describe("Invite expiry in days (1–30, default 7)")
+	}, async ({ org_id, email, role, expires_in_days }, { client }) => {
+		const body = { email };
+		if (role !== void 0) body["role"] = role;
+		if (expires_in_days !== void 0) body["expires_in_days"] = expires_in_days;
+		const result = await client.post(`/orgs/${org_id}/invites`, body);
 		return { content: [{
 			type: "text",
 			text: JSON.stringify(result, null, 2)
 		}] };
 	});
-	registerTool(server, apiClient, "amba_webhooks_rotate_secret", "Rotate the HMAC signing secret for a subscription. The new secret is returned ONCE — update your receiver config with it. To avoid dropped deliveries, have your receiver accept both the old and new secret for a brief overlap window before retiring the old one.", {
-		project_id: z.string().describe("The project ID"),
-		subscription_id: z.string().describe("The subscription UUID")
-	}, async ({ project_id, subscription_id }, { client }) => {
-		const result = await client.post(`/projects/${project_id}/webhooks/subscriptions/${subscription_id}/rotate-secret`);
+	registerTool(server, apiClient, "amba_orgs_transfer_owner", "Transfer ownership of an organization to another developer (who must already be reachable). Optionally remove the previous owner instead of demoting them to admin.", {
+		org_id: z.string().describe("The org UUID"),
+		new_owner_developer_id: z.string().describe("Developer UUID of the new owner"),
+		remove_previous_owner: z.boolean().optional().describe("If true, remove the previous owner entirely instead of demoting to admin")
+	}, async ({ org_id, new_owner_developer_id, remove_previous_owner }, { client }) => {
+		const body = { new_owner_developer_id };
+		if (remove_previous_owner !== void 0) body["remove_previous_owner"] = remove_previous_owner;
+		const result = await client.post(`/orgs/${org_id}/transfer-ownership`, body);
 		return { content: [{
 			type: "text",
 			text: JSON.stringify(result, null, 2)
 		}] };
 	});
-	registerTool(server, apiClient, "amba_webhooks_test", "Send a synthetic test delivery to a subscription to verify receiver setup. The test payload is tagged so it does not affect the failure circuit breaker or pollute your real event history. Returns a workflow id; poll amba_webhooks_deliveries_list shortly after for the result. Fails with 409 if the subscription is disabled.", {
-		project_id: z.string().describe("The project ID"),
-		subscription_id: z.string().describe("The subscription UUID")
-	}, async ({ project_id, subscription_id }, { client }) => {
-		const result = await client.post(`/projects/${project_id}/webhooks/subscriptions/${subscription_id}/test`);
+	registerTool(server, apiClient, "amba_provision_app", "App factory: atomically create a child org + a project under it and return the project keys. IDEMPOTENT by external_ref — a retry with the same (parent_org_id, external_ref) returns the same org/project (with keys_already_issued=true, since plaintext keys are shown only once). Store the keys from the first response.", {
+		parent_org_id: z.string().describe("Parent org UUID to create the child under"),
+		external_ref: z.string().describe("Stable per-app key for idempotency (e.g. your customer/app id)"),
+		org_name: z.string().optional().describe("Child org display name (defaults to external_ref)"),
+		project_name: z.string().optional().describe("Project display name (defaults to org_name)"),
+		bundle_id: z.string().optional().describe("Apple bundle id / Sign in with Apple audience"),
+		google_oauth_client_id: z.string().optional().describe("Google Sign In audience client id"),
+		platform: z.enum([
+			"ios",
+			"android",
+			"all"
+		]).optional().describe("Target platform (default all)"),
+		billing_mode: z.enum(["self", "parent"]).optional().describe("Child org payment_source: \"parent\" (default — bill the parent) or \"self\"")
+	}, async (args, { client }) => {
+		const body = {
+			parent_org_id: args.parent_org_id,
+			external_ref: args.external_ref
+		};
+		for (const k of [
+			"org_name",
+			"project_name",
+			"bundle_id",
+			"google_oauth_client_id",
+			"platform",
+			"billing_mode"
+		]) if (args[k] !== void 0) body[k] = args[k];
+		const result = await client.post("/provision", body);
 		return { content: [{
 			type: "text",
 			text: JSON.stringify(result, null, 2)
 		}] };
 	});
-	registerTool(server, apiClient, "amba_webhooks_deliveries_list", "List recent webhook delivery attempts (most recent first). Optionally filter by subscription_id and/or status. status is \"pending\", \"delivered\", \"failed\", or \"dlq\" (dead-lettered after exhausting retries). Default page size 50, max 200.", {
-		project_id: z.string().describe("The project ID"),
-		subscription_id: z.string().optional().describe("Filter to deliveries for a single subscription UUID."),
-		status: z.enum([
-			"pending",
-			"delivered",
-			"failed",
-			"dlq"
-		]).optional().describe("Filter by delivery status."),
-		limit: z.number().optional().describe("Page size (default 50, max 200).")
-	}, async ({ project_id, subscription_id, status, limit }, { client }) => {
-		const query = {};
-		if (subscription_id !== void 0) query.subscription_id = subscription_id;
-		if (status !== void 0) query.status = status;
-		if (limit !== void 0) query.limit = String(limit);
-		const result = await client.get(`/projects/${project_id}/webhooks/deliveries`, query);
+}
+//#endregion
+//#region src/tools/service-accounts.ts
+/**
+* Service-account lifecycle tools for Fork C delegated operator tokens.
+*
+* These tools intentionally cover only SA lifecycle. Delegated token minting is
+* an HTTP backend-to-backend call made by the partner app with the `amb_dsvc_`
+* secret; it is not exposed as an MCP tool.
+*/
+function registerTools$4(server, apiClient) {
+	registerTool(server, apiClient, "amba_service_accounts_create", "Create a scoped service account under an organization. Returns the amb_dsvc_ secret once; store it in the partner backend.", {
+		org_id: z.string().describe("Organization UUID that roots the service-account subtree"),
+		name: z.string().describe("Human-readable service account name"),
+		max_role: z.enum([
+			"owner",
+			"admin",
+			"member",
+			"viewer"
+		]).describe("Maximum role this service account may delegate"),
+		acting_developer_id: z.string().optional().describe("Optional developer UUID stamped as ownership lineage for delegated provisioning. Must be owner/admin on the org.")
+	}, async ({ org_id, name, max_role, acting_developer_id }, { client }) => {
+		const body = {
+			name,
+			max_role
+		};
+		if (acting_developer_id !== void 0) body["acting_developer_id"] = acting_developer_id;
+		const result = await client.post(`/orgs/${org_id}/service-accounts`, body);
 		return { content: [{
 			type: "text",
 			text: JSON.stringify(result, null, 2)
 		}] };
 	});
-	registerTool(server, apiClient, "amba_webhooks_deliveries_get", "Describe a single webhook delivery by id, including the full attempt log, attempt count, and last error.", {
-		project_id: z.string().describe("The project ID"),
-		delivery_id: z.string().describe("The delivery UUID")
-	}, async ({ project_id, delivery_id }, { client }) => {
-		const result = await client.get(`/projects/${project_id}/webhooks/deliveries/${delivery_id}`);
+	registerTool(server, apiClient, "amba_service_accounts_list", "List service accounts for an organization. Secrets are redacted; only prefix/last-4 and lifecycle metadata are returned.", { org_id: z.string().describe("Organization UUID") }, async ({ org_id }, { client }) => {
+		const result = await client.get(`/orgs/${org_id}/service-accounts`);
 		return { content: [{
 			type: "text",
 			text: JSON.stringify(result, null, 2)
 		}] };
 	});
-	registerTool(server, apiClient, "amba_webhooks_deliveries_replay", "Re-enqueue a terminated (failed or dead-lettered) delivery, rebuilding the original payload from the source event. The original idempotency key is preserved so receiver-side dedup treats it as a re-delivery, not a new event. Returns 409 if the delivery is still pending, or 410 if the source event has been purged.", {
-		project_id: z.string().describe("The project ID"),
-		delivery_id: z.string().describe("The delivery UUID to replay")
-	}, async ({ project_id, delivery_id }, { client }) => {
-		const result = await client.post(`/projects/${project_id}/webhooks/deliveries/${delivery_id}/replay`);
+	registerTool(server, apiClient, "amba_service_accounts_revoke", "Soft-revoke a service account. Its delegated tokens become invalid after the auth cache TTL.", { service_account_id: z.string().describe("Service account UUID") }, async ({ service_account_id }, { client }) => {
+		const result = await client.post(`/service-accounts/${service_account_id}/revoke`);
 		return { content: [{
 			type: "text",
 			text: JSON.stringify(result, null, 2)
@@ -6984,24 +7288,490 @@ function registerTools$1(server, apiClient) {
 	});
 }
 //#endregion
-//#region src/tools/email.ts
-function registerTools(server, apiClient) {
-	registerTool(server, apiClient, "amba_email_templates_create", "Create or update a transactional email template (upsert keyed by name — re-creating an existing name overwrites it). Templates are referenced by name when sending. Subject and html_body are required; text_body is an optional plain-text fallback. name must match ^[a-z][a-z0-9_]*$.", {
-		project_id: z.string().describe("The project ID"),
-		name: z.string().describe("Template name. Must match ^[a-z][a-z0-9_]*$."),
-		subject: z.string().describe("Email subject line. Supports template variables."),
-		html_body: z.string().describe("HTML body. Supports template variables."),
-		text_body: z.string().nullable().optional().describe("Optional plain-text fallback body. Pass null to leave unset.")
-	}, async ({ project_id, name, subject, html_body, text_body }, { client }) => {
-		const body = {
-			name,
-			subject,
-			html_body
-		};
-		if (text_body !== void 0) body.text_body = text_body;
-		const result = await client.post(`/projects/${project_id}/email/templates`, body);
-		return { content: [{
-			type: "text",
+//#region src/tools/affiliate.ts
+/**
+* Affiliate Programs tools (migration 052). Two personas, structurally scoped:
+*   - `amba_affiliate_*` — the program owner (admin); operates over the whole
+*     program. PAT must manage the program's owner org.
+*   - `amba_affiliate_my_*` — the affiliate (self-service); derives the
+*     affiliate from the PAT's own org(s) and takes NO other-affiliate id, so
+*     an affiliate cannot read a peer's data.
+* Zero-to-enrolled bootstrap is `amba_affiliate_signup` (public, in auth.ts).
+*/
+function registerTools$3(server, apiClient) {
+	registerTool(server, apiClient, "amba_affiliate_programs_create", "Create an affiliate program owned by an org. commission is a JSON tagged-union: {\"type\":\"percentage\",\"bps\":2000} | {\"type\":\"flat\",\"amount_cents\":5000} | {\"type\":\"recurring\",\"bps\":2000,\"max_cycles\":12} | {\"type\":\"tiered\",\"bps\":1000,\"tiers\":[{\"min_conversions\":10,\"bps\":2000}]}. For multi-level programs add a \"multi_level\":[{\"level\":1,\"bps\":500}] ladder and set multi_level_enabled.", {
+		owner_organization_id: z.string().describe("Org that owns the program"),
+		name: z.string().describe("Program name"),
+		commission: z.record(z.any()).describe("Commission model (tagged-union JSON)"),
+		conversion_kind: z.enum([
+			"event",
+			"payment",
+			"entitlement"
+		]).optional().describe("Which qualifying signal counts as a conversion (default event)"),
+		conversion_event_name: z.string().optional().describe("Tenant event name that counts as a conversion (for conversion_kind=event)"),
+		conversion_entitlement_id: z.string().optional().describe("Entitlement id that counts (for conversion_kind=entitlement)"),
+		attribution_model: z.enum(["first_touch", "last_touch"]).optional().describe("Which touch gets the credit (default last_touch)"),
+		attribution_window_days: z.number().int().optional().describe("Days a touch remains attributable (0–365, default 30)"),
+		allow_self_referral: z.boolean().optional().describe("Allow the owner org to enroll as its own affiliate (default false)"),
+		multi_level_enabled: z.boolean().optional().describe("Pay upline overrides per the commission \"multi_level\" ladder (default false)"),
+		currency: z.string().optional().describe("ISO currency (default usd)"),
+		payout_schedule: z.enum([
+			"manual",
+			"weekly",
+			"monthly"
+		]).optional(),
+		payout_threshold_cents: z.number().int().optional(),
+		hold_period_days: z.number().int().optional().describe("Refund-window holdback before commissions become payable"),
+		platform_fee_bps: z.number().int().optional().describe("Amba's cut on payouts (basis points)"),
+		approval_mode: z.enum(["auto", "manual"]).optional(),
+		funding_source: z.enum(["split_at_source", "external"]).optional().describe("Where commission money sources from (split_at_source default | external). Recorded today; the transfer mechanism is gated.")
+	}, async (args, { client }) => {
+		const result = await client.post("/affiliate/programs", args);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_programs_list", "List affiliate programs owned by orgs you can access.", {}, async (_, { client }) => {
+		const result = await client.get("/affiliate/programs");
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_programs_get", "Get an affiliate program by id.", { program_id: z.string() }, async ({ program_id }, { client }) => {
+		const result = await client.get(`/affiliate/programs/${program_id}`);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_programs_update", "Update an affiliate program (status, payout config, fee, approval mode, conversion definition, attribution, multi-level). Set status=\"active\" to launch; set multi_level_enabled=true to start paying upline overrides.", {
+		program_id: z.string(),
+		status: z.enum([
+			"draft",
+			"active",
+			"paused",
+			"archived"
+		]).optional(),
+		payout_threshold_cents: z.number().int().optional(),
+		hold_period_days: z.number().int().optional(),
+		platform_fee_bps: z.number().int().optional(),
+		approval_mode: z.enum(["auto", "manual"]).optional(),
+		funding_source: z.enum(["split_at_source", "external"]).optional(),
+		payout_schedule: z.enum([
+			"manual",
+			"weekly",
+			"monthly"
+		]).optional(),
+		name: z.string().optional(),
+		conversion_kind: z.enum([
+			"event",
+			"payment",
+			"entitlement"
+		]).optional(),
+		conversion_event_name: z.string().nullable().optional(),
+		conversion_entitlement_id: z.string().nullable().optional(),
+		attribution_model: z.enum(["first_touch", "last_touch"]).optional(),
+		attribution_window_days: z.number().int().optional(),
+		allow_self_referral: z.boolean().optional(),
+		multi_level_enabled: z.boolean().optional()
+	}, async ({ program_id, ...rest }, { client }) => {
+		const result = await client.patch(`/affiliate/programs/${program_id}`, rest);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_invite", "Enroll an affiliate. Pass affiliate_org_id to enroll an existing Amba org directly, or email to get guidance for the recipient to amba_affiliate_signup first. For multi-level programs, pass parent_enrollment_id to place the new affiliate under a sponsor (their upline).", {
+		program_id: z.string(),
+		affiliate_org_id: z.string().optional().describe("Existing affiliate org UUID to enroll"),
+		email: z.string().optional().describe("Email of an affiliate who has not yet joined Amba"),
+		parent_enrollment_id: z.string().optional().describe("Sponsor/upline enrollment id in this program (multi-level placement)")
+	}, async ({ program_id, affiliate_org_id, email, parent_enrollment_id }, { client }) => {
+		const body = {};
+		if (affiliate_org_id !== void 0) body["affiliate_org_id"] = affiliate_org_id;
+		if (email !== void 0) body["email"] = email;
+		if (parent_enrollment_id !== void 0) body["parent_enrollment_id"] = parent_enrollment_id;
+		const result = await client.post(`/affiliate/programs/${program_id}/invite`, body);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_affiliates_list", "List a program’s affiliates with their conversion + commission totals.", { program_id: z.string() }, async ({ program_id }, { client }) => {
+		const result = await client.get(`/affiliate/programs/${program_id}/affiliates`);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_affiliate_approve", "Approve (activate) a pending affiliate enrollment.", {
+		program_id: z.string(),
+		enrollment_id: z.string()
+	}, async ({ program_id, enrollment_id }, { client }) => {
+		const result = await client.post(`/affiliate/programs/${program_id}/affiliates/${enrollment_id}/approve`, {});
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_affiliate_ban", "Ban an affiliate from a program (links die; pending conversions voided).", {
+		program_id: z.string(),
+		enrollment_id: z.string()
+	}, async ({ program_id, enrollment_id }, { client }) => {
+		const result = await client.post(`/affiliate/programs/${program_id}/affiliates/${enrollment_id}/ban`, {});
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_affiliate_pause", "Pause an affiliate enrollment (their links stop earning; reversible via approve).", {
+		program_id: z.string(),
+		enrollment_id: z.string()
+	}, async ({ program_id, enrollment_id }, { client }) => {
+		const result = await client.post(`/affiliate/programs/${program_id}/affiliates/${enrollment_id}/pause`, {});
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_affiliates_get", "Get one affiliate enrollment with its codes, conversions, and commission totals.", {
+		program_id: z.string(),
+		enrollment_id: z.string()
+	}, async ({ program_id, enrollment_id }, { client }) => {
+		const result = await client.get(`/affiliate/programs/${program_id}/affiliates/${enrollment_id}`);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_conversions_list", "List conversions for a program (optionally filter by status).", {
+		program_id: z.string(),
+		status: z.enum([
+			"pending",
+			"approved",
+			"rejected",
+			"clawed_back"
+		]).optional()
+	}, async ({ program_id, status }, { client }) => {
+		const qs = status ? `?status=${status}` : "";
+		const result = await client.get(`/affiliate/programs/${program_id}/conversions${qs}`);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_conversion_approve", "Approve a pending conversion so it accrues commission.", {
+		program_id: z.string(),
+		conversion_id: z.string()
+	}, async ({ program_id, conversion_id }, { client }) => {
+		const result = await client.post(`/affiliate/programs/${program_id}/conversions/${conversion_id}/approve`, {});
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_conversion_reject", "Reject a pending conversion so it never accrues commission.", {
+		program_id: z.string(),
+		conversion_id: z.string()
+	}, async ({ program_id, conversion_id }, { client }) => {
+		const result = await client.post(`/affiliate/programs/${program_id}/conversions/${conversion_id}/reject`, {});
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_conversion_clawback", "Claw back an approved/paid conversion (the underlying sale refunded or charged back). Pre-payout commissions are reversed; already-paid commissions become negative carry-forward netted against the affiliate’s next payout.", {
+		program_id: z.string(),
+		conversion_id: z.string(),
+		reason: z.string().optional().describe("Why (e.g. refund, chargeback). Default \"refund\".")
+	}, async ({ program_id, conversion_id, reason }, { client }) => {
+		const body = {};
+		if (reason !== void 0) body["reason"] = reason;
+		const result = await client.post(`/affiliate/programs/${program_id}/conversions/${conversion_id}/clawback`, body);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_analytics_get", "Program-level analytics: conversion + commission totals and an affiliate leaderboard.", { program_id: z.string() }, async ({ program_id }, { client }) => {
+		const result = await client.get(`/affiliate/programs/${program_id}/analytics`);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_leaderboard_get", "Affiliate leaderboard for a program: top affiliates by commission, with clicks + EPC.", {
+		program_id: z.string(),
+		limit: z.number().int().optional()
+	}, async ({ program_id, limit }, { client }) => {
+		const qs = limit !== void 0 ? `?limit=${limit}` : "";
+		const result = await client.get(`/affiliate/programs/${program_id}/leaderboard${qs}`);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_payouts_list", "Settlement (payout) history for a program’s affiliates: net amount, period, transfer id, status.", { program_id: z.string() }, async ({ program_id }, { client }) => {
+		const result = await client.get(`/affiliate/programs/${program_id}/payouts`);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_payout_run", "Run payouts for a program: pay each affiliate org their payable commissions over the threshold via Stripe Connect. Gated by ORG_PAYOUTS_LIVE (money movement).", { program_id: z.string() }, async ({ program_id }, { client }) => {
+		const result = await client.post(`/affiliate/programs/${program_id}/payouts`, {});
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_my_programs_list", "List the affiliate programs your org(s) are enrolled in.", {}, async (_, { client }) => {
+		const result = await client.get("/affiliate-me/programs");
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_my_invites_list", "List affiliate-program invitations pending for your org(s).", {}, async (_, { client }) => {
+		const result = await client.get("/affiliate-me/invites");
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_my_invite_accept", "Accept an affiliate-program invitation addressed to your org (activates the enrollment and returns your referral code).", { enrollment_id: z.string() }, async ({ enrollment_id }, { client }) => {
+		const result = await client.post(`/affiliate-me/invites/${enrollment_id}/accept`, {});
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_my_referral_generate", "Mint a FRESH referral code for a program you are enrolled in (rotates/replaces your current active code).", { program_id: z.string() }, async ({ program_id }, { client }) => {
+		const result = await client.post(`/affiliate-me/programs/${program_id}/referral`, {});
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_my_conversions_list", "List conversions across your affiliate enrollments (optionally filter by status).", { status: z.enum([
+		"pending",
+		"approved",
+		"rejected",
+		"clawed_back"
+	]).optional() }, async ({ status }, { client }) => {
+		const qs = status ? `?status=${status}` : "";
+		const result = await client.get(`/affiliate-me/conversions${qs}`);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_my_payout_request", "Check what one of your orgs is owed and whether its payout account is ready. Does NOT move money — owners settle payable commissions on the program schedule; this surfaces the balance + readiness.", { org_id: z.string() }, async ({ org_id }, { client }) => {
+		const result = await client.post("/affiliate-me/payout-request", { org_id });
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_my_referral_get", "Get your referral code(s) / link(s) for a program you are enrolled in.", { program_id: z.string() }, async ({ program_id }, { client }) => {
+		const result = await client.get(`/affiliate-me/programs/${program_id}/referral`);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_my_stats_get", "Your affiliate stats across all enrollments: conversions, earnings, pending vs paid.", {}, async (_, { client }) => {
+		const result = await client.get("/affiliate-me/stats");
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_my_balance_get", "Your available (unpaid) and lifetime-paid commission balance, per currency.", {}, async (_, { client }) => {
+		const result = await client.get("/affiliate-me/balance");
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_my_payouts_list", "Your payout/settlement history.", {}, async (_, { client }) => {
+		const result = await client.get("/affiliate-me/payouts");
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_my_payout_create", "Create a Stripe Connect payout account for an org you own (so you can receive commissions).", {
+		org_id: z.string(),
+		country: z.string().optional().describe("2-letter country (default US)")
+	}, async ({ org_id, country }, { client }) => {
+		const body = { org_id };
+		if (country !== void 0) body["country"] = country;
+		const result = await client.post("/affiliate-me/payout-account", body);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_my_payout_onboarding", "Get a hosted Stripe onboarding URL to finish setting up an org’s payout account. Surface the URL to the user as a copy box.", { org_id: z.string() }, async ({ org_id }, { client }) => {
+		const result = await client.post("/affiliate-me/payout-account/link", { org_id });
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_affiliate_my_payout_status", "Check whether an org’s payout account is set up.", { org_id: z.string() }, async ({ org_id }, { client }) => {
+		const result = await client.get(`/affiliate-me/payout-account?org_id=${org_id}`);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+}
+//#endregion
+//#region src/tools/webhooks.ts
+function registerTools$2(server, apiClient) {
+	registerTool(server, apiClient, "amba_webhooks_create", "Register an outbound webhook subscription. Amba sends an HMAC-signed POST to target_url every time an event named event_name fires. The signing secret is returned ONCE in this response — copy it into your receiver config; later reads never include it. target_url must be https:// (http:// is allowed only for localhost during development).", {
+		project_id: z.string().describe("The project ID"),
+		event_name: z.string().describe("Event name to subscribe to. Must match ^[a-z][a-z0-9_.-]{0,127}$ (case-insensitive)."),
+		target_url: z.string().describe("HTTPS endpoint that receives the signed POST. http:// allowed only for localhost.")
+	}, async ({ project_id, event_name, target_url }, { client }) => {
+		const result = await client.post(`/projects/${project_id}/webhooks/subscriptions`, {
+			event_name,
+			target_url
+		});
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_webhooks_list", "List all webhook subscriptions for a project (most recent first). Secrets are never included — only id, event_name, target_url, status, and timestamps. status is \"active\", \"degraded\" (the delivery circuit breaker tripped on repeated failures), or \"disabled\".", { project_id: z.string().describe("The project ID") }, async ({ project_id }, { client }) => {
+		const result = await client.get(`/projects/${project_id}/webhooks/subscriptions`);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_webhooks_get", "Describe a single webhook subscription by id. Returns event_name, target_url, status, attempt metadata, and timestamps (no secret).", {
+		project_id: z.string().describe("The project ID"),
+		subscription_id: z.string().describe("The subscription UUID")
+	}, async ({ project_id, subscription_id }, { client }) => {
+		const result = await client.get(`/projects/${project_id}/webhooks/subscriptions/${subscription_id}`);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_webhooks_update", "Update a webhook subscription. Any of event_name, target_url, or status may be changed; supply at least one. status accepts only \"active\" or \"disabled\" — \"degraded\" is reserved for the automatic failure circuit breaker and cannot be set manually.", {
+		project_id: z.string().describe("The project ID"),
+		subscription_id: z.string().describe("The subscription UUID"),
+		event_name: z.string().optional().describe("New event name. Must match ^[a-z][a-z0-9_.-]{0,127}$ (case-insensitive)."),
+		target_url: z.string().optional().describe("New HTTPS endpoint. http:// allowed only for localhost."),
+		status: z.enum(["active", "disabled"]).optional().describe("Enable or disable delivery. \"degraded\" cannot be set manually.")
+	}, async ({ project_id, subscription_id, event_name, target_url, status }, { client }) => {
+		const body = {};
+		if (event_name !== void 0) body.event_name = event_name;
+		if (target_url !== void 0) body.target_url = target_url;
+		if (status !== void 0) body.status = status;
+		const result = await client.patch(`/projects/${project_id}/webhooks/subscriptions/${subscription_id}`, body);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_webhooks_delete", "Delete a webhook subscription. No further events are delivered to its target_url after this.", {
+		project_id: z.string().describe("The project ID"),
+		subscription_id: z.string().describe("The subscription UUID")
+	}, async ({ project_id, subscription_id }, { client }) => {
+		const result = await client.delete(`/projects/${project_id}/webhooks/subscriptions/${subscription_id}`);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_webhooks_rotate_secret", "Rotate the HMAC signing secret for a subscription. The new secret is returned ONCE — update your receiver config with it. To avoid dropped deliveries, have your receiver accept both the old and new secret for a brief overlap window before retiring the old one.", {
+		project_id: z.string().describe("The project ID"),
+		subscription_id: z.string().describe("The subscription UUID")
+	}, async ({ project_id, subscription_id }, { client }) => {
+		const result = await client.post(`/projects/${project_id}/webhooks/subscriptions/${subscription_id}/rotate-secret`);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_webhooks_test", "Send a synthetic test delivery to a subscription to verify receiver setup. The test payload is tagged so it does not affect the failure circuit breaker or pollute your real event history. Returns a workflow id; poll amba_webhooks_deliveries_list shortly after for the result. Fails with 409 if the subscription is disabled.", {
+		project_id: z.string().describe("The project ID"),
+		subscription_id: z.string().describe("The subscription UUID")
+	}, async ({ project_id, subscription_id }, { client }) => {
+		const result = await client.post(`/projects/${project_id}/webhooks/subscriptions/${subscription_id}/test`);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_webhooks_deliveries_list", "List recent webhook delivery attempts (most recent first). Optionally filter by subscription_id and/or status. status is \"pending\", \"delivered\", \"failed\", or \"dlq\" (dead-lettered after exhausting retries). Default page size 50, max 200.", {
+		project_id: z.string().describe("The project ID"),
+		subscription_id: z.string().optional().describe("Filter to deliveries for a single subscription UUID."),
+		status: z.enum([
+			"pending",
+			"delivered",
+			"failed",
+			"dlq"
+		]).optional().describe("Filter by delivery status."),
+		limit: z.number().optional().describe("Page size (default 50, max 200).")
+	}, async ({ project_id, subscription_id, status, limit }, { client }) => {
+		const query = {};
+		if (subscription_id !== void 0) query.subscription_id = subscription_id;
+		if (status !== void 0) query.status = status;
+		if (limit !== void 0) query.limit = String(limit);
+		const result = await client.get(`/projects/${project_id}/webhooks/deliveries`, query);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_webhooks_deliveries_get", "Describe a single webhook delivery by id, including the full attempt log, attempt count, and last error.", {
+		project_id: z.string().describe("The project ID"),
+		delivery_id: z.string().describe("The delivery UUID")
+	}, async ({ project_id, delivery_id }, { client }) => {
+		const result = await client.get(`/projects/${project_id}/webhooks/deliveries/${delivery_id}`);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_webhooks_deliveries_replay", "Re-enqueue a terminated (failed or dead-lettered) delivery, rebuilding the original payload from the source event. The original idempotency key is preserved so receiver-side dedup treats it as a re-delivery, not a new event. Returns 409 if the delivery is still pending, or 410 if the source event has been purged.", {
+		project_id: z.string().describe("The project ID"),
+		delivery_id: z.string().describe("The delivery UUID to replay")
+	}, async ({ project_id, delivery_id }, { client }) => {
+		const result = await client.post(`/projects/${project_id}/webhooks/deliveries/${delivery_id}/replay`);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+}
+//#endregion
+//#region src/tools/email.ts
+function registerTools$1(server, apiClient) {
+	registerTool(server, apiClient, "amba_email_templates_create", "Create or update a transactional email template (upsert keyed by name — re-creating an existing name overwrites it). Templates are referenced by name when sending. Subject and html_body are required; text_body is an optional plain-text fallback. name must match ^[a-z][a-z0-9_]*$.", {
+		project_id: z.string().describe("The project ID"),
+		name: z.string().describe("Template name. Must match ^[a-z][a-z0-9_]*$."),
+		subject: z.string().describe("Email subject line. Supports template variables."),
+		html_body: z.string().describe("HTML body. Supports template variables."),
+		text_body: z.string().nullable().optional().describe("Optional plain-text fallback body. Pass null to leave unset.")
+	}, async ({ project_id, name, subject, html_body, text_body }, { client }) => {
+		const body = {
+			name,
+			subject,
+			html_body
+		};
+		if (text_body !== void 0) body.text_body = text_body;
+		const result = await client.post(`/projects/${project_id}/email/templates`, body);
+		return { content: [{
+			type: "text",
 			text: JSON.stringify(result, null, 2)
 		}] };
 	});
@@ -7149,6 +7919,51 @@ function registerTools(server, apiClient) {
 	});
 }
 //#endregion
+//#region src/tools/app-mcp.ts
+function registerTools(server, apiClient) {
+	registerTool(server, apiClient, "amba_app_mcp_get_config", "Read the configuration of this app's agent surface (the per-app MCP endpoint whose tools are the app's own collections and functions). Returns: enabled flag, hostname slug, auth_mode (which credential types may connect: all / client_only / developer_only), the exposure allowlist (which collections/functions are projected into agent tools — DEFAULT: none), and ready-to-use connection info (`connection.url` works today; `connection.hostname_url` appears once a slug is set, with a note on activation timing).", { project_id: z.string().describe("The project ID") }, async ({ project_id }, { client }) => {
+		const result = await client.get(`/projects/${project_id}/app-mcp/config`);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_app_mcp_update_config", "Update the app agent surface configuration. `enabled: false` turns the whole surface off (existing connections lose their tools on the next request). `slug` reserves a friendly hostname label for the surface (lowercase DNS label, globally unique — 409 SLUG_TAKEN on collision; null clears it). `auth_mode` restricts who may connect: \"all\" (default — developer tokens and app client keys), \"client_only\" (only the app's client keys + end-user sessions), or \"developer_only\". Provide at least one field.", {
+		project_id: z.string().describe("The project ID"),
+		enabled: z.boolean().optional().describe("Turn the agent surface on/off"),
+		slug: z.string().nullable().optional().describe("Hostname label (lowercase DNS label) or null to clear"),
+		auth_mode: z.enum([
+			"all",
+			"client_only",
+			"developer_only"
+		]).optional().describe("Which credential types may connect")
+	}, async ({ project_id, enabled, slug, auth_mode }, { client }) => {
+		const body = {};
+		if (enabled !== void 0) body.enabled = enabled;
+		if (slug !== void 0) body.slug = slug;
+		if (auth_mode !== void 0) body.auth_mode = auth_mode;
+		const result = await client.patch(`/projects/${project_id}/app-mcp/config`, body);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+	registerTool(server, apiClient, "amba_app_mcp_set_exposure", "Set which collections and deployed functions the app agent surface exposes as typed tools. EXPLICIT ALLOWLIST with full-set replace semantics per provided kind: `collections: [\"recipes\"]` makes recipes the ONLY exposed collection; an empty array hides everything of that kind; an omitted kind is left unchanged. Nothing is exposed by default — after creating a collection or deploying a function, call this to make it an agent tool. Functions additionally pick up the typed input schema they declared at deploy time (metadata `mcp.input_schema`).", {
+		project_id: z.string().describe("The project ID"),
+		collections: z.array(z.string()).optional().describe("Full replacement list of exposed collection names"),
+		functions: z.array(z.string()).optional().describe("Full replacement list of exposed function names")
+	}, async ({ project_id, collections, functions }, { client }) => {
+		const body = {};
+		if (collections !== void 0) body.collections = collections;
+		if (functions !== void 0) body.functions = functions;
+		const result = await client.put(`/projects/${project_id}/app-mcp/exposure`, body);
+		return { content: [{
+			type: "text",
+			text: JSON.stringify(result, null, 2)
+		}] };
+	});
+}
+//#endregion
 //#region src/resources/amba-setup-identity.ts
 /**
 * `amba://setup/identity` — per-surface playbook for end-user auth.
@@ -8435,32 +9250,33 @@ const AMBA_SETUP_SOCIAL_MIME = "text/markdown";
 * Companion to `AMBA_SETUP_GUIDE_MD`. Step 3 of the main playbook
 * tells the agent to fetch this resource when wiring infrastructure.
 *
-* Surface scope: collections (typed DB tables), functions
+* Surface scope: collections (relational Postgres tables), functions
 * (serverless), analytics, AI prompts, secrets, configs / feature
 * flags, third-party integrations, media (file storage + CDN),
 * sites (static asset hosting).
 *
 * Twin: `packages/cli/skill-bundle/references/infrastructure.md`.
-* Drift gate in `amba-setup.test.ts`. No vendor leakage (Postgres /
-* Temporal / R2 names scrubbed before exposing on the wire).
+* Drift gate in `amba-setup.test.ts`. Collections are named as relational
+* Postgres tables; the hosting supplier (Neon) and the rest of the infra
+* stack (Temporal / R2) stay scrubbed before exposing on the wire.
 */
 const AMBA_SETUP_INFRASTRUCTURE_MD = `# Infrastructure
 
-The plumbing that sits behind every other surface: custom database tables (Collections — schema-first, per-tenant), serverless functions (run server-side code without standing up a backend), analytics (events + sessions), AI prompts (managed LLM templates, callable from the SDK with per-tenant keys), secrets, runtime configs, feature flags, third-party integrations (RevenueCat / Superwall / Resend / Stripe / etc.), media (file storage + CDN), and sites (static asset hosting at \`*.app.amba.host\`).
+The plumbing that sits behind every other surface: relational Postgres tables (Collections — schema-first, per-tenant), serverless functions (run server-side code without standing up a backend), analytics (events + sessions), AI prompts (managed LLM templates, callable from the SDK with per-tenant keys), secrets, runtime configs, feature flags, third-party integrations (RevenueCat / Superwall / Stripe / push credentials), media (file storage + CDN), and sites (static asset hosting at \`*.app.amba.host\`).
 
 If gamification, economy, and social are the playable surface, **infrastructure is what you build a custom product on top of**. Anything that doesn't fit the canned surfaces lands here.
 
 ## MCP tools
 
-### Collections (typed tables)
+### Collections (relational Postgres tables)
 
-A collection is a schema-first table inside the project's isolated tenant database. You describe the columns, the server creates the table and any indexes. Rows are scoped to the signed-in \`app_user\` automatically (server-enforced auto row-level isolation) for SDK clients — admin tools bypass this.
+A collection is a relational Postgres table inside the project's isolated tenant database — typed columns, foreign keys, transactions, unique indexes, and vector search. You describe the columns, the server creates the table and any indexes. Rows are scoped to the signed-in \`app_user\` automatically (server-enforced auto row-level isolation) for SDK clients — admin tools bypass this.
 
 Admin tools authenticate the developer/agent (pass \`pat\` or send it as the inbound Bearer) and take \`project_id\`. Client tools authenticate an end-user and take \`api_key\` (+ \`session_token\`) — NOT \`project_id\` and NOT a \`pat\`. Every row tool names the collection with \`name\`, never \`collection\`.
 
 | Tool | Purpose | Example args |
 | --- | --- | --- |
-| \`amba_collections_create\` | Create a typed collection. Pass \`shared: true\` for developer-seeded GLOBAL content (question banks, lookup tables) so \`user_id\` is nullable. | \`{ project_id, name: "todos", columns: [{ name: "title", type: "text", nullable: false }, { name: "done", type: "boolean", nullable: false, default: false }, { name: "due_at", type: "timestamptz", nullable: true }], shared: false }\` |
+| \`amba_collections_create\` | Create a typed collection. Pass \`shared: true\` for developer-seeded GLOBAL content (question banks, lookup tables) so \`user_id\` is nullable. | \`{ project_id, name: "todos", columns: [{ name: "title", type: "text", nullable: false }, { name: "done", type: "boolean", nullable: false }, { name: "due_at", type: "timestamptz", nullable: true }], shared: false }\` |
 | \`amba_collections_list\` | List collections in this project. | \`{ project_id }\` |
 | \`amba_collections_get\` | Read one collection's schema. | \`{ project_id, name: "todos" }\` |
 | \`amba_collections_alter\` | Exactly ONE of: \`add_column\`, \`add_index\`, \`drop_column\`, or \`relax_user_id\` per call. \`relax_user_id: true\` converts an existing collection to shared (drops the \`user_id\` NOT NULL). | \`{ project_id, name: "todos", add_column: { name: "priority", type: "integer", nullable: true } }\` |
@@ -8477,7 +9293,7 @@ Admin tools authenticate the developer/agent (pass \`pat\` or send it as the inb
 | \`amba_client_find_rows\` | Filter / sort / paginate rows (SDK-shaped \`filter\`). | \`{ api_key, session_token, name: "todos", filter: {...}, order: ["created_at desc"], limit: 50 }\` |
 | \`amba_client_find_nearest_rows\` | Vector-similarity search (rows with a \`vector(<dim>)\` column). | \`{ api_key, session_token, name: "todos", column: "embedding", to_vector: [...], k: 10 }\` |
 
-Column types: \`text\`, \`integer\`, \`bigint\`, \`numeric\`, \`boolean\`, \`timestamptz\`, \`date\`, \`jsonb\`, \`uuid\`, \`vector(<dim>)\` (e.g. \`vector(1536)\` for OpenAI embeddings), plus array forms \`text[]\`, \`integer[]\`, \`bigint[]\`, \`numeric[]\`, \`boolean[]\`, \`uuid[]\`. Use \`integer\` (not \`int\`), \`numeric\` (not \`float\`/\`real\`/\`double\`), and \`jsonb\` (not \`json\`) — the validator rejects the aliases.
+Column types: \`text\`, \`integer\`, \`bigint\`, \`numeric\`, \`boolean\`, \`timestamptz\`, \`date\`, \`jsonb\`, \`uuid\`, \`vector\` (pass a separate \`dimension\` field, e.g. \`{ name: "embedding", type: "vector", dimension: 1536 }\` for OpenAI embeddings), plus array forms \`text[]\`, \`integer[]\`, \`bigint[]\`, \`numeric[]\`, \`boolean[]\`, \`uuid[]\`. Columns are NOT NULL unless \`nullable: true\`; column defaults are not supported (set values at insert time). Use \`integer\` (not \`int\`), \`numeric\` (not \`float\`/\`real\`/\`double\`), and \`jsonb\` (not \`json\`) — the validator rejects the aliases.
 
 ### Functions (serverless code)
 
@@ -8494,6 +9310,19 @@ Run user code in a sandbox triggered by HTTP, cron, or webhook. The function get
 | \`amba_functions_pause_schedule\` | Pause a scheduled trigger without deleting it. | \`{ project_id, function_id }\` |
 | \`amba_functions_resume_schedule\` | Resume. | \`{ project_id, function_id }\` |
 | \`amba_functions_trigger_schedule\` | Fire a scheduled function ad-hoc (testing). | \`{ project_id, function_id }\` |
+| \`amba_function_domains_attach\` | Attach one exact hostname to one function; returns DNS validation instructions. | \`{ project_id, name: "feed", hostname: "feeds.example.com" }\` |
+| \`amba_function_domains_list\` | List provider-neutral hostname, ownership, and certificate status. | \`{ project_id, name: "feed" }\` |
+| \`amba_function_domains_refresh\` | Re-poll DNS ownership and certificate state. | \`{ project_id, name: "feed", hostname: "feeds.example.com" }\` |
+| \`amba_function_domains_remove\` | Detach an exact function hostname. | \`{ project_id, name: "feed", hostname: "feeds.example.com" }\` |
+
+Function-domain routing preserves the complete incoming path and query string.
+It is exact-host only (no wildcard/path rewrite and no automatic \`www\` for a
+subdomain). Podcast/feed clients cannot attach an Amba API key, so their
+function must be deployed with \`public: true\` and validate any private token
+inside the handler. Effective-tier caps are free 1, pro 5, scale 20, and
+enterprise/comped 50; attach is limited to five attempts per project per hour.
+Unverified claims become eligible for reclaim after 24 hours, and routing
+resources are allocated only after ownership is active.
 
 ### AI prompts
 
@@ -8512,7 +9341,7 @@ Managed LLM templates: a stored prompt with provider + model + system message, i
 | \`amba_ai_prompts_list\` | List prompts. | \`{ project_id }\` |
 | \`amba_ai_prompts_get\` | Read one prompt. | \`{ project_id, name }\` |
 | \`amba_ai_prompts_update\` | Edit a prompt (replaces all fields; bumps version). | \`{ project_id, name, provider, model, system_prompt: "..." }\` |
-| \`amba_ai_prompts_invoke\` | Invoke a prompt server-side (admin testing). \`messages\` is a provider-shaped array. | \`{ project_id, name, messages: [{ role: "user", content: "..." }] }\` |
+| \`amba_ai_prompts_invoke\` | Invoke by name server-side (admin testing; works with \`client_invokable: false\`). Uses the named gateway path, so the prompt budget, rate limit, token cap, and spend attribution are enforced. | \`{ project_id, name, messages: [{ role: "user", content: "..." }] }\` |
 | \`amba_ai_prompts_delete\` | Delete. | \`{ project_id, name }\` |
 
 ### Analytics + events + sessions
@@ -8529,11 +9358,15 @@ Managed LLM templates: a stored prompt with provider + model + system message, i
 
 ### Secrets + configs + integrations
 
-Secrets here are **function-scoped** — they become environment bindings on your deployed functions. They are NOT where AI provider keys go (use \`amba_ai_providers_set\` for those — see AI prompts above).
+Secrets here become environment bindings on deployed functions. Omit \`function\`
+for a project-wide secret or pass it to scope the value to one function. Setting
+or rotating a secret queues an asynchronous update for already-deployed
+functions; later deployments reconcile the binding too. They are NOT where AI
+provider keys go (use \`amba_ai_providers_set\` for those — see AI prompts above).
 
 | Tool | Purpose | Example args |
 | --- | --- | --- |
-| \`amba_secrets_set\` | Set a function-scoped secret (encrypted at rest; bound on the next deploy). | \`{ project_id, name: "STRIPE_WEBHOOK_SECRET", value: "whsec_..." }\` |
+| \`amba_secrets_set\` | Set or rotate a function secret; omit \`function\` for project-wide scope or pass it for one function. Already-deployed functions receive it asynchronously. | \`{ project_id, name: "STRIPE_WEBHOOK_SECRET", value: "whsec_..." }\` |
 | \`amba_secrets_get\` | Read a secret (returns \`"<redacted>"\` unless explicitly requested). | \`{ project_id, name }\` |
 | \`amba_secrets_list\` | List secret names. | \`{ project_id }\` |
 | \`amba_secrets_delete\` | Delete. | \`{ project_id, name }\` |
@@ -8570,6 +9403,23 @@ Secrets here are **function-scoped** — they become environment bindings on you
 | \`amba_sites_remove_domain\` | Detach a domain. | \`{ project_id, site_id, domain }\` |
 | \`amba_sites_delete\` | Delete a site. | \`{ project_id, site_id }\` |
 
+### Purchased domains + email forwarding
+
+| Tool | Purpose | Example args |
+| --- | --- | --- |
+| \`amba_domains_search\` | Search available domains (free). | \`{ project_id, query: "myapp" }\` |
+| \`amba_domains_check\` | Check authoritative price + availability. | \`{ project_id, domains: ["myapp.com"] }\` |
+| \`amba_domains_purchase\` | Quote, then confirm, a domain purchase. | \`{ project_id, domain: "myapp.com", site: "marketing" }\` |
+| \`amba_domains_list\` | List purchased domains. | \`{ project_id }\` |
+| \`amba_domains_email_enable\` | Enable inbound routing when no MX conflict exists. | \`{ project_id, domain: "myapp.com" }\` |
+| \`amba_domains_email_destinations_add\` | Add a destination mailbox; returns action-required until verified. | \`{ project_id, domain: "myapp.com", email: "owner@example.net" }\` |
+| \`amba_domains_email_destinations_get\` | Poll destination verification. | \`{ project_id, domain: "myapp.com", destination_id }\` |
+| \`amba_domains_email_forwards_set\` | Create/update a literal forward. | \`{ project_id, domain: "myapp.com", source: "support", destination: "owner@example.net" }\` |
+| \`amba_domains_email_forwards_list\` | List literal forwards. | \`{ project_id, domain: "myapp.com" }\` |
+| \`amba_domains_email_forwards_delete\` | Delete a literal forward. | \`{ project_id, domain: "myapp.com", forward_id }\` |
+| \`amba_domains_email_catch_all_set\` | Enable/update/disable catch-all. | \`{ project_id, domain: "myapp.com", enabled: true, destination: "owner@example.net" }\` |
+| \`amba_domains_email_catch_all_get\` | Read catch-all state. | \`{ project_id, domain: "myapp.com" }\` |
+
 ## SDK init per stack
 
 \`Amba.configure(...)\` runs first. The infrastructure surfaces — collections, AI, config, flags, events — are SDK-side reads; the snippets below show what the client calls look like.
@@ -8710,15 +9560,13 @@ Batch.
 
 4. **Analytics:** which tracker do you want?
    - Only Amba's built-in events (recommended — already wired)
-   - Amba + Mixpanel / PostHog / Segment forwarding (configure via \`amba_integrations_configure\`)
+   - Amba + your own analytics pipeline (subscribe a webhook to project events via \`amba_webhooks_create\` and forward server-side)
    - None (rarely useful — events drive XP / achievements / streaks; disabling cripples gamification)
 
 5. **Third-party integrations to set up:**
    - [ ] RevenueCat (IAP / subscriptions on iOS + Android)
    - [ ] Superwall (paywall A/B)
-   - [ ] Resend (transactional email)
-   - [ ] Stripe (web payments / subscriptions)
-   - [ ] Mixpanel / PostHog / Segment (analytics forwarding)
+   - [ ] Stripe Billing (web subscriptions through the app's own Stripe account — provider \`stripe_billing\`)
    - [ ] OpenAI / Anthropic / Mistral / Gemini LLM keys (required for \`Amba.ai.*\` — set via \`amba_ai_providers_set\`, **not** \`amba_integrations_configure\`)
 
 6. **Feature flags:** seed any starter flags?
@@ -9066,6 +9914,7 @@ const TOOL_CATEGORY = {
 	amba_monetization_export: "economy",
 	amba_monetization_definitions_list: "economy",
 	amba_monetization_adopt: "economy",
+	amba_monetization_apply: "economy",
 	amba_entitlements_define: "economy",
 	amba_products_create: "economy",
 	amba_entitlements_map_product: "economy",
@@ -9213,6 +10062,48 @@ const TOOL_CATEGORY = {
 	amba_reprovision_project: "infrastructure",
 	amba_projects_get_provisioning_status: "infrastructure",
 	amba_get_provisioning_status: "infrastructure",
+	amba_orgs_create: "infrastructure",
+	amba_orgs_list: "infrastructure",
+	amba_orgs_get: "infrastructure",
+	amba_orgs_update: "infrastructure",
+	amba_orgs_invite_member: "infrastructure",
+	amba_orgs_transfer_owner: "infrastructure",
+	amba_provision_app: "infrastructure",
+	amba_service_accounts_create: "infrastructure",
+	amba_service_accounts_list: "infrastructure",
+	amba_service_accounts_revoke: "infrastructure",
+	amba_affiliate_signup: "economy",
+	amba_affiliate_programs_create: "economy",
+	amba_affiliate_programs_list: "economy",
+	amba_affiliate_programs_get: "economy",
+	amba_affiliate_programs_update: "economy",
+	amba_affiliate_invite: "economy",
+	amba_affiliate_affiliates_list: "economy",
+	amba_affiliate_affiliates_get: "economy",
+	amba_affiliate_affiliate_approve: "economy",
+	amba_affiliate_affiliate_pause: "economy",
+	amba_affiliate_affiliate_ban: "economy",
+	amba_affiliate_conversions_list: "economy",
+	amba_affiliate_conversion_approve: "economy",
+	amba_affiliate_conversion_reject: "economy",
+	amba_affiliate_conversion_clawback: "economy",
+	amba_affiliate_analytics_get: "economy",
+	amba_affiliate_leaderboard_get: "economy",
+	amba_affiliate_payouts_list: "economy",
+	amba_affiliate_payout_run: "economy",
+	amba_affiliate_my_programs_list: "economy",
+	amba_affiliate_my_referral_get: "economy",
+	amba_affiliate_my_referral_generate: "economy",
+	amba_affiliate_my_stats_get: "economy",
+	amba_affiliate_my_balance_get: "economy",
+	amba_affiliate_my_invites_list: "economy",
+	amba_affiliate_my_invite_accept: "economy",
+	amba_affiliate_my_conversions_list: "economy",
+	amba_affiliate_my_payouts_list: "economy",
+	amba_affiliate_my_payout_request: "economy",
+	amba_affiliate_my_payout_create: "economy",
+	amba_affiliate_my_payout_onboarding: "economy",
+	amba_affiliate_my_payout_status: "economy",
 	amba_collections_create: "infrastructure",
 	amba_create_collection: "infrastructure",
 	amba_collections_list: "infrastructure",
@@ -9258,6 +10149,10 @@ const TOOL_CATEGORY = {
 	amba_resume_function_schedule: "infrastructure",
 	amba_functions_trigger_schedule: "infrastructure",
 	amba_trigger_function_schedule: "infrastructure",
+	amba_function_domains_attach: "infrastructure",
+	amba_function_domains_list: "infrastructure",
+	amba_function_domains_refresh: "infrastructure",
+	amba_function_domains_remove: "infrastructure",
 	amba_sites_list: "infrastructure",
 	amba_list_sites: "infrastructure",
 	amba_sites_get: "infrastructure",
@@ -9268,6 +10163,8 @@ const TOOL_CATEGORY = {
 	amba_delete_site: "infrastructure",
 	amba_sites_add_domain: "infrastructure",
 	amba_add_site_domain: "infrastructure",
+	amba_sites_refresh_domain: "infrastructure",
+	amba_refresh_site_domain: "infrastructure",
 	amba_sites_remove_domain: "infrastructure",
 	amba_remove_site_domain: "infrastructure",
 	amba_sites_list_domains: "infrastructure",
@@ -9276,6 +10173,16 @@ const TOOL_CATEGORY = {
 	amba_domains_check: "infrastructure",
 	amba_domains_purchase: "infrastructure",
 	amba_domains_list: "infrastructure",
+	amba_domains_email_status: "infrastructure",
+	amba_domains_email_enable: "infrastructure",
+	amba_domains_email_destinations_add: "infrastructure",
+	amba_domains_email_destinations_list: "infrastructure",
+	amba_domains_email_destinations_get: "infrastructure",
+	amba_domains_email_forwards_set: "infrastructure",
+	amba_domains_email_forwards_list: "infrastructure",
+	amba_domains_email_forwards_delete: "infrastructure",
+	amba_domains_email_catch_all_get: "infrastructure",
+	amba_domains_email_catch_all_set: "infrastructure",
 	amba_operations_get: "infrastructure",
 	amba_operations_list: "infrastructure",
 	amba_media_upload: "infrastructure",
@@ -9343,8 +10250,11 @@ const TOOL_CATEGORY = {
 	amba_payments_account_status: "economy",
 	amba_payments_set_fee: "economy",
 	amba_payments_charge: "economy",
+	amba_payments_refund: "economy",
 	amba_payments_balance: "economy",
 	amba_payments_payouts: "economy",
+	amba_agent_checkout_enable: "economy",
+	amba_agent_checkout_capabilities: "economy",
 	amba_projects_invite_member: "infrastructure",
 	amba_projects_list_members: "infrastructure",
 	amba_projects_remove_member: "infrastructure",
@@ -9378,7 +10288,10 @@ const TOOL_CATEGORY = {
 	amba_remote_configs_create: "infrastructure",
 	amba_remote_configs_list: "infrastructure",
 	amba_remote_configs_update: "infrastructure",
-	amba_remote_configs_delete: "infrastructure"
+	amba_remote_configs_delete: "infrastructure",
+	amba_app_mcp_get_config: "infrastructure",
+	amba_app_mcp_update_config: "infrastructure",
+	amba_app_mcp_set_exposure: "infrastructure"
 };
 /**
 * Look up the canonical category for an MCP tool name. Accepts both
@@ -9585,9 +10498,10 @@ function mapCollectionSchema(schema, options = {}) {
 * column names, types, nullability, the access policy in plain words, and
 * a worked example per verb.
 *
-* Pure string builders — snapshot-friendly, no I/O. NO provider leakage:
-* "collection", "row", "column", "function" only — never the underlying
-* storage engine.
+* Pure string builders — snapshot-friendly, no I/O. Collections are named as
+* what they are — relational Postgres tables. The hosting supplier (Neon) and
+* the rest of the infra stack stay hidden: "collection", "row", "column",
+* and "function" are the customer vocabulary, never a supplier name.
 */
 /** A human-friendly type label for a column kind. */
 function labelForKind(kind) {
@@ -9711,10 +10625,11 @@ function describeCollectionTool(verb, ctx) {
 			`Example: { "select": [{ "fn": "count" }] }.`
 		].join(" ");
 		case "find_nearest": return [
-			`Vector similarity search over "${collection}" — returns the rows whose embedding is closest to your query vector.`,
+			`Vector similarity search over "${collection}" — returns the rows closest to your query, with a synthesized \`_distance\` column.`,
 			`This tool exists because "${collection}" has a vector column (${mapped.vectorColumns.join(", ")}).`,
+			`Pass \`to_text\` (the server computes the embedding) or a raw \`to_vector\`; optionally narrow with a typed \`where\`.`,
 			policy,
-			`Example: { "vector": [0.1, 0.2, …], "limit": 5 }.`
+			`Example: { "to_text": "cozy winter recipes", "k": 5 }.`
 		].join(" ");
 		default: return `Operate on the "${collection}" collection.`;
 	}
@@ -9723,29 +10638,45 @@ function describeCollectionTool(verb, ctx) {
 function describeListCollections(namespace) {
 	return [
 		`List every collection exposed by this app's agent surface (namespace "${namespace}").`,
-		`Each collection projects typed list/get/find/insert/update/delete/aggregate tools you can call directly —`,
-		`this tool is the index. Returns each collection's name and column summary.`
+		`Each collection is a relational Postgres table — typed columns, foreign keys, transactions, unique indexes, and vector search —`,
+		`projected into typed list/get/find/insert/update/delete/aggregate tools you can call directly.`,
+		`This tool is the index. Returns each collection's name and column summary.`
 	].join(" ");
 }
+/**
+* Generate the description string for a function tool. Honest-confidence
+* rule: a tool with a declared schema reads like a hand-built SDK call; a
+* tool WITHOUT one says so plainly instead of over-claiming.
+*/
+function describeFunctionTool(ctx) {
+	const parts = [];
+	if (ctx.declaredDescription) {
+		parts.push(ctx.declaredDescription.trim());
+		parts.push(`(Deployed function "${ctx.fn}" on this app.)`);
+	} else parts.push(`Invoke the deployed function "${ctx.fn}" on this app.`);
+	if (ctx.hasDeclaredSchema) parts.push("Arguments match the input schema the function declared at deploy time and are sent as the request body.");
+	else parts.push("This function declared no input schema — pass `body` (free-form JSON sent as the request body) and/or `query` (string key/value pairs appended to the URL). Consult the function author for the expected shape.");
+	parts.push("Runs with the same credential as this connection; the response status and body are returned as-is.");
+	return parts.join(" ");
+}
 /** Description for the `<ns>_whoami` meta tool. */
 function describeWhoami(namespace) {
 	return [`Report which app project this agent surface is connected to and the scope of the current credential`, `(namespace "${namespace}"). Use it to confirm you are pointed at the right app before mutating data.`].join(" ");
 }
 //#endregion
 //#region src/auto/collection-tools.ts
-/** Admin-route fetch (mirrors tools/collections.ts adminFetch). */
-async function adminFetch(apiClient, bearer, options) {
-	let url = `${apiClient.getBaseUrl()}${options.path}`;
-	if (options.query && Object.keys(options.query).length > 0) url += `?${new URLSearchParams(options.query).toString()}`;
-	const headers = {
-		Authorization: `Bearer ${bearer}`,
-		Accept: "application/json"
+async function proxyFetch(baseUrl, headers, call) {
+	let url = `${baseUrl}${call.path}`;
+	if (call.query && Object.keys(call.query).length > 0) url += `?${new URLSearchParams(call.query).toString()}`;
+	const allHeaders = {
+		Accept: "application/json",
+		...headers
 	};
-	if (options.body !== void 0) headers["Content-Type"] = "application/json";
+	if (call.body !== void 0) allHeaders["Content-Type"] = "application/json";
 	const res = await fetch(url, {
-		method: options.method,
-		headers,
-		body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
+		method: call.method,
+		headers: allHeaders,
+		body: call.body !== void 0 ? JSON.stringify(call.body) : void 0
 	});
 	let body;
 	try {
@@ -9761,6 +10692,16 @@ async function adminFetch(apiClient, bearer, options) {
 		body
 	};
 }
+/** Admin-route fetch (mirrors tools/collections.ts adminFetch). */
+async function adminFetch(apiClient, bearer, call) {
+	return proxyFetch(apiClient.getBaseUrl(), { Authorization: `Bearer ${bearer}` }, call);
+}
+/** Client-route fetch: API key + optional end-user session Bearer. */
+async function clientFetch(clientAuth, call) {
+	const headers = { "X-Api-Key": clientAuth.apiKey };
+	if (clientAuth.sessionToken) headers["Authorization"] = `Bearer ${clientAuth.sessionToken}`;
+	return proxyFetch(clientAuth.baseUrl, headers, call);
+}
 /**
 * Tool-name fragment regex. MCP + `tool-naming.test.ts` require lowercase
 * `_`-separated names. The namespace + collection are sanitized to that
@@ -9776,11 +10717,19 @@ function collectionToolName(namespace, collection, verb) {
 	return `${sanitizeNameFragment(namespace)}_${sanitizeNameFragment(collection)}_${verb}`;
 }
 /**
+* Default `order` for list/find when the caller gives none. A
+* deterministic single-column order is what lets the route return a
+* bootstrap `next_cursor` on the first page (and is what the tool
+* description promises: newest first).
+*/
+const DEFAULT_LIST_ORDER = "created_at desc";
+/**
 * Register the typed CRUD tools for a single collection on `server`,
-* proxying to the existing admin routes via `apiClient`.
+* proxying to the existing authoritative routes for the requested scope.
 */
 function registerCollectionToolsFor(server, apiClient, options) {
-	const { projectId, namespace, collection, schema, policy, scope } = options;
+	const { projectId, namespace, collection, schema, policy, scope, clientAuth } = options;
+	if (scope === "client" && !clientAuth) throw new Error("registerCollectionToolsFor: clientAuth is required for client scope");
 	const mapped = mapCollectionSchema(schema, { includeUserIdInInsert: scope === "admin" });
 	const describeCtx = {
 		collection,
@@ -9789,95 +10738,107 @@ function registerCollectionToolsFor(server, apiClient, options) {
 		writePolicy: policy.write_policy,
 		scope
 	};
-	const rowsPath = `/projects/${projectId}/collections/${encodeURIComponent(collection)}/rows`;
+	const encColl = encodeURIComponent(collection);
+	const rowsRoot = scope === "admin" ? `/projects/${projectId}/collections/${encColl}/rows` : `/collections/${encColl}`;
 	const name = (verb) => collectionToolName(namespace, collection, verb);
-	registerTool(server, apiClient, name("list"), describeCollectionTool("list", describeCtx), {
+	/**
+	* Register one verb tool. Admin scope goes through `registerTool` (the
+	* pat-as-argument helper — the developer Bearer flows from the inbound
+	* request or a per-call `pat` arg); client scope registers a plain tool
+	* whose handler closes over the connection's API key + session token
+	* (an end-user agent has no pat — its credential IS the connection).
+	*/
+	function addTool(verb, schemaShape, run) {
+		if (scope === "client") {
+			registerPublicTool(server, name(verb), describeCollectionTool(verb, describeCtx), schemaShape, async (args) => run(args, (call) => clientFetch(clientAuth, call)));
+			return;
+		}
+		registerTool(server, apiClient, name(verb), describeCollectionTool(verb, describeCtx), schemaShape, async (args, { pat }) => run(args, (call) => adminFetch(apiClient, pat, call)));
+	}
+	/** Build the `?query=` JSON for list/find from common args. */
+	function buildFindQuery(args) {
+		const findQuery = {};
+		if (args.where !== void 0) findQuery.where = args.where;
+		findQuery.order = args.order !== void 0 ? args.order : DEFAULT_LIST_ORDER;
+		if (args.limit !== void 0) findQuery.limit = args.limit;
+		if (args.cursor !== void 0) findQuery.cursor = args.cursor;
+		if (args.select !== void 0) findQuery.select = args.select;
+		if (args.include_deleted !== void 0) findQuery.includeDeleted = args.include_deleted;
+		return findQuery;
+	}
+	const listFindCommon = {
+		order: z.union([z.string(), z.array(z.string())]).optional().describe("Order spec, e.g. \"created_at desc\". Defaults to \"created_at desc\"."),
 		limit: z.number().int().positive().optional().describe("Max rows (default 50)."),
-		cursor: z.string().optional().describe("Opaque cursor from a prior page."),
-		order: z.union([z.string(), z.array(z.string())]).optional().describe("Order spec, e.g. \"created_at desc\"."),
+		cursor: z.string().optional().describe("Opaque cursor from a prior page (`next_cursor`). Omit for the first page."),
 		select: z.array(z.string()).optional().describe("Subset of columns to return."),
 		include_deleted: z.boolean().optional().describe("Include soft-deleted rows. Default false.")
-	}, async ({ limit, cursor, order, select, include_deleted }, { pat }) => {
-		const findQuery = {};
-		if (limit !== void 0) findQuery.limit = limit;
-		if (cursor !== void 0) findQuery.cursor = cursor;
-		if (order !== void 0) findQuery.order = order;
-		if (select !== void 0) findQuery.select = select;
-		if (include_deleted !== void 0) findQuery.includeDeleted = include_deleted;
-		return passthroughResult(await adminFetch(apiClient, pat, {
+	};
+	addTool("list", { ...listFindCommon }, async (args, exec) => {
+		const findQuery = buildFindQuery(args);
+		return passthroughResult(await exec({
 			method: "GET",
-			path: rowsPath,
-			query: Object.keys(findQuery).length > 0 ? { query: JSON.stringify(findQuery) } : void 0
+			path: rowsRoot,
+			query: { query: JSON.stringify(findQuery) }
 		}));
 	});
-	registerTool(server, apiClient, name("get"), describeCollectionTool("get", describeCtx), { id: z.string().describe("Row id (uuid).") }, async ({ id }, { pat }) => {
-		return passthroughResult(await adminFetch(apiClient, pat, {
+	addTool("get", { id: z.string().describe("Row id (uuid).") }, async (args, exec) => {
+		return passthroughResult(await exec({
 			method: "GET",
-			path: `${rowsPath}/${encodeURIComponent(id)}`
+			path: `${rowsRoot}/${encodeURIComponent(String(args.id))}`
 		}));
 	});
-	registerTool(server, apiClient, name("find"), describeCollectionTool("find", describeCtx), {
+	addTool("find", {
 		where: z.object({
 			...mapped.whereShape,
 			and: z.array(z.unknown()).optional().describe("AND-combine nested where clauses."),
 			or: z.array(z.unknown()).optional().describe("OR-combine nested where clauses."),
 			not: z.unknown().optional().describe("Negate a nested where clause.")
 		}).partial().optional().describe("Typed, per-column filter."),
-		order: z.union([z.string(), z.array(z.string())]).optional().describe("Order spec, e.g. \"created_at desc\"."),
-		limit: z.number().int().positive().optional().describe("Max rows (default 50)."),
-		cursor: z.string().optional().describe("Opaque cursor from a prior page."),
-		select: z.array(z.string()).optional().describe("Subset of columns to return."),
-		include_deleted: z.boolean().optional().describe("Include soft-deleted rows. Default false.")
-	}, async ({ where, order, limit, cursor, select, include_deleted }, { pat }) => {
-		const findQuery = {};
-		if (where !== void 0) findQuery.where = where;
-		if (order !== void 0) findQuery.order = order;
-		if (limit !== void 0) findQuery.limit = limit;
-		if (cursor !== void 0) findQuery.cursor = cursor;
-		if (select !== void 0) findQuery.select = select;
-		if (include_deleted !== void 0) findQuery.includeDeleted = include_deleted;
-		return passthroughResult(await adminFetch(apiClient, pat, {
+		...listFindCommon
+	}, async (args, exec) => {
+		const findQuery = buildFindQuery(args);
+		return passthroughResult(await exec({
 			method: "GET",
-			path: rowsPath,
-			query: Object.keys(findQuery).length > 0 ? { query: JSON.stringify(findQuery) } : void 0
+			path: rowsRoot,
+			query: { query: JSON.stringify(findQuery) }
 		}));
 	});
-	registerTool(server, apiClient, name("insert"), describeCollectionTool("insert", describeCtx), {
+	addTool("insert", {
 		...mapped.insertShape,
 		...scope === "admin" ? { as_system: z.boolean().optional().describe("Admin only. On a shared collection, insert a global row with no owner (user_id NULL). Mutually exclusive with user_id.") } : {}
-	}, async (args, { pat }) => {
+	}, async (args, exec) => {
 		const row = {};
 		for (const [k, v] of Object.entries(args)) {
 			if (k === "pat") continue;
 			if (v !== void 0) row[k] = v;
 		}
-		return passthroughResult(await adminFetch(apiClient, pat, {
+		return passthroughResult(await exec({
 			method: "POST",
-			path: rowsPath,
+			path: rowsRoot,
 			body: row
 		}));
 	});
-	registerTool(server, apiClient, name("update"), describeCollectionTool("update", describeCtx), {
+	addTool("update", {
 		id: z.string().describe("Row id (uuid) to update."),
 		set: z.object({ ...mapped.updateShape }).describe("Column→value map of the fields to change (merge-patch).")
-	}, async ({ id, set }, { pat }) => {
-		return passthroughResult(await adminFetch(apiClient, pat, {
+	}, async (args, exec) => {
+		return passthroughResult(await exec({
 			method: "PATCH",
-			path: `${rowsPath}/${encodeURIComponent(id)}`,
-			body: { set }
+			path: `${rowsRoot}/${encodeURIComponent(String(args.id))}`,
+			body: { set: args.set }
 		}));
 	});
-	registerTool(server, apiClient, name("delete"), describeCollectionTool("delete", describeCtx), {
+	addTool("delete", {
 		id: z.string().describe("Row id (uuid) to delete."),
-		hard: z.boolean().optional().describe("false (default) soft-deletes (recoverable); true permanently removes.")
-	}, async ({ id, hard }, { pat }) => {
-		return passthroughResult(await adminFetch(apiClient, pat, {
+		...scope === "admin" ? { hard: z.boolean().optional().describe("false (default) soft-deletes (recoverable); true permanently removes.") } : {}
+	}, async (args, exec) => {
+		return passthroughResult(await exec({
 			method: "DELETE",
-			path: `${rowsPath}/${encodeURIComponent(id)}`,
-			query: hard === true ? { hard: "true" } : void 0
+			path: `${rowsRoot}/${encodeURIComponent(String(args.id))}`,
+			query: scope === "admin" && args.hard === true ? { hard: "true" } : void 0
 		}));
 	});
-	registerTool(server, apiClient, name("aggregate"), describeCollectionTool("aggregate", describeCtx), {
+	addTool("aggregate", {
 		select: z.array(z.object({
 			fn: z.enum([
 				"count",
@@ -9892,62 +10853,248 @@ function registerCollectionToolsFor(server, apiClient, options) {
 		group_by: z.union([z.string(), z.array(z.string())]).optional().describe("Column(s) to group by. Omit for a whole-collection aggregate."),
 		where: z.object({ ...mapped.whereShape }).partial().optional().describe("Typed, per-column filter to aggregate a subset."),
 		include_deleted: z.boolean().optional().describe("Include soft-deleted rows. Default false.")
-	}, async ({ select, group_by, where, include_deleted }, { pat }) => {
-		const body = { select };
-		if (group_by !== void 0) body.group_by = group_by;
-		if (where !== void 0) body.where = where;
-		if (include_deleted !== void 0) body.includeDeleted = include_deleted;
-		return passthroughResult(await adminFetch(apiClient, pat, {
+	}, async (args, exec) => {
+		const body = { select: args.select };
+		if (args.group_by !== void 0) body.group_by = args.group_by;
+		if (args.where !== void 0) body.where = args.where;
+		if (args.include_deleted !== void 0) if (scope === "admin") body.includeDeleted = args.include_deleted;
+		else body.include_deleted = args.include_deleted;
+		return passthroughResult(await exec({
 			method: "POST",
-			path: `${rowsPath}/aggregate`,
+			path: `${rowsRoot}/aggregate`,
+			body
+		}));
+	});
+	if (scope === "client" && mapped.hasVector) addTool("find_nearest", {
+		to_text: z.string().optional().describe("Find rows nearest to this text (the server computes the embedding). Exactly one of to_text / to_vector is required."),
+		to_vector: z.array(z.number()).optional().describe("Find rows nearest to this raw vector. Exactly one of to_text / to_vector."),
+		column: z.string().optional().describe(`Vector column to search (default "embedding"). This collection has: ${mapped.vectorColumns.join(", ")}.`),
+		k: z.number().int().positive().optional().describe("How many rows to return (default 10, max 100)."),
+		distance: z.enum([
+			"cosine",
+			"l2",
+			"inner_product"
+		]).optional().describe("Distance metric — must match how the vector index was created (default cosine)."),
+		where: z.object({ ...mapped.whereShape }).partial().optional().describe("Typed, per-column filter applied on top of the nearest search."),
+		include_deleted: z.boolean().optional().describe("Include soft-deleted rows. Default false.")
+	}, async (args, exec) => {
+		const body = {};
+		if (args.to_text !== void 0) body.to_text = args.to_text;
+		if (args.to_vector !== void 0) body.to_vector = args.to_vector;
+		if (args.column !== void 0) body.column = args.column;
+		if (args.k !== void 0) body.k = args.k;
+		if (args.distance !== void 0) body.distance = args.distance;
+		if (args.where !== void 0) body.where = args.where;
+		if (args.include_deleted !== void 0) body.includeDeleted = args.include_deleted;
+		return passthroughResult(await exec({
+			method: "POST",
+			path: `${rowsRoot}/find-nearest`,
 			body
 		}));
 	});
 }
 //#endregion
-//#region src/auto/index.ts
-/** Page size for the admin collections list (the route caps at 200). */
-const COLLECTION_PAGE_SIZE = 200;
+//#region src/auto/json-schema-to-zod.ts
 /**
-* Hard cap on total pages fetched, so a bad `total` (or a route that never
-* advances) can't spin forever. 200 * 100 = 20k collections — far beyond
-* any real project.
+* Declared-function-input-schema → zod shape mapper (auto-MCP Phase 2,
+* slices C/I).
+*
+* A deployed function may DECLARE its input schema in the deploy
+* annotation (`mcp.input_schema`). The API validates the annotation down
+* to a SUPPORTED SUBSET of JSON Schema at deploy time (see
+* `apps/api/src/lib/function-mcp-schema.ts`); this module converts that
+* subset into the `ZodRawShape` the MCP tool registration consumes, so a
+* declared schema becomes a genuinely typed tool — the agent sees the
+* function's real parameters, not a `body: object` blob.
+*
+* Supported subset (deliberately mirrored with the deploy-time
+* validator — change both together):
+*
+*   - top level: { type: "object", properties, required? }
+*   - property types: string | number | integer | boolean | object | array
+*   - per property: description?, enum? (strings/numbers), items?
+*   - nesting: objects/arrays up to the validator's depth cap
+*
+* Fail-safe posture: this runs against schemas the API already validated,
+* but a manifest could carry an annotation written by an older/newer API.
+* Any construct we can't map cleanly degrades to `z.unknown()` for that
+* property (the tool still works; the typing is just looser) — never a
+* throw, because a registration-time throw would take down the whole
+* tool surface for one bad annotation.
 */
-const COLLECTION_MAX_PAGES = 100;
+function isPlainObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Convert one property schema to a zod type. Never throws. */
+function jsonSchemaPropertyToZod(schema) {
+	if (!isPlainObject(schema)) return z.unknown();
+	const en = schema["enum"];
+	if (Array.isArray(en) && en.length > 0) {
+		if (en.every((v) => typeof v === "string")) {
+			const literals = en.map((v) => z.literal(v));
+			const first = literals[0];
+			if (literals.length === 1) return withDescription(first, schema);
+			return withDescription(z.union([
+				first,
+				literals[1],
+				...literals.slice(2)
+			]), schema);
+		}
+		if (en.every((v) => typeof v === "number")) {
+			const literals = en.map((v) => z.literal(v));
+			const first = literals[0];
+			if (literals.length === 1) return withDescription(first, schema);
+			return withDescription(z.union([
+				first,
+				literals[1],
+				...literals.slice(2)
+			]), schema);
+		}
+		return withDescription(z.unknown(), schema);
+	}
+	switch (schema["type"]) {
+		case "string": return withDescription(z.string(), schema);
+		case "number": return withDescription(z.number(), schema);
+		case "integer": return withDescription(z.number().int(), schema);
+		case "boolean": return withDescription(z.boolean(), schema);
+		case "array": {
+			const items = schema["items"];
+			const elem = items === void 0 ? z.unknown() : jsonSchemaPropertyToZod(items);
+			return withDescription(z.array(elem), schema);
+		}
+		case "object": {
+			const props = schema["properties"];
+			if (!isPlainObject(props)) return withDescription(z.record(z.unknown()), schema);
+			const required = new Set(Array.isArray(schema["required"]) ? schema["required"].filter((r) => typeof r === "string") : []);
+			const shape = {};
+			for (const [key, value] of Object.entries(props)) {
+				const mapped = jsonSchemaPropertyToZod(value);
+				shape[key] = required.has(key) ? mapped : mapped.optional();
+			}
+			return withDescription(z.object(shape), schema);
+		}
+		default: return withDescription(z.unknown(), schema);
+	}
+}
+function withDescription(type, schema) {
+	const description = schema["description"];
+	if (typeof description === "string" && description.length > 0) return type.describe(description);
+	return type;
+}
 /**
-* Fetch EVERY collection name for a project, advancing `offset` until the
-* reported `pagination.total` is reached (the admin list route caps each
-* page at 200).
-*
-* Returns `{ ok, names }`. `ok` is `false` if ANY page (first OR a later
-* one) returns a non-success status — a partial list must not masquerade
-* as complete, or the caller would silently register only some of the
-* project's collections as tools. On a mid-pagination failure the
-* already-fetched `names` are still returned alongside `ok:false` so a
-* caller can surface a diagnostic that includes what it did see.
+* Convert a declared top-level input schema to a `ZodRawShape` (the MCP
+* tool registration input). Returns `null` when the schema is not the
+* supported `type: "object"` shape — the caller falls back to the
+* generic `{ body?, query? }` tool input.
 */
-async function listAllCollections(apiClient, projectId) {
-	const names = [];
-	let offset = 0;
-	for (let page = 0; page < COLLECTION_MAX_PAGES; page++) {
-		const res = await adminGet(apiClient, `/projects/${projectId}/collections?limit=${COLLECTION_PAGE_SIZE}&offset=${offset}`);
-		if (res.status < 200 || res.status >= 300) return {
-			ok: false,
-			names
-		};
-		const pageNames = (res.body.data ?? []).map((c) => c.name).filter((n) => typeof n === "string" && n.length > 0);
-		names.push(...pageNames);
-		const total = res.body.pagination?.total;
-		offset += COLLECTION_PAGE_SIZE;
-		if (typeof total === "number") {
-			if (offset >= total) break;
-		} else if (pageNames.length < COLLECTION_PAGE_SIZE) break;
+function jsonSchemaToZodShape(schema) {
+	if (!isPlainObject(schema) || schema["type"] !== "object") return null;
+	const props = schema["properties"];
+	if (!isPlainObject(props)) return null;
+	const required = new Set(Array.isArray(schema["required"]) ? schema["required"].filter((r) => typeof r === "string") : []);
+	const shape = {};
+	for (const [key, value] of Object.entries(props)) {
+		const mapped = jsonSchemaPropertyToZod(value);
+		shape[key] = required.has(key) ? mapped : mapped.optional();
+	}
+	return shape;
+}
+//#endregion
+//#region src/auto/function-tools.ts
+/** Build the `<ns>_fn_<name>` tool name. */
+function functionToolName(namespace, fn) {
+	return `${sanitizeNameFragment(namespace)}_fn_${sanitizeNameFragment(fn)}`;
+}
+/** Generic input shape for functions without a declared schema. */
+const GENERIC_FUNCTION_SHAPE = {
+	body: z.unknown().optional().describe("JSON request body forwarded to the function as-is."),
+	query: z.record(z.string()).optional().describe("String key/value pairs appended to the invocation URL as query parameters.")
+};
+/**
+* Invoke the function through its public execution URL with the
+* connection's credential. Returns `{ status, body }` — the function's
+* response verbatim (JSON when parseable, text otherwise).
+*/
+async function invokeFunction(input) {
+	let url = input.invokeUrl;
+	if (input.query && Object.keys(input.query).length > 0) {
+		const qs = new URLSearchParams(input.query).toString();
+		url += url.includes("?") ? `&${qs}` : `?${qs}`;
+	}
+	const headers = {
+		Accept: "application/json",
+		"X-Api-Key": input.clientAuth.apiKey
+	};
+	if (input.clientAuth.sessionToken) headers["Authorization"] = `Bearer ${input.clientAuth.sessionToken}`;
+	let bodyText;
+	if (input.body !== void 0) {
+		headers["Content-Type"] = "application/json";
+		bodyText = JSON.stringify(input.body);
 	}
+	const res = await fetch(url, {
+		method: "POST",
+		headers,
+		body: bodyText
+	});
+	const text = await res.text();
+	let parsed = text;
+	try {
+		parsed = text.length > 0 ? JSON.parse(text) : null;
+	} catch {}
 	return {
-		ok: true,
-		names
+		status: res.status,
+		body: parsed
 	};
 }
+/**
+* Register the tool for a single exposed function on `server`.
+*/
+function registerFunctionToolsFor(server, options) {
+	const { namespace, fn, clientAuth } = options;
+	const toolName = functionToolName(namespace, fn.name);
+	const declaredShape = fn.input_schema ? jsonSchemaToZodShape(fn.input_schema) : null;
+	const description = describeFunctionTool({
+		fn: fn.name,
+		declaredDescription: fn.description ?? null,
+		hasDeclaredSchema: declaredShape !== null,
+		isPublic: fn.public === true
+	});
+	if (declaredShape) {
+		registerPublicTool(server, toolName, description, declaredShape, async (args) => {
+			return jsonResult$1(await invokeFunction({
+				invokeUrl: fn.invoke_url,
+				clientAuth,
+				body: args
+			}));
+		});
+		return;
+	}
+	registerPublicTool(server, toolName, description, GENERIC_FUNCTION_SHAPE, async (args) => {
+		const { body, query } = args;
+		return jsonResult$1(await invokeFunction({
+			invokeUrl: fn.invoke_url,
+			clientAuth,
+			body,
+			...query ? { query } : {}
+		}));
+	});
+}
+//#endregion
+//#region src/auto/index.ts
+/** Verbs a collection's typed tool set advertises (per scope + schema). */
+function verbsFor(scope, schema) {
+	const verbs = [
+		"list",
+		"get",
+		"find",
+		"insert",
+		"update",
+		"delete",
+		"aggregate"
+	];
+	if (scope === "client" && mapCollectionSchema(schema).hasVector) verbs.push("find_nearest");
+	return verbs;
+}
 /** Admin GET helper bound to a Bearer (no pat-arg machinery needed here). */
 async function adminGet(apiClient, path) {
 	const res = await fetch(`${apiClient.getBaseUrl()}${path}`, {
@@ -9974,17 +11121,22 @@ async function apiClientToken(apiClient) {
 /**
 * Register the auto-MCP tool surface for one project on `server`.
 *
-* Lists + introspects the project's collections (admin routes) and
-* registers a typed tool set per collection, plus the two meta tools.
 * Returns the names of the collections that were exposed plus `listOk`
-* (false when the collection listing was incomplete — a paginated page
-* failed — in which case typed tools are deliberately NOT registered so a
-* truncated set never masquerades as the whole project).
+* (false when no manifest was available — in which case NO data tools
+* register and the meta tools carry the diagnostic).
 */
 async function registerAutoMcpTools(server, apiClient, options) {
-	const { projectId, scope } = options;
-	const namespace = sanitizeNameFragment(options.namespace ?? projectId);
-	registerTool(server, apiClient, `${namespace}_whoami`, describeWhoami(namespace), {}, async (_args, { pat }) => {
+	const { projectId, scope, manifest, clientAuth } = options;
+	const namespace = sanitizeNameFragment(options.namespace ?? (manifest?.slug ? manifest.slug : projectId));
+	if (scope === "client") registerPublicTool(server, `${namespace}_whoami`, describeWhoami(namespace), {}, async () => jsonResult$1({
+		status: 200,
+		project_id: projectId,
+		scope,
+		namespace,
+		authenticated: Boolean(clientAuth),
+		end_user_session: Boolean(clientAuth?.sessionToken)
+	}));
+	else registerTool(server, apiClient, `${namespace}_whoami`, describeWhoami(namespace), {}, async (_args, { pat }) => {
 		const me = await adminGet(apiClient.withToken(pat), `/projects/${projectId}`);
 		return jsonResult$1({
 			status: me.status,
@@ -9994,85 +11146,83 @@ async function registerAutoMcpTools(server, apiClient, options) {
 			authenticated: me.status >= 200 && me.status < 300
 		});
 	});
-	let collections = [];
-	let listOk = false;
-	try {
-		const all = await listAllCollections(apiClient, projectId);
-		listOk = all.ok;
-		collections = all.ok ? all.names : [];
-	} catch {
-		collections = [];
-		listOk = false;
-	}
-	registerTool(server, apiClient, `${namespace}_list_collections`, describeListCollections(namespace), {}, async (_args, { pat }) => {
-		const boundClient = apiClient.withToken(pat);
-		const all = await listAllCollections(boundClient, projectId);
-		const names = all.names;
-		const described = await Promise.all(names.map(async (collection) => {
-			let exposed = false;
-			try {
-				const res = await adminGet(boundClient, `/projects/${projectId}/collections/${encodeURIComponent(collection)}`);
-				exposed = res.status >= 200 && res.status < 300 && Array.isArray(res.body.data?.columns);
-			} catch {
-				exposed = false;
-			}
-			return {
-				collection,
-				exposed
-			};
-		}));
-		return jsonResult$1({
-			status: all.ok ? 200 : 502,
-			list_complete: all.ok,
+	if (!manifest) {
+		const diagnosticHandler = async () => jsonResult$1({
+			status: 503,
+			list_complete: false,
 			namespace,
 			project_id: projectId,
 			scope,
-			collections: described.map(({ collection, exposed }) => ({
-				collection,
-				exposed,
-				tools: exposed ? [
-					"list",
-					"get",
-					"find",
-					"insert",
-					"update",
-					"delete",
-					"aggregate"
-				].map((v) => collectionToolName(namespace, collection, v)) : []
-			}))
+			error: {
+				code: "MANIFEST_UNAVAILABLE",
+				message: "The app tool manifest could not be loaded for this connection. Retry shortly; if it persists, verify the credential belongs to this app and that its agent surface is enabled."
+			},
+			collections: [],
+			functions: []
 		});
-	});
-	for (const collection of collections) {
-		let described;
-		try {
-			const res = await adminGet(apiClient, `/projects/${projectId}/collections/${encodeURIComponent(collection)}`);
-			if (res.status < 200 || res.status >= 300) continue;
-			described = res.body;
-		} catch {
-			continue;
-		}
-		const data = described.data;
-		if (!data || !Array.isArray(data.columns)) continue;
+		if (scope === "client") registerPublicTool(server, `${namespace}_list_collections`, describeListCollections(namespace), {}, diagnosticHandler);
+		else registerTool(server, apiClient, `${namespace}_list_collections`, describeListCollections(namespace), {}, diagnosticHandler);
+		return {
+			namespace,
+			collections: [],
+			listOk: false
+		};
+	}
+	const manifestFunctions = (manifest.functions ?? []).filter((f) => f && typeof f.name === "string" && f.name.length > 0 && typeof f.invoke_url === "string");
+	const exposedCollections = manifest.collections.map((c) => ({
+		collection: c.name,
+		exposed: true,
+		tools: verbsFor(scope, c).map((v) => collectionToolName(namespace, c.name, v))
+	}));
+	const exposedFunctions = manifestFunctions.map((f) => ({
+		function: f.name,
+		exposed: scope === "client",
+		tools: scope === "client" ? [functionToolName(namespace, f.name)] : [],
+		typed: Boolean(f.input_schema)
+	}));
+	const listCollectionsHandler = async () => jsonResult$1({
+		status: 200,
+		list_complete: true,
+		namespace,
+		project_id: projectId,
+		scope,
+		manifest_version: manifest.version,
+		exposure_note: exposedCollections.length === 0 && exposedFunctions.length === 0 ? "Nothing is exposed on this agent surface yet. Exposure is an explicit allowlist the app developer manages (collections and functions are NOT exposed by default)." : void 0,
+		collections: exposedCollections,
+		functions: exposedFunctions
+	});
+	if (scope === "client") registerPublicTool(server, `${namespace}_list_collections`, describeListCollections(namespace), {}, listCollectionsHandler);
+	else registerTool(server, apiClient, `${namespace}_list_collections`, describeListCollections(namespace), {}, listCollectionsHandler);
+	for (const entry of manifest.collections) {
 		const policy = {
-			read_policy: data.read_policy ?? "owner",
-			write_policy: data.write_policy ?? "owner"
+			read_policy: entry.read_policy ?? "owner",
+			write_policy: entry.write_policy ?? "owner"
 		};
 		registerCollectionToolsFor(server, apiClient, {
 			projectId,
 			namespace,
-			collection,
+			collection: entry.name,
 			schema: {
-				name: data.name,
-				columns: data.columns
+				name: entry.name,
+				columns: entry.columns
 			},
 			policy,
-			scope
+			scope,
+			clientAuth
 		});
 	}
+	if (scope === "client" && clientAuth) for (const fn of manifestFunctions) registerFunctionToolsFor(server, {
+		namespace,
+		fn,
+		clientAuth: {
+			apiKey: clientAuth.apiKey,
+			...clientAuth.sessionToken ? { sessionToken: clientAuth.sessionToken } : {}
+		}
+	});
 	return {
 		namespace,
-		collections,
-		listOk
+		collections: manifest.collections.map((c) => c.name),
+		listOk: true
 	};
 }
 //#endregion
@@ -10083,7 +11233,14 @@ async function registerAutoMcpTools(server, apiClient, options) {
 * called against it once.
 */
 function registerAllTools(server, apiClient) {
-	registerTools$15(server, apiClient);
+	registerTools$20(server, apiClient);
+	registerTools$42(server, apiClient);
+	registerTools$5(server, apiClient);
+	registerTools$3(server, apiClient);
+	registerTools$41(server, apiClient);
+	registerTools$40(server, apiClient);
+	registerTools$39(server, apiClient);
+	registerTools$38(server, apiClient);
 	registerTools$37(server, apiClient);
 	registerTools$36(server, apiClient);
 	registerTools$35(server, apiClient);
@@ -10101,11 +11258,11 @@ function registerAllTools(server, apiClient) {
 	registerTools$23(server, apiClient);
 	registerTools$22(server, apiClient);
 	registerTools$21(server, apiClient);
-	registerTools$20(server, apiClient);
 	registerTools$19(server, apiClient);
 	registerTools$18(server, apiClient);
 	registerTools$17(server, apiClient);
 	registerTools$16(server, apiClient);
+	registerTools$15(server, apiClient);
 	registerTools$14(server, apiClient);
 	registerTools$13(server, apiClient);
 	registerTools$12(server, apiClient);
@@ -10115,9 +11272,7 @@ function registerAllTools(server, apiClient) {
 	registerTools$8(server, apiClient);
 	registerTools$7(server, apiClient);
 	registerTools$6(server, apiClient);
-	registerTools$5(server, apiClient);
 	registerTools$4(server, apiClient);
-	registerTools$3(server, apiClient);
 	registerTools$2(server, apiClient);
 	registerTools$1(server, apiClient);
 	registerTools(server, apiClient);
@@ -10141,4 +11296,4 @@ function createApiClient(options) {
 	return new ApiClient(opts);
 }
 //#endregion
-export { AMBA_SETUP_ECONOMY_MD, AMBA_SETUP_ECONOMY_MIME, AMBA_SETUP_ECONOMY_URI, AMBA_SETUP_ENGAGEMENT_MD, AMBA_SETUP_ENGAGEMENT_MIME, AMBA_SETUP_ENGAGEMENT_URI, AMBA_SETUP_GAMIFICATION_MD, AMBA_SETUP_GAMIFICATION_MIME, AMBA_SETUP_GAMIFICATION_URI, AMBA_SETUP_GUIDE_BODY_VERSION, AMBA_SETUP_GUIDE_MD, AMBA_SETUP_GUIDE_MIME, AMBA_SETUP_GUIDE_URI, AMBA_SETUP_IDENTITY_MD, AMBA_SETUP_IDENTITY_MIME, AMBA_SETUP_IDENTITY_URI, AMBA_SETUP_INFRASTRUCTURE_MD, AMBA_SETUP_INFRASTRUCTURE_MIME, AMBA_SETUP_INFRASTRUCTURE_URI, AMBA_SETUP_SOCIAL_MD, AMBA_SETUP_SOCIAL_MIME, AMBA_SETUP_SOCIAL_URI, AMBA_SETUP_SUB_RESOURCES, ApiClient, CATEGORY_META, CATEGORY_ORDER, EXPO_BUILD_PROMPT_MD, EXPO_BUILD_PROMPT_MIME, EXPO_BUILD_PROMPT_URI, SERVER_MANAGED_COLUMNS, TOOL_CATEGORY, classifyColumn, collectionToolName, createApiClient, describeCollectionTool, describeListCollections, describeWhoami, getToolCategory, mapCollectionSchema, registerAllResources, registerAllTools, registerAutoMcpTools, registerCollectionToolsFor, sanitizeNameFragment };
+export { AMBA_SETUP_ECONOMY_MD, AMBA_SETUP_ECONOMY_MIME, AMBA_SETUP_ECONOMY_URI, AMBA_SETUP_ENGAGEMENT_MD, AMBA_SETUP_ENGAGEMENT_MIME, AMBA_SETUP_ENGAGEMENT_URI, AMBA_SETUP_GAMIFICATION_MD, AMBA_SETUP_GAMIFICATION_MIME, AMBA_SETUP_GAMIFICATION_URI, AMBA_SETUP_GUIDE_BODY_VERSION, AMBA_SETUP_GUIDE_MD, AMBA_SETUP_GUIDE_MIME, AMBA_SETUP_GUIDE_URI, AMBA_SETUP_IDENTITY_MD, AMBA_SETUP_IDENTITY_MIME, AMBA_SETUP_IDENTITY_URI, AMBA_SETUP_INFRASTRUCTURE_MD, AMBA_SETUP_INFRASTRUCTURE_MIME, AMBA_SETUP_INFRASTRUCTURE_URI, AMBA_SETUP_SOCIAL_MD, AMBA_SETUP_SOCIAL_MIME, AMBA_SETUP_SOCIAL_URI, AMBA_SETUP_SUB_RESOURCES, ApiClient, CATEGORY_META, CATEGORY_ORDER, EXPO_BUILD_PROMPT_MD, EXPO_BUILD_PROMPT_MIME, EXPO_BUILD_PROMPT_URI, SERVER_MANAGED_COLUMNS, TOOL_CATEGORY, classifyColumn, collectionToolName, createApiClient, describeCollectionTool, describeFunctionTool, describeListCollections, describeWhoami, functionToolName, getToolCategory, jsonSchemaToZodShape, mapCollectionSchema, registerAllResources, registerAllTools, registerAutoMcpTools, registerCollectionToolsFor, registerFunctionToolsFor, sanitizeNameFragment };