@layers/amba 1.1.0 → 4.0.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -38,7 +38,7 @@ After restarting your MCP client, paste:
38
38
 
39
39
  …to scaffold a full Expo app with Amba as the only backend. The skill
40
40
  fetches the canonical prompt from
41
- <https://docs.amba.dev/docs/prompts/expo-build> at invocation time and
41
+ <https://docs.amba.dev/prompts/expo-build> at invocation time and
42
42
  falls back to an inlined snapshot when offline. Use `--no-skills` to
43
43
  skip the skill install.
44
44
 
@@ -20,6 +20,7 @@ export interface ProjectSummary {
20
20
  platform: string;
21
21
  environment?: string;
22
22
  bundle_id?: string | null;
23
+ google_oauth_client_id?: string | null;
23
24
  status?: string;
24
25
  created_at?: string;
25
26
  }
@@ -27,6 +28,12 @@ export declare function listProjects(): Promise<ApiListResponse<ProjectSummary>>
27
28
  export declare function createProject(input: {
28
29
  name: string;
29
30
  bundle_id?: string;
31
+ /**
32
+ * Google OAuth 2.0 client id. Doubles as the audience the server
33
+ * expects on Google Sign In id tokens — set this if your app uses
34
+ * Sign in with Google. Public identifier, not a secret.
35
+ */
36
+ google_oauth_client_id?: string;
30
37
  platform?: string;
31
38
  /**
32
39
  * Project environment. `'development'` flags the row as the developer's
@@ -40,6 +47,25 @@ export declare function createProject(input: {
40
47
  platform: string;
41
48
  environment?: string;
42
49
  }>>;
50
+ /**
51
+ * PATCH /admin/projects/:projectId — update mutable fields. Server
52
+ * silently ignores unknown keys; we filter to the documented allow-list
53
+ * before sending so a typo at the CLI doesn't pass the wire silently.
54
+ */
55
+ export declare function updateProject(projectId: string, patch: {
56
+ name?: string;
57
+ bundle_id?: string | null;
58
+ google_oauth_client_id?: string | null;
59
+ platform?: string;
60
+ environment?: string;
61
+ }): Promise<ApiResponse<{
62
+ id: string;
63
+ name: string;
64
+ bundle_id: string | null;
65
+ google_oauth_client_id: string | null;
66
+ platform: string;
67
+ environment: string;
68
+ }>>;
43
69
  export declare function getProject(projectId: string): Promise<ApiResponse<{
44
70
  id: string;
45
71
  name: string;
@@ -53,15 +79,16 @@ export declare function deleteProject(projectId: string): Promise<ApiResponse<{
53
79
  deleted: boolean;
54
80
  }>>;
55
81
  export declare function reprovisionProject(projectId: string): Promise<ApiResponse<{
56
- workflowId?: string;
82
+ projectId: string;
83
+ job_id?: string;
57
84
  status?: string;
58
- message?: string;
85
+ collapsed?: boolean;
59
86
  }>>;
60
87
  export declare function getProvisioningStatus(projectId: string): Promise<ApiResponse<{
61
88
  projectId: string;
62
89
  status: string;
63
- workflowId?: string | null;
64
- errorMessage?: string | null;
90
+ provisioned_at: string | null;
91
+ region: string | null;
65
92
  }>>;
66
93
  export declare function createApiKey(projectId: string, keyType: 'client' | 'server', environment: 'development' | 'production'): Promise<ApiResponse<{
67
94
  id: string;
@@ -321,11 +348,14 @@ export declare function scheduleFunction(projectId: string, input: {
321
348
  schedule_id: string;
322
349
  }>>;
323
350
  export interface FunctionLogEvent {
324
- /** Logpush row — see `r2-log-reader.ts:LogpushTraceEvent`. Field-shape stable. */
351
+ /** Sanitized log row — see `r2-log-reader.ts:SanitizedLogEvent`. Field-shape stable. */
325
352
  Event?: {
326
353
  Timestamp?: string;
327
354
  };
328
- ScriptName?: string;
355
+ /** The function's name (parsed server-side from the internal script name). */
356
+ function_name?: string;
357
+ /** The deploy version this event came from. */
358
+ version?: number;
329
359
  Outcome?: string;
330
360
  Logs?: Array<{
331
361
  Level?: string;
@@ -390,8 +420,8 @@ export declare function listSecretSyncStatus(projectId: string): Promise<ApiList
390
420
  export interface SetSecretResultRow {
391
421
  /** Secret name as set by the customer. */
392
422
  name: string;
393
- /** Function name the secret binds to. */
394
- function: string;
423
+ /** Function the secret binds to, or `null` for a project-wide secret. */
424
+ function: string | null;
395
425
  /** Secret store version number (1, 2, 3, ...). */
396
426
  version: number;
397
427
  /** Backend version resource path — exposed for ops debugging. */
@@ -405,12 +435,16 @@ export declare function setSecretViaApi(projectId: string, input: {
405
435
  name: string;
406
436
  /** Plaintext secret value. <=64KiB. */
407
437
  value: string;
408
- /** Function name the secret binds to. v1 has no project-wide secrets. */
409
- function: string;
438
+ /**
439
+ * Function the secret binds to. OMIT for a PROJECT-WIDE secret
440
+ * (applied to every function in the project, including ones deployed
441
+ * later).
442
+ */
443
+ function?: string;
410
444
  }): Promise<ApiResponse<SetSecretResultRow>>;
411
445
  export interface ListSecretsRow {
412
- /** Function name the secret binds to. */
413
- function: string;
446
+ /** Function the secret binds to, or `null` for a project-wide secret. */
447
+ function: string | null;
414
448
  /** Secret name. */
415
449
  name: string;
416
450
  /** Latest secret-store version number. */
@@ -420,12 +454,14 @@ export interface ListSecretsRow {
420
454
  last_error: string | null;
421
455
  updated_at: string;
422
456
  }
423
- export declare function listSecretsViaApi(projectId: string): Promise<ApiListResponse<ListSecretsRow>>;
424
- export declare function deleteSecretViaApi(projectId: string, name: string, options: {
425
- function: string;
457
+ export declare function listSecretsViaApi(projectId: string, options?: {
458
+ function?: string;
459
+ }): Promise<ApiListResponse<ListSecretsRow>>;
460
+ export declare function deleteSecretViaApi(projectId: string, name: string, options?: {
461
+ function?: string;
426
462
  }): Promise<ApiResponse<{
427
463
  name: string;
428
- function: string;
464
+ function: string | null;
429
465
  deleted: true;
430
466
  }>>;
431
467
  /** Closed set of column types the server accepts. */
@@ -521,8 +557,8 @@ export declare function dropCollection(projectId: string, name: string, confirm:
521
557
  export type AiProviderName = 'anthropic' | 'openai';
522
558
  export interface AiProviderRow {
523
559
  name: AiProviderName;
524
- /** Canonical secret name in the secret store. NULL only mid-rotation. */
525
- api_key_secret_name: string | null;
560
+ /** Whether an API key is currently configured for this provider. */
561
+ configured: boolean;
526
562
  /** Preview cue printed to the CLI on register; NOT a real partial key. */
527
563
  api_key_preview?: string;
528
564
  created_at?: string;
@@ -552,9 +588,23 @@ export interface SiteDomainRow {
552
588
  hostname: string;
553
589
  provider_hostname_id: string | null;
554
590
  cert_status: 'pending_validation' | 'pending_issuance' | 'pending_deployment' | 'active' | 'error';
591
+ ownership_status: 'pending' | 'active' | 'error';
555
592
  created_at: string;
556
593
  updated_at: string;
557
594
  }
595
+ /** A DNS record the customer must publish to validate / prove ownership. */
596
+ export interface DomainValidationRecord {
597
+ txt_name?: string;
598
+ txt_value?: string;
599
+ http_url?: string;
600
+ http_body?: string;
601
+ }
602
+ /** Hostname-ownership token returned as a DNS TXT record. */
603
+ export interface DomainOwnershipVerification {
604
+ type?: string;
605
+ name?: string;
606
+ value?: string;
607
+ }
558
608
  export declare function createSite(projectId: string, input: {
559
609
  name: string;
560
610
  }): Promise<ApiResponse<SiteRow>>;
@@ -595,7 +645,16 @@ export declare function addSiteDomainViaApi(projectId: string, siteName: string,
595
645
  hostname: string;
596
646
  provider_hostname_id: string;
597
647
  cert_status: SiteDomainRow["cert_status"];
648
+ ownership_status: SiteDomainRow["ownership_status"];
598
649
  dns_target: string;
650
+ is_apex: boolean;
651
+ dns_note: string | null;
652
+ ssl_validation: DomainValidationRecord[];
653
+ ownership_verification: DomainOwnershipVerification | null;
654
+ ownership_verification_http: {
655
+ http_url?: string;
656
+ http_body?: string;
657
+ } | null;
599
658
  created_at: string;
600
659
  }>>;
601
660
  /**
@@ -627,6 +686,51 @@ export declare function deleteSiteViaApi(projectId: string, siteName: string, op
627
686
  deleted: true;
628
687
  cascade: DeleteCascadeSummary;
629
688
  }>>;
689
+ /** A candidate domain from a search. */
690
+ export interface DomainSuggestion {
691
+ domain: string;
692
+ available: boolean;
693
+ price_usd: number | null;
694
+ currency: string;
695
+ premium: boolean;
696
+ }
697
+ /** Authoritative availability + price for a specific domain. */
698
+ export interface DomainAvailability extends DomainSuggestion {
699
+ supported: boolean;
700
+ }
701
+ /** Purchase response — either a quote (executed=false) or a result. */
702
+ export interface DomainPurchaseResult {
703
+ domain: string;
704
+ site: string;
705
+ executed: boolean;
706
+ available?: boolean;
707
+ price_usd?: number | null;
708
+ currency?: string;
709
+ premium?: boolean;
710
+ confirmation_required?: boolean;
711
+ gated?: boolean;
712
+ live?: boolean;
713
+ registered?: boolean;
714
+ provisioned?: boolean;
715
+ cert_status?: string;
716
+ ownership_status?: string;
717
+ dns_autoconfigured?: boolean;
718
+ url?: string;
719
+ public_url?: string;
720
+ message?: string;
721
+ }
722
+ export declare function searchDomainsViaApi(projectId: string, query: string, limit?: number): Promise<ApiListResponse<DomainSuggestion>>;
723
+ export declare function checkDomainsViaApi(projectId: string, domains: string[]): Promise<ApiListResponse<DomainAvailability>>;
724
+ export declare function purchaseDomainViaApi(projectId: string, body: {
725
+ domain: string;
726
+ site: string;
727
+ accept_price_usd?: number;
728
+ confirm?: boolean;
729
+ auto_renew?: boolean;
730
+ privacy?: boolean;
731
+ years?: number;
732
+ }): Promise<ApiResponse<DomainPurchaseResult>>;
733
+ export declare function listPurchasedDomainsViaApi(projectId: string): Promise<ApiListResponse<Record<string, unknown>>>;
630
734
  /**
631
735
  * Delete a function entirely. Cascade: removes the deployed script
632
736
  * (backend 404 treated as success), then marks every historical
package/dist/auth.d.ts CHANGED
@@ -37,6 +37,14 @@ export declare function clearCredentials(): Promise<void>;
37
37
  * `null` clears any prior override.
38
38
  */
39
39
  export declare function setBearerOverride(token: string | null): void;
40
+ /**
41
+ * Read the current bearer override without consuming it. Returns
42
+ * `null` when no override is set. Used by commands that need to know
43
+ * "did the operator supply a PAT for this invocation?" — e.g. `init`
44
+ * branches on whether to bypass stored-creds and use the supplied
45
+ * token verbatim.
46
+ */
47
+ export declare function getBearerOverride(): string | null;
40
48
  /** Test-only: reset the override between cases. */
41
49
  export declare function __resetTokenOverride(): void;
42
50
  /**
package/dist/bundle.d.ts CHANGED
@@ -1,24 +1,38 @@
1
1
  /**
2
2
  * Customer-function bundling for `amba functions deploy`.
3
3
  *
4
- * Uses esbuild (the Workers ecosystem bundler-of-record). The shared
5
- * runtime stdlib is marked `external` so customer bundles don't
6
- * re-include megabytes of `@anthropic-ai/sdk`, `postgres`, `zod`, etc.;
7
- * these resolve at dispatch time via platform-level bindings.
4
+ * Uses esbuild. Customer code is bundled into a single self-contained
5
+ * ES module — the upstream runtime resolves nothing at dispatch time
6
+ * except built-in JavaScript globals.
8
7
  *
9
8
  * Two checks gate the bundle before upload:
10
9
  * 1. Pre-upload size check against `BUNDLE_MAX_SIZE_BYTES` (8 MB
11
10
  * default — the platform's 10 MB compressed cap minus 2 MB
12
11
  * headroom) with a clear error pointing at the externalization
13
12
  * config.
14
- * 2. Bundle-shape report — the CLI prints what's externalized vs
15
- * bundled at deploy time so size issues are debuggable.
13
+ * 2. Bundle-shape report — the CLI prints what's bundled vs
14
+ * externalized at deploy time so size issues are debuggable.
15
+ *
16
+ * History note (2026-05-27): the prior version of this file pinned
17
+ * `@layers/amba-functions` + `@layers/amba-api-middleware` as
18
+ * "platform-level bindings" externals. Neither is — they were
19
+ * server-side packages, and `@layers/amba-functions` was unpublished
20
+ * in the 4.0.2 cutover (a deprecated wrapper that never matched the
21
+ * actual runtime). Any function importing one of them was rejected
22
+ * upstream as "no such module." The default externals list is now
23
+ * empty; customer code is expected to be self-contained.
16
24
  */
17
25
  import { type BuildOptions } from 'esbuild';
18
26
  /**
19
- * Modules customer code MUST externalize. The runtime exposes these as
20
- * platform-level bindings; bundling them per-script wastes hundreds of
21
- * KB to MBs and quickly hits the script-size cap.
27
+ * Modules the bundler treats as `external` by default. The Amba
28
+ * function runtime exposes zero npm packages — there is no "platform
29
+ * stdlib" for customer functions to import. Keep this list empty.
30
+ *
31
+ * The `extraExternals` field on `BundleOptions` is a programmatic
32
+ * escape hatch (used by tests + future CLI wiring). It's intentionally
33
+ * not exposed as a `amba functions deploy` flag today — externalizing
34
+ * a module that isn't actually provided at runtime is exactly the
35
+ * footgun this list-defaults-to-empty change closes.
22
36
  */
23
37
  export declare const RUNTIME_STDLIB_EXTERNALS: readonly string[];
24
38
  /**
@@ -0,0 +1,34 @@
1
+ /**
2
+ * `amba billing *` subcommands — CLI access to the per-project billing
3
+ * surface that ships behind `/v1/admin/projects/:id/billing/*`.
4
+ *
5
+ * amba billing status — tier, headroom on each
6
+ * metered axis, next-bill date,
7
+ * human_action_required.
8
+ *
9
+ * amba billing upgrade --tier <t> — print the Stripe Checkout
10
+ * URL for tier ∈ {pro, scale}
11
+ * [--interval month|year] at the chosen interval. CLI
12
+ * deliberately does NOT auto-
13
+ * open a browser: agents pipe
14
+ * the URL into a confirmation
15
+ * step, humans copy-paste.
16
+ *
17
+ * amba billing portal — print the Customer Portal
18
+ * URL for card / cancel / etc.
19
+ *
20
+ * amba billing set-ceiling <usd|off> — cap (or remove) the monthly
21
+ * spend ceiling.
22
+ *
23
+ * Project is resolved via `loadProjectConfig` (AMBA_PROJECT_ID env, then
24
+ * .env / .env.local in the cwd) — same pattern as `amba secrets *`.
25
+ */
26
+ export declare function billingStatusCommand(): Promise<void>;
27
+ export declare function billingUpgradeCommand(input: {
28
+ tier: 'pro' | 'scale';
29
+ interval?: 'month' | 'year';
30
+ }): Promise<void>;
31
+ export declare function billingPortalCommand(): Promise<void>;
32
+ export declare function billingSetCeilingCommand(input: {
33
+ ceiling: number | null;
34
+ }): Promise<void>;
@@ -0,0 +1,41 @@
1
+ /**
2
+ * `amba claim <email>` — bind a sandbox account to a real email address
3
+ * via a one-click magic link.
4
+ *
5
+ * Sandbox accounts are minted with an auto-generated address
6
+ * (`sandbox-<epoch>-<nonce>@layers.com`) and remain capped at 100 MAU /
7
+ * 10 MB DB until the developer claims a real email. This command POSTs
8
+ * the target email to `/v1/auth/developer/claim` under the developer's
9
+ * stored PAT; the backend emails a single-use magic link that — when
10
+ * clicked — updates the developer row and flips the project tier from
11
+ * `sandbox` to `verified_free` (1,000 MAU, 500 MB DB).
12
+ *
13
+ * Wire shape:
14
+ *
15
+ * POST {AMBA_API_URL}/v1/auth/developer/claim
16
+ * Authorization: Bearer {pat}
17
+ * Content-Type: application/json
18
+ * Body: { "email": "<target-email>" }
19
+ *
20
+ * Success: HTTP 200 `{ "ok": true }`
21
+ * Errors: HTTP 400 INVALID_INPUT
22
+ * HTTP 409 EMAIL_TAKEN — that address already owns another account
23
+ * HTTP 409 ALREADY_CLAIMED — this account is already verified
24
+ * HTTP 429 — rate-limited
25
+ * HTTP 5xx — surface verbatim with code + message
26
+ *
27
+ * UX contract: a single ✓ line + a hint that the link expires in 15
28
+ * minutes. No copy-paste tokens, no follow-up commands. The click in
29
+ * the email is the whole flow.
30
+ */
31
+ export interface ClaimCommandOptions {
32
+ /** Override the API root for tests + ops. Defaults to env or `https://api.amba.dev`. */
33
+ apiUrl?: string;
34
+ /** Inject a fetch implementation — test seam. */
35
+ fetchImpl?: typeof fetch;
36
+ /** Inject the developer PAT directly — test seam. Bypasses ~/.amba lookup. */
37
+ pat?: string;
38
+ /** Override `~/` resolution for credential lookup — test seam. */
39
+ homeDir?: string;
40
+ }
41
+ export declare function claimCommand(email: string, options?: ClaimCommandOptions): Promise<void>;
@@ -0,0 +1,27 @@
1
+ /**
2
+ * `amba domains ...` commands — buy a domain through Amba.
3
+ *
4
+ * amba domains search <query> find available domains + prices
5
+ * amba domains check <domain...> authoritative availability + price
6
+ * amba domains buy <domain> --site s buy + connect to a site
7
+ * amba domains list domains this project has purchased
8
+ *
9
+ * Search + check are free. `buy` surfaces the cost and requires explicit
10
+ * confirmation (interactive y/N, or `--yes`) before it submits a purchase —
11
+ * and the API itself only executes a real, paid registration when the
12
+ * platform has live purchasing enabled. A registered domain is auto-
13
+ * connected to the chosen site with no DNS setup by the customer.
14
+ */
15
+ export declare function domainsSearchCommand(query: string, options?: {
16
+ limit?: number;
17
+ }): Promise<void>;
18
+ export declare function domainsCheckCommand(domains: string[]): Promise<void>;
19
+ export interface DomainsBuyOptions {
20
+ site: string;
21
+ yes?: boolean;
22
+ noPrivacy?: boolean;
23
+ noAutoRenew?: boolean;
24
+ years?: number;
25
+ }
26
+ export declare function domainsBuyCommand(domain: string, options: DomainsBuyOptions): Promise<void>;
27
+ export declare function domainsListCommand(): Promise<void>;
@@ -9,8 +9,8 @@
9
9
  * Output formatting:
10
10
  * - `--json`: NDJSON to stdout (one event per line) so `| jq` works.
11
11
  * - default: human-readable lines:
12
- * 2026-05-08T12:34:56.789Z scan-letter-v3 [info] "scanning"
13
- * 2026-05-08T12:34:57.012Z scan-letter-v3 [exception] TypeError: …
12
+ * 2026-05-08T12:34:56.789Z scan-letter@v3 [info] "scanning"
13
+ * 2026-05-08T12:34:57.012Z scan-letter@v3 [exception] TypeError: …
14
14
  *
15
15
  * Server-side scoping is enforced — the API filters by ScriptName
16
16
  * prefix so a developer can never read another tenant's logs.
@@ -55,11 +55,12 @@ export interface DevOptions {
55
55
  * — externalization rules, size cap, and source-map handling are
56
56
  * identical so dev → prod parity is automatic.
57
57
  *
58
- * Handler shape: `export default async function (req: Request): Promise<Response>`.
58
+ * Handler shape: `export default { async fetch(req, env, ctx) { ... } }`.
59
59
  * `.env.local` values in the customer's working directory are passed
60
- * through to the child process so the handler can read them via
61
- * `process.env.MY_KEY`. Existing values in the parent's env take
62
- * priority (so `MY_KEY=x amba functions dev …` wins).
60
+ * through to the child process and bridged into the `env` parameter so
61
+ * the handler reads them the same way as in production (`env.MY_KEY`).
62
+ * Existing values in the parent's env take priority (so
63
+ * `MY_KEY=x amba functions dev …` wins).
63
64
  */
64
65
  export declare function functionsDevCommand(entryPoint: string, options?: DevOptions): Promise<void>;
65
66
  /**
@@ -40,42 +40,42 @@ export declare function runSandboxInit(cwd: string, options: {
40
40
  sandboxEmail?: string;
41
41
  noMcpConfig?: boolean;
42
42
  /**
43
- * Skip the project-local `/amba-build` Claude Code skill install.
44
- * Default is to install (the skill is what makes the agentic
45
- * "/amba-build <design>" invocation work). Set true in CI or
46
- * during tests that don't want stray files written into the
47
- * caller's CWD.
43
+ * Skip the project-local skill install. Default is to install. Set
44
+ * true in CI or during tests that don't want stray files written.
48
45
  */
49
46
  noSkills?: boolean;
50
47
  json?: boolean;
51
48
  /**
52
49
  * Override `~/` resolution. The CLI itself never passes this — it's
53
50
  * the seam tests use to avoid touching the developer's actual home
54
- * directory. (vi.spyOn can't intercept `os.homedir` under ESM, so
55
- * dependency injection is the cleanest substitute.)
51
+ * directory.
56
52
  */
57
53
  homeDir?: string;
58
54
  }): Promise<SandboxResult>;
59
55
  /**
60
56
  * Build the plaintext (no ANSI) success-output block printed at the
61
- * end of `amba init --sandbox`. Pure function — exported only for the
62
- * vitest cases that assert on per-line content. The CLI wraps each
63
- * line with picocolors in `printSandboxNextSteps` below.
57
+ * end of `amba init --sandbox`. Pure function — exported for the
58
+ * vitest cases that assert on per-line content. The CLI wraps the
59
+ * output with picocolors in `printSandboxNextSteps` below.
64
60
  *
65
- * Structure (in order):
66
- * 1. Per-artifact checklist (`✓ ...` lines)
67
- * 2. SDK install + configure hint
68
- * 3. "Done." + per-client restart bullets — ONLY for clients we
69
- * actually wrote configs to. Never instruct the user to "restart
70
- * Cursor" if we only touched `~/.claude.json`. When no config
71
- * was written (manual-paste path), falls back to a generic
72
- * "quit + reopen" line.
73
- * 4. Tail-line resume hint + sandbox limits + verify URL.
61
+ * Design: silent-until-done. The install (provision account, mint
62
+ * keys, write .env.local, write MCP config, install skill) is COMPLETE
63
+ * the moment this output lands. The MCP config has been persisted —
64
+ * it activates on the next launch of the developer's coding agent. We
65
+ * do NOT instruct the developer to restart anything; we just state
66
+ * what's wired and what's next.
74
67
  *
75
- * We intentionally do NOT print any "kill -HUP / SIGHUP" advanced
76
- * workaround. Telling the agent to surface a clean "restart your MCP
77
- * client" instruction to the human is the whole optimization — adding
78
- * an experimental fallback just dilutes the signal and risks the
79
- * agent surfacing the workaround instead.
68
+ * Shape (~6 lines, Vercel/Stripe aesthetic):
69
+ * ✓ Amba ready
70
+ * project: <id>
71
+ * keys → .env.local
72
+ * mcp → <paths> (active next agent launch)
73
+ * skill → <skill paths> (when installed)
74
+ *
75
+ * next: npm install <sdk-pkg>
76
+ * Amba.configure({ projectId, clientKey }) at app startup
77
+ *
78
+ * The fallback for "no MCP client config detected" is a one-line
79
+ * note + a paste-ready snippet — still no restart copy.
80
80
  */
81
81
  export declare function buildSandboxNextStepsLines(r: SandboxResult): string[];
@@ -3,8 +3,16 @@ export declare function projectsCreateCommand(input: {
3
3
  name: string;
4
4
  env?: string;
5
5
  bundleId?: string;
6
+ googleOauthClientId?: string;
6
7
  platform?: string;
7
8
  }): Promise<void>;
9
+ export declare function projectsUpdateCommand(projectId: string, input: {
10
+ name?: string;
11
+ bundleId?: string;
12
+ googleOauthClientId?: string;
13
+ platform?: string;
14
+ environment?: string;
15
+ }): Promise<void>;
8
16
  export declare function projectsShowCommand(projectId: string): Promise<void>;
9
17
  export declare function projectsDeleteCommand(projectId: string, opts?: {
10
18
  yes?: boolean;
@@ -1,13 +1,25 @@
1
1
  /**
2
- * `amba secrets ...` — write per-function secrets through the platform
3
- * API. The CLI sends `{name, value, function}` to the admin endpoint;
4
- * the server stores the value, validates reserved binding names, and
5
- * propagates it to the deployed Worker's binding. Sync is eventual —
6
- * `amba secrets list` shows progress.
2
+ * `amba secrets ...` — write secrets through the platform API. The CLI
3
+ * sends `{name, value, function?}` to the admin endpoint; the server
4
+ * stores the value, validates reserved binding names, and propagates it to
5
+ * the deployed Worker binding(s). Sync is eventual — `amba secrets list`
6
+ * shows progress.
7
+ *
8
+ * Two scopes:
9
+ * - `--function <name>` → the secret binds to that one function.
10
+ * - no `--function` → a PROJECT-WIDE secret, visible to every
11
+ * function in the project (and to any function deployed later). Set it
12
+ * once instead of repeating the same value per function.
13
+ *
14
+ * Secrets may be set BEFORE the function is deployed. The sync drains once
15
+ * a deployment lands (and `amba functions deploy` re-syncs at the end).
7
16
  */
8
17
  export interface SecretsSetOptions {
9
- /** Function name the secret binds to. Required — there are no project-wide secrets. */
10
- function: string;
18
+ /**
19
+ * Function the secret binds to. Omit for a PROJECT-WIDE secret (applied
20
+ * to every function in the project, including ones deployed later).
21
+ */
22
+ function?: string;
11
23
  /**
12
24
  * Environment selector. Currently informational: both `dev` and `prod`
13
25
  * write to the same secret namespace per project. Workarounds:
@@ -23,7 +35,15 @@ export interface SecretsSetOptions {
23
35
  fromStdin?: boolean;
24
36
  }
25
37
  export declare function secretsSetCommand(name: string, value: string | undefined, options: SecretsSetOptions): Promise<void>;
26
- export declare function secretsListCommand(): Promise<void>;
38
+ export interface SecretsListOptions {
39
+ /**
40
+ * Filter to secrets for a single function. Without this, all secrets
41
+ * across all functions in the project are listed — noisy when a
42
+ * project has 10+ functions.
43
+ */
44
+ function?: string;
45
+ }
46
+ export declare function secretsListCommand(options?: SecretsListOptions): Promise<void>;
27
47
  export declare function secretsUnsetCommand(name: string, options: {
28
- function: string;
48
+ function?: string;
29
49
  }): Promise<void>;