@layers/amba 4.0.3 → 4.1.0

package/dist/index.js

@@ -3,16 +3,497 @@ import { Command } from "commander";
 import pc from "picocolors";
 import { access, chmod, mkdir, mkdtemp, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
-import { basename, dirname, join, relative, resolve } from "node:path";
+import path, { basename, dirname, join, relative, resolve } from "node:path";
 import { createServer } from "node:http";
 import open from "open";
 import { createHash, randomBytes } from "node:crypto";
 import { createInterface } from "node:readline";
-import { fileURLToPath } from "node:url";
-import { createWriteStream, watch } from "node:fs";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import fs, { createWriteStream, watch } from "node:fs";
 import { spawn } from "node:child_process";
 import { build } from "esbuild";
-//#region ../shared/dist/index.js
+import process$1 from "node:process";
+new Map([
+	{
+		type: "user.created",
+		plane: "app",
+		description: "An app user (end user) was created in the project.",
+		payloadExample: {
+			app_user_id: "usr_123",
+			external_id: "auth0|abc",
+			created_at: "2026-06-03T00:00:00Z"
+		},
+		status: "live"
+	},
+	{
+		type: "user.updated",
+		plane: "app",
+		description: "An app user's profile or attributes changed.",
+		payloadExample: {
+			app_user_id: "usr_123",
+			changed: ["display_name"]
+		},
+		status: "live"
+	},
+	{
+		type: "user.deleted",
+		plane: "app",
+		description: "An app user was deleted.",
+		payloadExample: { app_user_id: "usr_123" },
+		status: "live"
+	},
+	{
+		type: "user.reset",
+		plane: "app",
+		description: "An app user's gamification, economy, engagement and participation state was reset to zero (the user row itself was kept).",
+		payloadExample: {
+			app_user_id: "usr_123",
+			cleared: {
+				user_xp: 1,
+				xp_ledger: 12
+			}
+		},
+		status: "live"
+	},
+	{
+		type: "engagement.push.delivered",
+		plane: "app",
+		description: "A push notification was delivered to a device.",
+		payloadExample: {
+			app_user_id: "usr_123",
+			campaign_id: "cmp_1",
+			delivered_at: "2026-06-03T00:00:00Z"
+		},
+		status: "live"
+	},
+	{
+		type: "engagement.push.failed",
+		plane: "app",
+		description: "A push notification failed to deliver.",
+		payloadExample: {
+			app_user_id: "usr_123",
+			campaign_id: "cmp_1",
+			reason: "unregistered_token"
+		},
+		status: "live"
+	},
+	{
+		type: "email.sent",
+		plane: "app",
+		description: "A transactional email was accepted by the provider for delivery.",
+		payloadExample: {
+			app_user_id: "usr_123",
+			template: "welcome",
+			to: "a@b.com"
+		},
+		status: "live"
+	},
+	{
+		type: "email.failed",
+		plane: "app",
+		description: "A transactional email failed to send.",
+		payloadExample: {
+			app_user_id: "usr_123",
+			template: "welcome",
+			reason: "bounce"
+		},
+		status: "live"
+	},
+	{
+		type: "email.suppressed",
+		plane: "app",
+		description: "An email was suppressed (recipient on the suppression list).",
+		payloadExample: {
+			app_user_id: "usr_123",
+			to: "a@b.com",
+			reason: "unsubscribed"
+		},
+		status: "live"
+	},
+	{
+		type: "gamification.xp.granted",
+		plane: "app",
+		description: "XP was granted to a user.",
+		payloadExample: {
+			app_user_id: "usr_123",
+			amount: 50,
+			total_xp: 1250,
+			rule: "mission_completed",
+			transaction_id: "xpl_abc"
+		},
+		status: "live"
+	},
+	{
+		type: "gamification.level.up",
+		plane: "app",
+		description: "A user crossed an XP threshold into a new level.",
+		payloadExample: {
+			app_user_id: "usr_123",
+			level: 7,
+			previous_level: 6
+		},
+		status: "live"
+	},
+	{
+		type: "gamification.achievement.unlocked",
+		plane: "app",
+		description: "A user unlocked an achievement.",
+		payloadExample: {
+			app_user_id: "usr_123",
+			achievement_id: "first_win",
+			unlocked_at: "2026-06-03T00:00:00Z"
+		},
+		status: "live"
+	},
+	{
+		type: "gamification.streak.advanced",
+		plane: "app",
+		description: "A user's streak advanced (a qualifying action extended it).",
+		payloadExample: {
+			app_user_id: "usr_123",
+			streak_id: "daily",
+			count: 12
+		},
+		status: "live"
+	},
+	{
+		type: "gamification.streak.broken",
+		plane: "app",
+		description: "A user's streak reset to zero after a missed window.",
+		payloadExample: {
+			app_user_id: "usr_123",
+			streak_id: "daily",
+			previous_count: 12
+		},
+		status: "live"
+	},
+	{
+		type: "gamification.challenge.completed",
+		plane: "app",
+		description: "A user completed a challenge.",
+		payloadExample: {
+			app_user_id: "usr_123",
+			challenge_id: "ch_1"
+		},
+		status: "live"
+	},
+	{
+		type: "economy.currency.granted",
+		plane: "app",
+		description: "Currency was granted to a user.",
+		payloadExample: {
+			app_user_id: "usr_123",
+			currency: "coins",
+			amount: 100,
+			balance: 350,
+			transaction_id: "ctx_abc"
+		},
+		status: "live"
+	},
+	{
+		type: "economy.currency.spent",
+		plane: "app",
+		description: "A user spent currency.",
+		payloadExample: {
+			app_user_id: "usr_123",
+			currency: "coins",
+			amount: 100,
+			balance: 250,
+			transaction_id: "ctx_def"
+		},
+		status: "live"
+	},
+	{
+		type: "economy.catalog.purchased",
+		plane: "app",
+		description: "A user purchased a catalog item.",
+		payloadExample: {
+			app_user_id: "usr_123",
+			item_id: "sword",
+			price: 100,
+			currency: "coins"
+		},
+		status: "live"
+	},
+	{
+		type: "economy.inventory.granted",
+		plane: "app",
+		description: "An item was granted into a user inventory.",
+		payloadExample: {
+			app_user_id: "usr_123",
+			item_id: "sword",
+			quantity: 1
+		},
+		status: "live"
+	},
+	{
+		type: "subscription.started",
+		plane: "app",
+		description: "A user gained an active subscription / entitlement.",
+		payloadExample: {
+			app_user_id: "usr_123",
+			entitlement_id: "pro",
+			product_id: "pro_yearly",
+			store: "app_store",
+			period_type: "normal"
+		},
+		status: "live"
+	},
+	{
+		type: "subscription.renewed",
+		plane: "app",
+		description: "An active subscription renewed for another billing period.",
+		payloadExample: {
+			app_user_id: "usr_123",
+			entitlement_id: "pro",
+			product_id: "pro_yearly",
+			store: "app_store"
+		},
+		status: "live"
+	},
+	{
+		type: "subscription.expired",
+		plane: "app",
+		description: "A subscription lapsed / was revoked and access ended.",
+		payloadExample: {
+			app_user_id: "usr_123",
+			entitlement_id: "pro",
+			product_id: "pro_yearly"
+		},
+		status: "live"
+	},
+	{
+		type: "entitlement.granted",
+		plane: "app",
+		description: "An entitlement became active for a user (any source).",
+		payloadExample: {
+			app_user_id: "usr_123",
+			entitlement_id: "pro",
+			product_id: "pro_yearly",
+			source: "webhook"
+		},
+		status: "live"
+	},
+	{
+		type: "entitlement.revoked",
+		plane: "app",
+		description: "An entitlement became inactive for a user (any source).",
+		payloadExample: {
+			app_user_id: "usr_123",
+			entitlement_id: "pro",
+			source: "manual"
+		},
+		status: "live"
+	},
+	{
+		type: "social.friendship.created",
+		plane: "app",
+		description: "A friendship was established between two users.",
+		payloadExample: {
+			app_user_id: "usr_123",
+			friend_id: "usr_456"
+		},
+		status: "live"
+	},
+	{
+		type: "social.message.sent",
+		plane: "app",
+		description: "A message was sent in a conversation.",
+		payloadExample: {
+			conversation_id: "cnv_1",
+			sender_id: "usr_123"
+		},
+		status: "live"
+	},
+	{
+		type: "social.review.created",
+		plane: "app",
+		description: "A review was submitted.",
+		payloadExample: {
+			app_user_id: "usr_123",
+			rating: 5,
+			target_id: "item_1"
+		},
+		status: "live"
+	},
+	{
+		type: "content.published",
+		plane: "app",
+		description: "A content item was published / went live.",
+		payloadExample: {
+			item_id: "post_1",
+			library: "news"
+		},
+		status: "live"
+	},
+	{
+		type: "moderation.flagged",
+		plane: "app",
+		description: "User content entered the moderation queue.",
+		payloadExample: {
+			queue_id: "mq_1",
+			content_type: "message",
+			reason: "auto_flag"
+		},
+		status: "live"
+	},
+	{
+		type: "moderation.rejected",
+		plane: "app",
+		description: "Moderated content was rejected.",
+		payloadExample: {
+			queue_id: "mq_1",
+			moderator: "auto"
+		},
+		status: "live"
+	},
+	{
+		type: "project.provisioning.started",
+		plane: "control",
+		description: "Project provisioning began (tenant DB + keys being created).",
+		payloadExample: { project_id: "prj_1" },
+		status: "live"
+	},
+	{
+		type: "project.provisioned",
+		plane: "control",
+		description: "The project finished provisioning and is ready to use.",
+		payloadExample: {
+			project_id: "prj_1",
+			provisioned_at: "2026-06-03T00:00:00Z"
+		},
+		status: "live"
+	},
+	{
+		type: "project.provisioning.failed",
+		plane: "control",
+		description: "Project provisioning failed and was compensated.",
+		payloadExample: {
+			project_id: "prj_1",
+			reason: "neon_quota"
+		},
+		status: "live"
+	},
+	{
+		type: "site.deploy.completed",
+		plane: "control",
+		description: "A static site deploy completed and is serving.",
+		payloadExample: {
+			site: "marketing",
+			deployment_id: "dep_1",
+			url: "https://x.app.amba.host",
+			file_count: 4,
+			serving_configured: true
+		},
+		status: "live"
+	},
+	{
+		type: "site.deploy.failed",
+		plane: "control",
+		description: "A static site deploy failed.",
+		payloadExample: {
+			project_id: "prj_1",
+			site: "marketing",
+			reason: "storage_write_failed"
+		},
+		status: "live"
+	},
+	{
+		type: "domain.registered",
+		plane: "control",
+		description: "A domain was registered through Amba.",
+		payloadExample: {
+			domain: "myapp.com",
+			site: "marketing"
+		},
+		status: "live"
+	},
+	{
+		type: "domain.cert.issued",
+		plane: "control",
+		description: "The TLS certificate for an attached domain became active.",
+		payloadExample: {
+			project_id: "prj_1",
+			domain: "app.myapp.com"
+		},
+		status: "live"
+	},
+	{
+		type: "domain.connected",
+		plane: "control",
+		description: "A domain is fully connected to a site and serving.",
+		payloadExample: {
+			project_id: "prj_1",
+			domain: "myapp.com",
+			site: "marketing"
+		},
+		status: "live"
+	},
+	{
+		type: "billing.subscription.updated",
+		plane: "control",
+		description: "The project's subscription state changed.",
+		payloadExample: {
+			project_id: "prj_1",
+			tier: "pro",
+			status: "active"
+		},
+		status: "live"
+	},
+	{
+		type: "billing.invoice.paid",
+		plane: "control",
+		description: "An invoice was paid.",
+		payloadExample: {
+			project_id: "prj_1",
+			invoice_id: "in_1",
+			amount_usd: 49
+		},
+		status: "live"
+	},
+	{
+		type: "billing.payment_failed",
+		plane: "control",
+		description: "A payment attempt failed.",
+		payloadExample: {
+			project_id: "prj_1",
+			invoice_id: "in_1",
+			reason: "card_declined"
+		},
+		status: "live"
+	},
+	{
+		type: "billing.ceiling_warning",
+		plane: "control",
+		description: "The project's current-period usage cost crossed 80% of its spend ceiling. Fires at most once per billing period.",
+		payloadExample: {
+			project_id: "prj_1",
+			threshold_pct: 80,
+			ceiling_usd: 100,
+			current_overage_usd: 82.4,
+			pct_consumed: .824,
+			billing_period: "2026-06-01",
+			resets_at: "2026-07-01T00:00:00.000Z"
+		},
+		status: "live"
+	},
+	{
+		type: "billing.ceiling_reached",
+		plane: "control",
+		description: "The project's current-period usage cost reached its spend ceiling — metered writes now return 402 (read-only mode) until the period resets or the ceiling changes. Fires at most once per billing period.",
+		payloadExample: {
+			project_id: "prj_1",
+			threshold_pct: 100,
+			ceiling_usd: 100,
+			current_overage_usd: 101.1,
+			pct_consumed: 1.011,
+			billing_period: "2026-06-01",
+			resets_at: "2026-07-01T00:00:00.000Z",
+			read_only: true
+		},
+		status: "live"
+	}
+].map((e) => [e.type, e]));
 /**
 * Shared email-shape validation.
 *
@@ -529,7 +1010,8 @@ async function deployFunctionViaApi(projectId, input) {
 	fd.set("script", new Blob([input.bundleCode], { type: "application/javascript+module" }), `${input.name}.js`);
 	const metadata = {
 		name: input.name,
-		...input.rate_limit !== void 0 ? { rate_limit: input.rate_limit } : {}
+		...input.rate_limit !== void 0 ? { rate_limit: input.rate_limit } : {},
+		...input.public === true ? { public: true } : {}
 	};
 	fd.set("metadata", new Blob([JSON.stringify(metadata)], { type: "application/json" }), "metadata.json");
 	return request("POST", `/projects/${projectId}/functions/deploy`, fd);
@@ -545,6 +1027,8 @@ async function getFunctionLogs(projectId, functionName, options = {}) {
 	if (options.since) params.set("since", options.since);
 	if (options.until) params.set("until", options.until);
 	if (options.limit !== void 0) params.set("limit", String(options.limit));
+	if (options.requestId) params.set("request_id", options.requestId);
+	if (options.sinceRequestId) params.set("since_request_id", options.sinceRequestId);
 	const qs = params.toString();
 	return request("GET", `/projects/${projectId}/functions/${functionName}/logs${qs ? `?${qs}` : ""}`);
 }
@@ -672,6 +1156,17 @@ async function deleteFunctionViaApi(projectId, functionName, options) {
 async function listSiteDomains(projectId, siteName) {
 	return request("GET", `/projects/${projectId}/sites/${encodeURIComponent(siteName)}/domains`);
 }
+/** GET the current project's declarative configuration bundle. */
+async function exportPromotionBundle(projectId) {
+	return request("GET", `/projects/${projectId}/promotion/export`);
+}
+/** POST a declarative bundle to import it into the project. */
+async function importPromotionBundle(projectId, bundle, mode) {
+	return request("POST", `/projects/${projectId}/promotion/import`, {
+		bundle,
+		mode
+	});
+}
 async function validateApiKey(apiKey) {
 	const res = await fetch(`${getApiRoot()}/v1/auth/validate`, {
 		method: "POST",
@@ -2149,6 +2644,14 @@ Tell the user where their credentials live:
 
 **Already have a PAT?** Skip the signup. Call \`amba_developer_me({})\` to verify the Bearer; if it succeeds, either reuse the most recent project (\`amba_projects_list\`) or call \`amba_projects_create({ name: "<app-name>", platform: "all" })\` and then \`amba_api_keys_create\` twice to mint client + server keys for \`environment: "development"\`.
 
+**Can't reach \`amba_developer_signup\` — it's not in your tool list, or your harness blocks the call?** Do NOT try to work around it by adding the MCP server yourself, running an installer, or editing your own settings/permissions — refusing to self-modify or widen your own permissions is the correct call, and you should not circumvent it. Instead, hand the developer **one** command to run in **their own** terminal (which is not subject to your sandbox):
+
+\`\`\`bash
+npx @layers/amba init
+\`\`\`
+
+It creates the account with no browser and writes \`AMBA_PROJECT_ID\` + \`AMBA_CLIENT_KEY\` to \`.env.local\` (and wires this MCP server up for your next session). Ask them to run it, tell you when it's done, then resume from this Step 0 by reading \`.env.local\`. Asking the developer to paste an \`amb_ck_…\` client key is the last-resort lite path — it's enough to wire \`Amba.configure()\` + runtime calls and verify events land, but a client key alone can't do admin provisioning (creating achievements, collections, segments, etc.), which needs the PAT or server key.
+
 ## Step 1 — Classify the app
 
 Look at what the user told you and at any files they shared. You're trying to pick one of ten presets in 30 seconds, not write a treatise. Inputs:
@@ -2270,7 +2773,7 @@ SKIPPED (low signal — re-run with /amba <feature> if you want them)
 NEEDS YOUR INPUT
   - Apple Sign In: add the "Sign in with Apple" capability in Xcode > Signing & Capabilities.
   - Google Sign In: paste your Google OAuth client ID into amba_projects_update({ google_oauth_client_id: "..." }).
-  - APNs / FCM: upload credentials in app.amba.dev before push delivers.
+  - APNs / FCM: configure credentials with amba_integrations_configure (paste the .p8 / service-account JSON inline) before push delivers.
 
 NEXT STEPS
   - Paste AMBA_CLIENT_KEY into your build env (already shown above)
@@ -4081,7 +4584,7 @@ function confirm$1(question) {
 		});
 	});
 }
-function handleError$1(err) {
+function handleError$2(err) {
 	if (err instanceof ApiClientError) if (err.statusCode === 401 || err.statusCode === 403) console.log(pc.red("  ✗") + " Not authenticated — run `amba login` first.");
 	else console.log(pc.red("  ✗") + ` ${err.message}`);
 	else if (err instanceof Error) console.log(pc.red("  ✗") + ` ${err.message}`);
@@ -4131,7 +4634,7 @@ async function projectsListCommand() {
 		console.log(pc.dim(`  ${projects.length} project${projects.length === 1 ? "" : "s"}`));
 		console.log();
 	} catch (err) {
-		handleError$1(err);
+		handleError$2(err);
 	}
 }
 async function projectsCreateCommand(input) {
@@ -4177,7 +4680,7 @@ async function projectsCreateCommand(input) {
 		console.log(pc.dim("  Next: ") + pc.cyan(`amba projects show ${id}`));
 		console.log();
 	} catch (err) {
-		handleError$1(err);
+		handleError$2(err);
 	}
 }
 async function projectsUpdateCommand(projectId, input) {
@@ -4203,7 +4706,7 @@ async function projectsUpdateCommand(projectId, input) {
 			console.log();
 			process.exit(1);
 		}
-		handleError$1(err);
+		handleError$2(err);
 	}
 }
 async function projectsShowCommand(projectId) {
@@ -4221,7 +4724,7 @@ async function projectsShowCommand(projectId) {
 			console.log();
 			process.exit(1);
 		}
-		handleError$1(err);
+		handleError$2(err);
 	}
 }
 async function projectsDeleteCommand(projectId, opts = {}) {
@@ -4246,7 +4749,7 @@ async function projectsDeleteCommand(projectId, opts = {}) {
 			console.log();
 			process.exit(1);
 		}
-		handleError$1(err);
+		handleError$2(err);
 	}
 }
 //#endregion
@@ -4989,6 +5492,47 @@ function parseEnv(content) {
 * empty; customer code is expected to be self-contained.
 */
 /**
+* Conventional entry-point filenames probed (in order) when
+* `amba functions deploy <dir>` is pointed at a directory rather than a
+* single file. Mirrors the Node / bundler convention (`index.*`) so a
+* developer can `amba functions deploy ./my-fn` with an `index.ts` inside.
+*/
+const FUNCTION_ENTRY_CANDIDATES = [
+	"index.ts",
+	"index.js",
+	"index.mjs"
+];
+/**
+* Resolve the bundler entry point from a deploy target that may be either a
+* single file OR a directory.
+*
+*   - File  → returned as-is (single-file back-compat path).
+*   - Dir   → resolved by convention to `index.{ts,js,mjs}`, or to an
+*             explicit `entry` (relative to the directory) when provided.
+*
+* Throws an actionable error when the target doesn't exist, or when a
+* directory has no resolvable entry point (and no `--entry` was passed).
+*/
+async function resolveFunctionEntry(target, explicitEntry) {
+	const st = await stat(target).catch(() => null);
+	if (!st) throw new Error(`Deploy target not found: ${target}`);
+	if (st.isFile()) {
+		if (explicitEntry) throw new Error(`--entry is only valid when deploying a directory; ${target} is a file. Drop --entry, or point the deploy at the directory containing ${explicitEntry}.`);
+		return target;
+	}
+	if (!st.isDirectory()) throw new Error(`Deploy target is neither a file nor a directory: ${target}`);
+	if (explicitEntry) {
+		const candidate = join(target, explicitEntry);
+		if (!(await stat(candidate).catch(() => null))?.isFile()) throw new Error(`--entry file not found: ${candidate}`);
+		return candidate;
+	}
+	for (const name of FUNCTION_ENTRY_CANDIDATES) {
+		const candidate = join(target, name);
+		if ((await stat(candidate).catch(() => null))?.isFile()) return candidate;
+	}
+	throw new Error(`No entry point found in directory ${target}. Add one of ${FUNCTION_ENTRY_CANDIDATES.join(", ")}, or pass --entry <file> (relative to the directory).`);
+}
+/**
 * Modules the bundler treats as `external` by default. The Amba
 * function runtime exposes zero npm packages — there is no "platform
 * stdlib" for customer functions to import. Keep this list empty.
@@ -5011,6 +5555,91 @@ var BundleSizeError = class extends Error {
 	}
 };
 /**
+* The single source-of-truth message for the wrong-handler-shape failure.
+* Shared between the CLI bundler (pre-upload), the local `dev` runner, and
+* the server-side deploy hint so dev / deploy / prod all describe the fix
+* identically. Customer functions run as Module Workers; the legacy
+* service-worker shape (`export default async function (req) { … }`) is
+* rejected by the runtime at upload, so we reject it before the round-trip.
+*/
+const HANDLER_SHAPE_FIX_MESSAGE = "Function entrypoint must `export default { async fetch(req, env, ctx) { … } }` (the Module Worker shape). Found a default-exported function instead.";
+/** Message used when the entry file has no `export default` at all. */
+const HANDLER_SHAPE_MISSING_DEFAULT_MESSAGE = "Function entrypoint must `export default { async fetch(req, env, ctx) { … } }` (the Module Worker shape). No default export was found.";
+/** Message used when the default export is present but has no `fetch` method. */
+const HANDLER_SHAPE_NO_FETCH_MESSAGE = "Function entrypoint must `export default { async fetch(req, env, ctx) { … } }` (the Module Worker shape). The default export has no `fetch` method.";
+/**
+* Thrown when the bundled entry's `export default` is not the Module Worker
+* shape (`{ fetch(req, env, ctx) }`). Raised BEFORE any upload so a wrong
+* handler shape fails fast on the developer's machine with an actionable
+* message instead of an opaque upstream rejection at deploy time.
+*/
+var HandlerShapeError = class extends Error {
+	kind;
+	constructor(message, kind) {
+		super(message);
+		this.kind = kind;
+		this.name = "HandlerShapeError";
+	}
+};
+/**
+* Inspect an already-imported module namespace and assert it has the
+* Module Worker handler shape: a default export that is an object (or
+* function-with-properties) carrying a callable `fetch`.
+*
+* Pure + side-effect free — it only reads the shape of `mod.default`, never
+* invokes `fetch`. This is the unit-testable core; `assertModuleWorkerShape`
+* wraps the import-from-code plumbing around it.
+*
+* Throws `HandlerShapeError` on:
+*   - no default export (`missing-default`)
+*   - a default-exported plain function — the legacy service-worker shape
+*     (`plain-function`)
+*   - a default export with no callable `fetch` (`no-fetch`)
+*/
+function assertHandlerShape(mod) {
+	const def = mod.default;
+	if (def === void 0 || def === null) throw new HandlerShapeError(HANDLER_SHAPE_MISSING_DEFAULT_MESSAGE, "missing-default");
+	if (typeof def === "function") {
+		if (typeof def.fetch !== "function") throw new HandlerShapeError(HANDLER_SHAPE_FIX_MESSAGE, "plain-function");
+		return;
+	}
+	if (typeof def !== "object") throw new HandlerShapeError(HANDLER_SHAPE_NO_FETCH_MESSAGE, "no-fetch");
+	if (typeof def.fetch !== "function") throw new HandlerShapeError(HANDLER_SHAPE_NO_FETCH_MESSAGE, "no-fetch");
+}
+/**
+* Validate that the bundled customer code exports the Module Worker handler
+* shape, by importing it in isolation and inspecting `mod.default`.
+*
+* Mechanism: write the bundle to a throwaway temp `.mjs` and dynamic-import
+* it, then hand the namespace to `assertHandlerShape`. This is the same
+* import-and-inspect approach the local `dev` runner uses
+* (`functions.ts` DEV_RUNNER_SOURCE) — reused here so the pre-upload check
+* and the dev runner agree on what "valid shape" means. Importing runs the
+* module's top-level code (unavoidable to read the export), but the handler
+* itself is NEVER invoked — we only read the shape of the exported object.
+*
+* The temp file is always cleaned up (best-effort) before returning.
+*/
+async function assertModuleWorkerShape(code) {
+	const dir = await mkdtemp(join(tmpdir(), "amba-fn-shape-"));
+	const filePath = join(dir, "fn.mjs");
+	try {
+		await writeFile(filePath, code, "utf8");
+		let mod;
+		try {
+			mod = await import(pathToFileURL(filePath).href);
+		} catch (err) {
+			throw new Error(`Failed to load the function entrypoint while validating its handler shape: ${err instanceof Error ? err.message : String(err)}`);
+		}
+		assertHandlerShape(mod);
+	} finally {
+		await rm(dir, {
+			recursive: true,
+			force: true
+		}).catch(() => {});
+	}
+}
+/**
 * Bundle a customer function file for upload to a Workers dispatch
 * namespace. Returns the bundled code + metadata; throws
 * `BundleSizeError` when the compressed size exceeds the cap so the CLI
@@ -5043,6 +5672,7 @@ async function bundleFunction(options) {
 	const compressedSize = await gzipSizeOf(output.contents);
 	const max = options.maxSizeBytes ?? 8388608;
 	if (compressedSize > max) throw new BundleSizeError(compressedSize, max);
+	if (options.validateHandlerShape !== false) await assertModuleWorkerShape(code);
 	return {
 		code,
 		sha256: await hashSha256Hex(output.contents),
@@ -5091,16 +5721,19 @@ function formatBytes$1(n) {
 * records the deployment in a single round-trip. The other subcommands
 * are thin shells over the admin API helpers in `api-client.ts`.
 */
-async function functionsDeployCommand(entryPoint, options = {}) {
+async function functionsDeployCommand(target, options = {}) {
 	const projectId = (await loadProjectConfig()).projectId;
-	const functionName = options.name ?? basename(entryPoint).replace(/\.[^.]+$/, "");
+	const targetIsDir = (await stat(target).catch(() => null))?.isDirectory() ?? false;
+	const entryPoint = await resolveFunctionEntry(target, options.entry);
+	const defaultName = targetIsDir ? basename(target.replace(/[/\\]+$/, "")) : basename(entryPoint).replace(/\.[^.]+$/, "");
+	const functionName = options.name ?? defaultName;
 	validateFunctionName(functionName);
 	const rateLimit = parseRateLimitFlags(options);
 	console.log();
 	console.log(pc.bold(`  amba functions deploy ${pc.cyan(functionName)}`));
 	console.log(pc.dim("  ─────────────────────────────────"));
 	console.log();
-	console.log(pc.dim("  Bundling…"));
+	console.log(pc.dim(`  Bundling ${entryPoint}…`));
 	const bundle = await bundleFunction({ entryPoint });
 	printBundleReport(bundle);
 	if (options.dryRun) {
@@ -5113,7 +5746,8 @@ async function functionsDeployCommand(entryPoint, options = {}) {
 		result = await deployFunctionViaApi(projectId, {
 			name: functionName,
 			bundleCode: bundle.code,
-			rate_limit: rateLimit
+			rate_limit: rateLimit,
+			public: options.public === true ? true : void 0
 		});
 	} catch (err) {
 		if (err instanceof ApiClientError && err.statusCode === 503) {
@@ -5126,6 +5760,7 @@ async function functionsDeployCommand(entryPoint, options = {}) {
 	console.log(pc.green("  ✓") + ` Deployed ${pc.cyan(functionName)} ${pc.dim(`v${result.data.version}`)}`);
 	console.log(pc.green("  ✓") + ` URL: ${pc.underline(result.fn_url)}`);
 	if (rateLimit) console.log(pc.dim(`  Rate limit: ${rateLimit.max} per ${rateLimit.window} (key=${rateLimit.key}) — enforced pre-dispatch`));
+	if (options.public === true) console.log(pc.yellow("  ! Public") + pc.dim(" — no X-Api-Key required. Verify the webhook signature inside your handler."));
 	console.log();
 }
 async function functionsListCommand() {
@@ -5481,11 +6116,15 @@ try {
       return fetchFn(req, env, ctx);
     };
   } else if (typeof mod.default === 'function') {
-    // Legacy plain-function shape — still accepted for backward compat but env
-    // parameter is not available (secrets only reachable via process.env).
-    handler = mod.default;
+    // Legacy service-worker shape (\`export default async function (req) { ... }\`).
+    // REJECTED — production runs functions as Module Workers and the runtime
+    // rejects this shape at upload. Accepting it in dev was a dev/prod parity
+    // trap: a function that ran here would fail \`amba functions deploy\`. Reject
+    // with the same fix the bundler + server hint use so dev and prod agree.
+    process.stderr.write('  Error: Function entrypoint must \`export default { async fetch(req, env, ctx) { … } }\` (the Module Worker shape). Found a default-exported function instead.\\n');
+    process.exit(2);
   } else {
-    process.stderr.write('  Error: entry file must export default { async fetch(req, env, ctx) { ... } }\\n');
+    process.stderr.write('  Error: Function entrypoint must \`export default { async fetch(req, env, ctx) { … } }\` (the Module Worker shape). The default export has no \`fetch\` method.\\n');
     process.exit(2);
   }
 } catch (err) {
@@ -5634,6 +6273,10 @@ function parseRateLimitFlags(options) {
 *   - `--tail`: print the last hour's events, then poll every 3s for
 *     new events past the highest seen `EventTimestampMs`. Ctrl+C to stop.
 *
+* `--since-request-id <r_...>` anchors the range start at the oldest event
+* mentioning that request id ("show me everything from this request
+* onward") — the server resolves the anchor; works in both modes.
+*
 * Output formatting:
 *   - `--json`: NDJSON to stdout (one event per line) so `| jq` works.
 *   - default: human-readable lines:
@@ -5653,8 +6296,11 @@ async function functionsLogsCommand(functionName, options = {}) {
 	const res = await getFunctionLogs(projectConfig.projectId, functionName, {
 		since: options.since,
 		until: options.until,
-		limit: options.limit
+		limit: options.limit,
+		requestId: options.requestId,
+		sinceRequestId: options.sinceRequestId
 	});
+	if (res.data.anchor && !options.json) console.error(pc.dim(`  Anchored at ${res.data.anchor} (--since-request-id).`));
 	printEvents(res.data.events, options.json);
 	if (res.data.truncated) if (options.json) process.stderr.write(`{"truncated":true}\n`);
 	else console.error(pc.yellow(`  ! Result truncated at limit; narrow --since / --until or raise --limit.`));
@@ -5662,20 +6308,33 @@ async function functionsLogsCommand(functionName, options = {}) {
 async function runTail(projectId, functionName, options) {
 	let sinceMs = options.since ? Date.parse(options.since) : Date.now() - 3600 * 1e3;
 	if (Number.isNaN(sinceMs)) throw new Error("--since must be a valid ISO 8601 timestamp");
-	if (!options.json) console.error(pc.dim(`  Tailing ${functionName} — Ctrl+C to stop. Initial backfill from ${new Date(sinceMs).toISOString()}.`));
+	if (!options.json) console.error(pc.dim(options.sinceRequestId ? `  Tailing ${functionName} — Ctrl+C to stop. Anchoring backfill at request ${options.sinceRequestId}.` : `  Tailing ${functionName} — Ctrl+C to stop. Initial backfill from ${new Date(sinceMs).toISOString()}.`));
 	let highWaterMs = sinceMs;
+	let firstFetch = true;
 	for (;;) {
 		let result;
+		const anchored = firstFetch && options.sinceRequestId !== void 0;
 		try {
 			result = await getFunctionLogs(projectId, functionName, {
-				since: new Date(highWaterMs).toISOString(),
-				limit: options.limit ?? 200
+				...anchored ? { sinceRequestId: options.sinceRequestId } : { since: new Date(highWaterMs).toISOString() },
+				...anchored && options.since ? { since: options.since } : {},
+				limit: options.limit ?? 200,
+				requestId: options.requestId
 			});
 		} catch (err) {
+			if (anchored) throw err;
 			console.error(pc.yellow(`  ! tail fetch failed: `) + (err instanceof Error ? err.message : String(err)));
 			await sleep$1(TAIL_POLL_MS);
 			continue;
 		}
+		if (anchored) {
+			firstFetch = false;
+			if (result.data.anchor) {
+				if (!options.json) console.error(pc.dim(`  Anchored at ${result.data.anchor} (--since-request-id).`));
+				const anchorMs = Date.parse(result.data.anchor);
+				if (!Number.isNaN(anchorMs)) highWaterMs = anchorMs;
+			}
+		}
 		if (result.data.events.length > 0) {
 			printEvents(result.data.events, options.json);
 			highWaterMs = result.data.events.reduce((m, e) => Math.max(m, e.EventTimestampMs ?? 0), highWaterMs) + 1;
@@ -5900,7 +6559,7 @@ function renderStatus(status) {
 * Project is resolved via `loadProjectConfig` (AMBA_PROJECT_ID env, then
 * .env / .env.local in the cwd) — same pattern as `amba secrets *`.
 */
-function handleError(err) {
+function handleError$1(err) {
 	if (err instanceof ApiClientError) if (err.statusCode === 401 || err.statusCode === 403) console.log(pc.red("  ✗") + " Not authenticated — run `amba login` first.");
 	else console.log(pc.red("  ✗") + ` ${err.message}`);
 	else if (err instanceof Error) console.log(pc.red("  ✗") + ` ${err.message}`);
@@ -5914,7 +6573,7 @@ function handleError(err) {
 * its own request wrapper — same auth flow as `request()` in api-client,
 * intentionally not exported there so we don't grow the public surface.
 */
-async function adminWrite(method, path, body) {
+async function adminWrite$1(method, path, body) {
 	const token = await resolveBearerToken();
 	const url = `${process.env["AMBA_API_URL"] ?? "https://api.amba.dev"}/v1/admin${path}`;
 	const res = await fetch(url, {
@@ -5940,6 +6599,11 @@ async function adminWrite(method, path, body) {
 	}
 	return await res.json();
 }
+/** Append "· $X.XX" to a usage line when the meter accrued cost this period. */
+function costSuffix(cost) {
+	if (!cost || cost.cost_usd <= 0) return "";
+	return `  ${pc.yellow(`$${cost.cost_usd.toFixed(2)}`)}`;
+}
 function formatAxis(label, axis, isStorage) {
 	const used = axis.used === null ? "—" : isStorage ? axis.used >= 1024 ? `${(axis.used / 1024).toFixed(2)} GB` : `${axis.used} MB` : axis.used.toLocaleString();
 	const limit = axis.limit === null ? "unlimited" : isStorage ? axis.limit >= 1024 ? `${(axis.limit / 1024).toFixed(0)} GB` : `${axis.limit} MB` : axis.limit.toLocaleString();
@@ -5957,18 +6621,29 @@ async function billingStatusCommand() {
 		console.log(`  Tier:               ${pc.bold(s.tier)}`);
 		console.log(`  Subscription:       ${s.subscription_status ?? pc.dim("—")}`);
 		console.log(`  Next bill anchor:   ${s.current_period_end ? new Date(s.current_period_end).toLocaleDateString() : pc.dim("—")}`);
-		console.log(`  Spend ceiling:      ${s.ceiling_usd === null ? pc.dim("no cap") : `$${s.ceiling_usd}`}`);
+		const pctCeiling = s.ceiling_pct_consumed === null || s.ceiling_pct_consumed === void 0 ? null : Math.round(s.ceiling_pct_consumed * 100);
+		console.log(`  Spend ceiling:      ${s.ceiling_usd === null ? pc.dim("no cap") : `$${s.ceiling_usd}${pctCeiling === null ? "" : pc.dim(` (${pctCeiling}% consumed)`)}`}`);
 		console.log(`  Spend mode:         ${s.mode}`);
 		console.log(`  Projected overage:  $${s.projected_overage_usd_this_month.toFixed(2)}`);
+		if (s.projected_end_of_period_overage_usd !== void 0 && s.period) console.log(`  End-of-period est.: $${s.projected_end_of_period_overage_usd.toFixed(2)} ${pc.dim(`(period resets ${new Date(s.period.resets_at).toLocaleDateString()})`)}`);
 		if (s.paused_at) console.log(`  ${pc.yellow("Paused at:")}          ${s.paused_at} ${pc.dim("(wakes on next request)")}`);
+		if (s.enforcement?.read_only) {
+			console.log();
+			console.log(pc.red("  READ-ONLY MODE: ") + "spend ceiling reached — metered writes return 402 until the period resets or the ceiling is raised.");
+		} else if (s.enforcement && s.enforcement.over_quota_meters.length > 0) {
+			console.log();
+			console.log(pc.yellow("  Over quota: ") + s.enforcement.over_quota_meters.join(", ") + pc.dim(" — writes on these meters are refused on throttle mode (402; new signups 429 at the MAU quota)."));
+		}
 		console.log();
 		console.log(pc.bold("  Usage — rolling 30 days"));
-		console.log(formatAxis("Monthly active users", s.headroom.mau, false));
-		console.log(formatAxis("Engagement events", s.headroom.engagement_events, false));
-		console.log(formatAxis("Telemetry events", s.headroom.telemetry_events, false));
-		console.log(formatAxis("Push deliveries", s.headroom.push, false));
-		console.log(formatAxis("Database storage", s.headroom.db_storage_mb, true));
-		console.log(formatAxis("Media storage", s.headroom.media_storage_mb, true));
+		const cost = s.usage_cost_by_meter ?? {};
+		console.log(formatAxis("Monthly active users", s.headroom.mau, false) + costSuffix(cost.mau));
+		console.log(formatAxis("Engagement events", s.headroom.engagement_events, false) + costSuffix(cost.engagement_events));
+		console.log(formatAxis("Telemetry events", s.headroom.telemetry_events, false) + costSuffix(cost.telemetry_events));
+		console.log(formatAxis("Push deliveries", s.headroom.push, false) + costSuffix(cost.push));
+		console.log(formatAxis("Database storage", s.headroom.db_storage_mb, true) + costSuffix(cost.db_storage_mb));
+		console.log(formatAxis("Media storage", s.headroom.media_storage_mb, true) + costSuffix(cost.media_storage_mb));
+		if (s.headroom.app_mcp_tool_calls) console.log(formatAxis("Agent tool calls", s.headroom.app_mcp_tool_calls, false) + costSuffix(cost.app_mcp_tool_calls));
 		console.log();
 		if (s.human_action_required !== "none") {
 			const action = s.human_action_required.replaceAll("_", " ");
@@ -5976,7 +6651,7 @@ async function billingStatusCommand() {
 			console.log();
 		}
 	} catch (err) {
-		handleError(err);
+		handleError$1(err);
 	}
 }
 async function billingUpgradeCommand(input) {
@@ -5987,7 +6662,7 @@ async function billingUpgradeCommand(input) {
 	try {
 		const { projectId } = await loadProjectConfig();
 		const interval = input.interval ?? "month";
-		const res = await adminWrite("POST", `/projects/${projectId}/billing/checkout`, {
+		const res = await adminWrite$1("POST", `/projects/${projectId}/billing/checkout`, {
 			tier: input.tier,
 			interval
 		});
@@ -6001,7 +6676,7 @@ async function billingUpgradeCommand(input) {
 		console.log(pc.dim("  Subscription status updates automatically once Stripe confirms (a few seconds)."));
 		console.log();
 	} catch (err) {
-		handleError(err);
+		handleError$1(err);
 	}
 }
 async function billingPortalCommand() {
@@ -6011,13 +6686,13 @@ async function billingPortalCommand() {
 	console.log();
 	try {
 		const { projectId } = await loadProjectConfig();
-		const res = await adminWrite("POST", `/projects/${projectId}/billing/portal`);
+		const res = await adminWrite$1("POST", `/projects/${projectId}/billing/portal`);
 		console.log(pc.bold("  Open this URL to manage your subscription:"));
 		console.log();
 		console.log(`  ${pc.cyan(res.data.url)}`);
 		console.log();
 	} catch (err) {
-		handleError(err);
+		handleError$1(err);
 	}
 }
 async function billingSetCeilingCommand(input) {
@@ -6027,92 +6702,513 @@ async function billingSetCeilingCommand(input) {
 	console.log();
 	try {
 		const { projectId } = await loadProjectConfig();
-		await adminWrite(`PUT`, `/projects/${projectId}/billing/ceiling`, { ceiling_usd: input.ceiling });
+		await adminWrite$1(`PUT`, `/projects/${projectId}/billing/ceiling`, { ceiling_usd: input.ceiling });
 		if (input.ceiling === null) console.log(pc.green("  ✓") + " Spend ceiling removed (linear overage continues).");
 		else console.log(pc.green("  ✓") + ` Spend ceiling set to $${input.ceiling}/mo.`);
 		console.log();
 	} catch (err) {
-		handleError(err);
+		handleError$1(err);
 	}
 }
 //#endregion
-//#region src/commands/collections.ts
+//#region src/commands/payments.ts
 /**
-* `amba collections ...` — thin shells over the admin collection routes.
-*
-* Wire shapes:
-*
-*   POST   /admin/projects/:p/collections             — create (full schema)
-*   GET    /admin/projects/:p/collections             — list
-*   PATCH  /admin/projects/:p/collections/:name       — single-op alter
-*   DELETE /admin/projects/:p/collections/:name       — drop (requires ?confirm)
-*
-* The CLI's job is to:
-*   1. Validate names / types client-side so an obviously-bad invocation
-*      doesn't round-trip.
-*   2. Translate the user-friendly CLI flag shape (`--field name:type`,
-*      `--add-field`, `--drop-field`) into the wire shape (single op per
-*      PATCH).
-*   3. Block until the server reports success.
-*   4. Surface server errors with a sensible CLI message.
-*
-* Multi-op alters are issued sequentially so the operator audit trail
-* stays one-to-one with developer actions.
+* `amba payments *` subcommands — CLI access to the Amba Payments (Stripe
+* Connect platform) surface at `/v1/admin/projects/:id/payments/*`
+* (tracker #10).
+*
+* Amba is the payments rail for the developer's app: the app is the seller,
+* Amba takes a platform fee, Stripe carries money-transmission. This is the
+* developer-facing onboarding + config + reporting surface, so naming Stripe
+* here is by intent (same as `amba billing`).
+*
+*   amba payments setup                    — create the connected account +
+*                                            print the hosted onboarding URL.
+*   amba payments status                   — onboarding stage + capability flags.
+*   amba payments set-fee <bps|off>        — default platform fee (basis points).
+*   amba payments balance                  — connected-account balance.
+*   amba payments payouts                  — recent payouts.
+*
+* Every live call is gated by the platform's PAYMENTS_CONNECT_LIVE
+* kill-switch — when off the API returns PAYMENTS_NOT_ENABLED, surfaced
+* verbatim here. Project resolved via loadProjectConfig (same as billing).
 */
+function handleError(err) {
+	if (err instanceof ApiClientError) if (err.statusCode === 401 || err.statusCode === 403) console.log(pc.red("  ✗") + " Not authenticated — run `amba login` first.");
+	else if (err.errorCode === "PAYMENTS_NOT_ENABLED") console.log(pc.yellow("  •") + " Payments are not enabled on this Amba platform yet. The platform owner must finish setup before payments go live.");
+	else console.log(pc.red("  ✗") + ` ${err.message}`);
+	else if (err instanceof Error) console.log(pc.red("  ✗") + ` ${err.message}`);
+	else console.log(pc.red("  ✗") + " Unknown error");
+	console.log();
+	process.exit(1);
+}
 /**
-* Closed-set type catalog. Matches data's `ColumnType` exactly — keeps
-* the CLI fail-fast path aligned with the DDL emit's accepted shapes.
-*
-* The CLI accepts customer-friendly synonyms (e.g. `int` → `integer`)
-* via `normalizeColumnType` so the `--field` flag stays ergonomic
-* without the API needing to relax its closed catalog.
+* POST/PUT to the admin API. Mirrors the helper in billing.ts (api-client
+* doesn't export a generic write for arbitrary paths).
 */
-const ALLOWED_TYPES = new Set([
-	"uuid",
-	"text",
-	"integer",
-	"bigint",
-	"numeric",
-	"boolean",
-	"timestamptz",
-	"date",
-	"jsonb",
-	"vector"
-]);
-const TYPE_SYNONYMS = {
-	int: "integer",
-	int4: "integer",
-	int8: "bigint",
-	bool: "boolean",
-	json: "jsonb",
-	string: "text"
-};
-async function collectionsCreateCommand(name, options) {
-	const reason = getReservationReason(name);
-	if (reason) throw new Error(`Cannot create collection '${name}': ${reason}`);
-	const columns = options.field.map(parseColumnSpec);
-	const indexes = options.index.map(parseIndexSpec);
-	const projectConfig = await loadProjectConfig();
-	console.log();
-	console.log(pc.bold(`  amba collections create ${pc.cyan(name)}`));
-	for (const c of columns) console.log(pc.dim("    ") + c.name + pc.dim(": ") + c.type + (c.nullable ? pc.dim(" NULL") : pc.dim(" NOT NULL")));
-	console.log();
-	const res = await createCollection(projectConfig.projectId, {
-		name,
-		columns,
-		indexes
+async function adminWrite(method, path, body) {
+	const token = await resolveBearerToken();
+	const url = `${process.env["AMBA_API_URL"] ?? "https://api.amba.dev"}/v1/admin${path}`;
+	const res = await fetch(url, {
+		method,
+		headers: {
+			Authorization: `Bearer ${token}`,
+			"Content-Type": "application/json",
+			"User-Agent": "amba-cli/0.1.1"
+		},
+		body: body === void 0 ? void 0 : JSON.stringify(body)
 	});
-	console.log(pc.green("  ✓") + ` Created — version ${res.data.version}`);
-	console.log(pc.dim(`    workflow_id: ${res.data.workflow_id}`));
-	console.log();
+	if (!res.ok) {
+		let message = `API request failed: ${res.status} ${res.statusText}`;
+		let code;
+		try {
+			const errorBody = await res.json();
+			if (errorBody.error?.message) {
+				message = errorBody.error.message;
+				code = errorBody.error.code;
+			}
+		} catch {}
+		throw new ApiClientError(message, res.status, code);
+	}
+	return await res.json();
 }
-async function collectionsAlterCommand(name, options) {
-	if (options.addField.length === 0 && options.dropField.length === 0 && options.addIndex.length === 0) throw new Error("amba collections alter: at least one of --add-field, --add-index, or --drop-field is required.");
-	const confirmed = new Set(options.confirm ?? []);
-	for (const col of options.dropField) if (!confirmed.has(col)) throw new Error(`Refusing to drop column '${col}' without --confirm ${col} (DROP COLUMN is destructive).`);
-	const projectConfig = await loadProjectConfig();
-	for (const fieldSpec of options.addField) {
-		const column = parseColumnSpec(fieldSpec);
+function printAccount(a) {
+	console.log(`  Account:            ${pc.dim(a.stripe_account_id)}`);
+	console.log(`  Onboarding:         ${pc.bold(a.onboarding_status)}`);
+	console.log(`  Charges enabled:    ${a.charges_enabled ? pc.green("yes") : pc.yellow("no")}`);
+	console.log(`  Payouts enabled:    ${a.payouts_enabled ? pc.green("yes") : pc.yellow("no")}`);
+	console.log(`  Country:            ${a.country ?? pc.dim("—")}`);
+	console.log(`  Default fee:        ${a.default_platform_fee_bps === null ? pc.dim("none") : `${a.default_platform_fee_bps} bps (${(a.default_platform_fee_bps / 100).toFixed(2)}%)`}`);
+}
+async function paymentsSetupCommand(input) {
+	console.log();
+	console.log(pc.bold("  amba payments setup"));
+	console.log(pc.dim("  ─────────────────────────────────"));
+	console.log();
+	try {
+		const { projectId } = await loadProjectConfig();
+		printAccount((await adminWrite("POST", `/projects/${projectId}/payments/accounts`, {
+			...input.country ? { country: input.country } : {},
+			...input.email ? { email: input.email } : {}
+		})).data);
+		console.log();
+		const link = await adminWrite("POST", `/projects/${projectId}/payments/accounts/link`);
+		console.log(pc.bold("  Open this URL to finish setting up payments:"));
+		console.log();
+		console.log(`  ${pc.cyan(link.data.url)}`);
+		console.log();
+		console.log(pc.dim("  Status updates automatically once setup completes."));
+		console.log();
+	} catch (err) {
+		handleError(err);
+	}
+}
+async function paymentsStatusCommand() {
+	console.log();
+	console.log(pc.bold("  amba payments status"));
+	console.log(pc.dim("  ─────────────────────────────────"));
+	console.log();
+	try {
+		const { projectId } = await loadProjectConfig();
+		const res = await adminGet(`/projects/${projectId}/payments/accounts`);
+		if (!res.data.connected_account) {
+			console.log(pc.dim("  No payments account yet. Run `amba payments setup`."));
+			console.log();
+			return;
+		}
+		printAccount(res.data.connected_account);
+		console.log();
+	} catch (err) {
+		handleError(err);
+	}
+}
+async function paymentsSetFeeCommand(input) {
+	console.log();
+	console.log(pc.bold("  amba payments set-fee"));
+	console.log(pc.dim("  ─────────────────────────────────"));
+	console.log();
+	try {
+		const { projectId } = await loadProjectConfig();
+		await adminWrite("PUT", `/projects/${projectId}/payments/config`, { default_platform_fee_bps: input.bps });
+		if (input.bps === null) console.log(pc.green("  ✓") + " Default platform fee cleared.");
+		else console.log(pc.green("  ✓") + ` Default platform fee set to ${input.bps} bps (${(input.bps / 100).toFixed(2)}%).`);
+		console.log();
+	} catch (err) {
+		handleError(err);
+	}
+}
+async function paymentsBalanceCommand() {
+	console.log();
+	console.log(pc.bold("  amba payments balance"));
+	console.log(pc.dim("  ─────────────────────────────────"));
+	console.log();
+	try {
+		const { projectId } = await loadProjectConfig();
+		const res = await adminGet(`/projects/${projectId}/payments/balance`);
+		const fmt = (b) => `${(b.amount / 100).toFixed(2)} ${b.currency.toUpperCase()}`;
+		console.log(`  Available:  ${res.data.available.length ? res.data.available.map(fmt).join(", ") : pc.dim("—")}`);
+		console.log(`  Pending:    ${res.data.pending.length ? res.data.pending.map(fmt).join(", ") : pc.dim("—")}`);
+		console.log();
+	} catch (err) {
+		handleError(err);
+	}
+}
+async function paymentsPayoutsCommand(input) {
+	console.log();
+	console.log(pc.bold("  amba payments payouts"));
+	console.log(pc.dim("  ─────────────────────────────────"));
+	console.log();
+	try {
+		const { projectId } = await loadProjectConfig();
+		const res = await adminGet(`/projects/${projectId}/payments/payouts${input.limit ? `?limit=${input.limit}` : ""}`);
+		if (res.data.length === 0) {
+			console.log(pc.dim("  No payouts yet."));
+			console.log();
+			return;
+		}
+		for (const p of res.data) {
+			const arrival = (/* @__PURE__ */ new Date(p.arrival_date * 1e3)).toLocaleDateString();
+			console.log(`  ${pc.dim(p.id.padEnd(28))} ${(p.amount / 100).toFixed(2)} ${p.currency.toUpperCase().padEnd(4)} ${pc.dim(p.status.padEnd(12))} arrives ${arrival}`);
+		}
+		console.log();
+	} catch (err) {
+		handleError(err);
+	}
+}
+//#endregion
+//#region src/commands/monetization.ts
+/**
+* `amba monetization *` subcommands — CLI access to the monetization control
+* plane behind `/v1/admin/projects/:id/monetization/*`.
+*
+*   amba monetization plan     — three-way diff (declared vs adopted baseline
+*                                vs live provider) + store-floor preflight +
+*                                drift. READ-ONLY — previews; applies nothing.
+*   amba monetization drift    — out-of-band changes to Amba-managed objects.
+*   amba monetization export   — snapshot the live config to a declarative
+*                                bundle (the `monetization` section), to stdout
+*                                or a file.
+*   amba monetization adopt    — record the live config as the managed baseline
+*                                so the next plan is a no-op. Writes ONLY Amba's
+*                                own state — never the provider. Idempotent.
+*   amba monetization apply    — push the declared config to the provider.
+*                                DURABLE: the API returns a pollable
+*                                operation_id and the CLI polls it to a
+*                                terminal state. Additive changes apply
+*                                automatically; destructive changes run only
+*                                behind --confirm (which approves the exact
+*                                plan_hash — a pending apply awaiting
+*                                confirmation is approved by re-running with
+*                                --confirm). STORE-PRODUCT steps (creating
+*                                declared products in the provider and, for
+*                                App Store products with push intent, in App
+*                                Store Connect) ALWAYS wait for an explicit
+*                                approval of the started apply — an up-front
+*                                --confirm never auto-runs them. Refuses if
+*                                the provider drifted since the plan.
+*
+* Project is resolved via `loadProjectConfig` — same pattern as the other
+* project-scoped CLI commands.
+*/
+/**
+* Authenticated write helper (POST). Mirrors the `adminWrite` in
+* `commands/billing.ts` — kept local so the api-client public surface doesn't
+* grow a generic POST.
+*/
+async function adminPost(path, body) {
+	const token = await resolveBearerToken();
+	const url = `${process.env["AMBA_API_URL"] ?? "https://api.amba.dev"}/v1/admin${path}`;
+	const res = await fetch(url, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${token}`,
+			"Content-Type": "application/json",
+			"User-Agent": "amba-cli/0.1.1"
+		},
+		body: body === void 0 ? void 0 : JSON.stringify(body)
+	});
+	if (!res.ok) {
+		let message = `API request failed: ${res.status} ${res.statusText}`;
+		let code;
+		try {
+			const errorBody = await res.json();
+			if (errorBody.error?.message) {
+				message = errorBody.error.message;
+				code = errorBody.error.code;
+			}
+		} catch {}
+		throw new ApiClientError(message, res.status, code);
+	}
+	return await res.json();
+}
+function header(title) {
+	console.log();
+	console.log(pc.bold(`  amba monetization ${title}`));
+	console.log(pc.dim("  ─────────────────────────────────"));
+	console.log();
+}
+async function monetizationPlanCommand() {
+	const { projectId } = await loadProjectConfig();
+	header("plan");
+	const plan = (await adminGet(`/projects/${projectId}/monetization/plan`)).data;
+	if (plan.clean) {
+		console.log(pc.green("  ✓") + " No changes — declared config matches the live provider.");
+		console.log();
+		return;
+	}
+	if (plan.ops.length > 0) {
+		console.log(pc.bold("  Pending operations (preview — nothing is applied):"));
+		for (const op of plan.ops) console.log(`    ${pc.cyan(op.op.padEnd(12))} ${pc.bold(op.object_type)} ${op.identifier}  ${pc.dim(`[${op.status}]`)}`);
+		console.log();
+	}
+	if (plan.store_floor.length > 0) {
+		console.log(pc.yellow("  Store-floor preflight — blocking gaps apply can neither resolve nor create:"));
+		for (const sf of plan.store_floor) {
+			console.log(`    ${pc.bold(sf.product_key)} → ${sf.store_identifier} (${sf.store})`);
+			console.log(pc.dim(`      ${sf.reason}`));
+		}
+		console.log();
+	}
+	printHumanFloor(plan.human_floor);
+	if (plan.drift.length > 0) {
+		console.log(pc.yellow("  Drift — managed objects changed out-of-band in the provider:"));
+		for (const d of plan.drift) console.log(`    ${pc.bold(d.object_type)} ${d.identifier}`);
+		console.log();
+	}
+}
+/** Print the store-side human-floor checklist (exact console locations). */
+function printHumanFloor(items) {
+	if (!items || items.length === 0) return;
+	console.log(pc.yellow("  Store checklist — steps no API can do (with exact locations):"));
+	for (const h of items) {
+		console.log(`    ${pc.bold("□")} ${h.title}${h.product_key ? pc.dim(` (${h.product_key})`) : ""}`);
+		console.log(pc.dim(`      ${h.detail}`));
+		console.log(pc.dim(`      where: ${h.location}`));
+	}
+	console.log();
+}
+async function monetizationDriftCommand() {
+	const { projectId } = await loadProjectConfig();
+	header("drift");
+	const data = (await adminGet(`/projects/${projectId}/monetization/drift`)).data;
+	if (!data.has_drift) {
+		console.log(pc.green("  ✓") + " No drift — managed config matches the live provider.");
+		console.log();
+		return;
+	}
+	console.log(pc.yellow("  Drift detected:"));
+	for (const d of data.drift) console.log(`    ${pc.bold(d.object_type)} ${d.identifier}`);
+	console.log();
+}
+async function monetizationExportCommand(options = {}) {
+	const { projectId } = await loadProjectConfig();
+	const bundle = {
+		version: 1,
+		monetization: (await adminGet(`/projects/${projectId}/monetization/export`)).data.monetization
+	};
+	const json = JSON.stringify(bundle, null, 2);
+	if (options.file) {
+		await writeFile(resolve(options.file), json + "\n", "utf-8");
+		console.log();
+		console.log(pc.green("  ✓") + ` Wrote live monetization config to ${pc.cyan(options.file)}.`);
+		console.log();
+	} else console.log(json);
+}
+async function monetizationAdoptCommand(options = {}) {
+	const { projectId } = await loadProjectConfig();
+	header("adopt");
+	if (!options.all) {
+		console.log("  ✗ Pass --all to adopt the entire live config as the managed baseline.");
+		process.exit(1);
+	}
+	const d = (await adminPost(`/projects/${projectId}/monetization/adopt`, { adopt_all: true })).data;
+	console.log(pc.green("  ✓") + ` Adopted ${d.adopted} object(s) as the managed baseline ` + pc.dim(`(${d.entitlements} entitlements · ${d.products} products · ${d.offerings} offerings · ${d.packages} packages · ${d.paywalls} paywalls)`));
+	console.log(pc.dim("    The next `amba monetization plan` is now a clean no-op."));
+	console.log();
+}
+async function monetizationApplyCommand(options = {}) {
+	const { projectId } = await loadProjectConfig();
+	header("apply");
+	const plan = (await adminGet(`/projects/${projectId}/monetization/plan`)).data;
+	if (plan.store_floor.length > 0) {
+		console.log(pc.yellow("  Store floor not satisfied — apply can neither resolve nor create these:"));
+		for (const sf of plan.store_floor) {
+			console.log(`    ${pc.bold(sf.product_key)} → ${sf.store_identifier} (${sf.store})`);
+			console.log(pc.dim(`      ${sf.reason}`));
+		}
+		console.log();
+		console.log("  ✗ Fix the declaration (or connect the app), then run plan + apply again.");
+		process.exit(1);
+	}
+	if (plan.clean) {
+		console.log(pc.green("  ✓") + " Nothing to apply — declared config matches the provider.");
+		console.log();
+		return;
+	}
+	if (options.reconcile && options.reconcile !== "amba" && options.reconcile !== "adopt") {
+		console.log(pc.red("  ✗") + " --reconcile must be 'amba' or 'adopt'.");
+		process.exit(1);
+	}
+	const body = { plan_hash: plan.plan_hash };
+	if (options.confirm) body["confirm"] = plan.plan_hash;
+	if (options.allowDetachLive) body["allow_detach_live"] = true;
+	if (options.reconcile) body["reconcile"] = options.reconcile;
+	let start;
+	try {
+		start = (await adminPost(`/projects/${projectId}/monetization/apply`, body)).data;
+	} catch (err) {
+		if (err instanceof ApiClientError && err.errorCode === "MONETIZATION_APPLY_IN_PROGRESS") {
+			console.log(pc.yellow("  ⚠ An apply is already in progress for this project."));
+			console.log(pc.dim("    Wait for it to finish, or re-run with --confirm to approve a pending confirmation."));
+			console.log();
+			process.exit(1);
+		}
+		throw err;
+	}
+	if (start.refused.length > 0) {
+		console.log(pc.yellow("  Not applicable via API (do these in the provider dashboard):"));
+		for (const r of start.refused) console.log(`    ${pc.bold(r.op)} ${r.object_type} ${r.identifier}`);
+		console.log();
+	}
+	if (start.status === "succeeded") {
+		console.log(pc.green("  ✓") + " Nothing to apply — declared config matches the provider.");
+		console.log();
+		return;
+	}
+	if (start.confirm_required) {
+		const storeSteps = start.gated.filter((g) => g.store === true);
+		console.log(pc.yellow("  ⚠ This plan includes gated operation(s) — they are NOT applied yet."));
+		for (const g of start.gated) {
+			const tag = g.store === true ? pc.magenta(" [store]") : "";
+			console.log(`    ${pc.bold(g.op)} ${g.object_type} ${g.identifier}${tag}`);
+		}
+		console.log();
+		if (storeSteps.length > 0) console.log(pc.dim("    Store catalog steps require an explicit approval of THIS apply — an up-front --confirm never auto-runs them."));
+		printHumanFloor(start.human_floor);
+		console.log(pc.dim("    Review the plan, then approve the pending apply:"));
+		console.log(`    ${pc.cyan("amba monetization apply --confirm")}`);
+		console.log();
+		console.log(pc.dim(`    operation: ${start.operation_id}`));
+		console.log();
+		process.exit(1);
+	}
+	console.log(pc.dim(`  Applying… (operation ${start.operation_id} — safe to Ctrl-C; the apply continues)`));
+	const op = await pollApplyOperation(projectId, start.operation_id);
+	if (op.result?.sandbox_stage?.ran) {
+		const s = op.result.sandbox_stage;
+		const tag = s.passed ? pc.green("✓ sandbox passed") : pc.red("✗ sandbox failed");
+		console.log(`  ${tag} ` + pc.dim(s.detail));
+		console.log();
+	}
+	if (op.status === "succeeded") {
+		const r = op.result ?? {};
+		console.log(pc.green("  ✓") + ` Applied ${r.applied ?? 0} change(s) to the provider ` + pc.dim(`(${r.skipped_existing ?? 0} already present, ${r.gated_applied ?? 0} destructive)`));
+		console.log();
+		return;
+	}
+	console.log(pc.red("  ✗") + " Apply did not complete.");
+	if (op.failed_reason) console.log(pc.dim(`    ${op.failed_reason}`));
+	console.log();
+	process.exit(1);
+}
+/** Poll GET /operations/:id until the apply reaches a terminal state. */
+async function pollApplyOperation(projectId, operationId) {
+	const POLL_INTERVAL_MS = 3e3;
+	const deadline = Date.now() + 900 * 1e3;
+	for (;;) {
+		const op = (await adminGet(`/projects/${projectId}/operations/${operationId}`)).data;
+		if (op.status === "succeeded" || op.status === "failed") return op;
+		if (Date.now() >= deadline) {
+			console.log(pc.yellow(`  ⚠ Still running server-side (operation ${operationId}).`) + pc.dim(" Re-run `amba monetization plan` later — a clean plan means it finished."));
+			process.exit(1);
+		}
+		await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+	}
+}
+//#endregion
+//#region src/commands/collections.ts
+/**
+* `amba collections ...` — thin shells over the admin collection routes.
+*
+* Wire shapes:
+*
+*   POST   /admin/projects/:p/collections             — create (full schema)
+*   GET    /admin/projects/:p/collections             — list
+*   PATCH  /admin/projects/:p/collections/:name       — single-op alter
+*   DELETE /admin/projects/:p/collections/:name       — drop (requires ?confirm)
+*
+* The CLI's job is to:
+*   1. Validate names / types client-side so an obviously-bad invocation
+*      doesn't round-trip.
+*   2. Translate the user-friendly CLI flag shape (`--field name:type`,
+*      `--add-field`, `--drop-field`) into the wire shape (single op per
+*      PATCH).
+*   3. Block until the server reports success.
+*   4. Surface server errors with a sensible CLI message.
+*
+* Multi-op alters are issued sequentially so the operator audit trail
+* stays one-to-one with developer actions.
+*/
+/**
+* Closed-set type catalog. Matches data's `ColumnType` exactly — keeps
+* the CLI fail-fast path aligned with the DDL emit's accepted shapes.
+*
+* The CLI accepts customer-friendly synonyms (e.g. `int` → `integer`)
+* via `normalizeColumnType` so the `--field` flag stays ergonomic
+* without the API needing to relax its closed catalog.
+*/
+const ALLOWED_TYPES = new Set([
+	"uuid",
+	"text",
+	"integer",
+	"bigint",
+	"numeric",
+	"boolean",
+	"timestamptz",
+	"date",
+	"jsonb",
+	"vector",
+	"text[]",
+	"integer[]",
+	"bigint[]",
+	"numeric[]",
+	"boolean[]",
+	"uuid[]"
+]);
+const TYPE_SYNONYMS = {
+	int: "integer",
+	int4: "integer",
+	int8: "bigint",
+	bool: "boolean",
+	json: "jsonb",
+	string: "text"
+};
+async function collectionsCreateCommand(name, options) {
+	const reason = getReservationReason(name);
+	if (reason) throw new Error(`Cannot create collection '${name}': ${reason}`);
+	const columns = options.field.map(parseColumnSpec);
+	const indexes = options.index.map(parseIndexSpec);
+	const projectConfig = await loadProjectConfig();
+	console.log();
+	console.log(pc.bold(`  amba collections create ${pc.cyan(name)}`));
+	for (const c of columns) console.log(pc.dim("    ") + c.name + pc.dim(": ") + c.type + (c.nullable ? pc.dim(" NULL") : pc.dim(" NOT NULL")));
+	console.log();
+	const res = await createCollection(projectConfig.projectId, {
+		name,
+		columns,
+		indexes
+	});
+	console.log(pc.green("  ✓") + ` Created — version ${res.data.version}`);
+	console.log(pc.dim(`    workflow_id: ${res.data.workflow_id}`));
+	console.log();
+}
+async function collectionsAlterCommand(name, options) {
+	if (options.addField.length === 0 && options.dropField.length === 0 && options.addIndex.length === 0) throw new Error("amba collections alter: at least one of --add-field, --add-index, or --drop-field is required.");
+	const confirmed = new Set(options.confirm ?? []);
+	for (const col of options.dropField) if (!confirmed.has(col)) throw new Error(`Refusing to drop column '${col}' without --confirm ${col} (DROP COLUMN is destructive).`);
+	const projectConfig = await loadProjectConfig();
+	for (const fieldSpec of options.addField) {
+		const column = parseColumnSpec(fieldSpec);
 		const res = await alterCollection(projectConfig.projectId, name, { add_column: column });
 		console.log(pc.green("  ✓") + ` add column ${pc.cyan(column.name)} (${column.type}) — version ${res.data.version}`);
 	}
@@ -6144,7 +7240,10 @@ async function collectionsDropCommand(name, options = {}) {
 }
 function normalizeColumnType(raw) {
 	const baseRaw = (raw.split("(")[0] ?? raw).trim().toLowerCase();
-	const base = TYPE_SYNONYMS[baseRaw] ?? baseRaw;
+	const isArray = baseRaw.endsWith("[]");
+	const elementRaw = isArray ? baseRaw.slice(0, -2) : baseRaw;
+	const element = TYPE_SYNONYMS[elementRaw] ?? elementRaw;
+	const base = isArray ? `${element}[]` : element;
 	if (!ALLOWED_TYPES.has(base)) throw new Error(`Unknown type '${raw}'. Allowed: ${[...ALLOWED_TYPES].join(", ")}.`);
 	return base;
 }
@@ -6154,7 +7253,11 @@ function normalizeColumnType(raw) {
 * Accepted grammars:
 *
 *   1. **Plain column:** `name:type[:nullable]`
-*      Examples: `letter_id:uuid`, `parsed:jsonb:nullable`.
+*      Examples: `letter_id:uuid`, `parsed:jsonb:nullable`, `tags:text[]`,
+*      `scores:integer[]:nullable`. Array types (`text[]`, `integer[]`,
+*      `bigint[]`, `numeric[]`, `boolean[]`, `uuid[]`) follow the same
+*      grammar as scalars and unlock the contains/containedBy/overlaps
+*      query operators.
 *
 *   2. **Foreign key:** `name:type:fk(<table>[.<column>][:onDelete])`
 *      Examples:
@@ -6181,12 +7284,14 @@ function normalizeColumnType(raw) {
 * left-to-right: the third segment is the FK / vector / nullable
 * marker; if it's an FK or vector, the optional fourth segment is
 * `nullable`. Plain columns put `nullable` in slot 3.
+*
+* Exported for tests.
 */
 function parseColumnSpec(spec) {
 	const parts = spec.replace(/^([a-z_][a-z0-9_]*):vector\((\d+)\)/i, "$1:vector:$2").replace(/fk\(([^)]+)\)/i, (_match, inner) => {
 		return `fk(${inner.replace(/:/g, "|")})`;
 	}).split(":");
-	if (parts.length < 2 || parts.length > 4) throw new Error(`Invalid field spec '${spec}'. Grammar:\n  name:type[:nullable]                          (plain)\n  name:type:fk(table[.col][:onDelete])[:nullable] (foreign key)\n  name:vector:<dim>[:nullable]                  (vector / pgvector)\nExamples: user_id:uuid, parsed:jsonb:nullable, plan_id:uuid:fk(plans),\n          embedding:vector:1536, comment_id:uuid:fk(comments.id:set_null).`);
+	if (parts.length < 2 || parts.length > 4) throw new Error(`Invalid field spec '${spec}'. Grammar:\n  name:type[:nullable]                          (plain)\n  name:type:fk(table[.col][:onDelete])[:nullable] (foreign key)\n  name:vector:<dim>[:nullable]                  (vector / pgvector)\nExamples: user_id:uuid, tags:text[], parsed:jsonb:nullable, plan_id:uuid:fk(plans),\n          embedding:vector:1536, comment_id:uuid:fk(comments.id:set_null).`);
 	const colName = parts[0];
 	const type = parts[1];
 	const slot3 = parts[2];
@@ -6210,85 +7315,1265 @@ function parseColumnSpec(spec) {
 			if (slot4 !== "nullable") throw new Error(`Invalid trailing token '${slot4}' on vector column '${colName}'. Only 'nullable' is allowed after the dimension.`);
 			out.nullable = true;
 		}
-		return out;
+		return out;
+	}
+	if (slot3 === "nullable") {
+		out.nullable = true;
+		if (slot4 !== void 0) throw new Error(`Invalid trailing token '${slot4}' on column '${colName}'. 'nullable' must be the last segment for plain fields.`);
+		return out;
+	}
+	if (slot3.startsWith("fk(") && slot3.endsWith(")")) {
+		out.references = parseFkSpec(slot3.slice(3, -1).replace(/\|/g, ":"));
+		if (slot4 !== void 0) {
+			if (slot4 !== "nullable") throw new Error(`Invalid trailing token '${slot4}' on column '${colName}'. Only 'nullable' is allowed after fk(...).`);
+			out.nullable = true;
+		}
+		return out;
+	}
+	throw new Error(`Invalid third segment '${slot3}' on column '${colName}'. Expected 'nullable', fk(...), or — for vector columns — a positive integer dimension.`);
+}
+/**
+* Parse the `fk(...)` body into the API's `references` shape.
+* Supported inner grammars:
+*   - `<table>` → `{ table }` (FK to `<table>(id)`, no ON DELETE clause)
+*   - `<table>.<column>` → `{ table, column }`
+*   - `<table>:<onDelete>` → `{ table, onDelete }`
+*   - `<table>.<column>:<onDelete>` → `{ table, column, onDelete }`
+*
+* `onDelete` accepts case-insensitive `cascade | restrict | set_null | no_action`
+* (and the `set null` / `no action` SQL spellings) — translated to the
+* canonical uppercased form the API expects.
+*/
+function parseFkSpec(inner) {
+	const [tablePart, onDelete] = inner.includes(":") ? inner.split(":") : [inner, void 0];
+	const trimmedTable = tablePart.trim();
+	if (trimmedTable.length === 0) throw new Error(`Invalid fk(...) — table name is required.`);
+	const dotIdx = trimmedTable.indexOf(".");
+	let table;
+	let column;
+	if (dotIdx === -1) table = trimmedTable;
+	else {
+		table = trimmedTable.slice(0, dotIdx);
+		column = trimmedTable.slice(dotIdx + 1);
+	}
+	if (!/^[a-z_][a-z0-9_]*$/.test(table)) throw new Error(`Invalid fk table name '${table}'.`);
+	if (column !== void 0 && !/^[a-z_][a-z0-9_]*$/.test(column)) throw new Error(`Invalid fk column name '${column}'.`);
+	const out = { table };
+	if (column !== void 0) out.column = column;
+	if (onDelete !== void 0) out.onDelete = normalizeOnDelete(onDelete);
+	return out;
+}
+function normalizeOnDelete(raw) {
+	switch (raw.trim().toLowerCase().replace(/_/g, " ")) {
+		case "cascade": return "CASCADE";
+		case "restrict": return "RESTRICT";
+		case "set null": return "SET NULL";
+		case "no action": return "NO ACTION";
+		default: throw new Error(`Invalid onDelete '${raw}' in fk(...). Supported: cascade | restrict | set_null | no_action.`);
+	}
+}
+/**
+* Parse an index spec into the wire shape data's API expects.
+*
+* Input syntax (CLI-friendly): `"col1 [asc|desc], col2 [asc|desc]"`.
+* Wire shape (per data's contract): `{ columns: ['col1 desc', 'col2 asc'] }` —
+* direction is embedded in each column string and parsed by the DDL emit.
+*
+* Bare column names (no direction) are passed through verbatim; the
+* default sort direction is the DDL emit's responsibility.
+*
+* Exported for tests.
+*/
+function parseIndexSpec(spec) {
+	const cols = [];
+	for (const part of spec.split(",")) {
+		const trimmed = part.trim();
+		if (!trimmed) throw new Error(`Invalid index spec '${spec}'.`);
+		const m = /^([a-zA-Z_][a-zA-Z0-9_]*)(?:\s+(asc|desc))?$/i.exec(trimmed);
+		if (!m) throw new Error(`Invalid index column '${trimmed}'. Expected '<col>' or '<col> asc|desc'.`);
+		const colName = m[1];
+		const direction = m[2]?.toLowerCase();
+		cols.push(direction ? `${colName} ${direction}` : colName);
+	}
+	return { columns: cols };
+}
+//#endregion
+//#region src/ship/config.ts
+/**
+* `amba ship` config — the typed, hand-validated launch config.
+*
+* One file per repo (default `amba.ship.json`) describes how to take this Expo
+* app from code-complete to live on the App Store and Google Play. It carries
+* NON-SECRET identifiers and the NAME of the env var holding the Expo token —
+* never secret values (the App Store Connect `.p8` and Play service-account
+* JSON live in `eas.json`, owned by the app repo, exactly where the build runs).
+*
+* Validation is hand-rolled (the CLI deliberately ships no `zod` — see
+* `_internal/shared.ts` for the same return-all-errors-at-once pattern). The
+* field names are the canonical contract; `validateShipConfig` reports every
+* problem in one pass and enforces the cross-field invariants.
+*
+* Monetization is NOT described here: the App Store / Play product catalog is
+* Amba's monetization control plane (`amba monetization`, the durable Track H
+* apply against the provider). `ship` only flips `monetization.enabled` to
+* decide whether to verify that catalog is in sync before building.
+*/
+/** The ordered launch phases. `ship` runs them in this sequence. */
+const SHIP_PHASES = [
+	"preflight",
+	"monetization",
+	"build",
+	"submit",
+	"metadata",
+	"release"
+];
+const SHIP_PLATFORMS = ["ios", "android"];
+/** Google Play release tracks `ship` can submit to. */
+const PLAY_TRACKS = [
+	"internal",
+	"alpha",
+	"beta",
+	"production"
+];
+/** Default config filename when no `--config <path>` is passed. */
+const DEFAULT_SHIP_CONFIG_FILE = "amba.ship.json";
+const SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
+const SEMVER_RE = /^\d+\.\d+\.\d+$/;
+const REVERSE_DNS_RE = /^[a-zA-Z][a-zA-Z0-9_]*(\.[a-zA-Z][a-zA-Z0-9_]*)+$/;
+function asObject(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return null;
+	return value;
+}
+/**
+* Validate an untrusted parsed JSON value into a typed `ShipConfig`,
+* collecting EVERY problem (not just the first) so a misconfigured file
+* surfaces all its issues in one run. Returns the typed config on success.
+*/
+function validateShipConfig(raw) {
+	const errors = [];
+	const root = asObject(raw);
+	if (!root) return {
+		ok: false,
+		errors: ["config must be a JSON object"]
+	};
+	if (typeof root["version"] !== "number") errors.push("version must be a number");
+	const app = asObject(root["app"]);
+	if (!app) errors.push("app must be an object");
+	else {
+		const slug = app["slug"];
+		if (typeof slug !== "string" || !SLUG_RE.test(slug)) errors.push("app.slug must be lowercase letters, digits and dashes");
+		if (typeof app["name"] !== "string" || app["name"].trim().length === 0) errors.push("app.name must be a non-empty string");
+		if (typeof app["version"] !== "string" || !SEMVER_RE.test(app["version"])) errors.push("app.version must be semver MAJOR.MINOR.PATCH");
+		if (typeof app["bundleId"] !== "string" || !REVERSE_DNS_RE.test(app["bundleId"])) errors.push("app.bundleId must be a reverse-DNS identifier like ai.uselayers.unbury");
+		if (typeof app["androidPackage"] !== "string" || !REVERSE_DNS_RE.test(app["androidPackage"])) errors.push("app.androidPackage must be a reverse-DNS identifier like ai.uselayers.unbury");
+	}
+	const build = asObject(root["build"]);
+	if (!build) errors.push("build must be an object");
+	else {
+		if (typeof build["profile"] !== "string" || build["profile"].trim().length === 0) errors.push("build.profile must be a non-empty string (an eas.json build profile)");
+		const platforms = build["platforms"];
+		if (!Array.isArray(platforms) || platforms.length === 0) errors.push("build.platforms must be a non-empty array of \"ios\" | \"android\"");
+		else {
+			const seen = /* @__PURE__ */ new Set();
+			for (const p of platforms) if (p !== "ios" && p !== "android") errors.push(`build.platforms entries must be "ios" or "android" (got ${JSON.stringify(p)})`);
+			else if (seen.has(p)) errors.push(`build.platforms has a duplicate entry "${p}"`);
+			else seen.add(p);
+		}
+	}
+	const ios = asObject(root["ios"]);
+	if (!ios) errors.push("ios must be an object");
+	else if (ios["ascAppId"] !== null && typeof ios["ascAppId"] !== "string") errors.push("ios.ascAppId must be a string or null");
+	else if (typeof ios["ascAppId"] === "string" && ios["ascAppId"].trim().length === 0) errors.push("ios.ascAppId must be a non-empty string when set (or null)");
+	const android = asObject(root["android"]);
+	if (!android) errors.push("android must be an object");
+	else if (!PLAY_TRACKS.includes(android["track"])) errors.push(`android.track must be one of ${PLAY_TRACKS.join(" | ")}`);
+	const monetization = asObject(root["monetization"]);
+	if (!monetization) errors.push("monetization must be an object");
+	else if (typeof monetization["enabled"] !== "boolean") errors.push("monetization.enabled must be a boolean");
+	const secrets = asObject(root["secrets"]);
+	if (!secrets) errors.push("secrets must be an object");
+	else if (typeof secrets["expoTokenEnvVar"] !== "string" || secrets["expoTokenEnvVar"].trim().length === 0) errors.push("secrets.expoTokenEnvVar must be a non-empty env var NAME (e.g. \"EXPO_TOKEN\")");
+	if (errors.length > 0) return {
+		ok: false,
+		errors
+	};
+	const a = app;
+	const b = build;
+	return {
+		ok: true,
+		config: {
+			version: root["version"],
+			app: {
+				slug: a["slug"],
+				name: a["name"].trim(),
+				version: a["version"],
+				bundleId: a["bundleId"],
+				androidPackage: a["androidPackage"]
+			},
+			build: {
+				profile: b["profile"].trim(),
+				platforms: b["platforms"].slice()
+			},
+			ios: { ascAppId: ios["ascAppId"] },
+			android: { track: android["track"] },
+			monetization: { enabled: monetization["enabled"] },
+			secrets: { expoTokenEnvVar: secrets["expoTokenEnvVar"].trim() }
+		}
+	};
+}
+/**
+* A starter config written by `amba ship init`. Placeholders are intentionally
+* obvious so the validator's invariants don't pass on an unedited file's IDs
+* (the reverse-DNS / semver placeholders DO validate so `--phase preflight`
+* works immediately; the operator swaps in their real values).
+*/
+function shipConfigTemplate(slug) {
+	return {
+		version: 1,
+		app: {
+			slug,
+			name: "My App",
+			version: "1.0.0",
+			bundleId: `com.example.${slug.replace(/-/g, "")}`,
+			androidPackage: `com.example.${slug.replace(/-/g, "")}`
+		},
+		build: {
+			profile: "production",
+			platforms: ["ios", "android"]
+		},
+		ios: { ascAppId: null },
+		android: { track: "internal" },
+		monetization: { enabled: false },
+		secrets: { expoTokenEnvVar: "EXPO_TOKEN" }
+	};
+}
+//#endregion
+//#region src/ship/exec.ts
+/**
+* The external-command boundary for `amba ship`.
+*
+* Every shell-out (always `eas`) goes through an `Executor`, so the phase
+* logic — which args get built, how `--json` output is parsed, which failures
+* map to which manual gate — is unit-tested against a fake executor with NO
+* live cloud, no EAS account, and no Apple/Google credentials. The default
+* `createNodeExecutor()` is a thin, shell-free wrapper around
+* `node:child_process.spawn` (mirrors the launch toolkit's `lib/exec`).
+*/
+/**
+* Redact secret-shaped tokens from a string before it is logged. A backstop,
+* not a license — `ship` never puts secret values on a command line (EAS reads
+* its token from the env and its store creds from eas.json). Covers Expo /
+* common access-token shapes and `Bearer`/`sk_` prefixes.
+*/
+function redactSecrets(text) {
+	return text.replace(/\b(Bearer)\s+[A-Za-z0-9._-]+/gi, "$1 ***").replace(/\b(sk|pk|rcb)_[A-Za-z0-9]+/g, "$1_***").replace(/\bamb_dpat_[A-Za-z0-9_-]+/g, "amb_dpat_***").replace(/\b[A-Za-z0-9_-]*EXPO_TOKEN[A-Za-z0-9_-]*=\S+/g, "EXPO_TOKEN=***");
+}
+/** A backing executor over `node:child_process.spawn`. Never invokes a shell. */
+function createNodeExecutor(globalDryRun = false) {
+	return { run(cmd, args, opts = {}) {
+		const dryRun = opts.dryRun ?? globalDryRun;
+		const printable = redactSecrets([cmd, ...args].join(" "));
+		if (dryRun) return Promise.resolve({
+			command: printable,
+			code: 0,
+			stdout: "",
+			stderr: "",
+			dryRun: true
+		});
+		const stream = opts.stream ?? false;
+		return new Promise((resolve, reject) => {
+			const child = spawn(cmd, args, {
+				cwd: opts.cwd ?? process$1.cwd(),
+				env: opts.env ? {
+					...process$1.env,
+					...opts.env
+				} : process$1.env,
+				shell: false
+			});
+			let stdout = "";
+			let stderr = "";
+			let timedOut = false;
+			let timer;
+			if (opts.timeoutMs && opts.timeoutMs > 0) timer = setTimeout(() => {
+				timedOut = true;
+				child.kill("SIGKILL");
+			}, opts.timeoutMs);
+			child.stdout?.on("data", (chunk) => {
+				const s = chunk.toString();
+				stdout += s;
+				if (stream) process$1.stdout.write(redactSecrets(s));
+			});
+			child.stderr?.on("data", (chunk) => {
+				const s = chunk.toString();
+				stderr += s;
+				if (stream) process$1.stderr.write(redactSecrets(s));
+			});
+			child.on("error", (err) => {
+				if (timer) clearTimeout(timer);
+				const hint = err.code === "ENOENT" ? `Command "${cmd}" not found. Is it installed and on PATH?` : err.message;
+				reject(/* @__PURE__ */ new Error(`Failed to start "${printable}": ${hint}`));
+			});
+			child.on("close", (code) => {
+				if (timer) clearTimeout(timer);
+				if (timedOut) {
+					reject(/* @__PURE__ */ new Error(`Command timed out after ${opts.timeoutMs}ms: ${printable}\n  stderr tail: ${redactSecrets(stderr.slice(-400))}`));
+					return;
+				}
+				if ((code ?? -1) !== 0) {
+					reject(/* @__PURE__ */ new Error(`Command failed (exit ${code ?? -1}): ${printable}\n  stderr tail: ${redactSecrets(stderr.slice(-400) || stdout.slice(-400) || "(no output)")}`));
+					return;
+				}
+				resolve({
+					command: printable,
+					code: code ?? 0,
+					stdout,
+					stderr,
+					dryRun: false
+				});
+			});
+		});
+	} };
+}
+/**
+* Run a command and report success/failure WITHOUT throwing — for read-only
+* "is this CLI installed/authed?" probes where a non-zero exit is data, not a
+* fatal error.
+*/
+async function probe(exec, cmd, args, opts = {}) {
+	try {
+		return {
+			ok: true,
+			result: await exec.run(cmd, args, {
+				...opts,
+				dryRun: false
+			})
+		};
+	} catch {
+		return { ok: false };
+	}
+}
+//#endregion
+//#region src/ship/state.ts
+/**
+* `amba ship` per-app idempotency state.
+*
+* Each app's launch progress is a JSON file at `.amba/ship-state/<slug>.json`
+* recording, per phase, whether it is done / failed / blocked-by-a-human-gate /
+* in-progress, when, and an optional structured `note` (e.g. the build ids a
+* later phase reads back). The orchestrator uses it to skip already-done phases
+* and to resume the "clear a gate → re-run" loop.
+*
+* PURITY RULE: this module NEVER reads the clock itself — callers pass an
+* ISO-8601 timestamp into every mutation so it stays deterministically
+* testable (the orchestrator owns the clock). The file is purely an
+* optimization/audit log: deleting it is safe because every phase re-detects
+* real cloud state before mutating.
+*/
+const STATE_DIR = path.join(".amba", "ship-state");
+/** Path to the state file for a slug, under `<baseDir>/.amba/ship-state/`. */
+function shipStatePath(slug, baseDir = process.cwd()) {
+	return path.join(baseDir, STATE_DIR, `${slug}.json`);
+}
+/** Load state for a slug, or a fresh empty state if none exists. Pure read. */
+function loadShipState(slug, baseDir = process.cwd()) {
+	const file = shipStatePath(slug, baseDir);
+	if (!fs.existsSync(file)) return {
+		slug,
+		stateVersion: 1,
+		phases: {}
+	};
+	let parsed;
+	try {
+		parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+	} catch (err) {
+		throw new Error(`Corrupt ship state at ${file}: ${err instanceof Error ? err.message : String(err)}. Delete it to start fresh (phases re-detect cloud state).`);
+	}
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`Corrupt ship state at ${file}: expected a JSON object. Delete it to start fresh.`);
+	const state = parsed;
+	if (state.slug !== slug) throw new Error(`State file ${file} is for slug "${state.slug}", expected "${slug}".`);
+	if (!state.phases || typeof state.phases !== "object") state.phases = {};
+	return state;
+}
+/** Write state atomically (write temp, then rename) to avoid partial files. */
+function saveShipState(state, baseDir = process.cwd()) {
+	const file = shipStatePath(state.slug, baseDir);
+	fs.mkdirSync(path.dirname(file), { recursive: true });
+	const tmp = `${file}.tmp`;
+	fs.writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n", "utf8");
+	fs.renameSync(tmp, file);
+}
+/**
+* Return a NEW state with one phase updated. Pure: does not touch disk and does
+* not read the clock — the caller passes `timestamp`. Use `saveShipState` to
+* persist.
+*/
+function withPhase(state, phase, status, timestamp, note) {
+	return {
+		...state,
+		phases: {
+			...state.phases,
+			[phase]: {
+				status,
+				updatedAt: timestamp,
+				...note !== void 0 ? { note } : {}
+			}
+		}
+	};
+}
+/** True if a phase is recorded as done. Used by the orchestrator for idempotency. */
+function isPhaseDone(state, phase) {
+	return state.phases[phase]?.status === "done";
+}
+//#endregion
+//#region src/ship/phases.ts
+const EAS = "eas";
+const EXEC_TIMEOUT_MS = 10 * 6e4;
+function easBuildArgs(platform, profile) {
+	return [
+		"build",
+		"--platform",
+		platform,
+		"--profile",
+		profile,
+		"--non-interactive",
+		"--json",
+		"--no-wait"
+	];
+}
+function easSubmitArgs(input) {
+	const selector = input.buildId ? ["--id", input.buildId] : ["--latest"];
+	const track = input.track ? ["--track", input.track] : [];
+	return [
+		"submit",
+		"--platform",
+		input.platform,
+		"--profile",
+		input.profile,
+		...selector,
+		...track,
+		"--non-interactive",
+		"--json",
+		"--no-wait"
+	];
+}
+function easBuildViewArgs(buildId) {
+	return [
+		"build:view",
+		buildId,
+		"--json",
+		"--non-interactive"
+	];
+}
+function easMetadataArgs(profile) {
+	return [
+		"metadata:push",
+		"--profile",
+		profile,
+		"--non-interactive"
+	];
+}
+/** Parse the first JSON value out of CLI stdout, tolerating a leaked banner. */
+function parseLooseJson(raw) {
+	const trimmed = (raw || "").trim();
+	if (!trimmed) return null;
+	try {
+		return JSON.parse(trimmed);
+	} catch {
+		const start = trimmed.search(/[[{]/);
+		if (start === -1) return null;
+		try {
+			return JSON.parse(trimmed.slice(start));
+		} catch {
+			return null;
+		}
+	}
+}
+/** Pull the build object for `platform` out of `eas build --json` stdout. */
+function extractBuild(raw, platform) {
+	const parsed = parseLooseJson(raw);
+	if (parsed === null) throw new Error("eas build --json produced no parseable output. Is the Expo token set and the project linked (eas init)?");
+	const builds = Array.isArray(parsed) ? parsed : [parsed];
+	const want = platform.toUpperCase();
+	const match = builds.find((b) => (b.platform ?? "").toUpperCase() === want);
+	if (match?.id) return match;
+	const sole = builds.length === 1 ? builds[0] : void 0;
+	if (sole?.id && (!sole.platform || sole.platform.toUpperCase() === want)) return sole;
+	throw new Error(`eas build --json did not return a build id for ${platform}.`);
+}
+function artifactUrlOf(b) {
+	return b.artifacts?.applicationArchiveUrl ?? b.artifacts?.buildUrl ?? null;
+}
+/** Parse the submission object for `platform` out of `eas submit --json` stdout. */
+function parseSubmission(raw, platform) {
+	const parsed = parseLooseJson(raw);
+	if (parsed === null) return { platform };
+	const subs = Array.isArray(parsed) ? parsed : [parsed];
+	const want = platform.toUpperCase();
+	const match = subs.find((s) => (s.platform ?? "").toUpperCase() === want);
+	if (match) return match;
+	const sole = subs.length === 1 ? subs[0] : void 0;
+	if (sole && (!sole.platform || sole.platform.toUpperCase() === want)) return sole;
+	return { platform };
+}
+function diagnoseBuildFailure(message) {
+	const o = (message || "").toLowerCase();
+	if (o.includes("not found") && o.includes("eas")) return "eas CLI not installed. Install it with `npm i -g eas-cli`, then re-run.";
+	if (o.includes("not logged in") || o.includes("expo_token") || o.includes("authenticate")) return "Auth: set your Expo token env var (non-interactive) or run `eas login`.";
+	if (o.includes("eas.json") || o.includes("build profile")) return "Missing/invalid eas.json or the build profile. Add a build.<profile> entry to eas.json.";
+	if (o.includes("project") && o.includes("id") || o.includes("eas init")) return "Project not linked. Run `eas init` once (writes extra.eas.projectId into app.json), then re-run.";
+	if (o.includes("credential") || o.includes("keystore") || o.includes("distribution certificate") || o.includes("provisioning profile")) return "Missing signing credentials. Under --non-interactive EAS will not create them — run `eas credentials` once.";
+	return "See the eas build prerequisites (eas.json build profile, linked project, signing credentials).";
+}
+/** A submit failure that needs a human store action, or null for a plain error. */
+function diagnoseSubmitGate(platform, message) {
+	const o = (message || "").toLowerCase();
+	if (platform === "ios") {
+		if (o.includes("ascappid") || o.includes("app store connect") && o.includes("not found")) return "The App Store Connect app record is missing. Create it at appstoreconnect.apple.com → Apps → +, then set ios.ascAppId. EAS Submit cannot create it (eas-cli #2418).";
+		if (o.includes("export compliance") || o.includes("encryption")) return "The first upload needs an export-compliance answer in App Store Connect (appstoreconnect.apple.com).";
+	} else {
+		if (o.includes("manually at least once") || o.includes("upload your app manually")) return "Google requires the Play app + first release to be created/published ONCE in Play Console (play.google.com/console) before API submissions work.";
+		if (o.includes("service account") || o.includes("permission") || o.includes("androidpublisher")) return "The Play service account lacks access, or the Play Developer API is disabled — grant it in Play Console and enable androidpublisher.googleapis.com.";
+	}
+	return null;
+}
+function readNote(ctx, phase) {
+	const raw = ctx.getNote(phase);
+	if (!raw) return null;
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return null;
+	}
+}
+const TERMINAL_OK = "finished";
+const TERMINAL_BAD = new Set(["errored", "canceled"]);
+/**
+* The env to pass to every `eas` child. EAS reads the token from `EXPO_TOKEN`
+* specifically, so a config that names a DIFFERENT env var
+* (`secrets.expoTokenEnvVar`) must map that value onto `EXPO_TOKEN` — otherwise
+* a non-default name passes preflight while `eas build`/`submit` run
+* unauthenticated.
+*/
+function easEnv(ctx) {
+	const varName = ctx.config.secrets.expoTokenEnvVar;
+	const token = ctx.env[varName];
+	if (varName !== "EXPO_TOKEN" && token) return {
+		...ctx.env,
+		EXPO_TOKEN: token
+	};
+	return ctx.env;
+}
+/** Config-derived store gates (no external call) — surfaced by preflight. */
+function storeGateWarnings(ctx) {
+	const warnings = [];
+	if (ctx.platforms.includes("ios") && !ctx.config.ios.ascAppId) warnings.push("ios.ascAppId is null — create the App Store Connect app record (appstoreconnect.apple.com → Apps → +) and set it before the submit phase.");
+	if (ctx.platforms.includes("android")) warnings.push("Android: the Play app + first release must be created/published once in Play Console before API submissions work.");
+	return warnings;
+}
+const runPreflight = async (ctx) => {
+	const tokenVar = ctx.config.secrets.expoTokenEnvVar;
+	if (ctx.dryRun) {
+		ctx.log("would verify: eas installed + authenticated");
+		const warnings = storeGateWarnings(ctx);
+		for (const w of warnings) ctx.log(`warning: ${w}`);
+		return {
+			status: "done",
+			detail: "dry-run: eas probes not executed"
+		};
+	}
+	const warnings = [];
+	if (!(await probe(ctx.exec, EAS, ["--version"])).ok) return {
+		status: "failed",
+		detail: "eas CLI not found on PATH. Install it with `npm i -g eas-cli`, then re-run preflight."
+	};
+	ctx.log("eas CLI installed");
+	const tokenSet = (ctx.env[tokenVar] ?? "").trim().length > 0;
+	if ((await probe(ctx.exec, EAS, ["whoami"], { env: easEnv(ctx) })).ok) ctx.log(`eas authenticated ${tokenSet ? `(via ${tokenVar})` : "(via stored CLI session)"}`);
+	else if (tokenSet) ctx.log(`${tokenVar} is set (eas whoami unavailable — token used at build time)`);
+	else warnings.push(`Not authenticated with EAS: set ${tokenVar} (CI) or run \`eas login\`. Build will fail without it.`);
+	warnings.push(...storeGateWarnings(ctx));
+	for (const w of warnings) ctx.log(`warning: ${w}`);
+	return {
+		status: "done",
+		detail: warnings.length === 0 ? "all checks passed" : `${warnings.length} warning(s)`
+	};
+};
+const runMonetization = async (ctx) => {
+	if (!ctx.config.monetization.enabled) return {
+		status: "skipped",
+		detail: "monetization disabled in config"
+	};
+	const projectId = await ctx.resolveProjectId();
+	if (!projectId) return {
+		status: "skipped",
+		detail: "no Amba project linked — run `amba init` to manage the store product catalog"
+	};
+	if (ctx.dryRun) return {
+		status: "done",
+		detail: `would verify the monetization catalog for project ${projectId}`
+	};
+	let plan;
+	try {
+		plan = (await ctx.adminGet(`/projects/${projectId}/monetization/plan`)).data;
+	} catch (err) {
+		if (err instanceof ApiClientError && (err.errorCode === "MONETIZATION_NOT_CONFIGURED" || err.errorCode === "MONETIZATION_NOT_MIGRATED")) return {
+			status: "skipped",
+			detail: "no monetization configured for this project (nothing to verify)"
+		};
+		return {
+			status: "failed",
+			detail: `could not verify monetization: ${err instanceof Error ? err.message : String(err)}. Fix API access (or set monetization.enabled=false) and re-run.`
+		};
+	}
+	if (plan.clean) return {
+		status: "done",
+		detail: "store product catalog is in sync"
+	};
+	const gates = [];
+	for (const op of plan.ops) gates.push(`${op.op} ${op.object_type} ${op.identifier}`);
+	for (const sf of plan.store_floor) gates.push(`store floor: ${sf.product_key} → ${sf.store_identifier} (${sf.store}) — ${sf.reason}`);
+	for (const h of plan.human_floor ?? []) gates.push(`${h.title} — ${h.detail} (${h.location})`);
+	gates.push("Apply with `amba monetization apply`.");
+	return {
+		status: "gate",
+		detail: `monetization catalog has ${plan.ops.length} pending change(s)`,
+		gates
+	};
+};
+const runBuild = async (ctx) => {
+	const { profile } = ctx.config.build;
+	const tokenVar = ctx.config.secrets.expoTokenEnvVar;
+	if ((ctx.env[tokenVar] ?? "").trim().length === 0) ctx.log(`warning: ${tokenVar} not set — eas build needs it for non-interactive CI auth.`);
+	const builds = { ...readNote(ctx, "build")?.builds };
+	for (const platform of ctx.platforms) {
+		const existing = builds[platform];
+		if (existing && existing.appVersion === ctx.config.app.version && existing.profile === profile && !TERMINAL_BAD.has((existing.status || "").toLowerCase()) && !ctx.force) {
+			ctx.log(`${platform}: reusing build ${existing.buildId} (${existing.status}) — pass --force to rebuild`);
+			continue;
+		}
+		ctx.log(`${platform}: triggering eas ${profile} build…`);
+		let stdout = "";
+		let isDry = false;
+		try {
+			const res = await ctx.exec.run(EAS, easBuildArgs(platform, profile), {
+				env: easEnv(ctx),
+				timeoutMs: EXEC_TIMEOUT_MS,
+				dryRun: ctx.dryRun
+			});
+			stdout = res.stdout;
+			isDry = res.dryRun;
+		} catch (err) {
+			return {
+				status: "failed",
+				detail: `${platform} build failed: ${diagnoseBuildFailure(err instanceof Error ? err.message : String(err))}`,
+				note: JSON.stringify({
+					profile,
+					appVersion: ctx.config.app.version,
+					builds
+				})
+			};
+		}
+		const record = isDry ? {
+			buildId: `dry-run-${platform}`,
+			status: "dry-run",
+			platform,
+			artifactUrl: null,
+			buildPageUrl: null,
+			appVersion: ctx.config.app.version,
+			profile,
+			triggeredAt: ctx.now()
+		} : (() => {
+			const b = extractBuild(stdout, platform);
+			return {
+				buildId: b.id,
+				status: b.status ?? "in-queue",
+				platform,
+				artifactUrl: artifactUrlOf(b),
+				buildPageUrl: b.buildDetailsPageUrl ?? null,
+				appVersion: b.appVersion ?? ctx.config.app.version,
+				profile,
+				triggeredAt: ctx.now()
+			};
+		})();
+		builds[platform] = record;
+		ctx.log(`${platform}: queued build ${record.buildId} (${record.status})`);
+		ctx.checkpoint("build", "in-progress", JSON.stringify({
+			profile,
+			appVersion: ctx.config.app.version,
+			builds
+		}));
+	}
+	const note = {
+		profile,
+		appVersion: ctx.config.app.version,
+		builds
+	};
+	return {
+		status: "done",
+		detail: Object.values(builds).map((r) => `${r.platform}=${r.buildId}(${r.status})`).join(" "),
+		note: JSON.stringify(note)
+	};
+};
+const runSubmit = async (ctx) => {
+	const { profile } = ctx.config.build;
+	const prior = readNote(ctx, "submit");
+	const buildNote = readNote(ctx, "build");
+	const submissions = { ...prior?.submissions };
+	const gates = [];
+	let failure = null;
+	for (const platform of ctx.platforms) {
+		if (platform === "ios" && !ctx.config.ios.ascAppId) {
+			gates.push("iOS: create the App Store Connect app record (appstoreconnect.apple.com → Apps → +) and set ios.ascAppId, then re-run submit.");
+			continue;
+		}
+		const buildId = buildNote?.builds?.[platform]?.buildId ?? null;
+		if (!buildId) ctx.log(`${platform}: no recorded build id — submitting --latest (run the build phase first for a deterministic mapping)`);
+		const existing = submissions[platform];
+		if (existing && existing.buildId === buildId && !TERMINAL_BAD.has((existing.status || "").toLowerCase()) && !ctx.force) {
+			ctx.log(`${platform}: already submitted for build ${buildId ?? "(latest)"} (${existing.status}) — pass --force to resubmit`);
+			continue;
+		}
+		ctx.log(`${platform}: submitting to the store…`);
+		const track = platform === "android" ? ctx.config.android.track : void 0;
+		let stdout = "";
+		let isDry = false;
+		try {
+			const res = await ctx.exec.run(EAS, easSubmitArgs({
+				platform,
+				profile,
+				buildId,
+				track
+			}), {
+				env: easEnv(ctx),
+				timeoutMs: EXEC_TIMEOUT_MS,
+				dryRun: ctx.dryRun
+			});
+			stdout = res.stdout;
+			isDry = res.dryRun;
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			const gate = diagnoseSubmitGate(platform, msg);
+			if (gate) {
+				gates.push(`${platform}: ${gate}`);
+				continue;
+			}
+			failure = `${platform} submit failed: ${msg}`;
+			break;
+		}
+		const record = isDry ? {
+			submissionId: `dry-run-${platform}`,
+			status: "dry-run",
+			platform,
+			buildId,
+			detailsPageUrl: null,
+			submittedAt: ctx.now()
+		} : (() => {
+			const s = parseSubmission(stdout, platform);
+			return {
+				submissionId: s.id ?? null,
+				status: s.status ?? "in-queue",
+				platform,
+				buildId: s.buildId ?? buildId,
+				detailsPageUrl: s.submissionDetailsPageUrl ?? null,
+				submittedAt: ctx.now()
+			};
+		})();
+		submissions[platform] = record;
+		ctx.log(`${platform}: submitted (${record.status})`);
+		ctx.checkpoint("submit", "in-progress", JSON.stringify({
+			profile,
+			submissions
+		}));
+	}
+	const note = JSON.stringify({
+		profile,
+		submissions
+	});
+	if (failure) return {
+		status: "failed",
+		detail: failure,
+		note
+	};
+	if (gates.length > 0) return {
+		status: "gate",
+		detail: `${gates.length} platform(s) need a store action`,
+		note,
+		gates
+	};
+	return {
+		status: "done",
+		detail: Object.values(submissions).map((r) => `${r.platform}=${r.status}`).join(" "),
+		note
+	};
+};
+const runMetadata = async (ctx) => {
+	const reminders = [];
+	if (ctx.platforms.includes("ios")) reminders.push("iOS: capture screenshots and complete the App Privacy questionnaire in App Store Connect.");
+	if (ctx.platforms.includes("android")) reminders.push("Android: complete the Play listing (graphics, Data safety, Content rating) in Play Console.");
+	if (ctx.platforms.includes("ios")) {
+		ctx.log("pushing App Store listing metadata…");
+		try {
+			await ctx.exec.run(EAS, easMetadataArgs(ctx.config.build.profile), {
+				env: easEnv(ctx),
+				timeoutMs: EXEC_TIMEOUT_MS,
+				dryRun: ctx.dryRun
+			});
+			ctx.log("App Store listing metadata pushed");
+		} catch (err) {
+			return {
+				status: "gate",
+				detail: `eas metadata:push did not run: ${err instanceof Error ? err.message.split("\n")[0] : String(err)}`,
+				gates: ["Configure the App Store listing (eas.json metadata) or complete it in App Store Connect.", ...reminders]
+			};
+		}
+	}
+	for (const r of reminders) ctx.log(`reminder: ${r}`);
+	return {
+		status: "done",
+		detail: "listing metadata pushed; complete the store-side checklist",
+		gates: reminders
+	};
+};
+/** Poll a build to a terminal state via `eas build:view`. Returns the last status. */
+async function waitForBuild(ctx, buildId) {
+	if (ctx.dryRun) return TERMINAL_OK;
+	const deadline = Date.now() + ctx.releaseMaxWaitMs;
+	let last = "unknown";
+	for (;;) {
+		const res = await probe(ctx.exec, EAS, easBuildViewArgs(buildId), { env: easEnv(ctx) });
+		if (res.ok && res.result) {
+			if (res.result.dryRun) return TERMINAL_OK;
+			const parsed = parseLooseJson(res.result.stdout);
+			last = ((Array.isArray(parsed) ? parsed[0] : parsed)?.status ?? last ?? "unknown").toLowerCase();
+		}
+		if (last === TERMINAL_OK || TERMINAL_BAD.has(last)) return last;
+		if (Date.now() >= deadline) return last;
+		ctx.log(`build ${buildId}: ${last} — re-checking…`);
+		await ctx.sleep(ctx.releasePollMs);
+	}
+}
+const runRelease = async (ctx) => {
+	const profile = ctx.config.build.profile;
+	const prior = readNote(ctx, "release");
+	const buildNote = readNote(ctx, "build");
+	const submitNote = readNote(ctx, "submit");
+	const releases = { ...prior?.releases };
+	const gates = [];
+	let failure = null;
+	for (const platform of ctx.platforms) {
+		const buildRec = buildNote?.builds?.[platform];
+		if (!buildRec?.buildId) {
+			gates.push(`${platform}: no recorded build — run \`amba ship --phase build\` first.`);
+			releases[platform] = {
+				platform,
+				buildId: null,
+				buildStatus: "unknown",
+				releaseState: "pending-build",
+				gate: true,
+				detail: "No recorded build."
+			};
+			continue;
+		}
+		ctx.log(`${platform}: waiting for build ${buildRec.buildId} to finish…`);
+		const buildStatus = await waitForBuild(ctx, buildRec.buildId);
+		if (TERMINAL_BAD.has(buildStatus)) {
+			failure = `${platform}: build ${buildRec.buildId} is ${buildStatus}; re-run the build phase.`;
+			releases[platform] = {
+				platform,
+				buildId: buildRec.buildId,
+				buildStatus,
+				releaseState: "blocked",
+				gate: false,
+				detail: failure
+			};
+			break;
+		}
+		if (buildStatus !== TERMINAL_OK) {
+			gates.push(`${platform}: build ${buildRec.buildId} still ${buildStatus} — re-run release once it finishes.`);
+			releases[platform] = {
+				platform,
+				buildId: buildRec.buildId,
+				buildStatus,
+				releaseState: "pending-build",
+				gate: true,
+				detail: `Build still ${buildStatus}.`
+			};
+			continue;
+		}
+		if (platform === "ios") {
+			gates.push("iOS: in App Store Connect, attach the build to a version, then \"Add for Review\" → \"Submit for Review\" (appstoreconnect.apple.com).");
+			releases[platform] = {
+				platform,
+				buildId: buildRec.buildId,
+				buildStatus,
+				releaseState: "in-testflight",
+				gate: true,
+				detail: "Uploaded to App Store Connect / TestFlight; Submit-for-Review is manual."
+			};
+			continue;
+		}
+		const priorAndroid = releases[platform];
+		if (priorAndroid && priorAndroid.buildId === buildRec.buildId && priorAndroid.releaseState === "promoted-to-production" && !ctx.force) {
+			ctx.log("android: build already promoted to production — pass --force to re-promote");
+			continue;
+		}
+		if (ctx.config.android.track === "production") {
+			if (!submitNote?.submissions?.["android"]) {
+				gates.push("android: nothing submitted to Play yet — run `amba ship --phase submit` first (your track is \"production\").");
+				releases[platform] = {
+					platform,
+					buildId: buildRec.buildId,
+					buildStatus,
+					releaseState: "blocked",
+					gate: true,
+					detail: "No submission recorded; run the submit phase before release."
+				};
+				continue;
+			}
+			releases[platform] = {
+				platform,
+				buildId: buildRec.buildId,
+				buildStatus,
+				releaseState: "promoted-to-production",
+				gate: false,
+				detail: "Submitted directly to the production track."
+			};
+			ctx.log("android: already on the production track");
+			continue;
+		}
+		ctx.log(`android: promoting build ${buildRec.buildId} to the production track…`);
+		try {
+			await ctx.exec.run(EAS, easSubmitArgs({
+				platform: "android",
+				profile,
+				buildId: buildRec.buildId,
+				track: "production"
+			}), {
+				env: easEnv(ctx),
+				timeoutMs: EXEC_TIMEOUT_MS,
+				dryRun: ctx.dryRun
+			});
+			releases[platform] = {
+				platform,
+				buildId: buildRec.buildId,
+				buildStatus,
+				releaseState: "promoted-to-production",
+				gate: false,
+				detail: "Promoted internal → production via eas submit."
+			};
+			ctx.log("android: promotion to production queued");
+		} catch (err) {
+			const msg = err instanceof Error ? err.message : String(err);
+			const gate = diagnoseSubmitGate("android", msg);
+			releases[platform] = {
+				platform,
+				buildId: buildRec.buildId,
+				buildStatus,
+				releaseState: "blocked",
+				gate: gate !== null,
+				detail: gate ?? msg
+			};
+			if (gate) gates.push(`android: ${gate}`);
+			else failure = `android promotion failed: ${msg}`;
+			if (failure) break;
+		}
 	}
-	if (slot3 === "nullable") {
-		out.nullable = true;
-		if (slot4 !== void 0) throw new Error(`Invalid trailing token '${slot4}' on column '${colName}'. 'nullable' must be the last segment for plain fields.`);
-		return out;
+	const note = JSON.stringify({
+		profile,
+		releases
+	});
+	if (failure) return {
+		status: "failed",
+		detail: failure,
+		note
+	};
+	if (gates.length > 0) return {
+		status: "gate",
+		detail: `${gates.length} platform(s) need a store action`,
+		note,
+		gates
+	};
+	return {
+		status: "done",
+		detail: Object.values(releases).map((r) => `${r.platform}=${r.releaseState}`).join(" "),
+		note
+	};
+};
+const PHASE_RUNNERS = {
+	preflight: runPreflight,
+	monetization: runMonetization,
+	build: runBuild,
+	submit: runSubmit,
+	metadata: runMetadata,
+	release: runRelease
+};
+//#endregion
+//#region src/ship/orchestrator.ts
+/** Phases that ship a specific binary version (invalidated on a version bump). */
+const VERSION_SCOPED_PHASES = [
+	"build",
+	"submit",
+	"metadata",
+	"release"
+];
+/** The canonical run order, filtered to the requested subset. */
+function orderedPhases(requested) {
+	const want = new Set(requested);
+	return SHIP_PHASES.filter((p) => want.has(p));
+}
+async function defaultResolveProjectId() {
+	try {
+		const { projectId } = await loadProjectConfig();
+		return projectId;
+	} catch {
+		return null;
 	}
-	if (slot3.startsWith("fk(") && slot3.endsWith(")")) {
-		out.references = parseFkSpec(slot3.slice(3, -1).replace(/\|/g, ":"));
-		if (slot4 !== void 0) {
-			if (slot4 !== "nullable") throw new Error(`Invalid trailing token '${slot4}' on column '${colName}'. Only 'nullable' is allowed after fk(...).`);
-			out.nullable = true;
+}
+async function runShip(opts) {
+	const slug = opts.config.app.slug;
+	const baseDir = opts.stateBaseDir ?? process.cwd();
+	const now = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+	const log = opts.log ?? (() => {});
+	const runners = opts.runners ?? PHASE_RUNNERS;
+	let state = loadShipState(slug, baseDir);
+	if (state.appVersion !== void 0 && state.appVersion !== opts.config.app.version) {
+		const phases = { ...state.phases };
+		for (const p of VERSION_SCOPED_PHASES) delete phases[p];
+		state = {
+			...state,
+			phases
+		};
+	}
+	state = {
+		...state,
+		appVersion: opts.config.app.version
+	};
+	const persist = (phase, status, note) => {
+		state = withPhase(state, phase, status, now(), note);
+		if (!opts.dryRun) saveShipState(state, baseDir);
+	};
+	const ctx = {
+		config: opts.config,
+		exec: opts.exec,
+		platforms: opts.platforms,
+		dryRun: opts.dryRun,
+		force: opts.force,
+		env: opts.env ?? process.env,
+		now,
+		log,
+		getNote: (phase) => state.phases[phase]?.note ?? null,
+		checkpoint: (phase, status, note) => persist(phase, status, note),
+		resolveProjectId: opts.resolveProjectId ?? defaultResolveProjectId,
+		adminGet: opts.adminGet ?? adminGet,
+		sleep: opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))),
+		releasePollMs: opts.releasePollMs ?? 3e4,
+		releaseMaxWaitMs: opts.releaseMaxWaitMs ?? 45 * 6e4
+	};
+	const rows = [];
+	let blocked = false;
+	let failed = false;
+	for (const phase of orderedPhases(opts.phases)) {
+		if (!opts.force && isPhaseDone(state, phase)) {
+			const rec = state.phases[phase];
+			rows.push({
+				phase,
+				status: "skipped",
+				detail: `already done ${rec?.updatedAt ?? ""}`.trim()
+			});
+			continue;
+		}
+		if ((blocked || failed) && !opts.dryRun) {
+			rows.push({
+				phase,
+				status: "pending",
+				detail: "not reached (earlier phase needs action)"
+			});
+			continue;
+		}
+		const outcome = await runners[phase](ctx);
+		if (opts.dryRun) {
+			const status = outcome.status === "done" ? "dry-run" : outcome.status;
+			rows.push({
+				phase,
+				status,
+				detail: outcome.detail,
+				...outcome.gates ? { gates: outcome.gates } : {}
+			});
+			if (outcome.status === "failed") failed = true;
+			continue;
+		}
+		switch (outcome.status) {
+			case "done":
+				persist(phase, "done", outcome.note);
+				rows.push({
+					phase,
+					status: "done",
+					detail: outcome.detail,
+					...outcome.gates ? { gates: outcome.gates } : {}
+				});
+				break;
+			case "skipped":
+				rows.push({
+					phase,
+					status: "skipped",
+					detail: outcome.detail
+				});
+				break;
+			case "gate":
+				persist(phase, "gate", outcome.note);
+				rows.push({
+					phase,
+					status: "gate",
+					detail: outcome.detail,
+					...outcome.gates ? { gates: outcome.gates } : {}
+				});
+				blocked = true;
+				break;
+			case "failed":
+				persist(phase, "failed", outcome.note);
+				rows.push({
+					phase,
+					status: "failed",
+					detail: outcome.detail
+				});
+				failed = true;
+				break;
 		}
-		return out;
 	}
-	throw new Error(`Invalid third segment '${slot3}' on column '${colName}'. Expected 'nullable', fk(...), or — for vector columns — a positive integer dimension.`);
+	return {
+		rows,
+		blocked,
+		failed
+	};
 }
+//#endregion
+//#region src/commands/ship.ts
 /**
-* Parse the `fk(...)` body into the API's `references` shape.
-* Supported inner grammars:
-*   - `<table>` → `{ table }` (FK to `<table>(id)`, no ON DELETE clause)
-*   - `<table>.<column>` → `{ table, column }`
-*   - `<table>:<onDelete>` → `{ table, onDelete }`
-*   - `<table>.<column>:<onDelete>` → `{ table, column, onDelete }`
-*
-* `onDelete` accepts case-insensitive `cascade | restrict | set_null | no_action`
-* (and the `set null` / `no action` SQL spellings) — translated to the
-* canonical uppercased form the API expects.
+* `amba ship` — take this Expo app from code-complete to live on the App Store
+* and Google Play, and `amba ship init` to scaffold its config.
+*
+*   amba ship                 run the full pipeline (preflight → monetization →
+*                             build → submit → metadata → release)
+*   amba ship --phase build   run a single phase
+*   amba ship --dry-run       print the plan; touch nothing
+*   amba ship init            scaffold amba.ship.json
+*
+* Build/submit/release shell out to `eas` (the Expo toolchain owns the build,
+* the signing credentials, and the store submit). Monetization delegates to the
+* Amba control plane (`amba monetization`). Steps no API can do — create the
+* store app record, the Apple Paid-Apps agreement, screenshots, store review —
+* are detected and surfaced as manual gates with the exact console action.
 */
-function parseFkSpec(inner) {
-	const [tablePart, onDelete] = inner.includes(":") ? inner.split(":") : [inner, void 0];
-	const trimmedTable = tablePart.trim();
-	if (trimmedTable.length === 0) throw new Error(`Invalid fk(...) — table name is required.`);
-	const dotIdx = trimmedTable.indexOf(".");
-	let table;
-	let column;
-	if (dotIdx === -1) table = trimmedTable;
-	else {
-		table = trimmedTable.slice(0, dotIdx);
-		column = trimmedTable.slice(dotIdx + 1);
+/** Read + parse + validate a ship config file. Throws with every error joined. */
+async function loadShipConfig(file) {
+	const path = resolve(file);
+	let raw;
+	try {
+		raw = await readFile(path, "utf-8");
+	} catch {
+		throw new Error(`Config not found: ${file}. Run ${pc.cyan("amba ship init")} to scaffold one.`);
 	}
-	if (!/^[a-z_][a-z0-9_]*$/.test(table)) throw new Error(`Invalid fk table name '${table}'.`);
-	if (column !== void 0 && !/^[a-z_][a-z0-9_]*$/.test(column)) throw new Error(`Invalid fk column name '${column}'.`);
-	const out = { table };
-	if (column !== void 0) out.column = column;
-	if (onDelete !== void 0) out.onDelete = normalizeOnDelete(onDelete);
-	return out;
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (err) {
+		throw new Error(`Failed to parse ${file} as JSON: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	const result = validateShipConfig(parsed);
+	if (!result.ok) throw new Error(`Invalid ${file}:\n${result.errors.map((e) => `  • ${e}`).join("\n")}`);
+	return result.config;
+}
+function parseShipPhase(raw) {
+	if (raw === void 0 || raw === "all") return "all";
+	if (SHIP_PHASES.includes(raw)) return raw;
+	throw new Error(`Unknown --phase "${raw}". Expected one of: ${SHIP_PHASES.join(", ")}, all.`);
+}
+/** Resolve the platforms to act on: --platform override, else the config's. */
+function resolvePlatforms(raw, configPlatforms) {
+	if (raw === void 0 || raw === "all") return configPlatforms;
+	if (!SHIP_PLATFORMS.includes(raw)) throw new Error(`Unknown --platform "${raw}". Expected one of: ${SHIP_PLATFORMS.join(", ")}, all.`);
+	const platform = raw;
+	if (!configPlatforms.includes(platform)) throw new Error(`Platform "${platform}" is not in build.platforms (${configPlatforms.join(", ")}).`);
+	return [platform];
+}
+const STATUS_BADGE = {
+	done: pc.green("done"),
+	"dry-run": pc.cyan("dry-run"),
+	skipped: pc.dim("skipped"),
+	gate: pc.yellow("GATE"),
+	failed: pc.red("failed"),
+	pending: pc.dim("pending")
+};
+function renderTable(rows) {
+	console.log();
+	for (const row of rows) console.log(`  ${row.phase.padEnd(13)} ${STATUS_BADGE[row.status].padEnd(18)} ${pc.dim(row.detail)}`);
+	console.log();
 }
-function normalizeOnDelete(raw) {
-	switch (raw.trim().toLowerCase().replace(/_/g, " ")) {
-		case "cascade": return "CASCADE";
-		case "restrict": return "RESTRICT";
-		case "set null": return "SET NULL";
-		case "no action": return "NO ACTION";
-		default: throw new Error(`Invalid onDelete '${raw}' in fk(...). Supported: cascade | restrict | set_null | no_action.`);
+function renderGates(rows) {
+	const gateRows = rows.filter((r) => r.gates && r.gates.length > 0);
+	if (gateRows.length === 0) return;
+	console.log(pc.yellow("  Manual gates — steps no API can do (with exact locations):"));
+	for (const row of gateRows) for (const gate of row.gates ?? []) console.log(`    ${pc.bold("□")} ${pc.dim(`[${row.phase}]`)} ${gate}`);
+	console.log();
+}
+async function shipCommand(options = {}, deps = {}) {
+	const config = await loadShipConfig(options.config ?? "amba.ship.json");
+	const phase = parseShipPhase(options.phase);
+	const platforms = resolvePlatforms(options.platform, config.build.platforms);
+	const dryRun = options.dryRun === true;
+	const phases = phase === "all" ? [...SHIP_PHASES] : [phase];
+	console.log();
+	console.log(pc.bold(`  amba ship ${pc.cyan(config.app.name)} ${pc.dim(`v${config.app.version}`)}`));
+	console.log(pc.dim("  ─────────────────────────────────"));
+	console.log(pc.dim(`  phase=${phase} · platforms=${platforms.join(",")}${dryRun ? " · DRY-RUN" : ""}${options.force ? " · FORCE" : ""}`));
+	const result = await runShip({
+		config,
+		phases,
+		platforms,
+		exec: deps.exec ?? createNodeExecutor(dryRun),
+		dryRun,
+		force: options.force === true,
+		log: (line) => console.log(pc.dim(`    ${line}`)),
+		...deps.stateBaseDir !== void 0 ? { stateBaseDir: deps.stateBaseDir } : {},
+		...deps.resolveProjectId ? { resolveProjectId: deps.resolveProjectId } : {},
+		...deps.adminGet ? { adminGet: deps.adminGet } : {},
+		...deps.now ? { now: deps.now } : {},
+		...deps.sleep ? { sleep: deps.sleep } : {},
+		...deps.releasePollMs !== void 0 ? { releasePollMs: deps.releasePollMs } : {},
+		...deps.releaseMaxWaitMs !== void 0 ? { releaseMaxWaitMs: deps.releaseMaxWaitMs } : {}
+	});
+	renderTable(result.rows);
+	renderGates(result.rows);
+	if (result.failed) {
+		const bad = result.rows.find((r) => r.status === "failed");
+		throw new Error(`Launch failed${bad ? ` at ${bad.phase}` : ""}: ${bad?.detail ?? "see above"}`);
+	}
+	if (dryRun) {
+		console.log(pc.green("  ✓") + " Dry-run complete — nothing was changed.");
+		console.log();
+		return;
+	}
+	if (result.blocked) {
+		const gates = result.rows.filter((r) => r.status === "gate").length;
+		console.log(pc.yellow("  ⏸ Launch paused") + pc.dim(` — ${gates} gate(s) need a manual store action (above). Clear them, then re-run `) + pc.cyan("amba ship") + pc.dim("."));
+		console.log();
+		return;
 	}
+	console.log(pc.green("  ✓") + " Launch run complete.");
+	console.log();
 }
-/**
-* Parse an index spec into the wire shape data's API expects.
-*
-* Input syntax (CLI-friendly): `"col1 [asc|desc], col2 [asc|desc]"`.
-* Wire shape (per data's contract): `{ columns: ['col1 desc', 'col2 asc'] }` —
-* direction is embedded in each column string and parsed by the DDL emit.
-*
-* Bare column names (no direction) are passed through verbatim; the
-* default sort direction is the DDL emit's responsibility.
-*/
-function parseIndexSpec(spec) {
-	const cols = [];
-	for (const part of spec.split(",")) {
-		const trimmed = part.trim();
-		if (!trimmed) throw new Error(`Invalid index spec '${spec}'.`);
-		const m = /^([a-zA-Z_][a-zA-Z0-9_]*)(?:\s+(asc|desc))?$/i.exec(trimmed);
-		if (!m) throw new Error(`Invalid index column '${trimmed}'. Expected '<col>' or '<col> asc|desc'.`);
-		const colName = m[1];
-		const direction = m[2]?.toLowerCase();
-		cols.push(direction ? `${colName} ${direction}` : colName);
+async function shipInitCommand(options = {}) {
+	const file = options.config ?? "amba.ship.json";
+	const path = resolve(file);
+	if (!options.force) {
+		if (await access(path).then(() => true, () => false)) throw new Error(`${file} already exists. Pass ${pc.cyan("--force")} to overwrite it.`);
 	}
-	return { columns: cols };
+	const template = shipConfigTemplate((options.slug ?? "my-app").toLowerCase());
+	await writeFile(path, JSON.stringify(template, null, 2) + "\n", "utf-8");
+	console.log();
+	console.log(pc.green("  ✓") + ` Wrote ${pc.cyan(file)}.`);
+	console.log(pc.dim("    Edit the app IDs, then ") + pc.cyan("amba ship --phase preflight") + pc.dim(" to check your setup."));
+	console.log();
 }
 //#endregion
 //#region src/_internal/codegen.ts
@@ -6334,8 +8619,22 @@ const PG_TYPE_TO_TS = {
 	jsonb: "unknown",
 	json: "unknown"
 };
+const ARRAY_UDT_TO_TS = {
+	_text: "string",
+	_varchar: "string",
+	_uuid: "string",
+	_int4: "number",
+	_int8: "number",
+	_int2: "number",
+	_numeric: "number",
+	_float8: "number",
+	_float4: "number",
+	_bool: "boolean"
+};
 function tsTypeForColumn(col) {
-	const base = PG_TYPE_TO_TS[col.data_type] ?? "unknown";
+	let base;
+	if (col.data_type === "ARRAY") base = `${col.udt_name ? ARRAY_UDT_TO_TS[col.udt_name] ?? "unknown" : "unknown"}[]`;
+	else base = PG_TYPE_TO_TS[col.data_type] ?? "unknown";
 	if (col.column_name === "deleted_at") return "string | null";
 	if (col.is_nullable === "YES") return `${base} | null`;
 	return base;
@@ -6885,9 +9184,351 @@ async function domainsListCommand() {
 	console.log();
 }
 //#endregion
+//#region src/commands/iac.ts
+/**
+* `amba apply` / `amba diff` / `amba export` — declarative
+* infrastructure-as-code for a project's reusable configuration.
+*
+* A declarative bundle (default `amba.config.json`) captures the entities a
+* developer hand-builds once and wants to stand up identically elsewhere:
+* remote configs, collection schemas, content libraries + items, currencies,
+* achievements, streaks, challenges, leaderboards, and xp_rules. It carries
+* CONFIGURATION ONLY — no secrets, no per-user data.
+*
+* These commands wrap the platform's promotion endpoints:
+*   GET  /v1/admin/projects/:p/promotion/export
+*   POST /v1/admin/projects/:p/promotion/import   (mode=skip_existing|merge)
+*
+*   - `amba export [file]`  writes the current project's bundle to disk.
+*   - `amba apply  [file]`  POSTs the local bundle to the import endpoint and
+*                           prints a `{ created, updated, skipped }` summary
+*                           per section (the server's authoritative result).
+*   - `amba diff   [file]`  shows what `apply` WOULD change without writing.
+*                           The import route has NO server-side dry-run, so
+*                           `diff` exports the current project and computes the
+*                           created/updated/skipped per section LOCALLY.
+*/
+/** Default declarative bundle filename when no `[file]` is passed. */
+const DEFAULT_BUNDLE_FILE = "amba.config.json";
+/** The ordered list of bundle sections + their natural-key field. */
+const BUNDLE_SECTIONS = [
+	{
+		key: "remote_configs",
+		naturalKey: "key"
+	},
+	{
+		key: "collections",
+		naturalKey: "name"
+	},
+	{
+		key: "currencies",
+		naturalKey: "code"
+	},
+	{
+		key: "achievements",
+		naturalKey: "key"
+	},
+	{
+		key: "streaks",
+		naturalKey: "key"
+	},
+	{
+		key: "leaderboards",
+		naturalKey: "name"
+	},
+	{
+		key: "xp_rules",
+		naturalKey: "name"
+	},
+	{
+		key: "challenges",
+		naturalKey: "name"
+	},
+	{
+		key: "content_libraries",
+		naturalKey: "name"
+	},
+	{
+		key: "monetization",
+		naturalKey: "key"
+	}
+];
+/**
+* Read + parse a declarative bundle from disk. JSON only — we deliberately
+* don't pull in a YAML dependency the CLI doesn't already ship (the package
+* has no YAML lib), so `.yaml`/`.yml` files are rejected with a clear hint
+* rather than silently mis-parsed.
+*/
+async function readBundleFile(file) {
+	const path = resolve(file);
+	if (/\.ya?ml$/i.test(path)) throw new Error(`YAML bundles are not supported. Convert ${file} to JSON (the bundle format is plain JSON).`);
+	let raw;
+	try {
+		raw = await readFile(path, "utf-8");
+	} catch {
+		throw new Error(`Bundle file not found: ${file}. Run \`amba export\` to scaffold one from your current project.`);
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(raw);
+	} catch (err) {
+		throw new Error(`Failed to parse ${file} as JSON: ${err instanceof Error ? err.message : String(err)}`);
+	}
+	if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`Bundle in ${file} must be a JSON object with a \`version\` field.`);
+	const bundle = parsed;
+	if (typeof bundle["version"] !== "number") throw new Error(`Bundle in ${file} is missing a numeric \`version\` field. Re-export it with \`amba export\`.`);
+	return bundle;
+}
+/**
+* Index a section array by its natural key. Definitions missing the key (or
+* non-object entries) are skipped — they can't be matched and the server
+* will reject them on apply.
+*/
+function indexByNaturalKey(items, naturalKey) {
+	const out = /* @__PURE__ */ new Map();
+	if (!Array.isArray(items)) return out;
+	for (const item of items) {
+		if (item === null || typeof item !== "object" || Array.isArray(item)) continue;
+		const rec = item;
+		const k = rec[naturalKey];
+		if (typeof k !== "string" && typeof k !== "number") continue;
+		out.set(String(k), rec);
+	}
+	return out;
+}
+/**
+* Pure section-by-section diff of a desired bundle against the current
+* project's exported bundle. The classification MIRRORS the server's import
+* (`apps/api/src/lib/promotion-bundle.ts`) so `amba diff` agrees with what
+* `amba apply` will report:
+*   - created — natural key absent in current.
+*   - updated — natural key present AND `mode === 'merge'`. The server runs an
+*               UNCONDITIONAL update for every existing key in merge mode and
+*               increments `updated` — it does NOT compare field values, so we
+*               don't either (a local field comparison made `diff` under-report).
+*   - skipped — natural key present under `skip_existing`; OR an existing
+*               collection (always — collections are create-if-absent, never
+*               merged); OR a `remote_configs` row flagged `is_system: true`
+*               (the server always skips those before any existence check); OR
+*               a desired row with no valid natural key (can't be matched
+*               against the export, and the server import dedups by that key —
+*               so it is never a reliable create).
+*
+* Within one bundle section, the server walks rows sequentially and each
+* insert mutates the DB, so a SECOND row sharing a natural key already created
+* by an EARLIER row in the same section is seen as existing (→ skip under
+* skip_existing, update under merge) rather than created a second time. We
+* track already-seen keys per section to mirror that, so duplicate-keyed local
+* rows don't inflate the `created` total versus what `apply` does.
+*/
+function computeLocalDiff(desired, current, mode) {
+	const diff = {};
+	for (const { key, naturalKey } of BUNDLE_SECTIONS) {
+		const desiredItems = desired[key];
+		if (!Array.isArray(desiredItems) || desiredItems.length === 0) continue;
+		const currentIndex = indexByNaturalKey(current[key], naturalKey);
+		const section = {
+			created: 0,
+			updated: 0,
+			skipped: 0
+		};
+		const seen = /* @__PURE__ */ new Set();
+		for (const item of desiredItems) {
+			if (item === null || typeof item !== "object" || Array.isArray(item)) continue;
+			const rec = item;
+			if (key === "remote_configs" && rec["is_system"] === true) {
+				section.skipped++;
+				continue;
+			}
+			const k = rec[naturalKey];
+			const matchKey = typeof k === "string" || typeof k === "number" ? String(k) : null;
+			if (matchKey === null) {
+				section.skipped++;
+				continue;
+			}
+			const existing = currentIndex.has(matchKey) || seen.has(matchKey);
+			seen.add(matchKey);
+			if (!existing) {
+				section.created++;
+				continue;
+			}
+			if (key === "collections" || mode === "skip_existing") {
+				section.skipped++;
+				continue;
+			}
+			section.updated++;
+		}
+		diff[key] = section;
+	}
+	const monDiff = computeMonetizationLocalDiff(desired["monetization"], current["monetization"], mode);
+	if (monDiff) diff["monetization"] = monDiff;
+	return diff;
+}
+/**
+* Natural keys per monetization sub-collection. All key on `key` except the
+* package join, which is unique within an offering — but for diff purposes the
+* package counts roll into their owning offering, so only the four top-level
+* collections are counted here.
+*/
+const MONETIZATION_SUBSECTIONS = [
+	"entitlements",
+	"products",
+	"offerings",
+	"paywalls"
+];
+function computeMonetizationLocalDiff(desired, current, mode) {
+	if (desired === null || typeof desired !== "object" || Array.isArray(desired)) return null;
+	const desiredObj = desired;
+	const currentObj = current !== null && typeof current === "object" && !Array.isArray(current) ? current : {};
+	const section = {
+		created: 0,
+		updated: 0,
+		skipped: 0
+	};
+	let any = false;
+	for (const sub of MONETIZATION_SUBSECTIONS) {
+		const desiredItems = desiredObj[sub];
+		if (!Array.isArray(desiredItems) || desiredItems.length === 0) continue;
+		any = true;
+		const currentIndex = indexByNaturalKey(currentObj[sub], "key");
+		const seen = /* @__PURE__ */ new Set();
+		for (const item of desiredItems) {
+			if (item === null || typeof item !== "object" || Array.isArray(item)) continue;
+			const k = item["key"];
+			const matchKey = typeof k === "string" || typeof k === "number" ? String(k) : null;
+			if (matchKey === null) {
+				section.skipped++;
+				continue;
+			}
+			const existing = currentIndex.has(matchKey) || seen.has(matchKey);
+			seen.add(matchKey);
+			if (!existing) section.created++;
+			else if (mode === "skip_existing") section.skipped++;
+			else section.updated++;
+		}
+	}
+	return any ? section : null;
+}
+/** Roll a per-section diff up into grand totals across every section. */
+function summarizeDiff(diff) {
+	return Object.values(diff).reduce((acc, s) => ({
+		created: acc.created + s.created,
+		updated: acc.updated + s.updated,
+		skipped: acc.skipped + s.skipped
+	}), {
+		created: 0,
+		updated: 0,
+		skipped: 0
+	});
+}
+function renderSummary(summary, verb) {
+	let created = 0;
+	let updated = 0;
+	let skipped = 0;
+	const sections = Object.keys(summary);
+	if (sections.length === 0) console.log(pc.dim("  Nothing to " + verb + " — bundle is empty."));
+	for (const section of sections) {
+		const s = summary[section];
+		created += s.created;
+		updated += s.updated;
+		skipped += s.skipped;
+		console.log(`  ${pc.bold(section)}  ${pc.green(`${s.created} created`)} · ${pc.cyan(`${s.updated} updated`)} · ` + pc.dim(`${s.skipped} skipped`));
+	}
+	console.log();
+	console.log(pc.dim(`  Total: ${created} created · ${updated} updated · ${skipped} skipped`));
+}
+/**
+* `amba export [file]` — write the current project's declarative bundle to
+* disk so it can be checked in, diffed, and re-applied.
+*/
+async function exportConfigCommand(file = DEFAULT_BUNDLE_FILE, options = {}) {
+	const projectId = await requireProjectId(process.cwd(), options.project);
+	const path = resolve(file);
+	console.log();
+	console.log(pc.bold(`  amba export ${pc.cyan(file)}`));
+	console.log(pc.dim("  ─────────────────────────────────"));
+	console.log();
+	console.log(pc.dim(`  Project: ${projectId}`));
+	console.log(pc.dim("  Fetching current configuration…"));
+	const bundle = (await exportPromotionBundle(projectId)).data;
+	await writeFile(path, JSON.stringify(bundle, null, 2) + "\n", "utf-8");
+	const sectionCount = BUNDLE_SECTIONS.reduce((sum, { key }) => {
+		const v = bundle[key];
+		if (Array.isArray(v)) return sum + v.length;
+		if (key === "monetization" && v !== null && typeof v === "object") {
+			const m = v;
+			return sum + MONETIZATION_SUBSECTIONS.reduce((n, sub) => n + (Array.isArray(m[sub]) ? m[sub].length : 0), 0);
+		}
+		return sum;
+	}, 0);
+	console.log();
+	console.log(pc.green("  ✓") + ` Wrote ${pc.cyan(file)} (${sectionCount} definitions).`);
+	console.log(pc.dim("    Edit it, then ") + pc.cyan("amba diff") + pc.dim(" to preview and ") + pc.cyan("amba apply") + pc.dim(" to apply."));
+	console.log();
+}
+/**
+* `amba apply [file]` — read a local declarative bundle and POST it to the
+* import endpoint. Prints the server's authoritative `{ created, updated,
+* skipped }` per section.
+*/
+async function applyConfigCommand(file = DEFAULT_BUNDLE_FILE, options = {}) {
+	const projectId = await requireProjectId(process.cwd(), options.project);
+	const mode = options.mode ?? "skip_existing";
+	const bundle = await readBundleFile(file);
+	console.log();
+	console.log(pc.bold(`  amba apply ${pc.cyan(file)}`));
+	console.log(pc.dim("  ─────────────────────────────────"));
+	console.log();
+	console.log(pc.dim(`  Project: ${projectId}`));
+	console.log(pc.dim(`  Mode:    ${mode}`));
+	console.log(pc.dim("  Applying…"));
+	console.log();
+	let res;
+	try {
+		res = await importPromotionBundle(projectId, bundle, mode);
+	} catch (err) {
+		if (err instanceof ApiClientError && (err.statusCode === 400 || err.statusCode === 422)) throw new Error(`${err.message}\n  → Re-export a fresh bundle with \`amba export\` if this was hand-edited.`);
+		throw err;
+	}
+	renderSummary(res.data.summary, "apply");
+	console.log();
+}
+/**
+* `amba diff [file]` — show what `apply` WOULD change without writing.
+*
+* The import route has no server-side dry-run, so this fetches the current
+* project's exported bundle and computes the diff LOCALLY. Output mirrors the
+* `apply` summary shape so the two read identically.
+*/
+async function diffConfigCommand(file = DEFAULT_BUNDLE_FILE, options = {}) {
+	const projectId = await requireProjectId(process.cwd(), options.project);
+	const mode = options.mode ?? "skip_existing";
+	const desired = await readBundleFile(file);
+	console.log();
+	console.log(pc.bold(`  amba diff ${pc.cyan(file)}`));
+	console.log(pc.dim("  ─────────────────────────────────"));
+	console.log();
+	console.log(pc.dim(`  Project: ${projectId}`));
+	console.log(pc.dim(`  Mode:    ${mode}`));
+	console.log(pc.dim("  (computed locally — the import route has no server dry-run)"));
+	console.log(pc.dim("  Fetching current configuration…"));
+	console.log();
+	const diff = computeLocalDiff(desired, (await exportPromotionBundle(projectId)).data, mode);
+	renderSummary(diff, "change");
+	const totals = summarizeDiff(diff);
+	console.log();
+	if (totals.created > 0 || totals.updated > 0) console.log(pc.dim("  Run ") + pc.cyan(`amba apply ${file}`) + pc.dim(" to apply these changes."));
+	else if (totals.skipped > 0) if (mode === "skip_existing") {
+		console.log(pc.green("  ✓") + " apply would make no changes (skip_existing leaves existing entities untouched).");
+		console.log(pc.dim("    Skipped entities are NOT compared — re-run with ") + pc.cyan("--mode merge") + pc.dim(" to overwrite them, or `amba export` to see current values."));
+	} else console.log(pc.green("  ✓") + " apply would make no changes.");
+	else console.log(pc.green("  ✓") + " No changes — nothing in the bundle to apply.");
+	console.log();
+}
+//#endregion
 //#region src/index.ts
 const program = new Command();
-program.name("amba").description("amba — agent-native backend-as-a-service for mobile apps.").version("0.1.0");
+program.name("amba").description("amba — agent-native backend-as-a-service for mobile apps.").version("4.1.0");
 program.option("--token <pat>", "Use a Personal Access Token for headless / CI / agent use (overrides ~/.amba/credentials.json + AMBA_PAT env)");
 program.hook("preAction", (thisCommand) => {
 	setBearerOverride(resolveTokenSource({
@@ -7029,8 +9670,8 @@ program.command("schema").description("Schema export commands").command("export"
 	}));
 });
 const functions = program.command("functions").description("Customer serverless functions deployed to the edge");
-functions.command("deploy <file>").description("Bundle a function file and deploy to the dispatch namespace").option("--name <name>", "Function name (default: filename without extension)").option("--dry-run", "Bundle and report size without uploading").option("--rate-limit-window <duration>", "Rate-limit window: 60s | 5m | 1h").option("--rate-limit-max <int>", "Rate-limit max requests per window", (v) => Number.parseInt(v, 10)).option("--rate-limit-key <kind>", "Rate-limit bucket key: user_id | ip").action(async (file, opts) => {
-	await runAction(() => functionsDeployCommand(file, opts));
+functions.command("deploy <target>").description("Bundle a function (a single file OR a directory) and deploy to the dispatch namespace. A directory resolves its entry by convention (index.ts/js/mjs) or via --entry.").option("--name <name>", "Function name (default: file name without extension, or the directory leaf name)").option("--entry <file>", "Entry file when <target> is a directory (relative to it). Default: index.ts/js/mjs.").option("--dry-run", "Bundle and report size without uploading").option("--rate-limit-window <duration>", "Rate-limit window: 60s | 5m | 1h").option("--rate-limit-max <int>", "Rate-limit max requests per window", (v) => Number.parseInt(v, 10)).option("--rate-limit-key <kind>", "Rate-limit bucket key: user_id | ip").option("--public", "Deploy WITHOUT the X-Api-Key gate so external webhook senders can call it. You MUST verify the webhook signature in your handler. Default: private.").action(async (target, opts) => {
+	await runAction(() => functionsDeployCommand(target, opts));
 });
 functions.command("list").description("List active functions for the current project").action(async () => {
 	await runAction(functionsListCommand);
@@ -7047,11 +9688,13 @@ functions.command("dev <file>").description("Run a local dev server for your fun
 		noWatch: opts.watch === false
 	}));
 });
-functions.command("logs <name>").description("Stream log events for a deployed function").option("--since <iso>", "Start of the time range (default: 1 hour ago)").option("--until <iso>", "End of the time range (default: now). Ignored on --tail.").option("--limit <n>", "Max events per fetch (default 100, max 1000)", (v) => parseInt(v, 10)).option("--tail", "Follow new events; polls every 3s. Ctrl+C to stop.").option("--follow", "Alias for --tail (kept for backwards compatibility with v1 log commands).").option("--json", "NDJSON output to stdout (one event per line)").action(async (name, opts) => {
+functions.command("logs <name>").description("Stream log events for a deployed function").option("--since <iso>", "Start of the time range (default: 1 hour ago)").option("--until <iso>", "End of the time range (default: now). Ignored on --tail.").option("--limit <n>", "Max events per fetch (default 100, max 1000)", (v) => parseInt(v, 10)).option("--request-id <id>", "Only show events whose logs mention this request id (e.g. r_...). Works with --tail.").option("--since-request-id <id>", "Start the range at the oldest event mentioning this request id (e.g. r_...) — \"everything from this request onward\". Searches the last 24h (or --since/--until when given). Works with --tail.").option("--tail", "Follow new events; polls every 3s. Ctrl+C to stop.").option("--follow", "Alias for --tail (kept for backwards compatibility with v1 log commands).").option("--json", "NDJSON output to stdout (one event per line)").action(async (name, opts) => {
 	await runAction(() => functionsLogsCommand(name, {
 		since: opts.since,
 		until: opts.until,
 		limit: opts.limit,
+		requestId: opts.requestId,
+		sinceRequestId: opts.sinceRequestId,
 		tail: opts.tail || opts.follow,
 		json: opts.json
 	}));
@@ -7114,8 +9757,77 @@ billing.command("set-ceiling <amount>").description("Cap the monthly bill at <am
 	}
 	await runAction(() => billingSetCeilingCommand({ ceiling }));
 });
+const payments = program.command("payments").description("Accept payments in your app (Amba is the rail; your app is the seller)");
+payments.command("setup").description("Create the connected payments account and print the hosted onboarding URL").option("--country <code>", "Two-letter ISO country code for the seller (e.g. US)").option("--email <email>", "Contact email for the connected account").action(async (opts) => {
+	if (opts.country && !/^[A-Za-z]{2}$/.test(opts.country)) {
+		console.log("  ✗ --country must be a two-letter ISO code (e.g. US)");
+		process.exit(1);
+	}
+	await runAction(() => paymentsSetupCommand({
+		country: opts.country ? opts.country.toUpperCase() : void 0,
+		email: opts.email
+	}));
+});
+payments.command("status").description("Show onboarding stage + whether charges/payouts are enabled").action(async () => {
+	await runAction(paymentsStatusCommand);
+});
+payments.command("set-fee <bps>").description("Set the default platform fee in basis points (250 = 2.5%), or 'off' to clear").action(async (bps) => {
+	let value;
+	if (bps.toLowerCase() === "off" || bps === "") value = null;
+	else {
+		const parsed = Number(bps);
+		if (!Number.isInteger(parsed) || parsed < 0 || parsed > 1e4) {
+			console.log("  ✗ bps must be an integer between 0 and 10000, or \"off\"");
+			process.exit(1);
+		}
+		value = parsed;
+	}
+	await runAction(() => paymentsSetFeeCommand({ bps: value }));
+});
+payments.command("balance").description("Show the connected account's available and pending balance").action(async () => {
+	await runAction(paymentsBalanceCommand);
+});
+payments.command("payouts").description("List recent payouts to the seller bank account").option("--limit <n>", "How many payouts to show (default 10)").action(async (opts) => {
+	const limit = opts.limit ? Number(opts.limit) : void 0;
+	if (limit !== void 0 && (!Number.isInteger(limit) || limit < 1 || limit > 100)) {
+		console.log("  ✗ --limit must be an integer between 1 and 100");
+		process.exit(1);
+	}
+	await runAction(() => paymentsPayoutsCommand({ limit }));
+});
+const monetization = program.command("monetization").description("Monetization control plane: plan, drift, export, adopt, and apply your subscription config as Infrastructure-as-Code.");
+monetization.command("plan").description("Preview the three-way diff (declared vs adopted vs live) + store-floor + drift").action(async () => {
+	await runAction(monetizationPlanCommand);
+});
+monetization.command("drift").description("Show managed objects changed out-of-band in the provider").action(async () => {
+	await runAction(monetizationDriftCommand);
+});
+monetization.command("export").description("Snapshot the live monetization config to a declarative bundle (stdout or --file)").option("--file <path>", "Write the bundle to this file instead of stdout").action(async (opts) => {
+	await runAction(() => monetizationExportCommand(opts));
+});
+monetization.command("adopt").description("Record the live config as the managed baseline (writes Amba state only; idempotent)").option("--all", "Adopt the entire live config").action(async (opts) => {
+	await runAction(() => monetizationAdoptCommand(opts));
+});
+monetization.command("apply").description("Apply the declared config to the provider. Additive ops (create entitlements/offerings/packages/paywall-drafts + attach products) apply automatically; destructive ops (detach/archive/remove) need --confirm.").option("--confirm", "Confirm and execute the gated destructive ops (detach/archive/remove). Without it they are reported but not run.").option("--allow-detach-live", "Accept detaching a product a live customer currently resolves (otherwise refused).").option("--reconcile <mode>", "Out-of-band drift mode: 'amba' (default) or 'adopt'.").action(async (opts) => {
+	await runAction(() => monetizationApplyCommand(opts));
+});
+program.command("ship").description("Take this Expo app from code-complete to live on the App Store + Google Play (preflight → monetization → build → submit → metadata → release).").option("--phase <phase>", `Run a single phase (${SHIP_PHASES.join(" | ")}) instead of the whole pipeline.`).option("--platform <platform>", "Limit to 'ios' | 'android' (default: build.platforms from the config).").option("--dry-run", "Print the plan; make no cloud changes and no state writes.").option("--force", "Re-run phases already recorded as done.").option("--config <path>", `Config file (default: ${DEFAULT_SHIP_CONFIG_FILE}).`).action(async (opts) => {
+	await runAction(() => shipCommand({
+		phase: opts.phase,
+		platform: opts.platform,
+		dryRun: opts.dryRun,
+		force: opts.force,
+		config: opts.config
+	}));
+}).command("init").description(`Scaffold a ${DEFAULT_SHIP_CONFIG_FILE} for this app`).option("--config <path>", `Output file (default: ${DEFAULT_SHIP_CONFIG_FILE})`).option("--slug <slug>", "App slug used to scope the launch state (default: my-app)").option("--force", "Overwrite an existing config file").action(async (opts) => {
+	await runAction(() => shipInitCommand({
+		config: opts.config,
+		slug: opts.slug,
+		force: opts.force
+	}));
+});
 const collections = program.command("collections").description("Customer collections (schema-first Postgres in each tenant database)");
-collections.command("create <name>").description("Create a collection with the given fields").option("--field <spec>", "Field spec: name:type[:nullable] (e.g. user_id:uuid, parsed:jsonb:nullable). Repeatable.", (val, prev) => [...prev ?? [], val], []).option("--index <spec>", "Index spec: \"col1 [asc|desc], col2 [asc|desc]\". Repeatable.", (val, prev) => [...prev ?? [], val], []).action(async (name, opts) => {
+collections.command("create <name>").description("Create a collection with the given fields").option("--field <spec>", "Field spec: name:type[:nullable] (e.g. user_id:uuid, tags:text[], parsed:jsonb:nullable, embedding:vector:1536). Repeatable.", (val, prev) => [...prev ?? [], val], []).option("--index <spec>", "Index spec: \"col1 [asc|desc], col2 [asc|desc]\". Repeatable.", (val, prev) => [...prev ?? [], val], []).action(async (name, opts) => {
 	await runAction(() => collectionsCreateCommand(name, opts));
 });
 collections.command("alter <name>").description("Add columns / indexes or drop columns on an existing collection").option("--add-field <spec>", "Column to add (name:type[:nullable]). Repeatable.", (val, prev) => [...prev ?? [], val], []).option("--add-index <spec>", "Index to add (\"col [asc|desc], …\"). Repeatable.", (val, prev) => [...prev ?? [], val], []).option("--drop-field <name>", "Column to drop (DESTRUCTIVE — requires --confirm <name>). Repeatable.", (val, prev) => [...prev ?? [], val], []).option("--confirm <name>", "Confirm a destructive --drop-field <name>. Repeatable.", (val, prev) => [...prev ?? [], val], []).action(async (name, opts) => {
@@ -7131,7 +9843,7 @@ program.command("types").description("TypeScript codegen for collections").comma
 	await runAction(() => typesGenerateCommand(opts));
 });
 const sites = program.command("sites").description("Static site hosting");
-sites.command("deploy <dir>").description("Upload a built static-site directory to Pages-for-Platforms").option("--name <name>", "Site name (default: basename of dir, slug-cleaned)").option("--dry-run", "Scan + size-check without uploading").action(async (dir, opts) => {
+sites.command("deploy <dir>").description("Upload a built static-site directory to Amba site hosting").option("--name <name>", "Site name (default: basename of dir, slug-cleaned)").option("--dry-run", "Scan + size-check without uploading").action(async (dir, opts) => {
 	await runAction(() => sitesDeployCommand(dir, opts));
 });
 sites.command("list").description("List sites for the current project").action(async () => {
@@ -7199,6 +9911,29 @@ aiProviders.command("list").description("List registered AI providers for the cu
 aiProviders.command("delete <provider>").description("Remove a provider registration (refuses if active prompts reference it)").action(async (provider) => {
 	await runAction(() => aiProvidersDeleteCommand(provider));
 });
+function parseImportMode(raw) {
+	if (raw === void 0) return "skip_existing";
+	if (raw === "merge" || raw === "skip_existing") return raw;
+	console.log("  ✗ --mode must be \"skip_existing\" (default) or \"merge\"");
+	process.exit(1);
+}
+program.command("export [file]").description("Write the current project's declarative configuration bundle to disk (default: amba.config.json)").option("--project <id>", "Project id (overrides .env.local)").action(async (file, opts) => {
+	await runAction(() => exportConfigCommand(file, { project: opts.project }));
+});
+program.command("diff [file]").description("Show what `amba apply` WOULD change (created/updated/skipped per section) without writing. Computed locally by exporting the current project and comparing — the import route has no server dry-run.").option("--project <id>", "Project id (overrides .env.local)").option("--mode <mode>", "'skip_existing' (default) or 'merge'").action(async (file, opts) => {
+	const mode = parseImportMode(opts.mode);
+	await runAction(() => diffConfigCommand(file, {
+		project: opts.project,
+		mode
+	}));
+});
+program.command("apply [file]").description("Apply a declarative configuration bundle (default: amba.config.json) — JSON only. Prints { created, updated, skipped } per section.").option("--project <id>", "Project id (overrides .env.local)").option("--mode <mode>", "'skip_existing' (default — no-op on conflict) or 'merge' (refresh existing definitions)").action(async (file, opts) => {
+	const mode = parseImportMode(opts.mode);
+	await runAction(() => applyConfigCommand(file, {
+		project: opts.project,
+		mode
+	}));
+});
 program.parse();
 //#endregion
 export {};