@layers/amba 4.1.1 → 4.1.2

package/dist/api-client.d.ts

@@ -23,6 +23,26 @@ export interface ProjectSummary {
     google_oauth_client_id?: string | null;
     status?: string;
     created_at?: string;
+    /** Persisted subscription/accounting tier. */
+    tier?: 'free' | 'pro' | 'scale' | 'enterprise';
+    /** Runtime entitlement tier; differs from `tier` for comped projects. */
+    effective_tier?: 'free' | 'pro' | 'scale' | 'enterprise';
+    comped?: boolean;
+}
+export interface CreatedProject extends ProjectSummary {
+    api_keys?: {
+        client: {
+            key: string;
+            prefix?: string;
+            type?: 'client';
+        };
+        server: {
+            key: string;
+            prefix?: string;
+            type?: 'server';
+        };
+    };
+    provisioning_status?: string;
 }
 export declare function listProjects(): Promise<ApiListResponse<ProjectSummary>>;
 export declare function createProject(input: {
@@ -41,12 +61,7 @@ export declare function createProject(input: {
      * bootstrap. Defaults to `'production'` when omitted.
      */
     environment?: 'development' | 'production';
-}): Promise<ApiResponse<{
-    id: string;
-    name: string;
-    platform: string;
-    environment?: string;
-}>>;
+}): Promise<ApiResponse<CreatedProject>>;
 /**
  * PATCH /admin/projects/:projectId — update mutable fields. Server
  * silently ignores unknown keys; we filter to the documented allow-list
@@ -281,6 +296,48 @@ export interface FunctionDeploymentRow {
      *  function so external webhook senders can reach it. Default false. */
     is_public?: boolean;
 }
+/** Provider-neutral lifecycle for an exact hostname bound to one function. */
+export interface FunctionDomain {
+    id: string;
+    project_id: string;
+    function_name: string;
+    hostname: string;
+    cert_status: 'pending_validation' | 'pending_issuance' | 'pending_deployment' | 'active' | 'error';
+    ownership_status: 'pending' | 'active' | 'error';
+    /** True only when certificate/ownership are active and routing reconciliation succeeded. */
+    live: boolean;
+    created_at: string;
+    updated_at: string;
+}
+export interface FunctionDomainValidationRecord {
+    txt_name?: string;
+    txt_value?: string;
+    http_url?: string;
+    http_body?: string;
+}
+export interface FunctionDomainOwnershipVerification {
+    type?: string;
+    name?: string;
+    value?: string;
+}
+/** Attach always returns DNS instructions; refresh may add them when available. */
+export interface AttachedFunctionDomain extends FunctionDomain {
+    dns_target: string;
+    /** Additive status when Amba controls the purchased domain's DNS zone. */
+    dns_autoconfigured?: boolean;
+    dns_records_published?: number;
+    /** True when automatic DNS publication failed and refresh should be retried. */
+    dns_error?: boolean;
+    ssl_validation: FunctionDomainValidationRecord[];
+    ownership_verification: FunctionDomainOwnershipVerification | null;
+    ownership_verification_http: {
+        http_url?: string;
+        http_body?: string;
+    } | null;
+}
+export type RefreshedFunctionDomain = FunctionDomain & Partial<Pick<AttachedFunctionDomain, 'dns_target' | 'dns_autoconfigured' | 'dns_records_published' | 'dns_error' | 'ssl_validation' | 'ownership_verification' | 'ownership_verification_http'>> & {
+    cleanup_pending?: boolean;
+};
 export declare function recordFunctionDeployment(projectId: string, input: {
     name: string;
     runtime_script_name: string;
@@ -324,6 +381,17 @@ export declare function deployFunctionViaApi(projectId: string, input: {
 export declare function listFunctionDeployments(projectId: string, options?: {
     activeOnly?: boolean;
 }): Promise<ApiListResponse<FunctionDeploymentRow>>;
+/** Attach one exact hostname to one deployed function. */
+export declare function attachFunctionDomainViaApi(projectId: string, functionName: string, hostname: string): Promise<ApiResponse<AttachedFunctionDomain>>;
+/** List provider-neutral ownership/certificate status for a function's hostnames. */
+export declare function listFunctionDomainsViaApi(projectId: string, functionName: string): Promise<ApiListResponse<FunctionDomain>>;
+/** Re-poll DNS ownership and certificate state for one exact hostname. */
+export declare function refreshFunctionDomainViaApi(projectId: string, functionName: string, hostname: string): Promise<ApiResponse<RefreshedFunctionDomain>>;
+/** Detach one exact hostname from a function. */
+export declare function removeFunctionDomainViaApi(projectId: string, functionName: string, hostname: string): Promise<ApiResponse<{
+    hostname: string;
+    deleted: true;
+}>>;
 export interface FunctionDeployContext {
     /** Dispatch namespace for the script PUT (e.g. `amba_tenant_functions`). */
     dispatch_namespace: string;
@@ -382,6 +450,11 @@ export interface FunctionLogEvent {
 export interface FunctionLogsResponse {
     events: FunctionLogEvent[];
     truncated: boolean;
+    /** Provider-neutral freshness for the underlying log-ingestion stream. */
+    ingestion?: {
+        status: 'current' | 'delayed' | 'no_batches' | 'unknown' | 'historical';
+        latest_batch_at: string | null;
+    };
     since: string;
     until: string;
     /** Present when `since_request_id` anchored the range — the anchor event's timestamp. */
@@ -419,7 +492,7 @@ export interface SecretSyncPendingRow {
     function_name: string | null;
     secret_name: string;
     expected_version: number;
-    status: 'pending' | 'syncing' | 'sync_failed_retrying' | 'synced';
+    status: 'pending' | 'syncing' | 'sync_failed_retrying' | 'synced' | 'revocation_pending' | 'revoking' | 'revoke_failed_retrying';
     last_error: string | null;
     attempts: number;
     created_at: string;
@@ -441,7 +514,7 @@ export interface SetSecretResultRow {
     /** Backend version resource path — exposed for ops debugging. */
     version_path: string;
     /** `'pending'` until the secret sync completes. */
-    sync_status: 'pending' | 'syncing' | 'sync_failed_retrying' | 'synced';
+    sync_status: 'pending';
     created_at: string;
 }
 export declare function setSecretViaApi(projectId: string, input: {
@@ -463,7 +536,7 @@ export interface ListSecretsRow {
     name: string;
     /** Latest secret-store version number. */
     version: number;
-    sync_status: 'pending' | 'syncing' | 'sync_failed_retrying' | 'synced';
+    sync_status: 'pending' | 'syncing' | 'sync_failed_retrying' | 'synced' | 'revocation_pending' | 'revoking' | 'revoke_failed_retrying';
     attempts: number;
     last_error: string | null;
     updated_at: string;
@@ -473,11 +546,7 @@ export declare function listSecretsViaApi(projectId: string, options?: {
 }): Promise<ApiListResponse<ListSecretsRow>>;
 export declare function deleteSecretViaApi(projectId: string, name: string, options?: {
     function?: string;
-}): Promise<ApiResponse<{
-    name: string;
-    function: string | null;
-    deleted: true;
-}>>;
+}): Promise<void>;
 /** Closed set of column types the server accepts. */
 export type CollectionColumnType = 'uuid' | 'text' | 'integer' | 'bigint' | 'numeric' | 'boolean' | 'timestamptz' | 'date' | 'jsonb' | 'vector' | 'text[]' | 'integer[]' | 'bigint[]' | 'numeric[]' | 'boolean[]' | 'uuid[]';
 export interface CollectionColumn {

package/dist/bundle.d.ts

@@ -76,8 +76,8 @@ export declare class BundleSizeError extends Error {
 export declare const HANDLER_SHAPE_FIX_MESSAGE: string;
 /** Message used when the entry file has no `export default` at all. */
 export declare const HANDLER_SHAPE_MISSING_DEFAULT_MESSAGE: string;
-/** Message used when the default export is present but has no `fetch` method. */
-export declare const HANDLER_SHAPE_NO_FETCH_MESSAGE: string;
+/** Back-compatible export name for the no-supported-handler message. */
+export declare const HANDLER_SHAPE_NO_FETCH_MESSAGE = "Function entrypoint must have a callable `fetch` or `scheduled` method on its default export.";
 /**
  * Thrown when the bundled entry's `export default` is not the Module Worker
  * shape (`{ fetch(req, env, ctx) }`). Raised BEFORE any upload so a wrong

package/dist/commands/function-domains.d.ts

@@ -0,0 +1,5 @@
+/** `amba functions domains ...` exact-hostname lifecycle commands. */
+export declare function functionDomainsAttachCommand(functionName: string, hostnameInput: string): Promise<void>;
+export declare function functionDomainsListCommand(functionName: string): Promise<void>;
+export declare function functionDomainsRefreshCommand(functionName: string, hostnameInput: string): Promise<void>;
+export declare function functionDomainsRemoveCommand(functionName: string, hostnameInput: string): Promise<void>;

package/dist/index.js

@@ -864,6 +864,7 @@ async function request(method, path, body) {
 		} catch {}
 		throw new ApiClientError(errorMessage, res.status, errorCode);
 	}
+	if (res.status === 204) return void 0;
 	return await res.json();
 }
 /**
@@ -880,7 +881,13 @@ async function listProjects() {
 	return request("GET", "/projects");
 }
 async function createProject(input) {
-	return request("POST", "/projects", input);
+	const response = await request("POST", "/projects", input);
+	if ("project" in response.data) return { data: {
+		...response.data.project,
+		api_keys: response.data.api_keys,
+		provisioning_status: response.data.provisioning_status
+	} };
+	return response;
 }
 /**
 * PATCH /admin/projects/:projectId — update mutable fields. Server
@@ -1019,6 +1026,25 @@ async function deployFunctionViaApi(projectId, input) {
 async function listFunctionDeployments(projectId, options = {}) {
 	return request("GET", `/projects/${projectId}/functions/deployments${options.activeOnly ? "?active=1" : ""}`);
 }
+function functionDomainsPath(projectId, functionName) {
+	return `/projects/${encodeURIComponent(projectId)}/functions/${encodeURIComponent(functionName)}/domains`;
+}
+/** Attach one exact hostname to one deployed function. */
+async function attachFunctionDomainViaApi(projectId, functionName, hostname) {
+	return request("POST", functionDomainsPath(projectId, functionName), { hostname });
+}
+/** List provider-neutral ownership/certificate status for a function's hostnames. */
+async function listFunctionDomainsViaApi(projectId, functionName) {
+	return request("GET", functionDomainsPath(projectId, functionName));
+}
+/** Re-poll DNS ownership and certificate state for one exact hostname. */
+async function refreshFunctionDomainViaApi(projectId, functionName, hostname) {
+	return request("POST", `${functionDomainsPath(projectId, functionName)}/${encodeURIComponent(hostname)}/refresh`);
+}
+/** Detach one exact hostname from a function. */
+async function removeFunctionDomainViaApi(projectId, functionName, hostname) {
+	return request("DELETE", `${functionDomainsPath(projectId, functionName)}/${encodeURIComponent(hostname)}`);
+}
 async function scheduleFunction(projectId, input) {
 	return request("POST", `/projects/${projectId}/functions/schedules`, input);
 }
@@ -2002,7 +2028,11 @@ async function ensureProjectForCwd(cwd, options) {
 		name: uniqueName,
 		environment
 	});
-	const { clientKey, serverKey } = await mintProjectKeyPair(project.data.id, environment);
+	const initialKeys = project.data.api_keys;
+	const { clientKey, serverKey } = initialKeys ? {
+		clientKey: initialKeys.client.key,
+		serverKey: initialKeys.server.key
+	} : await mintProjectKeyPair(project.data.id, environment);
 	const creds = {
 		version: 1,
 		project_id: project.data.id,
@@ -2924,7 +2954,7 @@ That's the entire setup. The CLI:
    detects on disk — Claude Code, Cursor, Windsurf.
 6. Verifies the PAT against the API and confirms it's good.
 
-The Amba MCP toolset (\`amba_*\` tools — ~130 of them) is available to
+The Amba MCP toolset (\`amba_*\` tools — 500+ of them) is available to
 the agent immediately: pass the freshly-minted \`pat\` as an inline
 argument on every \`amba_*\` call in the current session. The next time
 your MCP client starts it picks the PAT up from the config as the
@@ -3874,6 +3904,7 @@ async function initCommand(options = {}) {
 		const defaultProjectName = basename(cwd) || "amba-project";
 		let projectId;
 		let projectName;
+		let createdKeys = null;
 		if (linkedProject) {
 			projectId = linkedProject.project_id;
 			projectName = linkedProject.project_name;
@@ -3910,20 +3941,30 @@ async function initCommand(options = {}) {
 				} else {
 					const name = await prompt(`  Project name (default: ${defaultProjectName}): `);
 					const finalName = name.length > 0 ? name : defaultProjectName;
-					projectId = (await createProject({
+					const res = await createProject({
 						name: finalName,
 						environment
-					})).data.id;
+					});
+					projectId = res.data.id;
 					projectName = finalName;
+					if (res.data.api_keys) createdKeys = {
+						clientKey: res.data.api_keys.client.key,
+						serverKey: res.data.api_keys.server.key
+					};
 				}
 			} else {
 				const name = await prompt(`  Project name (default: ${defaultProjectName}): `);
 				const finalName = name.length > 0 ? name : defaultProjectName;
-				projectId = (await createProject({
+				const res = await createProject({
 					name: finalName,
 					environment
-				})).data.id;
+				});
+				projectId = res.data.id;
 				projectName = finalName;
+				if (res.data.api_keys) createdKeys = {
+					clientKey: res.data.api_keys.client.key,
+					serverKey: res.data.api_keys.server.key
+				};
 			}
 		}
 		if (spinner.stopped) spinner = createSpinner("minting keys");
@@ -3935,6 +3976,9 @@ async function initCommand(options = {}) {
 			clientKey = linkedProject.client_key;
 			if (linkedProject.server_key) serverKey = linkedProject.server_key;
 			else serverKey = (await createApiKey(projectId, "server", environment)).data.key;
+		} else if (createdKeys) {
+			clientKey = createdKeys.clientKey;
+			serverKey = createdKeys.serverKey;
 		} else {
 			const clientRes = await createApiKey(projectId, "client", environment);
 			const serverRes = await createApiKey(projectId, "server", environment);
@@ -5562,11 +5606,11 @@ var BundleSizeError = class extends Error {
 * service-worker shape (`export default async function (req) { … }`) is
 * rejected by the runtime at upload, so we reject it before the round-trip.
 */
-const HANDLER_SHAPE_FIX_MESSAGE = "Function entrypoint must `export default { async fetch(req, env, ctx) { … } }` (the Module Worker shape). Found a default-exported function instead.";
+const HANDLER_SHAPE_FIX_MESSAGE = "Function entrypoint must `export default { async fetch(req, env, ctx) { … } }` or `export default { async scheduled(controller, env, ctx) { … } }` (the Module Worker shape). Found a default-exported function instead.";
 /** Message used when the entry file has no `export default` at all. */
-const HANDLER_SHAPE_MISSING_DEFAULT_MESSAGE = "Function entrypoint must `export default { async fetch(req, env, ctx) { … } }` (the Module Worker shape). No default export was found.";
-/** Message used when the default export is present but has no `fetch` method. */
-const HANDLER_SHAPE_NO_FETCH_MESSAGE = "Function entrypoint must `export default { async fetch(req, env, ctx) { … } }` (the Module Worker shape). The default export has no `fetch` method.";
+const HANDLER_SHAPE_MISSING_DEFAULT_MESSAGE = "Function entrypoint must `export default { async fetch(req, env, ctx) { … } }` or `export default { async scheduled(controller, env, ctx) { … } }` (the Module Worker shape). No default export was found.";
+/** Back-compatible export name for the no-supported-handler message. */
+const HANDLER_SHAPE_NO_FETCH_MESSAGE = "Function entrypoint must have a callable `fetch` or `scheduled` method on its default export.";
 /**
 * Thrown when the bundled entry's `export default` is not the Module Worker
 * shape (`{ fetch(req, env, ctx) }`). Raised BEFORE any upload so a wrong
@@ -5600,11 +5644,14 @@ function assertHandlerShape(mod) {
 	const def = mod.default;
 	if (def === void 0 || def === null) throw new HandlerShapeError(HANDLER_SHAPE_MISSING_DEFAULT_MESSAGE, "missing-default");
 	if (typeof def === "function") {
-		if (typeof def.fetch !== "function") throw new HandlerShapeError(HANDLER_SHAPE_FIX_MESSAGE, "plain-function");
+		const fetchOnFn = def.fetch;
+		const scheduledOnFn = def.scheduled;
+		if (typeof fetchOnFn !== "function" && typeof scheduledOnFn !== "function") throw new HandlerShapeError(HANDLER_SHAPE_FIX_MESSAGE, "plain-function");
 		return;
 	}
 	if (typeof def !== "object") throw new HandlerShapeError(HANDLER_SHAPE_NO_FETCH_MESSAGE, "no-fetch");
-	if (typeof def.fetch !== "function") throw new HandlerShapeError(HANDLER_SHAPE_NO_FETCH_MESSAGE, "no-fetch");
+	const handler = def;
+	if (typeof handler.fetch !== "function" && typeof handler.scheduled !== "function") throw new HandlerShapeError(HANDLER_SHAPE_NO_FETCH_MESSAGE, "no-fetch");
 }
 /**
 * Validate that the bundled customer code exports the Module Worker handler
@@ -5727,7 +5774,7 @@ async function functionsDeployCommand(target, options = {}) {
 	const entryPoint = await resolveFunctionEntry(target, options.entry);
 	const defaultName = targetIsDir ? basename(target.replace(/[/\\]+$/, "")) : basename(entryPoint).replace(/\.[^.]+$/, "");
 	const functionName = options.name ?? defaultName;
-	validateFunctionName(functionName);
+	validateFunctionName$1(functionName);
 	const rateLimit = parseRateLimitFlags(options);
 	console.log();
 	console.log(pc.bold(`  amba functions deploy ${pc.cyan(functionName)}`));
@@ -5775,7 +5822,7 @@ async function functionsListCommand() {
 	console.log();
 }
 async function functionsDeleteCommand(name, options = {}) {
-	validateFunctionName(name);
+	validateFunctionName$1(name);
 	if (!options.confirm || options.confirm !== name) throw new Error(`Delete is destructive. Pass --confirm ${name} to proceed. Clients calling this function will start 404'ing immediately.`);
 	const cascade = (await deleteFunctionViaApi((await loadProjectConfig()).projectId, name, { confirm: name })).data.cascade;
 	console.log(pc.green("  ✓") + ` Deleted ${pc.bold(name)}.`);
@@ -5783,7 +5830,7 @@ async function functionsDeleteCommand(name, options = {}) {
 }
 async function functionsScheduleCommand(name, cron, options = {}) {
 	const projectConfig = await loadProjectConfig();
-	validateFunctionName(name);
+	validateFunctionName$1(name);
 	const timezone = options.tz ?? "UTC";
 	const res = await scheduleFunction(projectConfig.projectId, {
 		name,
@@ -6115,6 +6162,14 @@ try {
       };
       return fetchFn(req, env, ctx);
     };
+  } else if (mod.default && typeof mod.default.scheduled === 'function') {
+    // Scheduled-only modules are valid in production. This command exposes
+    // an HTTP server, so return a clear 405 instead of rejecting a deployable
+    // handler shape during local startup.
+    handler = () => new Response(
+      'This function only exports scheduled(); use amba functions schedule/run-now to invoke it.',
+      { status: 405, headers: { 'content-type': 'text/plain; charset=utf-8' } },
+    );
   } else if (typeof mod.default === 'function') {
     // Legacy service-worker shape (\`export default async function (req) { ... }\`).
     // REJECTED — production runs functions as Module Workers and the runtime
@@ -6124,7 +6179,7 @@ try {
     process.stderr.write('  Error: Function entrypoint must \`export default { async fetch(req, env, ctx) { … } }\` (the Module Worker shape). Found a default-exported function instead.\\n');
     process.exit(2);
   } else {
-    process.stderr.write('  Error: Function entrypoint must \`export default { async fetch(req, env, ctx) { … } }\` (the Module Worker shape). The default export has no \`fetch\` method.\\n');
+    process.stderr.write('  Error: Function entrypoint default export must have a callable \`fetch\` or \`scheduled\` method.\\n');
     process.exit(2);
   }
 } catch (err) {
@@ -6194,8 +6249,8 @@ process.on('SIGINT', () => shutdown('SIGINT'));
 * function-name overwrites — same upsert semantics as `amba secrets set`.
 */
 async function functionsConsumeCommand(queueName, functionName, options = {}) {
-	validateFunctionName(functionName);
-	validateFunctionName(queueName);
+	validateFunctionName$1(functionName);
+	validateFunctionName$1(queueName);
 	const res = await upsertQueueBinding((await loadProjectConfig()).projectId, {
 		queue_name: queueName,
 		function_name: functionName,
@@ -6225,11 +6280,11 @@ async function functionsConsumersListCommand() {
 	console.log();
 }
 async function functionsConsumersUnbindCommand(queueName) {
-	validateFunctionName(queueName);
+	validateFunctionName$1(queueName);
 	await deleteQueueBinding((await loadProjectConfig()).projectId, queueName);
 	console.log(pc.green("  ✓") + ` Unbound queue ${pc.cyan(queueName)}.`);
 }
-function validateFunctionName(name) {
+function validateFunctionName$1(name) {
 	if (!/^[a-z][a-z0-9_-]*$/.test(name)) throw new Error(`Invalid function name '${name}'. Must match /^[a-z][a-z0-9_-]*$/ (lowercase ASCII, digits, underscore or hyphen; must start with a letter).`);
 	if (name.length > 58) throw new Error("Function name must be 58 characters or fewer.");
 }
@@ -6302,6 +6357,10 @@ async function functionsLogsCommand(functionName, options = {}) {
 	});
 	if (res.data.anchor && !options.json) console.error(pc.dim(`  Anchored at ${res.data.anchor} (--since-request-id).`));
 	printEvents(res.data.events, options.json);
+	if (res.data.events.length === 0 && !options.json) {
+		if (res.data.ingestion?.status === "delayed") console.error(pc.yellow(`  ! Log ingestion is delayed${res.data.ingestion.latest_batch_at ? `; latest batch arrived ${res.data.ingestion.latest_batch_at}` : ""}. Retry shortly.`));
+		else if (res.data.ingestion?.status === "no_batches") console.error(pc.yellow("  ! No log batches reached this window yet. Retry shortly."));
+	}
 	if (res.data.truncated) if (options.json) process.stderr.write(`{"truncated":true}\n`);
 	else console.error(pc.yellow(`  ! Result truncated at limit; narrow --since / --until or raise --limit.`));
 }
@@ -6385,6 +6444,85 @@ function sleep$1(ms) {
 	return new Promise((r) => setTimeout(r, ms));
 }
 //#endregion
+//#region src/commands/function-domains.ts
+/** `amba functions domains ...` exact-hostname lifecycle commands. */
+const FUNCTION_NAME_RE = /^[a-z][a-z0-9_-]{0,57}$/;
+function validateFunctionName(name) {
+	if (!FUNCTION_NAME_RE.test(name)) throw new Error(`Invalid function name "${name}". Use lowercase letters, numbers, hyphens, or underscores (max 58 chars; start with a letter).`);
+}
+/**
+* Normalize case/trailing-dot spelling without trying to replace the API's
+* authoritative DNS validation. This command accepts one exact hostname only:
+* schemes, paths, ports, and wildcard labels are never meaningful here.
+*/
+function normalizeExactHostname(input) {
+	const hostname = input.trim().toLowerCase().replace(/\.$/, "");
+	if (hostname.length === 0 || hostname.length > 253 || !hostname.includes(".") || hostname.includes("*") || hostname.includes("/") || hostname.includes(":") || /\s/.test(hostname)) throw new Error(`Invalid hostname "${input}". Pass one exact DNS hostname such as feeds.example.com (no scheme, path, port, or wildcard).`);
+	return hostname;
+}
+function lifecycle(domain) {
+	if (domain.live) return pc.green("active");
+	if (domain.cert_status === "active" && domain.ownership_status === "active") return "certificate=active, ownership=active, reconciliation=pending";
+	return `certificate=${domain.cert_status}, ownership=${domain.ownership_status}`;
+}
+function printDomain(domain) {
+	console.log(`  ${pc.bold(domain.hostname)}  ${lifecycle(domain)}`);
+}
+function printDnsInstructions(domain) {
+	if (domain.dns_error === true) console.log(pc.yellow("    Automatic DNS publication failed; retry with domains refresh."));
+	if ("cleanup_pending" in domain && domain.cleanup_pending === true) console.log(pc.yellow("    Routing cleanup is incomplete; retry with domains refresh."));
+	if ("dns_autoconfigured" in domain && domain.dns_autoconfigured === true) console.log(pc.dim(`    DNS records published automatically${domain.dns_records_published === void 0 ? "" : ` (${domain.dns_records_published})`}.`));
+	if (domain.dns_target) console.log(pc.dim(`    DNS target: CNAME ${domain.hostname} → ${domain.dns_target}`));
+	for (const record of domain.ssl_validation ?? []) if (record.txt_name && record.txt_value) console.log(pc.dim(`    Certificate TXT: ${record.txt_name} = ${record.txt_value}`));
+	else if (record.http_url && record.http_body) console.log(pc.dim(`    Certificate HTTP: ${record.http_url} → ${record.http_body}`));
+	const ownership = domain.ownership_verification;
+	if (ownership?.name && ownership.value) console.log(pc.dim(`    Ownership ${ownership.type ?? "TXT"}: ${ownership.name} = ${ownership.value}`));
+	const ownershipHttp = domain.ownership_verification_http;
+	if (ownershipHttp?.http_url && ownershipHttp.http_body) console.log(pc.dim(`    Ownership HTTP: ${ownershipHttp.http_url} → ${ownershipHttp.http_body}`));
+}
+async function functionDomainsAttachCommand(functionName, hostnameInput) {
+	validateFunctionName(functionName);
+	const hostname = normalizeExactHostname(hostnameInput);
+	const { projectId } = await loadProjectConfig();
+	const result = await attachFunctionDomainViaApi(projectId, functionName, hostname);
+	console.log();
+	console.log(pc.green("  ✓") + ` Attached ${pc.bold(result.data.hostname)} to ${functionName}.`);
+	console.log(pc.dim(`    Status: ${lifecycle(result.data)}`));
+	printDnsInstructions(result.data);
+	console.log(pc.dim("    Exact hostname only; no automatic www hostname was created."));
+	if (!result.data.live && result.data.ownership_status !== "active") console.log(pc.dim("    Unverified claims become eligible for reclaim after 24 hours."));
+	console.log();
+}
+async function functionDomainsListCommand(functionName) {
+	validateFunctionName(functionName);
+	const { projectId } = await loadProjectConfig();
+	const result = await listFunctionDomainsViaApi(projectId, functionName);
+	console.log();
+	if (result.data.length === 0) console.log(pc.dim(`  No custom domains attached to ${functionName}.`));
+	else for (const domain of result.data) printDomain(domain);
+	console.log();
+}
+async function functionDomainsRefreshCommand(functionName, hostnameInput) {
+	validateFunctionName(functionName);
+	const hostname = normalizeExactHostname(hostnameInput);
+	const { projectId } = await loadProjectConfig();
+	const result = await refreshFunctionDomainViaApi(projectId, functionName, hostname);
+	console.log();
+	console.log(pc.green("  ✓") + ` Refreshed ${pc.bold(result.data.hostname)}.`);
+	console.log(pc.dim(`    Status: ${lifecycle(result.data)}`));
+	printDnsInstructions(result.data);
+	console.log();
+}
+async function functionDomainsRemoveCommand(functionName, hostnameInput) {
+	validateFunctionName(functionName);
+	const hostname = normalizeExactHostname(hostnameInput);
+	const { projectId } = await loadProjectConfig();
+	const result = await removeFunctionDomainViaApi(projectId, functionName, hostname);
+	console.log();
+	console.log(pc.green("  ✓") + ` Removed ${pc.bold(result.data.hostname)} from ${functionName}.`);
+	console.log();
+}
+//#endregion
 //#region src/commands/ai.ts
 /**
 * `amba ai providers ...` — register / list / remove AI provider API keys.
@@ -6517,8 +6655,8 @@ async function secretsListCommand(options = {}) {
 async function secretsUnsetCommand(name, options) {
 	validateSecretName(name);
 	await deleteSecretViaApi((await loadProjectConfig()).projectId, name, { function: options.function });
-	console.log(pc.green("  ✓") + ` Removed from GCP Secret Manager.`);
-	console.log(pc.dim("  Workers Secret on the dispatched script remains until the next deploy — redeploy to clear."));
+	console.log(pc.green("  ✓") + ` Secret removed from the backing store.`);
+	console.log(pc.dim("  Workers binding revocation queued; provider failures retry automatically."));
 }
 function validateSecretName(name) {
 	const reason = getBindingReservationReason(name);
@@ -6529,6 +6667,9 @@ function renderStatus(status) {
 		case "synced": return pc.green("synced");
 		case "syncing": return pc.cyan("syncing");
 		case "sync_failed_retrying": return pc.yellow("retrying");
+		case "revocation_pending": return pc.yellow("revocation pending");
+		case "revoking": return pc.cyan("revoking");
+		case "revoke_failed_retrying": return pc.yellow("revocation retrying");
 		default: return pc.dim(status);
 	}
 }
@@ -6618,7 +6759,10 @@ async function billingStatusCommand() {
 	try {
 		const { projectId } = await loadProjectConfig();
 		const s = (await adminGet(`/projects/${projectId}/billing/status`)).data;
-		console.log(`  Tier:               ${pc.bold(s.tier)}`);
+		const effectiveTier = s.effective_tier ?? s.tier;
+		console.log(`  Effective tier:     ${pc.bold(effectiveTier)}`);
+		if (effectiveTier !== s.tier) console.log(`  Stored tier:        ${s.tier}`);
+		if (s.comped === true) console.log(`  Billing:            ${pc.green("comped")} ${pc.dim("(no customer charge)")}`);
 		console.log(`  Subscription:       ${s.subscription_status ?? pc.dim("—")}`);
 		console.log(`  Next bill anchor:   ${s.current_period_end ? new Date(s.current_period_end).toLocaleDateString() : pc.dim("—")}`);
 		const pctCeiling = s.ceiling_pct_consumed === null || s.ceiling_pct_consumed === void 0 ? null : Math.round(s.ceiling_pct_consumed * 100);
@@ -9530,7 +9674,7 @@ async function diffConfigCommand(file = DEFAULT_BUNDLE_FILE, options = {}) {
 //#endregion
 //#region src/index.ts
 const program = new Command();
-program.name("amba").description("amba — agent-native backend-as-a-service for mobile apps.").version("4.1.1");
+program.name("amba").description("amba — agent-native backend-as-a-service for mobile apps.").version("4.1.2");
 program.option("--token <pat>", "Use a Personal Access Token for headless / CI / agent use (overrides ~/.amba/credentials.json + AMBA_PAT env)");
 program.hook("preAction", (thisCommand) => {
 	setBearerOverride(resolveTokenSource({
@@ -9678,8 +9822,8 @@ functions.command("deploy <target>").description("Bundle a function (a single fi
 functions.command("list").description("List active functions for the current project").action(async () => {
 	await runAction(functionsListCommand);
 });
-functions.command("delete <name>").description("Disable + remove a function from the dispatch namespace").action(async (name) => {
-	await runAction(() => functionsDeleteCommand(name));
+functions.command("delete <name>").description("Disable + remove a function from the dispatch namespace (destructive)").option("--confirm <name>", "Pass the function name to confirm deletion").action(async (name, opts) => {
+	await runAction(() => functionsDeleteCommand(name, { confirm: opts.confirm }));
 });
 functions.command("schedule <name> <cron>").description("Register a cron schedule that invokes a deployed function").option("--tz <iana>", "IANA timezone for the schedule (default: UTC)").action(async (name, cron, opts) => {
 	await runAction(() => functionsScheduleCommand(name, cron, opts));
@@ -9711,8 +9855,21 @@ consumers.command("list").description("List queue bindings for the current proje
 consumers.command("unbind <queue-name>").description("Remove the binding for a queue (DROP)").action(async (queueName) => {
 	await runAction(() => functionsConsumersUnbindCommand(queueName));
 });
+const functionDomains = functions.command("domains").description("Manage exact custom hostnames for functions");
+functionDomains.command("attach <name> <hostname>").description("Attach one exact hostname to a deployed function").action(async (name, hostname) => {
+	await runAction(() => functionDomainsAttachCommand(name, hostname));
+});
+functionDomains.command("list <name>").description("List custom hostname ownership and certificate status").action(async (name) => {
+	await runAction(() => functionDomainsListCommand(name));
+});
+functionDomains.command("refresh <name> <hostname>").description("Refresh DNS ownership and certificate status").action(async (name, hostname) => {
+	await runAction(() => functionDomainsRefreshCommand(name, hostname));
+});
+functionDomains.command("remove <name> <hostname>").description("Detach an exact hostname from a function").action(async (name, hostname) => {
+	await runAction(() => functionDomainsRemoveCommand(name, hostname));
+});
 const secrets = program.command("secrets").description("Function secrets (GCP canonical, Workers-Secret synced)");
-secrets.command("set <name> [value]").description("Store a secret and queue its sync to your deployed function(s). Omit --function for a project-wide secret. Use --from-stdin to keep the value out of shell history.").option("--function <name>", "Function the secret binds to. OMIT this flag to set a PROJECT-WIDE secret — one value visible to every function in the project (and to any function deployed later). With it, the secret is scoped to just that function. Use the same name as the entry passed to 'amba functions deploy'. Secrets may be set before the function is deployed; the sync drains once you deploy.").option("--env <env>", "'dev' | 'prod' — INFORMATIONAL ONLY. Both share one secret namespace per project. Use distinct secret names (e.g. STRIPE_KEY_DEV / STRIPE_KEY_PROD) or two amba projects for real env isolation.").option("--from-stdin", "Read the secret value from stdin instead of the positional arg. Mutually exclusive with <value>. Pipe in: `echo $KEY | amba secrets set NAME --from-stdin`.").action(async (name, value, opts) => {
+secrets.command("set <name> [value]").description("Store a secret and queue its sync to your deployed function(s). Omit --function for a project-wide secret. Use --from-stdin to keep the value out of shell history.").option("--function <name>", "Function the secret binds to. OMIT this flag to set a PROJECT-WIDE secret — one value visible to every function in the project (and to any function deployed later). With it, the secret is scoped to just that function and overrides a same-name project-wide value. Use the same name as the entry passed to 'amba functions deploy'. Secrets may be set before the function is deployed; the sync drains once you deploy.").option("--env <env>", "'dev' | 'prod' — INFORMATIONAL ONLY. Both share one secret namespace per project. Use distinct secret names (e.g. STRIPE_KEY_DEV / STRIPE_KEY_PROD) or two amba projects for real env isolation.").option("--from-stdin", "Read the secret value from stdin instead of the positional arg. Mutually exclusive with <value>. Pipe in: `echo $KEY | amba secrets set NAME --from-stdin`.").action(async (name, value, opts) => {
 	await runAction(() => secretsSetCommand(name, value, {
 		function: opts.function,
 		env: opts.env ?? "dev",
@@ -9722,7 +9879,7 @@ secrets.command("set <name> [value]").description("Store a secret and queue its
 secrets.command("list").description("List secret sync status for the current project").option("--function <name>", "Filter to secrets for a single function (avoids listing all functions at once)").action(async (opts) => {
 	await runAction(() => secretsListCommand({ function: opts.function }));
 });
-secrets.command("unset <name>").description("Remove a secret (Worker binding cleared on next deploy)").option("--function <name>", "Function the secret was bound to. Omit to remove the project-wide secret of this name.").action(async (name, opts) => {
+secrets.command("unset <name>").description("Remove a secret and revoke its Worker binding").option("--function <name>", "Function the secret was bound to. Omit to remove the project-wide secret of this name. A surviving same-name value at the other scope is restored automatically.").action(async (name, opts) => {
 	await runAction(() => secretsUnsetCommand(name, opts));
 });
 const billing = program.command("billing").description("Per-project subscription, headroom, and spend controls");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@layers/amba",
-  "version": "4.1.1",
+  "version": "4.1.2",
   "description": "amba — agent-native backend-as-a-service. Functions, collections, storage, AI, email, queues, sites, and `amba ship` to take an Expo app live on the App Store + Google Play. `npx @layers/amba init` to start.",
   "type": "module",
   "bin": {
@@ -49,8 +49,8 @@
     "tsdown": "^0.12.5",
     "typescript": "^5.8.3",
     "vitest": "^3.2.4",
-    "@layers/amba-mcp": "4.0.6",
-    "@layers/amba-shared": "4.0.4"
+    "@layers/amba-shared": "4.0.4",
+    "@layers/amba-mcp": "4.0.6"
   },
   "scripts": {
     "build": "tsdown && tsc --emitDeclarationOnly",

package/skill-bundle/SKILL.md

@@ -89,7 +89,7 @@ Check whether a project exists in this directory:
 >      }'
 >    ```
 >    The response is the standard MCP envelope `{"jsonrpc":"2.0","id":"1","result":{"content":[{"type":"text","text":"<JSON body>"}]}}`. You construct calls by hand the same way you would with typed tools — every `amba_*` tool name from the catalog works. This is the same wire the typed-tool surface uses; you just skip the client-side configuration loop.
-> 2. **The `amba` CLI via bash.** Already authenticated via `~/.amba/credentials.json`. Coverage: `amba projects {list,create,update,show,delete}`, `amba collections {create,alter,list,drop}`, `amba functions {deploy,list,delete,schedule,dev,logs,consume}`, `amba push test`, `amba secrets {set,list,unset}`, `amba config {list,set}`, `amba sites <subcommands>`, `amba seed`, `amba status --detailed`, `amba logs tail`, `amba analytics export`, `amba schema export`, `amba ai <subcommands>`, `amba db migrate`, `amba billing {status,upgrade,portal,set-ceiling}`, `amba claim <email>` (sandbox → verified_free magic link). Run `amba --help` once if you need to see the full subcommand surface. Use this when you want a typed wrapper for a common op; the JSON-RPC path is strictly more flexible.
+> 2. **The `amba` CLI via bash.** Already authenticated via `~/.amba/credentials.json`. Coverage: `amba projects {list,create,update,show,delete}`, `amba collections {create,alter,list,drop}`, `amba functions {deploy,list,delete,schedule,dev,logs,consume,domains}`, `amba push test`, `amba secrets {set,list,unset}`, `amba config {list,set}`, `amba sites <subcommands>`, `amba seed`, `amba status --detailed`, `amba logs tail`, `amba analytics export`, `amba schema export`, `amba ai <subcommands>`, `amba db migrate`, `amba billing {status,upgrade,portal,set-ceiling}`, `amba claim <email>` (sandbox → verified_free magic link). Run `amba --help` once if you need to see the full subcommand surface. Use this when you want a typed wrapper for a common op; the JSON-RPC path is strictly more flexible.
 > 3. **Wait for next agent launch.** The MCP entry is already persisted; on the next launch, `mcp__amba__*` tools appear automatically.
 >
 > A SEPARATE case: if Amba MCP IS wired in this session but the inbound Bearer is stale (e.g., the user just ran `amba_developer_signup` and got a fresh PAT), pass `pat: "<the new PAT>"` as an inline argument on every subsequent `amba_*` tool call to override the inbound Bearer for that one call. This only helps when the `mcp__amba__*` tools already exist in your tool list — it does not summon them into existence.

package/skill-bundle/references/infrastructure.md

@@ -37,6 +37,9 @@ Run user code in a sandbox triggered by HTTP, cron, or webhook. The function get
 | Tool | Purpose | Example args |
 | --- | --- | --- |
 | `amba_functions_deploy` / `amba_deploy_function` | Deploy a function from source (TypeScript / JavaScript / Python). | `{ project_id, name: "send_welcome_email", runtime: "node22", source: "export default async (req) => { ... }", trigger: { type: "http" } }` |
+| `amba_function_domains_attach` | Attach an exact hostname to a function and return DNS validation records. | `{ project_id, name: "feed", hostname: "feeds.example.com" }` |
+| `amba_function_domains_list` / `amba_function_domains_refresh` | Read or refresh ownership/certificate status. | `{ project_id, name: "feed", hostname: "feeds.example.com" }` |
+| `amba_function_domains_remove` | Detach an exact function hostname. | `{ project_id, name: "feed", hostname: "feeds.example.com" }` |
 | `amba_functions_list` / `amba_list_functions` | List functions. | `{ project_id }` |
 | `amba_functions_get` / `amba_get_function` | Read function metadata. | `{ project_id, function_id }` |
 | `amba_functions_get_logs` / `amba_get_function_logs` | Recent invocation logs. | `{ project_id, function_id, limit: 100 }` |
@@ -46,6 +49,11 @@ Run user code in a sandbox triggered by HTTP, cron, or webhook. The function get
 | `amba_functions_resume_schedule` / `amba_resume_function_schedule` | Resume. | `{ project_id, function_id }` |
 | `amba_functions_trigger_schedule` / `amba_trigger_function_schedule` | Fire a scheduled function ad-hoc (testing). | `{ project_id, function_id }` |
 
+Function-domain MVP limits use effective tier: free 1, pro 5, scale 20,
+enterprise/comped 50. Attach is limited to five attempts per project per hour.
+Unverified claims become eligible for exact-host reclaim after 24 hours; Worker
+route/KV allocation waits until provider ownership is active.
+
 ### AI prompts
 
 Managed LLM templates: a stored prompt with provider + model + system message, invoked by name from the SDK. The actual LLM call is rewritten server-side per-tenant — the customer's provider API key (Anthropic / OpenAI / Mistral / Gemini) stays server-side, never on the device.
@@ -80,7 +88,7 @@ Managed LLM templates: a stored prompt with provider + model + system message, i
 
 | Tool | Purpose | Example args |
 | --- | --- | --- |
-| `amba_secrets_set` / `amba_set_secret` | Set a **function-scoped** secret (encrypted at rest; bound on the next deploy). For third-party API keys called from your functions — NOT AI provider keys (use `amba_ai_providers_set` for those). | `{ project_id, name: "STRIPE_WEBHOOK_SECRET", value: "whsec_..." }` |
+| `amba_secrets_set` / `amba_set_secret` | Set or rotate a function secret. Omit `function` for a project-wide value or pass it for one function. Already-deployed functions receive the new binding asynchronously; a future deploy also reconciles it. For third-party API keys called from your functions — NOT AI provider keys (use `amba_ai_providers_set` for those). | `{ project_id, name: "STRIPE_WEBHOOK_SECRET", value: "whsec_..." }` |
 | `amba_secrets_get` / `amba_get_secret` | Read a secret (returns `"<redacted>"` unless explicitly requested). | `{ project_id, name }` |
 | `amba_secrets_list` / `amba_list_secrets` | List secret names. | `{ project_id }` |
 | `amba_secrets_delete` / `amba_delete_secret` | Delete. | `{ project_id, name }` |