@layers/amba 4.1.5 → 4.1.7

package/dist/api-client.d.ts

@@ -21,6 +21,8 @@ export interface ProjectSummary {
     environment?: string;
     bundle_id?: string | null;
     google_oauth_client_id?: string | null;
+    magic_link_redirect_url?: string | null;
+    auth_email_brand_name?: string | null;
     status?: string;
     created_at?: string;
     /** Persisted subscription/accounting tier. */
@@ -71,6 +73,8 @@ export declare function updateProject(projectId: string, patch: {
     name?: string;
     bundle_id?: string | null;
     google_oauth_client_id?: string | null;
+    magic_link_redirect_url?: string | null;
+    auth_email_brand_name?: string | null;
     platform?: string;
     environment?: string;
 }): Promise<ApiResponse<{
@@ -78,6 +82,8 @@ export declare function updateProject(projectId: string, patch: {
     name: string;
     bundle_id: string | null;
     google_oauth_client_id: string | null;
+    magic_link_redirect_url: string | null;
+    auth_email_brand_name: string | null;
     platform: string;
     environment: string;
 }>>;
@@ -87,6 +93,8 @@ export declare function getProject(projectId: string): Promise<ApiResponse<{
     platform: string;
     environment: string;
     bundle_id: string | null;
+    magic_link_redirect_url: string | null;
+    auth_email_brand_name: string | null;
     created_at: string;
 }>>;
 export declare function deleteProject(projectId: string): Promise<ApiResponse<{
@@ -674,7 +682,7 @@ export declare function dropCollection(projectId: string, name: string, confirm:
     deleted: boolean;
     version: number;
 }>>;
-export type AiProviderName = 'anthropic' | 'openai';
+export type AiProviderName = 'anthropic' | 'openai' | 'mistral' | 'gemini';
 export interface AiProviderRow {
     name: AiProviderName;
     /** Whether an API key is currently configured for this provider. */

package/dist/commands/projects.d.ts

@@ -1,3 +1,4 @@
+import { updateProject } from '../api-client.js';
 export declare function projectsListCommand(): Promise<void>;
 export declare function projectsCreateCommand(input: {
     name: string;
@@ -6,13 +7,19 @@ export declare function projectsCreateCommand(input: {
     googleOauthClientId?: string;
     platform?: string;
 }): Promise<void>;
-export declare function projectsUpdateCommand(projectId: string, input: {
+export interface ProjectUpdateCommandInput {
     name?: string;
     bundleId?: string;
     googleOauthClientId?: string;
+    magicLinkRedirectUrl?: string;
+    authEmailBrandName?: string;
+    clearMagicLinkRedirectUrl?: boolean;
+    clearAuthEmailBrandName?: boolean;
     platform?: string;
     environment?: string;
-}): Promise<void>;
+}
+export declare function buildProjectUpdatePatch(input: ProjectUpdateCommandInput): Parameters<typeof updateProject>[1];
+export declare function projectsUpdateCommand(projectId: string, input: ProjectUpdateCommandInput): Promise<void>;
 export declare function projectsShowCommand(projectId: string): Promise<void>;
 export declare function projectsDeleteCommand(projectId: string, opts?: {
     yes?: boolean;

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { Command } from "commander";
+import { Command, Option } from "commander";
 import pc from "picocolors";
 import { access, chmod, mkdir, mkdtemp, readFile, readdir, rename, rm, stat, writeFile } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
@@ -660,6 +660,13 @@ function isPatShape(token) {
 */
 async function browserAuthFlow() {
 	return new Promise((resolve, reject) => {
+		let timeout;
+		const settle = (outcome) => {
+			if (timeout !== void 0) clearTimeout(timeout);
+			server.close();
+			server.closeAllConnections();
+			outcome();
+		};
 		const server = createServer((req, res) => {
 			const url = new URL(req.url ?? "/", `http://localhost`);
 			if (url.pathname !== "/callback") {
@@ -672,20 +679,16 @@ async function browserAuthFlow() {
 			const expiresAt = url.searchParams.get("expires_at");
 			if (!accessToken || !refreshToken || !expiresAt) {
 				res.writeHead(400, { "Content-Type": "text/html" });
-				res.end("<html><body><h2>Authentication failed</h2><p>Missing token parameters. Please try again.</p></body></html>");
-				server.close();
-				reject(/* @__PURE__ */ new Error("Missing token parameters in callback"));
+				res.end("<html><body><h2>Authentication failed</h2><p>Missing token parameters. Please try again.</p></body></html>", () => settle(() => reject(/* @__PURE__ */ new Error("Missing token parameters in callback"))));
 				return;
 			}
-			res.writeHead(200, { "Content-Type": "text/html" });
-			res.end("<html><body style=\"font-family:system-ui;text-align:center;padding:3rem\"><h2>Authenticated!</h2><p>You can close this window and return to the terminal.</p></body></html>");
 			const creds = {
 				access_token: accessToken,
 				refresh_token: refreshToken,
 				expires_at: expiresAt
 			};
-			server.close();
-			resolve(creds);
+			res.writeHead(200, { "Content-Type": "text/html" });
+			res.end("<html><body style=\"font-family:system-ui;text-align:center;padding:3rem\"><h2>Authenticated!</h2><p>You can close this window and return to the terminal.</p></body></html>", () => settle(() => resolve(creds)));
 		});
 		server.listen(0, "127.0.0.1", () => {
 			const addr = server.address();
@@ -703,9 +706,8 @@ async function browserAuthFlow() {
 				console.log(pc.yellow(`  Please open this URL manually:`));
 				console.log(`  ${pc.underline(authUrl)}`);
 			});
-			setTimeout(() => {
-				server.close();
-				reject(/* @__PURE__ */ new Error("Authentication timed out. Please try again."));
+			timeout = setTimeout(() => {
+				settle(() => reject(/* @__PURE__ */ new Error("Authentication timed out. Please try again.")));
 			}, 12e4);
 		});
 	});
@@ -4738,22 +4740,34 @@ async function projectsCreateCommand(input) {
 		handleError$2(err);
 	}
 }
-async function projectsUpdateCommand(projectId, input) {
-	console.log();
-	console.log(pc.bold(`  amba projects update ${projectId}`));
-	console.log(pc.dim("  ─────────────────────────────────"));
-	console.log();
+function buildProjectUpdatePatch(input) {
+	if (input.magicLinkRedirectUrl !== void 0 && input.clearMagicLinkRedirectUrl) throw new Error("--magic-link-redirect-url conflicts with --clear-magic-link-redirect-url");
+	if (input.authEmailBrandName !== void 0 && input.clearAuthEmailBrandName) throw new Error("--auth-email-brand-name conflicts with --clear-auth-email-brand-name");
 	const patch = {};
 	if (input.name !== void 0) patch.name = input.name;
 	if (input.bundleId !== void 0) patch.bundle_id = input.bundleId;
 	if (input.googleOauthClientId !== void 0) patch.google_oauth_client_id = input.googleOauthClientId;
 	if (input.platform !== void 0) patch.platform = input.platform;
 	if (input.environment !== void 0) patch.environment = input.environment;
+	if (input.magicLinkRedirectUrl !== void 0) patch.magic_link_redirect_url = input.magicLinkRedirectUrl;
+	if (input.clearMagicLinkRedirectUrl) patch.magic_link_redirect_url = null;
+	if (input.authEmailBrandName !== void 0) patch.auth_email_brand_name = input.authEmailBrandName;
+	if (input.clearAuthEmailBrandName) patch.auth_email_brand_name = null;
+	return patch;
+}
+async function projectsUpdateCommand(projectId, input) {
+	console.log();
+	console.log(pc.bold(`  amba projects update ${projectId}`));
+	console.log(pc.dim("  ─────────────────────────────────"));
+	console.log();
+	const patch = buildProjectUpdatePatch(input);
 	try {
 		const res = await updateProject(projectId, patch);
 		console.log(pc.green("  ✓") + ` Updated ${pc.bold(res.data.name)} ${pc.dim(`(${res.data.id})`)}`);
 		if (res.data.bundle_id) console.log(pc.dim(`    Bundle ID: ${res.data.bundle_id}`));
 		if (res.data.google_oauth_client_id) console.log(pc.dim(`    Google OAuth client id: ${res.data.google_oauth_client_id}`));
+		if (res.data.magic_link_redirect_url) console.log(pc.dim(`    Magic-link callback: ${res.data.magic_link_redirect_url}`));
+		if (res.data.auth_email_brand_name) console.log(pc.dim(`    Auth email brand: ${res.data.auth_email_brand_name}`));
 		console.log();
 	} catch (err) {
 		if (err instanceof ApiClientError && err.statusCode === 404) {
@@ -6602,7 +6616,12 @@ async function functionDomainsRemoveCommand(functionName, hostnameInput) {
 * server-side; the CLI never echoes plaintext back. The API returns a
 * `api_key_preview` (first-6 + last-4) for confirmation.
 */
-const VALID_PROVIDERS = new Set(["anthropic", "openai"]);
+const VALID_PROVIDERS = new Set([
+	"anthropic",
+	"openai",
+	"mistral",
+	"gemini"
+]);
 function assertValidProvider(name) {
 	if (!VALID_PROVIDERS.has(name)) throw new Error(`Unknown AI provider '${name}'. Supported: ${[...VALID_PROVIDERS].join(", ")}.`);
 }
@@ -9761,7 +9780,7 @@ async function diffConfigCommand(file = DEFAULT_BUNDLE_FILE, options = {}) {
 //#endregion
 //#region src/index.ts
 const program = new Command();
-program.name("amba").description("amba — agent-native backend-as-a-service for mobile apps.").version("4.1.5");
+program.name("amba").description("amba — agent-native backend-as-a-service for mobile apps.").version("4.1.7");
 program.option("--token <pat>", "Use a Personal Access Token for headless / CI / agent use (overrides ~/.amba/credentials.json + AMBA_PAT env)");
 program.hook("preAction", (thisCommand) => {
 	setBearerOverride(resolveTokenSource({
@@ -9850,13 +9869,17 @@ projects.command("create").description("Create a new project").requiredOption("-
 		platform: opts.platform
 	}));
 });
-projects.command("update <projectId>").description("Update mutable fields on a project").option("--name <name>", "Display name").option("--bundle-id <id>", "Bundle identifier (Apple Sign In audience)").option("--google-oauth-client-id <id>", "Google OAuth 2.0 client id (Google Sign In audience). Public identifier, not a secret.").option("--platform <platform>", "Platform: 'ios' | 'android' | 'all'").option("--environment <env>", "Environment label: 'development' | 'production'").action(async (projectId, opts) => {
+projects.command("update <projectId>").description("Update mutable fields on a project").option("--name <name>", "Display name").option("--bundle-id <id>", "Bundle identifier (Apple Sign In audience)").option("--google-oauth-client-id <id>", "Google OAuth 2.0 client id (Google Sign In audience). Public identifier, not a secret.").option("--platform <platform>", "Platform: 'ios' | 'android' | 'all'").option("--environment <env>", "Environment label: 'development' | 'production'").addOption(new Option("--magic-link-redirect-url <url>", "Exact HTTPS callback URL for magic-link sign-in (Amba appends the token query parameter)").conflicts("clearMagicLinkRedirectUrl")).addOption(new Option("--clear-magic-link-redirect-url", "Clear the project callback and restore the platform fallback").conflicts("magicLinkRedirectUrl")).addOption(new Option("--auth-email-brand-name <name>", "Brand shown in auth emails and sender attribution").conflicts("clearAuthEmailBrandName")).addOption(new Option("--clear-auth-email-brand-name", "Clear the auth-email brand and fall back to the project name").conflicts("authEmailBrandName")).action(async (projectId, opts) => {
 	await runAction(() => projectsUpdateCommand(projectId, {
 		name: opts.name,
 		bundleId: opts.bundleId,
 		googleOauthClientId: opts.googleOauthClientId,
 		platform: opts.platform,
-		environment: opts.environment
+		environment: opts.environment,
+		magicLinkRedirectUrl: opts.magicLinkRedirectUrl,
+		authEmailBrandName: opts.authEmailBrandName,
+		clearMagicLinkRedirectUrl: opts.clearMagicLinkRedirectUrl,
+		clearAuthEmailBrandName: opts.clearAuthEmailBrandName
 	}));
 });
 projects.command("show <projectId>").description("Show full project details as JSON").action(async (projectId) => {
@@ -10156,7 +10179,7 @@ domains.command("buy <domain>").description("Buy a domain + connect it to a site
 domains.command("list").description("List domains this project has purchased through Amba").action(async () => {
 	await runAction(domainsListCommand);
 });
-const aiProviders = program.command("ai").description("AI gateway — manage provider keys + prompts").command("providers").description("Per-project provider key registration (Anthropic, OpenAI)");
+const aiProviders = program.command("ai").description("AI gateway — manage provider keys + prompts").command("providers").description("Per-project provider key registration (Anthropic, OpenAI, Mistral, Gemini)");
 aiProviders.command("add <provider>").description("Register an AI provider key. Plaintext stored securely server-side; a preview (first-6+last-4) is printed back. Use --from-stdin to keep the key out of shell history.").option("--key <value>", "Provider API key plaintext (alternative: --from-stdin)").option("--from-stdin", "Read the key from stdin instead of --key").action(async (provider, opts) => {
 	await runAction(() => aiProvidersAddCommand(provider, opts));
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@layers/amba",
-  "version": "4.1.5",
+  "version": "4.1.7",
   "description": "amba — agent-native backend-as-a-service. Functions, collections, storage, AI, email, queues, sites, and `amba ship` to take an Expo app live on the App Store + Google Play. `npx @layers/amba init` to start.",
   "type": "module",
   "bin": {
@@ -49,8 +49,8 @@
     "tsdown": "^0.12.5",
     "typescript": "^5.8.3",
     "vitest": "^3.2.4",
-    "@layers/amba-mcp": "4.0.9",
-    "@layers/amba-shared": "4.0.4"
+    "@layers/amba-mcp": "4.0.10",
+    "@layers/amba-shared": "4.0.5"
   },
   "scripts": {
     "build": "tsdown && tsc --emitDeclarationOnly",

package/skill-bundle/references/identity.md

@@ -9,8 +9,8 @@ There is no separate "identity provisioning" step — `auth` is the default surf
 | Tool | Purpose | Example args |
 | --- | --- | --- |
 | `amba_developer_me` | Verify the developer PAT and read the developer's profile. Pre-flight check before any provisioning. | `{}` |
-| `amba_projects_get` | Read a project's config (bundle id, OAuth client id, platform). | `{ project_id: "p_…" }` |
-| `amba_projects_update` | Set `bundle_id` (Apple audience) and `google_oauth_client_id` (Google audience). Required before Sign in with Apple / Google works. | `{ project_id, bundle_id: "com.example.fitness", google_oauth_client_id: "1234.apps.googleusercontent.com" }` |
+| `amba_projects_get` | Read a project's config (social audiences, magic-link callback, auth-email brand, platform). | `{ project_id: "p_…" }` |
+| `amba_projects_update` | Set social audiences plus the exact magic-link callback and auth-email brand. Pass null for an auth field to restore its fallback. | `{ project_id, magic_link_redirect_url: "https://app.example.com/auth/callback", auth_email_brand_name: "My App" }` |
 | `amba_users_list` | Browse end-users (app_users) of the project — useful as a smoke check after the first sign-in. | `{ project_id, limit: 20 }` |
 | `amba_users_get` | Fetch a single app_user by id. | `{ project_id, user_id }` |
 | `amba_users_bulk_update` | Set custom properties on many users at once (e.g. backfilling a `tier` property used for segmentation). | `{ project_id, user_ids: [...], properties: { tier: "trial" } }` |
@@ -18,7 +18,7 @@ There is no separate "identity provisioning" step — `auth` is the default surf
 | `amba_delete_api_key` / `amba_api_keys_delete` | Revoke a leaked key. | `{ project_id, api_key_id }` |
 | `amba_assign_role` / `amba_roles_assign` | Grant an RBAC role to an app_user (admin / moderator / etc.). | `{ project_id, user_id, role_id }` |
 
-There's no `amba_auth_*` namespace — auth is owned by the SDK on the client side, and there are no provisioning calls for it beyond setting the project's audience identifiers. If the user wants Apple/Google sign-in, the **mandatory** preflight is:
+There's no `amba_auth_*` namespace — auth is owned by the SDK on the client side. Project-level routing, branding, and social audience configuration use `amba_projects_update`. If the user wants Apple/Google sign-in, the **mandatory** preflight is:
 
 ```
 mcp__amba__amba_projects_update({
@@ -30,6 +30,18 @@ mcp__amba__amba_projects_update({
 
 Without this, the server rejects identity tokens with `AUDIENCE_NOT_CONFIGURED` and the user thinks Amba is broken. If they don't know their bundle id, ask; if they don't have a Google OAuth client yet, tell them to create one at console.cloud.google.com and link it later.
 
+For magic-link sign-in, configure the exact HTTPS callback before sending a production email:
+
+```
+mcp__amba__amba_projects_update({
+  project_id: process.env.AMBA_PROJECT_ID,
+  magic_link_redirect_url: "https://app.example.com/auth/callback",
+  auth_email_brand_name: "Example App"
+})
+```
+
+Amba appends the one-time `token` query parameter to that exact URL. Auth-email copy uses the project brand; sends from the shared platform mailbox retain visible `via Amba` attribution. A pure customer-branded From address requires a separately verified sender domain.
+
 ## SDK init per stack
 
 ### Expo