@layers/amba 4.1.6 → 4.1.8

package/dist/index.js

@@ -597,12 +597,36 @@ const RESERVED_BINDING_PREFIXES = ["AMBA_", "EDGE_"];
 const RESERVED_BINDING_EXACT_NAMES = ["STORAGE", "EDGE_DB_PROXY"];
 const VALID_BINDING_NAME_RE = /^[A-Z][A-Z0-9_]*$/;
 const MAX_BINDING_NAME_LENGTH = 64;
+const INJECTED_BINDINGS_BY_PREFIX = {
+	AMBA_: [
+		"AMBA_API_URL",
+		"AMBA_PROJECT_ID",
+		"AMBA_INTERNAL_TOKEN",
+		"AMBA_AI_GATEWAY_URL"
+	],
+	EDGE_: ["EDGE_HEADER_SIGNING_SECRET"]
+};
+const RESERVED_EXACT_PURPOSE = {
+	STORAGE: "the platform's built-in object-storage binding (env.STORAGE)",
+	EDGE_DB_PROXY: "a platform database binding"
+};
+const SUGGESTED_BINDING_PREFIX = "APP_";
+function suggestedBindingName(name) {
+	const reservedPrefix = RESERVED_BINDING_PREFIXES.find((prefix) => name.startsWith(prefix)) ?? "";
+	const rest = name.slice(reservedPrefix.length);
+	const candidate = `${SUGGESTED_BINDING_PREFIX}${rest}`;
+	return rest.length > 0 && VALID_BINDING_NAME_RE.test(candidate) ? candidate : `${SUGGESTED_BINDING_PREFIX}SECRET`;
+}
 /** Return why a binding name is reserved/invalid, or `null` if acceptable. */
 function getBindingReservationReason(name) {
 	if (typeof name !== "string" || name.length === 0) return "Binding name must be a non-empty string";
 	if (name.length > MAX_BINDING_NAME_LENGTH) return `Binding name must be at most ${MAX_BINDING_NAME_LENGTH} characters`;
-	for (const prefix of RESERVED_BINDING_PREFIXES) if (name.startsWith(prefix)) return `Binding name starts with reserved prefix "${prefix}" (platform namespace)`;
-	for (const exact of RESERVED_BINDING_EXACT_NAMES) if (name === exact) return `Binding name "${exact}" is reserved by a platform binding`;
+	for (const exact of RESERVED_BINDING_EXACT_NAMES) if (name === exact) return `"${exact}" is reserved for ${RESERVED_EXACT_PURPOSE[exact]}. Use your own name instead, for example "${suggestedBindingName(name)}"`;
+	for (const prefix of RESERVED_BINDING_PREFIXES) if (name.startsWith(prefix)) {
+		const injected = INJECTED_BINDINGS_BY_PREFIX[prefix];
+		if (injected.includes(name)) return `"${name}" is injected into every function by the platform; read env.${name} instead of setting it`;
+		return `names starting with "${prefix}" are reserved for values the platform injects into every function (${injected.join(", ")}). Use your own prefix instead, for example "${suggestedBindingName(name)}"`;
+	}
 	if (!VALID_BINDING_NAME_RE.test(name)) return "Binding name must match /^[A-Z][A-Z0-9_]*$/ (uppercase ASCII, digits, underscore; must start with a letter)";
 	return null;
 }
@@ -660,6 +684,13 @@ function isPatShape(token) {
 */
 async function browserAuthFlow() {
 	return new Promise((resolve, reject) => {
+		let timeout;
+		const settle = (outcome) => {
+			if (timeout !== void 0) clearTimeout(timeout);
+			server.close();
+			server.closeAllConnections();
+			outcome();
+		};
 		const server = createServer((req, res) => {
 			const url = new URL(req.url ?? "/", `http://localhost`);
 			if (url.pathname !== "/callback") {
@@ -672,20 +703,16 @@ async function browserAuthFlow() {
 			const expiresAt = url.searchParams.get("expires_at");
 			if (!accessToken || !refreshToken || !expiresAt) {
 				res.writeHead(400, { "Content-Type": "text/html" });
-				res.end("<html><body><h2>Authentication failed</h2><p>Missing token parameters. Please try again.</p></body></html>");
-				server.close();
-				reject(/* @__PURE__ */ new Error("Missing token parameters in callback"));
+				res.end("<html><body><h2>Authentication failed</h2><p>Missing token parameters. Please try again.</p></body></html>", () => settle(() => reject(/* @__PURE__ */ new Error("Missing token parameters in callback"))));
 				return;
 			}
-			res.writeHead(200, { "Content-Type": "text/html" });
-			res.end("<html><body style=\"font-family:system-ui;text-align:center;padding:3rem\"><h2>Authenticated!</h2><p>You can close this window and return to the terminal.</p></body></html>");
 			const creds = {
 				access_token: accessToken,
 				refresh_token: refreshToken,
 				expires_at: expiresAt
 			};
-			server.close();
-			resolve(creds);
+			res.writeHead(200, { "Content-Type": "text/html" });
+			res.end("<html><body style=\"font-family:system-ui;text-align:center;padding:3rem\"><h2>Authenticated!</h2><p>You can close this window and return to the terminal.</p></body></html>", () => settle(() => resolve(creds)));
 		});
 		server.listen(0, "127.0.0.1", () => {
 			const addr = server.address();
@@ -703,9 +730,8 @@ async function browserAuthFlow() {
 				console.log(pc.yellow(`  Please open this URL manually:`));
 				console.log(`  ${pc.underline(authUrl)}`);
 			});
-			setTimeout(() => {
-				server.close();
-				reject(/* @__PURE__ */ new Error("Authentication timed out. Please try again."));
+			timeout = setTimeout(() => {
+				settle(() => reject(/* @__PURE__ */ new Error("Authentication timed out. Please try again.")));
 			}, 12e4);
 		});
 	});
@@ -1298,6 +1324,8 @@ function generateSandboxEmail() {
 function generateSandboxPassword() {
 	return randomBytes(24).toString("base64url");
 }
+/** Request header carrying AMBA_SIGNUP_TOKEN on the signup call. */
+const SIGNUP_TOKEN_HEADER = "X-Amba-Signup-Token";
 /**
 * POST the synthesized credentials at the public signup endpoint.
 *
@@ -1313,12 +1341,17 @@ function generateSandboxPassword() {
 */
 async function performSandboxSignup(req, options = {}) {
 	const apiUrl = options.apiUrl ?? process.env["AMBA_API_URL"] ?? "https://api.amba.dev";
-	const res = await (options.fetchImpl ?? fetch)(`${apiUrl}/v1/auth/developer/signup`, {
+	const fetchImpl = options.fetchImpl ?? fetch;
+	const url = `${apiUrl}/v1/auth/developer/signup`;
+	const headers = {
+		"Content-Type": "application/json",
+		"User-Agent": "amba-cli/sandbox"
+	};
+	const signupToken = process.env["AMBA_SIGNUP_TOKEN"]?.trim();
+	if (signupToken) headers[SIGNUP_TOKEN_HEADER] = signupToken;
+	const res = await fetchImpl(url, {
 		method: "POST",
-		headers: {
-			"Content-Type": "application/json",
-			"User-Agent": "amba-cli/sandbox"
-		},
+		headers,
 		body: JSON.stringify({
 			email: req.email,
 			password: req.password,
@@ -9778,7 +9811,7 @@ async function diffConfigCommand(file = DEFAULT_BUNDLE_FILE, options = {}) {
 //#endregion
 //#region src/index.ts
 const program = new Command();
-program.name("amba").description("amba — agent-native backend-as-a-service for mobile apps.").version("4.1.6");
+program.name("amba").description("amba — agent-native backend-as-a-service for mobile apps.").version("4.1.8");
 program.option("--token <pat>", "Use a Personal Access Token for headless / CI / agent use (overrides ~/.amba/credentials.json + AMBA_PAT env)");
 program.hook("preAction", (thisCommand) => {
 	setBearerOverride(resolveTokenSource({
@@ -9983,7 +10016,7 @@ functionDomains.command("remove <name> <hostname>").description("Detach an exact
 	await runAction(() => functionDomainsRemoveCommand(name, hostname));
 });
 const secrets = program.command("secrets").description("Function secrets (GCP canonical, Workers-Secret synced)");
-secrets.command("set <name> [value]").description("Store a secret and queue its sync to your deployed function(s). Omit --function for a project-wide secret. Use --from-stdin to keep the value out of shell history.").option("--function <name>", "Function the secret binds to. OMIT this flag to set a PROJECT-WIDE secret — one value visible to every function in the project (and to any function deployed later). With it, the secret is scoped to just that function and overrides a same-name project-wide value. Use the same name as the entry passed to 'amba functions deploy'. Secrets may be set before the function is deployed; the sync drains once you deploy.").option("--env <env>", "'dev' | 'prod' — INFORMATIONAL ONLY. Both share one secret namespace per project. Use distinct secret names (e.g. STRIPE_KEY_DEV / STRIPE_KEY_PROD) or two amba projects for real env isolation.").option("--from-stdin", "Read the secret value from stdin instead of the positional arg. Mutually exclusive with <value>. Pipe in: `echo $KEY | amba secrets set NAME --from-stdin`.").action(async (name, value, opts) => {
+secrets.command("set <name> [value]").description("Store a secret and queue its sync to your deployed function(s). Omit --function for a project-wide secret. Use --from-stdin to keep the value out of shell history. Names starting with AMBA_ or EDGE_ are reserved for values every function already receives (env.AMBA_PROJECT_ID, env.AMBA_API_URL, env.AMBA_INTERNAL_TOKEN); use your own prefix, e.g. APP_CLIENT_KEY.").option("--function <name>", "Function the secret binds to. OMIT this flag to set a PROJECT-WIDE secret — one value visible to every function in the project (and to any function deployed later). With it, the secret is scoped to just that function and overrides a same-name project-wide value. Use the same name as the entry passed to 'amba functions deploy'. Secrets may be set before the function is deployed; the sync drains once you deploy.").option("--env <env>", "'dev' | 'prod' — INFORMATIONAL ONLY. Both share one secret namespace per project. Use distinct secret names (e.g. STRIPE_KEY_DEV / STRIPE_KEY_PROD) or two amba projects for real env isolation.").option("--from-stdin", "Read the secret value from stdin instead of the positional arg. Mutually exclusive with <value>. Pipe in: `echo $KEY | amba secrets set NAME --from-stdin`.").action(async (name, value, opts) => {
 	await runAction(() => secretsSetCommand(name, value, {
 		function: opts.function,
 		env: opts.env ?? "dev",

package/dist/sandbox.d.ts

@@ -146,6 +146,8 @@ export declare function generateSandboxEmail(): string;
  * accept "agent signup" with no password and we'd drop this entirely.
  */
 export declare function generateSandboxPassword(): string;
+/** Request header carrying AMBA_SIGNUP_TOKEN on the signup call. */
+export declare const SIGNUP_TOKEN_HEADER = "X-Amba-Signup-Token";
 /**
  * POST the synthesized credentials at the public signup endpoint.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@layers/amba",
-  "version": "4.1.6",
+  "version": "4.1.8",
   "description": "amba — agent-native backend-as-a-service. Functions, collections, storage, AI, email, queues, sites, and `amba ship` to take an Expo app live on the App Store + Google Play. `npx @layers/amba init` to start.",
   "type": "module",
   "bin": {
@@ -49,8 +49,8 @@
     "tsdown": "^0.12.5",
     "typescript": "^5.8.3",
     "vitest": "^3.2.4",
-    "@layers/amba-mcp": "4.0.10",
-    "@layers/amba-shared": "4.0.5"
+    "@layers/amba-shared": "4.0.6",
+    "@layers/amba-mcp": "4.0.11"
   },
   "scripts": {
     "build": "tsdown && tsc --emitDeclarationOnly",