@biznetgio/neo-app 0.4.14 → 0.4.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biznetgio/neo-app",
-  "version": "0.4.14",
+  "version": "0.4.16",
   "description": "NEO App CLI — one-command agent onboarding, MCP server, and project ops for coding agents (Codex, Claude Code).",
   "type": "module",
   "bin": {

package/src/deploySource.js

@@ -6,6 +6,7 @@ import { basename, join } from 'node:path';
 import { existsSync, readFileSync, readdirSync, writeFileSync, rmSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import { tmpdir } from 'node:os';
+import { estimateCost } from './pricing.js';
 
 export function sanitizeName(s) {
   return (
@@ -262,7 +263,16 @@ export async function deploySource(api, { projectId, src, name, port, build, ser
 
   if (dryRun) {
     for (const p of plan) log(`[dry-run] would ${p}`);
-    return { dryRun: true, plan, service: svc, environment: targetEnv };
+    // Cost confirmation before a billable deploy (handoff 3.3/3.4). A new service
+    // starts on the default compute tier; estimate from the live price book so the
+    // user sees the cost in the dry-run. Best-effort — never fail the dry-run on it.
+    let estimatedCost;
+    try {
+      const book = (await api.get('/api/v1/pricing')).data;
+      estimatedCost = estimateCost(book, { computeTier: 'micro' });
+      log(`[dry-run] estimated cost (default micro compute, ${svcType}): ~${estimatedCost.monthly} ${estimatedCost.currency}/mo (${estimatedCost.hourly}/h) — ${estimatedCost.assumptions}. Use neo_estimate for a specific size.`);
+    } catch { /* price book unavailable — skip the estimate, not the dry-run */ }
+    return { dryRun: true, plan, service: svc, environment: targetEnv, serviceType: svcType, estimatedCost };
   }
 
   if (src.mode === 'dir' || src.mode === 'zip') {

package/src/mcp/tools.js

@@ -6,6 +6,7 @@ import { resolve } from 'node:path';
 import { statSync } from 'node:fs';
 import { deploySource } from '../deploySource.js';
 import { pkgVersion } from '../util.js';
+import { estimateCost } from '../pricing.js';
 
 const str = (description) => ({ type: 'string', description });
 const int = (description) => ({ type: 'integer', description });
@@ -23,6 +24,23 @@ function result(status, data) {
   return data;
 }
 
+// Credentials are write-only (handoff 4.4/4.5/4.7/5): never hand a raw secret
+// (password, connection string, access/secret key, token) back to the agent.
+// Recursively replace any secret-looking value with a reference marker so the
+// agent still sees the resource's shape and non-secret identifiers.
+const SECRET_KEY = /(password|secret|secretkey|accesskey|connectionstring|connstr|dsn|token|privatekey|apikey)/i;
+function redactSecrets(value) {
+  if (Array.isArray(value)) return value.map(redactSecrets);
+  if (value && typeof value === 'object') {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = SECRET_KEY.test(k) ? '[redacted — credentials are write-only; bind them to a consumer instead]' : redactSecrets(v);
+    }
+    return out;
+  }
+  return value;
+}
+
 export const TOOLS = [
   {
     name: 'neo_whoami',
@@ -65,10 +83,10 @@ export const TOOLS = [
         { type: 'template', create: true, deploy: true, scale: false, logs: true, variables: true, delete: true },
         { type: 'static_site', create: 'via_folder', deploy: true, scale: false, logs: true, variables: true, delete: true, note: 'neo_deploy_folder serviceType=static_site (auto-detected for static-only folders); auto-detection from a repo/monorepo is still TODO (handoff 6)' },
         { type: 'worker', create: 'via_folder', deploy: true, scale: true, logs: true, variables: true, delete: true, note: 'neo_deploy_folder serviceType=worker — no public ingress; repo auto-detection still TODO (handoff 6)' },
-        { type: 'database', create: false, deploy: false, delete: true, note: 'neo_delete_database exists; create still has no MCP tool (handoff 4.4)' },
-        { type: 'queue', create: false, deploy: false, delete: true, note: 'neo_delete_queue exists; create still has no MCP tool (handoff 4.5)' },
-        { type: 'cron', create: false, deploy: false, delete: true, note: 'neo_delete_cron exists; create still has no MCP tool (handoff 4.6)' },
-        { type: 'object_storage', create: false, deploy: false, delete: true, note: 'neo_delete_bucket exists; create still has no MCP tool (handoff 4.7)' },
+        { type: 'database', create: true, get: true, list: true, delete: true, note: 'neo_create/list/get/delete_database (0.4.15); update/plan still TODO (handoff 4.4)' },
+        { type: 'queue', create: true, get: true, list: true, delete: true, note: 'neo_create/list/get/delete_queue (0.4.15); update/plan still TODO (handoff 4.5)' },
+        { type: 'cron', create: true, get: true, list: true, delete: true, note: 'neo_create/list/get/delete_cron (0.4.15); manual-run/history still TODO (handoff 4.6)' },
+        { type: 'object_storage', create: true, get: true, list: true, delete: true, note: 'neo_create/list/get/delete_bucket (0.4.15); object put/get still TODO (handoff 4.7)' },
       ];
 
       return {
@@ -76,11 +94,11 @@ export const TOOLS = [
         controlPlane,
         resourceTypes,
         // Verbs this MCP build exposes today (no create-DB/queue/cron/bucket, no costed plan/apply yet).
-        lifecycleVerbs: ['list', 'get', 'deploy', 'scale', 'logs', 'get_variables', 'set_variable', 'delete', 'list_approvals', 'get_approval', 'get_credit', 'list_templates'],
+        lifecycleVerbs: ['create', 'list', 'get', 'deploy', 'scale', 'logs', 'get_variables', 'set_variable', 'delete', 'list_approvals', 'get_approval', 'get_credit', 'list_templates'],
         sourceTypes: ['git', 'image', 'dockerfile', 'local', 'template'],
         environments: ['staging', 'production'],
         pricing,
-        costConsent: { planApplyEnforced: false, note: 'neo_plan_stack / Approve & Create not implemented yet (handoff 3.3-3.4)' },
+        costConsent: { estimateAvailable: true, dryRunIncludesCost: true, planApplyEnforced: false, note: 'neo_estimate + deploy dry-run show cost (0.4.16); server-enforced neo_plan_stack / Approve & Create is still TODO (handoff 3.3-3.5)' },
         minClientVersion: pkgVersion(),
         deprecations: [],
       };
@@ -243,6 +261,37 @@ export const TOOLS = [
       return (await api.get(`/api/v1/orgs/${orgId}/credit`)).data;
     },
   },
+  {
+    name: 'neo_estimate',
+    description:
+      'Estimate the hourly and monthly cost (IDR) of a service or resource from the LIVE price book, so you can show the user the cost BEFORE a billable create/deploy (handoff 3.3/3.4). Read-only. Covers compute (a tier, or custom vcpu/memoryMB), persistent storage, and object storage; variable usage (queue messages, cron runs) is excluded and noted. Pass orgId to apply that org\'s price overrides.',
+    mutating: false,
+    schema: {
+      type: 'object',
+      properties: {
+        computeTier: str('Compute tier key: micro | small | medium | large | xlarge (bundled compute)'),
+        vcpu: { type: 'number', description: 'Custom vCPU count (use instead of computeTier)' },
+        memoryMB: int('Custom memory in MB (use with vcpu)'),
+        storageGB: int('Persistent/database storage in GB (optional)'),
+        objectStorageGB: int('Object-storage quota in GB (optional)'),
+        replicas: int('Replica count (default 1)'),
+        orgId: str('Organization id (optional — applies that org\'s price overrides)'),
+      },
+    },
+    async call(api, args) {
+      // Prefer the org price book (applies overrides); fall back to global defaults.
+      let orgId = args.orgId;
+      if (!orgId) { try { orgId = await api.resolveOrgId(); } catch { orgId = null; } }
+      let book;
+      try {
+        book = (await api.get(orgId ? `/api/v1/orgs/${orgId}/pricing` : '/api/v1/pricing')).data;
+      } catch {
+        book = (await api.get('/api/v1/pricing')).data; // org book may 404; global always readable
+      }
+      const est = estimateCost(book, args);
+      return { ...est, priceBook: orgId ? `org:${orgId}` : 'global-defaults' };
+    },
+  },
   {
     name: 'neo_list_templates',
     description: 'List deployable templates (e.g. wordpress, n8n, redis).',
@@ -305,7 +354,7 @@ export const TOOLS = [
         environment: args.environment || 'production',
         dryRun: !!args.dryRun,
       });
-      if (r.dryRun) return { status: 'dry_run', plan: r.plan, service: r.service, environment: r.environment };
+      if (r.dryRun) return { status: 'dry_run', plan: r.plan, service: r.service, environment: r.environment, estimatedCost: r.estimatedCost };
       if (r.pending) return { status: 'pending_approval', approvalId: r.approvalId };
       return { status: r.result, url: r.url || undefined, appId: r.appId };
     },
@@ -327,6 +376,177 @@ export const TOOLS = [
       return found;
     },
   },
+  // --- Managed resources (handoff 4.4-4.7): create/list/get for DB, Queue, Cron,
+  // Object Storage. Credentials in responses are redacted (write-only). A member's
+  // create may return pending_approval (202) — surfaced verbatim, not an error. ---
+  {
+    name: 'neo_create_database',
+    description: 'Create a managed database in a project (handoff 4.4). Returns the resource (credentials redacted); poll neo_get_database for readiness, then deploy via REST/portal if needed. May return pending_approval.',
+    mutating: true,
+    schema: {
+      type: 'object',
+      properties: {
+        projectId: str('Project id'),
+        name: str('Database name'),
+        engine: { type: 'string', description: 'postgres | mysql (engine)' },
+        version: str('Engine version, e.g. "16" (optional)'),
+        environment: str('production or staging (optional, default production)'),
+        volumeSize: str('Storage size, e.g. "10Gi" (optional)'),
+        replicas: int('Read/failover replicas for HA (optional; postgres/CNPG only)'),
+        deploymentMode: { type: 'string', description: 'single | ha (optional)' },
+      },
+      required: ['projectId', 'name', 'engine'],
+    },
+    async call(api, args) {
+      const { projectId, ...body } = args;
+      const { status, data } = await api.post(`/api/v1/projects/${projectId}/databases`, body);
+      return redactSecrets(result(status, data));
+    },
+  },
+  {
+    name: 'neo_list_databases',
+    description: 'List managed databases in a project (credentials redacted).',
+    mutating: false,
+    schema: { type: 'object', properties: { projectId: str('Project id') }, required: ['projectId'] },
+    async call(api, args) {
+      return redactSecrets((await api.get(`/api/v1/projects/${args.projectId}/databases`)).data);
+    },
+  },
+  {
+    name: 'neo_get_database',
+    description: 'Get one managed database by id, including provisioning/readiness state (credentials redacted — bind them to a consumer instead).',
+    mutating: false,
+    schema: { type: 'object', properties: { databaseId: str('Database id') }, required: ['databaseId'] },
+    async call(api, args) {
+      return redactSecrets((await api.get(`/api/v1/databases/${args.databaseId}`)).data);
+    },
+  },
+  {
+    name: 'neo_create_queue',
+    description: 'Create a managed queue in a project (handoff 4.5). Credentials redacted. May return pending_approval.',
+    mutating: true,
+    schema: {
+      type: 'object',
+      properties: {
+        projectId: str('Project id'),
+        name: str('Queue name'),
+        planClass: str('Plan/engine class (optional)'),
+        environment: str('production or staging (optional, default production)'),
+        volumeSize: str('Storage size, e.g. "10Gi" (optional)'),
+        dlqEnabled: { type: 'boolean', description: 'Enable a dead-letter queue (optional)' },
+      },
+      required: ['projectId', 'name'],
+    },
+    async call(api, args) {
+      const { projectId, ...body } = args;
+      const { status, data } = await api.post(`/api/v1/projects/${projectId}/queues`, body);
+      return redactSecrets(result(status, data));
+    },
+  },
+  {
+    name: 'neo_list_queues',
+    description: 'List managed queues in a project (credentials redacted).',
+    mutating: false,
+    schema: { type: 'object', properties: { projectId: str('Project id') }, required: ['projectId'] },
+    async call(api, args) {
+      return redactSecrets((await api.get(`/api/v1/projects/${args.projectId}/queues`)).data);
+    },
+  },
+  {
+    name: 'neo_get_queue',
+    description: 'Get one managed queue by id, including readiness (credentials redacted).',
+    mutating: false,
+    schema: { type: 'object', properties: { queueId: str('Queue id') }, required: ['queueId'] },
+    async call(api, args) {
+      return redactSecrets((await api.get(`/api/v1/queues/${args.queueId}`)).data);
+    },
+  },
+  {
+    name: 'neo_create_cron',
+    description: 'Create a scheduled job (cron) in a project (handoff 4.6). Target is either an existing service command (mode=app_command, serviceId+command) or an HTTP endpoint (mode=http_endpoint, url+method). Schedule via scheduleType (cron|interval|once|seconds) + schedule/intervalMinutes. May return pending_approval.',
+    mutating: true,
+    schema: {
+      type: 'object',
+      properties: {
+        projectId: str('Project id'),
+        name: str('Job name'),
+        mode: { type: 'string', description: 'app_command | http_endpoint' },
+        scheduleType: { type: 'string', description: 'cron | interval | once | seconds' },
+        schedule: str('Cron expression (when scheduleType=cron), e.g. "0 * * * *"'),
+        intervalMinutes: int('Interval in minutes (when scheduleType=interval)'),
+        timezone: str('IANA timezone, e.g. "Asia/Jakarta" (optional)'),
+        serviceId: str('Target service id (mode=app_command)'),
+        image: str('Image to run (mode=app_command, if not targeting a service)'),
+        command: { type: 'array', items: { type: 'string' }, description: 'Command argv (mode=app_command)' },
+        url: str('Target URL (mode=http_endpoint)'),
+        method: str('HTTP method (mode=http_endpoint), e.g. GET/POST'),
+        environment: str('production or staging (optional, default production)'),
+      },
+      required: ['projectId', 'name', 'mode', 'scheduleType'],
+    },
+    async call(api, args) {
+      const { projectId, ...body } = args;
+      const { status, data } = await api.post(`/api/v1/projects/${projectId}/crons`, body);
+      return redactSecrets(result(status, data));
+    },
+  },
+  {
+    name: 'neo_list_crons',
+    description: 'List scheduled jobs (crons) in a project.',
+    mutating: false,
+    schema: { type: 'object', properties: { projectId: str('Project id') }, required: ['projectId'] },
+    async call(api, args) {
+      return redactSecrets((await api.get(`/api/v1/projects/${args.projectId}/crons`)).data);
+    },
+  },
+  {
+    name: 'neo_get_cron',
+    description: 'Get one scheduled job (cron) by id, including its schedule and last run.',
+    mutating: false,
+    schema: { type: 'object', properties: { cronId: str('Cron/scheduled-job id') }, required: ['cronId'] },
+    async call(api, args) {
+      return redactSecrets((await api.get(`/api/v1/crons/${args.cronId}`)).data);
+    },
+  },
+  {
+    name: 'neo_create_bucket',
+    description: 'Create an S3-compatible object-storage bucket in a project (handoff 4.7). Access keys are provisioned server-side and are NOT returned (write-only). May return pending_approval.',
+    mutating: true,
+    schema: {
+      type: 'object',
+      properties: {
+        projectId: str('Project id'),
+        name: str('Bucket name'),
+        region: str('Region (optional; see neo_list_regions on the portal)'),
+        acl: { type: 'string', description: 'private | public-read (optional, default private)' },
+        quotaGB: int('Storage quota in GB (optional)'),
+      },
+      required: ['projectId', 'name'],
+    },
+    async call(api, args) {
+      const { projectId, ...body } = args;
+      const { status, data } = await api.post(`/api/v1/projects/${projectId}/buckets`, body);
+      return redactSecrets(result(status, data));
+    },
+  },
+  {
+    name: 'neo_list_buckets',
+    description: 'List object-storage buckets in a project.',
+    mutating: false,
+    schema: { type: 'object', properties: { projectId: str('Project id') }, required: ['projectId'] },
+    async call(api, args) {
+      return redactSecrets((await api.get(`/api/v1/projects/${args.projectId}/buckets`)).data);
+    },
+  },
+  {
+    name: 'neo_get_bucket',
+    description: 'Get one object-storage bucket by id (access keys not returned — write-only).',
+    mutating: false,
+    schema: { type: 'object', properties: { bucketId: str('Bucket id') }, required: ['bucketId'] },
+    async call(api, args) {
+      return redactSecrets((await api.get(`/api/v1/buckets/${args.bucketId}`)).data);
+    },
+  },
   // --- Cleanup (handoff 3.6): MCP can delete every resource type it can reach, so
   // an agent never leaks a resource it created. These are DESTRUCTIVE and permanent;
   // the server hard-deletes the record and tears down the running workload. ---

package/src/pricing.js

@@ -0,0 +1,77 @@
+// Cost estimation from the NEO App price book (handoff 3.3/3.4 — cost consent).
+// Pure + dependency-free so it's trivially testable and reusable by both the
+// neo_estimate MCP tool and the deploy dry-run. The price book is the live
+// `/pricing` response: { prices: [{metric,key,rate,unit,currency,active}], tiers:[{key,vcpu,memoryMB,defaultRate}] }.
+// defaultRate is IDR/MONTH; hourly SKUs prorate over 730 hours/month.
+
+export const HOURS_PER_MONTH = 730;
+
+// priceOf finds an active price entry for a metric (+ optional tier key), or null.
+function priceOf(prices, metric, key = '') {
+  return (prices || []).find((x) => x.metric === metric && (x.key || '') === key && x.active !== false) || null;
+}
+
+// The price book is NOT self-describing by metric name: `compute_tier_hour`
+// actually carries unit:"month" with a MONTHLY rate, while `vcpu_hour`/`gb_ram_hour`
+// are genuinely hourly. So always normalize by the entry's `unit`, never the name.
+function hourlyFrom(price) {
+  if (!price) return null;
+  return /month/i.test(price.unit || '') ? price.rate / HOURS_PER_MONTH : price.rate;
+}
+function monthlyFrom(price) {
+  if (!price) return null;
+  return /month/i.test(price.unit || '') ? price.rate : price.rate * HOURS_PER_MONTH;
+}
+
+// estimateCost returns { currency, hourly, monthly, breakdown, assumptions } for
+// a spec: { computeTier?, vcpu?, memoryMB?, storageGB?, objectStorageGB?, replicas? }.
+// Compute is a bundled tier (compute_tier_hour, else the tier's defaultRate/730)
+// or custom (vcpu_hour*vCPU + gb_ram_hour*GB-RAM). Storage/object use their SKUs.
+export function estimateCost(book, spec = {}) {
+  const prices = book?.prices || [];
+  const tiers = book?.tiers || [];
+  const replicas = spec.replicas && spec.replicas > 0 ? spec.replicas : 1;
+  const breakdown = [];
+  let hourly = 0;
+  let monthlyExtra = 0; // monthly-only SKUs (storage/object)
+
+  if (spec.computeTier) {
+    let h = hourlyFrom(priceOf(prices, 'compute_tier_hour', spec.computeTier));
+    if (h == null) {
+      const tier = tiers.find((t) => t.key === spec.computeTier);
+      h = tier ? tier.defaultRate / HOURS_PER_MONTH : null; // defaultRate is monthly
+    }
+    if (h == null) {
+      const known = tiers.map((t) => t.key).join(', ') || 'none in price book';
+      throw new Error(`unknown compute tier "${spec.computeTier}" — known tiers: ${known}`);
+    }
+    hourly += h * replicas;
+    breakdown.push({ item: `compute ${spec.computeTier}${replicas > 1 ? ` x${replicas}` : ''}`, hourly: h * replicas });
+  } else if (spec.vcpu || spec.memoryMB) {
+    const vc = hourlyFrom(priceOf(prices, 'vcpu_hour')) || 0;
+    const gr = hourlyFrom(priceOf(prices, 'gb_ram_hour')) || 0;
+    const h = (vc * (spec.vcpu || 0) + gr * ((spec.memoryMB || 0) / 1024)) * replicas;
+    hourly += h;
+    breakdown.push({ item: `compute custom (${spec.vcpu || 0} vCPU, ${spec.memoryMB || 0} MB)${replicas > 1 ? ` x${replicas}` : ''}`, hourly: h });
+  }
+
+  if (spec.storageGB) {
+    const m = monthlyFrom(priceOf(prices, 'storage_gb_month') || priceOf(prices, 'gb_storage_hour'));
+    if (m != null) { monthlyExtra += m * spec.storageGB; breakdown.push({ item: `storage ${spec.storageGB} GB`, monthly: m * spec.storageGB }); }
+  }
+  if (spec.objectStorageGB) {
+    const m = monthlyFrom(priceOf(prices, 'object_gb_month') || priceOf(prices, 'object_gb_hour')) || 0;
+    monthlyExtra += m * spec.objectStorageGB;
+    breakdown.push({ item: `object storage ${spec.objectStorageGB} GB`, monthly: m * spec.objectStorageGB });
+  }
+
+  const monthly = hourly * HOURS_PER_MONTH + monthlyExtra;
+  const currency = (prices.find((p) => p.currency)?.currency) || 'IDR';
+  return {
+    currency,
+    hourly: Math.round(hourly * 10000) / 10000,
+    monthly: Math.round(monthly),
+    breakdown,
+    assumptions: `${HOURS_PER_MONTH} hours/month; variable usage (queue messages, cron runs, egress) not included — this is an estimate, not a quote`,
+  };
+}