@biznetgio/neo-app 0.4.15 → 0.4.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biznetgio/neo-app",
-  "version": "0.4.15",
+  "version": "0.4.17",
   "description": "NEO App CLI — one-command agent onboarding, MCP server, and project ops for coding agents (Codex, Claude Code).",
   "type": "module",
   "bin": {

package/src/deploySource.js

@@ -6,6 +6,7 @@ import { basename, join } from 'node:path';
 import { existsSync, readFileSync, readdirSync, writeFileSync, rmSync } from 'node:fs';
 import { execFileSync } from 'node:child_process';
 import { tmpdir } from 'node:os';
+import { estimateCost } from './pricing.js';
 
 export function sanitizeName(s) {
   return (
@@ -262,7 +263,16 @@ export async function deploySource(api, { projectId, src, name, port, build, ser
 
   if (dryRun) {
     for (const p of plan) log(`[dry-run] would ${p}`);
-    return { dryRun: true, plan, service: svc, environment: targetEnv };
+    // Cost confirmation before a billable deploy (handoff 3.3/3.4). A new service
+    // starts on the default compute tier; estimate from the live price book so the
+    // user sees the cost in the dry-run. Best-effort — never fail the dry-run on it.
+    let estimatedCost;
+    try {
+      const book = (await api.get('/api/v1/pricing')).data;
+      estimatedCost = estimateCost(book, { computeTier: 'micro' });
+      log(`[dry-run] estimated cost (default micro compute, ${svcType}): ~${estimatedCost.monthly} ${estimatedCost.currency}/mo (${estimatedCost.hourly}/h) — ${estimatedCost.assumptions}. Use neo_estimate for a specific size.`);
+    } catch { /* price book unavailable — skip the estimate, not the dry-run */ }
+    return { dryRun: true, plan, service: svc, environment: targetEnv, serviceType: svcType, estimatedCost };
   }
 
   if (src.mode === 'dir' || src.mode === 'zip') {

package/src/mcp/tools.js

@@ -6,6 +6,7 @@ import { resolve } from 'node:path';
 import { statSync } from 'node:fs';
 import { deploySource } from '../deploySource.js';
 import { pkgVersion } from '../util.js';
+import { estimateCost } from '../pricing.js';
 
 const str = (description) => ({ type: 'string', description });
 const int = (description) => ({ type: 'integer', description });
@@ -27,6 +28,17 @@ function result(status, data) {
 // (password, connection string, access/secret key, token) back to the agent.
 // Recursively replace any secret-looking value with a reference marker so the
 // agent still sees the resource's shape and non-secret identifiers.
+// §2 safety: a create/deploy mutation must name its environment explicitly —
+// NEVER default to production. A silent prod mutation is the exact risk the
+// handoff calls out ("Never default a missing environment to production").
+function requireEnv(env) {
+  const e = String(env || '').toLowerCase();
+  if (e !== 'staging' && e !== 'production') {
+    throw new Error('environment is required and must be "staging" or "production" — it is never defaulted (handoff §2: never silently mutate production). Test on staging first.');
+  }
+  return e;
+}
+
 const SECRET_KEY = /(password|secret|secretkey|accesskey|connectionstring|connstr|dsn|token|privatekey|apikey)/i;
 function redactSecrets(value) {
   if (Array.isArray(value)) return value.map(redactSecrets);
@@ -84,7 +96,7 @@ export const TOOLS = [
         { type: 'worker', create: 'via_folder', deploy: true, scale: true, logs: true, variables: true, delete: true, note: 'neo_deploy_folder serviceType=worker — no public ingress; repo auto-detection still TODO (handoff 6)' },
         { type: 'database', create: true, get: true, list: true, delete: true, note: 'neo_create/list/get/delete_database (0.4.15); update/plan still TODO (handoff 4.4)' },
         { type: 'queue', create: true, get: true, list: true, delete: true, note: 'neo_create/list/get/delete_queue (0.4.15); update/plan still TODO (handoff 4.5)' },
-        { type: 'cron', create: true, get: true, list: true, delete: true, note: 'neo_create/list/get/delete_cron (0.4.15); manual-run/history still TODO (handoff 4.6)' },
+        { type: 'cron', create: true, get: true, list: true, run: true, delete: true, note: 'neo_create/list/get/run/delete_cron (0.4.15-0.4.17); run-history still TODO (handoff 4.6)' },
         { type: 'object_storage', create: true, get: true, list: true, delete: true, note: 'neo_create/list/get/delete_bucket (0.4.15); object put/get still TODO (handoff 4.7)' },
       ];
 
@@ -97,7 +109,7 @@ export const TOOLS = [
         sourceTypes: ['git', 'image', 'dockerfile', 'local', 'template'],
         environments: ['staging', 'production'],
         pricing,
-        costConsent: { planApplyEnforced: false, note: 'neo_plan_stack / Approve & Create not implemented yet (handoff 3.3-3.4)' },
+        costConsent: { estimateAvailable: true, dryRunIncludesCost: true, planApplyEnforced: false, note: 'neo_estimate + deploy dry-run show cost (0.4.16); server-enforced neo_plan_stack / Approve & Create is still TODO (handoff 3.3-3.5)' },
         minClientVersion: pkgVersion(),
         deprecations: [],
       };
@@ -260,6 +272,37 @@ export const TOOLS = [
       return (await api.get(`/api/v1/orgs/${orgId}/credit`)).data;
     },
   },
+  {
+    name: 'neo_estimate',
+    description:
+      'Estimate the hourly and monthly cost (IDR) of a service or resource from the LIVE price book, so you can show the user the cost BEFORE a billable create/deploy (handoff 3.3/3.4). Read-only. Covers compute (a tier, or custom vcpu/memoryMB), persistent storage, and object storage; variable usage (queue messages, cron runs) is excluded and noted. Pass orgId to apply that org\'s price overrides.',
+    mutating: false,
+    schema: {
+      type: 'object',
+      properties: {
+        computeTier: str('Compute tier key: micro | small | medium | large | xlarge (bundled compute)'),
+        vcpu: { type: 'number', description: 'Custom vCPU count (use instead of computeTier)' },
+        memoryMB: int('Custom memory in MB (use with vcpu)'),
+        storageGB: int('Persistent/database storage in GB (optional)'),
+        objectStorageGB: int('Object-storage quota in GB (optional)'),
+        replicas: int('Replica count (default 1)'),
+        orgId: str('Organization id (optional — applies that org\'s price overrides)'),
+      },
+    },
+    async call(api, args) {
+      // Prefer the org price book (applies overrides); fall back to global defaults.
+      let orgId = args.orgId;
+      if (!orgId) { try { orgId = await api.resolveOrgId(); } catch { orgId = null; } }
+      let book;
+      try {
+        book = (await api.get(orgId ? `/api/v1/orgs/${orgId}/pricing` : '/api/v1/pricing')).data;
+      } catch {
+        book = (await api.get('/api/v1/pricing')).data; // org book may 404; global always readable
+      }
+      const est = estimateCost(book, args);
+      return { ...est, priceBook: orgId ? `org:${orgId}` : 'global-defaults' };
+    },
+  },
   {
     name: 'neo_list_templates',
     description: 'List deployable templates (e.g. wordpress, n8n, redis).',
@@ -297,12 +340,13 @@ export const TOOLS = [
         name: str('Service name (optional)'),
         serviceType: { type: 'string', enum: ['web', 'worker', 'static_site'], description: 'web (default) | worker (no public URL) | static_site. Auto-detects static_site for a static-only folder; else web.' },
         port: int('Container port (optional; ignored for worker)'),
-        environment: str('production or staging (optional, default production)'),
+        environment: { type: 'string', enum: ['staging', 'production'], description: 'REQUIRED — staging or production. Never defaulted (handoff §2). Deploy to staging first.' },
         dryRun: { type: 'boolean', description: 'Preview the plan without creating/uploading/deploying anything (JNG #93)' },
       },
-      required: ['projectId', 'path'],
+      required: ['projectId', 'path', 'environment'],
     },
     async call(api, args) {
+      const environment = requireEnv(args.environment);
       const p = resolve(args.path);
       let src;
       try {
@@ -319,10 +363,10 @@ export const TOOLS = [
         name: args.name,
         serviceType: args.serviceType,
         port: args.port,
-        environment: args.environment || 'production',
+        environment,
         dryRun: !!args.dryRun,
       });
-      if (r.dryRun) return { status: 'dry_run', plan: r.plan, service: r.service, environment: r.environment };
+      if (r.dryRun) return { status: 'dry_run', plan: r.plan, service: r.service, environment: r.environment, estimatedCost: r.estimatedCost };
       if (r.pending) return { status: 'pending_approval', approvalId: r.approvalId };
       return { status: r.result, url: r.url || undefined, appId: r.appId };
     },
@@ -358,14 +402,15 @@ export const TOOLS = [
         name: str('Database name'),
         engine: { type: 'string', description: 'postgres | mysql (engine)' },
         version: str('Engine version, e.g. "16" (optional)'),
-        environment: str('production or staging (optional, default production)'),
+        environment: { type: 'string', enum: ['staging', 'production'], description: 'REQUIRED — staging or production (never defaulted, handoff §2)' },
         volumeSize: str('Storage size, e.g. "10Gi" (optional)'),
         replicas: int('Read/failover replicas for HA (optional; postgres/CNPG only)'),
         deploymentMode: { type: 'string', description: 'single | ha (optional)' },
       },
-      required: ['projectId', 'name', 'engine'],
+      required: ['projectId', 'name', 'engine', 'environment'],
     },
     async call(api, args) {
+      requireEnv(args.environment);
       const { projectId, ...body } = args;
       const { status, data } = await api.post(`/api/v1/projects/${projectId}/databases`, body);
       return redactSecrets(result(status, data));
@@ -399,13 +444,14 @@ export const TOOLS = [
         projectId: str('Project id'),
         name: str('Queue name'),
         planClass: str('Plan/engine class (optional)'),
-        environment: str('production or staging (optional, default production)'),
+        environment: { type: 'string', enum: ['staging', 'production'], description: 'REQUIRED — staging or production (never defaulted, handoff §2)' },
         volumeSize: str('Storage size, e.g. "10Gi" (optional)'),
         dlqEnabled: { type: 'boolean', description: 'Enable a dead-letter queue (optional)' },
       },
-      required: ['projectId', 'name'],
+      required: ['projectId', 'name', 'environment'],
     },
     async call(api, args) {
+      requireEnv(args.environment);
       const { projectId, ...body } = args;
       const { status, data } = await api.post(`/api/v1/projects/${projectId}/queues`, body);
       return redactSecrets(result(status, data));
@@ -448,11 +494,12 @@ export const TOOLS = [
         command: { type: 'array', items: { type: 'string' }, description: 'Command argv (mode=app_command)' },
         url: str('Target URL (mode=http_endpoint)'),
         method: str('HTTP method (mode=http_endpoint), e.g. GET/POST'),
-        environment: str('production or staging (optional, default production)'),
+        environment: { type: 'string', enum: ['staging', 'production'], description: 'REQUIRED — staging or production (never defaulted, handoff §2)' },
       },
-      required: ['projectId', 'name', 'mode', 'scheduleType'],
+      required: ['projectId', 'name', 'mode', 'scheduleType', 'environment'],
     },
     async call(api, args) {
+      requireEnv(args.environment);
       const { projectId, ...body } = args;
       const { status, data } = await api.post(`/api/v1/projects/${projectId}/crons`, body);
       return redactSecrets(result(status, data));
@@ -476,6 +523,16 @@ export const TOOLS = [
       return redactSecrets((await api.get(`/api/v1/crons/${args.cronId}`)).data);
     },
   },
+  {
+    name: 'neo_run_cron',
+    description: 'Trigger a scheduled job (cron) to run now, out of schedule (handoff 4.6). Returns the run result. Not applicable to a continuous "seconds" cron.',
+    mutating: true,
+    schema: { type: 'object', properties: { cronId: str('Cron/scheduled-job id') }, required: ['cronId'] },
+    async call(api, args) {
+      const { status, data } = await api.post(`/api/v1/crons/${args.cronId}/run`);
+      return redactSecrets(result(status, data));
+    },
+  },
   {
     name: 'neo_create_bucket',
     description: 'Create an S3-compatible object-storage bucket in a project (handoff 4.7). Access keys are provisioned server-side and are NOT returned (write-only). May return pending_approval.',

package/src/pricing.js

@@ -0,0 +1,77 @@
+// Cost estimation from the NEO App price book (handoff 3.3/3.4 — cost consent).
+// Pure + dependency-free so it's trivially testable and reusable by both the
+// neo_estimate MCP tool and the deploy dry-run. The price book is the live
+// `/pricing` response: { prices: [{metric,key,rate,unit,currency,active}], tiers:[{key,vcpu,memoryMB,defaultRate}] }.
+// defaultRate is IDR/MONTH; hourly SKUs prorate over 730 hours/month.
+
+export const HOURS_PER_MONTH = 730;
+
+// priceOf finds an active price entry for a metric (+ optional tier key), or null.
+function priceOf(prices, metric, key = '') {
+  return (prices || []).find((x) => x.metric === metric && (x.key || '') === key && x.active !== false) || null;
+}
+
+// The price book is NOT self-describing by metric name: `compute_tier_hour`
+// actually carries unit:"month" with a MONTHLY rate, while `vcpu_hour`/`gb_ram_hour`
+// are genuinely hourly. So always normalize by the entry's `unit`, never the name.
+function hourlyFrom(price) {
+  if (!price) return null;
+  return /month/i.test(price.unit || '') ? price.rate / HOURS_PER_MONTH : price.rate;
+}
+function monthlyFrom(price) {
+  if (!price) return null;
+  return /month/i.test(price.unit || '') ? price.rate : price.rate * HOURS_PER_MONTH;
+}
+
+// estimateCost returns { currency, hourly, monthly, breakdown, assumptions } for
+// a spec: { computeTier?, vcpu?, memoryMB?, storageGB?, objectStorageGB?, replicas? }.
+// Compute is a bundled tier (compute_tier_hour, else the tier's defaultRate/730)
+// or custom (vcpu_hour*vCPU + gb_ram_hour*GB-RAM). Storage/object use their SKUs.
+export function estimateCost(book, spec = {}) {
+  const prices = book?.prices || [];
+  const tiers = book?.tiers || [];
+  const replicas = spec.replicas && spec.replicas > 0 ? spec.replicas : 1;
+  const breakdown = [];
+  let hourly = 0;
+  let monthlyExtra = 0; // monthly-only SKUs (storage/object)
+
+  if (spec.computeTier) {
+    let h = hourlyFrom(priceOf(prices, 'compute_tier_hour', spec.computeTier));
+    if (h == null) {
+      const tier = tiers.find((t) => t.key === spec.computeTier);
+      h = tier ? tier.defaultRate / HOURS_PER_MONTH : null; // defaultRate is monthly
+    }
+    if (h == null) {
+      const known = tiers.map((t) => t.key).join(', ') || 'none in price book';
+      throw new Error(`unknown compute tier "${spec.computeTier}" — known tiers: ${known}`);
+    }
+    hourly += h * replicas;
+    breakdown.push({ item: `compute ${spec.computeTier}${replicas > 1 ? ` x${replicas}` : ''}`, hourly: h * replicas });
+  } else if (spec.vcpu || spec.memoryMB) {
+    const vc = hourlyFrom(priceOf(prices, 'vcpu_hour')) || 0;
+    const gr = hourlyFrom(priceOf(prices, 'gb_ram_hour')) || 0;
+    const h = (vc * (spec.vcpu || 0) + gr * ((spec.memoryMB || 0) / 1024)) * replicas;
+    hourly += h;
+    breakdown.push({ item: `compute custom (${spec.vcpu || 0} vCPU, ${spec.memoryMB || 0} MB)${replicas > 1 ? ` x${replicas}` : ''}`, hourly: h });
+  }
+
+  if (spec.storageGB) {
+    const m = monthlyFrom(priceOf(prices, 'storage_gb_month') || priceOf(prices, 'gb_storage_hour'));
+    if (m != null) { monthlyExtra += m * spec.storageGB; breakdown.push({ item: `storage ${spec.storageGB} GB`, monthly: m * spec.storageGB }); }
+  }
+  if (spec.objectStorageGB) {
+    const m = monthlyFrom(priceOf(prices, 'object_gb_month') || priceOf(prices, 'object_gb_hour')) || 0;
+    monthlyExtra += m * spec.objectStorageGB;
+    breakdown.push({ item: `object storage ${spec.objectStorageGB} GB`, monthly: m * spec.objectStorageGB });
+  }
+
+  const monthly = hourly * HOURS_PER_MONTH + monthlyExtra;
+  const currency = (prices.find((p) => p.currency)?.currency) || 'IDR';
+  return {
+    currency,
+    hourly: Math.round(hourly * 10000) / 10000,
+    monthly: Math.round(monthly),
+    breakdown,
+    assumptions: `${HOURS_PER_MONTH} hours/month; variable usage (queue messages, cron runs, egress) not included — this is an estimate, not a quote`,
+  };
+}