@biznetgio/neo-app 0.4.17 → 0.4.19

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biznetgio/neo-app",
-  "version": "0.4.17",
+  "version": "0.4.19",
   "description": "NEO App CLI — one-command agent onboarding, MCP server, and project ops for coding agents (Codex, Claude Code).",
   "type": "module",
   "bin": {

package/src/mcp/tools.js

@@ -105,11 +105,12 @@ export const TOOLS = [
         controlPlane,
         resourceTypes,
         // Verbs this MCP build exposes today (no create-DB/queue/cron/bucket, no costed plan/apply yet).
-        lifecycleVerbs: ['create', 'list', 'get', 'deploy', 'scale', 'logs', 'get_variables', 'set_variable', 'delete', 'list_approvals', 'get_approval', 'get_credit', 'list_templates'],
+        lifecycleVerbs: ['plan', 'apply', 'get_operation', 'create', 'list', 'get', 'deploy', 'scale', 'logs', 'get_variables', 'set_variable', 'estimate', 'bind', 'unbind', 'run_cron', 'delete', 'list_approvals', 'get_approval', 'get_credit', 'list_templates'],
+        bindings: { supported: true, targets: ['neo_db', 'neo_queue'], writeOnly: true, note: 'neo_bind_resource injects DATABASE_URL/NATS_URL server-side at deploy; the secret is never returned (handoff 5)' },
         sourceTypes: ['git', 'image', 'dockerfile', 'local', 'template'],
         environments: ['staging', 'production'],
         pricing,
-        costConsent: { estimateAvailable: true, dryRunIncludesCost: true, planApplyEnforced: false, note: 'neo_estimate + deploy dry-run show cost (0.4.16); server-enforced neo_plan_stack / Approve & Create is still TODO (handoff 3.3-3.5)' },
+        costConsent: { estimateAvailable: true, dryRunIncludesCost: true, planApplyEnforced: true, note: 'neo_plan_stack returns a costed immutable plan; neo_apply_stack is server-enforced (hash/expiry/one-shot) so a billable stack requires a reviewed plan (handoff 3.3-3.5)' },
         minClientVersion: pkgVersion(),
         deprecations: [],
       };
@@ -572,6 +573,137 @@ export const TOOLS = [
       return redactSecrets((await api.get(`/api/v1/buckets/${args.bucketId}`)).data);
     },
   },
+  // --- Typed bindings (handoff 5): attach a DB/queue to a consumer service. The
+  // connection string is injected as an env var SERVER-SIDE at the consumer's next
+  // deploy (marked a secret) — it is never returned to the agent (write-only). ---
+  {
+    name: 'neo_bind_resource',
+    description:
+      'Bind a managed database or queue to a consumer service so its connection is injected as an environment variable at the consumer\'s next deploy — WITHOUT ever exposing the secret to you (handoff 5, write-only). envKey defaults to DATABASE_URL (neo_db) or NATS_URL (neo_queue). After binding, redeploy the consumer (neo_deploy) for it to take effect. The target and consumer must be in the same project.',
+    mutating: true,
+    schema: {
+      type: 'object',
+      properties: {
+        appId: str('Consumer service/app id that will receive the env var (from neo_list_services)'),
+        targetType: { type: 'string', enum: ['neo_db', 'neo_queue'], description: 'neo_db | neo_queue — the resource to attach' },
+        targetId: str('The database or queue id to bind'),
+        envKey: str('Env var name to inject (optional; default DATABASE_URL for neo_db, NATS_URL for neo_queue)'),
+      },
+      required: ['appId', 'targetType', 'targetId'],
+    },
+    async call(api, args) {
+      const { appId, ...body } = args;
+      const { status, data } = await api.post(`/api/v1/apps/${appId}/bindings`, body);
+      return redactSecrets(result(status, data));
+    },
+  },
+  {
+    name: 'neo_list_bindings',
+    description: 'List the resource bindings attached to a consumer service — the env keys and target resources, never the secret connection values.',
+    mutating: false,
+    schema: { type: 'object', properties: { appId: str('Consumer service/app id') }, required: ['appId'] },
+    async call(api, args) {
+      return redactSecrets((await api.get(`/api/v1/apps/${args.appId}/bindings`)).data);
+    },
+  },
+  {
+    name: 'neo_unbind_resource',
+    description: 'Remove a resource binding by id. The env var stops being injected on the consumer\'s next deploy. Removes the wiring only — the database/queue itself is untouched.',
+    mutating: true,
+    destructive: true,
+    schema: { type: 'object', properties: { bindingId: str('Binding id (from neo_list_bindings)') }, required: ['bindingId'] },
+    async call(api, args) {
+      const { status, data } = await api.del(`/api/v1/bindings/${args.bindingId}`);
+      return result(status, data);
+    },
+  },
+  // --- Costed plan / apply backbone (handoff 3.3-3.5 + 7): plan a whole stack
+  // zero-write, review the cost, then apply with the plan id+hash. The server
+  // enforces the plan (hash/expiry/one-shot) and runs it in dependency order. ---
+  {
+    name: 'neo_plan_stack',
+    description:
+      'Create an immutable, COSTED plan for a whole stack (services + databases/queues/buckets + bindings) WITHOUT creating anything — zero-write (handoff 3.3). Returns planId, planHash, itemized monthly/hourly cost, and ordered phases. Show the cost to the user for approval, then call neo_apply_stack with planId+planHash. The plan expires in 15 minutes.',
+    mutating: false,
+    schema: {
+      type: 'object',
+      properties: {
+        projectId: str('Project id'),
+        environment: { type: 'string', enum: ['staging', 'production'], description: 'REQUIRED — staging or production (never defaulted, handoff §2)' },
+        resources: {
+          type: 'array',
+          description: 'The stack resources. Each needs a unique name + kind (app | database | queue | bucket).',
+          items: {
+            type: 'object',
+            properties: {
+              kind: { type: 'string', enum: ['app', 'database', 'queue', 'bucket'] },
+              name: str('Unique resource name within this stack (bindings reference it)'),
+              serviceType: str('app: web | worker | static_site'),
+              image: str('app: prebuilt image reference'),
+              repoUrl: str('app: git repository URL'),
+              branch: str('app: git branch'),
+              port: int('app: container port'),
+              computeTier: str('app/db/queue: micro | small | medium | large | xlarge'),
+              engine: str('database: postgres | mysql'),
+              version: str('database: engine version, e.g. 16'),
+              volumeSize: str('database: storage size, e.g. 10Gi'),
+              quotaGB: int('bucket: storage quota GB'),
+              region: str('bucket: region'),
+            },
+            required: ['kind', 'name'],
+          },
+        },
+        bindings: {
+          type: 'array',
+          description: 'Wire a database/queue into a consumer app (injected as an env var at deploy, server-side).',
+          items: {
+            type: 'object',
+            properties: {
+              consumer: str('The consumer app resource name'),
+              targetType: { type: 'string', enum: ['neo_db', 'neo_queue'] },
+              target: str('The database/queue resource name'),
+              envKey: str('Env var name (optional; default DATABASE_URL / NATS_URL)'),
+            },
+            required: ['consumer', 'targetType', 'target'],
+          },
+        },
+      },
+      required: ['projectId', 'environment', 'resources'],
+    },
+    async call(api, args) {
+      requireEnv(args.environment);
+      const { projectId, ...body } = args;
+      const { status, data } = await api.post(`/api/v1/projects/${projectId}/plans`, body);
+      return result(status, data);
+    },
+  },
+  {
+    name: 'neo_apply_stack',
+    description:
+      'Apply a planned stack. REQUIRES the planId and the exact planHash from neo_plan_stack — the SERVER rejects a missing, changed, expired, or already-applied plan, so a billable stack can never be created without first creating + reviewing its costed plan (handoff 3.4/3.5, server-enforced approval). Creates resources in dependency order (foundations → services → bindings → deploy) and returns an operationId to poll with neo_get_operation.',
+    mutating: true,
+    schema: {
+      type: 'object',
+      properties: {
+        planId: str('Plan id from neo_plan_stack'),
+        planHash: str('Plan hash from neo_plan_stack — must match exactly (proves you reviewed this plan)'),
+      },
+      required: ['planId', 'planHash'],
+    },
+    async call(api, args) {
+      const { status, data } = await api.post(`/api/v1/plans/${args.planId}/apply`, { planHash: args.planHash });
+      return result(status, data);
+    },
+  },
+  {
+    name: 'neo_get_operation',
+    description: 'Get the status of a stack apply (the operationId/planId from neo_apply_stack): overall status (applying | applied | failed) plus per-resource status (creating | created | deployed | failed). Poll until terminal.',
+    mutating: false,
+    schema: { type: 'object', properties: { operationId: str('Operation id (= plan id from neo_apply_stack)') }, required: ['operationId'] },
+    async call(api, args) {
+      return redactSecrets((await api.get(`/api/v1/plans/${args.operationId}`)).data);
+    },
+  },
   // --- Cleanup (handoff 3.6): MCP can delete every resource type it can reach, so
   // an agent never leaks a resource it created. These are DESTRUCTIVE and permanent;
   // the server hard-deletes the record and tears down the running workload. ---