@biznetgio/neo-app 0.4.24 → 0.4.26

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biznetgio/neo-app",
-  "version": "0.4.24",
+  "version": "0.4.26",
   "description": "NEO App CLI — one-command agent onboarding, MCP server, and project ops for coding agents (Codex, Claude Code).",
   "type": "module",
   "bin": {

package/src/api.js

@@ -58,6 +58,18 @@ export class NeoApi {
     return { status: res.status, data: payload };
   }
 
+  // postForm sends a multipart/form-data body (FormData); fetch sets the boundary.
+  async postForm(path, form) {
+    const headers = {};
+    if (this.token) headers.Authorization = `Bearer ${this.token}`;
+    const res = await fetch(this.baseUrl + path, { method: 'POST', headers, body: form });
+    const payload = await res.json().catch(() => null);
+    if (res.status >= 400) {
+      throw new ApiError(res.status, (payload && payload.error) || res.statusText, payload);
+    }
+    return { status: res.status, data: payload };
+  }
+
   get(path, opts) {
     return this.request('GET', path, opts);
   }

package/src/mcp/tools.js

@@ -2,8 +2,8 @@
 // map). Read-only vs mutating is annotated; mutating tools surface the server's
 // 202 pending_approval result verbatim instead of treating it as success/failure.
 
-import { resolve } from 'node:path';
-import { statSync } from 'node:fs';
+import { resolve, basename } from 'node:path';
+import { statSync, readFileSync } from 'node:fs';
 import { deploySource } from '../deploySource.js';
 import { pkgVersion } from '../util.js';
 import { estimateCost } from '../pricing.js';
@@ -94,10 +94,10 @@ export const TOOLS = [
         { type: 'template', create: true, deploy: true, scale: false, logs: true, variables: true, delete: true },
         { type: 'static_site', create: 'via_folder', deploy: true, scale: false, logs: true, variables: true, delete: true, note: 'neo_deploy_folder serviceType=static_site (auto-detected for static-only folders); auto-detection from a repo/monorepo is still TODO (handoff 6)' },
         { type: 'worker', create: 'via_folder', deploy: true, scale: true, logs: true, variables: true, delete: true, note: 'neo_deploy_folder serviceType=worker — no public ingress; repo auto-detection still TODO (handoff 6)' },
-        { type: 'database', create: true, get: true, list: true, update: true, delete: true, note: 'neo_create/list/get/update(resize)/delete_database (0.4.15-0.4.21); backup/restore still TODO (handoff 4.4)' },
-        { type: 'queue', create: true, get: true, list: true, delete: true, note: 'neo_create/list/get/delete_queue (0.4.15); update/plan still TODO (handoff 4.5)' },
+        { type: 'database', create: true, get: true, list: true, update: true, backup: true, delete: true, note: 'neo_create/list/get/update(resize)/delete_database + backup (list/create/run); restore still TODO (handoff 4.4)' },
+        { type: 'queue', create: true, get: true, list: true, update: true, delete: true, note: 'neo_create/list/get/update/delete_queue (0.4.15-0.4.25) (handoff 4.5)' },
         { type: 'cron', create: true, get: true, list: true, run: true, runs: true, delete: true, note: 'neo_create/list/get/run/list_runs/delete_cron (0.4.15-0.4.21) (handoff 4.6)' },
-        { type: 'object_storage', create: true, get: true, list: true, objects: true, delete: true, note: 'neo_create/list/get/delete_bucket + list/delete objects (0.4.15-0.4.21); object upload still TODO (handoff 4.7)' },
+        { type: 'object_storage', create: true, get: true, list: true, objects: true, upload: true, delete: true, note: 'neo_create/list/get/delete_bucket + list/upload/presign(get)/delete objects (0.4.15-0.4.25) (handoff 4.7)' },
       ];
 
       return {
@@ -105,7 +105,7 @@ export const TOOLS = [
         controlPlane,
         resourceTypes,
         // Verbs this MCP build exposes today (no create-DB/queue/cron/bucket, no costed plan/apply yet).
-        lifecycleVerbs: ['plan', 'apply', 'get_operation', 'wait_operation', 'create', 'list', 'get', 'update', 'deploy', 'scale', 'logs', 'get_variables', 'set_variable', 'estimate', 'scan_repo', 'bind', 'unbind', 'run_cron', 'presign_object', 'delete', 'list_approvals', 'get_approval', 'get_credit', 'list_templates'],
+        lifecycleVerbs: ['plan', 'apply', 'get_operation', 'wait_operation', 'delete_stack', 'reconcile_usage', 'create', 'list', 'get', 'update', 'deploy', 'scale', 'logs', 'get_variables', 'set_variable', 'estimate', 'scan_repo', 'bind', 'unbind', 'run_cron', 'presign_object', 'backup', 'delete', 'list_approvals', 'get_approval', 'get_credit', 'list_templates'],
         bindings: { supported: true, targets: ['neo_db', 'neo_queue'], writeOnly: true, note: 'neo_bind_resource injects DATABASE_URL/NATS_URL server-side at deploy; the secret is never returned (handoff 5)' },
         sourceTypes: ['git', 'image', 'dockerfile', 'local', 'template'],
         environments: ['staging', 'production'],
@@ -349,6 +349,11 @@ export const TOOLS = [
         suggestedBuildType: s.type === 'docker' ? 'dockerfile' : 'railpack',
         contextDir: s.path || undefined,
         detectedDependencies: s.deps || [], // database | queue | object_storage, inferred from the manifest
+        // Confidence + evidence (handoff 6): an explicit Dockerfile/index.html is high
+        // confidence; a language marker is inferred (medium). The stack marker + any
+        // detectedDependencies ARE the evidence.
+        typeConfidence: (s.type === 'docker' || s.type === 'static') ? 'high' : 'medium',
+        evidence: { marker: s.type, manifestDeps: s.deps || [] },
       }));
       const anyDeps = components.some((c) => c.detectedDependencies.length);
       return {
@@ -517,6 +522,45 @@ export const TOOLS = [
       return redactSecrets(result(status, data));
     },
   },
+  {
+    name: 'neo_list_backups',
+    description: 'List configured database backups in a project (handoff 4.4): schedule, destination, last run status.',
+    mutating: false,
+    schema: { type: 'object', properties: { projectId: str('Project id') }, required: ['projectId'] },
+    async call(api, args) {
+      return redactSecrets((await api.get(`/api/v1/projects/${args.projectId}/backups`)).data);
+    },
+  },
+  {
+    name: 'neo_create_backup',
+    description: 'Configure a backup for a managed database (handoff 4.4). `cron` sets a schedule (empty = manual only); `destination` is local (default) or s3. Trigger it with neo_run_backup.',
+    mutating: true,
+    schema: {
+      type: 'object',
+      properties: {
+        projectId: str('Project id'),
+        databaseId: str('Database id to back up'),
+        cron: str('Cron schedule (optional; empty = manual)'),
+        destination: { type: 'string', enum: ['local', 's3'], description: 'local (default) | s3' },
+      },
+      required: ['projectId', 'databaseId'],
+    },
+    async call(api, args) {
+      const { projectId, ...body } = args;
+      const { status, data } = await api.post(`/api/v1/projects/${projectId}/backups`, body);
+      return redactSecrets(result(status, data));
+    },
+  },
+  {
+    name: 'neo_run_backup',
+    description: 'Trigger a configured database backup to run now (handoff 4.4).',
+    mutating: true,
+    schema: { type: 'object', properties: { backupId: str('Backup id (from neo_list_backups)') }, required: ['backupId'] },
+    async call(api, args) {
+      const { status, data } = await api.post(`/api/v1/backups/${args.backupId}/run`);
+      return redactSecrets(result(status, data));
+    },
+  },
   {
     name: 'neo_create_queue',
     description: 'Create a managed queue in a project (handoff 4.5). Credentials redacted. May return pending_approval.',
@@ -558,6 +602,27 @@ export const TOOLS = [
       return redactSecrets((await api.get(`/api/v1/queues/${args.queueId}`)).data);
     },
   },
+  {
+    name: 'neo_update_queue',
+    description: 'Update a managed queue (handoff 4.5): plan class, DLQ, retention, and storage (grow-only — a smaller volumeSize is rejected). Redeploy the queue for it to take effect.',
+    mutating: true,
+    schema: {
+      type: 'object',
+      properties: {
+        queueId: str('Queue id'),
+        planClass: str('dev | standard'),
+        dlqEnabled: { type: 'boolean', description: 'Enable/disable the dead-letter queue' },
+        volumeSize: str('New storage size, e.g. "20Gi" — must be >= current (grow-only)'),
+        retention: { type: 'object', description: 'Retention policy {maxAgeSeconds, maxBytes, maxMsgs}' },
+      },
+      required: ['queueId'],
+    },
+    async call(api, args) {
+      const { queueId, ...body } = args;
+      const { status, data } = await api.put(`/api/v1/queues/${queueId}`, body);
+      return redactSecrets(result(status, data));
+    },
+  },
   {
     name: 'neo_create_cron',
     description: 'Create a scheduled job (cron) in a project (handoff 4.6). Target is either an existing service command (mode=app_command, serviceId+command) or an HTTP endpoint (mode=http_endpoint, url+method). Schedule via scheduleType (cron|interval|once|seconds) + schedule/intervalMinutes. May return pending_approval.',
@@ -693,6 +758,31 @@ export const TOOLS = [
       return (await api.get(`/api/v1/buckets/${args.bucketId}/objects/presign`, { query: { object: args.object } })).data;
     },
   },
+  {
+    name: 'neo_upload_bucket_object',
+    description: 'Upload a LOCAL file to an object-storage bucket (handoff 4.7 — object put). The path is on the machine running this MCP server. objectName defaults to the file\'s basename.',
+    mutating: true,
+    schema: {
+      type: 'object',
+      properties: {
+        bucketId: str('Bucket id'),
+        filePath: str('Local file path to upload'),
+        objectName: str('Object key/name in the bucket (optional; default the file basename)'),
+      },
+      required: ['bucketId', 'filePath'],
+    },
+    async call(api, args) {
+      const p = resolve(args.filePath);
+      const st = statSync(p);
+      if (!st.isFile()) throw new Error(`not a file: ${args.filePath}`);
+      const name = args.objectName || basename(p);
+      const form = new FormData();
+      form.append('object_name', name);
+      form.append('file', new Blob([readFileSync(p)]), name);
+      const { status, data } = await api.postForm(`/api/v1/buckets/${args.bucketId}/objects`, form);
+      return result(status, data);
+    },
+  },
   // --- Typed bindings (handoff 5): attach a DB/queue to a consumer service. The
   // connection string is injected as an env var SERVER-SIDE at the consumer's next
   // deploy (marked a secret) — it is never returned to the agent (write-only). ---
@@ -846,6 +936,50 @@ export const TOOLS = [
       return op;
     },
   },
+  {
+    name: 'neo_delete_stack',
+    description:
+      'Tear down a whole stack created by neo_apply_stack — deletes its resources in REVERSE dependency order (services first, then databases/queues/crons/buckets, handoff 3.6/7). Destructive and irreversible. Pass the operationId/planId from the apply.',
+    mutating: true,
+    destructive: true,
+    schema: { type: 'object', properties: { operationId: str('Operation/plan id from neo_apply_stack') }, required: ['operationId'] },
+    async call(api, args) {
+      const op = (await api.get(`/api/v1/plans/${args.operationId}`)).data;
+      const entries = Object.entries(op.result || {}).map(([name, v]) => ({ name, kind: v.kind, id: v.id })).filter((e) => e.id);
+      const rank = { app: 0, cron: 1, database: 2, queue: 2, bucket: 2 }; // services before foundations
+      entries.sort((a, b) => (rank[a.kind] ?? 3) - (rank[b.kind] ?? 3));
+      const path = { app: 'apps', database: 'databases', queue: 'queues', cron: 'crons', bucket: 'buckets' };
+      const deleted = [];
+      for (const e of entries) {
+        if (!path[e.kind]) continue;
+        try { await api.del(`/api/v1/${path[e.kind]}/${e.id}`); deleted.push({ name: e.name, kind: e.kind, status: 'deleted' }); }
+        catch (err) { deleted.push({ name: e.name, kind: e.kind, status: 'failed', error: err.message }); }
+      }
+      return { operationId: args.operationId, order: 'reverse-dependency (services → foundations)', deleted };
+    },
+  },
+  {
+    name: 'neo_reconcile_usage',
+    description:
+      'Reconcile an approved plan\'s estimated cost against actual metered usage (handoff A2). Returns the plan\'s fixed monthly estimate + price-book snapshot + the variable SKUs, and the project\'s actual usage, so billing can be checked against what was approved. Usage accrues hourly — a freshly-applied stack shows ~0 until it runs.',
+    mutating: false,
+    schema: { type: 'object', properties: { planId: str('Plan id from neo_plan_stack/apply') }, required: ['planId'] },
+    async call(api, args) {
+      const plan = (await api.get(`/api/v1/plans/${args.planId}`)).data;
+      let usage = null;
+      try { usage = (await api.get(`/api/v1/projects/${plan.projectId}/usage`)).data; } catch { /* usage may be unavailable */ }
+      return {
+        planId: args.planId,
+        projectId: plan.projectId,
+        estimatedMonthly: plan.cost?.monthly ?? null,
+        currency: plan.cost?.currency,
+        priceBook: plan.cost?.priceBook,
+        variableSkus: plan.cost?.variable || [],
+        actualUsage: redactSecrets(usage),
+        note: 'estimatedMonthly is the FIXED compute/storage estimate; actualUsage is metered (incl. variable usage). Compare over a full billing period — a just-applied stack has not accrued usage yet.',
+      };
+    },
+  },
   // --- Cleanup (handoff 3.6): MCP can delete every resource type it can reach, so
   // an agent never leaks a resource it created. These are DESTRUCTIVE and permanent;
   // the server hard-deletes the record and tears down the running workload. ---