@biznetgio/neo-app 0.4.27 → 0.4.29

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biznetgio/neo-app",
-  "version": "0.4.27",
+  "version": "0.4.29",
   "description": "NEO App CLI — one-command agent onboarding, MCP server, and project ops for coding agents (Codex, Claude Code).",
   "type": "module",
   "bin": {

package/src/mcp/tools.js

@@ -39,6 +39,32 @@ function requireEnv(env) {
   return e;
 }
 
+// gbFromSize parses "10Gi"/"10G"/"10" → 10 (integer GB), else undefined.
+function gbFromSize(v) {
+  if (v == null) return undefined;
+  const m = String(v).match(/(\d+)/);
+  return m ? parseInt(m[1], 10) : undefined;
+}
+
+// confirmCost is the Approve & Create gate for billable one-shot creates: unless
+// args.confirm===true it returns the live-priced cost and creates NOTHING — the
+// agent shows the user, then re-calls with confirm:true. plan/apply remains the
+// server-immutable costed path; this is the lighter client-side gate (handoff 3.3).
+async function confirmCost(api, args, spec) {
+  if (args.confirm === true) return null;
+  let orgId = null;
+  try { orgId = await api.resolveOrgId(args.orgId); } catch { orgId = null; }
+  let book = null;
+  try { book = (await api.get(orgId ? `/api/v1/orgs/${orgId}/pricing` : '/api/v1/pricing')).data; }
+  catch { try { book = (await api.get('/api/v1/pricing')).data; } catch { book = null; } }
+  return {
+    requiresConfirmation: true,
+    cost: book ? estimateCost(book, spec) : null,
+    priceBook: orgId ? `org:${orgId}` : 'global-defaults',
+    message: 'Billable resource — show the user this cost, then re-call with confirm:true to create. For an immutable, server-pinned quote use neo_plan_stack → neo_apply_stack.',
+  };
+}
+
 const SECRET_KEY = /(password|secret|secretkey|accesskey|connectionstring|connstr|dsn|token|privatekey|apikey)/i;
 function redactSecrets(value) {
   if (Array.isArray(value)) return value.map(redactSecrets);
@@ -94,8 +120,8 @@ export const TOOLS = [
         { type: 'template', create: true, deploy: true, scale: false, logs: true, variables: true, delete: true },
         { type: 'static_site', create: 'via_folder', deploy: true, scale: false, logs: true, variables: true, delete: true, nativeStatic: true, note: 'neo_deploy_folder serviceType=static_site with buildCommand/publishDirectory → native nginx static hosting (0.4.27); auto-detected for static-only folders' },
         { type: 'worker', create: 'via_folder', deploy: true, scale: true, logs: true, variables: true, delete: true, note: 'neo_deploy_folder serviceType=worker — no public ingress; repo auto-detection still TODO (handoff 6)' },
-        { type: 'database', create: true, get: true, list: true, update: true, backup: true, delete: true, note: 'neo_create/list/get/update(resize)/delete_database + backup (list/create/run); restore still TODO (handoff 4.4)' },
-        { type: 'queue', create: true, get: true, list: true, update: true, delete: true, note: 'neo_create/list/get/update/delete_queue (0.4.15-0.4.25) (handoff 4.5)' },
+        { type: 'database', create: true, get: true, list: true, update: true, backup: true, verify: true, publicAccess: true, delete: true, note: 'neo_create/list/get/update(resize)/delete_database + backup + verify (SQL round-trip probe) + enable/disable_db_public_access; restore still TODO (handoff 4.4)' },
+        { type: 'queue', create: true, get: true, list: true, update: true, publicAccess: true, delete: true, note: 'neo_create/list/get/update/delete_queue + enable/disable_queue_public_access (handoff 4.5)' },
         { type: 'cron', create: true, get: true, list: true, run: true, runs: true, delete: true, note: 'neo_create/list/get/run/list_runs/delete_cron (0.4.15-0.4.21) (handoff 4.6)' },
         { type: 'object_storage', create: true, get: true, list: true, objects: true, upload: true, delete: true, note: 'neo_create/list/get/delete_bucket + list/upload/presign(get)/delete objects (0.4.15-0.4.25) (handoff 4.7)' },
       ];
@@ -105,7 +131,7 @@ export const TOOLS = [
         controlPlane,
         resourceTypes,
         // Verbs this MCP build exposes today (no create-DB/queue/cron/bucket, no costed plan/apply yet).
-        lifecycleVerbs: ['plan', 'apply', 'get_operation', 'wait_operation', 'delete_stack', 'reconcile_usage', 'create', 'list', 'get', 'update', 'deploy', 'scale', 'logs', 'get_variables', 'set_variable', 'estimate', 'scan_repo', 'bind', 'unbind', 'run_cron', 'presign_object', 'backup', 'delete', 'list_approvals', 'get_approval', 'get_credit', 'list_templates'],
+        lifecycleVerbs: ['plan', 'apply', 'get_operation', 'wait_operation', 'delete_stack', 'reconcile_usage', 'service_usage', 'create', 'list', 'get', 'update', 'verify', 'enable_public_access', 'disable_public_access', 'deploy', 'scale', 'logs', 'get_variables', 'set_variable', 'estimate', 'scan_repo', 'bind', 'unbind', 'run_cron', 'presign_object', 'backup', 'delete', 'delete_project', 'list_approvals', 'get_approval', 'get_credit', 'list_templates'],
         bindings: { supported: true, targets: ['neo_db', 'neo_queue'], writeOnly: true, note: 'neo_bind_resource injects DATABASE_URL/NATS_URL server-side at deploy; the secret is never returned (handoff 5)' },
         sourceTypes: ['git', 'image', 'dockerfile', 'local', 'template'],
         environments: ['staging', 'production'],
@@ -293,6 +319,25 @@ export const TOOLS = [
       return (await api.get(`/api/v1/orgs/${orgId}/credit`)).data;
     },
   },
+  {
+    name: 'neo_service_usage',
+    description: 'Get the metered usage + cost attributed to ONE service/resource in a project — per-service usage attribution (handoff §4). Filters the project usage breakdown to this resourceId.',
+    mutating: false,
+    schema: { type: 'object', properties: { projectId: str('Project id'), resourceId: str('Service/database/queue/bucket id (from neo_list_services/databases/…)') }, required: ['projectId', 'resourceId'] },
+    async call(api, args) {
+      const u = (await api.get(`/api/v1/projects/${args.projectId}/usage`)).data || {};
+      const lines = (u.lines || []).filter((l) => l.resourceId === args.resourceId);
+      const totalCost = Math.round(lines.reduce((sum, l) => sum + (l.cost || 0), 0));
+      return {
+        resourceId: args.resourceId,
+        period: u.period,
+        currency: u.currency,
+        lines,
+        totalCost,
+        note: lines.length ? undefined : 'no metered usage attributed to this resource yet (usage accrues hourly)',
+      };
+    },
+  },
   {
     name: 'neo_estimate',
     description:
@@ -477,12 +522,15 @@ export const TOOLS = [
         volumeSize: str('Storage size, e.g. "10Gi" (optional)'),
         replicas: int('Read/failover replicas for HA (optional; postgres/CNPG only)'),
         deploymentMode: { type: 'string', description: 'single | ha (optional)' },
+        confirm: { type: 'boolean', description: 'Approve & Create: without confirm:true the tool returns the cost and creates nothing. Re-call with confirm:true to actually create.' },
       },
       required: ['projectId', 'name', 'engine', 'environment'],
     },
     async call(api, args) {
       requireEnv(args.environment);
-      const { projectId, ...body } = args;
+      const gate = await confirmCost(api, args, { storageGB: gbFromSize(args.volumeSize), replicas: args.replicas });
+      if (gate) return gate;
+      const { projectId, confirm, orgId, ...body } = args;
       const { status, data } = await api.post(`/api/v1/projects/${projectId}/databases`, body);
       return redactSecrets(result(status, data));
     },
@@ -526,6 +574,16 @@ export const TOOLS = [
       return redactSecrets(result(status, data));
     },
   },
+  {
+    name: 'neo_verify_database',
+    description: 'Functionally verify a managed database (handoff §8.1): runs an in-cluster probe that opens the DB and does a SQL round-trip (SELECT 1), returning {verified, log} — WITHOUT handing you any credentials. Postgres only for now. Synchronous (waits up to ~60s for the probe).',
+    mutating: true,
+    schema: { type: 'object', properties: { databaseId: str('Database id (postgres)') }, required: ['databaseId'] },
+    async call(api, args) {
+      const { status, data } = await api.post(`/api/v1/databases/${args.databaseId}/verify`);
+      return result(status, data);
+    },
+  },
   {
     name: 'neo_list_backups',
     description: 'List configured database backups in a project (handoff 4.4): schedule, destination, last run status.',
@@ -577,13 +635,16 @@ export const TOOLS = [
         planClass: str('Plan/engine class (optional)'),
         environment: { type: 'string', enum: ['staging', 'production'], description: 'REQUIRED — staging or production (never defaulted, handoff §2)' },
         volumeSize: str('Storage size, e.g. "10Gi" (optional)'),
-        dlqEnabled: { type: 'boolean', description: 'Enable a dead-letter queue (optional)' },
+        dlqEnabled: { type: 'boolean', description: 'Enable a dead-letter queue (optional, default true). Pass false to disable — this is now honored.' },
+        confirm: { type: 'boolean', description: 'Approve & Create: without confirm:true the tool returns the cost and creates nothing. Re-call with confirm:true to actually create.' },
       },
       required: ['projectId', 'name', 'environment'],
     },
     async call(api, args) {
       requireEnv(args.environment);
-      const { projectId, ...body } = args;
+      const gate = await confirmCost(api, args, { storageGB: gbFromSize(args.volumeSize) });
+      if (gate) return gate;
+      const { projectId, confirm, orgId, ...body } = args;
       const { status, data } = await api.post(`/api/v1/projects/${projectId}/queues`, body);
       return redactSecrets(result(status, data));
     },
@@ -974,6 +1035,16 @@ export const TOOLS = [
       const plan = (await api.get(`/api/v1/plans/${args.planId}`)).data;
       let usage = null;
       try { usage = (await api.get(`/api/v1/projects/${plan.projectId}/usage`)).data; } catch { /* usage may be unavailable */ }
+      // Per-resource actuals: attribute the project usage lines to this plan's resources.
+      const planIds = new Set(Object.values(plan.result || {}).map((v) => v && v.id).filter(Boolean));
+      const perResource = {};
+      for (const l of (usage?.lines || [])) {
+        if (!planIds.has(l.resourceId)) continue;
+        const r = perResource[l.resourceId] || { resourceName: l.resourceName, resourceType: l.resourceType, cost: 0 };
+        r.cost += l.cost || 0;
+        perResource[l.resourceId] = r;
+      }
+      const actualForPlan = Math.round(Object.values(perResource).reduce((s, r) => s + r.cost, 0));
       return {
         planId: args.planId,
         projectId: plan.projectId,
@@ -981,8 +1052,10 @@ export const TOOLS = [
         currency: plan.cost?.currency,
         priceBook: plan.cost?.priceBook,
         variableSkus: plan.cost?.variable || [],
-        actualUsage: redactSecrets(usage),
-        note: 'estimatedMonthly is the FIXED compute/storage estimate; actualUsage is metered (incl. variable usage). Compare over a full billing period — a just-applied stack has not accrued usage yet.',
+        actualForPlanResources: actualForPlan,
+        perResource,
+        projectUsageTotal: usage?.totalCost,
+        note: 'estimatedMonthly is the FIXED monthly compute/storage estimate; actualForPlanResources sums the metered cost of THIS plan\'s resources so far (accrues hourly — ~0 just after apply). perResource breaks it down.',
       };
     },
   },
@@ -1044,4 +1117,79 @@ export const TOOLS = [
       return result(status, data);
     },
   },
+  {
+    name: 'neo_enable_db_public_access',
+    description: 'Enable internet access to a managed postgres database through the TLS gateway (phase 3). Provisions a least-privilege external role, assigns a public host, and flips publicEnabled. The DB must be DEPLOYED first. Optionally restrict to allowlistCidrs. Credentials are write-only — retrieve the full external connection string from the dashboard; this returns the public host/port, external username, and CA URL.',
+    mutating: true,
+    schema: {
+      type: 'object',
+      properties: {
+        databaseId: str('Database id (postgres, already deployed)'),
+        allowlistCidrs: { type: 'array', items: { type: 'string' }, description: 'CIDR allowlist, e.g. ["203.0.113.0/24"] (optional; empty = allow any source IP)' },
+      },
+      required: ['databaseId'],
+    },
+    async call(api, args) {
+      const { status, data } = await api.post(`/api/v1/databases/${args.databaseId}/public-access`, { allowlistCidrs: args.allowlistCidrs || [] });
+      return redactSecrets(result(status, data));
+    },
+  },
+  {
+    name: 'neo_disable_db_public_access',
+    description: 'Disable internet access to a managed database. Non-destructive: the external role is set NOLOGIN and its objects are preserved; routing stops.',
+    mutating: true,
+    schema: { type: 'object', properties: { databaseId: str('Database id') }, required: ['databaseId'] },
+    async call(api, args) {
+      const { status, data } = await api.del(`/api/v1/databases/${args.databaseId}/public-access`);
+      return result(status, data);
+    },
+  },
+  {
+    name: 'neo_enable_queue_public_access',
+    description: 'Enable internet access to a managed queue through the TLS gateway (phase 3). Assigns a public host and flips publicEnabled. The queue must be DEPLOYED first. Optionally restrict to allowlistCidrs. Credentials are write-only — retrieve the full connection string from the dashboard.',
+    mutating: true,
+    schema: {
+      type: 'object',
+      properties: {
+        queueId: str('Queue id (already deployed)'),
+        allowlistCidrs: { type: 'array', items: { type: 'string' }, description: 'CIDR allowlist (optional; empty = allow any source IP)' },
+      },
+      required: ['queueId'],
+    },
+    async call(api, args) {
+      const { status, data } = await api.post(`/api/v1/queues/${args.queueId}/public-access`, { allowlistCidrs: args.allowlistCidrs || [] });
+      return redactSecrets(result(status, data));
+    },
+  },
+  {
+    name: 'neo_disable_queue_public_access',
+    description: 'Disable internet access to a managed queue. Non-destructive: routing stops; the queue keeps running for in-cluster consumers.',
+    mutating: true,
+    schema: { type: 'object', properties: { queueId: str('Queue id') }, required: ['queueId'] },
+    async call(api, args) {
+      const { status, data } = await api.del(`/api/v1/queues/${args.queueId}/public-access`);
+      return result(status, data);
+    },
+  },
+  {
+    name: 'neo_delete_project',
+    description: 'Permanently delete a project and ALL its resources (apps, databases, queues, crons, buckets, and the project namespace with its PVCs/CNPG clusters). Destructive and irreversible — nothing is recoverable. Requires confirm:true. Only the project creator or an org owner/admin may delete it.',
+    mutating: true,
+    destructive: true,
+    schema: {
+      type: 'object',
+      properties: {
+        projectId: str('Project id'),
+        confirm: { type: 'boolean', description: 'Must be true to proceed — guards against accidental deletion of an entire project.' },
+      },
+      required: ['projectId', 'confirm'],
+    },
+    async call(api, args) {
+      if (args.confirm !== true) {
+        return { error: 'refused', message: 'Deleting a project removes ALL its resources and is irreversible. Re-call with confirm:true to proceed.' };
+      }
+      const { status, data } = await api.del(`/api/v1/projects/${args.projectId}`);
+      return result(status, data);
+    },
+  },
 ];