@biznetgio/neo-app 0.4.42 → 0.4.44

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biznetgio/neo-app",
-  "version": "0.4.42",
+  "version": "0.4.44",
   "description": "NEO App CLI — one-command agent onboarding, MCP server, and project ops for coding agents (Codex, Claude Code).",
   "type": "module",
   "bin": {

package/src/mcp/tools.js

@@ -87,6 +87,53 @@ async function confirmCost(api, args, spec) {
   };
 }
 
+// billableGate routes a billable one-shot create through the SAME server-side generic
+// confirmation subsystem as deletes (handoff: generic confirmation for billable creates),
+// so every create is approved + audited server-side and single-use. It returns either:
+//   { query }               — append to the create POST; the server consumes the confirmation
+//   { requiresConfirmation } — a preview; CREATES NOTHING
+// A confirmationId re-plays an already-approved confirmation; confirm:true is a one-call
+// shortcut that mints + auto-approves one; neither returns the cost + a pending confirmationId.
+async function billableGate(api, { projectId, kind, name, confirmationId, confirm }, spec) {
+  if (confirmationId) return { query: `?confirmationId=${encodeURIComponent(confirmationId)}` };
+
+  // Estimate the cost (best-effort) for display and the confirmation summary.
+  let orgId = null;
+  try { orgId = await api.resolveOrgId(); } catch { orgId = null; }
+  let book = null;
+  try { book = (await api.get(orgId ? `/api/v1/orgs/${orgId}/pricing` : '/api/v1/pricing')).data; }
+  catch { try { book = (await api.get('/api/v1/pricing')).data; } catch { book = null; } }
+  let cost = null;
+  if (book) { try { cost = estimateCost(book, spec); } catch { cost = null; } }
+  const costNote = cost ? `~${cost.monthly} ${cost.currency}/mo (${cost.hourly}/h)` : '';
+
+  // Mint a server-side billable_create confirmation bound to this exact resource.
+  // Retry a transient 5xx/dropped connection: minting has no lasting side effect (an
+  // unused pending confirmation just expires), so this is safe and keeps a flaky gateway
+  // from failing an otherwise-fine create (same spirit as the api-layer idempotent retry).
+  let mint;
+  for (let attempt = 1; ; attempt++) {
+    try { mint = (await api.post('/api/v1/confirmations', { action: 'billable_create', projectId, kind, name, estimatedCost: costNote })).data; break; }
+    catch (e) {
+      if (attempt < 3 && (e?.status >= 500 || e?.status === 0)) { await new Promise((r) => setTimeout(r, 300 * attempt)); continue; }
+      throw e;
+    }
+  }
+  const id = mint.confirmationId;
+  if (confirm === true) {
+    // One-call shortcut: approve the just-minted confirmation, then let the create consume it.
+    await api.post(`/api/v1/confirmations/${id}/decide`, { decision: 'approve' });
+    return { query: `?confirmationId=${encodeURIComponent(id)}` };
+  }
+  return {
+    requiresConfirmation: true,
+    cost,
+    priceBook: orgId ? `org:${orgId}` : 'global-defaults',
+    confirmationId: id,
+    message: `Billable ${kind} — show the user this cost, then approve server-side: neo_confirm_action("${id}", "approve"), and re-call this tool with confirmationId="${id}". (Shortcut: re-call with confirm:true.) Nothing was created.`,
+  };
+}
+
 const SECRET_KEY = /(password|secret|secretkey|accesskey|connectionstring|connstr|dsn|token|privatekey|apikey|authorization)/i;
 // Deployment snapshots (exact keys) embed rendered configs with plaintext creds — a
 // queue's `--pass`, a DB's POSTGRES_PASSWORD. Redact by EXACT key so we don't also
@@ -163,6 +210,13 @@ export const TOOLS = [
         environments: ['staging', 'production'],
         pricing,
         costConsent: { estimateAvailable: true, dryRunIncludesCost: true, planApplyEnforced: true, note: 'neo_plan_stack returns a costed immutable plan; neo_apply_stack is server-enforced (hash/expiry/one-shot) so a billable stack requires a reviewed plan (handoff 3.3-3.5)' },
+        // Project/organization lifecycle (issue #107 §3). Honest to THIS build: project
+        // deletion is zero-write-preview → exact-name server confirmation → cascade delete;
+        // a dedicated costed plan (neo_plan_project_deletion) is not yet exposed, so
+        // requiresPlan is false. Organization deletion is unsupported and out of scope —
+        // no org-delete tool exists, and deleting a project never deletes its organization.
+        project: { delete: true, cascadeDelete: true, requiresPlan: false, requiresConfirmation: true, note: 'neo_delete_project: zero-write preview → exact-name, single-use server confirmation → cascade delete of all child resources.' },
+        organization: { delete: false, note: 'Organization deletion is unsupported and out of scope; no organization-delete tool is exposed.' },
         minClientVersion: pkgVersion(),
         deprecations: [],
       };
@@ -217,7 +271,7 @@ export const TOOLS = [
   },
   {
     name: 'neo_confirm_action',
-    description: 'Record a human DECISION on a confirmation (NEVER creates or deletes anything itself) — the server-enforced approval step for a high-risk action (project/service deletion, billable create). decision is approve | decline | cancel. Approving a DELETION requires confirmationPhrase to exactly equal the target name (the human must type it). After approve, call the action tool again with this confirmationId to actually perform it (single-use). Show the human the summary from the preview and ask once; never infer consent.',
+    description: 'Record a human DECISION on a confirmation (NEVER creates or deletes anything itself) — the server-enforced approval step for a high-risk action (project/service deletion, billable create). decision is approve | decline | cancel. Approving a DELETION requires confirmationPhrase to exactly equal the target name (the human must type it — never manufacture it). If the confirmation has ackRequired:true (a project with production resources), approving ALSO requires acknowledgeNoRefund:true. After approve, call the action tool again with this confirmationId to actually perform it (single-use). Show the human the summary from the preview and ask once; never infer consent.',
     mutating: true,
     schema: {
       type: 'object',
@@ -225,11 +279,12 @@ export const TOOLS = [
         confirmationId: str('Confirmation id (from a destructive preview or a plan)'),
         decision: { type: 'string', enum: ['approve', 'decline', 'cancel'], description: 'approve | decline | cancel' },
         confirmationPhrase: str('For a deletion: the EXACT target name, typed by the human, required to approve'),
+        acknowledgeNoRefund: { type: 'boolean', description: 'Required to approve when the confirmation has ackRequired:true (production project delete): the human explicitly acknowledges there is no refund, credit, or proration.' },
       },
       required: ['confirmationId', 'decision'],
     },
     async call(api, args) {
-      const { status, data } = await api.post(`/api/v1/confirmations/${args.confirmationId}/decide`, { decision: args.decision, confirmationPhrase: args.confirmationPhrase });
+      const { status, data } = await api.post(`/api/v1/confirmations/${args.confirmationId}/decide`, { decision: args.decision, confirmationPhrase: args.confirmationPhrase, acknowledgeNoRefund: args.acknowledgeNoRefund === true });
       return result(status, data);
     },
   },
@@ -698,22 +753,23 @@ export const TOOLS = [
         volumeSize: str('Storage size, e.g. "10Gi" (optional)'),
         replicas: int('Read/failover replicas for HA (optional; postgres/CNPG only)'),
         deploymentMode: { type: 'string', description: 'single | ha (optional)' },
-        confirm: { type: 'boolean', description: 'Approve & Create: without confirm:true the tool returns the cost and creates nothing. Re-call with confirm:true to actually create.' },
+        confirm: { type: 'boolean', description: 'Approve & Create in one call: mints + auto-approves a server-side billable confirmation, then creates. Without confirm (or confirmationId) the tool returns the cost + a pending confirmationId and creates nothing.' },
+        confirmationId: str('An APPROVED billable_create confirmation id (from neo_confirm_action) — re-call with it to create. Alternative to confirm:true.'),
       },
       required: ['projectId', 'name', 'engine', 'environment'],
     },
     async call(api, args) {
       requireEnv(args.environment);
-      const gate = await confirmCost(api, args, { storageGB: gbFromSize(args.volumeSize), replicas: args.replicas });
-      if (gate) return gate;
-      const { projectId, confirm, orgId, ...body } = args;
-      const { status, data } = await api.post(`/api/v1/projects/${projectId}/databases`, body);
+      const gate = await billableGate(api, { projectId: args.projectId, kind: 'database', name: args.name, confirmationId: args.confirmationId, confirm: args.confirm }, { storageGB: gbFromSize(args.volumeSize), replicas: args.replicas });
+      if (gate.requiresConfirmation) return gate;
+      const { projectId, confirm, confirmationId, orgId, ...body } = args;
+      const { status, data } = await api.post(`/api/v1/projects/${projectId}/databases${gate.query}`, body);
       return redactSecrets(result(status, data));
     },
   },
   {
     name: 'neo_deploy_database',
-    description: 'Deploy an individually-created managed database so it actually runs (provisions the cluster, sets its private host/port). Required after neo_create_database before the DB is reachable, bindable, or can have public access enabled. Poll neo_get_database until host is set and neo_verify_database passes. Credentials redacted.',
+    description: 'Deploy an individually-created managed database so it actually runs (provisions the cluster, sets its private host/port). Required after neo_create_database before the DB is reachable, bindable, or can have public access enabled. For CNPG postgres this returns ready:false — the Cluster is created but initdb runs ~1-3 min and SQL is NOT reachable yet; the deployment status stays "running" and flips to "success" when a ready instance comes up. Do NOT treat the response as terminal: poll neo_verify_database until it passes (authoritative SQL round-trip) before connecting/binding. Credentials redacted.',
     mutating: true,
     schema: { type: 'object', properties: { databaseId: str('Database id (from neo_create_database)') }, required: ['databaseId'] },
     async call(api, args) {
@@ -868,16 +924,17 @@ export const TOOLS = [
         environment: { type: 'string', enum: ['staging', 'production'], description: 'REQUIRED — staging or production (never defaulted, handoff §2)' },
         volumeSize: str('Storage size, e.g. "10Gi" (optional)'),
         dlqEnabled: { type: 'boolean', description: 'Enable a dead-letter queue (optional, default true). Pass false to disable — this is now honored.' },
-        confirm: { type: 'boolean', description: 'Approve & Create: without confirm:true the tool returns the cost and creates nothing. Re-call with confirm:true to actually create.' },
+        confirm: { type: 'boolean', description: 'Approve & Create in one call: mints + auto-approves a server-side billable confirmation, then creates. Without confirm (or confirmationId) the tool returns the cost + a pending confirmationId and creates nothing.' },
+        confirmationId: str('An APPROVED billable_create confirmation id (from neo_confirm_action) — re-call with it to create. Alternative to confirm:true.'),
       },
       required: ['projectId', 'name', 'environment'],
     },
     async call(api, args) {
       requireEnv(args.environment);
-      const gate = await confirmCost(api, args, { storageGB: gbFromSize(args.volumeSize) });
-      if (gate) return gate;
-      const { projectId, confirm, orgId, ...body } = args;
-      const { status, data } = await api.post(`/api/v1/projects/${projectId}/queues`, body);
+      const gate = await billableGate(api, { projectId: args.projectId, kind: 'queue', name: args.name, confirmationId: args.confirmationId, confirm: args.confirm }, { storageGB: gbFromSize(args.volumeSize) });
+      if (gate.requiresConfirmation) return gate;
+      const { projectId, confirm, confirmationId, orgId, ...body } = args;
+      const { status, data } = await api.post(`/api/v1/projects/${projectId}/queues${gate.query}`, body);
       return redactSecrets(result(status, data));
     },
   },
@@ -1005,20 +1062,21 @@ export const TOOLS = [
         retryCount: int('Retries on failure (optional) → backoffLimit'),
         concurrencyPolicy: { type: 'string', enum: ['Allow', 'Forbid', 'Replace'], description: 'Overlap policy if a run is still going when the next is due (optional, default Allow)' },
         environment: { type: 'string', enum: ['staging', 'production'], description: 'REQUIRED — staging or production (never defaulted, handoff §2)' },
-        confirm: { type: 'boolean', description: 'Approve & Create: without confirm:true the tool returns the cost (crons are billed per run — variable) and creates nothing. Re-call with confirm:true to create.' },
+        confirm: { type: 'boolean', description: 'Approve & Create in one call: mints + auto-approves a server-side billable confirmation (crons are billed per run — variable), then creates. Without confirm (or confirmationId) the tool returns the cost + a pending confirmationId and creates nothing.' },
+        confirmationId: str('An APPROVED billable_create confirmation id (from neo_confirm_action) — re-call with it to create. Alternative to confirm:true.'),
       },
       required: ['projectId', 'name', 'mode', 'scheduleType', 'environment'],
     },
     async call(api, args) {
       requireEnv(args.environment);
-      const gate = await confirmCost(api, args, {}); // cron cost is variable (per-run) — gate surfaces the rate
-      if (gate) return gate;
+      const gate = await billableGate(api, { projectId: args.projectId, kind: 'cron', name: args.name, confirmationId: args.confirmationId, confirm: args.confirm }, {}); // cron cost is variable (per-run) — gate surfaces the rate
+      if (gate.requiresConfirmation) return gate;
       // Merge contentType into headers for convenience (unless already set).
       if (args.contentType) {
         args = { ...args, headers: { 'Content-Type': args.contentType, ...(args.headers || {}) } };
       }
-      const { projectId, confirm, orgId, contentType, ...body } = args;
-      const { status, data } = await api.post(`/api/v1/projects/${projectId}/crons`, body);
+      const { projectId, confirm, confirmationId, orgId, contentType, ...body } = args;
+      const { status, data } = await api.post(`/api/v1/projects/${projectId}/crons${gate.query}`, body);
       return redactSecrets(result(status, data));
     },
   },
@@ -1071,15 +1129,16 @@ export const TOOLS = [
         region: str('Region (optional; see neo_list_regions on the portal)'),
         acl: { type: 'string', description: 'private | public-read (optional, default private)' },
         quotaGB: int('Storage quota in GB (optional)'),
-        confirm: { type: 'boolean', description: 'Approve & Create: without confirm:true the tool returns the cost and creates nothing. Re-call with confirm:true to actually create.' },
+        confirm: { type: 'boolean', description: 'Approve & Create in one call: mints + auto-approves a server-side billable confirmation, then creates. Without confirm (or confirmationId) the tool returns the cost + a pending confirmationId and creates nothing.' },
+        confirmationId: str('An APPROVED billable_create confirmation id (from neo_confirm_action) — re-call with it to create. Alternative to confirm:true.'),
       },
       required: ['projectId', 'name'],
     },
     async call(api, args) {
-      const gate = await confirmCost(api, args, { objectStorageGB: gbFromSize(args.quotaGB) });
-      if (gate) return gate;
-      const { projectId, confirm, orgId, ...body } = args;
-      const { status, data } = await api.post(`/api/v1/projects/${projectId}/buckets`, body);
+      const gate = await billableGate(api, { projectId: args.projectId, kind: 'bucket', name: args.name, confirmationId: args.confirmationId, confirm: args.confirm }, { objectStorageGB: gbFromSize(args.quotaGB) });
+      if (gate.requiresConfirmation) return gate;
+      const { projectId, confirm, confirmationId, orgId, ...body } = args;
+      const { status, data } = await api.post(`/api/v1/projects/${projectId}/buckets${gate.query}`, body);
       return redactSecrets(result(status, data));
     },
   },
@@ -1404,15 +1463,21 @@ export const TOOLS = [
       if (args.confirmationId) {
         return deleteAndConverge(api, `/api/v1/apps/${args.appId}`, args.appId, 'service', `?confirmationId=${encodeURIComponent(args.confirmationId)}`);
       }
+      // GET /apps/{id} returns { application: {...} }, so unwrap it — reading .data directly
+      // left every field undefined and the preview showed service:{} (retest B).
       let svc = null;
-      try { svc = (await api.get(`/api/v1/apps/${args.appId}`)).data; } catch { /* preview best-effort */ }
+      try { const d = (await api.get(`/api/v1/apps/${args.appId}`)).data; svc = (d && d.application) || d; } catch { /* preview best-effort */ }
       let c;
       try { c = (await api.post('/api/v1/confirmations', { action: 'service_delete', targetId: args.appId })).data; }
       catch (e) { return { deleted: false, error: 'confirmation_failed', message: 'Could not create a deletion confirmation: ' + (e.message || e) }; }
-      const phrase = (c.summary && c.summary.phraseRequired) || (svc && svc.name);
+      // Prefer the server confirmation's authoritative identity (what neo_get_confirmation shows);
+      // fall back to the unwrapped GET, then to just the id.
+      const svcView = (c.summary && c.summary.service) ||
+        (svc ? { id: svc.id, name: svc.name, type: svc.serviceType, environment: svc.environment } : { id: args.appId });
+      const phrase = (c.summary && c.summary.phraseRequired) || svcView.name;
       return {
         deleted: false, requiresConfirmation: true,
-        service: svc ? { id: svc.id, name: svc.name, type: svc.serviceType, environment: svc.environment } : { id: args.appId },
+        service: svcView,
         warning: 'IRREVERSIBLE: deletes the service and tears down its running workload.',
         confirmationId: c.confirmationId, phraseRequired: phrase,
         message: `To delete: call neo_confirm_action("${c.confirmationId}", "approve", confirmationPhrase="${phrase}") — the human must type the exact service name — then re-call neo_delete_service with confirmationId="${c.confirmationId}".`,