@biznetgio/neo-app 0.4.43 → 0.4.44

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biznetgio/neo-app",
-  "version": "0.4.43",
+  "version": "0.4.44",
   "description": "NEO App CLI — one-command agent onboarding, MCP server, and project ops for coding agents (Codex, Claude Code).",
   "type": "module",
   "bin": {

package/src/mcp/tools.js

@@ -210,6 +210,13 @@ export const TOOLS = [
         environments: ['staging', 'production'],
         pricing,
         costConsent: { estimateAvailable: true, dryRunIncludesCost: true, planApplyEnforced: true, note: 'neo_plan_stack returns a costed immutable plan; neo_apply_stack is server-enforced (hash/expiry/one-shot) so a billable stack requires a reviewed plan (handoff 3.3-3.5)' },
+        // Project/organization lifecycle (issue #107 §3). Honest to THIS build: project
+        // deletion is zero-write-preview → exact-name server confirmation → cascade delete;
+        // a dedicated costed plan (neo_plan_project_deletion) is not yet exposed, so
+        // requiresPlan is false. Organization deletion is unsupported and out of scope —
+        // no org-delete tool exists, and deleting a project never deletes its organization.
+        project: { delete: true, cascadeDelete: true, requiresPlan: false, requiresConfirmation: true, note: 'neo_delete_project: zero-write preview → exact-name, single-use server confirmation → cascade delete of all child resources.' },
+        organization: { delete: false, note: 'Organization deletion is unsupported and out of scope; no organization-delete tool is exposed.' },
         minClientVersion: pkgVersion(),
         deprecations: [],
       };
@@ -264,7 +271,7 @@ export const TOOLS = [
   },
   {
     name: 'neo_confirm_action',
-    description: 'Record a human DECISION on a confirmation (NEVER creates or deletes anything itself) — the server-enforced approval step for a high-risk action (project/service deletion, billable create). decision is approve | decline | cancel. Approving a DELETION requires confirmationPhrase to exactly equal the target name (the human must type it). After approve, call the action tool again with this confirmationId to actually perform it (single-use). Show the human the summary from the preview and ask once; never infer consent.',
+    description: 'Record a human DECISION on a confirmation (NEVER creates or deletes anything itself) — the server-enforced approval step for a high-risk action (project/service deletion, billable create). decision is approve | decline | cancel. Approving a DELETION requires confirmationPhrase to exactly equal the target name (the human must type it — never manufacture it). If the confirmation has ackRequired:true (a project with production resources), approving ALSO requires acknowledgeNoRefund:true. After approve, call the action tool again with this confirmationId to actually perform it (single-use). Show the human the summary from the preview and ask once; never infer consent.',
     mutating: true,
     schema: {
       type: 'object',
@@ -272,11 +279,12 @@ export const TOOLS = [
         confirmationId: str('Confirmation id (from a destructive preview or a plan)'),
         decision: { type: 'string', enum: ['approve', 'decline', 'cancel'], description: 'approve | decline | cancel' },
         confirmationPhrase: str('For a deletion: the EXACT target name, typed by the human, required to approve'),
+        acknowledgeNoRefund: { type: 'boolean', description: 'Required to approve when the confirmation has ackRequired:true (production project delete): the human explicitly acknowledges there is no refund, credit, or proration.' },
       },
       required: ['confirmationId', 'decision'],
     },
     async call(api, args) {
-      const { status, data } = await api.post(`/api/v1/confirmations/${args.confirmationId}/decide`, { decision: args.decision, confirmationPhrase: args.confirmationPhrase });
+      const { status, data } = await api.post(`/api/v1/confirmations/${args.confirmationId}/decide`, { decision: args.decision, confirmationPhrase: args.confirmationPhrase, acknowledgeNoRefund: args.acknowledgeNoRefund === true });
       return result(status, data);
     },
   },