@biznetgio/neo-app 0.4.73 → 0.4.75

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biznetgio/neo-app",
-  "version": "0.4.73",
+  "version": "0.4.75",
   "description": "NEO App CLI — one-command agent onboarding, MCP server, and project ops for coding agents (Codex, Claude Code).",
   "type": "module",
   "bin": {

package/prompt.md

@@ -6,7 +6,7 @@ Keep this in sync with cli/prompt.md (the npm package's bundled copy).
 -->
 # Set this repo up on NEO App
 
-**Version:** 0.4.5 · **Last updated:** 2026-10-15
+**Version:** 0.4.74 · **Last updated:** 2026-11-05
 
 These are the official setup instructions from NEO App (Biznet Gio's managed-app
 platform). If you are an AI coding agent, complete the steps below yourself by running
@@ -17,7 +17,7 @@ into chat, repository files, the skill, or MCP configuration.
 ## What NEO App runs
 
 Web services, background workers, scheduled jobs, static sites, managed databases
-(PostgreSQL/MySQL/…), queues (NATS), and object storage — on managed Kubernetes, served
+(PostgreSQL/MySQL/Redis), queues (NATS), and object storage — on managed Kubernetes, served
 over HTTPS with automatic TLS. It is **not** for GPU training or for apps that need
 several containers running side by side at runtime (a single app container alongside
 managed databases is fine). If the repo has no server to put behind a URL (a library or
@@ -118,10 +118,17 @@ tools — never the portal UI. The lifecycle is the same for every resource type
    components in a monorepo. Ask the human which to deploy; never collapse a monorepo
    into one service.
 2. **Plan and show the cost**: `neo_plan_stack` returns an immutable, priced plan
-   (`planId`, `planHash`, cost in IDR, expiry). Show the human the cost and get an
+   (`planId`, `planHash`, cost in IDR with monthly and hourly totals, expiry). Show
+   the human the cost and get an
    explicit **Approve & Create**. Individual creates (`neo_create_database`,
    `neo_create_queue`) instead return the cost and create nothing until you re-call
    with `confirm: true`.
+   **Pricing is resource-based and hourly (#144).** Compute is priced per **vCPU-hour**
+   and per **GB-RAM-hour** independently — there are no packages/tiers. Size a service
+   with `vcpu` + `memoryMB` (or `cpuLimit`/`memoryLimit`); a legacy tier key still works
+   but resolves to its concrete vCPU/RAM. Storage and object storage bill per GB-hour.
+   Time-based components accrue hourly and are **capped at 730 billable hours/month**; a
+   monthly figure is a non-authoritative estimate (hourly × up to 730).
 3. **Apply**: `neo_apply_stack({planId, planHash})`. If the price book changed since the
    plan, apply is refused — re-plan to re-quote. A `pending_approval` result is the
    approval policy working, not an error; wait for it.

package/src/commands/db.js

@@ -0,0 +1,93 @@
+// `neo-app db` — terminal discoverability for the managed-database lifecycle (#149 retest).
+// Read-only inspection (list/get) runs here directly; billable/mutating operations
+// (create, verify, query, backup, restore, redis-command, delete) stay on the MCP
+// server's audited cost-consent path and are listed here so a terminal-only user can
+// discover them from the CLI command tree instead of only through an agent.
+
+import { resolveConfig } from '../config.js';
+import { getCredential } from '../creds.js';
+import { NeoApi } from '../api.js';
+import { readLink } from '../link.js';
+import { log, ok, fail, c } from '../util.js';
+
+// The full lifecycle, with the MCP tool that performs each one. Shown by `neo-app db`.
+const OPS = [
+  ['list',          'neo-app db list',            'List databases in the linked project (read-only)'],
+  ['get <id>',      'neo-app db get <id>',        'Show one database, incl. redacted connection string (read-only)'],
+  ['create',        'neo_create_database',        'Provision PostgreSQL / MySQL / Redis (billable — cost consent)'],
+  ['deploy',        'neo_deploy_database',        'Start/roll out the database pods'],
+  ['verify',        'neo_verify_database',        'Round-trip health probe (engine-aware)'],
+  ['query',         'neo_db_query',               'Read-only SQL (postgres/mysql)'],
+  ['redis',         'neo_redis_command',          'Run a safe Redis command (denylist-guarded)'],
+  ['metrics',       'neo_get_database_metrics',   'Engine-aware metrics snapshot'],
+  ['backup',        'neo_run_backup / neo_create_backup', 'Create and run a logical backup'],
+  ['restore',       'neo_restore_database',       'Restore a SQL dump (postgres/mysql)'],
+  ['public',        'neo_enable_db_public_access','Enable/disable TLS public access'],
+  ['delete',        'neo_delete_database',        'Delete a database (billable stop)'],
+];
+
+function usage() {
+  log(`${c.bold('neo-app db')} — managed database lifecycle (PostgreSQL · MySQL · Redis)\n`);
+  log(c.bold('Run directly from the CLI (read-only):'));
+  log('  neo-app db list');
+  log('  neo-app db get <database-id>\n');
+  log(c.bold('Mutating / billable operations run through the MCP server'));
+  log(`(start it with ${c.bold('neo-app mcp')} — your agent calls these; the Portal exposes them too):`);
+  for (const [, how, desc] of OPS.slice(2)) log(`  · ${c.bold(how.padEnd(34))} ${c.dim(desc)}`);
+  log(`\nPrice a database before creating it: ${c.bold('neo-app estimate --storage <GB>')}`);
+}
+
+function connect(opts) {
+  const cfg = resolveConfig(opts);
+  const cred = getCredential(cfg.baseUrl);
+  if (!cred?.token) { fail(`not authenticated for ${cfg.baseUrl} — run 'neo-app login'`); process.exit(1); }
+  return new NeoApi({ baseUrl: cfg.baseUrl, token: cred.token });
+}
+
+function requireProject(opts) {
+  const projectId = opts.project || readLink()?.projectId;
+  if (!projectId) { fail("no linked project — run 'neo-app link <project-id>' or pass --project <id>"); process.exit(1); }
+  return projectId;
+}
+
+export async function db(sub, opts = {}, positionals = []) {
+  if (!sub || sub === 'help') return void usage();
+
+  if (sub === 'list' || sub === 'ls') {
+    const api = connect(opts);
+    const projectId = requireProject(opts);
+    let dbs;
+    try { dbs = (await api.get(`/api/v1/projects/${projectId}/databases`)).data?.databases || []; }
+    catch (e) { fail(`list failed: ${e.message || e}`); process.exit(1); }
+    if (opts.json) return void process.stdout.write(JSON.stringify({ databases: dbs }, null, 2) + '\n');
+    if (!dbs.length) return void ok('no databases in this project');
+    for (const d of dbs) {
+      const status = d.status || (d.host ? 'deployed' : 'not_deployed');
+      log(`  ${c.bold(d.name)}  ${c.dim(`${d.engine} ${d.version || ''}`.trim())}  ${status}  ${c.dim(d.environment || 'production')}  ${c.dim(d.id)}`);
+    }
+    return;
+  }
+
+  if (sub === 'get' || sub === 'show') {
+    const id = positionals[0];
+    if (!id) { fail('usage: neo-app db get <database-id>'); process.exit(2); }
+    const api = connect(opts);
+    let view;
+    try { view = (await api.get(`/api/v1/databases/${id}`)).data; }
+    catch (e) { fail(`get failed: ${e.message || e}`); process.exit(1); }
+    if (opts.json) return void process.stdout.write(JSON.stringify(view, null, 2) + '\n');
+    for (const [k, v] of Object.entries(view)) if (v !== undefined && v !== null && v !== '') log(`  ${c.dim(k.padEnd(18))} ${v}`);
+    return;
+  }
+
+  // Any lifecycle verb typed at the CLI: point the user at the discoverable path.
+  const known = OPS.find(([key]) => key.split(' ')[0] === sub);
+  if (known) {
+    log(`${c.bold(sub)} runs through the MCP server (${c.bold(known[1])}) or the Portal — not as a direct CLI write.`);
+    log(`Start the MCP server with ${c.bold('neo-app mcp')} so your agent can call it, or use the Portal.`);
+    return;
+  }
+  fail(`unknown db subcommand: ${sub}`);
+  usage();
+  process.exit(2);
+}

package/src/index.js

@@ -20,8 +20,11 @@ ${c.bold('Commands')}
                            (or pass the same via --source <path|.zip|git-url>)
   project create [name]    Create a project (defaults to the dir name) and link it
   project list             List projects in your organization (find ids to link)
+  db [list|get|...]        Managed database lifecycle (PostgreSQL/MySQL/Redis);
+                           list/get run here, the rest via the MCP server
   status | whoami          Show connected account, org, environment, linked project
-  mcp                      Run the local stdio MCP server (used by agents)
+  mcp                      Run the MCP server: local stdio (default), or hosted
+                           Streamable HTTP + SSE with --http [--port <n>] [--host <h>]
 
 ${c.bold('Options')}
   --project <id>           Target/link a project (agent setup, deploy)
@@ -37,8 +40,8 @@ ${c.bold('Options')}
   --yes                    Non-interactive (headless/CI); also approves a billable deploy without the cost prompt
   --dry-run               Print intended changes without writing
   --json                   Machine-readable output incl. the normalized cost (deploy, estimate)
-  --tier <key>             estimate: compute tier (micro|small|medium|large|xlarge)
-  --vcpu <n> --mem <MB>    estimate: custom compute (instead of --tier)
+  --vcpu <n> --mem <MB>    estimate: compute, priced per vCPU-hour + GB-RAM-hour (#144)
+  --tier <key>             estimate: legacy size shorthand (micro|…|xlarge) → vCPU/RAM
   --storage <GB>           estimate: database/persistent storage
   --object <GB>            estimate: object-storage quota (billed monthly-upfront)
   --queue / --cron         estimate: a queue (per-message) / cron (per-run) resource
@@ -80,6 +83,9 @@ const options = {
   replicas: { type: 'string' },
   queue: { type: 'boolean' },
   cron: { type: 'boolean' },
+  http: { type: 'boolean' },
+  sse: { type: 'boolean' },
+  host: { type: 'string' },
   version: { type: 'boolean', short: 'v' },
   help: { type: 'boolean', short: 'h' },
 };
@@ -102,7 +108,7 @@ export async function main(argv = process.argv.slice(2)) {
   // Root help, and `--help` on a KNOWN command, print usage. An UNKNOWN command must
   // still error (nonzero exit) even with `--help`, so a bad command isn't silently
   // accepted (JNG #97). Per-subcommand help is tracked in #89.
-  const KNOWN_COMMANDS = new Set(['agent', 'setup', 'config', 'login', 'deploy', 'estimate', 'link', 'project', 'status', 'whoami', 'mcp', 'version', 'help']);
+  const KNOWN_COMMANDS = new Set(['agent', 'setup', 'config', 'login', 'deploy', 'estimate', 'link', 'project', 'status', 'whoami', 'mcp', 'db', 'version', 'help']);
   if (positionals.length === 0 || (opts.help && KNOWN_COMMANDS.has(cmd))) return void console.log(HELP);
 
   try {
@@ -119,7 +125,13 @@ export async function main(argv = process.argv.slice(2)) {
     if (cmd === 'project' && sub === 'create') return void (await (await import('./commands/link.js')).createProject(positionals[2], opts));
     if (cmd === 'project' && (sub === 'list' || sub === 'ls')) return void (await (await import('./commands/link.js')).listProjects(opts));
     if (cmd === 'status' || cmd === 'whoami') return void (await (await import('./commands/status.js')).status(opts));
-    if (cmd === 'mcp') return void (await (await import('./mcp/server.js')).runMcpServer());
+    if (cmd === 'db') return void (await (await import('./commands/db.js')).db(sub, opts, positionals.slice(2)));
+    if (cmd === 'mcp') {
+      const mcp = await import('./mcp/server.js');
+      // Hosted mode: Streamable HTTP + SSE over one listener (auth per request). Default: stdio.
+      if (opts.http || opts.sse || opts.port) return void (await mcp.runMcpHttpServer({ port: opts.port, host: opts.host }));
+      return void (await mcp.runMcpServer());
+    }
     if (cmd === 'version') return void console.log(version());
     if (cmd === 'help') return void console.log(HELP);
 

package/src/mcp/server.js

@@ -1,10 +1,19 @@
-// NEO App local stdio MCP server (`neo-app mcp`). Reuses the authenticated CLI
-// credential for the configured control-plane — the token is NEVER passed in agent
-// config, it is read here from the credential store (or NEO_APP_TOKEN). All logging
-// goes to stderr; stdout is the JSON-RPC channel.
+// NEO App MCP server. ONE tool registry (./tools.js, the canonical neo_* contract) served
+// over three transports so every surface is capability- and version-identical (#175):
+//   • stdio  (`neo-app mcp`)          — local agent, reuses the authenticated CLI credential.
+//   • Streamable HTTP (`mcp --http`)  — hosted, STATELESS (fresh server+transport per POST,
+//                                       JSON responses), auth from the request's Bearer token.
+//                                       Stateless keeps it multi-replica-safe and lets the
+//                                       control plane front it per-request (it owns sessions).
+//   • SSE  (same `--http` listener)   — hosted, session per connection (for direct clients).
+// serverInfo.version is the packed npm version for every transport (never "docker").
+// All logging goes to stderr; stdout is the stdio JSON-RPC channel.
 
+import { createServer as createHttpServer } from 'node:http';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js';
 import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { resolveConfig } from '../config.js';
 import { getCredential } from '../creds.js';
@@ -12,16 +21,10 @@ import { NeoApi } from '../api.js';
 import { pkgVersion } from '../util.js';
 import { TOOLS } from './tools.js';
 
-export async function runMcpServer() {
-  const cfg = resolveConfig({});
-  const cred = getCredential(cfg.baseUrl);
-  const api = new NeoApi({ baseUrl: cfg.baseUrl, token: cred?.token });
-  if (!cred?.token) {
-    console.error(`[neo-app mcp] no credential for ${cfg.baseUrl} — run 'neo-app login' or set NEO_APP_TOKEN`);
-  }
-
-  // serverInfo.version MUST equal the packed npm artifact version (handoff 3.1):
-  // derive it from package.json, never hard-code it.
+// buildServer wires the shared tool registry onto a fresh MCP Server bound to ONE NeoApi
+// (one session's auth token + env pin). Every transport reuses it, so stdio and hosted
+// HTTP/SSE serve the identical neo_* contract, annotations, and version (#175 parity).
+function buildServer(api) {
   const server = new Server({ name: 'neo-app', version: pkgVersion() }, { capabilities: { tools: {} } });
 
   server.setRequestHandler(ListToolsRequestSchema, async () => ({
@@ -40,7 +43,7 @@ export async function runMcpServer() {
     }
     if (!api.token) {
       return {
-        content: [{ type: 'text', text: 'Not authenticated. Run `neo-app login` or set NEO_APP_TOKEN.' }],
+        content: [{ type: 'text', text: 'Not authenticated. Send an Authorization: Bearer <kap_ token> header (hosted), run `neo-app login`, or set NEO_APP_TOKEN (stdio).' }],
         isError: true,
       };
     }
@@ -54,6 +57,104 @@ export async function runMcpServer() {
     }
   });
 
+  return server;
+}
+
+// runMcpServer: local stdio. One process = one local credential (unchanged behavior).
+export async function runMcpServer() {
+  const cfg = resolveConfig({});
+  const cred = getCredential(cfg.baseUrl);
+  const api = new NeoApi({ baseUrl: cfg.baseUrl, token: cred?.token });
+  if (!cred?.token) {
+    console.error(`[neo-app mcp] no credential for ${cfg.baseUrl} — run 'neo-app login' or set NEO_APP_TOKEN`);
+  }
+  // serverInfo.version MUST equal the packed npm artifact version (handoff 3.1): buildServer
+  // derives it from package.json.
+  const server = buildServer(api);
   await server.connect(new StdioServerTransport());
-  console.error(`[neo-app mcp] ready: ${cfg.env} ${cfg.baseUrl}`);
+  console.error(`[neo-app mcp] ready: ${cfg.env} ${cfg.baseUrl} — ${TOOLS.length} tools v${pkgVersion()}`);
+}
+
+const bearer = (req) => {
+  const m = /^Bearer\s+(.+)$/i.exec(req.headers['authorization'] || '');
+  return m ? m[1].trim() : null;
+};
+
+// runMcpHttpServer: hosted Streamable HTTP + SSE. The agent's per-request Bearer token
+// becomes that session's NeoApi token — NEVER a local credential. baseUrl is the control
+// plane this MCP fronts (config / NEO_APP_URL). Returns the http.Server (for tests).
+export async function runMcpHttpServer({ port, host } = {}) {
+  const cfg = resolveConfig({});
+  // Honor an explicit port, including 0 (ephemeral, used by tests); else PORT, else 8750.
+  const listenPort = (port != null && port !== '') ? Number(port) : Number(process.env.PORT || 8750);
+  const listenHost = host || process.env.HOST || '0.0.0.0';
+  // Mount point for the MCP routes. Default '/mcp'; set NEO_APP_MCP_BASE_PATH=/api/v1/mcp
+  // when the control plane reverse-proxies that public path straight through to this sidecar,
+  // so the SSE "endpoint" event the client is told to POST back to resolves correctly.
+  const base = (process.env.NEO_APP_MCP_BASE_PATH || '/mcp').replace(/\/+$/, '');
+  const apiFor = (req) => new NeoApi({ baseUrl: cfg.baseUrl, token: bearer(req) });
+
+  // SSE keeps per-connection state in-process (sessionId -> transport); the agent's Bearer
+  // token is bound to the session's NeoApi when the stream opens. Streamable HTTP is stateless
+  // (no map). ponytail: the SSE map → run as a SINGLE replica; add sticky routing or a shared
+  // store before scaling SSE horizontally. Streamable HTTP has no such limit.
+  const sseSessions = new Map();  // sessionId -> SSEServerTransport
+
+  const json = (res, code, obj) => { res.writeHead(code, { 'content-type': 'application/json' }); res.end(JSON.stringify(obj)); };
+
+  const httpServer = createHttpServer(async (req, res) => {
+    try {
+      const url = new URL(req.url, `http://${req.headers.host || 'localhost'}`);
+
+      // Unauthenticated liveness/capability probe so infra can confirm the hosted MCP is up
+      // and advertises the full contract (version + tool count) — the opposite of the #175
+      // "connected but silently reduced" failure.
+      if (req.method === 'GET' && (url.pathname === '/healthz' || url.pathname === '/version')) {
+        return json(res, 200, { component: 'neo-app-mcp', version: pkgVersion(), tools: TOOLS.length, transports: ['streamable-http', 'sse'] });
+      }
+
+      // --- Streamable HTTP (stateless): a fresh server + transport per POST, JSON responses.
+      // Each request is self-contained (the SDK answers tools/list without a prior initialize),
+      // so no session id is minted here — the control plane fronting this owns session state. ---
+      if (url.pathname === base) {
+        if (req.method !== 'POST') {
+          res.setHeader('allow', 'POST');
+          return json(res, 405, { error: 'method not allowed; stateless Streamable HTTP MCP uses POST' });
+        }
+        const server = buildServer(apiFor(req));
+        const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });
+        res.on('close', () => { transport.close(); server.close(); });
+        await server.connect(transport);
+        await transport.handleRequest(req, res); // SDK reads the JSON-RPC body from the stream
+        return;
+      }
+
+      // --- SSE (stateful): GET <base>/sse opens the stream, POST <base>/messages carries messages ---
+      if (url.pathname === `${base}/sse` && req.method === 'GET') {
+        const server = buildServer(apiFor(req));
+        const transport = new SSEServerTransport(`${base}/messages`, res);
+        sseSessions.set(transport.sessionId, transport);
+        res.on('close', () => { sseSessions.delete(transport.sessionId); server.close(); });
+        await server.connect(transport); // calls transport.start() → sends the endpoint event
+        return;
+      }
+      if (url.pathname === `${base}/messages` && req.method === 'POST') {
+        const transport = sseSessions.get(url.searchParams.get('sessionId'));
+        if (!transport) return json(res, 404, { error: 'no such SSE session' });
+        await transport.handlePostMessage(req, res);
+        return;
+      }
+
+      return json(res, 404, { error: 'not found' });
+    } catch (e) {
+      console.error('[neo-app mcp] request error', e?.message || e);
+      if (!res.headersSent) json(res, 500, { error: String(e?.message || e) });
+      else try { res.end(); } catch { /* already closed */ }
+    }
+  });
+
+  await new Promise((resolve) => httpServer.listen(listenPort, listenHost, resolve));
+  const boundPort = httpServer.address()?.port ?? listenPort;
+  console.error(`[neo-app mcp] hosted ready: http://${listenHost}:${boundPort}${base} (streamable) + ${base}/sse — fronting ${cfg.baseUrl}, ${TOOLS.length} tools v${pkgVersion()}`);
+  return httpServer;
 }

package/src/mcp/tools.js

@@ -31,10 +31,14 @@ function result(status, data) {
 // §2 safety: a create/deploy mutation must name its environment explicitly —
 // NEVER default to production. A silent prod mutation is the exact risk the
 // handoff calls out ("Never default a missing environment to production").
-// sessionEnv pins ONE target environment (staging|production) for this MCP session so an
-// agent doesn't mix staging and production within a task (JNG #136). Seeded from
-// NEO_APP_TARGET_ENV; set at runtime with neo_set_context. null = not chosen yet.
-let sessionEnv = (() => { const e = String(process.env.NEO_APP_TARGET_ENV || '').toLowerCase(); return (e === 'staging' || e === 'production') ? e : null; })();
+// The session env pin (JNG #136) is PER-API-SESSION state, not a module global, so one
+// hosted MCP process can serve many tenants concurrently without their env pins bleeding
+// across sessions — each MCP session has its own NeoApi, and the pin lives on it. Stdio
+// has a single api for the whole process, so the behavior is identical to a module global.
+// Seeded once per api from NEO_APP_TARGET_ENV; null = not chosen yet.
+function seedSessionEnv() { const e = String(process.env.NEO_APP_TARGET_ENV || '').toLowerCase(); return (e === 'staging' || e === 'production') ? e : null; }
+function getSessionEnv(api) { if (api._sessionEnv === undefined) api._sessionEnv = seedSessionEnv(); return api._sessionEnv; }
+function setSessionEnv(api, v) { api._sessionEnv = v; }
 
 // envStrict validates an explicit staging|production value (no fallback).
 function envStrict(env) {
@@ -48,36 +52,39 @@ function envStrict(env) {
 // call), a later call for a DIFFERENT environment is refused unless allowCrossEnvironment is
 // set — so staging and production can't be mixed in one session. The first explicit choice
 // pins the session so subsequent calls inherit it. Never silently defaulted.
-function requireEnv(env, allowCross = false) {
+function requireEnv(api, env, allowCross = false) {
   const e = String(env || '').toLowerCase();
   const explicit = (e === 'staging' || e === 'production') ? e : null;
-  if (sessionEnv) {
-    if (explicit && explicit !== sessionEnv && !allowCross) {
-      throw new Error(`environment_mismatch: this session is pinned to "${sessionEnv}" but the call requested "${explicit}". Staging and production must not be mixed in one session (JNG #136). Pass allowCrossEnvironment:true to allow this one call, or re-pin with neo_set_context.`);
+  const pinned = getSessionEnv(api);
+  if (pinned) {
+    if (explicit && explicit !== pinned && !allowCross) {
+      throw new Error(`environment_mismatch: this session is pinned to "${pinned}" but the call requested "${explicit}". Staging and production must not be mixed in one session (JNG #136). Pass allowCrossEnvironment:true to allow this one call, or re-pin with neo_set_context.`);
     }
-    return explicit || sessionEnv;
+    return explicit || pinned;
   }
-  if (explicit) { sessionEnv = explicit; return explicit; } // pin the first explicit choice
+  if (explicit) { setSessionEnv(api, explicit); return explicit; } // pin the first explicit choice
   throw new Error('environment_not_chosen: pin it once with neo_set_context({environment:"staging"|"production"}) (ask the user which if unclear; prefer staging), or pass environment explicitly. Never defaulted so staging and production don\'t get mixed (JNG #136).');
 }
 
 // Shared schema fragment: the per-call escape hatch for the session environment pin.
 const allowCrossEnvProp = { allowCrossEnvironment: { type: 'boolean', description: 'Override the session environment pin for THIS call only (JNG #136). A call whose environment differs from the pinned one is refused by default so staging and production are not mixed; set true to allow this one cross-environment action.' } };
 
-// resetSessionEnv clears the session pin. Exported for tests that exercise the pin
-// invariant in sequence (each must start from a clean, unpinned session).
-export function resetSessionEnv() { sessionEnv = null; }
+// resetSessionEnv clears a session's pin. With api-scoped state each test uses a fresh api,
+// so pins never cross tests; kept exported and tolerant of any/no arg for the existing
+// beforeEach(resetSessionEnv) hooks (a no-op when called without a real api).
+export function resetSessionEnv(api) { if (api && typeof api === 'object') api._sessionEnv = null; }
 
 // assertResourceEnv enforces the session pin on an EXISTING resource addressed by id (JNG #136 §4):
 // if the session is pinned and the resource lives in a different environment, refuse so an
 // ID-based op can't touch the wrong environment's resource. allowCrossEnvironment overrides it;
 // resources with no environment (buckets are shared) and an unpinned session are not guarded.
 async function assertResourceEnv(api, getPath, allowCross = false) {
-  if (!sessionEnv || allowCross) return;
+  const pinned = getSessionEnv(api);
+  if (!pinned || allowCross) return;
   let env;
   try { env = (await api.get(getPath)).data?.environment; } catch { return; } // can't resolve → don't block
-  if (env && env !== sessionEnv) {
-    throw new Error(`environment_mismatch: this session is pinned to "${sessionEnv}" but that resource is in "${env}". Staging and production must not be mixed (JNG #136). Pass allowCrossEnvironment:true to act on it anyway, or re-pin with neo_set_context.`);
+  if (env && env !== pinned) {
+    throw new Error(`environment_mismatch: this session is pinned to "${pinned}" but that resource is in "${env}". Staging and production must not be mixed (JNG #136). Pass allowCrossEnvironment:true to act on it anyway, or re-pin with neo_set_context.`);
   }
 }
 
@@ -201,6 +208,11 @@ async function billableGate(api, { projectId, kind, name, confirmationId, confir
   const resources = specToResources(spec);
   if (resources.length) {
     try { cost = (await api.estimate({ projectId }, { resources })).cost; } catch { cost = null; }
+  } else if (kind === 'database') {
+    // A managed DB is storage-billed only (metering.go/JNG #25); with no volume
+    // there is no fixed cost. Quote Rp0 rather than a bare null (#149 r18a note:
+    // "Redis create returns a null cost estimate") so the gate shows a real figure.
+    cost = { monthly: 0, hourly: 0, currency: 'IDR', note: 'storage-billed only; no volume specified' };
   }
   const costNote = cost ? formatCost(cost) : '';
 
@@ -270,8 +282,8 @@ export const TOOLS = [
       required: ['environment'],
     },
     async call(api, args) {
-      sessionEnv = envStrict(args.environment);
-      return { environment: sessionEnv, pinned: true, note: 'Pinned for this session. Env-requiring tools now use it; override per-call by passing environment explicitly.' };
+      setSessionEnv(api, envStrict(args.environment));
+      return { environment: getSessionEnv(api), pinned: true, note: 'Pinned for this session. Env-requiring tools now use it; override per-call by passing environment explicitly.' };
     },
   },
   {
@@ -281,7 +293,7 @@ export const TOOLS = [
     schema: { type: 'object', properties: {} },
     async call(api) {
       const acct = (typeof api.actingIdentity === 'function') ? await api.actingIdentity().catch(() => ({})) : {};
-      return { environment: sessionEnv, ...acct };
+      return { environment: getSessionEnv(api), ...acct };
     },
   },
   {
@@ -317,6 +329,10 @@ export const TOOLS = [
         const v = (await api.get('/version')).data || {};
         controlPlane.version = v.version ?? null;
         controlPlane.gitCommit = v.gitCommit ?? null;
+        // Report the PUBLIC control-plane URL when the server advertises one — the
+        // hosted sidecar reaches the control plane on loopback (127.0.0.1), so
+        // api.baseUrl alone would leak the internal address (#175 r18a retest).
+        if (v.publicUrl) controlPlane.baseUrl = v.publicUrl;
       } catch { /* leave nulls */ }
 
       // Price book is readable by any member; surface whether cost data is
@@ -335,7 +351,7 @@ export const TOOLS = [
         { type: 'template', create: true, deploy: true, scale: false, update: true, logs: true, variables: true, delete: true },
         { type: 'static_site', create: 'via_folder', deploy: true, scale: false, update: true, domains: true, logs: true, variables: true, delete: true, nativeStatic: true, note: 'neo_deploy_folder serviceType=static_site with buildCommand/publishDirectory → native nginx (0.4.27); neo_update_service for domain/tls/path' },
         { type: 'worker', create: 'via_folder', deploy: true, scale: true, update: true, health: true, autoscale: true, logs: true, variables: true, usage: true, delete: true, note: 'neo_deploy_folder serviceType=worker (no public ingress) + neo_update_service (compute/replicas/autoscale/command/health)' },
-        { type: 'database', create: true, deploy: true, get: true, list: true, update: true, backup: true, restore: true, verify: true, publicAccess: true, delete: true, note: 'neo_create/deploy/list/get/update(resize)/delete_database + backup + restore (postgres, local backups) + verify (SQL round-trip) + enable/disable_db_public_access (handoff 4.4)' },
+        { type: 'database', create: true, deploy: true, get: true, list: true, update: true, backup: true, restore: true, verify: true, publicAccess: 'postgres-only', delete: true, engines: ['postgres', 'mysql', 'mariadb', 'redis'], note: 'neo_create/deploy/list/get/update(resize)/delete_database + backup + restore (postgres & mysql/mariadb SQL dumps; redis RDB restores via pod file-swap) + verify (postgres/mysql SQL round-trip, redis SET/GET/TTL/DEL). Managed DBs are storage-billed only (no compute line). publicAccess is postgres-only today; mysql/redis are private-binding only (handoff 4.4, #149).' },
         { type: 'queue', create: true, deploy: true, get: true, list: true, update: true, verify: true, publicAccess: true, delete: true, note: 'neo_create/deploy/list/get/update/verify(publish→persist)/delete_queue + enable/disable_queue_public_access (handoff 4.5)' },
         { type: 'cron', create: true, get: true, list: true, run: true, runs: true, questionnaire: true, delete: true, note: 'neo_cron_questionnaire (guided) + create/list/get/run/list_runs/delete_cron (handoff 4.6)' },
         { type: 'object_storage', create: true, get: true, list: true, objects: true, upload: true, verify: true, delete: true, note: 'neo_create/list/get/verify(put→list→delete)/delete_bucket + list/upload/presign(get)/delete objects (handoff 4.7)' },
@@ -352,7 +368,7 @@ export const TOOLS = [
         sourceTypes: ['git', 'image', 'dockerfile', 'local', 'template'],
         environments: ['staging', 'production'],
         // Active session context + the one-environment-per-session invariant (JNG #136).
-        context: { environment: sessionEnv, pinned: !!sessionEnv },
+        context: { environment: getSessionEnv(api), pinned: !!getSessionEnv(api) },
         environmentIsolation: {
           supported: true,
           pinnedBy: ['neo_set_context', 'first explicit environment on an env-requiring call'],
@@ -468,9 +484,9 @@ export const TOOLS = [
       type: 'object',
       properties: {
         appId: str('Service/app id'),
-        computeTier: str('Bundled compute tier (micro | small | medium | large | xlarge)'),
-        cpuLimit: str('Custom CPU limit, e.g. "500m" (use with memoryLimit; unbundled)'),
-        memoryLimit: str('Custom memory limit, e.g. "512Mi" (unbundled)'),
+        computeTier: str('Legacy size shorthand (micro|small|medium|large|xlarge) — maps to its concrete vCPU/RAM. Prefer cpuLimit+memoryLimit. Compute is resource-based (#144): priced per vCPU-hour + GB-RAM-hour, no packages.'),
+        cpuLimit: str('CPU, e.g. "500m" or "1" (use with memoryLimit) — resource-based billing'),
+        memoryLimit: str('Memory, e.g. "512Mi" or "1Gi" (use with cpuLimit) — resource-based billing'),
         replicas: int('Fixed replica count'),
         autoscaleMin: int('Autoscale min replicas'),
         autoscaleMax: int('Autoscale max replicas'),
@@ -498,7 +514,9 @@ export const TOOLS = [
       const { appId, confirm, orgId, computeTier, allowCrossEnvironment, ...rest } = args;
       await assertResourceEnv(api, `/api/v1/apps/${appId}`, allowCrossEnvironment); // JNG #136 §4
       const body = { ...rest };
-      if (computeTier) { body.billingMode = 'bundled'; body.cpuLimit = computeTier; }
+      // #144: compute is resource-based. A legacy tier shorthand is passed through as
+      // cpuLimit; the control plane maps it to concrete vCPU/RAM and bills unbundled.
+      if (computeTier) { body.cpuLimit = computeTier; }
       else if (args.cpuLimit || args.memoryLimit) { body.billingMode = 'unbundled'; }
       const costChanging = computeTier || args.cpuLimit || args.memoryLimit || args.replicas !== undefined || args.autoscaleMax !== undefined || args.autoscaleMin !== undefined || args.volumeSize !== undefined || (Array.isArray(args.mounts) && args.mounts.length > 0);
       if (costChanging && confirm !== true) {
@@ -729,7 +747,7 @@ export const TOOLS = [
       required: ['projectId'],
     },
     async call(api, args) {
-      const env = requireEnv(args.environment, args.allowCrossEnvironment);
+      const env = requireEnv(api, args.environment, args.allowCrossEnvironment);
       return { environment: env, ...(await api.get(`/api/v1/projects/${args.projectId}/environments/${env}/config`)).data };
     },
   },
@@ -781,22 +799,22 @@ export const TOOLS = [
   },
   {
     name: 'neo_get_database_metrics',
-    description: 'Current resource usage for a managed postgres database (JNG #133): cpuMillicores + memoryBytes (metrics-server), databaseSizeBytes vs volumeSize (is it filling up?), and connections / maxConnections / connectionsPercent. Snapshot only (no history). Use before a migration or resize to check headroom.',
+    description: 'Current resource usage for a managed database — postgres, mysql/mariadb, or redis (#149). Always: cpuMillicores + memoryBytes (metrics-server). SQL engines: databaseSizeBytes vs volumeSize, connections / maxConnections / connectionsPercent. Redis: usedMemoryBytes / maxMemoryBytes / memoryPercent, connectedClients, keys, opsPerSec, hitRatioPercent, evictedKeys, role. Snapshot only (no history). Use before a migration or resize to check headroom.',
     mutating: false,
-    schema: { type: 'object', properties: { databaseId: str('Database id (postgres, deployed)') }, required: ['databaseId'] },
+    schema: { type: 'object', properties: { databaseId: str('Database id (deployed)') }, required: ['databaseId'] },
     async call(api, args) {
       return (await api.get(`/api/v1/databases/${args.databaseId}/metrics`)).data;
     },
   },
   {
     name: 'neo_db_query',
-    description: 'Run a SQL query inside a managed postgres database\'s primary pod and return the result (JNG #128). READ-ONLY by default (the session is set read-only, so any write errors); pass readOnly:false to allow writes (CAUTION). Credentials are never exposed. The database must be deployed. Use for quick checks like "SELECT count(*) FROM sessions;".',
+    description: 'Run a SQL query inside a managed SQL database\'s primary pod (postgres or mysql/mariadb) and return the result (JNG #128, #149). READ-ONLY by default (the session is set read-only, so any write errors); pass readOnly:false to allow writes (CAUTION). Credentials are never exposed. The database must be deployed. For Redis use neo_redis_command. Use for quick checks like "SELECT count(*) FROM sessions;".',
     mutating: true,
     schema: {
       type: 'object',
       properties: {
-        databaseId: str('Database id (postgres, deployed)'),
-        sql: str('SQL to run (piped into psql)'),
+        databaseId: str('Database id (postgres/mysql, deployed)'),
+        sql: str('SQL to run (piped into the engine client)'),
         readOnly: { type: 'boolean', description: 'true (default) runs in a read-only session; false allows writes' },
         ...allowCrossEnvProp,
       },
@@ -807,6 +825,24 @@ export const TOOLS = [
       return (await api.post(`/api/v1/databases/${args.databaseId}/query`, { sql: args.sql, readOnly: args.readOnly })).data;
     },
   },
+  {
+    name: 'neo_redis_command',
+    description: 'Run a single Redis command inside a managed redis instance\'s pod (safe inspection, #149). Destructive/administrative commands are blocked (FLUSHALL, FLUSHDB, CONFIG, SHUTDOWN, EVAL, CLUSTER, ACL, CLIENT, REPLICAOF, …); ordinary commands (GET, TTL, TYPE, DBSIZE, INFO, SCAN, LLEN, HGETALL, …) are allowed. Credentials are never exposed; the database must be deployed. For SQL engines use neo_db_query.',
+    mutating: true,
+    schema: {
+      type: 'object',
+      properties: {
+        databaseId: str('Database id (redis, deployed)'),
+        command: str('Redis command, e.g. "GET mykey" or "INFO memory"'),
+        ...allowCrossEnvProp,
+      },
+      required: ['databaseId', 'command'],
+    },
+    async call(api, args) {
+      await assertResourceEnv(api, `/api/v1/databases/${args.databaseId}`, args.allowCrossEnvironment); // JNG #136 §4
+      return (await api.post(`/api/v1/databases/${args.databaseId}/redis-command`, { command: args.command })).data;
+    },
+  },
   {
     name: 'neo_set_variable',
     description:
@@ -824,7 +860,7 @@ export const TOOLS = [
       required: ['projectId', 'key', 'value'],
     },
     async call(api, args) {
-      const env = requireEnv(args.environment, args.allowCrossEnvironment);
+      const env = requireEnv(api, args.environment, args.allowCrossEnvironment);
       const path = `/api/v1/projects/${args.projectId}/environments/${env}/config`;
       // The PUT replaces the whole set, so merge current vars first.
       const current = (await api.get(path)).data?.vars || [];
@@ -936,14 +972,14 @@ export const TOOLS = [
   {
     name: 'neo_estimate',
     description:
-      'Estimate the hourly and monthly cost (IDR) of a service or resource from the LIVE price book, so you can show the user the cost BEFORE a billable create/deploy (handoff 3.3/3.4). Read-only. Covers compute (a tier, or custom vcpu/memoryMB), persistent storage, and object storage; variable usage (queue messages, cron runs) is excluded and noted. Pass orgId to apply that org\'s price overrides.',
+      'Estimate the hourly and monthly cost (IDR) of a service or resource from the LIVE price book, so you can show the user the cost BEFORE a billable create/deploy (handoff 3.3/3.4). Read-only. Compute is resource-based (#144): priced per vCPU-hour + GB-RAM-hour independently (no packages), hourly, capped at 730 billable hours/month. Covers compute (vcpu+memoryMB, or a legacy tier shorthand that resolves to concrete vCPU/RAM), persistent storage, and object storage (all per GB-hour); variable usage (queue messages, cron runs) is excluded and noted. The monthly figure is a non-authoritative estimate (hourly × up to 730). Pass orgId to apply that org\'s price overrides.',
     mutating: false,
     schema: {
       type: 'object',
       properties: {
-        computeTier: str('Compute tier key: micro | small | medium | large | xlarge (bundled compute)'),
-        vcpu: { type: 'number', description: 'Custom vCPU count (use instead of computeTier)' },
-        memoryMB: int('Custom memory in MB (use with vcpu)'),
+        computeTier: str('Legacy size shorthand (micro|small|medium|large|xlarge) — resolves to concrete vCPU/RAM. Prefer vcpu+memoryMB. Compute is resource-based (#144), not packaged.'),
+        vcpu: { type: 'number', description: 'vCPU count — priced per vCPU-hour (preferred over computeTier)' },
+        memoryMB: int('Memory in MB — priced per GB-RAM-hour (use with vcpu)'),
         storageGB: int('Persistent/database storage in GB (optional)'),
         objectStorageGB: int('Object-storage quota in GB (optional)'),
         replicas: int('Replica count (default 1)'),
@@ -1023,7 +1059,7 @@ export const TOOLS = [
   },
   {
     name: 'neo_list_templates',
-    description: 'List deployable templates (e.g. wordpress, n8n, redis).',
+    description: 'List deployable templates (e.g. n8n) with their manifest: the Creates/Reuses resource graph, pinned source/version, min resources, public routes, and limitations — enough to show the resource graph and a live estimate before deploy. WordPress was retired.',
     mutating: false,
     schema: { type: 'object', properties: {} },
     async call(api) {
@@ -1032,7 +1068,7 @@ export const TOOLS = [
   },
   {
     name: 'neo_deploy_template',
-    description: 'Deploy a template (e.g. wordpress, n8n) into a project. May return pending_approval.',
+    description: 'Deploy a template (e.g. n8n) into a project. May return pending_approval. Retired templates (e.g. wordpress) return 410 "no longer available".',
     mutating: true,
     schema: {
       type: 'object',
@@ -1069,7 +1105,7 @@ export const TOOLS = [
       required: ['projectId', 'path', 'environment'],
     },
     async call(api, args) {
-      const environment = requireEnv(args.environment, args.allowCrossEnvironment);
+      const environment = requireEnv(api, args.environment, args.allowCrossEnvironment);
       const p = resolve(args.path);
       let src;
       try {
@@ -1129,7 +1165,7 @@ export const TOOLS = [
       properties: {
         projectId: str('Project id'),
         name: str('Database name'),
-        engine: { type: 'string', description: 'postgres | mysql (engine)' },
+        engine: { type: 'string', description: 'postgres | mysql | redis (also mariadb, mongo) — engine' },
         version: str('Engine version, e.g. "16" (optional)'),
         environment: { type: 'string', enum: ['staging', 'production'], description: 'REQUIRED — staging or production (never defaulted, handoff §2)' },
         ...allowCrossEnvProp,
@@ -1142,7 +1178,7 @@ export const TOOLS = [
       required: ['projectId', 'name', 'engine', 'environment'],
     },
     async call(api, args) {
-      const environment = requireEnv(args.environment, args.allowCrossEnvironment); // explicit, else the session pin (JNG #136)
+      const environment = requireEnv(api, args.environment, args.allowCrossEnvironment); // explicit, else the session pin (JNG #136)
       validateDbArgs(args); // reject sub-10Gi / EOL config before pricing (JNG #132)
       const gate = await billableGate(api, { projectId: args.projectId, kind: 'database', name: args.name, confirmationId: args.confirmationId, confirm: args.confirm, environment }, { storageGB: gbFromSize(args.volumeSize), replicas: args.replicas });
       if (gate.requiresConfirmation) return { environment, ...gate };
@@ -1213,9 +1249,9 @@ export const TOOLS = [
   },
   {
     name: 'neo_verify_database',
-    description: 'Functionally verify a managed database (handoff §8.1): runs an in-cluster probe that opens the DB and does a SQL round-trip (SELECT 1), returning {verified, log} — WITHOUT handing you any credentials. Postgres only for now. Synchronous (waits up to ~60s for the probe).',
+    description: 'Functionally verify a managed database (handoff §8.1, #149): runs an in-cluster probe that connects and does an engine-level round trip — postgres/mysql a disposable SQL transaction, redis a namespaced SET/GET/TTL/DEL — returning {verified, check, log} WITHOUT handing you any credentials. This is the authoritative readiness check after neo_deploy_database. Synchronous (waits up to ~60s for the probe).',
     mutating: true,
-    schema: { type: 'object', properties: { databaseId: str('Database id (postgres)') }, required: ['databaseId'] },
+    schema: { type: 'object', properties: { databaseId: str('Database id (deployed)') }, required: ['databaseId'] },
     async call(api, args) {
       const { status, data } = await api.post(`/api/v1/databases/${args.databaseId}/verify`);
       return result(status, data);
@@ -1223,13 +1259,13 @@ export const TOOLS = [
   },
   {
     name: 'neo_restore_database',
-    description: 'Restore a postgres database from a prior backup (handoff 4.4). DESTRUCTIVE — applies the backup dump into the LIVE database (overwrites/merges) and is irreversible, so it requires confirm:true. Pass backupId for a specific backup, else the latest successful one is used. Local-destination backups only for now.',
+    description: 'Restore a postgres or mysql/mariadb database from a prior backup (handoff 4.4, #149). DESTRUCTIVE — applies the backup SQL dump into the LIVE database (overwrites/merges) and is irreversible, so it requires confirm:true. Pass backupId for a specific backup, else the latest successful one is used. Local-destination backups only for now. Redis RDB snapshots restore by a pod-level file swap, not here.',
     mutating: true,
     destructive: true,
     schema: {
       type: 'object',
       properties: {
-        databaseId: str('Database id (postgres)'),
+        databaseId: str('Database id (postgres/mysql)'),
         backupId: str('Backup id to restore from (optional; default the latest successful backup)'),
         confirm: { type: 'boolean', description: 'Must be true — restore overwrites data in the live database.' },
       },
@@ -1320,7 +1356,7 @@ export const TOOLS = [
       required: ['projectId', 'name', 'environment'],
     },
     async call(api, args) {
-      const environment = requireEnv(args.environment, args.allowCrossEnvironment); // explicit, else the session pin (JNG #136)
+      const environment = requireEnv(api, args.environment, args.allowCrossEnvironment); // explicit, else the session pin (JNG #136)
       const gate = await billableGate(api, { projectId: args.projectId, kind: 'queue', name: args.name, confirmationId: args.confirmationId, confirm: args.confirm, environment }, { queue: true }); // queue bills per-message only (JNG #52) — 0 fixed + queue_message rate
       if (gate.requiresConfirmation) return { environment, ...gate };
       const { projectId, confirm, confirmationId, orgId, ...body } = args;
@@ -1462,7 +1498,7 @@ export const TOOLS = [
       required: ['projectId', 'name', 'mode', 'scheduleType', 'environment'],
     },
     async call(api, args) {
-      const environment = requireEnv(args.environment, args.allowCrossEnvironment); // explicit, else the session pin (JNG #136)
+      const environment = requireEnv(api, args.environment, args.allowCrossEnvironment); // explicit, else the session pin (JNG #136)
       const gate = await billableGate(api, { projectId: args.projectId, kind: 'cron', name: args.name, confirmationId: args.confirmationId, confirm: args.confirm }, { cron: true }); // cron has no fixed cost — the contract surfaces the per-run `cron_run` rate in cost.variable
       if (gate.requiresConfirmation) return { environment, ...gate };
       // Merge contentType into headers for convenience (unless already set).
@@ -1637,8 +1673,9 @@ export const TOOLS = [
       if (!allowCrossEnvironment) {
         let cEnv;
         try { cEnv = (await api.get(`/api/v1/apps/${appId}`)).data?.environment; } catch { /* can't resolve → don't block */ }
-        if (sessionEnv && cEnv && cEnv !== sessionEnv) {
-          throw new Error(`environment_mismatch: this session is pinned to "${sessionEnv}" but that service is in "${cEnv}" (JNG #136). Pass allowCrossEnvironment:true to override, or re-pin with neo_set_context.`);
+        const pinnedEnv = getSessionEnv(api);
+        if (pinnedEnv && cEnv && cEnv !== pinnedEnv) {
+          throw new Error(`environment_mismatch: this session is pinned to "${pinnedEnv}" but that service is in "${cEnv}" (JNG #136). Pass allowCrossEnvironment:true to override, or re-pin with neo_set_context.`);
         }
         if (args.targetType !== 'neo_object_storage') {
           const tPath = args.targetType === 'neo_db' ? `/api/v1/databases/${args.targetId}` : `/api/v1/queues/${args.targetId}`;
@@ -1744,7 +1781,9 @@ export const TOOLS = [
               branch: str('app: git branch'),
               deps: { type: 'array', items: { type: 'string', enum: ['database', 'queue', 'object_storage'] }, description: 'app: managed-resource dependencies this service needs (from neo_scan_repo `deps`). The plan flags any dep not satisfied by a binding as incompleteTopology and apply refuses it unless acknowledged — so a service needing NATS_URL/DATABASE_URL isn\'t deployed into a 503 (JNG #112 §7).' },
               port: int('app: container port'),
-              computeTier: str('app/db/queue: micro | small | medium | large | xlarge'),
+              computeTier: str('app: legacy size shorthand (micro|small|medium|large|xlarge) → concrete vCPU/RAM; prefer cpuLimit+memoryLimit. Compute is resource-based (#144).'),
+              cpuLimit: str('app: CPU, e.g. "0.5" or "1" (use with memoryLimit) — resource-based'),
+              memoryLimit: str('app: memory, e.g. "512M" or "1Gi" (use with cpuLimit) — resource-based'),
               engine: str('database: postgres | mysql'),
               version: str('database: engine version, e.g. 16'),
               volumeSize: str('database: storage size, e.g. 10Gi'),
@@ -1790,7 +1829,7 @@ export const TOOLS = [
       required: ['projectId', 'environment', 'resources'],
     },
     async call(api, args) {
-      const environment = requireEnv(args.environment, args.allowCrossEnvironment); // explicit, else the session pin (JNG #136)
+      const environment = requireEnv(api, args.environment, args.allowCrossEnvironment); // explicit, else the session pin (JNG #136)
       const { projectId, ...body } = args;
       body.environment = environment; // send the resolved env so the pin actually targets it
       const { status, data } = await api.post(`/api/v1/projects/${projectId}/plans`, body);