@biznetgio/neo-app 0.4.74 → 0.4.77

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biznetgio/neo-app",
-  "version": "0.4.74",
+  "version": "0.4.77",
   "description": "NEO App CLI — one-command agent onboarding, MCP server, and project ops for coding agents (Codex, Claude Code).",
   "type": "module",
   "bin": {

package/prompt.md

@@ -6,7 +6,7 @@ Keep this in sync with cli/prompt.md (the npm package's bundled copy).
 -->
 # Set this repo up on NEO App
 
-**Version:** 0.4.74 · **Last updated:** 2026-11-05
+**Version:** 0.4.77 · **Last updated:** 2026-11-07
 
 These are the official setup instructions from NEO App (Biznet Gio's managed-app
 platform). If you are an AI coding agent, complete the steps below yourself by running
@@ -123,6 +123,12 @@ tools — never the portal UI. The lifecycle is the same for every resource type
    explicit **Approve & Create**. Individual creates (`neo_create_database`,
    `neo_create_queue`) instead return the cost and create nothing until you re-call
    with `confirm: true`.
+   **Pricing is resource-based and hourly (#144).** Compute is priced per **vCPU-hour**
+   and per **GB-RAM-hour** independently — there are no packages/tiers. Size a service
+   with `vcpu` + `memoryMB` (or `cpuLimit`/`memoryLimit`); a legacy tier key still works
+   but resolves to its concrete vCPU/RAM. Storage and object storage bill per GB-hour.
+   Time-based components accrue hourly and are **capped at 730 billable hours/month**; a
+   monthly figure is a non-authoritative estimate (hourly × up to 730).
 3. **Apply**: `neo_apply_stack({planId, planHash})`. If the price book changed since the
    plan, apply is refused — re-plan to re-quote. A `pending_approval` result is the
    approval policy working, not an error; wait for it.

package/src/commands/db.js

@@ -0,0 +1,98 @@
+// `neo-app db` — terminal discoverability for the managed-database lifecycle (#149 retest).
+// Read-only inspection (list/get) runs here directly; billable/mutating operations
+// (create, verify, query, backup, restore, redis-command, delete) stay on the MCP
+// server's audited cost-consent path and are listed here so a terminal-only user can
+// discover them from the CLI command tree instead of only through an agent.
+
+import { resolveConfig } from '../config.js';
+import { getCredential } from '../creds.js';
+import { NeoApi } from '../api.js';
+import { readLink } from '../link.js';
+import { log, ok, fail, c } from '../util.js';
+import { redactSecrets } from '../redact.js';
+
+// The full lifecycle, with the MCP tool that performs each one. Shown by `neo-app db`.
+const OPS = [
+  ['list',          'neo-app db list',            'List databases in the linked project (read-only)'],
+  ['get <id>',      'neo-app db get <id>',        'Show one database, incl. redacted connection string (read-only)'],
+  ['create',        'neo_create_database',        'Provision PostgreSQL / MySQL / Redis (billable — cost consent)'],
+  ['deploy',        'neo_deploy_database',        'Start/roll out the database pods'],
+  ['verify',        'neo_verify_database',        'Round-trip health probe (engine-aware)'],
+  ['query',         'neo_db_query',               'Read-only SQL (postgres/mysql)'],
+  ['redis',         'neo_redis_command',          'Run a safe Redis command (denylist-guarded)'],
+  ['metrics',       'neo_get_database_metrics',   'Engine-aware metrics snapshot'],
+  ['backup',        'neo_run_backup / neo_create_backup', 'Create and run a logical backup'],
+  ['restore',       'neo_restore_database',       'Restore a SQL dump (postgres/mysql)'],
+  ['public',        'neo_enable_db_public_access','Enable/disable TLS public access'],
+  ['delete',        'neo_delete_database',        'Delete a database (billable stop)'],
+];
+
+function usage() {
+  log(`${c.bold('neo-app db')} — managed database lifecycle (PostgreSQL · MySQL · Redis)\n`);
+  log(c.bold('Run directly from the CLI (read-only):'));
+  log('  neo-app db list');
+  log('  neo-app db get <database-id>\n');
+  log(c.bold('Mutating / billable operations run through the MCP server'));
+  log(`(start it with ${c.bold('neo-app mcp')} — your agent calls these; the Portal exposes them too):`);
+  for (const [, how, desc] of OPS.slice(2)) log(`  · ${c.bold(how.padEnd(34))} ${c.dim(desc)}`);
+  log(`\nPrice a database before creating it: ${c.bold('neo-app estimate --storage <GB>')}`);
+}
+
+function connect(opts) {
+  const cfg = resolveConfig(opts);
+  const cred = getCredential(cfg.baseUrl);
+  if (!cred?.token) { fail(`not authenticated for ${cfg.baseUrl} — run 'neo-app login'`); process.exit(1); }
+  return new NeoApi({ baseUrl: cfg.baseUrl, token: cred.token });
+}
+
+function requireProject(opts) {
+  const projectId = opts.project || readLink()?.projectId;
+  if (!projectId) { fail("no linked project — run 'neo-app link <project-id>' or pass --project <id>"); process.exit(1); }
+  return projectId;
+}
+
+export async function db(sub, opts = {}, positionals = []) {
+  if (!sub || sub === 'help') return void usage();
+
+  if (sub === 'list' || sub === 'ls') {
+    const api = connect(opts);
+    const projectId = requireProject(opts);
+    let dbs;
+    try { dbs = (await api.get(`/api/v1/projects/${projectId}/databases`)).data?.databases || []; }
+    catch (e) { fail(`list failed: ${e.message || e}`); process.exit(1); }
+    // Credentials are write-only: the API hands an owner/admin an unredacted
+    // connectionString (Portal reveal), but a terminal must never echo it (#149 retest).
+    dbs = redactSecrets(dbs);
+    if (opts.json) return void process.stdout.write(JSON.stringify({ databases: dbs }, null, 2) + '\n');
+    if (!dbs.length) return void ok('no databases in this project');
+    for (const d of dbs) {
+      const status = d.status || (d.host ? 'deployed' : 'not_deployed');
+      log(`  ${c.bold(d.name)}  ${c.dim(`${d.engine} ${d.version || ''}`.trim())}  ${status}  ${c.dim(d.environment || 'production')}  ${c.dim(d.id)}`);
+    }
+    return;
+  }
+
+  if (sub === 'get' || sub === 'show') {
+    const id = positionals[0];
+    if (!id) { fail('usage: neo-app db get <database-id>'); process.exit(2); }
+    const api = connect(opts);
+    let view;
+    try { view = (await api.get(`/api/v1/databases/${id}`)).data; }
+    catch (e) { fail(`get failed: ${e.message || e}`); process.exit(1); }
+    view = redactSecrets(view); // write-only credentials never reach the terminal (#149 retest)
+    if (opts.json) return void process.stdout.write(JSON.stringify(view, null, 2) + '\n');
+    for (const [k, v] of Object.entries(view)) if (v !== undefined && v !== null && v !== '') log(`  ${c.dim(k.padEnd(18))} ${v}`);
+    return;
+  }
+
+  // Any lifecycle verb typed at the CLI: point the user at the discoverable path.
+  const known = OPS.find(([key]) => key.split(' ')[0] === sub);
+  if (known) {
+    log(`${c.bold(sub)} runs through the MCP server (${c.bold(known[1])}) or the Portal — not as a direct CLI write.`);
+    log(`Start the MCP server with ${c.bold('neo-app mcp')} so your agent can call it, or use the Portal.`);
+    return;
+  }
+  fail(`unknown db subcommand: ${sub}`);
+  usage();
+  process.exit(2);
+}

package/src/index.js

@@ -20,6 +20,8 @@ ${c.bold('Commands')}
                            (or pass the same via --source <path|.zip|git-url>)
   project create [name]    Create a project (defaults to the dir name) and link it
   project list             List projects in your organization (find ids to link)
+  db [list|get|...]        Managed database lifecycle (PostgreSQL/MySQL/Redis);
+                           list/get run here, the rest via the MCP server
   status | whoami          Show connected account, org, environment, linked project
   mcp                      Run the MCP server: local stdio (default), or hosted
                            Streamable HTTP + SSE with --http [--port <n>] [--host <h>]
@@ -38,8 +40,8 @@ ${c.bold('Options')}
   --yes                    Non-interactive (headless/CI); also approves a billable deploy without the cost prompt
   --dry-run               Print intended changes without writing
   --json                   Machine-readable output incl. the normalized cost (deploy, estimate)
-  --tier <key>             estimate: compute tier (micro|small|medium|large|xlarge)
-  --vcpu <n> --mem <MB>    estimate: custom compute (instead of --tier)
+  --vcpu <n> --mem <MB>    estimate: compute, priced per vCPU-hour + GB-RAM-hour (#144)
+  --tier <key>             estimate: legacy size shorthand (micro|…|xlarge) → vCPU/RAM
   --storage <GB>           estimate: database/persistent storage
   --object <GB>            estimate: object-storage quota (billed monthly-upfront)
   --queue / --cron         estimate: a queue (per-message) / cron (per-run) resource
@@ -106,8 +108,11 @@ export async function main(argv = process.argv.slice(2)) {
   // Root help, and `--help` on a KNOWN command, print usage. An UNKNOWN command must
   // still error (nonzero exit) even with `--help`, so a bad command isn't silently
   // accepted (JNG #97). Per-subcommand help is tracked in #89.
-  const KNOWN_COMMANDS = new Set(['agent', 'setup', 'config', 'login', 'deploy', 'estimate', 'link', 'project', 'status', 'whoami', 'mcp', 'version', 'help']);
-  if (positionals.length === 0 || (opts.help && KNOWN_COMMANDS.has(cmd))) return void console.log(HELP);
+  const KNOWN_COMMANDS = new Set(['agent', 'setup', 'config', 'login', 'deploy', 'estimate', 'link', 'project', 'status', 'whoami', 'mcp', 'db', 'version', 'help']);
+  // `db --help` renders the DB-specific help (its usage() lists the lifecycle), not the
+  // generic top-level help — #149 retest CLI discoverability caveat. Other known commands
+  // still fall back to the root HELP (per-subcommand help tracked in #89).
+  if (positionals.length === 0 || (opts.help && KNOWN_COMMANDS.has(cmd) && cmd !== 'db')) return void console.log(HELP);
 
   try {
     // `agent setup` and `setup agent` both work (parity with InstaCloud's `setup agent`).
@@ -123,6 +128,7 @@ export async function main(argv = process.argv.slice(2)) {
     if (cmd === 'project' && sub === 'create') return void (await (await import('./commands/link.js')).createProject(positionals[2], opts));
     if (cmd === 'project' && (sub === 'list' || sub === 'ls')) return void (await (await import('./commands/link.js')).listProjects(opts));
     if (cmd === 'status' || cmd === 'whoami') return void (await (await import('./commands/status.js')).status(opts));
+    if (cmd === 'db') return void (await (await import('./commands/db.js')).db(sub, opts, positionals.slice(2)));
     if (cmd === 'mcp') {
       const mcp = await import('./mcp/server.js');
       // Hosted mode: Streamable HTTP + SSE over one listener (auth per request). Default: stdio.

package/src/mcp/tools.js

@@ -7,6 +7,7 @@ import { statSync, readFileSync } from 'node:fs';
 import { deploySource } from '../deploySource.js';
 import { pkgVersion } from '../util.js';
 import { specToResources, formatCost } from '../cost.js';
+import { redactSecrets } from '../redact.js';
 
 const str = (description) => ({ type: 'string', description });
 const int = (description) => ({ type: 'integer', description });
@@ -245,22 +246,8 @@ async function billableGate(api, { projectId, kind, name, confirmationId, confir
   };
 }
 
-const SECRET_KEY = /(password|secret|secretkey|accesskey|connectionstring|connstr|dsn|token|privatekey|apikey|authorization)/i;
-// Deployment snapshots (exact keys) embed rendered configs with plaintext creds — a
-// queue's `--pass`, a DB's POSTGRES_PASSWORD. Redact by EXACT key so we don't also
-// hit resourceId/source-of-truth-style names (substring match would catch "reSOURCEid").
-const SECRET_EXACT = new Set(['source', 'installed']);
-function redactSecrets(value) {
-  if (Array.isArray(value)) return value.map(redactSecrets);
-  if (value && typeof value === 'object') {
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-      out[k] = (SECRET_KEY.test(k) || SECRET_EXACT.has(k.toLowerCase())) ? '[redacted — credentials are write-only; bind them to a consumer instead]' : redactSecrets(v);
-    }
-    return out;
-  }
-  return value;
-}
+// redactSecrets lives in ../redact.js — the single redactor the CLI `db` commands share,
+// so every terminal/JSON output path masks credentials identically (#149 retest).
 
 export const TOOLS = [
   {
@@ -484,9 +471,9 @@ export const TOOLS = [
       type: 'object',
       properties: {
         appId: str('Service/app id'),
-        computeTier: str('Bundled compute tier (micro | small | medium | large | xlarge)'),
-        cpuLimit: str('Custom CPU limit, e.g. "500m" (use with memoryLimit; unbundled)'),
-        memoryLimit: str('Custom memory limit, e.g. "512Mi" (unbundled)'),
+        computeTier: str('Legacy size shorthand (micro|small|medium|large|xlarge) — maps to its concrete vCPU/RAM. Prefer cpuLimit+memoryLimit. Compute is resource-based (#144): priced per vCPU-hour + GB-RAM-hour, no packages.'),
+        cpuLimit: str('CPU, e.g. "500m" or "1" (use with memoryLimit) — resource-based billing'),
+        memoryLimit: str('Memory, e.g. "512Mi" or "1Gi" (use with cpuLimit) — resource-based billing'),
         replicas: int('Fixed replica count'),
         autoscaleMin: int('Autoscale min replicas'),
         autoscaleMax: int('Autoscale max replicas'),
@@ -514,7 +501,9 @@ export const TOOLS = [
       const { appId, confirm, orgId, computeTier, allowCrossEnvironment, ...rest } = args;
       await assertResourceEnv(api, `/api/v1/apps/${appId}`, allowCrossEnvironment); // JNG #136 §4
       const body = { ...rest };
-      if (computeTier) { body.billingMode = 'bundled'; body.cpuLimit = computeTier; }
+      // #144: compute is resource-based. A legacy tier shorthand is passed through as
+      // cpuLimit; the control plane maps it to concrete vCPU/RAM and bills unbundled.
+      if (computeTier) { body.cpuLimit = computeTier; }
       else if (args.cpuLimit || args.memoryLimit) { body.billingMode = 'unbundled'; }
       const costChanging = computeTier || args.cpuLimit || args.memoryLimit || args.replicas !== undefined || args.autoscaleMax !== undefined || args.autoscaleMin !== undefined || args.volumeSize !== undefined || (Array.isArray(args.mounts) && args.mounts.length > 0);
       if (costChanging && confirm !== true) {
@@ -970,16 +959,18 @@ export const TOOLS = [
   {
     name: 'neo_estimate',
     description:
-      'Estimate the hourly and monthly cost (IDR) of a service or resource from the LIVE price book, so you can show the user the cost BEFORE a billable create/deploy (handoff 3.3/3.4). Read-only. Covers compute (a tier, or custom vcpu/memoryMB), persistent storage, and object storage; variable usage (queue messages, cron runs) is excluded and noted. Pass orgId to apply that org\'s price overrides.',
+      'Estimate the hourly and monthly cost (IDR) of a service or resource from the LIVE price book, so you can show the user the cost BEFORE a billable create/deploy (handoff 3.3/3.4). Read-only. Compute is resource-based (#144): priced per vCPU-hour + GB-RAM-hour independently (no packages), hourly, capped at 730 billable hours/month. Covers compute (vcpu+memoryMB, or a legacy tier shorthand that resolves to concrete vCPU/RAM), persistent storage, and object storage (all per GB-hour), plus queue and cron (0 fixed cost — their per-message/per-run rates are disclosed in variable[]). The monthly figure is a non-authoritative estimate (hourly × up to 730). Pass orgId to apply that org\'s price overrides.',
     mutating: false,
     schema: {
       type: 'object',
       properties: {
-        computeTier: str('Compute tier key: micro | small | medium | large | xlarge (bundled compute)'),
-        vcpu: { type: 'number', description: 'Custom vCPU count (use instead of computeTier)' },
-        memoryMB: int('Custom memory in MB (use with vcpu)'),
+        computeTier: str('Legacy size shorthand (micro|small|medium|large|xlarge) — resolves to concrete vCPU/RAM. Prefer vcpu+memoryMB. Compute is resource-based (#144), not packaged.'),
+        vcpu: { type: 'number', description: 'vCPU count — priced per vCPU-hour (preferred over computeTier)' },
+        memoryMB: int('Memory in MB — priced per GB-RAM-hour (use with vcpu)'),
         storageGB: int('Persistent/database storage in GB (optional)'),
         objectStorageGB: int('Object-storage quota in GB (optional)'),
+        queue: { type: 'boolean', description: 'Include a NEO Queue — 0 fixed cost; discloses the per-message (queue_message) rate in variable[]' },
+        cron: { type: 'boolean', description: 'Include a Scheduled Job — 0 fixed cost; discloses the per-run (cron_run) rate in variable[]' },
         replicas: int('Replica count (default 1)'),
         orgId: str('Organization id (optional — applies that org\'s price overrides)'),
       },
@@ -991,7 +982,7 @@ export const TOOLS = [
       if (!orgId) { try { orgId = await api.resolveOrgId(); } catch { orgId = null; } }
       if (!orgId) throw new Error('no organization for this account — cannot estimate cost');
       const resources = specToResources(args);
-      if (!resources.length) throw new Error('nothing to estimate — pass computeTier (or vcpu+memoryMB), storageGB, and/or objectStorageGB');
+      if (!resources.length) throw new Error('nothing to estimate — pass computeTier (or vcpu+memoryMB), storageGB, objectStorageGB, queue, and/or cron');
       const { cost } = await api.estimate({ orgId }, { resources });
       return cost; // normalized contract: currency/hourly/monthly/breakdown/variable/upfront/priceBook/priceBookVersion/assumptions
     },
@@ -1779,7 +1770,9 @@ export const TOOLS = [
               branch: str('app: git branch'),
               deps: { type: 'array', items: { type: 'string', enum: ['database', 'queue', 'object_storage'] }, description: 'app: managed-resource dependencies this service needs (from neo_scan_repo `deps`). The plan flags any dep not satisfied by a binding as incompleteTopology and apply refuses it unless acknowledged — so a service needing NATS_URL/DATABASE_URL isn\'t deployed into a 503 (JNG #112 §7).' },
               port: int('app: container port'),
-              computeTier: str('app/db/queue: micro | small | medium | large | xlarge'),
+              computeTier: str('app: legacy size shorthand (micro|small|medium|large|xlarge) → concrete vCPU/RAM; prefer cpuLimit+memoryLimit. Compute is resource-based (#144).'),
+              cpuLimit: str('app: CPU, e.g. "0.5" or "1" (use with memoryLimit) — resource-based'),
+              memoryLimit: str('app: memory, e.g. "512M" or "1Gi" (use with cpuLimit) — resource-based'),
               engine: str('database: postgres | mysql'),
               version: str('database: engine version, e.g. 16'),
               volumeSize: str('database: storage size, e.g. 10Gi'),

package/src/redact.js

@@ -0,0 +1,26 @@
+// Single redactor for every CLI/MCP path that prints a control-plane response to a
+// terminal, a file, or JSON (#149 retest SECURITY BLOCKER): managed-DB/queue credentials
+// are write-only. The control-plane API still returns an unredacted connectionString to an
+// owner/admin (the Portal's RBAC-gated reveal), so a terminal tool that echoes that response
+// raw leaks a plaintext password. Every CLI/MCP output routes through redactSecrets so a
+// credential never reaches a shell, a log, or a JSON dump — matching MCP's write-only stance.
+
+const SECRET_KEY = /(password|secret|secretkey|accesskey|connectionstring|connstr|dsn|token|privatekey|apikey|authorization)/i;
+// Deployment snapshots (exact keys) embed rendered configs with plaintext creds — a
+// queue's `--pass`, a DB's POSTGRES_PASSWORD. Redact by EXACT key so we don't also hit
+// resourceId/source-of-truth-style names (a substring match would catch "reSOURCEid").
+const SECRET_EXACT = new Set(['source', 'installed']);
+
+export const REDACTED = '[redacted — credentials are write-only; bind them to a consumer instead]';
+
+export function redactSecrets(value) {
+  if (Array.isArray(value)) return value.map(redactSecrets);
+  if (value && typeof value === 'object') {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = (SECRET_KEY.test(k) || SECRET_EXACT.has(k.toLowerCase())) ? REDACTED : redactSecrets(v);
+    }
+    return out;
+  }
+  return value;
+}