@biznetgio/neo-app 0.4.78 → 0.4.80

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biznetgio/neo-app",
-  "version": "0.4.78",
+  "version": "0.4.80",
   "description": "NEO App CLI — one-command agent onboarding, MCP server, and project ops for coding agents (Codex, Claude Code).",
   "type": "module",
   "bin": {

package/prompt.md

@@ -6,7 +6,7 @@ Keep this in sync with cli/prompt.md (the npm package's bundled copy).
 -->
 # Set this repo up on NEO App
 
-**Version:** 0.4.78 · **Last updated:** 2026-11-09
+**Version:** 0.4.80 · **Last updated:** 2026-11-09
 
 These are the official setup instructions from NEO App (Biznet Gio's managed-app
 platform). If you are an AI coding agent, complete the steps below yourself by running

package/src/commands/template.js

@@ -0,0 +1,168 @@
+// `neo-app template` — terminal parity for the one-click catalogue (#99 CLI parity).
+// list/show are read-only; plan is a zero-write live cost preview; apply deploys through
+// the SAME server-enforced publication gate as the Portal/MCP — a blocked/draft template
+// is refused (409), so a CLI user gets the same catalogue, review, and gate everywhere.
+
+import { resolveConfig } from '../config.js';
+import { getCredential } from '../creds.js';
+import { NeoApi } from '../api.js';
+import { readLink } from '../link.js';
+import { formatCost } from '../cost.js';
+import { log, ok, fail, c } from '../util.js';
+
+function connect(opts) {
+  const cfg = resolveConfig(opts);
+  const cred = getCredential(cfg.baseUrl);
+  if (!cred?.token) { fail(`not authenticated for ${cfg.baseUrl} — run 'neo-app login'`); process.exit(1); }
+  return new NeoApi({ baseUrl: cfg.baseUrl, token: cred.token });
+}
+
+function requireProject(opts) {
+  const projectId = opts.project || readLink()?.projectId;
+  if (!projectId) { fail("no linked project — run 'neo-app link <project-id>' or pass --project <id>"); process.exit(1); }
+  return projectId;
+}
+
+// Default list is deployable-only (approved); --all / --view all includes blocked
+// templates with their status (research view), matching GET /templates?view=all.
+async function fetchCatalog(api, all) {
+  const q = all ? '?view=all' : '';
+  return (await api.get('/api/v1/templates' + q)).data?.templates || [];
+}
+
+export function findTemplate(list, name) {
+  return list.find((t) => t.name === name || t.title === name);
+}
+
+// Map a template's Creates graph into /estimate resource specs (mirrors the Portal/#170),
+// so the CLI prices a template from the same authoritative price book — never hard-coded.
+export function estimateResources(t) {
+  return (t.creates || []).map((cr) => {
+    const volumeSize = cr.minStorageGB ? `${cr.minStorageGB}Gi` : undefined;
+    if (cr.kind === 'app') return { kind: 'app', name: t.name, computeTier: cr.computeTier || 'micro', volumeSize };
+    if (cr.kind === 'database') return { kind: 'database', name: `${t.name}-db`, engine: cr.engine, computeTier: cr.computeTier, volumeSize };
+    if (cr.kind === 'queue') return { kind: 'queue', name: `${t.name}-queue`, computeTier: cr.computeTier, volumeSize };
+    if (cr.kind === 'bucket') return { kind: 'bucket', name: `${t.name}-bucket`, volumeSize };
+    return { kind: cr.kind, name: t.name };
+  });
+}
+
+function usage() {
+  log(`${c.bold('neo-app template')} — one-click application catalogue\n`);
+  log(c.bold('Commands:'));
+  log('  neo-app template list [--all] [--json]                 List deployable templates (--all incl. blocked)');
+  log('  neo-app template show <name> [--json]                  Show one template manifest + status');
+  log('  neo-app template plan <name> --project <id> [--json]   Live cost preview (zero-write)');
+  log('  neo-app template apply <name> --project <id> --confirm Deploy (gated; a blocked template is refused)');
+}
+
+async function printCost(api, t, projectId) {
+  const resources = estimateResources(t);
+  if (!resources.length) return null;
+  let cost;
+  try { cost = (await api.estimate({ projectId }, { resources })).cost; }
+  catch (e) { log(c.dim(`  (live price unavailable: ${e.message || e})`)); return null; }
+  log(c.bold(`  Estimated cost: ${formatCost(cost)}`));
+  for (const l of cost.breakdown || []) log(`    · ${l.item}: ${l.monthly} ${cost.currency}/mo (${l.hourly}/h)`);
+  if (cost.priceBookVersion) log(c.dim(`    price book: ${cost.priceBookVersion}`));
+  return cost;
+}
+
+async function cmdList(api, opts) {
+  const all = !!(opts.all || opts.view === 'all');
+  const cat = await fetchCatalog(api, all);
+  if (opts.json) return void process.stdout.write(JSON.stringify({ templates: cat }, null, 2) + '\n');
+  if (!cat.length) return void ok('no templates');
+  for (const t of cat) {
+    const status = (t.status || (t.deployable ? 'approved' : 'unknown')).padEnd(10);
+    const flag = t.deployable ? c.dim('deployable') : c.bold('BLOCKED   ');
+    const src = t.source?.image ? `${t.source.image}:${t.source.version}` : (t.source?.repo || '');
+    log(`  ${c.bold((t.title || t.name).padEnd(16))} ${status} ${flag}  ${c.dim(src)}`);
+  }
+  log(c.dim('\nReview a template before deploy: neo-app template plan <name> --project <id>'));
+}
+
+async function cmdShow(api, name, opts) {
+  const cat = await fetchCatalog(api, true); // show works for blocked too (research view)
+  const t = findTemplate(cat, name);
+  if (!t) { fail(`template not found: ${name}`); process.exit(2); }
+  if (opts.json) return void process.stdout.write(JSON.stringify(t, null, 2) + '\n');
+  log(`${c.bold(t.title || t.name)}  ${c.dim(t.category || '')}`);
+  log(`  status       ${t.status}${t.deployable ? '' : c.bold('  (NOT deployable)')}`);
+  if (t.blockedReason) log(`  unblock      ${t.blockedReason}`);
+  if (t.description) log(`  ${t.description}`);
+  if (t.source) log(`  source       ${t.source.image || t.source.repo}:${t.source.version}${t.source.digest ? '@' + t.source.digest : ''}`);
+  if (t.license) log(`  license      ${t.license}`);
+  if (t.reviewedHash) log(`  reviewedHash ${t.reviewedHash}`);
+  for (const cr of t.creates || []) log(`  creates      ${cr.kind}${cr.engine ? ' (' + cr.engine + ')' : ''}${cr.minStorageGB ? ' ≥' + cr.minStorageGB + 'GiB' : ''}${cr.note ? ' — ' + cr.note : ''}`);
+  for (const r of t.publicRoutes || []) log(`  route        ${r}`);
+  for (const lim of t.limitations || []) log(c.dim(`  note         ${lim}`));
+}
+
+async function cmdPlan(api, name, opts) {
+  const projectId = requireProject(opts);
+  const cat = await fetchCatalog(api, true);
+  const t = findTemplate(cat, name);
+  if (!t) { fail(`template not found: ${name}`); process.exit(2); }
+  if (!t.deployable) { fail(`template '${t.name}' is not deployable (status: ${t.status}). ${t.blockedReason || ''}`.trim()); process.exit(1); }
+  if (opts.json) {
+    const resources = estimateResources(t);
+    let cost = null;
+    try { cost = (await api.estimate({ projectId }, { resources })).cost; } catch { /* surfaced as null */ }
+    return void process.stdout.write(JSON.stringify({ template: t.name, projectId, creates: t.creates || [], cost }, null, 2) + '\n');
+  }
+  log(c.bold(`Plan: ${t.title || t.name} → project ${projectId}`));
+  for (const cr of t.creates || []) log(`  creates ${cr.kind}${cr.engine ? ' (' + cr.engine + ')' : ''}${cr.minStorageGB ? ' ≥' + cr.minStorageGB + 'GiB' : ''}`);
+  await printCost(api, t, projectId);
+  ok(`zero-write preview — nothing created. Deploy: neo-app template apply ${t.name} --project ${projectId} --confirm`);
+}
+
+async function cmdApply(api, name, opts) {
+  const projectId = requireProject(opts);
+  const cat = await fetchCatalog(api, true);
+  const t = findTemplate(cat, name);
+  if (!t) { fail(`template not found: ${name}`); process.exit(2); }
+  // Client-side gate mirrors the server (which also rejects with 409) so a blocked
+  // template never even POSTs a deploy.
+  if (!t.deployable) { fail(`template '${t.name}' is not deployable (status: ${t.status}). ${t.blockedReason || 'not approved'}`); process.exit(1); }
+  // Cost consent: without --confirm we show the price and create nothing.
+  if (!opts.confirm && !opts.yes) {
+    log(c.bold(`About to deploy ${t.title || t.name} into project ${projectId} (billable):`));
+    await printCost(api, t, projectId);
+    fail('re-run with --confirm to deploy. Nothing was created.');
+    process.exit(2);
+  }
+  try {
+    const { status, data } = await api.post(`/api/v1/projects/${projectId}/templates/${encodeURIComponent(t.name)}`, { name: opts.name || t.name });
+    if (status === 202 || data?.approvalId) { ok(`deploy requires approval — pending_approval${data?.approvalId ? ' (' + data.approvalId + ')' : ''}`); return; }
+    ok(`deployed ${t.name}${data?.url ? ' → ' + data.url : ''}`);
+  } catch (e) {
+    // A blocked template reaches the server gate as 409 — surface it verbatim.
+    fail(`deploy failed: ${e.message || e}`);
+    process.exit(1);
+  }
+}
+
+export async function template(sub, opts = {}, positionals = []) {
+  if (!sub || sub === 'help' || opts.help) return void usage();
+  const api = connect(opts);
+  if (sub === 'list' || sub === 'ls') return void (await cmdList(api, opts));
+  if (sub === 'show' || sub === 'get') {
+    const n = positionals[0];
+    if (!n) { fail('usage: neo-app template show <name>'); process.exit(2); }
+    return void (await cmdShow(api, n, opts));
+  }
+  if (sub === 'plan') {
+    const n = positionals[0];
+    if (!n) { fail('usage: neo-app template plan <name> --project <id>'); process.exit(2); }
+    return void (await cmdPlan(api, n, opts));
+  }
+  if (sub === 'apply' || sub === 'deploy') {
+    const n = positionals[0];
+    if (!n) { fail('usage: neo-app template apply <name> --project <id> --confirm'); process.exit(2); }
+    return void (await cmdApply(api, n, opts));
+  }
+  fail(`unknown template subcommand: ${sub}`);
+  usage();
+  process.exit(2);
+}

package/src/index.js

@@ -22,6 +22,8 @@ ${c.bold('Commands')}
   project list             List projects in your organization (find ids to link)
   db [list|get|...]        Managed database lifecycle (PostgreSQL/MySQL/Redis);
                            list/get run here, the rest via the MCP server
+  template [list|show|plan|apply]   One-click app catalogue; apply is gated
+                           (a blocked template is refused), plan is a zero-write cost preview
   status | whoami          Show connected account, org, environment, linked project
   mcp                      Run the MCP server: local stdio (default), or hosted
                            Streamable HTTP + SSE with --http [--port <n>] [--host <h>]
@@ -83,6 +85,9 @@ const options = {
   replicas: { type: 'string' },
   queue: { type: 'boolean' },
   cron: { type: 'boolean' },
+  all: { type: 'boolean' },
+  view: { type: 'string' },
+  confirm: { type: 'boolean' },
   http: { type: 'boolean' },
   sse: { type: 'boolean' },
   host: { type: 'string' },
@@ -108,11 +113,11 @@ export async function main(argv = process.argv.slice(2)) {
   // Root help, and `--help` on a KNOWN command, print usage. An UNKNOWN command must
   // still error (nonzero exit) even with `--help`, so a bad command isn't silently
   // accepted (JNG #97). Per-subcommand help is tracked in #89.
-  const KNOWN_COMMANDS = new Set(['agent', 'setup', 'config', 'login', 'deploy', 'estimate', 'link', 'project', 'status', 'whoami', 'mcp', 'db', 'version', 'help']);
-  // `db --help` renders the DB-specific help (its usage() lists the lifecycle), not the
-  // generic top-level help — #149 retest CLI discoverability caveat. Other known commands
-  // still fall back to the root HELP (per-subcommand help tracked in #89).
-  if (positionals.length === 0 || (opts.help && KNOWN_COMMANDS.has(cmd) && cmd !== 'db')) return void console.log(HELP);
+  const KNOWN_COMMANDS = new Set(['agent', 'setup', 'config', 'login', 'deploy', 'estimate', 'link', 'project', 'status', 'whoami', 'mcp', 'db', 'template', 'templates', 'version', 'help']);
+  // `db`/`template --help` render their OWN command help (their usage() lists the
+  // subcommands), not the generic top-level help — #149/#99 CLI discoverability. Other
+  // known commands still fall back to the root HELP (per-subcommand help tracked in #89).
+  if (positionals.length === 0 || (opts.help && KNOWN_COMMANDS.has(cmd) && cmd !== 'db' && cmd !== 'template' && cmd !== 'templates')) return void console.log(HELP);
 
   try {
     // `agent setup` and `setup agent` both work (parity with InstaCloud's `setup agent`).
@@ -129,6 +134,7 @@ export async function main(argv = process.argv.slice(2)) {
     if (cmd === 'project' && (sub === 'list' || sub === 'ls')) return void (await (await import('./commands/link.js')).listProjects(opts));
     if (cmd === 'status' || cmd === 'whoami') return void (await (await import('./commands/status.js')).status(opts));
     if (cmd === 'db') return void (await (await import('./commands/db.js')).db(sub, opts, positionals.slice(2)));
+    if (cmd === 'template' || cmd === 'templates') return void (await (await import('./commands/template.js')).template(sub, opts, positionals.slice(2)));
     if (cmd === 'mcp') {
       const mcp = await import('./mcp/server.js');
       // Hosted mode: Streamable HTTP + SSE over one listener (auth per request). Default: stdio.

package/src/mcp/tools.js

@@ -1048,16 +1048,17 @@ export const TOOLS = [
   },
   {
     name: 'neo_list_templates',
-    description: 'List deployable templates (e.g. n8n) with their manifest: the Creates/Reuses resource graph, pinned source/version, min resources, public routes, and limitations — enough to show the resource graph and a live estimate before deploy. WordPress was retired.',
+    description: 'List deployable (APPROVED) templates with their manifest: the Creates/Reuses resource graph, pinned source/version + reviewedHash, status, min resources, public routes, and limitations — enough to show the graph and a live estimate before deploy. Only approved templates are returned by default (blocked/draft/retired are NOT deployable and are excluded); pass view:"all" for the research view that also includes blocked templates with their status + blockedReason. WordPress was retired.',
     mutating: false,
-    schema: { type: 'object', properties: {} },
-    async call(api) {
-      return (await api.get('/api/v1/templates')).data;
+    schema: { type: 'object', properties: { view: { type: 'string', enum: ['deployable', 'all'], description: 'deployable (default — approved only) | all (research view incl. blocked, with status)' } } },
+    async call(api, args) {
+      const q = args && args.view === 'all' ? '?view=all' : '';
+      return (await api.get('/api/v1/templates' + q)).data;
     },
   },
   {
     name: 'neo_deploy_template',
-    description: 'Deploy a template (e.g. n8n) into a project. May return pending_approval. Retired templates (e.g. wordpress) return 410 "no longer available".',
+    description: 'Deploy an APPROVED template (e.g. n8n) into a project. Only approved templates deploy: a blocked/draft template returns 409 with the requirements to unblock (e.g. documenso/listmonk need SMTP), and a retired template (e.g. wordpress) returns 410 "no longer available". May return pending_approval.',
     mutating: true,
     schema: {
       type: 'object',