@manifest-network/manifest-agent-core 0.14.0 → 0.15.0

package/dist/close-lease.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"close-lease.d.ts","names":[],"sources":["../src/close-lease.ts"],"mappings":";;;;AAoF2B;;;;;;;;;;;;;;;;;;;;;;;;;;iBAJL,UAAA,CACpB,IAAA,EAAM,cAAA,EACN,SAAA,EAAW,mBAAA,EACX,IAAA,EAAM,iBAAA,GACL,OAAA,CAAQ,gBAAA"}
+{"version":3,"file":"close-lease.d.ts","names":[],"sources":["../src/close-lease.ts"],"mappings":";;;;AAuF2B;;;;;;;;;;;;;;;;;;;;;;;;;;iBAJL,UAAA,CACpB,IAAA,EAAM,cAAA,EACN,SAAA,EAAW,mBAAA,EACX,IAAA,EAAM,iBAAA,GACL,OAAA,CAAQ,gBAAA"}

package/dist/close-lease.js

@@ -1,6 +1,7 @@
+import { makeCancellationScope } from "./internals/cancellation.js";
 import { decode, isTerminal } from "./internals/lease-state.js";
 import { verifyAndRecover } from "./internals/verify-recover.js";
-import { ManifestMCPError, ManifestMCPErrorCode, stopApp } from "@manifest-network/manifest-mcp-core";
+import { ManifestMCPError, ManifestMCPErrorCode, noopLogger, parseLeaseUuid, stopApp } from "@manifest-network/manifest-mcp-core";
 //#region src/close-lease.ts
 /**
 * Public entry point: orchestrate closing an existing lease via the
@@ -52,12 +53,23 @@ const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
 */
 async function closeLease(args, callbacks, opts) {
 	validateArgs(args);
+	const cx = makeCancellationScope({
+		opts,
+		onProgress: callbacks.onProgress,
+		opLabel: "Lease close",
+		broadcasts: true
+	});
+	cx.throwIfCancelled();
 	const block = renderConfirmationBlock(args);
 	if (callbacks.onConfirm) {
-		if (await callbacks.onConfirm(block) !== "yes") throw new ManifestMCPError(ManifestMCPErrorCode.OPERATION_CANCELLED, "User declined to proceed with close-lease.");
+		if (await cx.race(callbacks.onConfirm(block)) !== "yes") throw new ManifestMCPError(ManifestMCPErrorCode.OPERATION_CANCELLED, "User declined to proceed with close-lease.");
 	}
 	callbacks.onProgress?.({ kind: "user_confirmed" });
-	await stopApp(opts.clientManager, args.leaseUuid);
+	cx.throwIfCancelled();
+	await stopApp({
+		chain: opts.clientManager,
+		logger: noopLogger
+	}, { leaseUuid: parseLeaseUuid(args.leaseUuid) });
 	const verifyResult = await verifyAndRecover({
 		verifier: async () => {
 			let result;

package/dist/close-lease.js.map

@@ -1 +1 @@
-{"version":3,"file":"close-lease.js","names":["decodeLeaseState"],"sources":["../src/close-lease.ts"],"sourcesContent":["/**\n * Public entry point: orchestrate closing an existing lease via the\n * `close-lease` billing tx.\n *\n * Composition (mirrors `deploy-app.ts` / `manage-domain.ts`):\n *\n *   1. Validate args.\n *   2. Render a confirmation block + optionally consult `onConfirm`.\n *   3. Broadcast `stopApp` (which submits `MsgCloseLease`).\n *   4. Verify the post-broadcast on-chain state via `verifyAndRecover`\n *      driving a direct `billing.v1.lease({ leaseUuid })` query +\n *      `lease-state.decode` + `isTerminal`. Terminal states (CLOSED /\n *      REJECTED / EXPIRED / INSUFFICIENT_FUNDS) count as success;\n *      PENDING / ACTIVE map to the `pending_drift` branch; a chain\n *      response with no lease (`{ lease: null }`) maps to the catch-all\n *      `unclassified` branch.\n *   5. On verify-failure, invoke the simple-form `onFailure({ reason })`\n *      then throw `ManifestMCPError(TX_FAILED)`. On success, emit\n *      `onComplete` with the typed `CloseLeaseResult`.\n */\n\nimport {\n  ManifestMCPError,\n  ManifestMCPErrorCode,\n  stopApp,\n} from '@manifest-network/manifest-mcp-core';\nimport {\n  decode as decodeLeaseState,\n  isTerminal,\n} from './internals/lease-state.js';\nimport {\n  type VerificationSpec,\n  verifyAndRecover,\n} from './internals/verify-recover.js';\nimport type {\n  CloseLeaseArgs,\n  CloseLeaseCallbacks,\n  CloseLeaseOptions,\n  CloseLeaseResult,\n  DeploymentPlanBlock,\n  LeaseStateName,\n} from './types.js';\n\nconst UUID_RE =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\ntype CloseOutcome = 'terminal' | 'pending' | 'not_found';\n\ninterface CloseDiag {\n  stateName?: LeaseStateName;\n  reason?: string;\n}\n\n/**\n * Close a lease and verify it reached a terminal on-chain state.\n *\n * @throws `ManifestMCPError(INVALID_CONFIG)` for args validation.\n * @throws `ManifestMCPError(OPERATION_CANCELLED)` when `onConfirm` returns\n *   `'no'` (deliberate user cancellation — ENG-272).\n * @throws `ManifestMCPError` (typically `TX_FAILED`) propagated as-is\n *   from the `stopApp()` broadcast step. Broadcast errors do NOT invoke\n *   `onFailure` — that callback is reserved for post-broadcast\n *   verification failures. `stopApp` already raises a structured\n *   `ManifestMCPError` from the core package; wrapping it again at this\n *   layer would be redundant. Callers wanting to react to broadcast\n *   errors should catch them at the call site.\n * @throws `ManifestMCPError(TX_FAILED)` when post-broadcast verification\n *   reaches one of two failure modes (both with `onFailure({ reason })`\n *   invoked first):\n *     - the lease is still non-terminal (`pending_drift` branch — state\n *       decoded as PENDING / ACTIVE / similar non-terminal); or\n *     - the chain returns `{ lease: null }` post-close, so the lease is\n *       not visible on-chain (`unclassified` branch).\n * @throws `ManifestMCPError(QUERY_FAILED)` when the post-broadcast verify\n *   chain query (`billing.v1.lease`) raises a non-NotFound error\n *   (RPC / transport / decoding failure). Wrapped inside the verifier\n *   closure so the failure flows through `onFailure({ reason })` before\n *   the throw. Structured `ManifestMCPError`s raised by the chain client\n *   are re-thrown as-is (with `onFailure` invoked first).\n */\nexport async function closeLease(\n  args: CloseLeaseArgs,\n  callbacks: CloseLeaseCallbacks,\n  opts: CloseLeaseOptions,\n): Promise<CloseLeaseResult> {\n  validateArgs(args);\n\n  const block = renderConfirmationBlock(args);\n  if (callbacks.onConfirm) {\n    const yesNo = await callbacks.onConfirm(block);\n    if (yesNo !== 'yes') {\n      throw new ManifestMCPError(\n        ManifestMCPErrorCode.OPERATION_CANCELLED,\n        'User declined to proceed with close-lease.',\n      );\n    }\n  }\n  callbacks.onProgress?.({ kind: 'user_confirmed' });\n\n  await stopApp(opts.clientManager, args.leaseUuid);\n\n  // Direct single-lease query (Copilot review PR #60, comment 3275999624):\n  // the previous `leasesByTenant` + page-1-only pagination would\n  // false-`not_found` for tenants with >100 leases. `billing.v1.lease`\n  // is the same query shape `troubleshoot.ts` already uses; it's\n  // tenant-agnostic and bounded to a single lease.\n  const spec: VerificationSpec<unknown, CloseOutcome, CloseDiag> = {\n    verifier: async () => {\n      // Wrap the chain call in try/catch (Copilot review PR #60,\n      // comment 3276419264): if `billing.v1.lease` rejects (RPC down,\n      // transport, structured `ManifestMCPError`), the error would\n      // otherwise propagate OUT of `verifyAndRecover` and bypass the\n      // post-verify `onFailure({ reason })` callback below. Mirror\n      // the disambiguation pattern from `lookupDomain` (commit aaa5cc5)\n      // and `troubleshootDeployment` (commit f1a4737): invoke\n      // `onFailure` first, then re-throw `ManifestMCPError` as-is or\n      // wrap plain errors as `QUERY_FAILED`.\n      let result: unknown;\n      try {\n        const queryClient = await opts.clientManager.getQueryClient();\n        result = await queryClient.liftedinit.billing.v1.lease({\n          leaseUuid: args.leaseUuid,\n        });\n      } catch (err) {\n        const reason = `Failed to query lease ${args.leaseUuid} during close-verify: ${\n          err instanceof Error ? err.message : String(err)\n        }`;\n        if (callbacks.onFailure) {\n          await callbacks.onFailure({ reason });\n        }\n        if (err instanceof ManifestMCPError) {\n          throw err;\n        }\n        throw new ManifestMCPError(ManifestMCPErrorCode.QUERY_FAILED, reason);\n      }\n      const lease = (result as { lease?: unknown })?.lease;\n      if (lease === null || lease === undefined) {\n        return {\n          outcome: 'not_found' as const,\n          diagnostic: {\n            reason: `lease ${args.leaseUuid} not visible on chain after close`,\n          },\n        };\n      }\n      const rawState = (lease as { state?: unknown }).state;\n      const stateName = decodeLeaseState(\n        typeof rawState === 'number' || typeof rawState === 'string'\n          ? rawState\n          : undefined,\n      );\n      if (stateName === undefined) {\n        return {\n          outcome: 'pending' as const,\n          diagnostic: {\n            reason: `lease ${args.leaseUuid} state could not be decoded (raw=${String(rawState)})`,\n          },\n        };\n      }\n      return {\n        outcome: (isTerminal(stateName) ? 'terminal' : 'pending') as\n          | 'terminal'\n          | 'pending',\n        diagnostic: { stateName },\n      };\n    },\n    successValues: ['terminal'],\n    branches: {\n      pending: {\n        branchId: 'pending_drift',\n        journalActionTags: ['close-lease-verify-pending'],\n        buildFailureEnvelope: (d) => ({\n          outcome: 'failed',\n          reason:\n            d.reason ??\n            `close_lease tx accepted but state is still ${d.stateName ?? 'unknown'}.`,\n        }),\n        buildRecoveryOptions: () => [],\n      },\n      not_found: {\n        branchId: 'unclassified',\n        journalActionTags: ['close-lease-verify-not-found'],\n        buildFailureEnvelope: (d) => ({\n          outcome: 'failed',\n          reason:\n            d.reason ??\n            `Lease ${args.leaseUuid} not visible on chain after close.`,\n        }),\n        buildRecoveryOptions: () => [],\n      },\n    },\n  };\n\n  const verifyResult = await verifyAndRecover(spec, undefined);\n\n  if (verifyResult.result !== 'success') {\n    const reason =\n      verifyResult.failure?.reason ?? 'close-lease verification failed.';\n    if (callbacks.onFailure) {\n      await callbacks.onFailure({ reason });\n    }\n    throw new ManifestMCPError(ManifestMCPErrorCode.TX_FAILED, reason);\n  }\n\n  // Invariant: when `verifyAndRecover` returns success, the matched\n  // outcome was `'terminal'`, and the verifier's `terminal` branch\n  // ALWAYS sets `diagnostic.stateName` (see the spec above). A missing\n  // `stateName` on the success path means the verifier invariant is\n  // broken — likely a future refactor regression. The previous\n  // implementation fell back to `'LEASE_STATE_CLOSED'` silently, which\n  // would lie to the caller (Copilot review PR #60, comment 3276719603).\n  // Fail loudly with a typed error instead. `TX_FAILED` is the closest\n  // available code in `ManifestMCPErrorCode` (no `INTERNAL_ERROR`\n  // variant); the message names the invariant explicitly.\n  if (!verifyResult.diagnostic.stateName) {\n    throw new ManifestMCPError(\n      ManifestMCPErrorCode.TX_FAILED,\n      `close-lease verifier invariant violated: success outcome reached without diagnostic.stateName for lease ${args.leaseUuid}`,\n    );\n  }\n  const finalState: LeaseStateName = verifyResult.diagnostic.stateName;\n  const result: CloseLeaseResult = {\n    leaseUuid: args.leaseUuid,\n    finalState,\n  };\n  callbacks.onComplete?.(result);\n  return result;\n}\n\n// --- Helpers --------------------------------------------------------\n\nfunction validateArgs(args: CloseLeaseArgs): void {\n  if (typeof args.leaseUuid !== 'string' || !args.leaseUuid.match(UUID_RE)) {\n    throw new ManifestMCPError(\n      ManifestMCPErrorCode.INVALID_CONFIG,\n      `closeLease: leaseUuid must be a UUID; got \"${args.leaseUuid}\".`,\n    );\n  }\n}\n\nfunction renderConfirmationBlock(args: CloseLeaseArgs): DeploymentPlanBlock {\n  // Image is not tracked in `CloseLeaseArgs` and `stopApp` doesn't return it;\n  // surface the gap explicitly so reviewers/users see the missing context\n  // rather than silently omitting an image field they'd expect.\n  const text = [\n    `Close lease ${args.leaseUuid}.`,\n    '  Image: (image not recorded)',\n    '  This is permanent — the lease cannot be reopened.',\n    '',\n    'Proceed?',\n  ].join('\\n');\n  return { text };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA2CA,MAAM,UACJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCF,eAAsB,WACpB,MACA,WACA,MAC2B;CAC3B,aAAa,IAAI;CAEjB,MAAM,QAAQ,wBAAwB,IAAI;CAC1C,IAAI,UAAU;MAER,MADgB,UAAU,UAAU,KAAK,MAC/B,OACZ,MAAM,IAAI,iBACR,qBAAqB,qBACrB,4CACF;CAAA;CAGJ,UAAU,aAAa,EAAE,MAAM,iBAAiB,CAAC;CAEjD,MAAM,QAAQ,KAAK,eAAe,KAAK,SAAS;CA6FhD,MAAM,eAAe,MAAM,iBAAiB;EArF1C,UAAU,YAAY;GAUpB,IAAI;GACJ,IAAI;IAEF,SAAS,OAAM,MADW,KAAK,cAAc,eAAe,GACjC,WAAW,QAAQ,GAAG,MAAM,EACrD,WAAW,KAAK,UAClB,CAAC;GACH,SAAS,KAAK;IACZ,MAAM,SAAS,yBAAyB,KAAK,UAAU,wBACrD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;IAEjD,IAAI,UAAU,WACZ,MAAM,UAAU,UAAU,EAAE,OAAO,CAAC;IAEtC,IAAI,eAAe,kBACjB,MAAM;IAER,MAAM,IAAI,iBAAiB,qBAAqB,cAAc,MAAM;GACtE;GACA,MAAM,QAAS,QAAgC;GAC/C,IAAI,UAAU,QAAQ,UAAU,KAAA,GAC9B,OAAO;IACL,SAAS;IACT,YAAY,EACV,QAAQ,SAAS,KAAK,UAAU,mCAClC;GACF;GAEF,MAAM,WAAY,MAA8B;GAChD,MAAM,YAAYA,OAChB,OAAO,aAAa,YAAY,OAAO,aAAa,WAChD,WACA,KAAA,CACN;GACA,IAAI,cAAc,KAAA,GAChB,OAAO;IACL,SAAS;IACT,YAAY,EACV,QAAQ,SAAS,KAAK,UAAU,mCAAmC,OAAO,QAAQ,EAAE,GACtF;GACF;GAEF,OAAO;IACL,SAAU,WAAW,SAAS,IAAI,aAAa;IAG/C,YAAY,EAAE,UAAU;GAC1B;EACF;EACA,eAAe,CAAC,UAAU;EAC1B,UAAU;GACR,SAAS;IACP,UAAU;IACV,mBAAmB,CAAC,4BAA4B;IAChD,uBAAuB,OAAO;KAC5B,SAAS;KACT,QACE,EAAE,UACF,8CAA8C,EAAE,aAAa,UAAU;IAC3E;IACA,4BAA4B,CAAC;GAC/B;GACA,WAAW;IACT,UAAU;IACV,mBAAmB,CAAC,8BAA8B;IAClD,uBAAuB,OAAO;KAC5B,SAAS;KACT,QACE,EAAE,UACF,SAAS,KAAK,UAAU;IAC5B;IACA,4BAA4B,CAAC;GAC/B;EACF;CAG6C,GAAG,KAAA,CAAS;CAE3D,IAAI,aAAa,WAAW,WAAW;EACrC,MAAM,SACJ,aAAa,SAAS,UAAU;EAClC,IAAI,UAAU,WACZ,MAAM,UAAU,UAAU,EAAE,OAAO,CAAC;EAEtC,MAAM,IAAI,iBAAiB,qBAAqB,WAAW,MAAM;CACnE;CAYA,IAAI,CAAC,aAAa,WAAW,WAC3B,MAAM,IAAI,iBACR,qBAAqB,WACrB,2GAA2G,KAAK,WAClH;CAEF,MAAM,aAA6B,aAAa,WAAW;CAC3D,MAAM,SAA2B;EAC/B,WAAW,KAAK;EAChB;CACF;CACA,UAAU,aAAa,MAAM;CAC7B,OAAO;AACT;AAIA,SAAS,aAAa,MAA4B;CAChD,IAAI,OAAO,KAAK,cAAc,YAAY,CAAC,KAAK,UAAU,MAAM,OAAO,GACrE,MAAM,IAAI,iBACR,qBAAqB,gBACrB,8CAA8C,KAAK,UAAU,GAC/D;AAEJ;AAEA,SAAS,wBAAwB,MAA2C;CAW1E,OAAO,EAAE,MAPI;EACX,eAAe,KAAK,UAAU;EAC9B;EACA;EACA;EACA;CACF,EAAE,KAAK,IACK,EAAE;AAChB"}
+{"version":3,"file":"close-lease.js","names":["decodeLeaseState"],"sources":["../src/close-lease.ts"],"sourcesContent":["/**\n * Public entry point: orchestrate closing an existing lease via the\n * `close-lease` billing tx.\n *\n * Composition (mirrors `deploy-app.ts` / `manage-domain.ts`):\n *\n *   1. Validate args.\n *   2. Render a confirmation block + optionally consult `onConfirm`.\n *   3. Broadcast `stopApp` (which submits `MsgCloseLease`).\n *   4. Verify the post-broadcast on-chain state via `verifyAndRecover`\n *      driving a direct `billing.v1.lease({ leaseUuid })` query +\n *      `lease-state.decode` + `isTerminal`. Terminal states (CLOSED /\n *      REJECTED / EXPIRED / INSUFFICIENT_FUNDS) count as success;\n *      PENDING / ACTIVE map to the `pending_drift` branch; a chain\n *      response with no lease (`{ lease: null }`) maps to the catch-all\n *      `unclassified` branch.\n *   5. On verify-failure, invoke the simple-form `onFailure({ reason })`\n *      then throw `ManifestMCPError(TX_FAILED)`. On success, emit\n *      `onComplete` with the typed `CloseLeaseResult`.\n */\n\nimport {\n  ManifestMCPError,\n  ManifestMCPErrorCode,\n  noopLogger,\n  parseLeaseUuid,\n  stopApp,\n} from '@manifest-network/manifest-mcp-core';\nimport { makeCancellationScope } from './internals/cancellation.js';\nimport {\n  decode as decodeLeaseState,\n  isTerminal,\n} from './internals/lease-state.js';\nimport {\n  type VerificationSpec,\n  verifyAndRecover,\n} from './internals/verify-recover.js';\nimport type {\n  CloseLeaseArgs,\n  CloseLeaseCallbacks,\n  CloseLeaseOptions,\n  CloseLeaseResult,\n  DeploymentPlanBlock,\n  LeaseStateName,\n} from './types.js';\n\nconst UUID_RE =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\ntype CloseOutcome = 'terminal' | 'pending' | 'not_found';\n\ninterface CloseDiag {\n  stateName?: LeaseStateName;\n  reason?: string;\n}\n\n/**\n * Close a lease and verify it reached a terminal on-chain state.\n *\n * @throws `ManifestMCPError(INVALID_CONFIG)` for args validation.\n * @throws `ManifestMCPError(OPERATION_CANCELLED)` when `onConfirm` returns\n *   `'no'` (deliberate user cancellation — ENG-272).\n * @throws `ManifestMCPError` (typically `TX_FAILED`) propagated as-is\n *   from the `stopApp()` broadcast step. Broadcast errors do NOT invoke\n *   `onFailure` — that callback is reserved for post-broadcast\n *   verification failures. `stopApp` already raises a structured\n *   `ManifestMCPError` from the core package; wrapping it again at this\n *   layer would be redundant. Callers wanting to react to broadcast\n *   errors should catch them at the call site.\n * @throws `ManifestMCPError(TX_FAILED)` when post-broadcast verification\n *   reaches one of two failure modes (both with `onFailure({ reason })`\n *   invoked first):\n *     - the lease is still non-terminal (`pending_drift` branch — state\n *       decoded as PENDING / ACTIVE / similar non-terminal); or\n *     - the chain returns `{ lease: null }` post-close, so the lease is\n *       not visible on-chain (`unclassified` branch).\n * @throws `ManifestMCPError(QUERY_FAILED)` when the post-broadcast verify\n *   chain query (`billing.v1.lease`) raises a non-NotFound error\n *   (RPC / transport / decoding failure). Wrapped inside the verifier\n *   closure so the failure flows through `onFailure({ reason })` before\n *   the throw. Structured `ManifestMCPError`s raised by the chain client\n *   are re-thrown as-is (with `onFailure` invoked first).\n */\nexport async function closeLease(\n  args: CloseLeaseArgs,\n  callbacks: CloseLeaseCallbacks,\n  opts: CloseLeaseOptions,\n): Promise<CloseLeaseResult> {\n  validateArgs(args);\n\n  const cx = makeCancellationScope({\n    opts,\n    onProgress: callbacks.onProgress,\n    opLabel: 'Lease close',\n    broadcasts: true,\n  });\n  cx.throwIfCancelled();\n\n  const block = renderConfirmationBlock(args);\n  if (callbacks.onConfirm) {\n    const yesNo = await cx.race(callbacks.onConfirm(block));\n    if (yesNo !== 'yes') {\n      throw new ManifestMCPError(\n        ManifestMCPErrorCode.OPERATION_CANCELLED,\n        'User declined to proceed with close-lease.',\n      );\n    }\n  }\n  callbacks.onProgress?.({ kind: 'user_confirmed' });\n\n  cx.throwIfCancelled();\n\n  // txCtx has no signer (ManageDomain/CloseLease flows carry no walletProvider);\n  // the sender resolves from ctx.chain (the CosmosClientManager wallet). See OI-SENDER.\n  await stopApp(\n    { chain: opts.clientManager, logger: noopLogger },\n    { leaseUuid: parseLeaseUuid(args.leaseUuid) },\n  );\n\n  // Direct single-lease query (Copilot review PR #60, comment 3275999624):\n  // the previous `leasesByTenant` + page-1-only pagination would\n  // false-`not_found` for tenants with >100 leases. `billing.v1.lease`\n  // is the same query shape `troubleshoot.ts` already uses; it's\n  // tenant-agnostic and bounded to a single lease.\n  const spec: VerificationSpec<unknown, CloseOutcome, CloseDiag> = {\n    verifier: async () => {\n      // Wrap the chain call in try/catch (Copilot review PR #60,\n      // comment 3276419264): if `billing.v1.lease` rejects (RPC down,\n      // transport, structured `ManifestMCPError`), the error would\n      // otherwise propagate OUT of `verifyAndRecover` and bypass the\n      // post-verify `onFailure({ reason })` callback below. Mirror\n      // the disambiguation pattern from `lookupDomain` (commit aaa5cc5)\n      // and `troubleshootDeployment` (commit f1a4737): invoke\n      // `onFailure` first, then re-throw `ManifestMCPError` as-is or\n      // wrap plain errors as `QUERY_FAILED`.\n      let result: unknown;\n      try {\n        const queryClient = await opts.clientManager.getQueryClient();\n        result = await queryClient.liftedinit.billing.v1.lease({\n          leaseUuid: args.leaseUuid,\n        });\n      } catch (err) {\n        const reason = `Failed to query lease ${args.leaseUuid} during close-verify: ${\n          err instanceof Error ? err.message : String(err)\n        }`;\n        if (callbacks.onFailure) {\n          await callbacks.onFailure({ reason });\n        }\n        if (err instanceof ManifestMCPError) {\n          throw err;\n        }\n        throw new ManifestMCPError(ManifestMCPErrorCode.QUERY_FAILED, reason);\n      }\n      const lease = (result as { lease?: unknown })?.lease;\n      if (lease === null || lease === undefined) {\n        return {\n          outcome: 'not_found' as const,\n          diagnostic: {\n            reason: `lease ${args.leaseUuid} not visible on chain after close`,\n          },\n        };\n      }\n      const rawState = (lease as { state?: unknown }).state;\n      const stateName = decodeLeaseState(\n        typeof rawState === 'number' || typeof rawState === 'string'\n          ? rawState\n          : undefined,\n      );\n      if (stateName === undefined) {\n        return {\n          outcome: 'pending' as const,\n          diagnostic: {\n            reason: `lease ${args.leaseUuid} state could not be decoded (raw=${String(rawState)})`,\n          },\n        };\n      }\n      return {\n        outcome: (isTerminal(stateName) ? 'terminal' : 'pending') as\n          | 'terminal'\n          | 'pending',\n        diagnostic: { stateName },\n      };\n    },\n    successValues: ['terminal'],\n    branches: {\n      pending: {\n        branchId: 'pending_drift',\n        journalActionTags: ['close-lease-verify-pending'],\n        buildFailureEnvelope: (d) => ({\n          outcome: 'failed',\n          reason:\n            d.reason ??\n            `close_lease tx accepted but state is still ${d.stateName ?? 'unknown'}.`,\n        }),\n        buildRecoveryOptions: () => [],\n      },\n      not_found: {\n        branchId: 'unclassified',\n        journalActionTags: ['close-lease-verify-not-found'],\n        buildFailureEnvelope: (d) => ({\n          outcome: 'failed',\n          reason:\n            d.reason ??\n            `Lease ${args.leaseUuid} not visible on chain after close.`,\n        }),\n        buildRecoveryOptions: () => [],\n      },\n    },\n  };\n\n  const verifyResult = await verifyAndRecover(spec, undefined);\n\n  if (verifyResult.result !== 'success') {\n    const reason =\n      verifyResult.failure?.reason ?? 'close-lease verification failed.';\n    if (callbacks.onFailure) {\n      await callbacks.onFailure({ reason });\n    }\n    throw new ManifestMCPError(ManifestMCPErrorCode.TX_FAILED, reason);\n  }\n\n  // Invariant: when `verifyAndRecover` returns success, the matched\n  // outcome was `'terminal'`, and the verifier's `terminal` branch\n  // ALWAYS sets `diagnostic.stateName` (see the spec above). A missing\n  // `stateName` on the success path means the verifier invariant is\n  // broken — likely a future refactor regression. The previous\n  // implementation fell back to `'LEASE_STATE_CLOSED'` silently, which\n  // would lie to the caller (Copilot review PR #60, comment 3276719603).\n  // Fail loudly with a typed error instead. `TX_FAILED` is the closest\n  // available code in `ManifestMCPErrorCode` (no `INTERNAL_ERROR`\n  // variant); the message names the invariant explicitly.\n  if (!verifyResult.diagnostic.stateName) {\n    throw new ManifestMCPError(\n      ManifestMCPErrorCode.TX_FAILED,\n      `close-lease verifier invariant violated: success outcome reached without diagnostic.stateName for lease ${args.leaseUuid}`,\n    );\n  }\n  const finalState: LeaseStateName = verifyResult.diagnostic.stateName;\n  const result: CloseLeaseResult = {\n    leaseUuid: args.leaseUuid,\n    finalState,\n  };\n  callbacks.onComplete?.(result);\n  return result;\n}\n\n// --- Helpers --------------------------------------------------------\n\nfunction validateArgs(args: CloseLeaseArgs): void {\n  if (typeof args.leaseUuid !== 'string' || !args.leaseUuid.match(UUID_RE)) {\n    throw new ManifestMCPError(\n      ManifestMCPErrorCode.INVALID_CONFIG,\n      `closeLease: leaseUuid must be a UUID; got \"${args.leaseUuid}\".`,\n    );\n  }\n}\n\nfunction renderConfirmationBlock(args: CloseLeaseArgs): DeploymentPlanBlock {\n  // Image is not tracked in `CloseLeaseArgs` and `stopApp` doesn't return it;\n  // surface the gap explicitly so reviewers/users see the missing context\n  // rather than silently omitting an image field they'd expect.\n  const text = [\n    `Close lease ${args.leaseUuid}.`,\n    '  Image: (image not recorded)',\n    '  This is permanent — the lease cannot be reopened.',\n    '',\n    'Proceed?',\n  ].join('\\n');\n  return { text };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AA8CA,MAAM,UACJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCF,eAAsB,WACpB,MACA,WACA,MAC2B;CAC3B,aAAa,IAAI;CAEjB,MAAM,KAAK,sBAAsB;EAC/B;EACA,YAAY,UAAU;EACtB,SAAS;EACT,YAAY;CACd,CAAC;CACD,GAAG,iBAAiB;CAEpB,MAAM,QAAQ,wBAAwB,IAAI;CAC1C,IAAI,UAAU;MAER,MADgB,GAAG,KAAK,UAAU,UAAU,KAAK,CAAC,MACxC,OACZ,MAAM,IAAI,iBACR,qBAAqB,qBACrB,4CACF;CAAA;CAGJ,UAAU,aAAa,EAAE,MAAM,iBAAiB,CAAC;CAEjD,GAAG,iBAAiB;CAIpB,MAAM,QACJ;EAAE,OAAO,KAAK;EAAe,QAAQ;CAAW,GAChD,EAAE,WAAW,eAAe,KAAK,SAAS,EAAE,CAC9C;CA6FA,MAAM,eAAe,MAAM,iBAAiB;EArF1C,UAAU,YAAY;GAUpB,IAAI;GACJ,IAAI;IAEF,SAAS,OAAM,MADW,KAAK,cAAc,eAAe,GACjC,WAAW,QAAQ,GAAG,MAAM,EACrD,WAAW,KAAK,UAClB,CAAC;GACH,SAAS,KAAK;IACZ,MAAM,SAAS,yBAAyB,KAAK,UAAU,wBACrD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;IAEjD,IAAI,UAAU,WACZ,MAAM,UAAU,UAAU,EAAE,OAAO,CAAC;IAEtC,IAAI,eAAe,kBACjB,MAAM;IAER,MAAM,IAAI,iBAAiB,qBAAqB,cAAc,MAAM;GACtE;GACA,MAAM,QAAS,QAAgC;GAC/C,IAAI,UAAU,QAAQ,UAAU,KAAA,GAC9B,OAAO;IACL,SAAS;IACT,YAAY,EACV,QAAQ,SAAS,KAAK,UAAU,mCAClC;GACF;GAEF,MAAM,WAAY,MAA8B;GAChD,MAAM,YAAYA,OAChB,OAAO,aAAa,YAAY,OAAO,aAAa,WAChD,WACA,KAAA,CACN;GACA,IAAI,cAAc,KAAA,GAChB,OAAO;IACL,SAAS;IACT,YAAY,EACV,QAAQ,SAAS,KAAK,UAAU,mCAAmC,OAAO,QAAQ,EAAE,GACtF;GACF;GAEF,OAAO;IACL,SAAU,WAAW,SAAS,IAAI,aAAa;IAG/C,YAAY,EAAE,UAAU;GAC1B;EACF;EACA,eAAe,CAAC,UAAU;EAC1B,UAAU;GACR,SAAS;IACP,UAAU;IACV,mBAAmB,CAAC,4BAA4B;IAChD,uBAAuB,OAAO;KAC5B,SAAS;KACT,QACE,EAAE,UACF,8CAA8C,EAAE,aAAa,UAAU;IAC3E;IACA,4BAA4B,CAAC;GAC/B;GACA,WAAW;IACT,UAAU;IACV,mBAAmB,CAAC,8BAA8B;IAClD,uBAAuB,OAAO;KAC5B,SAAS;KACT,QACE,EAAE,UACF,SAAS,KAAK,UAAU;IAC5B;IACA,4BAA4B,CAAC;GAC/B;EACF;CAG6C,GAAG,KAAA,CAAS;CAE3D,IAAI,aAAa,WAAW,WAAW;EACrC,MAAM,SACJ,aAAa,SAAS,UAAU;EAClC,IAAI,UAAU,WACZ,MAAM,UAAU,UAAU,EAAE,OAAO,CAAC;EAEtC,MAAM,IAAI,iBAAiB,qBAAqB,WAAW,MAAM;CACnE;CAYA,IAAI,CAAC,aAAa,WAAW,WAC3B,MAAM,IAAI,iBACR,qBAAqB,WACrB,2GAA2G,KAAK,WAClH;CAEF,MAAM,aAA6B,aAAa,WAAW;CAC3D,MAAM,SAA2B;EAC/B,WAAW,KAAK;EAChB;CACF;CACA,UAAU,aAAa,MAAM;CAC7B,OAAO;AACT;AAIA,SAAS,aAAa,MAA4B;CAChD,IAAI,OAAO,KAAK,cAAc,YAAY,CAAC,KAAK,UAAU,MAAM,OAAO,GACrE,MAAM,IAAI,iBACR,qBAAqB,gBACrB,8CAA8C,KAAK,UAAU,GAC/D;AAEJ;AAEA,SAAS,wBAAwB,MAA2C;CAW1E,OAAO,EAAE,MAPI;EACX,eAAe,KAAK,UAAU;EAC9B;EACA;EACA;EACA;CACF,EAAE,KAAK,IACK,EAAE;AAChB"}

package/dist/deploy-app.d.ts

@@ -1,4 +1,4 @@
-import { DeployAppCallbacks, DeployAppOptions, DeployResult, DeploySpec } from "./types.js";
+import { AppDeploySpec, DeployAppCallbacks, DeployAppOptions, DeployResult } from "./types.js";
 
 //#region src/deploy-app.d.ts
 /**
@@ -19,7 +19,7 @@ import { DeployAppCallbacks, DeployAppOptions, DeployResult, DeploySpec } from "
  * branch) throw directly as `ManifestMCPError(TX_FAILED)` without
  * invoking `onFailure`.
  */
-declare function deployApp(spec: DeploySpec, callbacks: DeployAppCallbacks, opts: DeployAppOptions): Promise<DeployResult>;
+declare function deployApp(spec: AppDeploySpec, callbacks: DeployAppCallbacks, opts: DeployAppOptions): Promise<DeployResult>;
 //#endregion
 export { deployApp };
 //# sourceMappingURL=deploy-app.d.ts.map

package/dist/deploy-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-app.d.ts","names":[],"sources":["../src/deploy-app.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;iBAkIsB,SAAA,CACpB,IAAA,EAAM,UAAA,EACN,SAAA,EAAW,kBAAA,EACX,IAAA,EAAM,gBAAA,GACL,OAAA,CAAQ,YAAA"}
+{"version":3,"file":"deploy-app.d.ts","names":[],"sources":["../src/deploy-app.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;iBAqIsB,SAAA,CACpB,IAAA,EAAM,aAAA,EACN,SAAA,EAAW,kBAAA,EACX,IAAA,EAAM,gBAAA,GACL,OAAA,CAAQ,YAAA"}

package/dist/deploy-app.js

@@ -1,20 +1,20 @@
+import { makeCancellationScope } from "./internals/cancellation.js";
 import { decode } from "./internals/lease-state.js";
-import { isStackSpec, summarizeSpec, validateSpec } from "./internals/spec-normalize.js";
-import { buildFredDeployInput, buildManifestPreviewInput } from "./internals/build-fred-input.js";
 import { classifyDeployError } from "./internals/classify-deploy-error.js";
 import { extractRunningEndpoints, formatEndpointAsUrl, normalizeFredUrl } from "./internals/connection.js";
 import { classifyDeployResponse } from "./internals/classify-deploy-response.js";
 import { EMPTY_DENOM_MAP, loadChainDenomMap } from "./internals/humanize-denom.js";
 import { evaluateReadinessFromFredResponse } from "./internals/evaluate-readiness-from-fred.js";
 import { renderDeploymentPlan } from "./internals/render-deployment-plan.js";
+import { isStackSpec, summarizeSpec, validateSpec } from "./internals/spec-normalize.js";
 import { renderIntentRecap } from "./internals/render-intent-recap.js";
 import { renderPartialSuccessPrompt } from "./internals/render-partial-success-prompt.js";
-import { ManifestMCPError, ManifestMCPErrorCode, cosmosEstimateFee, resolveSku, setItemCustomDomain, stopApp } from "@manifest-network/manifest-mcp-core";
+import { ManifestMCPError, ManifestMCPErrorCode, asLeaseUuid, asProviderUuid, cosmosEstimateFee, noopLogger, parseFqdn, parseLeaseUuid, resolveSku, setItemCustomDomain, stopApp } from "@manifest-network/manifest-mcp-core";
 import { AuthTimestampTracker, buildManifestPreview, checkDeploymentReadiness, createAuthToken, createLeaseDataSignMessage, createSignMessage, deployApp as deployApp$1, fetchActiveLease, pollLeaseUntilReady, resolveProviderUrl, uploadLeaseData, waitForAppReady } from "@manifest-network/manifest-mcp-fred";
 //#region src/deploy-app.ts
 /**
 * Public entry point: orchestrate a Manifest-Network app deployment from
-* a typed `DeploySpec` through the plan/confirm/broadcast/save flow.
+* a typed `AppDeploySpec` through the plan/confirm/broadcast/save flow.
 *
 * Architect's α-locked composition (post-PR-3 sub-plan Q1):
 *
@@ -75,6 +75,13 @@ async function deployApp(spec, callbacks, opts) {
 		throw new ManifestMCPError(ManifestMCPErrorCode.INVALID_CONFIG, err instanceof Error ? err.message : `Invalid spec: ${String(err)}`);
 	}
 	if (typeof opts.walletProvider.signArbitrary !== "function") throw new ManifestMCPError(ManifestMCPErrorCode.INVALID_CONFIG, "opts.walletProvider must implement signArbitrary for ADR-036 auth tokens.");
+	const { signal, throwIfCancelled, race } = makeCancellationScope({
+		opts,
+		onProgress: callbacks.onProgress,
+		opLabel: "Deployment",
+		broadcasts: true
+	});
+	throwIfCancelled();
 	const walletAddress = await opts.walletProvider.getAddress();
 	const clientAddress = await opts.clientManager.getAddress();
 	if (walletAddress !== clientAddress) throw new ManifestMCPError(ManifestMCPErrorCode.INVALID_CONFIG, `opts.walletProvider and opts.clientManager are bound to different addresses (walletProvider=${walletAddress}, clientManager=${clientAddress}); they must reference the same wallet to avoid creating an orphaned lease on the clientManager wallet when ADR-036 auth (signed by walletProvider) fails.`);
@@ -83,12 +90,17 @@ async function deployApp(spec, callbacks, opts) {
 	const chainId = opts.clientManager.getConfig().chainId;
 	const activeChain = /mainnet|main/i.test(chainId) ? "mainnet" : "testnet";
 	const queryClient = await opts.clientManager.getQueryClient();
+	const readCtx = {
+		query: queryClient,
+		chain: opts.clientManager,
+		logger: noopLogger
+	};
 	const resolvePin = async (s) => {
 		const providerUuid = requestedProviderUuid(s);
 		const skuUuid = requestedSkuUuid(s);
 		try {
 			return {
-				pin: await resolveSku(queryClient, {
+				pin: await resolveSku(readCtx, {
 					size: requestedSize(s),
 					...providerUuid !== void 0 ? { providerUuid } : {},
 					...skuUuid !== void 0 ? { skuUuid } : {}
@@ -102,9 +114,9 @@ async function deployApp(spec, callbacks, opts) {
 					kind: "sku_ambiguous",
 					candidates
 				});
-				const pick = await callbacks.onResolveSku(candidates);
+				const pick = await race(callbacks.onResolveSku(candidates));
 				return {
-					pin: await resolveSku(queryClient, {
+					pin: await resolveSku(readCtx, {
 						size: requestedSize(s),
 						skuUuid: pick.skuUuid,
 						providerUuid: pick.providerUuid
@@ -116,7 +128,7 @@ async function deployApp(spec, callbacks, opts) {
 		}
 	};
 	let { pin: pinned, elicited: pinElicited } = await resolvePin(spec);
-	let readiness = evaluateReadinessFromFredResponse(await checkDeploymentReadiness(queryClient, tenantAddress, {
+	let readiness = evaluateReadinessFromFredResponse(await checkDeploymentReadiness(readCtx, tenantAddress, {
 		image: primaryImage(spec),
 		size: pinned.name,
 		providerUuid: pinned.providerUuid,
@@ -130,7 +142,7 @@ async function deployApp(spec, callbacks, opts) {
 		`${readiness.reasons.join("; ")}`;
 		throw new ManifestMCPError(ManifestMCPErrorCode.INVALID_CONFIG, `Readiness check failed: ${readiness.reasons.join("; ")}`);
 	}
-	let preview = await buildManifestPreview(buildManifestPreviewInput(spec, requestedSize(spec)));
+	let preview = await buildManifestPreview(spec);
 	let summary = summarizeSpec(spec);
 	let fees = await estimateFees(opts, spec, preview.meta_hash_hex, pinned.skuUuid);
 	let plan = {
@@ -158,7 +170,7 @@ async function deployApp(spec, callbacks, opts) {
 		block
 	});
 	if (callbacks.onPlan) {
-		const verdict = await callbacks.onPlan(plan);
+		const verdict = await race(callbacks.onPlan(plan));
 		if (verdict === "cancel") throw new ManifestMCPError(ManifestMCPErrorCode.OPERATION_CANCELLED, "User cancelled deployment at plan step.");
 		if (verdict !== "confirm") {
 			confirmedSpec = applyPlanEdit(confirmedSpec, verdict);
@@ -173,7 +185,7 @@ async function deployApp(spec, callbacks, opts) {
 				skuUuid: pinned.skuUuid,
 				providerUuid: pinned.providerUuid
 			};
-			readiness = evaluateReadinessFromFredResponse(await checkDeploymentReadiness(queryClient, tenantAddress, {
+			readiness = evaluateReadinessFromFredResponse(await checkDeploymentReadiness(readCtx, tenantAddress, {
 				image: primaryImage(confirmedSpec),
 				size: pinned.name,
 				providerUuid: pinned.providerUuid,
@@ -184,7 +196,7 @@ async function deployApp(spec, callbacks, opts) {
 				readiness
 			});
 			if (readiness.status === "block") throw new ManifestMCPError(ManifestMCPErrorCode.INVALID_CONFIG, `Post-edit readiness check failed: ${readiness.reasons.join("; ")}`);
-			preview = await buildManifestPreview(buildManifestPreviewInput(confirmedSpec, requestedSize(confirmedSpec)));
+			preview = await buildManifestPreview(confirmedSpec);
 			summary = summarizeSpec(confirmedSpec);
 			fees = await estimateFees(opts, confirmedSpec, preview.meta_hash_hex, pinned.skuUuid);
 			plan = {
@@ -213,7 +225,7 @@ async function deployApp(spec, callbacks, opts) {
 		activeChain
 	}) };
 	if (callbacks.onConfirm) {
-		if (await callbacks.onConfirm(recapBlock) !== "yes") throw new ManifestMCPError(ManifestMCPErrorCode.OPERATION_CANCELLED, "User declined to proceed at intent-recap step.");
+		if (await race(callbacks.onConfirm(recapBlock)) !== "yes") throw new ManifestMCPError(ManifestMCPErrorCode.OPERATION_CANCELLED, "User declined to proceed at intent-recap step.");
 	}
 	callbacks.onProgress?.({ kind: "user_confirmed" });
 	const signArbitrary = opts.walletProvider.signArbitrary.bind(opts.walletProvider);
@@ -228,14 +240,26 @@ async function deployApp(spec, callbacks, opts) {
 		const { pub_key, signature } = await signArbitrary(address, createLeaseDataSignMessage(leaseUuid, metaHashHex, ts));
 		return createAuthToken(address, leaseUuid, ts, pub_key.value, signature, metaHashHex);
 	};
+	throwIfCancelled();
 	callbacks.onProgress?.({ kind: "deploy_app_broadcast" });
-	const fredInput = buildFredDeployInput(confirmedSpec, pinned.name, {
+	const fredInput = {
+		...confirmedSpec,
+		size: pinned.name,
 		skuUuid: pinned.skuUuid,
 		providerUuid: pinned.providerUuid
-	});
+	};
 	let fredResult;
 	try {
-		fredResult = await deployApp$1(opts.clientManager, getAuthToken, getLeaseDataAuthToken, fredInput, opts.fetchFn);
+		fredResult = await deployApp$1({
+			query: queryClient,
+			chain: opts.clientManager,
+			fetch: opts.fetchFn ?? globalThis.fetch,
+			logger: noopLogger,
+			providerAuth: {
+				providerToken: (i) => getAuthToken(i.address, i.leaseUuid),
+				leaseDataToken: (i) => getLeaseDataAuthToken(i.address, i.leaseUuid, i.metaHashHex)
+			}
+		}, fredInput, signal ? { abortSignal: signal } : {});
 	} catch (err) {
 		const recoveryCtx = {
 			manifestJson: preview.manifest_json,
@@ -267,7 +291,19 @@ async function deployApp(spec, callbacks, opts) {
 		let attempt = 0;
 		let pollResult;
 		try {
-			pollResult = await waitForAppReady(queryClient, tenantAddress, leaseUuid, getAuthToken, {
+			pollResult = await waitForAppReady({
+				query: queryClient,
+				chain: opts.clientManager,
+				fetch: opts.fetchFn ?? globalThis.fetch,
+				logger: noopLogger,
+				providerAuth: {
+					providerToken: (i) => getAuthToken(i.address, i.leaseUuid),
+					leaseDataToken: (i) => getLeaseDataAuthToken(i.address, i.leaseUuid, i.metaHashHex)
+				}
+			}, {
+				address: tenantAddress,
+				leaseUuid
+			}, {
 				timeoutMs: opts.waitForReadyTimeoutMs ?? 48e4,
 				onProgress: (status) => {
 					attempt += 1;
@@ -280,7 +316,7 @@ async function deployApp(spec, callbacks, opts) {
 						...stateName !== void 0 ? { state: stateName } : {}
 					});
 				}
-			}, opts.fetchFn);
+			});
 		} catch (err) {
 			const reason = err instanceof Error ? `wait_for_app_ready failed for lease ${leaseUuid}: ${err.message}` : `wait_for_app_ready failed for lease ${leaseUuid}: ${String(err)}`;
 			throw new ManifestMCPError(ManifestMCPErrorCode.TX_FAILED, reason);
@@ -298,8 +334,8 @@ async function deployApp(spec, callbacks, opts) {
 		}
 		fredResult = {
 			...fredResult,
-			lease_uuid: pollResult.lease_uuid,
-			provider_uuid: pollResult.provider_uuid,
+			lease_uuid: asLeaseUuid(pollResult.lease_uuid),
+			provider_uuid: asProviderUuid(pollResult.provider_uuid),
 			provider_url: pollResult.provider_url
 		};
 		liveState = pollResult.status.state;
@@ -353,15 +389,13 @@ function primaryImage(spec) {
 	return spec.image ?? "";
 }
 function requestedSize(spec) {
-	const recorded = spec.size;
-	return typeof recorded === "string" && recorded.length > 0 ? recorded : "small";
+	return spec.size;
 }
 /**
 * SKU disambiguator intent helpers. `providerUuid` / `skuUuid` are
-* first-class optional fields on both `DeploySpec` variants (ENG-296,
-* mirroring ENG-275's typed `size`). Returns `undefined` for absent /
-* empty values so `resolveSku` only narrows when a real disambiguator is
-* supplied.
+* first-class optional fields on `AppDeploySpec` (ENG-296, mirroring
+* ENG-275's typed `size`). Returns `undefined` for absent / empty values
+* so `resolveSku` only narrows when a real disambiguator is supplied.
 */
 function requestedProviderUuid(spec) {
 	const v = spec.providerUuid;
@@ -426,11 +460,10 @@ function applyPlanEdit(spec, edit) {
 				}
 			};
 		}
-		const single = spec;
 		return {
-			...single,
+			...spec,
 			env: {
-				...single.env ?? {},
+				...spec.env ?? {},
 				...edit.env
 			}
 		};
@@ -478,7 +511,10 @@ async function dispatchRecovery(choice, envelope, spec, opts, callbacks, ctx) {
 		case "salvage_without_domain": throw new ManifestMCPError(ManifestMCPErrorCode.TX_FAILED, `salvage_without_domain: lease ${leaseUuid} retained without domain; caller should re-run troubleshootDeployment.`);
 		case "cancel_lease":
 		case "close_lease":
-			await stopApp(opts.clientManager, leaseUuid);
+			await stopApp({
+				chain: opts.clientManager,
+				logger: noopLogger
+			}, { leaseUuid: parseLeaseUuid(leaseUuid) });
 			throw new ManifestMCPError(ManifestMCPErrorCode.TX_FAILED, `${choice.id}: lease ${leaseUuid} closed.`);
 	}
 	throw new ManifestMCPError(ManifestMCPErrorCode.TX_FAILED, `Unknown recovery option: ${choice.id}`);
@@ -537,19 +573,30 @@ async function retrySetDomainAndComplete(leaseUuid, spec, opts, callbacks, ctx)
 	const domain = customDomainOf(spec);
 	if (!domain) throw new ManifestMCPError(ManifestMCPErrorCode.INVALID_CONFIG, "retry_set_domain requires a customDomain in spec.");
 	const serviceName = customDomainServiceOf(spec);
-	const setItemOpts = serviceName ? { serviceName } : void 0;
 	try {
-		await setItemCustomDomain(opts.clientManager, leaseUuid, domain, setItemOpts);
+		await setItemCustomDomain({
+			chain: opts.clientManager,
+			logger: noopLogger
+		}, {
+			leaseUuid: parseLeaseUuid(leaseUuid),
+			customDomain: parseFqdn(domain),
+			serviceName
+		});
 	} catch (err) {
 		const reason = err instanceof Error ? `retry_set_domain set-item-custom-domain failed for lease ${leaseUuid}: ${err.message}` : `retry_set_domain set-item-custom-domain failed for lease ${leaseUuid}: ${String(err)}`;
 		throw new ManifestMCPError(err instanceof ManifestMCPError ? err.code : ManifestMCPErrorCode.TX_FAILED, reason);
 	}
-	const queryClient = await opts.clientManager.getQueryClient();
+	const readCtx = {
+		query: await opts.clientManager.getQueryClient(),
+		chain: opts.clientManager,
+		fetch: opts.fetchFn ?? globalThis.fetch,
+		logger: noopLogger
+	};
 	let lease;
 	let providerApiUrl;
 	try {
-		lease = await fetchActiveLease(queryClient, leaseUuid, "cannot complete retry_set_domain");
-		providerApiUrl = await resolveProviderUrl(queryClient, lease.providerUuid);
+		lease = await fetchActiveLease(readCtx, leaseUuid, "cannot complete retry_set_domain");
+		providerApiUrl = await resolveProviderUrl(readCtx, lease.providerUuid);
 	} catch (err) {
 		const reason = err instanceof Error ? `retry_set_domain failed to resolve provider for lease ${leaseUuid}: ${err.message}` : `retry_set_domain failed to resolve provider for lease ${leaseUuid}: ${String(err)}`;
 		throw new ManifestMCPError(err instanceof ManifestMCPError ? err.code : ManifestMCPErrorCode.TX_FAILED, reason);