@manifest-network/manifest-agent-core 0.9.0 → 0.11.0

package/README.md

@@ -2,7 +2,7 @@
 
 TypeScript orchestration surface for Manifest agent flows. This package owns the deploy / manage-domain / troubleshoot / close-lease orchestration that host surfaces consume in lockstep — a bug fix in the core's recovery branch fixes every host surface simultaneously.
 
-> **Status.** All four orchestration functions have real implementations as of ENG-129 (PRs 1–4). The package remains `private: true` pending a publish decision; do not depend on it from external repos yet.
+> **Status.** Publicly published on npm as `@manifest-network/manifest-agent-core` (ENG-129). Consume via `npm install @manifest-network/manifest-agent-core`. The MCP-server adapter that wraps this orchestration surface via elicitation lives at [`@manifest-network/manifest-mcp-agent`](../agent/README.md).
 
 See [ENG-127](https://linear.app/liftedinit/issue/ENG-127) for the broader initiative and [ENG-128](https://linear.app/liftedinit/issue/ENG-128) for the bootstrap PR.
 

package/dist/close-lease.d.ts

@@ -4,8 +4,9 @@ import { CloseLeaseArgs, CloseLeaseCallbacks, CloseLeaseOptions, CloseLeaseResul
 /**
  * Close a lease and verify it reached a terminal on-chain state.
  *
- * @throws `ManifestMCPError(INVALID_CONFIG)` for args validation or when
- *   `onConfirm` returns `'no'`.
+ * @throws `ManifestMCPError(INVALID_CONFIG)` for args validation.
+ * @throws `ManifestMCPError(OPERATION_CANCELLED)` when `onConfirm` returns
+ *   `'no'` (deliberate user cancellation — ENG-272).
  * @throws `ManifestMCPError` (typically `TX_FAILED`) propagated as-is
  *   from the `stopApp()` broadcast step. Broadcast errors do NOT invoke
  *   `onFailure` — that callback is reserved for post-broadcast

package/dist/close-lease.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"close-lease.d.ts","names":[],"sources":["../src/close-lease.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+EsB,UAAA,CACpB,IAAA,EAAM,cAAA,EACN,SAAA,EAAW,mBAAA,EACX,IAAA,EAAM,iBAAA,GACL,OAAA,CAAQ,gBAAA"}
+{"version":3,"file":"close-lease.d.ts","names":[],"sources":["../src/close-lease.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgFsB,UAAA,CACpB,IAAA,EAAM,cAAA,EACN,SAAA,EAAW,mBAAA,EACX,IAAA,EAAM,iBAAA,GACL,OAAA,CAAQ,gBAAA"}

package/dist/close-lease.js

@@ -26,8 +26,9 @@ const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
 /**
 * Close a lease and verify it reached a terminal on-chain state.
 *
-* @throws `ManifestMCPError(INVALID_CONFIG)` for args validation or when
-*   `onConfirm` returns `'no'`.
+* @throws `ManifestMCPError(INVALID_CONFIG)` for args validation.
+* @throws `ManifestMCPError(OPERATION_CANCELLED)` when `onConfirm` returns
+*   `'no'` (deliberate user cancellation — ENG-272).
 * @throws `ManifestMCPError` (typically `TX_FAILED`) propagated as-is
 *   from the `stopApp()` broadcast step. Broadcast errors do NOT invoke
 *   `onFailure` — that callback is reserved for post-broadcast
@@ -53,7 +54,7 @@ async function closeLease(args, callbacks, opts) {
 	validateArgs(args);
 	const block = renderConfirmationBlock(args);
 	if (callbacks.onConfirm) {
-		if (await callbacks.onConfirm(block) !== "yes") throw new ManifestMCPError(ManifestMCPErrorCode.INVALID_CONFIG, "User declined to proceed with close-lease.");
+		if (await callbacks.onConfirm(block) !== "yes") throw new ManifestMCPError(ManifestMCPErrorCode.OPERATION_CANCELLED, "User declined to proceed with close-lease.");
 	}
 	callbacks.onProgress?.({ kind: "user_confirmed" });
 	await stopApp(opts.clientManager, args.leaseUuid);

package/dist/close-lease.js.map

@@ -1 +1 @@
-{"version":3,"file":"close-lease.js","names":["decodeLeaseState"],"sources":["../src/close-lease.ts"],"sourcesContent":["/**\n * Public entry point: orchestrate closing an existing lease via the\n * `close-lease` billing tx.\n *\n * Composition (mirrors `deploy-app.ts` / `manage-domain.ts`):\n *\n *   1. Validate args.\n *   2. Render a confirmation block + optionally consult `onConfirm`.\n *   3. Broadcast `stopApp` (which submits `MsgCloseLease`).\n *   4. Verify the post-broadcast on-chain state via `verifyAndRecover`\n *      driving a direct `billing.v1.lease({ leaseUuid })` query +\n *      `lease-state.decode` + `isTerminal`. Terminal states (CLOSED /\n *      REJECTED / EXPIRED / INSUFFICIENT_FUNDS) count as success;\n *      PENDING / ACTIVE map to the `pending_drift` branch; a chain\n *      response with no lease (`{ lease: null }`) maps to the catch-all\n *      `unclassified` branch.\n *   5. On verify-failure, invoke the simple-form `onFailure({ reason })`\n *      then throw `ManifestMCPError(TX_FAILED)`. On success, emit\n *      `onComplete` with the typed `CloseLeaseResult`.\n */\n\nimport {\n  ManifestMCPError,\n  ManifestMCPErrorCode,\n  stopApp,\n} from '@manifest-network/manifest-mcp-core';\nimport {\n  decode as decodeLeaseState,\n  isTerminal,\n} from './internals/lease-state.js';\nimport {\n  type VerificationSpec,\n  verifyAndRecover,\n} from './internals/verify-recover.js';\nimport type {\n  CloseLeaseArgs,\n  CloseLeaseCallbacks,\n  CloseLeaseOptions,\n  CloseLeaseResult,\n  DeploymentPlanBlock,\n  LeaseStateName,\n} from './types.js';\n\nconst UUID_RE =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\ntype CloseOutcome = 'terminal' | 'pending' | 'not_found';\n\ninterface CloseDiag {\n  stateName?: LeaseStateName;\n  reason?: string;\n}\n\n/**\n * Close a lease and verify it reached a terminal on-chain state.\n *\n * @throws `ManifestMCPError(INVALID_CONFIG)` for args validation or when\n *   `onConfirm` returns `'no'`.\n * @throws `ManifestMCPError` (typically `TX_FAILED`) propagated as-is\n *   from the `stopApp()` broadcast step. Broadcast errors do NOT invoke\n *   `onFailure` — that callback is reserved for post-broadcast\n *   verification failures. `stopApp` already raises a structured\n *   `ManifestMCPError` from the core package; wrapping it again at this\n *   layer would be redundant. Callers wanting to react to broadcast\n *   errors should catch them at the call site.\n * @throws `ManifestMCPError(TX_FAILED)` when post-broadcast verification\n *   reaches one of two failure modes (both with `onFailure({ reason })`\n *   invoked first):\n *     - the lease is still non-terminal (`pending_drift` branch — state\n *       decoded as PENDING / ACTIVE / similar non-terminal); or\n *     - the chain returns `{ lease: null }` post-close, so the lease is\n *       not visible on-chain (`unclassified` branch).\n * @throws `ManifestMCPError(QUERY_FAILED)` when the post-broadcast verify\n *   chain query (`billing.v1.lease`) raises a non-NotFound error\n *   (RPC / transport / decoding failure). Wrapped inside the verifier\n *   closure so the failure flows through `onFailure({ reason })` before\n *   the throw. Structured `ManifestMCPError`s raised by the chain client\n *   are re-thrown as-is (with `onFailure` invoked first).\n */\nexport async function closeLease(\n  args: CloseLeaseArgs,\n  callbacks: CloseLeaseCallbacks,\n  opts: CloseLeaseOptions,\n): Promise<CloseLeaseResult> {\n  validateArgs(args);\n\n  const block = renderConfirmationBlock(args);\n  if (callbacks.onConfirm) {\n    const yesNo = await callbacks.onConfirm(block);\n    if (yesNo !== 'yes') {\n      throw new ManifestMCPError(\n        ManifestMCPErrorCode.INVALID_CONFIG,\n        'User declined to proceed with close-lease.',\n      );\n    }\n  }\n  callbacks.onProgress?.({ kind: 'user_confirmed' });\n\n  await stopApp(opts.clientManager, args.leaseUuid);\n\n  // Direct single-lease query (Copilot review PR #60, comment 3275999624):\n  // the previous `leasesByTenant` + page-1-only pagination would\n  // false-`not_found` for tenants with >100 leases. `billing.v1.lease`\n  // is the same query shape `troubleshoot.ts` already uses; it's\n  // tenant-agnostic and bounded to a single lease.\n  const spec: VerificationSpec<unknown, CloseOutcome, CloseDiag> = {\n    verifier: async () => {\n      // Wrap the chain call in try/catch (Copilot review PR #60,\n      // comment 3276419264): if `billing.v1.lease` rejects (RPC down,\n      // transport, structured `ManifestMCPError`), the error would\n      // otherwise propagate OUT of `verifyAndRecover` and bypass the\n      // post-verify `onFailure({ reason })` callback below. Mirror\n      // the disambiguation pattern from `lookupDomain` (commit aaa5cc5)\n      // and `troubleshootDeployment` (commit f1a4737): invoke\n      // `onFailure` first, then re-throw `ManifestMCPError` as-is or\n      // wrap plain errors as `QUERY_FAILED`.\n      let result: unknown;\n      try {\n        const queryClient = await opts.clientManager.getQueryClient();\n        result = await queryClient.liftedinit.billing.v1.lease({\n          leaseUuid: args.leaseUuid,\n        });\n      } catch (err) {\n        const reason = `Failed to query lease ${args.leaseUuid} during close-verify: ${\n          err instanceof Error ? err.message : String(err)\n        }`;\n        if (callbacks.onFailure) {\n          await callbacks.onFailure({ reason });\n        }\n        if (err instanceof ManifestMCPError) {\n          throw err;\n        }\n        throw new ManifestMCPError(ManifestMCPErrorCode.QUERY_FAILED, reason);\n      }\n      const lease = (result as { lease?: unknown })?.lease;\n      if (lease === null || lease === undefined) {\n        return {\n          outcome: 'not_found' as const,\n          diagnostic: {\n            reason: `lease ${args.leaseUuid} not visible on chain after close`,\n          },\n        };\n      }\n      const rawState = (lease as { state?: unknown }).state;\n      const stateName = decodeLeaseState(\n        typeof rawState === 'number' || typeof rawState === 'string'\n          ? rawState\n          : undefined,\n      );\n      if (stateName === undefined) {\n        return {\n          outcome: 'pending' as const,\n          diagnostic: {\n            reason: `lease ${args.leaseUuid} state could not be decoded (raw=${String(rawState)})`,\n          },\n        };\n      }\n      return {\n        outcome: (isTerminal(stateName) ? 'terminal' : 'pending') as\n          | 'terminal'\n          | 'pending',\n        diagnostic: { stateName },\n      };\n    },\n    successValues: ['terminal'],\n    branches: {\n      pending: {\n        branchId: 'pending_drift',\n        journalActionTags: ['close-lease-verify-pending'],\n        buildFailureEnvelope: (d) => ({\n          outcome: 'failed',\n          reason:\n            d.reason ??\n            `close_lease tx accepted but state is still ${d.stateName ?? 'unknown'}.`,\n        }),\n        buildRecoveryOptions: () => [],\n      },\n      not_found: {\n        branchId: 'unclassified',\n        journalActionTags: ['close-lease-verify-not-found'],\n        buildFailureEnvelope: (d) => ({\n          outcome: 'failed',\n          reason:\n            d.reason ??\n            `Lease ${args.leaseUuid} not visible on chain after close.`,\n        }),\n        buildRecoveryOptions: () => [],\n      },\n    },\n  };\n\n  const verifyResult = await verifyAndRecover(spec, undefined);\n\n  if (verifyResult.result !== 'success') {\n    const reason =\n      verifyResult.failure?.reason ?? 'close-lease verification failed.';\n    if (callbacks.onFailure) {\n      await callbacks.onFailure({ reason });\n    }\n    throw new ManifestMCPError(ManifestMCPErrorCode.TX_FAILED, reason);\n  }\n\n  // Invariant: when `verifyAndRecover` returns success, the matched\n  // outcome was `'terminal'`, and the verifier's `terminal` branch\n  // ALWAYS sets `diagnostic.stateName` (see the spec above). A missing\n  // `stateName` on the success path means the verifier invariant is\n  // broken — likely a future refactor regression. The previous\n  // implementation fell back to `'LEASE_STATE_CLOSED'` silently, which\n  // would lie to the caller (Copilot review PR #60, comment 3276719603).\n  // Fail loudly with a typed error instead. `TX_FAILED` is the closest\n  // available code in `ManifestMCPErrorCode` (no `INTERNAL_ERROR`\n  // variant); the message names the invariant explicitly.\n  if (!verifyResult.diagnostic.stateName) {\n    throw new ManifestMCPError(\n      ManifestMCPErrorCode.TX_FAILED,\n      `close-lease verifier invariant violated: success outcome reached without diagnostic.stateName for lease ${args.leaseUuid}`,\n    );\n  }\n  const finalState: LeaseStateName = verifyResult.diagnostic.stateName;\n  const result: CloseLeaseResult = {\n    leaseUuid: args.leaseUuid,\n    finalState,\n  };\n  callbacks.onComplete?.(result);\n  return result;\n}\n\n// --- Helpers --------------------------------------------------------\n\nfunction validateArgs(args: CloseLeaseArgs): void {\n  if (typeof args.leaseUuid !== 'string' || !args.leaseUuid.match(UUID_RE)) {\n    throw new ManifestMCPError(\n      ManifestMCPErrorCode.INVALID_CONFIG,\n      `closeLease: leaseUuid must be a UUID; got \"${args.leaseUuid}\".`,\n    );\n  }\n}\n\nfunction renderConfirmationBlock(args: CloseLeaseArgs): DeploymentPlanBlock {\n  // Image is not tracked in `CloseLeaseArgs` and `stopApp` doesn't return it;\n  // surface the gap explicitly so reviewers/users see the missing context\n  // rather than silently omitting an image field they'd expect.\n  const text = [\n    `Close lease ${args.leaseUuid}.`,\n    '  Image: (image not recorded)',\n    '  This is permanent — the lease cannot be reopened.',\n    '',\n    'Proceed?',\n  ].join('\\n');\n  return { text };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA2CA,MAAM,UACJ;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCF,eAAsB,WACpB,MACA,WACA,MAC2B;AAC3B,cAAa,KAAK;CAElB,MAAM,QAAQ,wBAAwB,KAAK;AAC3C,KAAI,UAAU;MACE,MAAM,UAAU,UAAU,MAAM,KAChC,MACZ,OAAM,IAAI,iBACR,qBAAqB,gBACrB,6CACD;;AAGL,WAAU,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAM,QAAQ,KAAK,eAAe,KAAK,UAAU;CA6FjD,MAAM,eAAe,MAAM,iBAtFsC;EAC/D,UAAU,YAAY;GAUpB,IAAI;AACJ,OAAI;AAEF,aAAS,OADW,MAAM,KAAK,cAAc,gBAAgB,EAClC,WAAW,QAAQ,GAAG,MAAM,EACrD,WAAW,KAAK,WACjB,CAAC;YACK,KAAK;IACZ,MAAM,SAAS,yBAAyB,KAAK,UAAU,wBACrD,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAElD,QAAI,UAAU,UACZ,OAAM,UAAU,UAAU,EAAE,QAAQ,CAAC;AAEvC,QAAI,eAAe,iBACjB,OAAM;AAER,UAAM,IAAI,iBAAiB,qBAAqB,cAAc,OAAO;;GAEvE,MAAM,QAAS,QAAgC;AAC/C,OAAI,UAAU,QAAQ,UAAU,KAAA,EAC9B,QAAO;IACL,SAAS;IACT,YAAY,EACV,QAAQ,SAAS,KAAK,UAAU,oCACjC;IACF;GAEH,MAAM,WAAY,MAA8B;GAChD,MAAM,YAAYA,OAChB,OAAO,aAAa,YAAY,OAAO,aAAa,WAChD,WACA,KAAA,EACL;AACD,OAAI,cAAc,KAAA,EAChB,QAAO;IACL,SAAS;IACT,YAAY,EACV,QAAQ,SAAS,KAAK,UAAU,mCAAmC,OAAO,SAAS,CAAC,IACrF;IACF;AAEH,UAAO;IACL,SAAU,WAAW,UAAU,GAAG,aAAa;IAG/C,YAAY,EAAE,WAAW;IAC1B;;EAEH,eAAe,CAAC,WAAW;EAC3B,UAAU;GACR,SAAS;IACP,UAAU;IACV,mBAAmB,CAAC,6BAA6B;IACjD,uBAAuB,OAAO;KAC5B,SAAS;KACT,QACE,EAAE,UACF,8CAA8C,EAAE,aAAa,UAAU;KAC1E;IACD,4BAA4B,EAAE;IAC/B;GACD,WAAW;IACT,UAAU;IACV,mBAAmB,CAAC,+BAA+B;IACnD,uBAAuB,OAAO;KAC5B,SAAS;KACT,QACE,EAAE,UACF,SAAS,KAAK,UAAU;KAC3B;IACD,4BAA4B,EAAE;IAC/B;GACF;EACF,EAEiD,KAAA,EAAU;AAE5D,KAAI,aAAa,WAAW,WAAW;EACrC,MAAM,SACJ,aAAa,SAAS,UAAU;AAClC,MAAI,UAAU,UACZ,OAAM,UAAU,UAAU,EAAE,QAAQ,CAAC;AAEvC,QAAM,IAAI,iBAAiB,qBAAqB,WAAW,OAAO;;AAapE,KAAI,CAAC,aAAa,WAAW,UAC3B,OAAM,IAAI,iBACR,qBAAqB,WACrB,2GAA2G,KAAK,YACjH;CAEH,MAAM,aAA6B,aAAa,WAAW;CAC3D,MAAM,SAA2B;EAC/B,WAAW,KAAK;EAChB;EACD;AACD,WAAU,aAAa,OAAO;AAC9B,QAAO;;AAKT,SAAS,aAAa,MAA4B;AAChD,KAAI,OAAO,KAAK,cAAc,YAAY,CAAC,KAAK,UAAU,MAAM,QAAQ,CACtE,OAAM,IAAI,iBACR,qBAAqB,gBACrB,8CAA8C,KAAK,UAAU,IAC9D;;AAIL,SAAS,wBAAwB,MAA2C;AAW1E,QAAO,EAAE,MAPI;EACX,eAAe,KAAK,UAAU;EAC9B;EACA;EACA;EACA;EACD,CAAC,KAAK,KAAK,EACG"}
+{"version":3,"file":"close-lease.js","names":["decodeLeaseState"],"sources":["../src/close-lease.ts"],"sourcesContent":["/**\n * Public entry point: orchestrate closing an existing lease via the\n * `close-lease` billing tx.\n *\n * Composition (mirrors `deploy-app.ts` / `manage-domain.ts`):\n *\n *   1. Validate args.\n *   2. Render a confirmation block + optionally consult `onConfirm`.\n *   3. Broadcast `stopApp` (which submits `MsgCloseLease`).\n *   4. Verify the post-broadcast on-chain state via `verifyAndRecover`\n *      driving a direct `billing.v1.lease({ leaseUuid })` query +\n *      `lease-state.decode` + `isTerminal`. Terminal states (CLOSED /\n *      REJECTED / EXPIRED / INSUFFICIENT_FUNDS) count as success;\n *      PENDING / ACTIVE map to the `pending_drift` branch; a chain\n *      response with no lease (`{ lease: null }`) maps to the catch-all\n *      `unclassified` branch.\n *   5. On verify-failure, invoke the simple-form `onFailure({ reason })`\n *      then throw `ManifestMCPError(TX_FAILED)`. On success, emit\n *      `onComplete` with the typed `CloseLeaseResult`.\n */\n\nimport {\n  ManifestMCPError,\n  ManifestMCPErrorCode,\n  stopApp,\n} from '@manifest-network/manifest-mcp-core';\nimport {\n  decode as decodeLeaseState,\n  isTerminal,\n} from './internals/lease-state.js';\nimport {\n  type VerificationSpec,\n  verifyAndRecover,\n} from './internals/verify-recover.js';\nimport type {\n  CloseLeaseArgs,\n  CloseLeaseCallbacks,\n  CloseLeaseOptions,\n  CloseLeaseResult,\n  DeploymentPlanBlock,\n  LeaseStateName,\n} from './types.js';\n\nconst UUID_RE =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\ntype CloseOutcome = 'terminal' | 'pending' | 'not_found';\n\ninterface CloseDiag {\n  stateName?: LeaseStateName;\n  reason?: string;\n}\n\n/**\n * Close a lease and verify it reached a terminal on-chain state.\n *\n * @throws `ManifestMCPError(INVALID_CONFIG)` for args validation.\n * @throws `ManifestMCPError(OPERATION_CANCELLED)` when `onConfirm` returns\n *   `'no'` (deliberate user cancellation — ENG-272).\n * @throws `ManifestMCPError` (typically `TX_FAILED`) propagated as-is\n *   from the `stopApp()` broadcast step. Broadcast errors do NOT invoke\n *   `onFailure` — that callback is reserved for post-broadcast\n *   verification failures. `stopApp` already raises a structured\n *   `ManifestMCPError` from the core package; wrapping it again at this\n *   layer would be redundant. Callers wanting to react to broadcast\n *   errors should catch them at the call site.\n * @throws `ManifestMCPError(TX_FAILED)` when post-broadcast verification\n *   reaches one of two failure modes (both with `onFailure({ reason })`\n *   invoked first):\n *     - the lease is still non-terminal (`pending_drift` branch — state\n *       decoded as PENDING / ACTIVE / similar non-terminal); or\n *     - the chain returns `{ lease: null }` post-close, so the lease is\n *       not visible on-chain (`unclassified` branch).\n * @throws `ManifestMCPError(QUERY_FAILED)` when the post-broadcast verify\n *   chain query (`billing.v1.lease`) raises a non-NotFound error\n *   (RPC / transport / decoding failure). Wrapped inside the verifier\n *   closure so the failure flows through `onFailure({ reason })` before\n *   the throw. Structured `ManifestMCPError`s raised by the chain client\n *   are re-thrown as-is (with `onFailure` invoked first).\n */\nexport async function closeLease(\n  args: CloseLeaseArgs,\n  callbacks: CloseLeaseCallbacks,\n  opts: CloseLeaseOptions,\n): Promise<CloseLeaseResult> {\n  validateArgs(args);\n\n  const block = renderConfirmationBlock(args);\n  if (callbacks.onConfirm) {\n    const yesNo = await callbacks.onConfirm(block);\n    if (yesNo !== 'yes') {\n      throw new ManifestMCPError(\n        ManifestMCPErrorCode.OPERATION_CANCELLED,\n        'User declined to proceed with close-lease.',\n      );\n    }\n  }\n  callbacks.onProgress?.({ kind: 'user_confirmed' });\n\n  await stopApp(opts.clientManager, args.leaseUuid);\n\n  // Direct single-lease query (Copilot review PR #60, comment 3275999624):\n  // the previous `leasesByTenant` + page-1-only pagination would\n  // false-`not_found` for tenants with >100 leases. `billing.v1.lease`\n  // is the same query shape `troubleshoot.ts` already uses; it's\n  // tenant-agnostic and bounded to a single lease.\n  const spec: VerificationSpec<unknown, CloseOutcome, CloseDiag> = {\n    verifier: async () => {\n      // Wrap the chain call in try/catch (Copilot review PR #60,\n      // comment 3276419264): if `billing.v1.lease` rejects (RPC down,\n      // transport, structured `ManifestMCPError`), the error would\n      // otherwise propagate OUT of `verifyAndRecover` and bypass the\n      // post-verify `onFailure({ reason })` callback below. Mirror\n      // the disambiguation pattern from `lookupDomain` (commit aaa5cc5)\n      // and `troubleshootDeployment` (commit f1a4737): invoke\n      // `onFailure` first, then re-throw `ManifestMCPError` as-is or\n      // wrap plain errors as `QUERY_FAILED`.\n      let result: unknown;\n      try {\n        const queryClient = await opts.clientManager.getQueryClient();\n        result = await queryClient.liftedinit.billing.v1.lease({\n          leaseUuid: args.leaseUuid,\n        });\n      } catch (err) {\n        const reason = `Failed to query lease ${args.leaseUuid} during close-verify: ${\n          err instanceof Error ? err.message : String(err)\n        }`;\n        if (callbacks.onFailure) {\n          await callbacks.onFailure({ reason });\n        }\n        if (err instanceof ManifestMCPError) {\n          throw err;\n        }\n        throw new ManifestMCPError(ManifestMCPErrorCode.QUERY_FAILED, reason);\n      }\n      const lease = (result as { lease?: unknown })?.lease;\n      if (lease === null || lease === undefined) {\n        return {\n          outcome: 'not_found' as const,\n          diagnostic: {\n            reason: `lease ${args.leaseUuid} not visible on chain after close`,\n          },\n        };\n      }\n      const rawState = (lease as { state?: unknown }).state;\n      const stateName = decodeLeaseState(\n        typeof rawState === 'number' || typeof rawState === 'string'\n          ? rawState\n          : undefined,\n      );\n      if (stateName === undefined) {\n        return {\n          outcome: 'pending' as const,\n          diagnostic: {\n            reason: `lease ${args.leaseUuid} state could not be decoded (raw=${String(rawState)})`,\n          },\n        };\n      }\n      return {\n        outcome: (isTerminal(stateName) ? 'terminal' : 'pending') as\n          | 'terminal'\n          | 'pending',\n        diagnostic: { stateName },\n      };\n    },\n    successValues: ['terminal'],\n    branches: {\n      pending: {\n        branchId: 'pending_drift',\n        journalActionTags: ['close-lease-verify-pending'],\n        buildFailureEnvelope: (d) => ({\n          outcome: 'failed',\n          reason:\n            d.reason ??\n            `close_lease tx accepted but state is still ${d.stateName ?? 'unknown'}.`,\n        }),\n        buildRecoveryOptions: () => [],\n      },\n      not_found: {\n        branchId: 'unclassified',\n        journalActionTags: ['close-lease-verify-not-found'],\n        buildFailureEnvelope: (d) => ({\n          outcome: 'failed',\n          reason:\n            d.reason ??\n            `Lease ${args.leaseUuid} not visible on chain after close.`,\n        }),\n        buildRecoveryOptions: () => [],\n      },\n    },\n  };\n\n  const verifyResult = await verifyAndRecover(spec, undefined);\n\n  if (verifyResult.result !== 'success') {\n    const reason =\n      verifyResult.failure?.reason ?? 'close-lease verification failed.';\n    if (callbacks.onFailure) {\n      await callbacks.onFailure({ reason });\n    }\n    throw new ManifestMCPError(ManifestMCPErrorCode.TX_FAILED, reason);\n  }\n\n  // Invariant: when `verifyAndRecover` returns success, the matched\n  // outcome was `'terminal'`, and the verifier's `terminal` branch\n  // ALWAYS sets `diagnostic.stateName` (see the spec above). A missing\n  // `stateName` on the success path means the verifier invariant is\n  // broken — likely a future refactor regression. The previous\n  // implementation fell back to `'LEASE_STATE_CLOSED'` silently, which\n  // would lie to the caller (Copilot review PR #60, comment 3276719603).\n  // Fail loudly with a typed error instead. `TX_FAILED` is the closest\n  // available code in `ManifestMCPErrorCode` (no `INTERNAL_ERROR`\n  // variant); the message names the invariant explicitly.\n  if (!verifyResult.diagnostic.stateName) {\n    throw new ManifestMCPError(\n      ManifestMCPErrorCode.TX_FAILED,\n      `close-lease verifier invariant violated: success outcome reached without diagnostic.stateName for lease ${args.leaseUuid}`,\n    );\n  }\n  const finalState: LeaseStateName = verifyResult.diagnostic.stateName;\n  const result: CloseLeaseResult = {\n    leaseUuid: args.leaseUuid,\n    finalState,\n  };\n  callbacks.onComplete?.(result);\n  return result;\n}\n\n// --- Helpers --------------------------------------------------------\n\nfunction validateArgs(args: CloseLeaseArgs): void {\n  if (typeof args.leaseUuid !== 'string' || !args.leaseUuid.match(UUID_RE)) {\n    throw new ManifestMCPError(\n      ManifestMCPErrorCode.INVALID_CONFIG,\n      `closeLease: leaseUuid must be a UUID; got \"${args.leaseUuid}\".`,\n    );\n  }\n}\n\nfunction renderConfirmationBlock(args: CloseLeaseArgs): DeploymentPlanBlock {\n  // Image is not tracked in `CloseLeaseArgs` and `stopApp` doesn't return it;\n  // surface the gap explicitly so reviewers/users see the missing context\n  // rather than silently omitting an image field they'd expect.\n  const text = [\n    `Close lease ${args.leaseUuid}.`,\n    '  Image: (image not recorded)',\n    '  This is permanent — the lease cannot be reopened.',\n    '',\n    'Proceed?',\n  ].join('\\n');\n  return { text };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AA2CA,MAAM,UACJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCF,eAAsB,WACpB,MACA,WACA,MAC2B;AAC3B,cAAa,KAAK;CAElB,MAAM,QAAQ,wBAAwB,KAAK;AAC3C,KAAI,UAAU;MAER,MADgB,UAAU,UAAU,MAAM,KAChC,MACZ,OAAM,IAAI,iBACR,qBAAqB,qBACrB,6CACD;;AAGL,WAAU,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAM,QAAQ,KAAK,eAAe,KAAK,UAAU;CA6FjD,MAAM,eAAe,MAAM,iBAAiB;EArF1C,UAAU,YAAY;GAUpB,IAAI;AACJ,OAAI;AAEF,aAAS,OAAM,MADW,KAAK,cAAc,gBAAgB,EAClC,WAAW,QAAQ,GAAG,MAAM,EACrD,WAAW,KAAK,WACjB,CAAC;YACK,KAAK;IACZ,MAAM,SAAS,yBAAyB,KAAK,UAAU,wBACrD,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;AAElD,QAAI,UAAU,UACZ,OAAM,UAAU,UAAU,EAAE,QAAQ,CAAC;AAEvC,QAAI,eAAe,iBACjB,OAAM;AAER,UAAM,IAAI,iBAAiB,qBAAqB,cAAc,OAAO;;GAEvE,MAAM,QAAS,QAAgC;AAC/C,OAAI,UAAU,QAAQ,UAAU,KAAA,EAC9B,QAAO;IACL,SAAS;IACT,YAAY,EACV,QAAQ,SAAS,KAAK,UAAU,oCACjC;IACF;GAEH,MAAM,WAAY,MAA8B;GAChD,MAAM,YAAYA,OAChB,OAAO,aAAa,YAAY,OAAO,aAAa,WAChD,WACA,KAAA,EACL;AACD,OAAI,cAAc,KAAA,EAChB,QAAO;IACL,SAAS;IACT,YAAY,EACV,QAAQ,SAAS,KAAK,UAAU,mCAAmC,OAAO,SAAS,CAAC,IACrF;IACF;AAEH,UAAO;IACL,SAAU,WAAW,UAAU,GAAG,aAAa;IAG/C,YAAY,EAAE,WAAW;IAC1B;;EAEH,eAAe,CAAC,WAAW;EAC3B,UAAU;GACR,SAAS;IACP,UAAU;IACV,mBAAmB,CAAC,6BAA6B;IACjD,uBAAuB,OAAO;KAC5B,SAAS;KACT,QACE,EAAE,UACF,8CAA8C,EAAE,aAAa,UAAU;KAC1E;IACD,4BAA4B,EAAE;IAC/B;GACD,WAAW;IACT,UAAU;IACV,mBAAmB,CAAC,+BAA+B;IACnD,uBAAuB,OAAO;KAC5B,SAAS;KACT,QACE,EAAE,UACF,SAAS,KAAK,UAAU;KAC3B;IACD,4BAA4B,EAAE;IAC/B;GACF;EAG6C,EAAE,KAAA,EAAU;AAE5D,KAAI,aAAa,WAAW,WAAW;EACrC,MAAM,SACJ,aAAa,SAAS,UAAU;AAClC,MAAI,UAAU,UACZ,OAAM,UAAU,UAAU,EAAE,QAAQ,CAAC;AAEvC,QAAM,IAAI,iBAAiB,qBAAqB,WAAW,OAAO;;AAapE,KAAI,CAAC,aAAa,WAAW,UAC3B,OAAM,IAAI,iBACR,qBAAqB,WACrB,2GAA2G,KAAK,YACjH;CAEH,MAAM,aAA6B,aAAa,WAAW;CAC3D,MAAM,SAA2B;EAC/B,WAAW,KAAK;EAChB;EACD;AACD,WAAU,aAAa,OAAO;AAC9B,QAAO;;AAKT,SAAS,aAAa,MAA4B;AAChD,KAAI,OAAO,KAAK,cAAc,YAAY,CAAC,KAAK,UAAU,MAAM,QAAQ,CACtE,OAAM,IAAI,iBACR,qBAAqB,gBACrB,8CAA8C,KAAK,UAAU,IAC9D;;AAIL,SAAS,wBAAwB,MAA2C;AAW1E,QAAO,EAAE,MAPI;EACX,eAAe,KAAK,UAAU;EAC9B;EACA;EACA;EACA;EACD,CAAC,KAAK,KACM,EAAE"}

package/dist/deploy-app.d.ts

@@ -6,8 +6,9 @@ import { DeployAppCallbacks, DeployAppOptions, DeployResult, DeploySpec } from "
  * locked composition + E-hybrid runtime-context contract.
  *
  * @throws `ManifestMCPError(INVALID_CONFIG)` for spec / wallet validation.
- * @throws `ManifestMCPError(INVALID_CONFIG)` when `onConfirm` returns
- *   `'no'` or `onPlan` returns `'cancel'`.
+ * @throws `ManifestMCPError(OPERATION_CANCELLED)` when `onConfirm` returns
+ *   `'no'` or `onPlan` returns `'cancel'` (deliberate user cancellation —
+ *   ENG-272).
  *
  * Errors from fred's broadcast or core's recovery primitives surface as
  * typed `ManifestMCPError`s. Partial-success failures with applicable

package/dist/deploy-app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-app.d.ts","names":[],"sources":["../src/deploy-app.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;iBAoHsB,SAAA,CACpB,IAAA,EAAM,UAAA,EACN,SAAA,EAAW,kBAAA,EACX,IAAA,EAAM,gBAAA,GACL,OAAA,CAAQ,YAAA"}
+{"version":3,"file":"deploy-app.d.ts","names":[],"sources":["../src/deploy-app.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;iBAiIsB,SAAA,CACpB,IAAA,EAAM,UAAA,EACN,SAAA,EAAW,kBAAA,EACX,IAAA,EAAM,gBAAA,GACL,OAAA,CAAQ,YAAA"}

package/dist/deploy-app.js

@@ -1,15 +1,17 @@
 import { decode } from "./internals/lease-state.js";
+import { isStackSpec, summarizeSpec, validateSpec } from "./internals/spec-normalize.js";
+import { buildFredDeployInput, buildManifestPreviewInput } from "./internals/build-fred-input.js";
 import { classifyDeployError } from "./internals/classify-deploy-error.js";
 import { extractRunningEndpoints, formatEndpointAsUrl, normalizeFredUrl } from "./internals/connection.js";
 import { classifyDeployResponse } from "./internals/classify-deploy-response.js";
-import { findSkuUuid } from "./internals/find-sku-uuid.js";
 import { EMPTY_DENOM_MAP, loadChainDenomMap } from "./internals/humanize-denom.js";
+import { evaluateReadinessFromFredResponse } from "./internals/evaluate-readiness-from-fred.js";
+import { findSkuUuid } from "./internals/find-sku-uuid.js";
 import { renderDeploymentPlan } from "./internals/render-deployment-plan.js";
-import { isStackSpec, summarizeSpec, validateSpec } from "./internals/spec-normalize.js";
 import { renderIntentRecap } from "./internals/render-intent-recap.js";
 import { renderPartialSuccessPrompt } from "./internals/render-partial-success-prompt.js";
 import { ManifestMCPError, ManifestMCPErrorCode, cosmosEstimateFee, setItemCustomDomain, stopApp } from "@manifest-network/manifest-mcp-core";
-import { AuthTimestampTracker, buildManifestPreview, checkDeploymentReadiness, createAuthToken, createLeaseDataSignMessage, createSignMessage, deployApp as deployApp$1 } from "@manifest-network/manifest-mcp-fred";
+import { AuthTimestampTracker, buildManifestPreview, checkDeploymentReadiness, createAuthToken, createLeaseDataSignMessage, createSignMessage, deployApp as deployApp$1, fetchActiveLease, pollLeaseUntilReady, resolveProviderUrl, uploadLeaseData, waitForAppReady } from "@manifest-network/manifest-mcp-fred";
 //#region src/deploy-app.ts
 /**
 * Public entry point: orchestrate a Manifest-Network app deployment from
@@ -54,8 +56,9 @@ import { AuthTimestampTracker, buildManifestPreview, checkDeploymentReadiness, c
 * locked composition + E-hybrid runtime-context contract.
 *
 * @throws `ManifestMCPError(INVALID_CONFIG)` for spec / wallet validation.
-* @throws `ManifestMCPError(INVALID_CONFIG)` when `onConfirm` returns
-*   `'no'` or `onPlan` returns `'cancel'`.
+* @throws `ManifestMCPError(OPERATION_CANCELLED)` when `onConfirm` returns
+*   `'no'` or `onPlan` returns `'cancel'` (deliberate user cancellation —
+*   ENG-272).
 *
 * Errors from fred's broadcast or core's recovery primitives surface as
 * typed `ManifestMCPError`s. Partial-success failures with applicable
@@ -81,10 +84,10 @@ async function deployApp(spec, callbacks, opts) {
 	const chainId = opts.clientManager.getConfig().chainId;
 	const activeChain = /mainnet|main/i.test(chainId) ? "mainnet" : "testnet";
 	const queryClient = await opts.clientManager.getQueryClient();
-	let readiness = evaluateReadinessFromRaw(await checkDeploymentReadiness(queryClient, tenantAddress, {
+	let readiness = evaluateReadinessFromFredResponse(await checkDeploymentReadiness(queryClient, tenantAddress, {
 		image: primaryImage(spec),
 		size: requestedSize(spec)
-	}), opts.clientManager.getConfig().gasPrice ?? "1umfx", denomMap);
+	}), opts.clientManager.getConfig().gasPrice ?? "1umfx", denomMap, tenantAddress);
 	callbacks.onProgress?.({
 		kind: "readiness_evaluated",
 		readiness
@@ -117,7 +120,7 @@ async function deployApp(spec, callbacks, opts) {
 	});
 	if (callbacks.onPlan) {
 		const verdict = await callbacks.onPlan(plan);
-		if (verdict === "cancel") throw new ManifestMCPError(ManifestMCPErrorCode.INVALID_CONFIG, "User cancelled deployment at plan step.");
+		if (verdict === "cancel") throw new ManifestMCPError(ManifestMCPErrorCode.OPERATION_CANCELLED, "User cancelled deployment at plan step.");
 		if (verdict !== "confirm") {
 			confirmedSpec = applyPlanEdit(confirmedSpec, verdict);
 			try {
@@ -125,10 +128,10 @@ async function deployApp(spec, callbacks, opts) {
 			} catch (err) {
 				throw new ManifestMCPError(ManifestMCPErrorCode.INVALID_CONFIG, err instanceof Error ? `Post-edit spec failed validation: ${err.message}` : `Post-edit spec failed validation: ${String(err)}`);
 			}
-			readiness = evaluateReadinessFromRaw(await checkDeploymentReadiness(queryClient, tenantAddress, {
+			readiness = evaluateReadinessFromFredResponse(await checkDeploymentReadiness(queryClient, tenantAddress, {
 				image: primaryImage(confirmedSpec),
 				size: requestedSize(confirmedSpec)
-			}), opts.clientManager.getConfig().gasPrice ?? "1umfx", denomMap);
+			}), opts.clientManager.getConfig().gasPrice ?? "1umfx", denomMap, tenantAddress);
 			callbacks.onProgress?.({
 				kind: "readiness_evaluated",
 				readiness
@@ -162,7 +165,7 @@ async function deployApp(spec, callbacks, opts) {
 		activeChain
 	}) };
 	if (callbacks.onConfirm) {
-		if (await callbacks.onConfirm(recapBlock) !== "yes") throw new ManifestMCPError(ManifestMCPErrorCode.INVALID_CONFIG, "User declined to proceed at intent-recap step.");
+		if (await callbacks.onConfirm(recapBlock) !== "yes") throw new ManifestMCPError(ManifestMCPErrorCode.OPERATION_CANCELLED, "User declined to proceed at intent-recap step.");
 	}
 	callbacks.onProgress?.({ kind: "user_confirmed" });
 	const signArbitrary = opts.walletProvider.signArbitrary.bind(opts.walletProvider);
@@ -183,16 +186,72 @@ async function deployApp(spec, callbacks, opts) {
 	try {
 		fredResult = await deployApp$1(opts.clientManager, getAuthToken, getLeaseDataAuthToken, fredInput, opts.fetchFn);
 	} catch (err) {
-		return await handleBroadcastFailure(err, confirmedSpec, callbacks, opts);
+		const recoveryCtx = {
+			manifestJson: preview.manifest_json,
+			metaHash: preview.meta_hash_hex,
+			getAuthToken,
+			getLeaseDataAuthToken,
+			tenantAddress,
+			chainId,
+			denomMap
+		};
+		return await handleBroadcastFailure(err, confirmedSpec, callbacks, opts, recoveryCtx);
 	}
-	const classification = classifyDeployResponse(fredResult);
+	let liveState = fredResult.state;
+	let liveConnection = fredResult.connection;
+	let classification = classifyDeployResponse(fredResult);
 	callbacks.onProgress?.({
 		kind: "deploy_response_classified",
 		outcome: classification.outcome
 	});
-	if (classification.outcome !== "active") {
-		const detail = classification.errorSummary ?? (classification.stateName !== void 0 ? `Lease ${classification.leaseUuid ?? "<no-uuid>"} returned non-active state ${classification.stateName}` : `fred deployApp returned non-active outcome '${classification.outcome}'`);
-		throw new ManifestMCPError(ManifestMCPErrorCode.INVALID_CONFIG, `${detail}. Full routing (needs_wait → wait_for_app_ready polling; failed → FailureEnvelope) deferred to ENG-185 scope item #6.`);
+	if (classification.outcome === "failed") {
+		const reason = classification.errorSummary ?? `fred deployApp returned failed outcome for lease ${classification.leaseUuid ?? "<no-uuid>"}`;
+		throw new ManifestMCPError(ManifestMCPErrorCode.TX_FAILED, reason);
+	}
+	if (classification.outcome === "needs_wait") {
+		if (!classification.leaseUuid) throw new ManifestMCPError(ManifestMCPErrorCode.INVALID_CONFIG, "Internal invariant: classifier returned needs_wait without leaseUuid.");
+		const leaseUuid = classification.leaseUuid;
+		const pollStartMs = Date.now();
+		let attempt = 0;
+		let pollResult;
+		try {
+			pollResult = await waitForAppReady(queryClient, tenantAddress, leaseUuid, getAuthToken, {
+				timeoutMs: opts.waitForReadyTimeoutMs ?? 48e4,
+				onProgress: (status) => {
+					attempt += 1;
+					const stateName = decode(status.state);
+					callbacks.onProgress?.({
+						kind: "polling_for_readiness",
+						leaseUuid,
+						attempt,
+						elapsedMs: Date.now() - pollStartMs,
+						...stateName !== void 0 ? { state: stateName } : {}
+					});
+				}
+			}, opts.fetchFn);
+		} catch (err) {
+			const reason = err instanceof Error ? `wait_for_app_ready failed for lease ${leaseUuid}: ${err.message}` : `wait_for_app_ready failed for lease ${leaseUuid}: ${String(err)}`;
+			throw new ManifestMCPError(ManifestMCPErrorCode.TX_FAILED, reason);
+		}
+		classification = classifyDeployResponse({
+			lease_uuid: pollResult.lease_uuid,
+			provider_uuid: pollResult.provider_uuid,
+			provider_url: pollResult.provider_url,
+			state: pollResult.state,
+			connection: pollResult.status
+		});
+		if (classification.outcome !== "active") {
+			const reason = classification.errorSummary ?? `wait_for_app_ready returned for lease ${leaseUuid} but post-poll classifier outcome is ${classification.outcome}`;
+			throw new ManifestMCPError(ManifestMCPErrorCode.TX_FAILED, reason);
+		}
+		fredResult = {
+			...fredResult,
+			lease_uuid: pollResult.lease_uuid,
+			provider_uuid: pollResult.provider_uuid,
+			provider_url: pollResult.provider_url
+		};
+		liveState = pollResult.status.state;
+		liveConnection = pollResult.status;
 	}
 	callbacks.onProgress?.({
 		kind: "app_ready_confirmed",
@@ -211,13 +270,13 @@ async function deployApp(spec, callbacks, opts) {
 		callbacks
 	});
 	let leaseStateDecoded;
-	if (fredResult.state === void 0) leaseStateDecoded = "LEASE_STATE_ACTIVE";
+	if (liveState === void 0) leaseStateDecoded = "LEASE_STATE_ACTIVE";
 	else {
-		const decoded = decode(fredResult.state);
-		if (decoded === void 0) throw new ManifestMCPError(ManifestMCPErrorCode.INVALID_CONFIG, `Unrecognized lease state from fred deployApp response: ${String(fredResult.state)}. Cannot safely classify; refusing to silently coerce to ACTIVE.`);
+		const decoded = decode(liveState);
+		if (decoded === void 0) throw new ManifestMCPError(ManifestMCPErrorCode.INVALID_CONFIG, `Unrecognized lease state from fred deployApp response: ${String(liveState)}. Cannot safely classify; refusing to silently coerce to ACTIVE.`);
 		leaseStateDecoded = decoded;
 	}
-	const endpointUrls = extractRunningEndpoints(fredResult.connection).map(formatEndpointAsUrl);
+	const endpointUrls = extractRunningEndpoints(liveConnection).map(formatEndpointAsUrl);
 	const fallbackUrl = typeof fredResult.url === "string" ? normalizeFredUrl(fredResult.url) : "";
 	const result = {
 		leaseUuid: fredResult.lease_uuid,
@@ -251,40 +310,16 @@ function customDomainOf(spec) {
 function customDomainServiceOf(spec) {
 	if (isStackSpec(spec)) return spec.serviceName;
 }
-function evaluateReadinessFromRaw(raw, gasPrice, denomMap) {
-	const rawAny = raw;
-	return {
-		status: "ok",
-		reasons: [],
-		suggestedActions: [],
-		walletBalances: rawAny.wallet_balances ?? [],
-		credits: rawAny.credits ?? null,
-		sku: rawAny.sku ?? null
-	};
-}
-function buildManifestPreviewInput(spec, size) {
-	if (isStackSpec(spec)) return {
-		size,
-		services: spec.services
-	};
-	const single = spec;
-	return {
-		size,
-		image: single.image,
-		port: typeof single.port === "number" ? single.port : Array.isArray(single.port) ? single.port[0] : void 0,
-		env: single.env
-	};
-}
 async function estimateFees(opts, spec, metaHashHex) {
 	const size = requestedSize(spec);
 	const { skuUuid } = await findSkuUuid(opts.clientManager, size);
-	const itemArg = isStackSpec(spec) && spec.serviceName ? `${skuUuid}:1:${spec.serviceName}` : `${skuUuid}:1`;
+	const itemArgs = isStackSpec(spec) ? Object.keys(spec.services).map((name) => `${skuUuid}:1:${name}`) : [`${skuUuid}:1`];
 	let createLeaseEstimate;
 	try {
 		createLeaseEstimate = await cosmosEstimateFee(opts.clientManager, "billing", "create-lease", [
 			"--meta-hash",
 			metaHashHex,
-			itemArg
+			...itemArgs
 		]);
 	} catch (err) {
 		const msg = `Failed to estimate create-lease fee: ${err instanceof Error ? err.message : String(err)}`;
@@ -301,27 +336,10 @@ async function estimateFees(opts, spec, metaHashHex) {
 		},
 		...typeof customDomainOf(spec) === "string" ? { setDomain: {
 			notEstimated: true,
-			reason: "set-domain fee skipped — pre-broadcast lease UUID unavailable; full approach-3 fallback deferred to PR-3.x"
+			reason: "no representative lease for pre-broadcast simulation"
 		} } : {}
 	};
 }
-function buildFredDeployInput(spec, size) {
-	const base = { size };
-	if (isStackSpec(spec)) base.services = spec.services;
-	else {
-		const single = spec;
-		base.image = single.image;
-		base.port = typeof single.port === "number" ? single.port : Array.isArray(single.port) ? single.port[0] : void 0;
-		base.env = single.env;
-	}
-	const customDomain = spec.customDomain;
-	if (customDomain) {
-		base.customDomain = customDomain;
-		const svcName = customDomainServiceOf(spec);
-		if (svcName) base.serviceName = svcName;
-	}
-	return base;
-}
 function applyPlanEdit(spec, edit) {
 	if (edit.kind === "replace_spec") return edit.spec;
 	if (edit.kind === "edit_env") {
@@ -354,7 +372,7 @@ function applyPlanEdit(spec, edit) {
 	}
 	return spec;
 }
-async function handleBroadcastFailure(err, spec, callbacks, opts) {
+async function handleBroadcastFailure(err, spec, callbacks, opts, ctx) {
 	const requestedCustomDomain = customDomainOf(spec);
 	const classified = classifyDeployError(err, { ...requestedCustomDomain ? { expectedCustomDomain: requestedCustomDomain } : {} });
 	if (classified.outcome === "partially_succeeded" && classified.leaseUuid) {
@@ -364,33 +382,34 @@ async function handleBroadcastFailure(err, spec, callbacks, opts) {
 			...requestedCustomDomain ? { requestedCustomDomain } : {},
 			reason: classified.reason
 		};
-		const options = renderPartialSuccessPrompt({
+		const promptPayload = renderPartialSuccessPrompt({
 			leaseUuid: classified.leaseUuid,
 			decodedState: "LEASE_STATE_PENDING",
 			reason: classified.reason,
 			...requestedCustomDomain ? { requestedCustomDomain } : {}
-		}).options.map((id) => ({
+		});
+		const options = promptPayload.options.map((id) => ({
 			id,
 			label: recoveryOptionLabel(id),
 			description: recoveryOptionDescription(id)
 		}));
-		if (options.length > 0 && callbacks.onFailure !== void 0) return await dispatchRecovery(await callbacks.onFailure(envelope, options), envelope, spec, opts);
+		if (options.length > 0 && callbacks.onFailure !== void 0) {
+			callbacks.onProgress?.({
+				kind: "partial_success_prompt_rendered",
+				prompt: promptPayload.prompt,
+				leaseUuid: envelope.leaseUuid
+			});
+			return await dispatchRecovery(await callbacks.onFailure(envelope, options), envelope, spec, opts, callbacks, ctx);
+		}
 		throw new ManifestMCPError(ManifestMCPErrorCode.TX_FAILED, classified.reason);
 	}
 	classified.reason;
 	throw new ManifestMCPError(ManifestMCPErrorCode.TX_FAILED, classified.reason);
 }
-async function dispatchRecovery(choice, envelope, spec, opts) {
+async function dispatchRecovery(choice, envelope, spec, opts, callbacks, ctx) {
 	const leaseUuid = envelope.outcome === "partially_succeeded" ? envelope.leaseUuid : "";
 	switch (choice.id) {
-		case "retry_set_domain": {
-			const domain = customDomainOf(spec);
-			if (!domain) throw new ManifestMCPError(ManifestMCPErrorCode.INVALID_CONFIG, "retry_set_domain requires a customDomain in spec.");
-			const serviceName = customDomainServiceOf(spec);
-			const setItemOpts = serviceName ? { serviceName } : void 0;
-			await setItemCustomDomain(opts.clientManager, leaseUuid, domain, setItemOpts);
-			throw new ManifestMCPError(ManifestMCPErrorCode.TX_FAILED, `retry_set_domain completed for ${leaseUuid}; caller should re-run troubleshootDeployment to confirm app readiness.`);
-		}
+		case "retry_set_domain": return await retrySetDomainAndComplete(leaseUuid, spec, opts, callbacks, ctx);
 		case "salvage_without_domain": throw new ManifestMCPError(ManifestMCPErrorCode.TX_FAILED, `salvage_without_domain: lease ${leaseUuid} retained without domain; caller should re-run troubleshootDeployment.`);
 		case "cancel_lease":
 		case "close_lease":
@@ -399,6 +418,155 @@ async function dispatchRecovery(choice, envelope, spec, opts) {
 	}
 	throw new ManifestMCPError(ManifestMCPErrorCode.TX_FAILED, `Unknown recovery option: ${choice.id}`);
 }
+/**
+* `retry_set_domain` recovery: decompose the deploy after the partial-
+* success failure. ENG-185 sub-PR E.
+*
+* Steps (mirrors fred's atomic `deployApp` minus the create-lease tx,
+* which already succeeded):
+*   1. `setItemCustomDomain` — broadcast the domain claim against the
+*      pre-existing lease. Stack specs thread `serviceName` so the
+*      tx targets the named lease item.
+*   2. `fetchActiveLease` + `resolveProviderUrl` — look up the provider
+*      URL from the on-chain lease record (the partial-success error
+*      envelope only carries `leaseUuid`).
+*   3. `uploadLeaseData` — push the manifest payload to the provider.
+*      Uses the ADR-036 lease-data auth token (signed against the
+*      manifest's meta-hash).
+*   4. `pollLeaseUntilReady` — poll until the provider reports ACTIVE +
+*      running. Uses the LOWER-LEVEL primitive (not `waitForAppReady`)
+*      so the already-resolved `providerApiUrl` and auth-token closure
+*      pass through directly — no redundant on-chain queries (Copilot
+*      fix-1, PR #71). Reuses D's canonical polling-emission pattern:
+*      `onProgress` closure translates each `FredLeaseStatus` sample
+*      into a typed `polling_for_readiness` ProgressEvent, default
+*      480_000ms timeout overridable via `opts.waitForReadyTimeoutMs`.
+*   5. Defense #2 parity (post-poll re-classify) — guard the
+*      ACTIVE-with-no-instances race per D's pattern.
+*   6. Persist manifest (best-effort) + build typed `DeployResult` +
+*      emit `app_ready_confirmed` + `success_rendered` + onComplete.
+*
+* Failure paths (sibling-parity wraps — every catch site surfaces
+* `retry_set_domain <primitive-name> failed for lease ${leaseUuid}:
+* ${err.message}` in the thrown message, matching D's L548-550 style).
+* Error-code policy: typed `ManifestMCPError`s flow through with their
+* original code preserved (precedent at `estimateFees` — see the
+* `cosmosEstimateFee` catch block); untyped errors default to
+* `TX_FAILED`. The post-poll re-classify path likewise prefixes BOTH
+* the errorSummary-set and the no-errorSummary branches with
+* `retry_set_domain` + leaseUuid (Copilot fix-4, PR #71):
+*   - `setItemCustomDomain` throws → wrap with prefix + leaseUuid +
+*     code preservation. Most likely cause: chain rejected the
+*     set-item-custom-domain tx (FQDN validation, reserved-suffix
+*     match, lease not active, etc.).
+*   - `fetchActiveLease` / `resolveProviderUrl` throw → wrap with
+*     prefix + leaseUuid.
+*   - `uploadLeaseData` throws → wrap with prefix + leaseUuid.
+*   - `pollLeaseUntilReady` throws → wrap with prefix + leaseUuid.
+*   - Post-poll re-classify outcome !== 'active' → wrap both
+*     branches: errorSummary-set (terminal-state response) AND
+*     no-errorSummary fallback (ACTIVE-with-no-instances Defense #2
+*     race) carry prefix + leaseUuid.
+*/
+async function retrySetDomainAndComplete(leaseUuid, spec, opts, callbacks, ctx) {
+	const domain = customDomainOf(spec);
+	if (!domain) throw new ManifestMCPError(ManifestMCPErrorCode.INVALID_CONFIG, "retry_set_domain requires a customDomain in spec.");
+	const serviceName = customDomainServiceOf(spec);
+	const setItemOpts = serviceName ? { serviceName } : void 0;
+	try {
+		await setItemCustomDomain(opts.clientManager, leaseUuid, domain, setItemOpts);
+	} catch (err) {
+		const reason = err instanceof Error ? `retry_set_domain set-item-custom-domain failed for lease ${leaseUuid}: ${err.message}` : `retry_set_domain set-item-custom-domain failed for lease ${leaseUuid}: ${String(err)}`;
+		throw new ManifestMCPError(err instanceof ManifestMCPError ? err.code : ManifestMCPErrorCode.TX_FAILED, reason);
+	}
+	const queryClient = await opts.clientManager.getQueryClient();
+	let lease;
+	let providerApiUrl;
+	try {
+		lease = await fetchActiveLease(queryClient, leaseUuid, "cannot complete retry_set_domain");
+		providerApiUrl = await resolveProviderUrl(queryClient, lease.providerUuid);
+	} catch (err) {
+		const reason = err instanceof Error ? `retry_set_domain failed to resolve provider for lease ${leaseUuid}: ${err.message}` : `retry_set_domain failed to resolve provider for lease ${leaseUuid}: ${String(err)}`;
+		throw new ManifestMCPError(err instanceof ManifestMCPError ? err.code : ManifestMCPErrorCode.TX_FAILED, reason);
+	}
+	const manifestBytes = new TextEncoder().encode(ctx.manifestJson);
+	try {
+		const leaseDataAuthToken = await ctx.getLeaseDataAuthToken(ctx.tenantAddress, leaseUuid, ctx.metaHash);
+		await uploadLeaseData(providerApiUrl, leaseUuid, manifestBytes, leaseDataAuthToken, opts.fetchFn);
+	} catch (err) {
+		const reason = err instanceof Error ? `retry_set_domain manifest upload failed for lease ${leaseUuid}: ${err.message}` : `retry_set_domain manifest upload failed for lease ${leaseUuid}: ${String(err)}`;
+		throw new ManifestMCPError(err instanceof ManifestMCPError ? err.code : ManifestMCPErrorCode.TX_FAILED, reason);
+	}
+	const pollStartMs = Date.now();
+	let attempt = 0;
+	let pollResult;
+	try {
+		pollResult = await pollLeaseUntilReady(providerApiUrl, leaseUuid, () => ctx.getAuthToken(ctx.tenantAddress, leaseUuid), {
+			timeoutMs: opts.waitForReadyTimeoutMs ?? 48e4,
+			onProgress: (status) => {
+				attempt += 1;
+				const stateName = decode(status.state);
+				callbacks.onProgress?.({
+					kind: "polling_for_readiness",
+					leaseUuid,
+					attempt,
+					elapsedMs: Date.now() - pollStartMs,
+					...stateName !== void 0 ? { state: stateName } : {}
+				});
+			}
+		}, opts.fetchFn);
+	} catch (err) {
+		const reason = err instanceof Error ? `retry_set_domain pollLeaseUntilReady failed for lease ${leaseUuid}: ${err.message}` : `retry_set_domain pollLeaseUntilReady failed for lease ${leaseUuid}: ${String(err)}`;
+		throw new ManifestMCPError(err instanceof ManifestMCPError ? err.code : ManifestMCPErrorCode.TX_FAILED, reason);
+	}
+	const classification = classifyDeployResponse({
+		lease_uuid: leaseUuid,
+		provider_uuid: lease.providerUuid,
+		provider_url: providerApiUrl,
+		state: pollResult.state,
+		connection: pollResult
+	});
+	if (classification.outcome !== "active") {
+		const reason = classification.errorSummary !== void 0 ? `retry_set_domain post-poll re-classification failed for lease ${leaseUuid}: ${classification.errorSummary}` : `retry_set_domain: pollLeaseUntilReady returned for lease ${leaseUuid} but post-poll classifier outcome is ${classification.outcome}`;
+		throw new ManifestMCPError(ManifestMCPErrorCode.TX_FAILED, reason);
+	}
+	callbacks.onProgress?.({
+		kind: "app_ready_confirmed",
+		leaseUuid
+	});
+	const persistedPath = await tryPersistManifest({
+		leaseUuid,
+		image: primaryImage(spec),
+		size: requestedSize(spec),
+		metaHash: ctx.metaHash,
+		chainId: ctx.chainId,
+		manifestJson: ctx.manifestJson,
+		customDomain: domain,
+		customDomainService: serviceName,
+		dataDir: opts.dataDir,
+		callbacks
+	});
+	const liveState = pollResult.state;
+	let leaseStateDecoded;
+	const decoded = decode(liveState);
+	if (decoded === void 0) throw new ManifestMCPError(ManifestMCPErrorCode.INVALID_CONFIG, `Unrecognized lease state from pollLeaseUntilReady response: ${String(liveState)}. Cannot safely classify; refusing to silently coerce to ACTIVE.`);
+	leaseStateDecoded = decoded;
+	const endpointUrls = extractRunningEndpoints(pollResult).map(formatEndpointAsUrl);
+	const result = {
+		leaseUuid,
+		providerUuid: lease.providerUuid,
+		leaseState: leaseStateDecoded,
+		urls: endpointUrls,
+		customDomain: domain,
+		manifestPath: persistedPath ?? ""
+	};
+	callbacks.onProgress?.({
+		kind: "success_rendered",
+		result
+	});
+	callbacks.onComplete?.(result);
+	return result;
+}
 function recoveryOptionLabel(id) {
 	switch (id) {
 		case "retry_set_domain": return "Retry set-domain + upload";