@manifest-network/manifest-mcp-fred 0.8.0 → 0.10.0

package/README.md

@@ -1,6 +1,6 @@
 # @manifest-network/manifest-mcp-fred
 
-MCP server for Manifest provider (Fred) operations. Registers 8 tools for app deployment, status, logs, restart, update, diagnostics, and releases. Composes on-chain operations with off-chain provider HTTP calls using ADR-036 authentication.
+MCP server for Manifest provider (Fred) operations. Registers 11 tools (plus 3 MCP resources and 3 prompts) for catalog browsing, deployment readiness, manifest preview, app deployment, status, logs, restart, update, diagnostics, releases, and ready-state polling. Composes on-chain operations with off-chain provider HTTP calls using ADR-036 authentication.
 
 This package also **exports all tool functions and HTTP clients** for use by library consumers without requiring the MCP protocol.
 
@@ -15,7 +15,10 @@ npm install @manifest-network/manifest-mcp-fred
 | Tool | Description |
 |------|-------------|
 | `browse_catalog` | Browse available providers and service tiers with health checks |
-| `deploy_app` | Deploy a new application (create lease + deploy container) |
+| `check_deployment_readiness` | Pre-flight checks (balance, SKU availability, image pull) before `deploy_app` |
+| `build_manifest_preview` | Preview the SDL/manifest that `deploy_app` would submit |
+| `deploy_app` | Deploy a new application (create lease + deploy container, optional custom domain) |
+| `wait_for_app_ready` | Poll provider until a deployed app reports ready |
 | `app_status` | Get detailed status for a deployed app by lease UUID |
 | `get_logs` | Get logs for a deployed app by lease UUID |
 | `restart_app` | Restart a deployed app via the provider |
@@ -23,6 +26,10 @@ npm install @manifest-network/manifest-mcp-fred
 | `app_diagnostics` | Get provision diagnostics for a deployed app |
 | `app_releases` | Get release/version history for a deployed app |
 
+## Resources & prompts
+
+The Fred server also exposes 3 MCP resources (`manifest://leases/active`, `manifest://leases/recent`, `manifest://providers`) and 3 prompts (`deploy-containerized-app`, `diagnose-failing-app`, `shutdown-all-leases`).
+
 ## Usage
 
 ### As an MCP server (via node package)

package/dist/http/auth.d.ts

@@ -14,6 +14,18 @@ declare class AuthTimestampTracker {
   private queue;
   next(): Promise<number>;
 }
+/**
+ * Build the ADR-036 sign message for a generic provider/Fred call.
+ *
+ * NOTE (security): the message currently scopes a token to a tenant + lease +
+ * timestamp, but not to a specific HTTP operation. If the provider's replay
+ * tracker is per-endpoint rather than global, a token issued for a read
+ * endpoint (e.g. status) could be replayed against a mutating endpoint
+ * (e.g. restart, update) within the 30 s replay window. Tightening this
+ * requires a coordinated server change to also validate an operation scope —
+ * do not change this format unilaterally without updating the provider/Fred
+ * verifier in lockstep, or every auth call will fail.
+ */
 declare function createSignMessage(tenant: string, leaseUuid: string, timestamp: number): string;
 declare function createLeaseDataSignMessage(leaseUuid: string, metaHashHex: string, timestamp: number): string;
 interface AuthTokenPayload {

package/dist/http/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","names":[],"sources":["../../src/http/auth.ts"],"mappings":";;AAYA;;;;;;;;;cAAa,oBAAA;EAAA,QACH,IAAA;EAAA,QACA,KAAA;EAER,IAAA,CAAA,GAAQ,OAAA;AAAA;AAAA,iBAkBM,iBAAA,CACd,MAAA,UACA,SAAA,UACA,SAAA;AAAA,iBAKc,0BAAA,CACd,SAAA,UACA,WAAA,UACA,SAAA;AAAA,UAKe,gBAAA;EAAA,SACN,MAAA;EAAA,SACA,UAAA;EAAA,SACA,SAAA;EAAA,SACA,OAAA;EAAA,SACA,SAAA;EAAA,SACA,SAAA;AAAA;AAAA,iBAGK,eAAA,CACd,MAAA,UACA,SAAA,UACA,SAAA,UACA,MAAA,UACA,SAAA,UACA,WAAA"}
+{"version":3,"file":"auth.d.ts","names":[],"sources":["../../src/http/auth.ts"],"mappings":";;AAYA;;;;;;;;;cAAa,oBAAA;EAAA,QACH,IAAA;EAAA,QACA,KAAA;EAER,IAAA,CAAA,GAAQ,OAAA;AAAA;;;;;;AAsCV;;;;;;;iBARgB,iBAAA,CACd,MAAA,UACA,SAAA,UACA,SAAA;AAAA,iBAKc,0BAAA,CACd,SAAA,UACA,WAAA,UACA,SAAA;AAAA,UAKe,gBAAA;EAAA,SACN,MAAA;EAAA,SACA,UAAA;EAAA,SACA,SAAA;EAAA,SACA,OAAA;EAAA,SACA,SAAA;EAAA,SACA,SAAA;AAAA;AAAA,iBAGK,eAAA,CACd,MAAA,UACA,SAAA,UACA,SAAA,UACA,MAAA,UACA,SAAA,UACA,WAAA"}

package/dist/http/auth.js

@@ -30,6 +30,18 @@ var AuthTimestampTracker = class {
 		return result;
 	}
 };
+/**
+* Build the ADR-036 sign message for a generic provider/Fred call.
+*
+* NOTE (security): the message currently scopes a token to a tenant + lease +
+* timestamp, but not to a specific HTTP operation. If the provider's replay
+* tracker is per-endpoint rather than global, a token issued for a read
+* endpoint (e.g. status) could be replayed against a mutating endpoint
+* (e.g. restart, update) within the 30 s replay window. Tightening this
+* requires a coordinated server change to also validate an operation scope —
+* do not change this format unilaterally without updating the provider/Fred
+* verifier in lockstep, or every auth call will fail.
+*/
 function createSignMessage(tenant, leaseUuid, timestamp) {
 	return `${tenant}:${leaseUuid}:${timestamp}`;
 }

package/dist/http/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","names":[],"sources":["../../src/http/auth.ts"],"sourcesContent":["import { toBase64 } from '@cosmjs/encoding';\n\n/**\n * Produces unix-second timestamps guaranteed unique across calls.\n *\n * ADR-036 signing is deterministic, so tokens sharing the same timestamp\n * produce identical signatures. The provider's replay tracker rejects\n * duplicate signatures on protected endpoints (connection, restart, update).\n * We wait for the wall clock to advance rather than drifting into the future\n * (the provider enforces a 30 s max token age and 10 s max-future-skew).\n * A promise queue serializes concurrent callers.\n */\nexport class AuthTimestampTracker {\n  private last = 0;\n  private queue: Promise<number> = Promise.resolve(0);\n\n  next(): Promise<number> {\n    const result = this.queue.then(async () => {\n      let now = Math.floor(Date.now() / 1000);\n      while (now <= this.last) {\n        // Cap sleep at 1 s so forward clock jumps (e.g. NTP) are\n        // picked up quickly instead of waiting the full precomputed delay.\n        const sleepMs = Math.min((this.last - now + 1) * 1000, 1000);\n        await new Promise((resolve) => setTimeout(resolve, sleepMs));\n        now = Math.floor(Date.now() / 1000);\n      }\n      this.last = now;\n      return now;\n    });\n    this.queue = result.catch(() => this.last);\n    return result;\n  }\n}\n\nexport function createSignMessage(\n  tenant: string,\n  leaseUuid: string,\n  timestamp: number,\n): string {\n  return `${tenant}:${leaseUuid}:${timestamp}`;\n}\n\nexport function createLeaseDataSignMessage(\n  leaseUuid: string,\n  metaHashHex: string,\n  timestamp: number,\n): string {\n  return `manifest lease data ${leaseUuid} ${metaHashHex} ${timestamp}`;\n}\n\nexport interface AuthTokenPayload {\n  readonly tenant: string;\n  readonly lease_uuid: string;\n  readonly timestamp: number;\n  readonly pub_key: string;\n  readonly signature: string;\n  readonly meta_hash?: string;\n}\n\nexport function createAuthToken(\n  tenant: string,\n  leaseUuid: string,\n  timestamp: number,\n  pubKey: string,\n  signature: string,\n  metaHashHex?: string,\n): string {\n  const payload: AuthTokenPayload = {\n    tenant,\n    lease_uuid: leaseUuid,\n    timestamp,\n    pub_key: pubKey,\n    signature,\n    ...(metaHashHex !== undefined && { meta_hash: metaHashHex }),\n  };\n  return toBase64(new TextEncoder().encode(JSON.stringify(payload)));\n}\n"],"mappings":";;;;;;;;;;;;AAYA,IAAa,uBAAb,MAAkC;;AAChC,OAAQ,OAAO;AACf,OAAQ,QAAyB,QAAQ,QAAQ,EAAE;;CAEnD,OAAwB;EACtB,MAAM,SAAS,KAAK,MAAM,KAAK,YAAY;GACzC,IAAI,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;AACvC,UAAO,OAAO,KAAK,MAAM;IAGvB,MAAM,UAAU,KAAK,KAAK,KAAK,OAAO,MAAM,KAAK,KAAM,IAAK;AAC5D,UAAM,IAAI,SAAS,YAAY,WAAW,SAAS,QAAQ,CAAC;AAC5D,UAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;;AAErC,QAAK,OAAO;AACZ,UAAO;IACP;AACF,OAAK,QAAQ,OAAO,YAAY,KAAK,KAAK;AAC1C,SAAO;;;AAIX,SAAgB,kBACd,QACA,WACA,WACQ;AACR,QAAO,GAAG,OAAO,GAAG,UAAU,GAAG;;AAGnC,SAAgB,2BACd,WACA,aACA,WACQ;AACR,QAAO,uBAAuB,UAAU,GAAG,YAAY,GAAG;;AAY5D,SAAgB,gBACd,QACA,WACA,WACA,QACA,WACA,aACQ;CACR,MAAM,UAA4B;EAChC;EACA,YAAY;EACZ;EACA,SAAS;EACT;EACA,GAAI,gBAAgB,KAAA,KAAa,EAAE,WAAW,aAAa;EAC5D;AACD,QAAO,SAAS,IAAI,aAAa,CAAC,OAAO,KAAK,UAAU,QAAQ,CAAC,CAAC"}
+{"version":3,"file":"auth.js","names":[],"sources":["../../src/http/auth.ts"],"sourcesContent":["import { toBase64 } from '@cosmjs/encoding';\n\n/**\n * Produces unix-second timestamps guaranteed unique across calls.\n *\n * ADR-036 signing is deterministic, so tokens sharing the same timestamp\n * produce identical signatures. The provider's replay tracker rejects\n * duplicate signatures on protected endpoints (connection, restart, update).\n * We wait for the wall clock to advance rather than drifting into the future\n * (the provider enforces a 30 s max token age and 10 s max-future-skew).\n * A promise queue serializes concurrent callers.\n */\nexport class AuthTimestampTracker {\n  private last = 0;\n  private queue: Promise<number> = Promise.resolve(0);\n\n  next(): Promise<number> {\n    const result = this.queue.then(async () => {\n      let now = Math.floor(Date.now() / 1000);\n      while (now <= this.last) {\n        // Cap sleep at 1 s so forward clock jumps (e.g. NTP) are\n        // picked up quickly instead of waiting the full precomputed delay.\n        const sleepMs = Math.min((this.last - now + 1) * 1000, 1000);\n        await new Promise((resolve) => setTimeout(resolve, sleepMs));\n        now = Math.floor(Date.now() / 1000);\n      }\n      this.last = now;\n      return now;\n    });\n    this.queue = result.catch(() => this.last);\n    return result;\n  }\n}\n\n/**\n * Build the ADR-036 sign message for a generic provider/Fred call.\n *\n * NOTE (security): the message currently scopes a token to a tenant + lease +\n * timestamp, but not to a specific HTTP operation. If the provider's replay\n * tracker is per-endpoint rather than global, a token issued for a read\n * endpoint (e.g. status) could be replayed against a mutating endpoint\n * (e.g. restart, update) within the 30 s replay window. Tightening this\n * requires a coordinated server change to also validate an operation scope —\n * do not change this format unilaterally without updating the provider/Fred\n * verifier in lockstep, or every auth call will fail.\n */\nexport function createSignMessage(\n  tenant: string,\n  leaseUuid: string,\n  timestamp: number,\n): string {\n  return `${tenant}:${leaseUuid}:${timestamp}`;\n}\n\nexport function createLeaseDataSignMessage(\n  leaseUuid: string,\n  metaHashHex: string,\n  timestamp: number,\n): string {\n  return `manifest lease data ${leaseUuid} ${metaHashHex} ${timestamp}`;\n}\n\nexport interface AuthTokenPayload {\n  readonly tenant: string;\n  readonly lease_uuid: string;\n  readonly timestamp: number;\n  readonly pub_key: string;\n  readonly signature: string;\n  readonly meta_hash?: string;\n}\n\nexport function createAuthToken(\n  tenant: string,\n  leaseUuid: string,\n  timestamp: number,\n  pubKey: string,\n  signature: string,\n  metaHashHex?: string,\n): string {\n  const payload: AuthTokenPayload = {\n    tenant,\n    lease_uuid: leaseUuid,\n    timestamp,\n    pub_key: pubKey,\n    signature,\n    ...(metaHashHex !== undefined && { meta_hash: metaHashHex }),\n  };\n  return toBase64(new TextEncoder().encode(JSON.stringify(payload)));\n}\n"],"mappings":";;;;;;;;;;;;AAYA,IAAa,uBAAb,MAAkC;;AAChC,OAAQ,OAAO;AACf,OAAQ,QAAyB,QAAQ,QAAQ,EAAE;;CAEnD,OAAwB;EACtB,MAAM,SAAS,KAAK,MAAM,KAAK,YAAY;GACzC,IAAI,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;AACvC,UAAO,OAAO,KAAK,MAAM;IAGvB,MAAM,UAAU,KAAK,KAAK,KAAK,OAAO,MAAM,KAAK,KAAM,IAAK;AAC5D,UAAM,IAAI,SAAS,YAAY,WAAW,SAAS,QAAQ,CAAC;AAC5D,UAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;;AAErC,QAAK,OAAO;AACZ,UAAO;IACP;AACF,OAAK,QAAQ,OAAO,YAAY,KAAK,KAAK;AAC1C,SAAO;;;;;;;;;;;;;;;AAgBX,SAAgB,kBACd,QACA,WACA,WACQ;AACR,QAAO,GAAG,OAAO,GAAG,UAAU,GAAG;;AAGnC,SAAgB,2BACd,WACA,aACA,WACQ;AACR,QAAO,uBAAuB,UAAU,GAAG,YAAY,GAAG;;AAY5D,SAAgB,gBACd,QACA,WACA,WACA,QACA,WACA,aACQ;CACR,MAAM,UAA4B;EAChC;EACA,YAAY;EACZ;EACA,SAAS;EACT;EACA,GAAI,gBAAgB,KAAA,KAAa,EAAE,WAAW,aAAa;EAC5D;AACD,QAAO,SAAS,IAAI,aAAa,CAAC,OAAO,KAAK,UAAU,QAAQ,CAAC,CAAC"}

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { AuthTokenPayload, createAuthToken, createLeaseDataSignMessage, createSignMessage } from "./http/auth.js";
+import { AuthTimestampTracker, AuthTokenPayload, createAuthToken, createLeaseDataSignMessage, createSignMessage } from "./http/auth.js";
 import { ConnectionDetails, InstanceInfo, LeaseConnectionResponse, ProviderApiError, ProviderHealthResponse, ServiceConnectionDetails, checkedFetch, getLeaseConnectionInfo, getProviderHealth, uploadLeaseData, validateProviderUrl } from "./http/provider.js";
 import { FredActionResponse, FredInstanceInfo, FredLeaseInfo, FredLeaseLogs, FredLeaseProvision, FredLeaseRelease, FredLeaseReleases, FredLeaseStatus, FredServiceStatus, MAX_TAIL, PollOptions, TerminalChainLeaseState, TerminalChainState, TerminalChainStateContext, TerminalChainStateError, getLeaseInfo, getLeaseLogs, getLeaseProvision, getLeaseReleases, getLeaseStatus, pollLeaseUntilReady, restartLease, updateLease } from "./http/fred.js";
 import { BuildManifestOptions, ManifestFormat, ManifestValidationResult, buildManifest, buildStackManifest, deriveAppNameFromImage, getServiceNames, isStackManifest, mergeManifest, metaHashHex, normalizePorts, parseStackManifest, validateManifest, validateServiceName } from "./manifest.js";
@@ -23,24 +23,11 @@ declare class FredMCPServer {
   private walletProvider;
   private authTokens;
   constructor(options: ManifestMCPServerOptions$1);
-  private registerTools;
-  private registerResources;
-  private registerPrompts;
-  /**
-   * Builds a fire-and-forget progress emitter for a long-running tool.
-   * Returns `undefined` if the caller didn't request progress (no
-   * `progressToken` in `extra._meta`); callers can branch on that to skip
-   * notification work entirely.
-   *
-   * Notifications are best-effort: failures are logged but don't fail the
-   * tool. Each call increments the progress counter.
-   */
-  private progressEmitter;
   getServer(): Server;
   getClientManager(): CosmosClientManager;
   disconnect(): void;
 }
 declare function createMnemonicFredServer(config: MnemonicServerConfig): Promise<FredMCPServer>;
 //#endregion
-export { type AuthTokenPayload, type BuildManifestOptions, type BuildManifestPreviewInput, type BuildManifestPreviewResult, type CheckDeploymentReadinessInput, type CheckDeploymentReadinessResult, type ConnectionDetails, type DeployAppInput, type DeployAppResult, type FredActionResponse, type FredInstanceInfo, type FredLeaseInfo, type FredLeaseLogs, type FredLeaseProvision, type FredLeaseRelease, type FredLeaseReleases, type FredLeaseStatus, FredMCPServer, type FredServiceStatus, INFRASTRUCTURE_ERROR_CODES, type InstanceInfo, type LeaseConnectionResponse, MAX_TAIL, type ManifestFormat, ManifestMCPError, ManifestMCPErrorCode, type ManifestMCPServerOptions, type ManifestPreviewServiceInput, type ManifestValidationResult, type PollOptions, ProviderApiError, type ProviderHealthResponse, type ServiceConfig, type ServiceConnectionDetails, type SkuSummary, type TerminalChainLeaseState, type TerminalChainState, type TerminalChainStateContext, TerminalChainStateError, type WaitForAppReadyOptions, type WaitForAppReadyResult, appStatus, browseCatalog, buildManifest, buildManifestPreview, buildStackManifest, checkDeploymentReadiness, checkedFetch, createAuthToken, createLeaseDataSignMessage, createMnemonicFredServer, createSignMessage, deployApp, deriveAppNameFromImage, fetchActiveLease, getAppLogs, getLeaseConnectionInfo, getLeaseInfo, getLeaseLogs, getLeaseProvision, getLeaseReleases, getLeaseStatus, getProviderHealth, getServiceNames, isStackManifest, mapWithConcurrency, mergeManifest, metaHashHex, normalizePorts, parseStackManifest, pollLeaseUntilReady, resolveProviderUrl, restartApp, restartLease, updateApp, updateLease, uploadLeaseData, validateManifest, validateProviderUrl, validateServiceName, waitForAppReady };
+export { AuthTimestampTracker, type AuthTokenPayload, type BuildManifestOptions, type BuildManifestPreviewInput, type BuildManifestPreviewResult, type CheckDeploymentReadinessInput, type CheckDeploymentReadinessResult, type ConnectionDetails, type DeployAppInput, type DeployAppResult, type FredActionResponse, type FredInstanceInfo, type FredLeaseInfo, type FredLeaseLogs, type FredLeaseProvision, type FredLeaseRelease, type FredLeaseReleases, type FredLeaseStatus, FredMCPServer, type FredServiceStatus, INFRASTRUCTURE_ERROR_CODES, type InstanceInfo, type LeaseConnectionResponse, MAX_TAIL, type ManifestFormat, ManifestMCPError, ManifestMCPErrorCode, type ManifestMCPServerOptions, type ManifestPreviewServiceInput, type ManifestValidationResult, type PollOptions, ProviderApiError, type ProviderHealthResponse, type ServiceConfig, type ServiceConnectionDetails, type SkuSummary, type TerminalChainLeaseState, type TerminalChainState, type TerminalChainStateContext, TerminalChainStateError, type WaitForAppReadyOptions, type WaitForAppReadyResult, appStatus, browseCatalog, buildManifest, buildManifestPreview, buildStackManifest, checkDeploymentReadiness, checkedFetch, createAuthToken, createLeaseDataSignMessage, createMnemonicFredServer, createSignMessage, deployApp, deriveAppNameFromImage, fetchActiveLease, getAppLogs, getLeaseConnectionInfo, getLeaseInfo, getLeaseLogs, getLeaseProvision, getLeaseReleases, getLeaseStatus, getProviderHealth, getServiceNames, isStackManifest, mapWithConcurrency, mergeManifest, metaHashHex, normalizePorts, parseStackManifest, pollLeaseUntilReady, resolveProviderUrl, restartApp, restartLease, updateApp, updateLease, uploadLeaseData, validateManifest, validateProviderUrl, validateServiceName, waitForAppReady };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../src/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;cA+Ia,aAAA;EAAA,QACH,SAAA;EAAA,QACA,aAAA;EAAA,QACA,cAAA;EAAA,QACA,UAAA;cAEI,OAAA,EAAS,0BAAA;EAAA,QA4Bb,aAAA;EAAA,QAu2BA,iBAAA;EAAA,QAgKA,eAAA;EAviCA;;;;;;;;;EAAA,QA2qCA,eAAA;EA0BR,SAAA,CAAA,GAAa,MAAA;EAIb,gBAAA,CAAA,GAAoB,mBAAA;EAIpB,UAAA,CAAA;AAAA;AAAA,iBAKc,wBAAA,CACd,MAAA,EAAQ,oBAAA,GACP,OAAA,CAAQ,aAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../src/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;cAkHa,aAAA;EAAA,QACH,SAAA;EAAA,QACA,aAAA;EAAA,QACA,cAAA;EAAA,QACA,UAAA;cAEI,OAAA,EAAS,0BAAA;EAqCrB,SAAA,CAAA,GAAa,MAAA;EAIb,gBAAA,CAAA,GAAoB,mBAAA;EAIpB,UAAA,CAAA;AAAA;AAAA,iBAKc,wBAAA,CACd,MAAA,EAAQ,oBAAA,GACP,OAAA,CAAQ,aAAA"}