insta 0.0.1 → 0.0.2

package/README.md

@@ -0,0 +1,117 @@
+# insta-cli
+
+InstaCloud CLI (`insta`) — a thin client of the [platform](../platform) control-plane API.
+管理 project / branch / secrets / deploy / governance，面向开发者与 agent。
+
+技术栈：Node 20 + TypeScript（ESM）+ commander。所有命令都是平台 API 的封装。
+
+## 安装
+
+**一键装（原生二进制，无需 node）** — macOS / Linux / WSL：
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/InsForge/insta-cli/main/install.sh | sh
+#   装到 ~/.insta/bin/insta（可 INSTA_INSTALL_DIR 覆盖）；校验 SHA256SUMS。
+#   固定版本：curl -fsSL .../install.sh | INSTA_VERSION=v0.1.0 sh
+# Windows：从 releases 页下载 insta-windows-x64.exe。
+```
+
+**从源码构建（需 node）：**
+
+```bash
+npm install
+npm run build         # -> dist/index.js（bin: insta；纯 JS，运行需 node）
+node dist/index.js --help
+```
+
+### 自己出二进制（Bun 交叉编译）
+
+`install.sh` 装的二进制由 CI（tag `v*` → `.github/workflows/release.yml`）用 Bun 交叉编译并发到 GitHub
+releases。本地也可出：需 [Bun](https://bun.sh)。npm 包仍发布 JS（`dist/index.js`）——二进制是另一条渠道。
+
+```bash
+npm run compile            # 只编译当前平台 -> dist/bin/insta
+npm run build:binaries     # 交叉编译全平台 -> dist/bin/insta-<os>-<arch>(.exe) + SHA256SUMS
+#   版本号（baked 进 `insta --version`）默认取 package.json，也可传参：bash scripts/build-binaries.sh 1.2.3
+```
+
+产物形如 `insta-darwin-arm64` / `insta-linux-x64` / `insta-windows-x64.exe`（`file` 显示 Mach-O/ELF/PE 原生可执行）。
+`dist/` 已 gitignore；二进制不入库，交给 CI 发到 releases。
+
+## Quickstart
+
+```bash
+# 指向控制面（默认 http://localhost:8080，可用 $INSTA_API_URL 或 --api-url 覆盖）
+insta login --email you@example.com --password ****** --api-url http://localhost:8080
+insta project create my-app          # 新建空 project 并 link 当前目录（默认不含 service）
+insta services add postgres db       # 按需添加 service（postgres/storage/compute）
+insta services add compute api       # compute 用于部署镜像
+insta secrets                        # 把当前 branch 的凭证写入 ./.env（secret seam）
+insta deploy --image <registry/img>  # 部署容器镜像到当前 branch 的 compute service
+insta status                         # 登录态 + 已 link 的 project/branch
+```
+
+## 命令
+
+| 命令 | 说明 |
+|------|------|
+| `insta login [--email --password --api-url]` | 登录（email/password；token 自动 refresh） |
+| `insta login --oauth <github\|google>` | 浏览器 OAuth 登录（启本地回环端口，浏览器授权后自动带回 token） |
+| `insta logout` / `insta status [--json]` | 登出 / 查看状态 |
+| `insta org list [--json]` / `org create <name>` | 组织（每个用户仅可拥有一个 free org） |
+| `insta project create <name> [--org]` | 新建空 project 并 link（默认不含任何 service） |
+| `insta project list [--org] [--json]` / `link <id>` / `delete` | 项目管理 |
+| `insta services add <postgres\|storage\|compute> <name>` | 按需 provision 一个 service（postgres/compute 分配默认访问域名） |
+| `insta services list [--json]` / `services remove <type> <name>` | 列出 / 删除 service |
+| `insta services scale compute <name> <number> [region]` | 设置 compute 机器数（付费档；free 拒绝） |
+| `insta services upgrade <compute\|postgres> <name> <spec>` | 升级 spec（付费档；只升不降） |
+| `insta branch create <name> [--from]` | 新建分支环境（物化 project 当前的 services；每 project 上限 10 个 branch） |
+| `insta branch list [--json]` / `switch <name>` / `delete <name>` | 分支管理 |
+| `insta secrets [--branch -o --print --json]` | secret seam：凭证写入 `.env` |
+| `insta secrets list [--branch]` | 仅列出 secret 名 |
+| `insta deploy --image <url> [--branch --group --port]` | 部署镜像 |
+| `insta manifest [--json]` | agent 可读的环境清单 |
+| `insta metrics <db\|compute> [group] [--branch --from --to --step --json]` | 资源指标（compute=Fly；db 受限） |
+| `insta logs <db\|compute> [group] [--branch --limit --region --instance --json]` | 运行时日志（compute=Fly；db 受限） |
+| `insta events [--branch --limit --json]` | 审计 + agent 事件时间线 |
+| `insta usage [--from --to --json]` | 按 meter 聚合的资源用量（含 costUsd） |
+| `insta billing [--org --json]` | 当前计费周期摘要（tier / 额度 / 已用 / overage / 状态） |
+| `insta billing upgrade <pro\|enterprise> [--org --no-open --json]` | Stripe Checkout 订阅付费档，返回并打开支付链接 |
+| `insta billing portal [--org --no-open --json]` | 打开 Stripe Customer Portal（改套餐 / 卡 / 取消） |
+| `insta approvals list [--status] [--json]` | 治理审批列表 |
+| `insta approvals approve <id> [--always]` / `deny <id>` | 批准 / 拒绝（admin） |
+| `insta policy get [--json]` / `policy set <action> <decision>` | 治理策略（action 含 `service.add/remove/scale/upgrade`） |
+
+被 governance gate 的操作（`secrets.read`/`deploy`/`project.delete`/`branch.delete`/`service.add`/`service.remove`/`service.scale`/`service.upgrade`）命中审批时，
+CLI 会提示 `approval required — run: insta approvals approve <id>`。
+
+## 配置位置
+
+- 全局：`~/.insta/config.json`（apiUrl + access/refresh token + user）
+- 项目：`./.insta/project.json`（projectId / orgId / 当前 branch）
+
+## 本地端到端跑通
+
+平台提供 `dev:fake` 模式（fake provider adapters，无需 Neon/Fly/Tigris 凭证）：
+
+```bash
+# 1) 起 Postgres + 平台 dev 服务（见 ../platform）
+docker run -d --name pg -e POSTGRES_PASSWORD=insta -e POSTGRES_DB=insta_dev -p 55432:5432 postgres:16-alpine
+cd ../platform && DATABASE_URL='postgres://postgres:insta@localhost:55432/insta_dev' PORT=8899 npm run dev:fake
+
+# 2) 用 CLI 跑全流程（注册走 /auth/signup + /auth/verify-email，dev 模式验证码打印在服务端日志）
+INSTA_API_URL=http://localhost:8899 insta login --email you@x.com --password ...
+```
+
+## OAuth 浏览器登录
+
+```bash
+insta login --oauth github          # 或 google
+# CLI 起本地回环端口 → 打开浏览器到 /auth/cli/authorize → Better Auth 走 provider 授权 →
+# 平台读会话 cookie 换出 bearer token → 带回回环端口 → CLI 存为登录态
+```
+
+> 平台侧需配置该 provider 的 OAuth 应用（`GITHUB_OAUTH_CLIENT_ID/SECRET` 或 `GOOGLE_*`），
+> 且应用的回调 URL 必须是 **`{INSTA_API_BASE_URL}/api/auth/callback/<provider>`**（不是回环地址）。
+
+> `metrics` / `logs` / `usage` 已支持（usage 为采集层聚合）。多 compute service（`services add compute`）、`services scale/upgrade` 已实现；镜像构建后续加入。多 postgres/storage service（每 project >1 个）暂受 credential-seam 限制，为后续工作。

package/dist/api.js

@@ -0,0 +1,99 @@
+// Thin API client over the platform control-plane. Handles bearer auth + one-shot refresh on 401.
+// 2xx (including 202 approval_required) returns the parsed body; >=400 throws ApiError.
+import { readGlobal, writeGlobal, readProject } from './config.js';
+import { die } from './util.js';
+export class ApiError extends Error {
+    status;
+    constructor(status, msg) {
+        super(msg);
+        this.status = status;
+        this.name = 'ApiError';
+    }
+}
+export class ApiClient {
+    cfg;
+    constructor(cfg) {
+        this.cfg = cfg;
+    }
+    static async load() { return new ApiClient(await readGlobal()); }
+    get apiUrl() { return this.cfg.apiUrl; }
+    get config() { return this.cfg; }
+    async persist() { await writeGlobal(this.cfg); }
+    setApiUrl(url) { this.cfg.apiUrl = url; }
+    setSession(tokens, user) {
+        this.cfg.accessToken = tokens.accessToken;
+        this.cfg.refreshToken = tokens.refreshToken;
+        if (user)
+            this.cfg.user = user;
+    }
+    clearSession() {
+        delete this.cfg.accessToken;
+        delete this.cfg.refreshToken;
+        delete this.cfg.user;
+    }
+    // Returns parsed body for status < 400 (incl. 202); throws ApiError otherwise.
+    async request(method, path, body, opts = {}) {
+        const res = await this.raw(method, path, body, opts.auth ?? true);
+        if (res.status >= 400)
+            throw new ApiError(res.status, res.body?.error ?? `HTTP ${res.status}`);
+        return res.body;
+    }
+    // Like request but returns {status, body} so callers can branch on 202 (approval_required).
+    async rawRequest(method, path, body, opts = {}) {
+        const res = await this.raw(method, path, body, opts.auth ?? true);
+        if (res.status >= 400)
+            throw new ApiError(res.status, res.body?.error ?? `HTTP ${res.status}`);
+        return res;
+    }
+    async raw(method, path, body, auth) {
+        let r = await this.fetch(method, path, body, auth);
+        if (r.status === 401 && auth && this.cfg.refreshToken) {
+            if (await this.refresh())
+                r = await this.fetch(method, path, body, auth);
+        }
+        return r;
+    }
+    async fetch(method, path, body, auth) {
+        const headers = { 'Content-Type': 'application/json' };
+        if (auth && this.cfg.accessToken)
+            headers.Authorization = `Bearer ${this.cfg.accessToken}`;
+        const res = await fetch(this.apiUrl + path, {
+            method,
+            headers,
+            body: body === undefined ? undefined : JSON.stringify(body),
+        });
+        const text = await res.text();
+        let parsed = null;
+        try {
+            parsed = text ? JSON.parse(text) : null;
+        }
+        catch {
+            parsed = { raw: text };
+        }
+        return { status: res.status, body: parsed };
+    }
+    async refresh() {
+        try {
+            const res = await this.fetch('POST', '/auth/refresh', { refreshToken: this.cfg.refreshToken }, false);
+            if (res.status >= 400)
+                return false;
+            this.cfg.accessToken = res.body.accessToken;
+            this.cfg.refreshToken = res.body.refreshToken;
+            await this.persist();
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+// Resolve the linked project (./.insta/project.json), or null.
+export async function linkedProject() { return readProject(); }
+// Resolve the linked project or exit with guidance.
+export async function requireProject() {
+    const p = await readProject();
+    if (!p)
+        die('no linked project — run `insta project create <name>` or `insta project link <id>`');
+    return p;
+}
+//# sourceMappingURL=api.js.map

package/dist/commands/auth.js

@@ -0,0 +1,100 @@
+import { createServer } from 'node:http';
+import { randomBytes } from 'node:crypto';
+import { ApiClient, linkedProject } from '../api.js';
+import { info, die, printJson, promptPassword, openUrl } from '../util.js';
+export async function login(opts) {
+    if (opts.oauth)
+        return loginOauth(opts.oauth, opts);
+    const api = await ApiClient.load();
+    if (opts.apiUrl)
+        api.setApiUrl(opts.apiUrl);
+    if (!opts.email)
+        die('--email is required (or use --oauth <github|google>)');
+    const password = opts.password ?? process.env.INSTA_PASSWORD ?? (await promptPassword());
+    const res = await api.request('POST', '/auth/login', { email: opts.email, password }, { auth: false });
+    api.setSession(res, res.user);
+    await api.persist();
+    info(`logged in as ${res.user.email ?? res.user.id} @ ${api.apiUrl}`);
+}
+// Browser OAuth (GitHub/Google) via a loopback listener. We open the platform's CLI-OAuth bridge,
+// which runs Better Auth's social flow and bounces the resulting session token back to us.
+export async function loginOauth(provider, opts) {
+    if (provider !== 'github' && provider !== 'google')
+        die('provider must be github or google');
+    const api = await ApiClient.load();
+    if (opts.apiUrl)
+        api.setApiUrl(opts.apiUrl);
+    const token = await browserOauth(api.apiUrl, provider);
+    api.setSession({ accessToken: token, refreshToken: token });
+    const me = await api.request('GET', '/me');
+    api.setSession({ accessToken: token, refreshToken: token }, me.user);
+    await api.persist();
+    info(`logged in as ${me.user.email ?? me.user.id} @ ${api.apiUrl}`);
+}
+// Start a loopback server, open the browser at the platform bridge, and await the token.
+function browserOauth(apiUrl, provider) {
+    return new Promise((resolve, reject) => {
+        const state = randomBytes(16).toString('hex');
+        let timer;
+        const server = createServer((req, res) => {
+            const url = new URL(req.url ?? '/', 'http://127.0.0.1');
+            if (url.pathname !== '/callback') {
+                res.writeHead(404);
+                res.end();
+                return;
+            }
+            const token = url.searchParams.get('token');
+            const err = url.searchParams.get('error');
+            const ok = !!token && !err && url.searchParams.get('state') === state;
+            res.writeHead(ok ? 200 : 400, { 'content-type': 'text/html' });
+            res.end(`<!doctype html><meta charset=utf-8><body style="font-family:system-ui;text-align:center;margin-top:4rem"><h2>InstaCloud</h2><p>${ok ? '✓ Login complete — you can close this tab.' : '✗ Login failed' + (err ? ` (${err})` : '')}</p></body>`);
+            clearTimeout(timer);
+            server.close();
+            if (err)
+                return reject(new Error(`oauth failed: ${err}`));
+            if (!token)
+                return reject(new Error('no token returned'));
+            if (url.searchParams.get('state') !== state)
+                return reject(new Error('state mismatch — aborting'));
+            resolve(token);
+        });
+        server.on('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            const addr = server.address();
+            const port = typeof addr === 'object' && addr ? addr.port : 0;
+            const redirect = `http://127.0.0.1:${port}/callback`;
+            const authorizeUrl = `${apiUrl}/auth/cli/authorize?provider=${encodeURIComponent(provider)}&redirect=${encodeURIComponent(redirect)}&state=${state}`;
+            info(`opening browser to authorize with ${provider}…`);
+            if (!openUrl(authorizeUrl))
+                info(`open this URL to continue:\n  ${authorizeUrl}`);
+            timer = setTimeout(() => { server.close(); reject(new Error('timed out waiting for browser login (2m)')); }, 120_000);
+        });
+    });
+}
+export async function logout() {
+    const api = await ApiClient.load();
+    if (api.config.refreshToken) {
+        try {
+            await api.request('POST', '/auth/logout', { refreshToken: api.config.refreshToken }, { auth: false });
+        }
+        catch { /* ignore */ }
+    }
+    api.clearSession();
+    await api.persist();
+    info('logged out');
+}
+export async function status(opts) {
+    const api = await ApiClient.load();
+    let user = null;
+    try {
+        user = (await api.request('GET', '/me')).user;
+    }
+    catch { /* not logged in */ }
+    const project = await linkedProject();
+    if (opts.json)
+        return printJson({ apiUrl: api.apiUrl, user, project });
+    info(`api:     ${api.apiUrl}`);
+    info(`user:    ${user ? (user.email ?? user.id) : '(not logged in)'}`);
+    info(`project: ${project ? `${project.projectId} (branch ${project.branch})` : '(none linked)'}`);
+}
+//# sourceMappingURL=auth.js.map

package/dist/commands/billing.js

@@ -0,0 +1,52 @@
+import { ApiClient, requireProject } from '../api.js';
+import { die, info, openUrl, printJson } from '../util.js';
+// Resolve the target org: explicit --org, else the linked project's org.
+async function resolveOrgId(opts) {
+    if (opts.org)
+        return opts.org;
+    return (await requireProject()).orgId;
+}
+// insta billing — current cycle summary for the org.
+export async function billing(opts) {
+    const api = await ApiClient.load();
+    const orgId = await resolveOrgId(opts);
+    const s = await api.request('GET', `/orgs/${orgId}/billing`);
+    if (opts.json)
+        return printJson(s);
+    info(`tier:     ${s.tier}`);
+    info(`status:   ${s.status}`);
+    info(`cycle:    ${String(s.cycleStart).slice(0, 10)} → ${String(s.cycleEnd).slice(0, 10)}`);
+    info(`included: $${Number(s.includedUsd).toFixed(2)}`);
+    info(`used:     $${Number(s.usedUsd).toFixed(4)}`);
+    info(`overage:  $${Number(s.overageUsd).toFixed(4)}`);
+    if (s.status === 'suspended')
+        info('⚠  org suspended — billing limit reached; resumes next cycle (or `insta billing upgrade pro`)');
+}
+// insta billing upgrade <tier> — start a Stripe Checkout to subscribe the org to a paid tier.
+export async function billingUpgrade(tier, opts) {
+    if (tier !== 'pro' && tier !== 'enterprise')
+        die('tier must be pro|enterprise');
+    const api = await ApiClient.load();
+    const orgId = await resolveOrgId(opts);
+    const { url } = await api.request('POST', `/orgs/${orgId}/billing/checkout`, { tier });
+    if (opts.json)
+        return printJson({ url });
+    presentUrl(url, `Subscribe to ${tier} — complete checkout in your browser:`, opts.open);
+}
+// insta billing portal — open the Stripe Customer Portal (change plan / card / cancel).
+export async function billingPortal(opts) {
+    const api = await ApiClient.load();
+    const orgId = await resolveOrgId(opts);
+    const { url } = await api.request('POST', `/orgs/${orgId}/billing/portal`);
+    if (opts.json)
+        return printJson({ url });
+    presentUrl(url, 'Manage billing in your browser:', opts.open);
+}
+// Print the URL and, unless --no-open, try to open it in the browser.
+function presentUrl(url, label, open) {
+    info(label);
+    info(`  ${url}`);
+    if (open !== false && openUrl(url))
+        info('(opened in your default browser)');
+}
+//# sourceMappingURL=billing.js.map

package/dist/commands/branch.js

@@ -0,0 +1,40 @@
+import { ApiClient, requireProject } from '../api.js';
+import { writeProject } from '../config.js';
+import { info, die, printJson, handleApproval } from '../util.js';
+export async function branchCreate(name, opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const out = await api.request('POST', `/projects/${p.projectId}/branches`, { name, from: opts.from ?? p.branch });
+    info(`created branch ${out.branch.name} (${out.branch.id})`);
+}
+export async function branchList(opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const { branches } = await api.request('GET', `/projects/${p.projectId}/branches`);
+    if (opts.json)
+        return printJson(branches);
+    for (const b of branches)
+        info(`${b.is_default ? '*' : ' '} ${b.name}  [${b.status}]  ${b.id}`);
+}
+export async function branchSwitch(name) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const { branches } = await api.request('GET', `/projects/${p.projectId}/branches`);
+    if (!branches.some((b) => b.name === name))
+        die(`branch not found: ${name}`);
+    await writeProject({ ...p, branch: name });
+    info(`switched to branch ${name} — run \`insta secrets\` to refresh .env`);
+}
+export async function branchDelete(name) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const { branches } = await api.request('GET', `/projects/${p.projectId}/branches`);
+    const b = branches.find((x) => x.name === name || x.id === name);
+    if (!b)
+        die(`branch not found: ${name}`);
+    const res = await api.rawRequest('DELETE', `/projects/${p.projectId}/branches/${b.id}`);
+    if (handleApproval(res))
+        return;
+    info(`deleted branch ${name}`);
+}
+//# sourceMappingURL=branch.js.map

package/dist/commands/compute.js

@@ -0,0 +1,45 @@
+import { ApiClient, requireProject } from '../api.js';
+import { info, printJson, handleApproval } from '../util.js';
+// Attach a developer-owned custom domain to a branch's compute service. Fly issues the cert + routes
+// it; the platform returns the DNS records to set in your OWN zone.
+export async function setDomain(host, opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const res = await api.rawRequest('POST', `/projects/${p.projectId}/compute/domain`, { hostname: host, branch: opts.branch ?? p.branch, group: opts.group });
+    if (handleApproval(res))
+        return;
+    printDomain(res.body, opts.json);
+}
+// Re-check a custom domain's cert status + required DNS records.
+export async function checkDomain(host, opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const qs = new URLSearchParams({ hostname: host });
+    if (opts.branch ?? p.branch)
+        qs.set('branch', opts.branch ?? p.branch);
+    if (opts.group)
+        qs.set('group', opts.group);
+    printDomain(await api.request('GET', `/projects/${p.projectId}/compute/domain?${qs}`), opts.json);
+}
+export async function removeDomain(host, opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const res = await api.rawRequest('DELETE', `/projects/${p.projectId}/compute/domain`, { hostname: host, branch: opts.branch ?? p.branch, group: opts.group });
+    if (handleApproval(res))
+        return;
+    info(`removed custom domain ${res.body.hostname} from ${res.body.flyApp}`);
+}
+function printDomain(r, json) {
+    if (json)
+        return printJson(r);
+    info(`${r.hostname} → ${r.flyApp}`);
+    info(`  status: ${r.status}${r.configured ? ' ✓ configured' : ''}`);
+    if (r.dns?.length) {
+        info('  set these DNS records at your domain registrar:');
+        for (const d of r.dns)
+            info(`    ${String(d.type).padEnd(5)} ${d.name}  →  ${d.value}${d.note ? `   # ${d.note}` : ''}`);
+    }
+    if (!r.configured)
+        info('  once DNS propagates, Fly issues the cert — re-check with `insta compute check-domain`');
+}
+//# sourceMappingURL=compute.js.map

package/dist/commands/deploy.js

@@ -0,0 +1,44 @@
+import { resolve, join } from 'node:path';
+import { existsSync } from 'node:fs';
+import { ApiClient, requireProject } from '../api.js';
+import { info, die, handleApproval } from '../util.js';
+import { flyctlBuildAndPush, ensureFlyctl } from '../flyctl-build.js';
+// Deploy either a prebuilt image (`--image`) or a source directory (positional `<dir>`, built
+// remotely on Fly and pushed with a short-lived platform-minted token). Exactly one mode.
+export async function deploy(dir, opts) {
+    if (dir && opts.image)
+        die('pick one: a source <dir> OR --image <url>, not both');
+    if (!dir && !opts.image)
+        die('usage: insta deploy <dir> | --image <url>  [--branch <b>] [--group <g>] [--port <n>]');
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const branch = opts.branch ?? p.branch;
+    const image = dir ? await buildFromSource(api, p.projectId, dir, branch, opts) : opts.image;
+    const res = await api.rawRequest('POST', `/projects/${p.projectId}/deploy`, {
+        image,
+        branch,
+        group: opts.group,
+        port: opts.port ? Number(opts.port) : undefined,
+    });
+    if (handleApproval(res))
+        return;
+    info(`deployed ${image} -> ${res.body.url} (branch ${res.body.branch}, group ${res.body.group})`);
+}
+// Source mode: mint a scoped Fly deploy token from the platform, then build+push <dir> (needs a
+// Dockerfile) with flyctl's remote builder, returning the pushed image ref to deploy.
+async function buildFromSource(api, projectId, dir, branch, opts) {
+    const absDir = resolve(process.cwd(), dir);
+    if (!existsSync(join(absDir, 'Dockerfile')))
+        die(`no Dockerfile at ${join(absDir, 'Dockerfile')} — add one, or use --image <url>`);
+    await ensureFlyctl();
+    const port = opts.port ? Number(opts.port) : 8080;
+    const tok = await api.rawRequest('POST', `/projects/${projectId}/deploy-token`, { branch, group: opts.group });
+    if (handleApproval(tok))
+        die('deploy requires approval — get it approved, then re-run');
+    const { token, flyApp } = tok.body;
+    info(`building ${dir} for ${flyApp} (remote builder)…`);
+    const { imageRef } = await flyctlBuildAndPush({ dir: absDir, flyApp, imageLabel: `insta-${Date.now()}`, token, port });
+    info(`  pushed ${imageRef}`);
+    return imageRef;
+}
+//# sourceMappingURL=deploy.js.map

package/dist/commands/govern.js

@@ -0,0 +1,55 @@
+import { ApiClient, requireProject } from '../api.js';
+import { info, printJson } from '../util.js';
+export async function events(opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const qs = [];
+    if (opts.branch)
+        qs.push(`branch=${encodeURIComponent(opts.branch)}`);
+    if (opts.limit)
+        qs.push(`limit=${opts.limit}`);
+    const { events } = await api.request('GET', `/projects/${p.projectId}/events${qs.length ? `?${qs.join('&')}` : ''}`);
+    if (opts.json)
+        return printJson(events);
+    for (const e of events)
+        info(`${e.created_at}  [${e.source}] ${e.kind}`);
+}
+export async function approvalsList(opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const { approvals } = await api.request('GET', `/projects/${p.projectId}/approvals${opts.status ? `?status=${opts.status}` : ''}`);
+    if (opts.json)
+        return printJson(approvals);
+    if (!approvals.length)
+        return info('(no approvals)');
+    for (const a of approvals)
+        info(`${a.id}  ${a.action}  [${a.status}]  ${a.requested_at}`);
+}
+export async function approvalsApprove(id, opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const out = await api.request('POST', `/projects/${p.projectId}/approvals/${id}/approve`, { always: !!opts.always });
+    info(`approved ${out.approval.action} (${id})${opts.always ? ' — policy set to allow' : ''}`);
+}
+export async function approvalsDeny(id) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const out = await api.request('POST', `/projects/${p.projectId}/approvals/${id}/deny`);
+    info(`denied ${out.approval.action} (${id})`);
+}
+export async function policyGet(opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const { policy } = await api.request('GET', `/projects/${p.projectId}/policy`);
+    if (opts.json)
+        return printJson(policy);
+    for (const [action, decision] of Object.entries(policy))
+        info(`${action}: ${decision}`);
+}
+export async function policySet(action, decision) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    await api.request('PUT', `/projects/${p.projectId}/policy/${action}`, { decision });
+    info(`policy ${action} = ${decision}`);
+}
+//# sourceMappingURL=govern.js.map

package/dist/commands/manifest.js

@@ -0,0 +1,20 @@
+import { ApiClient, requireProject } from '../api.js';
+import { info, printJson } from '../util.js';
+// Agent-legible view of each environment's databases / storage / compute.
+export async function manifest(opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const detail = await api.request('GET', `/projects/${p.projectId}`);
+    if (opts.json)
+        return printJson(detail);
+    info(`project ${detail.project.name} (${detail.project.id}) [${detail.project.status}]`);
+    for (const b of detail.branches) {
+        info(`  branch ${b.name}${b.is_default ? ' *' : ''} [${b.status}]`);
+        const rs = detail.resources.filter((r) => r.branchId === b.id || (b.is_default && r.branchId === null));
+        for (const r of rs) {
+            const where = r.ref?.url ?? r.ref?.bucket ?? r.ref?.neonProjectId ?? '';
+            info(`    - ${r.kind}${r.name ? `(${r.name})` : ''}  ${where}  [${r.status}]`);
+        }
+    }
+}
+//# sourceMappingURL=manifest.js.map

package/dist/commands/metrics.js

@@ -0,0 +1,88 @@
+import { ApiClient, requireProject } from '../api.js';
+import { info, printJson } from '../util.js';
+function qs(params) {
+    const u = new URLSearchParams();
+    for (const [k, v] of Object.entries(params))
+        if (v !== undefined && v !== '')
+            u.set(k, String(v));
+    const s = u.toString();
+    return s ? `?${s}` : '';
+}
+// insta metrics <db|compute> [group]
+export async function metrics(component, group, opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const res = await api.request('GET', `/projects/${p.projectId}/metrics${qs({ component, group, branch: opts.branch ?? p.branch, from: opts.from, to: opts.to, step: opts.step })}`);
+    if (opts.json)
+        return printJson(res);
+    if (res.note)
+        info(`note: ${res.note}`);
+    if (!res.series?.length)
+        return info('(no series)');
+    for (const s of res.series) {
+        const last = s.points?.[s.points.length - 1];
+        info(`${s.name}${s.unit ? ` (${s.unit})` : ''}: ${last ? last[1] : 'n/a'}  [${s.points?.length ?? 0} points]`);
+    }
+}
+// Customer-facing name for each internal billing dimension (the platform stores RAM as `ram`).
+const DIMENSION_LABEL = { ram: 'memory' };
+// Window line. Defaults to the current billing cycle; `to` is the exclusive next-cycle start, so
+// show the inclusive last day (to − 1 day) — e.g. an org created on the 5th reads "…-05 → …next-04".
+function cycleLine(res) {
+    const day = (sec) => new Date(sec * 1000).toISOString().slice(0, 10);
+    return `billing cycle ${day(res.from)} → ${day(res.to - 86400)}`;
+}
+function printDimensions(dims) {
+    for (const d of dims) {
+        const label = DIMENSION_LABEL[d.dimension] ?? d.dimension;
+        const cost = d.costUsd != null ? `  ($${Number(d.costUsd).toFixed(4)})` : '';
+        info(`${label}: ${d.quantity} ${d.unit}${cost}`);
+    }
+}
+// insta usage — usage across the 5 billing dimensions (cpu/memory/volume/egress/storage) for the
+// current billing cycle. Shows the whole ORG by default (with a per-project breakdown); pass --proj
+// [id] for a single project (the linked one, or a given id). Billed dimensions, not raw fly/neon meters.
+export async function usage(opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    if (opts.proj !== undefined && opts.proj !== false) {
+        const projectId = typeof opts.proj === 'string' ? opts.proj : p.projectId;
+        const res = await api.request('GET', `/projects/${projectId}/usage${qs({ from: opts.from, to: opts.to })}`);
+        if (opts.json)
+            return printJson(res);
+        info(cycleLine(res));
+        if (!res.dimensions?.length)
+            return info('(no usage recorded)');
+        printDimensions(res.dimensions);
+        return info(`total: $${Number(res.totalCostUsd ?? 0).toFixed(4)}`);
+    }
+    // Default: the whole org (the linked project's org), with a per-project cost breakdown.
+    const res = await api.request('GET', `/orgs/${p.orgId}/usage${qs({ from: opts.from, to: opts.to })}`);
+    if (opts.json)
+        return printJson(res);
+    info(cycleLine(res));
+    if (!res.org?.dimensions?.length)
+        return info('(no usage recorded)');
+    printDimensions(res.org.dimensions);
+    info(`total: $${Number(res.org.totalCostUsd ?? 0).toFixed(4)}`);
+    if (res.projects?.length) {
+        info('by project:');
+        for (const pr of res.projects)
+            info(`  ${pr.name}: $${Number(pr.totalCostUsd ?? 0).toFixed(4)}`);
+    }
+}
+// insta logs <db|compute> [group]
+export async function logs(component, group, opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const res = await api.request('GET', `/projects/${p.projectId}/logs${qs({ component, group, branch: opts.branch ?? p.branch, limit: opts.limit, region: opts.region, instance: opts.instance })}`);
+    if (opts.json)
+        return printJson(res);
+    if (res.note)
+        info(`note: ${res.note}`);
+    if (!res.lines?.length)
+        return info('(no logs)');
+    for (const l of res.lines)
+        info(`${l.ts}  ${(l.level ?? '').padEnd(5)} ${l.message}`);
+}
+//# sourceMappingURL=metrics.js.map