insta 0.0.1 → 0.0.2

package/dist/commands/observe.js

@@ -0,0 +1,58 @@
+// `insta observe` — the local credential-audit hook. install wires a PostToolUse hook into the
+// agent harness; report renders the local audit; sync uploads findings into the project timeline
+// (idempotent via a stable dedup key, matching the platform's audit-event ingest).
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { installObserve, uninstallObserve } from '../observe/install.js';
+import { renderReport } from '../observe/report.js';
+import { ApiClient, requireProject } from '../api.js';
+import { info, printJson } from '../util.js';
+async function readAudit() {
+    try {
+        const txt = await readFile(join(process.cwd(), '.insta', 'audit.jsonl'), 'utf8');
+        return txt.split('\n').filter(Boolean).map((l) => JSON.parse(l));
+    }
+    catch {
+        return [];
+    }
+}
+function dedupKey(r) {
+    return `${r.ts}|${r.fingerprint}|${r.surface}|${r.sink}|${r.kind}`;
+}
+function* chunk(a, n) {
+    for (let i = 0; i < a.length; i += n)
+        yield a.slice(i, i + n);
+}
+export async function observeInstall() {
+    const res = installObserve({ cwd: process.cwd() });
+    info(`installed observe hook (claude: ${res.claude}, codex: ${res.codex}) → ./.insta/observe`);
+    info('it scans agent tool-use for credential exposure; findings append to ./.insta/audit.jsonl');
+    info('run `insta observe report` to review, `insta observe sync` to upload to the project timeline');
+}
+export async function observeUninstall() {
+    uninstallObserve(process.cwd());
+    info('uninstalled observe hook');
+}
+export async function observeReport(opts) {
+    const rows = await readAudit();
+    if (opts.json)
+        return printJson(rows);
+    info(renderReport(rows));
+}
+export async function observeSync() {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const rows = await readAudit();
+    if (!rows.length)
+        return info('nothing to sync (./.insta/audit.jsonl is empty)');
+    const events = rows.map((r) => ({ source: 'agent', kind: `cred.${r.kind ?? 'touch'}`, branchId: null, dedupKey: dedupKey(r), payload: r }));
+    let recorded = 0;
+    let skipped = 0;
+    for (const c of chunk(events, 200)) {
+        const out = await api.request('POST', `/projects/${p.projectId}/events`, { events: c });
+        recorded += out.recorded;
+        skipped += out.skipped;
+    }
+    info(`synced ${rows.length} finding(s) → recorded ${recorded}, skipped ${skipped} (already uploaded)`);
+}
+//# sourceMappingURL=observe.js.map

package/dist/commands/org.js

@@ -0,0 +1,16 @@
+import { ApiClient } from '../api.js';
+import { info, printJson } from '../util.js';
+export async function orgList(opts) {
+    const api = await ApiClient.load();
+    const { orgs } = await api.request('GET', '/orgs');
+    if (opts.json)
+        return printJson(orgs);
+    for (const o of orgs)
+        info(`${o.id}  ${o.name}${o.is_personal ? ' (personal)' : ''}  [${o.role}]`);
+}
+export async function orgCreate(name) {
+    const api = await ApiClient.load();
+    const { org } = await api.request('POST', '/orgs', { name });
+    info(`created org ${org.id} (${org.name})`);
+}
+//# sourceMappingURL=org.js.map

package/dist/commands/project.js

@@ -0,0 +1,61 @@
+import { ApiClient, requireProject } from '../api.js';
+import { writeProject } from '../config.js';
+import { info, die, printJson, handleApproval } from '../util.js';
+import { installObserve } from '../observe/install.js';
+import { installSkills } from '../ensure-skills.js';
+// Best-effort: wire the credential-audit hook into the project (no-op if assets aren't built).
+function tryInstallObserve() {
+    try {
+        const r = installObserve({ cwd: process.cwd() });
+        if (r.claude || r.codex)
+            info('  installed observe hook (credential audit) → ./.insta/observe');
+    }
+    catch { /* assets missing (dev/unbuilt) — skip silently */ }
+}
+async function resolveOrg(api, given) {
+    if (given)
+        return given;
+    const { orgs } = await api.request('GET', '/orgs');
+    if (!orgs.length)
+        die('no org found — run `insta org create <name>`');
+    return orgs[0].id;
+}
+export async function projectCreate(name, opts) {
+    const api = await ApiClient.load();
+    const orgId = await resolveOrg(api, opts.org);
+    const out = await api.request('POST', `/orgs/${orgId}/projects`, { name });
+    await writeProject({ projectId: out.project.id, orgId, branch: out.defaultBranch.name });
+    info(`created project ${out.project.id} (${name})`);
+    info(`  resources: ${out.resources.map((r) => r.kind).join(', ')}`);
+    info(`  linked ./.insta/project.json (branch ${out.defaultBranch.name})`);
+    tryInstallObserve();
+    await installSkills({ cwd: process.cwd() });
+}
+export async function projectList(opts) {
+    const api = await ApiClient.load();
+    const orgId = await resolveOrg(api, opts.org);
+    const { projects } = await api.request('GET', `/orgs/${orgId}/projects`);
+    if (opts.json)
+        return printJson(projects);
+    if (!projects.length)
+        return info('(no projects)');
+    for (const p of projects)
+        info(`${p.id}  ${p.name}  [${p.status}]`);
+}
+export async function projectLink(id) {
+    const api = await ApiClient.load();
+    const { project } = await api.request('GET', `/projects/${id}`);
+    await writeProject({ projectId: project.id, orgId: project.org_id, branch: 'main' });
+    info(`linked project ${project.id} (${project.name})`);
+    tryInstallObserve();
+    await installSkills({ cwd: process.cwd() });
+}
+export async function projectDelete(opts) {
+    const api = await ApiClient.load();
+    const projectId = opts.project ?? (await requireProject()).projectId;
+    const res = await api.rawRequest('DELETE', `/projects/${projectId}`);
+    if (handleApproval(res))
+        return;
+    info(`deleted project ${projectId}`);
+}
+//# sourceMappingURL=project.js.map

package/dist/commands/secrets.js

@@ -0,0 +1,36 @@
+import { writeFile } from 'node:fs/promises';
+import { ApiClient, requireProject } from '../api.js';
+import { info, printJson, serializeEnv, handleApproval } from '../util.js';
+function q(branch) {
+    return branch ? `?branch=${encodeURIComponent(branch)}` : '';
+}
+// Fetch the credential bundle (the secret seam) and write it to .env (or print).
+export async function secrets(opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const branch = opts.branch ?? p.branch;
+    const res = await api.rawRequest('GET', `/projects/${p.projectId}/secrets${q(branch)}`);
+    if (handleApproval(res))
+        return;
+    const bundle = res.body.secrets;
+    if (opts.json)
+        return printJson(bundle);
+    if (opts.print) {
+        process.stdout.write(serializeEnv(bundle));
+        return;
+    }
+    const out = opts.output ?? '.env';
+    await writeFile(out, serializeEnv(bundle));
+    info(`wrote ${Object.keys(bundle).length} secrets to ${out} (branch ${branch})`);
+}
+export async function secretsList(opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const branch = opts.branch ?? p.branch;
+    const res = await api.rawRequest('GET', `/projects/${p.projectId}/secrets${q(branch)}`);
+    if (handleApproval(res))
+        return;
+    for (const name of Object.keys(res.body.secrets))
+        info(name);
+}
+//# sourceMappingURL=secrets.js.map

package/dist/commands/services.js

@@ -0,0 +1,89 @@
+// `insta services` — manage a project's opt-in services (postgres | storage | compute).
+import { ApiClient, requireProject } from '../api.js';
+import { info, printJson, handleApproval } from '../util.js';
+export const SERVICE_TYPES = ['postgres', 'storage', 'compute'];
+// ---- pure, unit-tested helpers (throw plain Errors; the CLI guard turns them into clean output) ----
+// Validate a service-type argument against the allowed set for a command.
+export function assertType(type, allowed = SERVICE_TYPES) {
+    if (!allowed.includes(type))
+        throw new Error(`type must be ${allowed.join('|')}`);
+}
+// Parse a positive-integer machine count.
+export function parseCount(raw) {
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n < 1)
+        throw new Error(`count must be a positive integer, got: ${raw}`);
+    return n;
+}
+// Resolve a service id from a `services list` result by (type, name).
+export function resolveServiceId(services, type, name) {
+    const svc = services.find((s) => s.type === type && s.name === name);
+    if (!svc)
+        throw new Error(`service not found: ${type} ${name}`);
+    return svc.id;
+}
+// ---- commands ----
+export async function servicesAdd(type, name) {
+    assertType(type);
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const res = await api.rawRequest('POST', `/projects/${p.projectId}/services`, { type, name });
+    if (handleApproval(res))
+        return;
+    const svc = res.body.service;
+    info(`added ${type} service ${name} (${svc.id})${svc.domain ? ` — ${svc.domain}` : ''}`);
+}
+export async function servicesList(opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const { services } = await api.request('GET', `/projects/${p.projectId}/services`);
+    if (opts.json)
+        return printJson(services);
+    if (!services.length)
+        return info('(no services — add one with `insta services add <postgres|storage|compute> <name>`)');
+    for (const s of services) {
+        const extra = s.type === 'compute' ? `  x${s.machine_count}` : '';
+        info(`${s.type}/${s.name}  [${s.status}]${extra}${s.domain ? `  ${s.domain}` : ''}  ${s.id}`);
+    }
+}
+export async function servicesRemove(type, name) {
+    assertType(type);
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const { services } = await api.request('GET', `/projects/${p.projectId}/services`);
+    const id = resolveServiceId(services, type, name);
+    const res = await api.rawRequest('DELETE', `/projects/${p.projectId}/services/${id}`);
+    if (handleApproval(res))
+        return;
+    info(`removed ${type} service ${name}`);
+}
+// insta services scale compute <name> <number> [region]
+export async function servicesScale(type, name, number, region, _opts) {
+    assertType(type, ['compute']);
+    const machineCount = parseCount(number);
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const { services } = await api.request('GET', `/projects/${p.projectId}/services`);
+    const id = resolveServiceId(services, type, name);
+    const res = await api.rawRequest('POST', `/projects/${p.projectId}/services/${id}/scale`, { machineCount, region });
+    if (handleApproval(res))
+        return;
+    if (_opts.json)
+        return printJson(res.body.service);
+    info(`scaled compute ${name} to ${machineCount} machine(s)${region ? ` in ${region}` : ''}`);
+}
+// insta services upgrade <compute|postgres> <name> <new-spec>
+export async function servicesUpgrade(type, name, spec, _opts) {
+    assertType(type, ['compute', 'postgres']);
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const { services } = await api.request('GET', `/projects/${p.projectId}/services`);
+    const id = resolveServiceId(services, type, name);
+    const res = await api.rawRequest('POST', `/projects/${p.projectId}/services/${id}/upgrade`, { spec });
+    if (handleApproval(res))
+        return;
+    if (_opts.json)
+        return printJson(res.body.service);
+    info(`upgraded ${type} ${name} to ${spec}`);
+}
+//# sourceMappingURL=services.js.map

package/dist/config.js

@@ -0,0 +1,35 @@
+// CLI config: global (~/.insta/config.json: api url + tokens) and per-project (./.insta/project.json).
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+const GLOBAL_DIR = join(homedir(), '.insta');
+const GLOBAL_FILE = join(GLOBAL_DIR, 'config.json');
+const PROJECT_DIR = '.insta';
+const PROJECT_FILE = 'project.json';
+const DEFAULT_API = process.env.INSTA_API_URL ?? 'https://beta-api.insta.insforge.dev';
+export async function readGlobal() {
+    try {
+        const parsed = JSON.parse(await readFile(GLOBAL_FILE, 'utf8'));
+        return { ...parsed, apiUrl: parsed.apiUrl ?? DEFAULT_API };
+    }
+    catch {
+        return { apiUrl: DEFAULT_API };
+    }
+}
+export async function writeGlobal(c) {
+    await mkdir(GLOBAL_DIR, { recursive: true });
+    await writeFile(GLOBAL_FILE, JSON.stringify(c, null, 2));
+}
+export async function readProject(cwd = process.cwd()) {
+    try {
+        return JSON.parse(await readFile(join(cwd, PROJECT_DIR, PROJECT_FILE), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+export async function writeProject(c, cwd = process.cwd()) {
+    await mkdir(join(cwd, PROJECT_DIR), { recursive: true });
+    await writeFile(join(cwd, PROJECT_DIR, PROJECT_FILE), JSON.stringify(c, null, 2));
+}
+//# sourceMappingURL=config.js.map

package/dist/ensure-skills.js

@@ -0,0 +1,70 @@
+// Install the related agent skills into a linked project so the developer's coding agent has
+// context for what InstaCloud provisions — the `insta` CLI itself plus the three services you build
+// directly against (Neon Postgres, Tigris storage, Better Auth). Runs `npx skills add`
+// (vercel-labs/skills) fully non-interactively. Best-effort: a failure (offline, npx missing, a
+// repo moved) prints a manual fallback and never blocks or fails the host command — same contract
+// as the observe-hook install.
+import { spawn } from 'node:child_process';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+// Where `npx skills add` drops skills for the agents we pin below: Claude Code → .claude/skills/,
+// Codex → .agents/skills/ (.github/skills/ is the third well-known dir). These are regenerable
+// agent context, not the developer's source — keep them out of git.
+const SKILL_DIRS = ['.claude/skills/', '.agents/skills/', '.github/skills/'];
+const defaultRunner = (cmd, args, inherit = false) => new Promise((resolve) => {
+    const p = spawn(cmd, args, { stdio: inherit ? 'inherit' : 'ignore' });
+    p.on('error', () => resolve({ ok: false })); // e.g. npx not on PATH
+    p.on('close', (code) => resolve({ ok: code === 0 }));
+});
+// `npx skills add` is non-interactive only when we remove every prompt: pin the target agents
+// (-a claude-code -a codex) so it neither asks which agent nor fans out to every known agent dir;
+// name the exact skills (-s …) so there's no skill picker; -y to skip the scope/confirm prompt;
+// --copy to write real files (not symlinks into a transient npx cache).
+const AGENT_FLAGS = ['-a', 'claude-code', '-a', 'codex', '-y', '--copy'];
+const SKILLS = [
+    { label: 'insta', args: ['skills', 'add', 'InsForge/insta-skills', '-s', 'insta', ...AGENT_FLAGS] },
+    { label: 'neon-postgres', args: ['skills', 'add', 'neondatabase/agent-skills', '-s', 'neon-postgres', ...AGENT_FLAGS] },
+    { label: 'tigris', args: ['skills', 'add', 'tigrisdata/skills',
+            '-s', 'tigris-object-operations', '-s', 'file-storage', '-s', 'tigris-sdk-guide',
+            '-s', 'tigris-security-access-control', '-s', 'tigris-image-optimization',
+            '-s', 'tigris-s3-migration', '-s', 'tigris-static-assets', '-s', 'tigris-agent-kit',
+            ...AGENT_FLAGS] },
+    { label: 'better-auth', args: ['skills', 'add', 'better-auth/skills',
+            '-s', 'better-auth-best-practices', '-s', 'email-and-password-best-practices',
+            '-s', 'better-auth-security-best-practices', ...AGENT_FLAGS] },
+];
+// Install all related skills. Production omits `run`/`print` → the real spawn + stdout; tests inject
+// a fake runner and capture output. Continues past a per-skill failure so one bad repo doesn't skip
+// the rest, and never throws.
+export async function installSkills(deps) {
+    const run = deps.run ?? defaultRunner;
+    const print = deps.print ?? ((s) => process.stdout.write(s + '\n'));
+    try {
+        print('  installing related agent skills (insta, neon-postgres, tigris, better-auth) via `npx skills add` …');
+        for (const s of SKILLS) {
+            const r = await run('npx', s.args, true); // streamed so the user sees download progress
+            print(r.ok ? `  ${s.label} ✓` : `  ${s.label} failed — add manually: npx ${s.args.join(' ')}`);
+        }
+        const added = ensureGitignore(deps.cwd, SKILL_DIRS);
+        if (added.length)
+            print(`  .gitignore += ${added.join(', ')}`);
+    }
+    catch {
+        /* best-effort convenience — never block the host command */
+    }
+}
+// Append any missing entries to the project's ./.gitignore (creating it if absent). Idempotent:
+// entries already present are left alone. Returns the entries it added.
+export function ensureGitignore(cwd, entries) {
+    const p = join(cwd, '.gitignore');
+    const existing = existsSync(p) ? readFileSync(p, 'utf8') : '';
+    const have = new Set(existing.split('\n').map((l) => l.trim()));
+    const missing = entries.filter((e) => !have.has(e));
+    if (missing.length === 0)
+        return [];
+    const prefix = existing && !existing.endsWith('\n') ? '\n' : '';
+    const comment = '# InstaCloud: agent skills installed by `npx skills add` (regenerable, not source)';
+    writeFileSync(p, existing + `${prefix}\n${comment}\n${missing.join('\n')}\n`);
+    return missing;
+}
+//# sourceMappingURL=ensure-skills.js.map

package/dist/flyctl-build.js

@@ -0,0 +1,79 @@
+// Build a source directory into an image and push it to Fly's registry, using a short-lived,
+// app-scoped deploy token minted by the platform (the CLI never holds a standing Fly credential).
+// Shells out to `flyctl deploy --build-only --push` (remote builder). Ported from firth.
+import { spawn } from 'node:child_process';
+import { existsSync, writeFileSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+import { info } from './util.js';
+// Spawn flyctl, tee its output to the user (so they see buildkit progress) AND capture it for digest
+// parsing.
+export const defaultBuildRunner = (cmd, args, opts) => new Promise((resolve) => {
+    const child = spawn(cmd, args, { cwd: opts.cwd, env: opts.env, stdio: ['inherit', 'pipe', 'pipe'] });
+    let output = '';
+    child.stdout?.on('data', (b) => { const s = b.toString(); output += s; process.stdout.write(s); });
+    child.stderr?.on('data', (b) => { const s = b.toString(); output += s; process.stderr.write(s); });
+    child.on('error', (err) => resolve({ code: -1, output: `${output}\n${err.message}` }));
+    child.on('close', (code) => resolve({ code: code ?? -1, output }));
+});
+// buildkit prints "pushing manifest for registry.fly.io/<app>:<label>@sha256:<digest>" on push.
+// Pin to the digest — the bare tag races on Fly's registry (MANIFEST_UNKNOWN); the digest always resolves.
+export function parseImageDigest(output, flyApp) {
+    const m = output.match(/pushing manifest for registry\.fly\.io\/[^\s]+@(sha256:[0-9a-f]+)/);
+    return m ? `registry.fly.io/${flyApp}@${m[1]}` : null;
+}
+// Write a minimal stub fly.toml iff the dir has none (flyctl needs app config; a fresh app has no
+// machines to derive it from). Region is build-config only — `--build-only` places no machines.
+// Returns a cleanup callback the caller MUST run in finally; leaves a user's own fly.toml alone.
+function ensureFlyTomlStub(dir, flyApp, port) {
+    const path = join(dir, 'fly.toml');
+    if (existsSync(path))
+        return () => { };
+    const stub = `# Auto-generated by insta for source deploy. Safe to delete.\n` +
+        `app = "${flyApp}"\n` +
+        `primary_region = "iad"\n\n` +
+        `[build]\n\n` +
+        `[http_service]\n` +
+        `  internal_port = ${port}\n` +
+        `  force_https = true\n`;
+    writeFileSync(path, stub, 'utf8');
+    return () => { try {
+        unlinkSync(path);
+    }
+    catch { /* best-effort */ } };
+}
+export async function flyctlBuildAndPush(opts, run = defaultBuildRunner) {
+    const cleanup = ensureFlyTomlStub(opts.dir, opts.flyApp, opts.port);
+    try {
+        const { code, output } = await run('flyctl', ['deploy', '--remote-only', '--build-only', '--push', '--app', opts.flyApp, '--image-label', opts.imageLabel, '--no-cache'], { cwd: opts.dir, env: { ...process.env, FLY_API_TOKEN: opts.token } });
+        if (code !== 0)
+            throw new Error(`flyctl deploy --build-only failed (exit ${code}). See output above.`);
+        const imageRef = parseImageDigest(output, opts.flyApp);
+        if (!imageRef)
+            throw new Error('flyctl build succeeded but no "pushing manifest" digest line was found — cannot determine the image. Re-run with FLY_LOG_LEVEL=debug.');
+        return { imageRef };
+    }
+    finally {
+        cleanup();
+    }
+}
+// Best-effort: ensure the fly CLI is available (needed for source-directory deploys). Never blocks —
+// if it can't be installed the subsequent build surfaces a clear error.
+export async function ensureFlyctl() {
+    const ok = (cmd, args, inherit = false) => new Promise((resolve) => {
+        const p = spawn(cmd, args, { stdio: inherit ? 'inherit' : 'ignore' });
+        p.on('error', () => resolve(false));
+        p.on('close', (code) => resolve(code === 0));
+    });
+    try {
+        if (await ok('flyctl', ['version']))
+            return;
+        if (process.platform === 'darwin' && (await ok('brew', ['--version']))) {
+            info('flyctl not found — installing with `brew install flyctl` (one-time)…');
+            info((await ok('brew', ['install', 'flyctl'], true)) ? 'flyctl installed ✓' : 'flyctl install failed — install manually: https://fly.io/docs/flyctl/install/');
+            return;
+        }
+        info('flyctl (fly CLI) not found — install it to deploy from source: https://fly.io/docs/flyctl/install/');
+    }
+    catch { /* best-effort convenience */ }
+}
+//# sourceMappingURL=flyctl-build.js.map

package/dist/index.js

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { Command } from 'commander';
+import { ApiError } from './api.js';
+import { die } from './util.js';
+import * as auth from './commands/auth.js';
+import * as org from './commands/org.js';
+import * as project from './commands/project.js';
+import * as branch from './commands/branch.js';
+import * as services from './commands/services.js';
+import * as secretsCmd from './commands/secrets.js';
+import { deploy } from './commands/deploy.js';
+import * as computeCmd from './commands/compute.js';
+import { manifest } from './commands/manifest.js';
+import * as govern from './commands/govern.js';
+import * as observe from './commands/observe.js';
+import * as obs from './commands/metrics.js';
+import { billing, billingUpgrade, billingPortal } from './commands/billing.js';
+function onError(e) {
+    if (e instanceof ApiError)
+        die(`${e.message} (HTTP ${e.status})`);
+    die(e instanceof Error ? e.message : String(e));
+}
+// Wrap an async action so rejections surface as clean CLI errors.
+const guard = (fn) => (...a) => fn(...a).then(() => undefined).catch(onError);
+const program = new Command();
+// Version resolution: INSTA_CLI_VERSION (baked into the standalone binary via bun build --define) →
+// the installed package.json (npm/node — ../package.json sits beside dist/) → 0.0.0.
+function resolveVersion() {
+    if (process.env.INSTA_CLI_VERSION)
+        return process.env.INSTA_CLI_VERSION;
+    try {
+        return JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+program.name('insta').description('InstaCloud CLI — manage projects, branches, secrets, deploys').version(resolveVersion());
+// ---- auth ----
+program.command('login').description('Log in with email + password, or --oauth <github|google> (browser)')
+    .option('--email <email>', 'account email')
+    .option('--password <password>', 'account password (else $INSTA_PASSWORD or prompt)')
+    .option('--oauth <provider>', 'browser OAuth login: github | google')
+    .option('--api-url <url>', 'control-plane API base URL')
+    .action(guard((o) => auth.login(o)));
+program.command('logout').description('Log out and clear local tokens').action(guard(() => auth.logout()));
+program.command('status').description('Show login + linked project').option('--json').action(guard((o) => auth.status(o)));
+// ---- org ----
+const orgCmd = program.command('org').description('Manage organizations');
+orgCmd.command('list').option('--json').action(guard((o) => org.orgList(o)));
+orgCmd.command('create <name>').action(guard((name) => org.orgCreate(name)));
+// ---- project ----
+const pj = program.command('project').description('Manage projects');
+pj.command('create <name>').option('--org <id>', 'org to create under (default: personal)').action(guard((name, o) => project.projectCreate(name, o)));
+pj.command('list').option('--org <id>').option('--json').action(guard((o) => project.projectList(o)));
+pj.command('link <id>').description('Link a project to this directory').action(guard((id) => project.projectLink(id)));
+pj.command('delete').option('--project <id>').action(guard((o) => project.projectDelete(o)));
+// ---- branch ----
+const br = program.command('branch').description('Manage branch environments');
+br.command('create <name>').option('--from <branch>', 'parent branch (default: current)').action(guard((name, o) => branch.branchCreate(name, o)));
+br.command('list').option('--json').action(guard((o) => branch.branchList(o)));
+br.command('switch <name>').action(guard((name) => branch.branchSwitch(name)));
+br.command('delete <name>').action(guard((name) => branch.branchDelete(name)));
+// ---- services (opt-in postgres/storage/compute) ----
+const svc = program.command('services').alias('svc').description('Manage project services (postgres|storage|compute)');
+svc.command('add <type> <name>').description('Provision a service on demand (assigns a default domain for postgres/compute)')
+    .action(guard((type, name) => services.servicesAdd(type, name)));
+svc.command('list').option('--json').action(guard((o) => services.servicesList(o)));
+svc.command('remove <type> <name>').description('Remove a service and destroy its resources')
+    .action(guard((type, name) => services.servicesRemove(type, name)));
+svc.command('scale <type> <name> <number> [region]').description('Set a compute service machine count (paid plans only)')
+    .option('--json').action(guard((type, name, number, region, o) => services.servicesScale(type, name, number, region, o)));
+svc.command('upgrade <type> <name> <spec>').description('Change a compute/postgres service spec (paid plans only)')
+    .option('--json').action(guard((type, name, spec, o) => services.servicesUpgrade(type, name, spec, o)));
+// ---- secrets (seam) ----
+const sec = program.command('secrets').description('Fetch the credential bundle (secret seam) into .env')
+    .option('--branch <branch>').option('-o, --output <file>', 'output file (default .env)').option('--print', 'print instead of writing').option('--json')
+    .action(guard((o) => secretsCmd.secrets(o)));
+sec.command('list').description('List secret names only').option('--branch <branch>').action(guard((o) => secretsCmd.secretsList(o)));
+// ---- deploy ----
+program.command('deploy [dir]').description('Deploy a source directory (built remotely on Fly) or a prebuilt --image to a branch compute group')
+    .option('--image <url>', 'prebuilt container image to deploy (instead of a source dir)').option('--branch <b>').option('--group <g>').option('--port <p>')
+    .action(guard((dir, o) => deploy(dir, o)));
+// ---- compute custom domains (bring your own domain → Fly cert + routing) ----
+const compute = program.command('compute').description('Compute custom domains (bring your own domain)');
+compute.command('set-domain <host>').description('Attach a custom domain to a branch compute service (gated: deploy)')
+    .option('--branch <b>').option('--group <g>').option('--json').action(guard((host, o) => computeCmd.setDomain(host, o)));
+compute.command('check-domain <host>').description("Show a custom domain's cert status + required DNS records")
+    .option('--branch <b>').option('--group <g>').option('--json').action(guard((host, o) => computeCmd.checkDomain(host, o)));
+compute.command('remove-domain <host>').description('Detach a custom domain (gated: deploy)')
+    .option('--branch <b>').option('--group <g>').action(guard((host, o) => computeCmd.removeDomain(host, o)));
+// ---- manifest ----
+program.command('manifest').description('Print an agent-legible view of the project environments').option('--json').action(guard((o) => manifest(o)));
+// ---- observability ----
+program.command('metrics <target> [group]').description('Service metrics (target: db|compute)')
+    .option('--branch <b>').option('--from <unix>').option('--to <unix>').option('--step <s>').option('--json')
+    .action(guard((target, group, o) => obs.metrics(target, group, o)));
+program.command('logs <target> [group]').description('Service runtime logs (target: db|compute)')
+    .option('--branch <b>').option('--limit <n>').option('--region <r>').option('--instance <i>').option('--json')
+    .action(guard((target, group, o) => obs.logs(target, group, o)));
+program.command('usage').description('Usage for the current billing cycle by billing dimension (org by default; --proj for one project)')
+    .option('--from <unix>').option('--to <unix>').option('--proj [id]', 'show one project (the linked one, or a given id) instead of the whole org').option('--json')
+    .action(guard((o) => obs.usage(o)));
+const bill = program.command('billing').description('Current billing cycle summary (tier / credit / used / overage)')
+    .option('--org <id>', 'target org (default: linked project\'s org)').option('--json')
+    .action(guard((o) => billing(o)));
+bill.command('upgrade <tier>').description('Subscribe the org to a paid tier (pro|enterprise) via Stripe Checkout')
+    .option('--org <id>').option('--no-open', 'print the URL instead of opening a browser').option('--json')
+    .action(guard((tier, o) => billingUpgrade(tier, o)));
+bill.command('portal').description('Open the Stripe Customer Portal (change plan / card / cancel)')
+    .option('--org <id>').option('--no-open', 'print the URL instead of opening a browser').option('--json')
+    .action(guard((o) => billingPortal(o)));
+// ---- events (audit timeline) ----
+program.command('events').description('Show the audit + agent-event timeline').option('--branch <b>').option('--limit <n>').option('--json').action(guard((o) => govern.events(o)));
+// ---- approvals ----
+const ap = program.command('approvals').description('Governance approvals (HITL)');
+ap.command('list').option('--status <s>', 'pending|granted|denied|consumed').option('--json').action(guard((o) => govern.approvalsList(o)));
+ap.command('approve <id>').option('--always', 'also set the policy to allow').action(guard((id, o) => govern.approvalsApprove(id, o)));
+ap.command('deny <id>').action(guard((id) => govern.approvalsDeny(id)));
+// ---- observe (local credential audit) ----
+const ob = program.command('observe').description('Local credential-audit hook');
+ob.command('install').description('Install the PostToolUse hook into this project').action(guard(() => observe.observeInstall()));
+ob.command('uninstall').action(guard(() => observe.observeUninstall()));
+ob.command('report').description('Render the local credential audit').option('--json').action(guard((o) => observe.observeReport(o)));
+ob.command('sync').description('Upload findings into the project timeline').action(guard(() => observe.observeSync()));
+// ---- policy ----
+const pol = program.command('policy').description('Governance policy');
+pol.command('get').option('--json').action(guard((o) => govern.policyGet(o)));
+pol.command('set <action> <decision>').description('action: secrets.read|deploy|project.delete|branch.delete|service.add|service.remove|service.scale|service.upgrade; decision: allow|deny|approve').action(guard((a, d) => govern.policySet(a, d)));
+program.parseAsync(process.argv);
+//# sourceMappingURL=index.js.map

package/dist/observe/hook.js

@@ -0,0 +1,62 @@
+// PostToolUse hook: reads a tool-use event on stdin (Claude Code / Codex), scans every string
+// surface for credential exposure, and appends findings to ./.insta/audit.jsonl. Ported from firth.
+import { appendFileSync, mkdirSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import { scanEvent } from './scanner.js';
+export function recordFindings(event, baseDir) {
+    const instaDir = join(baseDir, '.insta');
+    const instaAbs = resolve(instaDir);
+    const selfDir = dirname(fileURLToPath(import.meta.url));
+    const ignore = (p) => {
+        let ap;
+        try {
+            ap = resolve(p);
+        }
+        catch {
+            return false;
+        }
+        return ap.startsWith(instaAbs) || ap.startsWith(selfDir);
+    };
+    const findings = scanEvent(event, { ignorePath: ignore });
+    if (findings.length === 0)
+        return 0;
+    const common = {
+        ts: new Date().toISOString(),
+        session_id: event.session_id ?? null,
+        tool: event.tool_name ?? null,
+        cwd: event.cwd ?? null,
+    };
+    mkdirSync(instaDir, { recursive: true });
+    const lines = findings.map((f) => JSON.stringify({ ...common, ...f })).join('\n') + '\n';
+    appendFileSync(join(instaDir, 'audit.jsonl'), lines, 'utf8');
+    return findings.length;
+}
+async function readStdin() {
+    const chunks = [];
+    for await (const c of process.stdin)
+        chunks.push(c);
+    return Buffer.concat(chunks).toString('utf8');
+}
+export async function main() {
+    let event;
+    try {
+        event = JSON.parse(await readStdin());
+    }
+    catch {
+        process.exit(0);
+    }
+    const base = process.env.CLAUDE_PROJECT_DIR || event.cwd || '.';
+    try {
+        recordFindings(event, base);
+    }
+    catch (e) {
+        process.stderr.write(`insta-observe: ${e instanceof Error ? e.message : e}\n`);
+    }
+    process.exit(0);
+}
+// Run only when executed directly (the materialized .insta/observe/hook.js entry).
+// Imported by tests → guard is false → main() does not run.
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
+    void main();
+//# sourceMappingURL=hook.js.map