insta 0.0.1 → 0.0.3

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,118 @@
+# insta-cli
+
+InstaCloud CLI (`insta`) — a thin client of the [platform](../platform) control-plane API.
+Manages project / branch / secrets / deploy / governance — built for developers and agents.
+
+Tech stack: Node 20 + TypeScript (ESM) + commander. Every command is a wrapper around the platform API.
+
+## Installation
+
+**One-line install (native binary, no node required)** — macOS / Linux / WSL:
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/InsForge/insta-cli/main/install.sh | sh
+#   Installs to ~/.insta/bin/insta (override with INSTA_INSTALL_DIR); verifies SHA256SUMS.
+#   Pin a version: curl -fsSL .../install.sh | INSTA_VERSION=v0.1.0 sh
+# Windows: download insta-windows-x64.exe from the releases page.
+```
+
+**Build from source (requires node):**
+
+```bash
+npm install
+npm run build         # -> dist/index.js (bin: insta; pure JS, requires node to run)
+node dist/index.js --help
+```
+
+### Build your own binaries (Bun cross-compilation)
+
+The binaries that `install.sh` installs are cross-compiled with Bun by CI (tag `v*` → `.github/workflows/release.yml`)
+and published to GitHub releases. You can also build them locally: requires [Bun](https://bun.sh). The npm package still
+ships JS (`dist/index.js`) — binaries are a separate distribution channel.
+
+```bash
+npm run compile            # compile for the current platform only -> dist/bin/insta
+npm run build:binaries     # cross-compile all platforms -> dist/bin/insta-<os>-<arch>(.exe) + SHA256SUMS
+#   The version (baked into `insta --version`) defaults to package.json, or pass it: bash scripts/build-binaries.sh 1.2.3
+```
+
+Artifacts look like `insta-darwin-arm64` / `insta-linux-x64` / `insta-windows-x64.exe` (`file` reports native Mach-O/ELF/PE executables).
+`dist/` is gitignored; binaries are not committed — CI publishes them to releases.
+
+## Quickstart
+
+```bash
+# Point at the control plane (defaults to http://localhost:8080; override with $INSTA_API_URL or --api-url)
+insta login --email you@example.com --password ****** --api-url http://localhost:8080
+insta project create my-app          # create an empty project and link the current directory (no services by default)
+insta services add postgres db       # add services on demand (postgres/storage/compute)
+insta services add compute api       # compute is used to deploy images
+insta secrets                        # write the current branch's credentials to ./.env (secret seam)
+insta deploy --image <registry/img>  # deploy a container image to the current branch's compute service
+insta status                         # login state + linked project/branch
+```
+
+## Commands
+
+| Command | Description |
+|------|------|
+| `insta login [--email --password --api-url]` | Log in (email/password; tokens auto-refresh) |
+| `insta login --oauth <github\|google>` | Browser OAuth login (starts a local loopback port; the token is carried back automatically after browser authorization) |
+| `insta logout` / `insta status [--json]` | Log out / show status |
+| `insta org list [--json]` / `org create <name>` | Organizations (each user may own only one free org) |
+| `insta project create <name> [--org]` | Create an empty project and link it (no services by default) |
+| `insta project list [--org] [--json]` / `link <id>` / `delete` | Project management |
+| `insta services add <postgres\|storage\|compute> <name>` | Provision a service on demand (postgres/compute get a default access domain) |
+| `insta services list [--json]` / `services remove <type> <name>` | List / remove services |
+| `insta services scale compute <name> <number> [region]` | Set the compute machine count (paid tiers; rejected on free) |
+| `insta services upgrade <compute\|postgres> <name> <spec>` | Upgrade the spec (paid tiers; upgrade only, no downgrade) |
+| `insta branch create <name> [--from]` | Create a branch environment (materializes the project's current services; up to 10 branches per project) |
+| `insta branch list [--json]` / `switch <name>` / `delete <name>` | Branch management |
+| `insta secrets [--branch -o --print --json]` | Secret seam: write credentials to `.env` |
+| `insta secrets list [--branch]` | List secret names only |
+| `insta deploy --image <url> [--branch --group --port]` | Deploy an image |
+| `insta manifest [--json]` | Agent-readable environment manifest |
+| `insta metrics <db\|compute> [group] [--branch --from --to --step --json]` | Resource metrics (compute=Fly; db limited) |
+| `insta logs <db\|compute> [group] [--branch --limit --region --instance --json]` | Runtime logs (compute=Fly; db limited) |
+| `insta events [--branch --limit --json]` | Audit + agent event timeline |
+| `insta usage [--from --to --json]` | Resource usage aggregated by meter (includes costUsd) |
+| `insta billing [--org --json]` | Current billing-cycle summary (tier / quota / used / overage / status) |
+| `insta billing upgrade <pro\|enterprise> [--org --no-open --json]` | Subscribe to a paid tier via Stripe Checkout; returns and opens the payment link |
+| `insta billing portal [--org --no-open --json]` | Open the Stripe Customer Portal (change plan / card / cancel) |
+| `insta approvals list [--status] [--json]` | Governance approval list |
+| `insta approvals approve <id> [--always]` / `deny <id>` | Approve / deny (admin) |
+| `insta policy get [--json]` / `policy set <action> <decision>` | Governance policy (actions include `service.add/remove/scale/upgrade`) |
+
+When a governance-gated operation (`secrets.read`/`deploy`/`project.delete`/`branch.delete`/`service.add`/`service.remove`/`service.scale`/`service.upgrade`) hits an approval,
+the CLI prompts `approval required — run: insta approvals approve <id>`.
+
+## Configuration locations
+
+- Global: `~/.insta/config.json` (apiUrl + access/refresh token + user)
+- Project: `./.insta/project.json` (projectId / orgId / current branch)
+
+## Local end-to-end run
+
+The platform provides a `dev:fake` mode (fake provider adapters, no Neon/Fly/Tigris credentials required):
+
+```bash
+# 1) Start Postgres + the platform dev server (see ../platform)
+docker run -d --name pg -e POSTGRES_PASSWORD=insta -e POSTGRES_DB=insta_dev -p 55432:5432 postgres:16-alpine
+cd ../platform && DATABASE_URL='postgres://postgres:insta@localhost:55432/insta_dev' PORT=8899 npm run dev:fake
+
+# 2) Run the full flow with the CLI (signup goes through /auth/signup + /auth/verify-email; in dev mode the verification code is printed in the server logs)
+INSTA_API_URL=http://localhost:8899 insta login --email you@x.com --password ...
+```
+
+## OAuth browser login
+
+```bash
+insta login --oauth github          # or google
+# CLI starts a local loopback port → opens the browser to /auth/cli/authorize → Better Auth runs provider authorization →
+# the platform reads the session cookie to exchange for a bearer token → carries it back to the loopback port → CLI stores it as login state
+```
+
+> The platform must have an OAuth app configured for that provider (`GITHUB_OAUTH_CLIENT_ID/SECRET` or `GOOGLE_*`),
+> and the app's callback URL must be **`{INSTA_API_BASE_URL}/api/auth/callback/<provider>`** (not the loopback address).
+
+> `metrics` / `logs` / `usage` are supported (usage is aggregated at the collection layer). Multiple compute services (`services add compute`) and `services scale/upgrade` are implemented; image building will come later. Multiple postgres/storage services (>1 per project) are currently constrained by the credential seam and remain future work.

package/dist/api.js

@@ -0,0 +1,99 @@
+// Thin API client over the platform control-plane. Handles bearer auth + one-shot refresh on 401.
+// 2xx (including 202 approval_required) returns the parsed body; >=400 throws ApiError.
+import { readGlobal, writeGlobal, readProject } from './config.js';
+import { die } from './util.js';
+export class ApiError extends Error {
+    status;
+    constructor(status, msg) {
+        super(msg);
+        this.status = status;
+        this.name = 'ApiError';
+    }
+}
+export class ApiClient {
+    cfg;
+    constructor(cfg) {
+        this.cfg = cfg;
+    }
+    static async load() { return new ApiClient(await readGlobal()); }
+    get apiUrl() { return this.cfg.apiUrl; }
+    get config() { return this.cfg; }
+    async persist() { await writeGlobal(this.cfg); }
+    setApiUrl(url) { this.cfg.apiUrl = url; }
+    setSession(tokens, user) {
+        this.cfg.accessToken = tokens.accessToken;
+        this.cfg.refreshToken = tokens.refreshToken;
+        if (user)
+            this.cfg.user = user;
+    }
+    clearSession() {
+        delete this.cfg.accessToken;
+        delete this.cfg.refreshToken;
+        delete this.cfg.user;
+    }
+    // Returns parsed body for status < 400 (incl. 202); throws ApiError otherwise.
+    async request(method, path, body, opts = {}) {
+        const res = await this.raw(method, path, body, opts.auth ?? true);
+        if (res.status >= 400)
+            throw new ApiError(res.status, res.body?.error ?? `HTTP ${res.status}`);
+        return res.body;
+    }
+    // Like request but returns {status, body} so callers can branch on 202 (approval_required).
+    async rawRequest(method, path, body, opts = {}) {
+        const res = await this.raw(method, path, body, opts.auth ?? true);
+        if (res.status >= 400)
+            throw new ApiError(res.status, res.body?.error ?? `HTTP ${res.status}`);
+        return res;
+    }
+    async raw(method, path, body, auth) {
+        let r = await this.fetch(method, path, body, auth);
+        if (r.status === 401 && auth && this.cfg.refreshToken) {
+            if (await this.refresh())
+                r = await this.fetch(method, path, body, auth);
+        }
+        return r;
+    }
+    async fetch(method, path, body, auth) {
+        const headers = { 'Content-Type': 'application/json' };
+        if (auth && this.cfg.accessToken)
+            headers.Authorization = `Bearer ${this.cfg.accessToken}`;
+        const res = await fetch(this.apiUrl + path, {
+            method,
+            headers,
+            body: body === undefined ? undefined : JSON.stringify(body),
+        });
+        const text = await res.text();
+        let parsed = null;
+        try {
+            parsed = text ? JSON.parse(text) : null;
+        }
+        catch {
+            parsed = { raw: text };
+        }
+        return { status: res.status, body: parsed };
+    }
+    async refresh() {
+        try {
+            const res = await this.fetch('POST', '/auth/refresh', { refreshToken: this.cfg.refreshToken }, false);
+            if (res.status >= 400)
+                return false;
+            this.cfg.accessToken = res.body.accessToken;
+            this.cfg.refreshToken = res.body.refreshToken;
+            await this.persist();
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+// Resolve the linked project (./.insta/project.json), or null.
+export async function linkedProject() { return readProject(); }
+// Resolve the linked project or exit with guidance.
+export async function requireProject() {
+    const p = await readProject();
+    if (!p)
+        die('no linked project — run `insta project create <name>` or `insta project link <id>`');
+    return p;
+}
+//# sourceMappingURL=api.js.map

package/dist/commands/auth.js

@@ -0,0 +1,100 @@
+import { createServer } from 'node:http';
+import { randomBytes } from 'node:crypto';
+import { ApiClient, linkedProject } from '../api.js';
+import { info, die, printJson, promptPassword, openUrl } from '../util.js';
+export async function login(opts) {
+    if (opts.oauth)
+        return loginOauth(opts.oauth, opts);
+    const api = await ApiClient.load();
+    if (opts.apiUrl)
+        api.setApiUrl(opts.apiUrl);
+    if (!opts.email)
+        die('--email is required (or use --oauth <github|google>)');
+    const password = opts.password ?? process.env.INSTA_PASSWORD ?? (await promptPassword());
+    const res = await api.request('POST', '/auth/login', { email: opts.email, password }, { auth: false });
+    api.setSession(res, res.user);
+    await api.persist();
+    info(`logged in as ${res.user.email ?? res.user.id} @ ${api.apiUrl}`);
+}
+// Browser OAuth (GitHub/Google) via a loopback listener. We open the platform's CLI-OAuth bridge,
+// which runs Better Auth's social flow and bounces the resulting session token back to us.
+export async function loginOauth(provider, opts) {
+    if (provider !== 'github' && provider !== 'google')
+        die('provider must be github or google');
+    const api = await ApiClient.load();
+    if (opts.apiUrl)
+        api.setApiUrl(opts.apiUrl);
+    const token = await browserOauth(api.apiUrl, provider);
+    api.setSession({ accessToken: token, refreshToken: token });
+    const me = await api.request('GET', '/me');
+    api.setSession({ accessToken: token, refreshToken: token }, me.user);
+    await api.persist();
+    info(`logged in as ${me.user.email ?? me.user.id} @ ${api.apiUrl}`);
+}
+// Start a loopback server, open the browser at the platform bridge, and await the token.
+function browserOauth(apiUrl, provider) {
+    return new Promise((resolve, reject) => {
+        const state = randomBytes(16).toString('hex');
+        let timer;
+        const server = createServer((req, res) => {
+            const url = new URL(req.url ?? '/', 'http://127.0.0.1');
+            if (url.pathname !== '/callback') {
+                res.writeHead(404);
+                res.end();
+                return;
+            }
+            const token = url.searchParams.get('token');
+            const err = url.searchParams.get('error');
+            const ok = !!token && !err && url.searchParams.get('state') === state;
+            res.writeHead(ok ? 200 : 400, { 'content-type': 'text/html' });
+            res.end(`<!doctype html><meta charset=utf-8><body style="font-family:system-ui;text-align:center;margin-top:4rem"><h2>InstaCloud</h2><p>${ok ? '✓ Login complete — you can close this tab.' : '✗ Login failed' + (err ? ` (${err})` : '')}</p></body>`);
+            clearTimeout(timer);
+            server.close();
+            if (err)
+                return reject(new Error(`oauth failed: ${err}`));
+            if (!token)
+                return reject(new Error('no token returned'));
+            if (url.searchParams.get('state') !== state)
+                return reject(new Error('state mismatch — aborting'));
+            resolve(token);
+        });
+        server.on('error', reject);
+        server.listen(0, '127.0.0.1', () => {
+            const addr = server.address();
+            const port = typeof addr === 'object' && addr ? addr.port : 0;
+            const redirect = `http://127.0.0.1:${port}/callback`;
+            const authorizeUrl = `${apiUrl}/auth/cli/authorize?provider=${encodeURIComponent(provider)}&redirect=${encodeURIComponent(redirect)}&state=${state}`;
+            info(`opening browser to authorize with ${provider}…`);
+            if (!openUrl(authorizeUrl))
+                info(`open this URL to continue:\n  ${authorizeUrl}`);
+            timer = setTimeout(() => { server.close(); reject(new Error('timed out waiting for browser login (2m)')); }, 120_000);
+        });
+    });
+}
+export async function logout() {
+    const api = await ApiClient.load();
+    if (api.config.refreshToken) {
+        try {
+            await api.request('POST', '/auth/logout', { refreshToken: api.config.refreshToken }, { auth: false });
+        }
+        catch { /* ignore */ }
+    }
+    api.clearSession();
+    await api.persist();
+    info('logged out');
+}
+export async function status(opts) {
+    const api = await ApiClient.load();
+    let user = null;
+    try {
+        user = (await api.request('GET', '/me')).user;
+    }
+    catch { /* not logged in */ }
+    const project = await linkedProject();
+    if (opts.json)
+        return printJson({ apiUrl: api.apiUrl, user, project });
+    info(`api:     ${api.apiUrl}`);
+    info(`user:    ${user ? (user.email ?? user.id) : '(not logged in)'}`);
+    info(`project: ${project ? `${project.projectId} (branch ${project.branch})` : '(none linked)'}`);
+}
+//# sourceMappingURL=auth.js.map

package/dist/commands/billing.js

@@ -0,0 +1,52 @@
+import { ApiClient, requireProject } from '../api.js';
+import { die, info, openUrl, printJson } from '../util.js';
+// Resolve the target org: explicit --org, else the linked project's org.
+async function resolveOrgId(opts) {
+    if (opts.org)
+        return opts.org;
+    return (await requireProject()).orgId;
+}
+// insta billing — current cycle summary for the org.
+export async function billing(opts) {
+    const api = await ApiClient.load();
+    const orgId = await resolveOrgId(opts);
+    const s = await api.request('GET', `/orgs/${orgId}/billing`);
+    if (opts.json)
+        return printJson(s);
+    info(`tier:     ${s.tier}`);
+    info(`status:   ${s.status}`);
+    info(`cycle:    ${String(s.cycleStart).slice(0, 10)} → ${String(s.cycleEnd).slice(0, 10)}`);
+    info(`included: $${Number(s.includedUsd).toFixed(2)}`);
+    info(`used:     $${Number(s.usedUsd).toFixed(4)}`);
+    info(`overage:  $${Number(s.overageUsd).toFixed(4)}`);
+    if (s.status === 'suspended')
+        info('⚠  org suspended — billing limit reached; resumes next cycle (or `insta billing upgrade pro`)');
+}
+// insta billing upgrade <tier> — start a Stripe Checkout to subscribe the org to a paid tier.
+export async function billingUpgrade(tier, opts) {
+    if (tier !== 'pro' && tier !== 'enterprise')
+        die('tier must be pro|enterprise');
+    const api = await ApiClient.load();
+    const orgId = await resolveOrgId(opts);
+    const { url } = await api.request('POST', `/orgs/${orgId}/billing/checkout`, { tier });
+    if (opts.json)
+        return printJson({ url });
+    presentUrl(url, `Subscribe to ${tier} — complete checkout in your browser:`, opts.open);
+}
+// insta billing portal — open the Stripe Customer Portal (change plan / card / cancel).
+export async function billingPortal(opts) {
+    const api = await ApiClient.load();
+    const orgId = await resolveOrgId(opts);
+    const { url } = await api.request('POST', `/orgs/${orgId}/billing/portal`);
+    if (opts.json)
+        return printJson({ url });
+    presentUrl(url, 'Manage billing in your browser:', opts.open);
+}
+// Print the URL and, unless --no-open, try to open it in the browser.
+function presentUrl(url, label, open) {
+    info(label);
+    info(`  ${url}`);
+    if (open !== false && openUrl(url))
+        info('(opened in your default browser)');
+}
+//# sourceMappingURL=billing.js.map

package/dist/commands/branch.js

@@ -0,0 +1,40 @@
+import { ApiClient, requireProject } from '../api.js';
+import { writeProject } from '../config.js';
+import { info, die, printJson, handleApproval } from '../util.js';
+export async function branchCreate(name, opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const out = await api.request('POST', `/projects/${p.projectId}/branches`, { name, from: opts.from ?? p.branch });
+    info(`created branch ${out.branch.name} (${out.branch.id})`);
+}
+export async function branchList(opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const { branches } = await api.request('GET', `/projects/${p.projectId}/branches`);
+    if (opts.json)
+        return printJson(branches);
+    for (const b of branches)
+        info(`${b.is_default ? '*' : ' '} ${b.name}  [${b.status}]  ${b.id}`);
+}
+export async function branchSwitch(name) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const { branches } = await api.request('GET', `/projects/${p.projectId}/branches`);
+    if (!branches.some((b) => b.name === name))
+        die(`branch not found: ${name}`);
+    await writeProject({ ...p, branch: name });
+    info(`switched to branch ${name} — run \`insta secrets\` to refresh .env`);
+}
+export async function branchDelete(name) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const { branches } = await api.request('GET', `/projects/${p.projectId}/branches`);
+    const b = branches.find((x) => x.name === name || x.id === name);
+    if (!b)
+        die(`branch not found: ${name}`);
+    const res = await api.rawRequest('DELETE', `/projects/${p.projectId}/branches/${b.id}`);
+    if (handleApproval(res))
+        return;
+    info(`deleted branch ${name}`);
+}
+//# sourceMappingURL=branch.js.map

package/dist/commands/compute.js

@@ -0,0 +1,45 @@
+import { ApiClient, requireProject } from '../api.js';
+import { info, printJson, handleApproval } from '../util.js';
+// Attach a developer-owned custom domain to a branch's compute service. Fly issues the cert + routes
+// it; the platform returns the DNS records to set in your OWN zone.
+export async function setDomain(host, opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const res = await api.rawRequest('POST', `/projects/${p.projectId}/compute/domain`, { hostname: host, branch: opts.branch ?? p.branch, group: opts.group });
+    if (handleApproval(res))
+        return;
+    printDomain(res.body, opts.json);
+}
+// Re-check a custom domain's cert status + required DNS records.
+export async function checkDomain(host, opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const qs = new URLSearchParams({ hostname: host });
+    if (opts.branch ?? p.branch)
+        qs.set('branch', opts.branch ?? p.branch);
+    if (opts.group)
+        qs.set('group', opts.group);
+    printDomain(await api.request('GET', `/projects/${p.projectId}/compute/domain?${qs}`), opts.json);
+}
+export async function removeDomain(host, opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const res = await api.rawRequest('DELETE', `/projects/${p.projectId}/compute/domain`, { hostname: host, branch: opts.branch ?? p.branch, group: opts.group });
+    if (handleApproval(res))
+        return;
+    info(`removed custom domain ${res.body.hostname} from ${res.body.flyApp}`);
+}
+function printDomain(r, json) {
+    if (json)
+        return printJson(r);
+    info(`${r.hostname} → ${r.flyApp}`);
+    info(`  status: ${r.status}${r.configured ? ' ✓ configured' : ''}`);
+    if (r.dns?.length) {
+        info('  set these DNS records at your domain registrar:');
+        for (const d of r.dns)
+            info(`    ${String(d.type).padEnd(5)} ${d.name}  →  ${d.value}${d.note ? `   # ${d.note}` : ''}`);
+    }
+    if (!r.configured)
+        info('  once DNS propagates, Fly issues the cert — re-check with `insta compute check-domain`');
+}
+//# sourceMappingURL=compute.js.map