insta 0.0.1 → 0.0.3

package/dist/commands/deploy.js

@@ -0,0 +1,44 @@
+import { resolve, join } from 'node:path';
+import { existsSync } from 'node:fs';
+import { ApiClient, requireProject } from '../api.js';
+import { info, die, handleApproval } from '../util.js';
+import { flyctlBuildAndPush, ensureFlyctl } from '../flyctl-build.js';
+// Deploy either a prebuilt image (`--image`) or a source directory (positional `<dir>`, built
+// remotely on Fly and pushed with a short-lived platform-minted token). Exactly one mode.
+export async function deploy(dir, opts) {
+    if (dir && opts.image)
+        die('pick one: a source <dir> OR --image <url>, not both');
+    if (!dir && !opts.image)
+        die('usage: insta deploy <dir> | --image <url>  [--branch <b>] [--group <g>] [--port <n>]');
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const branch = opts.branch ?? p.branch;
+    const image = dir ? await buildFromSource(api, p.projectId, dir, branch, opts) : opts.image;
+    const res = await api.rawRequest('POST', `/projects/${p.projectId}/deploy`, {
+        image,
+        branch,
+        group: opts.group,
+        port: opts.port ? Number(opts.port) : undefined,
+    });
+    if (handleApproval(res))
+        return;
+    info(`deployed ${image} -> ${res.body.url} (branch ${res.body.branch}, group ${res.body.group})`);
+}
+// Source mode: mint a scoped Fly deploy token from the platform, then build+push <dir> (needs a
+// Dockerfile) with flyctl's remote builder, returning the pushed image ref to deploy.
+async function buildFromSource(api, projectId, dir, branch, opts) {
+    const absDir = resolve(process.cwd(), dir);
+    if (!existsSync(join(absDir, 'Dockerfile')))
+        die(`no Dockerfile at ${join(absDir, 'Dockerfile')} — add one, or use --image <url>`);
+    await ensureFlyctl();
+    const port = opts.port ? Number(opts.port) : 8080;
+    const tok = await api.rawRequest('POST', `/projects/${projectId}/deploy-token`, { branch, group: opts.group });
+    if (handleApproval(tok))
+        die('deploy requires approval — get it approved, then re-run');
+    const { token, flyApp } = tok.body;
+    info(`building ${dir} for ${flyApp} (remote builder)…`);
+    const { imageRef } = await flyctlBuildAndPush({ dir: absDir, flyApp, imageLabel: `insta-${Date.now()}`, token, port });
+    info(`  pushed ${imageRef}`);
+    return imageRef;
+}
+//# sourceMappingURL=deploy.js.map

package/dist/commands/govern.js

@@ -0,0 +1,55 @@
+import { ApiClient, requireProject } from '../api.js';
+import { info, printJson } from '../util.js';
+export async function events(opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const qs = [];
+    if (opts.branch)
+        qs.push(`branch=${encodeURIComponent(opts.branch)}`);
+    if (opts.limit)
+        qs.push(`limit=${opts.limit}`);
+    const { events } = await api.request('GET', `/projects/${p.projectId}/events${qs.length ? `?${qs.join('&')}` : ''}`);
+    if (opts.json)
+        return printJson(events);
+    for (const e of events)
+        info(`${e.created_at}  [${e.source}] ${e.kind}`);
+}
+export async function approvalsList(opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const { approvals } = await api.request('GET', `/projects/${p.projectId}/approvals${opts.status ? `?status=${opts.status}` : ''}`);
+    if (opts.json)
+        return printJson(approvals);
+    if (!approvals.length)
+        return info('(no approvals)');
+    for (const a of approvals)
+        info(`${a.id}  ${a.action}  [${a.status}]  ${a.requested_at}`);
+}
+export async function approvalsApprove(id, opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const out = await api.request('POST', `/projects/${p.projectId}/approvals/${id}/approve`, { always: !!opts.always });
+    info(`approved ${out.approval.action} (${id})${opts.always ? ' — policy set to allow' : ''}`);
+}
+export async function approvalsDeny(id) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const out = await api.request('POST', `/projects/${p.projectId}/approvals/${id}/deny`);
+    info(`denied ${out.approval.action} (${id})`);
+}
+export async function policyGet(opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const { policy } = await api.request('GET', `/projects/${p.projectId}/policy`);
+    if (opts.json)
+        return printJson(policy);
+    for (const [action, decision] of Object.entries(policy))
+        info(`${action}: ${decision}`);
+}
+export async function policySet(action, decision) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    await api.request('PUT', `/projects/${p.projectId}/policy/${action}`, { decision });
+    info(`policy ${action} = ${decision}`);
+}
+//# sourceMappingURL=govern.js.map

package/dist/commands/manifest.js

@@ -0,0 +1,20 @@
+import { ApiClient, requireProject } from '../api.js';
+import { info, printJson } from '../util.js';
+// Agent-legible view of each environment's databases / storage / compute.
+export async function manifest(opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const detail = await api.request('GET', `/projects/${p.projectId}`);
+    if (opts.json)
+        return printJson(detail);
+    info(`project ${detail.project.name} (${detail.project.id}) [${detail.project.status}]`);
+    for (const b of detail.branches) {
+        info(`  branch ${b.name}${b.is_default ? ' *' : ''} [${b.status}]`);
+        const rs = detail.resources.filter((r) => r.branchId === b.id || (b.is_default && r.branchId === null));
+        for (const r of rs) {
+            const where = r.ref?.url ?? r.ref?.bucket ?? r.ref?.neonProjectId ?? '';
+            info(`    - ${r.kind}${r.name ? `(${r.name})` : ''}  ${where}  [${r.status}]`);
+        }
+    }
+}
+//# sourceMappingURL=manifest.js.map

package/dist/commands/metrics.js

@@ -0,0 +1,88 @@
+import { ApiClient, requireProject } from '../api.js';
+import { info, printJson } from '../util.js';
+function qs(params) {
+    const u = new URLSearchParams();
+    for (const [k, v] of Object.entries(params))
+        if (v !== undefined && v !== '')
+            u.set(k, String(v));
+    const s = u.toString();
+    return s ? `?${s}` : '';
+}
+// insta metrics <db|compute> [group]
+export async function metrics(component, group, opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const res = await api.request('GET', `/projects/${p.projectId}/metrics${qs({ component, group, branch: opts.branch ?? p.branch, from: opts.from, to: opts.to, step: opts.step })}`);
+    if (opts.json)
+        return printJson(res);
+    if (res.note)
+        info(`note: ${res.note}`);
+    if (!res.series?.length)
+        return info('(no series)');
+    for (const s of res.series) {
+        const last = s.points?.[s.points.length - 1];
+        info(`${s.name}${s.unit ? ` (${s.unit})` : ''}: ${last ? last[1] : 'n/a'}  [${s.points?.length ?? 0} points]`);
+    }
+}
+// Customer-facing name for each internal billing dimension (the platform stores RAM as `ram`).
+const DIMENSION_LABEL = { ram: 'memory' };
+// Window line. Defaults to the current billing cycle; `to` is the exclusive next-cycle start, so
+// show the inclusive last day (to − 1 day) — e.g. an org created on the 5th reads "…-05 → …next-04".
+function cycleLine(res) {
+    const day = (sec) => new Date(sec * 1000).toISOString().slice(0, 10);
+    return `billing cycle ${day(res.from)} → ${day(res.to - 86400)}`;
+}
+function printDimensions(dims) {
+    for (const d of dims) {
+        const label = DIMENSION_LABEL[d.dimension] ?? d.dimension;
+        const cost = d.costUsd != null ? `  ($${Number(d.costUsd).toFixed(4)})` : '';
+        info(`${label}: ${d.quantity} ${d.unit}${cost}`);
+    }
+}
+// insta usage — usage across the 5 billing dimensions (cpu/memory/volume/egress/storage) for the
+// current billing cycle. Shows the whole ORG by default (with a per-project breakdown); pass --proj
+// [id] for a single project (the linked one, or a given id). Billed dimensions, not raw fly/neon meters.
+export async function usage(opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    if (opts.proj !== undefined && opts.proj !== false) {
+        const projectId = typeof opts.proj === 'string' ? opts.proj : p.projectId;
+        const res = await api.request('GET', `/projects/${projectId}/usage${qs({ from: opts.from, to: opts.to })}`);
+        if (opts.json)
+            return printJson(res);
+        info(cycleLine(res));
+        if (!res.dimensions?.length)
+            return info('(no usage recorded)');
+        printDimensions(res.dimensions);
+        return info(`total: $${Number(res.totalCostUsd ?? 0).toFixed(4)}`);
+    }
+    // Default: the whole org (the linked project's org), with a per-project cost breakdown.
+    const res = await api.request('GET', `/orgs/${p.orgId}/usage${qs({ from: opts.from, to: opts.to })}`);
+    if (opts.json)
+        return printJson(res);
+    info(cycleLine(res));
+    if (!res.org?.dimensions?.length)
+        return info('(no usage recorded)');
+    printDimensions(res.org.dimensions);
+    info(`total: $${Number(res.org.totalCostUsd ?? 0).toFixed(4)}`);
+    if (res.projects?.length) {
+        info('by project:');
+        for (const pr of res.projects)
+            info(`  ${pr.name}: $${Number(pr.totalCostUsd ?? 0).toFixed(4)}`);
+    }
+}
+// insta logs <db|compute> [group]
+export async function logs(component, group, opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const res = await api.request('GET', `/projects/${p.projectId}/logs${qs({ component, group, branch: opts.branch ?? p.branch, limit: opts.limit, region: opts.region, instance: opts.instance })}`);
+    if (opts.json)
+        return printJson(res);
+    if (res.note)
+        info(`note: ${res.note}`);
+    if (!res.lines?.length)
+        return info('(no logs)');
+    for (const l of res.lines)
+        info(`${l.ts}  ${(l.level ?? '').padEnd(5)} ${l.message}`);
+}
+//# sourceMappingURL=metrics.js.map

package/dist/commands/observe.js

@@ -0,0 +1,58 @@
+// `insta observe` — the local credential-audit hook. install wires a PostToolUse hook into the
+// agent harness; report renders the local audit; sync uploads findings into the project timeline
+// (idempotent via a stable dedup key, matching the platform's audit-event ingest).
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { installObserve, uninstallObserve } from '../observe/install.js';
+import { renderReport } from '../observe/report.js';
+import { ApiClient, requireProject } from '../api.js';
+import { info, printJson } from '../util.js';
+async function readAudit() {
+    try {
+        const txt = await readFile(join(process.cwd(), '.insta', 'audit.jsonl'), 'utf8');
+        return txt.split('\n').filter(Boolean).map((l) => JSON.parse(l));
+    }
+    catch {
+        return [];
+    }
+}
+function dedupKey(r) {
+    return `${r.ts}|${r.fingerprint}|${r.surface}|${r.sink}|${r.kind}`;
+}
+function* chunk(a, n) {
+    for (let i = 0; i < a.length; i += n)
+        yield a.slice(i, i + n);
+}
+export async function observeInstall() {
+    const res = installObserve({ cwd: process.cwd() });
+    info(`installed observe hook (claude: ${res.claude}, codex: ${res.codex}) → ./.insta/observe`);
+    info('it scans agent tool-use for credential exposure; findings append to ./.insta/audit.jsonl');
+    info('run `insta observe report` to review, `insta observe sync` to upload to the project timeline');
+}
+export async function observeUninstall() {
+    uninstallObserve(process.cwd());
+    info('uninstalled observe hook');
+}
+export async function observeReport(opts) {
+    const rows = await readAudit();
+    if (opts.json)
+        return printJson(rows);
+    info(renderReport(rows));
+}
+export async function observeSync() {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const rows = await readAudit();
+    if (!rows.length)
+        return info('nothing to sync (./.insta/audit.jsonl is empty)');
+    const events = rows.map((r) => ({ source: 'agent', kind: `cred.${r.kind ?? 'touch'}`, branchId: null, dedupKey: dedupKey(r), payload: r }));
+    let recorded = 0;
+    let skipped = 0;
+    for (const c of chunk(events, 200)) {
+        const out = await api.request('POST', `/projects/${p.projectId}/events`, { events: c });
+        recorded += out.recorded;
+        skipped += out.skipped;
+    }
+    info(`synced ${rows.length} finding(s) → recorded ${recorded}, skipped ${skipped} (already uploaded)`);
+}
+//# sourceMappingURL=observe.js.map

package/dist/commands/org.js

@@ -0,0 +1,16 @@
+import { ApiClient } from '../api.js';
+import { info, printJson } from '../util.js';
+export async function orgList(opts) {
+    const api = await ApiClient.load();
+    const { orgs } = await api.request('GET', '/orgs');
+    if (opts.json)
+        return printJson(orgs);
+    for (const o of orgs)
+        info(`${o.id}  ${o.name}${o.is_personal ? ' (personal)' : ''}  [${o.role}]`);
+}
+export async function orgCreate(name) {
+    const api = await ApiClient.load();
+    const { org } = await api.request('POST', '/orgs', { name });
+    info(`created org ${org.id} (${org.name})`);
+}
+//# sourceMappingURL=org.js.map

package/dist/commands/project.js

@@ -0,0 +1,61 @@
+import { ApiClient, requireProject } from '../api.js';
+import { writeProject } from '../config.js';
+import { info, die, printJson, handleApproval } from '../util.js';
+import { installObserve } from '../observe/install.js';
+import { installSkills } from '../ensure-skills.js';
+// Best-effort: wire the credential-audit hook into the project (no-op if assets aren't built).
+function tryInstallObserve() {
+    try {
+        const r = installObserve({ cwd: process.cwd() });
+        if (r.claude || r.codex)
+            info('  installed observe hook (credential audit) → ./.insta/observe');
+    }
+    catch { /* assets missing (dev/unbuilt) — skip silently */ }
+}
+async function resolveOrg(api, given) {
+    if (given)
+        return given;
+    const { orgs } = await api.request('GET', '/orgs');
+    if (!orgs.length)
+        die('no org found — run `insta org create <name>`');
+    return orgs[0].id;
+}
+export async function projectCreate(name, opts) {
+    const api = await ApiClient.load();
+    const orgId = await resolveOrg(api, opts.org);
+    const out = await api.request('POST', `/orgs/${orgId}/projects`, { name });
+    await writeProject({ projectId: out.project.id, orgId, branch: out.defaultBranch.name });
+    info(`created project ${out.project.id} (${name})`);
+    info(`  resources: ${out.resources.map((r) => r.kind).join(', ')}`);
+    info(`  linked ./.insta/project.json (branch ${out.defaultBranch.name})`);
+    tryInstallObserve();
+    await installSkills({ cwd: process.cwd() });
+}
+export async function projectList(opts) {
+    const api = await ApiClient.load();
+    const orgId = await resolveOrg(api, opts.org);
+    const { projects } = await api.request('GET', `/orgs/${orgId}/projects`);
+    if (opts.json)
+        return printJson(projects);
+    if (!projects.length)
+        return info('(no projects)');
+    for (const p of projects)
+        info(`${p.id}  ${p.name}  [${p.status}]`);
+}
+export async function projectLink(id) {
+    const api = await ApiClient.load();
+    const { project } = await api.request('GET', `/projects/${id}`);
+    await writeProject({ projectId: project.id, orgId: project.org_id, branch: 'main' });
+    info(`linked project ${project.id} (${project.name})`);
+    tryInstallObserve();
+    await installSkills({ cwd: process.cwd() });
+}
+export async function projectDelete(opts) {
+    const api = await ApiClient.load();
+    const projectId = opts.project ?? (await requireProject()).projectId;
+    const res = await api.rawRequest('DELETE', `/projects/${projectId}`);
+    if (handleApproval(res))
+        return;
+    info(`deleted project ${projectId}`);
+}
+//# sourceMappingURL=project.js.map

package/dist/commands/secrets.js

@@ -0,0 +1,36 @@
+import { writeFile } from 'node:fs/promises';
+import { ApiClient, requireProject } from '../api.js';
+import { info, printJson, serializeEnv, handleApproval } from '../util.js';
+function q(branch) {
+    return branch ? `?branch=${encodeURIComponent(branch)}` : '';
+}
+// Fetch the credential bundle (the secret seam) and write it to .env (or print).
+export async function secrets(opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const branch = opts.branch ?? p.branch;
+    const res = await api.rawRequest('GET', `/projects/${p.projectId}/secrets${q(branch)}`);
+    if (handleApproval(res))
+        return;
+    const bundle = res.body.secrets;
+    if (opts.json)
+        return printJson(bundle);
+    if (opts.print) {
+        process.stdout.write(serializeEnv(bundle));
+        return;
+    }
+    const out = opts.output ?? '.env';
+    await writeFile(out, serializeEnv(bundle));
+    info(`wrote ${Object.keys(bundle).length} secrets to ${out} (branch ${branch})`);
+}
+export async function secretsList(opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const branch = opts.branch ?? p.branch;
+    const res = await api.rawRequest('GET', `/projects/${p.projectId}/secrets${q(branch)}`);
+    if (handleApproval(res))
+        return;
+    for (const name of Object.keys(res.body.secrets))
+        info(name);
+}
+//# sourceMappingURL=secrets.js.map

package/dist/commands/services.js

@@ -0,0 +1,89 @@
+// `insta services` — manage a project's opt-in services (postgres | storage | compute).
+import { ApiClient, requireProject } from '../api.js';
+import { info, printJson, handleApproval } from '../util.js';
+export const SERVICE_TYPES = ['postgres', 'storage', 'compute'];
+// ---- pure, unit-tested helpers (throw plain Errors; the CLI guard turns them into clean output) ----
+// Validate a service-type argument against the allowed set for a command.
+export function assertType(type, allowed = SERVICE_TYPES) {
+    if (!allowed.includes(type))
+        throw new Error(`type must be ${allowed.join('|')}`);
+}
+// Parse a positive-integer machine count.
+export function parseCount(raw) {
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n < 1)
+        throw new Error(`count must be a positive integer, got: ${raw}`);
+    return n;
+}
+// Resolve a service id from a `services list` result by (type, name).
+export function resolveServiceId(services, type, name) {
+    const svc = services.find((s) => s.type === type && s.name === name);
+    if (!svc)
+        throw new Error(`service not found: ${type} ${name}`);
+    return svc.id;
+}
+// ---- commands ----
+export async function servicesAdd(type, name) {
+    assertType(type);
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const res = await api.rawRequest('POST', `/projects/${p.projectId}/services`, { type, name });
+    if (handleApproval(res))
+        return;
+    const svc = res.body.service;
+    info(`added ${type} service ${name} (${svc.id})${svc.domain ? ` — ${svc.domain}` : ''}`);
+}
+export async function servicesList(opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const { services } = await api.request('GET', `/projects/${p.projectId}/services`);
+    if (opts.json)
+        return printJson(services);
+    if (!services.length)
+        return info('(no services — add one with `insta services add <postgres|storage|compute> <name>`)');
+    for (const s of services) {
+        const extra = s.type === 'compute' ? `  x${s.machine_count}` : '';
+        info(`${s.type}/${s.name}  [${s.status}]${extra}${s.domain ? `  ${s.domain}` : ''}  ${s.id}`);
+    }
+}
+export async function servicesRemove(type, name) {
+    assertType(type);
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const { services } = await api.request('GET', `/projects/${p.projectId}/services`);
+    const id = resolveServiceId(services, type, name);
+    const res = await api.rawRequest('DELETE', `/projects/${p.projectId}/services/${id}`);
+    if (handleApproval(res))
+        return;
+    info(`removed ${type} service ${name}`);
+}
+// insta services scale compute <name> <number> [region]
+export async function servicesScale(type, name, number, region, _opts) {
+    assertType(type, ['compute']);
+    const machineCount = parseCount(number);
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const { services } = await api.request('GET', `/projects/${p.projectId}/services`);
+    const id = resolveServiceId(services, type, name);
+    const res = await api.rawRequest('POST', `/projects/${p.projectId}/services/${id}/scale`, { machineCount, region });
+    if (handleApproval(res))
+        return;
+    if (_opts.json)
+        return printJson(res.body.service);
+    info(`scaled compute ${name} to ${machineCount} machine(s)${region ? ` in ${region}` : ''}`);
+}
+// insta services upgrade <compute|postgres> <name> <new-spec>
+export async function servicesUpgrade(type, name, spec, _opts) {
+    assertType(type, ['compute', 'postgres']);
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const { services } = await api.request('GET', `/projects/${p.projectId}/services`);
+    const id = resolveServiceId(services, type, name);
+    const res = await api.rawRequest('POST', `/projects/${p.projectId}/services/${id}/upgrade`, { spec });
+    if (handleApproval(res))
+        return;
+    if (_opts.json)
+        return printJson(res.body.service);
+    info(`upgraded ${type} ${name} to ${spec}`);
+}
+//# sourceMappingURL=services.js.map

package/dist/config.js

@@ -0,0 +1,35 @@
+// CLI config: global (~/.insta/config.json: api url + tokens) and per-project (./.insta/project.json).
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+const GLOBAL_DIR = join(homedir(), '.insta');
+const GLOBAL_FILE = join(GLOBAL_DIR, 'config.json');
+const PROJECT_DIR = '.insta';
+const PROJECT_FILE = 'project.json';
+const DEFAULT_API = process.env.INSTA_API_URL ?? 'https://beta-api.insta.insforge.dev';
+export async function readGlobal() {
+    try {
+        const parsed = JSON.parse(await readFile(GLOBAL_FILE, 'utf8'));
+        return { ...parsed, apiUrl: parsed.apiUrl ?? DEFAULT_API };
+    }
+    catch {
+        return { apiUrl: DEFAULT_API };
+    }
+}
+export async function writeGlobal(c) {
+    await mkdir(GLOBAL_DIR, { recursive: true });
+    await writeFile(GLOBAL_FILE, JSON.stringify(c, null, 2));
+}
+export async function readProject(cwd = process.cwd()) {
+    try {
+        return JSON.parse(await readFile(join(cwd, PROJECT_DIR, PROJECT_FILE), 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+export async function writeProject(c, cwd = process.cwd()) {
+    await mkdir(join(cwd, PROJECT_DIR), { recursive: true });
+    await writeFile(join(cwd, PROJECT_DIR, PROJECT_FILE), JSON.stringify(c, null, 2));
+}
+//# sourceMappingURL=config.js.map

package/dist/ensure-skills.js

@@ -0,0 +1,70 @@
+// Install the related agent skills into a linked project so the developer's coding agent has
+// context for what InstaCloud provisions — the `insta` CLI itself plus the three services you build
+// directly against (Neon Postgres, Tigris storage, Better Auth). Runs `npx skills add`
+// (vercel-labs/skills) fully non-interactively. Best-effort: a failure (offline, npx missing, a
+// repo moved) prints a manual fallback and never blocks or fails the host command — same contract
+// as the observe-hook install.
+import { spawn } from 'node:child_process';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+// Where `npx skills add` drops skills for the agents we pin below: Claude Code → .claude/skills/,
+// Codex → .agents/skills/ (.github/skills/ is the third well-known dir). These are regenerable
+// agent context, not the developer's source — keep them out of git.
+const SKILL_DIRS = ['.claude/skills/', '.agents/skills/', '.github/skills/'];
+const defaultRunner = (cmd, args, inherit = false) => new Promise((resolve) => {
+    const p = spawn(cmd, args, { stdio: inherit ? 'inherit' : 'ignore' });
+    p.on('error', () => resolve({ ok: false })); // e.g. npx not on PATH
+    p.on('close', (code) => resolve({ ok: code === 0 }));
+});
+// `npx skills add` is non-interactive only when we remove every prompt: pin the target agents
+// (-a claude-code -a codex) so it neither asks which agent nor fans out to every known agent dir;
+// name the exact skills (-s …) so there's no skill picker; -y to skip the scope/confirm prompt;
+// --copy to write real files (not symlinks into a transient npx cache).
+const AGENT_FLAGS = ['-a', 'claude-code', '-a', 'codex', '-y', '--copy'];
+const SKILLS = [
+    { label: 'insta', args: ['skills', 'add', 'InsForge/insta-skills', '-s', 'insta', ...AGENT_FLAGS] },
+    { label: 'neon-postgres', args: ['skills', 'add', 'neondatabase/agent-skills', '-s', 'neon-postgres', ...AGENT_FLAGS] },
+    { label: 'tigris', args: ['skills', 'add', 'tigrisdata/skills',
+            '-s', 'tigris-object-operations', '-s', 'file-storage', '-s', 'tigris-sdk-guide',
+            '-s', 'tigris-security-access-control', '-s', 'tigris-image-optimization',
+            '-s', 'tigris-s3-migration', '-s', 'tigris-static-assets', '-s', 'tigris-agent-kit',
+            ...AGENT_FLAGS] },
+    { label: 'better-auth', args: ['skills', 'add', 'better-auth/skills',
+            '-s', 'better-auth-best-practices', '-s', 'email-and-password-best-practices',
+            '-s', 'better-auth-security-best-practices', ...AGENT_FLAGS] },
+];
+// Install all related skills. Production omits `run`/`print` → the real spawn + stdout; tests inject
+// a fake runner and capture output. Continues past a per-skill failure so one bad repo doesn't skip
+// the rest, and never throws.
+export async function installSkills(deps) {
+    const run = deps.run ?? defaultRunner;
+    const print = deps.print ?? ((s) => process.stdout.write(s + '\n'));
+    try {
+        print('  installing related agent skills (insta, neon-postgres, tigris, better-auth) via `npx skills add` …');
+        for (const s of SKILLS) {
+            const r = await run('npx', s.args, true); // streamed so the user sees download progress
+            print(r.ok ? `  ${s.label} ✓` : `  ${s.label} failed — add manually: npx ${s.args.join(' ')}`);
+        }
+        const added = ensureGitignore(deps.cwd, SKILL_DIRS);
+        if (added.length)
+            print(`  .gitignore += ${added.join(', ')}`);
+    }
+    catch {
+        /* best-effort convenience — never block the host command */
+    }
+}
+// Append any missing entries to the project's ./.gitignore (creating it if absent). Idempotent:
+// entries already present are left alone. Returns the entries it added.
+export function ensureGitignore(cwd, entries) {
+    const p = join(cwd, '.gitignore');
+    const existing = existsSync(p) ? readFileSync(p, 'utf8') : '';
+    const have = new Set(existing.split('\n').map((l) => l.trim()));
+    const missing = entries.filter((e) => !have.has(e));
+    if (missing.length === 0)
+        return [];
+    const prefix = existing && !existing.endsWith('\n') ? '\n' : '';
+    const comment = '# InstaCloud: agent skills installed by `npx skills add` (regenerable, not source)';
+    writeFileSync(p, existing + `${prefix}\n${comment}\n${missing.join('\n')}\n`);
+    return missing;
+}
+//# sourceMappingURL=ensure-skills.js.map

package/dist/flyctl-build.js

@@ -0,0 +1,79 @@
+// Build a source directory into an image and push it to Fly's registry, using a short-lived,
+// app-scoped deploy token minted by the platform (the CLI never holds a standing Fly credential).
+// Shells out to `flyctl deploy --build-only --push` (remote builder). Ported from firth.
+import { spawn } from 'node:child_process';
+import { existsSync, writeFileSync, unlinkSync } from 'node:fs';
+import { join } from 'node:path';
+import { info } from './util.js';
+// Spawn flyctl, tee its output to the user (so they see buildkit progress) AND capture it for digest
+// parsing.
+export const defaultBuildRunner = (cmd, args, opts) => new Promise((resolve) => {
+    const child = spawn(cmd, args, { cwd: opts.cwd, env: opts.env, stdio: ['inherit', 'pipe', 'pipe'] });
+    let output = '';
+    child.stdout?.on('data', (b) => { const s = b.toString(); output += s; process.stdout.write(s); });
+    child.stderr?.on('data', (b) => { const s = b.toString(); output += s; process.stderr.write(s); });
+    child.on('error', (err) => resolve({ code: -1, output: `${output}\n${err.message}` }));
+    child.on('close', (code) => resolve({ code: code ?? -1, output }));
+});
+// buildkit prints "pushing manifest for registry.fly.io/<app>:<label>@sha256:<digest>" on push.
+// Pin to the digest — the bare tag races on Fly's registry (MANIFEST_UNKNOWN); the digest always resolves.
+export function parseImageDigest(output, flyApp) {
+    const m = output.match(/pushing manifest for registry\.fly\.io\/[^\s]+@(sha256:[0-9a-f]+)/);
+    return m ? `registry.fly.io/${flyApp}@${m[1]}` : null;
+}
+// Write a minimal stub fly.toml iff the dir has none (flyctl needs app config; a fresh app has no
+// machines to derive it from). Region is build-config only — `--build-only` places no machines.
+// Returns a cleanup callback the caller MUST run in finally; leaves a user's own fly.toml alone.
+function ensureFlyTomlStub(dir, flyApp, port) {
+    const path = join(dir, 'fly.toml');
+    if (existsSync(path))
+        return () => { };
+    const stub = `# Auto-generated by insta for source deploy. Safe to delete.\n` +
+        `app = "${flyApp}"\n` +
+        `primary_region = "iad"\n\n` +
+        `[build]\n\n` +
+        `[http_service]\n` +
+        `  internal_port = ${port}\n` +
+        `  force_https = true\n`;
+    writeFileSync(path, stub, 'utf8');
+    return () => { try {
+        unlinkSync(path);
+    }
+    catch { /* best-effort */ } };
+}
+export async function flyctlBuildAndPush(opts, run = defaultBuildRunner) {
+    const cleanup = ensureFlyTomlStub(opts.dir, opts.flyApp, opts.port);
+    try {
+        const { code, output } = await run('flyctl', ['deploy', '--remote-only', '--build-only', '--push', '--app', opts.flyApp, '--image-label', opts.imageLabel, '--no-cache'], { cwd: opts.dir, env: { ...process.env, FLY_API_TOKEN: opts.token } });
+        if (code !== 0)
+            throw new Error(`flyctl deploy --build-only failed (exit ${code}). See output above.`);
+        const imageRef = parseImageDigest(output, opts.flyApp);
+        if (!imageRef)
+            throw new Error('flyctl build succeeded but no "pushing manifest" digest line was found — cannot determine the image. Re-run with FLY_LOG_LEVEL=debug.');
+        return { imageRef };
+    }
+    finally {
+        cleanup();
+    }
+}
+// Best-effort: ensure the fly CLI is available (needed for source-directory deploys). Never blocks —
+// if it can't be installed the subsequent build surfaces a clear error.
+export async function ensureFlyctl() {
+    const ok = (cmd, args, inherit = false) => new Promise((resolve) => {
+        const p = spawn(cmd, args, { stdio: inherit ? 'inherit' : 'ignore' });
+        p.on('error', () => resolve(false));
+        p.on('close', (code) => resolve(code === 0));
+    });
+    try {
+        if (await ok('flyctl', ['version']))
+            return;
+        if (process.platform === 'darwin' && (await ok('brew', ['--version']))) {
+            info('flyctl not found — installing with `brew install flyctl` (one-time)…');
+            info((await ok('brew', ['install', 'flyctl'], true)) ? 'flyctl installed ✓' : 'flyctl install failed — install manually: https://fly.io/docs/flyctl/install/');
+            return;
+        }
+        info('flyctl (fly CLI) not found — install it to deploy from source: https://fly.io/docs/flyctl/install/');
+    }
+    catch { /* best-effort convenience */ }
+}
+//# sourceMappingURL=flyctl-build.js.map