insta 0.0.24 → 0.0.26

package/dist/commands/auth.js

@@ -1,6 +1,6 @@
 import { createServer } from 'node:http';
 import { randomBytes } from 'node:crypto';
-import { ApiClient, linkedProject } from '../api.js';
+import { ApiClient, ApiError, linkedProject } from '../api.js';
 import { ENVS, ENV_NAMES, envForApiUrl, isEnvName } from '../env.js';
 import { info, die, printJson, promptPassword, openUrl } from '../util.js';
 /** --api-url and --env both set the target host; --api-url wins (more specific), matching the
@@ -17,6 +17,8 @@ function targetApiUrl(opts) {
     return ENVS[want].api;
 }
 export async function login(opts) {
+    if (opts.device)
+        return loginDevice(opts);
     if (opts.oauth)
         return loginOauth(opts.oauth, opts);
     const api = await ApiClient.load();
@@ -24,7 +26,7 @@ export async function login(opts) {
     if (target)
         api.setApiUrl(target);
     if (!opts.email)
-        die('--email is required (or use --oauth <github|google>)');
+        die('--email is required (or use --oauth <github|google>; on a headless machine, --device)');
     const password = opts.password ?? process.env.INSTA_PASSWORD ?? (await promptPassword());
     const res = await api.request('POST', '/auth/login', { email: opts.email, password }, { auth: false });
     api.setSession(res, res.user);
@@ -47,6 +49,80 @@ export async function loginOauth(provider, opts) {
     await api.persist();
     info(`logged in as ${me.user.email ?? me.user.id} @ ${api.apiUrl}`);
 }
+// RFC 8628 device authorization — login from a machine with no usable browser (VM, SSH box, CI
+// container). The loopback --oauth flow can never work there: its callback targets 127.0.0.1 on
+// THIS machine. Here the roles invert — we mint a code, print a link the human opens on ANY
+// device, and poll the platform until they approve in the console.
+export async function loginDevice(opts) {
+    const api = await ApiClient.load();
+    const target = targetApiUrl(opts);
+    if (target)
+        api.setApiUrl(target);
+    const token = await deviceGrant((path, body) => api.request('POST', path, body, { auth: false }));
+    api.setSession({ accessToken: token, refreshToken: token });
+    const me = await api.request('GET', '/me');
+    api.setSession({ accessToken: token, refreshToken: token }, me.user);
+    await api.persist();
+    info(`logged in as ${me.user.email ?? me.user.id} @ ${api.apiUrl}`);
+}
+const sleepSeconds = (s) => new Promise((r) => setTimeout(r, s * 1000));
+// Drives the device grant against the platform's Better Auth mount (/api/auth/device*) and
+// returns the approved session token. Injectable poster + wait keep this testable without a
+// network or real timers. Poll errors arrive as ApiError with the OAuth error code as message.
+export async function deviceGrant(post, wait = sleepSeconds) {
+    const start = (await post('/api/auth/device/code', { client_id: 'insta-cli' }));
+    // A missing/garbage expires_in must fail loudly here — carried into the deadline arithmetic it
+    // becomes NaN, every `Date.now() < deadline` is false, and login dies as a bogus instant expiry.
+    // Cap the lifetime too: a huge-but-finite value (Number.MAX_VALUE) overflows the ms conversion
+    // to Infinity and would otherwise pin the CLI polling forever.
+    const expiresIn = Number(start.expires_in);
+    if (!Number.isFinite(expiresIn) || expiresIn <= 0) {
+        throw new Error('malformed device authorization response (missing expires_in) — is the platform up to date?');
+    }
+    const lifetime = Math.min(expiresIn, 3600); // no device code sensibly outlives an hour
+    info('to log in, open this link in a browser on any device:');
+    info(`  ${start.verification_uri_complete ?? start.verification_uri}`);
+    info(`and check it shows this code: ${start.user_code}`);
+    info(`waiting for approval… (expires in ${Math.round(lifetime / 60)}m, ctrl-c to abort)`);
+    // Absent OR non-finite interval = the RFC 8628 §3.2 default 5s: NaN would fire the timer
+    // instantly and Infinity gets truncated to ~1ms by Node — both hot-poll the token endpoint.
+    const rawInterval = Number(start.interval);
+    let interval = Number.isFinite(rawInterval) ? Math.max(rawInterval, 1) : 5;
+    const deadline = Date.now() + lifetime * 1000;
+    while (Date.now() < deadline) {
+        await wait(interval);
+        let grant = null;
+        try {
+            grant = (await post('/api/auth/device/token', {
+                grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+                device_code: start.device_code,
+                client_id: 'insta-cli',
+            }));
+        }
+        catch (e) {
+            if (!(e instanceof ApiError))
+                continue; // transport blip (dropped SSH/CI link) — keep polling until deadline
+            const code = e.message;
+            if (code === 'authorization_pending')
+                continue;
+            if (code === 'slow_down') {
+                interval += 5;
+                continue;
+            } // RFC 8628 §3.5: back off by 5s
+            if (code === 'expired_token')
+                break;
+            if (code === 'access_denied')
+                throw new Error('login request was denied in the console');
+            throw e; // a definite API-level error (invalid_grant, …) — not retryable
+        }
+        // Validated OUTSIDE the try: a 200 without a token is a malformed response that must fail
+        // loudly, not be mistaken for a transport blip and retried into an empty stored session.
+        if (!grant?.access_token)
+            throw new Error('malformed token response (missing access_token)');
+        return grant.access_token;
+    }
+    throw new Error('device login expired before it was approved — run `insta login --device` again');
+}
 // Start a loopback server, open the browser at the platform bridge, and await the token.
 function browserOauth(apiUrl, provider) {
     return new Promise((resolve, reject) => {

package/dist/commands/compute.js

@@ -87,4 +87,63 @@ export async function computeAlwaysOn(mode, serviceName, opts) {
     const on = res.body.service?.always_on;
     info(`compute ${res.body.service?.name ?? id}: always-on ${on ? 'ENABLED — machines stay warm (no cold starts; idle RAM bills at actual usage)' : 'disabled — scales to zero when idle (default)'}`);
 }
+// ---- limits (the resource ceiling; paid plans) ----
+// Parse a human memory value into MB: "512", "512mb", "1gb", "2g", "1.5gb".
+// Exported for unit tests — this is the only place a user-typed size becomes a number.
+export function parseMemoryMb(raw) {
+    const m = /^\s*(\d+(?:\.\d+)?)\s*(g|gb|gi|gib|m|mb|mi|mib)?\s*$/i.exec(raw);
+    if (!m)
+        throw new Error(`invalid memory: ${raw} (try 512mb, 1gb, 2gb)`);
+    const n = Number(m[1]);
+    const unit = (m[2] ?? 'mb').toLowerCase();
+    const mb = unit.startsWith('g') ? n * 1024 : n;
+    if (!(mb > 0))
+        throw new Error(`invalid memory: ${raw}`);
+    return Math.round(mb);
+}
+// Whole and half GB collapse (1536 → "1.5 GB"); anything else stays exact in MB — a display that
+// rounds 1536 to "2 GB" claims a ceiling the API did not set.
+export const fmtMb = (mb) => (mb >= 1024 && mb % 512 === 0 ? `${mb / 1024} GB` : `${mb} MB`);
+// The --cpu override, through a throwing parser like every other user-typed number in this repo
+// (parseCount, parseMemoryMb). A bare Number() turns a typo into NaN, which JSON.stringify
+// serializes as null — the server then sees {cpu: null} instead of the user seeing an error.
+// Enforces the provider grid the help text advertises: the server would reject 100 anyway, but a
+// value the client KNOWS is invalid should fail locally, matching what --help promises.
+const CPU_SIZES = [1, 2, 4, 6, 8];
+export function parseCpu(raw) {
+    const n = Number(raw);
+    if (!CPU_SIZES.includes(n))
+        throw new Error(`invalid cpu: ${raw} (provider sizes: ${CPU_SIZES.join(', ')})`);
+    return n;
+}
+// Show or set a compute service's ceiling. With no --memory it PRINTS the current limits and the
+// plan cap (so `insta compute limits` is a safe read), which is also what a UI renders as a slider
+// with its plan-limit marker.
+export async function computeLimits(serviceName, opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const branch = opts.branch ?? p.branch;
+    const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(branch)}`);
+    const id = resolveComputeServiceId(services, serviceName);
+    if (!opts.memory && !opts.cpu) {
+        const r = await api.request('GET', `/projects/${p.projectId}/services/${id}/limits`);
+        if (opts.json)
+            return printJson(r);
+        info(`compute ${serviceName ?? id}: ceiling ${r.limits.cpu} vCPU / ${fmtMb(r.limits.memoryMb)}  (plan max ${r.cap.cpu} vCPU / ${fmtMb(r.cap.memoryMb)})`);
+        info('  billing is actual usage — the ceiling caps what the app may burn, it is not a price');
+        return;
+    }
+    if (!opts.memory)
+        throw new Error('--memory is required when setting limits (cpu is derived from it; pass --cpu only to override)');
+    const body = { memoryMb: parseMemoryMb(opts.memory) };
+    if (opts.cpu)
+        body.cpu = parseCpu(opts.cpu);
+    const res = await api.rawRequest('PUT', `/projects/${p.projectId}/services/${id}/limits`, body);
+    if (handleApproval(res))
+        return;
+    if (opts.json)
+        return printJson(res.body);
+    const l = res.body.limits;
+    info(`compute ${res.body.service?.name ?? id}: ceiling set to ${l.cpu} vCPU / ${fmtMb(l.memoryMb)}`);
+}
 //# sourceMappingURL=compute.js.map

package/dist/commands/db.js

@@ -1,4 +1,4 @@
-import { ApiClient, requireProject } from '../api.js';
+import { ApiClient, ApiError, requireProject } from '../api.js';
 import { info, printJson, handleApproval } from '../util.js';
 // Toggle a postgres service between scale-to-zero (the default: instance suspends when idle,
 // cold-starts on the next connection) and always-on (instance stays warm; idle RAM bills at
@@ -24,4 +24,96 @@ export async function dbAlwaysOn(mode, opts) {
     const s2z = res.body?.scaleToZero;
     info(`postgres ${opts.group ?? 'default'}: always-on ${s2z === false ? 'ENABLED — instance stays warm (no cold starts; idle RAM bills at actual usage)' : 'disabled — scales to zero when idle (default; first connection after idle cold-starts)'}`);
 }
+// Validated pass-throughs for the provider's quantity strings. The insta-db resize API takes
+// k8s-style quantities (cpu: "2", "2500m"; memory: "4Gi", "2048Mi"), so unlike the compute path
+// there is no unit conversion here — but junk must still fail LOCALLY with an example, not travel
+// to the server as-is. CASE-EXACT deliberately: k8s quantities are case-sensitive ("4gi" is
+// rejected server-side), and local validation that accepts a form the backend refuses would
+// defeat its own purpose.
+export function parseDbCpu(raw) {
+    if (!/^\d+(\.\d+)?m?$/.test(raw.trim()))
+        throw new Error(`invalid cpu: ${raw} (try 2, 4, or 2500m)`);
+    return raw.trim();
+}
+export function parseDbMemory(raw) {
+    if (!/^\d+(\.\d+)?(Gi|Mi|G|M)$/.test(raw.trim()))
+        throw new Error(`invalid memory: ${raw} (try 4Gi or 8Gi)`);
+    return raw.trim();
+}
+// MiB → display without lying: whole/half GiB collapse, anything else stays exact in MiB
+// (1536 MiB is "1.5 GiB", 1300 MiB is "1300 MiB" — never "1 GiB").
+export function fmtMib(mib) {
+    return mib >= 1024 && mib % 512 === 0 ? `${mib / 1024} GiB` : `${mib} MiB`;
+}
+export async function fetchDbInstance(api, projectId, suffix) {
+    try {
+        const res = await api.rawRequest('GET', `/projects/${projectId}/database/instance${suffix}`);
+        return { kind: 'ok', body: res.body };
+    }
+    catch (e) {
+        // The platform answers a provider-shaped 502 for services with no manageable instance
+        // (Neon-backed): a soft case, not a failure. Everything else stays an error — an expired
+        // token must not render as "no ceiling set" — but wrapped so the user sees what failed.
+        if (e instanceof ApiError && e.status === 502)
+            return { kind: 'no-instance' };
+        if (e instanceof ApiError)
+            throw new Error(`reading the instance failed (${e.status}): ${e.message}`);
+        throw e;
+    }
+}
+// Show or set a postgres service's resource ceiling (insta-db-backed only). Paid plans — the
+// ceiling is the tier lever now that billing follows actual usage. Moves both directions:
+// unlike storage it is a cgroup limit, not a provisioned volume.
+export async function dbLimits(opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const qs = new URLSearchParams();
+    const branch = opts.branch ?? p.branch;
+    if (branch)
+        qs.set('branch', branch);
+    if (opts.group)
+        qs.set('group', opts.group);
+    const suffix = qs.toString() ? `?${qs}` : '';
+    if (!opts.cpu && !opts.memory) {
+        const read = await fetchDbInstance(api, p.projectId, suffix);
+        if (read.kind === 'no-instance') {
+            info(`postgres ${opts.group ?? 'default'}: no manageable instance (Neon-backed services manage their own resources)`);
+            return;
+        }
+        if (opts.json)
+            return printJson(read.body);
+        const cpuMilli = read.body?.cpuMilli;
+        const mib = read.body?.memoryMib;
+        if (typeof cpuMilli === 'number' && typeof mib === 'number') {
+            const cpu = cpuMilli % 1000 === 0 ? `${cpuMilli / 1000}` : `${cpuMilli}m`;
+            info(`postgres ${opts.group ?? 'default'}: ceiling ${cpu} vCPU / ${fmtMib(mib)}`);
+            info('  billing is actual usage — the ceiling caps what the database may burn, it is not a price');
+        }
+        else {
+            info(`postgres ${opts.group ?? 'default'}: provider reported no ceiling — set one with --cpu/--memory`);
+        }
+        return;
+    }
+    const body = {};
+    if (opts.cpu)
+        body.cpu = parseDbCpu(opts.cpu);
+    if (opts.memory)
+        body.memory = parseDbMemory(opts.memory);
+    let res;
+    try {
+        res = await api.rawRequest('PATCH', `/projects/${p.projectId}/database/settings${suffix}`, body);
+    }
+    catch (e) {
+        if (e instanceof ApiError)
+            throw new Error(`setting the ceiling failed (${e.status}): ${e.message}`);
+        throw e;
+    }
+    if (handleApproval(res))
+        return;
+    if (opts.json)
+        return printJson(res.body);
+    const cpu = typeof res.body?.cpuMilli === 'number' ? `${res.body.cpuMilli / 1000} vCPU` : (opts.cpu ?? 'unchanged');
+    const mem = typeof res.body?.memoryMib === 'number' ? fmtMib(res.body.memoryMib) : (opts.memory ?? 'unchanged');
+    info(`postgres ${opts.group ?? 'default'}: ceiling set to ${cpu} / ${mem}`);
+}
 //# sourceMappingURL=db.js.map

package/dist/index.js

@@ -54,10 +54,11 @@ function resolveVersion() {
 }
 program.name('insta').description('InstaCloud CLI — manage projects, branches, secrets, deploys').version(resolveVersion());
 // ---- auth ----
-program.command('login').description('Log in with email + password, or --oauth <github|google> (browser)')
+program.command('login').description('Log in with email + password, --oauth <github|google> (browser), or --device (headless)')
     .option('--email <email>', 'account email')
     .option('--password <password>', 'account password (else $INSTA_PASSWORD or prompt)')
     .option('--oauth <provider>', 'browser OAuth login: github | google')
+    .option('--device', 'device-code login: approve from a browser on any other machine (VMs, SSH, CI)')
     .option('--api-url <url>', 'control-plane API base URL')
     .option('--env <name>', `deployment environment: ${ENV_NAMES.join(' | ')}`)
     .action(guard((o) => auth.login(o)));
@@ -163,10 +164,17 @@ compute.command('suspend [service]').description('Suspend a compute service (RAM
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeSuspend(service, o)));
 compute.command('status [service]').description("Show a compute service's desired vs. live state")
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeStatus(service, o)));
+compute.command('limits [service]').description("Show or set a compute service's resource ceiling (paid plans). --memory is the dial; cpu derives from it unless --cpu is given. Billing is actual usage — the ceiling caps what the app may burn, it is not a price")
+    .option('--memory <size>', 'memory ceiling, e.g. 512mb or 1gb').option('--cpu <n>', 'vCPU ceiling override (provider sizes: 1, 2, 4, 6, 8)')
+    .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeLimits(service, o)));
 compute.command('always-on <mode> [service]').description('Set a compute service always-on (mode: on|off). on = machines never scale to zero; off = default scale-to-zero. All plans; billing is actual usage either way')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((mode, service, o) => computeCmd.computeAlwaysOn(mode, service, o)));
 // ---- db (postgres service controls) ----
-const db = program.command('db').description('Postgres service controls (always-on / scale-to-zero)');
+const db = program.command('db').description('Postgres service controls (limits / always-on / scale-to-zero)');
+db.command('limits').description("Show or set a postgres service's resource ceiling (paid plans; insta-db-backed only). Moves both directions")
+    .option('--cpu <n>', "vCPU ceiling, e.g. 2 or 2500m").option('--memory <size>', "memory ceiling, e.g. 4Gi")
+    .option('--json').option('--branch <branch>', 'branch (default: current)').option('--group <g>', 'postgres service name (default: the sole/default one)')
+    .action(guard((o) => dbCmd.dbLimits(o)));
 db.command('always-on <mode>').description('Set a postgres service always-on (mode: on|off). on = instance stays warm, no cold starts; off = default scale-to-zero (idle instance suspends; first connection cold-starts). insta-db-backed services only')
     .option('--json').option('--branch <branch>', 'branch (default: current)').option('--group <g>', 'postgres service name (default: the sole/default one)')
     .action(guard((mode, o) => dbCmd.dbAlwaysOn(mode, o)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.0.24",
+  "version": "0.0.26",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [