insta 0.1.19 → 0.1.21

package/README.md

@@ -237,7 +237,7 @@ build never reaches a production installer.
 | `insta build [dir]` · `deploy [dir]` | Verify a source dir would build; deploy a source directory (built remotely) or `--image <url>`. `insta build logs <id>` reads source-build output: `--source archive` (default) uses the deploy operation ID, `--source github` uses a GitHub build ID; `--follow` watches output, `--json` returns one snapshot |
 | `insta cron` | Branch-scoped HTTP schedules: `list` · `create` · `show` · `edit` · `pause` · `resume` · `delete` · `run` · `runs` · `preview`. Expressions are UTC and so is every time printed; `run` is one EXTRA execution and does not consume the next scheduled tick; literal header values are write-only, so `show` lists their names only — a header backed by `--secret-ref` is resolved from a project secret at send time and `show` names that secret too |
 | `insta run <cmd>` | Run a command with the branch bundle injected, nothing written to disk |
-| `insta template` | `list` · `info` · `deploy` |
+| `insta template` | Browse and deploy: `list` · `info` · `deploy`. Author your org's community templates: `create` (from a project, or `--blank`) · `drafts` · `draft` · `edit --patch <file>` · `regenerate` · `publish` · `unpublish` · `delete`. `publish` and `delete` ask on a terminal and need `--yes` anywhere else, and always for an agent |
 | `insta billing` | Current cycle overview; `subscribe <tier>` · `portal` · `usage` |
 | `insta agent` | `setup` (this machine's coding agents) · `manifest` · `policy …` · `approvals …` · `observe …` · `events` |
 | `insta config` | `install-mcp` · `regions` · `autoupdate` |

package/dist/commands/billing.js

@@ -2,11 +2,11 @@ import { ApiClient, ApiError, requireProject } from '../api.js';
 import { die, info, openUrl, printJson } from '../util.js';
 import { cycleLine, dimensionLines } from './metrics.js';
 // Resolve the target org: explicit --org, else the linked project's org.
-export async function resolveOrgId(opts) {
+export async function resolveOrgId(opts, project = requireProject) {
     if (opts.org)
         return opts.org;
     // `ProjectConfig.orgId` is typed string but INSTA_PROJECT_ID resolves a project with no org.
-    const orgId = (await requireProject()).orgId;
+    const orgId = (await project()).orgId;
     if (!orgId)
         die('INSTA_PROJECT_ID names no organization — set INSTA_ORG_ID, or pass --org <id>');
     return orgId;

package/dist/commands/compute.js

@@ -68,10 +68,26 @@ export function domainGuidanceLines(r, ctx = {}) {
 // where the hostname resolves — we cannot confirm routing, and must not call it serving. A Fly
 // answer carries no `ssl` and has no per-hostname origin concept, so its own verdict stands.
 const reportsOrigin = (r) => r.ssl !== undefined;
+// A deployment with NO edge custody for custom domains (a pre-Cloudflare plane). It reports
+// `origin: ""` exactly like a region whose operator forgot cf-custom-origin, so the pair alone reads
+// it backwards and names a setting this deployment does not have. The plane's own verdict
+// (`originStatus: 'unmanaged'`) decides when relayed; without it, `ssl: 'external'` is the plane's
+// marker for the same deployment class (it manages no edge certificate here) — the same fallback the
+// console uses. Only an unconfirmed origin is reinterpreted: a reported, confirmed origin stands.
+const edgeUnmanaged = (r) => r.originStatus === 'unmanaged' ||
+    (r.originStatus === undefined && r.ssl === 'external' && (r.origin === undefined || r.origin === ''));
 // Where the hostname actually resolves — the region-specific origin the plane requested vs what
 // Cloudflare holds. Each shape carries its action; absent fields are reported as absent.
 export function domainResolveLine(r) {
     const region = r.region ?? 'this region';
+    if (edgeUnmanaged(r)) {
+        // Not ready (routing cannot be confirmed from here), but no operator knob to name either:
+        // setting cf-custom-origin does nothing on a deployment with no edge custody.
+        return {
+            line: `  ${pad('resolves to', 12)}UNMANAGED — ${region} does not manage edge certificates for custom domains, so where ${r.hostname} lands cannot be confirmed from here; if it does not serve, contact support`,
+            ready: false,
+        };
+    }
     if (r.origin === undefined) {
         if (reportsOrigin(r)) {
             return {
@@ -194,6 +210,7 @@ export function domainStatusLines(r, ctx = {}) {
         }
     }
     const ssl = r.ssl ?? (r.configured ? 'active' : undefined);
+    const reasonOnCert = !!r.errorReason && r.status !== 'error' && ssl !== undefined && ssl !== 'active' && ssl !== 'external';
     if (ssl === 'active')
         stage('certificate', 'active', '(edge TLS issued)');
     else if (ssl === 'external')
@@ -203,7 +220,11 @@ export function domainStatusLines(r, ctx = {}) {
         blockers.push('certificate');
     }
     else {
-        stage('certificate', 'pending', `(${ssl} — issues once ownership is verified)`);
+        // A pending certificate with a reason from the plane: the reason IS why it has not issued (a CAA
+        // block, the hostname not pointed at the edge), so it replaces the generic text here and is not
+        // repeated below. An `error` row keeps its reason on its own error line.
+        const detail = reasonOnCert ? `(${ssl}) ${r.errorReason}` : `(${ssl} — issues once ownership is verified)`;
+        stage('certificate', 'pending', detail);
         blockers.push('certificate');
     }
     const resolve = domainResolveLine(r);
@@ -214,9 +235,17 @@ export function domainStatusLines(r, ctx = {}) {
         stage('error', r.status, r.errorReason || '(the plane reported an error state with no reason)');
         blockers.push('the plane reports an error state');
     }
-    else if (r.errorReason) {
-        stage('error', r.status, r.errorReason);
-        blockers.push(r.errorReason);
+    else if (r.errorReason && !reasonOnCert) {
+        // On an ACTIVE row the plane keeps serving and REPORTS what the edge says has regressed (it
+        // never demotes a serving row on an edge read). That is a warning beside a serving hostname,
+        // not a blocker: turning it into one would print "not yet" for a domain taking traffic.
+        // Every other state with a reason is still being set up, and the reason is what blocks it.
+        if (r.status === 'active')
+            stage('warning', r.status, r.errorReason);
+        else {
+            stage('error', r.status, r.errorReason);
+            blockers.push(r.errorReason);
+        }
     }
     // An unconfirmed routing target is one blocker among the others, not a headline that hides them:
     // a user fixing their DNS needs the whole outstanding list, not whichever item sorted first.

package/dist/commands/postgres.js

@@ -390,7 +390,7 @@ export async function dbConnect(service, opts) {
     process.stderr.write(`psql → postgres/${r.serviceName}${branch ? ` (branch ${branch})` : ''} — a suspended instance wakes on connect, so the first prompt can take a few seconds\n`);
     relayExitCode(await connectWithPsql(r.url));
 }
-async function confirmOnTerminal(question) {
+export async function confirmOnTerminal(question) {
     const answer = await clack.confirm({ message: question, initialValue: false });
     if (clack.isCancel(answer))
         return false;

package/dist/commands/template-author.js

@@ -0,0 +1,292 @@
+// `insta template` authoring commands: the org's community templates, from drafts to the gallery.
+import { readFileSync } from 'node:fs';
+import { agentMode } from '../agent.js';
+import { ApiClient, ApiError, requireProject } from '../api.js';
+import { info, printJson, refuse } from '../util.js';
+import { resolveOrgId } from './billing.js';
+import { confirmOnTerminal } from './postgres.js';
+// ---- pure helpers ----
+/** The console editor of a draft: the API host with its leading `api.` label read as `console.`. */
+export function templateEditorUrl(apiUrl, orgId, code) {
+    let url;
+    try {
+        url = new URL(apiUrl);
+    }
+    catch {
+        return null;
+    }
+    const labels = url.hostname.split('.');
+    // Any other host has no console this CLI knows of.
+    if (labels.length < 2 || labels[0] !== 'api')
+        return null;
+    url.hostname = ['console', ...labels.slice(1)].join('.');
+    return `${url.origin}/orgs/${encodeURIComponent(orgId)}/templates/${encodeURIComponent(code)}`;
+}
+/** The status a person reads. */
+export function templateStatusWord(t) {
+    if (t.takenDown)
+        return 'taken down';
+    if (t.status === 'published' && t.hasUnpublishedChanges)
+        return 'published, with unpublished edits';
+    return t.status;
+}
+const headLine = (t) => `${t.code}: ${t.name} (${templateStatusWord(t)})`;
+/** One aligned row per template of the org, as `template list` prints the gallery. */
+export function draftListLines(templates) {
+    if (!templates.length)
+        return ['no templates in this org yet, create one with: insta template create'];
+    const head = ['CODE', 'STATUS', 'VERSION', 'NAME'];
+    const rows = templates.map((t) => [t.code, templateStatusWord(t), t.publishedVersion ?? '-', t.name]);
+    const widths = head.map((h, i) => Math.max(h.length, ...rows.map((r) => r[i].length)));
+    return [head, ...rows].map((r) => r.map((c, i) => (i === r.length - 1 ? c : c.padEnd(widths[i]))).join('  ').trimEnd());
+}
+/** Each requirement with its mark, and what is still missing for an unmet one. */
+export function requirementLines(requirements) {
+    return requirements.map((r) => `  ${r.ok ? '✓' : '✗'} ${r.code}${!r.ok && r.items.length ? `: ${r.items.join(', ')}` : ''}`);
+}
+/** What still stands between the draft and a publish. */
+export function readinessLines(requirements) {
+    const unmet = requirements.filter((r) => !r.ok);
+    return unmet.length ? ['not ready to publish yet:', ...requirementLines(unmet)] : ['ready to publish'];
+}
+/** What a regenerate found changed in the project since the draft was last built. */
+export function regenerateChangeLines(c) {
+    const rows = [
+        ['services added', c.addedServices], ['services removed', c.removedServices],
+        ['variables added', c.addedVariables], ['variables removed', c.removedVariables],
+    ];
+    const lines = rows.filter(([, names]) => names.length).map(([label, names]) => `  ${label}: ${names.join(', ')}`);
+    return lines.length ? lines : ['  no service or variable was added to or removed from the project'];
+}
+function serviceText(s) {
+    const kind = s.type === 'postgres' && s.pgVersion !== undefined ? `postgres ${s.pgVersion}`
+        : s.type === 'storage' ? `storage, ${s.public ? 'public' : 'private'}`
+            : s.type;
+    const bits = [
+        kind,
+        s.port != null ? `port ${s.port}` : undefined,
+        s.image ? `image ${s.image}` : undefined,
+        // A null mount path on a volume is the default /data.
+        s.volume ? `volume at ${s.mountPath ?? '/data'}` : undefined,
+        s.removed ? 'removed' : undefined,
+    ];
+    return `${s.name} (${bits.filter(Boolean).join(', ')})`;
+}
+function variableText(v) {
+    const notes = [
+        v.originalName ? `renamed from ${v.originalName}` : undefined,
+        v.brokenReference ? `broken reference ${v.brokenReference}` : undefined,
+    ].filter(Boolean);
+    return `${v.kind}${v.value !== undefined ? ` ${v.value}` : ''}${v.description ? `: ${v.description}` : ''}${notes.length ? ` (${notes.join(', ')})` : ''}`;
+}
+/** The whole draft as `draft <code>` prints it. */
+export function draftLines(t, editorUrl) {
+    const lines = [headLine(t)];
+    const field = (label, value) => { if (value)
+        lines.push(`  ${label.padEnd(9)} ${value}`); };
+    field('tagline', t.tagline);
+    field('category', t.category);
+    field('readme', t.readme ? `${Buffer.byteLength(t.readme, 'utf8')} bytes` : null);
+    field('logo', t.logoUrl);
+    field('version', t.publishedVersion);
+    field('updated', t.updatedAt);
+    lines.push(`services (${t.services.length}):`);
+    for (const s of t.services) {
+        lines.push(`  ${serviceText(s)}`);
+        const width = Math.max(...s.variables.map((v) => v.name.length));
+        for (const v of s.variables)
+            lines.push(`    ${v.name.padEnd(width)}  ${variableText(v)}`);
+    }
+    lines.push('publish requirements:', ...requirementLines(t.publishRequirements));
+    if (editorUrl)
+        lines.push(`editor: ${editorUrl}`);
+    return lines;
+}
+/** The console editor's PATCH body, as an agent wrote it to a file or to stdin. */
+export function parsePatch(text, from) {
+    let value;
+    try {
+        // A UTF-8 BOM belongs to the file, and JSON.parse rejects it.
+        value = JSON.parse(text.charCodeAt(0) === 0xfeff ? text.slice(1) : text);
+    }
+    catch (e) {
+        throw new Error(`the patch from ${from} is not valid JSON: ${e.message}`);
+    }
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new Error(`the patch from ${from} must be one JSON object, the body the console editor sends, for example {"tagline": "Self-hosted analytics"}`);
+    }
+    return value;
+}
+export const BLANK_NOT_YET = 'this platform does not create blank templates yet. Create a template from a project instead: insta template create --project <id>';
+async function createBlank(api, orgId, body) {
+    try {
+        return await api.request('POST', `/orgs/${orgId}/templates`, body);
+    }
+    catch (e) {
+        // No route yet: Fastify's own 404 for a person, the governance hook's refusal for an agent.
+        const missing = e instanceof ApiError
+            && ((e.status === 404 && e.body?.error === 'Not Found') || (e.status === 403 && e.body?.error === 'unclassified_agent_action'));
+        if (missing)
+            throw new Error(BLANK_NOT_YET);
+        throw e;
+    }
+}
+// A coded answer is a whole sentence for the person: print it without the HTTP status.
+async function platformSentence(call) {
+    try {
+        return await call;
+    }
+    catch (e) {
+        if (e instanceof ApiError && typeof e.body?.code === 'string')
+            throw new Error(e.message);
+        throw e;
+    }
+}
+// Decode once at the end: a multi-byte character can straddle two chunks.
+export async function readAllStdin(stream = process.stdin) {
+    const chunks = [];
+    for await (const chunk of stream)
+        chunks.push(chunk);
+    return Buffer.concat(chunks).toString('utf8');
+}
+const byAgent = (deps) => deps.agent ?? !!agentMode();
+// An agent on a pty and --json are never a person at the prompt.
+const canAsk = (opts, deps) => !opts.json && !byAgent(deps) && (deps.tty ?? (!!process.stdin.isTTY && !!process.stdout.isTTY));
+const noAnswerReason = (deps) => byAgent(deps) ? 'an agent passes --yes only after the person has said yes.' : 'there is no terminal to confirm on.';
+const orgFlag = (opts) => (opts.org ? ` --org ${opts.org}` : '');
+// ---- commands ----
+export async function templateDrafts(opts = {}, deps = {}) {
+    const api = deps.api ?? (await ApiClient.load());
+    const orgId = await resolveOrgId(opts, deps.project);
+    const { templates } = await api.request('GET', `/orgs/${orgId}/templates`);
+    if (opts.json)
+        return printJson(templates);
+    for (const line of draftListLines(templates))
+        info(line);
+}
+export async function templateDraft(code, opts = {}, deps = {}) {
+    const api = deps.api ?? (await ApiClient.load());
+    const orgId = await resolveOrgId(opts, deps.project);
+    const { template } = await api.request('GET', `/orgs/${orgId}/templates/${encodeURIComponent(code)}`);
+    const editorUrl = templateEditorUrl(api.apiUrl, template.orgId, template.code);
+    if (opts.json)
+        return printJson({ template, editorUrl });
+    for (const line of draftLines(template, editorUrl))
+        info(line);
+}
+export async function templateCreate(opts = {}, deps = {}) {
+    if (opts.blank && opts.project)
+        throw new Error('--blank starts a template with no project, so it does not take --project');
+    if (opts.org && !opts.blank)
+        throw new Error("--org goes with --blank: a draft generated from a project belongs to that project's org");
+    // Presence, not truthiness: an empty --name reaches the platform's own sentence.
+    const body = opts.name !== undefined ? { name: opts.name } : undefined;
+    const api = deps.api ?? (await ApiClient.load());
+    let answer;
+    if (opts.blank) {
+        answer = await createBlank(api, await resolveOrgId(opts, deps.project), body);
+    }
+    else {
+        const projectId = opts.project ?? (await (deps.project ?? requireProject)()).projectId;
+        answer = await api.request('POST', `/projects/${projectId}/template-drafts`, body);
+    }
+    const { template } = answer;
+    const editorUrl = templateEditorUrl(api.apiUrl, template.orgId, template.code);
+    if (opts.json)
+        return printJson({ template, editorUrl });
+    info(`created ${headLine(template)}`);
+    if (editorUrl)
+        info(`editor: ${editorUrl}`);
+}
+export async function templateEdit(code, opts, deps = {}) {
+    const from = opts.patch === '-' ? 'stdin' : opts.patch;
+    let text;
+    try {
+        text = opts.patch === '-' ? await (deps.readStdin ?? readAllStdin)() : readFileSync(opts.patch, 'utf8');
+    }
+    catch (e) {
+        throw new Error(`cannot read the patch from ${from}: ${e.message}`);
+    }
+    const patch = parsePatch(text, from);
+    const api = deps.api ?? (await ApiClient.load());
+    const orgId = await resolveOrgId(opts, deps.project);
+    const path = `/orgs/${orgId}/templates/${encodeURIComponent(code)}`;
+    // Without one, the edit applies to the draft as it is now.
+    const expectedUpdatedAt = patch.expectedUpdatedAt ?? (await api.request('GET', path)).template.updatedAt;
+    const { template } = await platformSentence(api.request('PATCH', path, { ...patch, expectedUpdatedAt }));
+    if (opts.json)
+        return printJson({ template, editorUrl: templateEditorUrl(api.apiUrl, template.orgId, template.code) });
+    info(`saved ${headLine(template)}`);
+    for (const line of readinessLines(template.publishRequirements))
+        info(line);
+}
+export async function templateRegenerate(code, opts = {}, deps = {}) {
+    const api = deps.api ?? (await ApiClient.load());
+    const orgId = await resolveOrgId(opts, deps.project);
+    let answer;
+    try {
+        answer = await api.request('POST', `/orgs/${orgId}/templates/${encodeURIComponent(code)}/regenerate`);
+    }
+    catch (e) {
+        // Its 400s are sentences for the person: a blank draft, a deleted source project.
+        if (e instanceof ApiError && e.status === 400)
+            throw new Error(e.message);
+        throw e;
+    }
+    const { template, changes } = answer;
+    if (opts.json)
+        return printJson({ template, changes, editorUrl: templateEditorUrl(api.apiUrl, template.orgId, template.code) });
+    info(`regenerated ${headLine(template)}`);
+    for (const line of regenerateChangeLines(changes))
+        info(line);
+    for (const line of readinessLines(template.publishRequirements))
+        info(line);
+}
+export async function templatePublish(code, opts = {}, deps = {}) {
+    if (!opts.yes && !canAsk(opts, deps)) {
+        refuse([
+            `refusing to publish ${code} without --yes: ${noAnswerReason(deps)}`,
+            `Publishing lists the template in the community gallery at once, with no review. Ask the person first, then run: insta template publish ${code}${orgFlag(opts)} --yes`,
+        ]);
+    }
+    const api = deps.api ?? (await ApiClient.load());
+    const orgId = await resolveOrgId(opts, deps.project);
+    const path = `/orgs/${orgId}/templates/${encodeURIComponent(code)}`;
+    const { template: current } = await api.request('GET', path);
+    if (!opts.yes) {
+        info(`${code} becomes public in the community gallery at once, with no review. Anyone can find it and deploy it.`);
+        if (!(await (deps.confirm ?? confirmOnTerminal)(`Publish ${code} now?`)))
+            return info('nothing was published');
+    }
+    const { template } = await platformSentence(api.request('POST', `${path}/publish`, { expectedUpdatedAt: current.updatedAt }));
+    if (opts.json)
+        return printJson({ template, editorUrl: templateEditorUrl(api.apiUrl, template.orgId, template.code) });
+    info(`published ${template.code} version ${template.publishedVersion} to the community gallery`);
+    info(`take it out again with: insta template unpublish ${template.code}${orgFlag(opts)}`);
+}
+export async function templateUnpublish(code, opts = {}, deps = {}) {
+    const api = deps.api ?? (await ApiClient.load());
+    const orgId = await resolveOrgId(opts, deps.project);
+    const { template } = await api.request('POST', `/orgs/${orgId}/templates/${encodeURIComponent(code)}/unpublish`);
+    if (opts.json)
+        return printJson({ template, editorUrl: templateEditorUrl(api.apiUrl, template.orgId, template.code) });
+    info(`unpublished ${template.code}: it is out of the community gallery, and deployed copies keep running`);
+}
+export async function templateDelete(code, opts = {}, deps = {}) {
+    if (!opts.yes && !canAsk(opts, deps)) {
+        refuse([
+            `refusing to delete the draft ${code} without --yes: ${noAnswerReason(deps)}`,
+            `Deleting cannot be undone. To go ahead, run: insta template delete ${code}${orgFlag(opts)} --yes`,
+        ]);
+    }
+    const api = deps.api ?? (await ApiClient.load());
+    const orgId = await resolveOrgId(opts, deps.project);
+    if (!opts.yes && !(await (deps.confirm ?? confirmOnTerminal)(`Delete the draft ${code}? This cannot be undone.`))) {
+        return info('nothing was deleted');
+    }
+    await api.request('DELETE', `/orgs/${orgId}/templates/${encodeURIComponent(code)}`);
+    if (opts.json)
+        return printJson({ ok: true, orgId, code });
+    info(`deleted the draft ${code}`);
+}
+//# sourceMappingURL=template-author.js.map

package/dist/index.js

@@ -33,6 +33,7 @@ import * as managedDb from './commands/managed-db.js';
 import * as storageCmd from './commands/storage.js';
 import { manifest } from './commands/manifest.js';
 import * as template from './commands/template.js';
+import * as templateAuthor from './commands/template-author.js';
 import * as govern from './commands/govern.js';
 import * as observe from './commands/observe.js';
 import * as obs from './commands/metrics.js';
@@ -535,7 +536,7 @@ program.command('run <cmd> [args...]').description('Run a command with the branc
     .passThroughOptions().allowUnknownOption()
     .action(guard((cmd, args, o) => runCmd.run([cmd, ...(args ?? [])], o)));
 // ---- templates (registry, local insta.template.yaml, or a GitHub URL) ----
-const tpl = program.command('template').description('Browse and deploy app templates (registry, a local dir, or a GitHub URL)');
+const tpl = program.command('template').description("Browse and deploy app templates (registry, a local dir, or a GitHub URL), and author your org's community templates");
 tpl.command('list').description('List templates in the platform registry').option('--json').action(guard((o) => template.templateList(o)));
 tpl.command('info <code>').description('Show a template: version, upstream pin, services, and its required/optional variables')
     .option('--json').action(guard((code, o) => template.templateInfo(code, o)));
@@ -546,6 +547,38 @@ tpl.command('deploy <code-or-dir-or-url>').description('Deploy a template onto a
     .option('-y, --yes', 'non-interactive: missing required variables fail with a --set list instead of prompting')
     .option('--json')
     .action(guard((target, o) => template.templateDeploy(target, o)));
+// Authoring: the org's community templates, the same drafts the console editor changes.
+tpl.command('create').description("Create a community template draft from the linked project (or --project), or an empty one with --blank. Prints its code, status and the console editor link")
+    .option('--project <id>', 'project to generate the draft from (default: the linked project)')
+    .option('--blank', 'start with no project and no services (needs a platform that creates blank templates)')
+    .option('--name <name>', 'template name, 1 to 80 characters (default: the project name, or New template with --blank)')
+    .option('--org <id>', "org of a --blank draft (default: linked project's org)")
+    .option('--json')
+    .action(guard((o) => templateAuthor.templateCreate(o)));
+tpl.command('drafts').description("List your org's community templates, drafts and published, with their status")
+    .option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .action(guard((o) => templateAuthor.templateDrafts(o)));
+tpl.command('draft <code>').description('Show one community template draft: its services, every variable with its choice, and the publish requirements')
+    .option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .action(guard((code, o) => templateAuthor.templateDraft(code, o)));
+tpl.command('edit <code>').description("Change a draft with the console editor's PATCH body as JSON. Without expectedUpdatedAt in it, the draft's current one is used")
+    .requiredOption('--patch <file>', 'JSON file holding the PATCH body, or - to read it from stdin')
+    .option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .action(guard((code, o) => templateAuthor.templateEdit(code, o)));
+tpl.command('regenerate <code>').description('Rebuild a draft from its project as the project is now, keeping your edits. A blocked item is fixed in the project, then regenerated')
+    .option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .action(guard((code, o) => templateAuthor.templateRegenerate(code, o)));
+tpl.command('publish <code>').description('Publish the draft to the community gallery: public at once, with no review. Asks on a terminal, needs --yes anywhere else, and always for an agent')
+    .option('-y, --yes', "publish without asking (get the person's yes first)")
+    .option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .action(guard((code, o) => templateAuthor.templatePublish(code, o)));
+tpl.command('unpublish <code>').description('Take the template out of the community gallery. Deployed copies keep running')
+    .option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .action(guard((code, o) => templateAuthor.templateUnpublish(code, o)));
+tpl.command('delete <code>').description('Delete a draft that was never published. Asks on a terminal, needs --yes anywhere else, and always for an agent')
+    .option('-y, --yes', 'delete without asking')
+    .option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .action(guard((code, o) => templateAuthor.templateDelete(code, o)));
 // ---- billing ----
 const bill = program.command('billing').description('Billing: current cycle overview (bare), subscribe to a tier, redeem a credit code, Stripe portal, usage by dimension')
     .option('--org <id>', 'target org (default: linked project\'s org)').option('--json')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.1.19",
+  "version": "0.1.21",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [