ibee-cli 0.4.0__tar.gz → 0.4.2__tar.gz

{ibee_cli-0.4.0/src/ibee_cli.egg-info → ibee_cli-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ibee-cli
-Version: 0.4.0
+Version: 0.4.2
 Summary: Official command-line interface for the IBEE Solutions cloud platform
 Author-email: IBEE Solutions <support@ibee.ai>
 License-Expression: MIT
@@ -13,7 +13,7 @@ Classifier: Environment :: Console
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: ibee<0.5.0,>=0.4.0
+Requires-Dist: ibee<0.5.0,>=0.4.2
 Requires-Dist: httpx>=0.27
 Requires-Dist: typer>=0.12
 Requires-Dist: click>=8.1
@@ -305,15 +305,15 @@ an interactive hidden prompt, or pipe one line to `--password-stdin`.
 Bucket and VM placement are automatic when `--site-id` is omitted. Use
 `ibee compute sites` and pass `--site-id` only when placement must be pinned.
 
-Billable creates send one product request. The public gateway performs the
-authoritative, fail-closed billing decision before routing; a valid denial is
-returned without calling the product service. `ibee billing eligibility`
-remains available as an optional point-in-time preview, and the global
-`--check-billing` flag (or `IBEE_CHECK_BILLING=1`) runs the portal's preflight
-before a billable create: the create is sent only when billing answers
-`allowed: true`, otherwise the portal's explanation is printed (with top-up
-guidance when adding credits in the portal can resolve it) and the command
-exits 1. The preflight never reserves funds.
+All product writes reach the upstream API for fresh Billing and lifecycle decisions.
+The CLI never queries billing eligibility or calculates an admission estimate automatically.
+Legacy `--check-billing`, `--preflight-billing`, NAT `--preflight`,
+`--billing-check/--no-billing-check`, and `IBEE_CHECK_BILLING` are deprecated no-ops.
+Structural, workspace, state, scope and destructive-action checks remain in place.
+`ibee billing eligibility` is an explicit diagnostic query: `allowed: false` is data (exit 0);
+the explicit `--require` option retains exit 1 on denial.
+It supports `REVOKE_CREDENTIAL` and `SECURITY_RECOVERY`.
+Upstream errors retain their classification; suspension messages do not infer who suspended an organization.
 
 Load balancers take backends, routing, policy, health checks and L7 rules either
 as flags (`--backend TYPE:TARGET:PORT[:WEIGHT][:tls]`, `--rule
@@ -406,7 +406,7 @@ on) controls the read-only checks that need the current state.
 - **NAT gateways** exist only in `nat_gateway` VPCs (one per VPC; `nat create`
   prints the existing one instead of sending a create). A Reserved IP must be in
   the VPC's site, unattached and `reserved`. `--preflight` (or `--check-billing`)
-  checks NAT-GATEWAY eligibility first. `nat delete` shows how many NAT VMs lose
+  is a deprecated no-op; upstream decides admission. `nat delete` shows how many NAT VMs lose
   outbound internet and how many forwarding rules are deleted before it asks;
   `--ip-action reserve` of a platform-assigned IP needs `--billing-catalog` (the
   RESERVED-IP SKU); deletion is refused while a virtual IP holds a Reserved IP.
@@ -422,8 +422,8 @@ on) controls the read-only checks that need the current state.
   253 characters (`--reverse-dns ""` clears it); `release` is refused while
   attached; `attach` is for unattached IPs (`move` for an IP on another VM,
   `--detach-from-service` for one on a NAT gateway or virtual IP); an attach to a VM
-  outside a VPC points at `reserved-ips convert`. `convert` runs the RESERVED-IP
-  billing check first (`--no-billing-check` skips it; it needs `billing.read`).
+  outside a VPC points at `reserved-ips convert`. The API decides admission for
+  `convert`.
 - **Firewalls**: group names are unique in any case (1-120 characters) and
   customers cannot create default groups. Rules: tcp and udp need `--port` (22 or
   8000-8080), icmp and any take none; sources are IPv4 addresses or CIDRs (a bare
@@ -488,8 +488,7 @@ for confirmation, the read-only checks run first (`--no-check-state` skips them)
   timeout). `purge` needs `--mode`; `--mode all` asks first; only the selector for the
   mode is accepted (`--path` 1-30, https URLs only; `--hostname`, `--tag`, `--prefix`
   1-100). A purge the CDN reports as failed exits 1.
-- `--check-billing` (or `--preflight-billing`) checks OBJECTST-STD before a bucket or
-  S3 credential create and CUSTOMDO-STD before a custom domain.
+- `--check-billing` and `--preflight-billing` are deprecated no-ops for storage and CDN.
 - `block-storage create --vm-type`/`--delete-on-termination`, the Block Storage delete
   idempotency key, `cdn cache-policies` and `cdn metrics` are not yet part of the
   published API contract; behaviour may change. Block Storage plans, bucket emptying,
@@ -520,10 +519,7 @@ inputs first.
   values are refused. In `patch-value`, a JSON `null` deletes that key. `--cas` is an
   integer >= 0; a check-and-set mismatch is reported as a conflict and never retried.
   `list` sends a trimmed `--query` (at most 128 characters) only when it is not blank.
-- **Billing**: `stores create` and `secrets create` check SECRETMA-STD eligibility
-  first, as the portal does (`--no-billing-check` turns it off; the global
-  `--check-billing` forces it on). When the token lacks `billing.read` the check is
-  skipped with a warning, because the API still enforces billing on the create.
+- **Billing**: store and secret writes use upstream admission. Both legacy billing-check flags are no-ops.
 - **Batch create**: every item follows the `secrets create` rules and the error names
   its index. Duplicate names are reported (the API skips them). A file with more than
   500 secrets or over 64 KiB is sent as consecutive requests and the results are
@@ -564,7 +560,7 @@ inputs first.
 | `-o`, `--output` | `IBEE_OUTPUT` | `table`, `json`, `yaml` or `id` |
 | `--json` | | Same as `-o json` |
 | `--yes`, `-y` | `IBEE_ASSUME_YES=1` | Answer yes to every confirmation |
-| `--check-billing` | `IBEE_CHECK_BILLING=1` | Billing preflight before billable creates |
+| `--check-billing` | `IBEE_CHECK_BILLING=1` | Deprecated no-op; upstream decides admission |
 
 Without `-o`, each command keeps its usual format (tables for most lists, JSON
 for single resources and operation results). `-o yaml` prints YAML and `-o id`

{ibee_cli-0.4.0 → ibee_cli-0.4.2}/README.md

@@ -280,15 +280,15 @@ an interactive hidden prompt, or pipe one line to `--password-stdin`.
 Bucket and VM placement are automatic when `--site-id` is omitted. Use
 `ibee compute sites` and pass `--site-id` only when placement must be pinned.
 
-Billable creates send one product request. The public gateway performs the
-authoritative, fail-closed billing decision before routing; a valid denial is
-returned without calling the product service. `ibee billing eligibility`
-remains available as an optional point-in-time preview, and the global
-`--check-billing` flag (or `IBEE_CHECK_BILLING=1`) runs the portal's preflight
-before a billable create: the create is sent only when billing answers
-`allowed: true`, otherwise the portal's explanation is printed (with top-up
-guidance when adding credits in the portal can resolve it) and the command
-exits 1. The preflight never reserves funds.
+All product writes reach the upstream API for fresh Billing and lifecycle decisions.
+The CLI never queries billing eligibility or calculates an admission estimate automatically.
+Legacy `--check-billing`, `--preflight-billing`, NAT `--preflight`,
+`--billing-check/--no-billing-check`, and `IBEE_CHECK_BILLING` are deprecated no-ops.
+Structural, workspace, state, scope and destructive-action checks remain in place.
+`ibee billing eligibility` is an explicit diagnostic query: `allowed: false` is data (exit 0);
+the explicit `--require` option retains exit 1 on denial.
+It supports `REVOKE_CREDENTIAL` and `SECURITY_RECOVERY`.
+Upstream errors retain their classification; suspension messages do not infer who suspended an organization.
 
 Load balancers take backends, routing, policy, health checks and L7 rules either
 as flags (`--backend TYPE:TARGET:PORT[:WEIGHT][:tls]`, `--rule
@@ -381,7 +381,7 @@ on) controls the read-only checks that need the current state.
 - **NAT gateways** exist only in `nat_gateway` VPCs (one per VPC; `nat create`
   prints the existing one instead of sending a create). A Reserved IP must be in
   the VPC's site, unattached and `reserved`. `--preflight` (or `--check-billing`)
-  checks NAT-GATEWAY eligibility first. `nat delete` shows how many NAT VMs lose
+  is a deprecated no-op; upstream decides admission. `nat delete` shows how many NAT VMs lose
   outbound internet and how many forwarding rules are deleted before it asks;
   `--ip-action reserve` of a platform-assigned IP needs `--billing-catalog` (the
   RESERVED-IP SKU); deletion is refused while a virtual IP holds a Reserved IP.
@@ -397,8 +397,8 @@ on) controls the read-only checks that need the current state.
   253 characters (`--reverse-dns ""` clears it); `release` is refused while
   attached; `attach` is for unattached IPs (`move` for an IP on another VM,
   `--detach-from-service` for one on a NAT gateway or virtual IP); an attach to a VM
-  outside a VPC points at `reserved-ips convert`. `convert` runs the RESERVED-IP
-  billing check first (`--no-billing-check` skips it; it needs `billing.read`).
+  outside a VPC points at `reserved-ips convert`. The API decides admission for
+  `convert`.
 - **Firewalls**: group names are unique in any case (1-120 characters) and
   customers cannot create default groups. Rules: tcp and udp need `--port` (22 or
   8000-8080), icmp and any take none; sources are IPv4 addresses or CIDRs (a bare
@@ -463,8 +463,7 @@ for confirmation, the read-only checks run first (`--no-check-state` skips them)
   timeout). `purge` needs `--mode`; `--mode all` asks first; only the selector for the
   mode is accepted (`--path` 1-30, https URLs only; `--hostname`, `--tag`, `--prefix`
   1-100). A purge the CDN reports as failed exits 1.
-- `--check-billing` (or `--preflight-billing`) checks OBJECTST-STD before a bucket or
-  S3 credential create and CUSTOMDO-STD before a custom domain.
+- `--check-billing` and `--preflight-billing` are deprecated no-ops for storage and CDN.
 - `block-storage create --vm-type`/`--delete-on-termination`, the Block Storage delete
   idempotency key, `cdn cache-policies` and `cdn metrics` are not yet part of the
   published API contract; behaviour may change. Block Storage plans, bucket emptying,
@@ -495,10 +494,7 @@ inputs first.
   values are refused. In `patch-value`, a JSON `null` deletes that key. `--cas` is an
   integer >= 0; a check-and-set mismatch is reported as a conflict and never retried.
   `list` sends a trimmed `--query` (at most 128 characters) only when it is not blank.
-- **Billing**: `stores create` and `secrets create` check SECRETMA-STD eligibility
-  first, as the portal does (`--no-billing-check` turns it off; the global
-  `--check-billing` forces it on). When the token lacks `billing.read` the check is
-  skipped with a warning, because the API still enforces billing on the create.
+- **Billing**: store and secret writes use upstream admission. Both legacy billing-check flags are no-ops.
 - **Batch create**: every item follows the `secrets create` rules and the error names
   its index. Duplicate names are reported (the API skips them). A file with more than
   500 secrets or over 64 KiB is sent as consecutive requests and the results are
@@ -539,7 +535,7 @@ inputs first.
 | `-o`, `--output` | `IBEE_OUTPUT` | `table`, `json`, `yaml` or `id` |
 | `--json` | | Same as `-o json` |
 | `--yes`, `-y` | `IBEE_ASSUME_YES=1` | Answer yes to every confirmation |
-| `--check-billing` | `IBEE_CHECK_BILLING=1` | Billing preflight before billable creates |
+| `--check-billing` | `IBEE_CHECK_BILLING=1` | Deprecated no-op; upstream decides admission |
 
 Without `-o`, each command keeps its usual format (tables for most lists, JSON
 for single resources and operation results). `-o yaml` prints YAML and `-o id`

{ibee_cli-0.4.0 → ibee_cli-0.4.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ibee-cli"
-version = "0.4.0"
+version = "0.4.2"
 description = "Official command-line interface for the IBEE Solutions cloud platform"
 readme = "README.md"
 license = "MIT"
@@ -18,7 +18,7 @@ classifiers = [
     "Environment :: Console",
 ]
 dependencies = [
-    "ibee>=0.4.0,<0.5.0",
+    "ibee>=0.4.2,<0.5.0",
     "httpx>=0.27",
     "typer>=0.12",
     "click>=8.1",

{ibee_cli-0.4.0 → ibee_cli-0.4.2}/src/ibee_cli/__init__.py

@@ -1,3 +1,3 @@
 """IBEE Solutions command-line interface."""
 
-__version__ = "0.4.0"
+__version__ = "0.4.2"

{ibee_cli-0.4.0 → ibee_cli-0.4.2}/src/ibee_cli/commands/block_storage.py

@@ -47,7 +47,6 @@ from ..helpers import (
     idempotency_key_option,
     load_json_input,
     poll_interval_option,
-    preflight_billing,
     resolve_idempotency_key,
     resolve_wait,
     timeout_option,
@@ -264,7 +263,7 @@ def create_volume(
 
     settings, workspace, client = _session(ctx)
     key = resolve_idempotency_key(idempotency_key, "block-create", name)
-    # Validate first (exit 2) so a bad request never reaches the billing preflight.
+    # Validate first (exit 2) so a bad request never reaches the API.
     body = build_block_volume_create_body(
         name=name,
         size_gb=size_gb,
@@ -277,10 +276,6 @@ def create_volume(
         vm_type=vm_type,
         delete_on_termination=delete_on_termination,
     )
-    if settings.check_billing:
-        preflight_billing(
-            settings, client, workspace, sku_code=body.get("sku_code"), resource_type="block_storage"
-        )
     try:
         with api_hints({400: CREATE_PLAN_HINT}):
             result = client.block_storage.create_block_volume(

{ibee_cli-0.4.0 → ibee_cli-0.4.2}/src/ibee_cli/commands/buckets.py

@@ -176,7 +176,7 @@ def create_bucket(
     preflight: bool = typer.Option(
         False,
         "--preflight-billing",
-        help="Check OBJECTST-STD billing eligibility first (same as the global --check-billing)",
+        help="Deprecated no-op; upstream decides billing and lifecycle admission.",
     ),
 ) -> None:
     """Create a bucket."""
@@ -191,7 +191,7 @@ def create_bucket(
         object_lock_enabled=bucket_lock,
         default_retention=retention,
         tags=tag or None,
-        preflight_billing=preflight or settings.check_billing,
+        preflight_billing=False,
     )
     print_json(result, id_field="name")
 
@@ -353,7 +353,7 @@ def create_credential(
     preflight: bool = typer.Option(
         False,
         "--preflight-billing",
-        help="Check OBJECTST-STD billing eligibility first (same as the global --check-billing)",
+        help="Deprecated no-op; upstream decides billing and lifecycle admission.",
     ),
 ) -> None:
     """Create an S3 access key; its secret is displayed only once.
@@ -368,7 +368,7 @@ def create_credential(
         permission_type=permission_type,
         bucket_scope=bucket_scope,
         allowed_buckets=allowed_bucket or None,
-        preflight_billing=preflight or settings.check_billing,
+        preflight_billing=False,
     )
     # Never print only the ID: the one-time secret would be lost. -o id falls back to JSON.
     print_structured(result, "yaml" if settings.output == "yaml" else "json", id_field="access_key_id")

{ibee_cli-0.4.0 → ibee_cli-0.4.2}/src/ibee_cli/commands/cdn.py

@@ -152,7 +152,7 @@ def create_distribution(
     preflight: bool = typer.Option(
         False,
         "--preflight-billing",
-        help="Check billing eligibility first (same as the global --check-billing)",
+        help="Deprecated no-op; upstream decides billing and lifecycle admission.",
     ),
 ) -> None:
     """Create a CDN distribution for a public bucket.
@@ -171,7 +171,7 @@ def create_distribution(
         origin_type=origin_type,
         cache_policy=cache_policy,
         check_origin_public=check_origin,
-        preflight_billing=preflight or settings.check_billing,
+        preflight_billing=False,
     ))
 
 
@@ -327,7 +327,7 @@ def create_domain(
     preflight: bool = typer.Option(
         False,
         "--preflight-billing",
-        help="Check CUSTOMDO-STD billing eligibility first (same as the global --check-billing)",
+        help="Deprecated no-op; upstream decides billing and lifecycle admission.",
     ),
 ) -> None:
     """Add a custom domain (billed), then print the CNAME record to create."""
@@ -337,7 +337,7 @@ def create_domain(
         distribution_id,
         workspace_id=workspace,
         domain=domain,
-        preflight_billing=preflight or settings.check_billing,
+        preflight_billing=False,
     )
     _print(result)
     if not settings.structured_output:

{ibee_cli-0.4.0 → ibee_cli-0.4.2}/src/ibee_cli/commands/gpus.py

@@ -151,7 +151,7 @@ def create_gpu_vm(
     preflight: bool = typer.Option(
         False,
         "--preflight-billing",
-        help="Check billing eligibility for the plan SKU first (same as the global --check-billing)",
+        help="Deprecated no-op; upstream decides billing and lifecycle admission.",
     ),
     wait: bool = typer.Option(False, "--wait", help="Poll until the VM is provisioned"),
     timeout: Optional[float] = timeout_option(),
@@ -223,7 +223,7 @@ def delete_gpu_vm(
     reserved_ip_billing_catalog_file: Optional[str] = typer.Option(None, "--reserved-ip-billing-catalog-file"),
     requested_by: Optional[str] = typer.Option(None, "--requested-by"),
     preflight: bool = typer.Option(
-        False, "--preflight-billing", help="With --reserve-public-ip, check billing eligibility for the Reserved IP SKU"
+        False, "--preflight-billing", help="Deprecated no-op; upstream decides billing and lifecycle admission."
     ),
     check_state: bool = check_state_option(),
     wait: bool = typer.Option(False, "--wait", help="Poll until the VM is deleted"),

{ibee_cli-0.4.0 → ibee_cli-0.4.2}/src/ibee_cli/commands/load_balancers.py

@@ -275,7 +275,7 @@ def _create(
 ) -> None:
     settings, workspace, client = _session(ctx)
     method = getattr(client.load_balancers, f"create_{layer}load_balancer")
-    lb = method(workspace_id=workspace, check_billing=check_billing or settings.check_billing,
+    lb = method(workspace_id=workspace, check_billing=False,
                 **{key: value for key, value in fields.items() if value is not None})
     print_json(lb, id_field=ID_FIELD)
 
@@ -333,7 +333,7 @@ def create_l4_load_balancer(
         None, "--tls", help="TLS JSON object (managed certificates only; default for tls_passthrough)"
     ),
     check_billing: bool = typer.Option(
-        False, "--check-billing", help="Check LOADBALA-STD billing eligibility first (same as the global option)"
+        False, "--check-billing", help="Deprecated no-op; upstream decides billing and lifecycle admission."
     ),
 ) -> None:
     """Create an L4 load balancer (TCP or TLS passthrough)."""
@@ -402,7 +402,7 @@ def create_l7_load_balancer(
     ),
     rules: Optional[str] = typer.Option(None, "--rules", help="Rules JSON array"),
     check_billing: bool = typer.Option(
-        False, "--check-billing", help="Check LOADBALA-STD billing eligibility first (same as the global option)"
+        False, "--check-billing", help="Deprecated no-op; upstream decides billing and lifecycle admission."
     ),
 ) -> None:
     """Create an L7 load balancer (HTTP or HTTPS)."""

{ibee_cli-0.4.0 → ibee_cli-0.4.2}/src/ibee_cli/commands/networking.py

@@ -529,7 +529,7 @@ def create_nat_gateway(
     ),
     preflight: bool = typer.Option(
         False, "--preflight", "--preflight-billing",
-        help="Check NAT-GATEWAY billing eligibility first (also set by the global --check-billing)",
+        help="Deprecated no-op; upstream decides billing and lifecycle admission.",
     ),
     check_state: bool = check_state_option(),
 ) -> None:
@@ -561,7 +561,7 @@ def create_nat_gateway(
             reserved_public_ip_id=reserved_public_ip_id,
             name=name,
             billing_catalog=catalog,
-            preflight_billing=preflight or settings.check_billing,
+            preflight_billing=False,
             check_state=False,
         )
     print_json(gateway, id_field="nat_gateway_id")

{ibee_cli-0.4.0 → ibee_cli-0.4.2}/src/ibee_cli/commands/reserved_ips.py

@@ -2,7 +2,7 @@
 
 The Python SDK applies the portal's rules: label and reverse-DNS formats, no release
 while attached, attach versus move, no detach of a converted address that is still
-the VM's active IP, and the RESERVED-IP billing preflight for conversions.
+the VM's active IP, and upstream admission for conversions.
 """
 
 from __future__ import annotations
@@ -60,7 +60,7 @@ def reserve_ip(
         None, "--billing-catalog-file", metavar="PATH", help="Read --billing-catalog from a JSON file"
     ),
     check_billing: bool = typer.Option(
-        False, "--check-billing", help="Check RESERVED-IP billing eligibility first (same as the global option)"
+        False, "--check-billing", help="Deprecated no-op; upstream decides billing and lifecycle admission."
     ),
 ) -> None:
     """Reserve a new public IP address (billed while reserved)."""
@@ -72,7 +72,7 @@ def reserve_ip(
         site_id=site_id,
         label=label,
         billing_catalog=catalog,
-        check_billing=check_billing or settings.check_billing,
+        check_billing=False,
     )
     print_json(reserved, id_field=ID_FIELD)
 
@@ -93,7 +93,7 @@ def convert_vm_public_ip(
     billing_check: bool = typer.Option(
         True,
         "--billing-check/--no-billing-check",
-        help="Check RESERVED-IP billing eligibility first (default: on; needs the billing.read scope)",
+        help="Deprecated no-op; upstream decides billing and lifecycle admission.",
     ),
 ) -> None:
     """Keep a VM's current public IPv4 as a Reserved IP (VMs outside a VPC).
@@ -103,22 +103,14 @@ def convert_vm_public_ip(
 
     _settings, workspace, client = _session(ctx)
     catalog = load_json_input(billing_catalog, billing_catalog_file, "billing-catalog")
-    try:
-        reserved = client.reserved_ips.convert_vm_public_ip_to_reserved_ip(
-            workspace_id=workspace,
-            vm_id=vm_id,
-            site_id=site_id,
-            label=label,
-            billing_catalog=catalog,
-            billing_check=billing_check,
-        )
-    except ForbiddenError as exc:
-        text = str(getattr(exc, "message", "") or "")
-        if billing_check and (getattr(exc, "required_scope", None) == "billing.read" or "billing.read" in text):
-            exc.cli_hint = (  # type: ignore[attr-defined]
-                "The RESERVED-IP billing check needs the billing.read scope; grant it or pass --no-billing-check."
-            )
-        raise
+    reserved = client.reserved_ips.convert_vm_public_ip_to_reserved_ip(
+        workspace_id=workspace,
+        vm_id=vm_id,
+        site_id=site_id,
+        label=label,
+        billing_catalog=catalog,
+        billing_check=False,
+    )
     print_json(reserved, id_field=ID_FIELD)
 
 

{ibee_cli-0.4.0 → ibee_cli-0.4.2}/src/ibee_cli/commands/secrets.py

@@ -278,8 +278,7 @@ def create_store(
     billing_check: bool = typer.Option(
         True,
         "--billing-check/--no-billing-check",
-        help="Check SECRETMA-STD billing eligibility first, as the portal does (default: on). "
-        "Skipped with a warning when the token lacks billing.read",
+        help="Deprecated no-op; upstream decides billing and lifecycle admission.",
     ),
     if_exists: IfExists = typer.Option(
         IfExists.ERROR,
@@ -299,7 +298,7 @@ def create_store(
                 workspace_id=workspace,
                 name=body["name"],
                 description=body.get("description"),
-                preflight_billing=bool(billing_check or settings.check_billing),
+                preflight_billing=False,
             )
         except ConflictError as exc:
             if if_exists is not IfExists.REUSE or type(exc) is not ConflictError:
@@ -997,8 +996,7 @@ def create_secret(
     billing_check: bool = typer.Option(
         True,
         "--billing-check/--no-billing-check",
-        help="Check SECRETMA-STD billing eligibility first, as the portal does (default: on). "
-        "Skipped with a warning when the token lacks billing.read",
+        help="Deprecated no-op; upstream decides billing and lifecycle admission.",
     ),
 ) -> None:
     """Create a secret in an active store."""
@@ -1016,7 +1014,7 @@ def create_secret(
             workspace_id=workspace,
             secret_name=secret_name,
             value=secret_value,
-            preflight_billing=bool(billing_check or settings.check_billing),
+            preflight_billing=False,
         )
     if settings.structured_output:
         print_json(result)

{ibee_cli-0.4.0 → ibee_cli-0.4.2}/src/ibee_cli/commands/vm_lifecycle.py

@@ -398,7 +398,7 @@ def create_vms(
         ),
     )
     if preflight or getattr(settings, "check_billing", False):
-        common["preflight_billing"] = True
+        common["preflight_billing"] = False
     results = []
     for vm_name, key in zip(names, keys):
         try:
@@ -521,7 +521,7 @@ def delete_vm(
         kwargs = resolve("reserve" if reserve else "release")
     if preflight or getattr(settings, "check_billing", False):
         if kwargs.get("public_ip_action") == "reserve":
-            kwargs["preflight_billing"] = True
+            kwargs["preflight_billing"] = False
     result = _method(resource, spec, "delete")(
         vm_id=vm_id,
         workspace_id=workspace,
@@ -1041,7 +1041,7 @@ def register_vm_lifecycle(app: typer.Typer, spec: VmCommandSpec) -> None:
         billing_catalog: Optional[str] = typer.Option(None, "--billing-catalog", help=SNAPSHOT_SKU_HELP),
         billing_catalog_file: Optional[str] = typer.Option(None, "--billing-catalog-file", help="File with the SKU JSON"),
         preflight: bool = typer.Option(
-            False, "--preflight-billing", help="Check billing eligibility for the SKU first (needs billing.read)"
+            False, "--preflight-billing", help="Deprecated no-op; upstream decides billing and lifecycle admission."
         ),
         requested_by: Optional[str] = typer.Option(None, "--requested-by"),
         check_state: bool = check_state_option(),
@@ -1065,7 +1065,7 @@ def register_vm_lifecycle(app: typer.Typer, spec: VmCommandSpec) -> None:
                 mode=mode,
                 selected_data_volume_ids=selected_data_volume_id,
                 requested_by=requested_by,
-                preflight_billing=True if preflight or getattr(settings, "check_billing", False) else None,
+                preflight_billing=False,
             ),
         )
         snapshot_id = cell(result, "snapshot_set_id") or cell(result, "id")

{ibee_cli-0.4.0 → ibee_cli-0.4.2}/src/ibee_cli/commands/vms.py

@@ -103,7 +103,7 @@ def create_vm(
     ram_mb: Optional[int] = typer.Option(None, "--ram-mb", help="RAM in MB (default: the plan's; must match it)"),
     disk_gb: Optional[int] = typer.Option(None, "--disk-gb", help="Root disk in GB (default: the plan's; must match it)"),
     billing_term: Optional[str] = typer.Option(
-        None, "--billing-term", help="Billing term: " + ", ".join(BILLING_TERMS) + " (default HOURLY, or the plan's first term)"
+        None, "--billing-term", help="Billing term sent to the API: " + ", ".join(BILLING_TERMS) + " (default HOURLY, or the plan's first term); admission is decided upstream"
     ),
     windows_license: Optional[str] = typer.Option(
         None,
@@ -150,7 +150,7 @@ def create_vm(
     preflight: bool = typer.Option(
         False,
         "--preflight-billing",
-        help="Check billing eligibility for the plan SKU first (same as the global --check-billing)",
+        help="Deprecated no-op; upstream decides billing and lifecycle admission.",
     ),
     wait: bool = typer.Option(False, "--wait", help="Poll until the VM is provisioned"),
     timeout: Optional[float] = timeout_option(),
@@ -222,7 +222,7 @@ def delete_vm(
     reserved_ip_billing_catalog_file: Optional[str] = typer.Option(None, "--reserved-ip-billing-catalog-file"),
     requested_by: Optional[str] = typer.Option(None, "--requested-by"),
     preflight: bool = typer.Option(
-        False, "--preflight-billing", help="With --reserve-public-ip, check billing eligibility for the Reserved IP SKU"
+        False, "--preflight-billing", help="Deprecated no-op; upstream decides billing and lifecycle admission."
     ),
     check_state: bool = check_state_option(),
     wait: bool = typer.Option(False, "--wait", help="Poll until the VM is deleted"),

{ibee_cli-0.4.0 → ibee_cli-0.4.2}/src/ibee_cli/helpers.py

@@ -2,8 +2,8 @@
 
 Compute writes (VM create/delete/power, access, resize, and volume actions)
 return `202 + operation_id`; these helpers build idempotency keys, optionally
-poll the operation to a terminal state (`--wait`), run the optional billing
-preflight (`--check-billing`), ask for confirmation of destructive actions,
+poll the operation to a terminal state (`--wait`), retain deprecated no-op billing
+flags, ask for confirmation of destructive actions,
 and parse structured values from the command line.
 """
 
@@ -549,36 +549,8 @@ def preflight_billing(
     estimated_cost_minor: Optional[int | float] = None,
     resource_type: str = "resource",
 ) -> Any:
-    """Portal billing preflight before a billable create, when ``--check-billing`` is set.
-
-    Without ``--check-billing`` (or ``IBEE_CHECK_BILLING``) nothing is called, so a
-    create stays a single request and the API edge alone decides admission. With it,
-    the create continues only when billing answers ``allowed`` exactly ``true``;
-    otherwise ``BillingDeniedError`` is raised (printed with the portal wording, exit 1).
-    """
-
-    if not getattr(settings, "check_billing", False):
-        return None
-    billing = getattr(client, "billing", None)
-    require = getattr(billing, "require_resource_eligibility", None)
-    if callable(require):
-        kwargs: dict[str, Any] = {"workspace_id": workspace_id, "resource_type": resource_type}
-        sku = normalize_sku_code(sku_code)
-        if sku:
-            kwargs["sku_code"] = sku
-        cost = normalize_estimated_cost_minor(estimated_cost_minor)
-        if cost is not None:
-            kwargs["estimated_cost_minor"] = cost
-        return require(**kwargs)
-    decision = check_billing_eligibility(
-        client,
-        workspace_id,
-        sku_code=sku_code,
-        estimated_cost_minor=estimated_cost_minor,
-    )
-    if _field(decision, "allowed") is not True:
-        raise BillingDeniedError(decision=decision, create_type=resource_type)
-    return decision
+    """Deprecated compatibility no-op; the mutation endpoint decides admission."""
+    return None
 
 
 def preflight_create(
@@ -589,24 +561,8 @@ def preflight_create(
     sku_code: Optional[str] = None,
     estimated_cost_minor: Optional[int | float] = None,
 ) -> Any:
-    """``preflight_billing`` for a billable create command, building the client on demand.
-
-    Does nothing (and sends nothing) unless ``--check-billing``/``IBEE_CHECK_BILLING`` is set.
-    """
-
-    if not getattr(settings, "check_billing", False):
-        return None
-    from .context import get_client, require_workspace
-
-    workspace = require_workspace(settings)
-    return preflight_billing(
-        settings,
-        client if client is not None else get_client(settings),
-        workspace,
-        sku_code=sku_code,
-        estimated_cost_minor=estimated_cost_minor,
-        resource_type=resource_type,
-    )
+    """Deprecated compatibility no-op; no client or workspace is resolved."""
+    return None
 
 
 # ---------------------------------------------------------------------------

{ibee_cli-0.4.0 → ibee_cli-0.4.2}/src/ibee_cli/main.py

@@ -87,8 +87,8 @@ def main(
         False,
         "--check-billing",
         help=(
-            "Ask billing before a billable create and stop when it would be denied "
-            "(env IBEE_CHECK_BILLING=1)"
+            "Deprecated no-op; upstream decides mutation admission "
+            "(also applies to IBEE_CHECK_BILLING)"
         ),
     ),
     version: bool = typer.Option(

{ibee_cli-0.4.0 → ibee_cli-0.4.2}/src/ibee_cli/render.py

@@ -495,7 +495,7 @@ def _api_error_lines(exc: ApiError) -> list[str]:
         return [f"Validation failed (422): {message}"]
     if status == 423 or isinstance(exc, OrganizationSuspendedError):
         return [
-            "Organization suspended (423): billing has suspended this organization, "
+            "Organization suspended (423): this organization is suspended, "
             f"so this change is blocked. {message}"
         ]
     if status == 429: