ibee-cli 0.4.1__tar.gz → 0.4.2__tar.gz

{ibee_cli-0.4.1/src/ibee_cli.egg-info → ibee_cli-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ibee-cli
-Version: 0.4.1
+Version: 0.4.2
 Summary: Official command-line interface for the IBEE Solutions cloud platform
 Author-email: IBEE Solutions <support@ibee.ai>
 License-Expression: MIT
@@ -13,7 +13,7 @@ Classifier: Environment :: Console
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: ibee<0.5.0,>=0.4.1
+Requires-Dist: ibee<0.5.0,>=0.4.2
 Requires-Dist: httpx>=0.27
 Requires-Dist: typer>=0.12
 Requires-Dist: click>=8.1
@@ -305,22 +305,15 @@ an interactive hidden prompt, or pipe one line to `--password-stdin`.
 Bucket and VM placement are automatic when `--site-id` is omitted. Use
 `ibee compute sites` and pass `--site-id` only when placement must be pinned.
 
-Billable creates send one product request. The public gateway performs the
-authoritative, fail-closed billing decision before routing; a valid denial is
-returned without calling the product service. `ibee billing eligibility`
-remains available as an optional point-in-time preview, and the global
-`--check-billing` flag (or `IBEE_CHECK_BILLING=1`) runs the portal's preflight
-before a billable create: the create is sent only when billing answers
-`allowed: true`, otherwise the portal's explanation is printed (with top-up
-guidance when adding credits in the portal can resolve it) and the command
-exits 1. The preflight never reserves funds.
-
-For Cloud/GPU VM creates, `--check-billing` / `--preflight-billing` checks Billing's
-account status only. No SKU-only monthly probe or client-calculated price is
-sent. The selected catalog term goes to the create API, where the upstream
-catalog quote and Billing decide affordability before provisioning. A passing
-preflight is not purchase approval. CLI 0.4.1 requires Python SDK 0.4.1 or later;
-the CLI delegates to it and does not implement its own pricing policy.
+All product writes reach the upstream API for fresh Billing and lifecycle decisions.
+The CLI never queries billing eligibility or calculates an admission estimate automatically.
+Legacy `--check-billing`, `--preflight-billing`, NAT `--preflight`,
+`--billing-check/--no-billing-check`, and `IBEE_CHECK_BILLING` are deprecated no-ops.
+Structural, workspace, state, scope and destructive-action checks remain in place.
+`ibee billing eligibility` is an explicit diagnostic query: `allowed: false` is data (exit 0);
+the explicit `--require` option retains exit 1 on denial.
+It supports `REVOKE_CREDENTIAL` and `SECURITY_RECOVERY`.
+Upstream errors retain their classification; suspension messages do not infer who suspended an organization.
 
 Load balancers take backends, routing, policy, health checks and L7 rules either
 as flags (`--backend TYPE:TARGET:PORT[:WEIGHT][:tls]`, `--rule
@@ -413,7 +406,7 @@ on) controls the read-only checks that need the current state.
 - **NAT gateways** exist only in `nat_gateway` VPCs (one per VPC; `nat create`
   prints the existing one instead of sending a create). A Reserved IP must be in
   the VPC's site, unattached and `reserved`. `--preflight` (or `--check-billing`)
-  checks NAT-GATEWAY eligibility first. `nat delete` shows how many NAT VMs lose
+  is a deprecated no-op; upstream decides admission. `nat delete` shows how many NAT VMs lose
   outbound internet and how many forwarding rules are deleted before it asks;
   `--ip-action reserve` of a platform-assigned IP needs `--billing-catalog` (the
   RESERVED-IP SKU); deletion is refused while a virtual IP holds a Reserved IP.
@@ -429,8 +422,8 @@ on) controls the read-only checks that need the current state.
   253 characters (`--reverse-dns ""` clears it); `release` is refused while
   attached; `attach` is for unattached IPs (`move` for an IP on another VM,
   `--detach-from-service` for one on a NAT gateway or virtual IP); an attach to a VM
-  outside a VPC points at `reserved-ips convert`. `convert` runs the RESERVED-IP
-  billing check first (`--no-billing-check` skips it; it needs `billing.read`).
+  outside a VPC points at `reserved-ips convert`. The API decides admission for
+  `convert`.
 - **Firewalls**: group names are unique in any case (1-120 characters) and
   customers cannot create default groups. Rules: tcp and udp need `--port` (22 or
   8000-8080), icmp and any take none; sources are IPv4 addresses or CIDRs (a bare
@@ -495,8 +488,7 @@ for confirmation, the read-only checks run first (`--no-check-state` skips them)
   timeout). `purge` needs `--mode`; `--mode all` asks first; only the selector for the
   mode is accepted (`--path` 1-30, https URLs only; `--hostname`, `--tag`, `--prefix`
   1-100). A purge the CDN reports as failed exits 1.
-- `--check-billing` (or `--preflight-billing`) checks OBJECTST-STD before a bucket or
-  S3 credential create and CUSTOMDO-STD before a custom domain.
+- `--check-billing` and `--preflight-billing` are deprecated no-ops for storage and CDN.
 - `block-storage create --vm-type`/`--delete-on-termination`, the Block Storage delete
   idempotency key, `cdn cache-policies` and `cdn metrics` are not yet part of the
   published API contract; behaviour may change. Block Storage plans, bucket emptying,
@@ -527,10 +519,7 @@ inputs first.
   values are refused. In `patch-value`, a JSON `null` deletes that key. `--cas` is an
   integer >= 0; a check-and-set mismatch is reported as a conflict and never retried.
   `list` sends a trimmed `--query` (at most 128 characters) only when it is not blank.
-- **Billing**: `stores create` and `secrets create` check SECRETMA-STD eligibility
-  first, as the portal does (`--no-billing-check` turns it off; the global
-  `--check-billing` forces it on). When the token lacks `billing.read` the check is
-  skipped with a warning, because the API still enforces billing on the create.
+- **Billing**: store and secret writes use upstream admission. Both legacy billing-check flags are no-ops.
 - **Batch create**: every item follows the `secrets create` rules and the error names
   its index. Duplicate names are reported (the API skips them). A file with more than
   500 secrets or over 64 KiB is sent as consecutive requests and the results are
@@ -571,7 +560,7 @@ inputs first.
 | `-o`, `--output` | `IBEE_OUTPUT` | `table`, `json`, `yaml` or `id` |
 | `--json` | | Same as `-o json` |
 | `--yes`, `-y` | `IBEE_ASSUME_YES=1` | Answer yes to every confirmation |
-| `--check-billing` | `IBEE_CHECK_BILLING=1` | Billing preflight before billable creates |
+| `--check-billing` | `IBEE_CHECK_BILLING=1` | Deprecated no-op; upstream decides admission |
 
 Without `-o`, each command keeps its usual format (tables for most lists, JSON
 for single resources and operation results). `-o yaml` prints YAML and `-o id`

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/README.md

@@ -280,22 +280,15 @@ an interactive hidden prompt, or pipe one line to `--password-stdin`.
 Bucket and VM placement are automatic when `--site-id` is omitted. Use
 `ibee compute sites` and pass `--site-id` only when placement must be pinned.
 
-Billable creates send one product request. The public gateway performs the
-authoritative, fail-closed billing decision before routing; a valid denial is
-returned without calling the product service. `ibee billing eligibility`
-remains available as an optional point-in-time preview, and the global
-`--check-billing` flag (or `IBEE_CHECK_BILLING=1`) runs the portal's preflight
-before a billable create: the create is sent only when billing answers
-`allowed: true`, otherwise the portal's explanation is printed (with top-up
-guidance when adding credits in the portal can resolve it) and the command
-exits 1. The preflight never reserves funds.
-
-For Cloud/GPU VM creates, `--check-billing` / `--preflight-billing` checks Billing's
-account status only. No SKU-only monthly probe or client-calculated price is
-sent. The selected catalog term goes to the create API, where the upstream
-catalog quote and Billing decide affordability before provisioning. A passing
-preflight is not purchase approval. CLI 0.4.1 requires Python SDK 0.4.1 or later;
-the CLI delegates to it and does not implement its own pricing policy.
+All product writes reach the upstream API for fresh Billing and lifecycle decisions.
+The CLI never queries billing eligibility or calculates an admission estimate automatically.
+Legacy `--check-billing`, `--preflight-billing`, NAT `--preflight`,
+`--billing-check/--no-billing-check`, and `IBEE_CHECK_BILLING` are deprecated no-ops.
+Structural, workspace, state, scope and destructive-action checks remain in place.
+`ibee billing eligibility` is an explicit diagnostic query: `allowed: false` is data (exit 0);
+the explicit `--require` option retains exit 1 on denial.
+It supports `REVOKE_CREDENTIAL` and `SECURITY_RECOVERY`.
+Upstream errors retain their classification; suspension messages do not infer who suspended an organization.
 
 Load balancers take backends, routing, policy, health checks and L7 rules either
 as flags (`--backend TYPE:TARGET:PORT[:WEIGHT][:tls]`, `--rule
@@ -388,7 +381,7 @@ on) controls the read-only checks that need the current state.
 - **NAT gateways** exist only in `nat_gateway` VPCs (one per VPC; `nat create`
   prints the existing one instead of sending a create). A Reserved IP must be in
   the VPC's site, unattached and `reserved`. `--preflight` (or `--check-billing`)
-  checks NAT-GATEWAY eligibility first. `nat delete` shows how many NAT VMs lose
+  is a deprecated no-op; upstream decides admission. `nat delete` shows how many NAT VMs lose
   outbound internet and how many forwarding rules are deleted before it asks;
   `--ip-action reserve` of a platform-assigned IP needs `--billing-catalog` (the
   RESERVED-IP SKU); deletion is refused while a virtual IP holds a Reserved IP.
@@ -404,8 +397,8 @@ on) controls the read-only checks that need the current state.
   253 characters (`--reverse-dns ""` clears it); `release` is refused while
   attached; `attach` is for unattached IPs (`move` for an IP on another VM,
   `--detach-from-service` for one on a NAT gateway or virtual IP); an attach to a VM
-  outside a VPC points at `reserved-ips convert`. `convert` runs the RESERVED-IP
-  billing check first (`--no-billing-check` skips it; it needs `billing.read`).
+  outside a VPC points at `reserved-ips convert`. The API decides admission for
+  `convert`.
 - **Firewalls**: group names are unique in any case (1-120 characters) and
   customers cannot create default groups. Rules: tcp and udp need `--port` (22 or
   8000-8080), icmp and any take none; sources are IPv4 addresses or CIDRs (a bare
@@ -470,8 +463,7 @@ for confirmation, the read-only checks run first (`--no-check-state` skips them)
   timeout). `purge` needs `--mode`; `--mode all` asks first; only the selector for the
   mode is accepted (`--path` 1-30, https URLs only; `--hostname`, `--tag`, `--prefix`
   1-100). A purge the CDN reports as failed exits 1.
-- `--check-billing` (or `--preflight-billing`) checks OBJECTST-STD before a bucket or
-  S3 credential create and CUSTOMDO-STD before a custom domain.
+- `--check-billing` and `--preflight-billing` are deprecated no-ops for storage and CDN.
 - `block-storage create --vm-type`/`--delete-on-termination`, the Block Storage delete
   idempotency key, `cdn cache-policies` and `cdn metrics` are not yet part of the
   published API contract; behaviour may change. Block Storage plans, bucket emptying,
@@ -502,10 +494,7 @@ inputs first.
   values are refused. In `patch-value`, a JSON `null` deletes that key. `--cas` is an
   integer >= 0; a check-and-set mismatch is reported as a conflict and never retried.
   `list` sends a trimmed `--query` (at most 128 characters) only when it is not blank.
-- **Billing**: `stores create` and `secrets create` check SECRETMA-STD eligibility
-  first, as the portal does (`--no-billing-check` turns it off; the global
-  `--check-billing` forces it on). When the token lacks `billing.read` the check is
-  skipped with a warning, because the API still enforces billing on the create.
+- **Billing**: store and secret writes use upstream admission. Both legacy billing-check flags are no-ops.
 - **Batch create**: every item follows the `secrets create` rules and the error names
   its index. Duplicate names are reported (the API skips them). A file with more than
   500 secrets or over 64 KiB is sent as consecutive requests and the results are
@@ -546,7 +535,7 @@ inputs first.
 | `-o`, `--output` | `IBEE_OUTPUT` | `table`, `json`, `yaml` or `id` |
 | `--json` | | Same as `-o json` |
 | `--yes`, `-y` | `IBEE_ASSUME_YES=1` | Answer yes to every confirmation |
-| `--check-billing` | `IBEE_CHECK_BILLING=1` | Billing preflight before billable creates |
+| `--check-billing` | `IBEE_CHECK_BILLING=1` | Deprecated no-op; upstream decides admission |
 
 Without `-o`, each command keeps its usual format (tables for most lists, JSON
 for single resources and operation results). `-o yaml` prints YAML and `-o id`

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ibee-cli"
-version = "0.4.1"
+version = "0.4.2"
 description = "Official command-line interface for the IBEE Solutions cloud platform"
 readme = "README.md"
 license = "MIT"
@@ -18,7 +18,7 @@ classifiers = [
     "Environment :: Console",
 ]
 dependencies = [
-    "ibee>=0.4.1,<0.5.0",
+    "ibee>=0.4.2,<0.5.0",
     "httpx>=0.27",
     "typer>=0.12",
     "click>=8.1",

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/src/ibee_cli/__init__.py

@@ -1,3 +1,3 @@
 """IBEE Solutions command-line interface."""
 
-__version__ = "0.4.1"
+__version__ = "0.4.2"

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/src/ibee_cli/commands/block_storage.py

@@ -47,7 +47,6 @@ from ..helpers import (
     idempotency_key_option,
     load_json_input,
     poll_interval_option,
-    preflight_billing,
     resolve_idempotency_key,
     resolve_wait,
     timeout_option,
@@ -264,7 +263,7 @@ def create_volume(
 
     settings, workspace, client = _session(ctx)
     key = resolve_idempotency_key(idempotency_key, "block-create", name)
-    # Validate first (exit 2) so a bad request never reaches the billing preflight.
+    # Validate first (exit 2) so a bad request never reaches the API.
     body = build_block_volume_create_body(
         name=name,
         size_gb=size_gb,
@@ -277,10 +276,6 @@ def create_volume(
         vm_type=vm_type,
         delete_on_termination=delete_on_termination,
     )
-    if settings.check_billing:
-        preflight_billing(
-            settings, client, workspace, sku_code=body.get("sku_code"), resource_type="block_storage"
-        )
     try:
         with api_hints({400: CREATE_PLAN_HINT}):
             result = client.block_storage.create_block_volume(

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/src/ibee_cli/commands/buckets.py

@@ -176,7 +176,7 @@ def create_bucket(
     preflight: bool = typer.Option(
         False,
         "--preflight-billing",
-        help="Check OBJECTST-STD billing eligibility first (same as the global --check-billing)",
+        help="Deprecated no-op; upstream decides billing and lifecycle admission.",
     ),
 ) -> None:
     """Create a bucket."""
@@ -191,7 +191,7 @@ def create_bucket(
         object_lock_enabled=bucket_lock,
         default_retention=retention,
         tags=tag or None,
-        preflight_billing=preflight or settings.check_billing,
+        preflight_billing=False,
     )
     print_json(result, id_field="name")
 
@@ -353,7 +353,7 @@ def create_credential(
     preflight: bool = typer.Option(
         False,
         "--preflight-billing",
-        help="Check OBJECTST-STD billing eligibility first (same as the global --check-billing)",
+        help="Deprecated no-op; upstream decides billing and lifecycle admission.",
     ),
 ) -> None:
     """Create an S3 access key; its secret is displayed only once.
@@ -368,7 +368,7 @@ def create_credential(
         permission_type=permission_type,
         bucket_scope=bucket_scope,
         allowed_buckets=allowed_bucket or None,
-        preflight_billing=preflight or settings.check_billing,
+        preflight_billing=False,
     )
     # Never print only the ID: the one-time secret would be lost. -o id falls back to JSON.
     print_structured(result, "yaml" if settings.output == "yaml" else "json", id_field="access_key_id")

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/src/ibee_cli/commands/cdn.py

@@ -152,7 +152,7 @@ def create_distribution(
     preflight: bool = typer.Option(
         False,
         "--preflight-billing",
-        help="Check billing eligibility first (same as the global --check-billing)",
+        help="Deprecated no-op; upstream decides billing and lifecycle admission.",
     ),
 ) -> None:
     """Create a CDN distribution for a public bucket.
@@ -171,7 +171,7 @@ def create_distribution(
         origin_type=origin_type,
         cache_policy=cache_policy,
         check_origin_public=check_origin,
-        preflight_billing=preflight or settings.check_billing,
+        preflight_billing=False,
     ))
 
 
@@ -327,7 +327,7 @@ def create_domain(
     preflight: bool = typer.Option(
         False,
         "--preflight-billing",
-        help="Check CUSTOMDO-STD billing eligibility first (same as the global --check-billing)",
+        help="Deprecated no-op; upstream decides billing and lifecycle admission.",
     ),
 ) -> None:
     """Add a custom domain (billed), then print the CNAME record to create."""
@@ -337,7 +337,7 @@ def create_domain(
         distribution_id,
         workspace_id=workspace,
         domain=domain,
-        preflight_billing=preflight or settings.check_billing,
+        preflight_billing=False,
     )
     _print(result)
     if not settings.structured_output:

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/src/ibee_cli/commands/gpus.py

@@ -151,7 +151,7 @@ def create_gpu_vm(
     preflight: bool = typer.Option(
         False,
         "--preflight-billing",
-        help="Check Billing account status first; upstream create decides affordability (same as --check-billing)",
+        help="Deprecated no-op; upstream decides billing and lifecycle admission.",
     ),
     wait: bool = typer.Option(False, "--wait", help="Poll until the VM is provisioned"),
     timeout: Optional[float] = timeout_option(),
@@ -223,7 +223,7 @@ def delete_gpu_vm(
     reserved_ip_billing_catalog_file: Optional[str] = typer.Option(None, "--reserved-ip-billing-catalog-file"),
     requested_by: Optional[str] = typer.Option(None, "--requested-by"),
     preflight: bool = typer.Option(
-        False, "--preflight-billing", help="With --reserve-public-ip, check billing eligibility for the Reserved IP SKU"
+        False, "--preflight-billing", help="Deprecated no-op; upstream decides billing and lifecycle admission."
     ),
     check_state: bool = check_state_option(),
     wait: bool = typer.Option(False, "--wait", help="Poll until the VM is deleted"),

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/src/ibee_cli/commands/load_balancers.py

@@ -275,7 +275,7 @@ def _create(
 ) -> None:
     settings, workspace, client = _session(ctx)
     method = getattr(client.load_balancers, f"create_{layer}load_balancer")
-    lb = method(workspace_id=workspace, check_billing=check_billing or settings.check_billing,
+    lb = method(workspace_id=workspace, check_billing=False,
                 **{key: value for key, value in fields.items() if value is not None})
     print_json(lb, id_field=ID_FIELD)
 
@@ -333,7 +333,7 @@ def create_l4_load_balancer(
         None, "--tls", help="TLS JSON object (managed certificates only; default for tls_passthrough)"
     ),
     check_billing: bool = typer.Option(
-        False, "--check-billing", help="Check LOADBALA-STD billing eligibility first (same as the global option)"
+        False, "--check-billing", help="Deprecated no-op; upstream decides billing and lifecycle admission."
     ),
 ) -> None:
     """Create an L4 load balancer (TCP or TLS passthrough)."""
@@ -402,7 +402,7 @@ def create_l7_load_balancer(
     ),
     rules: Optional[str] = typer.Option(None, "--rules", help="Rules JSON array"),
     check_billing: bool = typer.Option(
-        False, "--check-billing", help="Check LOADBALA-STD billing eligibility first (same as the global option)"
+        False, "--check-billing", help="Deprecated no-op; upstream decides billing and lifecycle admission."
     ),
 ) -> None:
     """Create an L7 load balancer (HTTP or HTTPS)."""

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/src/ibee_cli/commands/networking.py

@@ -529,7 +529,7 @@ def create_nat_gateway(
     ),
     preflight: bool = typer.Option(
         False, "--preflight", "--preflight-billing",
-        help="Check NAT-GATEWAY billing eligibility first (also set by the global --check-billing)",
+        help="Deprecated no-op; upstream decides billing and lifecycle admission.",
     ),
     check_state: bool = check_state_option(),
 ) -> None:
@@ -561,7 +561,7 @@ def create_nat_gateway(
             reserved_public_ip_id=reserved_public_ip_id,
             name=name,
             billing_catalog=catalog,
-            preflight_billing=preflight or settings.check_billing,
+            preflight_billing=False,
             check_state=False,
         )
     print_json(gateway, id_field="nat_gateway_id")

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/src/ibee_cli/commands/reserved_ips.py

@@ -2,7 +2,7 @@
 
 The Python SDK applies the portal's rules: label and reverse-DNS formats, no release
 while attached, attach versus move, no detach of a converted address that is still
-the VM's active IP, and the RESERVED-IP billing preflight for conversions.
+the VM's active IP, and upstream admission for conversions.
 """
 
 from __future__ import annotations
@@ -60,7 +60,7 @@ def reserve_ip(
         None, "--billing-catalog-file", metavar="PATH", help="Read --billing-catalog from a JSON file"
     ),
     check_billing: bool = typer.Option(
-        False, "--check-billing", help="Check RESERVED-IP billing eligibility first (same as the global option)"
+        False, "--check-billing", help="Deprecated no-op; upstream decides billing and lifecycle admission."
     ),
 ) -> None:
     """Reserve a new public IP address (billed while reserved)."""
@@ -72,7 +72,7 @@ def reserve_ip(
         site_id=site_id,
         label=label,
         billing_catalog=catalog,
-        check_billing=check_billing or settings.check_billing,
+        check_billing=False,
     )
     print_json(reserved, id_field=ID_FIELD)
 
@@ -93,7 +93,7 @@ def convert_vm_public_ip(
     billing_check: bool = typer.Option(
         True,
         "--billing-check/--no-billing-check",
-        help="Check RESERVED-IP billing eligibility first (default: on; needs the billing.read scope)",
+        help="Deprecated no-op; upstream decides billing and lifecycle admission.",
     ),
 ) -> None:
     """Keep a VM's current public IPv4 as a Reserved IP (VMs outside a VPC).
@@ -103,22 +103,14 @@ def convert_vm_public_ip(
 
     _settings, workspace, client = _session(ctx)
     catalog = load_json_input(billing_catalog, billing_catalog_file, "billing-catalog")
-    try:
-        reserved = client.reserved_ips.convert_vm_public_ip_to_reserved_ip(
-            workspace_id=workspace,
-            vm_id=vm_id,
-            site_id=site_id,
-            label=label,
-            billing_catalog=catalog,
-            billing_check=billing_check,
-        )
-    except ForbiddenError as exc:
-        text = str(getattr(exc, "message", "") or "")
-        if billing_check and (getattr(exc, "required_scope", None) == "billing.read" or "billing.read" in text):
-            exc.cli_hint = (  # type: ignore[attr-defined]
-                "The RESERVED-IP billing check needs the billing.read scope; grant it or pass --no-billing-check."
-            )
-        raise
+    reserved = client.reserved_ips.convert_vm_public_ip_to_reserved_ip(
+        workspace_id=workspace,
+        vm_id=vm_id,
+        site_id=site_id,
+        label=label,
+        billing_catalog=catalog,
+        billing_check=False,
+    )
     print_json(reserved, id_field=ID_FIELD)
 
 

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/src/ibee_cli/commands/secrets.py

@@ -278,8 +278,7 @@ def create_store(
     billing_check: bool = typer.Option(
         True,
         "--billing-check/--no-billing-check",
-        help="Check SECRETMA-STD billing eligibility first, as the portal does (default: on). "
-        "Skipped with a warning when the token lacks billing.read",
+        help="Deprecated no-op; upstream decides billing and lifecycle admission.",
     ),
     if_exists: IfExists = typer.Option(
         IfExists.ERROR,
@@ -299,7 +298,7 @@ def create_store(
                 workspace_id=workspace,
                 name=body["name"],
                 description=body.get("description"),
-                preflight_billing=bool(billing_check or settings.check_billing),
+                preflight_billing=False,
             )
         except ConflictError as exc:
             if if_exists is not IfExists.REUSE or type(exc) is not ConflictError:
@@ -997,8 +996,7 @@ def create_secret(
     billing_check: bool = typer.Option(
         True,
         "--billing-check/--no-billing-check",
-        help="Check SECRETMA-STD billing eligibility first, as the portal does (default: on). "
-        "Skipped with a warning when the token lacks billing.read",
+        help="Deprecated no-op; upstream decides billing and lifecycle admission.",
     ),
 ) -> None:
     """Create a secret in an active store."""
@@ -1016,7 +1014,7 @@ def create_secret(
             workspace_id=workspace,
             secret_name=secret_name,
             value=secret_value,
-            preflight_billing=bool(billing_check or settings.check_billing),
+            preflight_billing=False,
         )
     if settings.structured_output:
         print_json(result)

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/src/ibee_cli/commands/vm_lifecycle.py

@@ -398,7 +398,7 @@ def create_vms(
         ),
     )
     if preflight or getattr(settings, "check_billing", False):
-        common["preflight_billing"] = True
+        common["preflight_billing"] = False
     results = []
     for vm_name, key in zip(names, keys):
         try:
@@ -521,7 +521,7 @@ def delete_vm(
         kwargs = resolve("reserve" if reserve else "release")
     if preflight or getattr(settings, "check_billing", False):
         if kwargs.get("public_ip_action") == "reserve":
-            kwargs["preflight_billing"] = True
+            kwargs["preflight_billing"] = False
     result = _method(resource, spec, "delete")(
         vm_id=vm_id,
         workspace_id=workspace,
@@ -1041,7 +1041,7 @@ def register_vm_lifecycle(app: typer.Typer, spec: VmCommandSpec) -> None:
         billing_catalog: Optional[str] = typer.Option(None, "--billing-catalog", help=SNAPSHOT_SKU_HELP),
         billing_catalog_file: Optional[str] = typer.Option(None, "--billing-catalog-file", help="File with the SKU JSON"),
         preflight: bool = typer.Option(
-            False, "--preflight-billing", help="Check billing eligibility for the SKU first (needs billing.read)"
+            False, "--preflight-billing", help="Deprecated no-op; upstream decides billing and lifecycle admission."
         ),
         requested_by: Optional[str] = typer.Option(None, "--requested-by"),
         check_state: bool = check_state_option(),
@@ -1065,7 +1065,7 @@ def register_vm_lifecycle(app: typer.Typer, spec: VmCommandSpec) -> None:
                 mode=mode,
                 selected_data_volume_ids=selected_data_volume_id,
                 requested_by=requested_by,
-                preflight_billing=True if preflight or getattr(settings, "check_billing", False) else None,
+                preflight_billing=False,
             ),
         )
         snapshot_id = cell(result, "snapshot_set_id") or cell(result, "id")

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/src/ibee_cli/commands/vms.py

@@ -103,7 +103,7 @@ def create_vm(
     ram_mb: Optional[int] = typer.Option(None, "--ram-mb", help="RAM in MB (default: the plan's; must match it)"),
     disk_gb: Optional[int] = typer.Option(None, "--disk-gb", help="Root disk in GB (default: the plan's; must match it)"),
     billing_term: Optional[str] = typer.Option(
-        None, "--billing-term", help="Billing term: " + ", ".join(BILLING_TERMS) + " (default HOURLY, or the plan's first term)"
+        None, "--billing-term", help="Billing term sent to the API: " + ", ".join(BILLING_TERMS) + " (default HOURLY, or the plan's first term); admission is decided upstream"
     ),
     windows_license: Optional[str] = typer.Option(
         None,
@@ -150,7 +150,7 @@ def create_vm(
     preflight: bool = typer.Option(
         False,
         "--preflight-billing",
-        help="Check Billing account status first; upstream create decides affordability (same as --check-billing)",
+        help="Deprecated no-op; upstream decides billing and lifecycle admission.",
     ),
     wait: bool = typer.Option(False, "--wait", help="Poll until the VM is provisioned"),
     timeout: Optional[float] = timeout_option(),
@@ -222,7 +222,7 @@ def delete_vm(
     reserved_ip_billing_catalog_file: Optional[str] = typer.Option(None, "--reserved-ip-billing-catalog-file"),
     requested_by: Optional[str] = typer.Option(None, "--requested-by"),
     preflight: bool = typer.Option(
-        False, "--preflight-billing", help="With --reserve-public-ip, check billing eligibility for the Reserved IP SKU"
+        False, "--preflight-billing", help="Deprecated no-op; upstream decides billing and lifecycle admission."
     ),
     check_state: bool = check_state_option(),
     wait: bool = typer.Option(False, "--wait", help="Poll until the VM is deleted"),

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/src/ibee_cli/helpers.py

@@ -2,8 +2,8 @@
 
 Compute writes (VM create/delete/power, access, resize, and volume actions)
 return `202 + operation_id`; these helpers build idempotency keys, optionally
-poll the operation to a terminal state (`--wait`), run the optional billing
-preflight (`--check-billing`), ask for confirmation of destructive actions,
+poll the operation to a terminal state (`--wait`), retain deprecated no-op billing
+flags, ask for confirmation of destructive actions,
 and parse structured values from the command line.
 """
 
@@ -549,36 +549,8 @@ def preflight_billing(
     estimated_cost_minor: Optional[int | float] = None,
     resource_type: str = "resource",
 ) -> Any:
-    """Portal billing preflight before a billable create, when ``--check-billing`` is set.
-
-    Without ``--check-billing`` (or ``IBEE_CHECK_BILLING``) nothing is called, so a
-    create stays a single request and the API edge alone decides admission. With it,
-    the create continues only when billing answers ``allowed`` exactly ``true``;
-    otherwise ``BillingDeniedError`` is raised (printed with the portal wording, exit 1).
-    """
-
-    if not getattr(settings, "check_billing", False):
-        return None
-    billing = getattr(client, "billing", None)
-    require = getattr(billing, "require_resource_eligibility", None)
-    if callable(require):
-        kwargs: dict[str, Any] = {"workspace_id": workspace_id, "resource_type": resource_type}
-        sku = normalize_sku_code(sku_code)
-        if sku:
-            kwargs["sku_code"] = sku
-        cost = normalize_estimated_cost_minor(estimated_cost_minor)
-        if cost is not None:
-            kwargs["estimated_cost_minor"] = cost
-        return require(**kwargs)
-    decision = check_billing_eligibility(
-        client,
-        workspace_id,
-        sku_code=sku_code,
-        estimated_cost_minor=estimated_cost_minor,
-    )
-    if _field(decision, "allowed") is not True:
-        raise BillingDeniedError(decision=decision, create_type=resource_type)
-    return decision
+    """Deprecated compatibility no-op; the mutation endpoint decides admission."""
+    return None
 
 
 def preflight_create(
@@ -589,24 +561,8 @@ def preflight_create(
     sku_code: Optional[str] = None,
     estimated_cost_minor: Optional[int | float] = None,
 ) -> Any:
-    """``preflight_billing`` for a billable create command, building the client on demand.
-
-    Does nothing (and sends nothing) unless ``--check-billing``/``IBEE_CHECK_BILLING`` is set.
-    """
-
-    if not getattr(settings, "check_billing", False):
-        return None
-    from .context import get_client, require_workspace
-
-    workspace = require_workspace(settings)
-    return preflight_billing(
-        settings,
-        client if client is not None else get_client(settings),
-        workspace,
-        sku_code=sku_code,
-        estimated_cost_minor=estimated_cost_minor,
-        resource_type=resource_type,
-    )
+    """Deprecated compatibility no-op; no client or workspace is resolved."""
+    return None
 
 
 # ---------------------------------------------------------------------------

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/src/ibee_cli/main.py

@@ -87,8 +87,8 @@ def main(
         False,
         "--check-billing",
         help=(
-            "Ask billing before a billable create and stop when it would be denied "
-            "(env IBEE_CHECK_BILLING=1)"
+            "Deprecated no-op; upstream decides mutation admission "
+            "(also applies to IBEE_CHECK_BILLING)"
         ),
     ),
     version: bool = typer.Option(

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/src/ibee_cli/render.py

@@ -495,7 +495,7 @@ def _api_error_lines(exc: ApiError) -> list[str]:
         return [f"Validation failed (422): {message}"]
     if status == 423 or isinstance(exc, OrganizationSuspendedError):
         return [
-            "Organization suspended (423): billing has suspended this organization, "
+            "Organization suspended (423): this organization is suspended, "
             f"so this change is blocked. {message}"
         ]
     if status == 429:

{ibee_cli-0.4.1 → ibee_cli-0.4.2/src/ibee_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ibee-cli
-Version: 0.4.1
+Version: 0.4.2
 Summary: Official command-line interface for the IBEE Solutions cloud platform
 Author-email: IBEE Solutions <support@ibee.ai>
 License-Expression: MIT
@@ -13,7 +13,7 @@ Classifier: Environment :: Console
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: ibee<0.5.0,>=0.4.1
+Requires-Dist: ibee<0.5.0,>=0.4.2
 Requires-Dist: httpx>=0.27
 Requires-Dist: typer>=0.12
 Requires-Dist: click>=8.1
@@ -305,22 +305,15 @@ an interactive hidden prompt, or pipe one line to `--password-stdin`.
 Bucket and VM placement are automatic when `--site-id` is omitted. Use
 `ibee compute sites` and pass `--site-id` only when placement must be pinned.
 
-Billable creates send one product request. The public gateway performs the
-authoritative, fail-closed billing decision before routing; a valid denial is
-returned without calling the product service. `ibee billing eligibility`
-remains available as an optional point-in-time preview, and the global
-`--check-billing` flag (or `IBEE_CHECK_BILLING=1`) runs the portal's preflight
-before a billable create: the create is sent only when billing answers
-`allowed: true`, otherwise the portal's explanation is printed (with top-up
-guidance when adding credits in the portal can resolve it) and the command
-exits 1. The preflight never reserves funds.
-
-For Cloud/GPU VM creates, `--check-billing` / `--preflight-billing` checks Billing's
-account status only. No SKU-only monthly probe or client-calculated price is
-sent. The selected catalog term goes to the create API, where the upstream
-catalog quote and Billing decide affordability before provisioning. A passing
-preflight is not purchase approval. CLI 0.4.1 requires Python SDK 0.4.1 or later;
-the CLI delegates to it and does not implement its own pricing policy.
+All product writes reach the upstream API for fresh Billing and lifecycle decisions.
+The CLI never queries billing eligibility or calculates an admission estimate automatically.
+Legacy `--check-billing`, `--preflight-billing`, NAT `--preflight`,
+`--billing-check/--no-billing-check`, and `IBEE_CHECK_BILLING` are deprecated no-ops.
+Structural, workspace, state, scope and destructive-action checks remain in place.
+`ibee billing eligibility` is an explicit diagnostic query: `allowed: false` is data (exit 0);
+the explicit `--require` option retains exit 1 on denial.
+It supports `REVOKE_CREDENTIAL` and `SECURITY_RECOVERY`.
+Upstream errors retain their classification; suspension messages do not infer who suspended an organization.
 
 Load balancers take backends, routing, policy, health checks and L7 rules either
 as flags (`--backend TYPE:TARGET:PORT[:WEIGHT][:tls]`, `--rule
@@ -413,7 +406,7 @@ on) controls the read-only checks that need the current state.
 - **NAT gateways** exist only in `nat_gateway` VPCs (one per VPC; `nat create`
   prints the existing one instead of sending a create). A Reserved IP must be in
   the VPC's site, unattached and `reserved`. `--preflight` (or `--check-billing`)
-  checks NAT-GATEWAY eligibility first. `nat delete` shows how many NAT VMs lose
+  is a deprecated no-op; upstream decides admission. `nat delete` shows how many NAT VMs lose
   outbound internet and how many forwarding rules are deleted before it asks;
   `--ip-action reserve` of a platform-assigned IP needs `--billing-catalog` (the
   RESERVED-IP SKU); deletion is refused while a virtual IP holds a Reserved IP.
@@ -429,8 +422,8 @@ on) controls the read-only checks that need the current state.
   253 characters (`--reverse-dns ""` clears it); `release` is refused while
   attached; `attach` is for unattached IPs (`move` for an IP on another VM,
   `--detach-from-service` for one on a NAT gateway or virtual IP); an attach to a VM
-  outside a VPC points at `reserved-ips convert`. `convert` runs the RESERVED-IP
-  billing check first (`--no-billing-check` skips it; it needs `billing.read`).
+  outside a VPC points at `reserved-ips convert`. The API decides admission for
+  `convert`.
 - **Firewalls**: group names are unique in any case (1-120 characters) and
   customers cannot create default groups. Rules: tcp and udp need `--port` (22 or
   8000-8080), icmp and any take none; sources are IPv4 addresses or CIDRs (a bare
@@ -495,8 +488,7 @@ for confirmation, the read-only checks run first (`--no-check-state` skips them)
   timeout). `purge` needs `--mode`; `--mode all` asks first; only the selector for the
   mode is accepted (`--path` 1-30, https URLs only; `--hostname`, `--tag`, `--prefix`
   1-100). A purge the CDN reports as failed exits 1.
-- `--check-billing` (or `--preflight-billing`) checks OBJECTST-STD before a bucket or
-  S3 credential create and CUSTOMDO-STD before a custom domain.
+- `--check-billing` and `--preflight-billing` are deprecated no-ops for storage and CDN.
 - `block-storage create --vm-type`/`--delete-on-termination`, the Block Storage delete
   idempotency key, `cdn cache-policies` and `cdn metrics` are not yet part of the
   published API contract; behaviour may change. Block Storage plans, bucket emptying,
@@ -527,10 +519,7 @@ inputs first.
   values are refused. In `patch-value`, a JSON `null` deletes that key. `--cas` is an
   integer >= 0; a check-and-set mismatch is reported as a conflict and never retried.
   `list` sends a trimmed `--query` (at most 128 characters) only when it is not blank.
-- **Billing**: `stores create` and `secrets create` check SECRETMA-STD eligibility
-  first, as the portal does (`--no-billing-check` turns it off; the global
-  `--check-billing` forces it on). When the token lacks `billing.read` the check is
-  skipped with a warning, because the API still enforces billing on the create.
+- **Billing**: store and secret writes use upstream admission. Both legacy billing-check flags are no-ops.
 - **Batch create**: every item follows the `secrets create` rules and the error names
   its index. Duplicate names are reported (the API skips them). A file with more than
   500 secrets or over 64 KiB is sent as consecutive requests and the results are
@@ -571,7 +560,7 @@ inputs first.
 | `-o`, `--output` | `IBEE_OUTPUT` | `table`, `json`, `yaml` or `id` |
 | `--json` | | Same as `-o json` |
 | `--yes`, `-y` | `IBEE_ASSUME_YES=1` | Answer yes to every confirmation |
-| `--check-billing` | `IBEE_CHECK_BILLING=1` | Billing preflight before billable creates |
+| `--check-billing` | `IBEE_CHECK_BILLING=1` | Deprecated no-op; upstream decides admission |
 
 Without `-o`, each command keeps its usual format (tables for most lists, JSON
 for single resources and operation results). `-o yaml` prints YAML and `-o id`

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/src/ibee_cli.egg-info/requires.txt

@@ -1,4 +1,4 @@
-ibee<0.5.0,>=0.4.1
+ibee<0.5.0,>=0.4.2
 httpx>=0.27
 typer>=0.12
 click>=8.1

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/tests/test_billing_preflight.py

@@ -16,6 +16,37 @@ runner = CliRunner()
 BASE_ARGS = ["--token", "test-token", "--workspace", "973318"]
 
 
+@pytest.mark.parametrize("flag", [[], ["--check-billing"]])
+@pytest.mark.parametrize("status,code", [
+    (402, "billing_denied"), (403, "organization_restricted"),
+    (423, "organization_suspended"), (403, "key_revoked"),
+    (403, "workspace_not_allowed"), (403, "insufficient_scope"),
+])
+def test_mutation_errors_are_upstream_and_suspension_is_source_neutral(gw, flag, status, code):
+    gw.on("POST", "secret-store/stores", (status, {
+        "error": code, "message": "Admin lifecycle decision",
+        "enforcement_source": "ADMIN", "billing_reason": "insufficient_balance",
+        "required_scope": "secret_store.write",
+    }))
+    result = runner.invoke(app, [*BASE_ARGS, *flag, "secrets", "stores", "create", "app"])
+    assert result.exit_code == 1, result.output
+    assert [c.path for c in gw.writes()] == ["secret-store/stores"]
+    if status == 423:
+        assert "Organization suspended (423)" in result.output
+        assert "billing has suspended" not in result.output.lower()
+
+
+@pytest.mark.parametrize("operation", ["REVOKE_CREDENTIAL", "SECURITY_RECOVERY"])
+def test_explicit_lifecycle_eligibility_returns_denial_as_data(gw, monkeypatch, operation):
+    monkeypatch.setattr(billing, "get_client", lambda _settings: gw.client())
+    gw.on("POST", "billing/resource-eligibility", {
+        "organization_id": "org", "allowed": False, "reason": "upstream", "operation": operation,
+    })
+    result = runner.invoke(app, [*BASE_ARGS, "billing", "eligibility", "--operation", operation])
+    assert result.exit_code == 0, result.output
+    assert gw.last("POST", "billing/resource-eligibility").json == {"operation": operation}
+
+
 class Billing:
     def __init__(self, calls, response=None):
         self.calls = calls
@@ -89,7 +120,7 @@ def test_vm_preflight_uses_upstream_status_and_preserves_create_denial(gw, monke
                                 "--site-id", "site-1", "--plan-id", "plan", "--template-id", "image",
                                 "--billing-term", "HOURLY"])
     assert result.exit_code == (1 if denied else 0), result.output
-    assert gw.last("POST", "billing/resource-eligibility").json == {}
+    assert not any(c.path == "billing/resource-eligibility" for c in gw.calls)
     creates = [c for c in gw.calls if c.method == "POST" and c.path == f"compute/{family}-vms"]
     assert len(creates) == 1
     assert creates[0].json["billing_catalog"]["billing_interval"] == "HOURLY"
@@ -157,8 +188,8 @@ def test_secret_store_and_secret_create_run_the_portal_billing_preflight(monkeyp
         result = runner.invoke(app, [*BASE_ARGS, *secret_args, *extra])
         assert result.exit_code == 0, result.output
     assert [(name, kwargs["preflight_billing"]) for name, kwargs in resource_calls] == [
-        ("store", True),
-        ("secret", True),
+        ("store", False),
+        ("secret", False),
         ("store", False),
         ("secret", False),
     ]
@@ -168,4 +199,4 @@ def test_secret_store_and_secret_create_run_the_portal_billing_preflight(monkeyp
         app, [*BASE_ARGS, "--check-billing", "secrets", "stores", "create", "production", "--no-billing-check"]
     )
     assert result.exit_code == 0, result.output
-    assert resource_calls[0][1]["preflight_billing"] is True
+    assert resource_calls[0][1]["preflight_billing"] is False

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/tests/test_block_storage_cdn_commands.py

@@ -618,8 +618,7 @@ def test_domain_create_check_billing_uses_custom_domain_sku(gw):
     gw.on("POST", f"{D}/custom-domains", {"domain": "cdn.example.com", "status": "pending_validation"})
     result = run(["--check-billing", "cdn", "domains", "create", "dist-1", "cdn.example.com"])
     assert result.exit_code == 0, result.output
-    body = gw.last("POST", "billing/resource-eligibility").json
-    assert body["sku_code"] == "CUSTOMDO-STD" and body["estimated_cost_minor"] == 19900
+    assert not any(c.path == "billing/resource-eligibility" for c in gw.calls)
 
 
 def test_domain_path_is_normalised(gw):
@@ -729,11 +728,11 @@ def test_purge_success_false_exits_1(gw):
 
 def test_cdn_create_check_billing_denial_stops_before_create(gw):
     gw.on("GET", "object-storage/buckets/b1", {"name": "b1", "region": "r", "is_public": True})
-    gw.on("POST", "billing/resource-eligibility",
-          {"allowed": False, "reason": "insufficient_balance", "organization_id": "org-1"})
+    gw.on("POST", "cdn/distributions", (402, {"error": "billing_denied", "billing_reason": "insufficient_balance"}))
     result = run(["--check-billing", "cdn", "create", "site-cdn", "--origin-id", "b1"])
     assert result.exit_code == 1
-    assert not any(c.path == "cdn/distributions" for c in gw.calls)
+    assert any(c.path == "cdn/distributions" for c in gw.calls)
+    assert not any(c.path == "billing/resource-eligibility" for c in gw.calls)
 
 
 def test_cdn_edge_billing_denial_prints_portal_copy(gw):

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/tests/test_cli.py

@@ -37,7 +37,7 @@ def test_help_lists_command_groups():
 def test_version():
     result = runner.invoke(app, ["--version"])
     assert result.exit_code == 0
-    assert "ibee-cli 0.4.1" in result.output
+    assert "ibee-cli 0.4.2" in result.output
 
 
 def test_subcommand_help():

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/tests/test_foundations.py

@@ -14,6 +14,7 @@ from click import unstyle
 from typing import List, Optional
 
 import typer
+from ibee.billing import TOPUP_GUIDANCE
 from ibee.errors import error_from_response
 from typer.models import TyperInfo
 from typer.testing import CliRunner
@@ -434,7 +435,34 @@ def test_edge_billing_denial_prints_portal_copy_and_topup(probe):
     assert "Your available wallet balance does not cover this CDN distribution" in output
     assert "reason=insufficient_balance" in output
     assert "admission_context_id=adm-9" in output
-    assert "Add credits in the IBEE portal" in output
+    assert "Review billing for available actions" in output
+    assert "add credits" not in output.lower()
+
+
+def test_edge_billing_denial_topup_guidance_follows_allowed_operations(probe):
+    http = probe
+    denial = {
+        "error": "billing_denied",
+        "billing_reason": "insufficient_balance",
+        "billing_sku_code": "CDN-1",
+        "admission_context_id": "adm-9",
+    }
+    http.responses = [FakeResponse({**denial, "allowed_operations": ["billing_topup"]}, 402)]
+    result = run([*GATEWAY, *call("POST", "cdn/distributions", CDN_BODY)])
+    assert result.exit_code == 1
+    output = plain(result)
+    assert "Your available wallet balance does not cover this CDN distribution" in output
+    assert "You can add credits in the IBEE portal" in output
+    assert TOPUP_GUIDANCE in output
+
+    for extra in ({}, {"allowed_operations": ["billing_review"]}):
+        http.responses = [FakeResponse({**denial, **extra}, 402)]
+        result = run([*GATEWAY, *call("POST", "cdn/distributions", CDN_BODY)])
+        assert result.exit_code == 1
+        output = plain(result)
+        assert "reason=insufficient_balance" in output
+        assert "add credits" not in output.lower()
+        assert TOPUP_GUIDANCE not in output
 
 
 def test_service_error_shows_request_id(probe):
@@ -654,7 +682,7 @@ def test_check_billing_asks_the_sdk_to_preflight_the_plan_sku(monkeypatch):
     # The SDK checks the plan's SKU and cost itself, so no SKU-less CLI preflight is sent.
     assert calls == []
     assert [name for name, _ in vms_fake.calls] == ["create"]
-    assert vms_fake.calls[0][1]["preflight_billing"] is True
+    assert vms_fake.calls[0][1]["preflight_billing"] is False
 
 
 def test_check_billing_denial_blocks_create(monkeypatch):
@@ -663,7 +691,7 @@ def test_check_billing_denial_blocks_create(monkeypatch):
     class DenyingVms(FakeVms):
         def create_cloud_vm(self, **kwargs):
             self.calls.append(("create", kwargs))
-            assert kwargs["preflight_billing"] is True
+            assert kwargs["preflight_billing"] is False
             raise BillingDeniedError(
                 decision={"allowed": False, "reason": "initial_topup_required"}, create_type="vm"
             )
@@ -673,8 +701,10 @@ def test_check_billing_denial_blocks_create(monkeypatch):
     result = run(CREATE_ARGS, env={"IBEE_CHECK_BILLING": "1"})
     assert result.exit_code == 1
     output = plain(result)
-    assert "Add at least ₹2,000 to your wallet before creating your first cloud VM." in output
-    assert "Add credits in the IBEE portal" in output
+    assert "Billing requires an initial wallet top-up before creating your first cloud VM." in output
+    assert "Review billing for available actions" in output
+    assert "₹" not in output
+    assert "add credits" not in output.lower()
 
 
 def test_check_billing_falls_back_to_check_with_exact_true_gate():
@@ -683,9 +713,8 @@ def test_check_billing_falls_back_to_check_with_exact_true_gate():
     billing_fake = FakeBilling({"allowed": "true", "reason": "ok"})
     settings = SimpleNamespace(check_billing=True)
     client = SimpleNamespace(billing=billing_fake)
-    with pytest.raises(BillingDeniedError):
-        helpers.preflight_billing(settings, client, "973318", resource_type="gpu_vm")
-    assert [name for name, _ in billing_fake.calls] == ["check"]
+    assert helpers.preflight_billing(settings, client, "973318", resource_type="gpu_vm") is None
+    assert billing_fake.calls == []
 
 
 def test_preflight_create_uses_require_eligibility():
@@ -694,10 +723,8 @@ def test_preflight_create_uses_require_eligibility():
     calls = []
     client = SimpleNamespace(billing=RequireBilling(calls, allowed=False, reason="unknown_sku"))
     settings = SimpleNamespace(check_billing=True, workspace="973318")
-    with pytest.raises(BillingDeniedError) as info:
-        helpers.preflight_create(settings, "cdn", client=client)
-    assert "could not be verified" in str(info.value)
-    assert calls[0][1]["resource_type"] == "cdn"
+    assert helpers.preflight_create(settings, "cdn", client=client) is None
+    assert calls == []
     assert helpers.preflight_create(SimpleNamespace(check_billing=False), "cdn") is None
 
 
@@ -724,7 +751,8 @@ def test_billing_eligibility_require_exit_codes(monkeypatch):
     assert run(["billing", "eligibility"]).exit_code == 0
     result = run(["billing", "eligibility", "--require"])
     assert result.exit_code == 1
-    assert "Add credits in the IBEE portal" in plain(result)
+    assert "Review billing for available actions" in plain(result)
+    assert "add credits" not in plain(result).lower()
 
     billing_fake.decision = {"allowed": True, "reason": "ok"}
     assert run(["billing", "eligibility", "--require"]).exit_code == 0

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/tests/test_networking_parity_commands.py

@@ -291,19 +291,19 @@ def test_nat_create_warns_without_catalog_and_runs_preflight(gw):
     result = ok(run(["vpcs", "nat", "create", "vpc-1", "--preflight"]))
     assert "not be metered" in plain(result)
     assert [(c.method, c.path) for c in gw.writes()] == [
-        ("POST", "billing/resource-eligibility"),
         ("POST", f"{V}/nat-gateways"),
     ]
-    assert gw.writes()[0].json == {"sku_code": "NAT-GATEWAY"}
+    assert not any(c.path == "billing/resource-eligibility" for c in gw.calls)
     assert gw.last("POST", f"{V}/nat-gateways").json == {"name": "NAT Gateway"}
 
 
 def test_nat_create_global_check_billing_denial(gw):
     gw.on("GET", V, vpc())
-    gw.on("POST", "billing/resource-eligibility", decision("NAT-GATEWAY", False, "insufficient_balance"))
+    gw.on("POST", f"{V}/nat-gateways", (402, {"error": "billing_denied", "billing_reason": "insufficient_balance"}))
     result = run(["--check-billing", "vpcs", "nat", "create", "vpc-1", "--billing-catalog", json.dumps(NAT_CATALOG)])
     assert result.exit_code == 1, result.output
-    assert "Add credits" in plain(result)
+    assert "Review billing for available actions" in plain(result)
+    assert "add credits" not in plain(result).lower()
     assert not gw.requests("POST")[1:]
 
 
@@ -532,7 +532,7 @@ def test_reserve_ip_body_and_billing_check(gw):
     result = ok(run(["reserved-ips", "reserve", "--site-id", " site-1 ", "--label", "  edge  ", "--billing-catalog",
                      json.dumps({**RIP_CATALOG, "billing_options": [1]}), "--check-billing"]))
     assert json.loads(result.output)["public_ip_id"] == "rip-1"
-    assert gw.writes()[0].json == {"sku_code": "RESERVED-IP"}
+    assert not any(c.path == "billing/resource-eligibility" for c in gw.calls)
     assert gw.last("POST", "networking/reserved-ips").json == {
         "site_id": "site-1",
         "label": "edge",
@@ -559,14 +559,15 @@ def test_reserve_ip_edge_denial_names_the_reserved_ip(gw):
     result = run(["reserved-ips", "reserve", "--site-id", "site-1"])
     assert result.exit_code == 1
     assert "does not cover this Reserved IP" in plain(result)
-    assert "Add credits in the IBEE portal" in plain(result)
+    assert "Review billing for available actions" in plain(result)
+    assert "add credits" not in plain(result).lower()
 
 
 def test_convert_runs_billing_check_by_default(gw):
     gw.on("POST", "billing/resource-eligibility", decision("RESERVED-IP"))
     gw.on("POST", "networking/reserved-ips/convert", rip(allocation_method="converted"))
     ok(run(["reserved-ips", "convert", "--vm-id", "vm-1", "--site-id", "site-1", "--label", "web"]))
-    assert [c.path for c in gw.writes()] == ["billing/resource-eligibility", "networking/reserved-ips/convert"]
+    assert [c.path for c in gw.writes()] == ["networking/reserved-ips/convert"]
     assert gw.last("POST", "networking/reserved-ips/convert").json == {
         "vm_id": "vm-1", "site_id": "site-1", "label": "web"
     }
@@ -576,10 +577,10 @@ def test_convert_runs_billing_check_by_default(gw):
 
 
 def test_convert_billing_denial_stops_before_convert(gw):
-    gw.on("POST", "billing/resource-eligibility", decision("RESERVED-IP", False, "initial_topup_required"))
+    gw.on("POST", "networking/reserved-ips/convert", (402, {"error": "billing_denied", "billing_reason": "initial_topup_required"}))
     result = run(["reserved-ips", "convert", "--vm-id", "vm-1", "--site-id", "site-1"])
     assert result.exit_code == 1
-    assert [c.path for c in gw.writes()] == ["billing/resource-eligibility"]
+    assert [c.path for c in gw.writes()] == ["networking/reserved-ips/convert"]
 
 
 def test_release_refuses_while_attached(gw):
@@ -770,7 +771,7 @@ def test_create_l7_rules_sticky_and_billing_check(gw):
     ok(run(["--check-billing", "load-balancers", "create-l7", "web", "--protocol", "https", "--backend",
             "service:api:8080", "--sticky-header", "X-User-ID", "--rule", "1:/", "--rule", "2:/api:X-Env=beta",
             "--health-check-path", "/ready"]))
-    assert gw.writes()[0].json == {"sku_code": "LOADBALA-STD"}
+    assert not any(c.path == "billing/resource-eligibility" for c in gw.calls)
     body = gw.last("POST", f"{LB}/l7").json
     assert body["routing"] == {"sticky_header": "X-User-ID"}
     assert body["rules"] == [

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/tests/test_object_storage_commands.py

@@ -103,7 +103,7 @@ def test_create_bucket_preflight_uses_object_storage_sku(gw):
     gw.on("POST", B, bucket())
     result = run(["buckets", "create", "assets", "--region", "r1", "--preflight-billing"])
     assert result.exit_code == 0, result.output
-    assert gw.last("POST", "billing/resource-eligibility").json["sku_code"] == "OBJECTST-STD"
+    assert not any(c.path == "billing/resource-eligibility" for c in gw.calls)
 
 
 def test_list_buckets_table_and_next_page_hint(gw):

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/tests/test_review_fixes.py

@@ -200,11 +200,12 @@ def test_firewall_summary_page_of_exactly_100_checks_for_more(gw):
 
 
 def test_reserved_ip_convert_without_billing_scope_points_at_the_flag(gw):
-    gw.on("POST", "billing/resource-eligibility", SCOPE_403("billing.read"))
+    gw.on("POST", "networking/reserved-ips/convert", SCOPE_403("networking.write"))
     result = run(["reserved-ips", "convert", "--vm-id", "vm-1", "--site-id", "site-1"])
     assert result.exit_code == 1
-    assert "--no-billing-check" in plain(result)
-    assert all(c.path != "networking/reserved-ips/convert" for c in gw.calls)
+    assert "networking.write" in plain(result)
+    assert "--no-billing-check" not in plain(result)
+    assert [c.path for c in gw.writes()] == ["networking/reserved-ips/convert"]
 
 
 @pytest.mark.parametrize(

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/tests/test_secret_store_commands.py

@@ -168,17 +168,16 @@ def test_store_create_runs_billing_preflight_then_creates_trimmed_name(gw):
     gw.on("POST", ELIGIBILITY, {"allowed": True, "reason": "ok", "sku_code": "SECRETMA-STD", "organization_id": "org"})
     gw.on("POST", S, store())
     result = ok(run(["secrets", "stores", "create", "  Production  ", "-d", " main "]))
-    assert [(c.method, c.path) for c in gw.calls] == [("POST", ELIGIBILITY), ("POST", S)]
-    assert gw.last("POST", ELIGIBILITY).json["sku_code"] == "SECRETMA-STD"
+    assert [(c.method, c.path) for c in gw.calls] == [("POST", S)]
     assert gw.last("POST", S).json == {"name": "Production", "description": "main"}
     assert "created" in plain(result)
 
 
 def test_store_create_billing_denied_sends_no_create(gw):
-    gw.on("POST", ELIGIBILITY, {"allowed": False, "reason": "insufficient_balance", "sku_code": "SECRETMA-STD", "organization_id": "org"})
+    gw.on("POST", S, (402, {"error": "billing_denied", "billing_reason": "insufficient_balance"}))
     result = run(["secrets", "stores", "create", "Production"])
     assert result.exit_code == 1, result.output
-    assert [c.path for c in gw.calls] == [ELIGIBILITY]
+    assert [c.path for c in gw.calls] == [S]
     assert "402" in plain(result) or "Payment" in plain(result)
 
 
@@ -186,7 +185,8 @@ def test_store_create_skips_billing_check_without_billing_read(gw):
     gw.on("POST", ELIGIBILITY, (403, {"error": "insufficient_scope", "required_scope": "billing.read"}))
     gw.on("POST", S, store())
     result = ok(run(["secrets", "stores", "create", "Production"]))
-    assert "Billing preflight skipped" in plain(result)
+    assert "Billing preflight skipped" not in plain(result)
+    assert not any(c.path == ELIGIBILITY for c in gw.calls)
     assert gw.last("POST", S).json == {"name": "Production"}
 
 
@@ -332,7 +332,7 @@ def test_secret_create_normalizes_name_and_runs_preflight(gw):
     result = ok(run(["secrets", "create", "-s", "store-1", "-n", " DB-URL ", "--value", '{" url ":"postgres://x"}']))
     assert gw.last("POST", f"{S}/store-1/secrets").json == {"secret_name": "db-url", "value": {"url": "postgres://x"}}
     assert "normalized to 'db-url'" in plain(result)
-    assert [c.path for c in gw.calls] == [ELIGIBILITY, f"{S}/store-1/secrets"]
+    assert [c.path for c in gw.calls] == [f"{S}/store-1/secrets"]
 
 
 @pytest.mark.parametrize(

{ibee_cli-0.4.1 → ibee_cli-0.4.2}/tests/test_vm_parity_commands.py

@@ -125,7 +125,7 @@ def test_gpu_create_takes_shape_from_plan(sdk):
     name, args, kwargs = sdk.calls[0]
     assert name == "create_gpu_vm"
     assert "gpu_model" not in kwargs and "gpu_count" not in kwargs
-    assert kwargs["preflight_billing"] is True
+    assert kwargs["preflight_billing"] is False
     assert kwargs["idempotency_key"].startswith("cli-gpu-create-train-")
     assert_sdk_transport("gpu_vms", name, args, kwargs)
 
@@ -283,7 +283,7 @@ def test_delete_reserve_flag_with_preflight(sdk):
     assert result.exit_code == 0, result.output
     kwargs = sdk.calls[-1][2]
     assert (kwargs["public_ip_action"], kwargs["reserved_ip_label"], kwargs["preflight_billing"]) == (
-        "reserve", "keep", True
+        "reserve", "keep", False
     )
 
 
@@ -497,7 +497,7 @@ def test_snapshot_create_from_file_waits_for_success(sdk, tmp_path):
     (create, c_args, c_kwargs), (wait, w_args, w_kwargs) = sdk.calls
     assert create == "create_gpu_vm_snapshot"
     assert c_kwargs["billing_catalog"] == SNAP_SKU
-    assert c_kwargs["preflight_billing"] is True
+    assert c_kwargs["preflight_billing"] is False
     assert_sdk_transport("gpu_vms", create, c_args, c_kwargs)
     assert wait == "wait_for_gpu_vm_snapshot"
     assert w_args == ("snap-1",)