plans.yaml

# plans.yaml — plan definitions, limits, and pricing for instant.dev
#
# This file is the single source of truth for all plan configuration.
# Edit it to change limits or prices without touching any Go code.
#
# Limits of -1 mean unlimited.
# Prices are in cents (USD). 4900 = $49.00/month (Pro).

plans:
  anonymous:
    display_name: "Anonymous"
    audience: "pre-claim"
    price_monthly_cents: 0
    limits:
      provisions_per_day: 5
      postgres_storage_mb: 10
      postgres_connections: 2
      vector_storage_mb: 10
      vector_connections: 2
      redis_memory_mb: 5
      redis_commands_per_day: 1000
      mongodb_storage_mb: 5
      mongodb_connections: 2
      mongodb_ops_per_minute: 100
      queue_storage_mb: 1024
      queue_count: -1
      storage_storage_mb: 10
      webhook_requests_stored: 100
      team_members: 1
      vault_max_entries: 0
      vault_envs_allowed: []
      deployments_apps: 0
      # Backups: anonymous tier has no backup retention and cannot restore.
      # The worker's scheduled backup job skips anonymous rows; manual backups
      # are 402'd up front.
      backup_retention_days: 0
      backup_restore_enabled: false
      manual_backups_per_day: 0
      # FIX-H #Q50 — RPO/RTO surfaced on /api/v1/capabilities.
      rpo_minutes: 0
      rto_minutes: 0
      # FIX-G (2026-05-14): per-count cap on custom domains. The boolean
      # custom_domains feature flag still gates the route entirely; this
      # cap enforces how many hostnames a team may bind once unlocked.
      custom_domains_max: 0
    features:
      alerts: false
      custom_domains: false
      sla: false

  # `free` shares anonymous's exact limits and 24h TTL — the only difference is
  # audience. `anonymous` is for pre-claim agents (no team_id). `free` is for
  # claimed-but-unpaid teams (team_id set, no Razorpay subscription). The
  # pay-from-day-one policy still applies: the reaper deletes both at 24h.
  free:
    display_name: "Free"
    audience: "registered"
    price_monthly_cents: 0
    limits:
      provisions_per_day: 5
      postgres_storage_mb: 10
      postgres_connections: 2
      vector_storage_mb: 10
      vector_connections: 2
      redis_memory_mb: 5
      redis_commands_per_day: 1000
      mongodb_storage_mb: 5
      mongodb_connections: 2
      mongodb_ops_per_minute: 100
      queue_storage_mb: 1024
      queue_count: -1
      storage_storage_mb: 10
      webhook_requests_stored: 100
      team_members: 1
      vault_max_entries: 0
      vault_envs_allowed: []
      deployments_apps: 0
      # Mirror anonymous — free is claimed-but-unpaid, same pay-from-day-one
      # policy applies. No backups, no restore.
      backup_retention_days: 0
      backup_restore_enabled: false
      manual_backups_per_day: 0
      # FIX-H #Q50 — RPO/RTO surfaced on /api/v1/capabilities.
      rpo_minutes: 0
      rto_minutes: 0
      # FIX-G (2026-05-14): per-count cap on custom domains. The boolean
      # custom_domains feature flag still gates the route entirely; this
      # cap enforces how many hostnames a team may bind once unlocked.
      custom_domains_max: 0
    features:
      alerts: false
      custom_domains: false
      sla: false

  hobby:
    display_name: "Hobby"
    price_monthly_cents: 900
    limits:
      provisions_per_day: -1
      postgres_storage_mb: 1024
      postgres_connections: 8
      vector_storage_mb: 500
      vector_connections: 5
      redis_memory_mb: 50
      redis_commands_per_day: 10000
      mongodb_storage_mb: 100
      mongodb_connections: 5
      mongodb_ops_per_minute: 1000
      queue_storage_mb: 5120
      queue_count: 3
      storage_storage_mb: 512
      webhook_requests_stored: 1000
      team_members: 1
      vault_max_entries: 20
      vault_envs_allowed: ["production"]
      deployments_apps: 1
      # Hobby: 7-day retention, 1 manual backup per day, no self-serve restore.
      # The "no restore" is a deliberate Pro upgrade lever — the dashboard
      # shows a sales nudge on the restore CTA. Hobby customers who need to
      # recover production data must upgrade to Pro for self-serve restore.
      backup_retention_days: 7
      backup_restore_enabled: false
      manual_backups_per_day: 1
      # FIX-H #Q50 — RPO/RTO surfaced on /api/v1/capabilities.
      rpo_minutes: 1440
      rto_minutes: 30
      # FIX-G (2026-05-14): per-count cap on custom domains. The boolean
      # custom_domains feature flag still gates the route entirely; this
      # cap enforces how many hostnames a team may bind once unlocked.
      custom_domains_max: 0
    features:
      alerts: true
      custom_domains: false
      sla: false

  # hobby_plus — $19/mo mid-step between Hobby ($9) and Pro ($49). W11
  # mid-tier insertion (2026-05-13). Research-backed pricing decoy: a
  # triple-tier $9/$19/$49 lifts conversion ~22% vs $9/$49 by anchoring
  # against the middle price.
  #
  # PUBLIC VISIBILITY (intentional, 2026-05-15):
  # hobby_plus is API-only — it appears on /api/v1/capabilities (so agents
  # introspecting tiers see the full ladder) but does NOT appear on the
  # public /pricing page or marketing homepage. The marketing surface stays
  # Anonymous / Hobby / Pro / Team to keep the customer-facing comparison
  # uncluttered; hobby_plus is reached only via in-product upsell flows
  # (quota wall, custom-domain prompts). Dashboard PricingGrid renders it
  # only inside an authenticated upgrade journey, never on /pricing.
  # If/when hobby_plus becomes a primary outbound funnel, surface it on
  # instanode-web/src/pages/PricingPage.tsx (TierKey union + TIERS array
  # + ROWS column) and dashboard/src/components/PricingGrid.tsx in lock-step.
  #
  # The headline differentiators vs hobby:
  #   - 2 deployment apps (vs hobby's 1) — agents that ship two services
  #     (frontend + worker) no longer need to skip-upgrade to Pro for
  #     deployment headroom alone.
  #   - custom_domains: true — first paid tier where the custom-domain
  #     flow unlocks. The $10 step-up from hobby buys you a vanity URL.
  #   - 5 GB object storage (vs hobby's 512 MB) — meaningful headroom
  #     for content-heavy side projects without leaping to pro's 10 GB.
  #   - 50 vault entries with multi-env (dev/staging/prod) vs hobby's
  #     20 production-only — first tier with the multi-env workflow.
  # Razorpay plan IDs are placeholders (RAZORPAY_PLAN_ID_HOBBY_PLUS,
  # RAZORPAY_PLAN_ID_HOBBY_PLUS_ANNUAL) — operator must create the
  # Razorpay subscription plans before checkout will work for this tier.
  hobby_plus:
    display_name: "Hobby Plus"
    price_monthly_cents: 1900
    limits:
      provisions_per_day: -1
      postgres_storage_mb: 1024
      postgres_connections: 8
      vector_storage_mb: 1024
      vector_connections: 8
      redis_memory_mb: 50
      redis_commands_per_day: 10000
      mongodb_storage_mb: 1024
      mongodb_connections: 5
      mongodb_ops_per_minute: 1000
      queue_storage_mb: 5120
      queue_count: 5
      storage_storage_mb: 5120
      webhook_requests_stored: 5000
      team_members: 1
      vault_max_entries: 50
      # 2026-05-15: multi-env vault rolled back to production-only.
      # Multi-env workflows (vault copy, stack promote, env families,
      # twin/bulk-twin, pause/resume) are now Pro+ only — Hobby Plus stays
      # a quiet upsell on storage + restore + custom domain rather than
      # its own marquee multi-env tier. See multiEnvTierAllowed in
      # api/internal/handlers/stack.go for the corresponding code gate.
      vault_envs_allowed: ["production"]
      deployments_apps: 2
      # Backups: 14-day retention sits between hobby's 7 and pro's 30.
      # Restore is enabled — hobby_plus is the cheapest tier with
      # self-serve restore. This makes "Restore your data" the second
      # most concrete reason to upgrade from hobby (after custom domains).
      backup_retention_days: 14
      backup_restore_enabled: true
      manual_backups_per_day: 5
      # FIX-H #Q50 — RPO/RTO surfaced on /api/v1/capabilities.
      rpo_minutes: 1440
      rto_minutes: 30
      # FIX-G (2026-05-14): per-count cap on custom domains. The boolean
      # custom_domains feature flag still gates the route entirely; this
      # cap enforces how many hostnames a team may bind once unlocked.
      custom_domains_max: 1
    features:
      alerts: true
      custom_domains: true
      sla: false

  # hobby_plus_yearly — $199/yr ≈ $16.58/mo (about 1.5 months free).
  # Sits between hobby's "save 1 month" (~8%) and pro/team's
  # "2 months free" (~17%) so the savings ladder reads:
  #   Hobby $9 → save 1 month / Hobby Plus $19 → save ~1.5 months /
  #   Pro $49 → save 2 months.
  hobby_plus_yearly:
    display_name: "Hobby Plus (yearly)"
    price_monthly_cents: 19900
    billing_period: "yearly"
    limits:
      provisions_per_day: -1
      postgres_storage_mb: 1024
      postgres_connections: 8
      vector_storage_mb: 1024
      vector_connections: 8
      redis_memory_mb: 50
      redis_commands_per_day: 10000
      mongodb_storage_mb: 1024
      mongodb_connections: 5
      mongodb_ops_per_minute: 1000
      queue_storage_mb: 5120
      queue_count: 5
      storage_storage_mb: 5120
      webhook_requests_stored: 5000
      team_members: 1
      vault_max_entries: 50
      # Mirror hobby_plus monthly: multi-env rolled back to production-only.
      vault_envs_allowed: ["production"]
      deployments_apps: 2
      backup_retention_days: 14
      backup_restore_enabled: true
      manual_backups_per_day: 5
      # FIX-H #Q50 — RPO/RTO surfaced on /api/v1/capabilities.
      rpo_minutes: 1440
      rto_minutes: 30
      # FIX-G (2026-05-14): per-count cap on custom domains. The boolean
      # custom_domains feature flag still gates the route entirely; this
      # cap enforces how many hostnames a team may bind once unlocked.
      custom_domains_max: 1
    features:
      alerts: true
      custom_domains: true
      sla: false

  # hobby_yearly — same limits + features as hobby. Annual billing only,
  # ~17% cheaper than 12x monthly ($90/yr vs $108). The Razorpay webhook
  # maps this plan_id back to the canonical "hobby" tier (CanonicalTier),
  # so existing limits resolution doesn't have to know about the variant.
  hobby_yearly:
    display_name: "Hobby (yearly)"
    price_monthly_cents: 9000
    billing_period: "yearly"
    limits:
      provisions_per_day: -1
      postgres_storage_mb: 1024
      postgres_connections: 8
      vector_storage_mb: 500
      vector_connections: 5
      redis_memory_mb: 50
      redis_commands_per_day: 10000
      mongodb_storage_mb: 100
      mongodb_connections: 5
      mongodb_ops_per_minute: 1000
      queue_storage_mb: 5120
      queue_count: 3
      storage_storage_mb: 512
      webhook_requests_stored: 1000
      team_members: 1
      vault_max_entries: 20
      vault_envs_allowed: ["production"]
      deployments_apps: 1
      # Mirror hobby — same limits + features, only billing period differs.
      backup_retention_days: 7
      backup_restore_enabled: false
      manual_backups_per_day: 1
      # FIX-H #Q50 — RPO/RTO surfaced on /api/v1/capabilities.
      rpo_minutes: 1440
      rto_minutes: 30
      # FIX-G (2026-05-14): per-count cap on custom domains. The boolean
      # custom_domains feature flag still gates the route entirely; this
      # cap enforces how many hostnames a team may bind once unlocked.
      custom_domains_max: 0
    features:
      alerts: true
      custom_domains: false
      sla: false

  pro:
    display_name: "Pro"
    price_monthly_cents: 4900
    limits:
      provisions_per_day: -1
      # 2026-05-15 storage bump (PRICING-AUDIT-2026-05-15.md R1):
      # Pro headline limits raised so Pro is defensible against a 30-second
      # Supabase Pro comparison ($25 / 8 GB Postgres / 100 GB object).
      # Same $49/mo. Marginal infra cost on shared k8s + DO Spaces is
      # ~$0.05/GB-mo for Postgres and ~$0.04/GB for object — under
      # $3/customer at full saturation, and most Pro customers use a tiny
      # fraction of their ceiling.
      postgres_storage_mb: 10240
      postgres_connections: 20
      vector_storage_mb: 10240
      vector_connections: 20
      redis_memory_mb: 512
      redis_commands_per_day: 500000
      mongodb_storage_mb: 5120
      mongodb_connections: 20
      mongodb_ops_per_minute: 10000
      queue_storage_mb: 10240
      queue_count: 20
      storage_storage_mb: 51200
      webhook_requests_stored: 10000
      team_members: 5
      vault_max_entries: 200
      vault_envs_allowed: []
      deployments_apps: 10
      # Pro: 30-day backup retention, 100 manual backups/day, self-serve restore.
      # 100/day is effectively unlimited for the dashboard CTA but caps a
      # runaway agent loop. The marketing surface advertises "30-day backups
      # + 1-click restore" as a Pro headline feature.
      backup_retention_days: 30
      backup_restore_enabled: true
      manual_backups_per_day: 100
      # FIX-H #Q50 — RPO/RTO surfaced on /api/v1/capabilities.
      rpo_minutes: 60
      rto_minutes: 15
      # FIX-G (2026-05-14): per-count cap on custom domains. The boolean
      # custom_domains feature flag still gates the route entirely; this
      # cap enforces how many hostnames a team may bind once unlocked.
      custom_domains_max: 5
    features:
      alerts: true
      custom_domains: true
      sla: false

  # pro_yearly — $490/yr ≈ $40.83/mo (~17% off $49 x 12).
  pro_yearly:
    display_name: "Pro (yearly)"
    price_monthly_cents: 49000
    billing_period: "yearly"
    limits:
      provisions_per_day: -1
      # Mirror pro monthly limits (2026-05-15 storage bump).
      postgres_storage_mb: 10240
      postgres_connections: 20
      vector_storage_mb: 10240
      vector_connections: 20
      redis_memory_mb: 512
      redis_commands_per_day: 500000
      mongodb_storage_mb: 5120
      mongodb_connections: 20
      mongodb_ops_per_minute: 10000
      queue_storage_mb: 10240
      queue_count: 20
      storage_storage_mb: 51200
      webhook_requests_stored: 10000
      team_members: 5
      vault_max_entries: 200
      vault_envs_allowed: []
      deployments_apps: 10
      # Mirror pro — same limits + features, only billing period differs.
      backup_retention_days: 30
      backup_restore_enabled: true
      manual_backups_per_day: 100
      # FIX-H #Q50 — RPO/RTO surfaced on /api/v1/capabilities.
      rpo_minutes: 60
      rto_minutes: 15
      # FIX-G (2026-05-14): per-count cap on custom domains. The boolean
      # custom_domains feature flag still gates the route entirely; this
      # cap enforces how many hostnames a team may bind once unlocked.
      custom_domains_max: 5
    features:
      alerts: true
      custom_domains: true
      sla: false

  team:
    display_name: "Team"
    price_monthly_cents: 19900
    limits:
      provisions_per_day: -1
      postgres_storage_mb: -1
      postgres_connections: -1
      vector_storage_mb: -1
      vector_connections: -1
      redis_memory_mb: -1
      redis_commands_per_day: -1
      mongodb_storage_mb: -1
      mongodb_connections: -1
      mongodb_ops_per_minute: -1
      queue_storage_mb: -1
      queue_count: -1
      storage_storage_mb: -1
      webhook_requests_stored: -1
      team_members: -1
      vault_max_entries: -1
      vault_envs_allowed: []
      deployments_apps: -1
      # Team: 90-day retention, 1000 manual backups/day, self-serve restore.
      # The longer retention is the compliance lever — enterprises asking
      # for 90-day point-in-time recovery land here.
      backup_retention_days: 90
      backup_restore_enabled: true
      manual_backups_per_day: 1000
      # FIX-H #Q50 — RPO/RTO surfaced on /api/v1/capabilities.
      rpo_minutes: 60
      rto_minutes: 15
      # FIX-G (2026-05-14): per-count cap on custom domains. The boolean
      # custom_domains feature flag still gates the route entirely; this
      # cap enforces how many hostnames a team may bind once unlocked.
      custom_domains_max: 50
    features:
      alerts: true
      custom_domains: true
      sla: true

  # team_yearly — $1990/yr ≈ $165.83/mo (~17% off $199 x 12).
  team_yearly:
    display_name: "Team (yearly)"
    price_monthly_cents: 199000
    billing_period: "yearly"
    limits:
      provisions_per_day: -1
      postgres_storage_mb: -1
      postgres_connections: -1
      vector_storage_mb: -1
      vector_connections: -1
      redis_memory_mb: -1
      redis_commands_per_day: -1
      mongodb_storage_mb: -1
      mongodb_connections: -1
      mongodb_ops_per_minute: -1
      queue_storage_mb: -1
      queue_count: -1
      storage_storage_mb: -1
      webhook_requests_stored: -1
      team_members: -1
      vault_max_entries: -1
      vault_envs_allowed: []
      deployments_apps: -1
      # Mirror team — same limits + features, only billing period differs.
      backup_retention_days: 90
      backup_restore_enabled: true
      manual_backups_per_day: 1000
      # FIX-H #Q50 — RPO/RTO surfaced on /api/v1/capabilities.
      rpo_minutes: 60
      rto_minutes: 15
      # FIX-G (2026-05-14): per-count cap on custom domains. The boolean
      # custom_domains feature flag still gates the route entirely; this
      # cap enforces how many hostnames a team may bind once unlocked.
      custom_domains_max: 50
    features:
      alerts: true
      custom_domains: true
      sla: true

  # growth — $99/mo. Sits between Pro ($49) and Team ($199) as the
  # "unlimited supporting services" step for teams whose Postgres/Redis
  # caps Pro fine but who need unlimited mongo/queue/storage/webhook headroom.
  #
  # PUBLIC VISIBILITY (intentional, 2026-05-15):
  # growth is API-only — it appears on /api/v1/capabilities so agents
  # introspecting tiers see the full ladder, but does NOT appear on the
  # public /pricing page, marketing homepage, or dashboard PricingGrid.
  # The marketing surface stays Anonymous / Hobby / Pro / Team to keep
  # the comparison uncluttered. Growth is reached only via assisted
  # sales conversations (support@instanode.dev) — there is no in-product
  # upsell card for it today. If/when growth becomes a primary outbound
  # funnel, surface it in instanode-web/PricingPage.tsx and the dashboard
  # PricingGrid in lock-step with this file.
  growth:
    display_name: "Growth"
    price_monthly_cents: 9900
    limits:
      provisions_per_day: -1
      # 2026-05-15: bumped to keep Growth strictly above Pro after Pro's
      # storage bump. Growth's identity is still "unlimited supporting
      # services" (mongo/queue/storage/webhook) — the Postgres/Redis bump
      # just preserves tier-ladder ordering.
      # NOTE (P3 from DOC-REALITY-DELTA-2026-05-20): postgres_connections=20
      # matches Pro=20. The "preserves tier-ladder ordering" claim above is
      # about storage_mb (20480 > Pro's 10240), not connections. Growth's
      # connection bump is intentionally absent — Pro already gets the
      # highest single-DB connection count under shared infra; further
      # connection headroom is a Team-tier (dedicated infra) benefit.
      postgres_storage_mb: 20480
      postgres_connections: 20
      vector_storage_mb: 20480
      vector_connections: 20
      redis_memory_mb: 1024
      redis_commands_per_day: -1
      mongodb_storage_mb: -1
      mongodb_connections: -1
      mongodb_ops_per_minute: -1
      queue_storage_mb: -1
      queue_count: -1
      storage_storage_mb: -1
      webhook_requests_stored: -1
      team_members: 10
      vault_max_entries: 200
      vault_envs_allowed: []
      # B6-P3 (BugBash 2026-05-20, wave-3 consolidated): bumped from 5 → 50.
      # Pro's deployments_apps = 10; the previous value of 5 placed Growth
      # ($99/mo) BELOW Pro ($49/mo) on this dimension — a tier-ladder
      # inversion that violated the published "Growth = more of everything
      # Pro has, on shared infra" promise. 50 keeps a clear gap above Pro
      # without leaping to Team's unlimited (-1); a Growth customer
      # provisioning 50 distinct deploys is the realistic ceiling under
      # shared k8s before per-namespace overhead matters.
      deployments_apps: 50
      # Growth: matches Pro's backup posture (30-day retention, restore).
      # Growth sits between Pro and Team — the differentiator is dedicated
      # infra, not backup retention.
      backup_retention_days: 30
      backup_restore_enabled: true
      manual_backups_per_day: 100
      # FIX-H #Q50 — RPO/RTO surfaced on /api/v1/capabilities.
      rpo_minutes: 60
      rto_minutes: 15
      # FIX-G (2026-05-14): per-count cap on custom domains. The boolean
      # custom_domains feature flag still gates the route entirely; this
      # cap enforces how many hostnames a team may bind once unlocked.
      custom_domains_max: 3
    features:
      alerts: true
      custom_domains: true
      sla: false
      dedicated: true

# promotions — add codes here to offer discounts without code deploys.
# Each code is validated at checkout time. Comment them out to disable.
#
# promotions:
#   - code: "LAUNCH50"
#     discount_percent: 50
#     applies_to: ["pro", "team"]
#     expires_at: "2026-12-31"
#     max_uses: 1000
#     description: "50% off Pro or Team for the first 1000 signups"
#
#   - code: "FRIEND"
#     discount_percent: 20
#     applies_to: ["pro"]
#     expires_at: ""
#     max_uses: -1
#     description: "Friend referral — 20% off Pro, no expiry"
promotions: []