insta 0.0.20 → 0.0.22

package/dist/commands/mcp.js

@@ -0,0 +1,136 @@
+// `insta mcp install` — write the insta-cloud remote MCP server into each coding agent's own
+// config format. Claude Code is NOT handled here — it has a real registry CLI (`claude mcp add`,
+// see setup.ts registerMcp); these are the config-file agents. All entries are OAuth (no
+// credential written): each client discovers the platform AS via RFC 9728 and runs the browser
+// flow on first use.
+import { promises as fs } from 'node:fs';
+import { existsSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { info } from '../util.js';
+import { DEFAULT_MCP_URL, MCP_SERVER_NAME, registerMcp } from './setup.js';
+export const MCP_AGENT_TARGETS = ['cursor', 'codex', 'opencode', 'copilot', 'factory-droid'];
+export function configPath(slug, home) {
+    switch (slug) {
+        case 'cursor': return path.join(home, '.cursor', 'mcp.json');
+        case 'codex': return path.join(home, '.codex', 'config.toml');
+        case 'opencode': return path.join(home, '.config', 'opencode', 'opencode.json');
+        case 'copilot': return path.join(home, '.copilot', 'mcp-config.json');
+        case 'factory-droid': return path.join(home, '.factory', 'mcp.json');
+    }
+}
+// An agent counts as "on this machine" when its config dir already exists — we configure what's
+// installed, never scaffold a tool the user doesn't have.
+export function detectAgents(home) {
+    return MCP_AGENT_TARGETS.filter((slug) => existsSync(path.dirname(configPath(slug, home))));
+}
+// Merge our entry into existing JSON config. Returns null (skip, leave file alone) when the
+// existing content isn't valid JSON — never clobber a config we can't parse.
+export function renderJsonConfig(slug, existing, url) {
+    let root = {};
+    if (existing && existing.trim()) {
+        try {
+            root = JSON.parse(existing);
+        }
+        catch {
+            return null;
+        }
+        if (typeof root !== 'object' || root === null || Array.isArray(root))
+            return null;
+    }
+    if (slug === 'opencode') {
+        // OpenCode: `mcp` key, `type: "remote"` schema (docs.opencode.ai).
+        root.mcp = { ...(root.mcp ?? {}), [MCP_SERVER_NAME]: { type: 'remote', url, enabled: true } };
+        root.$schema ??= 'https://opencode.ai/config.json';
+    }
+    else {
+        const entry = slug === 'cursor' ? { url } // Cursor auto-detects HTTP from `url`
+            : slug === 'copilot' ? { type: 'http', url, tools: ['*'] }
+                : { type: 'http', url, disabled: false }; // factory-droid
+        root.mcpServers = { ...(root.mcpServers ?? {}), [MCP_SERVER_NAME]: entry };
+    }
+    return JSON.stringify(root, null, 2) + '\n';
+}
+// Codex config is TOML. Appending a complete `[mcp_servers.<name>]` table is always valid at
+// EOF, so we avoid a TOML parser: string-detect for idempotency, append for install.
+export function renderCodexConfig(existing, url) {
+    const base = existing ?? '';
+    if (base.includes(`[mcp_servers.${MCP_SERVER_NAME}]`))
+        return null; // already configured
+    const sep = base.length && !base.endsWith('\n') ? '\n' : '';
+    return `${base}${sep}\n[mcp_servers.${MCP_SERVER_NAME}]\nurl = "${url}"\n`;
+}
+// Install for one agent. Returns 'installed' | 'already' | 'skipped' (unparseable config).
+export async function installFor(slug, home, url) {
+    const file = configPath(slug, home);
+    let existing = null;
+    try {
+        existing = await fs.readFile(file, 'utf8');
+    }
+    catch {
+        existing = null;
+    }
+    if (slug === 'codex') {
+        const next = renderCodexConfig(existing, url);
+        if (next === null)
+            return 'already';
+        await fs.mkdir(path.dirname(file), { recursive: true });
+        await fs.writeFile(file, next);
+        return 'installed';
+    }
+    if (existing) {
+        try {
+            const root = JSON.parse(existing);
+            const entry = slug === 'opencode' ? root?.mcp?.[MCP_SERVER_NAME] : root?.mcpServers?.[MCP_SERVER_NAME];
+            if (entry)
+                return 'already';
+        }
+        catch { /* fall through to renderJsonConfig, which refuses to clobber */ }
+    }
+    const next = renderJsonConfig(slug, existing, url);
+    if (next === null)
+        return 'skipped';
+    await fs.mkdir(path.dirname(file), { recursive: true });
+    await fs.writeFile(file, next);
+    return 'installed';
+}
+const AGENT_LABELS = {
+    cursor: 'Cursor', codex: 'OpenAI Codex', opencode: 'OpenCode', copilot: 'GitHub Copilot', 'factory-droid': 'Factory Droid',
+};
+// Configure every detected config-file agent (or one forced via `agent`). Returns the labels of
+// agents now configured (installed or already present) for the caller's summary line.
+export async function installAgentConfigs(agent, home = os.homedir()) {
+    const url = process.env.INSTA_MCP_URL || DEFAULT_MCP_URL;
+    const targets = agent
+        ? MCP_AGENT_TARGETS.includes(agent) ? [agent] : []
+        : detectAgents(home);
+    if (agent && targets.length === 0) {
+        info(`unknown --agent "${agent}" — supported: claude-code, ${MCP_AGENT_TARGETS.join(', ')}`);
+        return [];
+    }
+    const done = [];
+    for (const slug of targets) {
+        const result = await installFor(slug, home, url);
+        if (result === 'skipped')
+            info(`  ${AGENT_LABELS[slug]}: existing config at ${configPath(slug, home)} isn't valid JSON — add ${MCP_SERVER_NAME} manually`);
+        else
+            done.push(AGENT_LABELS[slug]);
+    }
+    return done;
+}
+// `insta mcp install [--agent <slug>] [--mcp-token]` — claude-code goes through its registry CLI
+// (registerMcp); everything else is a config-file write. No --agent = claude-code + all detected.
+export async function mcpInstall(opts) {
+    if (!opts.agent || opts.agent === 'claude-code') {
+        await registerMcp(undefined, undefined, !!opts.mcpToken);
+        if (opts.agent)
+            return;
+    }
+    const done = await installAgentConfigs(opts.agent);
+    if (done.length)
+        info(`✓ MCP — configured for ${done.join(', ')} (restart those tools to pick it up)`);
+    else if (opts.agent) { /* messages already printed */ }
+    else
+        info('  no other MCP-capable agents detected (supported: cursor, codex, opencode, copilot, factory-droid)');
+}
+//# sourceMappingURL=mcp.js.map

package/dist/commands/regions.js

@@ -0,0 +1,12 @@
+import { ApiClient } from '../api.js';
+import { info, printJson } from '../util.js';
+// insta regions — list the regions a postgres/compute service can be created in.
+export async function regionsList(opts = {}) {
+    const api = await ApiClient.load();
+    const { regions } = await api.request('GET', '/regions');
+    if (opts.json)
+        return printJson(regions);
+    for (const r of regions)
+        info(`${r.slug}  ${r.label}`);
+}
+//# sourceMappingURL=regions.js.map

package/dist/commands/secrets.js

@@ -28,15 +28,61 @@ export async function secrets(opts) {
         info(`  .gitignore += ${out} (credentials must never be committed)`);
     info('  tip: `insta run -- <cmd>` injects these per-run with nothing written to disk');
 }
+// Render one branch's service-grouped secrets, then its unbound (branch-level) secrets.
+function renderBranch(b) {
+    for (const s of b.services)
+        if (s.secrets.length) {
+            info(`  ${s.type}/${s.name}`);
+            for (const n of s.secrets)
+                info(`    ${n}`);
+        }
+    if (b.unbound.length) {
+        info('  (branch-level)');
+        for (const n of b.unbound)
+            info(`    ${n}`);
+    }
+}
+// Show the full binding tree: project-wide, then every branch grouped by service.
+export async function secretsTree(opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const res = await api.rawRequest('GET', `/projects/${p.projectId}/secrets/tree`);
+    if (handleApproval(res))
+        return;
+    const tree = res.body;
+    if (opts.json)
+        return printJson(tree);
+    if (tree.projectWide.length) {
+        info('(project-wide)');
+        for (const n of tree.projectWide)
+            info(`  ${n}`);
+    }
+    for (const b of tree.branches) {
+        info(`${b.name}${b.isDefault ? ' *' : ''}`);
+        renderBranch(b);
+    }
+}
+// List secret names for the current (or given) branch, grouped by service.
 export async function secretsList(opts) {
     const api = await ApiClient.load();
     const p = await requireProject();
     const branch = opts.branch ?? p.branch;
-    const res = await api.rawRequest('GET', `/projects/${p.projectId}/secrets${q(branch)}`);
+    const res = await api.rawRequest('GET', `/projects/${p.projectId}/secrets/tree`);
     if (handleApproval(res))
         return;
-    for (const name of Object.keys(res.body.secrets))
-        info(name);
+    const tree = res.body;
+    const b = tree.branches.find((x) => x.name === branch);
+    if (opts.json)
+        return printJson({ projectWide: tree.projectWide, branch: b });
+    if (tree.projectWide.length) {
+        info('(project-wide)');
+        for (const n of tree.projectWide)
+            info(`  ${n}`);
+    }
+    if (b) {
+        info(`${b.name}`);
+        renderBranch(b);
+    }
 }
 async function readStdin() {
     let data = '';
@@ -44,19 +90,21 @@ async function readStdin() {
         data += chunk;
     return data.trim();
 }
-// Set a user secret. Project-wide by default; --branch scopes it to one branch. Value comes from
-// the argument, or stdin when omitted (keeps secret values out of shell history).
+// Set a user secret. Project-wide by default; --branch scopes it to one branch. --service binds
+// it to a branch service instead, which implies the current branch (binding requires one). Value
+// comes from the argument, or stdin when omitted (keeps secret values out of shell history).
 export async function secretsSet(name, value, opts) {
     const api = await ApiClient.load();
     const p = await requireProject();
     const v = value ?? (await readStdin());
     if (!v)
         die('value is required (pass as an argument or on stdin)');
-    const payload = opts.branch ? { value: v, branch: opts.branch } : { value: v };
+    const branch = opts.service ? (opts.branch ?? p.branch) : opts.branch;
+    const payload = { value: v, ...(branch ? { branch } : {}), ...(opts.service ? { service: opts.service } : {}) };
     const res = await api.rawRequest('PUT', `/projects/${p.projectId}/secrets/${encodeURIComponent(name)}`, payload);
     if (handleApproval(res))
         return;
-    info(`set ${name} (${opts.branch ? `branch ${opts.branch}` : 'project-wide'})`);
+    info(`set ${name}${opts.service ? ` → ${opts.service}` : ''} (${branch ? `branch ${branch}` : 'project-wide'})`);
 }
 export async function secretsUnset(name, opts) {
     const api = await ApiClient.load();

package/dist/commands/services.js

@@ -2,6 +2,7 @@
 import { ApiClient, requireProject } from '../api.js';
 import { info, printJson, handleApproval, renderNextActions } from '../util.js';
 export const SERVICE_TYPES = ['postgres', 'storage', 'compute'];
+const SERVICE_NAME_RE = /^[a-z0-9][a-z0-9-]{0,38}$/;
 export function q(branch) {
     return branch ? `?branch=${encodeURIComponent(branch)}` : '';
 }
@@ -11,6 +12,10 @@ export function assertType(type, allowed = SERVICE_TYPES) {
     if (!allowed.includes(type))
         throw new Error(`type must be ${allowed.join('|')}`);
 }
+export function assertServiceName(name) {
+    if (!SERVICE_NAME_RE.test(name))
+        throw new Error('service name must be lower-kebab (a-z, 0-9, -)');
+}
 // Parse a positive-integer machine count.
 export function parseCount(raw) {
     const n = Number(raw);
@@ -40,22 +45,46 @@ export function resolveComputeServiceId(services, name) {
         throw new Error(`multiple compute services — specify one: ${compute.map((s) => s.name).join(', ')}`);
     return compute[0].id;
 }
-// ---- commands ----
+// Map service-add options to the platform POST body. Pure, so it's unit-tested without a network
+// mock (mirrors deployRequestBody in deploy.ts). Validation (which options are valid for which
+// type) stays in servicesAdd, ahead of any network/config access.
+export function servicesAddRequestBody(type, name, branch, opts) {
+    return {
+        type, name, ...(branch ? { branch } : {}), public: !!opts.public,
+        ...(opts.image ? { image: opts.image } : {}), ...(opts.port ? { port: Number(opts.port) } : {}),
+        ...(opts.region ? { region: opts.region } : {}),
+    };
+}
 export async function servicesAdd(type, name, opts = {}) {
     assertType(type);
     if (opts.public && type !== 'storage')
         throw new Error('--public is only valid for storage services');
+    if (opts.region && type === 'storage')
+        throw new Error('--region is not valid for storage services');
+    if (opts.image && type !== 'compute')
+        throw new Error('--image is only valid for compute services');
+    if (opts.port && type !== 'compute')
+        throw new Error('--port is only valid for compute services');
     const api = await ApiClient.load();
     const p = await requireProject();
     const branch = opts.branch ?? p.branch;
-    const res = await api.rawRequest('POST', `/projects/${p.projectId}/services`, { type, name, ...(branch ? { branch } : {}), public: !!opts.public });
+    const res = await api.rawRequest('POST', `/projects/${p.projectId}/services`, servicesAddRequestBody(type, name, branch, opts));
     if (handleApproval(res))
         return;
     const svc = res.body.service;
     const access = svc.type === 'storage' ? `  [${svc.public ? 'public' : 'private'}]` : '';
-    info(`added ${type} service ${name} on ${branch ?? 'default'} (${svc.id})${access}${svc.domain ? ` — ${svc.domain}` : ''}`);
+    const img = svc.image ? `  running ${svc.image}${svc.port ? `:${svc.port}` : ''}` : '';
+    info(`added ${type} service ${name} on ${branch ?? 'default'} (${svc.id})${access}${svc.region ? `  ${svc.region}` : ''}${img}${svc.domain ? ` — ${svc.domain}` : ''}`);
     renderNextActions(res.body.nextActions);
 }
+// Render one `services list` row. Pure, so it's unit-tested without a network mock (mirrors
+// billingLines in billing.ts). Compute rows show the running image when the platform reports one.
+export function serviceListLine(s) {
+    const extra = s.type === 'compute'
+        ? `  x${s.machine_count}${s.image ? `  running ${s.image}${s.port ? `:${s.port}` : ''}` : ''}`
+        : s.type === 'storage' ? `  ${s.public ? 'public' : 'private'}` : '';
+    return `${s.type}/${s.name}  [${s.status}]${extra}${s.domain ? `  ${s.domain}` : ''}  ${s.id}`;
+}
 export async function servicesList(opts) {
     const api = await ApiClient.load();
     const p = await requireProject();
@@ -65,10 +94,8 @@ export async function servicesList(opts) {
         return printJson(services);
     if (!services.length)
         return info(`(no services on ${branch ?? 'default'} — add one with \`insta services add <postgres|storage|compute> <name>\`)`);
-    for (const s of services) {
-        const extra = s.type === 'compute' ? `  x${s.machine_count}` : s.type === 'storage' ? `  ${s.public ? 'public' : 'private'}` : '';
-        info(`${s.type}/${s.name}  [${s.status}]${extra}${s.domain ? `  ${s.domain}` : ''}  ${s.id}`);
-    }
+    for (const s of services)
+        info(serviceListLine(s));
 }
 export async function servicesRemove(type, name, opts = {}) {
     assertType(type);
@@ -82,6 +109,21 @@ export async function servicesRemove(type, name, opts = {}) {
         return;
     info(`removed ${type} service ${name} from ${branch ?? 'default'}`);
 }
+export async function servicesRename(type, name, newName, opts = {}) {
+    assertType(type);
+    assertServiceName(newName);
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const branch = opts.branch ?? p.branch;
+    const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(branch)}`);
+    const id = resolveServiceId(services, type, name);
+    const res = await api.rawRequest('POST', `/projects/${p.projectId}/services/${id}/rename`, { name: newName });
+    if (handleApproval(res))
+        return;
+    if (opts.json)
+        return printJson(res.body.service);
+    info(`renamed ${type} service ${name} to ${newName}`);
+}
 // Validate a bucket access-mode argument.
 export function parseAccess(raw) {
     if (raw === 'public')
@@ -134,4 +176,22 @@ export async function servicesUpgrade(type, name, spec, _opts) {
         return printJson(res.body.service);
     info(`upgraded ${type} ${name} to ${spec}`);
 }
+// insta services secrets <type> <name> — the secret names bound to a service.
+export async function servicesSecrets(type, name, opts = {}) {
+    assertType(type);
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(opts.branch ?? p.branch)}`);
+    const id = resolveServiceId(services, type, name);
+    const res = await api.rawRequest('GET', `/projects/${p.projectId}/services/${id}/secrets`);
+    if (handleApproval(res))
+        return;
+    const { secrets } = res.body;
+    if (opts.json)
+        return printJson(secrets);
+    if (!secrets.length)
+        return info(`(no secrets bound to ${type}/${name})`);
+    for (const n of secrets)
+        info(n);
+}
 //# sourceMappingURL=services.js.map

package/dist/commands/setup.js

@@ -6,7 +6,10 @@
 // Stack skills (neon/tigris/better-auth) intentionally stay per-project: their presence in a
 // project doubles as its stack manifest — that install happens on `project create|link`.
 import { spawn } from 'node:child_process';
+import os from 'node:os';
+import { ApiClient } from '../api.js';
 import { info } from '../util.js';
+import { installAgentConfigs } from './mcp.js';
 // The `skills` tool we shell out to prints a clack UI: a frame-by-frame clone spinner, an
 // "Installing to all N agents" banner, a full N-line install-path box, and a third-party
 // "Security Risk Assessment" that flags our OWN first-party skill as "Critical Risk". Streamed
@@ -89,7 +92,56 @@ const defaultRunner = (cmd, args) => new Promise((resolve) => {
 // -g = user-level (machine-global); -a '*' = every agent dir the skills tool supports
 // (Claude Code, Codex, Cursor, OpenCode, Copilot, …); --copy = real files, not cache symlinks.
 export const SETUP_ARGS = ['skills', 'add', 'InsForge/insta-skills', '-s', 'insta', '-a', '*', '-g', '-y', '--copy'];
-export async function setupAgent(opts, run = defaultRunner) {
+// ---- remote MCP registration ----
+export const MCP_SERVER_NAME = 'insta-cloud';
+export const DEFAULT_MCP_URL = 'https://mcp.instacloud.com/mcp';
+const defaultMinter = async () => {
+    try {
+        const api = await ApiClient.load();
+        if (!api.config.accessToken)
+            return null;
+        const { token } = await api.request('POST', '/tokens', { name: `mcp-${os.hostname()}` });
+        return token ?? null;
+    }
+    catch {
+        return null;
+    }
+};
+// Register the insta-cloud remote MCP server with Claude Code (user scope, so it follows the
+// machine like the skill install above). Default is OAuth: register with NO credential — the
+// platform's Better Auth MCP authorization server is discovered via RFC 9728 and Claude runs
+// the browser flow on first `/mcp` use, so no static token ever lands on disk. `--mcp-token`
+// is the headless fallback (CI, no browser): mint a durable token into the header instead.
+// Idempotent — an existing registration is left alone. Best-effort: the skill install is the
+// primary outcome; agents without an MCP registry are covered by the skill alone.
+export async function registerMcp(run = defaultRunner, mint = defaultMinter, useToken = false) {
+    const url = process.env.INSTA_MCP_URL || DEFAULT_MCP_URL;
+    if (!(await run('claude', ['--version'])).ok)
+        return; // no Claude Code on this machine
+    if ((await run('claude', ['mcp', 'get', MCP_SERVER_NAME])).ok) {
+        info(`✓ MCP — ${MCP_SERVER_NAME} already registered with Claude Code`);
+        return;
+    }
+    const args = ['mcp', 'add', '--transport', 'http', '--scope', 'user', MCP_SERVER_NAME, url];
+    if (useToken) {
+        const token = await mint();
+        if (!token) {
+            info('  MCP not registered (--mcp-token needs a login) — run `insta login`, then `insta setup agent --mcp-token` again');
+            return;
+        }
+        args.push('--header', `Authorization: Bearer ${token}`);
+    }
+    const res = await run('claude', args);
+    if (res.ok) {
+        info(`✓ MCP — ${MCP_SERVER_NAME} registered with Claude Code (\`claude mcp list\` to verify)`);
+        if (!useToken)
+            info('  first use: run `/mcp` in Claude Code and authorize in the browser (headless machines: `insta setup agent --mcp-token`)');
+    }
+    else {
+        info(`  MCP registration failed — add manually:\n    claude mcp add --transport http ${MCP_SERVER_NAME} ${url}`);
+    }
+}
+export async function setupAgent(opts, run = defaultRunner, mint, installConfigs = installAgentConfigs) {
     if (!opts.yes && !process.stdout.isTTY) {
         info('non-interactive shell — assuming -y');
     }
@@ -111,5 +163,9 @@ export async function setupAgent(opts, run = defaultRunner) {
     }
     info(summarizeInstall(res.output ?? ''));
     info('  every coding agent on this machine now knows InstaCloud (review skills before use — they run with full permissions).');
+    await registerMcp(run, mint, !!opts.mcpToken);
+    const others = await installConfigs();
+    if (others.length)
+        info(`✓ MCP — also configured for ${others.join(', ')} (restart those tools to pick it up)`);
 }
 //# sourceMappingURL=setup.js.map

package/dist/index.js

@@ -5,11 +5,13 @@ import { ApiError } from './api.js';
 import { die } from './util.js';
 import * as auth from './commands/auth.js';
 import * as setup from './commands/setup.js';
+import * as mcp from './commands/mcp.js';
 import * as runCmd from './commands/run.js';
 import * as org from './commands/org.js';
 import * as project from './commands/project.js';
 import * as branch from './commands/branch.js';
 import * as services from './commands/services.js';
+import * as regions from './commands/regions.js';
 import * as secretsCmd from './commands/secrets.js';
 import { deploy } from './commands/deploy.js';
 import * as computeCmd from './commands/compute.js';
@@ -66,7 +68,14 @@ program.command('run <cmd> [args...]').description('Run a command with the branc
 const setupCmd = program.command('setup').description('Set up this machine for InstaCloud agent workflows');
 setupCmd.command('agent').description('Install the insta skill user-globally for all coding agents')
     .option('-y, --yes', 'non-interactive')
+    .option('--mcp-token', 'register the MCP server with a minted insta_ API token instead of OAuth (headless machines / CI)')
     .action(guard((o) => setup.setupAgent(o)));
+// ---- MCP server integration ----
+const mcpCmd = program.command('mcp').description('insta-cloud remote MCP server integration');
+mcpCmd.command('install').description('Register the remote MCP server with coding agents (default: Claude Code + all detected)')
+    .option('--agent <slug>', 'one agent: claude-code, cursor, codex, opencode, copilot, factory-droid')
+    .option('--mcp-token', 'claude-code only: minted insta_ API token instead of OAuth (headless machines / CI)')
+    .action(guard((o) => mcp.mcpInstall(o)));
 // ---- org ----
 const orgCmd = program.command('org').description('Manage organizations');
 orgCmd.command('list').option('--json').action(guard((o) => org.orgList(o)));
@@ -89,28 +98,39 @@ br.command('merge <source>').description('Merge a branch service set into anothe
 const svc = program.command('services').alias('svc').description('Manage project services (postgres|storage|compute)');
 svc.command('add <type> <name>').description('Provision a service on demand (assigns a default domain for postgres/compute)')
     .option('--branch <branch>', 'target branch (default: current)')
+    .option('--region <region>', 'region for postgres/compute, e.g. us-east (see `insta regions`)')
     .option('--public', 'storage only: serve the bucket with anonymous public-read (default private)')
+    .option('--image <url>', 'compute only: run this container image at creation')
+    .option('--port <n>', 'compute only: port the image listens on (default 8080)')
     .action(guard((type, name, o) => services.servicesAdd(type, name, o)));
 svc.command('list').option('--json').option('--branch <branch>', 'branch (default: current)')
     .action(guard((o) => services.servicesList(o)));
 svc.command('remove <type> <name>').description('Remove a service and destroy its resources')
     .option('--branch <branch>', 'branch (default: current)')
     .action(guard((type, name, o) => services.servicesRemove(type, name, o)));
+svc.command('rename <type> <name> <new-name>').description('Rename a service and re-key its managed secret names')
+    .option('--json').option('--branch <branch>', 'branch (default: current)')
+    .action(guard((type, name, newName, o) => services.servicesRename(type, name, newName, o)));
 svc.command('set-access <type> <name> <access>').description('Set a storage service bucket access mode (access: public|private)')
     .option('--json').action(guard((type, name, access, o) => services.servicesSetAccess(type, name, access, o)));
 svc.command('scale <type> <name> <number> [region]').description('Set a compute service machine count (paid plans only)')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((type, name, number, region, o) => services.servicesScale(type, name, number, region, o)));
 svc.command('upgrade <type> <name> <spec>').description('Change a compute/postgres service spec (paid plans only)')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((type, name, spec, o) => services.servicesUpgrade(type, name, spec, o)));
+svc.command('secrets <type> <name>').description("List a service's secret names")
+    .option('--branch <b>').option('--json').action(guard((type, name, o) => services.servicesSecrets(type, name, o)));
 // ---- secrets (seam) ----
 const sec = program.command('secrets').description('Fetch the credential bundle (secret seam) into .env')
     .option('--branch <branch>').option('-o, --output <file>', 'output file (default .env)').option('--print', 'print instead of writing').option('--json')
     .action(guard((o) => secretsCmd.secrets(o)));
-sec.command('list').description('List secret names only').option('--branch <branch>').action(guard((o) => secretsCmd.secretsList(o)));
+sec.command('list').description('List secret names, grouped by service').option('--branch <branch>').option('--json').action(guard((o) => secretsCmd.secretsList(o)));
 sec.command('set <name> [value]').description('Set a user secret (project-wide; value from stdin if omitted)')
-    .option('--branch <branch>', 'scope to one branch').action(guard((n, v, o) => secretsCmd.secretsSet(n, v, o)));
+    .option('--branch <branch>', 'scope to one branch').option('--service <type/name>', 'bind to a branch service (implies current branch)')
+    .action(guard((n, v, o) => secretsCmd.secretsSet(n, v, o)));
 sec.command('unset <name>').description('Remove a user secret')
     .option('--branch <branch>', 'scope to one branch').action(guard((n, o) => secretsCmd.secretsUnset(n, o)));
+sec.command('tree').description('Show secrets as project → branch → service → secrets').option('--json')
+    .action(guard((o) => secretsCmd.secretsTree(o)));
 // ---- deploy ----
 program.command('deploy [dir]').description('Deploy a source directory (built remotely on Fly) or a prebuilt --image to a branch compute group')
     .option('--image <url>', 'prebuilt container image to deploy (instead of a source dir)').option('--branch <b>').option('--group <g>').option('--port <p>')
@@ -134,6 +154,8 @@ compute.command('status [service]').description("Show a compute service's desire
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeStatus(service, o)));
 // ---- manifest ----
 program.command('manifest').description('Print an agent-legible view of the project environments').option('--json').action(guard((o) => manifest(o)));
+// ---- regions ----
+program.command('regions').description('List regions available for postgres/compute services').option('--json').action(guard((o) => regions.regionsList(o)));
 // ---- observability ----
 program.command('metrics <target> [group]').description('Service metrics (target: db|compute)')
     .option('--branch <b>').option('--from <unix>').option('--to <unix>').option('--step <s>').option('--json')

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "insta",
-  "version": "0.0.20",
+  "version": "0.0.22",
   "type": "module",
-  "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
+  "description": "InstaCloud CLI \u2014 a thin client of the platform control-plane API.",
   "keywords": [
     "insta",
     "insforge",