insta 0.0.21 → 0.0.22

package/dist/commands/regions.js

@@ -0,0 +1,12 @@
+import { ApiClient } from '../api.js';
+import { info, printJson } from '../util.js';
+// insta regions — list the regions a postgres/compute service can be created in.
+export async function regionsList(opts = {}) {
+    const api = await ApiClient.load();
+    const { regions } = await api.request('GET', '/regions');
+    if (opts.json)
+        return printJson(regions);
+    for (const r of regions)
+        info(`${r.slug}  ${r.label}`);
+}
+//# sourceMappingURL=regions.js.map

package/dist/commands/secrets.js

@@ -28,15 +28,61 @@ export async function secrets(opts) {
         info(`  .gitignore += ${out} (credentials must never be committed)`);
     info('  tip: `insta run -- <cmd>` injects these per-run with nothing written to disk');
 }
+// Render one branch's service-grouped secrets, then its unbound (branch-level) secrets.
+function renderBranch(b) {
+    for (const s of b.services)
+        if (s.secrets.length) {
+            info(`  ${s.type}/${s.name}`);
+            for (const n of s.secrets)
+                info(`    ${n}`);
+        }
+    if (b.unbound.length) {
+        info('  (branch-level)');
+        for (const n of b.unbound)
+            info(`    ${n}`);
+    }
+}
+// Show the full binding tree: project-wide, then every branch grouped by service.
+export async function secretsTree(opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const res = await api.rawRequest('GET', `/projects/${p.projectId}/secrets/tree`);
+    if (handleApproval(res))
+        return;
+    const tree = res.body;
+    if (opts.json)
+        return printJson(tree);
+    if (tree.projectWide.length) {
+        info('(project-wide)');
+        for (const n of tree.projectWide)
+            info(`  ${n}`);
+    }
+    for (const b of tree.branches) {
+        info(`${b.name}${b.isDefault ? ' *' : ''}`);
+        renderBranch(b);
+    }
+}
+// List secret names for the current (or given) branch, grouped by service.
 export async function secretsList(opts) {
     const api = await ApiClient.load();
     const p = await requireProject();
     const branch = opts.branch ?? p.branch;
-    const res = await api.rawRequest('GET', `/projects/${p.projectId}/secrets${q(branch)}`);
+    const res = await api.rawRequest('GET', `/projects/${p.projectId}/secrets/tree`);
     if (handleApproval(res))
         return;
-    for (const name of Object.keys(res.body.secrets))
-        info(name);
+    const tree = res.body;
+    const b = tree.branches.find((x) => x.name === branch);
+    if (opts.json)
+        return printJson({ projectWide: tree.projectWide, branch: b });
+    if (tree.projectWide.length) {
+        info('(project-wide)');
+        for (const n of tree.projectWide)
+            info(`  ${n}`);
+    }
+    if (b) {
+        info(`${b.name}`);
+        renderBranch(b);
+    }
 }
 async function readStdin() {
     let data = '';
@@ -44,19 +90,21 @@ async function readStdin() {
         data += chunk;
     return data.trim();
 }
-// Set a user secret. Project-wide by default; --branch scopes it to one branch. Value comes from
-// the argument, or stdin when omitted (keeps secret values out of shell history).
+// Set a user secret. Project-wide by default; --branch scopes it to one branch. --service binds
+// it to a branch service instead, which implies the current branch (binding requires one). Value
+// comes from the argument, or stdin when omitted (keeps secret values out of shell history).
 export async function secretsSet(name, value, opts) {
     const api = await ApiClient.load();
     const p = await requireProject();
     const v = value ?? (await readStdin());
     if (!v)
         die('value is required (pass as an argument or on stdin)');
-    const payload = opts.branch ? { value: v, branch: opts.branch } : { value: v };
+    const branch = opts.service ? (opts.branch ?? p.branch) : opts.branch;
+    const payload = { value: v, ...(branch ? { branch } : {}), ...(opts.service ? { service: opts.service } : {}) };
     const res = await api.rawRequest('PUT', `/projects/${p.projectId}/secrets/${encodeURIComponent(name)}`, payload);
     if (handleApproval(res))
         return;
-    info(`set ${name} (${opts.branch ? `branch ${opts.branch}` : 'project-wide'})`);
+    info(`set ${name}${opts.service ? ` → ${opts.service}` : ''} (${branch ? `branch ${branch}` : 'project-wide'})`);
 }
 export async function secretsUnset(name, opts) {
     const api = await ApiClient.load();

package/dist/commands/services.js

@@ -2,6 +2,7 @@
 import { ApiClient, requireProject } from '../api.js';
 import { info, printJson, handleApproval, renderNextActions } from '../util.js';
 export const SERVICE_TYPES = ['postgres', 'storage', 'compute'];
+const SERVICE_NAME_RE = /^[a-z0-9][a-z0-9-]{0,38}$/;
 export function q(branch) {
     return branch ? `?branch=${encodeURIComponent(branch)}` : '';
 }
@@ -11,6 +12,10 @@ export function assertType(type, allowed = SERVICE_TYPES) {
     if (!allowed.includes(type))
         throw new Error(`type must be ${allowed.join('|')}`);
 }
+export function assertServiceName(name) {
+    if (!SERVICE_NAME_RE.test(name))
+        throw new Error('service name must be lower-kebab (a-z, 0-9, -)');
+}
 // Parse a positive-integer machine count.
 export function parseCount(raw) {
     const n = Number(raw);
@@ -40,22 +45,46 @@ export function resolveComputeServiceId(services, name) {
         throw new Error(`multiple compute services — specify one: ${compute.map((s) => s.name).join(', ')}`);
     return compute[0].id;
 }
-// ---- commands ----
+// Map service-add options to the platform POST body. Pure, so it's unit-tested without a network
+// mock (mirrors deployRequestBody in deploy.ts). Validation (which options are valid for which
+// type) stays in servicesAdd, ahead of any network/config access.
+export function servicesAddRequestBody(type, name, branch, opts) {
+    return {
+        type, name, ...(branch ? { branch } : {}), public: !!opts.public,
+        ...(opts.image ? { image: opts.image } : {}), ...(opts.port ? { port: Number(opts.port) } : {}),
+        ...(opts.region ? { region: opts.region } : {}),
+    };
+}
 export async function servicesAdd(type, name, opts = {}) {
     assertType(type);
     if (opts.public && type !== 'storage')
         throw new Error('--public is only valid for storage services');
+    if (opts.region && type === 'storage')
+        throw new Error('--region is not valid for storage services');
+    if (opts.image && type !== 'compute')
+        throw new Error('--image is only valid for compute services');
+    if (opts.port && type !== 'compute')
+        throw new Error('--port is only valid for compute services');
     const api = await ApiClient.load();
     const p = await requireProject();
     const branch = opts.branch ?? p.branch;
-    const res = await api.rawRequest('POST', `/projects/${p.projectId}/services`, { type, name, ...(branch ? { branch } : {}), public: !!opts.public });
+    const res = await api.rawRequest('POST', `/projects/${p.projectId}/services`, servicesAddRequestBody(type, name, branch, opts));
     if (handleApproval(res))
         return;
     const svc = res.body.service;
     const access = svc.type === 'storage' ? `  [${svc.public ? 'public' : 'private'}]` : '';
-    info(`added ${type} service ${name} on ${branch ?? 'default'} (${svc.id})${access}${svc.domain ? ` — ${svc.domain}` : ''}`);
+    const img = svc.image ? `  running ${svc.image}${svc.port ? `:${svc.port}` : ''}` : '';
+    info(`added ${type} service ${name} on ${branch ?? 'default'} (${svc.id})${access}${svc.region ? `  ${svc.region}` : ''}${img}${svc.domain ? ` — ${svc.domain}` : ''}`);
     renderNextActions(res.body.nextActions);
 }
+// Render one `services list` row. Pure, so it's unit-tested without a network mock (mirrors
+// billingLines in billing.ts). Compute rows show the running image when the platform reports one.
+export function serviceListLine(s) {
+    const extra = s.type === 'compute'
+        ? `  x${s.machine_count}${s.image ? `  running ${s.image}${s.port ? `:${s.port}` : ''}` : ''}`
+        : s.type === 'storage' ? `  ${s.public ? 'public' : 'private'}` : '';
+    return `${s.type}/${s.name}  [${s.status}]${extra}${s.domain ? `  ${s.domain}` : ''}  ${s.id}`;
+}
 export async function servicesList(opts) {
     const api = await ApiClient.load();
     const p = await requireProject();
@@ -65,10 +94,8 @@ export async function servicesList(opts) {
         return printJson(services);
     if (!services.length)
         return info(`(no services on ${branch ?? 'default'} — add one with \`insta services add <postgres|storage|compute> <name>\`)`);
-    for (const s of services) {
-        const extra = s.type === 'compute' ? `  x${s.machine_count}` : s.type === 'storage' ? `  ${s.public ? 'public' : 'private'}` : '';
-        info(`${s.type}/${s.name}  [${s.status}]${extra}${s.domain ? `  ${s.domain}` : ''}  ${s.id}`);
-    }
+    for (const s of services)
+        info(serviceListLine(s));
 }
 export async function servicesRemove(type, name, opts = {}) {
     assertType(type);
@@ -82,6 +109,21 @@ export async function servicesRemove(type, name, opts = {}) {
         return;
     info(`removed ${type} service ${name} from ${branch ?? 'default'}`);
 }
+export async function servicesRename(type, name, newName, opts = {}) {
+    assertType(type);
+    assertServiceName(newName);
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const branch = opts.branch ?? p.branch;
+    const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(branch)}`);
+    const id = resolveServiceId(services, type, name);
+    const res = await api.rawRequest('POST', `/projects/${p.projectId}/services/${id}/rename`, { name: newName });
+    if (handleApproval(res))
+        return;
+    if (opts.json)
+        return printJson(res.body.service);
+    info(`renamed ${type} service ${name} to ${newName}`);
+}
 // Validate a bucket access-mode argument.
 export function parseAccess(raw) {
     if (raw === 'public')
@@ -134,4 +176,22 @@ export async function servicesUpgrade(type, name, spec, _opts) {
         return printJson(res.body.service);
     info(`upgraded ${type} ${name} to ${spec}`);
 }
+// insta services secrets <type> <name> — the secret names bound to a service.
+export async function servicesSecrets(type, name, opts = {}) {
+    assertType(type);
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(opts.branch ?? p.branch)}`);
+    const id = resolveServiceId(services, type, name);
+    const res = await api.rawRequest('GET', `/projects/${p.projectId}/services/${id}/secrets`);
+    if (handleApproval(res))
+        return;
+    const { secrets } = res.body;
+    if (opts.json)
+        return printJson(secrets);
+    if (!secrets.length)
+        return info(`(no secrets bound to ${type}/${name})`);
+    for (const n of secrets)
+        info(n);
+}
 //# sourceMappingURL=services.js.map

package/dist/index.js

@@ -11,6 +11,7 @@ import * as org from './commands/org.js';
 import * as project from './commands/project.js';
 import * as branch from './commands/branch.js';
 import * as services from './commands/services.js';
+import * as regions from './commands/regions.js';
 import * as secretsCmd from './commands/secrets.js';
 import { deploy } from './commands/deploy.js';
 import * as computeCmd from './commands/compute.js';
@@ -97,28 +98,39 @@ br.command('merge <source>').description('Merge a branch service set into anothe
 const svc = program.command('services').alias('svc').description('Manage project services (postgres|storage|compute)');
 svc.command('add <type> <name>').description('Provision a service on demand (assigns a default domain for postgres/compute)')
     .option('--branch <branch>', 'target branch (default: current)')
+    .option('--region <region>', 'region for postgres/compute, e.g. us-east (see `insta regions`)')
     .option('--public', 'storage only: serve the bucket with anonymous public-read (default private)')
+    .option('--image <url>', 'compute only: run this container image at creation')
+    .option('--port <n>', 'compute only: port the image listens on (default 8080)')
     .action(guard((type, name, o) => services.servicesAdd(type, name, o)));
 svc.command('list').option('--json').option('--branch <branch>', 'branch (default: current)')
     .action(guard((o) => services.servicesList(o)));
 svc.command('remove <type> <name>').description('Remove a service and destroy its resources')
     .option('--branch <branch>', 'branch (default: current)')
     .action(guard((type, name, o) => services.servicesRemove(type, name, o)));
+svc.command('rename <type> <name> <new-name>').description('Rename a service and re-key its managed secret names')
+    .option('--json').option('--branch <branch>', 'branch (default: current)')
+    .action(guard((type, name, newName, o) => services.servicesRename(type, name, newName, o)));
 svc.command('set-access <type> <name> <access>').description('Set a storage service bucket access mode (access: public|private)')
     .option('--json').action(guard((type, name, access, o) => services.servicesSetAccess(type, name, access, o)));
 svc.command('scale <type> <name> <number> [region]').description('Set a compute service machine count (paid plans only)')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((type, name, number, region, o) => services.servicesScale(type, name, number, region, o)));
 svc.command('upgrade <type> <name> <spec>').description('Change a compute/postgres service spec (paid plans only)')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((type, name, spec, o) => services.servicesUpgrade(type, name, spec, o)));
+svc.command('secrets <type> <name>').description("List a service's secret names")
+    .option('--branch <b>').option('--json').action(guard((type, name, o) => services.servicesSecrets(type, name, o)));
 // ---- secrets (seam) ----
 const sec = program.command('secrets').description('Fetch the credential bundle (secret seam) into .env')
     .option('--branch <branch>').option('-o, --output <file>', 'output file (default .env)').option('--print', 'print instead of writing').option('--json')
     .action(guard((o) => secretsCmd.secrets(o)));
-sec.command('list').description('List secret names only').option('--branch <branch>').action(guard((o) => secretsCmd.secretsList(o)));
+sec.command('list').description('List secret names, grouped by service').option('--branch <branch>').option('--json').action(guard((o) => secretsCmd.secretsList(o)));
 sec.command('set <name> [value]').description('Set a user secret (project-wide; value from stdin if omitted)')
-    .option('--branch <branch>', 'scope to one branch').action(guard((n, v, o) => secretsCmd.secretsSet(n, v, o)));
+    .option('--branch <branch>', 'scope to one branch').option('--service <type/name>', 'bind to a branch service (implies current branch)')
+    .action(guard((n, v, o) => secretsCmd.secretsSet(n, v, o)));
 sec.command('unset <name>').description('Remove a user secret')
     .option('--branch <branch>', 'scope to one branch').action(guard((n, o) => secretsCmd.secretsUnset(n, o)));
+sec.command('tree').description('Show secrets as project → branch → service → secrets').option('--json')
+    .action(guard((o) => secretsCmd.secretsTree(o)));
 // ---- deploy ----
 program.command('deploy [dir]').description('Deploy a source directory (built remotely on Fly) or a prebuilt --image to a branch compute group')
     .option('--image <url>', 'prebuilt container image to deploy (instead of a source dir)').option('--branch <b>').option('--group <g>').option('--port <p>')
@@ -142,6 +154,8 @@ compute.command('status [service]').description("Show a compute service's desire
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeStatus(service, o)));
 // ---- manifest ----
 program.command('manifest').description('Print an agent-legible view of the project environments').option('--json').action(guard((o) => manifest(o)));
+// ---- regions ----
+program.command('regions').description('List regions available for postgres/compute services').option('--json').action(guard((o) => regions.regionsList(o)));
 // ---- observability ----
 program.command('metrics <target> [group]').description('Service metrics (target: db|compute)')
     .option('--branch <b>').option('--from <unix>').option('--to <unix>').option('--step <s>').option('--json')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.0.21",
+  "version": "0.0.22",
   "type": "module",
   "description": "InstaCloud CLI \u2014 a thin client of the platform control-plane API.",
   "keywords": [