insta 0.0.35 → 0.0.37

package/dist/commands/deploy.js

@@ -1,8 +1,11 @@
 import { resolve, join } from 'node:path';
 import { existsSync, readFileSync } from 'node:fs';
-import { ApiClient, requireProject } from '../api.js';
-import { info, die, handleApproval, renderNextActions } from '../util.js';
-import { flyctlBuildAndPush, ensureFlyctl } from '../flyctl-build.js';
+import { ApiClient, ApiError, requireProject } from '../api.js';
+import { info, die, printJson, handleApproval, renderNextActions } from '../util.js';
+import { flyctlBuildAndPush, ensureFlyctl, defaultBuildRunner, stderrBuildRunner } from '../flyctl-build.js';
+// With --json, stdout must carry exactly one JSON document (the deploy result), so every progress
+// line moves to stderr.
+const note = (opts) => (opts.json ? (m) => void process.stderr.write(m + '\n') : info);
 // Map CLI options to the platform deploy request body. Pure, so it's unit-tested. --websocket is only
 // sent when set (plain deploys unchanged).
 export function deployRequestBody(image, branch, opts) {
@@ -36,38 +39,73 @@ export async function deploy(dir, opts) {
     const api = await ApiClient.load();
     const p = await requireProject();
     const branch = opts.branch ?? p.branch;
+    const log = note(opts);
     let port = opts.port ? Number(opts.port) : undefined;
     if (dir && port === undefined) {
         const dockerfile = join(resolve(process.cwd(), dir), 'Dockerfile');
         const exposed = existsSync(dockerfile) ? dockerfileExposedPort(readFileSync(dockerfile, 'utf8')) : undefined;
         if (exposed) {
             port = exposed;
-            info(`using port ${exposed} (Dockerfile EXPOSE) — override with --port`);
+            log(`using port ${exposed} (Dockerfile EXPOSE) — override with --port`);
         }
     }
     const effOpts = { ...opts, port: port?.toString() };
     const image = dir ? await buildFromSource(api, p.projectId, dir, branch, effOpts) : opts.image;
     const res = await api.rawRequest('POST', `/projects/${p.projectId}/deploy`, deployRequestBody(image, branch, effOpts));
-    if (handleApproval(res))
+    if (handleApproval(res, opts.json))
         return;
+    if (opts.json)
+        return printJson({ image, ...res.body });
     info(`deployed ${image} -> ${res.body.url} (branch ${res.body.branch}, group ${res.body.group})`);
     renderNextActions(res.body.nextActions);
 }
+// The local image tag a daemon-side deploy runs: unique per build so a redeploy replaces, and
+// legible in `docker images`. Pure, so it's unit-tested.
+export function localImageTag(projectId, group, now = Date.now()) {
+    return `insta-src-${projectId.slice(0, 8)}-${group ?? 'default'}:${now}`;
+}
+// Local build for a local daemon (insta-oss): the CLI and the daemon share ONE docker, so a
+// locally-built tag is directly runnable — no registry, no push. Same injectable-runner pattern
+// as flyctl-build.ts.
+export async function dockerBuildLocal(absDir, tag, run = defaultBuildRunner) {
+    const { code } = await run('docker', ['build', '-t', tag, '.'], { cwd: absDir, env: process.env });
+    if (code !== 0)
+        throw new Error(`docker build failed (exit ${code}). See output above.`);
+    return tag;
+}
 // Source mode: mint a scoped Fly deploy token from the platform, then build+push <dir> (needs a
-// Dockerfile) with flyctl's remote builder, returning the pushed image ref to deploy.
-async function buildFromSource(api, projectId, dir, branch, opts) {
+// Dockerfile) with flyctl's remote builder, returning the pushed image ref to deploy. Against a
+// local daemon (insta-oss) the token mint answers 501 — build with docker instead, same contract.
+// Exported with injectable pieces for tests (the repo's DI pattern; no global mocks).
+export async function buildFromSource(api, projectId, dir, branch, opts, run = opts.json ? stderrBuildRunner : defaultBuildRunner) {
     const absDir = resolve(process.cwd(), dir);
     if (!existsSync(join(absDir, 'Dockerfile')))
         die(`no Dockerfile at ${join(absDir, 'Dockerfile')} — add one, or use --image <url>`);
-    await ensureFlyctl();
-    const port = opts.port ? Number(opts.port) : 8080;
-    const tok = await api.rawRequest('POST', `/projects/${projectId}/deploy-token`, { branch, group: opts.group });
-    if (handleApproval(tok))
-        die('deploy requires approval — get it approved, then re-run');
+    const log = note(opts);
+    let tok;
+    try {
+        tok = await api.rawRequest('POST', `/projects/${projectId}/deploy-token`, { branch, group: opts.group });
+    }
+    catch (e) {
+        // 501 = no remote builder here (insta-oss is the only deployment that answers it) — the
+        // daemon deploys from the SAME docker this shell uses, so build locally and hand it the tag.
+        if (!(e instanceof ApiError) || e.status !== 501)
+            throw e;
+        const tag = localImageTag(projectId, opts.group);
+        log(`no remote builder on this daemon — building ${dir} locally with docker…`);
+        const built = await dockerBuildLocal(absDir, tag, run);
+        log(`  built ${built}`);
+        return built;
+    }
+    // exit() with no argument honors the exit code handleApproval just set (2).
+    if (handleApproval(tok, opts.json))
+        process.exit();
     const { token, flyApp } = tok.body;
-    info(`building ${dir} for ${flyApp} (remote builder)…`);
-    const { imageRef } = await flyctlBuildAndPush({ dir: absDir, flyApp, imageLabel: `insta-${Date.now()}`, token, port });
-    info(`  pushed ${imageRef}`);
+    await ensureFlyctl(); // cloud path only — the local path needs docker, which the daemon requires anyway
+    const port = opts.port ? Number(opts.port) : 8080;
+    log(`building ${dir} for ${flyApp} (remote builder)…`);
+    const { imageRef } = await flyctlBuildAndPush({ dir: absDir, flyApp, imageLabel: `insta-${Date.now()}`, token, port }, run);
+    log(`  pushed ${imageRef}`);
     return imageRef;
 }
 //# sourceMappingURL=deploy.js.map

package/dist/commands/env.js

@@ -20,7 +20,20 @@ export async function envShow(opts) {
     if (!env)
         info('  (custom apiUrl — `insta env use <name>` to switch to a named environment)');
 }
-export async function envUse(name) {
+// One stable schema for BOTH envUse outcomes (no-op and real switch), so a scripted caller can key
+// on any field — mcpServer, previous — without probing which branch ran. Pure, unit-tested.
+export function envUseResult(target, previous, changed, sessionDropped) {
+    return {
+        env: target,
+        previous,
+        apiUrl: ENVS[target].api,
+        mcpUrl: ENVS[target].mcp,
+        mcpServer: mcpServerName(target),
+        changed,
+        sessionDropped,
+    };
+}
+export async function envUse(name, opts = {}) {
     const want = name.trim().toLowerCase();
     if (!isEnvName(want))
         die(`unknown environment "${name}" — expected one of: ${ENV_NAMES.join(', ')}`);
@@ -33,6 +46,8 @@ export async function envUse(name) {
     // how envForApiUrl already treats it) instead of being rewritten as a "switch" that needlessly
     // drops a perfectly good session.
     if (normalizeUrl(stored.apiUrl) === normalizeUrl(nextApi)) {
+        if (opts.json)
+            return printJson(envUseResult(target, from ?? target, false, false));
         info(`already on ${target} (${nextApi})`);
         return;
     }
@@ -49,6 +64,8 @@ export async function envUse(name) {
     delete next.refreshToken;
     delete next.user;
     await writeGlobal(next);
+    if (opts.json)
+        return printJson(envUseResult(target, from ?? null, true, hadSession));
     info(`switched ${from ?? '(custom)'} → ${target}`);
     info(`  api: ${nextApi}`);
     info(`  mcp: ${ENVS[target].mcp} (registers as \`${mcpServerName(target)}\`)`);

package/dist/commands/govern.js

@@ -29,12 +29,16 @@ export async function approvalsApprove(id, opts) {
     const api = await ApiClient.load();
     const p = await requireProject();
     const out = await api.request('POST', `/projects/${p.projectId}/approvals/${id}/approve`, { always: !!opts.always });
+    if (opts.json)
+        return printJson(out);
     info(`approved ${out.approval.action} (${id})${opts.always ? ' — policy set to allow' : ''}`);
 }
-export async function approvalsDeny(id) {
+export async function approvalsDeny(id, opts = {}) {
     const api = await ApiClient.load();
     const p = await requireProject();
     const out = await api.request('POST', `/projects/${p.projectId}/approvals/${id}/deny`);
+    if (opts.json)
+        return printJson(out);
     info(`denied ${out.approval.action} (${id})`);
 }
 export async function policyGet(opts) {
@@ -46,10 +50,12 @@ export async function policyGet(opts) {
     for (const [action, decision] of Object.entries(policy))
         info(`${action}: ${decision}`);
 }
-export async function policySet(action, decision) {
+export async function policySet(action, decision, opts = {}) {
     const api = await ApiClient.load();
     const p = await requireProject();
-    await api.request('PUT', `/projects/${p.projectId}/policy/${action}`, { decision });
+    const out = await api.request('PUT', `/projects/${p.projectId}/policy/${action}`, { decision });
+    if (opts.json)
+        return printJson({ action, decision, ...(out ?? {}) });
     info(`policy ${action} = ${decision}`);
 }
 //# sourceMappingURL=govern.js.map

package/dist/commands/metrics.js

@@ -60,7 +60,7 @@ function humanBytes(v, base) {
     const shown = i === 0 && Number.isInteger(value) ? String(value) : value.toFixed(1);
     return `${shown} ${units[i]}`;
 }
-// insta metrics <db|compute> [group]
+// insta metrics <db|compute|redis|mysql|mongodb> [group]
 export async function metrics(component, group, opts) {
     const api = await ApiClient.load();
     const p = await requireProject();
@@ -129,23 +129,60 @@ export async function usage(opts) {
             info(`  ${pr.name}: $${Number(pr.totalCostUsd ?? 0).toFixed(4)}`);
     }
 }
-// pure: platform path for a compute deploy-events request (used by `insta logs --deploy`).
+// pure: platform path for a deploy-events request (used by `insta logs --deploy`). Any Fly-backed
+// component (compute or a managed database) has machine lifecycle events; omitted → the platform
+// defaults to compute.
 export function deployEventsPath(projectId, opts) {
-    return `/projects/${projectId}/deploy-events${qs({ group: opts.group, branch: opts.branch, limit: opts.limit, instance: opts.instance })}`;
+    return `/projects/${projectId}/deploy-events${qs({ component: opts.component, group: opts.group, branch: opts.branch, limit: opts.limit, instance: opts.instance })}`;
 }
 // pure: render one deploy event as a log-style line.
 export function deployEventLine(ev) {
     const inst = ev.instance ? `  (${ev.instance})` : '';
     return `${ev.ts ?? ''}  [${ev.origin ?? ''}] ${ev.type ?? ''}: ${ev.status ?? ''}${inst}`;
 }
-// insta logs <db|compute> [group]
+// A log-window instant from the CLI: unix seconds (all digits) or anything Date.parse reads
+// (ISO-8601 etc.). Throws on junk — a mistyped instant must fail here, not become NaN on the wire.
+export function parseLogInstant(raw, flag) {
+    if (/^\d+$/.test(raw))
+        return Number(raw);
+    const ms = Date.parse(raw);
+    if (Number.isNaN(ms))
+        throw new Error(`invalid ${flag}: ${raw} (unix seconds or an ISO-8601 date)`);
+    return Math.floor(ms / 1000);
+}
+// '90s' | '30m' | '2h' | '1d' → seconds. Throws on junk, zero, and unknown units.
+export function parseSinceSeconds(raw) {
+    const m = /^(\d+)([smhd])$/.exec(raw.trim());
+    if (!m)
+        throw new Error(`invalid --since: ${raw} (e.g. 90s, 30m, 2h, 1d)`);
+    const n = Number(m[1]);
+    if (n === 0)
+        throw new Error(`invalid --since: ${raw} (must be > 0)`);
+    return n * { s: 1, m: 60, h: 3600, d: 86400 }[m[2]];
+}
+// The from/to pair for the logs request, from whichever window flags were given. Pure, unit-tested.
+export function resolveLogWindow(opts, now = Math.floor(Date.now() / 1000)) {
+    if (opts.since && opts.from)
+        throw new Error('pass --since or --from, not both');
+    const from = opts.since ? now - parseSinceSeconds(opts.since) : opts.from !== undefined ? parseLogInstant(opts.from, '--from') : undefined;
+    const to = opts.to !== undefined ? parseLogInstant(opts.to, '--to') : undefined;
+    if (from !== undefined && to !== undefined && to < from)
+        throw new Error('--to is before --from');
+    return { from, to };
+}
+// insta logs <db|compute|redis|mysql|mongodb> [group]
 export async function logs(component, group, opts) {
+    const windowFlags = opts.from !== undefined || opts.to !== undefined || opts.since !== undefined;
+    if (opts.deploy && windowFlags)
+        throw new Error('--from/--to/--since apply to runtime logs, not --deploy events');
+    const { from, to } = resolveLogWindow(opts);
     const api = await ApiClient.load();
     const p = await requireProject();
     if (opts.deploy) {
-        if (component !== 'compute')
-            return info('deploy events are only available for compute');
-        const res = await api.request('GET', deployEventsPath(p.projectId, { group, branch: opts.branch ?? p.branch, limit: opts.limit, instance: opts.instance }));
+        // Machine lifecycle events exist for every Fly-backed component; 'db' (postgres) has no machines.
+        if (component === 'db')
+            return info('deploy events are not available for db — use compute, redis, mysql or mongodb');
+        const res = await api.request('GET', deployEventsPath(p.projectId, { component, group, branch: opts.branch ?? p.branch, limit: opts.limit, instance: opts.instance }));
         if (opts.json)
             return printJson(res);
         if (res.note)
@@ -156,7 +193,7 @@ export async function logs(component, group, opts) {
             info(deployEventLine(ev));
         return;
     }
-    const res = await api.request('GET', `/projects/${p.projectId}/logs${qs({ component, group, branch: opts.branch ?? p.branch, limit: opts.limit, region: opts.region, instance: opts.instance })}`);
+    const res = await api.request('GET', `/projects/${p.projectId}/logs${qs({ component, group, branch: opts.branch ?? p.branch, limit: opts.limit, region: opts.region, instance: opts.instance, from: from !== undefined ? String(from) : undefined, to: to !== undefined ? String(to) : undefined })}`);
     if (opts.json)
         return printJson(res);
     if (res.note)

package/dist/commands/org.js

@@ -8,9 +8,11 @@ export async function orgList(opts) {
     for (const o of orgs)
         info(`${o.id}  ${o.name}${o.is_personal ? ' (personal)' : ''}  [${o.role}]`);
 }
-export async function orgCreate(name) {
+export async function orgCreate(name, opts = {}) {
     const api = await ApiClient.load();
     const { org } = await api.request('POST', '/orgs', { name });
+    if (opts.json)
+        return printJson(org);
     info(`created org ${org.id} (${org.name})`);
 }
 //# sourceMappingURL=org.js.map

package/dist/commands/project.js

@@ -13,14 +13,19 @@ const GENERIC_DIRS = new Set([
     'app', 'apps', 'users', 'user', 'bin', 'new', 'test', 'tests',
 ]);
 // Best-effort: wire the credential-audit hook into the project (no-op if assets aren't built).
-function tryInstallObserve() {
+// quiet: with --json the install still runs, but its note moves to stderr (stdout is JSON-only).
+function tryInstallObserve(quiet = false) {
     try {
         const r = installObserve({ cwd: process.cwd() });
-        if (r.claude || r.codex)
-            info('  installed observe hook (credential audit) → ./.insta/observe');
+        if (r.claude || r.codex) {
+            const line = '  installed observe hook (credential audit) → ./.insta/observe';
+            quiet ? process.stderr.write(line + '\n') : info(line);
+        }
     }
     catch { /* assets missing (dev/unbuilt) — skip silently */ }
 }
+// installSkills prints to stdout by default; with --json its notes go to stderr instead.
+const skillsPrint = (json) => (json ? (s) => void process.stderr.write(s + '\n') : undefined);
 async function resolveOrg(api, given) {
     if (given)
         return given;
@@ -51,7 +56,10 @@ export async function projectCreate(name, opts) {
     const resolved = resolveProjectName(name, process.cwd());
     if (!resolved) {
         // No name given and the cwd name is generic — don't provision resources under a junk name.
-        // Guide instead (no hang, no error): name it explicitly, or just ask the skill-equipped agent.
+        // A terminal gets guidance (no hang, no error); --json is a scripted caller with no human to
+        // guide, so it gets a hard error instead of an empty success.
+        if (opts.json)
+            die('no project name — pass one: insta project create <name>');
         info('name your project:  insta project create <name>');
         info('  (or just ask your coding agent — it has the insta skill and will do this for you)');
         return;
@@ -60,12 +68,17 @@ export async function projectCreate(name, opts) {
     const orgId = await resolveOrg(api, opts.org);
     const out = await api.request('POST', `/orgs/${orgId}/projects`, { name: resolved });
     await writeProject({ projectId: out.project.id, orgId, branch: out.defaultBranch.name });
-    info(`created project ${out.project.id} (${resolved})`);
-    info(`  resources: ${out.resources.map((r) => r.kind).join(', ')}`);
-    info(`  linked ./.insta/project.json (branch ${out.defaultBranch.name})`);
-    renderNextActions(out.nextActions);
-    tryInstallObserve();
-    await installSkills({ cwd: process.cwd() });
+    if (opts.json) {
+        printJson({ ...out, linked: { projectId: out.project.id, orgId, branch: out.defaultBranch.name } });
+    }
+    else {
+        info(`created project ${out.project.id} (${resolved})`);
+        info(`  resources: ${out.resources.map((r) => r.kind).join(', ')}`);
+        info(`  linked ./.insta/project.json (branch ${out.defaultBranch.name})`);
+        renderNextActions(out.nextActions);
+    }
+    tryInstallObserve(opts.json);
+    await installSkills({ cwd: process.cwd(), print: skillsPrint(opts.json) });
 }
 export async function projectList(opts) {
     const api = await ApiClient.load();
@@ -78,20 +91,25 @@ export async function projectList(opts) {
     for (const p of projects)
         info(`${p.id}  ${p.name}  [${p.status}]`);
 }
-export async function projectLink(id) {
+export async function projectLink(id, opts = {}) {
     const api = await ApiClient.load();
     const { project } = await api.request('GET', `/projects/${id}`);
     await writeProject({ projectId: project.id, orgId: project.org_id, branch: 'main' });
-    info(`linked project ${project.id} (${project.name})`);
-    tryInstallObserve();
-    await installSkills({ cwd: process.cwd() });
+    if (opts.json)
+        printJson({ project, linked: { projectId: project.id, orgId: project.org_id, branch: 'main' } });
+    else
+        info(`linked project ${project.id} (${project.name})`);
+    tryInstallObserve(opts.json);
+    await installSkills({ cwd: process.cwd(), print: skillsPrint(opts.json) });
 }
 export async function projectDelete(opts) {
     const api = await ApiClient.load();
     const projectId = opts.project ?? (await requireProject()).projectId;
     const res = await api.rawRequest('DELETE', `/projects/${projectId}`);
-    if (handleApproval(res))
+    if (handleApproval(res, opts.json))
         return;
+    if (opts.json)
+        return printJson({ ok: true, projectId });
     info(`deleted project ${projectId}`);
 }
 //# sourceMappingURL=project.js.map

package/dist/commands/run.js

@@ -4,7 +4,7 @@
 // as the process does.
 import { spawn } from 'node:child_process';
 import { ApiClient, requireProject } from '../api.js';
-import { die, info } from '../util.js';
+import { die, handleApproval } from '../util.js';
 /** Core, dependency-injected for tests: spawn cmd with the bundle in env, return its exit code. */
 export async function runWithSecrets(cmd, args, deps) {
     const bundle = await deps.fetchBundle();
@@ -28,10 +28,12 @@ export async function run(cmdAndArgs, opts) {
     const code = await runWithSecrets(cmd, rest, {
         fetchBundle: async () => {
             const res = await api.rawRequest('GET', `/projects/${p.projectId}/secrets?branch=${encodeURIComponent(branch)}`);
-            if (res.status === 202) {
-                die(`secrets.read requires approval — run: insta approvals approve ${res.body.approvalId}, then re-run`);
-            }
-            info(`running with ${Object.keys(res.body.secrets).length} injected secrets (branch ${branch}) — nothing written to disk`);
+            // exit() with no argument honors the exit code handleApproval just set (2).
+            if (handleApproval(res))
+                process.exit();
+            // stderr, not stdout: `insta run`'s stdout belongs entirely to the child command (that's why
+            // run has no --json — wrapping would break the child's own output contract).
+            process.stderr.write(`running with ${Object.keys(res.body.secrets).length} injected secrets (branch ${branch}) — nothing written to disk\n`);
             return res.body.secrets;
         },
     });

package/dist/commands/secrets.js

@@ -12,7 +12,7 @@ export async function secrets(opts) {
     const p = await requireProject();
     const branch = opts.branch ?? p.branch;
     const res = await api.rawRequest('GET', `/projects/${p.projectId}/secrets${q(branch)}`);
-    if (handleApproval(res))
+    if (handleApproval(res, opts.json))
         return;
     const bundle = res.body.secrets;
     if (opts.json)
@@ -47,7 +47,7 @@ export async function secretsTree(opts) {
     const api = await ApiClient.load();
     const p = await requireProject();
     const res = await api.rawRequest('GET', `/projects/${p.projectId}/secrets/tree`);
-    if (handleApproval(res))
+    if (handleApproval(res, opts.json))
         return;
     const tree = res.body;
     if (opts.json)
@@ -68,7 +68,7 @@ export async function secretsList(opts) {
     const p = await requireProject();
     const branch = opts.branch ?? p.branch;
     const res = await api.rawRequest('GET', `/projects/${p.projectId}/secrets/tree`);
-    if (handleApproval(res))
+    if (handleApproval(res, opts.json))
         return;
     const tree = res.body;
     const b = tree.branches.find((x) => x.name === branch);
@@ -102,8 +102,10 @@ export async function secretsSet(name, value, opts) {
     const branch = opts.service ? (opts.branch ?? p.branch) : opts.branch;
     const payload = { value: v, ...(branch ? { branch } : {}), ...(opts.service ? { service: opts.service } : {}) };
     const res = await api.rawRequest('PUT', `/projects/${p.projectId}/secrets/${encodeURIComponent(name)}`, payload);
-    if (handleApproval(res))
+    if (handleApproval(res, opts.json))
         return;
+    if (opts.json)
+        return printJson({ ok: true, name, branch: branch ?? null, service: opts.service ?? null });
     info(`set ${name}${opts.service ? ` → ${opts.service}` : ''} (${branch ? `branch ${branch}` : 'project-wide'})`);
 }
 export async function secretsUnset(name, opts) {
@@ -111,10 +113,75 @@ export async function secretsUnset(name, opts) {
     const p = await requireProject();
     const qs = opts.branch ? `?branch=${encodeURIComponent(opts.branch)}` : '';
     const res = await api.rawRequest('DELETE', `/projects/${p.projectId}/secrets/${encodeURIComponent(name)}${qs}`);
-    if (handleApproval(res))
+    if (handleApproval(res, opts.json))
         return;
+    if (opts.json)
+        return printJson({ ok: true, name, branch: opts.branch ?? null });
     info(`unset ${name} (${opts.branch ? `branch ${opts.branch}` : 'project-wide'})`);
 }
+export async function secretsBind(envName, source, opts) {
+    if (!opts.to)
+        die('--to <compute/name> is required');
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const branch = opts.branch ?? p.branch;
+    const res = await api.rawRequest('PUT', `/projects/${p.projectId}/secret-bindings/${encodeURIComponent(envName)}`, {
+        branch,
+        target: opts.to,
+        source,
+        ...(opts.sourceName ? { sourceName: opts.sourceName } : {}),
+    });
+    if (handleApproval(res, opts.json))
+        return;
+    if (opts.json)
+        return printJson({ ok: true });
+    info(`bound ${envName} on ${opts.to} to ${source}${opts.sourceName ? `.${opts.sourceName}` : ''} (branch ${branch})`);
+}
+export async function secretsUnbind(envName, opts) {
+    if (!opts.from)
+        die('--from <compute/name> is required');
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const branch = opts.branch ?? p.branch;
+    const res = await api.rawRequest('DELETE', `/projects/${p.projectId}/secret-bindings/${encodeURIComponent(envName)}?branch=${encodeURIComponent(branch)}&target=${encodeURIComponent(opts.from)}`);
+    if (handleApproval(res, opts.json))
+        return;
+    if (opts.json)
+        return printJson({ ok: true });
+    info(`unbound ${envName} from ${opts.from} (branch ${branch})`);
+}
+export async function secretsBindings(opts) {
+    if (!opts.target)
+        die('--target <compute/name> is required');
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const branch = opts.branch ?? p.branch;
+    const res = await api.rawRequest('GET', `/projects/${p.projectId}/secret-bindings?branch=${encodeURIComponent(branch)}&target=${encodeURIComponent(opts.target)}`);
+    if (handleApproval(res, opts.json))
+        return;
+    const bindings = res.body.bindings ?? [];
+    if (opts.json)
+        return printJson(bindings);
+    if (!bindings.length)
+        return info(`(no secret bindings for ${opts.target} on ${branch})`);
+    for (const b of bindings)
+        info(`${b.envName} <- ${b.source.type}/${b.source.name}.${b.sourceName}`);
+}
+export async function secretsSources(opts) {
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const branch = opts.branch ?? p.branch;
+    const res = await api.rawRequest('GET', `/projects/${p.projectId}/secret-sources?branch=${encodeURIComponent(branch)}`);
+    if (handleApproval(res, opts.json))
+        return;
+    const sources = res.body.sources ?? [];
+    if (opts.json)
+        return printJson(sources);
+    if (!sources.length)
+        return info(`(no credential sources on ${branch})`);
+    for (const s of sources)
+        info(`${s.service.type}/${s.service.name}: ${s.secrets.join(', ')}`);
+}
 /** Gitignore the env file we just wrote (git repos only; idempotent). Returns true if added. */
 export function ensureIgnored(cwd, name) {
     if (!existsSync(join(cwd, '.git')))

package/dist/commands/services.js

@@ -1,7 +1,7 @@
-// `insta services` — manage a project's opt-in services (postgres | storage | compute | redis).
+// `insta services` — manage a project's opt-in services (postgres | storage | compute | redis | mysql | mongodb).
 import { ApiClient, requireProject } from '../api.js';
 import { info, printJson, handleApproval, renderNextActions } from '../util.js';
-export const SERVICE_TYPES = ['postgres', 'storage', 'compute', 'redis'];
+export const SERVICE_TYPES = ['postgres', 'storage', 'compute', 'redis', 'mysql', 'mongodb'];
 const SERVICE_NAME_RE = /^[a-z0-9][a-z0-9-]{0,38}$/;
 export function q(branch) {
     return branch ? `?branch=${encodeURIComponent(branch)}` : '';
@@ -72,6 +72,9 @@ export function resolveSoleService(services, type, name) {
 export function resolveComputeServiceId(services, name) {
     return resolveSoleService(services, 'compute', name).id;
 }
+function defaultDatabasePort(type) {
+    return type === 'mysql' ? 3306 : type === 'mongodb' ? 27017 : 6379;
+}
 // Map service-add options to the platform POST body. Pure, so it's unit-tested without a network
 // mock (mirrors deployRequestBody in deploy.ts). Validation (which options are valid for which
 // type) stays in servicesAdd, ahead of any network/config access.
@@ -108,7 +111,7 @@ export async function servicesAdd(type, name, opts = {}) {
     const p = await requireProject();
     const branch = opts.branch ?? p.branch;
     const res = await api.rawRequest('POST', `/projects/${p.projectId}/services`, servicesAddRequestBody(type, name, branch, opts));
-    if (handleApproval(res))
+    if (handleApproval(res, opts.json))
         return;
     if (opts.json)
         return printJson(res.body.service);
@@ -124,7 +127,7 @@ export async function servicesAdd(type, name, opts = {}) {
 export function serviceListLine(s) {
     const extra = s.type === 'compute'
         ? `  x${s.machine_count}${s.volume_gib ? `  vol ${s.volume_gib}Gi` : ''}${s.image ? `  running ${s.image}${s.port ? `:${s.port}` : ''}` : ''}`
-        : s.type === 'redis' ? `  tcp/${s.port ?? 6379}${s.volume_gib ? `  vol ${s.volume_gib}Gi` : ''}`
+        : ['redis', 'mysql', 'mongodb'].includes(s.type) ? `  tcp/${s.port ?? defaultDatabasePort(s.type)}${s.volume_gib ? `  vol ${s.volume_gib}Gi` : ''}`
             : s.type === 'storage' ? `  ${s.public ? 'public' : 'private'}` : '';
     return `${s.type}/${s.name}  [${s.status}]${extra}${s.domain ? `  ${s.domain}` : ''}  ${s.id}`;
 }
@@ -136,7 +139,7 @@ export async function servicesList(opts) {
     if (opts.json)
         return printJson(services);
     if (!services.length)
-        return info(`(no services on ${branch ?? 'default'} — add one with \`insta services add <postgres|storage|compute|redis> <name>\`)`);
+        return info(`(no services on ${branch ?? 'default'} — add one with \`insta services add <postgres|storage|compute|redis|mysql|mongodb> <name>\`)`);
     for (const s of services)
         info(serviceListLine(s));
 }
@@ -148,8 +151,10 @@ export async function servicesRemove(type, name, opts = {}) {
     const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(branch)}`);
     const id = resolveServiceId(services, type, name);
     const res = await api.rawRequest('DELETE', `/projects/${p.projectId}/services/${id}`);
-    if (handleApproval(res))
+    if (handleApproval(res, opts.json))
         return;
+    if (opts.json)
+        return printJson({ ok: true, removed: { id, type, name, branch: branch ?? null } });
     info(`removed ${type} service ${name} from ${branch ?? 'default'}`);
 }
 export async function servicesRename(type, name, newName, opts = {}) {
@@ -161,7 +166,7 @@ export async function servicesRename(type, name, newName, opts = {}) {
     const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(branch)}`);
     const id = resolveServiceId(services, type, name);
     const res = await api.rawRequest('POST', `/projects/${p.projectId}/services/${id}/rename`, { name: newName });
-    if (handleApproval(res))
+    if (handleApproval(res, opts.json))
         return;
     if (opts.json)
         return printJson(res.body.service);
@@ -184,7 +189,7 @@ export async function servicesSetAccess(type, name, access, _opts) {
     const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(p.branch)}`);
     const id = resolveServiceId(services, type, name);
     const res = await api.rawRequest('PUT', `/projects/${p.projectId}/services/${id}/access`, { public: isPublic });
-    if (handleApproval(res))
+    if (handleApproval(res, _opts.json))
         return;
     if (_opts.json)
         return printJson(res.body.service);
@@ -199,7 +204,7 @@ export async function servicesScale(type, name, number, region, _opts) {
     const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(_opts.branch ?? p.branch)}`);
     const id = resolveServiceId(services, type, name);
     const res = await api.rawRequest('POST', `/projects/${p.projectId}/services/${id}/scale`, { machineCount, region });
-    if (handleApproval(res))
+    if (handleApproval(res, _opts.json))
         return;
     if (_opts.json)
         return printJson(res.body.service);
@@ -213,7 +218,7 @@ export async function servicesUpgrade(type, name, spec, _opts) {
     const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(_opts.branch ?? p.branch)}`);
     const id = resolveServiceId(services, type, name);
     const res = await api.rawRequest('POST', `/projects/${p.projectId}/services/${id}/upgrade`, { spec });
-    if (handleApproval(res))
+    if (handleApproval(res, _opts.json))
         return;
     if (_opts.json)
         return printJson(res.body.service);
@@ -227,7 +232,7 @@ export async function servicesSecrets(type, name, opts = {}) {
     const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(opts.branch ?? p.branch)}`);
     const id = resolveServiceId(services, type, name);
     const res = await api.rawRequest('GET', `/projects/${p.projectId}/services/${id}/secrets`);
-    if (handleApproval(res))
+    if (handleApproval(res, opts.json))
         return;
     const { secrets } = res.body;
     if (opts.json)