insta 0.0.82 → 0.1.0

package/README.md

@@ -33,15 +33,17 @@ version-pinned `npm install -g` fallback to run yourself). E2e-validated on macO
 and Windows (PowerShell + cmd):
 
 ```bash
-npx -y insta@latest setup agent
+npx -y insta@latest agent setup
 ```
 
+`insta setup agent` is still accepted as a hidden alias, so older instructions keep working.
+
 This command means **production** (CLI ≥ 0.0.38): if the machine was previously switched to
 staging it switches back — announced, session dropped, like `insta env use prod`. Staging is
 its own explicit command, which also persists the choice:
 
 ```bash
-npx -y insta@latest setup agent --env staging
+npx -y insta@latest agent setup --env staging
 ```
 
 On macOS/Linux without Node, the native-binary installer puts the `insta` CLI on PATH (the
@@ -56,7 +58,7 @@ curl -fsSL agents.instacloud.com | sh
 
 Pin a version with `INSTA_VERSION=v0.0.22`; change the install directory with
 `INSTA_INSTALL_DIR`. While the CLI is pre-1.0 it updates itself on new releases. Turn that
-off with `insta autoupdate off`.
+off with `insta config autoupdate off`.
 
 ## Quickstart
 
@@ -72,7 +74,7 @@ insta deploy .
 
 `project create` makes an empty project and links the current directory. Services are
 opt-in, so you add only what you need. `secrets` writes the current branch's user-defined
-secrets to `./.env` (the postgres connection string is read with `insta db url`). `deploy .`
+secrets to `./.env` (the postgres connection string is read with `insta postgres url`). `deploy .`
 builds the directory remotely and ships it to the branch's compute
 service, with no local Docker. Whether it needs a `Dockerfile` depends on where the
 service runs: on insta-compute it is optional, and a directory without one is built
@@ -119,7 +121,7 @@ the two branches diverge independently. A project is capped at 10 branches.
 only. Provider-minted service credentials (`DATABASE_URL`, `BUCKET_NAME`,
 `AWS_ACCESS_KEY_ID`, …) are not in that bundle — they reach compute through explicit
 `insta secrets bind` rules, and the postgres connection string is read directly with
-`insta db url` (or `insta db connect` for a psql session).
+`insta postgres url` (or `insta postgres connect` for a psql session).
 
 Secrets can be scoped per compute service, so several services may each define the same name — and
 a flat bundle cannot carry two values for one name. Such a name is **withheld** from the bundle and
@@ -133,8 +135,8 @@ it as `insta run --service compute/<name>` to inject exactly what that one servi
 
 Agent requests are governed by the project's `agent-policy`; human requests use normal RBAC.
 Where the agent policy says `approve`, the command stops and prints an approval id for a human
-admin to grant with `insta approvals approve <id>`. The agent then retries the unchanged request.
-Run `insta --agent agent-policy get --json` for stored overrides, `defaultRules`, `effectiveRules`,
+admin to grant with `insta agent approvals approve <id>`. The agent then retries the unchanged request.
+Run `insta --agent agent policy get --json` for stored overrides, `defaultRules`, `effectiveRules`,
 `bootstrapRules` and `ruleNotes`. Rules distinguish no affected branches (`project`), unprotected
 branches and protected branches. They describe policy, not authorization: RBAC, session checks,
 actual affected resources and compound actions still apply. An empty override object does not
@@ -143,8 +145,8 @@ mean rules are unavailable. Text output also lists effective rules. The old `pol
 
 ### Agents get the same surface
 
-`insta manifest` prints an agent-legible view of every branch and its URLs. `insta setup
-agent` installs the InstaCloud skill and registers the remote MCP server for the coding
+`insta agent manifest` prints an agent-legible view of every branch and its URLs. `insta agent
+setup` installs the InstaCloud skill and registers the remote MCP server for the coding
 agents on the machine — and, when running from the npx cache with no durable `insta` on
 PATH, first installs the CLI itself globally.
 
@@ -211,29 +213,26 @@ build never reaches a production installer.
 | Command | What it covers |
 |---|---|
 | `insta login` · `logout` · `status` | Browser sign-in (default), `--email` + password, or `--oauth github\|google`; `status` shows the environment, login and linked project/branch |
-| `insta env` | `show` · `use <prod\|staging>` |
-| `insta setup` | `agent` — install the CLI (if missing), the skill, and MCP for every coding agent; targets prod, `--env staging` for staging |
-| `insta mcp` | `install` — register the remote MCP server only |
 | `insta org` | `list` · `create` (one free org per user) |
 | `insta project` | `create` · `list` · `link` · `delete` |
 | `insta branch` | `create` · `list` · `switch` · `delete` · `merge` |
-| `insta services` | `add` · `list` · `remove` · `rename` · `set-access` · `scale` · `upgrade` · `secrets` |
-| `insta secrets` | Write `.env`, plus `list` · `set` · `unset` · `tree` |
+| `insta service` (`services`, `svc`) | `add` · `list` · `remove` · `rename` |
+| `insta secrets` | Write `.env`, plus `list` · `set` · `unset` · `bind` · `unbind` · `bindings` · `sources` · `tree` |
+| `insta domain` | Bought or bring-your-own: `attach` · `check` · `detach`; buy through InstaCloud: `search` · `buy` · `list` · `status` · `records …` |
+| `insta compute` | `start` · `stop` · `suspend` · `restart` · `status` · `scale` · `limits` · `volume` · `always-on` · `exec` · `ssh` · `repo` · `connect-repo` · `watch-paths` · `disconnect-repo` · `logs` · `metrics` |
+| `insta postgres` | `url` (print the DSN) · `connect` (psql) · `stats` · `limits` · `volume` · `always-on` · `logs` · `metrics` — every verb takes `[service]` |
+| `insta redis` · `mysql` · `mongodb` | `query` · `status` · `limits` · `volume` · `always-on` · `logs` · `metrics` |
+| `insta storage` | `list` · `get` · `delete` · `set-access` |
+| `insta build [dir]` · `deploy [dir]` | Verify a source dir would build; deploy a source directory (built remotely) or `--image <url>`. `insta build logs <id>` reads source-build output: `--source archive` (default) uses the deploy operation ID, `--source github` uses a GitHub build ID; `--follow` watches output, `--json` returns one snapshot |
 | `insta run <cmd>` | Run a command with the branch bundle injected, nothing written to disk |
-| `insta deploy [dir]` | Deploy a source directory (built remotely) or `--image <url>` |
-| `insta compute` | `start` · `stop` · `suspend` · `status` · `set-domain` · `check-domain` · `remove-domain` |
-| `insta domain` | Buy a domain through InstaCloud: `search` · `buy` · `attach` · `list` · `status` |
-| `insta db` | `url` (print the postgres DSN) · `connect` (psql session) · `limits` · `stats` · `always-on` · `volume` |
-| `insta regions` | Regions available for postgres and compute |
-| `insta manifest` | Agent-legible view of every branch and its URLs |
-| `insta build-logs <id>` | Read source-build output; `--source archive` (default) uses the deploy operation ID, `--source github` uses a GitHub build ID; `--follow` watches output, `--json` returns one snapshot |
-| `insta metrics` · `logs` · `events` | Service metrics; runtime logs (`--deploy` for deploy events); audit timeline |
-| `insta usage` · `billing` | Usage by billing dimension; `billing upgrade` · `billing portal` |
-| `insta approvals` | `list` · `approve` · `deny` |
-| `insta agent-policy` | `get` · `set <mode>` · `protect-branch` · `unprotect-branch` · `rule set <action> <decision>` · `revoke-sessions` |
-| `insta observe` | `install` · `uninstall` · `report` · `sync` — local credential audit |
+| `insta template` | `list` · `info` · `deploy` |
+| `insta billing` | Current cycle overview; `subscribe <tier>` · `portal` · `usage` |
+| `insta agent` | `setup` (this machine's coding agents) · `manifest` · `policy …` · `approvals …` · `observe …` · `events` |
+| `insta config` | `install-mcp` · `regions` · `autoupdate` |
 | `insta feedback` | Report an InstaCloud-side hurdle (bug / feature-request / friction) to the team — never for the app you are building; works logged-out |
-| `insta upgrade` · `autoupdate` | Update the CLI; show or set auto-update |
+| `insta upgrade` | Update the CLI |
+
+Every command accepts `--api-url <url>` for this invocation only (internal debugging); for `compute exec`, place it before `compute`. `insta --help` documents it.
 
 ## Configuration
 
@@ -256,10 +255,10 @@ build never reaches a production installer.
 ## Agent skills
 
 The `insta` skill and its task guides live in
-[InsForge/instacloud-skills](https://github.com/InsForge/instacloud-skills). `insta setup agent`
+[InsForge/instacloud-skills](https://github.com/InsForge/instacloud-skills). `insta agent setup`
 installs it user-globally for every coding agent on the machine. `insta project create` and
 `insta project link` additionally install the stack skills (Tigris, Better Auth) into the
-project, along with the `insta observe` credential-audit hook. Postgres needs no stack
+project, along with the `insta agent observe` credential-audit hook. Postgres needs no stack
 skill — it's plain Postgres, reached directly via `DATABASE_URL`.
 
 ## Contributing

package/dist/agent.js

@@ -17,7 +17,7 @@ export function canonicalTarget(path) {
     const url = new URL(path, 'https://platform.invalid');
     return url.pathname + url.search;
 }
-const guidance = 'agent session missing, expired, or for another project/environment — run `insta setup agent`';
+const guidance = 'agent session missing, expired, or for another project/environment — run `insta agent setup`';
 export async function issueAgentSession(api, projectId) {
     const pair = generateKeyPairSync('ed25519');
     const client = mode?.client ?? detectAgent(false)?.client ?? 'unknown';
@@ -30,7 +30,7 @@ export async function saveAgentSession(session, cwd = process.cwd()) {
     const root = await findProjectRoot(cwd) ?? cwd;
     const rel = '.insta/agent-session.json';
     if (alreadyTracked(root, [rel]).length)
-        throw new Error('agent-session.json is tracked by Git; untrack it before running insta setup agent');
+        throw new Error('agent-session.json is tracked by Git; untrack it before running insta agent setup');
     ensureGitignore(root, [rel], '# Local agent credentials');
     const dir = join(root, '.insta');
     await mkdir(dir, { recursive: true });

package/dist/api.js

@@ -1,6 +1,6 @@
 // Thin API client over the platform control-plane. Handles bearer auth + one-shot refresh on 401.
 // 2xx (including 202 approval_required) returns the parsed body; >=400 throws ApiError.
-import { readGlobal, writeGlobal, readProject, persistAutoLink, resolveProjectLink, foreignLinkMessage } from './config.js';
+import { readGlobal, readPersistedGlobal, writeGlobal, readProject, persistAutoLink, resolveProjectLink, foreignLinkMessage } from './config.js';
 import { autoResolveProject, promptChoice } from './resolve-project.js';
 import { die } from './util.js';
 import { USER_AGENT } from './version.js';
@@ -45,8 +45,23 @@ export class ApiClient {
     static async load() { return new ApiClient(await readGlobal()); }
     get apiUrl() { return this.cfg.apiUrl; }
     get config() { return this.cfg; }
-    async persist() { await writeGlobal(this.cfg); }
-    setApiUrl(url) { this.cfg.apiUrl = url; }
+    // `this.cfg` came from readGlobal(), which has already folded in the AMBIENT control-plane
+    // override (--api-url, INSTA_API_URL, INSTA_ENV) — so writing it back verbatim persists a
+    // debugging override as this machine's control plane. `insta logout --api-url <staging>` did
+    // exactly that: it re-pointed the stored apiUrl at staging and dropped the real login with it
+    // (readGlobal scrubs the session of a foreign deployment, and that scrubbed view was the thing
+    // being written). Only an EXPLICIT setApiUrl — a login, which chose the deployment it
+    // authenticated against — may move the stored URL; everything else keeps what is on disk.
+    async persist() {
+        if (this.apiUrlExplicit)
+            return writeGlobal(this.cfg);
+        await writeGlobal({ ...this.cfg, apiUrl: (await readPersistedGlobal()).apiUrl });
+    }
+    apiUrlExplicit = false;
+    setApiUrl(url) {
+        this.cfg.apiUrl = url;
+        this.apiUrlExplicit = true;
+    }
     setSession(tokens, user) {
         this.cfg.accessToken = tokens.accessToken;
         this.cfg.refreshToken = tokens.refreshToken;
@@ -144,7 +159,7 @@ export async function requireProject(deps = {}) {
     if (r)
         return r.link;
     if (agentMode())
-        die('agent mode requires a linked project — run `insta setup agent --project <id>`');
+        die('agent mode requires a linked project — run `insta agent setup --project <id>`');
     if (deps.autoResolve)
         return deps.autoResolve();
     // One command, just works: unlinked ≠ error. Resolve the project (auto when there's one,

package/dist/build-logs.js

@@ -24,7 +24,20 @@ export async function readBuildLogs(api, projectId, source, buildId, signal = Ab
             if (++requests > 200)
                 throw new Error('build logs exceed the per-read page limit');
             const params = new URLSearchParams({ ...(step ? { step } : {}), ...(cursor ? { cursor } : {}) });
-            const { body } = await api.rawRequest('GET', `/projects/${projectId}/builds/${source}/${encodeURIComponent(buildId)}/logs?${params}`, undefined, { signal });
+            signal.throwIfAborted();
+            const request = new AbortController();
+            const abort = () => request.abort(signal.reason);
+            signal.addEventListener('abort', abort, { once: true });
+            const timeout = setTimeout(() => request.abort(new DOMException('build log request timed out', 'TimeoutError')), 20_000);
+            let body;
+            try {
+                const response = await api.rawRequest('GET', `/projects/${projectId}/builds/${source}/${encodeURIComponent(buildId)}/logs?${params}`, undefined, { signal: request.signal });
+                body = response.body;
+            }
+            finally {
+                clearTimeout(timeout);
+                signal.removeEventListener('abort', abort);
+            }
             if (!body || !['ready', 'pending', 'unsupported', 'unavailable'].includes(body.state) || !Array.isArray(body.steps) || !Array.isArray(body.entries))
                 throw new Error('invalid build log response');
             bytes += Buffer.byteLength(JSON.stringify(body));
@@ -143,20 +156,24 @@ export function archiveLogWatcher(api, projectId, write, wait = sleep) {
     const follow = { tails: new Map(), emit: snapshot => printer.print(snapshot, write) };
     let warned = '';
     let unavailable = false;
-    return async (buildId, finished, remainingMs = 30_000) => {
+    return async (buildId, finished, remainingMs = 30_000, cancelSignal) => {
         if (unavailable)
             return;
-        const deadline = Date.now() + Math.min(remainingMs, finished ? 18_000 : 3000);
+        const started = Date.now();
+        const deadline = started + remainingMs;
+        const refreshDeadline = started + Math.min(remainingMs, finished ? 18_000 : remainingMs);
         for (let attempt = 0; attempt < (finished ? 6 : 1); attempt++) {
             if (attempt > 0)
-                await wait(Math.min(3000, Math.max(0, deadline - Date.now())));
-            const remaining = deadline - Date.now();
+                await wait(Math.min(3000, Math.max(0, refreshDeadline - Date.now())));
+            const finalRead = finished && (attempt === 5 || Date.now() >= refreshDeadline);
+            const remaining = Math.min(deadline - Date.now(), finalRead ? 30_000 : refreshDeadline - Date.now());
             if (remaining <= 0)
                 return;
-            if (finished && (attempt === 0 || attempt === 5))
+            if (finished && (attempt === 0 || finalRead))
                 follow.tails.clear();
+            const signal = cancelSignal ?? AbortSignal.timeout(remaining);
             try {
-                const snapshot = await readBuildLogs(api, projectId, 'archive', buildId, AbortSignal.timeout(remaining), follow);
+                const snapshot = await readBuildLogs(api, projectId, 'archive', buildId, signal, follow);
                 if (snapshot.state === 'unsupported') {
                     printer.finishLine(write);
                     write('Build logs are not supported for this build provider.\n');
@@ -168,14 +185,21 @@ export function archiveLogWatcher(api, projectId, write, wait = sleep) {
                 warned = '';
             }
             catch (error) {
+                if (cancelSignal?.aborted)
+                    return;
+                if (finished && signal.aborted && !finalRead && Date.now() < deadline)
+                    continue;
                 if (error instanceof ApiError && error.status === 400)
                     follow.tails.clear();
                 printer.finishLine(write);
-                const message = `Could not read build logs. Retry with: insta build-logs ${buildId}\n`;
+                const reason = signal.aborted || (error instanceof Error && error.name === 'TimeoutError') ? ' (timed out)' : error instanceof ApiError ? ` (HTTP ${error.status})` : '';
+                const message = `Could not read build logs${reason}. Retry with: insta build logs ${buildId}\n`;
                 if (warned !== message)
                     write(message);
                 warned = message;
             }
+            if (finalRead)
+                return;
         }
     };
 }

package/dist/commands/agent-policy.js

@@ -82,7 +82,7 @@ export function applyRule(policy, out, action, decision) {
         return { ...policy, branchDeveloperRules: { ...(policy.branchDeveloperRules ?? {}), [action]: decision } };
     const entry = catalog.find(e => e.action === action);
     if (!entry)
-        throw new Error(`unknown action: ${action}\nrun: insta agent-policy get --json`);
+        throw new Error(`unknown action: ${action}\nrun: insta agent policy get --json`);
     if (!entry.editable)
         throw new Error(`${action} is a fixed policy invariant and cannot be overridden`);
     // Snapshot taken from the resolved unprotected-branch view, which is the context these rules

package/dist/commands/auth.js

@@ -1,12 +1,19 @@
 import { createServer } from 'node:http';
 import { randomBytes } from 'node:crypto';
 import { ApiClient, ApiError, linkedProject } from '../api.js';
+import { readGlobal, readPersistedGlobal } from '../config.js';
 import { agentMode } from '../agent.js';
-import { ENVS, ENV_NAMES, envForApiUrl, isEnvName } from '../env.js';
+import { ENVS, ENV_NAMES, envForApiUrl, isEnvName, normalizeUrl } from '../env.js';
 import { info, die, printJson, promptPassword, openUrl } from '../util.js';
 /** --api-url and --env both set the target host; --api-url wins (more specific), matching the
  *  INSTA_API_URL > INSTA_ENV precedence in config.ts. Returns the URL to point at, or undefined
- *  to leave whatever is already resolved alone. */
+ *  to leave whatever is already resolved alone.
+ *
+ *  Every login entry point feeds this into `api.setApiUrl(targetApiUrl(opts) ?? api.apiUrl)`: a
+ *  login is the one command that MAY move the machine's stored control-plane URL, and it must
+ *  store the deployment it actually authenticated against — flag, env var or stored URL alike.
+ *  Without the explicit set, ApiClient.persist() keeps the URL already on disk (see its comment),
+ *  which would file a session minted on one deployment under another one's URL. */
 function targetApiUrl(opts) {
     if (opts.apiUrl)
         return opts.apiUrl;
@@ -50,9 +57,7 @@ export async function login(opts, device = loginDevice, claim = loginClaim) {
         return device(opts, openUrl);
     }
     const api = await ApiClient.load();
-    const target = targetApiUrl(opts);
-    if (target)
-        api.setApiUrl(target);
+    api.setApiUrl(targetApiUrl(opts) ?? api.apiUrl);
     const password = opts.password ?? process.env.INSTA_PASSWORD ?? (await promptPassword());
     const res = await api.request('POST', '/auth/login', { email: opts.email, password }, { auth: false });
     api.setSession(res, res.user);
@@ -65,9 +70,7 @@ export async function loginOauth(provider, opts) {
     if (provider !== 'github' && provider !== 'google')
         die('provider must be github or google');
     const api = await ApiClient.load();
-    const target = targetApiUrl(opts);
-    if (target)
-        api.setApiUrl(target);
+    api.setApiUrl(targetApiUrl(opts) ?? api.apiUrl);
     const token = await browserOauth(api.apiUrl, provider);
     api.setSession({ accessToken: token, refreshToken: token });
     const me = await api.request('GET', '/me');
@@ -82,9 +85,7 @@ export async function loginOauth(provider, opts) {
 // (which owns the signin round-trip), and poll the platform until they approve.
 export async function loginDevice(opts, open) {
     const api = await ApiClient.load();
-    const target = targetApiUrl(opts);
-    if (target)
-        api.setApiUrl(target);
+    api.setApiUrl(targetApiUrl(opts) ?? api.apiUrl);
     const token = await deviceGrant((path, body) => api.request('POST', path, body, { auth: false }), sleepSeconds, open);
     api.setSession({ accessToken: token, refreshToken: token });
     const me = await api.request('GET', '/me');
@@ -96,9 +97,7 @@ export async function loginDevice(opts, open) {
 // the console, the platform mints an insta_ key, and it is stored exactly as --api-key stores one.
 export async function loginClaim(email, opts, open, grant = claimGrant) {
     const api = await ApiClient.load();
-    const target = targetApiUrl(opts);
-    if (target)
-        api.setApiUrl(target);
+    api.setApiUrl(targetApiUrl(opts) ?? api.apiUrl);
     const client = agentMode()?.client ?? 'unknown';
     const key = await grant(email, client, (path, body, signal) => api.request('POST', path, body, { auth: false, signal }), sleepSeconds, open);
     const user = await applyApiKeyLogin(api, key);
@@ -108,9 +107,7 @@ export async function loginClaim(email, opts, open, grant = claimGrant) {
 // Non-interactive login with a durable insta_ key (minted via POST /tokens): store it and confirm against /me. No browser, no polling.
 export async function loginApiKey(key, opts) {
     const api = await ApiClient.load();
-    const target = targetApiUrl(opts);
-    if (target)
-        api.setApiUrl(target);
+    api.setApiUrl(targetApiUrl(opts) ?? api.apiUrl);
     const user = await applyApiKeyLogin(api, key);
     await api.persist();
     info(`logged in as ${user.email ?? user.id} @ ${api.apiUrl}`);
@@ -344,8 +341,25 @@ function browserOauth(apiUrl, provider) {
         });
     });
 }
+/** Log out: revoke the session on the server, then clear the local tokens.
+ *
+ *  Built from the PERSISTED config, not from `ApiClient.load()`'s override-resolved view. There is
+ *  exactly one stored session, so a runtime `--api-url` (or INSTA_API_URL / INSTA_ENV) has no
+ *  subject here — and pointing at a foreign deployment made this actively unsafe: readGlobal()
+ *  scrubs a foreign deployment's tokens, so the revoke below was skipped for want of a refresh
+ *  token while the local tokens were deleted anyway, leaving the session valid on the server with
+ *  nothing left on this machine to revoke it with. The revoke now always goes to the deployment
+ *  the session belongs to, with the real refresh token. `persist()` keeps the stored URL (see its
+ *  comment): logout never sets one explicitly. */
 export async function logout() {
-    const api = await ApiClient.load();
+    const stored = await readPersistedGlobal();
+    // Say so rather than ignoring it silently: exiting 0 with a bare "logged out" while the flag
+    // named a different deployment reads as if that deployment was the one logged out of.
+    const resolved = (await readGlobal()).apiUrl;
+    if (normalizeUrl(resolved) !== normalizeUrl(stored.apiUrl)) {
+        info(`note: the control-plane override (${resolved}) does not apply to logout — there is one stored session; logging out of ${stored.apiUrl}`);
+    }
+    const api = new ApiClient(stored);
     if (api.config.refreshToken) {
         try {
             await api.request('POST', '/auth/logout', { refreshToken: api.config.refreshToken }, { auth: false });

package/dist/commands/billing.js

@@ -49,17 +49,17 @@ export function billingLines(s, org) {
         const lapsed = s.subscriptionStatus === 'past_due' || s.subscriptionStatus === 'unpaid';
         const ended = s.subscriptionStatus === 'canceled' || s.subscriptionStatus === 'incomplete_expired';
         lines.push(s.tier === 'free'
-            ? `⚠  org suspended — billing limit reached; resumes next cycle (or \`insta billing upgrade pro${flag}\`)`
+            ? `⚠  org suspended — billing limit reached; resumes next cycle (or \`insta billing subscribe pro${flag}\`)`
             : lapsed
                 ? `⚠  org suspended — subscription payment did not go through; settle it in \`insta billing portal${flag}\``
                 : ended
                     ? s.tier === 'enterprise'
-                        // Per-deal, and `billing upgrade` cannot create one: naming a self-serve tier here
+                        // Per-deal, and `billing subscribe` cannot create one: naming a self-serve tier here
                         // would move them off the plan they negotiated.
                         ? '⚠  org suspended — the subscription ended; contact support to restore this plan'
-                        // Their OWN tier, not a hardcoded one: suggesting `upgrade pro` to a Team org
+                        // Their OWN tier, not a hardcoded one: suggesting `subscribe pro` to a Team org
                         // resubscribes it onto the wrong plan.
-                        : `⚠  org suspended — the subscription ended; resubscribe with \`insta billing upgrade ${s.tier}${flag}\``
+                        : `⚠  org suspended — the subscription ended; resubscribe with \`insta billing subscribe ${s.tier}${flag}\``
                     // Deliberately claims nothing about the subscription: `incomplete` reaches here too,
                     // and that one is neither current nor failed. All this branch knows is that the
                     // suspension has no billing cause it can name.
@@ -87,7 +87,7 @@ export async function billing(opts) {
     for (const l of billingLines(s, opts.org))
         info(l);
 }
-// insta billing upgrade <tier> — start a Stripe Checkout to subscribe the org to a paid tier.
+// insta billing subscribe <tier> — start a Stripe Checkout to subscribe the org to a paid tier.
 export async function billingUpgrade(tier, opts) {
     // pro|team, matching what POST /orgs/:orgId/billing/checkout accepts: `team` is a real
     // self-serve tier, and `enterprise` is per-deal and 400s at the server.