insta 0.0.83 → 0.1.1

package/dist/commands/compute.js

@@ -1,6 +1,6 @@
 import { ApiClient, ApiError, requireProject } from '../api.js';
 import { info, printJson, handleApproval, relayExitCode, writeFileAtomicSync, resolveThroughSymlink } from '../util.js';
-import { resolveComputeServiceId, resolveSoleService, q, parseVolumeGib } from './services.js';
+import { resolveComputeServiceId, resolveSoleService, q, parseVolumeGib, parseCount } from './services.js';
 export const isWorker = (s) => s.port === 0;
 // One line per compute service for the disambiguation error: name, region, default URL, status —
 // enough to pick one without a second command. Pure, exported for tests.
@@ -25,7 +25,7 @@ export function resolveDomainTarget(services, host, group) {
         return svc;
     }
     if (compute.length === 0)
-        throw new Error('no compute service in this project (add one with `insta services add compute <name>`)');
+        throw new Error('no compute service in this project (add one with `insta service add compute <name>`)');
     if (compute.length === 1) {
         const only = compute[0];
         if (isWorker(only))
@@ -43,7 +43,7 @@ const pad = (s, n) => s.padEnd(n);
 // An older platform may omit `dns` entirely; every reader treats that as "no records", not a crash.
 const recordsOf = (r) => r.dns ?? [];
 const flags = (c = {}) => `${c.group ? ` --group ${c.group}` : ''}${c.branch ? ` --branch ${c.branch}` : ''}`;
-// After set-domain: exactly what to do next, from the records the platform returned — never a
+// After attach: exactly what to do next, from the records the platform returned — never a
 // hand-built template. No records = say so; a template here would send the customer publishing
 // values the plane never issued. Pure, exported for tests.
 export function domainGuidanceLines(r, ctx = {}) {
@@ -58,7 +58,7 @@ export function domainGuidanceLines(r, ctx = {}) {
     out.push('add these DNS records at your DNS provider:');
     for (const d of records)
         out.push(`  ${pad(d.type, 6)} ${pad(d.name, nameW)} -> ${d.value}`);
-    out.push(`then: insta compute check-domain ${r.hostname}${flags(ctx)}`);
+    out.push(`then: insta domain check ${r.hostname}${flags(ctx)}`);
     return out;
 }
 // Whether this provider reports an edge routing target AT ALL. The compute plane's domain view
@@ -96,10 +96,10 @@ export function domainResolveLine(r) {
     }
     return { line: `  ${pad('resolves to', 12)}${r.origin}   (${region} router)   ok`, ready: true };
 }
-// check-domain: every stage, what each still needs, and where it routes. Pure, exported for tests.
+// check: every stage, what each still needs, and where it routes. Pure, exported for tests.
 export function domainStatusLines(r, ctx = {}) {
     if (r.status === 'not added') {
-        return [`${r.hostname} is not attached to ${targetOf(r)} — attach it with: insta compute set-domain ${r.hostname}${flags(ctx)}`];
+        return [`${r.hostname} is not attached to ${targetOf(r)} — attach it with: insta domain attach ${r.hostname}${flags(ctx)}`];
     }
     const records = recordsOf(r);
     const out = [`${r.hostname} -> ${targetOf(r)}`];
@@ -131,7 +131,7 @@ export function domainStatusLines(r, ctx = {}) {
             blockers.push('add the ownership TXT');
         }
         else {
-            stage('ownership', 'unchecked', `TXT ${txt.name} -> ${txt.value} (the plane has not checked it yet — re-run check-domain)`);
+            stage('ownership', 'unchecked', `TXT ${txt.name} -> ${txt.value} (the plane has not checked it yet — re-run insta domain check)`);
             blockers.push('ownership unchecked');
         }
     }
@@ -169,7 +169,7 @@ export function domainStatusLines(r, ctx = {}) {
             blockers.push(`add the ${d.type}`);
         }
         else {
-            stage(lbl, 'unchecked', `${d.type} ${d.name} -> ${d.value} (not checked yet — re-run check-domain)`);
+            stage(lbl, 'unchecked', `${d.type} ${d.name} -> ${d.value} (not checked yet — re-run insta domain check)`);
             blockers.push(`${d.type} unchecked`);
         }
     }
@@ -192,7 +192,7 @@ export function domainStatusLines(r, ctx = {}) {
             blockers.push(`add the ${d.type} ${d.name}`);
         }
         else {
-            stage(lbl, 'unchecked', `${where} (not checked yet — re-run check-domain)`);
+            stage(lbl, 'unchecked', `${where} (not checked yet — re-run insta domain check)`);
             blockers.push(`${d.type} ${d.name} unchecked`);
         }
     }
@@ -237,7 +237,7 @@ export function domainStatusLines(r, ctx = {}) {
 }
 // The platform's 409: the hostname is already bound elsewhere. Domains are never MOVED — the only
 // path is unbind there, then bind here — so the hint names the release step. Three shapes:
-//   owner named and present in this project → the exact remove-domain command;
+//   owner named and present in this project → the exact detach command;
 //   owner named but NOT in this project's services → it is held by a deleted (or other-project)
 //     service: an operator must release it (the plane has no self-serve orphan release yet);
 //   owner not named (today's plane) → the generic release instruction.
@@ -248,11 +248,11 @@ export function domainConflictMessage(host, e, services, ctx = {}) {
     const region = m?.[2];
     // The release command must name the OWNER's group, and the branch the user is working on — a
     // command that defaults back to the linked branch would release nothing.
-    const release = (group) => `insta compute remove-domain ${host}${flags({ group, branch: ctx.branch })}`;
+    const release = (group) => `insta domain detach ${host}${flags({ group, branch: ctx.branch })}`;
     if (owner) {
         const here = services.find((s) => s.type === 'compute' && s.name === owner);
         if (here)
-            return `${host} is already attached to ${owner}${region ? ` (${region})` : here.region ? ` (${here.region})` : ''} — domains are not moved; release it first: ${release(owner)}, then re-run set-domain`;
+            return `${host} is already attached to ${owner}${region ? ` (${region})` : here.region ? ` (${here.region})` : ''} — domains are not moved; release it first: ${release(owner)}, then re-run insta domain attach`;
         return `${host} is already attached to ${owner}${region ? ` in ${region}` : ''}, which is not a service in this project — it is held by a deleted service (or one in another project); ask an operator to release the hostname before re-binding it`;
     }
     return `${host} is already attached to another compute service — domains are not moved; release it there first (${release('<that service>')}) or, if that service was deleted, ask an operator to release the hostname`;
@@ -421,6 +421,12 @@ function execCommandIndex(argv) {
         const token = argv[cursor];
         if (token === '--agent')
             continue;
+        if (token === '--api-url') {
+            cursor++;
+            continue;
+        } // root flag with a value: skip both tokens
+        if (token.startsWith('--api-url='))
+            continue;
         if (token.startsWith('-'))
             return -1; // a global flag, or `--`: either way not our command path
         return token === 'compute' && argv[cursor + 1] === 'exec' ? cursor : -1;
@@ -470,7 +476,7 @@ export function resolveExecFallback(services, payload, note = (msg) => process.s
     if (head === undefined)
         return { serviceName: undefined, command: [] };
     if (!services.some((service) => service.type === 'compute' && service.name === head)) {
-        note(`note: no \`--\` separator was found and \`${head}\` is not a compute service, so it was read as the command. If \`${head}\` was the service, check the name with \`insta services list\`.`);
+        note(`note: no \`--\` separator was found and \`${head}\` is not a compute service, so it was read as the command. If \`${head}\` was the service, check the name with \`insta service list\`.`);
         return { serviceName: undefined, command: payload };
     }
     // `head` really is a service, so whatever follows it cannot be the command's first token.
@@ -567,21 +573,38 @@ export async function computeExec(serviceName, command, opts, recovery = {}) {
     applyExecResult(res, opts.json);
 }
 // ---- always-on (opt out of scale-to-zero; all plans; billing is actual usage either way) ----
-export async function computeAlwaysOn(mode, serviceName, opts) {
+export async function serviceAlwaysOn(type, mode, serviceName, opts) {
     if (mode !== 'on' && mode !== 'off')
         throw new Error('mode must be on|off');
     const api = await ApiClient.load();
     const p = await requireProject();
     const branch = opts.branch ?? p.branch;
     const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(branch)}`);
-    const id = resolveComputeServiceId(services, serviceName);
-    const res = await api.rawRequest('PUT', `/projects/${p.projectId}/services/${id}/always-on`, { enabled: mode === 'on' });
+    const svc = resolveSoleService(services, type, serviceName);
+    const res = await api.rawRequest('PUT', `/projects/${p.projectId}/services/${svc.id}/always-on`, { enabled: mode === 'on' });
     if (handleApproval(res, opts.json))
         return;
     if (opts.json)
         return printJson(res.body);
     const on = res.body.service?.always_on;
-    info(`compute ${res.body.service?.name ?? id}: always-on ${on ? 'ENABLED — machines stay warm (no cold starts; idle RAM bills at actual usage)' : 'disabled — scales to zero when idle'}`);
+    info(`${type} ${res.body.service?.name ?? svc.name}: always-on ${on ? 'ENABLED — machines stay warm (no cold starts; idle RAM bills at actual usage)' : 'disabled — scales to zero when idle'}`);
+}
+export const computeAlwaysOn = (mode, serviceName, opts) => serviceAlwaysOn('compute', mode, serviceName, opts);
+// `insta compute scale <count> [service] [--region <r>]` — POST /services/:id/scale. Count is
+// validated locally (1..10); the paid-plan gate is the backend's and its 403 flows verbatim.
+export async function computeScale(count, serviceName, opts) {
+    const machineCount = parseCount(count);
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const branch = opts.branch ?? p.branch;
+    const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(branch)}`);
+    const svc = resolveSoleService(services, 'compute', serviceName);
+    const res = await api.rawRequest('POST', `/projects/${p.projectId}/services/${svc.id}/scale`, { machineCount, region: opts.region });
+    if (handleApproval(res, opts.json))
+        return;
+    if (opts.json)
+        return printJson(res.body.service);
+    info(`scaled compute ${svc.name} to ${machineCount} replica(s)${opts.region ? ` in ${opts.region}` : ''}`);
 }
 // ---- limits (the resource ceiling; paid plans) ----
 // Parse a human memory value into MB: "512", "512mb", "1gb", "2g", "1.5gb".
@@ -615,30 +638,47 @@ export function parseCpu(raw) {
 // ---- volume (the persistent /data disk; attach any time, grow-only, deletable; never detach) ----
 // Render the volume read. Pure, exported for tests (mirrors serviceListLine). Every plan may view;
 // only growth is paid — that gate is the backend's to enforce, so nothing here pre-blocks.
-export function volumeLines(name, volume, cap) {
+export function volumeLines(name, volume, cap, type = 'compute') {
     if (!volume)
         return [
-            `compute ${name}: no volume attached (attach one: \`insta compute volume ${name} --size <gi>\` — it mounts at /data on the next deploy)`,
+            type === 'compute'
+                ? `compute ${name}: no volume attached (attach one: \`insta compute volume ${name} --size <gi>\` — it mounts at /data on the next deploy)`
+                : `${type} ${name}: no volume attached (attach one: \`insta ${type} volume ${name} --size <gi>\` — it mounts at the image's data directory)`,
         ];
+    // `--delete` exists on `compute volume` only — a managed database's volume IS its data
+    // directory, so the group never registered the flag (index.ts) and naming it here would print
+    // a command that fails.
+    const grow = type === 'compute'
+        ? 'grow with --size (grow-only), delete with --delete (destroys the data)'
+        : 'grow with --size (grow-only); the volume cannot be deleted — remove the service instead';
     return [
-        `compute ${name}: volume ${volume.sizeGib}Gi at ${volume.mountPath}  (plan max ${cap.volumeGib}Gi)`,
-        '  billing is actual data stored — the size is a cap, not a price; grow with --size (grow-only), delete with --delete (destroys the data)',
+        `${type} ${name}: volume ${volume.sizeGib}Gi at ${volume.mountPath}  (plan max ${cap.volumeGib}Gi)`,
+        `  billing is actual data stored — the size is a cap, not a price; ${grow}`,
     ];
 }
 // Render the PUT result. Pure, exported for tests. `attached` comes from the backend and is what
 // tells a FIRST attach (no disk yet — it mounts on the next deploy) apart from a grow (the live
 // disk was already extended); the wire size is authoritative in both cases.
-export function volumeWriteLine(name, body) {
+export function volumeWriteLine(name, body, type = 'compute') {
     if (body.attached) {
-        return `compute ${name}: volume ${body.volume.sizeGib}Gi attached — mounts at ${body.volume.mountPath} on the next deploy  (plan max ${body.cap.volumeGib}Gi)`;
+        // Only a compute service has a deploy step for the mount to wait on; a managed database has
+        // no deploy, so its disk is simply mounted.
+        const mounts = type === 'compute'
+            ? `mounts at ${body.volume.mountPath} on the next deploy`
+            : `mounts at ${body.volume.mountPath}`;
+        return `${type} ${name}: volume ${body.volume.sizeGib}Gi attached — ${mounts}  (plan max ${body.cap.volumeGib}Gi)`;
     }
-    return `compute ${name}: volume grown to ${body.volume.sizeGib}Gi at ${body.volume.mountPath}  (plan max ${body.cap.volumeGib}Gi)`;
+    return `${type} ${name}: volume grown to ${body.volume.sizeGib}Gi at ${body.volume.mountPath}  (plan max ${body.cap.volumeGib}Gi)`;
 }
 // Render the DELETE result. Pure, exported for tests. Deleting is the only way off the volume
 // path (there is no detach), so the line says what came back with it: the two constraints the
 // volume imposed.
-export function volumeDeleteLine(name) {
-    return `compute ${name}: volume deleted — the disk and its data are gone; suspend fast-wake and scale-out are back`;
+export function volumeDeleteLine(name, type = 'compute') {
+    // The two constraints a volume imposes — no suspend fast-wake, no scale-out — are compute-plane
+    // facts. `--delete` is registered on compute only, so the other branch is unreachable today;
+    // it is written type-aware anyway so the line cannot start lying if it ever becomes reachable.
+    const regained = type === 'compute' ? '; suspend fast-wake and scale-out are back' : '';
+    return `${type} ${name}: volume deleted — the disk and its data are gone${regained}`;
 }
 // Map a DELETE .../volume failure. Pure, exported for tests. An older backend has no DELETE
 // route, and what its 404 looks like depends on who answered: the real platform (Fastify, no
@@ -661,7 +701,7 @@ export function volumeDeleteError(e) {
 // no undo; billing stops now). The paid/cap/machine-count gates all belong to the backend, whose
 // 403/400 messages carry the upgrade hints and must reach the user verbatim (the guard prints
 // ApiError messages as-is).
-export async function computeVolume(serviceName, opts) {
+export async function serviceVolume(type, serviceName, opts) {
     if (opts.delete && opts.mountPath !== undefined)
         throw new Error('--delete cannot be combined with --mount-path');
     if (opts.mountPath !== undefined && !opts.size)
@@ -672,11 +712,11 @@ export async function computeVolume(serviceName, opts) {
     const p = await requireProject();
     const branch = opts.branch ?? p.branch;
     const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(branch)}`);
-    const id = resolveComputeServiceId(services, serviceName);
+    const svc = resolveSoleService(services, type, serviceName);
     if (opts.delete) {
         let res;
         try {
-            res = await api.rawRequest('DELETE', `/projects/${p.projectId}/services/${id}/volume`);
+            res = await api.rawRequest('DELETE', `/projects/${p.projectId}/services/${svc.id}/volume`);
         }
         catch (e) {
             throw volumeDeleteError(e);
@@ -685,40 +725,41 @@ export async function computeVolume(serviceName, opts) {
             return;
         if (opts.json)
             return printJson(res.body);
-        info(volumeDeleteLine(res.body.service?.name ?? serviceName ?? id));
+        info(volumeDeleteLine(res.body.service?.name ?? svc.name, type));
         return;
     }
     if (!opts.size) {
-        const r = await api.request('GET', `/projects/${p.projectId}/services/${id}/volume`);
+        const r = await api.request('GET', `/projects/${p.projectId}/services/${svc.id}/volume`);
         if (opts.json)
             return printJson(r);
-        for (const line of volumeLines(serviceName ?? id, r.volume, r.cap))
+        for (const line of volumeLines(svc.name, r.volume, r.cap, type))
             info(line);
         return;
     }
     const sizeGib = parseVolumeGib(opts.size);
-    const res = await api.rawRequest('PUT', `/projects/${p.projectId}/services/${id}/volume`, { sizeGib, ...(opts.mountPath !== undefined ? { mountPath: opts.mountPath } : {}) });
+    const res = await api.rawRequest('PUT', `/projects/${p.projectId}/services/${svc.id}/volume`, { sizeGib, ...(opts.mountPath !== undefined ? { mountPath: opts.mountPath } : {}) });
     if (handleApproval(res, opts.json))
         return;
     if (opts.json)
         return printJson(res.body);
-    info(volumeWriteLine(res.body.service?.name ?? serviceName ?? id, res.body));
+    info(volumeWriteLine(res.body.service?.name ?? svc.name, res.body, type));
 }
+export const computeVolume = (serviceName, opts) => serviceVolume('compute', serviceName, opts);
 // Show or set a compute service's ceiling. With no --memory it PRINTS the current limits and the
 // plan cap (so `insta compute limits` is a safe read), which is also what a UI renders as a slider
 // with its plan-limit marker.
-export async function computeLimits(serviceName, opts) {
+export async function serviceLimits(type, serviceName, opts) {
     const api = await ApiClient.load();
     const p = await requireProject();
     const branch = opts.branch ?? p.branch;
     const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(branch)}`);
-    const id = resolveComputeServiceId(services, serviceName);
+    const svc = resolveSoleService(services, type, serviceName);
     if (!opts.memory && !opts.cpu) {
-        const r = await api.request('GET', `/projects/${p.projectId}/services/${id}/limits`);
+        const r = await api.request('GET', `/projects/${p.projectId}/services/${svc.id}/limits`);
         if (opts.json)
             return printJson(r);
-        info(`compute ${serviceName ?? id}: ceiling ${r.limits.cpu} vCPU / ${fmtMb(r.limits.memoryMb)}  (plan max ${r.cap.cpu} vCPU / ${fmtMb(r.cap.memoryMb)})`);
-        info('  billing is actual usage — the ceiling caps what the app may burn, it is not a price');
+        info(`${type} ${svc.name}: ceiling ${r.limits.cpu} vCPU / ${fmtMb(r.limits.memoryMb)}  (plan max ${r.cap.cpu} vCPU / ${fmtMb(r.cap.memoryMb)})`);
+        info(`  billing is actual usage — the ceiling caps what the ${type === 'compute' ? 'app' : 'database'} may burn, it is not a price`);
         return;
     }
     if (!opts.memory)
@@ -726,14 +767,15 @@ export async function computeLimits(serviceName, opts) {
     const body = { memoryMb: parseMemoryMb(opts.memory) };
     if (opts.cpu)
         body.cpu = parseCpu(opts.cpu);
-    const res = await api.rawRequest('PUT', `/projects/${p.projectId}/services/${id}/limits`, body);
+    const res = await api.rawRequest('PUT', `/projects/${p.projectId}/services/${svc.id}/limits`, body);
     if (handleApproval(res, opts.json))
         return;
     if (opts.json)
         return printJson(res.body);
     const l = res.body.limits;
-    info(`compute ${res.body.service?.name ?? id}: ceiling set to ${l.cpu} vCPU / ${fmtMb(l.memoryMb)}`);
+    info(`${type} ${res.body.service?.name ?? svc.name}: ceiling set to ${l.cpu} vCPU / ${fmtMb(l.memoryMb)}`);
 }
+export const computeLimits = (serviceName, opts) => serviceLimits('compute', serviceName, opts);
 // ---- ssh (interactive sessions) --------------------------------------------
 import { chmodSync, existsSync, linkSync, lstatSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
 import { homedir } from 'node:os';

package/dist/commands/db-query.js

@@ -1,9 +1,9 @@
-// `insta db query <service> [args...]` — run a query/command against a MANAGED database
-// (mysql/redis/mongodb) through the platform's console exec API. Postgres is not a console target
-// (it has the SQL editor / DATABASE_URL, and `insta db url|connect`), so a postgres service is
-// rejected here. The shape logic — path, request body, result rendering — lives in pure,
-// unit-tested seams; the handler just resolves the service and wires them to the API, this repo's
-// pure-seam convention.
+// `insta redis|mysql|mongodb query <service> [args...]` — run a query/command against a MANAGED
+// database through the platform's console exec API. Postgres is not a console target (it has the
+// SQL editor / DATABASE_URL, and `insta postgres url|connect`), so a postgres service is rejected
+// here. The shape logic — path, request body, result rendering — lives in pure, unit-tested seams;
+// the handler just resolves the service and wires them to the API, this repo's pure-seam
+// convention.
 import { ApiClient, requireProject } from '../api.js';
 import { info, printJson, die, handleApproval } from '../util.js';
 import { q } from './services.js';
@@ -62,11 +62,13 @@ async function dbQueryDeps(deps) {
     return { api, project };
 }
 // Resolve <service> (a service NAME) to its id + engine, then dispatch to the console exec API.
-export async function dbQuery(service, args, opts = {}, deps) {
+// `engine` is the group the command was typed under (`insta redis query …`): a service of another
+// type is refused with the right group named, never queried through the wrong renderer.
+export async function dbQuery(service, args, opts = {}, deps, engine) {
     // An empty command is never valid — reject it before loading config or hitting the network,
     // rather than posting an empty statement/argv to the console.
     if (args.length === 0) {
-        die('usage: insta db query <service> <query…> (mysql/mongodb: one quoted statement; redis: e.g. GET mykey)');
+        die(`usage: insta ${engine ?? '<redis|mysql|mongodb>'} query <service> <query…> (mysql/mongodb: one quoted statement; redis: e.g. GET mykey)`);
     }
     const { api, project: p } = await dbQueryDeps(deps);
     const branch = opts.branch ?? p.branch;
@@ -75,24 +77,26 @@ export async function dbQuery(service, args, opts = {}, deps) {
     if (!svc)
         die(`service not found: ${service}`);
     if (!MANAGED_ENGINES.includes(svc.type)) {
-        die('db query is for managed databases (mysql/redis/mongodb); postgres uses the SQL editor / DATABASE_URL');
+        die('query is for managed databases (mysql/redis/mongodb); postgres uses `insta postgres url|connect` / the SQL editor');
     }
-    const engine = svc.type;
+    if (engine && svc.type !== engine)
+        die(`${service} is a ${svc.type} service — use: insta ${svc.type} query ${service} …`);
+    const resolved = svc.type;
     // --database is a mongodb-only selector (execBody drops it for the others). Rejecting it here,
     // rather than silently ignoring it, keeps the documented mongodb-only contract honest.
-    if (opts.database !== undefined && engine !== 'mongodb') {
+    if (opts.database !== undefined && resolved !== 'mongodb') {
         die('--database is only supported for mongodb services');
     }
-    const res = await api.rawRequest('POST', consoleExecPath(p.projectId, svc.id), execBody(engine, args, opts.database));
+    const res = await api.rawRequest('POST', consoleExecPath(p.projectId, svc.id), execBody(resolved, args, opts.database));
     if (handleApproval(res, opts.json))
         return;
     if (opts.json)
         return printJson(res.body);
-    if (engine === 'mysql') {
+    if (resolved === 'mysql') {
         for (const line of renderMysqlRows(res.body ?? {}))
             info(line);
     }
-    else if (engine === 'redis') {
+    else if (resolved === 'redis') {
         info(renderRedisReply(res.body?.reply));
     }
     else {

package/dist/commands/deploy.js

@@ -60,7 +60,7 @@ async function discoverLane(api, projectId, branch, opts) {
             // The route answered and the TARGET is what is missing: say so, or flyctl turns it into "no Dockerfile".
             // Both ways out: the project has several groups and none is named, or it has none at all.
             if (/compute group not found|branch not found/.test(e.message))
-                die(`${e.message} — name it with \`--group <name>\` (see \`insta services list\`), or add one: \`insta services add compute <name>\``);
+                die(`${e.message} — name it with \`--group <name>\` (see \`insta service list\`), or add one: \`insta service add compute <name>\``);
             return { lane: 'legacy' };
         }
         throw e;

package/dist/commands/domain.js

@@ -1,7 +1,7 @@
 import { ApiClient } from '../api.js';
 import { info, printJson, handleApproval, die } from '../util.js';
 import { presentUrl, resolveOrgId } from './billing.js';
-import { domainDeps, domainTarget } from './compute.js';
+import { domainDeps, domainTarget, setDomain, checkDomain, removeDomain } from './compute.js';
 const usd = (cents) => `$${(cents / 100).toFixed(2)}`;
 // --org wins; otherwise the linked project's org — the org verbs must not force a project link.
 async function orgDeps(opts, deps) {
@@ -70,7 +70,9 @@ export async function domainAttach(host, opts, deps) {
         const o = ownerOf(name, orders);
         if (o)
             die(`${o.domainName} is not registered yet — its order is ${o.status}: insta domain status ${o.domainName}`);
-        die(`no domain this org bought covers ${name} — for a domain you own elsewhere: insta compute set-domain ${name}`);
+        // Not a name this org bought: a domain owned elsewhere. Same verb, the bring-your-own path —
+        // the plane issues the edge cert and the DNS records to publish in your own zone are printed.
+        return setDomain(name, opts, { api, project: p });
     }
     const branch = opts.branch ?? p.branch;
     const { target } = await domainTarget(api, p.projectId, branch, name, opts.group);
@@ -90,12 +92,20 @@ export async function domainAttach(host, opts, deps) {
 function domainLines(d, linked = true) {
     const out = [`${d.domainName}  ${d.status}${d.expiresAt ? `  (expires ${d.expiresAt.slice(0, 10)}${d.autorenew ? ', auto-renews' : ''})` : ''}`];
     // Vacuously true for a domain with no hostnames, which is every domain until something attaches.
-    if (linked && d.hostnames.every((h) => h.state === 'failed')) {
+    // Not while delegated: the platform fails every hostname on the way out, and refuses the attach.
+    if (linked && !d.delegated && d.hostnames.every((h) => h.state === 'failed')) {
         const names = d.hostnames.map((h) => h.hostname);
         // Attaching the bought name itself re-attaches its www.
         const retry = names.includes(d.domainName) ? names.filter((h) => h !== `www.${d.domainName}`) : names;
         out.push(`  nothing serving — ${(retry.length ? retry : [d.domainName]).map((h) => `insta domain attach ${h}`).join('; ')}`);
     }
+    // The zone answers elsewhere, so nothing published here resolves and an attach is refused. The
+    // repair is a next action, so it follows `linked` like the others: under --org it would name this org.
+    if (d.delegated) {
+        out.push(`  delegated to ${d.nameservers.join(', ')}${linked ? '' : ' — attach is refused'}`);
+        if (linked)
+            out.push(`  attach is refused until: insta domain nameservers reset ${d.domainName}`);
+    }
     const w = Math.max(0, ...d.hostnames.map((x) => x.hostname.length));
     for (const h of d.hostnames)
         out.push(`  ${h.hostname.padEnd(w)}  ${h.state}${h.service ? ` → ${h.service}` : ''}${h.reason ? ` — ${h.reason}` : ''}`);
@@ -134,6 +144,53 @@ export async function domainStatus(name, opts, deps) {
     for (const line of domain ? domainLines(domain, !opts.org) : orderStatusLines(order, !opts.org))
         info(line);
 }
+// ---- nameservers and transferring out ----
+const domainPath = (orgId, domainName) => `/orgs/${orgId}/domains/${encodeURIComponent(domainName)}`;
+export async function domainNameserversSet(domainName, hosts, opts, deps) {
+    const nameservers = hosts.flatMap((h) => h.split(/[\s,]+/)).map((h) => h.replace(/\.$/, '')).filter(Boolean);
+    if (!nameservers.length)
+        die("name at least one nameserver, or `insta domain nameservers reset <domain>` to restore the registrar's own");
+    const { api, orgId } = await orgDeps(opts, deps);
+    const r = await api.request('PUT', `${domainPath(orgId, domainName)}/nameservers`, { nameservers });
+    if (opts.json)
+        return printJson(r);
+    for (const line of domainLines(r, !opts.org))
+        info(line);
+}
+export async function domainNameserversReset(domainName, opts, deps) {
+    const { api, orgId } = await orgDeps(opts, deps);
+    const r = await api.request('DELETE', `${domainPath(orgId, domainName)}/nameservers`);
+    if (opts.json)
+        return printJson(r);
+    for (const line of domainLines(r, !opts.org))
+        info(line);
+}
+export async function domainTransferLock(domainName, mode, opts, deps) {
+    if (mode !== 'on' && mode !== 'off')
+        die('mode must be on or off');
+    const locked = mode === 'on';
+    const { api, orgId } = await orgDeps(opts, deps);
+    const r = await api.request('PATCH', domainPath(orgId, domainName), { locked });
+    if (opts.json)
+        return printJson(r);
+    info(`${r.domainName}  transfer lock ${r.locked ? 'on' : 'off'}`);
+    if (!r.locked) {
+        // ICANN's post-registration lock outranks this one and nothing here can waive it.
+        if (r.transferLockExpiresAt && new Date(r.transferLockExpiresAt).getTime() > Date.now()) {
+            info(`  ICANN holds the registration until ${r.transferLockExpiresAt.slice(0, 10)} whatever this says`);
+        }
+        if (!opts.org)
+            info(`  authorization code: insta domain transfer code ${r.domainName}`);
+    }
+}
+export async function domainTransferCode(domainName, opts, deps) {
+    const { api, orgId } = await orgDeps(opts, deps);
+    const r = await api.request('POST', `${domainPath(orgId, domainName)}/auth-code`);
+    if (opts.json)
+        return printJson(r);
+    info(r.authCode);
+}
+// ---- records ----
 export function recordLines(records) {
     const w = (pick) => Math.max(...records.map((r) => pick(r).length));
     const idW = w((r) => String(r.id)), typeW = w((r) => r.type), nameW = w((r) => r.fqdn), answerW = w((r) => r.answer), ttlW = w((r) => String(r.ttl));
@@ -191,4 +248,49 @@ export async function domainRecordsRemove(domainName, id, opts, deps) {
         return printJson(r);
     info(`removed record ${id} from ${domainName}`);
 }
+export async function domainCheck(host, opts, deps) {
+    return checkDomain(host.trim().toLowerCase(), opts, deps);
+}
+/** The bought domain `host` sits under, or null — including when the question cannot be answered.
+ *
+ *  This lookup is a GUARD on a command that worked without it: a control plane without the
+ *  org-scoped domains route (an older deployment, insta-oss), a 403, or a transient 5xx must not
+ *  turn a bring-your-own detach into a hard failure. A failed read means "nothing says this is a
+ *  bought name", which is exactly how the command behaved before the guard existed. A read that
+ *  SUCCEEDS is authoritative, and its refusal stands. */
+async function boughtOwner(d, orgId, host) {
+    try {
+        const { items } = await d.api.request('GET', `/orgs/${orgId}/domains`);
+        return ownerOf(host, items);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Release a hostname from its compute service. Bring-your-own only: a hostname under a domain
+ * bought through InstaCloud is refused here.
+ *
+ * `attach` writes a bought hostname into the platform's DOMAINS record (state, serviceId,
+ * releaseFrom) and lets a reconciler bind it on the compute plane; this verb's only route,
+ * DELETE /projects/:id/compute/domain, unbinds on the compute plane alone and the platform
+ * exposes no detach route for the domains record. Running it would leave the record still
+ * claiming a binding that no longer exists — and, for an apex, `attach` binds both the name and
+ * its www while this takes one hostname. The supported way to move a bought hostname is another
+ * `attach`, which releases it from the old service itself.
+ */
+export async function domainDetach(host, opts, deps) {
+    const d = await domainDeps(deps);
+    const name = host.trim().toLowerCase();
+    // Without an org there is no domains list to check against (INSTA_PROJECT_ID-only CI links name
+    // none); a bring-your-own detach must keep working there, so the guard is simply not applied.
+    if (d.project.orgId) {
+        const owner = await boughtOwner(d, d.project.orgId, name);
+        if (owner) {
+            die(`${name} belongs to ${owner.domainName}, a domain bought through InstaCloud — its binding lives on the domain, not on the compute plane, so detaching it here would leave the domain still claiming it. `
+                + `Move it with \`insta domain attach ${name} --group <other service>\` (attach releases it from the current one), and see where it stands with \`insta domain status ${owner.domainName}\`.`);
+        }
+    }
+    return removeDomain(name, opts, d);
+}
 //# sourceMappingURL=domain.js.map

package/dist/commands/env.js

@@ -76,6 +76,6 @@ export async function envUse(name, opts = {}) {
     // files were written for the previous environment and are keyed by a different server name, so
     // they keep talking to it until setup is re-run. --env is REQUIRED in the hint: since 0.0.38 a
     // bare `setup agent` forces prod, which would silently undo the switch the user just made.
-    info(`  re-point this machine's agents at it with: insta setup agent --env ${target}`);
+    info(`  re-point this machine's agents at it with: insta agent setup --env ${target}`);
 }
 //# sourceMappingURL=env.js.map

package/dist/commands/managed-db.js

@@ -0,0 +1,34 @@
+// `insta redis|mysql|mongodb …` — the managed Fly databases. Their settings verbs (limits / volume /
+// always-on) reuse compute.ts's type-generalized handlers: the platform's /services/:id/{limits,
+// volume,always-on} accept "compute or managed-database" services. `status` cannot: GET
+// /services/:id/state is compute-only on the platform (services.state() throws for anything else),
+// so it reads the project's runtime-health — which covers compute, postgres and the managed DBs in
+// one call — and picks this service's entry.
+import { ApiClient, requireProject } from '../api.js';
+import { info, printJson } from '../util.js';
+import { q, resolveSoleService } from './services.js';
+// pure: `redis cache: standby  (1 machine, 0 failing)`. Exported for tests.
+export function statusLine(type, name, entry) {
+    if (!entry)
+        return `${type} ${name}: unknown  (the runtime-health read did not include this service)`;
+    const machines = `${entry.machines} machine${entry.machines === 1 ? '' : 's'}`;
+    return `${type} ${name}: ${entry.status}  (${machines}, ${entry.failing} failing)`;
+}
+async function managedDeps(deps) {
+    if (deps)
+        return deps;
+    const [api, project] = [await ApiClient.load(), await requireProject()];
+    return { api, project };
+}
+export async function managedStatus(type, serviceName, opts, deps) {
+    const { api, project: p } = await managedDeps(deps);
+    const branch = opts.branch ?? p.branch;
+    const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(branch)}`);
+    const svc = resolveSoleService(services, type, serviceName);
+    const res = await api.request('GET', `/projects/${p.projectId}/runtime-health${q(branch)}`);
+    const entry = res.services?.find((e) => e.serviceId === svc.id);
+    if (opts.json)
+        return printJson(entry ?? { serviceId: svc.id, status: 'unknown', machines: 0, failing: 0 });
+    info(statusLine(type, svc.name, entry));
+}
+//# sourceMappingURL=managed-db.js.map

package/dist/commands/mcp.js

@@ -1,4 +1,4 @@
-// `insta mcp install` — write the insta-cloud remote MCP server into each coding agent's own
+// `insta config install-mcp` — write the insta-cloud remote MCP server into each coding agent's own
 // config format. Claude Code is NOT handled here — it has a real registry CLI (`claude mcp add`,
 // see setup.ts registerMcp); these are the config-file agents. All entries are OAuth (no
 // credential written): each client discovers the platform AS via RFC 9728 and runs the browser
@@ -118,7 +118,7 @@ export async function installAgentConfigs(agent, home = os.homedir()) {
     }
     return done;
 }
-// `insta mcp install [--agent <slug>] [--mcp-token]` — claude-code goes through its registry CLI
+// `insta config install-mcp [--agent <slug>] [--mcp-token]` — claude-code goes through its registry CLI
 // (registerMcp); everything else is a config-file write. No --agent = claude-code + all detected.
 export async function mcpInstall(opts, register = registerMcp, installConfigs = installAgentConfigs) {
     if (opts.mcpToken && opts.agent && opts.agent !== 'claude-code') {