insta 0.0.83 → 0.1.1

package/dist/commands/metrics.js

@@ -60,7 +60,7 @@ function humanBytes(v, base) {
     const shown = i === 0 && Number.isInteger(value) ? String(value) : value.toFixed(1);
     return `${shown} ${units[i]}`;
 }
-// insta metrics <db|compute|redis|mysql|mongodb> [group]
+// shared handler behind `insta <compute|postgres|redis|mysql|mongodb> metrics [service]`
 export async function metrics(component, group, opts) {
     const api = await ApiClient.load();
     const p = await requireProject();
@@ -82,7 +82,7 @@ export function cycleLine(res) {
     const day = (sec) => new Date(sec * 1000).toISOString().slice(0, 10);
     return `billing cycle ${day(res.from)} → ${day(res.to - 86400)}`;
 }
-// Pure: format the per-dimension lines (label: qty unit (cost)). Shared by `insta usage` and
+// Pure: format the per-dimension lines (label: qty unit (cost)). Shared by `insta billing usage` and
 // `insta billing` so both render dimensions identically.
 export function dimensionLines(dims) {
     return dims.map((d) => {
@@ -95,7 +95,7 @@ function printDimensions(dims) {
     for (const l of dimensionLines(dims))
         info(l);
 }
-// insta usage — usage across the 5 billing dimensions (cpu/memory/volume/egress/storage) for the
+// insta billing usage — usage across the 5 billing dimensions (cpu/memory/volume/egress/storage) for the
 // current billing cycle. Shows the whole ORG by default (with a per-project breakdown); pass --proj
 // [id] for a single project (the linked one, or a given id). Billed dimensions, not raw provider
 // meters.
@@ -128,7 +128,8 @@ export async function usage(opts) {
             info(`  ${pr.name}: $${Number(pr.totalCostUsd ?? 0).toFixed(4)}`);
     }
 }
-// pure: platform path for a deploy-events request (used by `insta logs --deploy`). Any Fly-backed
+// pure: platform path for a deploy-events request (used by `insta compute logs --deploy` and the
+// equivalent on redis/mysql/mongodb). Any Fly-backed
 // component (compute or a managed database) has machine lifecycle events; omitted → the platform
 // defaults to compute.
 export function deployEventsPath(projectId, opts) {
@@ -169,7 +170,7 @@ export function resolveLogWindow(opts, now = Math.floor(Date.now() / 1000)) {
         throw new Error('--to is before --from');
     return { from, to };
 }
-// insta logs <db|compute|redis|mysql|mongodb> [group]
+// shared handler behind `insta <compute|postgres|redis|mysql|mongodb> logs [service]`
 export async function logs(component, group, opts) {
     const windowFlags = opts.from !== undefined || opts.to !== undefined || opts.since !== undefined;
     if (opts.deploy && windowFlags)

package/dist/commands/observe.js

@@ -1,4 +1,4 @@
-// `insta observe` — the local credential-audit hook. install wires a PostToolUse hook into the
+// `insta agent observe` — the local credential-audit hook. install wires a PostToolUse hook into the
 // agent harness; report renders the local audit; sync uploads findings into the project timeline
 // (idempotent via a stable dedup key, matching the platform's audit-event ingest).
 import { existsSync } from 'node:fs';
@@ -67,7 +67,7 @@ export async function observeInstall() {
     if (hint)
         info(hint);
     info('it scans agent tool-use for credential exposure; findings append to ./.insta/audit.jsonl');
-    info('run `insta observe report` to review, `insta observe sync` to upload to the project timeline');
+    info('run `insta agent observe report` to review, `insta agent observe sync` to upload to the project timeline');
 }
 export async function observeUninstall() {
     uninstallObserve(await installRoot());

package/dist/commands/{db.js → postgres.js}

@@ -7,7 +7,7 @@ import { parseVolumeGib, q, resolveSoleService } from './services.js';
 // cold-starts on the next connection) and always-on (instance stays warm; idle RAM bills at
 // actual usage). Thin wrapper over PATCH /database/settings {scaleToZero} — insta-db-backed
 // postgres only.
-export async function dbAlwaysOn(mode, opts) {
+export async function dbAlwaysOn(mode, service, opts) {
     if (mode !== 'on' && mode !== 'off')
         throw new Error('mode must be on|off');
     const api = await ApiClient.load();
@@ -16,15 +16,15 @@ export async function dbAlwaysOn(mode, opts) {
     const branch = opts.branch ?? p.branch;
     if (branch)
         qs.set('branch', branch);
-    if (opts.group)
-        qs.set('group', opts.group);
+    if (service)
+        qs.set('group', service);
     const res = await api.rawRequest('PATCH', `/projects/${p.projectId}/database/settings${qs.toString() ? `?${qs}` : ''}`, { scaleToZero: mode !== 'on' });
     if (handleApproval(res, opts.json))
         return;
     if (opts.json)
         return printJson(res.body);
     const s2z = res.body?.scaleToZero;
-    info(`postgres ${opts.group ?? 'default'}: always-on ${s2z === false ? 'ENABLED — instance stays warm (no cold starts; idle RAM bills at actual usage)' : 'disabled — scales to zero when idle (default; first connection after idle cold-starts)'}`);
+    info(`postgres ${service ?? 'default'}: always-on ${s2z === false ? 'ENABLED — instance stays warm (no cold starts; idle RAM bills at actual usage)' : 'disabled — scales to zero when idle (default; first connection after idle cold-starts)'}`);
 }
 // Validated pass-throughs for the provider's quantity strings. The insta-db resize API takes
 // k8s-style quantities (cpu: "2", "2500m"; memory: "4Gi", "2048Mi"), so unlike the compute path
@@ -66,20 +66,20 @@ export async function fetchDbInstance(api, projectId, suffix) {
 // Show or set a postgres service's resource ceiling (insta-db-backed only). Paid plans — the
 // ceiling is the tier lever now that billing follows actual usage. Moves both directions:
 // unlike storage it is a cgroup limit, not a provisioned volume.
-export async function dbLimits(opts) {
+export async function dbLimits(service, opts) {
     const api = await ApiClient.load();
     const p = await requireProject();
     const qs = new URLSearchParams();
     const branch = opts.branch ?? p.branch;
     if (branch)
         qs.set('branch', branch);
-    if (opts.group)
-        qs.set('group', opts.group);
+    if (service)
+        qs.set('group', service);
     const suffix = qs.toString() ? `?${qs}` : '';
     if (!opts.cpu && !opts.memory) {
         const read = await fetchDbInstance(api, p.projectId, suffix);
         if (read.kind === 'no-instance') {
-            info(`postgres ${opts.group ?? 'default'}: no manageable instance (this service manages its own resources)`);
+            info(`postgres ${service ?? 'default'}: no manageable instance (this service manages its own resources)`);
             return;
         }
         if (opts.json)
@@ -88,11 +88,11 @@ export async function dbLimits(opts) {
         const mib = read.body?.memoryMib;
         if (typeof cpuMilli === 'number' && typeof mib === 'number') {
             const cpu = cpuMilli % 1000 === 0 ? `${cpuMilli / 1000}` : `${cpuMilli}m`;
-            info(`postgres ${opts.group ?? 'default'}: ceiling ${cpu} vCPU / ${fmtMib(mib)}`);
+            info(`postgres ${service ?? 'default'}: ceiling ${cpu} vCPU / ${fmtMib(mib)}`);
             info('  billing is actual usage — the ceiling caps what the database may burn, it is not a price');
         }
         else {
-            info(`postgres ${opts.group ?? 'default'}: provider reported no ceiling — set one with --cpu/--memory`);
+            info(`postgres ${service ?? 'default'}: provider reported no ceiling — set one with --cpu/--memory`);
         }
         return;
     }
@@ -116,7 +116,7 @@ export async function dbLimits(opts) {
         return printJson(res.body);
     const cpu = typeof res.body?.cpuMilli === 'number' ? `${res.body.cpuMilli / 1000} vCPU` : (opts.cpu ?? 'unchanged');
     const mem = typeof res.body?.memoryMib === 'number' ? fmtMib(res.body.memoryMib) : (opts.memory ?? 'unchanged');
-    info(`postgres ${opts.group ?? 'default'}: ceiling set to ${cpu} / ${mem}`);
+    info(`postgres ${service ?? 'default'}: ceiling set to ${cpu} / ${mem}`);
 }
 // Bytes → human units, one decimal above KiB. Local because the metrics payload is the only
 // bytes-denominated read in this file (fmtMib serves the MiB-denominated resize path).
@@ -164,19 +164,19 @@ export function dbStatsLines(group, body) {
 // anywhere, and the code that handled it is retained, not live. Neon-backed: the platform read
 // over a direct SQL connection, so a one-shot call could wake a suspended endpoint — acceptable
 // for an explicit command, which is why nothing here polls.
-export async function dbStats(opts) {
+export async function dbStats(service, opts) {
     const api = await ApiClient.load();
     const p = await requireProject();
     const qs = new URLSearchParams();
     const branch = opts.branch ?? p.branch;
     if (branch)
         qs.set('branch', branch);
-    if (opts.group)
-        qs.set('group', opts.group);
+    if (service)
+        qs.set('group', service);
     const res = await api.rawRequest('GET', `/projects/${p.projectId}/database/metrics${qs.toString() ? `?${qs}` : ''}`);
     if (opts.json)
         return printJson(res.body);
-    for (const line of dbStatsLines(opts.group ?? 'default', res.body))
+    for (const line of dbStatsLines(service ?? 'default', res.body))
         info(line);
 }
 // Render the instance's volume from a database/instance read. Pure, exported for tests. Reads the
@@ -197,25 +197,25 @@ export function dbVolumeLines(group, body) {
 // is available on every plan; growth is paid and grow-only — both gates are the backend's to
 // enforce, so nothing here pre-blocks: its 403/400 messages carry the upgrade hints and are wrapped
 // with context but kept verbatim.
-export async function dbVolume(opts) {
+export async function dbVolume(service, opts) {
     const api = await ApiClient.load();
     const p = await requireProject();
     const qs = new URLSearchParams();
     const branch = opts.branch ?? p.branch;
     if (branch)
         qs.set('branch', branch);
-    if (opts.group)
-        qs.set('group', opts.group);
+    if (service)
+        qs.set('group', service);
     const suffix = qs.toString() ? `?${qs}` : '';
     if (!opts.size) {
         const read = await fetchDbInstance(api, p.projectId, suffix);
         if (read.kind === 'no-instance') {
-            info(`postgres ${opts.group ?? 'default'}: no manageable instance (this service manages its own storage)`);
+            info(`postgres ${service ?? 'default'}: no manageable instance (this service manages its own storage)`);
             return;
         }
         if (opts.json)
             return printJson(read.body);
-        for (const line of dbVolumeLines(opts.group ?? 'default', read.body))
+        for (const line of dbVolumeLines(service ?? 'default', read.body))
             info(line);
         return;
     }
@@ -234,9 +234,9 @@ export async function dbVolume(opts) {
     if (opts.json)
         return printJson(res.body);
     const vg = res.body?.volumeGib;
-    info(`postgres ${opts.group ?? 'default'}: volume ${typeof vg === 'number' ? `grown to ${vg}Gi` : `set to ${sizeGib}Gi`}`);
+    info(`postgres ${service ?? 'default'}: volume ${typeof vg === 'number' ? `grown to ${vg}Gi` : `set to ${sizeGib}Gi`}`);
 }
-// Resolve the postgres service (sole, or --group) and its connection string. Two reads: the
+// Resolve the postgres service (sole, or the named one) and its connection string. Two reads: the
 // branch's services list names the service; GET /services/:id/credentials (gated secrets.read)
 // carries the value. Provider-minted credentials are canonical within their source service
 // (DATABASE_URL) and deliberately absent from the general `insta secrets` bundle, so this is the
@@ -244,25 +244,25 @@ export async function dbVolume(opts) {
 // already branch-scoped by the list. Returns null when the read parked on an approval
 // (handleApproval already spoke). Takes the client as an argument so tests drive it with a stub,
 // per this repo's pure-seam convention.
-export async function resolveDbUrl(api, projectId, branch, group, json) {
+export async function resolveDbUrl(api, projectId, branch, service, json) {
     const { services } = await api.request('GET', `/projects/${projectId}/services${q(branch)}`);
-    const svc = resolveSoleService(services, 'postgres', group);
+    const svc = resolveSoleService(services, 'postgres', service);
     const res = await api.rawRequest('GET', `/projects/${projectId}/services/${svc.id}/credentials`);
     if (handleApproval(res, json))
         return null;
     const url = res.body?.credentials?.DATABASE_URL;
     if (typeof url !== 'string' || !url) {
-        throw new Error(`postgres ${svc.name} has no DATABASE_URL credential yet — still provisioning? (\`insta services list\` shows status)`);
+        throw new Error(`postgres ${svc.name} has no DATABASE_URL credential yet — still provisioning? (\`insta service list\` shows status)`);
     }
     return { serviceName: svc.name, url };
 }
 // Print the postgres connection string: the bare DSN on stdout, nothing else — pipe-friendly
-// (`psql "$(insta db url)"`), like `storage get --json` keeps stdout parseable.
-export async function dbUrl(opts) {
+// (`psql "$(insta postgres url)"`), like `storage get --json` keeps stdout parseable.
+export async function dbUrl(service, opts) {
     const api = await ApiClient.load();
     const p = await requireProject();
     const branch = opts.branch ?? p.branch;
-    const r = await resolveDbUrl(api, p.projectId, branch, opts.group, opts.json);
+    const r = await resolveDbUrl(api, p.projectId, branch, service, opts.json);
     if (!r)
         return;
     if (opts.json)
@@ -308,7 +308,7 @@ export async function connectWithPsql(url, spawnImpl = spawn) {
     return await new Promise((resolve, reject) => {
         const child = spawnImpl('psql', [], { stdio: 'inherit', env });
         child.on('error', (e) => reject(e.code === 'ENOENT'
-            ? new Error('psql not found on PATH — install the postgres client, or print the DSN with `insta db url`')
+            ? new Error('psql not found on PATH — install the postgres client, or print the DSN with `insta postgres url`')
             : e));
         // Signal death reports code null — map to the conventional 128+signo (full table from
         // os.constants) so the advertised exit-status passthrough holds for Ctrl-C'd/killed sessions.
@@ -318,15 +318,15 @@ export async function connectWithPsql(url, spawnImpl = spawn) {
 // Open an interactive psql session on the postgres service. The DSN never touches disk or argv
 // history beyond the child process. Exits with psql's own exit code (agents rely on this, as
 // with `compute exec`).
-export async function dbConnect(opts) {
+export async function dbConnect(service, opts) {
     const api = await ApiClient.load();
     const p = await requireProject();
     const branch = opts.branch ?? p.branch;
-    const r = await resolveDbUrl(api, p.projectId, branch, opts.group, opts.json);
+    const r = await resolveDbUrl(api, p.projectId, branch, service, opts.json);
     if (!r)
         return;
     // stderr: stdout belongs to psql (the `insta run` rule).
     process.stderr.write(`psql → postgres/${r.serviceName}${branch ? ` (branch ${branch})` : ''} — a suspended instance wakes on connect, so the first prompt can take a few seconds\n`);
     relayExitCode(await connectWithPsql(r.url));
 }
-//# sourceMappingURL=db.js.map
+//# sourceMappingURL=postgres.js.map

package/dist/commands/regions.js

@@ -1,6 +1,6 @@
 import { ApiClient } from '../api.js';
 import { info, printJson } from '../util.js';
-// insta regions — list the regions a postgres/compute service can be created in.
+// insta config regions — list the regions a postgres/compute service can be created in.
 export async function regionsList(opts = {}, deps) {
     const api = deps?.api ?? await ApiClient.load();
     const { regions } = await api.request('GET', '/regions');

package/dist/commands/services.js

@@ -1,4 +1,4 @@
-// `insta services` — manage a project's opt-in services (postgres | storage | compute | redis | mysql | mongodb).
+// `insta service` — manage a project's opt-in services (postgres | storage | compute | redis | mysql | mongodb).
 import { ApiClient, requireProject } from '../api.js';
 import { info, printJson, handleApproval, renderNextActions } from '../util.js';
 export const SERVICE_TYPES = ['postgres', 'storage', 'compute', 'redis', 'mysql', 'mongodb'];
@@ -16,6 +16,28 @@ export function assertServiceName(name) {
     if (!SERVICE_NAME_RE.test(name))
         throw new Error('service name must be lower-kebab (a-z, 0-9, -)');
 }
+// Every service type that owns an always-on / volume verb of its OWN. The creation-time flags are
+// compute-only, so the refusal has to name the group the user actually typed: pointing a redis or
+// mongodb user at `insta postgres …` sends them at a different service type (and, on a project
+// with no postgres, at nothing at all).
+const DB_TYPES = ['postgres', 'redis', 'mysql', 'mongodb'];
+const hasOwnGroup = (type) => DB_TYPES.includes(type);
+export function alwaysOnTypeError(type) {
+    const base = '--always-on / --no-always-on is only valid for compute services';
+    return hasOwnGroup(type) ? `${base} (for ${type}, use \`insta ${type} always-on on|off\` after creation)` : base;
+}
+export function volumeTypeError(type) {
+    const base = '--volume is only valid for compute services';
+    // insta-db-backed postgres is provisioned WITH its disk (dbVolume goes through
+    // PATCH /database/settings), so there is nothing to attach — only to grow. A managed Fly
+    // database can be volumeless, and `--size` attaches there (ServicesService.setVolumeSize's
+    // attach branch runs for isFlyRuntimeType), which is what `volumeLines` already prints.
+    if (type === 'postgres')
+        return `${base} (postgres has one by default — grow it with \`insta postgres volume --size <gi>\`)`;
+    if (hasOwnGroup(type))
+        return `${base} (attach or grow one after creation with \`insta ${type} volume --size <gi>\`)`;
+    return base;
+}
 const MAX_COMPUTE_REPLICAS = 10;
 // Parse a replica count inside the compute plane's current safety ceiling.
 export function parseCount(raw) {
@@ -65,7 +87,7 @@ export function resolveSoleService(services, type, name) {
         return svc;
     }
     if (of.length === 0)
-        throw new Error(`no ${type} service in this project (add one with \`insta services add ${type} <name>\`)`);
+        throw new Error(`no ${type} service in this project (add one with \`insta service add ${type} <name>\`)`);
     if (of.length > 1)
         throw new Error(`multiple ${type} services — specify one: ${of.map((s) => s.name).join(', ')}`);
     return of[0];
@@ -107,12 +129,12 @@ export async function servicesAdd(type, name, opts = {}) {
     }
     // Presence, not truthiness: `--no-always-on` is an explicit false and is just as compute-only.
     if (opts.alwaysOn !== undefined && type !== 'compute')
-        throw new Error('--always-on / --no-always-on is only valid for compute services (for postgres, use `insta db always-on on|off` after creation)');
+        throw new Error(alwaysOnTypeError(type));
     if (opts.mountPath !== undefined && (type !== 'compute' || opts.volume === undefined))
         throw new Error('--mount-path requires --volume on a compute service');
     if (opts.volume !== undefined) {
         if (type !== 'compute')
-            throw new Error('--volume is only valid for compute services (postgres has one by default — grow it with `insta db volume --size`)');
+            throw new Error(volumeTypeError(type));
         parseVolumeGib(opts.volume); // junk fails here, before any config/network access
     }
     const api = await ApiClient.load();
@@ -129,9 +151,10 @@ export async function servicesAdd(type, name, opts = {}) {
     // general `insta secrets` bundle — without this line nothing in the product says how to reach it.
     if (type === 'postgres') {
         // The hint must be runnable as printed: carry --branch when the service was created on a
-        // branch other than the linked one, and --group so it survives multiple postgres services.
-        const flags = `${opts.branch ? ` --branch ${opts.branch}` : ''} --group ${name}`;
-        info(`  connect: \`insta db url${flags}\` prints the connection string, \`insta db connect${flags}\` opens psql (--group optional with a single postgres service)`);
+        // branch other than the linked one, and the service name so it survives multiple postgres
+        // services (a trailing positional on `postgres url`/`postgres connect`, not a flag).
+        const branchFlag = opts.branch ? ` --branch ${opts.branch}` : '';
+        info(`  connect: \`insta postgres url ${name}${branchFlag}\` prints the connection string, \`insta postgres connect ${name}${branchFlag}\` opens psql ([service] optional with a single postgres service)`);
     }
     renderNextActions(res.body.nextActions);
 }
@@ -171,7 +194,7 @@ export async function servicesList(opts) {
     if (opts.json)
         return printJson(services);
     if (!services.length)
-        return info(`(no services on ${branch ?? 'default'} — add one with \`insta services add <postgres|storage|compute|redis|mysql|mongodb> <name>\`)`);
+        return info(`(no services on ${branch ?? 'default'} — add one with \`insta service add <postgres|storage|compute|redis|mysql|mongodb> <name>\`)`);
     for (const s of services)
         info(serviceListLine(s));
 }
@@ -212,66 +235,4 @@ export function parseAccess(raw) {
         return false;
     throw new Error(`access must be public|private, got: ${raw}`);
 }
-// insta services set-access storage <name> <public|private>
-export async function servicesSetAccess(type, name, access, _opts) {
-    assertType(type, ['storage']);
-    const isPublic = parseAccess(access);
-    const api = await ApiClient.load();
-    const p = await requireProject();
-    const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(p.branch)}`);
-    const id = resolveServiceId(services, type, name);
-    const res = await api.rawRequest('PUT', `/projects/${p.projectId}/services/${id}/access`, { public: isPublic });
-    if (handleApproval(res, _opts.json))
-        return;
-    if (_opts.json)
-        return printJson(res.body.service);
-    info(`set storage ${name} access to ${access}`);
-}
-// insta services scale compute <name> <number> [region]
-export async function servicesScale(type, name, number, region, _opts) {
-    assertType(type, ['compute']);
-    const machineCount = parseCount(number);
-    const api = await ApiClient.load();
-    const p = await requireProject();
-    const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(_opts.branch ?? p.branch)}`);
-    const id = resolveServiceId(services, type, name);
-    const res = await api.rawRequest('POST', `/projects/${p.projectId}/services/${id}/scale`, { machineCount, region });
-    if (handleApproval(res, _opts.json))
-        return;
-    if (_opts.json)
-        return printJson(res.body.service);
-    info(`scaled compute ${name} to ${machineCount} replica(s)${region ? ` in ${region}` : ''}`);
-}
-// insta services upgrade <compute|postgres> <name> <new-spec>
-export async function servicesUpgrade(type, name, spec, _opts) {
-    assertType(type, ['compute', 'postgres']);
-    const api = await ApiClient.load();
-    const p = await requireProject();
-    const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(_opts.branch ?? p.branch)}`);
-    const id = resolveServiceId(services, type, name);
-    const res = await api.rawRequest('POST', `/projects/${p.projectId}/services/${id}/upgrade`, { spec });
-    if (handleApproval(res, _opts.json))
-        return;
-    if (_opts.json)
-        return printJson(res.body.service);
-    info(`upgraded ${type} ${name} to ${spec}`);
-}
-// insta services secrets <type> <name> — the secret names bound to a service.
-export async function servicesSecrets(type, name, opts = {}) {
-    assertType(type);
-    const api = await ApiClient.load();
-    const p = await requireProject();
-    const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(opts.branch ?? p.branch)}`);
-    const id = resolveServiceId(services, type, name);
-    const res = await api.rawRequest('GET', `/projects/${p.projectId}/services/${id}/secrets`);
-    if (handleApproval(res, opts.json))
-        return;
-    const { secrets } = res.body;
-    if (opts.json)
-        return printJson(secrets);
-    if (!secrets.length)
-        return info(`(no secrets bound to ${type}/${name})`);
-    for (const n of secrets)
-        info(n);
-}
 //# sourceMappingURL=services.js.map

package/dist/commands/setup.js

@@ -1,5 +1,6 @@
-// `insta setup agent` — make this machine's coding agents InstaCloud-native in one step
-// (the Railway `railway setup agent` pattern). Installs the `insta` skill USER-GLOBALLY for
+// `insta agent setup` — make this machine's coding agents InstaCloud-native in one step.
+// (`setup agent` remains a permanent hidden alias; the canonical order is `agent setup`, per the
+// noun-first tree — see the Command architecture rules.) Installs the `insta` skill USER-GLOBALLY for
 // every agent the skills tool knows: the skill is pure product knowledge with brand-gated
 // triggers — no project state in it (the project binding is carried by ./.insta/project.json
 // at command time), so one machine-level copy is strictly better than per-project copies.
@@ -89,7 +90,7 @@ export function summarizeInstall(output) {
         : `${count} agent${count === 1 ? '' : 's'}`;
     return `✓ Agents — ${list}`;
 }
-// ---- CLI self-install (makes `npx -y insta setup agent` a complete one-liner) ----
+// ---- CLI self-install (makes `npx -y insta agent setup` a complete one-liner) ----
 // Under npx the CLI runs from the npm cache and vanishes when the process exits — but the skill
 // installed below tells every agent to run `insta …`, which then wouldn't exist. So when this
 // process came from the npm channel and no DURABLE `insta` is on PATH, install ourselves
@@ -226,7 +227,7 @@ export async function registerMcp(run = defaultRunner, mint = defaultMinter, use
     if (useToken) {
         const token = await mint();
         if (!token) {
-            info('  MCP not registered (--mcp-token needs a login) — run `insta login`, then `insta setup agent --mcp-token` again');
+            info('  MCP not registered (--mcp-token needs a login) — run `insta login`, then `insta agent setup --mcp-token` again');
             return 'no-token';
         }
         args.push('--header', `Authorization: Bearer ${token}`);
@@ -256,7 +257,7 @@ export function requireMcpRegistration(status) {
 /** The environment `setup agent` should target, and whether the machine must be switched to it
  *  first. Pure — decides only; the caller performs the switch.
  *
- *  The contract: the public one-liner `npx -y insta setup agent` means PRODUCTION,
+ *  The contract: the public one-liner `npx -y insta agent setup` means PRODUCTION,
  *  full stop — a leftover `insta env use staging` from last month must not silently give a new
  *  onboarding run staging skills. Staging is an explicit ask: `--env staging` (or $INSTA_ENV).
  *  Two deliberate exceptions leave the machine alone:
@@ -473,10 +474,10 @@ export async function setupAgent(opts, run = defaultRunner, mint, installConfigs
     }
     if (loggedIn) {
         if (await enroll())
-            info('✓ Project agent session ready (expires in 24 hours; refresh with insta setup agent)');
+            info('✓ Project agent session ready (expires in 24 hours; refresh with insta agent setup)');
     }
     else {
-        info('  project agent session not created — run `insta login`, then `insta setup agent`');
+        info('  project agent session not created — run `insta login`, then `insta agent setup`');
     }
     // THE summary line. The restart note exists because config-file agents only read their MCP
     // config at startup; the skill files need no restart.

package/dist/commands/storage.js

@@ -6,8 +6,8 @@ import { Readable } from 'node:stream';
 import { pipeline } from 'node:stream/promises';
 import { ApiClient, requireProject } from '../api.js';
 import { info, printJson, handleApproval } from '../util.js';
-import { q, resolveSoleService } from './services.js';
-import { fmtBytes } from './db.js'; // the repo's tested bytes formatter — don't grow a third copy
+import { q, resolveSoleService, parseAccess } from './services.js';
+import { fmtBytes } from './postgres.js'; // the repo's tested bytes formatter — don't grow a third copy
 function qs(params) {
     const u = new URLSearchParams();
     for (const [k, v] of Object.entries(params))
@@ -170,4 +170,19 @@ export async function storageDelete(key, opts) {
         return printJson(res.body);
     info(`deleted ${key} from storage/${svc.name} (branch ${branch})`);
 }
+// `insta storage set-access <public|private> [--service <name>]` — PUT /services/:id/access.
+// public = anonymous public-read on the bucket; private is the default a bucket is born with.
+export async function storageSetAccess(access, opts) {
+    const isPublic = parseAccess(access);
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const branch = opts.branch ?? p.branch;
+    const svc = await storageTarget(api, p.projectId, branch, opts.service);
+    const res = await api.rawRequest('PUT', `/projects/${p.projectId}/services/${svc.id}/access`, { public: isPublic });
+    if (handleApproval(res, opts.json))
+        return;
+    if (opts.json)
+        return printJson(res.body.service);
+    info(`set storage ${svc.name} access to ${access}`);
+}
 //# sourceMappingURL=storage.js.map

package/dist/commands/template.js

@@ -12,7 +12,7 @@ import { info, printJson, handleApproval, renderNextActions, CliCancel } from '.
 import { MANIFEST_FILE, collectManifestVariables, loadTemplateManifest } from '../template-manifest.js';
 import { parseGitHubTemplateUrl, fetchGitHubTemplate } from '../github-source.js';
 // One aligned row per template; numeric columns right-aligned. Plain padded columns, as the rest
-// of the CLI (storage list, compute check-domain) — no table library.
+// of the CLI (storage list, domain check) — no table library.
 export function templateListLines(templates) {
     if (!templates.length)
         return ['(no templates published yet)'];
@@ -233,7 +233,7 @@ export function partialMessage(dep) {
         ...serviceStateLines(dep),
         ...(dep?.error ? [`  ${dep.error}`] : []),
         ...(dep?.logsTail ? ['--- log tail ---', String(dep.logsTail).trimEnd()] : []),
-        'created services are kept — inspect with `insta logs compute <name>`, re-run the deploy to retry, or remove them with `insta services remove <type> <name>`',
+        'created services are kept — inspect with `insta compute logs <name>`, re-run the deploy to retry, or remove them with `insta service remove <type> <name>`',
     ].join('\n');
 }
 export function failureMessage(dep, fallbackStep) {
@@ -279,7 +279,7 @@ export async function watchDeployment(getDeployment, id, out = info, wait = slee
         }
         await wait(2);
     }
-    throw new Error(`timed out after ${Math.round(timeoutMs / 60_000)}m waiting for template deployment ${id} — check \`insta events\``);
+    throw new Error(`timed out after ${Math.round(timeoutMs / 60_000)}m waiting for template deployment ${id} — check \`insta agent events\``);
 }
 // ---- commands ----
 export async function templateList(opts) {
@@ -391,7 +391,7 @@ export async function templateDeploy(target, opts = {}, deps = {}) {
     for (const u of deploymentUrls(dep))
         info(`  ${u}`);
     // Provider credentials are not in the `insta secrets` bundle — point at the paths that exist.
-    info('next: `insta db url` prints the postgres DSN; bind service credentials into compute with `insta secrets bind`; `insta secrets` refreshes user-defined secrets in .env');
+    info('next: `insta postgres url` prints the postgres DSN; bind service credentials into compute with `insta secrets bind`; `insta secrets` refreshes user-defined secrets in .env');
     renderNextActions(dep.nextActions);
 }
 //# sourceMappingURL=template.js.map

package/dist/commands/upgrade.js

@@ -2,7 +2,7 @@
 // release installer; npm via `npm i -g`). A background version check (detached, cached in
 // ~/.insta/update-check.json) powers an update nudge — and, since the CLI is young and moves
 // fast, AUTO-UPDATE IS ON BY DEFAULT: when a newer version is known, a quiet upgrade runs in the
-// background. `insta autoupdate off` (or INSTA_NO_AUTOUPDATE=1) disables that, leaving just the
+// background. `insta config autoupdate off` (or INSTA_NO_AUTOUPDATE=1) disables that, leaving just the
 // stderr nudge.
 //
 // ONE SOURCE OF TRUTH. "What is the latest insta?" is answered in exactly one place —
@@ -20,7 +20,7 @@ import { spawn } from 'node:child_process';
 import { dirname, join } from 'node:path';
 import { homedir } from 'node:os';
 import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
-import { readGlobal, writeGlobal } from '../config.js';
+import { readGlobal, readPersistedGlobal, writeGlobal } from '../config.js';
 import { resolveSpawnable } from '../spawn.js';
 import { info } from '../util.js';
 const INSTALL_SH = 'https://raw.githubusercontent.com/InsForge/instacloud-cli/main/install.sh';
@@ -329,16 +329,22 @@ export async function backgroundCheck(current, deps = {}) {
     }
     return 'auto';
 }
-// `insta autoupdate [on|off]` — toggle / show the auto-update preference (default: on).
+// `insta config autoupdate [on|off]` — toggle / show the auto-update preference (default: on).
 export async function autoupdate(mode) {
-    const cfg = await readGlobal();
     if (mode === 'on' || mode === 'off') {
+        // Read-modify-write must use the PERSISTED config (like `env use` does), not readGlobal()'s
+        // runtime view: readGlobal() folds in a --api-url/INSTA_API_URL override and, when that override
+        // points at a different deployment, scrubs the stored session. Writing that view back to disk
+        // here would silently re-point ~/.insta/config.json at the override and log the user out just
+        // from toggling autoupdate.
+        const cfg = await readPersistedGlobal();
         await writeGlobal({ ...cfg, autoUpdate: mode === 'on' });
         info(`autoupdate ${mode}`);
         return;
     }
+    const cfg = await readGlobal();
     const enabled = cfg.autoUpdate !== false && !process.env.INSTA_NO_AUTOUPDATE;
-    info(`autoupdate: ${enabled ? 'on' : 'off'} (default on while the CLI is pre-1.0 — \`insta autoupdate off\` to disable)`);
+    info(`autoupdate: ${enabled ? 'on' : 'off'} (default on while the CLI is pre-1.0 — \`insta config autoupdate off\` to disable)`);
 }
 // Called once at CLI start-up. Never blocks: reads the cache synchronously, prints at most one
 // stderr line, and (when due) spawns detached children for the registry check / quiet upgrade.
@@ -353,11 +359,17 @@ export async function autoupdate(mode) {
  *  into the ssh session's stderr and an auto-upgrade spawns a detached process
  *  mid-connection. Same prefix rule trackCommand already applies to telemetry.
  */
-export function skipsUpdateCheck(cmd) {
+export function skipsUpdateCheck(cmd, sub) {
+    // The autoupdate PREFERENCE moved to `insta config autoupdate` in the command re-organization,
+    // so the level-1 name alone stopped matching it: `insta config autoupdate off` would run the
+    // very check it is being typed to switch off (and could auto-upgrade before the handler lands).
+    // The retired top-level spelling stays exempt too — it costs nothing and cannot regress.
+    if (cmd === 'config' && sub === 'autoupdate')
+        return true;
     return cmd === 'upgrade' || cmd === 'autoupdate' || !!cmd?.startsWith('__');
 }
 export function maybeUpdate(current, argv) {
-    if (skipsUpdateCheck(argv[2]))
+    if (skipsUpdateCheck(argv[2], argv[3]))
         return;
     const channel = detectChannel();
     const cache = readCache();
@@ -373,7 +385,7 @@ export function maybeUpdate(current, argv) {
     else if (action === 'auto') {
         writeCache({ ...cache, lastAutoAt: now });
         respawnDetached(['upgrade']);
-        console.error(`↑ auto-updating insta ${current} → ${cache.latest} in the background (\`insta autoupdate off\` to disable)`);
+        console.error(`↑ auto-updating insta ${current} → ${cache.latest} in the background (\`insta config autoupdate off\` to disable)`);
     }
 }
 // Re-invoke this same CLI (binary or node+script) detached, output discarded.