insta 0.1.13 → 0.1.15

package/dist/commands/deploy.js

@@ -147,12 +147,9 @@ export async function deploy(dir, opts) {
     const p = await requireProject();
     const branch = opts.branch ?? p.branch;
     const log = note(opts);
-    // Junk fails here, before a directory is packed and uploaded for a body the platform would only
-    // refuse: the same parser every other --port in this CLI runs. `Number()` alone sent NaN as
-    // `null` and let 0 or 70000 travel to the server.
     let port;
     try {
-        port = opts.port === undefined ? undefined : parsePort(opts.port);
+        port = opts.port === undefined ? undefined : parsePort(opts.port, { allowZero: true });
     }
     catch (e) {
         die(`--${e.message}`);

package/dist/commands/services.js

@@ -47,14 +47,13 @@ export function parseCount(raw) {
     }
     return n;
 }
-// Parse a TCP port. Junk fails here rather than reaching the API as NaN (the parseCpu lesson).
-// Decimal digits only, as parseVolumeGib: `Number()` alone would quietly read 0x1f90 as 8080 and
-// 1e3 as 1000, and a port written in hex is a typo worth reporting, not one worth honouring.
-export function parsePort(raw) {
+// Keep TCP-only callers strict; port 0 is reserved for explicitly opted-in compute workers.
+export function parsePort(raw, opts = {}) {
+    const min = opts.allowZero ? 0 : 1;
     const m = /^\s*(\d+)\s*$/.exec(raw);
     const n = m ? Number(m[1]) : NaN;
-    if (!Number.isInteger(n) || n < 1 || n > 65535)
-        throw new Error(`port must be an integer between 1 and 65535, got: ${raw}`);
+    if (!Number.isInteger(n) || n < min || n > 65535)
+        throw new Error(`port must be an integer between ${min} and 65535, got: ${raw}`);
     return n;
 }
 // Parse a volume size in whole Gi: "10" or "10Gi" (suffix case-insensitive — unlike the db
@@ -112,10 +111,11 @@ function defaultDatabasePort(type) {
 export function servicesAddRequestBody(type, name, branch, opts) {
     return {
         type, name, ...(branch ? { branch } : {}), public: !!opts.public,
-        ...(opts.image ? { image: opts.image } : {}), ...(opts.port ? { port: parsePort(opts.port) } : {}),
+        ...(opts.image ? { image: opts.image } : {}), ...(opts.port !== undefined ? { port: parsePort(opts.port, { allowZero: type === 'compute' }) } : {}),
         ...(opts.region ? { region: opts.region } : {}),
-        // Sent whenever the flag was given, false included: compute is born always-on by default,
-        // so `--no-always-on` must reach the API as an explicit false. Omitted means the platform default.
+        // Sent whenever the flag was given, false included: the birth default is platform config
+        // (INSTA_COMPUTE_ALWAYS_ON_DEFAULT, scale-to-zero unless set), so an explicit --no-always-on
+        // must reach the API as false to hold whatever that config says. Omitted means the platform default.
         ...(opts.alwaysOn !== undefined ? { alwaysOn: opts.alwaysOn } : {}),
         ...(opts.volume !== undefined ? { volumeGib: parseVolumeGib(opts.volume) } : {}),
         ...(opts.mountPath !== undefined ? { volumeMountPath: opts.mountPath } : {}),
@@ -130,10 +130,10 @@ export async function servicesAdd(type, name, opts = {}) {
         throw new Error('--region is not valid for storage services');
     if (opts.image && type !== 'compute')
         throw new Error('--image is only valid for compute services');
-    if (opts.port) {
+    if (opts.port !== undefined) {
         if (type !== 'compute')
             throw new Error('--port is only valid for compute services');
-        parsePort(opts.port); // junk fails here, before any config/network access
+        parsePort(opts.port, { allowZero: true });
     }
     // Presence, not truthiness: `--no-always-on` is an explicit false and is just as compute-only.
     if (opts.alwaysOn !== undefined && type !== 'compute')

package/dist/deploy-archive.js

@@ -121,7 +121,7 @@ export async function deployArchive(api, projectId, ref, branch, opts, now = Dat
             if (state === 'live') {
                 const image = res.body?.imageRef;
                 const url = res.body?.url;
-                if (typeof image !== 'string' || !image || typeof url !== 'string' || !url) {
+                if (typeof image !== 'string' || !image || typeof url !== 'string' || (!url && opts.port !== '0')) {
                     throw new Error('the deploy finished but the platform returned no image or URL for it — check `insta status`');
                 }
                 const optionalString = (field, v) => {

package/dist/index.js

@@ -153,9 +153,9 @@ svc.command('add [type] [name]').description('Provision a service on demand (com
     .option('--region <region>', 'region for postgres/compute/managed databases, e.g. us-east (see `insta config regions`)')
     .option('--public', 'storage only: serve the bucket with anonymous public-read (default private)')
     .option('--image <url>', 'compute only: run this container image at creation')
-    .option('--port <n>', 'compute only: port the image listens on (default 8080)')
-    .option('--always-on', 'compute only: create as always-on — never scales to zero (the default for new compute services; all plans; billing is actual usage either way)')
-    .option('--no-always-on', 'compute only: create as scale-to-zero — idle machines suspend and wake on the next request')
+    .option('--port <n>', 'compute only: port the image listens on (default 8080; 0 for a worker without a routed port)')
+    .option('--always-on', 'compute only: create as always-on — never scales to zero (all plans; billing is actual usage either way). A worker (--port 0) is always-on regardless')
+    .option('--no-always-on', 'compute only: create as scale-to-zero — idle machines suspend and wake on the next request (the default for new compute services; refused with --port 0, a worker cannot scale to zero)')
     .option('--mount-path <path>', 'compute only: container mount path for a new volume (requires --volume; default /data)')
     .option('--volume <gi>', 'compute only: attach a persistent volume of this many whole Gi (also attachable later: `insta compute volume <name> --size <gi>`). Any plan may attach up to its own plan cap (10Gi free, 50Gi paid by default; the bare `insta compute volume <name>` read prints it as plan max); a size above the free cap is paid. Volume services keep 1 machine and stop (cold wake) instead of suspend when idle')
     .option('--pg-version <major>', 'postgres only: the Postgres major version to create the database on — 16, 17 or 18 (default 16). Fixed for the database\'s lifetime; branches keep it')
@@ -379,7 +379,7 @@ compute.command('scale [count] [service]').description('Set a compute service sa
 compute.command('limits [service]').description("Show or set a compute service's resource ceiling (any plan within the free cap; raising above it needs a paid plan). --memory is the dial; cpu derives from it unless --cpu is given. Billing is actual usage — the ceiling caps what the app may burn, it is not a price")
     .option('--memory <size>', 'memory ceiling, e.g. 512mb or 1gb').option('--cpu <n>', 'vCPU ceiling override (provider sizes: 1, 2, 4, 6, 8)')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeLimits(service, o)));
-compute.command('always-on <mode> [service]').description('Set a compute service always-on (mode: on|off). on = machines never scale to zero (the default for new compute services); off = scale-to-zero. All plans; billing is actual usage either way')
+compute.command('always-on <mode> [service]').description('Set a compute service always-on (mode: on|off). on = machines never scale to zero; off = scale-to-zero (the default for new compute services; refused on a worker, port 0). All plans; billing is actual usage either way')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((mode, service, o) => computeCmd.computeAlwaysOn(mode, service, o)));
 compute.command('ssh [service]')
     .description("Issue a short-lived SSH certificate for a compute service and print the command that uses it -- this command does NOT open the session itself, it makes `ssh` work. `--setup` does the one-time work: it generates a dedicated key under ~/.insta/ssh (your existing keys are never touched), has the platform sign a SHORT-LIVED certificate for it, adds one @cert-authority line to ~/.ssh/known_hosts so every region is trusted without per-node fingerprint prompts, and writes an ssh_config block AT THE TOP of ~/.ssh/config giving each compute service the alias `<service>.insta`. After that it is plain `ssh api.insta`, scp and -L: the block renews that alias's certificate for you while OpenSSH parses the config. Needs an interactive login -- API keys are refused; use `insta compute exec` for one-shot commands from CI")
@@ -515,7 +515,7 @@ buildCmd.command('logs <build-id>').description('Read source-build output for a
     .action(guard((id, opts) => buildLogs(id, opts)));
 // ---- deploy ----
 program.command('deploy [dir]').description('Deploy a source directory (built remotely; on insta-compute a Dockerfile is optional and nixpacks detects the runtime) or a prebuilt --image to a branch compute group')
-    .option('--image <url>', 'prebuilt container image to deploy (instead of a source dir)').option('--branch <b>').option('--group <g>').option('--port <p>')
+    .option('--image <url>', 'prebuilt container image to deploy (instead of a source dir)').option('--branch <b>').option('--group <g>').option('--port <p>', 'port the app listens on (0 for a worker without a routed port)')
     .option('--websocket', 'run a WebSocket app (larger guest + connection-based concurrency)')
     .option('--replace-source', 'the service deploys from a connected GitHub repo: switch it to this image and remove the repo connection (admin); without it such a deploy is refused')
     .option('--json', 'print the deploy result as JSON (build progress goes to stderr)')

package/dist/pack.js

@@ -109,31 +109,8 @@ function walk(root, rel, out, links, ig, files, flavour, cap = Infinity) {
         }
     }
 }
-// The walk classifies with lstat and the read happens later, so a plain readFileSync would
-// FOLLOW a symlink that replaced the file in between and put a file from outside the directory
-// into an archive that promises none. Two guards, and neither is a full one on its own:
-//
-//   O_NOFOLLOW refuses when the final component is a symlink AT OPEN TIME, closing the swap the
-//   walk cannot see. Undefined on Windows, where it degrades to the check below.
-//
-//   fstat on the OPEN HANDLE must still describe the file the walk measured: same inode, same
-//   device, same size. Its job is the tar's own consistency -- a file rewritten to a different
-//   length mid-pack would otherwise produce a header whose count disagrees with its payload.
-//
-// Two things neither closes, and both are stated rather than implied away:
-//
-//   An ANCESTOR directory swapped for a symlink. Node exposes no openat, so resolving each
-//   component against a directory handle is not available here.
-//
-//   A same-size plain file deleted and recreated. Measured on linux rather than assumed: the
-//   inode is REUSED and mtimeNs/ctimeNs are byte-identical for a delete+create inside one
-//   timestamp tick, so no stat-based identity can see it. It is also the least interesting case
-//   -- the symlink promise still holds, the tar stays well formed because the length did not
-//   move, and the archive simply carries a slightly newer copy of a file the caller owns.
-//
-// The residual on both is narrow: someone able to rewrite files and directories inside the tree
-// being packed can already put any bytes they like into it by writing them.
-export function readEntry(abs, e) {
+// O_NOFOLLOW closes final-component symlink swaps only on platforms that expose it.
+export function readEntry(abs, e, platform = process.platform) {
     const noFollow = constants.O_NOFOLLOW ?? 0;
     let fd;
     try {
@@ -147,8 +124,10 @@ export function readEntry(abs, e) {
     }
     try {
         const st = fstatSync(fd);
+        // Some Windows libuv versions omit lstat's device ID; inode and size must still match.
+        const missingDevice = platform === 'win32' && (e.dev === 0 || e.dev === 0n);
         const same = st.isFile() && st.size === e.size
-            && (e.ino === undefined || st.ino === e.ino) && (e.dev === undefined || st.dev === e.dev);
+            && (e.ino === undefined || st.ino === e.ino) && (e.dev === undefined || missingDevice || st.dev === e.dev);
         if (!same)
             throw new Error(`${e.path} changed while packing — re-run the deploy`);
         return readFileSync(fd);

package/dist/resolve-service.js

@@ -70,7 +70,7 @@ export async function resolveServiceArgs(type, name, deps, given = {}) {
         throw new Error(missingArgsMessage(type));
     // A bad --port is a typo in the command, not an answer: fail before asking anything.
     if (given.port !== undefined)
-        parsePort(given.port);
+        parsePort(given.port, { allowZero: !type || type === 'compute' });
     const kind = type
         ? SERVICE_KINDS.find((k) => k.type === type && !k.needsImage)
         : await deps.selectKind(SERVICE_KINDS);
@@ -133,12 +133,12 @@ export async function promptServiceName(kind, suggested) {
 }
 export async function promptPort(fallback) {
     const answer = await clack.text({
-        message: 'Port the image listens on:',
+        message: 'Port the image listens on (0 for a worker):',
         initialValue: fallback,
         // The rule the command enforces, so the prompt and a --port can never disagree.
         validate: (v) => {
             try {
-                parsePort(v.trim());
+                parsePort(v.trim(), { allowZero: true });
                 return undefined;
             }
             catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [