insta 0.1.21 → 0.1.23

package/dist/commands/compute.js

@@ -624,7 +624,7 @@ export function removeTarget(count, service, opts) {
     if (opts.region !== undefined)
         throw new Error('--region does not apply to --remove');
     if (service !== undefined) {
-        throw new Error(count !== undefined && count.trim() !== '' && Number.isFinite(Number(count)) ? '--remove lowers the replica count by one; pass no count' : `unexpected argument: ${service} (usage: insta compute scale [service] --remove <instance>)`);
+        throw new Error(count !== undefined && count.trim() !== '' && Number.isFinite(Number(count)) ? '--remove names one instance; pass no count' : `unexpected argument: ${service} (usage: insta compute scale [service] --remove <instance>)`);
     }
     return count;
 }
@@ -634,7 +634,7 @@ export async function computeScale(count, serviceName, opts) {
     if (opts.remove !== undefined)
         return computeRemoveInstance(removeTarget(count, serviceName, { remove: opts.remove, region: opts.region }), opts.remove, opts);
     if (count === undefined)
-        throw new Error('a replica count is required (or --remove <instance> to drop one named instance)');
+        throw new Error('a replica cap is required (or --remove <instance> to drop one named instance)');
     const machineCount = parseCount(count);
     const api = await ApiClient.load();
     const p = await requireProject();
@@ -646,7 +646,7 @@ export async function computeScale(count, serviceName, opts) {
         return;
     if (opts.json)
         return printJson(res.body.service);
-    info(`scaled compute ${svc.name} to ${machineCount} replica(s)${opts.region ? ` in ${opts.region}` : ''}`);
+    info(`set compute ${svc.name} replica cap to ${machineCount}${opts.region ? ` in ${opts.region}` : ''}`);
 }
 // `insta compute scale [service] --remove <instance>` — DELETE /services/:id/instances/:instance.
 async function computeRemoveInstance(serviceName, instance, opts) {
@@ -660,7 +660,7 @@ async function computeRemoveInstance(serviceName, instance, opts) {
         return;
     if (opts.json)
         return printJson(res.body.service);
-    info(`removed ${instance} from compute ${svc.name}; ${res.body.service?.machine_count ?? '?'} replica(s) remain`);
+    info(`removed ${instance} from compute ${svc.name}; replica cap is now ${res.body.service?.machine_count ?? '?'}`);
 }
 // ---- limits (the resource ceiling; paid plans) ----
 // Parse a human memory value into MB: "512", "512mb", "1gb", "2g", "1.5gb".
@@ -1723,11 +1723,30 @@ export function acquireLockFile(path, now, staleMs) {
     // ask whether the holder still exists.
     const token = `${process.pid}:${randomUUID()}`;
     const release = () => {
+        // The claim a takeover of this token takes, so a release and a takeover never interleave.
+        const claim = takeoverClaim(path, token);
+        let claimed = false;
+        try {
+            linkSync(path, claim);
+            claimed = true;
+        }
+        catch (e) {
+            // Leave the lock unless the disk has no hardlinks, where no takeover can claim it either.
+            if (!LINK_UNSUPPORTED.has(String(e?.code)))
+                return;
+        }
         try {
             if (readFileSync(path, 'utf8') === token)
                 unlinkSync(path);
         }
         catch { /* already gone, or taken over by someone else */ }
+        finally {
+            if (claimed)
+                try {
+                    unlinkSync(claim);
+                }
+                catch { /* the inode keeps its other name */ }
+        }
     };
     const take = () => {
         try {
@@ -1859,21 +1878,22 @@ function processAlive(pid) {
  *  `path` keeps its inode throughout, so there is no moment at which the lock
  *  at `path` can have become somebody else's between the check and the act:
  *  the holder judged dead cannot release, every other breaker is behind the
- *  claim, and a release by anyone else checks for its own token first. Should
- *  the old holder's release ever run, it reads a foreign token and leaves the
- *  file alone.
+ *  claim, and a release by anyone else checks for its own token first.
+ *  The old holder's release takes this same claim, so it never lands inside a takeover.
+ *  A release that cannot take it leaves the lock, to be broken like an abandoned one.
  *
  *  Residual, and deliberately not "fixed": a breaker killed between the link
- *  and its write leaves the claim behind, and that one token can then no
- *  longer be broken (removing the claim by hand is the way out, and the busy
- *  message names the lock). Every scheme for reaping an abandoned claim needs
+ *  and its write, or a release killed before its unlink, leaves the claim
+ *  behind, and that one token can then no longer be broken or released
+ *  (removing the claim by hand is the way out, and the busy message names
+ *  the lock). Every scheme for reaping an abandoned claim needs
  *  to decide the claim is dead and then remove it -- the same check-then-act
  *  this function exists to eliminate, one level up. A claim left behind AFTER
  *  the write is inert: the lock now carries the breaker's token, and the next
  *  breaker keys its claim on that. A wedged lock is recoverable and says so;
  *  two writers in the same section silently lose the user's config. */
 function breakStaleLock(path, stale, mine) {
-    const claim = `${path}.stale.${createHash('sha256').update(stale).digest('hex').slice(0, 32)}`;
+    const claim = takeoverClaim(path, stale);
     try {
         linkSync(path, claim);
     }
@@ -1906,6 +1926,12 @@ function breakStaleLock(path, stale, mine) {
         catch { /* the inode keeps its other name */ }
     }
 }
+/** link() errors from a disk without hardlinks, where a release may skip its claim. */
+const LINK_UNSUPPORTED = new Set(['EPERM', 'ENOTSUP', 'EOPNOTSUPP', 'ENOSYS']);
+/** The hardlink that arbitrates breaking or releasing the lock `token` names. */
+function takeoverClaim(path, token) {
+    return `${path}.stale.${createHash('sha256').update(token).digest('hex').slice(0, 32)}`;
+}
 export async function computeSSH(serviceName, opts, deps = {}) {
     if (opts.ensureCert !== undefined)
         return ensureCertForAlias(opts.ensureCert);

package/dist/commands/template-author.js

@@ -65,6 +65,8 @@ function serviceText(s) {
     const bits = [
         kind,
         s.port != null ? `port ${s.port}` : undefined,
+        // Only a web service has one, and a platform that does not serve the field says nothing.
+        s.type === 'web' && s.healthcheck !== undefined ? (s.healthcheck ? `health check ${s.healthcheck}` : 'no health check') : undefined,
         s.image ? `image ${s.image}` : undefined,
         // A null mount path on a volume is the default /data.
         s.volume ? `volume at ${s.mountPath ?? '/data'}` : undefined,

package/dist/commands/template.js

@@ -32,6 +32,7 @@ export function templateListLines(templates) {
 export function normalizeInfoServices(raw) {
     const one = (name, s) => ({
         name, type: s?.type, port: s?.port,
+        healthcheck: typeof s?.healthcheck === 'string' ? s.healthcheck : undefined,
         volumeGib: s?.volumeGib ?? s?.volume?.size,
         volume: s?.volume === true || s?.volumeGib != null || s?.volume?.size != null,
         mountPath: typeof s?.mountPath === 'string' ? s.mountPath : undefined,
@@ -91,7 +92,9 @@ export function templateInfoLines(t, bold = (s) => s) {
             // A size only when the registry still carries one: a manifest names no size any more, so
             // "persistent /data" is all there is to say until the service exists.
             const disk = s.volumeGib ? `${s.volumeGib}Gi volume` : s.volume ? `persistent ${s.mountPath ?? '/data'}` : undefined;
-            const bits = [infoKind(s), s.port ? `port ${s.port}` : undefined, disk].filter(Boolean);
+            // Only a web service has a path to probe, and a manifest that names none has no health check.
+            const health = s.type === 'web' ? (s.healthcheck ? `health check ${s.healthcheck}` : 'no health check') : undefined;
+            const bits = [infoKind(s), s.port ? `port ${s.port}` : undefined, health, disk].filter(Boolean);
             return `${s.name}${bits.length ? ` (${bits.join(', ')})` : ''}`;
         });
         lines.push(`services (${services.length}): ${summary.join(', ')}`);

package/dist/index.js

@@ -375,9 +375,9 @@ compute.command('restart [service]').description("Restart a compute service by r
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeRestart(service, o)));
 compute.command('status [service]').description("Show a compute service's desired vs. live state")
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeStatus(service, o)));
-compute.command('scale [count] [service]').description('Set a compute service same-region replica count, 1 to 10 (paid plans only). --remove <instance> instead drops that one instance and runs one fewer; instance ids are the `instance` field of `insta compute logs --json`. The last instance cannot be removed')
+compute.command('scale [count] [service]').description('Set a compute service same-region replica cap, 1 to 10 (paid plans only). A scale-to-zero service runs 1 up to the cap on demand; an always-on service runs exactly the cap, so turn always-on on to hold a fixed count. --remove <instance> instead drops that one instance: an always-on service runs one fewer, a scale-to-zero one keeps its cap; instance ids are the `instance` field of `insta compute logs --json`. The last instance cannot be removed')
     .option('--region <region>', 'region to scale in (default: the service region)')
-    .option('--remove <instance>', 'drop this instance (inst-<12 hex>) and run one fewer replica')
+    .option('--remove <instance>', 'drop this instance (inst-<12 hex>)')
     .option('--json').option('--branch <branch>', 'branch (default: current)')
     .action(guard((count, service, o) => computeCmd.computeScale(count, service, o)));
 compute.command('limits [service]').description("Show or set a compute service's resource ceiling (any plan within the free cap; raising above it needs a paid plan). --memory is the dial; cpu derives from it unless --cpu is given. Billing is actual usage — the ceiling caps what the app may burn, it is not a price")
@@ -556,7 +556,8 @@ tpl.command('create').description("Create a community template draft from the li
     .option('--json')
     .action(guard((o) => templateAuthor.templateCreate(o)));
 tpl.command('drafts').description("List your org's community templates, drafts and published, with their status")
-    .option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .option('--org <id>', "target org (default: linked project's org)")
+    .option('--json', 'print one summary per template as the platform serves it, with no services, variables or publish requirements. insta template draft <code> --json prints one draft in full')
     .action(guard((o) => templateAuthor.templateDrafts(o)));
 tpl.command('draft <code>').description('Show one community template draft: its services, every variable with its choice, and the publish requirements')
     .option('--org <id>', "target org (default: linked project's org)").option('--json')

package/dist/template-manifest.js

@@ -14,6 +14,8 @@ export const MANIFEST_FILE = 'insta.template.yaml';
 const CODE_RE = /^[a-z0-9][a-z0-9-]{0,38}$/;
 export const ENV_NAME_RE = /^[A-Z][A-Z0-9_]{0,63}$/;
 const GENERATOR_RE = /^secret:([1-9]\d{0,2})$/;
+// The platform's HEALTHCHECK_RE (src/provisioning/templateManifest.ts), verbatim.
+const HEALTHCHECK_RE = /^\/(?!\/)[A-Za-z0-9\-._~!$&'()*+,;=:@%/?]*$/;
 // The compute vocabulary every CLI has known. Any other type is the platform's to accept or refuse.
 const COMPUTE_TYPES = ['web', 'worker'];
 // Datastores that never gain a url or host. Storage is left off because a public bucket may get an address.
@@ -116,10 +118,16 @@ export function validateManifest(m) {
             if (svc.alwaysOn === false)
                 problems.push(`${where}.alwaysOn: a worker cannot scale to zero — nothing is routed to it, so nothing would wake it; remove alwaysOn or set it true`);
         }
-        if (svc.type === 'web' && !svc.healthcheck)
-            problems.push(`${where}: web services must declare a healthcheck path`);
-        if (svc.healthcheck && !String(svc.healthcheck).startsWith('/'))
-            problems.push(`${where}: healthcheck must be an absolute path (start with /)`);
+        // Optional on a web service, and a given path must pass the platform's grammar.
+        if (svc.type !== 'worker' && svc.healthcheck !== undefined) {
+            const healthcheck = scalarString(svc.healthcheck);
+            if (healthcheck === null)
+                problems.push(`${where}.healthcheck must be a string`);
+            else if (!healthcheck.startsWith('/'))
+                problems.push(`${where}: healthcheck must be an absolute path (start with /)`);
+            else if (!HEALTHCHECK_RE.test(healthcheck))
+                problems.push(`${where}: healthcheck must be a single-slash absolute path on the service itself (no '//host', scheme, backslash or control characters), got: ${healthcheck}`);
+        }
         // Sizing is the platform's, capped for the org's plan. Same answers the
         // publish endpoint gives, said here so an author does not upload to find out. Read as unknown:
         // the type above admits only what is SUPPORTED, and the document is a cast over YAML.parse, so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.1.21",
+  "version": "0.1.23",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [