insta 0.1.24 → 0.1.25

package/dist/commands/deploy.js

@@ -6,7 +6,7 @@ import { info, die, printJson, handleApproval, renderNextActions, CliExit } from
 import { flyctlBuildAndPush, ensureFlyctl, defaultBuildRunner, stderrBuildRunner } from '../flyctl-build.js';
 import { packDirectory, windowsModeCaveat } from '../pack.js';
 import { deployArchive, uploadArchive } from '../deploy-archive.js';
-import { parseEndpoint, parsePort } from './services.js';
+import { isV6Endpoint, parseEndpoint, parsePort } from './services.js';
 // With --json, stdout must carry exactly one JSON document (the deploy result), so every progress
 // line moves to stderr.
 const note = (opts) => (opts.json ? (m) => void process.stderr.write(m + '\n') : info);
@@ -23,11 +23,19 @@ export function deployRequestBody(source, branch, opts) {
         replaceSource: opts.replaceSource ? true : undefined,
     };
 }
-// Where the deploy answers: the HTTPS URL, or for an endpoint tcp service its tcp address (the
-// platform reports no URL for one). Pure, so it's unit-tested.
-export function deployedTarget(r, port) {
-    if (r.endpointHost)
-        return `tcp://${r.endpointHost}:${port ?? '?'}`;
+// Where the deploy answers: the HTTPS URL, or for a v6-lane service (tcp, udp, tcp+udp) its
+// address, one scheme per protocol (the platform reports no URL for one). The scheme comes from the
+// RESULT's `endpoint` (instacloud-platform#681 reports it beside endpointHost, including on a
+// redeploy that passed none -- the endpoint the service kept); --endpoint is only the fallback for
+// an older platform that names the host but not the endpoint. With neither, the address prints
+// without a scheme rather than guessing tcp for what may be a udp service. Pure, so it's unit-tested.
+export function deployedTarget(r, port, flag) {
+    if (r.endpointHost) {
+        const endpoint = isV6Endpoint(r.endpoint) ? r.endpoint : isV6Endpoint(flag) ? flag : undefined;
+        if (endpoint === undefined)
+            return `${r.endpointHost}:${port ?? '?'} (endpoint unchanged; \`insta service list\` shows its protocol)`;
+        return (endpoint === 'tcp+udp' ? ['tcp', 'udp'] : [endpoint]).map((pr) => `${pr}://${r.endpointHost}:${port ?? '?'}`).join(', ');
+    }
     return r.url || '(no URL: a worker)';
 }
 // Ask the platform which lane serves this target, so the CLI stops knowing which provider backs
@@ -152,7 +160,7 @@ export async function deploy(dir, opts) {
     if (!dir && !opts.image)
         die('usage: insta deploy <dir> | --image <url>  [--branch <b>] [--group <g>] [--port <n>]');
     // Normalized here, once, so both lanes get the same validated value: the archive lane's body
-    // (deployArchive) otherwise silently drops anything that isn't exactly 'http'/'tcp' to
+    // (deployArchive) otherwise silently drops anything that isn't exactly one of the endpoints to
     // undefined, which let a typo like --endpoint tpc build and deploy using the service's existing
     // endpoint instead of failing locally. Checked before ApiClient.load()/requireProject(): those
     // can resolve a project and persist an automatic link for an unlinked directory, so a typo must
@@ -192,8 +200,8 @@ export async function deploy(dir, opts) {
         // nextActions, which the operation read does not carry.
         const d = source.deployed;
         if (opts.json)
-            return printJson({ image: d.image, url: d.url, ...(d.endpointHost ? { endpointHost: d.endpointHost } : {}), branch: d.branch, group: d.group, machineId: d.machineId });
-        info(`deployed ${d.image} -> ${deployedTarget(d, effOpts.port)} (branch ${d.branch}, group ${d.group})`);
+            return printJson({ image: d.image, url: d.url, ...(d.endpointHost ? { endpointHost: d.endpointHost } : {}), ...(d.endpoint ? { endpoint: d.endpoint } : {}), branch: d.branch, group: d.group, machineId: d.machineId });
+        info(`deployed ${d.image} -> ${deployedTarget(d, effOpts.port, endpoint)} (branch ${d.branch}, group ${d.group})`);
         return;
     }
     const res = await api.rawRequest('POST', `/projects/${p.projectId}/deploy`, deployRequestBody(source, branch, effOpts))
@@ -203,7 +211,7 @@ export async function deploy(dir, opts) {
     const what = source.image;
     if (opts.json)
         return printJson({ image: source.image, ...res.body });
-    info(`deployed ${what} -> ${deployedTarget(res.body, effOpts.port)} (branch ${res.body.branch}, group ${res.body.group})`);
+    info(`deployed ${what} -> ${deployedTarget(res.body, effOpts.port, endpoint)} (branch ${res.body.branch}, group ${res.body.group})`);
     renderNextActions(res.body.nextActions);
 }
 // The platform refuses an image deploy onto a repo-connected service and names the body field it

package/dist/commands/private-network.js

@@ -0,0 +1,101 @@
+// `insta compute public-access` and `insta <redis|mysql|mongodb> public-access`: show, close or
+// re-open a compute-plane service's public access (the platform's PUT .../services/:id/access).
+//
+// Every insta-compute service has a private address in its project branch: `<name>.insta.internal`
+// for compute, `<name>-<type>.insta.internal` for a managed database (the platform's private_host;
+// this file only prints what the platform reports, never composes one). Closing public access makes
+// the service private-only: its URL answers 403 (a database's public *_URL stops connecting) and
+// only services in the same branch reach it. Like `insta postgres public-access off`, closing asks
+// first, and a non-interactive caller (agent, CI, --json) must pass --yes.
+import { ApiClient, ApiError, requireProject } from '../api.js';
+import { handleApproval, info, printJson, refuse } from '../util.js';
+import { q, resolveSoleService } from './services.js';
+import { alwaysOnArgs, confirmOnTerminal } from './postgres.js';
+const isDb = (type) => type !== 'compute';
+const credential = (type) => `${type.toUpperCase()}_URL`;
+const privateCredential = (type) => `${type.toUpperCase()}_PRIVATE_URL`;
+/** `<host>:<port>` for the private address, or undefined when the platform reports none. */
+export function privateAddress(s) {
+    return s.private_host ? `${s.private_host}${s.port ? `:${s.port}` : ''}` : undefined;
+}
+// The show block. Pure, exported for tests.
+export function publicAccessLines(s) {
+    const pub = s.public;
+    const head = `${s.type} ${s.name}: public access ${pub === false ? 'off' : pub === true ? 'on' : 'unknown'}`;
+    const why = pub === false
+        ? (isDb(s.type) ? ` — ${credential(s.type)} does not connect; apps in this branch use ${privateCredential(s.type)}` : ' — its URL answers 403; only services in this branch reach it')
+        : pub === true ? (isDb(s.type) ? '' : ' — reachable from the internet at its URL') : '';
+    const lines = [head + why];
+    const addr = privateAddress(s);
+    if (addr) {
+        lines.push(`  private: ${addr}${s.type === 'compute' ? ' (TCP and UDP, from services in this branch)' : ` (from services in this branch; ${privateCredential(s.type)} holds the connection string)`}`);
+        if (s.private_fqdn)
+            lines.push(`  fqdn:    ${s.private_fqdn} (for tools that skip the search domain, e.g. nslookup, dig)`);
+    }
+    else {
+        lines.push('  private: none yet — the platform reports no private address for this service (not yet back-filled, a worker, or a region without the private network)');
+    }
+    return lines;
+}
+// Map a refusal to a CLI-shaped message. Pure, exported for tests.
+export function publicAccessErrorMessage(e, ctx) {
+    const code = e.body?.code;
+    const b = ctx.branch ? ` --branch ${ctx.branch}` : '';
+    if (code === 'private_network_disabled')
+        return `the private network is not yet available on this deployment — ${ctx.type} ${ctx.service} stays public`;
+    if (code === 'private_network_unavailable_in_region')
+        return `the region of ${ctx.type} ${ctx.service} has no private network yet — it stays public`;
+    if (code === 'no_private_name')
+        return `${ctx.type} ${ctx.service} has no private network name, so closing public access would leave it unreachable — rename it first: \`insta service rename ${ctx.type} ${ctx.service} <new-name>${b}\``;
+    if (code === 'private_name_taken')
+        return `${e.message} — rename one of the services: \`insta service rename ${ctx.type} ${ctx.service} <new-name>${b}\``;
+    return `${ctx.what} failed (${e.status}): ${e.message}`;
+}
+// What closing will break, said before asking. Pure, exported for tests.
+export function closeWarning(s) {
+    return isDb(s.type)
+        ? `closing public access: ${credential(s.type)} (the public address) stops connecting — external clients, CI and local development can no longer reach ${s.type} ${s.name}, and apps in this branch must use ${privateCredential(s.type)} (bind it and redeploy them)`
+        : `closing public access: ${s.type} ${s.name}'s URL will answer 403 and stop waking it — browsers, webhooks and every caller outside this branch lose it; services in this branch keep reaching it at its private address`;
+}
+export async function servicePublicAccess(type, first, second, opts, deps = {}) {
+    const { mode, service } = alwaysOnArgs(first, second);
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const branch = opts.branch ?? p.branch;
+    const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(branch)}`);
+    const svc = resolveSoleService(services, type, service);
+    if (!mode) {
+        if (opts.json)
+            return printJson({ name: svc.name, type: svc.type, public: svc.public ?? null, private_host: svc.private_host ?? null, private_fqdn: svc.private_fqdn ?? null, port: svc.port ?? null });
+        for (const l of publicAccessLines(svc))
+            info(l);
+        return;
+    }
+    if (mode === 'off' && !opts.yes) {
+        const tty = deps.tty ?? (!!process.stdin.isTTY && !!process.stdout.isTTY);
+        if (opts.json || !tty)
+            refuse([closeWarning(svc), `${type} ${svc.name}: re-run with --yes to confirm`]);
+        info(closeWarning(svc));
+        const ok = await (deps.confirm ?? confirmOnTerminal)(`Close public access to ${type} ${svc.name}?`);
+        if (!ok)
+            return info(`${type} ${svc.name}: public access unchanged`);
+    }
+    let res;
+    try {
+        res = await api.rawRequest('PUT', `/projects/${p.projectId}/services/${svc.id}/access`, { public: mode === 'on' });
+    }
+    catch (e) {
+        if (e instanceof ApiError)
+            throw new Error(publicAccessErrorMessage(e, { type, service: svc.name, branch: opts.branch, what: mode === 'off' ? 'closing public access' : 'opening public access' }));
+        throw e;
+    }
+    if (handleApproval(res, opts.json))
+        return;
+    if (opts.json)
+        return printJson(res.body);
+    const notice = typeof res.body?.notice === 'string' && res.body.notice ? res.body.notice : undefined;
+    info(`${type} ${svc.name}: public access ${mode === 'off' ? 'CLOSED' : 'open'}`);
+    if (notice)
+        info(`  ${notice}`);
+}
+//# sourceMappingURL=private-network.js.map

package/dist/commands/services.js

@@ -105,20 +105,32 @@ export function resolveComputeServiceId(services, name) {
 function defaultDatabasePort(type) {
     return type === 'mysql' ? 3306 : type === 'mongodb' ? 27017 : 6379;
 }
-// How a compute service is reached: http (the default HTTPS domain) or tcp (raw TCP on its port at
-// its own IPv6 address). Checked locally so a typo fails before any network call; which ports tcp
-// accepts is the platform's answer, not repeated here.
+export const ENDPOINTS = ['http', 'tcp', 'udp', 'tcp+udp'];
 export function parseEndpoint(raw) {
     const v = raw.trim().toLowerCase();
-    if (v !== 'http' && v !== 'tcp')
-        throw new Error(`--endpoint must be http or tcp, got: ${raw}`);
+    if (!ENDPOINTS.includes(v))
+        throw new Error(`--endpoint must be http, tcp, udp or tcp+udp, got: ${raw}`);
     return v;
 }
+// tcp, udp and tcp+udp are the same v6 lane with a different protocol set: no HTTP domain, and the
+// address is endpoint_host on the service port.
+export const isV6Endpoint = (e) => e === 'tcp' || e === 'udp' || e === 'tcp+udp';
 // Where a tcp service is dialed. The host is set once a deploy has confirmed it; before that the
 // row only knows its port.
 export function tcpAddress(s) {
     return s.endpoint_host ? `tcp://${s.endpoint_host}:${s.port}` : `tcp/${s.port ?? '?'} (address after the first deploy)`;
 }
+// Where a v6-lane service (tcp, udp or tcp+udp) is reached, one scheme per protocol it serves:
+// tcp://host:port, udp://host:port, or both for tcp+udp. tcp is exactly tcpAddress. Before a
+// deploy has confirmed the host, the row only knows the protocol and port.
+export function v6Address(s) {
+    if (s.endpoint === 'tcp')
+        return tcpAddress(s);
+    const protos = s.endpoint === 'tcp+udp' ? ['tcp', 'udp'] : ['udp'];
+    if (!s.endpoint_host)
+        return `${s.endpoint === 'tcp+udp' ? 'tcp+udp' : 'udp'}/${s.port ?? '?'} (address after the first deploy)`;
+    return protos.map((pr) => `${pr}://${s.endpoint_host}:${s.port}`).join(', ');
+}
 // Map service-add options to the platform POST body. Pure, so it's unit-tested without a network
 // mock (mirrors deployRequestBody in deploy.ts). Validation (which options are valid for which
 // type) stays in servicesAdd, ahead of any network/config access.
@@ -199,7 +211,7 @@ export function serviceAddedLine(type, name, branch, svc) {
     const vol = svc.volume_gib ? `  vol ${svc.volume_gib}Gi at ${svc.volume_mount_path ?? "/data"}` : '';
     // The major belongs next to the connect hint: it decides which psql/pg_dump to reach for.
     const pg = svc.type === 'postgres' ? pgBadge(svc.pg_version) : '';
-    const where = svc.endpoint === 'tcp' ? ` — ${tcpAddress(svc)}` : svc.domain ? ` — ${svc.domain}` : '';
+    const where = isV6Endpoint(svc.endpoint) ? ` — ${v6Address(svc)}` : svc.domain ? ` — ${svc.domain}` : '';
     return `added ${type} service ${name} on ${branch ?? 'default'} (${svc.id})${access}${svc.region ? `  ${svc.region}` : ''}${img}${vol}${pg}${where}`;
 }
 // `  pg <major>` for a postgres row, or '' when the platform sent nothing usable. The field arrives
@@ -218,9 +230,13 @@ export function serviceListLine(s) {
                 // Postgres major, so the reader picks matching pg_dump/psql BEFORE connecting (a newer client
                 // dumps statements an older server cannot restore). Older platforms send no pg_version.
                 : s.type === 'postgres' ? pgBadge(s.pg_version) : '';
-    // A tcp compute service has no HTTP domain; its address is the tcp one.
-    const where = s.type === 'compute' && s.endpoint === 'tcp' ? `  ${tcpAddress(s)}` : s.domain ? `  ${s.domain}` : '';
-    return `${s.type}/${s.name}  [${s.status}]${extra}${where}  ${s.id}`;
+    // A tcp/udp/tcp+udp compute service has no HTTP domain; its address is the v6-lane one.
+    const where = s.type === 'compute' && isV6Endpoint(s.endpoint) ? `  ${v6Address(s)}` : s.domain ? `  ${s.domain}` : '';
+    // The private address the platform reports (never composed here), and a closed compute service
+    // says so beside the URL it no longer serves.
+    const closed = s.type === 'compute' && s.public === false ? '  public off' : '';
+    const priv = s.private_host ? `  private ${s.private_host}${s.port ? `:${s.port}` : ''}` : '';
+    return `${s.type}/${s.name}  [${s.status}]${extra}${where}${closed}${priv}  ${s.id}`;
 }
 export async function servicesList(opts) {
     const api = await ApiClient.load();

package/dist/deploy-archive.js

@@ -1,5 +1,6 @@
 import { setTimeout as delay } from 'node:timers/promises';
 import { handleApproval } from './util.js';
+import { ENDPOINTS, isV6Endpoint } from './commands/services.js';
 export function archiveBuildSpec(hasDockerfile) {
     return hasDockerfile ? { type: 'dockerfile' } : { type: 'nixpacks' };
 }
@@ -72,7 +73,7 @@ export async function deployArchive(api, projectId, ref, branch, opts, now = Dat
         archive: ref,
         port: opts.port ? Number(opts.port) : undefined,
         websocket: typeof opts.websocket === 'boolean' ? opts.websocket : undefined,
-        endpoint: opts.endpoint === 'http' || opts.endpoint === 'tcp' ? opts.endpoint : undefined,
+        endpoint: ENDPOINTS.includes(opts.endpoint ?? '') ? opts.endpoint : undefined,
         replaceSource: opts.replaceSource === true ? true : undefined,
     });
     // An approval is a 202 too, told apart by its status word; anything else here is our operation.
@@ -122,8 +123,11 @@ export async function deployArchive(api, projectId, ref, branch, opts, now = Dat
             if (state === 'live') {
                 const image = res.body?.imageRef;
                 const url = res.body?.url;
-                // An endpoint tcp service has no URL: its answer is the tcp host instead. A worker has neither.
+                // A tcp/udp/tcp+udp (v6-lane) service has no URL: its answer is the v6 host instead. A worker has neither.
                 const endpointHost = typeof res.body?.endpointHost === 'string' && res.body.endpointHost ? res.body.endpointHost : undefined;
+                // The endpoint the service is on (instacloud-platform#681), so the address gets its scheme;
+                // an older platform omits it, and a value this CLI does not know is treated as absent.
+                const endpoint = endpointHost && isV6Endpoint(res.body?.endpoint) ? res.body.endpoint : undefined;
                 if (typeof image !== 'string' || !image || typeof url !== 'string' || (!url && opts.port !== '0' && !endpointHost)) {
                     throw new Error('the deploy finished but the platform returned no image or URL for it — check `insta status`');
                 }
@@ -135,7 +139,7 @@ export async function deployArchive(api, projectId, ref, branch, opts, now = Dat
                     return v;
                 };
                 return {
-                    image, url, ...(endpointHost ? { endpointHost } : {}),
+                    image, url, ...(endpointHost ? { endpointHost } : {}), ...(endpoint ? { endpoint } : {}),
                     branch: optionalString('branch', res.body.branch) ?? branch,
                     group: optionalString('group', res.body.group) ?? opts.group ?? '',
                     machineId: optionalString('machineId', res.body.machineId),

package/dist/index.js

@@ -28,6 +28,7 @@ import { buildLogs } from './commands/build-logs.js';
 import * as computeCmd from './commands/compute.js';
 import * as githubCmd from './commands/github.js';
 import * as pgCmd from './commands/postgres.js';
+import * as privateNet from './commands/private-network.js';
 import * as dbQueryCmd from './commands/db-query.js';
 import * as managedDb from './commands/managed-db.js';
 import * as storageCmd from './commands/storage.js';
@@ -155,7 +156,7 @@ svc.command('add [type] [name]').description('Provision a service on demand (com
     .option('--public', 'storage only: serve the bucket with anonymous public-read (default private)')
     .option('--image <url>', 'compute only: run this container image at creation')
     .option('--port <n>', 'compute only: port the image listens on (default 8080; 0 for a worker without a routed port)')
-    .option('--endpoint <http|tcp>', 'compute only: how the service is reached — http (default: HTTPS at its domain) or tcp (raw TCP on --port at its own public IPv6 address; IPv6 clients only, no platform TLS, no custom domain). tcp needs --port and refuses commonly scanned, web (80/443) and platform-reserved ports')
+    .option('--endpoint <http|tcp|udp|tcp+udp>', 'compute only: how the service is reached — http (default: HTTPS at its domain), or tcp / udp / tcp+udp (raw TCP, UDP or both on --port at its own public IPv6 address; IPv6 clients only, no platform TLS, no custom domain). tcp needs --port and refuses commonly scanned, web (80/443) and platform-reserved ports; udp refuses amplification-prone (DNS, NTP, SNMP, memcached, …) and platform-reserved ports; tcp+udp refuses both lists. A udp datagram wakes a suspended service and what the wake held is re-sent until the service first replies (an app may see it twice); a receive-only udp service (never replies) needs --always-on to stay awake')
     .option('--always-on', 'compute only: create as always-on — never scales to zero (all plans; billing is actual usage either way). A worker (--port 0) is always-on regardless')
     .option('--no-always-on', 'compute only: create as scale-to-zero — idle machines suspend and wake on the next request (the default for new compute services; refused with --port 0, a worker cannot scale to zero)')
     .option('--mount-path <path>', 'compute only: container mount path for a new volume (requires --volume; default /data)')
@@ -365,7 +366,7 @@ function addObservability(group, component, noun) {
 // optional makes commander unable to hold that boundary itself).
 const { argv: computeArgv, command: execCommand, windowsFallback: execWindowsFallback, } = computeCmd.splitExecArgs(process.argv);
 // ---- compute ----
-const compute = program.command('compute').description('Compute services: lifecycle (start/stop/suspend/restart/status), scale, limits, volume, always-on, exec, ssh, GitHub source, logs, metrics');
+const compute = program.command('compute').description('Compute services: lifecycle (start/stop/suspend/restart/status), scale, limits, volume, public access, always-on, exec, ssh, GitHub source, logs, metrics');
 compute.command('start [service]').description('Bring a compute service online (persistent — re-enables auto-wake)')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeStart(service, o)));
 compute.command('stop [service]').description('Take a compute service offline; traffic will NOT wake it until `start`')
@@ -384,6 +385,10 @@ compute.command('scale [count] [service]').description('Set a compute service sa
 compute.command('limits [service]').description("Show or set a compute service's resource ceiling (any plan within the free cap; raising above it needs a paid plan). --memory is the dial; cpu derives from it unless --cpu is given. Billing is actual usage — the ceiling caps what the app may burn, it is not a price")
     .option('--memory <size>', 'memory ceiling, e.g. 512mb or 1gb').option('--cpu <n>', 'vCPU ceiling override (provider sizes: 1, 2, 4, 6, 8)')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeLimits(service, o)));
+compute.command('public-access [mode] [service]').description("Show, close or re-open a compute service's public access (mode: on|off; no mode = print it and the service's private address). Every compute service is reachable by the other services in its project branch at <name>.insta.internal:<port> (TCP and UDP); off = private-only: its URL answers 403 and no longer wakes it, so only services in the same branch reach it. Immediate, no redeploy. Asks first; --yes when there is no terminal or with --json. insta-compute only (gated: service.setAccess)")
+    .option('-y, --yes', 'close without asking (required when there is no terminal, or with --json)')
+    .option('--json').option('--branch <branch>', 'branch (default: current)')
+    .action(guard((mode, service, o) => privateNet.servicePublicAccess('compute', mode, service, o)));
 compute.command('always-on <mode> [service]').description('Set a compute service always-on (mode: on|off). on = machines never scale to zero; off = scale-to-zero (the default for new compute services; refused on a worker, port 0). All plans; billing is actual usage either way')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((mode, service, o) => computeCmd.computeAlwaysOn(mode, service, o)));
 compute.command('ssh [service]')
@@ -463,7 +468,7 @@ pg.command('public-access [mode] [service]').description("Show, close or re-open
 addObservability(pg, 'db', 'postgres');
 // ---- redis / mysql / mongodb (managed databases) ----
 for (const type of ['redis', 'mysql', 'mongodb']) {
-    const g = program.command(type).description(`Managed ${type} services: query, status, resource ceiling, volume, always-on, logs, metrics`);
+    const g = program.command(type).description(`Managed ${type} services: query, status, resource ceiling, volume, public access, always-on, logs, metrics`);
     const query = g.command('query <service> [args...]').description(type === 'redis'
         ? 'Run a redis command against the service via the console exec API — a pre-tokenized argv, e.g. `GET mykey`'
         : `Run one quoted ${type} statement against the service via the console exec API`)
@@ -482,6 +487,10 @@ for (const type of ['redis', 'mysql', 'mongodb']) {
         .option('--size <gi>', 'new size in whole Gi, e.g. 10 (must be ≥ the current size)')
         .option('--json').option('--branch <branch>', 'branch (default: current)')
         .action(guard((service, o) => computeCmd.serviceVolume(type, service, o)));
+    g.command('public-access [mode] [service]').description(`Show, close or re-open a ${type} service's public access (mode: on|off; no mode = print it and the private address). On insta-compute every ${type} is reachable from services in its project branch at <name>-${type}.insta.internal (${type.toUpperCase()}_PRIVATE_URL); off = ${type.toUpperCase()}_URL stops connecting and only apps in the branch reach it, through ${type.toUpperCase()}_PRIVATE_URL. Asks first; --yes when there is no terminal or with --json (gated: service.setAccess)`)
+        .option('-y, --yes', 'close without asking (required when there is no terminal, or with --json)')
+        .option('--json').option('--branch <branch>', 'branch (default: current)')
+        .action(guard((mode, service, o) => privateNet.servicePublicAccess(type, mode, service, o)));
     g.command('always-on <mode> [service]').description(`Set a ${type} service always-on (mode: on|off). on = machines never scale to zero; off = scale-to-zero. Billing is actual usage either way`)
         .option('--json').option('--branch <branch>', 'branch (default: current)')
         .action(guard((mode, service, o) => computeCmd.serviceAlwaysOn(type, mode, service, o)));
@@ -526,7 +535,7 @@ buildCmd.command('logs <build-id>').description('Read source-build output for a
 program.command('deploy [dir]').description('Deploy a source directory (built remotely; on insta-compute a Dockerfile is optional and nixpacks detects the runtime) or a prebuilt --image to a branch compute group')
     .option('--image <url>', 'prebuilt container image to deploy (instead of a source dir)').option('--branch <b>').option('--group <g>').option('--port <p>', 'port the app listens on (0 for a worker without a routed port)')
     .option('--websocket', 'run a WebSocket app (larger guest + connection-based concurrency)')
-    .option('--endpoint <http|tcp>', 'switch how the service is reached from this deploy on: tcp (raw TCP on --port at its own public IPv6 address; IPv6 clients only) or http (back to its HTTPS domain). Omitted: keep the current endpoint')
+    .option('--endpoint <http|tcp|udp|tcp+udp>', 'switch how the service is reached from this deploy on: tcp / udp / tcp+udp (raw TCP, UDP or both on --port at its own public IPv6 address; IPv6 clients only) or http (back to its HTTPS domain). Omitted: keep the current endpoint')
     .option('--replace-source', 'the service deploys from a connected GitHub repo: switch it to this image and remove the repo connection (admin); without it such a deploy is refused')
     .option('--json', 'print the deploy result as JSON (build progress goes to stderr)')
     .action(guard((dir, o) => deploy(dir, o)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.1.24",
+  "version": "0.1.25",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [