insta 0.1.24 → 0.1.26

package/README.md

@@ -229,7 +229,7 @@ build never reaches a production installer.
 | `insta branch` | `create` · `list` · `switch` · `delete` · `merge` |
 | `insta service` (`services`, `svc`) | `add` · `list` · `remove` · `rename` |
 | `insta secrets` | Write `.env`, plus `list` · `set` · `unset` · `bind` · `unbind` · `bindings` · `sources` · `tree` |
-| `insta domain` | Bought or bring-your-own: `attach` · `check` · `detach`; buy through InstaCloud: `search` · `buy` · `list` · `status` · `records …` |
+| `insta domain` | Bought or bring-your-own: `attach` · `check` · `detach`. Domains already bought through InstaCloud: `list` · `status` · `records …` |
 | `insta compute` | `start` · `stop` · `suspend` · `restart` · `status` · `scale` · `limits` · `volume` · `always-on` · `exec` · `ssh` · `repo` · `connect-repo` · `watch-paths` · `disconnect-repo` · `logs` · `metrics` |
 | `insta postgres` | `url` (print the DSN) · `connect` (psql) · `stats` · `limits` · `restart` · `volume` · `always-on` · `private-access` · `public-access` · `logs` · `metrics` — every verb takes `[service]` |
 | `insta redis` · `mysql` · `mongodb` | `query` · `status` · `limits` · `volume` · `always-on` · `logs` · `metrics` |

package/dist/commands/cron.js

@@ -165,11 +165,11 @@ export function jobShowLines(j, serviceName) {
     // decrypts it. Saying so beats an empty "value" column that reads as "this header is set to
     // nothing". Secret-backed headers get a row each, because the secret NAME is readable and is the
     // thing an operator needs when a rotation or a missing secret is the question.
-    const refs = Object.entries(refsOf(j.request));
-    const literal = j.request.headerNames.filter((n) => findHeader(refsOf(j.request), n) === undefined);
+    const refs = refsOf(j.request);
+    const literal = j.request.headerNames.filter((n) => findHeader(refs, n) === undefined);
     const rows = [
         ...(literal.length ? [`${literal.join(', ')}  (names only — values are encrypted at rest and never returned)`] : []),
-        ...refs.map(([h, s]) => `${h} ← secret ${s}  (resolved at send time)`),
+        ...Object.entries(refs).map(([h, s]) => `${h} ← secret ${s}  (resolved at send time)`),
     ];
     if (!rows.length)
         lines.push('  headers      (none)');

package/dist/commands/deploy.js

@@ -6,7 +6,7 @@ import { info, die, printJson, handleApproval, renderNextActions, CliExit } from
 import { flyctlBuildAndPush, ensureFlyctl, defaultBuildRunner, stderrBuildRunner } from '../flyctl-build.js';
 import { packDirectory, windowsModeCaveat } from '../pack.js';
 import { deployArchive, uploadArchive } from '../deploy-archive.js';
-import { parseEndpoint, parsePort } from './services.js';
+import { isV6Endpoint, parseEndpoint, parsePort } from './services.js';
 // With --json, stdout must carry exactly one JSON document (the deploy result), so every progress
 // line moves to stderr.
 const note = (opts) => (opts.json ? (m) => void process.stderr.write(m + '\n') : info);
@@ -23,11 +23,19 @@ export function deployRequestBody(source, branch, opts) {
         replaceSource: opts.replaceSource ? true : undefined,
     };
 }
-// Where the deploy answers: the HTTPS URL, or for an endpoint tcp service its tcp address (the
-// platform reports no URL for one). Pure, so it's unit-tested.
-export function deployedTarget(r, port) {
-    if (r.endpointHost)
-        return `tcp://${r.endpointHost}:${port ?? '?'}`;
+// Where the deploy answers: the HTTPS URL, or for a v6-lane service (tcp, udp, tcp+udp) its
+// address, one scheme per protocol (the platform reports no URL for one). The scheme comes from the
+// RESULT's `endpoint` (instacloud-platform#681 reports it beside endpointHost, including on a
+// redeploy that passed none -- the endpoint the service kept); --endpoint is only the fallback for
+// an older platform that names the host but not the endpoint. With neither, the address prints
+// without a scheme rather than guessing tcp for what may be a udp service. Pure, so it's unit-tested.
+export function deployedTarget(r, port, flag) {
+    if (r.endpointHost) {
+        const endpoint = isV6Endpoint(r.endpoint) ? r.endpoint : isV6Endpoint(flag) ? flag : undefined;
+        if (endpoint === undefined)
+            return `${r.endpointHost}:${port ?? '?'} (endpoint unchanged; \`insta service list\` shows its protocol)`;
+        return (endpoint === 'tcp+udp' ? ['tcp', 'udp'] : [endpoint]).map((pr) => `${pr}://${r.endpointHost}:${port ?? '?'}`).join(', ');
+    }
     return r.url || '(no URL: a worker)';
 }
 // Ask the platform which lane serves this target, so the CLI stops knowing which provider backs
@@ -152,7 +160,7 @@ export async function deploy(dir, opts) {
     if (!dir && !opts.image)
         die('usage: insta deploy <dir> | --image <url>  [--branch <b>] [--group <g>] [--port <n>]');
     // Normalized here, once, so both lanes get the same validated value: the archive lane's body
-    // (deployArchive) otherwise silently drops anything that isn't exactly 'http'/'tcp' to
+    // (deployArchive) otherwise silently drops anything that isn't exactly one of the endpoints to
     // undefined, which let a typo like --endpoint tpc build and deploy using the service's existing
     // endpoint instead of failing locally. Checked before ApiClient.load()/requireProject(): those
     // can resolve a project and persist an automatic link for an unlinked directory, so a typo must
@@ -192,8 +200,8 @@ export async function deploy(dir, opts) {
         // nextActions, which the operation read does not carry.
         const d = source.deployed;
         if (opts.json)
-            return printJson({ image: d.image, url: d.url, ...(d.endpointHost ? { endpointHost: d.endpointHost } : {}), branch: d.branch, group: d.group, machineId: d.machineId });
-        info(`deployed ${d.image} -> ${deployedTarget(d, effOpts.port)} (branch ${d.branch}, group ${d.group})`);
+            return printJson({ image: d.image, url: d.url, ...(d.endpointHost ? { endpointHost: d.endpointHost } : {}), ...(d.endpoint ? { endpoint: d.endpoint } : {}), branch: d.branch, group: d.group, machineId: d.machineId });
+        info(`deployed ${d.image} -> ${deployedTarget(d, effOpts.port, endpoint)} (branch ${d.branch}, group ${d.group})`);
         return;
     }
     const res = await api.rawRequest('POST', `/projects/${p.projectId}/deploy`, deployRequestBody(source, branch, effOpts))
@@ -203,7 +211,7 @@ export async function deploy(dir, opts) {
     const what = source.image;
     if (opts.json)
         return printJson({ image: source.image, ...res.body });
-    info(`deployed ${what} -> ${deployedTarget(res.body, effOpts.port)} (branch ${res.body.branch}, group ${res.body.group})`);
+    info(`deployed ${what} -> ${deployedTarget(res.body, effOpts.port, endpoint)} (branch ${res.body.branch}, group ${res.body.group})`);
     renderNextActions(res.body.nextActions);
 }
 // The platform refuses an image deploy onto a repo-connected service and names the body field it

package/dist/commands/domain.js

@@ -30,9 +30,6 @@ export async function domainSearch(keyword, opts, deps) {
         return printJson(r);
     for (const line of searchLines(r.results))
         info(line);
-    const buyable = r.results.find((x) => x.purchasable);
-    if (buyable)
-        info(`buy one: insta domain buy ${buyable.domainName}`);
 }
 export async function domainBuy(name, opts, deps) {
     const years = whole('--years', opts.years);
@@ -117,10 +114,10 @@ function domainLines(d, linked = true) {
         out.push(`  ${h.hostname.padEnd(w)}  ${h.state}${h.service ? ` → ${h.service}` : ''}${h.reason ? ` — ${h.reason}` : ''}`);
     return out;
 }
-function orderStatusLines(o, linked = true) {
+function orderStatusLines(o) {
     const out = [`order ${o.id}: ${o.domainName} — ${o.status}${o.failedReason ? ` — ${o.failedReason}` : ''}`];
-    if (linked && o.status === 'canceled')
-        out.push(`  the checkout closed without payment — order again: insta domain buy ${o.domainName}`);
+    if (o.status === 'canceled')
+        out.push('  the checkout closed without payment');
     return out;
 }
 export async function domainList(opts, deps) {
@@ -129,7 +126,7 @@ export async function domainList(opts, deps) {
     if (opts.json)
         return printJson(r);
     if (!r.items.length)
-        return info('no domains bought through InstaCloud in this org (search: insta domain search <keyword>)');
+        return info('no domains bought through InstaCloud in this org');
     for (const d of r.items)
         for (const line of domainLines(d, !opts.org))
             info(line);
@@ -147,7 +144,7 @@ export async function domainStatus(name, opts, deps) {
         die(`${host} was not bought through this org`);
     if (opts.json)
         return printJson({ domain, order });
-    for (const line of domain ? domainLines(domain, !opts.org) : orderStatusLines(order, !opts.org))
+    for (const line of domain ? domainLines(domain, !opts.org) : orderStatusLines(order))
         info(line);
 }
 // ---- nameservers and transferring out ----
@@ -369,10 +366,9 @@ export function zoneRecordLines(records) {
  * into the zone itself — apexes included — instead of printing them for hand-copying. The zone is
  * SEEDED by the provider's record scan, which is a heuristic: the review-then-switch contract
  * (printed, and enforced by nothing else) is to compare `zone records` against the domain's current
- * DNS and add what is missing at the CURRENT provider — re-running delegate re-imports — before
- * re-pointing. A domain carrying live MX records is refused outright: a DNS move that can drop
- * mail is never done implicitly. 202 approval_required in agent mode (zone.delegate); org admin
- * either way.
+ * DNS before re-pointing. A domain carrying live MX records is refused outright: a DNS move that
+ * can drop mail is never done implicitly. 202 approval_required in agent mode (zone.delegate); org
+ * admin either way.
  */
 const orgArgOf = (opts) => (opts.org ? ` --org ${opts.org}` : '');
 export async function zoneDelegate(domainName, opts, deps) {
@@ -391,7 +387,7 @@ export async function zoneDelegate(domainName, opts, deps) {
     const z = res.body;
     for (const line of zoneLines(z, opts.org))
         info(line);
-    info(`the zone was seeded by a provider scan — a heuristic. Check \`insta domain zone records ${z.domainName}${orgArgOf(opts)}\` against your current DNS, add anything missing at your CURRENT provider (re-running delegate re-imports), and only then switch the nameservers.`);
+    info(`the zone was seeded by a provider scan, which can miss records. Check \`insta domain zone records ${z.domainName}${orgArgOf(opts)}\` against your current DNS, and only then switch the nameservers.`);
 }
 export async function zoneList(opts, deps) {
     const { api, orgId } = await orgDeps(opts, deps);
@@ -412,7 +408,7 @@ export async function zoneList(opts, deps) {
     if (opts.json)
         return printJson(r);
     if (!r.items.length)
-        return info('no delegated zones — start one: insta domain zone delegate <domain>');
+        return info('no delegated zones');
     for (const z of r.items)
         for (const line of zoneLines(z, opts.org))
             info(line);
@@ -425,7 +421,7 @@ export async function zoneRecords(domainName, opts, deps) {
     for (const line of zoneRecordLines(r.items))
         info(line);
     if (r.items.length)
-        info(`every type shows here (the scan is a heuristic) — add anything missing at your current DNS provider and re-run \`insta domain zone delegate ${domainName.trim().toLowerCase()}${orgArgOf(opts)}\` to re-import before switching nameservers`);
+        info('every type shows here. The provider scan can miss records, so compare them against your current DNS before switching nameservers');
 }
 /**
  * Release a delegated zone: the platform prunes the records it published and deletes the managed

package/dist/commands/private-network.js

@@ -0,0 +1,101 @@
+// `insta compute public-access` and `insta <redis|mysql|mongodb> public-access`: show, close or
+// re-open a compute-plane service's public access (the platform's PUT .../services/:id/access).
+//
+// Every insta-compute service has a private address in its project branch: `<name>.insta.internal`
+// for compute, `<name>-<type>.insta.internal` for a managed database (the platform's private_host;
+// this file only prints what the platform reports, never composes one). Closing public access makes
+// the service private-only: its URL answers 403 (a database's public *_URL stops connecting) and
+// only services in the same branch reach it. Like `insta postgres public-access off`, closing asks
+// first, and a non-interactive caller (agent, CI, --json) must pass --yes.
+import { ApiClient, ApiError, requireProject } from '../api.js';
+import { handleApproval, info, printJson, refuse } from '../util.js';
+import { q, resolveSoleService } from './services.js';
+import { alwaysOnArgs, confirmOnTerminal } from './postgres.js';
+const isDb = (type) => type !== 'compute';
+const credential = (type) => `${type.toUpperCase()}_URL`;
+const privateCredential = (type) => `${type.toUpperCase()}_PRIVATE_URL`;
+/** `<host>:<port>` for the private address, or undefined when the platform reports none. */
+export function privateAddress(s) {
+    return s.private_host ? `${s.private_host}${s.port ? `:${s.port}` : ''}` : undefined;
+}
+// The show block. Pure, exported for tests.
+export function publicAccessLines(s) {
+    const pub = s.public;
+    const head = `${s.type} ${s.name}: public access ${pub === false ? 'off' : pub === true ? 'on' : 'unknown'}`;
+    const why = pub === false
+        ? (isDb(s.type) ? ` — ${credential(s.type)} does not connect; apps in this branch use ${privateCredential(s.type)}` : ' — its URL answers 403; only services in this branch reach it')
+        : pub === true ? (isDb(s.type) ? '' : ' — reachable from the internet at its URL') : '';
+    const lines = [head + why];
+    const addr = privateAddress(s);
+    if (addr) {
+        lines.push(`  private: ${addr}${s.type === 'compute' ? ' (TCP and UDP, from services in this branch)' : ` (from services in this branch; ${privateCredential(s.type)} holds the connection string)`}`);
+        if (s.private_fqdn)
+            lines.push(`  fqdn:    ${s.private_fqdn} (for tools that skip the search domain, e.g. nslookup, dig)`);
+    }
+    else {
+        lines.push('  private: none yet — the platform reports no private address for this service (not yet back-filled, a worker, or a region without the private network)');
+    }
+    return lines;
+}
+// Map a refusal to a CLI-shaped message. Pure, exported for tests.
+export function publicAccessErrorMessage(e, ctx) {
+    const code = e.body?.code;
+    const b = ctx.branch ? ` --branch ${ctx.branch}` : '';
+    if (code === 'private_network_disabled')
+        return `the private network is not yet available on this deployment — ${ctx.type} ${ctx.service} stays public`;
+    if (code === 'private_network_unavailable_in_region')
+        return `the region of ${ctx.type} ${ctx.service} has no private network yet — it stays public`;
+    if (code === 'no_private_name')
+        return `${ctx.type} ${ctx.service} has no private network name, so closing public access would leave it unreachable — rename it first: \`insta service rename ${ctx.type} ${ctx.service} <new-name>${b}\``;
+    if (code === 'private_name_taken')
+        return `${e.message} — rename one of the services: \`insta service rename ${ctx.type} ${ctx.service} <new-name>${b}\``;
+    return `${ctx.what} failed (${e.status}): ${e.message}`;
+}
+// What closing will break, said before asking. Pure, exported for tests.
+export function closeWarning(s) {
+    return isDb(s.type)
+        ? `closing public access: ${credential(s.type)} (the public address) stops connecting — external clients, CI and local development can no longer reach ${s.type} ${s.name}, and apps in this branch must use ${privateCredential(s.type)} (bind it and redeploy them)`
+        : `closing public access: ${s.type} ${s.name}'s URL will answer 403 and stop waking it — browsers, webhooks and every caller outside this branch lose it; services in this branch keep reaching it at its private address`;
+}
+export async function servicePublicAccess(type, first, second, opts, deps = {}) {
+    const { mode, service } = alwaysOnArgs(first, second);
+    const api = await ApiClient.load();
+    const p = await requireProject();
+    const branch = opts.branch ?? p.branch;
+    const { services } = await api.request('GET', `/projects/${p.projectId}/services${q(branch)}`);
+    const svc = resolveSoleService(services, type, service);
+    if (!mode) {
+        if (opts.json)
+            return printJson({ name: svc.name, type: svc.type, public: svc.public ?? null, private_host: svc.private_host ?? null, private_fqdn: svc.private_fqdn ?? null, port: svc.port ?? null });
+        for (const l of publicAccessLines(svc))
+            info(l);
+        return;
+    }
+    if (mode === 'off' && !opts.yes) {
+        const tty = deps.tty ?? (!!process.stdin.isTTY && !!process.stdout.isTTY);
+        if (opts.json || !tty)
+            refuse([closeWarning(svc), `${type} ${svc.name}: re-run with --yes to confirm`]);
+        info(closeWarning(svc));
+        const ok = await (deps.confirm ?? confirmOnTerminal)(`Close public access to ${type} ${svc.name}?`);
+        if (!ok)
+            return info(`${type} ${svc.name}: public access unchanged`);
+    }
+    let res;
+    try {
+        res = await api.rawRequest('PUT', `/projects/${p.projectId}/services/${svc.id}/access`, { public: mode === 'on' });
+    }
+    catch (e) {
+        if (e instanceof ApiError)
+            throw new Error(publicAccessErrorMessage(e, { type, service: svc.name, branch: opts.branch, what: mode === 'off' ? 'closing public access' : 'opening public access' }));
+        throw e;
+    }
+    if (handleApproval(res, opts.json))
+        return;
+    if (opts.json)
+        return printJson(res.body);
+    const notice = typeof res.body?.notice === 'string' && res.body.notice ? res.body.notice : undefined;
+    info(`${type} ${svc.name}: public access ${mode === 'off' ? 'CLOSED' : 'open'}`);
+    if (notice)
+        info(`  ${notice}`);
+}
+//# sourceMappingURL=private-network.js.map

package/dist/commands/services.js

@@ -105,20 +105,32 @@ export function resolveComputeServiceId(services, name) {
 function defaultDatabasePort(type) {
     return type === 'mysql' ? 3306 : type === 'mongodb' ? 27017 : 6379;
 }
-// How a compute service is reached: http (the default HTTPS domain) or tcp (raw TCP on its port at
-// its own IPv6 address). Checked locally so a typo fails before any network call; which ports tcp
-// accepts is the platform's answer, not repeated here.
+export const ENDPOINTS = ['http', 'tcp', 'udp', 'tcp+udp'];
 export function parseEndpoint(raw) {
     const v = raw.trim().toLowerCase();
-    if (v !== 'http' && v !== 'tcp')
-        throw new Error(`--endpoint must be http or tcp, got: ${raw}`);
+    if (!ENDPOINTS.includes(v))
+        throw new Error(`--endpoint must be http, tcp, udp or tcp+udp, got: ${raw}`);
     return v;
 }
+// tcp, udp and tcp+udp are the same v6 lane with a different protocol set: no HTTP domain, and the
+// address is endpoint_host on the service port.
+export const isV6Endpoint = (e) => e === 'tcp' || e === 'udp' || e === 'tcp+udp';
 // Where a tcp service is dialed. The host is set once a deploy has confirmed it; before that the
 // row only knows its port.
 export function tcpAddress(s) {
     return s.endpoint_host ? `tcp://${s.endpoint_host}:${s.port}` : `tcp/${s.port ?? '?'} (address after the first deploy)`;
 }
+// Where a v6-lane service (tcp, udp or tcp+udp) is reached, one scheme per protocol it serves:
+// tcp://host:port, udp://host:port, or both for tcp+udp. tcp is exactly tcpAddress. Before a
+// deploy has confirmed the host, the row only knows the protocol and port.
+export function v6Address(s) {
+    if (s.endpoint === 'tcp')
+        return tcpAddress(s);
+    const protos = s.endpoint === 'tcp+udp' ? ['tcp', 'udp'] : ['udp'];
+    if (!s.endpoint_host)
+        return `${s.endpoint === 'tcp+udp' ? 'tcp+udp' : 'udp'}/${s.port ?? '?'} (address after the first deploy)`;
+    return protos.map((pr) => `${pr}://${s.endpoint_host}:${s.port}`).join(', ');
+}
 // Map service-add options to the platform POST body. Pure, so it's unit-tested without a network
 // mock (mirrors deployRequestBody in deploy.ts). Validation (which options are valid for which
 // type) stays in servicesAdd, ahead of any network/config access.
@@ -199,7 +211,7 @@ export function serviceAddedLine(type, name, branch, svc) {
     const vol = svc.volume_gib ? `  vol ${svc.volume_gib}Gi at ${svc.volume_mount_path ?? "/data"}` : '';
     // The major belongs next to the connect hint: it decides which psql/pg_dump to reach for.
     const pg = svc.type === 'postgres' ? pgBadge(svc.pg_version) : '';
-    const where = svc.endpoint === 'tcp' ? ` — ${tcpAddress(svc)}` : svc.domain ? ` — ${svc.domain}` : '';
+    const where = isV6Endpoint(svc.endpoint) ? ` — ${v6Address(svc)}` : svc.domain ? ` — ${svc.domain}` : '';
     return `added ${type} service ${name} on ${branch ?? 'default'} (${svc.id})${access}${svc.region ? `  ${svc.region}` : ''}${img}${vol}${pg}${where}`;
 }
 // `  pg <major>` for a postgres row, or '' when the platform sent nothing usable. The field arrives
@@ -218,9 +230,13 @@ export function serviceListLine(s) {
                 // Postgres major, so the reader picks matching pg_dump/psql BEFORE connecting (a newer client
                 // dumps statements an older server cannot restore). Older platforms send no pg_version.
                 : s.type === 'postgres' ? pgBadge(s.pg_version) : '';
-    // A tcp compute service has no HTTP domain; its address is the tcp one.
-    const where = s.type === 'compute' && s.endpoint === 'tcp' ? `  ${tcpAddress(s)}` : s.domain ? `  ${s.domain}` : '';
-    return `${s.type}/${s.name}  [${s.status}]${extra}${where}  ${s.id}`;
+    // A tcp/udp/tcp+udp compute service has no HTTP domain; its address is the v6-lane one.
+    const where = s.type === 'compute' && isV6Endpoint(s.endpoint) ? `  ${v6Address(s)}` : s.domain ? `  ${s.domain}` : '';
+    // The private address the platform reports (never composed here), and a closed compute service
+    // says so beside the URL it no longer serves.
+    const closed = s.type === 'compute' && s.public === false ? '  public off' : '';
+    const priv = s.private_host ? `  private ${s.private_host}${s.port ? `:${s.port}` : ''}` : '';
+    return `${s.type}/${s.name}  [${s.status}]${extra}${where}${closed}${priv}  ${s.id}`;
 }
 export async function servicesList(opts) {
     const api = await ApiClient.load();

package/dist/commands/template.js

@@ -344,6 +344,9 @@ async function promptVariable(v) {
         throw new CliCancel();
     return answer.trim();
 }
+// The poll route is keyed by deployment id, not project: name the project so agent mode signs
+// with the project-bound session (a bootstrap session is rejected as "for a different project").
+const readDeployment = (api, projectId) => (id) => api.request('GET', `/template-deployments/${id}`, undefined, { projectId });
 export async function templateDeploy(target, opts = {}, deps = {}) {
     const given = parseSetFlags(opts.set ?? []); // a typo'd --set fails before any network access
     // --json asked for parseable output: every human progress line is suppressed so stdout carries
@@ -424,9 +427,7 @@ export async function templateDeploy(target, opts = {}, deps = {}) {
         for (const line of publicBucketLines(services))
             info(line);
     }
-    // The poll route is keyed by deployment id, not project: name the project so agent mode signs
-    // with the project-bound session (a bootstrap session is rejected as "for a different project").
-    const dep = await watchDeployment((id) => api.request('GET', `/template-deployments/${id}`, undefined, { projectId: p.projectId }), deploymentId, quiet ? () => { } : info, deps.wait);
+    const dep = await watchDeployment(readDeployment(api, p.projectId), deploymentId, quiet ? () => { } : info, deps.wait);
     if (opts.json)
         return printJson(source ? { source, ...dep } : dep);
     info(`template ${codeLabel} deployed to branch ${branchName}`);
@@ -526,10 +527,10 @@ export async function templateUpgrade(service, opts = {}, deps = {}) {
     const branchName = opts.branch ?? p.branch;
     const ask = deps.ask ?? promptVariable;
     const target = await deploymentOfService(api, p.projectId, branchName, service, 'upgrade');
-    // The poll and preview routes are keyed by deployment id, not project: name the project so agent
-    // mode signs with the project-bound session, exactly as templateDeploy does.
-    // The preview is a GET and raises coded 409s of its own (template_superseded among them), so it
-    // gets the same reading as the POST rather than the raw "<sentence> (HTTP 409)" the guard prints.
+    // The preview route is keyed by deployment id, not project, so it names the project as
+    // readDeployment does. It is a GET and raises coded 409s of its own (template_superseded among
+    // them), so it gets the same reading as the POST rather than the raw "<sentence> (HTTP 409)" the
+    // guard prints.
     let plan;
     try {
         ;
@@ -576,7 +577,7 @@ export async function templateUpgrade(service, opts = {}, deps = {}) {
     const deploymentId = res.body.deploymentId ?? (res.body.deployment ?? res.body).id;
     if (!quiet)
         info(`upgrading ${service} to ${plan.to_version} (${deploymentId})`);
-    const dep = await watchDeployment((id) => api.request('GET', `/template-deployments/${id}`, undefined, { projectId: p.projectId }), deploymentId, quiet ? () => { } : info, deps.wait);
+    const dep = await watchDeployment(readDeployment(api, p.projectId), deploymentId, quiet ? () => { } : info, deps.wait);
     if (quiet)
         return printJson(dep);
     info(`${service} is on ${plan.to_version}`);
@@ -635,7 +636,7 @@ export async function templateRollback(service, opts = {}, deps = {}) {
         return;
     const deploymentId = res.body.deploymentId ?? (res.body.deployment ?? res.body).id;
     out(`rolling ${service} back (${deploymentId})`);
-    const dep = await watchDeployment((id) => api.request('GET', `/template-deployments/${id}`, undefined, { projectId: p.projectId }), deploymentId, out, deps.wait);
+    const dep = await watchDeployment(readDeployment(api, p.projectId), deploymentId, out, deps.wait);
     if (quiet)
         return printJson(dep);
     info(`${service} is back on ${(dep.deployment ?? dep).template_version ?? 'its previous version'}`);

package/dist/deploy-archive.js

@@ -1,5 +1,6 @@
 import { setTimeout as delay } from 'node:timers/promises';
 import { handleApproval } from './util.js';
+import { ENDPOINTS, isV6Endpoint } from './commands/services.js';
 export function archiveBuildSpec(hasDockerfile) {
     return hasDockerfile ? { type: 'dockerfile' } : { type: 'nixpacks' };
 }
@@ -72,7 +73,7 @@ export async function deployArchive(api, projectId, ref, branch, opts, now = Dat
         archive: ref,
         port: opts.port ? Number(opts.port) : undefined,
         websocket: typeof opts.websocket === 'boolean' ? opts.websocket : undefined,
-        endpoint: opts.endpoint === 'http' || opts.endpoint === 'tcp' ? opts.endpoint : undefined,
+        endpoint: ENDPOINTS.includes(opts.endpoint ?? '') ? opts.endpoint : undefined,
         replaceSource: opts.replaceSource === true ? true : undefined,
     });
     // An approval is a 202 too, told apart by its status word; anything else here is our operation.
@@ -122,8 +123,11 @@ export async function deployArchive(api, projectId, ref, branch, opts, now = Dat
             if (state === 'live') {
                 const image = res.body?.imageRef;
                 const url = res.body?.url;
-                // An endpoint tcp service has no URL: its answer is the tcp host instead. A worker has neither.
+                // A tcp/udp/tcp+udp (v6-lane) service has no URL: its answer is the v6 host instead. A worker has neither.
                 const endpointHost = typeof res.body?.endpointHost === 'string' && res.body.endpointHost ? res.body.endpointHost : undefined;
+                // The endpoint the service is on (instacloud-platform#681), so the address gets its scheme;
+                // an older platform omits it, and a value this CLI does not know is treated as absent.
+                const endpoint = endpointHost && isV6Endpoint(res.body?.endpoint) ? res.body.endpoint : undefined;
                 if (typeof image !== 'string' || !image || typeof url !== 'string' || (!url && opts.port !== '0' && !endpointHost)) {
                     throw new Error('the deploy finished but the platform returned no image or URL for it — check `insta status`');
                 }
@@ -135,7 +139,7 @@ export async function deployArchive(api, projectId, ref, branch, opts, now = Dat
                     return v;
                 };
                 return {
-                    image, url, ...(endpointHost ? { endpointHost } : {}),
+                    image, url, ...(endpointHost ? { endpointHost } : {}), ...(endpoint ? { endpoint } : {}),
                     branch: optionalString('branch', res.body.branch) ?? branch,
                     group: optionalString('group', res.body.group) ?? opts.group ?? '',
                     machineId: optionalString('machineId', res.body.machineId),

package/dist/index.js

@@ -28,6 +28,7 @@ import { buildLogs } from './commands/build-logs.js';
 import * as computeCmd from './commands/compute.js';
 import * as githubCmd from './commands/github.js';
 import * as pgCmd from './commands/postgres.js';
+import * as privateNet from './commands/private-network.js';
 import * as dbQueryCmd from './commands/db-query.js';
 import * as managedDb from './commands/managed-db.js';
 import * as storageCmd from './commands/storage.js';
@@ -155,7 +156,7 @@ svc.command('add [type] [name]').description('Provision a service on demand (com
     .option('--public', 'storage only: serve the bucket with anonymous public-read (default private)')
     .option('--image <url>', 'compute only: run this container image at creation')
     .option('--port <n>', 'compute only: port the image listens on (default 8080; 0 for a worker without a routed port)')
-    .option('--endpoint <http|tcp>', 'compute only: how the service is reached — http (default: HTTPS at its domain) or tcp (raw TCP on --port at its own public IPv6 address; IPv6 clients only, no platform TLS, no custom domain). tcp needs --port and refuses commonly scanned, web (80/443) and platform-reserved ports')
+    .option('--endpoint <http|tcp|udp|tcp+udp>', 'compute only: how the service is reached — http (default: HTTPS at its domain), or tcp / udp / tcp+udp (raw TCP, UDP or both on --port at its own public IPv6 address; IPv6 clients only, no platform TLS, no custom domain). tcp needs --port and refuses commonly scanned, web (80/443) and platform-reserved ports; udp refuses amplification-prone (DNS, NTP, SNMP, memcached, …) and platform-reserved ports; tcp+udp refuses both lists. A udp datagram wakes a suspended service and what the wake held is re-sent until the service first replies (an app may see it twice); a receive-only udp service (never replies) needs --always-on to stay awake')
     .option('--always-on', 'compute only: create as always-on — never scales to zero (all plans; billing is actual usage either way). A worker (--port 0) is always-on regardless')
     .option('--no-always-on', 'compute only: create as scale-to-zero — idle machines suspend and wake on the next request (the default for new compute services; refused with --port 0, a worker cannot scale to zero)')
     .option('--mount-path <path>', 'compute only: container mount path for a new volume (requires --volume; default /data)')
@@ -272,11 +273,12 @@ cron.command('runs <name>').description('Run history, most recent first: status,
 cron.command('preview <expression>').description('Validate an expression and print its next five UTC fire times — answered by the same parser the scheduler uses. Exits 1 when the expression is invalid')
     .option('--json').action(guard((expression, o) => cronCmd.cronPreview(expression, o)));
 // ---- domain (bought here, or bring your own; hostnames on compute services; DNS of bought zones) ----
-const dom = program.command('domain').description('Domains: buy through InstaCloud or bring your own — attach / check / detach hostnames on compute services; DNS records of bought domains');
-dom.command('search <keyword>').description('Search purchasable names with prices (a label like "myapp" or a full name like "myapp.com")')
+const dom = program.command('domain').description('Domains: attach, check and detach hostnames on compute services, and manage domains already bought through InstaCloud');
+// search, buy and zone delegate are hidden while the platform pauses new orders and BYO delegation.
+dom.command('search <keyword>', { hidden: true }).description('Search purchasable names with prices (a label like "myapp" or a full name like "myapp.com")')
     .option('--tlds <list>', 'comma-separated TLDs to include').option('--org <id>', "target org (default: linked project's org)").option('--json')
     .action(guard((keyword, o) => domainCmd.domainSearch(keyword, o)));
-dom.command('buy <name>').description('Buy a domain — pay at the printed Stripe Checkout link. It serves nothing until you attach it (gated: domain.purchase)')
+dom.command('buy <name>', { hidden: true }).description('Buy a domain — pay at the printed Stripe Checkout link. It serves nothing until you attach it (gated: domain.purchase)')
     .option('--years <n>', 'registration term in years (default 1)')
     .option('--no-open', 'print the checkout URL instead of opening a browser').option('--json')
     .action(guard((name, o) => domainCmd.domainBuy(name, o)));
@@ -308,14 +310,14 @@ ns.command('set <domain> <nameservers...>').description("Delegate the zone to na
 ns.command('reset <domain>').description("Put the zone back on the registrar's own nameservers — from your own delegation or from an InstaCloud-managed zone alike; a hostname `set` took down is re-attached with `insta domain attach`, one a managed zone was serving re-verifies on its own")
     .option('--org <id>', "target org (default: linked project's org)").option('--json')
     .action(guard((domain, o) => domainCmd.domainNameserversReset(domain, o)));
-const zone = dom.command('zone').description("Bring-your-own domains served from an InstaCloud-managed zone (nameserver delegation): point the domain's registrar at the pair `zone delegate` answers, and every attach's records — apexes included — are published for you. The alternative stays available: `insta domain attach` alone prints records to paste into your own zone");
-zone.command('delegate <domain>').description("Delegate a domain you own elsewhere: builds its managed zone (seeded by a provider record scan — a HEURISTIC, so review `zone records` and add anything missing at your current provider BEFORE switching nameservers; re-running delegate re-imports) and answers the two nameservers to set at your registrar. A domain carrying live MX records is refused — move mail first or keep the records path (org admin; gated: zone.delegate — agent mode gates from a linked project, an unlinked --org call falls under org administration instead)")
+const zone = dom.command('zone').description("Bring-your-own domains already delegated to an InstaCloud-managed zone: list them, review their records, or release them. For a hostname under a domain you own elsewhere, `insta domain attach` prints the records to add in your own DNS");
+zone.command('delegate <domain>', { hidden: true }).description("Delegate a domain you own elsewhere: builds its managed zone (seeded by a provider record scan — a HEURISTIC, so review `zone records` against your current DNS BEFORE switching nameservers) and answers the two nameservers to set at your registrar. A domain carrying live MX records is refused — move mail first or keep the records path (org admin; gated: zone.delegate — agent mode gates from a linked project, an unlinked --org call falls under org administration instead)")
     .option('--org <id>', "target org (default: linked project's org)").option('--json')
     .action(guard((domain, o) => domainCmd.zoneDelegate(domain, o)));
 zone.command('list').description("The org's delegated zones: which are still waiting for the nameserver switch and which are serving")
     .option('--org <id>', "target org (default: linked project's org)").option('--json')
     .action(guard((o) => domainCmd.zoneList(o)));
-zone.command('records <domain>').description("Every record in the delegated zone — the pre-switch review. The scan seeds common records but is not exhaustive: compare against your current DNS and add what is missing at your CURRENT provider, then re-run `zone delegate` to re-import")
+zone.command('records <domain>').description("Every record in the delegated zone, for review before you switch nameservers. The provider scan seeds common records but is not exhaustive, so compare it against your current DNS first")
     .option('--org <id>', "target org (default: linked project's org)").option('--json')
     .action(guard((domain, o) => domainCmd.zoneRecords(domain, o)));
 zone.command('release <domain>').description("Release a delegated zone: the platform's records are pruned and the zone deleted. Point the nameservers back at your own provider; hostnames re-verify on the records path (org admin; gated: zone.delegate — agent mode gates from a linked project, an unlinked --org call falls under org administration instead)")
@@ -365,7 +367,7 @@ function addObservability(group, component, noun) {
 // optional makes commander unable to hold that boundary itself).
 const { argv: computeArgv, command: execCommand, windowsFallback: execWindowsFallback, } = computeCmd.splitExecArgs(process.argv);
 // ---- compute ----
-const compute = program.command('compute').description('Compute services: lifecycle (start/stop/suspend/restart/status), scale, limits, volume, always-on, exec, ssh, GitHub source, logs, metrics');
+const compute = program.command('compute').description('Compute services: lifecycle (start/stop/suspend/restart/status), scale, limits, volume, public access, always-on, exec, ssh, GitHub source, logs, metrics');
 compute.command('start [service]').description('Bring a compute service online (persistent — re-enables auto-wake)')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeStart(service, o)));
 compute.command('stop [service]').description('Take a compute service offline; traffic will NOT wake it until `start`')
@@ -384,6 +386,10 @@ compute.command('scale [count] [service]').description('Set a compute service sa
 compute.command('limits [service]').description("Show or set a compute service's resource ceiling (any plan within the free cap; raising above it needs a paid plan). --memory is the dial; cpu derives from it unless --cpu is given. Billing is actual usage — the ceiling caps what the app may burn, it is not a price")
     .option('--memory <size>', 'memory ceiling, e.g. 512mb or 1gb').option('--cpu <n>', 'vCPU ceiling override (provider sizes: 1, 2, 4, 6, 8)')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((service, o) => computeCmd.computeLimits(service, o)));
+compute.command('public-access [mode] [service]').description("Show, close or re-open a compute service's public access (mode: on|off; no mode = print it and the service's private address). Every compute service is reachable by the other services in its project branch at <name>.insta.internal:<port> (TCP and UDP); off = private-only: its URL answers 403 and no longer wakes it, so only services in the same branch reach it. Immediate, no redeploy. Asks first; --yes when there is no terminal or with --json. insta-compute only (gated: service.setAccess)")
+    .option('-y, --yes', 'close without asking (required when there is no terminal, or with --json)')
+    .option('--json').option('--branch <branch>', 'branch (default: current)')
+    .action(guard((mode, service, o) => privateNet.servicePublicAccess('compute', mode, service, o)));
 compute.command('always-on <mode> [service]').description('Set a compute service always-on (mode: on|off). on = machines never scale to zero; off = scale-to-zero (the default for new compute services; refused on a worker, port 0). All plans; billing is actual usage either way')
     .option('--json').option('--branch <branch>', 'branch (default: current)').action(guard((mode, service, o) => computeCmd.computeAlwaysOn(mode, service, o)));
 compute.command('ssh [service]')
@@ -463,7 +469,7 @@ pg.command('public-access [mode] [service]').description("Show, close or re-open
 addObservability(pg, 'db', 'postgres');
 // ---- redis / mysql / mongodb (managed databases) ----
 for (const type of ['redis', 'mysql', 'mongodb']) {
-    const g = program.command(type).description(`Managed ${type} services: query, status, resource ceiling, volume, always-on, logs, metrics`);
+    const g = program.command(type).description(`Managed ${type} services: query, status, resource ceiling, volume, public access, always-on, logs, metrics`);
     const query = g.command('query <service> [args...]').description(type === 'redis'
         ? 'Run a redis command against the service via the console exec API — a pre-tokenized argv, e.g. `GET mykey`'
         : `Run one quoted ${type} statement against the service via the console exec API`)
@@ -482,6 +488,10 @@ for (const type of ['redis', 'mysql', 'mongodb']) {
         .option('--size <gi>', 'new size in whole Gi, e.g. 10 (must be ≥ the current size)')
         .option('--json').option('--branch <branch>', 'branch (default: current)')
         .action(guard((service, o) => computeCmd.serviceVolume(type, service, o)));
+    g.command('public-access [mode] [service]').description(`Show, close or re-open a ${type} service's public access (mode: on|off; no mode = print it and the private address). On insta-compute every ${type} is reachable from services in its project branch at <name>-${type}.insta.internal (${type.toUpperCase()}_PRIVATE_URL); off = ${type.toUpperCase()}_URL stops connecting and only apps in the branch reach it, through ${type.toUpperCase()}_PRIVATE_URL. Asks first; --yes when there is no terminal or with --json (gated: service.setAccess)`)
+        .option('-y, --yes', 'close without asking (required when there is no terminal, or with --json)')
+        .option('--json').option('--branch <branch>', 'branch (default: current)')
+        .action(guard((mode, service, o) => privateNet.servicePublicAccess(type, mode, service, o)));
     g.command('always-on <mode> [service]').description(`Set a ${type} service always-on (mode: on|off). on = machines never scale to zero; off = scale-to-zero. Billing is actual usage either way`)
         .option('--json').option('--branch <branch>', 'branch (default: current)')
         .action(guard((mode, service, o) => computeCmd.serviceAlwaysOn(type, mode, service, o)));
@@ -526,7 +536,7 @@ buildCmd.command('logs <build-id>').description('Read source-build output for a
 program.command('deploy [dir]').description('Deploy a source directory (built remotely; on insta-compute a Dockerfile is optional and nixpacks detects the runtime) or a prebuilt --image to a branch compute group')
     .option('--image <url>', 'prebuilt container image to deploy (instead of a source dir)').option('--branch <b>').option('--group <g>').option('--port <p>', 'port the app listens on (0 for a worker without a routed port)')
     .option('--websocket', 'run a WebSocket app (larger guest + connection-based concurrency)')
-    .option('--endpoint <http|tcp>', 'switch how the service is reached from this deploy on: tcp (raw TCP on --port at its own public IPv6 address; IPv6 clients only) or http (back to its HTTPS domain). Omitted: keep the current endpoint')
+    .option('--endpoint <http|tcp|udp|tcp+udp>', 'switch how the service is reached from this deploy on: tcp / udp / tcp+udp (raw TCP, UDP or both on --port at its own public IPv6 address; IPv6 clients only) or http (back to its HTTPS domain). Omitted: keep the current endpoint')
     .option('--replace-source', 'the service deploys from a connected GitHub repo: switch it to this image and remove the repo connection (admin); without it such a deploy is refused')
     .option('--json', 'print the deploy result as JSON (build progress goes to stderr)')
     .action(guard((dir, o) => deploy(dir, o)));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.1.24",
+  "version": "0.1.26",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [