insta 0.1.25 → 0.1.26

package/README.md

@@ -229,7 +229,7 @@ build never reaches a production installer.
 | `insta branch` | `create` · `list` · `switch` · `delete` · `merge` |
 | `insta service` (`services`, `svc`) | `add` · `list` · `remove` · `rename` |
 | `insta secrets` | Write `.env`, plus `list` · `set` · `unset` · `bind` · `unbind` · `bindings` · `sources` · `tree` |
-| `insta domain` | Bought or bring-your-own: `attach` · `check` · `detach`; buy through InstaCloud: `search` · `buy` · `list` · `status` · `records …` |
+| `insta domain` | Bought or bring-your-own: `attach` · `check` · `detach`. Domains already bought through InstaCloud: `list` · `status` · `records …` |
 | `insta compute` | `start` · `stop` · `suspend` · `restart` · `status` · `scale` · `limits` · `volume` · `always-on` · `exec` · `ssh` · `repo` · `connect-repo` · `watch-paths` · `disconnect-repo` · `logs` · `metrics` |
 | `insta postgres` | `url` (print the DSN) · `connect` (psql) · `stats` · `limits` · `restart` · `volume` · `always-on` · `private-access` · `public-access` · `logs` · `metrics` — every verb takes `[service]` |
 | `insta redis` · `mysql` · `mongodb` | `query` · `status` · `limits` · `volume` · `always-on` · `logs` · `metrics` |

package/dist/commands/cron.js

@@ -165,11 +165,11 @@ export function jobShowLines(j, serviceName) {
     // decrypts it. Saying so beats an empty "value" column that reads as "this header is set to
     // nothing". Secret-backed headers get a row each, because the secret NAME is readable and is the
     // thing an operator needs when a rotation or a missing secret is the question.
-    const refs = Object.entries(refsOf(j.request));
-    const literal = j.request.headerNames.filter((n) => findHeader(refsOf(j.request), n) === undefined);
+    const refs = refsOf(j.request);
+    const literal = j.request.headerNames.filter((n) => findHeader(refs, n) === undefined);
     const rows = [
         ...(literal.length ? [`${literal.join(', ')}  (names only — values are encrypted at rest and never returned)`] : []),
-        ...refs.map(([h, s]) => `${h} ← secret ${s}  (resolved at send time)`),
+        ...Object.entries(refs).map(([h, s]) => `${h} ← secret ${s}  (resolved at send time)`),
     ];
     if (!rows.length)
         lines.push('  headers      (none)');

package/dist/commands/domain.js

@@ -30,9 +30,6 @@ export async function domainSearch(keyword, opts, deps) {
         return printJson(r);
     for (const line of searchLines(r.results))
         info(line);
-    const buyable = r.results.find((x) => x.purchasable);
-    if (buyable)
-        info(`buy one: insta domain buy ${buyable.domainName}`);
 }
 export async function domainBuy(name, opts, deps) {
     const years = whole('--years', opts.years);
@@ -117,10 +114,10 @@ function domainLines(d, linked = true) {
         out.push(`  ${h.hostname.padEnd(w)}  ${h.state}${h.service ? ` → ${h.service}` : ''}${h.reason ? ` — ${h.reason}` : ''}`);
     return out;
 }
-function orderStatusLines(o, linked = true) {
+function orderStatusLines(o) {
     const out = [`order ${o.id}: ${o.domainName} — ${o.status}${o.failedReason ? ` — ${o.failedReason}` : ''}`];
-    if (linked && o.status === 'canceled')
-        out.push(`  the checkout closed without payment — order again: insta domain buy ${o.domainName}`);
+    if (o.status === 'canceled')
+        out.push('  the checkout closed without payment');
     return out;
 }
 export async function domainList(opts, deps) {
@@ -129,7 +126,7 @@ export async function domainList(opts, deps) {
     if (opts.json)
         return printJson(r);
     if (!r.items.length)
-        return info('no domains bought through InstaCloud in this org (search: insta domain search <keyword>)');
+        return info('no domains bought through InstaCloud in this org');
     for (const d of r.items)
         for (const line of domainLines(d, !opts.org))
             info(line);
@@ -147,7 +144,7 @@ export async function domainStatus(name, opts, deps) {
         die(`${host} was not bought through this org`);
     if (opts.json)
         return printJson({ domain, order });
-    for (const line of domain ? domainLines(domain, !opts.org) : orderStatusLines(order, !opts.org))
+    for (const line of domain ? domainLines(domain, !opts.org) : orderStatusLines(order))
         info(line);
 }
 // ---- nameservers and transferring out ----
@@ -369,10 +366,9 @@ export function zoneRecordLines(records) {
  * into the zone itself — apexes included — instead of printing them for hand-copying. The zone is
  * SEEDED by the provider's record scan, which is a heuristic: the review-then-switch contract
  * (printed, and enforced by nothing else) is to compare `zone records` against the domain's current
- * DNS and add what is missing at the CURRENT provider — re-running delegate re-imports — before
- * re-pointing. A domain carrying live MX records is refused outright: a DNS move that can drop
- * mail is never done implicitly. 202 approval_required in agent mode (zone.delegate); org admin
- * either way.
+ * DNS before re-pointing. A domain carrying live MX records is refused outright: a DNS move that
+ * can drop mail is never done implicitly. 202 approval_required in agent mode (zone.delegate); org
+ * admin either way.
  */
 const orgArgOf = (opts) => (opts.org ? ` --org ${opts.org}` : '');
 export async function zoneDelegate(domainName, opts, deps) {
@@ -391,7 +387,7 @@ export async function zoneDelegate(domainName, opts, deps) {
     const z = res.body;
     for (const line of zoneLines(z, opts.org))
         info(line);
-    info(`the zone was seeded by a provider scan — a heuristic. Check \`insta domain zone records ${z.domainName}${orgArgOf(opts)}\` against your current DNS, add anything missing at your CURRENT provider (re-running delegate re-imports), and only then switch the nameservers.`);
+    info(`the zone was seeded by a provider scan, which can miss records. Check \`insta domain zone records ${z.domainName}${orgArgOf(opts)}\` against your current DNS, and only then switch the nameservers.`);
 }
 export async function zoneList(opts, deps) {
     const { api, orgId } = await orgDeps(opts, deps);
@@ -412,7 +408,7 @@ export async function zoneList(opts, deps) {
     if (opts.json)
         return printJson(r);
     if (!r.items.length)
-        return info('no delegated zones — start one: insta domain zone delegate <domain>');
+        return info('no delegated zones');
     for (const z of r.items)
         for (const line of zoneLines(z, opts.org))
             info(line);
@@ -425,7 +421,7 @@ export async function zoneRecords(domainName, opts, deps) {
     for (const line of zoneRecordLines(r.items))
         info(line);
     if (r.items.length)
-        info(`every type shows here (the scan is a heuristic) — add anything missing at your current DNS provider and re-run \`insta domain zone delegate ${domainName.trim().toLowerCase()}${orgArgOf(opts)}\` to re-import before switching nameservers`);
+        info('every type shows here. The provider scan can miss records, so compare them against your current DNS before switching nameservers');
 }
 /**
  * Release a delegated zone: the platform prunes the records it published and deletes the managed

package/dist/commands/template.js

@@ -344,6 +344,9 @@ async function promptVariable(v) {
         throw new CliCancel();
     return answer.trim();
 }
+// The poll route is keyed by deployment id, not project: name the project so agent mode signs
+// with the project-bound session (a bootstrap session is rejected as "for a different project").
+const readDeployment = (api, projectId) => (id) => api.request('GET', `/template-deployments/${id}`, undefined, { projectId });
 export async function templateDeploy(target, opts = {}, deps = {}) {
     const given = parseSetFlags(opts.set ?? []); // a typo'd --set fails before any network access
     // --json asked for parseable output: every human progress line is suppressed so stdout carries
@@ -424,9 +427,7 @@ export async function templateDeploy(target, opts = {}, deps = {}) {
         for (const line of publicBucketLines(services))
             info(line);
     }
-    // The poll route is keyed by deployment id, not project: name the project so agent mode signs
-    // with the project-bound session (a bootstrap session is rejected as "for a different project").
-    const dep = await watchDeployment((id) => api.request('GET', `/template-deployments/${id}`, undefined, { projectId: p.projectId }), deploymentId, quiet ? () => { } : info, deps.wait);
+    const dep = await watchDeployment(readDeployment(api, p.projectId), deploymentId, quiet ? () => { } : info, deps.wait);
     if (opts.json)
         return printJson(source ? { source, ...dep } : dep);
     info(`template ${codeLabel} deployed to branch ${branchName}`);
@@ -526,10 +527,10 @@ export async function templateUpgrade(service, opts = {}, deps = {}) {
     const branchName = opts.branch ?? p.branch;
     const ask = deps.ask ?? promptVariable;
     const target = await deploymentOfService(api, p.projectId, branchName, service, 'upgrade');
-    // The poll and preview routes are keyed by deployment id, not project: name the project so agent
-    // mode signs with the project-bound session, exactly as templateDeploy does.
-    // The preview is a GET and raises coded 409s of its own (template_superseded among them), so it
-    // gets the same reading as the POST rather than the raw "<sentence> (HTTP 409)" the guard prints.
+    // The preview route is keyed by deployment id, not project, so it names the project as
+    // readDeployment does. It is a GET and raises coded 409s of its own (template_superseded among
+    // them), so it gets the same reading as the POST rather than the raw "<sentence> (HTTP 409)" the
+    // guard prints.
     let plan;
     try {
         ;
@@ -576,7 +577,7 @@ export async function templateUpgrade(service, opts = {}, deps = {}) {
     const deploymentId = res.body.deploymentId ?? (res.body.deployment ?? res.body).id;
     if (!quiet)
         info(`upgrading ${service} to ${plan.to_version} (${deploymentId})`);
-    const dep = await watchDeployment((id) => api.request('GET', `/template-deployments/${id}`, undefined, { projectId: p.projectId }), deploymentId, quiet ? () => { } : info, deps.wait);
+    const dep = await watchDeployment(readDeployment(api, p.projectId), deploymentId, quiet ? () => { } : info, deps.wait);
     if (quiet)
         return printJson(dep);
     info(`${service} is on ${plan.to_version}`);
@@ -635,7 +636,7 @@ export async function templateRollback(service, opts = {}, deps = {}) {
         return;
     const deploymentId = res.body.deploymentId ?? (res.body.deployment ?? res.body).id;
     out(`rolling ${service} back (${deploymentId})`);
-    const dep = await watchDeployment((id) => api.request('GET', `/template-deployments/${id}`, undefined, { projectId: p.projectId }), deploymentId, out, deps.wait);
+    const dep = await watchDeployment(readDeployment(api, p.projectId), deploymentId, out, deps.wait);
     if (quiet)
         return printJson(dep);
     info(`${service} is back on ${(dep.deployment ?? dep).template_version ?? 'its previous version'}`);

package/dist/index.js

@@ -273,11 +273,12 @@ cron.command('runs <name>').description('Run history, most recent first: status,
 cron.command('preview <expression>').description('Validate an expression and print its next five UTC fire times — answered by the same parser the scheduler uses. Exits 1 when the expression is invalid')
     .option('--json').action(guard((expression, o) => cronCmd.cronPreview(expression, o)));
 // ---- domain (bought here, or bring your own; hostnames on compute services; DNS of bought zones) ----
-const dom = program.command('domain').description('Domains: buy through InstaCloud or bring your own — attach / check / detach hostnames on compute services; DNS records of bought domains');
-dom.command('search <keyword>').description('Search purchasable names with prices (a label like "myapp" or a full name like "myapp.com")')
+const dom = program.command('domain').description('Domains: attach, check and detach hostnames on compute services, and manage domains already bought through InstaCloud');
+// search, buy and zone delegate are hidden while the platform pauses new orders and BYO delegation.
+dom.command('search <keyword>', { hidden: true }).description('Search purchasable names with prices (a label like "myapp" or a full name like "myapp.com")')
     .option('--tlds <list>', 'comma-separated TLDs to include').option('--org <id>', "target org (default: linked project's org)").option('--json')
     .action(guard((keyword, o) => domainCmd.domainSearch(keyword, o)));
-dom.command('buy <name>').description('Buy a domain — pay at the printed Stripe Checkout link. It serves nothing until you attach it (gated: domain.purchase)')
+dom.command('buy <name>', { hidden: true }).description('Buy a domain — pay at the printed Stripe Checkout link. It serves nothing until you attach it (gated: domain.purchase)')
     .option('--years <n>', 'registration term in years (default 1)')
     .option('--no-open', 'print the checkout URL instead of opening a browser').option('--json')
     .action(guard((name, o) => domainCmd.domainBuy(name, o)));
@@ -309,14 +310,14 @@ ns.command('set <domain> <nameservers...>').description("Delegate the zone to na
 ns.command('reset <domain>').description("Put the zone back on the registrar's own nameservers — from your own delegation or from an InstaCloud-managed zone alike; a hostname `set` took down is re-attached with `insta domain attach`, one a managed zone was serving re-verifies on its own")
     .option('--org <id>', "target org (default: linked project's org)").option('--json')
     .action(guard((domain, o) => domainCmd.domainNameserversReset(domain, o)));
-const zone = dom.command('zone').description("Bring-your-own domains served from an InstaCloud-managed zone (nameserver delegation): point the domain's registrar at the pair `zone delegate` answers, and every attach's records — apexes included — are published for you. The alternative stays available: `insta domain attach` alone prints records to paste into your own zone");
-zone.command('delegate <domain>').description("Delegate a domain you own elsewhere: builds its managed zone (seeded by a provider record scan — a HEURISTIC, so review `zone records` and add anything missing at your current provider BEFORE switching nameservers; re-running delegate re-imports) and answers the two nameservers to set at your registrar. A domain carrying live MX records is refused — move mail first or keep the records path (org admin; gated: zone.delegate — agent mode gates from a linked project, an unlinked --org call falls under org administration instead)")
+const zone = dom.command('zone').description("Bring-your-own domains already delegated to an InstaCloud-managed zone: list them, review their records, or release them. For a hostname under a domain you own elsewhere, `insta domain attach` prints the records to add in your own DNS");
+zone.command('delegate <domain>', { hidden: true }).description("Delegate a domain you own elsewhere: builds its managed zone (seeded by a provider record scan — a HEURISTIC, so review `zone records` against your current DNS BEFORE switching nameservers) and answers the two nameservers to set at your registrar. A domain carrying live MX records is refused — move mail first or keep the records path (org admin; gated: zone.delegate — agent mode gates from a linked project, an unlinked --org call falls under org administration instead)")
     .option('--org <id>', "target org (default: linked project's org)").option('--json')
     .action(guard((domain, o) => domainCmd.zoneDelegate(domain, o)));
 zone.command('list').description("The org's delegated zones: which are still waiting for the nameserver switch and which are serving")
     .option('--org <id>', "target org (default: linked project's org)").option('--json')
     .action(guard((o) => domainCmd.zoneList(o)));
-zone.command('records <domain>').description("Every record in the delegated zone — the pre-switch review. The scan seeds common records but is not exhaustive: compare against your current DNS and add what is missing at your CURRENT provider, then re-run `zone delegate` to re-import")
+zone.command('records <domain>').description("Every record in the delegated zone, for review before you switch nameservers. The provider scan seeds common records but is not exhaustive, so compare it against your current DNS first")
     .option('--org <id>', "target org (default: linked project's org)").option('--json')
     .action(guard((domain, o) => domainCmd.zoneRecords(domain, o)));
 zone.command('release <domain>').description("Release a delegated zone: the platform's records are pruned and the zone deleted. Point the nameservers back at your own provider; hostnames re-verify on the records path (org admin; gated: zone.delegate — agent mode gates from a linked project, an unlinked --org call falls under org administration instead)")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.1.25",
+  "version": "0.1.26",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [