insta 0.1.3 → 0.1.5

package/README.md

@@ -230,7 +230,7 @@ build never reaches a production installer.
 | `insta billing` | Current cycle overview; `subscribe <tier>` · `portal` · `usage` |
 | `insta agent` | `setup` (this machine's coding agents) · `manifest` · `policy …` · `approvals …` · `observe …` · `events` |
 | `insta config` | `install-mcp` · `regions` · `autoupdate` |
-| `insta feedback` | Report an InstaCloud-side hurdle (bug / feature-request / friction) to the team — never for the app you are building; works logged-out |
+| `insta feedback` | Report an InstaCloud-side hurdle (bug / feature-request / friction) to the team — never for the app you are building; on InstaCloud it needs `insta login`, so the team can reply |
 | `insta upgrade` | Update the CLI |
 
 Every command accepts `--api-url <url>` for this invocation only (internal debugging); for `compute exec`, place it before `compute`. `insta --help` documents it.

package/dist/commands/domain.js

@@ -336,4 +336,91 @@ export async function domainDetach(host, opts, deps) {
     }
     return removeDomain(name, opts, d);
 }
+const zonePath = (orgId, domainName) => `/orgs/${encodeURIComponent(orgId)}/zones${domainName ? `/${encodeURIComponent(domainName.trim().toLowerCase())}` : ''}`;
+export function zoneLines(z, orgFlag) {
+    const orgArg = orgFlag ? ` --org ${orgFlag}` : '';
+    if (z.status === 'active')
+        return [`${z.domainName}  delegated (${z.nameservers.join(', ')})`];
+    return [
+        `${z.domainName}  waiting for nameservers`,
+        `  set these at your domain's registrar: ${z.nameservers.join(', ')}`,
+        `  review the zone BEFORE switching: insta domain zone records ${z.domainName}${orgArg}`,
+    ];
+}
+export function zoneRecordLines(records) {
+    if (!records.length)
+        return ['no records in the zone yet — the provider scan runs shortly after delegating; run this again in a moment'];
+    const w = (pick) => Math.max(...records.map((r) => pick(r).length));
+    const typeW = w((r) => r.type), hostW = w((r) => r.host), answerW = w((r) => r.answer);
+    return records.map((r) => `  ${r.type.padEnd(typeW)}  ${r.host.padEnd(hostW)}  ${r.answer.padEnd(answerW)}${r.ttl !== undefined ? `  ttl ${r.ttl}` : ''}${r.priority !== undefined ? `  prio ${r.priority}` : ''}${r.proxied ? '  (proxied)' : ''}`);
+}
+/**
+ * Delegate a bring-your-own domain: the platform builds a managed zone for it and answers the two
+ * nameservers to set at the domain's own registrar. From then on every attach publishes its records
+ * into the zone itself — apexes included — instead of printing them for hand-copying. The zone is
+ * SEEDED by the provider's record scan, which is a heuristic: the review-then-switch contract
+ * (printed, and enforced by nothing else) is to compare `zone records` against the domain's current
+ * DNS and add what is missing at the CURRENT provider — re-running delegate re-imports — before
+ * re-pointing. A domain carrying live MX records is refused outright: a DNS move that can drop
+ * mail is never done implicitly. 202 approval_required in agent mode (zone.delegate); org admin
+ * either way.
+ */
+const orgArgOf = (opts) => (opts.org ? ` --org ${opts.org}` : '');
+export async function zoneDelegate(domainName, opts, deps) {
+    const { api, orgId } = await orgDeps(opts, deps);
+    // Same precedent as `domain delegate`: the org route signs for the linked project in agent mode
+    // (zone.delegate is read at the session project), but only when the link belongs to the org
+    // being mutated — under `--org` naming another org the call goes projectless and the platform's
+    // org-administration path judges it.
+    const link = deps?.project ?? (await readProject()) ?? undefined;
+    const projectId = link && link.orgId === orgId ? link.projectId : undefined;
+    const res = await api.rawRequest('POST', zonePath(orgId), { domainName }, projectId ? { projectId } : undefined);
+    if (handleApproval(res, opts.json))
+        return;
+    if (opts.json)
+        return printJson(res.body);
+    const z = res.body;
+    for (const line of zoneLines(z, opts.org))
+        info(line);
+    info(`the zone was seeded by a provider scan — a heuristic. Check \`insta domain zone records ${z.domainName}${orgArgOf(opts)}\` against your current DNS, add anything missing at your CURRENT provider (re-running delegate re-imports), and only then switch the nameservers.`);
+}
+export async function zoneList(opts, deps) {
+    const { api, orgId } = await orgDeps(opts, deps);
+    const r = await api.request('GET', zonePath(orgId));
+    if (opts.json)
+        return printJson(r);
+    if (!r.items.length)
+        return info('no delegated zones — start one: insta domain zone delegate <domain>');
+    for (const z of r.items)
+        for (const line of zoneLines(z, opts.org))
+            info(line);
+}
+export async function zoneRecords(domainName, opts, deps) {
+    const { api, orgId } = await orgDeps(opts, deps);
+    const r = await api.request('GET', `${zonePath(orgId, domainName)}/records`);
+    if (opts.json)
+        return printJson(r);
+    for (const line of zoneRecordLines(r.items))
+        info(line);
+    if (r.items.length)
+        info(`every type shows here (the scan is a heuristic) — add anything missing at your current DNS provider and re-run \`insta domain zone delegate ${domainName.trim().toLowerCase()}${orgArgOf(opts)}\` to re-import before switching nameservers`);
+}
+/**
+ * Release a delegated zone: the platform prunes the records it published and deletes the managed
+ * zone. The customer's next step — printed — is pointing the domain's nameservers back at their
+ * own provider; hostnames then re-verify on the records path.
+ */
+export async function zoneRelease(domainName, opts, deps) {
+    const { api, orgId } = await orgDeps(opts, deps);
+    const link = deps?.project ?? (await readProject()) ?? undefined;
+    const projectId = link && link.orgId === orgId ? link.projectId : undefined;
+    const res = await api.rawRequest('DELETE', zonePath(orgId, domainName), undefined, projectId ? { projectId } : undefined);
+    if (handleApproval(res, opts.json))
+        return;
+    if (opts.json)
+        return printJson(res.body);
+    const r = res.body;
+    info(`${r.domainName}  released`);
+    info(`point the domain's nameservers back at your DNS provider — hostnames re-verify on the records path (insta domain attach prints them)`);
+}
 //# sourceMappingURL=domain.js.map

package/dist/commands/feedback.js

@@ -5,14 +5,15 @@
 //
 // The backend is InstaCloud dogfooding itself: the "InstaCloud Agent Feedback" project runs the
 // ingest service (InsForge/instacloud-feedback repo) on a postgres + compute pair. It is NOT the
-// control-plane API on purpose — feedback must work logged-out, unlinked, and from insta-oss,
-// and a control-plane outage is exactly when we most want reports to still arrive.
+// control-plane API on purpose — feedback must work unlinked, from insta-oss, and through a
+// control-plane outage, which is exactly when we most want reports to still arrive.
 import { readFileSync, statSync } from 'node:fs';
 import os from 'node:os';
 import * as clack from '@clack/prompts';
+import { ApiClient, ApiError } from '../api.js';
 import { readGlobal, readProject } from '../config.js';
 import { envForApiUrl } from '../env.js';
-import { info, printJson, CliCancel } from '../util.js';
+import { info, printJson, refuse, CliCancel } from '../util.js';
 import { clean } from '../redact.js';
 import { cliVersion } from '../version.js';
 export const TYPES = ['bug', 'feature-request', 'friction', 'other'];
@@ -42,6 +43,8 @@ const FEEDBACK_INGEST_TOKEN = process.env.INSTA_FEEDBACK_TOKEN || 'insta-feedbac
 // the DB wake and persists, so a report can land after a shorter deadline gave up on it).
 // An expired deadline is reported as UNCONFIRMED, not failed — the report may well be stored.
 const FEEDBACK_TIMEOUT_MS = 15_000;
+// A slow control plane may cost a report its ticket, never the report itself.
+const ASSERTION_TIMEOUT_MS = 5_000;
 const MAX_FILE_BYTES = 256 * 1024;
 function requireEnum(value, allowed, flag) {
     if (!allowed.includes(value)) {
@@ -156,7 +159,7 @@ export async function buildPayload(opts, ctx) {
 /** One POST, one bounded attempt (FEEDBACK_TIMEOUT_MS), zero retries — feedback is a side quest and must never hang the CLI.
  *  Transport and server failures come back as a result, not an exception: the caller downgrades
  *  them to a warning so a broken feedback backend can't fail the user's actual task. */
-export async function submit(payload, fetchImpl) {
+export async function submit(payload, fetchImpl, assertion) {
     let res;
     try {
         res = await fetchImpl(FEEDBACK_ENDPOINT, {
@@ -164,6 +167,7 @@ export async function submit(payload, fetchImpl) {
             headers: {
                 'Content-Type': 'application/json',
                 Authorization: `Bearer ${FEEDBACK_INGEST_TOKEN}`,
+                ...(assertion ? { 'Insta-User-Assertion': assertion } : {}),
             },
             body: JSON.stringify(payload),
             signal: AbortSignal.timeout(FEEDBACK_TIMEOUT_MS),
@@ -184,7 +188,34 @@ export async function submit(payload, fetchImpl) {
         return { status: 'error', error: body?.error ?? `HTTP ${res.status}` };
     return { status: body?.status === 'duplicate' ? 'duplicate' : 'received', id: body?.id ?? null };
 }
+const SIGNED_OUT = 'not signed in to InstaCloud — run `insta login`, then send this again so the team can reply to you';
+const STAGING = 'not accepted from staging — send InstaCloud feedback from production';
+// Exit 2, not the submit path's 0: the caller can act on this one.
+function refuseFeedback(message, json) {
+    if (json)
+        printJson({ status: 'refused', submitted: false, error: message });
+    refuse([`insta feedback: ${message}`]);
+}
+function inputError(e, json) {
+    if (!json)
+        throw e;
+    printJson({ status: 'error', submitted: false, error: e instanceof Error ? e.message : String(e) });
+    process.exitCode = 1;
+}
 export async function feedback(opts, deps = {}) {
+    let api;
+    try {
+        api = deps.api ?? await ApiClient.load();
+    }
+    catch (e) {
+        return inputError(e, opts.json);
+    }
+    const env = envForApiUrl(api.apiUrl);
+    if (env === 'staging')
+        refuseFeedback(STAGING, opts.json);
+    // Before the prompts, so nobody types out a report only to be told to sign in.
+    if (env === 'prod' && !api.config.accessToken)
+        refuseFeedback(SIGNED_OUT, opts.json);
     const interactive = deps.interactive ?? (!opts.json && !!process.stdin.isTTY && !!process.stdout.isTTY);
     const missingRequired = !opts.type || !opts.component || !opts.title || (!opts.detail && !opts.file);
     if (missingRequired && interactive)
@@ -198,13 +229,22 @@ export async function feedback(opts, deps = {}) {
         payload = await buildPayload(opts, { cliVersion: deps.cliVersion ?? cliVersion() });
     }
     catch (e) {
-        if (!opts.json)
-            throw e;
-        printJson({ status: 'error', submitted: false, error: e instanceof Error ? e.message : String(e) });
-        process.exitCode = 1;
-        return;
+        return inputError(e, opts.json);
+    }
+    // Fetched after the prompts: it lives five minutes, and a person can take longer than that to type.
+    let assertion;
+    if (env === 'prod') {
+        try {
+            // Bearer only: agent evidence adds a session round trip the timeout cannot bound, and 401s signing in cannot fix.
+            assertion = (await api.request('GET', '/me/feedback-assertion', undefined, { evidence: false, signal: AbortSignal.timeout(ASSERTION_TIMEOUT_MS) })).token;
+        }
+        catch (e) {
+            if (e instanceof ApiError && e.status === 401)
+                refuseFeedback(SIGNED_OUT, opts.json);
+            process.stderr.write(`warning: could not confirm who you are (${e instanceof Error ? e.message : String(e)}) — sending anyway, but nobody can reply to this report\n`);
+        }
     }
-    const result = await submit(payload, deps.fetchImpl ?? fetch);
+    const result = await submit(payload, deps.fetchImpl ?? fetch, assertion);
     if (result.status === 'unconfirmed') {
         // NOT a failure claim: the request was still in flight at the deadline and the server
         // finishes what it started, so saying "not submitted" here would be a false negative.

package/dist/index.js

@@ -279,6 +279,19 @@ ns.command('set <domain> <nameservers...>').description("Delegate the zone to na
 ns.command('reset <domain>').description("Put the zone back on the registrar's own nameservers — from your own delegation or from an InstaCloud-managed zone alike; a hostname `set` took down is re-attached with `insta domain attach`, one a managed zone was serving re-verifies on its own")
     .option('--org <id>', "target org (default: linked project's org)").option('--json')
     .action(guard((domain, o) => domainCmd.domainNameserversReset(domain, o)));
+const zone = dom.command('zone').description("Bring-your-own domains served from an InstaCloud-managed zone (nameserver delegation): point the domain's registrar at the pair `zone delegate` answers, and every attach's records — apexes included — are published for you. The alternative stays available: `insta domain attach` alone prints records to paste into your own zone");
+zone.command('delegate <domain>').description("Delegate a domain you own elsewhere: builds its managed zone (seeded by a provider record scan — a HEURISTIC, so review `zone records` and add anything missing at your current provider BEFORE switching nameservers; re-running delegate re-imports) and answers the two nameservers to set at your registrar. A domain carrying live MX records is refused — move mail first or keep the records path (org admin; gated: zone.delegate — agent mode gates from a linked project, an unlinked --org call falls under org administration instead)")
+    .option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .action(guard((domain, o) => domainCmd.zoneDelegate(domain, o)));
+zone.command('list').description("The org's delegated zones: which are still waiting for the nameserver switch and which are serving")
+    .option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .action(guard((o) => domainCmd.zoneList(o)));
+zone.command('records <domain>').description("Every record in the delegated zone — the pre-switch review. The scan seeds common records but is not exhaustive: compare against your current DNS and add what is missing at your CURRENT provider, then re-run `zone delegate` to re-import")
+    .option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .action(guard((domain, o) => domainCmd.zoneRecords(domain, o)));
+zone.command('release <domain>').description("Release a delegated zone: the platform's records are pruned and the zone deleted. Point the nameservers back at your own provider; hostnames re-verify on the records path (org admin; gated: zone.delegate — agent mode gates from a linked project, an unlinked --org call falls under org administration instead)")
+    .option('--org <id>', "target org (default: linked project's org)").option('--json')
+    .action(guard((domain, o) => domainCmd.zoneRelease(domain, o)));
 const xfer = dom.command('transfer').description('Take a bought domain to another registrar — open the lock, then read the code (all three need org admin)');
 xfer.command('lock <domain> <mode>').description("Open or close the registrar transfer lock (mode: on|off). ICANN's own 60-day lock on a new registration outranks it")
     .option('--org <id>', "target org (default: linked project's org)").option('--json')
@@ -561,7 +574,7 @@ const setupCompat = program.command('setup', { hidden: true }).description('Comp
 withSetupAgentOptions(setupCompat.command('agent').description('Alias of `insta agent setup`, kept for the console one-liner'));
 // ---- feedback (agent + human hurdle reports → the InstaCloud team) ----
 program.command('feedback')
-    .description('Report an InstaCloud-side hurdle (bug / missing feature / friction) to the InstaCloud team — about the insta toolkit itself, NEVER about the app you are building. Works logged-out and unlinked.')
+    .description('Report an InstaCloud-side hurdle (bug / missing feature / friction) to the InstaCloud team — about the insta toolkit itself, NEVER about the app you are building. On InstaCloud it needs `insta login`, so the team can reply; works unlinked.')
     .option('--type <type>', `what kind of hurdle: ${feedbackCmd.TYPES.join(' | ')}`)
     .option('--component <component>', `which part of the toolkit: ${feedbackCmd.COMPONENTS.join(' | ')}`)
     .option('--title <title>', 'one-line summary (≤200 chars)')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [