insta 0.1.8 → 0.1.11

package/README.md

@@ -215,7 +215,7 @@ build never reaches a production installer.
 | `insta login` · `logout` · `status` | Browser sign-in (default), `--email` + password, or `--oauth github\|google`; `status` shows the environment, login and linked project/branch |
 | `insta org` | `list` · `create` (one free org per user) |
 | `insta tokens` | API tokens for CI and agents: `list` · `create <name>` · `revoke <id>`. A new token binds to the current org by default (`--org <id>`, `--project <id>`, or an explicit `--account` for everything the account can do); `--read-only` (GET only); `--expires 30d\|90d\|1y\|never` (default 90d). The plaintext is printed once |
-| `insta project` | `create` · `list` · `link` · `delete` |
+| `insta project` | `create` · `list` · `link` · `rename` · `delete` |
 | `insta branch` | `create` · `list` · `switch` · `delete` · `merge` |
 | `insta service` (`services`, `svc`) | `add` · `list` · `remove` · `rename` |
 | `insta secrets` | Write `.env`, plus `list` · `set` · `unset` · `bind` · `unbind` · `bindings` · `sources` · `tree` |
@@ -225,7 +225,7 @@ build never reaches a production installer.
 | `insta redis` · `mysql` · `mongodb` | `query` · `status` · `limits` · `volume` · `always-on` · `logs` · `metrics` |
 | `insta storage` | `list` · `get` · `delete` · `set-access` |
 | `insta build [dir]` · `deploy [dir]` | Verify a source dir would build; deploy a source directory (built remotely) or `--image <url>`. `insta build logs <id>` reads source-build output: `--source archive` (default) uses the deploy operation ID, `--source github` uses a GitHub build ID; `--follow` watches output, `--json` returns one snapshot |
-| `insta cron` | Branch-scoped HTTP schedules: `list` · `create` · `show` · `edit` · `pause` · `resume` · `delete` · `run` · `runs` · `preview`. Expressions are UTC and so is every time printed; `run` is one EXTRA execution and does not consume the next scheduled tick; header values are write-only, so `show` lists header names only |
+| `insta cron` | Branch-scoped HTTP schedules: `list` · `create` · `show` · `edit` · `pause` · `resume` · `delete` · `run` · `runs` · `preview`. Expressions are UTC and so is every time printed; `run` is one EXTRA execution and does not consume the next scheduled tick; literal header values are write-only, so `show` lists their names only — a header backed by `--secret-ref` is resolved from a project secret at send time and `show` names that secret too |
 | `insta run <cmd>` | Run a command with the branch bundle injected, nothing written to disk |
 | `insta template` | `list` · `info` · `deploy` |
 | `insta billing` | Current cycle overview; `subscribe <tier>` · `portal` · `usage` |

package/dist/commands/branch.js

@@ -7,8 +7,11 @@ export async function branchCreate(name, opts) {
     const out = await api.request('POST', `/projects/${p.projectId}/branches`, { name, from: opts.from ?? p.branch });
     if (opts.json)
         return printJson(out);
-    info(`created branch ${out.branch.name} (${out.branch.id})`);
-    renderNextActions(out.nextActions);
+    info(`created branch ${out.branch.name} (${out.branch.id}) [${out.branch.status}]`);
+    const creating = out.branch.status === 'creating';
+    if (creating)
+        info('  still provisioning — deploy once `insta branch list` shows it active (a deploy before then answers 404); if it shows error, re-run this command');
+    renderNextActions(creating ? out.nextActions?.filter((a) => a.op !== 'deploy') : out.nextActions);
 }
 export async function branchList(opts) {
     const api = await ApiClient.load();

package/dist/commands/build.js

@@ -3,9 +3,10 @@
 // Entirely local and offline: no login, no project link, nothing pushed or deployed. Phase 1 is
 // static-only — no Docker daemon involved.
 import { resolve, join } from 'node:path';
-import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { existsSync, readFileSync, statSync } from 'node:fs';
 import { info, printJson, die } from '../util.js';
 import { dockerfileExposedPort } from './deploy.js';
+import { contextEntries } from '../pack.js';
 import { nixpacksPlan, nixpacksGeneratedDockerfile, nixpacksAvailable, quietRunner } from '../nixpacks.js';
 // A failed critical sinks the build; a failed warning deserves attention; skips are not failures.
 export function computeVerdict(checks) {
@@ -45,63 +46,20 @@ export function envKeysFromDotEnvExample(content) {
 }
 const CONTEXT_WARN_BYTES = 100 * 1024 * 1024;
 const WALK_CAP = 50_000; // entries; hitting it marks the stats truncated (size becomes a floor)
-// Sizes what would actually ship: a dockerignored node_modules is skipped, not counted. (Only the
-// node_modules pattern is honored — full .dockerignore glob semantics aren't reimplemented here.)
 export function contextStats(dir, cap = WALK_CAP) {
-    const ignoreFile = join(dir, '.dockerignore');
-    const ignoreLines = existsSync(ignoreFile)
-        ? readFileSync(ignoreFile, 'utf8').split('\n').map((l) => l.trim()).filter((l) => l && !l.startsWith('#'))
-        : [];
-    const nodeModulesIgnored = ignoreLines.some((l) => ['node_modules', 'node_modules/', '/node_modules', '**/node_modules'].includes(l));
+    const entries = contextEntries(dir, cap + 1);
     let totalBytes = 0;
     let nodeModulesBytes = 0;
-    let hasNodeModules = false;
-    let truncated = false;
-    let seen = 0;
-    const walk = (d, inNodeModules) => {
-        let entries;
-        try {
-            entries = readdirSync(d);
-        }
-        catch {
-            return;
-        }
-        for (const name of entries) {
-            if (seen++ >= cap) {
-                truncated = true;
-                return;
-            }
-            if (name === '.git')
-                continue;
-            const p = join(d, name);
-            let st;
-            try {
-                st = statSync(p);
-            }
-            catch {
-                continue;
-            }
-            if (name === 'node_modules' && st.isDirectory()) {
-                hasNodeModules = true;
-                if (nodeModulesIgnored)
-                    continue; // excluded from the context — don't count it
-            }
-            const isNm = inNodeModules || name === 'node_modules';
-            if (st.isDirectory())
-                walk(p, isNm);
-            else {
-                totalBytes += st.size;
-                if (isNm)
-                    nodeModulesBytes += st.size;
-            }
-        }
-    };
-    walk(dir, false);
-    return { totalBytes, nodeModulesBytes, hasNodeModules, nodeModulesIgnored, truncated };
+    for (const e of entries.slice(0, cap)) {
+        totalBytes += e.size;
+        if (e.path.split('/').includes('node_modules'))
+            nodeModulesBytes += e.size;
+    }
+    return { totalBytes, nodeModulesBytes, truncated: entries.length > cap, hasDockerignore: existsSync(join(dir, '.dockerignore')) };
 }
 const mb = (bytes) => `${(bytes / 1024 / 1024).toFixed(1)} MB`;
 export function contextCheck(ctx) {
-    const shipsNodeModules = ctx.hasNodeModules && !ctx.nodeModulesIgnored;
+    const shipsNodeModules = ctx.nodeModulesBytes > 0;
     const tooBig = ctx.totalBytes > CONTEXT_WARN_BYTES;
     const size = `${mb(ctx.totalBytes)}${ctx.truncated ? '+' : ''}`;
     const detail = shipsNodeModules
@@ -116,7 +74,7 @@ export function contextCheck(ctx) {
         status: bad ? 'fail' : 'pass',
         title: 'build context',
         detail,
-        ...(bad ? { nextAction: 'add a .dockerignore (node_modules, build artifacts, secrets)' } : {}),
+        ...(bad ? { nextAction: `${ctx.hasDockerignore ? 'extend your' : 'add a'} .dockerignore (node_modules, build artifacts, secrets)` } : {}),
     };
 }
 export async function buildReport(dirArg, opts, deps) {
@@ -211,7 +169,12 @@ export async function buildReport(dirArg, opts, deps) {
         detail: port !== undefined ? `${port} (${rationale})` : rationale,
         ...(port !== undefined ? {} : { nextAction: 'pass --port <n> (or add EXPOSE <n> to the Dockerfile) — a port mismatch is the #1 deploy mistake' }),
     });
-    checks.push(contextCheck(contextStats(dir)));
+    try {
+        checks.push(contextCheck(contextStats(dir)));
+    }
+    catch (err) {
+        checks.push({ id: 'context', severity: 'warning', status: 'fail', title: 'build context', detail: err.message, nextAction: 'make it readable, or exclude it in .dockerignore — deploy cannot pack it either' });
+    }
     return {
         dir,
         plan: { builder, providers: np?.providers ?? [], installCommand: np?.installCommand, buildCommand: np?.buildCommand, startCommand: np?.startCommand, port, portRationale: rationale, envKeys },

package/dist/commands/cron.js

@@ -11,7 +11,9 @@
 //      so a localised column would read correctly today and lie twice a year, in both directions.
 //   3. Header VALUES are write-only — the request config is encrypted at rest and no read decrypts
 //      it. `show` can therefore list header NAMES and nothing else, and `edit` REPLACES the request
-//      rather than merging into one it cannot read (see cronEditWarnings).
+//      rather than merging into one it cannot read (see cronEditWarnings). The one readable part is
+//      `secretRefs` (header → project secret NAME, resolved at send time), which `edit` carries
+//      forward because it can (see buildRequest).
 import { randomUUID } from 'node:crypto';
 import { ApiClient, ApiError, requireProject } from '../api.js';
 import { die, handleApproval, info, printJson, refuse } from '../util.js';
@@ -53,13 +55,13 @@ export function parseRunLimit(raw) {
  * contains one (`authorization=Bearer a=b`, any base64 padding), so splitting on every `=` would
  * quietly truncate exactly the credentials this flag exists to carry.
  */
-export function parseHeader(raw) {
+export function parseHeader(raw, flag = '--header') {
     const at = raw.indexOf('=');
     if (at < 1)
-        throw new Error(`--header must be name=value, got: ${raw}`);
+        throw new Error(`${flag} must be name=value, got: ${raw}`);
     const name = raw.slice(0, at).trim();
     if (!name)
-        throw new Error(`--header must be name=value, got: ${raw}`);
+        throw new Error(`${flag} must be name=value, got: ${raw}`);
     return [name, raw.slice(at + 1)];
 }
 /**
@@ -67,18 +69,50 @@ export function parseHeader(raw) {
  * request carries one value per header, and silently dropping one of two credentials an agent
  * passed is the failure that shows up later as a 401 nobody can explain.
  */
-export function parseHeaders(list) {
-    const out = {};
+export function parseHeaders(list, flag = '--header') {
+    // `__proto__` is syntactically a valid HTTP header name. A `{}` literal is not a safe map for
+    // it: `out['__proto__'] = value` hits Object.prototype's __proto__ SETTER instead of creating
+    // an own property, so a string value is silently swallowed — the header would vanish with no
+    // error. A null-prototype object has no such setter, so the assignment below behaves like an
+    // ordinary map entry for every syntactically valid name, `__proto__` included.
+    const out = Object.create(null);
     for (const raw of list) {
-        const [name, value] = parseHeader(raw);
+        const [name, value] = parseHeader(raw, flag);
         // Header names are case-insensitive on the wire, so a case-varied repeat is the same repeat.
-        const clash = Object.keys(out).find((k) => k.toLowerCase() === name.toLowerCase());
+        const clash = findHeader(out, name);
         if (clash !== undefined)
-            throw new Error(`--header ${name} given twice (also as ${clash}) — a header carries one value`);
+            throw new Error(`${flag} ${name} given twice (also as ${clash}) — a header carries one value`);
         out[name] = value;
     }
     return out;
 }
+/** The key of `rec` naming header `name`, case-insensitively (header names are, on the wire). */
+function findHeader(rec, name) {
+    return Object.keys(rec).find((k) => k.toLowerCase() === name.toLowerCase());
+}
+/**
+ * Collect repeated `--secret-ref header=SECRET_NAME`. Same grammar as `--header`, and an EMPTY secret
+ * name means "remove this header's ref" on an edit — a secret cannot be named "", so the spelling is
+ * unambiguous, and it keeps removal on the flag that sets refs rather than adding a second one.
+ */
+export function parseSecretRefs(list) {
+    const out = parseHeaders(list, '--secret-ref');
+    for (const k of Object.keys(out)) {
+        const raw = out[k];
+        const trimmed = raw.trim();
+        // Only a LITERALLY empty value means "remove" — that's what makes the spelling unambiguous.
+        // A value that is merely whitespace is a fat-fingered secret name, not that same intent, and
+        // trimming it to '' would silently take the removal branch instead of naming the typo.
+        if (raw !== '' && trimmed === '')
+            throw new Error(`--secret-ref ${k}=${raw} names a blank secret — a secret name cannot be blank (use --secret-ref ${k}= with nothing after '=' to remove the ref)`);
+        out[k] = trimmed;
+    }
+    return out;
+}
+/** A job's refs, `{}` for a row written before refs existed. */
+export function refsOf(r) {
+    return r.secretRefs ?? {};
+}
 /** Resolve a cron job by the name the CLI addresses it with (mirrors resolveServiceId). */
 export function resolveJob(jobs, name) {
     const job = jobs.find((j) => j.name === name);
@@ -127,11 +161,19 @@ export function jobShowLines(j, serviceName) {
         `  target       ${targetLine(j.target, serviceName)}`,
         `  request      ${j.request.method}  timeout ${j.request_timeout_ms}ms`,
     ];
-    // Names, never values: the request config is encrypted at rest and no read decrypts it. Saying so
-    // beats an empty "value" column that reads as "this header is set to nothing".
-    lines.push(j.request.headerNames.length
-        ? `  headers      ${j.request.headerNames.join(', ')}  (names only — values are encrypted at rest and never returned)`
-        : '  headers      (none)');
+    // Literal headers: names, never values — the request config is encrypted at rest and no read
+    // decrypts it. Saying so beats an empty "value" column that reads as "this header is set to
+    // nothing". Secret-backed headers get a row each, because the secret NAME is readable and is the
+    // thing an operator needs when a rotation or a missing secret is the question.
+    const refs = Object.entries(refsOf(j.request));
+    const literal = j.request.headerNames.filter((n) => findHeader(refsOf(j.request), n) === undefined);
+    const rows = [
+        ...(literal.length ? [`${literal.join(', ')}  (names only — values are encrypted at rest and never returned)`] : []),
+        ...refs.map(([h, s]) => `${h} ← secret ${s}  (resolved at send time)`),
+    ];
+    if (!rows.length)
+        lines.push('  headers      (none)');
+    rows.forEach((r, i) => lines.push(`  ${i ? '           ' : 'headers    '}  ${r}`));
     lines.push(`  retry        ${retryLine(j.retry_policy)}`);
     lines.push(`  revision     ${j.revision}  (the If-Match an edit is conditioned on)`);
     lines.push(`  created      ${fmtUtc(j.created_at)}   updated ${fmtUtc(j.updated_at)}`);
@@ -185,7 +227,7 @@ export function conflictLines(name, revision, what) {
 }
 /** True when any flag that shapes the stored request was given. */
 export function namesRequest(o) {
-    return o.method !== undefined || o.body !== undefined || (o.header?.length ?? 0) > 0;
+    return o.method !== undefined || o.body !== undefined || (o.header?.length ?? 0) > 0 || (o.secretRef?.length ?? 0) > 0;
 }
 /** True when any flag that names a target was given. */
 export function namesTarget(o) {
@@ -208,8 +250,52 @@ export function assertTargetFlags(o, partial = false) {
     if (o.path !== undefined && !o.path.startsWith('/'))
         throw new Error(`--path must start with /, got: ${o.path}`);
 }
-/** The stored request, from the flags alone. `undefined` when no flag shaped one. */
-export function buildRequest(o) {
+/**
+ * The stored request. `undefined` when no flag shaped one.
+ *
+ * `current` is the request of the job being edited (omit it on create). Its secret refs are carried
+ * forward — unlike literal values they are readable, so dropping them would be a choice rather than
+ * a limitation — except for a header the flags re-supply, via `--secret-ref` (a new secret) or
+ * `--header` (a literal replacing the ref). `--secret-ref h=` removes one.
+ */
+export function buildRequest(o, current) {
+    const flags = parseRequestFlags(o);
+    if (!flags)
+        return undefined;
+    const { method, headers, refFlags } = flags;
+    const had = current ? refsOf(current) : {};
+    // Same reasoning as parseHeaders: `had` may carry a stored `__proto__` ref (it came off the
+    // wire through JSON.parse, which — unlike a `{}` literal assignment — gives it a real own
+    // property), and a `{}` accumulator here would silently drop it while carrying every other ref
+    // forward, breaking the one guarantee this function exists to keep.
+    const refs = Object.create(null);
+    for (const [h, s] of Object.entries(had)) {
+        if (findHeader(headers ?? {}, h) === undefined && findHeader(refFlags, h) === undefined)
+            refs[h] = s;
+    }
+    for (const [h, s] of Object.entries(refFlags)) {
+        if (s) {
+            refs[h] = s;
+            continue;
+        }
+        // A removal that removes nothing is a typo'd header name, and the ref it meant is still live.
+        if (!current)
+            throw new Error(`--secret-ref ${h}= removes a secret ref, and a new job has none — name the secret: --secret-ref ${h}=SECRET_NAME`);
+        if (findHeader(had, h) === undefined) {
+            const names = Object.keys(had);
+            throw new Error(`--secret-ref ${h}= removes a secret ref, and the job has none on ${h}${names.length ? ` (it has: ${names.join(', ')})` : ''}`);
+        }
+    }
+    return {
+        method,
+        ...(headers ? { headers } : {}),
+        ...(o.body !== undefined ? { body: o.body } : {}),
+        ...(Object.keys(refs).length ? { secretRefs: refs } : {}),
+    };
+}
+/** The request flags parsed and checked against each other — no job needed, so an edit runs this
+ *  before any network access. `undefined` when no flag shaped a request. */
+export function parseRequestFlags(o) {
     if (!namesRequest(o))
         return undefined;
     const method = o.method ? parseMethod(o.method) : o.body !== undefined ? 'POST' : 'GET';
@@ -219,23 +305,31 @@ export function buildRequest(o) {
     if (o.body !== undefined && method !== 'POST')
         throw new Error('--body is sent on POST only — drop --method GET, or drop --body');
     const headers = o.header?.length ? parseHeaders(o.header) : undefined;
-    return { method, ...(headers ? { headers } : {}), ...(o.body !== undefined ? { body: o.body } : {}) };
+    const refFlags = o.secretRef?.length ? parseSecretRefs(o.secretRef) : {};
+    // The platform refuses a header in both maps; saying so here names the flags that did it.
+    for (const h of Object.keys(refFlags)) {
+        const both = findHeader(headers ?? {}, h);
+        if (both !== undefined)
+            throw new Error(`${h} is given as both --header and --secret-ref — a header is a literal value or a secret, not both`);
+    }
+    return { method, ...(headers ? { headers } : {}), refFlags };
 }
 /**
  * What an edit that reshapes the request is about to LOSE.
  *
  * The API replaces `request` wholesale — it cannot merge, because a deep merge cannot express
- * "remove this header", and the CLI could not merge either even if the API did: header values are
- * write-only, so the values currently stored are unreadable here. Anything the new flags do not
- * re-supply is therefore gone, and the one thing this command must not do is drop a credential
- * without saying which one.
+ * "remove this header", and the CLI could not merge either even if the API did: literal header
+ * values are write-only, so the values currently stored are unreadable here. Anything the new flags
+ * do not re-supply is therefore gone, and the one thing this command must not do is drop a
+ * credential without saying which one. Secret refs are readable and buildRequest carries them into
+ * `next`, so only a ref the flags removed or replaced leaves — on purpose, and not warned about.
  */
 export function cronEditWarnings(current, next) {
     const out = [];
-    const kept = new Set(Object.keys(next.headers ?? {}).map((h) => h.toLowerCase()));
-    const dropped = current.headerNames.filter((n) => !kept.has(n.toLowerCase()));
+    const kept = new Set([...Object.keys(next.headers ?? {}), ...Object.keys(next.secretRefs ?? {})].map((h) => h.toLowerCase()));
+    const dropped = current.headerNames.filter((n) => !kept.has(n.toLowerCase()) && findHeader(refsOf(current), n) === undefined);
     if (dropped.length) {
-        out.push(`warning: the stored request is replaced, not merged (header values are write-only and cannot be read back) — these headers are dropped: ${dropped.join(', ')}`);
+        out.push(`warning: the stored request is replaced, not merged (literal header values are write-only and cannot be read back) — these headers are dropped: ${dropped.join(', ')}`);
     }
     // The METHOD is part of the request being replaced, and changing it is the quietest way to break
     // a job: `--header` alone on a POST job re-shapes the whole request, and the default method for a
@@ -375,13 +469,16 @@ export async function cronShow(name, opts = {}, injected) {
 }
 export async function cronEdit(name, opts = {}, injected) {
     assertTargetFlags(opts, true);
-    const request = buildRequest(opts);
+    // Contradictory flags fail before any network access; only whether a `--secret-ref h=` removal
+    // names a ref the job has waits for the job (buildRequest, below).
+    parseRequestFlags(opts);
     const timeout = opts.timeout === undefined ? undefined : parseTimeout(opts.timeout);
-    if (!namesTarget(opts) && !request && timeout === undefined && opts.expression === undefined && opts.name === undefined) {
-        throw new Error('nothing to change — pass --expression, --url/--service/--path, --method/--header/--body, --timeout or --name');
+    if (!namesTarget(opts) && !namesRequest(opts) && timeout === undefined && opts.expression === undefined && opts.name === undefined) {
+        throw new Error('nothing to change — pass --expression, --url/--service/--path, --method/--header/--secret-ref/--body, --timeout or --name');
     }
     const c = await context(opts, injected);
     const job = await findJob(c, name);
+    const request = buildRequest(opts, job.request);
     const target = namesTarget(opts)
         // An edit that moves a service target keeps the path it had unless --path says otherwise.
         ? await targetOf(c, opts, job.target.kind === 'service' ? job.target.path : '/')

package/dist/commands/govern.js

@@ -1,11 +1,22 @@
 import { ApiClient, requireProject } from '../api.js';
-import { info, printJson } from '../util.js';
+import { die, info, printJson } from '../util.js';
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 export async function events(opts) {
     const api = await ApiClient.load();
     const p = await requireProject();
     const qs = [];
-    if (opts.branch)
-        qs.push(`branch=${encodeURIComponent(opts.branch)}`);
+    if (opts.branch) {
+        let id = opts.branch;
+        // An id passes through unlooked-up: a deleted branch keeps its events but leaves the branch list.
+        if (!UUID.test(id)) {
+            const { branches } = await api.request('GET', `/projects/${p.projectId}/branches`);
+            const b = branches.find((x) => x.name === id);
+            if (!b)
+                die(`branch not found: ${id}`);
+            id = b.id;
+        }
+        qs.push(`branch=${encodeURIComponent(id)}`);
+    }
     if (opts.limit)
         qs.push(`limit=${opts.limit}`);
     const { events } = await api.request('GET', `/projects/${p.projectId}/events${qs.length ? `?${qs.join('&')}` : ''}`);

package/dist/commands/manifest.js

@@ -25,6 +25,13 @@ export function resourceLine(r) {
     const pg = r.kind === 'insta-db' || r.kind === 'neon' ? pgBadge(r.ref?.pgVersion) : '';
     return `    - ${resourceLabel(r)}  ${where}${pg}  [${r.status}]`;
 }
+// An origin postgres writes a root row and a default-branch row for one instance.
+export function branchResources(resources, b) {
+    const own = resources.filter((r) => r.branchId === b.id);
+    if (!b.is_default)
+        return own;
+    return resources.filter((r) => r.branchId === b.id || (r.branchId === null && !own.some((o) => o.kind === r.kind && o.name === r.name)));
+}
 // Agent-legible view of each environment's databases / storage / compute.
 export async function manifest(opts) {
     const api = await ApiClient.load();
@@ -35,8 +42,7 @@ export async function manifest(opts) {
     info(`project ${detail.project.name} (${detail.project.id}) [${detail.project.status}]`);
     for (const b of detail.branches) {
         info(`  branch ${b.name}${b.is_default ? ' *' : ''} [${b.status}]`);
-        const rs = detail.resources.filter((r) => r.branchId === b.id || (b.is_default && r.branchId === null));
-        for (const r of rs)
+        for (const r of branchResources(detail.resources, b))
             info(resourceLine(r));
     }
 }

package/dist/commands/postgres.js

@@ -3,13 +3,22 @@ import { constants as osConstants } from 'node:os';
 import { ApiClient, ApiError, requireProject } from '../api.js';
 import { info, printJson, handleApproval, relayExitCode } from '../util.js';
 import { parseVolumeGib, q, resolveSoleService } from './services.js';
-// Toggle a postgres service between scale-to-zero (the default: instance suspends when idle,
-// cold-starts on the next connection) and always-on (instance stays warm; idle RAM bills at
-// actual usage). Thin wrapper over PATCH /database/settings {scaleToZero} — insta-db-backed
-// postgres only.
-export async function dbAlwaysOn(mode, service, opts) {
-    if (mode !== 'on' && mode !== 'off')
+export function alwaysOnArgs(first, second) {
+    if (first === 'on' || first === 'off')
+        return { mode: first, service: second };
+    if (second !== undefined)
         throw new Error('mode must be on|off');
+    return { service: first };
+}
+export function alwaysOnLine(group, scaleToZero) {
+    return `postgres ${group}: always-on ${scaleToZero === false ? 'on — instance stays warm' : scaleToZero === true ? 'off — scales to zero when idle' : 'unknown — the provider did not report it'}`;
+}
+// Show or set a postgres service's idle mode: scale-to-zero (the default: instance suspends when
+// idle, cold-starts on the next connection) or always-on (instance stays warm; idle RAM bills at
+// actual usage). Reads GET /database/instance, sets PATCH /database/settings {scaleToZero} —
+// insta-db-backed postgres only.
+export async function dbAlwaysOn(first, second, opts) {
+    const { mode, service } = alwaysOnArgs(first, second);
     const api = await ApiClient.load();
     const p = await requireProject();
     const qs = new URLSearchParams();
@@ -18,7 +27,19 @@ export async function dbAlwaysOn(mode, service, opts) {
         qs.set('branch', branch);
     if (service)
         qs.set('group', service);
-    const res = await api.rawRequest('PATCH', `/projects/${p.projectId}/database/settings${qs.toString() ? `?${qs}` : ''}`, { scaleToZero: mode !== 'on' });
+    const suffix = qs.toString() ? `?${qs}` : '';
+    if (!mode) {
+        const read = await fetchDbInstance(api, p.projectId, suffix);
+        if (read.kind === 'no-instance') {
+            info(`postgres ${service ?? 'default'}: no manageable instance (this service manages its own resources)`);
+            return;
+        }
+        if (opts.json)
+            return printJson(read.body);
+        info(alwaysOnLine(service ?? 'default', read.body?.scaleToZero));
+        return;
+    }
+    const res = await api.rawRequest('PATCH', `/projects/${p.projectId}/database/settings${suffix}`, { scaleToZero: mode !== 'on' });
     if (handleApproval(res, opts.json))
         return;
     if (opts.json)

package/dist/commands/project.js

@@ -124,6 +124,16 @@ export async function projectLink(id, opts = {}) {
     await tryInstallObserve(opts.json);
     await installSkills({ cwd: process.cwd(), print: skillsPrint(opts.json) });
 }
+export async function projectRename(name, opts) {
+    const api = await ApiClient.load();
+    const projectId = opts.project ?? (await requireProject()).projectId;
+    const res = await api.rawRequest('PATCH', `/projects/${projectId}`, { name });
+    if (handleApproval(res, opts.json))
+        return;
+    if (opts.json)
+        return printJson(res.body);
+    info(`renamed project ${projectId} to ${res.body.project?.name ?? name}`);
+}
 export async function projectDelete(opts) {
     const api = await ApiClient.load();
     const projectId = opts.project ?? (await requireProject()).projectId;

package/dist/index.js

@@ -133,6 +133,7 @@ const pj = program.command('project').description('Manage projects');
 pj.command('create [name]').option('--org <id>', 'org to create under (default: personal)').option('--json').action(guard((name, o) => project.projectCreate(name, o)));
 pj.command('list').option('--org <id>').option('--json').action(guard((o) => project.projectList(o)));
 pj.command('link <id>').description('Link a project to this directory').option('--json').action(guard((id, o) => project.projectLink(id, o)));
+pj.command('rename <name>').description('Rename a project (display name only)').option('--project <id>').option('--json').action(guard((name, o) => project.projectRename(name, o)));
 pj.command('delete').option('--project <id>').option('--json').action(guard((o) => project.projectDelete(o)));
 // ---- branch ----
 const br = program.command('branch').description('Manage branch environments');
@@ -147,7 +148,7 @@ const svc = program.command('service').aliases(['services', 'svc']).description(
 // [type] [name] are optional so the command can answer "what can I add?" — a terminal is walked
 // through the dashboard's Add Service kinds, anything else gets that list back as an error
 // (resolve-service.ts). Picking Docker Image also fills in --image/--port from the answers.
-svc.command('add [type] [name]').description('Provision a service on demand (assigns a default domain for postgres/compute); with no type/name, a terminal picks from the service kinds')
+svc.command('add [type] [name]').description('Provision a service on demand (compute gets a default URL); with no type/name, a terminal picks from the service kinds')
     .option('--branch <branch>', 'target branch (default: current)')
     .option('--region <region>', 'region for postgres/compute/managed databases, e.g. us-east (see `insta config regions`)')
     .option('--public', 'storage only: serve the bucket with anonymous public-read (default private)')
@@ -213,9 +214,11 @@ sec.command('tree').description('Show secrets as project → branch → service
 // Every expression is evaluated in UTC and every time printed is UTC: a cron pinned to UTC does not
 // keep a fixed local time, so a localised column would quietly lie across a DST boundary.
 const cron = program.command('cron').description('Schedule HTTP calls on a branch — a compute service of the project, or an external URL. Expressions and every printed time are UTC');
-// The repeatable --header collector, declared once: commander needs the same reducer on create and
-// edit, and two copies is how they drift apart.
-const headerOption = (c) => c.option('--header <name=value>', 'request header, repeatable (split on the first = so a value may contain one). Values are encrypted at rest and are NEVER returned by a read — `cron show` lists header names only', (v, prev) => [...prev, v], []);
+// The repeatable --header / --secret-ref collectors, declared once: commander needs the same
+// reducers on create and edit, and two copies is how they drift apart. `--secret-ref h=` (empty
+// secret) is the removal, not a `--no-secret-ref`: commander reads a `--no-` twin as a boolean
+// negation of the whole option, so it could not carry the header name.
+const headerOption = (c) => c.option('--header <name=value>', 'non-secret request header, repeatable (split on the first = so a value may contain one). Values are encrypted at rest and are NEVER returned by a read — `cron show` lists header names only. For a credential use --secret-ref', (v, prev) => [...prev, v], []).option('--secret-ref <name=SECRET>', 'request header whose value is the project secret SECRET (set with `insta secrets set`), repeatable. The way to pass a credential: resolved at send time on every attempt, so rotating the secret takes effect on the next run with no edit to the job. User-set secrets only — platform-minted credentials (DATABASE_URL, …) do not resolve', (v, prev) => [...prev, v], []);
 cron.command('list').description('List the branch\'s cron jobs: state, expression, next UTC run and target')
     .option('--branch <branch>', 'branch (default: current)').option('--json')
     .action(guard((o) => cronCmd.cronList(o)));
@@ -229,11 +232,11 @@ headerOption(cron.command('create <name> <expression>'))
     .option('--timeout <ms>', 'request timeout, 1000..300000 ms; excludes cold start (the wake is timed separately)')
     .option('--branch <branch>', 'branch (default: current)').option('--json')
     .action(guard((name, expression, o) => cronCmd.cronCreate(name, expression, o)));
-cron.command('show <name>').description('Show one cron job: schedule, next UTC run, target, request (header NAMES only — values are write-only), retry policy and the revision an edit is conditioned on')
+cron.command('show <name>').description('Show one cron job: schedule, next UTC run, target, request (header NAMES only — literal values are write-only; a secret-backed header shows the secret it reads), retry policy and the revision an edit is conditioned on')
     .option('--branch <branch>', 'branch (default: current)').option('--json')
     .action(guard((name, o) => cronCmd.cronShow(name, o)));
 headerOption(cron.command('edit <name>'))
-    .description('Change a cron job. The request is REPLACED, not merged (header values cannot be read back, so anything --header does not re-supply is dropped — the command names what it drops). Conditioned on the revision just read: a concurrent edit fails rather than clobbering')
+    .description('Change a cron job. The request is REPLACED, not merged: literal header values cannot be read back, so any --header not re-supplied is dropped (the command names what it drops); secret refs ARE carried forward unless --header/--secret-ref names that header again — `--secret-ref <name>=` removes one. Conditioned on the revision just read: a concurrent edit fails rather than clobbering')
     .option('--expression <expr>', 'new 5-field cron expression (UTC; quote it)')
     .option('--name <new-name>', 'rename the job')
     .option('--url <url>', 'external target: an absolute http(s) URL')
@@ -435,7 +438,7 @@ pg.command('volume [service]').description("Show or grow a postgres service's pr
     .option('--size <gi>', 'new size in whole Gi, e.g. 10 (must be ≥ the current size)')
     .option('--json').option('--branch <branch>', 'branch (default: current)')
     .action(guard((service, o) => pgCmd.dbVolume(service, o)));
-pg.command('always-on <mode> [service]').description('Set a postgres service always-on (mode: on|off). on = instance stays warm, no cold starts; off = default scale-to-zero (idle instance suspends; first connection cold-starts). insta-db-backed services only')
+pg.command('always-on [mode] [service]').description('Show or set a postgres service always-on (mode: on|off; no mode = print the current setting). on = instance stays warm, no cold starts; off = default scale-to-zero (idle instance suspends; first connection cold-starts). insta-db-backed services only')
     .option('--json').option('--branch <branch>', 'branch (default: current)')
     .action(guard((mode, service, o) => pgCmd.dbAlwaysOn(mode, service, o)));
 addObservability(pg, 'db', 'postgres');

package/dist/pack.js

@@ -72,7 +72,7 @@ const ALWAYS_SKIP = new Set(['.git', '.insta']);
 // docker keeps these whatever the ignore file says; avoids a remote-only "Dockerfile not found".
 const KEPT_AT_ROOT = new Set(['Dockerfile', '.dockerignore']);
 // One global sort emits a parent before its children, since a dir name prefixes everything inside.
-function walk(root, rel, out, links, ig, files, flavour) {
+function walk(root, rel, out, links, ig, files, flavour, cap = Infinity) {
     const dirAbs = join(root, rel === '' ? '.' : rel.split('/').join(sep));
     const names = readdirSync(dirAbs).sort();
     // A nested .gitignore extends its own subtree; recompiled only where one exists. docker has none.
@@ -81,6 +81,8 @@ function walk(root, rel, out, links, ig, files, flavour) {
         ig = compileIgnore(files, 'git');
     }
     for (const name of names) {
+        if (out.length >= cap)
+            return;
         if (ALWAYS_SKIP.has(name))
             continue;
         const relPath = rel === '' ? name : `${rel}/${name}`;
@@ -98,7 +100,7 @@ function walk(root, rel, out, links, ig, files, flavour) {
                 continue;
             // Emitted whenever we descend, so a re-included child has its parent.
             out.push({ path: `${relPath}/`, mode: 0o755, size: 0, dir: true });
-            walk(root, relPath, out, links, ig, files, flavour);
+            walk(root, relPath, out, links, ig, files, flavour, cap);
         }
         else if (st.isFile()) {
             if (!keep && ig.excludes(relPath, false))
@@ -165,6 +167,14 @@ function rootIgnore(absDir) {
     const files = existsSync(join(absDir, '.gitignore')) ? [{ base: '', text: read('.gitignore') }] : [];
     return { ig: compileIgnore(files, 'git'), files, flavour: 'git' };
 }
+// .dockerignore only: the docker and flyctl lanes never read .gitignore, and `insta build` cannot know the lane.
+export function contextEntries(absDir, cap = Infinity) {
+    const entries = [];
+    const file = join(absDir, '.dockerignore');
+    const files = existsSync(file) ? [{ base: '', text: readFileSync(file, 'utf8') }] : [];
+    walk(absDir, '', entries, [], compileIgnore(files, 'docker'), files, 'docker', cap);
+    return entries;
+}
 const mib = (n) => `${(n / (1024 * 1024)).toFixed(1)} MiB`;
 // Windows has no POSIX exec bit for lstat to report, so a script packs as 0644 and the image
 // cannot run it. Same as `docker build` from Windows; say so rather than let it fail at start-up.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.1.8",
+  "version": "0.1.11",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
   "keywords": [