#373 feat(compute): public-access command and private addresses

Summary

The CLI side of compute private networking (platform InsForge/instacloud-platform#672; the plane has had it since insta-compute #413).

• insta compute public-access [on|off] [service] and insta <redis|mysql|mongodb> public-access [on|off] [service]:
  • With no mode, it prints public access and the private address the platform reports (private_host:port, plus private_fqdn). It never composes one.
  • off makes the service private-only:
    • compute: its URL answers 403 and stops waking it; only services in the same branch reach it.
    • database: *_URL stops connecting; apps use *_PRIVATE_URL.
  • Closing asks first. With no terminal, or with --json, it refuses (exit 2) unless --yes is passed. This is the same contract as insta postgres public-access off.
  • on re-opens without asking.
  • The platform's coded refusals are rewritten as CLI instructions: private_network_disabled, private_network_unavailable_in_region, no_private_name (names insta service rename), and private_name_taken.
• insta service list shows private <host>:<port> and, for a closed compute service, public off. A row with no private_host prints exactly as before.

Command surface mirrored in skills (cli-reference.md, separate PR).

Tests

• test/private-network.test.ts:
  • show;
  • off asks, declines, and refuses without --yes (TTY and --json);
  • --yes;
  • on;
  • one row per refusal code;
  • the command surfaces the mapped message;
  • list lines with and without an address.
• test/help-surface.test.ts: the managed database verb list and the compute verbs include public-access.
• Negative controls, each sabotaged in isolation; the named tests fail, and all pass after restore:
  • C1: drop the --yes gate.
  • C2: drop a code mapping.
  • C3: drop the private address from the list line.
  • C4: drop the public off badge.
• npm run typecheck and npm test pass: 2189 tests, after updating help-surface.

🤖 Generated with Claude Code

---

Summary by cubic

Adds the CLI side of compute private networking: new public-access commands for compute and managed database services, plus a private address shown in insta service list.

• insta compute public-access [on|off] [service] and insta <redis|mysql|mongodb> public-access [on|off] [service] show public access and the platform-reported private address; off makes the service private-only (compute URLs answer 403 and stop waking the service; database *_URLs stop connecting, apps use *_PRIVATE_URL), and on re-opens without asking.
• Closing asks first and requires --yes when there is no terminal or with --json; the platform's coded refusals now surface as CLI instructions (for example, a missing private name suggests insta service rename).
• insta service list shows private <host>:<port> and a public off badge for a closed compute service; rows without a private host print exactly as before.