[jwfing]

Release insta 0.1.28 with the insta build source-archive ceiling diagnostics from #388 (SUP2-1094). Only the package and lockfile version fields change.

After approval and merge, tag the merged commit as v0.1.28 to trigger the five native binaries, checksums, and npm OIDC publishing.

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

---

Summary by cubic

Bumps the insta package version to 0.1.28 in package.json and package-lock.json, preparing the release that includes the insta build source-archive ceiling diagnostics from #388 (SUP2-1094).

After merging, tag the commit as v0.1.28 to trigger publishing of the five native binaries, checksums, and npm OIDC releases.

^{Written for commit 479190e. Summary will update on new commits.}

[cubic-dev-ai]

1 issue found across 2 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="package.json">

<violation number="1" location="package.json:3">
P2: Before pushing the `v0.1.28` tag, confirm insta-platform#388 has merged. `fetchSecretBundle` in `src/commands/secrets.ts` says its fail-open `collisions ?? []` fallback is only safe if that platform change ships first, and this PR does not mention it.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Before pushing the v0.1.28 tag, confirm insta-platform#388 has merged. fetchSecretBundle in src/commands/secrets.ts says its fail-open collisions ?? [] fallback is only safe if that platform change ships first, and this PR does not mention it.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At package.json, line 3:

<comment>Before pushing the `v0.1.28` tag, confirm insta-platform#388 has merged. `fetchSecretBundle` in `src/commands/secrets.ts` says its fail-open `collisions ?? []` fallback is only safe if that platform change ships first, and this PR does not mention it.</comment>

<file context>
@@ -1,6 +1,6 @@
 {
   "name": "insta",
-  "version": "0.1.27",
+  "version": "0.1.28",
   "type": "module",
   "description": "InstaCloud CLI — a thin client of the platform control-plane API.",
</file context>

[Fermionic-Lyu]

LGTM, Approved.