docs(llms): surface CLI device-flow, INSTANT_TOKEN, MCP operate tools, ignored_fields, recycle claim token

[mastermanas805]

What

Updates llms.txt (the agent-facing source-of-truth) so AI agents discover capabilities that are now LIVE on prod (25233bf). Every claim was verified against api.instanode.dev and the api repo before writing — nothing invented.

Additions / corrections (before → after)

1. CLI device-flow login

• Added the missing POST /auth/cli/{id}/complete endpoint (the step the dashboard calls after browser login to close the loop — previously undocumented, the flow looked open-ended).
• Added a CLI login (instant login) bullet describing the full 4-step flow + headless PAT fallback + token resolution order.
• Corrected /auth/cli details: expires_at → expires_in; status enum approved → complete; 5min → 10min session TTL; noted the auth_url is a /login?cli_session=<id> dashboard URL.

2. Canonical bearer env var = INSTANT_TOKEN

• New sub-points under convention 3: the authenticated bearer env var is INSTANT_TOKEN (explicitly not INSTANODE_TOKEN), and on a 401 the agent path is the device-flow or a PAT in INSTANT_TOKEN — never the browser /login. (No stale INSTANODE_TOKEN references existed in the doc to scrub.)

3. MCP can operate, not just create

• New MCP server section. Lists provision/deploy/read tools, get_capabilities, get_deployment_events, and the operate set: set_vault_key, rotate_vault_key, update_deploy_env, update_stack_env, presign_storage, pause_resource, resume_resource, rotate_credentials, wake_deployment. Tool names matched exactly to the registered set in mcp/src/index.ts (e.g. create_postgres, claim_resource — not create_db/claim_token).

4. ignored_fields

• New convention 8: provision responses echo unrecognized top-level request keys in a sorted ignored_fields array. Live-verified on prod: {"name":"db","region":"nyc3","size":"large"} → "ignored_fields":["region","size"].

5. Recycle recovery claim_url

• Anonymous-tier note updated: the free_tier_recycle_requires_claim 402's claim_url is now a working tokenized link (/start?t=<jwt> → claim?t=<jwt>), not a tokenless dead-end. Live-verified on prod (the 402 envelope returns upgrade_url/claim_url carrying a real ?t= JWT).

Kept intact (unchanged)

• HARD Team gate — Team = "available soon / contact sales", not buyable/claimable.
• Finite tier limits — cross-checked against api/plans.yaml, untouched.
• Anon-deploy-via-/stacks/new example (deployments_apps=0 for anon) — untouched.

Follow-up

The openapi.json spec and the instanode-web public/llms.txt mirror will be synced in a follow-up coordinated pass — the api repo is currently locked by an open PR.

🤖 Generated with Claude Code