chore(release): 0.0.33

[CarmenDou]

What

Bumps the version to 0.0.33 so the insta storage commands from #90 reach a released binary.

v0.0.32 was tagged before #90 merged, so the currently published CLI has no storage command group at all — insta storage list on 0.0.32 is an unknown command. Everything between the two tags is that one feature:

3ea025f Merge pull request #90 from InsForge/feat/storage-commands
97ce6d1 fix(storage): stop emitting shell syntax that only works in one shell
8c0dc72 fix(storage): exit 128+signo, and skip the mode assertion off POSIX
60803e9 fix(storage): keep the replaced file's mode, and sweep the part on Ctrl-C
d162eb9 fix(storage): download to a temp file, and quote the page hint
97b310c fix(storage): address review — Windows paths, streaming, and page filters
8919437 feat(storage): browse, download, and delete a bucket's objects

How

npm version 0.0.33 --no-git-tag-version — package.json and package-lock.json only, no source change. Main is protected, so this goes through a PR before the tag, per the release flow in .claude/skills/developing-insta-cli/SKILL.md.

After merge the tag does the rest: git checkout main && git pull && git tag v0.0.33 && git push origin v0.0.33 builds the five platform binaries plus SHA256SUMS, publishes the GitHub Release, and publishes to npm over OIDC.

Verify

npm run typecheck   # clean
npm test            # 28 files, 289 passed

Run from a fresh npm ci in this worktree, not a borrowed node_modules — worth stating because a stale dependency set produces four bogus implicitly has an 'any' type errors in src/resolve-service.ts, whose callback types come from @clack/prompts. Main itself is clean.

What the release makes reachable, once installed:

insta storage list                 # keys, size, last modified; --prefix filters, --cursor pages
insta storage get <key> -o ./file  # streams from the provider through a short-lived presigned URL
insta storage delete <key>         # immediate, irreversible, gated on storage.delete

The platform routes these wrap are already on main and deployed to production.

---

Summary by cubic

Releases 0.0.33 to ship the insta storage command group from #90. v0.0.32 lacked storage commands; with 0.0.33, insta storage list|get|delete are available in the released CLI.

• Version bump only in package.json and package-lock.json; no source changes to review.
• After merge, tag v0.0.33 to publish binaries and the insta npm package.
• Users must upgrade to 0.0.33 to use insta storage; no config changes required.

^{Written for commit 9d4b3c9. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}

[jwfing]

Review: chore(release): 0.0.33

Summary: Clean, minimal version bump (0.0.32 → 0.0.33) touching only package.json and package-lock.json, with no source changes — it exists solely to cut a release that includes the insta storage command group from #90.

Requirements context

No /docs/superpowers/ spec dir in this repo; assessed against the PR description and the repo's own release flow in .claude/skills/developing-insta-cli/SKILL.md. That skill documents the exact two-half release process, whose first step is "PR changing package.json version (main is protected — never commit the bump directly)." This PR is precisely that step.

Verification performed

• Bump justification is factually correct. v0.0.32 points at dcbd4ef (the #93 release merge). git merge-base --is-ancestor 3ea025f v0.0.32 returns false — the #90 storage merge (3ea025f) is not contained in v0.0.32. So the claim that the published 0.0.32 binary lacks the storage command group holds, and 0.0.33 is the first tag that will include it.
• Version is a single source of truth. The CLI resolves its version dynamically from package.json at runtime (src/index.ts:53 via resolveVersion(), and src/observe/install.ts:11). A repo-wide grep for 0.0.3x outside the package files found no hardcoded version constant — so bumping package.json/lock is sufficient; nothing else drifts.
• Lockfile is consistent. Both the root version and the "" package entry in package-lock.json were bumped (package-lock.json:3 and :9), and the diff touches only those two strings — no dependency-tree churn.

Findings

Critical — (none)

Suggestion — (none)

Information

• Software engineering: No tests accompany this PR, which is correct — it is a metadata-only version bump with no behavioral change to exercise. The feature it releases (#90) was tested and reviewed on its own.
• Functionality: Bump achieves its stated goal; verified above. No gaps.
• Security: No security surface. No dependency changes in the lockfile, no secrets touched. npm publish is over OIDC trusted publishing (no token), per the release skill.
• Performance: N/A — no runtime code changed.

Verdict

approved (informational — no Critical findings). Posting as a comment; the GitHub green-check approval remains a separate human action. After merge, follow the skill's step 2: tag v0.0.33 on main to trigger the binary + npm release.

[jwfing]

LGTM - approved.