@cardelli/ambit 0.1.0 → 0.1.1

package/esm/lib/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/lib/cli.ts"],"names":[],"mappings":"AAKA,OAAO,sBAAsB,CAAC;AAiB9B,eAAO,MAAM,IAAI,GAAI,MAAM,MAAM,KAAG,MAAkC,CAAC;AACvE,eAAO,MAAM,GAAG,GAAI,MAAM,MAAM,KAAG,MAAiC,CAAC;AACrE,eAAO,MAAM,GAAG,GAAI,MAAM,MAAM,KAAG,MAAiC,CAAC;AACrE,eAAO,MAAM,KAAK,GAAI,MAAM,MAAM,KAAG,MAAmC,CAAC;AACzE,eAAO,MAAM,MAAM,GAAI,MAAM,MAAM,KAAG,MAAoC,CAAC;AAC3E,eAAO,MAAM,IAAI,GAAI,MAAM,MAAM,KAAG,MAAkC,CAAC;AACvE,eAAO,MAAM,IAAI,GAAI,MAAM,MAAM,KAAG,MAAkC,CAAC;AAMvE,eAAO,MAAM,QAAQ,GAAI,SAAS,MAAM,KAAG,IAE1C,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,KAAG,IAE5C,CAAC;AAEF,eAAO,MAAM,SAAS,GAAI,SAAS,MAAM,KAAG,IAE3C,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,KAAG,IAE5C,CAAC;AAMF,eAAO,MAAM,GAAG,GAAI,SAAS,MAAM,KAAG,KAGrC,CAAC;AAQF,qBAAa,OAAO;IAClB,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,OAAO,CAAM;IAErB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAe5B,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAI7B,IAAI,IAAI,IAAI;IASZ,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAK9B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;CAI5B;AAMD,eAAO,MAAM,MAAM,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,MAAM,CAW5D,CAAC;AAEF,eAAO,MAAM,OAAO,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,OAAO,CAG9D,CAAC;AAEF,eAAO,MAAM,UAAU,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,MAAM,CAIhE,CAAC;AAMF,eAAO,MAAM,UAAU,GAAU,MAAM,MAAM,KAAG,OAAO,CAAC,OAAO,CAO9D,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,KAAG,OAO7C,CAAC;AAMF,eAAO,MAAM,YAAY,QAAO,MAG/B,CAAC;AAEF,eAAO,MAAM,aAAa,QAAO,MAEhC,CAAC;AAEF,eAAO,MAAM,eAAe,QAAa,OAAO,CAAC,IAAI,CAOpD,CAAC;AAMF,eAAO,MAAM,QAAQ,GAAI,SAAQ,MAAU,KAAG,MAO7C,CAAC;AAMF,eAAO,MAAM,aAAa,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,OAAO,CAYpE,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/lib/cli.ts"],"names":[],"mappings":"AAKA,OAAO,sBAAsB,CAAC;AAiB9B,eAAO,MAAM,IAAI,GAAI,MAAM,MAAM,KAAG,MAAkC,CAAC;AACvE,eAAO,MAAM,GAAG,GAAI,MAAM,MAAM,KAAG,MAAiC,CAAC;AACrE,eAAO,MAAM,GAAG,GAAI,MAAM,MAAM,KAAG,MAAiC,CAAC;AACrE,eAAO,MAAM,KAAK,GAAI,MAAM,MAAM,KAAG,MAAmC,CAAC;AACzE,eAAO,MAAM,MAAM,GAAI,MAAM,MAAM,KAAG,MAAoC,CAAC;AAC3E,eAAO,MAAM,IAAI,GAAI,MAAM,MAAM,KAAG,MAAkC,CAAC;AACvE,eAAO,MAAM,IAAI,GAAI,MAAM,MAAM,KAAG,MAAkC,CAAC;AAMvE,eAAO,MAAM,QAAQ,GAAI,SAAS,MAAM,KAAG,IAE1C,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,KAAG,IAE5C,CAAC;AAEF,eAAO,MAAM,SAAS,GAAI,SAAS,MAAM,KAAG,IAE3C,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,KAAG,IAE5C,CAAC;AAMF,eAAO,MAAM,GAAG,GAAI,SAAS,MAAM,KAAG,KAGrC,CAAC;AAQF,qBAAa,OAAO;IAClB,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,OAAO,CAAM;IAErB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAe5B,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAI7B,IAAI,IAAI,IAAI;IASZ,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAK9B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;CAI5B;AAMD,eAAO,MAAM,MAAM,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,MAAM,CAW5D,CAAC;AAEF,eAAO,MAAM,OAAO,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,OAAO,CAG9D,CAAC;AAEF,eAAO,MAAM,UAAU,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,MAAM,CAIhE,CAAC;AAMF,eAAO,MAAM,UAAU,GAAU,MAAM,MAAM,KAAG,OAAO,CAAC,OAAO,CAO9D,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,KAAG,OAO7C,CAAC;AAMF,eAAO,MAAM,YAAY,QAAO,MAG/B,CAAC;AAEF,eAAO,MAAM,aAAa,QAAO,MAEhC,CAAC;AAEF,eAAO,MAAM,eAAe,QAAa,OAAO,CAAC,IAAI,CAOpD,CAAC;AAMF,eAAO,MAAM,QAAQ,GAAI,SAAQ,MAAU,KAAG,MAO7C,CAAC;AAMF,eAAO,MAAM,aAAa,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,OAAO,CASpE,CAAC"}

package/esm/lib/cli.js

@@ -161,16 +161,12 @@ export const randomId = (length = 6) => {
 // Command Exists Check
 // =============================================================================
 export const commandExists = async (command) => {
-    try {
-        const cmd = new dntShim.Deno.Command("which", {
-            args: [command],
-            stdout: "null",
-            stderr: "null",
+    const { spawn } = await import("node:child_process");
+    return new Promise((resolve) => {
+        const child = spawn("which", [command], {
+            stdio: "ignore",
         });
-        const { success } = await cmd.output();
-        return success;
-    }
-    catch {
-        return false;
-    }
+        child.on("error", () => resolve(false));
+        child.on("close", (code) => resolve(code === 0));
+    });
 };

package/esm/lib/command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/lib/command.ts"],"names":[],"mappings":"AAGA,OAAO,sBAAsB,CAAC;AAW9B,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAMD;;GAEG;AACH,eAAO,MAAM,UAAU,GACrB,MAAM,MAAM,EAAE,EACd,UAAU;IACR,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;CACtC,KACA,OAAO,CAAC,aAAa,CA8BvB,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,cAAc,GAAU,CAAC,EACpC,MAAM,MAAM,EAAE,EACd,UAAU;IACR,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,KACA,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAmBxD,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,cAAc,GACzB,OAAO,MAAM,EACb,MAAM,MAAM,EAAE,EACd,UAAU;IACR,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,KACA,OAAO,CAAC,aAAa,CAavB,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,QAAQ,GACnB,OAAO,MAAM,EACb,MAAM,MAAM,EAAE,EACd,UAAU;IACR,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,KACA,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAM9C,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EAAE,EACd,UAAU;IACR,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,KACA,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAkB5C,CAAC"}
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/lib/command.ts"],"names":[],"mappings":"AAGA,OAAO,sBAAsB,CAAC;AAU9B,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAMD;;GAEG;AACH,eAAO,MAAM,UAAU,GACrB,MAAM,MAAM,EAAE,EACd,UAAU;IACR,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;CACtC,KACA,OAAO,CAAC,aAAa,CAwCvB,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,cAAc,GAAU,CAAC,EACpC,MAAM,MAAM,EAAE,EACd,UAAU;IACR,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,KACA,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAmBxD,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,cAAc,GACzB,OAAO,MAAM,EACb,MAAM,MAAM,EAAE,EACd,UAAU;IACR,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,KACA,OAAO,CAAC,aAAa,CAavB,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,QAAQ,GACnB,OAAO,MAAM,EACb,MAAM,MAAM,EAAE,EACd,UAAU;IACR,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,KACA,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAM9C,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EAAE,EACd,UAAU;IACR,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,KACA,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAkB5C,CAAC"}

package/esm/lib/command.js

@@ -2,7 +2,7 @@
 // Shell Command Helpers
 // =============================================================================
 import "../_dnt.polyfills.js";
-import * as dntShim from "../_dnt.shims.js";
+import { spawn } from "node:child_process";
 import { Spinner } from "./cli.js";
 // =============================================================================
 // Run Command
@@ -10,34 +10,41 @@ import { Spinner } from "./cli.js";
 /**
  * Run a command and capture output.
  */
-export const runCommand = async (args, options) => {
+export const runCommand = (args, options) => {
     const [cmd, ...cmdArgs] = args;
-    try {
-        const command = new dntShim.Deno.Command(cmd, {
-            args: cmdArgs,
+    return new Promise((resolve) => {
+        const child = spawn(cmd, cmdArgs, {
             cwd: options?.cwd,
-            env: options?.env,
-            stdin: options?.stdin ?? "null",
-            stdout: "piped",
-            stderr: "piped",
+            env: options?.env ? { ...process.env, ...options.env } : undefined,
+            stdio: [
+                options?.stdin === "inherit" ? "inherit" : "ignore",
+                "pipe",
+                "pipe",
+            ],
         });
-        const { code, stdout, stderr } = await command.output();
-        const decoder = new TextDecoder();
-        return {
-            success: code === 0,
-            code,
-            stdout: decoder.decode(stdout),
-            stderr: decoder.decode(stderr),
-        };
-    }
-    catch (error) {
-        return {
-            success: false,
-            code: -1,
-            stdout: "",
-            stderr: error instanceof Error ? error.message : String(error),
-        };
-    }
+        const stdout = [];
+        const stderr = [];
+        child.stdout.setEncoding("utf8");
+        child.stderr.setEncoding("utf8");
+        child.stdout.on("data", (chunk) => stdout.push(chunk));
+        child.stderr.on("data", (chunk) => stderr.push(chunk));
+        child.on("error", (error) => {
+            resolve({
+                success: false,
+                code: -1,
+                stdout: "",
+                stderr: error.message,
+            });
+        });
+        child.on("close", (code) => {
+            resolve({
+                success: code === 0,
+                code: code ?? 1,
+                stdout: stdout.join(""),
+                stderr: stderr.join(""),
+            });
+        });
+    });
 };
 // =============================================================================
 // Run Command with JSON Output
@@ -101,21 +108,19 @@ export const runQuiet = async (label, args, options) => {
 /**
  * Run a command interactively (inherits stdio).
  */
-export const runInteractive = async (args, options) => {
+export const runInteractive = (args, options) => {
     const [cmd, ...cmdArgs] = args;
-    try {
-        const command = new dntShim.Deno.Command(cmd, {
-            args: cmdArgs,
+    return new Promise((resolve) => {
+        const child = spawn(cmd, cmdArgs, {
             cwd: options?.cwd,
-            env: options?.env,
-            stdin: "inherit",
-            stdout: "inherit",
-            stderr: "inherit",
+            env: options?.env ? { ...process.env, ...options.env } : undefined,
+            stdio: "inherit",
         });
-        const { code } = await command.output();
-        return { success: code === 0, code };
-    }
-    catch {
-        return { success: false, code: -1 };
-    }
+        child.on("error", () => {
+            resolve({ success: false, code: -1 });
+        });
+        child.on("close", (code) => {
+            resolve({ success: (code ?? 1) === 0, code: code ?? 1 });
+        });
+    });
 };

package/esm/src/cli/commands/create.js

@@ -6,7 +6,8 @@ import { bold, randomId, readSecret } from "../../../lib/cli.js";
 import { createOutput } from "../../../lib/output.js";
 import { registerCommand } from "../mod.js";
 import { extractSubnet, getRouterTag } from "../../schemas/config.js";
-import { createFlyProvider, getRouterAppName } from "../../providers/fly.js";
+import { isPublicTld } from "../../guard.js";
+import { createFlyProvider, FlyDeployError, getRouterAppName } from "../../providers/fly.js";
 import { createTailscaleProvider, enableAcceptRoutes, isAcceptRoutesEnabled, isTailscaleInstalled, waitForDevice, } from "../../providers/tailscale.js";
 import { getCredentialStore } from "../../credentials.js";
 import { resolveOrg } from "../../resolve.js";
@@ -53,6 +54,9 @@ ${bold("EXAMPLES")}
     if (!network) {
         return out.die("Network Name Required. Usage: ambit create <network>");
     }
+    if (isPublicTld(network)) {
+        return out.die(`"${network}" Is a Public TLD and Cannot Be Used as a Network Name`);
+    }
     const tag = args.tag || getRouterTag(network);
     const selfApprove = args["self-approve"] ?? false;
     out.blank()
@@ -164,7 +168,16 @@ ${bold("EXAMPLES")}
     out.ok("Set Router Secrets");
     const dockerDir = new URL("../../docker/router", globalThis[Symbol.for("import-meta-ponyfill-esmodule")](import.meta).url).pathname;
     out.blank().dim("Deploying Router...");
-    await fly.routerDeploy(routerAppName, dockerDir, { region });
+    try {
+        await fly.routerDeploy(routerAppName, dockerDir, { region });
+    }
+    catch (e) {
+        if (e instanceof FlyDeployError) {
+            out.dim(`  ${e.detail}`);
+            return out.die(e.message);
+        }
+        throw e;
+    }
     out.ok("Router Deployed");
     out.blank();
     const joinSpinner = out.spinner("Waiting for Router to Join Tailnet");
@@ -243,7 +256,6 @@ ${bold("EXAMPLES")}
         .dim("Control their access:")
         .dim("  https://login.tailscale.com/admin/acls/visual/general-access-rules")
         .blank();
-    // Print recommended ACL policy
     if (subnet && selfApprove) {
         out.header("Recommended Tailscale ACL Policy:")
             .blank()

package/esm/src/cli/commands/deploy.js

@@ -6,7 +6,7 @@ import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.27/mod.js";
 import { bold, confirm, fileExists } from "../../../lib/cli.js";
 import { createOutput } from "../../../lib/output.js";
 import { registerCommand } from "../mod.js";
-import { createFlyProvider } from "../../providers/fly.js";
+import { createFlyProvider, FlyDeployError } from "../../providers/fly.js";
 import { findRouterApp } from "../../discovery.js";
 import { resolveOrg } from "../../resolve.js";
 import { assertNotRouter, auditDeploy, scanFlyToml } from "../../guard.js";
@@ -172,11 +172,20 @@ ${bold("EXAMPLES")}
     // ==========================================================================
     out.header("Step 5: Deploy").blank();
     out.dim("Deploying with --no-public-ips --flycast ...");
-    await fly.deploySafe(app, {
-        image: args.image,
-        config: configPath,
-        region: args.region,
-    });
+    try {
+        await fly.deploySafe(app, {
+            image: args.image,
+            config: configPath,
+            region: args.region,
+        });
+    }
+    catch (e) {
+        if (e instanceof FlyDeployError) {
+            out.dim(`  ${e.detail}`);
+            return out.die(e.message);
+        }
+        throw e;
+    }
     out.ok("Deploy Succeeded");
     out.blank();
     // ==========================================================================

package/esm/src/cli/commands/destroy.js

@@ -6,7 +6,8 @@ import { bold, confirm } from "../../../lib/cli.js";
 import { createOutput } from "../../../lib/output.js";
 import { registerCommand } from "../mod.js";
 import { createFlyProvider } from "../../providers/fly.js";
-import { requireTailscaleProvider } from "../../credentials.js";
+import { createTailscaleProvider } from "../../providers/tailscale.js";
+import { checkDependencies } from "../../credentials.js";
 import { findRouterApp } from "../../discovery.js";
 import { resolveOrg } from "../../resolve.js";
 // =============================================================================
@@ -37,12 +38,17 @@ ${bold("OPTIONS")}
     if (!args.network) {
         return out.die("--network Is Required");
     }
+    // =========================================================================
+    // Prerequisites
+    // =========================================================================
+    const { tailscaleKey } = await checkDependencies(out);
     const fly = createFlyProvider();
-    await fly.ensureInstalled();
     await fly.ensureAuth({ interactive: !args.json });
-    const tailscale = await requireTailscaleProvider(out);
+    const tailscale = createTailscaleProvider("-", tailscaleKey);
     const org = await resolveOrg(fly, args, out);
-    // 1. Find the router app
+    // =========================================================================
+    // Discover Router
+    // =========================================================================
     const spinner = out.spinner("Discovering Router");
     const app = await findRouterApp(fly, org, args.network);
     if (!app) {
@@ -50,13 +56,15 @@ ${bold("OPTIONS")}
         return out.die(`No Router Found for Network '${args.network}'`);
     }
     spinner.success(`Found Router: ${app.appName}`);
-    // Get tailscale device to read the actual tag
     let tsDevice = null;
     try {
         tsDevice = await tailscale.getDeviceByHostname(app.appName);
     }
     catch { /* device may not exist */ }
     const tag = tsDevice?.tags?.[0] ?? null;
+    // =========================================================================
+    // Confirm
+    // =========================================================================
     out.blank()
         .header("ambit Destroy")
         .blank()
@@ -72,7 +80,9 @@ ${bold("OPTIONS")}
         }
         out.blank();
     }
-    // 2. Clean up tailscale
+    // =========================================================================
+    // Tear Down
+    // =========================================================================
     const dnsSpinner = out.spinner("Clearing Split DNS");
     try {
         await tailscale.clearSplitDns(app.network);
@@ -95,7 +105,6 @@ ${bold("OPTIONS")}
     catch {
         deviceSpinner.fail("Could Not Remove Tailscale Device");
     }
-    // 3. Destroy Fly app
     const appSpinner = out.spinner("Destroying Fly App");
     try {
         await fly.deleteApp(app.appName);
@@ -104,6 +113,9 @@ ${bold("OPTIONS")}
     catch {
         appSpinner.fail("Could Not Destroy Fly App");
     }
+    // =========================================================================
+    // Done
+    // =========================================================================
     out.done({ destroyed: true, appName: app.appName });
     out.ok("Router Destroyed");
     if (tag) {

package/esm/src/cli/commands/doctor.js

@@ -7,8 +7,8 @@ import { createOutput } from "../../../lib/output.js";
 import { runCommand } from "../../../lib/command.js";
 import { registerCommand } from "../mod.js";
 import { createFlyProvider } from "../../providers/fly.js";
-import { isAcceptRoutesEnabled, isTailscaleInstalled, } from "../../providers/tailscale.js";
-import { requireTailscaleProvider } from "../../credentials.js";
+import { createTailscaleProvider, isAcceptRoutesEnabled, isTailscaleInstalled, } from "../../providers/tailscale.js";
+import { checkDependencies } from "../../credentials.js";
 import { findRouterApp, getRouterMachineInfo, getRouterTailscaleInfo, listRouterApps, } from "../../discovery.js";
 import { resolveOrg } from "../../resolve.js";
 // =============================================================================
@@ -54,15 +54,15 @@ ${bold("CHECKS")}
         }
     };
     // =========================================================================
-    // Prerequisites (fail fast)
+    // Prerequisites
     // =========================================================================
+    const { tailscaleKey } = await checkDependencies(out);
     const fly = createFlyProvider();
-    await fly.ensureInstalled();
     await fly.ensureAuth({ interactive: !args.json });
-    const tailscale = await requireTailscaleProvider(out);
+    const tailscale = createTailscaleProvider("-", tailscaleKey);
     const org = await resolveOrg(fly, args, out);
     // =========================================================================
-    // Local checks
+    // Local Checks
     // =========================================================================
     report("Tailscale Installed", await isTailscaleInstalled(), "Install from https://tailscale.com/download");
     const tsStatus = await runCommand(["tailscale", "status", "--json"]);
@@ -77,7 +77,7 @@ ${bold("CHECKS")}
     report("Tailscale Connected", tsConnected, "Run: tailscale up");
     report("Accept Routes Enabled", await isAcceptRoutesEnabled(), "Run: sudo tailscale set --accept-routes");
     // =========================================================================
-    // Router checks
+    // Router Checks
     // =========================================================================
     if (args.network) {
         const app = await findRouterApp(fly, org, args.network);

package/esm/src/cli/commands/list.js

@@ -7,7 +7,8 @@ import { bold } from "../../../lib/cli.js";
 import { createOutput } from "../../../lib/output.js";
 import { registerCommand } from "../mod.js";
 import { createFlyProvider } from "../../providers/fly.js";
-import { requireTailscaleProvider } from "../../credentials.js";
+import { createTailscaleProvider } from "../../providers/tailscale.js";
+import { checkDependencies } from "../../credentials.js";
 import { getRouterMachineInfo, getRouterTailscaleInfo, listRouterApps, } from "../../discovery.js";
 import { resolveOrg } from "../../resolve.js";
 // =============================================================================
@@ -32,12 +33,17 @@ ${bold("OPTIONS")}
         return;
     }
     const out = createOutput(args.json);
+    // =========================================================================
+    // Prerequisites
+    // =========================================================================
+    const { tailscaleKey } = await checkDependencies(out);
     const fly = createFlyProvider();
-    await fly.ensureInstalled();
     await fly.ensureAuth({ interactive: !args.json });
-    const tailscale = await requireTailscaleProvider(out);
+    const tailscale = createTailscaleProvider("-", tailscaleKey);
     const org = await resolveOrg(fly, args, out);
-    // 1. Find all router apps
+    // =========================================================================
+    // Discover Routers
+    // =========================================================================
     const spinner = out.spinner("Discovering Routers");
     const routerApps = await listRouterApps(fly, org);
     spinner.success(`Found ${routerApps.length} Router${routerApps.length !== 1 ? "s" : ""}`);
@@ -50,14 +56,15 @@ ${bold("OPTIONS")}
         out.print();
         return;
     }
-    // 2. Get machine + tailscale state for each
     const routers = [];
     for (const app of routerApps) {
         const machine = await getRouterMachineInfo(fly, app.appName);
         const ts = await getRouterTailscaleInfo(tailscale, app.appName);
         routers.push({ ...app, machine, tailscale: ts });
     }
-    // 3. Render
+    // =========================================================================
+    // Render
+    // =========================================================================
     out.blank().header("Routers").blank();
     const rows = routers.map((r) => {
         const tsStatus = r.tailscale

package/esm/src/cli/commands/status.js

@@ -7,7 +7,8 @@ import { bold } from "../../../lib/cli.js";
 import { createOutput } from "../../../lib/output.js";
 import { registerCommand } from "../mod.js";
 import { createFlyProvider } from "../../providers/fly.js";
-import { requireTailscaleProvider } from "../../credentials.js";
+import { createTailscaleProvider, } from "../../providers/tailscale.js";
+import { checkDependencies } from "../../credentials.js";
 import { findRouterApp, getRouterMachineInfo, getRouterTailscaleInfo, listRouterApps, } from "../../discovery.js";
 import { resolveOrg } from "../../resolve.js";
 // =============================================================================
@@ -36,106 +37,111 @@ ${bold("EXAMPLES")}
 `);
         return;
     }
+    // =========================================================================
+    // Prerequisites
+    // =========================================================================
+    const { tailscaleKey } = await checkDependencies(createOutput(args.json));
     const fly = createFlyProvider();
-    await fly.ensureInstalled();
     await fly.ensureAuth({ interactive: !args.json });
+    const tailscale = createTailscaleProvider("-", tailscaleKey);
+    // =========================================================================
+    // Status
+    // =========================================================================
     if (args.network) {
-        // ========================================================================
-        // Single Router Detailed View
-        // ========================================================================
-        const out = createOutput(args.json);
-        const tailscale = await requireTailscaleProvider(out);
-        const org = await resolveOrg(fly, args, out);
-        // 1. Find the router
-        const app = await findRouterApp(fly, org, args.network);
-        if (!app) {
-            return out.die(`No Router Found for Network '${args.network}'`);
-        }
-        // 2. Get machine state
-        const machine = await getRouterMachineInfo(fly, app.appName);
-        // 3. Get tailscale state
-        const ts = await getRouterTailscaleInfo(tailscale, app.appName);
-        const tag = ts?.tags?.[0] ?? null;
-        out.blank()
-            .header("ambit Status")
-            .blank()
-            .text(`  Network:       ${bold(app.network)}`)
-            .text(`  TLD:           *.${app.network}`)
-            .text(`  Tag:           ${tag ?? "unknown"}`)
-            .blank()
-            .text(`  Router App:    ${app.appName}`)
-            .text(`  Region:        ${machine?.region ?? "unknown"}`)
-            .text(`  Machine State: ${machine?.state ?? "unknown"}`)
-            .text(`  Private IP:    ${machine?.privateIp ?? "unknown"}`)
-            .text(`  SOCKS Proxy:   ${machine?.privateIp
-            ? `socks5://[${machine.privateIp}]:1080`
-            : "unknown"}`);
-        if (machine?.subnet) {
-            out.text(`  Subnet:        ${machine.subnet}`);
-        }
-        out.blank();
-        if (ts) {
-            out.text(`  Tailscale IP:  ${ts.ip}`)
-                .text(`  Online:        ${ts.online ? "yes" : "no"}`);
-        }
-        else {
-            out.text("  Tailscale:     Not Found in Tailnet");
-        }
-        out.blank();
-        out.done({
-            network: app.network,
-            router: app,
-            machine,
-            tag,
-            tailscale: ts,
-        });
-        out.print();
+        await showNetworkStatus(fly, tailscale, args);
+    }
+    else {
+        await showAllStatus(fly, tailscale, args);
+    }
+};
+// =============================================================================
+// Single Router Detailed View
+// =============================================================================
+const showNetworkStatus = async (fly, tailscale, args) => {
+    const out = createOutput(args.json);
+    const org = await resolveOrg(fly, args, out);
+    const app = await findRouterApp(fly, org, args.network);
+    if (!app) {
+        return out.die(`No Router Found for Network '${args.network}'`);
+    }
+    const machine = await getRouterMachineInfo(fly, app.appName);
+    const ts = await getRouterTailscaleInfo(tailscale, app.appName);
+    const tag = ts?.tags?.[0] ?? null;
+    out.blank()
+        .header("ambit Status")
+        .blank()
+        .text(`  Network:       ${bold(app.network)}`)
+        .text(`  TLD:           *.${app.network}`)
+        .text(`  Tag:           ${tag ?? "unknown"}`)
+        .blank()
+        .text(`  Router App:    ${app.appName}`)
+        .text(`  Region:        ${machine?.region ?? "unknown"}`)
+        .text(`  Machine State: ${machine?.state ?? "unknown"}`)
+        .text(`  Private IP:    ${machine?.privateIp ?? "unknown"}`)
+        .text(`  SOCKS Proxy:   ${machine?.privateIp
+        ? `socks5://[${machine.privateIp}]:1080`
+        : "unknown"}`);
+    if (machine?.subnet) {
+        out.text(`  Subnet:        ${machine.subnet}`);
+    }
+    out.blank();
+    if (ts) {
+        out.text(`  Tailscale IP:  ${ts.ip}`)
+            .text(`  Online:        ${ts.online ? "yes" : "no"}`);
     }
     else {
-        // ========================================================================
-        // Summary Table of All Routers
-        // ========================================================================
-        const out = createOutput(args.json);
-        const tailscale = await requireTailscaleProvider(out);
-        const org = await resolveOrg(fly, args, out);
-        // 1. Find all router apps
-        const spinner = out.spinner("Discovering Routers");
-        const routerApps = await listRouterApps(fly, org);
-        spinner.success(`Found ${routerApps.length} Router${routerApps.length !== 1 ? "s" : ""}`);
-        if (routerApps.length === 0) {
-            out.blank()
-                .text("No Routers Found.")
-                .dim("  Create one with: ambit create <network>")
-                .blank();
-            out.done({ routers: [] });
-            out.print();
-            return;
-        }
-        // 2. Get machine + tailscale state for each
-        const routers = [];
-        for (const app of routerApps) {
-            const machine = await getRouterMachineInfo(fly, app.appName);
-            const ts = await getRouterTailscaleInfo(tailscale, app.appName);
-            routers.push({ ...app, machine, tailscale: ts });
-        }
-        // 3. Render
-        out.blank().header("Router Status").blank();
-        const rows = routers.map((r) => {
-            const tsStatus = r.tailscale
-                ? r.tailscale.online ? "online" : "offline"
-                : "not found";
-            return [r.network, r.appName, r.machine?.state ?? "unknown", tsStatus];
-        });
-        const table = new Table()
-            .header(["Network", "App", "State", "Tailscale"])
-            .body(rows)
-            .indent(2)
-            .padding(2);
-        out.text(table.toString());
-        out.blank();
-        out.done({ routers });
+        out.text("  Tailscale:     Not Found in Tailnet");
+    }
+    out.blank();
+    out.done({
+        network: app.network,
+        router: app,
+        machine,
+        tag,
+        tailscale: ts,
+    });
+    out.print();
+};
+// =============================================================================
+// Summary Table of All Routers
+// =============================================================================
+const showAllStatus = async (fly, tailscale, args) => {
+    const out = createOutput(args.json);
+    const org = await resolveOrg(fly, args, out);
+    const spinner = out.spinner("Discovering Routers");
+    const routerApps = await listRouterApps(fly, org);
+    spinner.success(`Found ${routerApps.length} Router${routerApps.length !== 1 ? "s" : ""}`);
+    if (routerApps.length === 0) {
+        out.blank()
+            .text("No Routers Found.")
+            .dim("  Create one with: ambit create <network>")
+            .blank();
+        out.done({ routers: [] });
         out.print();
+        return;
     }
+    const routers = [];
+    for (const app of routerApps) {
+        const machine = await getRouterMachineInfo(fly, app.appName);
+        const ts = await getRouterTailscaleInfo(tailscale, app.appName);
+        routers.push({ ...app, machine, tailscale: ts });
+    }
+    out.blank().header("Router Status").blank();
+    const rows = routers.map((r) => {
+        const tsStatus = r.tailscale
+            ? r.tailscale.online ? "online" : "offline"
+            : "not found";
+        return [r.network, r.appName, r.machine?.state ?? "unknown", tsStatus];
+    });
+    const table = new Table()
+        .header(["Network", "App", "State", "Tailscale"])
+        .body(rows)
+        .indent(2)
+        .padding(2);
+    out.text(table.toString());
+    out.blank();
+    out.done({ routers });
+    out.print();
 };
 // =============================================================================
 // Register Command

package/esm/src/credentials.d.ts

@@ -1,13 +1,22 @@
 import "../_dnt.polyfills.js";
-import { type TailscaleProvider } from "./providers/tailscale.js";
 export interface CredentialStore {
     getTailscaleApiKey(): Promise<string | null>;
     setTailscaleApiKey(key: string): Promise<void>;
 }
 export declare const createConfigCredentialStore: () => CredentialStore;
 export declare const getCredentialStore: () => CredentialStore;
-/** Get a TailscaleProvider or die via out.die(). Respects JSON mode. */
-export declare const requireTailscaleProvider: (out: {
+/**
+ * Verify that flyctl CLI and Tailscale API key are both available.
+ * Reports ALL missing dependencies before dying, so the user can
+ * fix everything in one pass instead of hitting errors one at a time.
+ *
+ * Returns the validated Tailscale API key for explicit injection into
+ * the provider created by the caller.
+ */
+export declare const checkDependencies: (out: {
+    err(msg: string): unknown;
     die(msg: string): never;
-}) => Promise<TailscaleProvider>;
+}) => Promise<{
+    tailscaleKey: string;
+}>;
 //# sourceMappingURL=credentials.d.ts.map

package/esm/src/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/src/credentials.ts"],"names":[],"mappings":"AAGA,OAAO,sBAAsB,CAAC;AAQ9B,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,0BAA0B,CAAC;AAclC,MAAM,WAAW,eAAe;IAC9B,kBAAkB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7C,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAQD,eAAO,MAAM,2BAA2B,QAAO,eA0B9C,CAAC;AAMF,eAAO,MAAM,kBAAkB,QAAO,eAgBrC,CAAC;AAMF,wEAAwE;AACxE,eAAO,MAAM,wBAAwB,GACnC,KAAK;IAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,KAC/B,OAAO,CAAC,iBAAiB,CAS3B,CAAC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/src/credentials.ts"],"names":[],"mappings":"AAGA,OAAO,sBAAsB,CAAC;AAqB9B,MAAM,WAAW,eAAe;IAC9B,kBAAkB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7C,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAQD,eAAO,MAAM,2BAA2B,QAAO,eA0B9C,CAAC;AAMF,eAAO,MAAM,kBAAkB,QAAO,eAgBrC,CAAC;AAMF;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAC5B,KAAK;IAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAAC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,KAC1D,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,CAyBlC,CAAC"}

package/esm/src/credentials.js

@@ -4,9 +4,8 @@
 import "../_dnt.polyfills.js";
 import * as dntShim from "../_dnt.shims.js";
 import { z } from "../deps/jsr.io/@zod/zod/4.3.6/src/index.js";
-import { ensureConfigDir, fileExists } from "../lib/cli.js";
+import { commandExists, ensureConfigDir, fileExists } from "../lib/cli.js";
 import { getConfigDir } from "./schemas/config.js";
-import { createTailscaleProvider, } from "./providers/tailscale.js";
 // =============================================================================
 // Schema
 // =============================================================================
@@ -59,14 +58,32 @@ export const getCredentialStore = () => {
     };
 };
 // =============================================================================
-// Require Tailscale Provider (fail-fast)
+// Check Dependencies (batch validation)
 // =============================================================================
-/** Get a TailscaleProvider or die via out.die(). Respects JSON mode. */
-export const requireTailscaleProvider = async (out) => {
-    const store = getCredentialStore();
-    const key = await store.getTailscaleApiKey();
+/**
+ * Verify that flyctl CLI and Tailscale API key are both available.
+ * Reports ALL missing dependencies before dying, so the user can
+ * fix everything in one pass instead of hitting errors one at a time.
+ *
+ * Returns the validated Tailscale API key for explicit injection into
+ * the provider created by the caller.
+ */
+export const checkDependencies = async (out) => {
+    const errors = [];
+    if (!(await commandExists("fly"))) {
+        errors.push("Flyctl Not Found. Install from https://fly.io/docs/flyctl/install/");
+    }
+    const key = await getCredentialStore().getTailscaleApiKey();
     if (!key) {
-        return out.die("Tailscale API Key Required. Run 'ambit create' or set TAILSCALE_API_KEY");
+        errors.push("Tailscale API Key Required. Run 'ambit create' or set TAILSCALE_API_KEY");
+    }
+    if (errors.length === 1) {
+        return out.die(errors[0]);
+    }
+    if (errors.length > 1) {
+        for (const e of errors)
+            out.err(e);
+        return out.die("Missing Prerequisites");
     }
-    return createTailscaleProvider("-", key);
+    return { tailscaleKey: key };
 };

package/esm/src/guard.d.ts

@@ -1,4 +1,10 @@
+import "../_dnt.polyfills.js";
 import type { FlyProvider } from "./providers/fly.js";
+/**
+ * Returns true if the given name is a public TLD (case-insensitive).
+ * Used to prevent creating networks that would shadow real DNS.
+ */
+export declare const isPublicTld: (name: string) => boolean;
 export interface PreflightResult {
     scanned: boolean;
     errors: string[];

package/esm/src/guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/src/guard.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAMtD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAMD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAOjD;AAMD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe,CAwDhE;AAMD;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,iBAAiB,CAAC,CAwF5B"}
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/src/guard.ts"],"names":[],"mappings":"AAWA,OAAO,sBAAsB,CAAC;AAI9B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAqLtD;;;GAGG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,MAAM,KAAG,OACN,CAAC;AAMtC,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAMD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAOjD;AAMD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe,CAwDhE;AAMD;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,iBAAiB,CAAC,CAwF5B"}

package/esm/src/guard.js

@@ -9,8 +9,191 @@
 //   - auditDeploy: post-deploy check that releases public IPs and reports
 //
 // =============================================================================
+import "../_dnt.polyfills.js";
 import { parse as parseToml } from "../deps/jsr.io/@std/toml/1.0.11/mod.js";
 // =============================================================================
+// Public TLD Blocklist (source: https://data.iana.org/TLD/tlds-alpha-by-domain.txt)
+// =============================================================================
+// deno-fmt-ignore
+const PUBLIC_TLDS = new Set([
+    "aaa", "aarp", "abb", "abbott", "abbvie", "abc", "able", "abogado", "abudhabi", "ac",
+    "academy", "accenture", "accountant", "accountants", "aco", "actor", "ad", "ads",
+    "adult", "ae", "aeg", "aero", "aetna", "af", "afl", "africa", "ag", "agakhan", "agency",
+    "ai", "aig", "airbus", "airforce", "airtel", "akdn", "al", "alibaba", "alipay",
+    "allfinanz", "allstate", "ally", "alsace", "alstom", "am", "amazon", "americanexpress",
+    "americanfamily", "amex", "amfam", "amica", "amsterdam", "analytics", "android",
+    "anquan", "anz", "ao", "aol", "apartments", "app", "apple", "aq", "aquarelle", "ar",
+    "arab", "aramco", "archi", "army", "arpa", "art", "arte", "as", "asda", "asia",
+    "associates", "at", "athleta", "attorney", "au", "auction", "audi", "audible", "audio",
+    "auspost", "author", "auto", "autos", "aw", "aws", "ax", "axa", "az", "azure", "ba",
+    "baby", "baidu", "banamex", "band", "bank", "bar", "barcelona", "barclaycard",
+    "barclays", "barefoot", "bargains", "baseball", "basketball", "bauhaus", "bayern",
+    "bb", "bbc", "bbt", "bbva", "bcg", "bcn", "bd", "be", "beats", "beauty", "beer",
+    "berlin", "best", "bestbuy", "bet", "bf", "bg", "bh", "bharti", "bi", "bible", "bid",
+    "bike", "bing", "bingo", "bio", "biz", "bj", "black", "blackfriday", "blockbuster",
+    "blog", "bloomberg", "blue", "bm", "bms", "bmw", "bn", "bnpparibas", "bo", "boats",
+    "boehringer", "bofa", "bom", "bond", "boo", "book", "booking", "bosch", "bostik",
+    "boston", "bot", "boutique", "box", "br", "bradesco", "bridgestone", "broadway",
+    "broker", "brother", "brussels", "bs", "bt", "build", "builders", "business", "buy",
+    "buzz", "bv", "bw", "by", "bz", "bzh", "ca", "cab", "cafe", "cal", "call",
+    "calvinklein", "cam", "camera", "camp", "canon", "capetown", "capital", "capitalone",
+    "car", "caravan", "cards", "care", "career", "careers", "cars", "casa", "case", "cash",
+    "casino", "cat", "catering", "catholic", "cba", "cbn", "cbre", "cc", "cd", "center",
+    "ceo", "cern", "cf", "cfa", "cfd", "cg", "ch", "chanel", "channel", "charity", "chase",
+    "chat", "cheap", "chintai", "christmas", "chrome", "church", "ci", "cipriani",
+    "circle", "cisco", "citadel", "citi", "citic", "city", "ck", "cl", "claims",
+    "cleaning", "click", "clinic", "clinique", "clothing", "cloud", "club", "clubmed",
+    "cm", "cn", "co", "coach", "codes", "coffee", "college", "cologne", "com", "commbank",
+    "community", "company", "compare", "computer", "comsec", "condos", "construction",
+    "consulting", "contact", "contractors", "cooking", "cool", "coop", "corsica",
+    "country", "coupon", "coupons", "courses", "cpa", "cr", "credit", "creditcard",
+    "creditunion", "cricket", "crown", "crs", "cruise", "cruises", "cu", "cuisinella",
+    "cv", "cw", "cx", "cy", "cymru", "cyou", "cz", "dad", "dance", "data", "date",
+    "dating", "datsun", "day", "dclk", "dds", "de", "deal", "dealer", "deals", "degree",
+    "delivery", "dell", "deloitte", "delta", "democrat", "dental", "dentist", "desi",
+    "design", "dev", "dhl", "diamonds", "diet", "digital", "direct", "directory",
+    "discount", "discover", "dish", "diy", "dj", "dk", "dm", "dnp", "do", "docs", "doctor",
+    "dog", "domains", "dot", "download", "drive", "dtv", "dubai", "dupont", "durban",
+    "dvag", "dvr", "dz", "earth", "eat", "ec", "eco", "edeka", "edu", "education", "ee",
+    "eg", "email", "emerck", "energy", "engineer", "engineering", "enterprises", "epson",
+    "equipment", "er", "ericsson", "erni", "es", "esq", "estate", "et", "eu", "eurovision",
+    "eus", "events", "exchange", "expert", "exposed", "express", "extraspace", "fage",
+    "fail", "fairwinds", "faith", "family", "fan", "fans", "farm", "farmers", "fashion",
+    "fast", "fedex", "feedback", "ferrari", "ferrero", "fi", "fidelity", "fido", "film",
+    "final", "finance", "financial", "fire", "firestone", "firmdale", "fish", "fishing",
+    "fit", "fitness", "fj", "fk", "flickr", "flights", "flir", "florist", "flowers", "fly",
+    "fm", "fo", "foo", "food", "football", "ford", "forex", "forsale", "forum",
+    "foundation", "fox", "fr", "free", "fresenius", "frl", "frogans", "frontier", "ftr",
+    "fujitsu", "fun", "fund", "furniture", "futbol", "fyi", "ga", "gal", "gallery",
+    "gallo", "gallup", "game", "games", "gap", "garden", "gay", "gb", "gbiz", "gd", "gdn",
+    "ge", "gea", "gent", "genting", "george", "gf", "gg", "ggee", "gh", "gi", "gift",
+    "gifts", "gives", "giving", "gl", "glass", "gle", "global", "globo", "gm", "gmail",
+    "gmbh", "gmo", "gmx", "gn", "godaddy", "gold", "goldpoint", "golf", "goodyear",
+    "goog", "google", "gop", "got", "gov", "gp", "gq", "gr", "grainger", "graphics",
+    "gratis", "green", "gripe", "grocery", "group", "gs", "gt", "gu", "gucci", "guge",
+    "guide", "guitars", "guru", "gw", "gy", "hair", "hamburg", "hangout", "haus", "hbo",
+    "hdfc", "hdfcbank", "health", "healthcare", "help", "helsinki", "here", "hermes",
+    "hiphop", "hisamitsu", "hitachi", "hiv", "hk", "hkt", "hm", "hn", "hockey",
+    "holdings", "holiday", "homedepot", "homegoods", "homes", "homesense", "honda",
+    "horse", "hospital", "host", "hosting", "hot", "hotels", "hotmail", "house", "how",
+    "hr", "hsbc", "ht", "hu", "hughes", "hyatt", "hyundai", "ibm", "icbc", "ice", "icu",
+    "id", "ie", "ieee", "ifm", "ikano", "il", "im", "imamat", "imdb", "immo", "immobilien",
+    "in", "inc", "industries", "infiniti", "info", "ing", "ink", "institute", "insurance",
+    "insure", "int", "international", "intuit", "investments", "io", "ipiranga", "iq",
+    "ir", "irish", "is", "ismaili", "ist", "istanbul", "it", "itau", "itv", "jaguar",
+    "java", "jcb", "je", "jeep", "jetzt", "jewelry", "jio", "jll", "jm", "jmp", "jnj", "jo",
+    "jobs", "joburg", "jot", "joy", "jp", "jpmorgan", "jprs", "juegos", "juniper",
+    "kaufen", "kddi", "ke", "kerryhotels", "kerryproperties", "kfh", "kg", "kh", "ki",
+    "kia", "kids", "kim", "kindle", "kitchen", "kiwi", "km", "kn", "koeln", "komatsu",
+    "kosher", "kp", "kpmg", "kpn", "kr", "krd", "kred", "kuokgroup", "kw", "ky", "kyoto",
+    "kz", "la", "lacaixa", "lamborghini", "lamer", "land", "landrover", "lanxess",
+    "lasalle", "lat", "latino", "latrobe", "law", "lawyer", "lb", "lc", "lds", "lease",
+    "leclerc", "lefrak", "legal", "lego", "lexus", "lgbt", "li", "lidl", "life",
+    "lifeinsurance", "lifestyle", "lighting", "like", "lilly", "limited", "limo",
+    "lincoln", "link", "live", "living", "lk", "llc", "llp", "loan", "loans", "locker",
+    "locus", "lol", "london", "lotte", "lotto", "love", "lpl", "lplfinancial", "lr", "ls",
+    "lt", "ltd", "ltda", "lu", "lundbeck", "luxe", "luxury", "lv", "ly", "ma", "madrid",
+    "maif", "maison", "makeup", "man", "management", "mango", "map", "market",
+    "marketing", "markets", "marriott", "marshalls", "mattel", "mba", "mc", "mckinsey",
+    "md", "me", "med", "media", "meet", "melbourne", "meme", "memorial", "men", "menu",
+    "merckmsd", "mg", "mh", "miami", "microsoft", "mil", "mini", "mint", "mit",
+    "mitsubishi", "mk", "ml", "mlb", "mls", "mm", "mma", "mn", "mo", "mobi", "mobile",
+    "moda", "moe", "moi", "mom", "monash", "money", "monster", "mormon", "mortgage",
+    "moscow", "moto", "motorcycles", "mov", "movie", "mp", "mq", "mr", "ms", "msd", "mt",
+    "mtn", "mtr", "mu", "museum", "music", "mv", "mw", "mx", "my", "mz", "na", "nab",
+    "nagoya", "name", "navy", "nba", "nc", "ne", "nec", "net", "netbank", "netflix",
+    "network", "neustar", "new", "news", "next", "nextdirect", "nexus", "nf", "nfl", "ng",
+    "ngo", "nhk", "ni", "nico", "nike", "nikon", "ninja", "nissan", "nissay", "nl", "no",
+    "nokia", "norton", "now", "nowruz", "nowtv", "np", "nr", "nra", "nrw", "ntt", "nu",
+    "nyc", "nz", "obi", "observer", "office", "okinawa", "olayan", "olayangroup", "ollo",
+    "om", "omega", "one", "ong", "onl", "online", "ooo", "open", "oracle", "orange", "org",
+    "organic", "origins", "osaka", "otsuka", "ott", "ovh", "pa", "page", "panasonic",
+    "paris", "pars", "partners", "parts", "party", "pay", "pccw", "pe", "pet", "pf",
+    "pfizer", "pg", "ph", "pharmacy", "phd", "philips", "phone", "photo", "photography",
+    "photos", "physio", "pics", "pictet", "pictures", "pid", "pin", "ping", "pink",
+    "pioneer", "pizza", "pk", "pl", "place", "play", "playstation", "plumbing", "plus",
+    "pm", "pn", "pnc", "pohl", "poker", "politie", "porn", "post", "pr", "praxi", "press",
+    "prime", "pro", "prod", "productions", "prof", "progressive", "promo", "properties",
+    "property", "protection", "pru", "prudential", "ps", "pt", "pub", "pw", "pwc", "py",
+    "qa", "qpon", "quebec", "quest", "racing", "radio", "re", "read", "realestate",
+    "realtor", "realty", "recipes", "red", "redumbrella", "rehab", "reise", "reisen",
+    "reit", "reliance", "ren", "rent", "rentals", "repair", "report", "republican",
+    "rest", "restaurant", "review", "reviews", "rexroth", "rich", "richardli", "ricoh",
+    "ril", "rio", "rip", "ro", "rocks", "rodeo", "rogers", "room", "rs", "rsvp", "ru",
+    "rugby", "ruhr", "run", "rw", "rwe", "ryukyu", "sa", "saarland", "safe", "safety",
+    "sakura", "sale", "salon", "samsclub", "samsung", "sandvik", "sandvikcoromant",
+    "sanofi", "sap", "sarl", "sas", "save", "saxo", "sb", "sbi", "sbs", "sc", "scb",
+    "schaeffler", "schmidt", "scholarships", "school", "schule", "schwarz", "science",
+    "scot", "sd", "se", "search", "seat", "secure", "security", "seek", "select", "sener",
+    "services", "seven", "sew", "sex", "sexy", "sfr", "sg", "sh", "shangrila", "sharp",
+    "shell", "shia", "shiksha", "shoes", "shop", "shopping", "shouji", "show", "si",
+    "silk", "sina", "singles", "site", "sj", "sk", "ski", "skin", "sky", "skype", "sl",
+    "sling", "sm", "smart", "smile", "sn", "sncf", "so", "soccer", "social", "softbank",
+    "software", "sohu", "solar", "solutions", "song", "sony", "soy", "spa", "space",
+    "sport", "spot", "sr", "srl", "ss", "st", "stada", "staples", "star", "statebank",
+    "statefarm", "stc", "stcgroup", "stockholm", "storage", "store", "stream", "studio",
+    "study", "style", "su", "sucks", "supplies", "supply", "support", "surf", "surgery",
+    "suzuki", "sv", "swatch", "swiss", "sx", "sy", "sydney", "systems", "sz", "tab",
+    "taipei", "talk", "taobao", "target", "tatamotors", "tatar", "tattoo", "tax", "taxi",
+    "tc", "tci", "td", "tdk", "team", "tech", "technology", "tel", "temasek", "tennis",
+    "teva", "tf", "tg", "th", "thd", "theater", "theatre", "tiaa", "tickets", "tienda",
+    "tips", "tires", "tirol", "tj", "tjmaxx", "tjx", "tk", "tkmaxx", "tl", "tm", "tmall",
+    "tn", "to", "today", "tokyo", "tools", "top", "toray", "toshiba", "total", "tours",
+    "town", "toyota", "toys", "tr", "trade", "trading", "training", "travel", "travelers",
+    "travelersinsurance", "trust", "trv", "tt", "tube", "tui", "tunes", "tushu", "tv",
+    "tvs", "tw", "tz", "ua", "ubank", "ubs", "ug", "uk", "unicom", "university", "uno",
+    "uol", "ups", "us", "uy", "uz", "va", "vacations", "vana", "vanguard", "vc", "ve",
+    "vegas", "ventures", "verisign", "versicherung", "vet", "vg", "vi", "viajes", "video",
+    "vig", "viking", "villas", "vin", "vip", "virgin", "visa", "vision", "viva", "vivo",
+    "vlaanderen", "vn", "vodka", "volvo", "vote", "voting", "voto", "voyage", "vu",
+    "wales", "walmart", "walter", "wang", "wanggou", "watch", "watches", "weather",
+    "weatherchannel", "webcam", "weber", "website", "wed", "wedding", "weibo", "weir",
+    "wf", "whoswho", "wien", "wiki", "williamhill", "win", "windows", "wine", "winners",
+    "wme", "woodside", "work", "works", "world", "wow", "ws", "wtc", "wtf", "xbox",
+    "xerox", "xihuan", "xin", "xn--11b4c3d", "xn--1ck2e1b", "xn--1qqw23a",
+    "xn--2scrj9c", "xn--30rr7y", "xn--3bst00m", "xn--3ds443g", "xn--3e0b707e",
+    "xn--3hcrj9c", "xn--3pxu8k", "xn--42c2d9a", "xn--45br5cyl", "xn--45brj9c",
+    "xn--45q11c", "xn--4dbrk0ce", "xn--4gbrim", "xn--54b7fta0cc", "xn--55qw42g",
+    "xn--55qx5d", "xn--5su34j936bgsg", "xn--5tzm5g", "xn--6frz82g",
+    "xn--6qq986b3xl", "xn--80adxhks", "xn--80ao21a", "xn--80aqecdr1a",
+    "xn--80asehdb", "xn--80aswg", "xn--8y0a063a", "xn--90a3ac", "xn--90ae",
+    "xn--90ais", "xn--9dbq2a", "xn--9et52u", "xn--9krt00a", "xn--b4w605ferd",
+    "xn--bck1b9a5dre4c", "xn--c1avg", "xn--c2br7g", "xn--cck2b3b",
+    "xn--cckwcxetd", "xn--cg4bki", "xn--clchc0ea0b2g2a9gcd", "xn--czr694b",
+    "xn--czrs0t", "xn--czru2d", "xn--d1acj3b", "xn--d1alf", "xn--e1a4c",
+    "xn--eckvdtc9d", "xn--efvy88h", "xn--fct429k", "xn--fhbei", "xn--fiq228c5hs",
+    "xn--fiq64b", "xn--fiqs8s", "xn--fiqz9s", "xn--fjq720a", "xn--flw351e",
+    "xn--fpcrj9c3d", "xn--fzc2c9e2c", "xn--fzys8d69uvgm", "xn--g2xx48c",
+    "xn--gckr3f0f", "xn--gecrj9c", "xn--gk3at1e", "xn--h2breg3eve", "xn--h2brj9c",
+    "xn--h2brj9c8c", "xn--hxt814e", "xn--i1b6b1a6a2e", "xn--imr513n",
+    "xn--io0a7i", "xn--j1aef", "xn--j1amh", "xn--j6w193g", "xn--jlq480n2rg",
+    "xn--jvr189m", "xn--kcrx77d1x4a", "xn--kprw13d", "xn--kpry57d", "xn--kput3i",
+    "xn--l1acc", "xn--lgbbat1ad8j", "xn--mgb9awbf", "xn--mgba3a3ejt",
+    "xn--mgba3a4f16a", "xn--mgba7c0bbn0a", "xn--mgbaam7a8h", "xn--mgbab2bd",
+    "xn--mgbah1a3hjkrd", "xn--mgbai9azgqp6j", "xn--mgbayh7gpa", "xn--mgbbh1a",
+    "xn--mgbbh1a71e", "xn--mgbc0a9azcg", "xn--mgbca7dzdo", "xn--mgbcpq6gpa1a",
+    "xn--mgberp4a5d4ar", "xn--mgbgu82a", "xn--mgbi4ecexp", "xn--mgbpl2fh",
+    "xn--mgbt3dhd", "xn--mgbtx2b", "xn--mgbx4cd0ab", "xn--mix891f",
+    "xn--mk1bu44c", "xn--mxtq1m", "xn--ngbc5azd", "xn--ngbe9e0a", "xn--ngbrx",
+    "xn--node", "xn--nqv7f", "xn--nqv7fs00ema", "xn--nyqy26a", "xn--o3cw4h",
+    "xn--ogbpf8fl", "xn--otu796d", "xn--p1acf", "xn--p1ai", "xn--pgbs0dh",
+    "xn--pssy2u", "xn--q7ce6a", "xn--q9jyb4c", "xn--qcka1pmc", "xn--qxa6a",
+    "xn--qxam", "xn--rhqv96g", "xn--rovu88b", "xn--rvc1e0am3e", "xn--s9brj9c",
+    "xn--ses554g", "xn--t60b56a", "xn--tckwe", "xn--tiq49xqyj", "xn--unup4y",
+    "xn--vermgensberater-ctb", "xn--vermgensberatung-pwb", "xn--vhquv",
+    "xn--vuq861b", "xn--w4r85el8fhu5dnra", "xn--w4rs40l", "xn--wgbh1c",
+    "xn--wgbl6a", "xn--xhq521b", "xn--xkc2al3hye2a", "xn--xkc2dl3a5ee0h",
+    "xn--y9a3aq", "xn--yfro4i67o", "xn--ygbi2ammx", "xn--zfr164b", "xxx", "xyz",
+    "yachts", "yahoo", "yamaxun", "yandex", "ye", "yodobashi", "yoga", "yokohama", "you",
+    "youtube", "yt", "yun", "za", "zappos", "zara", "zero", "zip", "zm", "zone", "zuerich",
+    "zw",
+]);
+/**
+ * Returns true if the given name is a public TLD (case-insensitive).
+ * Used to prevent creating networks that would shadow real DNS.
+ */
+export const isPublicTld = (name) => PUBLIC_TLDS.has(name.toLowerCase());
+// =============================================================================
 // assertNotRouter
 // =============================================================================
 /**

package/esm/src/providers/fly.d.ts

@@ -1,5 +1,15 @@
 import "../../_dnt.polyfills.js";
 import { type FlyApp, type FlyAppInfo, type FlyIp, type FlyMachine } from "../schemas/fly.js";
+/**
+ * Thrown when a `fly deploy` command fails. Carries the raw stderr so callers
+ * can surface it through `out` (respecting JSON mode) instead of printing
+ * directly.
+ */
+export declare class FlyDeployError extends Error {
+    /** Last meaningful line from flyctl stderr. */
+    readonly detail: string;
+    constructor(app: string, stderr: string);
+}
 export type MachineSize = "shared-cpu-1x" | "shared-cpu-2x" | "shared-cpu-4x";
 export interface MachineConfig {
     size: MachineSize;

package/esm/src/providers/fly.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fly.d.ts","sourceRoot":"","sources":["../../../src/src/providers/fly.ts"],"names":[],"mappings":"AAGA,OAAO,yBAAyB,CAAC;AAajC,OAAO,EACL,KAAK,MAAM,EACX,KAAK,UAAU,EAIf,KAAK,KAAK,EAEV,KAAK,UAAU,EAMhB,MAAM,mBAAmB,CAAC;AAa3B,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,eAAe,GAAG,eAAe,CAAC;AAE9E,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,aAAa,GACxB,MAAM,WAAW,KAChB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CASlC,CAAC;AAMF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAMD,MAAM,WAAW,WAAW;IAC1B,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,UAAU,CAAC,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5C,SAAS,CACP,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACjD,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1D,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1E,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,UAAU,CACR,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC5B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,YAAY,CACV,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACvC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAChE,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;CACzD;AAMD,eAAO,MAAM,iBAAiB,QAAO,WA+bpC,CAAC;AAMF,eAAO,MAAM,gBAAgB,GAC3B,SAAS,MAAM,EACf,cAAc,MAAM,KACnB,MAEF,CAAC"}
+{"version":3,"file":"fly.d.ts","sourceRoot":"","sources":["../../../src/src/providers/fly.ts"],"names":[],"mappings":"AAGA,OAAO,yBAAyB,CAAC;AAajC,OAAO,EACL,KAAK,MAAM,EACX,KAAK,UAAU,EAIf,KAAK,KAAK,EAEV,KAAK,UAAU,EAMhB,MAAM,mBAAmB,CAAC;AAa3B;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAMxC;AAmBD,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,eAAe,GAAG,eAAe,CAAC;AAE9E,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,aAAa,GACxB,MAAM,WAAW,KAChB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CASlC,CAAC;AAMF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAMD,MAAM,WAAW,WAAW;IAC1B,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,UAAU,CAAC,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5C,SAAS,CACP,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACjD,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1D,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1E,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,UAAU,CACR,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC5B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,YAAY,CACV,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACvC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAChE,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;CACzD;AAMD,eAAO,MAAM,iBAAiB,QAAO,WA6bpC,CAAC;AAMF,eAAO,MAAM,gBAAgB,GAC3B,SAAS,MAAM,EACf,cAAc,MAAM,KACnB,MAEF,CAAC"}

package/esm/src/providers/fly.js

@@ -12,6 +12,35 @@ import { fileExists } from "../../lib/cli.js";
 // Constants
 // =============================================================================
 const ROUTER_APP_PREFIX = "ambit-";
+// =============================================================================
+// Deploy Error
+// =============================================================================
+/**
+ * Thrown when a `fly deploy` command fails. Carries the raw stderr so callers
+ * can surface it through `out` (respecting JSON mode) instead of printing
+ * directly.
+ */
+export class FlyDeployError extends Error {
+    /** Last meaningful line from flyctl stderr. */
+    detail;
+    constructor(app, stderr) {
+        const detail = extractErrorDetail(stderr);
+        super(`Deploy Failed for '${app}'`);
+        this.name = "FlyDeployError";
+        this.detail = detail;
+    }
+}
+/**
+ * Pull the last non-empty, non-decoration line from fly stderr.
+ * Fly often prints progress lines then the actual error at the end.
+ */
+const extractErrorDetail = (stderr) => {
+    const lines = stderr
+        .split("\n")
+        .map((l) => l.replace(/\x1b\[[0-9;]*m/g, "").trim())
+        .filter((l) => l.length > 0 && !l.startsWith("-->") && l !== "Error");
+    return lines[lines.length - 1] ?? "unknown error";
+};
 export const getSizeConfig = (size) => {
     switch (size) {
         case "shared-cpu-1x":
@@ -226,8 +255,7 @@ export const createFlyProvider = () => {
             }
             const result = await runCommand(args);
             if (!result.success) {
-                console.error(result.stderr);
-                return die(`Deploy Failed for '${app}'`);
+                throw new FlyDeployError(app, result.stderr);
             }
         },
         async listIps(app) {
@@ -306,8 +334,7 @@ export const createFlyProvider = () => {
             }
             const result = await runCommand(args);
             if (!result.success) {
-                console.error(result.stderr);
-                return die(`Deploy Failed for '${app}'`);
+                throw new FlyDeployError(app, result.stderr);
             }
         },
         async listCerts(app) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cardelli/ambit",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Tailscale subnet router manager for Fly.io custom networks",
   "license": "MIT",
   "module": "./esm/src/providers/fly.js",
@@ -38,6 +38,9 @@
     "./src/discovery": {
       "import": "./esm/src/discovery.js"
     },
+    "./src/guard": {
+      "import": "./esm/src/guard.js"
+    },
     "./src/resolve": {
       "import": "./esm/src/resolve.js"
     }