@cardelli/ambit 0.1.0 → 0.1.2

package/esm/lib/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/lib/cli.ts"],"names":[],"mappings":"AAKA,OAAO,sBAAsB,CAAC;AAiB9B,eAAO,MAAM,IAAI,GAAI,MAAM,MAAM,KAAG,MAAkC,CAAC;AACvE,eAAO,MAAM,GAAG,GAAI,MAAM,MAAM,KAAG,MAAiC,CAAC;AACrE,eAAO,MAAM,GAAG,GAAI,MAAM,MAAM,KAAG,MAAiC,CAAC;AACrE,eAAO,MAAM,KAAK,GAAI,MAAM,MAAM,KAAG,MAAmC,CAAC;AACzE,eAAO,MAAM,MAAM,GAAI,MAAM,MAAM,KAAG,MAAoC,CAAC;AAC3E,eAAO,MAAM,IAAI,GAAI,MAAM,MAAM,KAAG,MAAkC,CAAC;AACvE,eAAO,MAAM,IAAI,GAAI,MAAM,MAAM,KAAG,MAAkC,CAAC;AAMvE,eAAO,MAAM,QAAQ,GAAI,SAAS,MAAM,KAAG,IAE1C,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,KAAG,IAE5C,CAAC;AAEF,eAAO,MAAM,SAAS,GAAI,SAAS,MAAM,KAAG,IAE3C,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,KAAG,IAE5C,CAAC;AAMF,eAAO,MAAM,GAAG,GAAI,SAAS,MAAM,KAAG,KAGrC,CAAC;AAQF,qBAAa,OAAO;IAClB,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,OAAO,CAAM;IAErB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAe5B,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAI7B,IAAI,IAAI,IAAI;IASZ,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAK9B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;CAI5B;AAMD,eAAO,MAAM,MAAM,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,MAAM,CAW5D,CAAC;AAEF,eAAO,MAAM,OAAO,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,OAAO,CAG9D,CAAC;AAEF,eAAO,MAAM,UAAU,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,MAAM,CAIhE,CAAC;AAMF,eAAO,MAAM,UAAU,GAAU,MAAM,MAAM,KAAG,OAAO,CAAC,OAAO,CAO9D,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,KAAG,OAO7C,CAAC;AAMF,eAAO,MAAM,YAAY,QAAO,MAG/B,CAAC;AAEF,eAAO,MAAM,aAAa,QAAO,MAEhC,CAAC;AAEF,eAAO,MAAM,eAAe,QAAa,OAAO,CAAC,IAAI,CAOpD,CAAC;AAMF,eAAO,MAAM,QAAQ,GAAI,SAAQ,MAAU,KAAG,MAO7C,CAAC;AAMF,eAAO,MAAM,aAAa,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,OAAO,CAYpE,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/lib/cli.ts"],"names":[],"mappings":"AAKA,OAAO,sBAAsB,CAAC;AAiB9B,eAAO,MAAM,IAAI,GAAI,MAAM,MAAM,KAAG,MAAkC,CAAC;AACvE,eAAO,MAAM,GAAG,GAAI,MAAM,MAAM,KAAG,MAAiC,CAAC;AACrE,eAAO,MAAM,GAAG,GAAI,MAAM,MAAM,KAAG,MAAiC,CAAC;AACrE,eAAO,MAAM,KAAK,GAAI,MAAM,MAAM,KAAG,MAAmC,CAAC;AACzE,eAAO,MAAM,MAAM,GAAI,MAAM,MAAM,KAAG,MAAoC,CAAC;AAC3E,eAAO,MAAM,IAAI,GAAI,MAAM,MAAM,KAAG,MAAkC,CAAC;AACvE,eAAO,MAAM,IAAI,GAAI,MAAM,MAAM,KAAG,MAAkC,CAAC;AAMvE,eAAO,MAAM,QAAQ,GAAI,SAAS,MAAM,KAAG,IAE1C,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,KAAG,IAE5C,CAAC;AAEF,eAAO,MAAM,SAAS,GAAI,SAAS,MAAM,KAAG,IAE3C,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,SAAS,MAAM,KAAG,IAE5C,CAAC;AAMF,eAAO,MAAM,GAAG,GAAI,SAAS,MAAM,KAAG,KAGrC,CAAC;AAQF,qBAAa,OAAO;IAClB,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,OAAO,CAAM;IAErB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAe5B,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAI7B,IAAI,IAAI,IAAI;IASZ,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAK9B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;CAI5B;AAMD,eAAO,MAAM,MAAM,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,MAAM,CAW5D,CAAC;AAEF,eAAO,MAAM,OAAO,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,OAAO,CAG9D,CAAC;AAEF,eAAO,MAAM,UAAU,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,MAAM,CAIhE,CAAC;AAMF,eAAO,MAAM,UAAU,GAAU,MAAM,MAAM,KAAG,OAAO,CAAC,OAAO,CAO9D,CAAC;AAEF,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,KAAG,OAO7C,CAAC;AAMF,eAAO,MAAM,YAAY,QAAO,MAG/B,CAAC;AAEF,eAAO,MAAM,aAAa,QAAO,MAEhC,CAAC;AAEF,eAAO,MAAM,eAAe,QAAa,OAAO,CAAC,IAAI,CAOpD,CAAC;AAMF,eAAO,MAAM,QAAQ,GAAI,SAAQ,MAAU,KAAG,MAO7C,CAAC;AAMF,eAAO,MAAM,aAAa,GAAU,SAAS,MAAM,KAAG,OAAO,CAAC,OAAO,CASpE,CAAC"}

package/esm/lib/cli.js

@@ -161,16 +161,12 @@ export const randomId = (length = 6) => {
 // Command Exists Check
 // =============================================================================
 export const commandExists = async (command) => {
-    try {
-        const cmd = new dntShim.Deno.Command("which", {
-            args: [command],
-            stdout: "null",
-            stderr: "null",
+    const { spawn } = await import("node:child_process");
+    return new Promise((resolve) => {
+        const child = spawn("which", [command], {
+            stdio: "ignore",
         });
-        const { success } = await cmd.output();
-        return success;
-    }
-    catch {
-        return false;
-    }
+        child.on("error", () => resolve(false));
+        child.on("close", (code) => resolve(code === 0));
+    });
 };

package/esm/lib/command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/lib/command.ts"],"names":[],"mappings":"AAGA,OAAO,sBAAsB,CAAC;AAW9B,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAMD;;GAEG;AACH,eAAO,MAAM,UAAU,GACrB,MAAM,MAAM,EAAE,EACd,UAAU;IACR,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;CACtC,KACA,OAAO,CAAC,aAAa,CA8BvB,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,cAAc,GAAU,CAAC,EACpC,MAAM,MAAM,EAAE,EACd,UAAU;IACR,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,KACA,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAmBxD,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,cAAc,GACzB,OAAO,MAAM,EACb,MAAM,MAAM,EAAE,EACd,UAAU;IACR,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,KACA,OAAO,CAAC,aAAa,CAavB,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,QAAQ,GACnB,OAAO,MAAM,EACb,MAAM,MAAM,EAAE,EACd,UAAU;IACR,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,KACA,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAM9C,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EAAE,EACd,UAAU;IACR,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,KACA,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAkB5C,CAAC"}
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/lib/command.ts"],"names":[],"mappings":"AAGA,OAAO,sBAAsB,CAAC;AAU9B,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAMD;;GAEG;AACH,eAAO,MAAM,UAAU,GACrB,MAAM,MAAM,EAAE,EACd,UAAU;IACR,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;CACtC,KACA,OAAO,CAAC,aAAa,CAwCvB,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,cAAc,GAAU,CAAC,EACpC,MAAM,MAAM,EAAE,EACd,UAAU;IACR,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,KACA,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAmBxD,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,cAAc,GACzB,OAAO,MAAM,EACb,MAAM,MAAM,EAAE,EACd,UAAU;IACR,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,KACA,OAAO,CAAC,aAAa,CAavB,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,QAAQ,GACnB,OAAO,MAAM,EACb,MAAM,MAAM,EAAE,EACd,UAAU;IACR,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,KACA,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAM9C,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EAAE,EACd,UAAU;IACR,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC9B,KACA,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAkB5C,CAAC"}

package/esm/lib/command.js

@@ -2,7 +2,7 @@
 // Shell Command Helpers
 // =============================================================================
 import "../_dnt.polyfills.js";
-import * as dntShim from "../_dnt.shims.js";
+import { spawn } from "node:child_process";
 import { Spinner } from "./cli.js";
 // =============================================================================
 // Run Command
@@ -10,34 +10,41 @@ import { Spinner } from "./cli.js";
 /**
  * Run a command and capture output.
  */
-export const runCommand = async (args, options) => {
+export const runCommand = (args, options) => {
     const [cmd, ...cmdArgs] = args;
-    try {
-        const command = new dntShim.Deno.Command(cmd, {
-            args: cmdArgs,
+    return new Promise((resolve) => {
+        const child = spawn(cmd, cmdArgs, {
             cwd: options?.cwd,
-            env: options?.env,
-            stdin: options?.stdin ?? "null",
-            stdout: "piped",
-            stderr: "piped",
+            env: options?.env ? { ...process.env, ...options.env } : undefined,
+            stdio: [
+                options?.stdin === "inherit" ? "inherit" : "ignore",
+                "pipe",
+                "pipe",
+            ],
         });
-        const { code, stdout, stderr } = await command.output();
-        const decoder = new TextDecoder();
-        return {
-            success: code === 0,
-            code,
-            stdout: decoder.decode(stdout),
-            stderr: decoder.decode(stderr),
-        };
-    }
-    catch (error) {
-        return {
-            success: false,
-            code: -1,
-            stdout: "",
-            stderr: error instanceof Error ? error.message : String(error),
-        };
-    }
+        const stdout = [];
+        const stderr = [];
+        child.stdout.setEncoding("utf8");
+        child.stderr.setEncoding("utf8");
+        child.stdout.on("data", (chunk) => stdout.push(chunk));
+        child.stderr.on("data", (chunk) => stderr.push(chunk));
+        child.on("error", (error) => {
+            resolve({
+                success: false,
+                code: -1,
+                stdout: "",
+                stderr: error.message,
+            });
+        });
+        child.on("close", (code) => {
+            resolve({
+                success: code === 0,
+                code: code ?? 1,
+                stdout: stdout.join(""),
+                stderr: stderr.join(""),
+            });
+        });
+    });
 };
 // =============================================================================
 // Run Command with JSON Output
@@ -101,21 +108,19 @@ export const runQuiet = async (label, args, options) => {
 /**
  * Run a command interactively (inherits stdio).
  */
-export const runInteractive = async (args, options) => {
+export const runInteractive = (args, options) => {
     const [cmd, ...cmdArgs] = args;
-    try {
-        const command = new dntShim.Deno.Command(cmd, {
-            args: cmdArgs,
+    return new Promise((resolve) => {
+        const child = spawn(cmd, cmdArgs, {
             cwd: options?.cwd,
-            env: options?.env,
-            stdin: "inherit",
-            stdout: "inherit",
-            stderr: "inherit",
+            env: options?.env ? { ...process.env, ...options.env } : undefined,
+            stdio: "inherit",
         });
-        const { code } = await command.output();
-        return { success: code === 0, code };
-    }
-    catch {
-        return { success: false, code: -1 };
-    }
+        child.on("error", () => {
+            resolve({ success: false, code: -1 });
+        });
+        child.on("close", (code) => {
+            resolve({ success: (code ?? 1) === 0, code: code ?? 1 });
+        });
+    });
 };

package/esm/src/cli/commands/create.js

@@ -6,7 +6,8 @@ import { bold, randomId, readSecret } from "../../../lib/cli.js";
 import { createOutput } from "../../../lib/output.js";
 import { registerCommand } from "../mod.js";
 import { extractSubnet, getRouterTag } from "../../schemas/config.js";
-import { createFlyProvider, getRouterAppName } from "../../providers/fly.js";
+import { isPublicTld } from "../../guard.js";
+import { createFlyProvider, FlyDeployError, getRouterAppName, } from "../../providers/fly.js";
 import { createTailscaleProvider, enableAcceptRoutes, isAcceptRoutesEnabled, isTailscaleInstalled, waitForDevice, } from "../../providers/tailscale.js";
 import { getCredentialStore } from "../../credentials.js";
 import { resolveOrg } from "../../resolve.js";
@@ -49,10 +50,14 @@ ${bold("EXAMPLES")}
         return;
     }
     const out = createOutput(args.json);
-    const network = args._[0];
-    if (!network) {
+    const networkArg = args._[0];
+    if (!networkArg || typeof networkArg !== "string") {
         return out.die("Network Name Required. Usage: ambit create <network>");
     }
+    const network = networkArg;
+    if (isPublicTld(network)) {
+        return out.die(`"${network}" Is a Public TLD and Cannot Be Used as a Network Name`);
+    }
     const tag = args.tag || getRouterTag(network);
     const selfApprove = args["self-approve"] ?? false;
     out.blank()
@@ -164,7 +169,16 @@ ${bold("EXAMPLES")}
     out.ok("Set Router Secrets");
     const dockerDir = new URL("../../docker/router", globalThis[Symbol.for("import-meta-ponyfill-esmodule")](import.meta).url).pathname;
     out.blank().dim("Deploying Router...");
-    await fly.routerDeploy(routerAppName, dockerDir, { region });
+    try {
+        await fly.routerDeploy(routerAppName, dockerDir, { region });
+    }
+    catch (e) {
+        if (e instanceof FlyDeployError) {
+            out.dim(`  ${e.detail}`);
+            return out.die(e.message);
+        }
+        throw e;
+    }
     out.ok("Router Deployed");
     out.blank();
     const joinSpinner = out.spinner("Waiting for Router to Join Tailnet");
@@ -243,7 +257,6 @@ ${bold("EXAMPLES")}
         .dim("Control their access:")
         .dim("  https://login.tailscale.com/admin/acls/visual/general-access-rules")
         .blank();
-    // Print recommended ACL policy
     if (subnet && selfApprove) {
         out.header("Recommended Tailscale ACL Policy:")
             .blank()

package/esm/src/cli/commands/deploy.js

@@ -3,21 +3,102 @@
 // =============================================================================
 import * as dntShim from "../../../_dnt.shims.js";
 import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.27/mod.js";
+import { join } from "../../../deps/jsr.io/@std/path/1.1.4/mod.js";
 import { bold, confirm, fileExists } from "../../../lib/cli.js";
 import { createOutput } from "../../../lib/output.js";
 import { registerCommand } from "../mod.js";
-import { createFlyProvider } from "../../providers/fly.js";
+import { createFlyProvider, FlyDeployError } from "../../providers/fly.js";
 import { findRouterApp } from "../../discovery.js";
 import { resolveOrg } from "../../resolve.js";
 import { assertNotRouter, auditDeploy, scanFlyToml } from "../../guard.js";
 // =============================================================================
+// Image Mode
+// =============================================================================
+/**
+ * Generate a minimal fly.toml with http_service config for auto start/stop.
+ * Written to a temp directory and cleaned up after deploy.
+ */
+const generateServiceToml = (port) => `[http_service]\n` +
+    `  internal_port = ${port}\n` +
+    `  auto_stop_machines = "stop"\n` +
+    `  auto_start_machines = true\n` +
+    `  min_machines_running = 0\n`;
+/**
+ * Parse --main-port value. Returns the port number, or null if "none".
+ * Dies on invalid input.
+ */
+const parseMainPort = (raw, out) => {
+    if (raw === "none")
+        return null;
+    const port = Number(raw);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) {
+        out.die(`Invalid --main-port: "${raw}". Use a port number (1-65535) or "none".`);
+        return "error";
+    }
+    return port;
+};
+/** Resolve deploy config for image mode (--image). */
+const resolveImageMode = (image, mainPortRaw, out) => {
+    const mainPort = parseMainPort(mainPortRaw, out);
+    if (mainPort === "error")
+        return null;
+    const preflight = { scanned: false, warnings: [] };
+    if (mainPort !== null) {
+        const tempDir = dntShim.Deno.makeTempDirSync();
+        const configPath = join(tempDir, "fly.toml");
+        dntShim.Deno.writeTextFileSync(configPath, generateServiceToml(mainPort));
+        out.ok(`HTTP Service on Port ${mainPort} (auto start/stop)`);
+        return { image, configPath, preflight, tempDir };
+    }
+    out.info("Image Mode — No Service Config");
+    return { image, preflight };
+};
+// =============================================================================
+// Config Mode
+// =============================================================================
+/** Resolve deploy config for config mode (default — uses fly.toml). */
+const resolveConfigMode = async (explicitConfig, out) => {
+    // Determine config path: explicit --config, or auto-detect ./fly.toml
+    let configPath = explicitConfig;
+    if (!configPath && await fileExists("./fly.toml")) {
+        configPath = "./fly.toml";
+    }
+    if (!configPath) {
+        out.info("No fly.toml Found — Deploying Without Config Scan");
+        return { preflight: { scanned: false, warnings: [] } };
+    }
+    if (!(await fileExists(configPath))) {
+        out.die(`Config File Not Found: ${configPath}`);
+        return null;
+    }
+    // Pre-flight scan
+    const tomlContent = await dntShim.Deno.readTextFile(configPath);
+    const scan = scanFlyToml(tomlContent);
+    if (scan.errors.length > 0) {
+        for (const err of scan.errors) {
+            out.err(err);
+        }
+        out.die("Pre-flight Check Failed. Fix fly.toml Before Deploying.");
+        return null;
+    }
+    for (const warn of scan.warnings) {
+        out.warn(warn);
+    }
+    out.ok(`Scanned ${configPath}`);
+    return {
+        configPath,
+        preflight: { scanned: scan.scanned, warnings: scan.warnings },
+    };
+};
+// =============================================================================
 // Deploy Command
 // =============================================================================
 const deploy = async (argv) => {
     const args = parseArgs(argv, {
-        string: ["network", "org", "region", "image", "config"],
+        string: ["network", "org", "region", "image", "config", "main-port"],
         boolean: ["help", "yes", "json"],
         alias: { y: "yes" },
+        default: { "main-port": "80" },
     });
     if (args.help) {
         console.log(`
@@ -35,13 +116,14 @@ ${bold("MODES")}
     ambit deploy <app> --network <name> --image <img>   Docker image, no toml
 
 ${bold("OPTIONS")}
-  --network <name>   Custom 6PN network to target (required)
-  --org <org>        Fly.io organization slug
-  --region <region>  Primary deployment region
-  --image <img>      Docker image (mutually exclusive with --config)
-  --config <path>    fly.toml path (mutually exclusive with --image)
-  -y, --yes          Skip confirmation prompts
-  --json             Output as JSON
+  --network <name>       Custom 6PN network to target (required)
+  --org <org>            Fly.io organization slug
+  --region <region>      Primary deployment region
+  --image <img>          Docker image (mutually exclusive with --config)
+  --config <path>        fly.toml path (mutually exclusive with --image)
+  --main-port <port>     Internal port for HTTP service in image mode (default: 80, "none" to skip)
+  -y, --yes              Skip confirmation prompts
+  --json                 Output as JSON
 
 ${bold("SAFETY")}
   Always deploys with --no-public-ips and --flycast.
@@ -59,10 +141,11 @@ ${bold("EXAMPLES")}
     // ==========================================================================
     // Phase 0: Parse & Validate
     // ==========================================================================
-    const app = args._[0];
-    if (!app) {
+    const appArg = args._[0];
+    if (!appArg || typeof appArg !== "string") {
         return out.die("App Name Required. Usage: ambit deploy <app> --network <name>");
     }
+    const app = appArg;
     if (!args.network) {
         return out.die("--network Is Required");
     }
@@ -70,7 +153,7 @@ ${bold("EXAMPLES")}
         assertNotRouter(app);
     }
     catch (e) {
-        return out.die(e.message);
+        return out.die(e instanceof Error ? e.message : String(e));
     }
     if (args.image && args.config) {
         return out.die("--image and --config Are Mutually Exclusive");
@@ -128,55 +211,42 @@ ${bold("EXAMPLES")}
     }
     out.blank();
     // ==========================================================================
-    // Phase 4: Pre-flight TOML Scan
+    // Phase 4: Resolve Deploy Mode
     // ==========================================================================
     out.header("Step 4: Pre-flight Check").blank();
-    let preflight = { scanned: false, warnings: [] };
-    // Determine config path for config mode (not image mode)
-    let configPath = args.config;
-    if (!args.image) {
-        if (!configPath) {
-            // Auto-detect ./fly.toml
-            if (await fileExists("./fly.toml")) {
-                configPath = "./fly.toml";
-            }
-        }
-        if (configPath) {
-            if (!(await fileExists(configPath))) {
-                return out.die(`Config File Not Found: ${configPath}`);
-            }
-            const tomlContent = await dntShim.Deno.readTextFile(configPath);
-            const scan = scanFlyToml(tomlContent);
-            preflight = { scanned: scan.scanned, warnings: scan.warnings };
-            if (scan.errors.length > 0) {
-                for (const err of scan.errors) {
-                    out.err(err);
-                }
-                return out.die("Pre-flight Check Failed. Fix fly.toml Before Deploying.");
-            }
-            for (const warn of scan.warnings) {
-                out.warn(warn);
-            }
-            out.ok(`Scanned ${configPath}`);
-        }
-        else {
-            out.info("No fly.toml Found — Deploying Without Config Scan");
-        }
-    }
-    else {
-        out.info("Image Mode — Skipping TOML Scan");
-    }
+    const deployConfig = args.image
+        ? resolveImageMode(args.image, String(args["main-port"]), out)
+        : await resolveConfigMode(args.config, out);
+    if (!deployConfig)
+        return; // mode resolver already called out.die()
     out.blank();
     // ==========================================================================
     // Phase 5: Deploy with Enforced Flags
     // ==========================================================================
     out.header("Step 5: Deploy").blank();
     out.dim("Deploying with --no-public-ips --flycast ...");
-    await fly.deploySafe(app, {
-        image: args.image,
-        config: configPath,
-        region: args.region,
-    });
+    try {
+        await fly.deploySafe(app, {
+            image: deployConfig.image,
+            config: deployConfig.configPath,
+            region: args.region,
+        });
+    }
+    catch (e) {
+        if (e instanceof FlyDeployError) {
+            out.dim(`  ${e.detail}`);
+            return out.die(e.message);
+        }
+        throw e;
+    }
+    finally {
+        if (deployConfig.tempDir) {
+            try {
+                dntShim.Deno.removeSync(deployConfig.tempDir, { recursive: true });
+            }
+            catch { /* ignore */ }
+        }
+    }
     out.ok("Deploy Succeeded");
     out.blank();
     // ==========================================================================
@@ -202,33 +272,23 @@ ${bold("EXAMPLES")}
     // Phase 7: Result
     // ==========================================================================
     const hasIssues = audit.public_ips_released > 0 || audit.warnings.length > 0;
+    const result = {
+        app,
+        network,
+        created,
+        audit: {
+            public_ips_released: audit.public_ips_released,
+            certs_removed: audit.certs_removed,
+            flycast_allocations: audit.flycast_allocations,
+            warnings: audit.warnings,
+        },
+        preflight: deployConfig.preflight,
+    };
     if (hasIssues) {
-        out.fail("Deploy Completed with Issues", {
-            app,
-            network,
-            created,
-            audit: {
-                public_ips_released: audit.public_ips_released,
-                certs_removed: audit.certs_removed,
-                flycast_allocations: audit.flycast_allocations,
-                warnings: audit.warnings,
-            },
-            preflight,
-        });
+        out.fail("Deploy Completed with Issues", result);
     }
     else {
-        out.done({
-            app,
-            network,
-            created,
-            audit: {
-                public_ips_released: audit.public_ips_released,
-                certs_removed: audit.certs_removed,
-                flycast_allocations: audit.flycast_allocations,
-                warnings: audit.warnings,
-            },
-            preflight,
-        });
+        out.done(result);
     }
     out.blank()
         .header("=".repeat(50))

package/esm/src/cli/commands/destroy.js

@@ -6,7 +6,8 @@ import { bold, confirm } from "../../../lib/cli.js";
 import { createOutput } from "../../../lib/output.js";
 import { registerCommand } from "../mod.js";
 import { createFlyProvider } from "../../providers/fly.js";
-import { requireTailscaleProvider } from "../../credentials.js";
+import { createTailscaleProvider } from "../../providers/tailscale.js";
+import { checkDependencies } from "../../credentials.js";
 import { findRouterApp } from "../../discovery.js";
 import { resolveOrg } from "../../resolve.js";
 // =============================================================================
@@ -37,12 +38,17 @@ ${bold("OPTIONS")}
     if (!args.network) {
         return out.die("--network Is Required");
     }
+    // =========================================================================
+    // Prerequisites
+    // =========================================================================
+    const { tailscaleKey } = await checkDependencies(out);
     const fly = createFlyProvider();
-    await fly.ensureInstalled();
     await fly.ensureAuth({ interactive: !args.json });
-    const tailscale = await requireTailscaleProvider(out);
+    const tailscale = createTailscaleProvider("-", tailscaleKey);
     const org = await resolveOrg(fly, args, out);
-    // 1. Find the router app
+    // =========================================================================
+    // Discover Router
+    // =========================================================================
     const spinner = out.spinner("Discovering Router");
     const app = await findRouterApp(fly, org, args.network);
     if (!app) {
@@ -50,13 +56,15 @@ ${bold("OPTIONS")}
         return out.die(`No Router Found for Network '${args.network}'`);
     }
     spinner.success(`Found Router: ${app.appName}`);
-    // Get tailscale device to read the actual tag
     let tsDevice = null;
     try {
         tsDevice = await tailscale.getDeviceByHostname(app.appName);
     }
     catch { /* device may not exist */ }
     const tag = tsDevice?.tags?.[0] ?? null;
+    // =========================================================================
+    // Confirm
+    // =========================================================================
     out.blank()
         .header("ambit Destroy")
         .blank()
@@ -72,7 +80,9 @@ ${bold("OPTIONS")}
         }
         out.blank();
     }
-    // 2. Clean up tailscale
+    // =========================================================================
+    // Tear Down
+    // =========================================================================
     const dnsSpinner = out.spinner("Clearing Split DNS");
     try {
         await tailscale.clearSplitDns(app.network);
@@ -95,7 +105,6 @@ ${bold("OPTIONS")}
     catch {
         deviceSpinner.fail("Could Not Remove Tailscale Device");
     }
-    // 3. Destroy Fly app
     const appSpinner = out.spinner("Destroying Fly App");
     try {
         await fly.deleteApp(app.appName);
@@ -104,6 +113,9 @@ ${bold("OPTIONS")}
     catch {
         appSpinner.fail("Could Not Destroy Fly App");
     }
+    // =========================================================================
+    // Done
+    // =========================================================================
     out.done({ destroyed: true, appName: app.appName });
     out.ok("Router Destroyed");
     if (tag) {

package/esm/src/cli/commands/doctor.js

@@ -7,8 +7,8 @@ import { createOutput } from "../../../lib/output.js";
 import { runCommand } from "../../../lib/command.js";
 import { registerCommand } from "../mod.js";
 import { createFlyProvider } from "../../providers/fly.js";
-import { isAcceptRoutesEnabled, isTailscaleInstalled, } from "../../providers/tailscale.js";
-import { requireTailscaleProvider } from "../../credentials.js";
+import { createTailscaleProvider, isAcceptRoutesEnabled, isTailscaleInstalled, } from "../../providers/tailscale.js";
+import { checkDependencies } from "../../credentials.js";
 import { findRouterApp, getRouterMachineInfo, getRouterTailscaleInfo, listRouterApps, } from "../../discovery.js";
 import { resolveOrg } from "../../resolve.js";
 // =============================================================================
@@ -54,15 +54,15 @@ ${bold("CHECKS")}
         }
     };
     // =========================================================================
-    // Prerequisites (fail fast)
+    // Prerequisites
     // =========================================================================
+    const { tailscaleKey } = await checkDependencies(out);
     const fly = createFlyProvider();
-    await fly.ensureInstalled();
     await fly.ensureAuth({ interactive: !args.json });
-    const tailscale = await requireTailscaleProvider(out);
+    const tailscale = createTailscaleProvider("-", tailscaleKey);
     const org = await resolveOrg(fly, args, out);
     // =========================================================================
-    // Local checks
+    // Local Checks
     // =========================================================================
     report("Tailscale Installed", await isTailscaleInstalled(), "Install from https://tailscale.com/download");
     const tsStatus = await runCommand(["tailscale", "status", "--json"]);
@@ -77,7 +77,7 @@ ${bold("CHECKS")}
     report("Tailscale Connected", tsConnected, "Run: tailscale up");
     report("Accept Routes Enabled", await isAcceptRoutesEnabled(), "Run: sudo tailscale set --accept-routes");
     // =========================================================================
-    // Router checks
+    // Router Checks
     // =========================================================================
     if (args.network) {
         const app = await findRouterApp(fly, org, args.network);

package/esm/src/cli/commands/list.js

@@ -7,7 +7,8 @@ import { bold } from "../../../lib/cli.js";
 import { createOutput } from "../../../lib/output.js";
 import { registerCommand } from "../mod.js";
 import { createFlyProvider } from "../../providers/fly.js";
-import { requireTailscaleProvider } from "../../credentials.js";
+import { createTailscaleProvider } from "../../providers/tailscale.js";
+import { checkDependencies } from "../../credentials.js";
 import { getRouterMachineInfo, getRouterTailscaleInfo, listRouterApps, } from "../../discovery.js";
 import { resolveOrg } from "../../resolve.js";
 // =============================================================================
@@ -32,12 +33,17 @@ ${bold("OPTIONS")}
         return;
     }
     const out = createOutput(args.json);
+    // =========================================================================
+    // Prerequisites
+    // =========================================================================
+    const { tailscaleKey } = await checkDependencies(out);
     const fly = createFlyProvider();
-    await fly.ensureInstalled();
     await fly.ensureAuth({ interactive: !args.json });
-    const tailscale = await requireTailscaleProvider(out);
+    const tailscale = createTailscaleProvider("-", tailscaleKey);
     const org = await resolveOrg(fly, args, out);
-    // 1. Find all router apps
+    // =========================================================================
+    // Discover Routers
+    // =========================================================================
     const spinner = out.spinner("Discovering Routers");
     const routerApps = await listRouterApps(fly, org);
     spinner.success(`Found ${routerApps.length} Router${routerApps.length !== 1 ? "s" : ""}`);
@@ -50,14 +56,15 @@ ${bold("OPTIONS")}
         out.print();
         return;
     }
-    // 2. Get machine + tailscale state for each
     const routers = [];
     for (const app of routerApps) {
         const machine = await getRouterMachineInfo(fly, app.appName);
         const ts = await getRouterTailscaleInfo(tailscale, app.appName);
         routers.push({ ...app, machine, tailscale: ts });
     }
-    // 3. Render
+    // =========================================================================
+    // Render
+    // =========================================================================
     out.blank().header("Routers").blank();
     const rows = routers.map((r) => {
         const tsStatus = r.tailscale