@cardelli/ambit 0.1.0

package/esm/src/cli/commands/create.js

@@ -0,0 +1,281 @@
+// =============================================================================
+// Create Command - Create Tailscale Subnet Router on Fly.io Custom Network
+// =============================================================================
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.27/mod.js";
+import { bold, randomId, readSecret } from "../../../lib/cli.js";
+import { createOutput } from "../../../lib/output.js";
+import { registerCommand } from "../mod.js";
+import { extractSubnet, getRouterTag } from "../../schemas/config.js";
+import { createFlyProvider, getRouterAppName } from "../../providers/fly.js";
+import { createTailscaleProvider, enableAcceptRoutes, isAcceptRoutesEnabled, isTailscaleInstalled, waitForDevice, } from "../../providers/tailscale.js";
+import { getCredentialStore } from "../../credentials.js";
+import { resolveOrg } from "../../resolve.js";
+// =============================================================================
+// Create Command
+// =============================================================================
+const create = async (argv) => {
+    const args = parseArgs(argv, {
+        string: ["org", "region", "api-key", "tag"],
+        boolean: ["help", "yes", "json", "self-approve"],
+        alias: { y: "yes" },
+    });
+    if (args.help) {
+        console.log(`
+${bold("ambit create")} - Create Tailscale Subnet Router
+
+${bold("USAGE")}
+  ambit create <network> [options]
+
+${bold("OPTIONS")}
+  --org <org>         Fly.io organization slug
+  --region <region>   Fly.io region (default: iad)
+  --api-key <key>     Tailscale API access token (tskey-api-...)
+  --tag <tag>         Tailscale ACL tag for the router (default: tag:ambit-<network>)
+  --self-approve      Approve subnet routes via API (when autoApprovers not configured)
+  -y, --yes           Skip confirmation prompts
+  --json              Output as JSON
+
+${bold("DESCRIPTION")}
+  Deploys a Tailscale subnet router onto a Fly.io custom private network.
+  The network name becomes a TLD on your tailnet:
+
+    my-app.${args._[0] || "<network>"} resolves to my-app.flycast
+
+${bold("EXAMPLES")}
+  ambit create browsers
+  ambit create browsers --org my-org --region sea
+  ambit create browsers --self-approve
+`);
+        return;
+    }
+    const out = createOutput(args.json);
+    const network = args._[0];
+    if (!network) {
+        return out.die("Network Name Required. Usage: ambit create <network>");
+    }
+    const tag = args.tag || getRouterTag(network);
+    const selfApprove = args["self-approve"] ?? false;
+    out.blank()
+        .header("=".repeat(50))
+        .header(`  ambit Create: ${network}`)
+        .header("=".repeat(50))
+        .blank();
+    // ==========================================================================
+    // Step 1: Fly.io Authentication
+    // ==========================================================================
+    out.header("Step 1: Fly.io Configuration").blank();
+    const fly = createFlyProvider();
+    await fly.ensureInstalled();
+    const email = await fly.ensureAuth({ interactive: !args.json });
+    out.ok(`Authenticated as ${email}`);
+    const org = await resolveOrg(fly, args, out);
+    const region = args.region || "iad";
+    out.ok(`Using Region: ${region}`).blank();
+    // ==========================================================================
+    // Step 2: Tailscale Configuration
+    // ==========================================================================
+    out.header("Step 2: Tailscale Configuration").blank();
+    const credentials = getCredentialStore();
+    let apiKey = args["api-key"] || (await credentials.getTailscaleApiKey());
+    if (!apiKey) {
+        if (args.json) {
+            return out.die("--api-key Is Required in JSON Mode");
+        }
+        out.dim("ambit needs an API access token (not an auth key) to manage your tailnet.")
+            .dim("Create one at: https://login.tailscale.com/admin/settings/keys")
+            .blank();
+        apiKey = await readSecret("API access token (tskey-api-...): ");
+        if (!apiKey) {
+            return out.die("Tailscale API Access Token Required");
+        }
+    }
+    if (!apiKey.startsWith("tskey-api-")) {
+        return out.die("Invalid Token Format. Expected 'tskey-api-...' (API access token, not auth key)");
+    }
+    const tailscale = createTailscaleProvider("-", apiKey);
+    const validateSpinner = out.spinner("Validating API Access Token");
+    const isValid = await tailscale.validateApiKey();
+    if (!isValid) {
+        validateSpinner.fail("Invalid API Access Token");
+        return out.die("Failed to Validate Tailscale API Access Token");
+    }
+    validateSpinner.success("API Access Token Validated");
+    await credentials.setTailscaleApiKey(apiKey);
+    // ==========================================================================
+    // Step 2.5: Check tagOwners
+    // ==========================================================================
+    const tagOwnerSpinner = out.spinner(`Checking tagOwners for ${tag}`);
+    const hasTagOwner = await tailscale.isTagOwnerConfigured(tag);
+    if (!hasTagOwner) {
+        tagOwnerSpinner.fail(`Tag ${tag} Not Configured in tagOwners`);
+        out.blank()
+            .text(`  The tag ${tag} does not exist in your Tailscale ACL tagOwners.`)
+            .text("  Tailscale will reject auth keys for undefined tags.")
+            .blank()
+            .text("  Add this tag in your Tailscale ACL settings:")
+            .dim("  https://login.tailscale.com/admin/acls/visual/tags")
+            .blank()
+            .dim(`    "tagOwners": { "${tag}": ["autogroup:admin"] }`)
+            .blank();
+        return out.die(`Add ${tag} to tagOwners Before Creating Router`);
+    }
+    tagOwnerSpinner.success(`Tag ${tag} Configured in tagOwners`);
+    // ==========================================================================
+    // Step 2.6: Check autoApprovers
+    // ==========================================================================
+    if (!selfApprove) {
+        const autoApproverSpinner = out.spinner("Checking autoApprovers Configuration");
+        const hasAutoApprover = await tailscale.isAutoApproverConfigured(tag);
+        if (!hasAutoApprover) {
+            autoApproverSpinner.fail("autoApprovers Not Configured");
+            out.blank()
+                .text(`  The tag ${tag} is not listed in your Tailscale ACL autoApprovers.`)
+                .text("  Routes advertised by the router will not be auto-approved.")
+                .blank()
+                .text("  Either configure autoApprovers in your Tailscale ACL policy:")
+                .dim(`    "autoApprovers": { "routes": { "fdaa:X:XXXX::/48": ["${tag}"] } }`)
+                .blank()
+                .text("  Or re-run with --self-approve to approve routes via API:")
+                .dim(`    ambit create ${network} --self-approve`)
+                .blank();
+            return out.die("Configure autoApprovers or Use --self-approve");
+        }
+        autoApproverSpinner.success("autoApprovers Configured");
+    }
+    else {
+        out.info("Self-Approve Mode: Routes Will Be Approved via API");
+    }
+    out.blank();
+    // ==========================================================================
+    // Step 3: Deploy Router on Custom 6PN
+    // ==========================================================================
+    out.header("Step 3: Deploy Subnet Router").blank();
+    const routerAppName = getRouterAppName(network, randomId(6));
+    out.info(`Creating Router App: ${routerAppName}`)
+        .info(`Custom Network: ${network}`)
+        .info(`Router Tag: ${tag}`);
+    await fly.createApp(routerAppName, org, { network });
+    out.ok(`Created App: ${routerAppName}`);
+    await fly.setSecrets(routerAppName, {
+        TAILSCALE_API_TOKEN: apiKey,
+        NETWORK_NAME: network,
+        TAILSCALE_TAGS: tag,
+    }, { stage: true });
+    out.ok("Set Router Secrets");
+    const dockerDir = new URL("../../docker/router", globalThis[Symbol.for("import-meta-ponyfill-esmodule")](import.meta).url).pathname;
+    out.blank().dim("Deploying Router...");
+    await fly.routerDeploy(routerAppName, dockerDir, { region });
+    out.ok("Router Deployed");
+    out.blank();
+    const joinSpinner = out.spinner("Waiting for Router to Join Tailnet");
+    const device = await waitForDevice(tailscale, routerAppName, 180000);
+    joinSpinner.success(`Router Joined Tailnet: ${device.addresses[0]}`);
+    const machines = await fly.listMachines(routerAppName);
+    const routerMachine = machines.find((m) => m.private_ip);
+    const subnet = routerMachine?.private_ip
+        ? extractSubnet(routerMachine.private_ip)
+        : null;
+    if (subnet) {
+        out.ok(`Subnet: ${subnet}`);
+    }
+    if (selfApprove && subnet) {
+        const approveSpinner = out.spinner("Approving Subnet Routes via API");
+        await tailscale.approveSubnetRoutes(device.id, [subnet]);
+        approveSpinner.success("Subnet Routes Approved via API");
+    }
+    if (device.advertisedRoutes && device.advertisedRoutes.length > 0) {
+        out.ok(`Routes: ${device.advertisedRoutes.join(", ")}`);
+    }
+    const dnsSpinner = out.spinner("Configuring Split DNS");
+    await tailscale.setSplitDns(network, [device.addresses[0]]);
+    dnsSpinner.success(`Split DNS Configured: *.${network} -> Router`);
+    // ==========================================================================
+    // Step 4: Local Client Configuration
+    // ==========================================================================
+    out.blank().header("Step 4: Local Client Configuration").blank();
+    if (await isTailscaleInstalled()) {
+        if (await isAcceptRoutesEnabled()) {
+            out.ok("Accept Routes Already Enabled");
+        }
+        else {
+            const routeSpinner = out.spinner("Enabling Accept Routes");
+            if (await enableAcceptRoutes()) {
+                routeSpinner.success("Accept Routes Enabled");
+            }
+            else {
+                routeSpinner.fail("Could Not Enable Accept Routes");
+                out.blank()
+                    .dim("Run Manually with Elevated Permissions:")
+                    .dim("  sudo tailscale set --accept-routes");
+            }
+        }
+    }
+    else {
+        out.warn("Tailscale CLI Not Found")
+            .dim("  Ensure Accept-Routes Is Enabled on This Device");
+    }
+    // ==========================================================================
+    // Done
+    // ==========================================================================
+    out.done({
+        network,
+        router: { appName: routerAppName, tailscaleIp: device.addresses[0] },
+        subnet: subnet || "unknown",
+        tag,
+    });
+    out.blank()
+        .header("=".repeat(50))
+        .header("  Router Created!")
+        .header("=".repeat(50))
+        .blank()
+        .text(`Any Flycast app on the "${network}" network is reachable as:`)
+        .text(`  <app-name>.${network}`)
+        .blank()
+        .text(`SOCKS5 proxy available at:`)
+        .text(`  socks5://[${routerMachine?.private_ip ?? "ROUTER_IP"}]:1080`)
+        .dim("Containers on this network can use it to reach your tailnet.")
+        .blank()
+        .dim("Deploy an app to this network:")
+        .dim(`  ambit deploy my-app --network ${network}`)
+        .blank()
+        .dim("Invite people to your tailnet:")
+        .dim("  https://login.tailscale.com/admin/users")
+        .dim("Control their access:")
+        .dim("  https://login.tailscale.com/admin/acls/visual/general-access-rules")
+        .blank();
+    // Print recommended ACL policy
+    if (subnet && selfApprove) {
+        out.header("Recommended Tailscale ACL Policy:")
+            .blank()
+            .dim("  Add these to your tailnet policy file at:")
+            .dim("  https://login.tailscale.com/admin/acls/file")
+            .blank()
+            .text(`  "tagOwners": { "${tag}": ["autogroup:admin"] }`)
+            .text(`  "autoApprovers": { "routes": { "${subnet}": ["${tag}"] } }`)
+            .blank()
+            .dim("  To restrict access, add ACL rules:")
+            .dim(`    {"action": "accept", "src": ["group:YOUR_GROUP"], "dst": ["${tag}:53"]}`)
+            .dim(`    {"action": "accept", "src": ["group:YOUR_GROUP"], "dst": ["${subnet}:*"]}`)
+            .blank();
+    }
+    else if (subnet) {
+        out.header("Recommended ACL Rules:")
+            .blank()
+            .dim("  To restrict access, add ACL rules to your policy file:")
+            .dim("  https://login.tailscale.com/admin/acls/file")
+            .blank()
+            .dim(`    {"action": "accept", "src": ["group:YOUR_GROUP"], "dst": ["${tag}:53"]}`)
+            .dim(`    {"action": "accept", "src": ["group:YOUR_GROUP"], "dst": ["${subnet}:*"]}`)
+            .blank();
+    }
+    out.print();
+};
+// =============================================================================
+// Register Command
+// =============================================================================
+registerCommand({
+    name: "create",
+    description: "Create a Tailscale subnet router on a Fly.io custom network",
+    usage: "ambit create <network> [--org <org>] [--region <region>]",
+    run: create,
+});

package/esm/src/cli/commands/deploy.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=deploy.d.ts.map

package/esm/src/cli/commands/deploy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../../../src/src/cli/commands/deploy.ts"],"names":[],"mappings":""}

package/esm/src/cli/commands/deploy.js

@@ -0,0 +1,251 @@
+// =============================================================================
+// Deploy Command - Safely Deploy a Workload App on a Custom Private Network
+// =============================================================================
+import * as dntShim from "../../../_dnt.shims.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.27/mod.js";
+import { bold, confirm, fileExists } from "../../../lib/cli.js";
+import { createOutput } from "../../../lib/output.js";
+import { registerCommand } from "../mod.js";
+import { createFlyProvider } from "../../providers/fly.js";
+import { findRouterApp } from "../../discovery.js";
+import { resolveOrg } from "../../resolve.js";
+import { assertNotRouter, auditDeploy, scanFlyToml } from "../../guard.js";
+// =============================================================================
+// Deploy Command
+// =============================================================================
+const deploy = async (argv) => {
+    const args = parseArgs(argv, {
+        string: ["network", "org", "region", "image", "config"],
+        boolean: ["help", "yes", "json"],
+        alias: { y: "yes" },
+    });
+    if (args.help) {
+        console.log(`
+${bold("ambit deploy")} - Deploy an App Safely on a Custom Private Network
+
+${bold("USAGE")}
+  ambit deploy <app> --network <name> [options]
+
+${bold("MODES")}
+  Config mode (default):
+    ambit deploy <app> --network <name>                 Uses ./fly.toml
+    ambit deploy <app> --network <name> --config path   Explicit fly.toml
+
+  Image mode:
+    ambit deploy <app> --network <name> --image <img>   Docker image, no toml
+
+${bold("OPTIONS")}
+  --network <name>   Custom 6PN network to target (required)
+  --org <org>        Fly.io organization slug
+  --region <region>  Primary deployment region
+  --image <img>      Docker image (mutually exclusive with --config)
+  --config <path>    fly.toml path (mutually exclusive with --image)
+  -y, --yes          Skip confirmation prompts
+  --json             Output as JSON
+
+${bold("SAFETY")}
+  Always deploys with --no-public-ips and --flycast.
+  Post-deploy audit releases any public IPs and verifies Flycast allocation.
+  Pre-flight scan rejects fly.toml with force_https or TLS on 443.
+
+${bold("EXAMPLES")}
+  ambit deploy my-app --network browsers
+  ambit deploy my-app --network browsers --image registry/img:latest
+  ambit deploy my-app --network browsers --config ./fly.toml --region sea
+`);
+        return;
+    }
+    const out = createOutput(args.json);
+    // ==========================================================================
+    // Phase 0: Parse & Validate
+    // ==========================================================================
+    const app = args._[0];
+    if (!app) {
+        return out.die("App Name Required. Usage: ambit deploy <app> --network <name>");
+    }
+    if (!args.network) {
+        return out.die("--network Is Required");
+    }
+    try {
+        assertNotRouter(app);
+    }
+    catch (e) {
+        return out.die(e.message);
+    }
+    if (args.image && args.config) {
+        return out.die("--image and --config Are Mutually Exclusive");
+    }
+    const network = args.network;
+    out.blank()
+        .header("=".repeat(50))
+        .header(`  ambit Deploy: ${app}`)
+        .header("=".repeat(50))
+        .blank();
+    // ==========================================================================
+    // Phase 1: Auth & Org
+    // ==========================================================================
+    out.header("Step 1: Fly.io Configuration").blank();
+    const fly = createFlyProvider();
+    await fly.ensureInstalled();
+    const email = await fly.ensureAuth({ interactive: !args.json });
+    out.ok(`Authenticated as ${email}`);
+    const org = await resolveOrg(fly, args, out);
+    out.blank();
+    // ==========================================================================
+    // Phase 2: Network Verification
+    // ==========================================================================
+    out.header("Step 2: Network Verification").blank();
+    const routerSpinner = out.spinner("Checking for Router on Network");
+    const router = await findRouterApp(fly, org, network);
+    if (!router) {
+        routerSpinner.fail("No Router Found");
+        return out.die(`No ambit router found on network '${network}'. ` +
+            `Run 'ambit create ${network}' first.`);
+    }
+    routerSpinner.success(`Router Found: ${router.appName}`);
+    out.blank();
+    // ==========================================================================
+    // Phase 3: App Creation (if needed)
+    // ==========================================================================
+    out.header("Step 3: App Setup").blank();
+    let created = false;
+    const exists = await fly.appExists(app);
+    if (exists) {
+        out.ok(`App '${app}' Exists`);
+    }
+    else {
+        out.info(`App '${app}' Does Not Exist — Will Create on Network '${network}'`);
+        if (!args.yes && !args.json) {
+            const confirmed = await confirm(`Create app '${app}' on network '${network}'?`);
+            if (!confirmed) {
+                out.text("Cancelled.");
+                return;
+            }
+        }
+        await fly.createApp(app, org, { network });
+        out.ok(`Created App '${app}' on Network '${network}'`);
+        created = true;
+    }
+    out.blank();
+    // ==========================================================================
+    // Phase 4: Pre-flight TOML Scan
+    // ==========================================================================
+    out.header("Step 4: Pre-flight Check").blank();
+    let preflight = { scanned: false, warnings: [] };
+    // Determine config path for config mode (not image mode)
+    let configPath = args.config;
+    if (!args.image) {
+        if (!configPath) {
+            // Auto-detect ./fly.toml
+            if (await fileExists("./fly.toml")) {
+                configPath = "./fly.toml";
+            }
+        }
+        if (configPath) {
+            if (!(await fileExists(configPath))) {
+                return out.die(`Config File Not Found: ${configPath}`);
+            }
+            const tomlContent = await dntShim.Deno.readTextFile(configPath);
+            const scan = scanFlyToml(tomlContent);
+            preflight = { scanned: scan.scanned, warnings: scan.warnings };
+            if (scan.errors.length > 0) {
+                for (const err of scan.errors) {
+                    out.err(err);
+                }
+                return out.die("Pre-flight Check Failed. Fix fly.toml Before Deploying.");
+            }
+            for (const warn of scan.warnings) {
+                out.warn(warn);
+            }
+            out.ok(`Scanned ${configPath}`);
+        }
+        else {
+            out.info("No fly.toml Found — Deploying Without Config Scan");
+        }
+    }
+    else {
+        out.info("Image Mode — Skipping TOML Scan");
+    }
+    out.blank();
+    // ==========================================================================
+    // Phase 5: Deploy with Enforced Flags
+    // ==========================================================================
+    out.header("Step 5: Deploy").blank();
+    out.dim("Deploying with --no-public-ips --flycast ...");
+    await fly.deploySafe(app, {
+        image: args.image,
+        config: configPath,
+        region: args.region,
+    });
+    out.ok("Deploy Succeeded");
+    out.blank();
+    // ==========================================================================
+    // Phase 6: Post-flight Audit
+    // ==========================================================================
+    out.header("Step 6: Post-flight Audit").blank();
+    const auditSpinner = out.spinner("Auditing Deployment");
+    const audit = await auditDeploy(fly, app, network);
+    auditSpinner.success("Audit Complete");
+    if (audit.public_ips_released > 0) {
+        out.warn(`Released ${audit.public_ips_released} Public IP(s)`);
+    }
+    if (audit.certs_removed > 0) {
+        out.ok(`Removed ${audit.certs_removed} Public Certificate(s)`);
+    }
+    for (const alloc of audit.flycast_allocations) {
+        out.ok(`Flycast: ${alloc.address} (network: ${alloc.network})`);
+    }
+    for (const warn of audit.warnings) {
+        out.warn(warn);
+    }
+    // ==========================================================================
+    // Phase 7: Result
+    // ==========================================================================
+    const hasIssues = audit.public_ips_released > 0 || audit.warnings.length > 0;
+    if (hasIssues) {
+        out.fail("Deploy Completed with Issues", {
+            app,
+            network,
+            created,
+            audit: {
+                public_ips_released: audit.public_ips_released,
+                certs_removed: audit.certs_removed,
+                flycast_allocations: audit.flycast_allocations,
+                warnings: audit.warnings,
+            },
+            preflight,
+        });
+    }
+    else {
+        out.done({
+            app,
+            network,
+            created,
+            audit: {
+                public_ips_released: audit.public_ips_released,
+                certs_removed: audit.certs_removed,
+                flycast_allocations: audit.flycast_allocations,
+                warnings: audit.warnings,
+            },
+            preflight,
+        });
+    }
+    out.blank()
+        .header("=".repeat(50))
+        .header(hasIssues ? "  Deploy Completed (with warnings)" : "  Deploy Completed!")
+        .header("=".repeat(50))
+        .blank()
+        .text(`App '${app}' Is Reachable from Your Tailnet as:`)
+        .text(`  ${app}.${network}`)
+        .blank();
+    out.print();
+};
+// =============================================================================
+// Register Command
+// =============================================================================
+registerCommand({
+    name: "deploy",
+    description: "Deploy an app safely on a custom private network",
+    usage: "ambit deploy <app> --network <name> [--image <img>] [--org <org>] [--region <region>]",
+    run: deploy,
+});

package/esm/src/cli/commands/destroy.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=destroy.d.ts.map

package/esm/src/cli/commands/destroy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"destroy.d.ts","sourceRoot":"","sources":["../../../../src/src/cli/commands/destroy.ts"],"names":[],"mappings":""}

package/esm/src/cli/commands/destroy.js

@@ -0,0 +1,133 @@
+// =============================================================================
+// Destroy Command - Tear Down Router and Clean Up
+// =============================================================================
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.27/mod.js";
+import { bold, confirm } from "../../../lib/cli.js";
+import { createOutput } from "../../../lib/output.js";
+import { registerCommand } from "../mod.js";
+import { createFlyProvider } from "../../providers/fly.js";
+import { requireTailscaleProvider } from "../../credentials.js";
+import { findRouterApp } from "../../discovery.js";
+import { resolveOrg } from "../../resolve.js";
+// =============================================================================
+// Destroy Command
+// =============================================================================
+const destroy = async (argv) => {
+    const args = parseArgs(argv, {
+        string: ["network", "org"],
+        boolean: ["help", "yes", "json"],
+        alias: { y: "yes" },
+    });
+    if (args.help) {
+        console.log(`
+${bold("ambit destroy")} - Tear Down Router
+
+${bold("USAGE")}
+  ambit destroy --network <name> [--org <org>] [--yes] [--json]
+
+${bold("OPTIONS")}
+  --network <name>   Network of the router to destroy (required)
+  --org <org>        Fly.io organization slug
+  -y, --yes          Skip confirmation prompts
+  --json             Output as JSON
+`);
+        return;
+    }
+    const out = createOutput(args.json);
+    if (!args.network) {
+        return out.die("--network Is Required");
+    }
+    const fly = createFlyProvider();
+    await fly.ensureInstalled();
+    await fly.ensureAuth({ interactive: !args.json });
+    const tailscale = await requireTailscaleProvider(out);
+    const org = await resolveOrg(fly, args, out);
+    // 1. Find the router app
+    const spinner = out.spinner("Discovering Router");
+    const app = await findRouterApp(fly, org, args.network);
+    if (!app) {
+        spinner.fail("Router Not Found");
+        return out.die(`No Router Found for Network '${args.network}'`);
+    }
+    spinner.success(`Found Router: ${app.appName}`);
+    // Get tailscale device to read the actual tag
+    let tsDevice = null;
+    try {
+        tsDevice = await tailscale.getDeviceByHostname(app.appName);
+    }
+    catch { /* device may not exist */ }
+    const tag = tsDevice?.tags?.[0] ?? null;
+    out.blank()
+        .header("ambit Destroy")
+        .blank()
+        .text(`  Network:    ${app.network}`)
+        .text(`  Router App: ${app.appName}`)
+        .text(`  Tag:        ${tag ?? "unknown"}`)
+        .blank();
+    if (!args.yes && !args.json) {
+        const confirmed = await confirm("Destroy this router?");
+        if (!confirmed) {
+            out.text("Cancelled.");
+            return;
+        }
+        out.blank();
+    }
+    // 2. Clean up tailscale
+    const dnsSpinner = out.spinner("Clearing Split DNS");
+    try {
+        await tailscale.clearSplitDns(app.network);
+        dnsSpinner.success("Split DNS Cleared");
+    }
+    catch {
+        dnsSpinner.fail("Split DNS Already Cleared");
+    }
+    const deviceSpinner = out.spinner("Removing Tailscale Device");
+    try {
+        const device = await tailscale.getDeviceByHostname(app.appName);
+        if (device) {
+            await tailscale.deleteDevice(device.id);
+            deviceSpinner.success("Tailscale Device Removed");
+        }
+        else {
+            deviceSpinner.success("Tailscale Device Not Found (Already Removed)");
+        }
+    }
+    catch {
+        deviceSpinner.fail("Could Not Remove Tailscale Device");
+    }
+    // 3. Destroy Fly app
+    const appSpinner = out.spinner("Destroying Fly App");
+    try {
+        await fly.deleteApp(app.appName);
+        appSpinner.success("Fly App Destroyed");
+    }
+    catch {
+        appSpinner.fail("Could Not Destroy Fly App");
+    }
+    out.done({ destroyed: true, appName: app.appName });
+    out.ok("Router Destroyed");
+    if (tag) {
+        out.blank()
+            .dim("If you added ACL policy entries for this router, remember to remove:")
+            .dim(`  tagOwners:     ${tag}`)
+            .dim(`  autoApprovers: routes for ${tag}`)
+            .dim(`  acls:          rules referencing ${tag}`)
+            .blank();
+    }
+    else {
+        out.blank()
+            .dim("If you added ACL policy entries for this router, remember to remove")
+            .dim("the associated tag from tagOwners, autoApprovers, and acls.")
+            .blank();
+    }
+    out.print();
+};
+// =============================================================================
+// Register Command
+// =============================================================================
+registerCommand({
+    name: "destroy",
+    description: "Tear down the router, clean up DNS and tailnet device",
+    usage: "ambit destroy --network <name> [--org <org>] [--yes] [--json]",
+    run: destroy,
+});