@cardelli/ambit 0.1.3 → 0.1.5

package/esm/src/cli/commands/create.js

@@ -1,7 +1,7 @@
 // =============================================================================
 // Create Command - Create Tailscale Subnet Router on Fly.io Custom Network
 // =============================================================================
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.27/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
 import { bold, randomId, readSecret } from "../../../lib/cli.js";
 import { createOutput } from "../../../lib/output.js";
 import { registerCommand } from "../mod.js";
@@ -11,13 +11,14 @@ import { createFlyProvider, FlyDeployError, getRouterAppName, } from "../../prov
 import { createTailscaleProvider, enableAcceptRoutes, isAcceptRoutesEnabled, isTailscaleInstalled, waitForDevice, } from "../../providers/tailscale.js";
 import { getCredentialStore } from "../../credentials.js";
 import { resolveOrg } from "../../resolve.js";
+import { findRouterApp } from "../../discovery.js";
 // =============================================================================
 // Create Command
 // =============================================================================
 const create = async (argv) => {
     const args = parseArgs(argv, {
         string: ["org", "region", "api-key", "tag"],
-        boolean: ["help", "yes", "json", "self-approve"],
+        boolean: ["help", "yes", "json", "no-auto-approve"],
         alias: { y: "yes" },
     });
     if (args.help) {
@@ -32,9 +33,9 @@ ${bold("OPTIONS")}
   --region <region>   Fly.io region (default: iad)
   --api-key <key>     Tailscale API access token (tskey-api-...)
   --tag <tag>         Tailscale ACL tag for the router (default: tag:ambit-<network>)
-  --self-approve      Approve subnet routes via API (when autoApprovers not configured)
+  --no-auto-approve        Skip waiting for router and approving routes
   -y, --yes           Skip confirmation prompts
-  --json              Output as JSON
+  --json              Output as JSON (implies --no-auto-approve)
 
 ${bold("DESCRIPTION")}
   Deploys a Tailscale subnet router onto a Fly.io custom private network.
@@ -45,7 +46,6 @@ ${bold("DESCRIPTION")}
 ${bold("EXAMPLES")}
   ambit create browsers
   ambit create browsers --org my-org --region sea
-  ambit create browsers --self-approve
 `);
         return;
     }
@@ -59,7 +59,7 @@ ${bold("EXAMPLES")}
         return out.die(`"${network}" Is a Public TLD and Cannot Be Used as a Network Name`);
     }
     const tag = args.tag || getRouterTag(network);
-    const selfApprove = args["self-approve"] ?? false;
+    const shouldApprove = !(args["no-auto-approve"] || args.json);
     out.blank()
         .header("=".repeat(50))
         .header(`  ambit Create: ${network}`)
@@ -75,7 +75,13 @@ ${bold("EXAMPLES")}
     out.ok(`Authenticated as ${email}`);
     const org = await resolveOrg(fly, args, out);
     const region = args.region || "iad";
-    out.ok(`Using Region: ${region}`).blank();
+    out.ok(`Using Region: ${region}`);
+    const existingRouter = await findRouterApp(fly, org, network);
+    if (existingRouter) {
+        return out.die(`A Router Already Exists for Network "${network}": ${existingRouter.appName}. ` +
+            `Use "ambit destroy ${network}" First, or Choose a Different Network Name.`);
+    }
+    out.blank();
     // ==========================================================================
     // Step 2: Tailscale Configuration
     // ==========================================================================
@@ -86,8 +92,8 @@ ${bold("EXAMPLES")}
         if (args.json) {
             return out.die("--api-key Is Required in JSON Mode");
         }
-        out.dim("ambit needs an API access token (not an auth key) to manage your tailnet.")
-            .dim("Create one at: https://login.tailscale.com/admin/settings/keys")
+        out.dim("Ambit Needs an API Access Token (Not an Auth Key) to Manage Your Tailnet.")
+            .dim("Create One at: https://login.tailscale.com/admin/settings/keys")
             .blank();
         apiKey = await readSecret("API access token (tskey-api-...): ");
         if (!apiKey) {
@@ -114,10 +120,10 @@ ${bold("EXAMPLES")}
     if (!hasTagOwner) {
         tagOwnerSpinner.fail(`Tag ${tag} Not Configured in tagOwners`);
         out.blank()
-            .text(`  The tag ${tag} does not exist in your Tailscale ACL tagOwners.`)
-            .text("  Tailscale will reject auth keys for undefined tags.")
+            .text(`  The Tag ${tag} Does Not Exist in Your Tailscale ACL tagOwners.`)
+            .text("  Tailscale Will Reject Auth Keys for Undefined Tags.")
             .blank()
-            .text("  Add this tag in your Tailscale ACL settings:")
+            .text("  Add This Tag in Your Tailscale ACL Settings:")
             .dim("  https://login.tailscale.com/admin/acls/visual/tags")
             .blank()
             .dim(`    "tagOwners": { "${tag}": ["autogroup:admin"] }`)
@@ -125,46 +131,31 @@ ${bold("EXAMPLES")}
         return out.die(`Add ${tag} to tagOwners Before Creating Router`);
     }
     tagOwnerSpinner.success(`Tag ${tag} Configured in tagOwners`);
-    // ==========================================================================
-    // Step 2.6: Check autoApprovers
-    // ==========================================================================
-    if (!selfApprove) {
-        const autoApproverSpinner = out.spinner("Checking autoApprovers Configuration");
-        const hasAutoApprover = await tailscale.isAutoApproverConfigured(tag);
-        if (!hasAutoApprover) {
-            autoApproverSpinner.fail("autoApprovers Not Configured");
-            out.blank()
-                .text(`  The tag ${tag} is not listed in your Tailscale ACL autoApprovers.`)
-                .text("  Routes advertised by the router will not be auto-approved.")
-                .blank()
-                .text("  Either configure autoApprovers in your Tailscale ACL policy:")
-                .dim(`    "autoApprovers": { "routes": { "fdaa:X:XXXX::/48": ["${tag}"] } }`)
-                .blank()
-                .text("  Or re-run with --self-approve to approve routes via API:")
-                .dim(`    ambit create ${network} --self-approve`)
-                .blank();
-            return out.die("Configure autoApprovers or Use --self-approve");
-        }
-        autoApproverSpinner.success("autoApprovers Configured");
-    }
-    else {
-        out.info("Self-Approve Mode: Routes Will Be Approved via API");
-    }
     out.blank();
     // ==========================================================================
     // Step 3: Deploy Router on Custom 6PN
     // ==========================================================================
+    let hasAutoApprover = false;
     out.header("Step 3: Deploy Subnet Router").blank();
-    const routerAppName = getRouterAppName(network, randomId(6));
+    const suffix = randomId(8);
+    const routerAppName = getRouterAppName(network, suffix);
     out.info(`Creating Router App: ${routerAppName}`)
         .info(`Custom Network: ${network}`)
         .info(`Router Tag: ${tag}`);
     await fly.createApp(routerAppName, org, { network });
     out.ok(`Created App: ${routerAppName}`);
+    const authKeySpinner = out.spinner("Creating Tag-Scoped Auth Key");
+    const authKey = await tailscale.createAuthKey({
+        reusable: false,
+        ephemeral: false,
+        preauthorized: true,
+        tags: [tag],
+    });
+    authKeySpinner.success("Auth Key Created (Single-Use, 5min Expiry)");
     await fly.setSecrets(routerAppName, {
-        TAILSCALE_API_TOKEN: apiKey,
+        TAILSCALE_AUTHKEY: authKey,
         NETWORK_NAME: network,
-        TAILSCALE_TAGS: tag,
+        ROUTER_ID: suffix,
     }, { stage: true });
     out.ok("Set Router Secrets");
     const dockerDir = new URL("../../docker/router", globalThis[Symbol.for("import-meta-ponyfill-esmodule")](import.meta).url).pathname;
@@ -180,61 +171,79 @@ ${bold("EXAMPLES")}
         throw e;
     }
     out.ok("Router Deployed");
-    out.blank();
-    const joinSpinner = out.spinner("Waiting for Router to Join Tailnet");
-    const device = await waitForDevice(tailscale, routerAppName, 180000);
-    joinSpinner.success(`Router Joined Tailnet: ${device.addresses[0]}`);
-    const machines = await fly.listMachines(routerAppName);
-    const routerMachine = machines.find((m) => m.private_ip);
-    const subnet = routerMachine?.private_ip
-        ? extractSubnet(routerMachine.private_ip)
-        : null;
-    if (subnet) {
-        out.ok(`Subnet: ${subnet}`);
-    }
-    if (selfApprove && subnet) {
-        const approveSpinner = out.spinner("Approving Subnet Routes via API");
-        await tailscale.approveSubnetRoutes(device.id, [subnet]);
-        approveSpinner.success("Subnet Routes Approved via API");
-    }
-    if (device.advertisedRoutes && device.advertisedRoutes.length > 0) {
-        out.ok(`Routes: ${device.advertisedRoutes.join(", ")}`);
-    }
-    const dnsSpinner = out.spinner("Configuring Split DNS");
-    await tailscale.setSplitDns(network, [device.addresses[0]]);
-    dnsSpinner.success(`Split DNS Configured: *.${network} -> Router`);
     // ==========================================================================
-    // Step 4: Local Client Configuration
+    // Step 4: Wait for Router, Approve Routes, Configure DNS
     // ==========================================================================
-    out.blank().header("Step 4: Local Client Configuration").blank();
-    if (await isTailscaleInstalled()) {
-        if (await isAcceptRoutesEnabled()) {
-            out.ok("Accept Routes Already Enabled");
+    let device = null;
+    let routerMachine;
+    let subnet = null;
+    if (shouldApprove) {
+        out.blank();
+        const joinSpinner = out.spinner("Waiting for Router to Join Tailnet");
+        device = await waitForDevice(tailscale, routerAppName, 180000);
+        joinSpinner.success(`Router Joined Tailnet: ${device.addresses[0]}`);
+        const machines = await fly.listMachines(routerAppName);
+        routerMachine = machines.find((m) => m.private_ip);
+        subnet = routerMachine?.private_ip
+            ? extractSubnet(routerMachine.private_ip)
+            : null;
+        if (subnet) {
+            out.ok(`Subnet: ${subnet}`);
+            hasAutoApprover = await tailscale.isAutoApproverConfigured(tag);
+            if (!hasAutoApprover) {
+                const approveSpinner = out.spinner("Approving Subnet Routes");
+                await tailscale.approveSubnetRoutes(device.id, [subnet]);
+                approveSpinner.success("Subnet Routes Approved");
+            }
+            else {
+                out.ok("Routes Auto-Approved via ACL Policy");
+            }
         }
-        else {
-            const routeSpinner = out.spinner("Enabling Accept Routes");
-            if (await enableAcceptRoutes()) {
-                routeSpinner.success("Accept Routes Enabled");
+        if (device.advertisedRoutes && device.advertisedRoutes.length > 0) {
+            out.ok(`Routes: ${device.advertisedRoutes.join(", ")}`);
+        }
+        const dnsSpinner = out.spinner("Configuring Split DNS");
+        await tailscale.setSplitDns(network, [device.addresses[0]]);
+        dnsSpinner.success(`Split DNS Configured: *.${network} -> Router`);
+        // ========================================================================
+        // Step 5: Local Client Configuration
+        // ========================================================================
+        out.blank().header("Step 5: Local Client Configuration").blank();
+        if (await isTailscaleInstalled()) {
+            if (await isAcceptRoutesEnabled()) {
+                out.ok("Accept Routes Already Enabled");
             }
             else {
-                routeSpinner.fail("Could Not Enable Accept Routes");
-                out.blank()
-                    .dim("Run Manually with Elevated Permissions:")
-                    .dim("  sudo tailscale set --accept-routes");
+                const routeSpinner = out.spinner("Enabling Accept Routes");
+                if (await enableAcceptRoutes()) {
+                    routeSpinner.success("Accept Routes Enabled");
+                }
+                else {
+                    routeSpinner.fail("Could Not Enable Accept Routes");
+                    out.blank()
+                        .dim("Run Manually With Elevated Permissions:")
+                        .dim("  sudo tailscale set --accept-routes");
+                }
             }
         }
+        else {
+            out.warn("Tailscale CLI Not Found")
+                .dim("  Ensure Accept-Routes is Enabled on This Device");
+        }
     }
     else {
-        out.warn("Tailscale CLI Not Found")
-            .dim("  Ensure Accept-Routes Is Enabled on This Device");
+        out.blank().info("Skipping Route Approval and DNS Configuration (Use ambit doctor to Verify Later)");
     }
     // ==========================================================================
     // Done
     // ==========================================================================
     out.done({
         network,
-        router: { appName: routerAppName, tailscaleIp: device.addresses[0] },
-        subnet: subnet || "unknown",
+        router: {
+            appName: routerAppName,
+            tailscaleIp: device?.addresses[0] ?? "pending",
+        },
+        subnet: subnet || "pending",
         tag,
     });
     out.blank()
@@ -244,43 +253,48 @@ ${bold("EXAMPLES")}
         .blank()
         .text(`Any Flycast app on the "${network}" network is reachable as:`)
         .text(`  <app-name>.${network}`)
-        .blank()
-        .text(`SOCKS5 proxy available at:`)
-        .text(`  socks5://[${routerMachine?.private_ip ?? "ROUTER_IP"}]:1080`)
-        .dim("Containers on this network can use it to reach your tailnet.")
-        .blank()
-        .dim("Deploy an app to this network:")
+        .blank();
+    if (routerMachine?.private_ip) {
+        out.text("SOCKS5 Proxy Available at:")
+            .text(`  socks5://[${routerMachine.private_ip}]:1080`)
+            .dim("Containers on This Network Can Use It to Reach Your Tailnet.")
+            .blank();
+    }
+    out.dim("Deploy an App to This Network:")
         .dim(`  ambit deploy my-app --network ${network}`)
         .blank()
-        .dim("Invite people to your tailnet:")
+        .dim("Invite People to Your Tailnet:")
         .dim("  https://login.tailscale.com/admin/users")
-        .dim("Control their access:")
+        .dim("Control Their Access:")
         .dim("  https://login.tailscale.com/admin/acls/visual/general-access-rules")
         .blank();
-    if (subnet && selfApprove) {
-        out.header("Recommended Tailscale ACL Policy:")
+    if (subnet && !hasAutoApprover) {
+        out.header("Recommended: Configure autoApprovers")
             .blank()
-            .dim("  Add these to your tailnet policy file at:")
+            .dim("  Add to Your Tailnet Policy File at:")
             .dim("  https://login.tailscale.com/admin/acls/file")
             .blank()
-            .text(`  "tagOwners": { "${tag}": ["autogroup:admin"] }`)
             .text(`  "autoApprovers": { "routes": { "${subnet}": ["${tag}"] } }`)
             .blank()
-            .dim("  To restrict access, add ACL rules:")
-            .dim(`    {"action": "accept", "src": ["group:YOUR_GROUP"], "dst": ["${tag}:53"]}`)
-            .dim(`    {"action": "accept", "src": ["group:YOUR_GROUP"], "dst": ["${subnet}:*"]}`)
+            .dim("  Routes Were Approved via API for This Session.")
+            .dim("  autoApprovers Will Auto-Approve on Future Restarts.")
             .blank();
     }
-    else if (subnet) {
+    if (subnet) {
         out.header("Recommended ACL Rules:")
             .blank()
-            .dim("  To restrict access, add ACL rules to your policy file:")
+            .dim("  To Restrict Access, Add ACL Rules to Your Policy File:")
             .dim("  https://login.tailscale.com/admin/acls/file")
             .blank()
             .dim(`    {"action": "accept", "src": ["group:YOUR_GROUP"], "dst": ["${tag}:53"]}`)
             .dim(`    {"action": "accept", "src": ["group:YOUR_GROUP"], "dst": ["${subnet}:*"]}`)
             .blank();
     }
+    if (!shouldApprove) {
+        out.dim("Route Approval Was Skipped. To Complete Setup:")
+            .dim(`  ambit doctor --network ${network}`)
+            .blank();
+    }
     out.print();
 };
 // =============================================================================

package/esm/src/cli/commands/deploy.js

@@ -2,12 +2,12 @@
 // Deploy Command - Safely Deploy a Workload App on a Custom Private Network
 // =============================================================================
 import * as dntShim from "../../../_dnt.shims.js";
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.27/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
 import { join } from "../../../deps/jsr.io/@std/path/1.1.4/mod.js";
 import { bold, confirm, fileExists } from "../../../lib/cli.js";
 import { createOutput } from "../../../lib/output.js";
 import { registerCommand } from "../mod.js";
-import { createFlyProvider, FlyDeployError } from "../../providers/fly.js";
+import { createFlyProvider, FlyDeployError, getWorkloadAppName, } from "../../providers/fly.js";
 import { findRouterApp } from "../../discovery.js";
 import { resolveOrg } from "../../resolve.js";
 import { assertNotRouter, auditDeploy, scanFlyToml } from "../../guard.js";
@@ -99,38 +99,41 @@ const resolveTemplateMode = async (templateRaw, out) => {
     const ref = parseTemplateRef(templateRaw);
     if (!ref) {
         out.die(`Invalid Template Reference: "${templateRaw}". ` +
-            `Format: owner/repo/path[@ref]`);
+            `Format: owner/repo[/path][@ref]`);
         return null;
     }
-    const label = `${ref.owner}/${ref.repo}/${ref.path}` +
+    const label = (ref.path === "."
+        ? `${ref.owner}/${ref.repo}`
+        : `${ref.owner}/${ref.repo}/${ref.path}`) +
         (ref.ref ? `@${ref.ref}` : "");
     out.info(`Template: ${label}`);
     const fetchSpinner = out.spinner("Fetching Template from GitHub");
     const result = await fetchTemplate(ref);
     if (!result.ok) {
         fetchSpinner.fail("Template Fetch Failed");
-        out.die(result.message);
+        out.die(result.error);
         return null;
     }
+    const { tempDir, templateDir } = result.value;
     fetchSpinner.success("Template Fetched");
     // Find and scan the template's fly.toml
-    const configPath = join(result.templateDir, "fly.toml");
+    const configPath = join(templateDir, "fly.toml");
     let tomlContent;
     try {
         tomlContent = await dntShim.Deno.readTextFile(configPath);
     }
     catch {
         try {
-            dntShim.Deno.removeSync(result.tempDir, { recursive: true });
+            dntShim.Deno.removeSync(tempDir, { recursive: true });
         }
         catch { /* ignore */ }
-        out.die(`Template '${ref.path}' Has No fly.toml`);
+        out.die(`Template '${ref.path === "." ? ref.repo : ref.path}' Has No fly.toml`);
         return null;
     }
     const scan = scanFlyToml(tomlContent);
     if (scan.errors.length > 0) {
         try {
-            dntShim.Deno.removeSync(result.tempDir, { recursive: true });
+            dntShim.Deno.removeSync(tempDir, { recursive: true });
         }
         catch { /* ignore */ }
         for (const err of scan.errors) {
@@ -142,11 +145,11 @@ const resolveTemplateMode = async (templateRaw, out) => {
     for (const warn of scan.warnings) {
         out.warn(warn);
     }
-    out.ok(`Scanned ${ref.path}/fly.toml`);
+    out.ok(`Scanned ${ref.path === "." ? "" : ref.path + "/"}fly.toml`);
     return {
         configPath,
         preflight: { scanned: scan.scanned, warnings: scan.warnings },
-        tempDir: result.tempDir,
+        tempDir,
     };
 };
 // =============================================================================
@@ -172,21 +175,24 @@ const deploy = async (argv) => {
 ${bold("ambit deploy")} - Deploy an App Safely on a Custom Private Network
 
 ${bold("USAGE")}
+  ambit deploy <app>.<network> [options]
   ambit deploy <app> --network <name> [options]
 
+  The network can be specified as part of the name (app.network) or with --network.
+
 ${bold("MODES")}
   Config mode (default):
-    ambit deploy <app> --network <name>                    Uses ./fly.toml
-    ambit deploy <app> --network <name> --config path      Explicit fly.toml
+    ambit deploy my-app.lab                                Uses ./fly.toml
+    ambit deploy my-app.lab --config path                  Explicit fly.toml
 
   Image mode:
-    ambit deploy <app> --network <name> --image <img>      Docker image, no toml
+    ambit deploy my-app.lab --image <img>                  Docker image, no toml
 
   Template mode:
-    ambit deploy <app> --network <name> --template <ref>   GitHub template
+    ambit deploy my-app.lab --template <ref>               GitHub template
 
 ${bold("OPTIONS")}
-  --network <name>       Custom 6PN network to target (required)
+  --network <name>       Target network
   --org <org>            Fly.io organization slug
   --region <region>      Primary deployment region
   -y, --yes              Skip confirmation prompts
@@ -200,10 +206,11 @@ ${bold("IMAGE MODE")}
   --main-port <port>     Internal port for HTTP service (default: 80, "none" to skip)
 
 ${bold("TEMPLATE MODE")}
-  --template <ref>       GitHub template as owner/repo/path[@ref]
+  --template <ref>       GitHub template as owner/repo[/path][@ref]
 
   Reference format:
-    owner/repo/path           Fetch from the default branch
+    owner/repo                Fetch repo root from the default branch
+    owner/repo/path           Fetch subdirectory from the default branch
     owner/repo/path@tag       Fetch a tagged release
     owner/repo/path@branch    Fetch a specific branch
     owner/repo/path@commit    Fetch a specific commit
@@ -214,11 +221,12 @@ ${bold("SAFETY")}
   Pre-flight scan rejects fly.toml with force_https or TLS on 443.
 
 ${bold("EXAMPLES")}
-  ambit deploy my-app --network browsers
-  ambit deploy my-app --network browsers --image registry/img:latest
-  ambit deploy my-app --network browsers --config ./fly.toml --region sea
-  ambit deploy my-browser --network lab --template ToxicPine/ambit-templates/cdp
-  ambit deploy my-browser --network lab --template ToxicPine/ambit-templates/cdp@v1.0
+  ambit deploy my-app.lab
+  ambit deploy my-app.lab --image registry/img:latest
+  ambit deploy my-app.lab --config ./fly.toml --region sea
+  ambit deploy my-claw.lab --template ToxicPine/ambit-openclaw
+  ambit deploy my-browser.lab --template ToxicPine/ambit-templates/chromatic
+  ambit deploy my-browser --network lab --template ToxicPine/ambit-templates/chromatic@v1.0
 `);
         return;
     }
@@ -228,11 +236,27 @@ ${bold("EXAMPLES")}
     // ==========================================================================
     const appArg = args._[0];
     if (!appArg || typeof appArg !== "string") {
-        return out.die("App Name Required. Usage: ambit deploy <app> --network <name>");
+        return out.die("Missing app name. Usage: ambit deploy <app>.<network>");
+    }
+    let app;
+    let network;
+    if (appArg.includes(".")) {
+        const parts = appArg.split(".");
+        if (parts.length !== 2 || !parts[0] || !parts[1]) {
+            return out.die(`'${appArg}' should have exactly one dot, like my-app.my-network`);
+        }
+        if (args.network) {
+            return out.die(`Network is already part of the name ('${appArg}'), --network is not needed`);
+        }
+        app = parts[0];
+        network = parts[1];
     }
-    const app = appArg;
-    if (!args.network) {
-        return out.die("--network Is Required");
+    else {
+        app = appArg;
+        if (!args.network) {
+            return out.die(`Missing network. Use: ambit deploy ${app}.<network>`);
+        }
+        network = args.network;
     }
     try {
         assertNotRouter(app);
@@ -244,7 +268,6 @@ ${bold("EXAMPLES")}
     if (modeFlags.length > 1) {
         return out.die("--image, --config, and --template Are Mutually Exclusive");
     }
-    const network = args.network;
     out.blank()
         .header("=".repeat(50))
         .header(`  ambit Deploy: ${app}`)
@@ -272,27 +295,29 @@ ${bold("EXAMPLES")}
             `Run 'ambit create ${network}' first.`);
     }
     routerSpinner.success(`Router Found: ${router.appName}`);
+    const routerId = router.routerId;
+    const flyAppName = getWorkloadAppName(app, routerId);
     out.blank();
     // ==========================================================================
     // Phase 3: App Creation (if needed)
     // ==========================================================================
     out.header("Step 3: App Setup").blank();
     let created = false;
-    const exists = await fly.appExists(app);
+    const exists = await fly.appExists(flyAppName);
     if (exists) {
-        out.ok(`App '${app}' Exists`);
+        out.ok(`App '${flyAppName}' Exists`);
     }
     else {
-        out.info(`App '${app}' Does Not Exist — Will Create on Network '${network}'`);
+        out.info(`App '${flyAppName}' Does Not Exist — Will Create on Network '${network}'`);
         if (!args.yes && !args.json) {
-            const confirmed = await confirm(`Create app '${app}' on network '${network}'?`);
+            const confirmed = await confirm(`Create app '${flyAppName}' on network '${network}'?`);
             if (!confirmed) {
                 out.text("Cancelled.");
                 return;
             }
         }
-        await fly.createApp(app, org, { network });
-        out.ok(`Created App '${app}' on Network '${network}'`);
+        await fly.createApp(app, org, { network, routerId });
+        out.ok(`Created App '${flyAppName}' on Network '${network}'`);
         created = true;
     }
     out.blank();
@@ -320,6 +345,7 @@ ${bold("EXAMPLES")}
     out.dim("Deploying with --no-public-ips --flycast ...");
     try {
         await fly.deploySafe(app, {
+            routerId,
             image: deployConfig.image,
             config: deployConfig.configPath,
             region: args.region,
@@ -347,7 +373,7 @@ ${bold("EXAMPLES")}
     // ==========================================================================
     out.header("Step 6: Post-flight Audit").blank();
     const auditSpinner = out.spinner("Auditing Deployment");
-    const audit = await auditDeploy(fly, app, network);
+    const audit = await auditDeploy(fly, flyAppName, network);
     auditSpinner.success("Audit Complete");
     if (audit.public_ips_released > 0) {
         out.warn(`Released ${audit.public_ips_released} Public IP(s)`);