@cardelli/ambit 0.1.4 → 0.1.5

package/esm/src/docker/router/start.sh

@@ -5,8 +5,10 @@ set -e
 # ambit - Self-Configuring Tailscale Subnet Router
 # =============================================================================
 # State is persisted to /var/lib/tailscale via Fly volume.
-# On first run: creates auth key (with tags), authenticates, approves routes.
+# On first run: authenticates with a pre-minted auth key, advertises routes.
 # On restart: reuses existing state, no new device created.
+# The router never receives the user's API token — only a single-use,
+# tag-scoped auth key that expires after 5 minutes.
 # =============================================================================
 
 echo "Router: Enabling IP Forwarding"
@@ -33,42 +35,9 @@ if /usr/local/bin/tailscale status --json 2>/dev/null | jq -e '.BackendState ==
     --hostname="${FLY_APP_NAME:-ambit}" \
     --advertise-routes="${SUBNET}"
 else
-  # First run - need to authenticate
-  if [ -n "${TAILSCALE_API_TOKEN}" ]; then
-    echo "Router: Creating Auth Key (First Run)"
-
-    TAGS_JSON="[]"
-    if [ -n "${TAILSCALE_TAGS}" ]; then
-      TAGS_JSON=$(echo "${TAILSCALE_TAGS}" | jq -R 'split(",")')
-    fi
-
-    AUTH_KEY_RESPONSE=$(curl -s -X POST \
-      -u "${TAILSCALE_API_TOKEN}:" \
-      -H "Content-Type: application/json" \
-      -d "$(jq -n \
-        --argjson tags "${TAGS_JSON}" \
-        '{
-          capabilities: { devices: { create: {
-            reusable: false,
-            ephemeral: false,
-            preauthorized: true,
-            tags: $tags
-          }}},
-          expirySeconds: 300
-        }' | jq 'if .capabilities.devices.create.tags == [] then .capabilities.devices.create |= del(.tags) else . end')" \
-      "https://api.tailscale.com/api/v2/tailnet/-/keys")
-
-    TAILSCALE_AUTHKEY=$(echo "${AUTH_KEY_RESPONSE}" | jq -r '.key')
-
-    if [ -z "${TAILSCALE_AUTHKEY}" ] || [ "${TAILSCALE_AUTHKEY}" = "null" ]; then
-      echo "Router: ERROR - Failed to Create Auth Key"
-      echo "${AUTH_KEY_RESPONSE}"
-      exit 1
-    fi
-
-    echo "Router: Auth Key Created"
-  elif [ -z "${TAILSCALE_AUTHKEY}" ]; then
-    echo "Router: ERROR - No TAILSCALE_API_TOKEN or TAILSCALE_AUTHKEY Provided"
+  # First run - authenticate with pre-minted auth key
+  if [ -z "${TAILSCALE_AUTHKEY}" ]; then
+    echo "Router: ERROR - No TAILSCALE_AUTHKEY Provided"
     exit 1
   fi
 
@@ -79,40 +48,6 @@ else
     --advertise-routes="${SUBNET}"
 fi
 
-echo "Router: Getting Node Key"
-NODE_KEY=$(/usr/local/bin/tailscale status --json | jq -r '.Self.PublicKey')
-echo "Router: Node Key ${NODE_KEY}"
-
-# Self-approve routes if we have API access
-# This is a fallback — if the user has autoApprovers configured in their
-# Tailscale policy file, routes are approved automatically and this block
-# is a no-op (routes are already enabled).
-if [ -n "${TAILSCALE_API_TOKEN}" ]; then
-  echo "Router: Finding Device ID"
-
-  DEVICES_RESPONSE=$(curl -s \
-    -u "${TAILSCALE_API_TOKEN}:" \
-    "https://api.tailscale.com/api/v2/tailnet/-/devices")
-
-  DEVICE_ID=$(echo "${DEVICES_RESPONSE}" | jq -r ".devices[] | select(.nodeKey == \"${NODE_KEY}\") | .id")
-
-  if [ -n "${DEVICE_ID}" ] && [ "${DEVICE_ID}" != "null" ]; then
-    echo "Router: Device ID ${DEVICE_ID}"
-    echo "Router: Approving Subnet Routes"
-
-    curl -s -X POST \
-      -u "${TAILSCALE_API_TOKEN}:" \
-      -H "Content-Type: application/json" \
-      -d "{\"routes\": [\"${SUBNET}\"]}" \
-      "https://api.tailscale.com/api/v2/device/${DEVICE_ID}/routes" > /dev/null
-
-    echo "Router: Routes Approved"
-  else
-    echo "Router: WARNING - Could Not Find Device ID"
-    echo "Router: Routes May Need Manual Approval"
-  fi
-fi
-
 echo "Router: Fully Configured"
 
 # Start SOCKS5 proxy for bidirectional tailnet access
@@ -124,10 +59,21 @@ echo "Router: Starting DNS Proxy"
 
 # Generate Corefile for CoreDNS
 # Rewrites NETWORK_NAME TLD to .flycast before forwarding to Fly DNS.
+# When ROUTER_ID is set, workload app names are suffixed: app.network ->
+# app-ROUTER_ID.flycast. This ties workloads to their router and avoids
+# name collisions across networks.
 # .flycast resolves to the Flycast address (private_v6) which routes through
 # Fly Proxy — enabling autostart/autostop and load balancing. The Flycast IP
 # is within the network's /48 subnet so it's routable through the tailnet.
-if [ -n "${NETWORK_NAME}" ]; then
+if [ -n "${NETWORK_NAME}" ] && [ -n "${ROUTER_ID}" ]; then
+  echo "Router: DNS Rewrite *.${NETWORK_NAME} -> *-${ROUTER_ID}.flycast"
+  cat > /etc/coredns/Corefile <<EOF
+.:53 {
+    rewrite name regex (.+)\.${NETWORK_NAME}\. {1}-${ROUTER_ID}.flycast. answer auto
+    forward . fdaa::3
+}
+EOF
+elif [ -n "${NETWORK_NAME}" ]; then
   echo "Router: DNS Rewrite ${NETWORK_NAME} -> flycast"
   cat > /etc/coredns/Corefile <<EOF
 .:53 {

package/esm/src/providers/fly.d.ts

@@ -32,6 +32,7 @@ export interface SafeDeployOptions {
     image?: string;
     config?: string;
     region?: string;
+    routerId?: string;
 }
 export interface FlyProvider {
     ensureInstalled(): Promise<void>;
@@ -41,6 +42,7 @@ export interface FlyProvider {
     listOrgs(): Promise<Record<string, string>>;
     createApp(name: string, org: string, options?: {
         network?: string;
+        routerId?: string;
     }): Promise<void>;
     deleteApp(name: string): Promise<void>;
     listApps(org?: string): Promise<FlyApp[]>;
@@ -67,4 +69,8 @@ export interface FlyProvider {
 }
 export declare const createFlyProvider: () => FlyProvider;
 export declare const getRouterAppName: (network: string, randomSuffix: string) => string;
+/** Extract the routerId suffix from a router app name. */
+export declare const getRouterSuffix: (routerAppName: string, network: string) => string;
+/** Build the physical Fly app name for a workload. */
+export declare const getWorkloadAppName: (name: string, routerId: string) => string;
 //# sourceMappingURL=fly.d.ts.map

package/esm/src/providers/fly.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fly.d.ts","sourceRoot":"","sources":["../../../src/src/providers/fly.ts"],"names":[],"mappings":"AAGA,OAAO,yBAAyB,CAAC;AAajC,OAAO,EACL,KAAK,MAAM,EACX,KAAK,UAAU,EAIf,KAAK,KAAK,EAEV,KAAK,UAAU,EAMhB,MAAM,mBAAmB,CAAC;AAa3B;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAMxC;AAmBD,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,eAAe,GAAG,eAAe,CAAC;AAE9E,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,aAAa,GACxB,MAAM,WAAW,KAChB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CASlC,CAAC;AAMF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAMD,MAAM,WAAW,WAAW;IAC1B,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,UAAU,CAAC,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5C,SAAS,CACP,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAC7B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACjD,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1D,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1E,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,UAAU,CACR,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC5B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,YAAY,CACV,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACvC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAChE,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;CACzD;AAMD,eAAO,MAAM,iBAAiB,QAAO,WA6bpC,CAAC;AAMF,eAAO,MAAM,gBAAgB,GAC3B,SAAS,MAAM,EACf,cAAc,MAAM,KACnB,MAEF,CAAC"}
+{"version":3,"file":"fly.d.ts","sourceRoot":"","sources":["../../../src/src/providers/fly.ts"],"names":[],"mappings":"AAGA,OAAO,yBAAyB,CAAC;AASjC,OAAO,EACL,KAAK,MAAM,EACX,KAAK,UAAU,EAIf,KAAK,KAAK,EAEV,KAAK,UAAU,EAMhB,MAAM,mBAAmB,CAAC;AAa3B;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAMxC;AAmBD,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,eAAe,GAAG,eAAe,CAAC;AAE9E,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,eAAO,MAAM,aAAa,GACxB,MAAM,WAAW,KAChB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CASlC,CAAC;AAMF,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD,MAAM,WAAW,WAAW;IAC1B,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,UAAU,CAAC,OAAO,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5C,SAAS,CACP,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAChD,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1C,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACjD,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1D,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1E,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D,UAAU,CACR,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC5B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,YAAY,CACV,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IACvC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAChE,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1C,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;CACzD;AAMD,eAAO,MAAM,iBAAiB,QAAO,WAqbpC,CAAC;AAMF,eAAO,MAAM,gBAAgB,GAC3B,SAAS,MAAM,EACf,cAAc,MAAM,KACnB,MAEF,CAAC;AAEF,0DAA0D;AAC1D,eAAO,MAAM,eAAe,GAC1B,eAAe,MAAM,EACrB,SAAS,MAAM,KACd,MAGF,CAAC;AAEF,sDAAsD;AACtD,eAAO,MAAM,kBAAkB,GAC7B,MAAM,MAAM,EACZ,UAAU,MAAM,KACf,MAEF,CAAC"}

package/esm/src/providers/fly.js

@@ -3,7 +3,8 @@
 // =============================================================================
 import "../../_dnt.polyfills.js";
 import * as dntShim from "../../_dnt.shims.js";
-import { runCommand, runCommandJson, runInteractive, runQuiet, } from "../../lib/command.js";
+import { runCommand, runJson, runQuiet } from "../../lib/command.js";
+import { Result } from "../../lib/result.js";
 import { commandExists, die, Spinner } from "../../lib/cli.js";
 import { dirname, resolve } from "../../deps/jsr.io/@std/path/1.1.4/mod.js";
 import { FlyAppInfoListSchema, FlyAppsListSchema, FlyAuthSchema, FlyIpListSchema, FlyMachinesListSchema, FlyOrgsSchema, FlyStatusSchema, mapFlyMachineSize, mapFlyMachineState, } from "../schemas/fly.js";
@@ -64,40 +65,40 @@ export const createFlyProvider = () => {
         async ensureAuth(options) {
             const interactive = options?.interactive ?? true;
             const result = await runCommand(["fly", "auth", "whoami", "--json"]);
-            if (result.success) {
-                try {
-                    const parsed = FlyAuthSchema.safeParse(JSON.parse(result.stdout));
+            if (result.ok) {
+                const auth = result.json();
+                if (auth.ok) {
+                    const parsed = FlyAuthSchema.safeParse(auth.value);
                     if (parsed.success) {
                         return parsed.data.email;
                     }
                 }
-                catch {
-                    // Parse failed, need to authenticate
-                }
             }
             if (!interactive) {
                 return die("Not Authenticated with Fly.io. Run 'fly auth login' First");
             }
-            const loginResult = await runInteractive(["fly", "auth", "login"]);
-            if (!loginResult.success) {
+            const loginResult = await runCommand(["fly", "auth", "login"], {
+                interactive: true,
+            });
+            if (!loginResult.ok) {
                 return die("Fly.io Authentication Failed");
             }
             const checkResult = await runCommand(["fly", "auth", "whoami", "--json"]);
-            if (!checkResult.success) {
+            if (!checkResult.ok) {
                 return die("Fly.io Authentication Verification Failed");
             }
-            const parsed = FlyAuthSchema.safeParse(JSON.parse(checkResult.stdout));
+            const parsed = FlyAuthSchema.safeParse(checkResult.json().unwrap());
             if (!parsed.success || !parsed.data) {
                 return die("Fly.io Authentication Response Invalid");
             }
             return parsed.data.email;
         },
         async listOrgs() {
-            const result = await runCommandJson(["fly", "orgs", "list", "--json"]);
-            if (!result.success || !result.data) {
+            const result = await runJson(["fly", "orgs", "list", "--json"]);
+            if (!result.ok) {
                 return die("Failed to List Organizations");
             }
-            const parsed = FlyOrgsSchema.safeParse(result.data);
+            const parsed = FlyOrgsSchema.safeParse(result.value);
             if (!parsed.success) {
                 return die("Failed to Parse Organizations");
             }
@@ -109,25 +110,24 @@ export const createFlyProvider = () => {
                 args.push("--org", org);
             }
             const result = await runCommand(args);
-            if (!result.success) {
-                return [];
-            }
-            try {
-                const parsed = FlyAppsListSchema.safeParse(JSON.parse(result.stdout));
-                return parsed.success ? parsed.data : [];
-            }
-            catch {
-                return [];
-            }
+            return result.json().flatMap((data) => {
+                const parsed = FlyAppsListSchema.safeParse(data);
+                return parsed.success
+                    ? Result.ok(parsed.data)
+                    : Result.err("Parse Failed");
+            }).unwrapOr([]);
         },
         async createApp(name, org, options) {
-            const args = ["fly", "apps", "create", name, "--org", org, "--json"];
+            const appName = options?.routerId
+                ? getWorkloadAppName(name, options.routerId)
+                : name;
+            const args = ["fly", "apps", "create", appName, "--org", org, "--json"];
             if (options?.network) {
                 args.push("--network", options.network);
             }
             const result = await runQuiet("Creating App", args);
-            if (!result.success) {
-                return die(`Failed to Create App '${name}'`);
+            if (!result.ok) {
+                return die(`Failed to Create App '${appName}'`);
             }
         },
         async deleteApp(name) {
@@ -138,29 +138,28 @@ export const createFlyProvider = () => {
                 name,
                 "--yes",
             ]);
-            if (!result.success) {
+            if (!result.ok) {
                 return die(`Failed to Delete App '${name}'`);
             }
         },
         async appExists(name) {
             const result = await runCommand(["fly", "status", "-a", name, "--json"]);
-            if (!result.success)
-                return false;
-            try {
-                const parsed = FlyStatusSchema.safeParse(JSON.parse(result.stdout));
-                return parsed.success && !!parsed.data.ID;
-            }
-            catch {
-                return false;
-            }
+            return result.json().match({
+                ok: (data) => {
+                    const parsed = FlyStatusSchema.safeParse(data);
+                    return parsed.success && !!parsed.data.ID;
+                },
+                err: () => false,
+            });
         },
         async listMachines(app) {
-            const result = await runCommandJson(["fly", "machines", "list", "-a", app, "--json"]);
-            if (!result.success || !result.data) {
-                return [];
-            }
-            const parsed = FlyMachinesListSchema.safeParse(result.data);
-            return parsed.success ? parsed.data : [];
+            const result = await runJson(["fly", "machines", "list", "-a", app, "--json"]);
+            return result.flatMap((data) => {
+                const parsed = FlyMachinesListSchema.safeParse(data);
+                return parsed.success
+                    ? Result.ok(parsed.data)
+                    : Result.err("Parse Failed");
+            }).unwrapOr([]);
         },
         async listMachinesMapped(app) {
             const raw = await this.listMachines(app);
@@ -198,7 +197,7 @@ export const createFlyProvider = () => {
             const spinner = new Spinner();
             spinner.start(`Creating ${config.size} Machine`);
             const result = await runCommand(args);
-            if (!result.success) {
+            if (!result.ok) {
                 spinner.fail("Machine Creation Failed");
                 return die(result.stderr || "Unknown Error");
             }
@@ -221,7 +220,7 @@ export const createFlyProvider = () => {
                 app,
                 "--force",
             ]);
-            if (!result.success) {
+            if (!result.ok) {
                 return die(`Failed to Destroy Machine '${shortId}'`);
             }
         },
@@ -236,7 +235,7 @@ export const createFlyProvider = () => {
                 args.push("--stage");
             }
             const result = await runQuiet(`Setting ${pairs.length} Secret(s)`, args);
-            if (!result.success) {
+            if (!result.ok) {
                 return die("Failed to Set Secrets");
             }
         },
@@ -254,7 +253,7 @@ export const createFlyProvider = () => {
                 args.push("--primary-region", config.region);
             }
             const result = await runCommand(args);
-            if (!result.success) {
+            if (!result.ok) {
                 throw new FlyDeployError(app, result.stderr);
             }
         },
@@ -267,15 +266,12 @@ export const createFlyProvider = () => {
                 app,
                 "--json",
             ]);
-            if (!result.success)
-                return [];
-            try {
-                const parsed = FlyIpListSchema.safeParse(JSON.parse(result.stdout));
-                return parsed.success ? parsed.data : [];
-            }
-            catch {
-                return [];
-            }
+            return result.json().flatMap((data) => {
+                const parsed = FlyIpListSchema.safeParse(data);
+                return parsed.success
+                    ? Result.ok(parsed.data)
+                    : Result.err("Parse Failed");
+            }).unwrapOr([]);
         },
         async releaseIp(app, address) {
             const result = await runCommand([
@@ -286,7 +282,7 @@ export const createFlyProvider = () => {
                 "-a",
                 app,
             ]);
-            if (!result.success) {
+            if (!result.ok) {
                 return die(`Failed to Release IP ${address} from '${app}'`);
             }
         },
@@ -301,22 +297,21 @@ export const createFlyProvider = () => {
                 "-a",
                 app,
             ]);
-            if (!result.success) {
+            if (!result.ok) {
                 return die(`Failed to Allocate Flycast IP on Network '${network}'`);
             }
         },
         async getConfig(app) {
             const result = await runCommand(["fly", "config", "show", "-a", app]);
-            if (!result.success)
-                return null;
-            try {
-                return JSON.parse(result.stdout);
-            }
-            catch {
-                return null;
-            }
+            return result.json().match({
+                ok: (v) => v,
+                err: () => null,
+            });
         },
         async deploySafe(app, options) {
+            const appName = options.routerId
+                ? getWorkloadAppName(app, options.routerId)
+                : app;
             const args = ["fly", "deploy"];
             // When config is provided, use its parent directory as the build context
             // so fly deploy finds the Dockerfile and COPY picks up the correct files
@@ -325,7 +320,7 @@ export const createFlyProvider = () => {
                 args.push(dirname(configAbs));
                 args.push("--config", configAbs);
             }
-            args.push("-a", app, "--yes", "--no-public-ips");
+            args.push("-a", appName, "--yes", "--no-public-ips");
             if (options.image) {
                 args.push("--image", options.image);
             }
@@ -333,8 +328,8 @@ export const createFlyProvider = () => {
                 args.push("--primary-region", options.region);
             }
             const result = await runCommand(args);
-            if (!result.success) {
-                throw new FlyDeployError(app, result.stderr);
+            if (!result.ok) {
+                throw new FlyDeployError(appName, result.stderr);
             }
         },
         async listCerts(app) {
@@ -346,17 +341,9 @@ export const createFlyProvider = () => {
                 app,
                 "--json",
             ]);
-            if (!result.success)
-                return [];
-            try {
-                const certs = JSON.parse(result.stdout);
-                return certs
-                    .map((c) => c.Hostname)
-                    .filter((h) => typeof h === "string");
-            }
-            catch {
-                return [];
-            }
+            return result.json().map((certs) => certs
+                .map((c) => c.Hostname)
+                .filter((h) => typeof h === "string")).unwrapOr([]);
         },
         async removeCert(app, hostname) {
             await runCommand([
@@ -404,8 +391,17 @@ export const createFlyProvider = () => {
     };
 };
 // =============================================================================
-// Router App Naming
+// App Naming
 // =============================================================================
 export const getRouterAppName = (network, randomSuffix) => {
     return `${ROUTER_APP_PREFIX}${network}-${randomSuffix}`;
 };
+/** Extract the routerId suffix from a router app name. */
+export const getRouterSuffix = (routerAppName, network) => {
+    const prefix = `${ROUTER_APP_PREFIX}${network}-`;
+    return routerAppName.slice(prefix.length);
+};
+/** Build the physical Fly app name for a workload. */
+export const getWorkloadAppName = (name, routerId) => {
+    return `${name}-${routerId}`;
+};

package/esm/src/providers/tailscale.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tailscale.d.ts","sourceRoot":"","sources":["../../../src/src/providers/tailscale.ts"],"names":[],"mappings":"AAGA,OAAO,yBAAyB,CAAC;AAKjC,OAAO,EACL,KAAK,mBAAmB,EAExB,KAAK,eAAe,EAErB,MAAM,yBAAyB,CAAC;AAYjC,MAAM,WAAW,iBAAiB;IAChC,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,aAAa,CAAC,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,WAAW,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC1C,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACvE,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACzD,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzD;AAiBD,eAAO,MAAM,uBAAuB,GAClC,SAAS,MAAM,EACf,QAAQ,MAAM,KACb,iBAoMF,CAAC;AAMF,eAAO,MAAM,aAAa,GACxB,UAAU,iBAAiB,EAC3B,UAAU,MAAM,EAChB,YAAW,MAAe,KACzB,OAAO,CAAC,eAAe,CAazB,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAa,OAAO,CAAC,OAAO,CAE5D,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,QAAa,OAAO,CAAC,OAAO,CAY7D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAAa,OAAO,CAAC,OAAO,CAG1D,CAAC"}
+{"version":3,"file":"tailscale.d.ts","sourceRoot":"","sources":["../../../src/src/providers/tailscale.ts"],"names":[],"mappings":"AAGA,OAAO,yBAAyB,CAAC;AAKjC,OAAO,EACL,KAAK,mBAAmB,EAExB,KAAK,eAAe,EAErB,MAAM,yBAAyB,CAAC;AAYjC,MAAM,WAAW,iBAAiB;IAChC,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,aAAa,CAAC,IAAI,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,WAAW,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC1C,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IACvE,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACzD,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACzD;AAiBD,eAAO,MAAM,uBAAuB,GAClC,SAAS,MAAM,EACf,QAAQ,MAAM,KACb,iBAoMF,CAAC;AAMF,eAAO,MAAM,aAAa,GACxB,UAAU,iBAAiB,EAC3B,UAAU,MAAM,EAChB,YAAW,MAAe,KACzB,OAAO,CAAC,eAAe,CAazB,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,oBAAoB,QAAa,OAAO,CAAC,OAAO,CAE5D,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,qBAAqB,QAAa,OAAO,CAAC,OAAO,CAM7D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAAa,OAAO,CAAC,OAAO,CAG1D,CAAC"}

package/esm/src/providers/tailscale.js

@@ -174,16 +174,10 @@ export const isTailscaleInstalled = async () => {
  */
 export const isAcceptRoutesEnabled = async () => {
     const result = await runCommand(["tailscale", "debug", "prefs"]);
-    if (!result.success) {
-        return false;
-    }
-    try {
-        const prefs = JSON.parse(result.stdout);
-        return prefs.RouteAll === true;
-    }
-    catch {
-        return false;
-    }
+    return result.json().match({
+        ok: (prefs) => prefs.RouteAll === true,
+        err: () => false,
+    });
 };
 /**
  * Enable accept-routes on the local client.
@@ -191,5 +185,5 @@ export const isAcceptRoutesEnabled = async () => {
  */
 export const enableAcceptRoutes = async () => {
     const result = await runCommand(["tailscale", "set", "--accept-routes"]);
-    return result.success;
+    return result.ok;
 };

package/esm/src/template.d.ts

@@ -1,6 +1,5 @@
-import type { Result } from "../lib/result.js";
-/** Kinds of errors that can occur when fetching a template from GitHub. */
-export type TemplateErrorKind = "NotFound" | "RateLimited" | "HttpError" | "ExtractionFailed" | "PathNotFound" | "PathNotDirectory" | "EmptyArchive" | "NetworkError";
+import "../_dnt.polyfills.js";
+import { Result } from "../lib/result.js";
 /** Parsed GitHub template reference. */
 export interface TemplateRef {
     owner: string;
@@ -12,7 +11,7 @@ export interface TemplateRef {
 export type TemplateFetchResult = Result<{
     tempDir: string;
     templateDir: string;
-}, TemplateErrorKind>;
+}>;
 /**
  * Parse a template reference string into its components.
  * Returns null if the format is invalid.

package/esm/src/template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"template.d.ts","sourceRoot":"","sources":["../../src/src/template.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAM/C,2EAA2E;AAC3E,MAAM,MAAM,iBAAiB,GACzB,UAAU,GACV,aAAa,GACb,WAAW,GACX,kBAAkB,GAClB,cAAc,GACd,kBAAkB,GAClB,cAAc,GACd,cAAc,CAAC;AAMnB,wCAAwC;AACxC,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CACzB;AAED,iDAAiD;AACjD,MAAM,MAAM,mBAAmB,GAAG,MAAM,CACtC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EACxC,iBAAiB,CAClB,CAAC;AAgCF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,KAAG,WAAW,GAAG,IAyB5D,CAAC;AAMF;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,GACxB,KAAK,WAAW,KACf,OAAO,CAAC,mBAAmB,CAsH7B,CAAC"}
+{"version":3,"file":"template.d.ts","sourceRoot":"","sources":["../../src/src/template.ts"],"names":[],"mappings":"AAgBA,OAAO,sBAAsB,CAAC;AAO9B,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAM1C,wCAAwC;AACxC,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CACzB;AAED,iDAAiD;AACjD,MAAM,MAAM,mBAAmB,GAAG,MAAM,CACtC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CACzC,CAAC;AAyBF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,KAAG,WAAW,GAAG,IAyB5D,CAAC;AAMF;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,GACxB,KAAK,WAAW,KACf,OAAO,CAAC,mBAAmB,CAqG7B,CAAC"}

package/esm/src/template.js

@@ -14,18 +14,16 @@
 //   ToxicPine/ambit-templates/cdp@main     → explicit branch
 //
 // =============================================================================
+import "../_dnt.polyfills.js";
 import * as dntShim from "../_dnt.shims.js";
 import { join } from "../deps/jsr.io/@std/path/1.1.4/mod.js";
 import { runCommand } from "../lib/command.js";
+import { Result } from "../lib/result.js";
 // =============================================================================
 // Internal Helpers
 // =============================================================================
 /** Shorthand for returning a typed fetch error. */
-const fail = (kind, message) => ({
-    ok: false,
-    kind,
-    message,
-});
+const fail = (message) => Result.err(message);
 /** Format a template reference for display. */
 const formatRef = (ref) => {
     const base = ref.path === "."
@@ -96,9 +94,9 @@ export const fetchTemplate = async (ref) => {
         }
         catch { /* ignore */ }
     };
-    const cleanFail = (kind, message) => {
+    const cleanFail = (message) => {
         cleanup();
-        return fail(kind, message);
+        return fail(message);
     };
     try {
         const url = ref.ref
@@ -113,13 +111,13 @@ export const fetchTemplate = async (ref) => {
         if (!response.ok) {
             const repo = formatRepo(ref);
             if (response.status === 404) {
-                return cleanFail("NotFound", `Template Repository Not Found: ${repo}. ` +
+                return cleanFail(`Template Repository Not Found: ${repo}. ` +
                     "Check that the repository exists and is public.");
             }
             if (response.status === 403) {
-                return cleanFail("RateLimited", "GitHub API Rate Limit Exceeded. Try again later.");
+                return cleanFail("GitHub API Rate Limit Exceeded. Try again later.");
             }
-            return cleanFail("HttpError", `GitHub API Returned HTTP ${response.status} for ${repo}`);
+            return cleanFail(`GitHub API Returned HTTP ${response.status} for ${repo}`);
         }
         // Write tarball to disk
         const tarballPath = join(tempDir, "template.tar.gz");
@@ -135,31 +133,31 @@ export const fetchTemplate = async (ref) => {
             "-C",
             extractDir,
         ]);
-        if (!extractResult.success) {
-            return cleanFail("ExtractionFailed", "Failed to Extract Template Archive");
+        if (!extractResult.ok) {
+            return cleanFail("Failed to Extract Template Archive");
         }
         // GitHub tarballs have a single top-level dir (owner-repo-commitish/)
         const entries = [...dntShim.Deno.readDirSync(extractDir)];
         const topLevel = entries.find((e) => e.isDirectory);
         if (!topLevel) {
-            return cleanFail("EmptyArchive", "Template Archive Has No Top-Level Directory");
+            return cleanFail("Template Archive Has No Top-Level Directory");
         }
         // Locate the template subdirectory
         const templateDir = join(extractDir, topLevel.name, ref.path);
         try {
             const stat = dntShim.Deno.statSync(templateDir);
             if (!stat.isDirectory) {
-                return cleanFail("PathNotDirectory", `Template Path '${ref.path}' Is Not a Directory in ${formatRepo(ref)}`);
+                return cleanFail(`Template Path '${ref.path}' Is Not a Directory in ${formatRepo(ref)}`);
             }
         }
         catch {
-            return cleanFail("PathNotFound", `Template Path '${ref.path}' Not Found in ${formatRepo(ref)}`);
+            return cleanFail(`Template Path '${ref.path}' Not Found in ${formatRepo(ref)}`);
         }
-        return { ok: true, tempDir, templateDir };
+        return Result.ok({ tempDir, templateDir });
     }
     catch (e) {
         if (e instanceof TypeError) {
-            return cleanFail("NetworkError", "Network Error: Could Not Reach GitHub");
+            return cleanFail("Network Error: Could Not Reach GitHub");
         }
         cleanup();
         throw e;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cardelli/ambit",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Deploy apps to the cloud that only you and your AI agents can reach",
   "license": "MIT",
   "module": "./esm/src/providers/fly.js",
@@ -29,6 +29,9 @@
     "./lib/output": {
       "import": "./esm/lib/output.js"
     },
+    "./lib/result": {
+      "import": "./esm/lib/result.js"
+    },
     "./lib/paths": {
       "import": "./esm/lib/paths.js"
     },
@@ -43,6 +46,9 @@
     },
     "./src/resolve": {
       "import": "./esm/src/resolve.js"
+    },
+    "./src/template": {
+      "import": "./esm/src/template.js"
     }
   },
   "scripts": {},