@cardelli/ambit 0.1.4 → 0.2.0

package/esm/util/fly-transforms.js

@@ -0,0 +1,87 @@
+// =============================================================================
+// Fly Transforms — Pure Data Transformations
+// =============================================================================
+// =============================================================================
+// Machine State Mapping
+// =============================================================================
+/**
+ * Map Fly machine state to internal state.
+ * Fly states: created, starting, started, stopping, stopped, destroying, destroyed
+ */
+export const mapFlyMachineState = (flyState) => {
+    switch (flyState.toLowerCase()) {
+        case "started":
+            return "running";
+        case "stopped":
+        case "suspended":
+            return "frozen";
+        case "created":
+        case "starting":
+            return "creating";
+        case "destroying":
+        case "destroyed":
+        case "failed":
+            return "failed";
+        default:
+            return "creating";
+    }
+};
+// =============================================================================
+// Machine Size Mapping
+// =============================================================================
+/**
+ * Map Fly guest config to machine size enum.
+ */
+export const mapFlyMachineSize = (guest) => {
+    if (!guest)
+        return "shared-cpu-1x";
+    const cpus = guest.cpus;
+    if (cpus >= 4)
+        return "shared-cpu-4x";
+    if (cpus >= 2)
+        return "shared-cpu-2x";
+    return "shared-cpu-1x";
+};
+/** Map raw Fly machines to internal MachineResult format. */
+export const mapMachines = (raw) => {
+    return raw.map((m) => ({
+        id: m.id,
+        state: mapFlyMachineState(m.state),
+        size: mapFlyMachineSize(m.config?.guest),
+        region: m.region,
+        privateIp: m.private_ip,
+    }));
+};
+export const getSizeConfig = (size) => {
+    switch (size) {
+        case "shared-cpu-1x":
+            return { cpus: 1, memoryMb: 1024 };
+        case "shared-cpu-2x":
+            return { cpus: 2, memoryMb: 2048 };
+        case "shared-cpu-4x":
+            return { cpus: 4, memoryMb: 4096 };
+    }
+};
+// =============================================================================
+// Error Detail Extraction
+// =============================================================================
+/**
+ * Pull the last non-empty, non-decoration line from fly stderr.
+ * Fly often prints progress lines then the actual error at the end.
+ */
+export const extractErrorDetail = (stderr) => {
+    const lines = stderr
+        .split("\n")
+        .map((l) => l.replace(/\x1b\[[0-9;]*m/g, "").trim())
+        .filter((l) => l.length > 0 && !l.startsWith("-->") && l !== "Error");
+    return lines[lines.length - 1] ?? "unknown error";
+};
+// =============================================================================
+// Subnet Extraction
+// =============================================================================
+export const extractSubnet = (privateIp) => {
+    // privateIp format: fdaa:X:XXXX::Y
+    // Extract first 3 hextets and append ::/48
+    const parts = privateIp.split(":");
+    return `${parts[0]}:${parts[1]}:${parts[2]}::/48`;
+};

package/esm/{src → util}/guard.d.ts

@@ -1,5 +1,4 @@
-import "../_dnt.polyfills.js";
-import type { FlyProvider } from "./providers/fly.js";
+import type { FlyProvider } from "../providers/fly.js";
 /**
  * Returns true if the given name is a public TLD (case-insensitive).
  * Used to prevent creating networks that would shadow real DNS.

package/esm/util/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../src/util/guard.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAsLvD;;;GAGG;AACH,eAAO,MAAM,WAAW,GAAI,MAAM,MAAM,KAAG,OACN,CAAC;AAMtC,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,mBAAmB,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAMD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAOjD;AAMD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe,CA8ChE;AAMD;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,WAAW,EAChB,GAAG,EAAE,MAAM,EACX,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,iBAAiB,CAAC,CA4F5B"}

package/esm/{src → util}/guard.js

@@ -9,8 +9,8 @@
 //   - auditDeploy: post-deploy check that releases public IPs and reports
 //
 // =============================================================================
-import "../_dnt.polyfills.js";
 import { parse as parseToml } from "../deps/jsr.io/@std/toml/1.0.11/mod.js";
+import { ROUTER_APP_PREFIX } from "./constants.js";
 // =============================================================================
 // Public TLD Blocklist (source: https://data.iana.org/TLD/tlds-alpha-by-domain.txt)
 // =============================================================================
@@ -201,7 +201,7 @@ export const isPublicTld = (name) => PUBLIC_TLDS.has(name.toLowerCase());
  * Workload apps must not start with the ambit- prefix.
  */
 export function assertNotRouter(app) {
-    if (app.startsWith("ambit-")) {
+    if (app.startsWith(ROUTER_APP_PREFIX)) {
         throw new Error("Cannot deploy ambit infrastructure apps (ambit-* prefix). " +
             "Use 'ambit create' to manage routers.");
     }
@@ -235,23 +235,21 @@ export function scanFlyToml(tomlContent) {
         result.errors.push("http_service.force_https is enabled. " +
             "This implies public HTTPS which is incompatible with Flycast-only deployment.");
     }
-    // Check [[services]] for TLS on 443 — dangerous if a public IP were ever added
-    const services = parsed.services;
-    if (Array.isArray(services)) {
-        result.warnings.push("fly.toml uses [[services]] blocks. Consider migrating to [http_service].");
-        for (const svc of services) {
-            const ports = svc.ports;
+    // Check [[services]] for TLS handler on port 443
+    if (Array.isArray(parsed.services)) {
+        const hasTlsHandler = parsed.services.some((svc) => {
+            const ports = svc?.ports;
             if (!Array.isArray(ports))
-                continue;
-            for (const port of ports) {
-                const handlers = port.handlers;
-                if (port.port === 443 &&
-                    Array.isArray(handlers) &&
-                    handlers.includes("tls")) {
-                    result.errors.push("Service has TLS handler on port 443. " +
-                        "This is designed for public HTTPS and incompatible with Flycast-only deployment.");
-                }
-            }
+                return false;
+            return ports.some((p) => {
+                const port = p;
+                const handlers = port?.handlers;
+                return Array.isArray(handlers) && handlers.includes("tls") &&
+                    port?.port === 443;
+            });
+        });
+        if (hasTlsHandler) {
+            result.errors.push("TLS Handler on Port 443 Is Incompatible with Flycast-Only Deployment.");
         }
     }
     return result;
@@ -271,7 +269,7 @@ export async function auditDeploy(fly, app, targetNetwork) {
         warnings: [],
     };
     // Phase 1: Check and clean IPs — only keep Flycast on the target network
-    const ips = await fly.listIps(app);
+    const ips = await fly.ips.list(app);
     for (const ip of ips) {
         const ipNetwork = ip.Network?.Name || "default";
         if (ip.Type === "private_v6" && ipNetwork === targetNetwork) {
@@ -283,23 +281,23 @@ export async function auditDeploy(fly, app, targetNetwork) {
         }
         else if (ip.Type === "private_v6") {
             // Flycast on wrong network (e.g. default from --flycast flag) — release
-            await fly.releaseIp(app, ip.Address);
+            await fly.ips.release(app, ip.Address);
             result.warnings.push(`Released Flycast IP ${ip.Address} on wrong network '${ipNetwork}' (expected '${targetNetwork}')`);
         }
         else {
             // Public IP — release immediately
-            await fly.releaseIp(app, ip.Address);
+            await fly.ips.release(app, ip.Address);
             result.public_ips_released++;
         }
     }
     // Phase 2: Remove auto-generated .fly.dev certs to keep the app fully private
-    const certs = await fly.listCerts(app);
+    const certs = await fly.certs.list(app);
     for (const hostname of certs) {
-        await fly.removeCert(app, hostname);
+        await fly.certs.remove(app, hostname);
         result.certs_removed++;
     }
     // Phase 3: Inspect merged config for dangerous patterns
-    const config = await fly.getConfig(app);
+    const config = await fly.apps.getConfig(app);
     if (config) {
         const services = config.services;
         if (Array.isArray(services) && services.length > 0) {
@@ -320,10 +318,12 @@ export async function auditDeploy(fly, app, targetNetwork) {
     // Phase 4: Verify Flycast allocation on target network
     const hasTargetFlycast = result.flycast_allocations.some((a) => a.network === targetNetwork);
     if (!hasTargetFlycast) {
-        // Allocate on the target network
-        await fly.allocateFlycastIp(app, targetNetwork);
+        // Allocate on the target network, then re-list to get the actual address
+        await fly.ips.allocateFlycast(app, targetNetwork);
+        const refreshed = await fly.ips.list(app);
+        const newIp = refreshed.find((ip) => ip.Type === "private_v6" && ip.Network?.Name === targetNetwork);
         result.flycast_allocations.push({
-            address: "(newly allocated)",
+            address: newIp?.Address ?? "allocated",
             network: targetNetwork,
         });
     }

package/esm/util/naming.d.ts

@@ -0,0 +1,5 @@
+export declare const getRouterAppName: (network: string, randomSuffix: string) => string;
+export declare const getRouterSuffix: (routerAppName: string, network: string) => string;
+export declare const getWorkloadAppName: (name: string, routerId: string) => string;
+export declare const getRouterTag: (network: string) => string;
+//# sourceMappingURL=naming.d.ts.map

package/esm/util/naming.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"naming.d.ts","sourceRoot":"","sources":["../../src/util/naming.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,gBAAgB,GAC3B,SAAS,MAAM,EACf,cAAc,MAAM,KACnB,MAEF,CAAC;AAEF,eAAO,MAAM,eAAe,GAC1B,eAAe,MAAM,EACrB,SAAS,MAAM,KACd,MAGF,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAC7B,MAAM,MAAM,EACZ,UAAU,MAAM,KACf,MAEF,CAAC;AAEF,eAAO,MAAM,YAAY,GAAI,SAAS,MAAM,KAAG,MAAgC,CAAC"}

package/esm/util/naming.js

@@ -0,0 +1,12 @@
+import { ROUTER_APP_PREFIX } from "./constants.js";
+export const getRouterAppName = (network, randomSuffix) => {
+    return `${ROUTER_APP_PREFIX}${network}-${randomSuffix}`;
+};
+export const getRouterSuffix = (routerAppName, network) => {
+    const prefix = `${ROUTER_APP_PREFIX}${network}-`;
+    return routerAppName.slice(prefix.length);
+};
+export const getWorkloadAppName = (name, routerId) => {
+    return `${name}-${routerId}`;
+};
+export const getRouterTag = (network) => `tag:ambit-${network}`;

package/esm/{src → util}/resolve.d.ts

@@ -1,11 +1,10 @@
-import "../_dnt.polyfills.js";
 import type { Output } from "../lib/output.js";
-import type { FlyProvider } from "./providers/fly.js";
+import type { FlyProvider } from "../providers/fly.js";
 /**
  * Resolve Fly.io organization: --org flag → single org auto-select → prompt.
  */
 export declare const resolveOrg: (fly: FlyProvider, args: {
     org?: string;
     json?: boolean;
-}, out: Output<Record<string, unknown>>) => Promise<string>;
+}, out: Output<any>) => Promise<string>;
 //# sourceMappingURL=resolve.d.ts.map

package/esm/util/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/util/resolve.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAMvD;;GAEG;AACH,eAAO,MAAM,UAAU,GACrB,KAAK,WAAW,EAChB,MAAM;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,EACtC,KAAK,MAAM,CAAC,GAAG,CAAC,KACf,OAAO,CAAC,MAAM,CA6BhB,CAAC"}

package/esm/{src → util}/resolve.js

@@ -1,7 +1,6 @@
 // =============================================================================
 // Resolve - Org Resolution Helper
 // =============================================================================
-import "../_dnt.polyfills.js";
 import { prompt } from "../lib/cli.js";
 // =============================================================================
 // Resolve Org
@@ -15,7 +14,7 @@ export const resolveOrg = async (fly, args, out) => {
     if (args.json) {
         return out.die("--org Is Required in JSON Mode");
     }
-    const orgs = await fly.listOrgs();
+    const orgs = await fly.orgs.list();
     const orgSlugs = Object.keys(orgs);
     if (orgSlugs.length === 0) {
         return out.die("No Fly.io Organizations Found");

package/esm/util/session.d.ts

@@ -0,0 +1,16 @@
+import { type FlyProvider } from "../providers/fly.js";
+import { type TailscaleProvider } from "../providers/tailscale.js";
+import type { Output } from "../lib/output.js";
+/**
+ * Bootstrap the three shared prerequisites every command needs:
+ * validates fly CLI + Tailscale key, authenticates with Fly, and resolves org.
+ */
+export declare const initSession: <T extends Record<string, unknown>>(out: Output<T>, opts: {
+    json: boolean;
+    org?: string;
+}) => Promise<{
+    fly: FlyProvider;
+    tailscale: TailscaleProvider;
+    org: string;
+}>;
+//# sourceMappingURL=session.d.ts.map

package/esm/util/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/util/session.ts"],"names":[],"mappings":"AAIA,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAI/C;;;GAGG;AACH,eAAO,MAAM,WAAW,GAAU,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjE,KAAK,MAAM,CAAC,CAAC,CAAC,EACd,MAAM;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,KACpC,OAAO,CAAC;IAAE,GAAG,EAAE,WAAW,CAAC;IAAC,SAAS,EAAE,iBAAiB,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAOzE,CAAC"}

package/esm/util/session.js

@@ -0,0 +1,19 @@
+// =============================================================================
+// Session — Shared Prerequisites Initialization
+// =============================================================================
+import { createFlyProvider } from "../providers/fly.js";
+import { createTailscaleProvider, } from "../providers/tailscale.js";
+import { checkDependencies } from "./credentials.js";
+import { resolveOrg } from "./resolve.js";
+/**
+ * Bootstrap the three shared prerequisites every command needs:
+ * validates fly CLI + Tailscale key, authenticates with Fly, and resolves org.
+ */
+export const initSession = async (out, opts) => {
+    const { tailscaleKey } = await checkDependencies(out);
+    const fly = createFlyProvider();
+    await fly.auth.login({ interactive: !opts.json });
+    const tailscale = createTailscaleProvider(tailscaleKey);
+    const org = await resolveOrg(fly, opts, out);
+    return { fly, tailscale, org };
+};

package/esm/util/tailscale-local.d.ts

@@ -0,0 +1,13 @@
+import type { TailscaleDevice } from "../schemas/tailscale.js";
+import type { TailscaleProvider } from "../providers/tailscale.js";
+export declare const isTailscaleInstalled: () => Promise<boolean>;
+export declare const isAcceptRoutesEnabled: () => Promise<boolean>;
+/**
+ * Enable accept-routes on the local client.
+ * Returns true if successful, false if it failed (likely permissions).
+ */
+export declare const enableAcceptRoutes: () => Promise<boolean>;
+export declare const waitForDevice: (provider: TailscaleProvider, hostname: string, timeoutMs?: number) => Promise<TailscaleDevice>;
+export declare const isTagOwnerConfigured: (policy: Record<string, unknown> | null, tag: string) => boolean;
+export declare const isAutoApproverConfigured: (policy: Record<string, unknown> | null, tag: string) => boolean;
+//# sourceMappingURL=tailscale-local.d.ts.map

package/esm/util/tailscale-local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tailscale-local.d.ts","sourceRoot":"","sources":["../../src/util/tailscale-local.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAMnE,eAAO,MAAM,oBAAoB,QAAa,OAAO,CAAC,OAAO,CAE5D,CAAC;AAEF,eAAO,MAAM,qBAAqB,QAAa,OAAO,CAAC,OAAO,CAM7D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAAa,OAAO,CAAC,OAAO,CAG1D,CAAC;AAMF,eAAO,MAAM,aAAa,GACxB,UAAU,iBAAiB,EAC3B,UAAU,MAAM,EAChB,YAAW,MAAe,KACzB,OAAO,CAAC,eAAe,CAazB,CAAC;AAMF,eAAO,MAAM,oBAAoB,GAC/B,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACtC,KAAK,MAAM,KACV,OASF,CAAC;AAEF,eAAO,MAAM,wBAAwB,GACnC,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,EACtC,KAAK,MAAM,KACV,OAgBF,CAAC"}

package/esm/util/tailscale-local.js

@@ -0,0 +1,63 @@
+// =============================================================================
+// Tailscale Local — CLI Operations + Pure Policy Checks
+// =============================================================================
+import { commandExists, die } from "../lib/cli.js";
+import { runCommand } from "../lib/command.js";
+// =============================================================================
+// Local CLI Operations
+// =============================================================================
+export const isTailscaleInstalled = async () => {
+    return await commandExists("tailscale");
+};
+export const isAcceptRoutesEnabled = async () => {
+    const result = await runCommand(["tailscale", "debug", "prefs"]);
+    return result.json().match({
+        ok: (prefs) => prefs.RouteAll === true,
+        err: () => false,
+    });
+};
+/**
+ * Enable accept-routes on the local client.
+ * Returns true if successful, false if it failed (likely permissions).
+ */
+export const enableAcceptRoutes = async () => {
+    const result = await runCommand(["tailscale", "set", "--accept-routes"]);
+    return result.ok;
+};
+// =============================================================================
+// Wait for Device
+// =============================================================================
+export const waitForDevice = async (provider, hostname, timeoutMs = 120000) => {
+    const startTime = Date.now();
+    const pollInterval = 5000;
+    while (Date.now() - startTime < timeoutMs) {
+        const device = await provider.devices.getByHostname(hostname);
+        if (device) {
+            return device;
+        }
+        await new Promise((resolve) => setTimeout(resolve, pollInterval));
+    }
+    return die(`Timeout Waiting for Device '${hostname}'`);
+};
+// =============================================================================
+// Pure Policy Checks
+// =============================================================================
+export const isTagOwnerConfigured = (policy, tag) => {
+    if (!policy)
+        return false;
+    const tagOwners = policy.tagOwners;
+    if (!tagOwners)
+        return false;
+    return tag in tagOwners;
+};
+export const isAutoApproverConfigured = (policy, tag) => {
+    if (!policy)
+        return false;
+    const autoApprovers = policy.autoApprovers;
+    if (!autoApprovers)
+        return false;
+    const routes = autoApprovers.routes;
+    if (!routes)
+        return false;
+    return Object.values(routes).some((approvers) => Array.isArray(approvers) && approvers.includes(tag));
+};

package/esm/{src → util}/template.d.ts

@@ -1,6 +1,4 @@
-import type { Result } from "../lib/result.js";
-/** Kinds of errors that can occur when fetching a template from GitHub. */
-export type TemplateErrorKind = "NotFound" | "RateLimited" | "HttpError" | "ExtractionFailed" | "PathNotFound" | "PathNotDirectory" | "EmptyArchive" | "NetworkError";
+import { Result } from "../lib/result.js";
 /** Parsed GitHub template reference. */
 export interface TemplateRef {
     owner: string;
@@ -12,7 +10,7 @@ export interface TemplateRef {
 export type TemplateFetchResult = Result<{
     tempDir: string;
     templateDir: string;
-}, TemplateErrorKind>;
+}>;
 /**
  * Parse a template reference string into its components.
  * Returns null if the format is invalid.

package/esm/util/template.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"template.d.ts","sourceRoot":"","sources":["../../src/util/template.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAM1C,wCAAwC;AACxC,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CACzB;AAED,iDAAiD;AACjD,MAAM,MAAM,mBAAmB,GAAG,MAAM,CACtC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CACzC,CAAC;AAyBF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,KAAG,WAAW,GAAG,IAyB5D,CAAC;AAMF;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,GACxB,KAAK,WAAW,KACf,OAAO,CAAC,mBAAmB,CAqG7B,CAAC"}

package/esm/{src → util}/template.js

@@ -17,15 +17,12 @@
 import * as dntShim from "../_dnt.shims.js";
 import { join } from "../deps/jsr.io/@std/path/1.1.4/mod.js";
 import { runCommand } from "../lib/command.js";
+import { Result } from "../lib/result.js";
 // =============================================================================
 // Internal Helpers
 // =============================================================================
 /** Shorthand for returning a typed fetch error. */
-const fail = (kind, message) => ({
-    ok: false,
-    kind,
-    message,
-});
+const fail = (message) => Result.err(message);
 /** Format a template reference for display. */
 const formatRef = (ref) => {
     const base = ref.path === "."
@@ -96,9 +93,9 @@ export const fetchTemplate = async (ref) => {
         }
         catch { /* ignore */ }
     };
-    const cleanFail = (kind, message) => {
+    const cleanFail = (message) => {
         cleanup();
-        return fail(kind, message);
+        return fail(message);
     };
     try {
         const url = ref.ref
@@ -113,13 +110,13 @@ export const fetchTemplate = async (ref) => {
         if (!response.ok) {
             const repo = formatRepo(ref);
             if (response.status === 404) {
-                return cleanFail("NotFound", `Template Repository Not Found: ${repo}. ` +
+                return cleanFail(`Template Repository Not Found: ${repo}. ` +
                     "Check that the repository exists and is public.");
             }
             if (response.status === 403) {
-                return cleanFail("RateLimited", "GitHub API Rate Limit Exceeded. Try again later.");
+                return cleanFail("GitHub API Rate Limit Exceeded. Try again later.");
             }
-            return cleanFail("HttpError", `GitHub API Returned HTTP ${response.status} for ${repo}`);
+            return cleanFail(`GitHub API Returned HTTP ${response.status} for ${repo}`);
         }
         // Write tarball to disk
         const tarballPath = join(tempDir, "template.tar.gz");
@@ -135,31 +132,31 @@ export const fetchTemplate = async (ref) => {
             "-C",
             extractDir,
         ]);
-        if (!extractResult.success) {
-            return cleanFail("ExtractionFailed", "Failed to Extract Template Archive");
+        if (!extractResult.ok) {
+            return cleanFail("Failed to Extract Template Archive");
         }
         // GitHub tarballs have a single top-level dir (owner-repo-commitish/)
         const entries = [...dntShim.Deno.readDirSync(extractDir)];
         const topLevel = entries.find((e) => e.isDirectory);
         if (!topLevel) {
-            return cleanFail("EmptyArchive", "Template Archive Has No Top-Level Directory");
+            return cleanFail("Template Archive Has No Top-Level Directory");
         }
         // Locate the template subdirectory
         const templateDir = join(extractDir, topLevel.name, ref.path);
         try {
             const stat = dntShim.Deno.statSync(templateDir);
             if (!stat.isDirectory) {
-                return cleanFail("PathNotDirectory", `Template Path '${ref.path}' Is Not a Directory in ${formatRepo(ref)}`);
+                return cleanFail(`Template Path '${ref.path}' Is Not a Directory in ${formatRepo(ref)}`);
             }
         }
         catch {
-            return cleanFail("PathNotFound", `Template Path '${ref.path}' Not Found in ${formatRepo(ref)}`);
+            return cleanFail(`Template Path '${ref.path}' Not Found in ${formatRepo(ref)}`);
         }
-        return { ok: true, tempDir, templateDir };
+        return Result.ok({ tempDir, templateDir });
     }
     catch (e) {
         if (e instanceof TypeError) {
-            return cleanFail("NetworkError", "Network Error: Could Not Reach GitHub");
+            return cleanFail("Network Error: Could Not Reach GitHub");
         }
         cleanup();
         throw e;

package/package.json

@@ -1,50 +1,8 @@
 {
   "name": "@cardelli/ambit",
-  "version": "0.1.4",
+  "version": "0.2.0",
   "description": "Deploy apps to the cloud that only you and your AI agents can reach",
   "license": "MIT",
-  "module": "./esm/src/providers/fly.js",
-  "exports": {
-    "./providers/fly": {
-      "import": "./esm/src/providers/fly.js"
-    },
-    "./providers/tailscale": {
-      "import": "./esm/src/providers/tailscale.js"
-    },
-    "./schemas/config": {
-      "import": "./esm/src/schemas/config.js"
-    },
-    "./schemas/fly": {
-      "import": "./esm/src/schemas/fly.js"
-    },
-    "./schemas/tailscale": {
-      "import": "./esm/src/schemas/tailscale.js"
-    },
-    "./lib/cli": {
-      "import": "./esm/lib/cli.js"
-    },
-    "./lib/command": {
-      "import": "./esm/lib/command.js"
-    },
-    "./lib/output": {
-      "import": "./esm/lib/output.js"
-    },
-    "./lib/paths": {
-      "import": "./esm/lib/paths.js"
-    },
-    "./src/credentials": {
-      "import": "./esm/src/credentials.js"
-    },
-    "./src/discovery": {
-      "import": "./esm/src/discovery.js"
-    },
-    "./src/guard": {
-      "import": "./esm/src/guard.js"
-    },
-    "./src/resolve": {
-      "import": "./esm/src/resolve.js"
-    }
-  },
   "scripts": {},
   "bin": {
     "ambit": "./esm/main.js"

package/esm/lib/paths.d.ts

@@ -1,3 +0,0 @@
-import "../_dnt.polyfills.js";
-export declare const getRouterDockerDir: () => string;
-//# sourceMappingURL=paths.d.ts.map

package/esm/lib/paths.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/lib/paths.ts"],"names":[],"mappings":"AAGA,OAAO,sBAAsB,CAAC;AAG9B,eAAO,MAAM,kBAAkB,QAAO,MACqB,CAAC"}

package/esm/lib/paths.js

@@ -1,5 +0,0 @@
-// =============================================================================
-// Path Helpers - Locate Package Resources
-// =============================================================================
-import "../_dnt.polyfills.js";
-export const getRouterDockerDir = () => new URL("../src/docker/router", globalThis[Symbol.for("import-meta-ponyfill-esmodule")](import.meta).url).pathname;

package/esm/src/cli/commands/create.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=create.d.ts.map

package/esm/src/cli/commands/create.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../../src/src/cli/commands/create.ts"],"names":[],"mappings":""}