@cardelli/ambit 0.3.0 → 0.3.1

package/esm/cli/commands/create/index.js

@@ -12,9 +12,9 @@ import { isPublicTld } from "../../../util/guard.js";
 import { createFlyProvider } from "../../../providers/fly.js";
 import { createTailscaleProvider, } from "../../../providers/tailscale.js";
 import { getCredentialStore } from "../../../util/credentials.js";
-import { FLY_PRIVATE_SUBNET, TAILSCALE_API_KEY_PREFIX, } from "../../../util/constants.js";
+import { TAILSCALE_API_KEY_PREFIX } from "../../../util/constants.js";
 import { resolveOrg } from "../../../util/resolve.js";
-import { assertAdditivePatch, isAutoApproverConfigured, isTagOwnerConfigured, patchAutoApprover, patchTagOwner, } from "../../../util/tailscale-local.js";
+import { assertAdditivePatch, isAutoApproverConfigured, isTagOwnerConfigured, patchTagOwner, } from "../../../util/tailscale-local.js";
 import { createTransition, hydrateCreate, reportSkipped, } from "./machine.js";
 // =============================================================================
 // Stage 1: Fly.io Configuration
@@ -107,40 +107,21 @@ const stageTailscaleConfig = async (out, opts) => {
     else {
         tagOwnerSpinner.success(`${opts.tag} Found in Tailscale ACL`);
     }
-    if (!opts.manual) {
-        const hasApprover = isAutoApproverConfigured(policy, opts.tag);
-        if (!hasApprover && policy) {
-            const beforeApprover = policy;
-            policy = patchAutoApprover(policy, opts.tag, FLY_PRIVATE_SUBNET);
-            assertAdditivePatch(beforeApprover, policy);
-            const validateApprover = await tailscale.acl.validatePolicy(policy);
-            if (!validateApprover.ok) {
-                return handleAclSetFailure(out, validateApprover, `Validating autoApprover patch for ${opts.tag}`);
-            }
-            const approverSpinner = out.spinner(`Adding autoApprover for ${opts.tag}`);
-            const result = await tailscale.acl.setPolicy(policy);
-            if (!result.ok) {
-                approverSpinner.fail(`Adding autoApprover for ${opts.tag}`);
-                return handleAclSetFailure(out, result, `Adding autoApprover for ${opts.tag}`);
-            }
-            approverSpinner.success(`Added autoApprover for ${opts.tag}`);
-        }
-    }
-    else if (opts.json) {
+    if (opts.manual && opts.json) {
         const approverSpinner = out.spinner(`Checking autoApprovers for ${opts.tag}`);
         const hasApprover = isAutoApproverConfigured(policy, opts.tag);
         if (!hasApprover) {
             approverSpinner.fail(`Auto-approve Not Configured for ${opts.tag}`);
             out.blank()
-                .text("  In JSON mode, ambit can't interactively approve the router's")
-                .text(`  network connections. You can set this up from the Tailscale dashboard:`)
+                .text("  In --manual --json mode, ambit can't interactively approve the")
+                .text("  router's subnet routes. Set up autoApprovers first:")
                 .link("  https://login.tailscale.com/admin/acls/visual/auto-approvers")
-                .dim(`  Route: ${FLY_PRIVATE_SUBNET}  Owner: ${opts.tag}`)
+                .dim(`  Route: <subnet>/48  Owner: ${opts.tag}`)
                 .blank()
-                .dim("  Or you can do it manually with this JSON config:")
-                .dim(`    "autoApprovers": { "routes": { "${FLY_PRIVATE_SUBNET}": ["${opts.tag}"] } }`)
+                .dim("  Or in the ACL file:")
+                .dim(`    "autoApprovers": { "routes": { "<subnet>/48": ["${opts.tag}"] } }`)
                 .blank();
-            return out.die(`Set Up Auto-approve for ${opts.tag} to Use --json`);
+            return out.die(`Set Up Auto-approve for ${opts.tag} to Use --manual --json`);
         }
         approverSpinner.success(`Auto-approve Configured for ${opts.tag}`);
     }
@@ -334,6 +315,7 @@ ${bold("EXAMPLES")}
         region,
         tag,
         shouldApprove,
+        manual,
     });
 };
 // =============================================================================

package/esm/cli/commands/create/machine.d.ts

@@ -3,7 +3,7 @@ import { Result } from "../../../lib/result.js";
 import { type FlyProvider } from "../../../providers/fly.js";
 import type { TailscaleProvider } from "../../../providers/tailscale.js";
 import type { TailscaleDevice } from "../../../schemas/tailscale.js";
-export type CreatePhase = "create_app" | "deploy_router" | "await_device" | "approve_routes" | "configure_dns" | "accept_routes" | "complete";
+export type CreatePhase = "create_app" | "deploy_router" | "approve_routes" | "configure_dns" | "accept_routes" | "complete";
 export type CreateResult = {
     network: string;
     router: {
@@ -22,6 +22,7 @@ export interface CreateCtx {
     region: string;
     tag: string;
     shouldApprove: boolean;
+    manual: boolean;
     appName: string;
     routerId: string;
     device?: TailscaleDevice;

package/esm/cli/commands/create/machine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/create/machine.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAQhD,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAS7E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAOrE,MAAM,MAAM,WAAW,GACnB,YAAY,GACZ,eAAe,GACf,cAAc,GACd,gBAAgB,GAChB,eAAe,GACf,eAAe,GACf,UAAU,CAAC;AAMf,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACxD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,WAAW,CAAC;IACjB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAeD,eAAO,MAAM,aAAa,GACxB,KAAK,MAAM,CAAC,YAAY,CAAC,EACzB,YAAY,WAAW,SAMxB,CAAC;AAMF,eAAO,MAAM,aAAa,GACxB,KAAK,SAAS,KACb,OAAO,CAAC,WAAW,CA4BrB,CAAC;AAMF,eAAO,MAAM,gBAAgB,GAC3B,OAAO,WAAW,EAClB,KAAK,SAAS,KACb,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAoH7B,CAAC"}
+{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/create/machine.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAQhD,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAW7E,OAAO,KAAK,EAAgB,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAOrE,MAAM,MAAM,WAAW,GACnB,YAAY,GACZ,eAAe,GACf,gBAAgB,GAChB,eAAe,GACf,eAAe,GACf,UAAU,CAAC;AAMf,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACxD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,WAAW,CAAC;IACjB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAcD,eAAO,MAAM,aAAa,GACxB,KAAK,MAAM,CAAC,YAAY,CAAC,EACzB,YAAY,WAAW,SAMxB,CAAC;AAMF,eAAO,MAAM,aAAa,GACxB,KAAK,SAAS,KACb,OAAO,CAAC,WAAW,CA4BrB,CAAC;AAMF,eAAO,MAAM,gBAAgB,GAC3B,OAAO,WAAW,EAClB,KAAK,SAAS,KACb,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CA6K7B,CAAC"}

package/esm/cli/commands/create/machine.js

@@ -7,7 +7,7 @@ import { extractSubnet } from "../../../util/fly-transforms.js";
 import { ROUTER_DOCKER_DIR, SECRET_NETWORK_NAME, SECRET_ROUTER_ID, SECRET_TAILSCALE_AUTHKEY, } from "../../../util/constants.js";
 import { FlyDeployError } from "../../../providers/fly.js";
 import { getRouterAppName } from "../../../util/naming.js";
-import { enableAcceptRoutes, isAcceptRoutesEnabled, isAutoApproverConfigured, isTailscaleInstalled, waitForDevice, } from "../../../util/tailscale-local.js";
+import { assertAdditivePatch, enableAcceptRoutes, isAcceptRoutesEnabled, isAutoApproverConfigured, isTailscaleInstalled, patchAutoApprover, waitForDevice, } from "../../../util/tailscale-local.js";
 import { findRouterApp, getRouterMachineInfo } from "../../../util/discovery.js";
 // =============================================================================
 // Phase Labels
@@ -15,7 +15,6 @@ import { findRouterApp, getRouterMachineInfo } from "../../../util/discovery.js"
 const CREATE_PHASES = [
     { phase: "create_app", label: "Fly App Created" },
     { phase: "deploy_router", label: "Router Deployed" },
-    { phase: "await_device", label: "Router in Tailnet" },
     { phase: "approve_routes", label: "Routes Approved" },
     { phase: "configure_dns", label: "Split DNS Configured" },
     { phase: "accept_routes", label: "Accept Routes Enabled" },
@@ -44,7 +43,7 @@ export const hydrateCreate = async (ctx) => {
         return "complete";
     const device = await ctx.tailscale.devices.getByHostname(router.appName);
     if (!device)
-        return "await_device";
+        return "approve_routes";
     ctx.device = device;
     const routes = await ctx.tailscale.routes.get(device.id);
     if (!routes || routes.unapproved.length > 0)
@@ -70,15 +69,7 @@ export const createTransition = async (phase, ctx) => {
             return Result.ok("deploy_router");
         }
         case "deploy_router": {
-            const authKey = await ctx.tailscale.auth.createKey({
-                reusable: false,
-                ephemeral: false,
-                preauthorized: true,
-                tags: [ctx.tag],
-            });
-            ctx.out.ok("Auth Key Created");
-            await ctx.out.spin("Setting Secrets", () => ctx.fly.secrets.set(ctx.appName, {
-                [SECRET_TAILSCALE_AUTHKEY]: authKey,
+            await ctx.out.spin("Staging Secrets", () => ctx.fly.secrets.set(ctx.appName, {
                 [SECRET_NETWORK_NAME]: ctx.network,
                 [SECRET_ROUTER_ID]: ctx.routerId,
             }, { stage: true }));
@@ -102,34 +93,84 @@ export const createTransition = async (phase, ctx) => {
             const m = machines.find((m) => m.private_ip);
             if (m?.private_ip)
                 ctx.subnet = extractSubnet(m.private_ip);
-            if (!ctx.shouldApprove)
-                return Result.ok("complete");
-            return Result.ok("await_device");
+            return Result.ok("approve_routes");
         }
-        case "await_device": {
-            ctx.device = await waitForDevice(ctx.tailscale, ctx.appName, 180000);
-            ctx.out.ok(`Router Joined Tailnet: ${ctx.device.addresses[0]}`);
+        case "approve_routes": {
             if (!ctx.subnet) {
                 const machines = await ctx.fly.machines.list(ctx.appName);
                 const m = machines.find((m) => m.private_ip);
                 if (m?.private_ip)
                     ctx.subnet = extractSubnet(m.private_ip);
             }
-            return Result.ok("approve_routes");
-        }
-        case "approve_routes": {
-            if (!ctx.device || !ctx.subnet) {
-                return Result.err("Missing Device or Subnet");
-            }
-            const policy = await ctx.tailscale.acl.getPolicy();
+            if (!ctx.subnet)
+                return Result.err("Missing Subnet");
+            let policy = await ctx.tailscale.acl.getPolicy();
             const hasAutoApprover = isAutoApproverConfigured(policy, ctx.tag);
-            if (hasAutoApprover) {
-                ctx.out.ok("Routes Auto-Approved via ACL Policy");
+            let approverReady = hasAutoApprover;
+            if (!hasAutoApprover && !ctx.manual && policy) {
+                const before = policy;
+                policy = patchAutoApprover(policy, ctx.tag, ctx.subnet);
+                assertAdditivePatch(before, policy);
+                const vr = await ctx.tailscale.acl.validatePolicy(policy);
+                if (!vr.ok) {
+                    ctx.out.warn(`Could Not Validate autoApprover Patch: ${vr.error ?? `HTTP ${vr.status}`}`);
+                }
+                else {
+                    const sr = await ctx.tailscale.acl.setPolicy(policy);
+                    if (sr.ok) {
+                        ctx.out.ok(`Added autoApprover for ${ctx.tag} → ${ctx.subnet}`);
+                        approverReady = true;
+                    }
+                    else if (sr.status === 403) {
+                        ctx.out.warn("API Token Lacks ACL Write Permission — Will Approve Routes Manually");
+                    }
+                    else {
+                        ctx.out.warn(`Could Not Set autoApprover: ${sr.error ?? `HTTP ${sr.status}`}`);
+                    }
+                }
             }
-            else {
+            // If the device isn't in the tailnet yet, the router hasn't
+            // authenticated. Mint an auth key and deliver it — the non-staged
+            // secrets set triggers a Fly restart. The router boots with the key,
+            // authenticates, and advertises routes. With autoApprover in place,
+            // routes are auto-approved immediately.
+            if (!ctx.device) {
+                const existing = await ctx.tailscale.devices.getByHostname(ctx.appName);
+                if (existing) {
+                    ctx.device = existing;
+                }
+                else {
+                    const authKey = await ctx.tailscale.auth.createKey({
+                        reusable: false,
+                        ephemeral: false,
+                        preauthorized: true,
+                        tags: [ctx.tag],
+                    });
+                    ctx.out.ok("Auth Key Created");
+                    const keySpinner = ctx.out.spinner("Delivering Auth Key (restarting router)");
+                    await ctx.fly.secrets.set(ctx.appName, {
+                        [SECRET_TAILSCALE_AUTHKEY]: authKey,
+                    });
+                    keySpinner.success("Auth Key Delivered");
+                    if (!ctx.shouldApprove) {
+                        ctx.out.dim("  Skipping Route Approval (--no-auto-approve)");
+                        return Result.ok("complete");
+                    }
+                    ctx.device = await waitForDevice(ctx.tailscale, ctx.appName, 180000);
+                    ctx.out.ok(`Router Joined Tailnet: ${ctx.device.addresses[0]}`);
+                }
+            }
+            const routes = await ctx.tailscale.routes.get(ctx.device.id);
+            if (routes && routes.unapproved.length > 0) {
+                if (approverReady) {
+                    ctx.out.warn("Routes Not Auto-Approved Despite autoApprover — Approving Manually");
+                }
                 await ctx.tailscale.routes.approve(ctx.device.id, [ctx.subnet]);
                 ctx.out.ok("Subnet Routes Approved");
             }
+            else {
+                ctx.out.ok("Routes Auto-Approved via ACL Policy");
+            }
             return Result.ok("configure_dns");
         }
         case "configure_dns": {

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "@cardelli/ambit",
-    "version": "0.3.0",
+    "version": "0.3.1",
     "description": "Deploy apps to the cloud that only you and your AI agents can reach",
     "license": "MIT",
     "tasks": {

package/esm/router/start.sh

@@ -5,7 +5,8 @@ set -e
 # ambit - Self-Configuring Tailscale Subnet Router
 # =============================================================================
 # State is persisted to /var/lib/tailscale via Fly volume.
-# On first run: authenticates with a pre-minted auth key, advertises routes.
+# On first run: waits for TAILSCALE_AUTHKEY (delivered by the CLI after
+# autoApprovers are in place), then authenticates and advertises routes.
 # On restart: reuses existing state, no new device created.
 # The router never receives the user's API token — only a single-use,
 # tag-scoped auth key that expires after 5 minutes.
@@ -41,10 +42,12 @@ if /usr/local/bin/tailscale status --json 2>/dev/null | jq -e '.BackendState ==
     --hostname="${FLY_APP_NAME:-ambit}" \
     --advertise-routes="${SUBNET}"
 else
-  # First run - authenticate with pre-minted auth key
+  # First run — auth key is delivered by the CLI via `fly secrets set` after
+  # autoApprovers are configured. If it's not here yet, wait for the restart
+  # that the non-staged secrets set triggers.
   if [ -z "${TAILSCALE_AUTHKEY}" ]; then
-    echo "Router: ERROR - No TAILSCALE_AUTHKEY Provided"
-    exit 1
+    echo "Router: Waiting for Auth Key (CLI will deliver via secrets)"
+    while true; do sleep 5; done
   fi
 
   echo "Router: Authenticating to Tailscale"

package/esm/util/constants.d.ts

@@ -2,7 +2,6 @@ export declare const ROUTER_APP_PREFIX = "ambit-";
 export declare const DEFAULT_FLY_NETWORK = "default";
 export declare const ROUTER_DOCKER_DIR: string;
 export declare const SOCKS_PROXY_PORT = 1080;
-export declare const FLY_PRIVATE_SUBNET = "fdaa::/16";
 export declare const TAILSCALE_API_KEY_PREFIX = "tskey-api-";
 export declare const ENV_TAILSCALE_API_KEY = "TAILSCALE_API_KEY";
 export declare const FLYCTL_INSTALL_URL = "https://fly.io/docs/flyctl/install/";

package/esm/util/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/util/constants.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C,eAAO,MAAM,iBAAiB,QACnB,CAAC;AAMZ,eAAO,MAAM,gBAAgB,OAAO,CAAC;AAErC,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAM9C,eAAO,MAAM,wBAAwB,eAAe,CAAC;AAErD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAMzD,eAAO,MAAM,kBAAkB,wCAAwC,CAAC;AAMxE,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAC5D,eAAO,MAAM,mBAAmB,iBAAiB,CAAC;AAClD,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAM5C,eAAO,MAAM,2BAA2B,yBAAyB,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/util/constants.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C,eAAO,MAAM,iBAAiB,QACnB,CAAC;AAMZ,eAAO,MAAM,gBAAgB,OAAO,CAAC;AAMrC,eAAO,MAAM,wBAAwB,eAAe,CAAC;AAErD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAMzD,eAAO,MAAM,kBAAkB,wCAAwC,CAAC;AAMxE,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAC5D,eAAO,MAAM,mBAAmB,iBAAiB,CAAC;AAClD,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAM5C,eAAO,MAAM,2BAA2B,yBAAyB,CAAC"}

package/esm/util/constants.js

@@ -12,7 +12,6 @@ export const ROUTER_DOCKER_DIR = new URL("../router", globalThis[Symbol.for("imp
 // Networking
 // =============================================================================
 export const SOCKS_PROXY_PORT = 1080;
-export const FLY_PRIVATE_SUBNET = "fdaa::/16";
 // =============================================================================
 // Tailscale
 // =============================================================================

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cardelli/ambit",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Deploy apps to the cloud that only you and your AI agents can reach",
   "license": "MIT",
   "scripts": {},