@cardelli/ambit 0.3.0 → 0.3.2

package/README.md

@@ -160,32 +160,51 @@ These work with all three modes.
 | `-y`, `--yes`         | Skip confirmation prompts                                      |
 | `--json`              | Machine-readable JSON output                                   |
 
-### `ambit status [network|app]`
+### `ambit list networks|apps`
 
-Without a subcommand, defaults to showing all routers (same as `status network`).
+#### `ambit list networks`
 
-#### `ambit status network [<name>]`
+Lists all networks and their routers in a table showing the network name, app name, region, machine state, Tailscale connectivity status, and ACL tag.
 
-Without a network name, shows a summary table of all routers. With a name, shows detailed status for a specific network: machine state, SOCKS proxy, Tailscale IP, subnet, and apps on the network.
+| Flag              | Description                    |
+| ----------------- | ------------------------------ |
+| `--org <org>`     | Fly.io organization slug       |
+| `--json`          | Machine-readable JSON output   |
+
+#### `ambit list apps <network>`
+
+Lists all workload apps on a specific network in a table showing the app name, region, and machine state.
 
 | Flag              | Description                    |
 | ----------------- | ------------------------------ |
 | `--org <org>`     | Fly.io organization slug       |
 | `--json`          | Machine-readable JSON output   |
 
-#### `ambit status app <app>.<network>`
+### `ambit status [networks|network|app]`
 
-Shows detailed status for a specific app: machines, Flycast IPs, and the backing router.
+Without a subcommand, defaults to showing all networks (same as `status networks`).
 
-| Flag                 | Description                                  |
-| -------------------- | -------------------------------------------- |
-| `--network <name>`   | Target network (if not using dot syntax)     |
-| `--org <org>`        | Fly.io organization slug                     |
-| `--json`             | Machine-readable JSON output                 |
+#### `ambit status networks`
+
+Shows a summary table of all networks and their routers.
 
-### `ambit list`
+| Flag              | Description                    |
+| ----------------- | ------------------------------ |
+| `--org <org>`     | Fly.io organization slug       |
+| `--json`          | Machine-readable JSON output   |
+
+#### `ambit status network <name>`
+
+Shows detailed status for a specific network: machine state, SOCKS proxy, Tailscale IP, subnet, and apps on the network.
+
+| Flag              | Description                    |
+| ----------------- | ------------------------------ |
+| `--org <org>`     | Fly.io organization slug       |
+| `--json`          | Machine-readable JSON output   |
 
-Lists all discovered routers across networks in a table showing the network name, app name, region, machine state, Tailscale connectivity status, and ACL tag.
+#### `ambit status app <app>.<network>`
+
+Shows detailed status for a specific app: machines, Flycast IPs, and the backing router.
 
 | Flag              | Description                    |
 | ----------------- | ------------------------------ |

package/esm/cli/commands/create/index.js

@@ -12,9 +12,9 @@ import { isPublicTld } from "../../../util/guard.js";
 import { createFlyProvider } from "../../../providers/fly.js";
 import { createTailscaleProvider, } from "../../../providers/tailscale.js";
 import { getCredentialStore } from "../../../util/credentials.js";
-import { FLY_PRIVATE_SUBNET, TAILSCALE_API_KEY_PREFIX, } from "../../../util/constants.js";
+import { TAILSCALE_API_KEY_PREFIX } from "../../../util/constants.js";
 import { resolveOrg } from "../../../util/resolve.js";
-import { assertAdditivePatch, isAutoApproverConfigured, isTagOwnerConfigured, patchAutoApprover, patchTagOwner, } from "../../../util/tailscale-local.js";
+import { assertAdditivePatch, isAutoApproverConfigured, isTagOwnerConfigured, patchTagOwner, } from "../../../util/tailscale-local.js";
 import { createTransition, hydrateCreate, reportSkipped, } from "./machine.js";
 // =============================================================================
 // Stage 1: Fly.io Configuration
@@ -107,40 +107,21 @@ const stageTailscaleConfig = async (out, opts) => {
     else {
         tagOwnerSpinner.success(`${opts.tag} Found in Tailscale ACL`);
     }
-    if (!opts.manual) {
-        const hasApprover = isAutoApproverConfigured(policy, opts.tag);
-        if (!hasApprover && policy) {
-            const beforeApprover = policy;
-            policy = patchAutoApprover(policy, opts.tag, FLY_PRIVATE_SUBNET);
-            assertAdditivePatch(beforeApprover, policy);
-            const validateApprover = await tailscale.acl.validatePolicy(policy);
-            if (!validateApprover.ok) {
-                return handleAclSetFailure(out, validateApprover, `Validating autoApprover patch for ${opts.tag}`);
-            }
-            const approverSpinner = out.spinner(`Adding autoApprover for ${opts.tag}`);
-            const result = await tailscale.acl.setPolicy(policy);
-            if (!result.ok) {
-                approverSpinner.fail(`Adding autoApprover for ${opts.tag}`);
-                return handleAclSetFailure(out, result, `Adding autoApprover for ${opts.tag}`);
-            }
-            approverSpinner.success(`Added autoApprover for ${opts.tag}`);
-        }
-    }
-    else if (opts.json) {
+    if (opts.manual && opts.json) {
         const approverSpinner = out.spinner(`Checking autoApprovers for ${opts.tag}`);
         const hasApprover = isAutoApproverConfigured(policy, opts.tag);
         if (!hasApprover) {
             approverSpinner.fail(`Auto-approve Not Configured for ${opts.tag}`);
             out.blank()
-                .text("  In JSON mode, ambit can't interactively approve the router's")
-                .text(`  network connections. You can set this up from the Tailscale dashboard:`)
+                .text("  In --manual --json mode, ambit can't interactively approve the")
+                .text("  router's subnet routes. Set up autoApprovers first:")
                 .link("  https://login.tailscale.com/admin/acls/visual/auto-approvers")
-                .dim(`  Route: ${FLY_PRIVATE_SUBNET}  Owner: ${opts.tag}`)
+                .dim(`  Route: <subnet>/48  Owner: ${opts.tag}`)
                 .blank()
-                .dim("  Or you can do it manually with this JSON config:")
-                .dim(`    "autoApprovers": { "routes": { "${FLY_PRIVATE_SUBNET}": ["${opts.tag}"] } }`)
+                .dim("  Or in the ACL file:")
+                .dim(`    "autoApprovers": { "routes": { "<subnet>/48": ["${opts.tag}"] } }`)
                 .blank();
-            return out.die(`Set Up Auto-approve for ${opts.tag} to Use --json`);
+            return out.die(`Set Up Auto-approve for ${opts.tag} to Use --manual --json`);
         }
         approverSpinner.success(`Auto-approve Configured for ${opts.tag}`);
     }
@@ -334,6 +315,7 @@ ${bold("EXAMPLES")}
         region,
         tag,
         shouldApprove,
+        manual,
     });
 };
 // =============================================================================

package/esm/cli/commands/create/machine.d.ts

@@ -3,7 +3,7 @@ import { Result } from "../../../lib/result.js";
 import { type FlyProvider } from "../../../providers/fly.js";
 import type { TailscaleProvider } from "../../../providers/tailscale.js";
 import type { TailscaleDevice } from "../../../schemas/tailscale.js";
-export type CreatePhase = "create_app" | "deploy_router" | "await_device" | "approve_routes" | "configure_dns" | "accept_routes" | "complete";
+export type CreatePhase = "create_app" | "deploy_router" | "approve_routes" | "configure_dns" | "accept_routes" | "complete";
 export type CreateResult = {
     network: string;
     router: {
@@ -22,6 +22,7 @@ export interface CreateCtx {
     region: string;
     tag: string;
     shouldApprove: boolean;
+    manual: boolean;
     appName: string;
     routerId: string;
     device?: TailscaleDevice;

package/esm/cli/commands/create/machine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/create/machine.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAQhD,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAS7E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAOrE,MAAM,MAAM,WAAW,GACnB,YAAY,GACZ,eAAe,GACf,cAAc,GACd,gBAAgB,GAChB,eAAe,GACf,eAAe,GACf,UAAU,CAAC;AAMf,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACxD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,WAAW,CAAC;IACjB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAeD,eAAO,MAAM,aAAa,GACxB,KAAK,MAAM,CAAC,YAAY,CAAC,EACzB,YAAY,WAAW,SAMxB,CAAC;AAMF,eAAO,MAAM,aAAa,GACxB,KAAK,SAAS,KACb,OAAO,CAAC,WAAW,CA4BrB,CAAC;AAMF,eAAO,MAAM,gBAAgB,GAC3B,OAAO,WAAW,EAClB,KAAK,SAAS,KACb,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAoH7B,CAAC"}
+{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/create/machine.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAQhD,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAW7E,OAAO,KAAK,EAAgB,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAOrE,MAAM,MAAM,WAAW,GACnB,YAAY,GACZ,eAAe,GACf,gBAAgB,GAChB,eAAe,GACf,eAAe,GACf,UAAU,CAAC;AAMf,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACxD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,WAAW,CAAC;IACjB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAcD,eAAO,MAAM,aAAa,GACxB,KAAK,MAAM,CAAC,YAAY,CAAC,EACzB,YAAY,WAAW,SAMxB,CAAC;AAMF,eAAO,MAAM,aAAa,GACxB,KAAK,SAAS,KACb,OAAO,CAAC,WAAW,CA4BrB,CAAC;AAMF,eAAO,MAAM,gBAAgB,GAC3B,OAAO,WAAW,EAClB,KAAK,SAAS,KACb,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CA6K7B,CAAC"}

package/esm/cli/commands/create/machine.js

@@ -7,7 +7,7 @@ import { extractSubnet } from "../../../util/fly-transforms.js";
 import { ROUTER_DOCKER_DIR, SECRET_NETWORK_NAME, SECRET_ROUTER_ID, SECRET_TAILSCALE_AUTHKEY, } from "../../../util/constants.js";
 import { FlyDeployError } from "../../../providers/fly.js";
 import { getRouterAppName } from "../../../util/naming.js";
-import { enableAcceptRoutes, isAcceptRoutesEnabled, isAutoApproverConfigured, isTailscaleInstalled, waitForDevice, } from "../../../util/tailscale-local.js";
+import { assertAdditivePatch, enableAcceptRoutes, isAcceptRoutesEnabled, isAutoApproverConfigured, isTailscaleInstalled, patchAutoApprover, waitForDevice, } from "../../../util/tailscale-local.js";
 import { findRouterApp, getRouterMachineInfo } from "../../../util/discovery.js";
 // =============================================================================
 // Phase Labels
@@ -15,7 +15,6 @@ import { findRouterApp, getRouterMachineInfo } from "../../../util/discovery.js"
 const CREATE_PHASES = [
     { phase: "create_app", label: "Fly App Created" },
     { phase: "deploy_router", label: "Router Deployed" },
-    { phase: "await_device", label: "Router in Tailnet" },
     { phase: "approve_routes", label: "Routes Approved" },
     { phase: "configure_dns", label: "Split DNS Configured" },
     { phase: "accept_routes", label: "Accept Routes Enabled" },
@@ -44,7 +43,7 @@ export const hydrateCreate = async (ctx) => {
         return "complete";
     const device = await ctx.tailscale.devices.getByHostname(router.appName);
     if (!device)
-        return "await_device";
+        return "approve_routes";
     ctx.device = device;
     const routes = await ctx.tailscale.routes.get(device.id);
     if (!routes || routes.unapproved.length > 0)
@@ -70,15 +69,7 @@ export const createTransition = async (phase, ctx) => {
             return Result.ok("deploy_router");
         }
         case "deploy_router": {
-            const authKey = await ctx.tailscale.auth.createKey({
-                reusable: false,
-                ephemeral: false,
-                preauthorized: true,
-                tags: [ctx.tag],
-            });
-            ctx.out.ok("Auth Key Created");
-            await ctx.out.spin("Setting Secrets", () => ctx.fly.secrets.set(ctx.appName, {
-                [SECRET_TAILSCALE_AUTHKEY]: authKey,
+            await ctx.out.spin("Staging Secrets", () => ctx.fly.secrets.set(ctx.appName, {
                 [SECRET_NETWORK_NAME]: ctx.network,
                 [SECRET_ROUTER_ID]: ctx.routerId,
             }, { stage: true }));
@@ -102,34 +93,84 @@ export const createTransition = async (phase, ctx) => {
             const m = machines.find((m) => m.private_ip);
             if (m?.private_ip)
                 ctx.subnet = extractSubnet(m.private_ip);
-            if (!ctx.shouldApprove)
-                return Result.ok("complete");
-            return Result.ok("await_device");
+            return Result.ok("approve_routes");
         }
-        case "await_device": {
-            ctx.device = await waitForDevice(ctx.tailscale, ctx.appName, 180000);
-            ctx.out.ok(`Router Joined Tailnet: ${ctx.device.addresses[0]}`);
+        case "approve_routes": {
             if (!ctx.subnet) {
                 const machines = await ctx.fly.machines.list(ctx.appName);
                 const m = machines.find((m) => m.private_ip);
                 if (m?.private_ip)
                     ctx.subnet = extractSubnet(m.private_ip);
             }
-            return Result.ok("approve_routes");
-        }
-        case "approve_routes": {
-            if (!ctx.device || !ctx.subnet) {
-                return Result.err("Missing Device or Subnet");
-            }
-            const policy = await ctx.tailscale.acl.getPolicy();
+            if (!ctx.subnet)
+                return Result.err("Missing Subnet");
+            let policy = await ctx.tailscale.acl.getPolicy();
             const hasAutoApprover = isAutoApproverConfigured(policy, ctx.tag);
-            if (hasAutoApprover) {
-                ctx.out.ok("Routes Auto-Approved via ACL Policy");
+            let approverReady = hasAutoApprover;
+            if (!hasAutoApprover && !ctx.manual && policy) {
+                const before = policy;
+                policy = patchAutoApprover(policy, ctx.tag, ctx.subnet);
+                assertAdditivePatch(before, policy);
+                const vr = await ctx.tailscale.acl.validatePolicy(policy);
+                if (!vr.ok) {
+                    ctx.out.warn(`Could Not Validate autoApprover Patch: ${vr.error ?? `HTTP ${vr.status}`}`);
+                }
+                else {
+                    const sr = await ctx.tailscale.acl.setPolicy(policy);
+                    if (sr.ok) {
+                        ctx.out.ok(`Added autoApprover for ${ctx.tag} → ${ctx.subnet}`);
+                        approverReady = true;
+                    }
+                    else if (sr.status === 403) {
+                        ctx.out.warn("API Token Lacks ACL Write Permission — Will Approve Routes Manually");
+                    }
+                    else {
+                        ctx.out.warn(`Could Not Set autoApprover: ${sr.error ?? `HTTP ${sr.status}`}`);
+                    }
+                }
             }
-            else {
+            // If the device isn't in the tailnet yet, the router hasn't
+            // authenticated. Mint an auth key and deliver it — the non-staged
+            // secrets set triggers a Fly restart. The router boots with the key,
+            // authenticates, and advertises routes. With autoApprover in place,
+            // routes are auto-approved immediately.
+            if (!ctx.device) {
+                const existing = await ctx.tailscale.devices.getByHostname(ctx.appName);
+                if (existing) {
+                    ctx.device = existing;
+                }
+                else {
+                    const authKey = await ctx.tailscale.auth.createKey({
+                        reusable: false,
+                        ephemeral: false,
+                        preauthorized: true,
+                        tags: [ctx.tag],
+                    });
+                    ctx.out.ok("Auth Key Created");
+                    const keySpinner = ctx.out.spinner("Delivering Auth Key (restarting router)");
+                    await ctx.fly.secrets.set(ctx.appName, {
+                        [SECRET_TAILSCALE_AUTHKEY]: authKey,
+                    });
+                    keySpinner.success("Auth Key Delivered");
+                    if (!ctx.shouldApprove) {
+                        ctx.out.dim("  Skipping Route Approval (--no-auto-approve)");
+                        return Result.ok("complete");
+                    }
+                    ctx.device = await waitForDevice(ctx.tailscale, ctx.appName, 180000);
+                    ctx.out.ok(`Router Joined Tailnet: ${ctx.device.addresses[0]}`);
+                }
+            }
+            const routes = await ctx.tailscale.routes.get(ctx.device.id);
+            if (routes && routes.unapproved.length > 0) {
+                if (approverReady) {
+                    ctx.out.warn("Routes Not Auto-Approved Despite autoApprover — Approving Manually");
+                }
                 await ctx.tailscale.routes.approve(ctx.device.id, [ctx.subnet]);
                 ctx.out.ok("Subnet Routes Approved");
             }
+            else {
+                ctx.out.ok("Routes Auto-Approved via ACL Policy");
+            }
             return Result.ok("configure_dns");
         }
         case "configure_dns": {

package/esm/cli/commands/list/apps.d.ts

@@ -0,0 +1,2 @@
+export declare const listApps: (argv: string[]) => Promise<void>;
+//# sourceMappingURL=apps.d.ts.map

package/esm/cli/commands/list/apps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/list/apps.ts"],"names":[],"mappings":"AAgCA,eAAO,MAAM,QAAQ,GAAU,MAAM,MAAM,EAAE,KAAG,OAAO,CAAC,IAAI,CAqE3D,CAAC"}

package/esm/cli/commands/list/apps.js

@@ -0,0 +1,72 @@
+// =============================================================================
+// List Apps — List All Workload Apps on a Network
+// =============================================================================
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { Table } from "../../../deps/jsr.io/@cliffy/table/1.0.0/mod.js";
+import { bold } from "../../../lib/cli.js";
+import { checkArgs } from "../../../lib/args.js";
+import { createOutput } from "../../../lib/output.js";
+import { findRouterApp, listWorkloadAppsOnNetwork, } from "../../../util/discovery.js";
+import { initSession } from "../../../util/session.js";
+// =============================================================================
+// List Apps Command
+// =============================================================================
+export const listApps = async (argv) => {
+    const opts = { string: ["org"], boolean: ["help", "json"] };
+    const args = parseArgs(argv, opts);
+    checkArgs(args, opts, "ambit list apps");
+    if (args.help) {
+        console.log(`
+${bold("ambit list apps")} - List Apps on a Network
+
+${bold("USAGE")}
+  ambit list apps <network> [--org <org>] [--json]
+
+${bold("OPTIONS")}
+  --org <org>   Fly.io organization slug
+  --json        Output as JSON
+
+${bold("EXAMPLES")}
+  ambit list apps browsers
+  ambit list apps browsers --json
+`);
+        return;
+    }
+    const out = createOutput(args.json);
+    const network = typeof args._[0] === "string" ? args._[0] : undefined;
+    if (!network) {
+        return out.die("Missing Network Name. Usage: ambit list apps <network>");
+    }
+    const { fly, org } = await initSession(out, {
+        json: args.json,
+        org: args.org,
+    });
+    const router = await findRouterApp(fly, org, network);
+    if (!router) {
+        return out.die(`No Network Found: '${network}'`);
+    }
+    const workloads = await listWorkloadAppsOnNetwork(fly, org, network);
+    if (workloads.length === 0) {
+        out.blank()
+            .text(`No Apps Found on Network '${network}'.`)
+            .dim("  Deploy one with: ambit deploy <app>.<network>")
+            .blank();
+        out.done({ network, apps: [] });
+        out.print();
+        return;
+    }
+    out.blank().header(`Apps on '${network}'`).blank();
+    const rows = workloads.map((w) => [w.appName, w.status]);
+    const table = new Table()
+        .header(["App", "Status"])
+        .body(rows)
+        .indent(2)
+        .padding(2);
+    out.text(table.toString());
+    out.blank();
+    out.done({
+        network,
+        apps: workloads.map((w) => ({ appName: w.appName, status: w.status })),
+    });
+    out.print();
+};

package/esm/cli/commands/list/index.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.d.ts.map

package/esm/cli/commands/list/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/list/index.ts"],"names":[],"mappings":""}

package/esm/cli/commands/list/index.js

@@ -0,0 +1,62 @@
+// =============================================================================
+// List Command - List Networks or Apps
+// =============================================================================
+import * as dntShim from "../../../_dnt.shims.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { bold } from "../../../lib/cli.js";
+import { registerCommand } from "../../mod.js";
+import { listNetworks } from "./networks.js";
+import { listApps } from "./apps.js";
+// =============================================================================
+// Top-Level Help
+// =============================================================================
+const showListHelp = () => {
+    console.log(`
+${bold("ambit list")} - List Networks or Apps
+
+${bold("USAGE")}
+  ambit list networks [options]
+  ambit list apps <network> [options]
+
+${bold("SUBCOMMANDS")}
+  networks   List all networks and their routers
+  apps       List workload apps on a specific network
+
+${bold("OPTIONS")}
+  --org <org>   Fly.io organization slug
+  --json        Output as JSON
+
+${bold("EXAMPLES")}
+  ambit list networks
+  ambit list apps browsers
+  ambit list apps browsers --json
+
+Run 'ambit list networks --help' or 'ambit list apps --help' for details.
+`);
+};
+// =============================================================================
+// Dispatcher
+// =============================================================================
+const list = async (argv) => {
+    const subcommand = typeof argv[0] === "string" ? argv[0] : undefined;
+    if (subcommand === "networks")
+        return listNetworks(argv.slice(1));
+    if (subcommand === "apps")
+        return listApps(argv.slice(1));
+    const args = parseArgs(argv, { boolean: ["help"] });
+    if (args.help) {
+        showListHelp();
+        return;
+    }
+    showListHelp();
+    dntShim.Deno.exit(1);
+};
+// =============================================================================
+// Register Command
+// =============================================================================
+registerCommand({
+    name: "list",
+    description: "List networks or apps",
+    usage: "ambit list networks|apps [options]",
+    run: list,
+});

package/esm/cli/commands/list/networks.d.ts

@@ -0,0 +1,2 @@
+export declare const listNetworks: (argv: string[]) => Promise<void>;
+//# sourceMappingURL=networks.d.ts.map

package/esm/cli/commands/list/networks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"networks.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/list/networks.ts"],"names":[],"mappings":"AAqEA,eAAO,MAAM,YAAY,GAAU,MAAM,MAAM,EAAE,KAAG,OAAO,CAAC,IAAI,CA2B/D,CAAC"}

package/esm/cli/commands/{list.js → list/networks.js}

@@ -1,28 +1,27 @@
 // =============================================================================
-// List Command - List All Discovered Routers
+// List Networks — List All Discovered Routers Across Networks
 // =============================================================================
-import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.28/mod.js";
-import { Table } from "../../deps/jsr.io/@cliffy/table/1.0.0/mod.js";
-import { bold } from "../../lib/cli.js";
-import { checkArgs } from "../../lib/args.js";
-import { createOutput } from "../../lib/output.js";
-import { registerCommand } from "../mod.js";
-import { discoverRouters } from "../../util/discovery.js";
-import { initSession } from "../../util/session.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { Table } from "../../../deps/jsr.io/@cliffy/table/1.0.0/mod.js";
+import { bold } from "../../../lib/cli.js";
+import { checkArgs } from "../../../lib/args.js";
+import { createOutput } from "../../../lib/output.js";
+import { discoverRouters } from "../../../util/discovery.js";
+import { initSession } from "../../../util/session.js";
 // =============================================================================
 // Stage: Render
 // =============================================================================
 const stageRender = (out, routers) => {
     if (routers.length === 0) {
         out.blank()
-            .text("No Routers Found.")
+            .text("No Networks Found.")
             .dim("  Create one with: ambit create <network>")
             .blank();
         out.done({ routers: [] });
         out.print();
         return;
     }
-    out.blank().header("Routers").blank();
+    out.blank().header("Networks").blank();
     const rows = routers.map((r) => {
         const tsStatus = r.tailscale
             ? (r.tailscale.online ? "online" : "offline")
@@ -31,14 +30,14 @@ const stageRender = (out, routers) => {
         return [
             r.network,
             r.appName,
+            r.status,
             r.machine?.region ?? "-",
-            r.machine?.state ?? "unknown",
             tsStatus,
             tag,
         ];
     });
     const table = new Table()
-        .header(["Network", "App", "Region", "State", "Tailscale", "Tag"])
+        .header(["Network", "App", "Status", "Region", "Tailscale", "Tag"])
         .body(rows)
         .indent(2)
         .padding(2);
@@ -48,18 +47,18 @@ const stageRender = (out, routers) => {
     out.print();
 };
 // =============================================================================
-// List Command
+// List Networks Command
 // =============================================================================
-const list = async (argv) => {
+export const listNetworks = async (argv) => {
     const opts = { string: ["org"], boolean: ["help", "json"] };
     const args = parseArgs(argv, opts);
-    checkArgs(args, opts, "ambit list");
+    checkArgs(args, opts, "ambit list networks");
     if (args.help) {
         console.log(`
-${bold("ambit list")} - List All Discovered Routers
+${bold("ambit list networks")} - List All Networks
 
 ${bold("USAGE")}
-  ambit list [--org <org>] [--json]
+  ambit list networks [--org <org>] [--json]
 
 ${bold("OPTIONS")}
   --org <org>   Fly.io organization slug
@@ -75,12 +74,3 @@ ${bold("OPTIONS")}
     const routers = await discoverRouters(out, fly, tailscale, org);
     stageRender(out, routers);
 };
-// =============================================================================
-// Register Command
-// =============================================================================
-registerCommand({
-    name: "list",
-    description: "List all discovered routers across networks",
-    usage: "ambit list [--org <org>] [--json]",
-    run: list,
-});

package/esm/cli/commands/status/app.d.ts

@@ -0,0 +1,2 @@
+export declare const statusApp: (argv: string[]) => Promise<void>;
+//# sourceMappingURL=app.d.ts.map

package/esm/cli/commands/status/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/status/app.ts"],"names":[],"mappings":"AA4JA,eAAO,MAAM,SAAS,GAAU,MAAM,MAAM,EAAE,KAAG,OAAO,CAAC,IAAI,CAyD5D,CAAC"}