@cardelli/ambit 0.3.3 → 0.3.5

package/README.md

@@ -211,6 +211,61 @@ Shows detailed status for a specific app: machines, Flycast IPs, and the backing
 | `--org <org>`     | Fly.io organization slug       |
 | `--json`          | Machine-readable JSON output   |
 
+### `ambit secrets list|set|unset|deploy <app>.<network>`
+
+Manage secrets for workload apps. Secrets are encrypted environment variables provided to the app at runtime.
+
+#### `ambit secrets list <app>.<network>`
+
+Lists secret names and digests (not values) for an app.
+
+#### `ambit secrets set <app>.<network> KEY=VALUE ...`
+
+Sets one or more secrets. Positional `KEY=VALUE` pairs and `--env` can be combined — positional args take precedence.
+
+| Flag              | Description                                  |
+| ----------------- | -------------------------------------------- |
+| `--env <file>`    | Load secrets from an env file                |
+| `--stage`         | Stage secrets without deploying              |
+| `--org <org>`     | Fly.io organization slug                     |
+| `--json`          | Machine-readable JSON output                 |
+
+#### `ambit secrets unset <app>.<network> KEY ...`
+
+Removes one or more secrets by name.
+
+| Flag              | Description                                  |
+| ----------------- | -------------------------------------------- |
+| `--stage`         | Stage removal without deploying              |
+| `--org <org>`     | Fly.io organization slug                     |
+| `--json`          | Machine-readable JSON output                 |
+
+#### `ambit secrets deploy <app>.<network>`
+
+Deploys staged secrets (from `set --stage` or `unset --stage`).
+
+| Flag              | Description                                  |
+| ----------------- | -------------------------------------------- |
+| `--org <org>`     | Fly.io organization slug                     |
+| `--json`          | Machine-readable JSON output                 |
+
+### `ambit logs <app>.<network>`
+
+Streams logs for a workload app. By default, logs are streamed continuously. Use `--no-tail` to fetch only buffered logs. Pipe through `less` for scrollable output:
+
+```bash
+npx @cardelli/ambit logs my-app.lab | less +F -R          # stream with scroll (Ctrl+C to scroll, F to resume)
+npx @cardelli/ambit logs my-app.lab --no-tail | less -R   # scroll buffered logs
+```
+
+| Flag                 | Description                                  |
+| -------------------- | -------------------------------------------- |
+| `-r`, `--region <r>` | Filter by region                             |
+| `--machine <id>`     | Filter by machine ID                         |
+| `-n`, `--no-tail`    | Only fetch buffered logs (no streaming)      |
+| `--org <org>`        | Fly.io organization slug                     |
+| `--json`             | JSON output                                  |
+
 ### `ambit destroy network <name>`
 
 Tears down a network: destroys the router, cleans up DNS, removes the Tailscale device, and automatically removes the router's tag from your Tailscale ACL policy (tagOwners and autoApprovers). If there are workload apps still on the network, ambit warns you before proceeding.

package/esm/cli/commands/create/index.js

@@ -169,7 +169,7 @@ const stageDeploy = async (out, fly, tailscale, opts) => {
 // =============================================================================
 // Stage 4: Summary
 // =============================================================================
-const stageSummary = async (out, fly, tailscale, ctx, opts) => {
+const stageSummary = async (out, _fly, tailscale, ctx, opts) => {
     const policy = await tailscale.acl.getPolicy();
     const hasAutoApprover = isAutoApproverConfigured(policy, opts.tag);
     out.done({
@@ -245,7 +245,7 @@ const create = async (argv) => {
         alias: { y: "yes" },
     };
     const args = parseArgs(argv, opts);
-    checkArgs(args, opts, "ambit create");
+    checkArgs(args, opts, "ambit create", 1);
     if (args.help) {
         console.log(`
 ${bold("ambit create")} - Create Tailscale Subnet Router

package/esm/cli/commands/create/machine.d.ts

@@ -1,4 +1,4 @@
-import { type Output } from "../../../lib/output.js";
+import type { Output } from "../../../lib/output.js";
 import { Result } from "../../../lib/result.js";
 import { type FlyProvider } from "../../../providers/fly.js";
 import type { TailscaleProvider } from "../../../providers/tailscale.js";

package/esm/cli/commands/create/machine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/create/machine.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAQhD,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAW7E,OAAO,KAAK,EAAgB,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAOrE,MAAM,MAAM,WAAW,GACnB,YAAY,GACZ,eAAe,GACf,gBAAgB,GAChB,eAAe,GACf,eAAe,GACf,UAAU,CAAC;AAMf,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACxD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,WAAW,CAAC;IACjB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAcD,eAAO,MAAM,aAAa,GACxB,KAAK,MAAM,CAAC,YAAY,CAAC,EACzB,YAAY,WAAW,SAMxB,CAAC;AAMF,eAAO,MAAM,aAAa,GACxB,KAAK,SAAS,KACb,OAAO,CAAC,WAAW,CA4BrB,CAAC;AAMF,eAAO,MAAM,gBAAgB,GAC3B,OAAO,WAAW,EAClB,KAAK,SAAS,KACb,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CA6K7B,CAAC"}
+{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/create/machine.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAQhD,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAW7E,OAAO,KAAK,EAAgB,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAOrE,MAAM,MAAM,WAAW,GACnB,YAAY,GACZ,eAAe,GACf,gBAAgB,GAChB,eAAe,GACf,eAAe,GACf,UAAU,CAAC;AAMf,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACxD,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,WAAW,CAAC;IACjB,SAAS,EAAE,iBAAiB,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAcD,eAAO,MAAM,aAAa,GACxB,KAAK,MAAM,CAAC,YAAY,CAAC,EACzB,YAAY,WAAW,SAMxB,CAAC;AAMF,eAAO,MAAM,aAAa,GACxB,KAAK,SAAS,KACb,OAAO,CAAC,WAAW,CA4BrB,CAAC;AAMF,eAAO,MAAM,gBAAgB,GAC3B,OAAO,WAAW,EAClB,KAAK,SAAS,KACb,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CA+K7B,CAAC"}

package/esm/cli/commands/deploy/index.js

@@ -153,7 +153,7 @@ const deploy = async (argv) => {
         default: { "main-port": "80" },
     };
     const args = parseArgs(argv, opts);
-    checkArgs(args, opts, "ambit deploy");
+    checkArgs(args, opts, "ambit deploy", 1);
     if (args.help) {
         console.log(`
 ${bold("ambit deploy")} - Deploy an App Safely on a Custom Private Network

package/esm/cli/commands/deploy/machine.d.ts

@@ -1,4 +1,4 @@
-import { type Output } from "../../../lib/output.js";
+import type { Output } from "../../../lib/output.js";
 import { Result } from "../../../lib/result.js";
 import { type FlyProvider, type SafeDeployOptions } from "../../../providers/fly.js";
 import type { DeployConfig } from "./modes.js";

package/esm/cli/commands/deploy/machine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/deploy/machine.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACvB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAM/C,MAAM,MAAM,WAAW,GACnB,YAAY,GACZ,WAAW,GACX,QAAQ,GACR,OAAO,GACP,UAAU,CAAC;AAMf,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE;QACL,mBAAmB,EAAE,MAAM,CAAC;QAC5B,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,SAAS,EAAE;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH,CAAC;AAEF,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,iBAAiB,CAAC;IACjC,KAAK,CAAC,EAAE;QACN,mBAAmB,EAAE,MAAM,CAAC;QAC5B,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH;AAaD,eAAO,MAAM,mBAAmB,GAC9B,KAAK,MAAM,CAAC,YAAY,CAAC,EACzB,YAAY,WAAW,SAMxB,CAAC;AAMF,eAAO,MAAM,aAAa,GACxB,KAAK,SAAS,KACb,OAAO,CAAC,WAAW,CAMrB,CAAC;AAMF,eAAO,MAAM,gBAAgB,GAC3B,OAAO,WAAW,EAClB,KAAK,SAAS,KACb,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CA6G7B,CAAC"}
+{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/deploy/machine.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACvB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAM/C,MAAM,MAAM,WAAW,GACnB,YAAY,GACZ,WAAW,GACX,QAAQ,GACR,OAAO,GACP,UAAU,CAAC;AAMf,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE;QACL,mBAAmB,EAAE,MAAM,CAAC;QAC5B,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,SAAS,EAAE;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH,CAAC;AAEF,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,iBAAiB,CAAC;IACjC,KAAK,CAAC,EAAE;QACN,mBAAmB,EAAE,MAAM,CAAC;QAC5B,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH;AAaD,eAAO,MAAM,mBAAmB,GAC9B,KAAK,MAAM,CAAC,YAAY,CAAC,EACzB,YAAY,WAAW,SAMxB,CAAC;AAMF,eAAO,MAAM,aAAa,GACxB,KAAK,SAAS,KACb,OAAO,CAAC,WAAW,CAMrB,CAAC;AAMF,eAAO,MAAM,gBAAgB,GAC3B,OAAO,WAAW,EAClB,KAAK,SAAS,KACb,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CA6G7B,CAAC"}

package/esm/cli/commands/deploy/modes.d.ts

@@ -1,4 +1,4 @@
-import { createOutput } from "../../../lib/output.js";
+import type { createOutput } from "../../../lib/output.js";
 /** Resolved deploy configuration — the output of mode-specific validation. */
 export interface DeployConfig {
     image?: string;

package/esm/cli/commands/deploy/modes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"modes.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/deploy/modes.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAQtD,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAoCD,sDAAsD;AACtD,eAAO,MAAM,gBAAgB,GAC3B,OAAO,MAAM,EACb,aAAa,MAAM,EACnB,KAAK,UAAU,CAAC,OAAO,YAAY,CAAC,KACnC,YAAY,GAAG,IAmBjB,CAAC;AAMF,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,GAC5B,gBAAgB,MAAM,GAAG,SAAS,EAClC,KAAK,UAAU,CAAC,OAAO,YAAY,CAAC,KACnC,OAAO,CAAC,YAAY,GAAG,IAAI,CAqC7B,CAAC;AAMF,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,GAC9B,aAAa,MAAM,EACnB,KAAK,UAAU,CAAC,OAAO,YAAY,CAAC,KACnC,OAAO,CAAC,YAAY,GAAG,IAAI,CAyE7B,CAAC"}
+{"version":3,"file":"modes.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/deploy/modes.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAQ3D,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAoCD,sDAAsD;AACtD,eAAO,MAAM,gBAAgB,GAC3B,OAAO,MAAM,EACb,aAAa,MAAM,EACnB,KAAK,UAAU,CAAC,OAAO,YAAY,CAAC,KACnC,YAAY,GAAG,IAmBjB,CAAC;AAMF,uEAAuE;AACvE,eAAO,MAAM,iBAAiB,GAC5B,gBAAgB,MAAM,GAAG,SAAS,EAClC,KAAK,UAAU,CAAC,OAAO,YAAY,CAAC,KACnC,OAAO,CAAC,YAAY,GAAG,IAAI,CAqC7B,CAAC;AAMF,4DAA4D;AAC5D,eAAO,MAAM,mBAAmB,GAC9B,aAAa,MAAM,EACnB,KAAK,UAAU,CAAC,OAAO,YAAY,CAAC,KACnC,OAAO,CAAC,YAAY,GAAG,IAAI,CAyE7B,CAAC"}

package/esm/cli/commands/destroy/app.js

@@ -107,7 +107,7 @@ export const destroyApp = async (argv) => {
         alias: { y: "yes" },
     };
     const args = parseArgs(argv, opts);
-    checkArgs(args, opts, "ambit destroy app");
+    checkArgs(args, opts, "ambit destroy app", 1);
     if (args.help) {
         console.log(`
 ${bold("ambit destroy app")} - Destroy a Workload App

package/esm/cli/commands/destroy/index.js

@@ -4,6 +4,7 @@
 import * as dntShim from "../../../_dnt.shims.js";
 import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
 import { bold } from "../../../lib/cli.js";
+import { checkArgs } from "../../../lib/args.js";
 import { registerCommand } from "../../mod.js";
 import { destroyNetwork } from "./network.js";
 import { destroyApp } from "./app.js";
@@ -46,7 +47,9 @@ const destroy = async (argv) => {
     if (subcommand === "app") {
         return destroyApp(argv.slice(1));
     }
-    const args = parseArgs(argv, { boolean: ["help"] });
+    const opts = { boolean: ["help"] };
+    const args = parseArgs(argv, opts);
+    checkArgs(args, opts, "ambit destroy", 0);
     if (args.help) {
         showDestroyHelp();
         return;

package/esm/cli/commands/destroy/network.js

@@ -225,7 +225,7 @@ export const destroyNetwork = async (argv) => {
         alias: { y: "yes" },
     };
     const args = parseArgs(argv, opts);
-    checkArgs(args, opts, "ambit destroy network");
+    checkArgs(args, opts, "ambit destroy network", 1);
     if (args.help) {
         console.log(`
 ${bold("ambit destroy network")} - Tear Down Router

package/esm/cli/commands/doctor.js

@@ -145,7 +145,7 @@ const doctorNetwork = async (argv) => {
         boolean: ["help", "json"],
     };
     const args = parseArgs(argv, opts);
-    checkArgs(args, opts, "ambit doctor network");
+    checkArgs(args, opts, "ambit doctor network", 1);
     if (args.help) {
         console.log(`
 ${bold("ambit doctor network")} - Check Router Health
@@ -192,7 +192,7 @@ const doctorApp = async (argv) => {
         boolean: ["help", "json"],
     };
     const args = parseArgs(argv, opts);
-    checkArgs(args, opts, "ambit doctor app");
+    checkArgs(args, opts, "ambit doctor app", 1);
     if (args.help) {
         console.log(`
 ${bold("ambit doctor app")} - Check App Health
@@ -286,7 +286,9 @@ const doctor = async (argv) => {
         return doctorNetwork(argv.slice(1));
     if (subcommand === "app")
         return doctorApp(argv.slice(1));
-    const args = parseArgs(argv, { boolean: ["help"] });
+    const opts = { string: ["org"], boolean: ["help", "json"] };
+    const args = parseArgs(argv, opts);
+    checkArgs(args, opts, "ambit doctor", 0);
     if (args.help) {
         showDoctorHelp();
         return;

package/esm/cli/commands/list/apps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apps.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/list/apps.ts"],"names":[],"mappings":"AAgCA,eAAO,MAAM,QAAQ,GAAU,MAAM,MAAM,EAAE,KAAG,OAAO,CAAC,IAAI,CAqE3D,CAAC"}
+{"version":3,"file":"apps.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/list/apps.ts"],"names":[],"mappings":"AA6BA,eAAO,MAAM,QAAQ,GAAU,MAAM,MAAM,EAAE,KAAG,OAAO,CAAC,IAAI,CAqE3D,CAAC"}

package/esm/cli/commands/list/apps.js

@@ -6,7 +6,7 @@ import { Table } from "../../../deps/jsr.io/@cliffy/table/1.0.0/mod.js";
 import { bold } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { createOutput } from "../../../lib/output.js";
-import { findRouterApp, listWorkloadAppsOnNetwork, } from "../../../util/discovery.js";
+import { findRouterApp, listWorkloadAppsOnNetwork } from "../../../util/discovery.js";
 import { initSession } from "../../../util/session.js";
 // =============================================================================
 // List Apps Command
@@ -14,7 +14,7 @@ import { initSession } from "../../../util/session.js";
 export const listApps = async (argv) => {
     const opts = { string: ["org"], boolean: ["help", "json"] };
     const args = parseArgs(argv, opts);
-    checkArgs(args, opts, "ambit list apps");
+    checkArgs(args, opts, "ambit list apps", 1);
     if (args.help) {
         console.log(`
 ${bold("ambit list apps")} - List Apps on a Network

package/esm/cli/commands/list/index.js

@@ -4,6 +4,7 @@
 import * as dntShim from "../../../_dnt.shims.js";
 import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
 import { bold } from "../../../lib/cli.js";
+import { checkArgs } from "../../../lib/args.js";
 import { registerCommand } from "../../mod.js";
 import { listNetworks } from "./networks.js";
 import { listApps } from "./apps.js";
@@ -43,7 +44,9 @@ const list = async (argv) => {
         return listNetworks(argv.slice(1));
     if (subcommand === "apps")
         return listApps(argv.slice(1));
-    const args = parseArgs(argv, { boolean: ["help"] });
+    const opts = { boolean: ["help"] };
+    const args = parseArgs(argv, opts);
+    checkArgs(args, opts, "ambit list", 0);
     if (args.help) {
         showListHelp();
         return;

package/esm/cli/commands/list/networks.js

@@ -52,7 +52,7 @@ const stageRender = (out, routers) => {
 export const listNetworks = async (argv) => {
     const opts = { string: ["org"], boolean: ["help", "json"] };
     const args = parseArgs(argv, opts);
-    checkArgs(args, opts, "ambit list networks");
+    checkArgs(args, opts, "ambit list networks", 0);
     if (args.help) {
         console.log(`
 ${bold("ambit list networks")} - List All Networks

package/esm/cli/commands/logs.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=logs.d.ts.map

package/esm/cli/commands/logs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logs.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/logs.ts"],"names":[],"mappings":""}

package/esm/cli/commands/logs.js

@@ -0,0 +1,142 @@
+// =============================================================================
+// Logs Command - Stream Logs for Workload Apps
+// =============================================================================
+import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { bold } from "../../lib/cli.js";
+import { checkArgs } from "../../lib/args.js";
+import { createOutput } from "../../lib/output.js";
+import { streamCommand } from "../../lib/command.js";
+import { registerCommand } from "../mod.js";
+import { findWorkloadApp } from "../../util/discovery.js";
+import { initSession } from "../../util/session.js";
+import { StreamTable } from "../../lib/table.js";
+// =============================================================================
+// Log Table
+// =============================================================================
+const logTable = new StreamTable([
+    { name: "Timestamp", width: 19 },
+    { name: "Region", width: 6 },
+    { name: "Level", width: 5 },
+    { name: "Message", width: 0 },
+]);
+const formatTimestamp = (ts) => {
+    return ts.replace("T", " ").replace(/\.\d+Z$/, "");
+};
+// =============================================================================
+// Logs Command
+// =============================================================================
+const logs = async (argv) => {
+    const opts = {
+        string: ["org", "region", "machine"],
+        boolean: ["help", "json", "no-tail"],
+        alias: { r: "region", n: "no-tail" },
+    };
+    const args = parseArgs(argv, opts);
+    checkArgs(args, opts, "ambit logs", 1);
+    if (args.help) {
+        console.log(`
+${bold("ambit logs")} - Stream Logs for a Workload App
+
+${bold("USAGE")}
+  ambit logs <app>.<network> [options]
+
+${bold("OPTIONS")}
+  --org <org>        Fly.io organization slug
+  -r, --region <r>   Filter by region
+  --machine <id>     Filter by machine ID
+  -n, --no-tail      Only fetch buffered logs (no streaming)
+  --json             JSON output
+
+${bold("EXAMPLES")}
+  ambit logs my-app.browsers
+  ambit logs my-app.browsers | less +F -R
+  ambit logs my-app.browsers --no-tail | less -R
+  ambit logs my-app.browsers --region iad --json
+`);
+        return;
+    }
+    const out = createOutput(args.json);
+    const appArg = args._[0];
+    if (!appArg || typeof appArg !== "string") {
+        return out.die("Missing App Name. Usage: ambit logs <app>.<network>");
+    }
+    if (!appArg.includes(".")) {
+        return out.die(`Missing Network. Use: ambit logs ${appArg}.<network>`);
+    }
+    const parts = appArg.split(".");
+    if (parts.length !== 2 || !parts[0] || !parts[1]) {
+        return out.die(`'${appArg}' Should Have Exactly One Dot, Like my-app.my-network`);
+    }
+    const app = parts[0];
+    const network = parts[1];
+    const { fly, org } = await initSession(out, {
+        json: args.json,
+        org: args.org,
+    });
+    const workload = await findWorkloadApp(fly, org, app, network);
+    if (!workload) {
+        return out.die(`App '${app}' Not Found on Network '${network}'`);
+    }
+    // Always request JSON from fly so we can parse and format
+    const flyArgs = ["fly", "logs", "-a", workload.appName, "--json"];
+    if (args["no-tail"])
+        flyArgs.push("--no-tail");
+    if (args.region)
+        flyArgs.push("--region", args.region);
+    if (args.machine)
+        flyArgs.push("--machine", args.machine);
+    const stream = streamCommand(flyArgs);
+    out.blank();
+    out.text(logTable.header());
+    out.text(logTable.separator());
+    // fly logs --json emits pretty-printed multi-line JSON objects.
+    // Accumulate lines and parse when brace depth returns to zero.
+    let buf = [];
+    let depth = 0;
+    for await (const line of stream.lines) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        for (const ch of trimmed) {
+            if (ch === "{")
+                depth++;
+            else if (ch === "}")
+                depth--;
+        }
+        buf.push(trimmed);
+        if (depth === 0 && buf.length > 0) {
+            const block = buf.join("");
+            buf = [];
+            try {
+                const entry = JSON.parse(block);
+                if (out.isJson()) {
+                    console.log(JSON.stringify(entry));
+                }
+                else {
+                    out.text(logTable.row([
+                        formatTimestamp(entry.timestamp ?? ""),
+                        entry.region ?? "",
+                        entry.level ?? "",
+                        entry.message ?? "",
+                    ]));
+                }
+            }
+            catch {
+                out.dim(`  ${block}`);
+            }
+        }
+    }
+    const result = await stream.done;
+    if (!result.ok && result.stderr) {
+        out.err(result.stderr.trim());
+    }
+};
+// =============================================================================
+// Register Command
+// =============================================================================
+registerCommand({
+    name: "logs",
+    description: "Stream logs for a workload app",
+    usage: "ambit logs <app>.<network> [--region <r>] [--no-tail] [--json]",
+    run: logs,
+});

package/esm/cli/commands/secrets.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=secrets.d.ts.map

package/esm/cli/commands/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/secrets.ts"],"names":[],"mappings":""}

package/esm/cli/commands/secrets.js

@@ -0,0 +1,302 @@
+// =============================================================================
+// Secrets Command - Manage Secrets for Workload Apps
+// =============================================================================
+import * as dntShim from "../../_dnt.shims.js";
+import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { Table } from "../../deps/jsr.io/@cliffy/table/1.0.0/mod.js";
+import { bold } from "../../lib/cli.js";
+import { checkArgs } from "../../lib/args.js";
+import { createOutput } from "../../lib/output.js";
+import { registerCommand } from "../mod.js";
+import { findWorkloadApp } from "../../util/discovery.js";
+import { initSession } from "../../util/session.js";
+// =============================================================================
+// Shared Helpers
+// =============================================================================
+const resolveAppTarget = (out, appArg, command) => {
+    if (!appArg || typeof appArg !== "string") {
+        return out.die(`Missing App Name. Usage: ${command} <app>.<network>`);
+    }
+    if (!appArg.includes(".")) {
+        return out.die(`Missing Network. Use: ${command} ${appArg}.<network>`);
+    }
+    const parts = appArg.split(".");
+    if (parts.length !== 2 || !parts[0] || !parts[1]) {
+        return out.die(`'${appArg}' Should Have Exactly One Dot, Like my-app.my-network`);
+    }
+    return { app: parts[0], network: parts[1] };
+};
+const resolveFlyAppName = async (out, fly, org, app, network) => {
+    const workload = await findWorkloadApp(fly, org, app, network);
+    if (!workload) {
+        return out.die(`App '${app}' Not Found on Network '${network}'`);
+    }
+    return workload.appName;
+};
+// =============================================================================
+// Secrets List
+// =============================================================================
+const secretsList = async (argv) => {
+    const opts = { string: ["org"], boolean: ["help", "json"] };
+    const args = parseArgs(argv, opts);
+    checkArgs(args, opts, "ambit secrets list", 1);
+    if (args.help) {
+        console.log(`
+${bold("ambit secrets list")} - List Secrets for an App
+
+${bold("USAGE")}
+  ambit secrets list <app>.<network> [--org <org>] [--json]
+
+${bold("OPTIONS")}
+  --org <org>   Fly.io organization slug
+  --json        Output as JSON
+
+${bold("EXAMPLES")}
+  ambit secrets list my-app.browsers
+  ambit secrets list my-app.browsers --json
+`);
+        return;
+    }
+    const out = createOutput(args.json);
+    const { app, network } = resolveAppTarget(out, args._[0], "ambit secrets list");
+    const { fly, org } = await initSession(out, {
+        json: args.json,
+        org: args.org,
+    });
+    const flyAppName = await resolveFlyAppName(out, fly, org, app, network);
+    const secrets = await fly.secrets.list(flyAppName);
+    if (secrets.length === 0) {
+        out.blank()
+            .text(`No Secrets Found for ${app}.${network}.`)
+            .blank();
+    }
+    else {
+        out.blank().header(`Secrets for ${app}.${network}`).blank();
+        const table = new Table()
+            .header(["Name", "Digest"])
+            .body(secrets.map((s) => [s.name, s.digest]))
+            .indent(2)
+            .padding(2);
+        out.text(table.toString());
+        out.blank();
+    }
+    out.done({ app, network, flyAppName, secrets });
+    out.print();
+};
+// =============================================================================
+// Secrets Set
+// =============================================================================
+const secretsSet = async (argv) => {
+    const opts = {
+        string: ["org", "env"],
+        boolean: ["help", "json", "stage"],
+    };
+    const args = parseArgs(argv, opts);
+    checkArgs(args, opts, "ambit secrets set", Infinity);
+    if (args.help) {
+        console.log(`
+${bold("ambit secrets set")} - Set Secrets for an App
+
+${bold("USAGE")}
+  ambit secrets set <app>.<network> KEY=VALUE ... [--org <org>] [--stage] [--json]
+  ambit secrets set <app>.<network> --env <file> [--org <org>] [--stage] [--json]
+
+${bold("OPTIONS")}
+  --env <file>  Load secrets from an env file (KEY=VALUE per line)
+  --org <org>   Fly.io organization slug
+  --stage       Stage secrets without deploying
+  --json        Output as JSON
+
+${bold("EXAMPLES")}
+  ambit secrets set my-app.browsers API_KEY=abc123
+  ambit secrets set my-app.browsers KEY1=val1 KEY2=val2 --stage
+  ambit secrets set my-app.browsers --env .env
+`);
+        return;
+    }
+    const out = createOutput(args.json);
+    const { app, network } = resolveAppTarget(out, args._[0], "ambit secrets set");
+    const secretsObj = {};
+    // Load from env file if provided
+    if (args.env) {
+        let content;
+        try {
+            content = await dntShim.Deno.readTextFile(args.env);
+        }
+        catch {
+            return out.die(`Failed to Read Env File: ${args.env}`);
+        }
+        for (const line of content.split("\n")) {
+            const trimmed = line.trim();
+            if (!trimmed || trimmed.startsWith("#"))
+                continue;
+            const eq = trimmed.indexOf("=");
+            if (eq === -1)
+                continue;
+            secretsObj[trimmed.slice(0, eq)] = trimmed.slice(eq + 1);
+        }
+    }
+    // Load from positional KEY=VALUE args
+    const pairs = args._.slice(1).map(String);
+    for (const pair of pairs) {
+        const eq = pair.indexOf("=");
+        if (eq === -1) {
+            return out.die(`Invalid Format: '${pair}'. Expected KEY=VALUE`);
+        }
+        secretsObj[pair.slice(0, eq)] = pair.slice(eq + 1);
+    }
+    if (Object.keys(secretsObj).length === 0) {
+        return out.die("No Secrets Provided. Use KEY=VALUE args or --env <file>");
+    }
+    const { fly, org } = await initSession(out, {
+        json: args.json,
+        org: args.org,
+    });
+    const flyAppName = await resolveFlyAppName(out, fly, org, app, network);
+    await out.spin(args.stage ? "Staging Secrets" : "Setting Secrets", () => fly.secrets.set(flyAppName, secretsObj, { stage: args.stage }));
+    out.done({ app, network, flyAppName });
+    out.print();
+};
+// =============================================================================
+// Secrets Unset
+// =============================================================================
+const secretsUnset = async (argv) => {
+    const opts = {
+        string: ["org"],
+        boolean: ["help", "json", "stage"],
+    };
+    const args = parseArgs(argv, opts);
+    checkArgs(args, opts, "ambit secrets unset", Infinity);
+    if (args.help) {
+        console.log(`
+${bold("ambit secrets unset")} - Remove Secrets from an App
+
+${bold("USAGE")}
+  ambit secrets unset <app>.<network> KEY ... [--org <org>] [--stage] [--json]
+
+${bold("OPTIONS")}
+  --org <org>   Fly.io organization slug
+  --stage       Stage removal without deploying
+  --json        Output as JSON
+
+${bold("EXAMPLES")}
+  ambit secrets unset my-app.browsers API_KEY
+  ambit secrets unset my-app.browsers KEY1 KEY2 --stage
+`);
+        return;
+    }
+    const out = createOutput(args.json);
+    const { app, network } = resolveAppTarget(out, args._[0], "ambit secrets unset");
+    const keys = args._.slice(1).map(String);
+    if (keys.length === 0) {
+        return out.die("No Secret Names Provided. Usage: ambit secrets unset <app>.<network> KEY ...");
+    }
+    const { fly, org } = await initSession(out, {
+        json: args.json,
+        org: args.org,
+    });
+    const flyAppName = await resolveFlyAppName(out, fly, org, app, network);
+    await out.spin(args.stage ? "Staging Secrets Removal" : "Removing Secrets", () => fly.secrets.unset(flyAppName, keys, { stage: args.stage }));
+    out.done({ app, network, flyAppName });
+    out.print();
+};
+// =============================================================================
+// Secrets Deploy
+// =============================================================================
+const secretsDeploy = async (argv) => {
+    const opts = { string: ["org"], boolean: ["help", "json"] };
+    const args = parseArgs(argv, opts);
+    checkArgs(args, opts, "ambit secrets deploy", 1);
+    if (args.help) {
+        console.log(`
+${bold("ambit secrets deploy")} - Deploy Staged Secrets
+
+${bold("USAGE")}
+  ambit secrets deploy <app>.<network> [--org <org>] [--json]
+
+${bold("OPTIONS")}
+  --org <org>   Fly.io organization slug
+  --json        Output as JSON
+
+${bold("EXAMPLES")}
+  ambit secrets deploy my-app.browsers
+`);
+        return;
+    }
+    const out = createOutput(args.json);
+    const { app, network } = resolveAppTarget(out, args._[0], "ambit secrets deploy");
+    const { fly, org } = await initSession(out, {
+        json: args.json,
+        org: args.org,
+    });
+    const flyAppName = await resolveFlyAppName(out, fly, org, app, network);
+    await out.spin("Deploying Secrets", () => fly.secrets.deploy(flyAppName));
+    out.done({ app, network, flyAppName });
+    out.print();
+};
+// =============================================================================
+// Top-Level Help
+// =============================================================================
+const showSecretsHelp = () => {
+    console.log(`
+${bold("ambit secrets")} - Manage Secrets for Workload Apps
+
+${bold("USAGE")}
+  ambit secrets list <app>.<network> [options]
+  ambit secrets set <app>.<network> KEY=VALUE ... [options]
+  ambit secrets unset <app>.<network> KEY ... [options]
+  ambit secrets deploy <app>.<network> [options]
+
+${bold("SUBCOMMANDS")}
+  list      List secret names and digests
+  set       Set one or more secrets
+  unset     Remove one or more secrets
+  deploy    Deploy staged secrets
+
+${bold("OPTIONS")}
+  --org <org>   Fly.io organization slug
+  --stage       Stage changes without deploying (set/unset only)
+  --json        Output as JSON
+
+${bold("EXAMPLES")}
+  ambit secrets list my-app.browsers
+  ambit secrets set my-app.browsers API_KEY=abc123
+  ambit secrets unset my-app.browsers API_KEY
+  ambit secrets deploy my-app.browsers
+
+Run 'ambit secrets <subcommand> --help' for details.
+`);
+};
+// =============================================================================
+// Dispatcher
+// =============================================================================
+const secrets = async (argv) => {
+    const subcommand = typeof argv[0] === "string" ? argv[0] : undefined;
+    if (subcommand === "list" || subcommand === "ls") {
+        return secretsList(argv.slice(1));
+    }
+    if (subcommand === "set")
+        return secretsSet(argv.slice(1));
+    if (subcommand === "unset")
+        return secretsUnset(argv.slice(1));
+    if (subcommand === "deploy")
+        return secretsDeploy(argv.slice(1));
+    const opts = { boolean: ["help"] };
+    const args = parseArgs(argv, opts);
+    checkArgs(args, opts, "ambit secrets", 0);
+    if (args.help) {
+        showSecretsHelp();
+        return;
+    }
+    showSecretsHelp();
+    dntShim.Deno.exit(1);
+};
+// =============================================================================
+// Register Command
+// =============================================================================
+registerCommand({
+    name: "secrets",
+    description: "Manage secrets for workload apps",
+    usage: "ambit secrets list|set|unset|deploy <app>.<network> [options]",
+    run: secrets,
+});

package/esm/cli/commands/share.js

@@ -168,7 +168,7 @@ const share = async (argv) => {
         boolean: ["help", "json"],
     };
     const args = parseArgs(argv, opts);
-    checkArgs(args, opts, "ambit share");
+    checkArgs(args, opts, "ambit share", Infinity);
     if (args.help) {
         console.log(`
 ${bold("ambit share")} - Grant Members Access to a Network

package/esm/cli/commands/status/app.js

@@ -100,7 +100,7 @@ export const statusApp = async (argv) => {
         boolean: ["help", "json"],
     };
     const args = parseArgs(argv, opts);
-    checkArgs(args, opts, "ambit status app");
+    checkArgs(args, opts, "ambit status app", 1);
     if (args.help) {
         console.log(`
 ${bold("ambit status app")} - Show App Status

package/esm/cli/commands/status/index.js

@@ -3,6 +3,7 @@
 // =============================================================================
 import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
 import { bold } from "../../../lib/cli.js";
+import { checkArgs } from "../../../lib/args.js";
 import { registerCommand } from "../../mod.js";
 import { statusNetworks } from "./networks.js";
 import { statusNetwork } from "./network.js";
@@ -50,7 +51,9 @@ const status = async (argv) => {
         return statusNetwork(argv.slice(1));
     if (subcommand === "app")
         return statusApp(argv.slice(1));
-    const args = parseArgs(argv, { boolean: ["help"] });
+    const opts = { string: ["org"], boolean: ["help", "json"] };
+    const args = parseArgs(argv, opts);
+    checkArgs(args, opts, "ambit status", 0);
     if (args.help) {
         showStatusHelp();
         return;

package/esm/cli/commands/status/network.js

@@ -73,7 +73,7 @@ const stageNetworkStatus = async (fly, tailscale, network, org, json) => {
 export const statusNetwork = async (argv) => {
     const opts = { string: ["org"], boolean: ["help", "json"] };
     const args = parseArgs(argv, opts);
-    checkArgs(args, opts, "ambit status network");
+    checkArgs(args, opts, "ambit status network", 1);
     if (args.help) {
         console.log(`
 ${bold("ambit status network")} - Show Detailed Status for a Network

package/esm/cli/commands/status/networks.js

@@ -14,7 +14,7 @@ import { initSession } from "../../../util/session.js";
 export const statusNetworks = async (argv) => {
     const opts = { string: ["org"], boolean: ["help", "json"] };
     const args = parseArgs(argv, opts);
-    checkArgs(args, opts, "ambit status networks");
+    checkArgs(args, opts, "ambit status networks", 0);
     if (args.help) {
         console.log(`
 ${bold("ambit status networks")} - Show Status of All Networks

package/esm/cli/mod.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../src/cli/mod.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAQD,eAAO,MAAM,eAAe,GAAI,SAAS,OAAO,KAAG,IAElD,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,KAAG,OAAO,GAAG,SAEnD,CAAC;AAEF,eAAO,MAAM,cAAc,QAAO,OAAO,EAExC,CAAC;AAQF,eAAO,MAAM,QAAQ,QAAO,IA+B3B,CAAC;AAEF,eAAO,MAAM,WAAW,QAAO,IAE9B,CAAC;AAMF,eAAO,MAAM,MAAM,GAAU,MAAM,MAAM,EAAE,KAAG,OAAO,CAAC,IAAI,CAuCzD,CAAC"}
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../src/cli/mod.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAQD,eAAO,MAAM,eAAe,GAAI,SAAS,OAAO,KAAG,IAElD,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,KAAG,OAAO,GAAG,SAEnD,CAAC;AAEF,eAAO,MAAM,cAAc,QAAO,OAAO,EAExC,CAAC;AAQF,eAAO,MAAM,QAAQ,QAAO,IAiC3B,CAAC;AAEF,eAAO,MAAM,WAAW,QAAO,IAE9B,CAAC;AAMF,eAAO,MAAM,MAAM,GAAU,MAAM,MAAM,EAAE,KAAG,OAAO,CAAC,IAAI,CAuCzD,CAAC"}

package/esm/cli/mod.js

@@ -35,6 +35,8 @@ ${bold("COMMANDS")}
   share      Grant a Tailscale group access to a network via ACL rules
   list       List all discovered routers across networks
   status     Show router status, network, and tailnet info
+  secrets    Manage secrets for workload apps
+  logs       Stream logs for a workload app
   destroy    Destroy a network (router) or a workload app
   doctor     Check that Tailscale and the router are working correctly
 

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "@cardelli/ambit",
-    "version": "0.3.3",
+    "version": "0.3.5",
     "description": "Deploy apps to the cloud that only you and your AI agents can reach",
     "license": "MIT",
     "tasks": {

package/esm/lib/args.d.ts

@@ -1,11 +1,14 @@
 /**
  * Validates parsed args against the declared options spec.
- * Dies with a Title Case error if unknown flags are found.
- * Pass the same options object you gave to parseArgs.
+ * Dies with a Title Case error if unknown flags or unexpected positional
+ * arguments are found.  Pass the same options object you gave to parseArgs.
+ *
+ * `maxPositional` (default 0) limits how many bare positional args are
+ * allowed.  Set it to the number the command actually expects.
  */
 export declare const checkArgs: (args: Record<string, unknown>, opts: {
     string?: readonly string[] | string[];
     boolean?: readonly string[] | string[];
     alias?: Record<string, string | string[]>;
-}, command: string) => void;
+}, command: string, maxPositional?: number) => void;
 //# sourceMappingURL=args.d.ts.map

package/esm/lib/args.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../../src/lib/args.ts"],"names":[],"mappings":"AAMA;;;;GAIG;AACH,eAAO,MAAM,SAAS,GACpB,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM;IACJ,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IACtC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;CAC3C,EACD,SAAS,MAAM,KACd,IAmBF,CAAC"}
+{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../../src/lib/args.ts"],"names":[],"mappings":"AAMA;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,GACpB,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,MAAM;IACJ,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IACtC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;CAC3C,EACD,SAAS,MAAM,EACf,sBAAiB,KAChB,IA4BF,CAAC"}

package/esm/lib/args.js

@@ -4,10 +4,13 @@
 import { createOutput } from "./output.js";
 /**
  * Validates parsed args against the declared options spec.
- * Dies with a Title Case error if unknown flags are found.
- * Pass the same options object you gave to parseArgs.
+ * Dies with a Title Case error if unknown flags or unexpected positional
+ * arguments are found.  Pass the same options object you gave to parseArgs.
+ *
+ * `maxPositional` (default 0) limits how many bare positional args are
+ * allowed.  Set it to the number the command actually expects.
  */
-export const checkArgs = (args, opts, command) => {
+export const checkArgs = (args, opts, command, maxPositional = 0) => {
     const known = new Set(["_"]);
     for (const k of opts.string ?? [])
         known.add(k);
@@ -25,4 +28,10 @@ export const checkArgs = (args, opts, command) => {
         const out = createOutput(!!args.json);
         out.die(`Unknown Flag(s): ${bad.join(", ")}. Run '${command} --help' for Usage.`);
     }
+    const positional = Array.isArray(args._) ? args._ : [];
+    if (positional.length > maxPositional) {
+        const extra = positional.slice(maxPositional).join(", ");
+        const out = createOutput(!!args.json);
+        out.die(`Unexpected Argument(s): ${extra}. Run '${command} --help' for Usage.`);
+    }
 };

package/esm/lib/command.d.ts

@@ -23,4 +23,13 @@ export declare class CmdResult {
 export declare const runCommand: (args: string[], options?: RunOptions) => Promise<CmdResult>;
 /** Run and parse stdout as JSON. */
 export declare const runJson: <T>(args: string[], options?: RunOptions) => Promise<Result<T>>;
+export interface StreamHandle {
+    lines: AsyncIterable<string>;
+    done: Promise<CmdResult>;
+}
+/**
+ * Spawn a command and stream stdout line-by-line via an async iterable.
+ * Use `done` to check the exit code after the stream ends.
+ */
+export declare const streamCommand: (args: string[], options?: Omit<RunOptions, "interactive">) => StreamHandle;
 //# sourceMappingURL=command.d.ts.map

package/esm/lib/command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/lib/command.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAMrC,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;CAC5B;AAMD,qBAAa,SAAS;IAIlB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM;IALzB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;gBAGV,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM;IAKzB,iDAAiD;IACjD,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;IAapB,8BAA8B;IAC9B,IAAI,MAAM,IAAI,MAAM,CAEnB;CACF;AAMD;;;GAGG;AACH,eAAO,MAAM,UAAU,GACrB,MAAM,MAAM,EAAE,EACd,UAAU,UAAU,KACnB,OAAO,CAAC,SAAS,CAyCnB,CAAC;AAMF,oCAAoC;AACpC,eAAO,MAAM,OAAO,GAAI,CAAC,EACvB,MAAM,MAAM,EAAE,EACd,UAAU,UAAU,KACnB,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAuD,CAAC"}
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/lib/command.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAMrC,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,KAAK,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;CAC5B;AAMD,qBAAa,SAAS;IAIlB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM;IALzB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;gBAGV,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM;IAKzB,iDAAiD;IACjD,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;IAapB,8BAA8B;IAC9B,IAAI,MAAM,IAAI,MAAM,CAEnB;CACF;AAMD;;;GAGG;AACH,eAAO,MAAM,UAAU,GACrB,MAAM,MAAM,EAAE,EACd,UAAU,UAAU,KACnB,OAAO,CAAC,SAAS,CAyCnB,CAAC;AAMF,oCAAoC;AACpC,eAAO,MAAM,OAAO,GAAI,CAAC,EACvB,MAAM,MAAM,EAAE,EACd,UAAU,UAAU,KACnB,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAuD,CAAC;AAM5E,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;CAC1B;AAED;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,MAAM,EAAE,EACd,UAAU,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,KACxC,YA+BF,CAAC"}

package/esm/lib/command.js

@@ -2,6 +2,8 @@
 // Shell Command Helpers
 // =============================================================================
 import { spawn } from "node:child_process";
+import { createInterface } from "node:readline";
+import process from "node:process";
 import { Result } from "./result.js";
 // =============================================================================
 // Command Result
@@ -82,3 +84,33 @@ export const runCommand = (args, options) => {
 // =============================================================================
 /** Run and parse stdout as JSON. */
 export const runJson = (args, options) => runCommand(args, options).then((r) => r.json());
+/**
+ * Spawn a command and stream stdout line-by-line via an async iterable.
+ * Use `done` to check the exit code after the stream ends.
+ */
+export const streamCommand = (args, options) => {
+    const [cmd, ...cmdArgs] = args;
+    const child = spawn(cmd, cmdArgs, {
+        cwd: options?.cwd,
+        env: options?.env ? { ...process.env, ...options.env } : undefined,
+        stdio: [
+            options?.stdin === "inherit" ? "inherit" : "ignore",
+            "pipe",
+            "pipe",
+        ],
+    });
+    child.stdout.setEncoding("utf8");
+    child.stderr.setEncoding("utf8");
+    const rl = createInterface({ input: child.stdout });
+    const stderr = [];
+    child.stderr.on("data", (chunk) => stderr.push(chunk));
+    const done = new Promise((resolve) => {
+        child.on("error", (error) => {
+            resolve(new CmdResult(-1, "", error.message));
+        });
+        child.on("close", (code) => {
+            resolve(new CmdResult(code ?? 1, "", stderr.join("")));
+        });
+    });
+    return { lines: rl, done };
+};

package/esm/lib/table.d.ts

@@ -0,0 +1,23 @@
+export interface Column {
+    name: string;
+    width: number;
+}
+export interface StreamTableOptions {
+    indent?: number;
+    padding?: number;
+}
+export declare class StreamTable {
+    private columns;
+    private indent;
+    private padding;
+    constructor(columns: Column[], opts?: StreamTableOptions);
+    /** Render the header row (bold column names). */
+    header(): string;
+    /** Render a separator line under the header. */
+    separator(): string;
+    /** Render a single data row. */
+    row(values: string[]): string;
+    private effectiveWidth;
+    private pad;
+}
+//# sourceMappingURL=table.d.ts.map

package/esm/lib/table.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"table.d.ts","sourceRoot":"","sources":["../../src/lib/table.ts"],"names":[],"mappings":"AAgBA,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAMD,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAW;IAC1B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAAS;gBAEZ,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,kBAAkB;IAMxD,iDAAiD;IACjD,MAAM,IAAI,MAAM;IAMhB,gDAAgD;IAChD,SAAS,IAAI,MAAM;IAWnB,gCAAgC;IAChC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM;IAU7B,OAAO,CAAC,cAAc;IAQtB,OAAO,CAAC,GAAG;CAMZ"}

package/esm/lib/table.js

@@ -0,0 +1,64 @@
+// =============================================================================
+// StreamTable - Fixed-Width Column Formatter for Streaming Output
+// =============================================================================
+//
+// Unlike @cliffy/table which needs all rows upfront to calculate widths,
+// StreamTable uses fixed column widths so rows can be rendered one at a time.
+// Each method returns a string — pass it to out.text() for JSON mode guard.
+//
+// =============================================================================
+import { bold, dim } from "./cli.js";
+// =============================================================================
+// StreamTable
+// =============================================================================
+export class StreamTable {
+    columns;
+    indent;
+    padding;
+    constructor(columns, opts) {
+        this.columns = columns;
+        this.indent = " ".repeat(opts?.indent ?? 2);
+        this.padding = " ".repeat(opts?.padding ?? 2);
+    }
+    /** Render the header row (bold column names). */
+    header() {
+        return this.indent + this.columns
+            .map((col, i) => bold(this.pad(col.name, col.width, i)))
+            .join(this.padding);
+    }
+    /** Render a separator line under the header. */
+    separator() {
+        return this.indent + dim(this.columns
+            .map((col, i) => {
+            const w = this.effectiveWidth(col.width, i);
+            return w > 0 ? "─".repeat(w) : "─".repeat(col.name.length);
+        })
+            .join(this.padding));
+    }
+    /** Render a single data row. */
+    row(values) {
+        return this.indent + this.columns
+            .map((col, i) => this.pad(values[i] ?? "", col.width, i))
+            .join(this.padding);
+    }
+    // ===========================================================================
+    // Internal
+    // ===========================================================================
+    effectiveWidth(width, index) {
+        // width=0 on last column means unbounded
+        if (width === 0 && index === this.columns.length - 1)
+            return 0;
+        // width=0 on non-last column falls back to header name length
+        if (width === 0)
+            return this.columns[index].name.length;
+        return width;
+    }
+    pad(value, width, index) {
+        const w = this.effectiveWidth(width, index);
+        if (w === 0)
+            return value; // unbounded last column
+        if (value.length > w)
+            return value.slice(0, w - 1) + "…";
+        return value.padEnd(w);
+    }
+}

package/esm/main.d.ts

@@ -7,4 +7,6 @@ import "./cli/commands/list/index.js";
 import "./cli/commands/status/index.js";
 import "./cli/commands/destroy/index.js";
 import "./cli/commands/doctor.js";
+import "./cli/commands/secrets.js";
+import "./cli/commands/logs.js";
 //# sourceMappingURL=main.d.ts.map

package/esm/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AACA,OAAO,qBAAqB,CAAC;AAkC7B,OAAO,gCAAgC,CAAC;AACxC,OAAO,gCAAgC,CAAC;AACxC,OAAO,yBAAyB,CAAC;AACjC,OAAO,8BAA8B,CAAC;AACtC,OAAO,gCAAgC,CAAC;AACxC,OAAO,iCAAiC,CAAC;AACzC,OAAO,0BAA0B,CAAC"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AACA,OAAO,qBAAqB,CAAC;AAoC7B,OAAO,gCAAgC,CAAC;AACxC,OAAO,gCAAgC,CAAC;AACxC,OAAO,yBAAyB,CAAC;AACjC,OAAO,8BAA8B,CAAC;AACtC,OAAO,gCAAgC,CAAC;AACxC,OAAO,iCAAiC,CAAC;AACzC,OAAO,0BAA0B,CAAC;AAClC,OAAO,2BAA2B,CAAC;AACnC,OAAO,wBAAwB,CAAC"}

package/esm/main.js

@@ -14,6 +14,8 @@ import * as dntShim from "./_dnt.shims.js";
 //   deploy     Deploy an app safely on a custom private network
 //   share      Grant a group access to a network via Tailscale ACL rules
 //   status     Show router status, network, and tailnet info
+//   secrets    Manage secrets for workload apps
+//   logs       Stream logs for a workload app
 //   destroy    Destroy a network (router) or a workload app
 //   doctor     Check that Tailscale and the router are working correctly
 //
@@ -37,6 +39,8 @@ import "./cli/commands/list/index.js";
 import "./cli/commands/status/index.js";
 import "./cli/commands/destroy/index.js";
 import "./cli/commands/doctor.js";
+import "./cli/commands/secrets.js";
+import "./cli/commands/logs.js";
 // =============================================================================
 // Main
 // =============================================================================

package/esm/providers/fly.d.ts

@@ -57,9 +57,17 @@ export interface FlyProvider {
         destroy(app: string, machineId: string): Promise<void>;
     };
     secrets: {
+        list(app: string): Promise<Array<{
+            name: string;
+            digest: string;
+        }>>;
         set(app: string, secrets: Record<string, string>, opts?: {
             stage?: boolean;
         }): Promise<void>;
+        unset(app: string, keys: string[], opts?: {
+            stage?: boolean;
+        }): Promise<void>;
+        deploy(app: string): Promise<void>;
     };
     ips: {
         list(app: string): Promise<FlyIp[]>;

package/esm/providers/fly.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fly.d.ts","sourceRoot":"","sources":["../../src/providers/fly.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,KAAK,MAAM,EACX,KAAK,UAAU,EAIf,KAAK,KAAK,EAEV,KAAK,UAAU,EAIhB,MAAM,mBAAmB,CAAC;AAa3B;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAMxC;AAMD,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,eAAe,GAAG,eAAe,CAAC;AAE9E,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAMD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE;QACJ,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE;YAAE,WAAW,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;KAC7B,CAAC;IACF,IAAI,EAAE;QACJ,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;KACzC,CAAC;IACF,IAAI,EAAE;QACJ,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACpD,MAAM,CACJ,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,GAC7C,OAAO,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACvC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;KAClE,CAAC;IACF,QAAQ,EAAE;QACR,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACzC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACxD,CAAC;IACF,OAAO,EAAE;QACP,GAAG,CACD,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,IAAI,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE,GACzB,OAAO,CAAC,IAAI,CAAC,CAAC;KAClB,CAAC;IACF,GAAG,EAAE;QACH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9D,CAAC;IACF,KAAK,EAAE;QACL,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACtD,CAAC;IACF,MAAM,EAAE;QACN,MAAM,CACJ,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,GAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;QACjB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC7D,CAAC;CACH;AAMD,eAAO,MAAM,iBAAiB,QAAO,WAqcpC,CAAC"}
+{"version":3,"file":"fly.d.ts","sourceRoot":"","sources":["../../src/providers/fly.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,KAAK,MAAM,EACX,KAAK,UAAU,EAIf,KAAK,KAAK,EAEV,KAAK,UAAU,EAIhB,MAAM,mBAAmB,CAAC;AAa3B;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAMxC;AAMD,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,eAAe,GAAG,eAAe,CAAC;AAE9E,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAMD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE;QACJ,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE;YAAE,WAAW,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;KAC7B,CAAC;IACF,IAAI,EAAE;QACJ,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;KACzC,CAAC;IACF,IAAI,EAAE;QACJ,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACpD,MAAM,CACJ,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,GAC7C,OAAO,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACvC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;KAClE,CAAC;IACF,QAAQ,EAAE;QACR,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACzC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACxD,CAAC;IACF,OAAO,EAAE;QACP,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC,CAAC;QACpE,GAAG,CACD,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,IAAI,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE,GACzB,OAAO,CAAC,IAAI,CAAC,CAAC;QACjB,KAAK,CACH,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE,GACzB,OAAO,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACpC,CAAC;IACF,GAAG,EAAE;QACH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9D,CAAC;IACF,KAAK,EAAE;QACL,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACtD,CAAC;IACF,MAAM,EAAE;QACN,MAAM,CACJ,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,GAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;QACjB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC7D,CAAC;CACH;AAMD,eAAO,MAAM,iBAAiB,QAAO,WAgfpC,CAAC"}

package/esm/providers/fly.js

@@ -246,6 +246,10 @@ export const createFlyProvider = () => {
             },
         },
         secrets: {
+            async list(app) {
+                const result = await runJson(["fly", "secrets", "list", "-a", app, "--json"]);
+                return result.unwrapOr([]);
+            },
             async set(app, secrets, opts) {
                 const pairs = Object.entries(secrets)
                     .filter(([_, v]) => v !== undefined && v !== "")
@@ -261,6 +265,30 @@ export const createFlyProvider = () => {
                     return die("Failed to Set Secrets");
                 }
             },
+            async unset(app, keys, opts) {
+                if (keys.length === 0)
+                    return;
+                const args = ["fly", "secrets", "unset", ...keys, "-a", app];
+                if (opts?.stage) {
+                    args.push("--stage");
+                }
+                const result = await runCommand(args);
+                if (!result.ok) {
+                    return die("Failed to Unset Secrets");
+                }
+            },
+            async deploy(app) {
+                const result = await runCommand([
+                    "fly",
+                    "secrets",
+                    "deploy",
+                    "-a",
+                    app,
+                ]);
+                if (!result.ok) {
+                    return die("Failed to Deploy Secrets");
+                }
+            },
         },
         ips: {
             async list(app) {

package/esm/util/fly-transforms.d.ts

@@ -1,5 +1,4 @@
-import type { FlyMachine } from "../schemas/fly.js";
-import { type FlyMachineGuestSchema } from "../schemas/fly.js";
+import type { FlyMachine, FlyMachineGuestSchema } from "../schemas/fly.js";
 import type { z } from "../deps/jsr.io/@zod/zod/4.3.6/src/index.js";
 /**
  * Map Fly machine state to internal state.

package/esm/util/fly-transforms.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fly-transforms.d.ts","sourceRoot":"","sources":["../../src/util/fly-transforms.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,4CAA4C,CAAC;AAMpE;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAC7B,UAAU,MAAM,KACf,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,QAiBtC,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,iBAAiB,GAC5B,QAAQ,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,KAC5C,eAAe,GAAG,eAAe,GAAG,eAOtC,CAAC;AAMF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,6DAA6D;AAC7D,eAAO,MAAM,WAAW,GAAI,KAAK,UAAU,EAAE,KAAG,aAAa,EAQ5D,CAAC;AAMF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,eAAO,MAAM,aAAa,GACxB,MAAM,WAAW,KAChB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CASlC,CAAC;AAMF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,KAAG,MAOnD,CAAC;AAMF,eAAO,MAAM,aAAa,GAAI,WAAW,MAAM,KAAG,MAKjD,CAAC"}
+{"version":3,"file":"fly-transforms.d.ts","sourceRoot":"","sources":["../../src/util/fly-transforms.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,4CAA4C,CAAC;AAMpE;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAC7B,UAAU,MAAM,KACf,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,QAiBtC,CAAC;AAMF;;GAEG;AACH,eAAO,MAAM,iBAAiB,GAC5B,QAAQ,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,KAC5C,eAAe,GAAG,eAAe,GAAG,eAOtC,CAAC;AAMF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,6DAA6D;AAC7D,eAAO,MAAM,WAAW,GAAI,KAAK,UAAU,EAAE,KAAG,aAAa,EAQ5D,CAAC;AAMF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,eAAO,MAAM,aAAa,GACxB,MAAM,WAAW,KAChB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CASlC,CAAC;AAMF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,KAAG,MAOnD,CAAC;AAMF,eAAO,MAAM,aAAa,GAAI,WAAW,MAAM,KAAG,MAKjD,CAAC"}

package/esm/util/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/util/resolve.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAMvD;;GAEG;AACH,eAAO,MAAM,UAAU,GACrB,KAAK,WAAW,EAChB,MAAM;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,EACtC,KAAK,MAAM,CAAC,GAAG,CAAC,KACf,OAAO,CAAC,MAAM,CA6BhB,CAAC"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/util/resolve.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAMvD;;GAEG;AACH,eAAO,MAAM,UAAU,GACrB,KAAK,WAAW,EAChB,MAAM;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,EAEtC,KAAK,MAAM,CAAC,GAAG,CAAC,KACf,OAAO,CAAC,MAAM,CA6BhB,CAAC"}

package/esm/util/resolve.js

@@ -8,7 +8,9 @@ import { prompt } from "../lib/cli.js";
 /**
  * Resolve Fly.io organization: --org flag → single org auto-select → prompt.
  */
-export const resolveOrg = async (fly, args, out) => {
+export const resolveOrg = async (fly, args, 
+// deno-lint-ignore no-explicit-any
+out) => {
     if (args.org)
         return args.org;
     if (args.json) {

package/esm/util/template.js

@@ -24,7 +24,7 @@ import { Result } from "../lib/result.js";
 /** Shorthand for returning a typed fetch error. */
 const fail = (message) => Result.err(message);
 /** Format a template reference for display. */
-const formatRef = (ref) => {
+const _formatRef = (ref) => {
     const base = ref.path === "."
         ? `${ref.owner}/${ref.repo}`
         : `${ref.owner}/${ref.repo}/${ref.path}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cardelli/ambit",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "Deploy apps to the cloud that only you and your AI agents can reach",
   "license": "MIT",
   "scripts": {},