@cardelli/ambit 0.3.5 → 0.4.1

package/README.md

@@ -65,15 +65,41 @@ Open `http://my-crazy-site.lab`. It works for you and nobody else.
 
 ## Commands
 
+### `ambit auth login`
+
+Authenticates with both Fly.io and Tailscale. Only prompts for credentials that are missing or invalid — existing valid tokens are preserved. Run this before using any other command.
+
+| Flag                    | Description                                    |
+| ----------------------- | ---------------------------------------------- |
+| `--ts-api-key <key>`    | Tailscale API access token (tskey-api-...)      |
+| `--fly-api-key <token>` | Fly.io API token                                |
+| `--json`                | Machine-readable JSON output                    |
+
+### `ambit auth whoami`
+
+Shows the current authentication status for both Fly.io and Tailscale.
+
+| Flag     | Description                 |
+| -------- | --------------------------- |
+| `--json` | Machine-readable JSON output |
+
+### `ambit auth logout`
+
+Clears all stored credentials and logs out of Fly.io.
+
+| Flag          | Description              |
+| ------------- | ------------------------ |
+| `-y`, `--yes` | Skip confirmation prompt |
+| `--json`      | Machine-readable JSON    |
+
 ### `ambit create <network>`
 
-This is the first command you run, it sets up your private network: a named slice of the cloud that only your devices can reach. Under the hood it handles Fly.io and Tailscale authentication, deploys the router, sets up DNS, configures your local machine to accept the new routes, and automatically adds the router's tag to your Tailscale ACL policy.
+Creates a private network. Deploys a Tailscale subnet router on a Fly.io custom network, sets up DNS, configures your local machine to accept the new routes, and automatically adds the router's tag to your Tailscale ACL policy. Requires `ambit auth login` first.
 
 | Flag                | Description                                                                 |
 | ------------------- | --------------------------------------------------------------------------- |
 | `--org <org>`       | Fly.io organization slug                                                    |
 | `--region <region>` | Fly.io region (default: `iad`)                                              |
-| `--api-key <key>`   | Tailscale API access token (tskey-api-...)                                  |
 | `--tag <tag>`       | Tailscale ACL tag for the router (default: `tag:ambit-<network>`)           |
 | `--manual`          | Skip automatic Tailscale ACL configuration (tagOwners + autoApprovers)      |
 | `--no-auto-approve` | Skip waiting for router and approving routes                                |
@@ -104,7 +130,7 @@ npx @cardelli/ambit share browsers group:team alice@example.com group:contractor
 
 This puts an app onto your private network. This is what you run whenever you want to host something. If the app doesn't exist yet, ambit creates it on the right network for you. The network can be specified as part of the name (`my-app.lab`) or with `--network` (`my-app --network lab`).
 
-Before deploying, ambit scans your config for settings that don't make sense on a private network (like `force_https`, which only matters for public traffic). After deploying, it checks that no public IPs were allocated, releases any that were, and verifies the app has a private address on the network you specified.
+Before deploying, ambit scans your config for settings that don't make sense on a private network (like `force_https`, which only matters for public traffic). After deploying, it checks that no public IPs were allocated, releases any that were, and verifies the app has a private address on the network you specified. Three environment variables are set automatically: `AMBIT_APP_NAME`, `AMBIT_NETWORK_NAME`, and `AMBIT_OUTBOUND_PROXY`.
 
 There are three deployment modes. They are mutually exclusive — you can only use one at a time.
 

package/esm/cli/commands/auth.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=auth.d.ts.map

package/esm/cli/commands/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/auth.ts"],"names":[],"mappings":""}

package/esm/cli/commands/auth.js

@@ -0,0 +1,336 @@
+// =============================================================================
+// Auth Command - Manage Fly.io and Tailscale Authentication
+// =============================================================================
+import * as dntShim from "../../_dnt.shims.js";
+import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { bold, confirm, readSecret } from "../../lib/cli.js";
+import { checkArgs } from "../../lib/args.js";
+import { createOutput } from "../../lib/output.js";
+import { registerCommand } from "../mod.js";
+import { runCommand } from "../../lib/command.js";
+import { createTailscaleProvider } from "../../providers/tailscale.js";
+import { getCredentialStore } from "../../util/credentials.js";
+import { TAILSCALE_API_KEY_PREFIX } from "../../util/constants.js";
+import { FlyAuthSchema } from "../../schemas/fly.js";
+import { fileExists } from "../../lib/cli.js";
+// =============================================================================
+// Helpers
+// =============================================================================
+const tryFlyWhoami = async (token) => {
+    const result = await runCommand(["fly", "auth", "whoami", "--json"], token ? { env: { FLY_API_TOKEN: token } } : undefined);
+    if (!result.ok)
+        return null;
+    const auth = result.json();
+    if (!auth.ok)
+        return null;
+    const parsed = FlyAuthSchema.safeParse(auth.value);
+    return parsed.success ? parsed.data.email : null;
+};
+const readFlyConfigToken = async () => {
+    const home = dntShim.Deno.env.get("HOME") || dntShim.Deno.env.get("USERPROFILE") || "";
+    const configPath = `${home}/.fly/config.yml`;
+    if (!(await fileExists(configPath)))
+        return null;
+    const content = await dntShim.Deno.readTextFile(configPath);
+    const match = content.match(/access_token:\s*(.+)/);
+    return match?.[1]?.trim() ?? null;
+};
+// =============================================================================
+// Auth Login
+// =============================================================================
+const authLogin = async (argv) => {
+    const opts = {
+        string: ["ts-api-key", "fly-api-key"],
+        boolean: ["help", "json"],
+    };
+    const args = parseArgs(argv, opts);
+    checkArgs(args, opts, "ambit auth login", 0);
+    if (args.help) {
+        console.log(`
+${bold("ambit auth login")} - Authenticate with Fly.io and Tailscale
+
+${bold("USAGE")}
+  ambit auth login [options]
+
+${bold("OPTIONS")}
+  --ts-api-key <key>    Tailscale API access token (tskey-api-...)
+  --fly-api-key <token> Fly.io API token
+  --json                Output as JSON
+
+${bold("DESCRIPTION")}
+  Authenticates with both Fly.io and Tailscale. Only prompts for
+  credentials that are missing or invalid — existing valid tokens
+  are preserved.
+
+${bold("EXAMPLES")}
+  ambit auth login
+  ambit auth login --ts-api-key tskey-api-... --fly-api-key fo1_...
+`);
+        return;
+    }
+    const out = createOutput(args.json);
+    const credentials = getCredentialStore();
+    // =========================================================================
+    // Step 1: Fly.io
+    // =========================================================================
+    out.blank().header("Fly.io Authentication").blank();
+    let flyEmail;
+    if (args["fly-api-key"]) {
+        const email = await tryFlyWhoami(args["fly-api-key"]);
+        if (!email) {
+            return out.die("Invalid Fly.io API Token");
+        }
+        await credentials.setFlyToken(args["fly-api-key"]);
+        out.ok(`Authenticated as ${email}`);
+        flyEmail = email;
+    }
+    else {
+        const storedToken = await credentials.getFlyToken();
+        const storedEmail = storedToken
+            ? await tryFlyWhoami(storedToken)
+            : null;
+        if (storedEmail) {
+            out.ok(`Already Authenticated as ${storedEmail}`);
+            flyEmail = storedEmail;
+        }
+        else {
+            if (args.json) {
+                return out.die("Not Authenticated with Fly.io. Provide --fly-api-key in JSON Mode");
+            }
+            const loginResult = await runCommand(["fly", "auth", "login"], {
+                interactive: true,
+            });
+            if (!loginResult.ok) {
+                return out.die("Fly.io Authentication Failed");
+            }
+            const token = await readFlyConfigToken();
+            if (!token) {
+                return out.die("Could Not Read Fly.io Token After Login");
+            }
+            const email = await tryFlyWhoami(token);
+            if (!email) {
+                return out.die("Fly.io Authentication Verification Failed");
+            }
+            await credentials.setFlyToken(token);
+            out.ok(`Authenticated as ${email}`);
+            flyEmail = email;
+        }
+    }
+    // =========================================================================
+    // Step 2: Tailscale
+    // =========================================================================
+    out.blank().header("Tailscale Authentication").blank();
+    let tailscaleOk = false;
+    if (args["ts-api-key"]) {
+        if (!args["ts-api-key"].startsWith(TAILSCALE_API_KEY_PREFIX)) {
+            return out.die("Invalid Token Format. Expected 'tskey-api-...' (API Access Token, Not Auth Key)");
+        }
+        const tailscale = createTailscaleProvider(args["ts-api-key"]);
+        const validateSpinner = out.spinner("Validating API Access Token");
+        const isValid = await tailscale.auth.validateKey();
+        if (!isValid) {
+            validateSpinner.fail("Invalid API Access Token");
+            return out.die("Failed to Validate Tailscale API Access Token");
+        }
+        validateSpinner.success("API Access Token Validated");
+        await credentials.setTailscaleApiKey(args["ts-api-key"]);
+        tailscaleOk = true;
+    }
+    else {
+        const storedKey = await credentials.getTailscaleApiKey();
+        if (storedKey) {
+            const tailscale = createTailscaleProvider(storedKey);
+            const validateSpinner = out.spinner("Checking Stored API Key");
+            const isValid = await tailscale.auth.validateKey();
+            if (isValid) {
+                validateSpinner.success("API Key Already Configured");
+                tailscaleOk = true;
+            }
+            else {
+                validateSpinner.fail("Stored API Key Is Invalid or Expired");
+                // Fall through to prompt
+            }
+        }
+        if (!tailscaleOk) {
+            if (args.json) {
+                return out.die("Tailscale API Key Not Configured. Provide --ts-api-key in JSON Mode");
+            }
+            out.dim("Ambit Needs an API Access Token (Not an Auth Key) to Manage Your Tailnet.")
+                .dim("Create One at:").link("  https://login.tailscale.com/admin/settings/keys")
+                .blank();
+            const apiKey = await readSecret("API access token (tskey-api-...): ");
+            if (!apiKey) {
+                return out.die("Tailscale API Access Token Required");
+            }
+            if (!apiKey.startsWith(TAILSCALE_API_KEY_PREFIX)) {
+                return out.die("Invalid Token Format. Expected 'tskey-api-...' (API Access Token, Not Auth Key)");
+            }
+            const tailscale = createTailscaleProvider(apiKey);
+            const validateSpinner = out.spinner("Validating API Access Token");
+            const isValid = await tailscale.auth.validateKey();
+            if (!isValid) {
+                validateSpinner.fail("Invalid API Access Token");
+                return out.die("Failed to Validate Tailscale API Access Token");
+            }
+            validateSpinner.success("API Access Token Validated");
+            await credentials.setTailscaleApiKey(apiKey);
+            tailscaleOk = true;
+        }
+    }
+    out.blank();
+    out.done({ fly: flyEmail, tailscale: tailscaleOk });
+    out.print();
+};
+// =============================================================================
+// Auth Whoami
+// =============================================================================
+const authWhoami = async (argv) => {
+    const opts = {
+        boolean: ["help", "json"],
+    };
+    const args = parseArgs(argv, opts);
+    checkArgs(args, opts, "ambit auth whoami", 0);
+    if (args.help) {
+        console.log(`
+${bold("ambit auth whoami")} - Show Current Authentication Status
+
+${bold("USAGE")}
+  ambit auth whoami [options]
+
+${bold("OPTIONS")}
+  --json   Output as JSON
+
+${bold("EXAMPLES")}
+  ambit auth whoami
+  ambit auth whoami --json
+`);
+        return;
+    }
+    const out = createOutput(args.json);
+    const credentials = getCredentialStore();
+    // =========================================================================
+    // Step 1: Fly.io
+    // =========================================================================
+    let flyEmail = null;
+    const storedToken = await credentials.getFlyToken();
+    if (storedToken) {
+        flyEmail = await tryFlyWhoami(storedToken);
+    }
+    if (!flyEmail) {
+        flyEmail = await tryFlyWhoami();
+    }
+    // =========================================================================
+    // Step 2: Tailscale
+    // =========================================================================
+    let tailscaleOk = false;
+    const storedKey = await credentials.getTailscaleApiKey();
+    if (storedKey) {
+        const tailscale = createTailscaleProvider(storedKey);
+        tailscaleOk = await tailscale.auth.validateKey();
+    }
+    // =========================================================================
+    // Output
+    // =========================================================================
+    out.blank();
+    out.text(`  Fly.io:     ${flyEmail ?? "Not Authenticated"}`);
+    out.text(`  Tailscale:  ${tailscaleOk ? "API Key Configured" : "Not Configured"}`);
+    out.blank();
+    out.done({ fly: flyEmail, tailscale: tailscaleOk });
+    out.print();
+};
+// =============================================================================
+// Auth Logout
+// =============================================================================
+const authLogout = async (argv) => {
+    const opts = {
+        boolean: ["help", "json", "yes"],
+        alias: { y: "yes" },
+    };
+    const args = parseArgs(argv, opts);
+    checkArgs(args, opts, "ambit auth logout", 0);
+    if (args.help) {
+        console.log(`
+${bold("ambit auth logout")} - Clear Stored Credentials
+
+${bold("USAGE")}
+  ambit auth logout [options]
+
+${bold("OPTIONS")}
+  -y, --yes   Skip confirmation prompt
+  --json      Output as JSON
+
+${bold("EXAMPLES")}
+  ambit auth logout
+  ambit auth logout --yes
+`);
+        return;
+    }
+    const out = createOutput(args.json);
+    if (!args.yes && !args.json) {
+        const ok = await confirm("This will clear all stored credentials. Continue?");
+        if (!ok) {
+            return out.die("Aborted");
+        }
+    }
+    const credentials = getCredentialStore();
+    await credentials.clear();
+    out.ok("Cleared Stored Credentials");
+    await runCommand(["fly", "auth", "logout"]);
+    out.ok("Logged Out of Fly.io");
+    out.blank();
+    out.done({ fly: true, tailscale: true });
+    out.print();
+};
+// =============================================================================
+// Top-Level Help
+// =============================================================================
+const showAuthHelp = () => {
+    console.log(`
+${bold("ambit auth")} - Manage Fly.io and Tailscale Authentication
+
+${bold("USAGE")}
+  ambit auth <subcommand> [options]
+
+${bold("SUBCOMMANDS")}
+  login     Authenticate with Fly.io and Tailscale
+  whoami    Show current authentication status
+  logout    Clear stored credentials
+
+${bold("EXAMPLES")}
+  ambit auth login
+  ambit auth whoami
+  ambit auth logout
+
+Run 'ambit auth <subcommand> --help' for details.
+`);
+};
+// =============================================================================
+// Dispatcher
+// =============================================================================
+const auth = async (argv) => {
+    const subcommand = typeof argv[0] === "string" ? argv[0] : undefined;
+    if (subcommand === "login")
+        return authLogin(argv.slice(1));
+    if (subcommand === "whoami")
+        return authWhoami(argv.slice(1));
+    if (subcommand === "logout")
+        return authLogout(argv.slice(1));
+    const opts = { boolean: ["help"] };
+    const args = parseArgs(argv, opts);
+    checkArgs(args, opts, "ambit auth", 0);
+    if (args.help) {
+        showAuthHelp();
+        return;
+    }
+    showAuthHelp();
+    dntShim.Deno.exit(1);
+};
+// =============================================================================
+// Register Command
+// =============================================================================
+registerCommand({
+    name: "auth",
+    description: "Manage Fly.io and Tailscale authentication",
+    usage: "ambit auth login|whoami|logout [options]",
+    run: auth,
+});

package/esm/cli/commands/create/index.js

@@ -2,7 +2,7 @@
 // Create Command - Create Tailscale Subnet Router on Fly.io Custom Network
 // =============================================================================
 import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
-import { bold, readSecret } from "../../../lib/cli.js";
+import { bold } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { createOutput } from "../../../lib/output.js";
 import { runMachine } from "../../../lib/machine.js";
@@ -21,7 +21,8 @@ import { createTransition, hydrateCreate, reportSkipped, } from "./machine.js";
 // =============================================================================
 const stageFlyConfig = async (out, opts) => {
     out.header("Step 1: Fly.io Configuration").blank();
-    const fly = createFlyProvider();
+    const flyToken = await getCredentialStore().getFlyToken();
+    const fly = createFlyProvider(flyToken ?? undefined);
     await fly.auth.ensureInstalled();
     const email = await fly.auth.login({ interactive: !opts.json });
     out.ok(`Authenticated as ${email}`);
@@ -44,18 +45,9 @@ const handleAclSetFailure = (out, result, action) => {
 const stageTailscaleConfig = async (out, opts) => {
     out.header("Step 2: Tailscale Configuration").blank();
     const credentials = getCredentialStore();
-    let apiKey = opts.apiKey || (await credentials.getTailscaleApiKey());
+    const apiKey = await credentials.getTailscaleApiKey();
     if (!apiKey) {
-        if (opts.json) {
-            return out.die("--api-key Is Required in JSON Mode");
-        }
-        out.dim("Ambit Needs an API Access Token (Not an Auth Key) to Manage Your Tailnet.")
-            .dim("Create One at:").link("  https://login.tailscale.com/admin/settings/keys")
-            .blank();
-        apiKey = await readSecret("API access token (tskey-api-...): ");
-        if (!apiKey) {
-            return out.die("Tailscale API Access Token Required");
-        }
+        return out.die("Tailscale API Key Required. Run 'ambit auth login'");
     }
     if (!apiKey.startsWith(TAILSCALE_API_KEY_PREFIX)) {
         return out.die("Invalid Token Format. Expected 'tskey-api-...' (API Access Token, Not Auth Key)");
@@ -68,7 +60,6 @@ const stageTailscaleConfig = async (out, opts) => {
         return out.die("Failed to Validate Tailscale API Access Token");
     }
     validateSpinner.success("API Access Token Validated");
-    await credentials.setTailscaleApiKey(apiKey);
     const tagOwnerSpinner = out.spinner(`Checking tagOwners for ${opts.tag}`);
     let policy = await tailscale.acl.getPolicy();
     const hasTagOwner = isTagOwnerConfigured(policy, opts.tag);
@@ -240,7 +231,7 @@ const stageSummary = async (out, _fly, tailscale, ctx, opts) => {
 // =============================================================================
 const create = async (argv) => {
     const opts = {
-        string: ["org", "region", "api-key", "tag"],
+        string: ["org", "region", "tag"],
         boolean: ["help", "yes", "json", "no-auto-approve", "manual"],
         alias: { y: "yes" },
     };
@@ -256,7 +247,6 @@ ${bold("USAGE")}
 ${bold("OPTIONS")}
   --org <org>         Fly.io organization slug
   --region <region>   Fly.io region (default: iad)
-  --api-key <key>     Tailscale API access token (tskey-api-...)
   --tag <tag>         Tailscale ACL tag for the router (default: tag:ambit-<network>)
   --manual            Skip automatic Tailscale ACL configuration (tagOwners + autoApprovers)
   --no-auto-approve   Skip waiting for router and approving routes
@@ -305,7 +295,6 @@ ${bold("EXAMPLES")}
     const tailscale = await stageTailscaleConfig(out, {
         json: args.json,
         manual,
-        apiKey: args["api-key"],
         tag,
         network,
     });

package/esm/cli/commands/deploy/machine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/deploy/machine.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACvB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAM/C,MAAM,MAAM,WAAW,GACnB,YAAY,GACZ,WAAW,GACX,QAAQ,GACR,OAAO,GACP,UAAU,CAAC;AAMf,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE;QACL,mBAAmB,EAAE,MAAM,CAAC;QAC5B,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,SAAS,EAAE;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH,CAAC;AAEF,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,iBAAiB,CAAC;IACjC,KAAK,CAAC,EAAE;QACN,mBAAmB,EAAE,MAAM,CAAC;QAC5B,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH;AAaD,eAAO,MAAM,mBAAmB,GAC9B,KAAK,MAAM,CAAC,YAAY,CAAC,EACzB,YAAY,WAAW,SAMxB,CAAC;AAMF,eAAO,MAAM,aAAa,GACxB,KAAK,SAAS,KACb,OAAO,CAAC,WAAW,CAMrB,CAAC;AAMF,eAAO,MAAM,gBAAgB,GAC3B,OAAO,WAAW,EAClB,KAAK,SAAS,KACb,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CA6G7B,CAAC"}
+{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/deploy/machine.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACvB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAM/C,MAAM,MAAM,WAAW,GACnB,YAAY,GACZ,WAAW,GACX,QAAQ,GACR,OAAO,GACP,UAAU,CAAC;AAMf,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE;QACL,mBAAmB,EAAE,MAAM,CAAC;QAC5B,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,SAAS,EAAE;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH,CAAC;AAEF,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,iBAAiB,CAAC;IACjC,KAAK,CAAC,EAAE;QACN,mBAAmB,EAAE,MAAM,CAAC;QAC5B,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH;AAaD,eAAO,MAAM,mBAAmB,GAC9B,KAAK,MAAM,CAAC,YAAY,CAAC,EACzB,YAAY,WAAW,SAMxB,CAAC;AAMF,eAAO,MAAM,aAAa,GACxB,KAAK,SAAS,KACb,OAAO,CAAC,WAAW,CAMrB,CAAC;AAMF,eAAO,MAAM,gBAAgB,GAC3B,OAAO,WAAW,EAClB,KAAK,SAAS,KACb,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAiH7B,CAAC"}

package/esm/cli/commands/deploy/machine.js

@@ -59,11 +59,16 @@ export const deployTransition = async (phase, ctx) => {
             if (!ctx.created) {
                 ctx.out.skip(`App '${ctx.flyAppName}' Exists`);
             }
+            const ambitSecrets = {
+                AMBIT_APP_NAME: ctx.app,
+                AMBIT_NETWORK_NAME: ctx.network,
+            };
             if (ctx.routerPrivateIp) {
                 const proxyUrl = `socks5://[${ctx.routerPrivateIp}]:${SOCKS_PROXY_PORT}`;
-                await ctx.out.spin("Setting Outbound Proxy", () => ctx.fly.secrets.set(ctx.flyAppName, { [SECRET_AMBIT_OUTBOUND_PROXY]: proxyUrl }, { stage: true }));
+                ambitSecrets[SECRET_AMBIT_OUTBOUND_PROXY] = proxyUrl;
                 ctx.out.ok(`Outbound Proxy: ${proxyUrl}`);
             }
+            await ctx.out.spin("Staging Ambit Secrets", () => ctx.fly.secrets.set(ctx.flyAppName, ambitSecrets, { stage: true }));
             return Result.ok("deploy");
         }
         case "deploy": {

package/esm/cli/commands/doctor.js

@@ -108,6 +108,20 @@ const stageAppChecks = async (fly, tailscale, org, report, app, network) => {
     report(`App Running (${app}.${network})`, started !== undefined, machines.length > 0
         ? `Machine State: ${machines[0].state}`
         : "No Machines Found");
+    const secrets = await fly.secrets.list(workload.appName);
+    const secretNames = new Set(secrets.map((s) => s.name));
+    const hasAmbitSecrets = secretNames.has("AMBIT_APP_NAME") &&
+        secretNames.has("AMBIT_NETWORK_NAME");
+    if (!hasAmbitSecrets) {
+        await fly.secrets.set(workload.appName, {
+            AMBIT_APP_NAME: app,
+            AMBIT_NETWORK_NAME: network,
+        });
+        report(`Ambit Secrets Set (${app}.${network})`, true, "Auto-configured");
+    }
+    else {
+        report(`Ambit Secrets Set (${app}.${network})`, true);
+    }
     const router = await findRouterApp(fly, org, network);
     if (!router) {
         report(`Router Exists (${network})`, false, `Create with: ambit create ${network}`);

package/esm/cli/mod.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../src/cli/mod.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAQD,eAAO,MAAM,eAAe,GAAI,SAAS,OAAO,KAAG,IAElD,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,KAAG,OAAO,GAAG,SAEnD,CAAC;AAEF,eAAO,MAAM,cAAc,QAAO,OAAO,EAExC,CAAC;AAQF,eAAO,MAAM,QAAQ,QAAO,IAiC3B,CAAC;AAEF,eAAO,MAAM,WAAW,QAAO,IAE9B,CAAC;AAMF,eAAO,MAAM,MAAM,GAAU,MAAM,MAAM,EAAE,KAAG,OAAO,CAAC,IAAI,CAuCzD,CAAC"}
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../src/cli/mod.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAQD,eAAO,MAAM,eAAe,GAAI,SAAS,OAAO,KAAG,IAElD,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,KAAG,OAAO,GAAG,SAEnD,CAAC;AAEF,eAAO,MAAM,cAAc,QAAO,OAAO,EAExC,CAAC;AAQF,eAAO,MAAM,QAAQ,QAAO,IAkC3B,CAAC;AAEF,eAAO,MAAM,WAAW,QAAO,IAE9B,CAAC;AAMF,eAAO,MAAM,MAAM,GAAU,MAAM,MAAM,EAAE,KAAG,OAAO,CAAC,IAAI,CAuCzD,CAAC"}

package/esm/cli/mod.js

@@ -30,6 +30,7 @@ ${bold("USAGE")}
   ambit <command> [options]
 
 ${bold("COMMANDS")}
+  auth       Manage Fly.io and Tailscale authentication
   create     Create a Tailscale subnet router on a Fly.io custom network
   deploy     Deploy an app safely on a custom private network
   share      Grant a Tailscale group access to a network via ACL rules

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "@cardelli/ambit",
-    "version": "0.3.5",
+    "version": "0.4.1",
     "description": "Deploy apps to the cloud that only you and your AI agents can reach",
     "license": "MIT",
     "tasks": {

package/esm/deps/jsr.io/@std/path/1.1.4/constants.d.ts

@@ -2,7 +2,7 @@
  * The character used to separate entries in the PATH environment variable.
  * On Windows, this is `;`. On all other platforms, this is `:`.
  */
-export declare const DELIMITER: ";" | ":";
+export declare const DELIMITER: ":" | ";";
 /**
  * The character used to separate components of a file path.
  * On Windows, this is `\`. On all other platforms, this is `/`.

package/esm/main.d.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import "./_dnt.polyfills.js";
+import "./cli/commands/auth.js";
 import "./cli/commands/create/index.js";
 import "./cli/commands/deploy/index.js";
 import "./cli/commands/share.js";

package/esm/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AACA,OAAO,qBAAqB,CAAC;AAoC7B,OAAO,gCAAgC,CAAC;AACxC,OAAO,gCAAgC,CAAC;AACxC,OAAO,yBAAyB,CAAC;AACjC,OAAO,8BAA8B,CAAC;AACtC,OAAO,gCAAgC,CAAC;AACxC,OAAO,iCAAiC,CAAC;AACzC,OAAO,0BAA0B,CAAC;AAClC,OAAO,2BAA2B,CAAC;AACnC,OAAO,wBAAwB,CAAC"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AACA,OAAO,qBAAqB,CAAC;AAoC7B,OAAO,wBAAwB,CAAC;AAChC,OAAO,gCAAgC,CAAC;AACxC,OAAO,gCAAgC,CAAC;AACxC,OAAO,yBAAyB,CAAC;AACjC,OAAO,8BAA8B,CAAC;AACtC,OAAO,gCAAgC,CAAC;AACxC,OAAO,iCAAiC,CAAC;AACzC,OAAO,0BAA0B,CAAC;AAClC,OAAO,2BAA2B,CAAC;AACnC,OAAO,wBAAwB,CAAC"}

package/esm/main.js

@@ -32,6 +32,7 @@ import * as dntShim from "./_dnt.shims.js";
 // =============================================================================
 import { runCli } from "./cli/mod.js";
 import { Spinner, statusErr } from "./lib/cli.js";
+import "./cli/commands/auth.js";
 import "./cli/commands/create/index.js";
 import "./cli/commands/deploy/index.js";
 import "./cli/commands/share.js";

package/esm/providers/fly.d.ts

@@ -85,5 +85,5 @@ export interface FlyProvider {
         app(app: string, options: SafeDeployOptions): Promise<void>;
     };
 }
-export declare const createFlyProvider: () => FlyProvider;
+export declare const createFlyProvider: (token?: string) => FlyProvider;
 //# sourceMappingURL=fly.d.ts.map

package/esm/providers/fly.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fly.d.ts","sourceRoot":"","sources":["../../src/providers/fly.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,KAAK,MAAM,EACX,KAAK,UAAU,EAIf,KAAK,KAAK,EAEV,KAAK,UAAU,EAIhB,MAAM,mBAAmB,CAAC;AAa3B;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAMxC;AAMD,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,eAAe,GAAG,eAAe,CAAC;AAE9E,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAMD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE;QACJ,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE;YAAE,WAAW,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;KAC7B,CAAC;IACF,IAAI,EAAE;QACJ,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;KACzC,CAAC;IACF,IAAI,EAAE;QACJ,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACpD,MAAM,CACJ,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,GAC7C,OAAO,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACvC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;KAClE,CAAC;IACF,QAAQ,EAAE;QACR,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACzC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACxD,CAAC;IACF,OAAO,EAAE;QACP,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC,CAAC;QACpE,GAAG,CACD,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,IAAI,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE,GACzB,OAAO,CAAC,IAAI,CAAC,CAAC;QACjB,KAAK,CACH,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE,GACzB,OAAO,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACpC,CAAC;IACF,GAAG,EAAE;QACH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9D,CAAC;IACF,KAAK,EAAE;QACL,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACtD,CAAC;IACF,MAAM,EAAE;QACN,MAAM,CACJ,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,GAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;QACjB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC7D,CAAC;CACH;AAMD,eAAO,MAAM,iBAAiB,QAAO,WAgfpC,CAAC"}
+{"version":3,"file":"fly.d.ts","sourceRoot":"","sources":["../../src/providers/fly.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,KAAK,MAAM,EACX,KAAK,UAAU,EAIf,KAAK,KAAK,EAEV,KAAK,UAAU,EAIhB,MAAM,mBAAmB,CAAC;AAa3B;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,+CAA+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAMxC;AAMD,MAAM,MAAM,WAAW,GAAG,eAAe,GAAG,eAAe,GAAG,eAAe,CAAC;AAE9E,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAMD,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAMD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE;QACJ,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE;YAAE,WAAW,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QACzD,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;KAC7B,CAAC;IACF,IAAI,EAAE;QACJ,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;KACzC,CAAC;IACF,IAAI,EAAE;QACJ,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACtC,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACpD,MAAM,CACJ,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,GAC7C,OAAO,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACvC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;KAClE,CAAC;IACF,QAAQ,EAAE;QACR,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QACzC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACxD,CAAC;IACF,OAAO,EAAE;QACP,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC,CAAC;QACpE,GAAG,CACD,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,IAAI,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE,GACzB,OAAO,CAAC,IAAI,CAAC,CAAC;QACjB,KAAK,CACH,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,CAAC,EAAE;YAAE,KAAK,CAAC,EAAE,OAAO,CAAA;SAAE,GACzB,OAAO,CAAC,IAAI,CAAC,CAAC;QACjB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACpC,CAAC;IACF,GAAG,EAAE;QACH,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACrD,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC9D,CAAC;IACF,KAAK,EAAE;QACL,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACtD,CAAC;IACF,MAAM,EAAE;QACN,MAAM,CACJ,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,GAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;QACjB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KAC7D,CAAC;CACH;AAMD,eAAO,MAAM,iBAAiB,GAAI,QAAQ,MAAM,KAAG,WAogBlD,CAAC"}

package/esm/providers/fly.js

@@ -31,7 +31,14 @@ export class FlyDeployError extends Error {
 // =============================================================================
 // Create Fly Provider
 // =============================================================================
-export const createFlyProvider = () => {
+export const createFlyProvider = (token) => {
+    const envOverride = token ? { FLY_API_TOKEN: token } : undefined;
+    const run = (args, opts) => runCommand(args, envOverride
+        ? { ...opts, env: { ...opts?.env, ...envOverride } }
+        : opts);
+    const runJ = (args, opts) => runJson(args, envOverride
+        ? { ...opts, env: { ...opts?.env, ...envOverride } }
+        : opts);
     const provider = {
         auth: {
             async ensureInstalled() {
@@ -41,7 +48,7 @@ export const createFlyProvider = () => {
             },
             async login(opts) {
                 const interactive = opts?.interactive ?? true;
-                const result = await runCommand(["fly", "auth", "whoami", "--json"]);
+                const result = await run(["fly", "auth", "whoami", "--json"]);
                 if (result.ok) {
                     const auth = result.json();
                     if (auth.ok) {
@@ -52,15 +59,15 @@ export const createFlyProvider = () => {
                     }
                 }
                 if (!interactive) {
-                    return die("Not Authenticated with Fly.io. Run 'fly auth login' First");
+                    return die("Not Authenticated with Fly.io. Run 'ambit auth login' First");
                 }
-                const loginResult = await runCommand(["fly", "auth", "login"], {
+                const loginResult = await run(["fly", "auth", "login"], {
                     interactive: true,
                 });
                 if (!loginResult.ok) {
                     return die("Fly.io Authentication Failed");
                 }
-                const checkResult = await runCommand([
+                const checkResult = await run([
                     "fly",
                     "auth",
                     "whoami",
@@ -76,22 +83,24 @@ export const createFlyProvider = () => {
                 return parsed.data.email;
             },
             async getToken() {
+                if (token)
+                    return token;
                 const home = dntShim.Deno.env.get("HOME") || dntShim.Deno.env.get("USERPROFILE") || "";
                 const configPath = `${home}/.fly/config.yml`;
                 if (!(await fileExists(configPath))) {
-                    return die("Fly Config Not Found at ~/.fly/config.yml. Run 'fly auth login' First");
+                    return die("Fly Config Not Found at ~/.fly/config.yml. Run 'ambit auth login' First");
                 }
                 const content = await dntShim.Deno.readTextFile(configPath);
                 const match = content.match(/access_token:\s*(.+)/);
                 if (!match || !match[1]) {
-                    return die("No Access Token Found in ~/.fly/config.yml. Run 'fly auth login' First");
+                    return die("No Access Token Found in ~/.fly/config.yml. Run 'ambit auth login' First");
                 }
                 return match[1].trim();
             },
         },
         orgs: {
             async list() {
-                const result = await runJson(["fly", "orgs", "list", "--json"]);
+                const result = await runJ(["fly", "orgs", "list", "--json"]);
                 if (!result.ok) {
                     return die("Failed to List Organizations");
                 }
@@ -108,7 +117,7 @@ export const createFlyProvider = () => {
                 if (org) {
                     args.push("--org", org);
                 }
-                const result = await runCommand(args);
+                const result = await run(args);
                 return result.json().flatMap((data) => {
                     const parsed = FlyAppsListSchema.safeParse(data);
                     return parsed.success
@@ -117,10 +126,10 @@ export const createFlyProvider = () => {
                 }).unwrapOr([]);
             },
             async listWithNetwork(org) {
-                const token = await provider.auth.getToken();
+                const apiToken = await provider.auth.getToken();
                 const response = await fetch(`https://api.machines.dev/v1/apps?org_slug=${encodeURIComponent(org)}`, {
                     headers: {
-                        Authorization: `Bearer ${token}`,
+                        Authorization: `Bearer ${apiToken}`,
                         "Content-Type": "application/json",
                     },
                 });
@@ -142,13 +151,13 @@ export const createFlyProvider = () => {
                 if (opts?.network) {
                     args.push("--network", opts.network);
                 }
-                const result = await runCommand(args);
+                const result = await run(args);
                 if (!result.ok) {
                     return die(`Failed to Create App '${appName}'`);
                 }
             },
             async delete(name) {
-                const result = await runCommand([
+                const result = await run([
                     "fly",
                     "apps",
                     "destroy",
@@ -160,7 +169,7 @@ export const createFlyProvider = () => {
                 }
             },
             async exists(name) {
-                const result = await runCommand([
+                const result = await run([
                     "fly",
                     "status",
                     "-a",
@@ -176,7 +185,7 @@ export const createFlyProvider = () => {
                 });
             },
             async getConfig(name) {
-                const result = await runCommand(["fly", "config", "show", "-a", name]);
+                const result = await run(["fly", "config", "show", "-a", name]);
                 return result.json().match({
                     ok: (v) => v,
                     err: () => null,
@@ -185,7 +194,7 @@ export const createFlyProvider = () => {
         },
         machines: {
             async list(app) {
-                const result = await runJson(["fly", "machines", "list", "-a", app, "--json"]);
+                const result = await runJ(["fly", "machines", "list", "-a", app, "--json"]);
                 return result.flatMap((data) => {
                     const parsed = FlyMachinesListSchema.safeParse(data);
                     return parsed.success
@@ -217,7 +226,7 @@ export const createFlyProvider = () => {
                 if (config.region) {
                     args.push("--region", config.region);
                 }
-                const result = await runCommand(args);
+                const result = await run(args);
                 if (!result.ok) {
                     return die(result.stderr || "Unknown Error");
                 }
@@ -231,7 +240,7 @@ export const createFlyProvider = () => {
             },
             async destroy(app, machineId) {
                 const shortId = machineId.slice(0, 8);
-                const result = await runCommand([
+                const result = await run([
                     "fly",
                     "machines",
                     "destroy",
@@ -247,7 +256,7 @@ export const createFlyProvider = () => {
         },
         secrets: {
             async list(app) {
-                const result = await runJson(["fly", "secrets", "list", "-a", app, "--json"]);
+                const result = await runJ(["fly", "secrets", "list", "-a", app, "--json"]);
                 return result.unwrapOr([]);
             },
             async set(app, secrets, opts) {
@@ -260,7 +269,7 @@ export const createFlyProvider = () => {
                 if (opts?.stage) {
                     args.push("--stage");
                 }
-                const result = await runCommand(args);
+                const result = await run(args);
                 if (!result.ok) {
                     return die("Failed to Set Secrets");
                 }
@@ -272,13 +281,13 @@ export const createFlyProvider = () => {
                 if (opts?.stage) {
                     args.push("--stage");
                 }
-                const result = await runCommand(args);
+                const result = await run(args);
                 if (!result.ok) {
                     return die("Failed to Unset Secrets");
                 }
             },
             async deploy(app) {
-                const result = await runCommand([
+                const result = await run([
                     "fly",
                     "secrets",
                     "deploy",
@@ -292,7 +301,7 @@ export const createFlyProvider = () => {
         },
         ips: {
             async list(app) {
-                const result = await runCommand([
+                const result = await run([
                     "fly",
                     "ips",
                     "list",
@@ -308,7 +317,7 @@ export const createFlyProvider = () => {
                 }).unwrapOr([]);
             },
             async release(app, address) {
-                const result = await runCommand([
+                const result = await run([
                     "fly",
                     "ips",
                     "release",
@@ -321,7 +330,7 @@ export const createFlyProvider = () => {
                 }
             },
             async allocateFlycast(app, network) {
-                const result = await runCommand([
+                const result = await run([
                     "fly",
                     "ips",
                     "allocate-v6",
@@ -338,7 +347,7 @@ export const createFlyProvider = () => {
         },
         certs: {
             async list(app) {
-                const result = await runCommand([
+                const result = await run([
                     "fly",
                     "certs",
                     "list",
@@ -351,7 +360,7 @@ export const createFlyProvider = () => {
                     .filter((h) => typeof h === "string")).unwrapOr([]);
             },
             async remove(app, hostname) {
-                await runCommand([
+                await run([
                     "fly",
                     "certs",
                     "remove",
@@ -376,7 +385,7 @@ export const createFlyProvider = () => {
                 if (config?.region) {
                     args.push("--primary-region", config.region);
                 }
-                const result = await runCommand(args);
+                const result = await run(args);
                 if (!result.ok) {
                     throw new FlyDeployError(app, result.stderr);
                 }
@@ -400,7 +409,7 @@ export const createFlyProvider = () => {
                 if (options.region) {
                     args.push("--primary-region", options.region);
                 }
-                const result = await runCommand(args);
+                const result = await run(args);
                 if (!result.ok) {
                     throw new FlyDeployError(flyAppName, result.stderr);
                 }

package/esm/schemas/fly.d.ts

@@ -18,8 +18,8 @@ export type FlyAppStatus = z.infer<typeof FlyAppStatusEnum>;
  * Terminal: destroyed, replaced, migrated
  */
 export declare const FlyMachineStateEnum: z.ZodEnum<{
-    suspended: "suspended";
     created: "created";
+    suspended: "suspended";
     started: "started";
     stopped: "stopped";
     failed: "failed";
@@ -85,8 +85,8 @@ export declare const FlyMachineSchema: z.ZodObject<{
     id: z.ZodString;
     name: z.ZodString;
     state: z.ZodCatch<z.ZodEnum<{
-        suspended: "suspended";
         created: "created";
+        suspended: "suspended";
         started: "started";
         stopped: "stopped";
         failed: "failed";
@@ -130,8 +130,8 @@ export declare const FlyMachinesListSchema: z.ZodArray<z.ZodObject<{
     id: z.ZodString;
     name: z.ZodString;
     state: z.ZodCatch<z.ZodEnum<{
-        suspended: "suspended";
         created: "created";
+        suspended: "suspended";
         started: "started";
         stopped: "stopped";
         failed: "failed";

package/esm/util/constants.d.ts

@@ -4,6 +4,7 @@ export declare const ROUTER_DOCKER_DIR: string;
 export declare const SOCKS_PROXY_PORT = 1080;
 export declare const TAILSCALE_API_KEY_PREFIX = "tskey-api-";
 export declare const ENV_TAILSCALE_API_KEY = "TAILSCALE_API_KEY";
+export declare const ENV_FLY_API_TOKEN = "FLY_API_TOKEN";
 export declare const FLYCTL_INSTALL_URL = "https://fly.io/docs/flyctl/install/";
 export declare const SECRET_TAILSCALE_AUTHKEY = "TAILSCALE_AUTHKEY";
 export declare const SECRET_NETWORK_NAME = "NETWORK_NAME";

package/esm/util/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/util/constants.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C,eAAO,MAAM,iBAAiB,QACnB,CAAC;AAMZ,eAAO,MAAM,gBAAgB,OAAO,CAAC;AAMrC,eAAO,MAAM,wBAAwB,eAAe,CAAC;AAErD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAMzD,eAAO,MAAM,kBAAkB,wCAAwC,CAAC;AAMxE,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAC5D,eAAO,MAAM,mBAAmB,iBAAiB,CAAC;AAClD,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAM5C,eAAO,MAAM,2BAA2B,yBAAyB,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/util/constants.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,iBAAiB,WAAW,CAAC;AAE1C,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAE7C,eAAO,MAAM,iBAAiB,QACnB,CAAC;AAMZ,eAAO,MAAM,gBAAgB,OAAO,CAAC;AAMrC,eAAO,MAAM,wBAAwB,eAAe,CAAC;AAErD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAEzD,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAMjD,eAAO,MAAM,kBAAkB,wCAAwC,CAAC;AAMxE,eAAO,MAAM,wBAAwB,sBAAsB,CAAC;AAC5D,eAAO,MAAM,mBAAmB,iBAAiB,CAAC;AAClD,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAM5C,eAAO,MAAM,2BAA2B,yBAAyB,CAAC"}

package/esm/util/constants.js

@@ -17,6 +17,7 @@ export const SOCKS_PROXY_PORT = 1080;
 // =============================================================================
 export const TAILSCALE_API_KEY_PREFIX = "tskey-api-";
 export const ENV_TAILSCALE_API_KEY = "TAILSCALE_API_KEY";
+export const ENV_FLY_API_TOKEN = "FLY_API_TOKEN";
 // =============================================================================
 // External URLs
 // =============================================================================

package/esm/util/credentials.d.ts

@@ -1,6 +1,9 @@
 export interface CredentialStore {
     getTailscaleApiKey(): Promise<string | null>;
     setTailscaleApiKey(key: string): Promise<void>;
+    getFlyToken(): Promise<string | null>;
+    setFlyToken(token: string): Promise<void>;
+    clear(): Promise<void>;
 }
 export declare const createConfigCredentialStore: () => CredentialStore;
 export declare const getCredentialStore: () => CredentialStore;
@@ -17,5 +20,6 @@ export declare const checkDependencies: (out: {
     die(msg: string): never;
 }) => Promise<{
     tailscaleKey: string;
+    flyToken: string | null;
 }>;
 //# sourceMappingURL=credentials.d.ts.map

package/esm/util/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/util/credentials.ts"],"names":[],"mappings":"AA2BA,MAAM,WAAW,eAAe;IAC9B,kBAAkB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7C,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAQD,eAAO,MAAM,2BAA2B,QAAO,eA0B9C,CAAC;AAMF,eAAO,MAAM,kBAAkB,QAAO,eAerC,CAAC;AAMF;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAC5B,KAAK;IAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAAC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,KAC1D,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAA;CAAE,CAyBlC,CAAC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/util/credentials.ts"],"names":[],"mappings":"AA4BA,MAAM,WAAW,eAAe;IAC9B,kBAAkB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7C,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,WAAW,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACtC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AA+BD,eAAO,MAAM,2BAA2B,QAAO,eAiC9C,CAAC;AAMF,eAAO,MAAM,kBAAkB,QAAO,eA8BrC,CAAC;AAMF;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAC5B,KAAK;IAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAAC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAA;CAAE,KAC1D,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAoD3D,CAAC"}

package/esm/util/credentials.js

@@ -1,41 +1,68 @@
 // =============================================================================
-// Credential Store - Persistent Tailscale API Key Storage
+// Credential Store - Persistent Tailscale & Fly.io Token Storage
 // =============================================================================
 import * as dntShim from "../_dnt.shims.js";
 import { z } from "../deps/jsr.io/@zod/zod/4.3.6/src/index.js";
 import { commandExists, ensureConfigDir, fileExists, getConfigDir, } from "../lib/cli.js";
-import { ENV_TAILSCALE_API_KEY } from "./constants.js";
+import { ENV_FLY_API_TOKEN, ENV_TAILSCALE_API_KEY } from "./constants.js";
 // =============================================================================
 // Schema
 // =============================================================================
 const CredentialsSchema = z.object({
-    apiKey: z.string(),
+    apiKey: z.string().optional(),
+    flyToken: z.string().optional(),
 });
 // =============================================================================
 // Config File Implementation
 // =============================================================================
 const getCredentialsPath = () => `${getConfigDir()}/credentials.json`;
+const readCredentials = async () => {
+    const path = getCredentialsPath();
+    if (!(await fileExists(path)))
+        return {};
+    try {
+        const content = await dntShim.Deno.readTextFile(path);
+        const result = CredentialsSchema.safeParse(JSON.parse(content));
+        return result.success ? result.data : {};
+    }
+    catch {
+        return {};
+    }
+};
+const writeCredentials = async (data) => {
+    await ensureConfigDir();
+    const path = getCredentialsPath();
+    await dntShim.Deno.writeTextFile(path, JSON.stringify(data, null, 2) + "\n");
+};
 export const createConfigCredentialStore = () => {
     return {
         async getTailscaleApiKey() {
+            const data = await readCredentials();
+            return data.apiKey ?? null;
+        },
+        async setTailscaleApiKey(key) {
+            const data = await readCredentials();
+            data.apiKey = key;
+            await writeCredentials(data);
+        },
+        async getFlyToken() {
+            const data = await readCredentials();
+            return data.flyToken ?? null;
+        },
+        async setFlyToken(token) {
+            const data = await readCredentials();
+            data.flyToken = token;
+            await writeCredentials(data);
+        },
+        async clear() {
             const path = getCredentialsPath();
-            if (!(await fileExists(path))) {
-                return null;
-            }
             try {
-                const content = await dntShim.Deno.readTextFile(path);
-                const result = CredentialsSchema.safeParse(JSON.parse(content));
-                return result.success ? result.data.apiKey : null;
+                await dntShim.Deno.remove(path);
             }
             catch {
-                return null;
+                // File may not exist
             }
         },
-        async setTailscaleApiKey(key) {
-            await ensureConfigDir();
-            const path = getCredentialsPath();
-            await dntShim.Deno.writeTextFile(path, JSON.stringify({ apiKey: key }, null, 2) + "\n");
-        },
     };
 };
 // =============================================================================
@@ -53,6 +80,18 @@ export const getCredentialStore = () => {
         async setTailscaleApiKey(key) {
             await fileStore.setTailscaleApiKey(key);
         },
+        async getFlyToken() {
+            const envToken = dntShim.Deno.env.get(ENV_FLY_API_TOKEN);
+            if (envToken)
+                return envToken;
+            return await fileStore.getFlyToken();
+        },
+        async setFlyToken(token) {
+            await fileStore.setFlyToken(token);
+        },
+        async clear() {
+            await fileStore.clear();
+        },
     };
 };
 // =============================================================================
@@ -71,9 +110,33 @@ export const checkDependencies = async (out) => {
     if (!(await commandExists("fly"))) {
         errors.push("Flyctl Not Found. Install from https://fly.io/docs/flyctl/install/");
     }
-    const key = await getCredentialStore().getTailscaleApiKey();
+    const credentials = getCredentialStore();
+    const key = await credentials.getTailscaleApiKey();
     if (!key) {
-        errors.push("Tailscale API Key Required. Run 'ambit create' or set TAILSCALE_API_KEY");
+        errors.push("Tailscale API Key Required. Run 'ambit auth login' or set TAILSCALE_API_KEY");
+    }
+    let flyToken = await credentials.getFlyToken();
+    if (!flyToken) {
+        // Adopt token from flyctl's own config if available
+        const home = dntShim.Deno.env.get("HOME") || dntShim.Deno.env.get("USERPROFILE") || "";
+        const configPath = `${home}/.fly/config.yml`;
+        if (await fileExists(configPath)) {
+            try {
+                const content = await dntShim.Deno.readTextFile(configPath);
+                const match = content.match(/access_token:\s*(.+)/);
+                if (match?.[1]) {
+                    const adopted = match[1].trim();
+                    await credentials.setFlyToken(adopted);
+                    flyToken = adopted;
+                }
+            }
+            catch {
+                // Ignore read errors
+            }
+        }
+    }
+    if (!flyToken) {
+        errors.push("Fly.io Token Required. Run 'ambit auth login' or set FLY_API_TOKEN");
     }
     if (errors.length === 1) {
         return out.die(errors[0]);
@@ -83,5 +146,5 @@ export const checkDependencies = async (out) => {
             out.err(e);
         return out.die("Missing Prerequisites");
     }
-    return { tailscaleKey: key };
+    return { tailscaleKey: key, flyToken };
 };

package/esm/util/session.js

@@ -10,8 +10,8 @@ import { resolveOrg } from "./resolve.js";
  * validates fly CLI + Tailscale key, authenticates with Fly, and resolves org.
  */
 export const initSession = async (out, opts) => {
-    const { tailscaleKey } = await checkDependencies(out);
-    const fly = createFlyProvider();
+    const { tailscaleKey, flyToken } = await checkDependencies(out);
+    const fly = createFlyProvider(flyToken ?? undefined);
     await fly.auth.login({ interactive: !opts.json });
     const tailscale = createTailscaleProvider(tailscaleKey);
     const org = await resolveOrg(fly, opts, out);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cardelli/ambit",
-  "version": "0.3.5",
+  "version": "0.4.1",
   "description": "Deploy apps to the cloud that only you and your AI agents can reach",
   "license": "MIT",
   "scripts": {},