@cardelli/ambit 0.4.3 → 0.4.5

package/README.md

@@ -294,12 +294,12 @@ npx @cardelli/ambit logs my-app.lab --no-tail | less -R   # scroll buffered logs
 
 ### `ambit destroy network <name>`
 
-Tears down a network: destroys the router, cleans up DNS, removes the Tailscale device, and automatically removes the router's tag from your Tailscale ACL policy (tagOwners and autoApprovers). If there are workload apps still on the network, ambit warns you before proceeding.
+Tears down a network: destroys the router, cleans up DNS, removes the Tailscale device, and automatically removes the router's tag from your Tailscale ACL policy (`tagOwners`, `autoApprovers`, and tag-referencing access rules). If there are workload apps still on the network, ambit warns you before proceeding.
 
 | Flag              | Description                    |
 | ----------------- | ------------------------------ |
 | `--org <org>`     | Fly.io organization slug       |
-| `--manual`        | Skip automatic Tailscale ACL cleanup (tagOwners + autoApprovers) |
+| `--manual`        | Skip automatic Tailscale ACL cleanup |
 | `-y`, `--yes`     | Skip confirmation prompts      |
 | `--json`          | Machine-readable JSON output   |
 
@@ -340,7 +340,7 @@ Checks app health: verifies the app is deployed and running, then checks the rou
 
 ## Access Control
 
-By default, `ambit create` automatically adds the router's tag to your Tailscale ACL policy (`tagOwners` and `autoApprovers`). `ambit destroy network` automatically removes them. Pass `--manual` to either command to skip this and manage the policy yourself — useful if your API token lacks ACL write permission (`policy_file` scope).
+By default, `ambit create` automatically adds the router's tag to your Tailscale ACL policy (`tagOwners` and `autoApprovers`). `ambit destroy network` automatically removes those entries and any access rules that reference the router tag. Pass `--manual` to either command to skip this and manage the policy yourself — useful if your API token lacks ACL write permission (`policy_file` scope).
 
 If you want to lock down which users can reach which networks, two rules do the job — one for DNS queries and one for data traffic:
 
@@ -357,7 +357,7 @@ If you want to lock down which users can reach which networks, two rules do the
 }
 ```
 
-These `acls` entries are never touched automatically — ambit only manages `tagOwners` and `autoApprovers`.
+On destroy, Ambit removes access-rule references to the router tag, such as `tag:ambit-infra:53`, before removing the tag owner. Subnet-only access rules do not reference the tag and may still need manual cleanup.
 
 ## Multiple Networks
 

package/esm/cli/commands/auth.js

@@ -2,7 +2,7 @@
 // Auth Command - Manage Fly.io and Tailscale Authentication
 // =============================================================================
 import * as dntShim from "../../_dnt.shims.js";
-import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold, confirm, readSecret } from "../../lib/cli.js";
 import { checkArgs } from "../../lib/args.js";
 import { createOutput } from "../../lib/output.js";
@@ -12,7 +12,6 @@ import { createTailscaleProvider } from "../../providers/tailscale.js";
 import { getCredentialStore } from "../../util/credentials.js";
 import { TAILSCALE_API_KEY_PREFIX } from "../../util/constants.js";
 import { FlyAuthSchema } from "../../schemas/fly.js";
-import { fileExists } from "../../lib/cli.js";
 // =============================================================================
 // Helpers
 // =============================================================================
@@ -26,15 +25,6 @@ const tryFlyWhoami = async (token) => {
     const parsed = FlyAuthSchema.safeParse(auth.value);
     return parsed.success ? parsed.data.email : null;
 };
-const readFlyConfigToken = async () => {
-    const home = dntShim.Deno.env.get("HOME") || dntShim.Deno.env.get("USERPROFILE") || "";
-    const configPath = `${home}/.fly/config.yml`;
-    if (!(await fileExists(configPath)))
-        return null;
-    const content = await dntShim.Deno.readTextFile(configPath);
-    const match = content.match(/access_token:\s*(.+)/);
-    return match?.[1]?.trim() ?? null;
-};
 // =============================================================================
 // Auth Login
 // =============================================================================
@@ -59,8 +49,7 @@ ${bold("OPTIONS")}
 
 ${bold("DESCRIPTION")}
   Authenticates with both Fly.io and Tailscale. Only prompts for
-  credentials that are missing or invalid — existing valid tokens
-  are preserved.
+  credentials that are missing or invalid.
 
 ${bold("EXAMPLES")}
   ambit auth login
@@ -80,21 +69,11 @@ ${bold("EXAMPLES")}
         if (!email) {
             return out.die("Invalid Fly.io API Token");
         }
-        await credentials.setFlyToken(args["fly-api-key"]);
         out.ok(`Authenticated as ${email}`);
         flyEmail = email;
     }
     else {
-        // Adopt from ~/.fly/config.yml if it has a different token than the store
-        const storedToken = await credentials.getFlyToken();
-        const configToken = await readFlyConfigToken();
-        const bestToken = configToken && configToken !== storedToken
-            ? configToken
-            : storedToken;
-        if (bestToken && bestToken !== storedToken) {
-            await credentials.setFlyToken(bestToken);
-        }
-        const bestEmail = bestToken ? await tryFlyWhoami(bestToken) : null;
+        const bestEmail = await tryFlyWhoami();
         if (bestEmail) {
             out.ok(`Already Authenticated as ${bestEmail}`);
             flyEmail = bestEmail;
@@ -109,15 +88,10 @@ ${bold("EXAMPLES")}
             if (!loginResult.ok) {
                 return out.die("Fly.io Authentication Failed");
             }
-            const token = await readFlyConfigToken();
-            if (!token) {
-                return out.die("Could Not Read Fly.io Token After Login");
-            }
-            const email = await tryFlyWhoami(token);
+            const email = await tryFlyWhoami();
             if (!email) {
                 return out.die("Fly.io Authentication Verification Failed");
             }
-            await credentials.setFlyToken(token);
             out.ok(`Authenticated as ${email}`);
             flyEmail = email;
         }
@@ -218,13 +192,7 @@ ${bold("EXAMPLES")}
     // Step 1: Fly.io
     // =========================================================================
     let flyEmail = null;
-    const storedToken = await credentials.getFlyToken();
-    if (storedToken) {
-        flyEmail = await tryFlyWhoami(storedToken);
-    }
-    if (!flyEmail) {
-        flyEmail = await tryFlyWhoami();
-    }
+    flyEmail = await tryFlyWhoami();
     // =========================================================================
     // Step 2: Tailscale
     // =========================================================================

package/esm/cli/commands/create/index.js

@@ -1,7 +1,7 @@
 // =============================================================================
 // Create Command - Create Tailscale Subnet Router on Fly.io Custom Network
 // =============================================================================
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { createOutput } from "../../../lib/output.js";
@@ -21,12 +21,12 @@ import { createTransition, hydrateCreate, reportSkipped, } from "./machine.js";
 // =============================================================================
 const stageFlyConfig = async (out, opts) => {
     out.header("Step 1: Fly.io Configuration").blank();
-    const flyToken = await getCredentialStore().getFlyToken();
-    const fly = createFlyProvider(flyToken ?? undefined);
+    const fly = createFlyProvider();
     await fly.auth.ensureInstalled();
     const email = await fly.auth.login({ interactive: !opts.json });
     out.ok(`Authenticated as ${email}`);
     const org = await resolveOrg(fly, opts, out);
+    await fly.auth.useOrgToken(org);
     const region = opts.region || "iad";
     out.ok(`Using Region: ${region}`);
     out.blank();

package/esm/cli/commands/deploy/index.js

@@ -1,7 +1,7 @@
 // =============================================================================
 // Deploy Command - Safely Deploy a Workload App on a Custom Private Network
 // =============================================================================
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { createOutput } from "../../../lib/output.js";
@@ -24,6 +24,7 @@ const stageFlyConfig = async (out, opts) => {
     const email = await fly.auth.login({ interactive: !opts.json });
     out.ok(`Authenticated as ${email}`);
     const org = await resolveOrg(fly, opts, out);
+    await fly.auth.useOrgToken(org);
     out.blank();
     return { fly, org };
 };
@@ -84,6 +85,26 @@ const stageDeploy = async (out, fly, deployConfig, opts) => {
             image: deployConfig.image,
             config: deployConfig.configPath,
             region: opts.region,
+            // VM sizing
+            vmSize: opts.vmSize,
+            vmCpus: opts.vmCpus,
+            vmMemory: opts.vmMemory,
+            vmCpuKind: opts.vmCpuKind,
+            vmGpuKind: opts.vmGpuKind,
+            vmGpus: opts.vmGpus,
+            // Build options
+            dockerfile: opts.dockerfile,
+            buildArg: opts.buildArg,
+            buildSecret: opts.buildSecret,
+            buildTarget: opts.buildTarget,
+            localOnly: opts.localOnly,
+            remoteOnly: opts.remoteOnly,
+            // Deploy behavior
+            env: opts.env,
+            strategy: opts.strategy,
+            detach: opts.detach,
+            waitTimeout: opts.waitTimeout,
+            volumeInitialSize: opts.volumeInitialSize,
         },
     };
     const phase = await hydrateDeploy(ctx);
@@ -147,10 +168,24 @@ const deploy = async (argv) => {
             "config",
             "main-port",
             "template",
+            // VM sizing
+            "vm-size",
+            "vm-cpus",
+            "vm-memory",
+            "vm-cpu-kind",
+            "vm-gpu-kind",
+            "vm-gpus",
+            // Build options
+            "dockerfile",
+            "build-target",
+            "strategy",
+            "wait-timeout",
+            "volume-initial-size",
         ],
-        boolean: ["help", "yes", "json"],
-        alias: { y: "yes" },
+        boolean: ["help", "yes", "json", "local-only", "remote-only", "detach"],
+        alias: { y: "yes", e: "env" },
         default: { "main-port": "80" },
+        collect: ["build-arg", "build-secret", "env"],
     };
     const args = parseArgs(argv, opts);
     checkArgs(args, opts, "ambit deploy", 1);
@@ -199,6 +234,29 @@ ${bold("TEMPLATE MODE")}
     owner/repo/path@branch    Fetch a specific branch
     owner/repo/path@commit    Fetch a specific commit
 
+${bold("VM SIZING")}
+  --vm-size <size>       VM size preset (see "fly platform vm-sizes")
+  --vm-cpus <n>          Number of CPUs
+  --vm-memory <mb>       Memory in megabytes
+  --vm-cpu-kind <kind>   CPU kind: "shared" or "performance"
+  --vm-gpu-kind <model>  GPU model (a100-pcie-40gb, a100-sxm4-80gb, l40s, a10)
+  --vm-gpus <n>          Number of GPUs
+
+${bold("BUILD OPTIONS")} (config/template mode only)
+  --dockerfile <path>    Path to Dockerfile
+  --build-arg <K=V>      Build-time variable (repeatable)
+  --build-secret <K=V>   Build-time secret (repeatable)
+  --build-target <stage> Target build stage for multi-stage Dockerfiles
+  --local-only           Build locally using local Docker daemon
+  --remote-only          Build on remote builder (default)
+
+${bold("DEPLOY BEHAVIOR")}
+  -e, --env <K=V>        Environment variable (repeatable)
+  --strategy <name>      Deploy strategy: canary, rolling, bluegreen, immediate
+  --detach               Return immediately without monitoring
+  --wait-timeout <dur>   Time to wait for machines to become healthy (default: 5m0s)
+  --volume-initial-size <gb>  Initial volume size in GB on first deploy
+
 ${bold("SAFETY")}
   Always deploys with --no-public-ips and --flycast.
   Post-deploy audit releases any public IPs and verifies Flycast allocation.
@@ -275,6 +333,28 @@ ${bold("EXAMPLES")}
         routerId,
         flyAppName,
         routerPrivateIp,
+        // VM sizing
+        vmSize: args["vm-size"],
+        vmCpus: args["vm-cpus"] ? Number(args["vm-cpus"]) : undefined,
+        vmMemory: args["vm-memory"],
+        vmCpuKind: args["vm-cpu-kind"],
+        vmGpuKind: args["vm-gpu-kind"],
+        vmGpus: args["vm-gpus"] ? Number(args["vm-gpus"]) : undefined,
+        // Build options
+        dockerfile: args.dockerfile,
+        buildArg: args["build-arg"],
+        buildSecret: args["build-secret"],
+        buildTarget: args["build-target"],
+        localOnly: args["local-only"],
+        remoteOnly: args["remote-only"],
+        // Deploy behavior
+        env: args.env,
+        strategy: args.strategy,
+        detach: args.detach,
+        waitTimeout: args["wait-timeout"],
+        volumeInitialSize: args["volume-initial-size"]
+            ? Number(args["volume-initial-size"])
+            : undefined,
     });
 };
 // =============================================================================

package/esm/cli/commands/deploy/machine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/deploy/machine.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACvB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAM/C,MAAM,MAAM,WAAW,GACnB,YAAY,GACZ,WAAW,GACX,QAAQ,GACR,OAAO,GACP,UAAU,CAAC;AAMf,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE;QACL,mBAAmB,EAAE,MAAM,CAAC;QAC5B,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,SAAS,EAAE;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH,CAAC;AAEF,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,iBAAiB,CAAC;IACjC,KAAK,CAAC,EAAE;QACN,mBAAmB,EAAE,MAAM,CAAC;QAC5B,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH;AAaD,eAAO,MAAM,mBAAmB,GAC9B,KAAK,MAAM,CAAC,YAAY,CAAC,EACzB,YAAY,WAAW,SAMxB,CAAC;AAMF,eAAO,MAAM,aAAa,GACxB,KAAK,SAAS,KACb,OAAO,CAAC,WAAW,CAMrB,CAAC;AAMF,eAAO,MAAM,gBAAgB,GAC3B,OAAO,WAAW,EAClB,KAAK,SAAS,KACb,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAiH7B,CAAC"}
+{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/deploy/machine.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACvB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAM/C,MAAM,MAAM,WAAW,GACnB,YAAY,GACZ,WAAW,GACX,QAAQ,GACR,OAAO,GACP,UAAU,CAAC;AAMf,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE;QACL,mBAAmB,EAAE,MAAM,CAAC;QAC5B,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,SAAS,EAAE;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH,CAAC;AAEF,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,iBAAiB,CAAC;IACjC,KAAK,CAAC,EAAE;QACN,mBAAmB,EAAE,MAAM,CAAC;QAC5B,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH;AAaD,eAAO,MAAM,mBAAmB,GAC9B,KAAK,MAAM,CAAC,YAAY,CAAC,EACzB,YAAY,WAAW,SAMxB,CAAC;AAMF,eAAO,MAAM,aAAa,GACxB,KAAK,SAAS,KACb,OAAO,CAAC,WAAW,CAMrB,CAAC;AAMF,eAAO,MAAM,gBAAgB,GAC3B,OAAO,WAAW,EAClB,KAAK,SAAS,KACb,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAmH7B,CAAC"}

package/esm/cli/commands/destroy/app.js

@@ -1,7 +1,7 @@
 // =============================================================================
 // Destroy App — Destroy a Workload App on a Network
 // =============================================================================
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold, confirm } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { createOutput } from "../../../lib/output.js";

package/esm/cli/commands/destroy/index.js

@@ -2,7 +2,7 @@
 // Destroy Command - Destroy Networks or Apps
 // =============================================================================
 import * as dntShim from "../../../_dnt.shims.js";
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { registerCommand } from "../../mod.js";

package/esm/cli/commands/destroy/network.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/destroy/network.ts"],"names":[],"mappings":"AAuVA,eAAO,MAAM,cAAc,GAAU,MAAM,MAAM,EAAE,KAAG,OAAO,CAAC,IAAI,CA0DjE,CAAC"}
+{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/destroy/network.ts"],"names":[],"mappings":"AA8VA,eAAO,MAAM,cAAc,GAAU,MAAM,MAAM,EAAE,KAAG,OAAO,CAAC,IAAI,CA2DjE,CAAC"}

package/esm/cli/commands/destroy/network.js

@@ -1,7 +1,7 @@
 // =============================================================================
 // Destroy Network — Tear Down Router and Clean Up Tailnet
 // =============================================================================
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold, confirm } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { createOutput } from "../../../lib/output.js";
@@ -9,7 +9,7 @@ import { Result } from "../../../lib/result.js";
 import { runMachine } from "../../../lib/machine.js";
 import { findRouterApp, listWorkloadAppsOnNetwork } from "../../../util/discovery.js";
 import { getRouterTag } from "../../../util/naming.js";
-import { isAutoApproverConfigured, isTagOwnerConfigured, unpatchAutoApprover, unpatchTagOwner, } from "../../../util/tailscale-local.js";
+import { isAutoApproverConfigured, isTagOwnerConfigured, unpatchAclTagReferences, unpatchAutoApprover, unpatchTagOwner, } from "../../../util/tailscale-local.js";
 import { initSession } from "../../../util/session.js";
 // =============================================================================
 // Phase Labels
@@ -120,6 +120,11 @@ const destroyNetworkTransition = async (phase, ctx) => {
                 return Result.ok("complete");
             }
             let changed = false;
+            const withoutAclRefs = unpatchAclTagReferences(policy, tag);
+            if (withoutAclRefs !== policy) {
+                policy = withoutAclRefs;
+                changed = true;
+            }
             if (isTagOwnerConfigured(policy, tag)) {
                 policy = unpatchTagOwner(policy, tag);
                 changed = true;
@@ -195,8 +200,8 @@ const stageSummary = (out, ctx) => {
     const tag = ctx.tag || getRouterTag(ctx.network);
     if (!ctx.manual) {
         out.blank()
-            .dim("If You Added ACL Rules Referencing This Router, Remember to Remove:")
-            .dim(`  acls: rules referencing ${tag}`)
+            .dim("If You Added Subnet-Only ACL Rules for This Router, Remember to Remove:")
+            .dim(`  acls: rules for this network's subnet`)
             .blank();
     }
     else if (ctx.tag) {
@@ -235,14 +240,15 @@ ${bold("USAGE")}
 
 ${bold("OPTIONS")}
   --org <org>        Fly.io organization slug
-  --manual           Skip automatic Tailscale ACL cleanup (tagOwners + autoApprovers)
+  --manual           Skip automatic Tailscale ACL cleanup
   -y, --yes          Skip confirmation prompts
   --json             Output as JSON
 
 ${bold("DESCRIPTION")}
   By default, ambit removes the router's tag from your Tailscale ACL
-  policy (tagOwners and autoApprovers). Use --manual if your API token
-  lacks ACL write permission or you prefer to manage the policy yourself.
+  policy (tagOwners, autoApprovers, and tag-referencing access rules).
+  Use --manual if your API token lacks ACL write permission or you prefer
+  to manage the policy yourself.
 
 ${bold("EXAMPLES")}
   ambit destroy network browsers

package/esm/cli/commands/doctor.js

@@ -1,7 +1,7 @@
 // =============================================================================
 // Doctor Command - Verify Environment and Infrastructure Health
 // =============================================================================
-import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold } from "../../lib/cli.js";
 import { checkArgs } from "../../lib/args.js";
 import { createOutput } from "../../lib/output.js";

package/esm/cli/commands/list/apps.js

@@ -1,8 +1,8 @@
 // =============================================================================
 // List Apps — List All Workload Apps on a Network
 // =============================================================================
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
-import { Table } from "../../../deps/jsr.io/@cliffy/table/1.0.0/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
+import { Table } from "../../../deps/jsr.io/@cliffy/table/1.1.0/mod.js";
 import { bold } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { createOutput } from "../../../lib/output.js";

package/esm/cli/commands/list/index.js

@@ -2,7 +2,7 @@
 // List Command - List Networks or Apps
 // =============================================================================
 import * as dntShim from "../../../_dnt.shims.js";
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { registerCommand } from "../../mod.js";

package/esm/cli/commands/list/networks.js

@@ -1,8 +1,8 @@
 // =============================================================================
 // List Networks — List All Discovered Routers Across Networks
 // =============================================================================
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
-import { Table } from "../../../deps/jsr.io/@cliffy/table/1.0.0/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
+import { Table } from "../../../deps/jsr.io/@cliffy/table/1.1.0/mod.js";
 import { bold } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { createOutput } from "../../../lib/output.js";

package/esm/cli/commands/logs.js

@@ -1,7 +1,7 @@
 // =============================================================================
 // Logs Command - Stream Logs for Workload Apps
 // =============================================================================
-import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold } from "../../lib/cli.js";
 import { checkArgs } from "../../lib/args.js";
 import { createOutput } from "../../lib/output.js";

package/esm/cli/commands/secrets.js

@@ -2,8 +2,8 @@
 // Secrets Command - Manage Secrets for Workload Apps
 // =============================================================================
 import * as dntShim from "../../_dnt.shims.js";
-import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.28/mod.js";
-import { Table } from "../../deps/jsr.io/@cliffy/table/1.0.0/mod.js";
+import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.29/mod.js";
+import { Table } from "../../deps/jsr.io/@cliffy/table/1.1.0/mod.js";
 import { bold } from "../../lib/cli.js";
 import { checkArgs } from "../../lib/args.js";
 import { createOutput } from "../../lib/output.js";

package/esm/cli/commands/share.js

@@ -1,12 +1,12 @@
 // =============================================================================
 // Share Command - Grant Members Access to a Network via Tailscale ACL
 // =============================================================================
-import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold } from "../../lib/cli.js";
 import { checkArgs } from "../../lib/args.js";
 import { createOutput } from "../../lib/output.js";
 import { registerCommand } from "../mod.js";
-import { z } from "../../deps/jsr.io/@zod/zod/4.3.6/src/index.js";
+import { z } from "../../deps/jsr.io/@zod/zod/4.4.3/src/index.js";
 import { findRouterApp, getRouterMachineInfo } from "../../util/discovery.js";
 import { getRouterTag } from "../../util/naming.js";
 import { assertAdditivePatch, isAclRuleConfigured, patchAclRule, } from "../../util/tailscale-local.js";

package/esm/cli/commands/status/app.js

@@ -1,7 +1,7 @@
 // =============================================================================
 // Status App — Show App Status
 // =============================================================================
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { createOutput } from "../../../lib/output.js";

package/esm/cli/commands/status/index.js

@@ -1,7 +1,7 @@
 // =============================================================================
 // Status Command - Show Network, App, and Router Status
 // =============================================================================
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { registerCommand } from "../../mod.js";

package/esm/cli/commands/status/network.js

@@ -1,7 +1,7 @@
 // =============================================================================
 // Status Network — Show Detailed Status for a Single Network
 // =============================================================================
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { createOutput } from "../../../lib/output.js";

package/esm/cli/commands/status/networks.js

@@ -1,8 +1,8 @@
 // =============================================================================
 // Status Networks — Summary Table of All Networks
 // =============================================================================
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
-import { Table } from "../../../deps/jsr.io/@cliffy/table/1.0.0/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
+import { Table } from "../../../deps/jsr.io/@cliffy/table/1.1.0/mod.js";
 import { bold } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { createOutput } from "../../../lib/output.js";

package/esm/cli/mod.js

@@ -2,7 +2,7 @@
 // CLI Framework - Command Parser and Router
 // =============================================================================
 import * as dntShim from "../_dnt.shims.js";
-import { parseArgs } from "../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold, dim } from "../lib/cli.js";
 import denoConfig from "../deno.js";
 // =============================================================================

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "@cardelli/ambit",
-    "version": "0.4.3",
+    "version": "0.4.5",
     "description": "Deploy apps to the cloud that only you and your AI agents can reach",
     "license": "MIT",
     "tasks": {

package/esm/deps/jsr.io/@cliffy/table/{1.0.0 → 1.1.0}/_layout.d.ts

@@ -30,12 +30,16 @@ export declare class TableLayout {
      * settings.
      */
     protected createLayout(): RenderSettings;
+    private computeColumnDimensions;
+    private applyFlexShrink;
+    private applyFlexGrow;
+    private resolveColumnWeight;
     /**
      * Fills rows and cols by specified row/col span with a reference of the
      * original cell.
      */
     protected spanRows(rows: Array<RowType>): Array<Row<Cell>>;
-    protected getDeleteCount(rows: Array<Array<unknown>>, rowIndex: number, colIndex: number): 1 | 0;
+    protected getDeleteCount(rows: Array<Array<unknown>>, rowIndex: number, colIndex: number): 0 | 1;
     /**
      * Create a new row from existing row or cell array.
      * @param row Original row.

package/esm/deps/jsr.io/@cliffy/table/1.1.0/_layout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_layout.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@cliffy/table/1.1.0/_layout.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,KAAK,QAAQ,EAAkB,MAAM,WAAW,CAAC;AAEhE,OAAO,EAAE,GAAG,EAAE,KAAK,OAAO,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,KAAK,EAAiB,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAMtE,8BAA8B;AAC9B,UAAU,cAAc;IACtB,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;CACxB;AASD,6BAA6B;AAC7B,qBAAa,WAAW;;IAOpB,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,OAAO;IAPjB;;;;OAIG;gBAEO,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,aAAa;IAGhC,6BAA6B;IACtB,QAAQ,IAAI,MAAM;IAKzB;;;;OAIG;IACH,SAAS,CAAC,YAAY,IAAI,cAAc;IA0DxC,OAAO,CAAC,uBAAuB;IAsC/B,OAAO,CAAC,eAAe;IA6CvB,OAAO,CAAC,aAAa;IAsCrB,OAAO,CAAC,mBAAmB;IAwC3B;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IA4D1D,SAAS,CAAC,cAAc,CACtB,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAC3B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,CAAC,GAAG,CAAC;IAOR;;;OAGG;IACH,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;IAM5C;;;;;;;OAOG;IACH,SAAS,CAAC,UAAU,CAClB,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,EACjC,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,IAAI;IAcP,OAAO,CAAC,WAAW;IAInB;;;OAGG;IACH,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM;IAWlD;;;;;;OAMG;IACH,SAAS,CAAC,SAAS,CACjB,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,cAAc,EACpB,WAAW,CAAC,EAAE,OAAO,GACpB,MAAM;IAwET;;;;;;OAMG;IACH,SAAS,CAAC,UAAU,CAClB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,EACd,IAAI,EAAE,cAAc,EACpB,QAAQ,CAAC,EAAE,OAAO,GACjB,MAAM;IAqDT;;;;;OAKG;IACH,SAAS,CAAC,eAAe,CACvB,IAAI,EAAE,IAAI,EACV,SAAS,EAAE,MAAM,GAChB;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE;IAgDpC;;;;;;OAMG;IACH,SAAS,CAAC,eAAe,CACvB,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,EAC9B,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,EAC9B,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EACtB,IAAI,EAAE,cAAc,GACnB,MAAM;IA2BT;;;;;;;OAOG;IACH,SAAS,CAAC,gBAAgB,CACxB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,EAC9B,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,EAC9B,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EACtB,IAAI,EAAE,cAAc,GACnB,MAAM;CAoJV"}