@cardelli/ambit 0.4.4 → 0.4.5

package/README.md

@@ -294,12 +294,12 @@ npx @cardelli/ambit logs my-app.lab --no-tail | less -R   # scroll buffered logs
 
 ### `ambit destroy network <name>`
 
-Tears down a network: destroys the router, cleans up DNS, removes the Tailscale device, and automatically removes the router's tag from your Tailscale ACL policy (tagOwners and autoApprovers). If there are workload apps still on the network, ambit warns you before proceeding.
+Tears down a network: destroys the router, cleans up DNS, removes the Tailscale device, and automatically removes the router's tag from your Tailscale ACL policy (`tagOwners`, `autoApprovers`, and tag-referencing access rules). If there are workload apps still on the network, ambit warns you before proceeding.
 
 | Flag              | Description                    |
 | ----------------- | ------------------------------ |
 | `--org <org>`     | Fly.io organization slug       |
-| `--manual`        | Skip automatic Tailscale ACL cleanup (tagOwners + autoApprovers) |
+| `--manual`        | Skip automatic Tailscale ACL cleanup |
 | `-y`, `--yes`     | Skip confirmation prompts      |
 | `--json`          | Machine-readable JSON output   |
 
@@ -340,7 +340,7 @@ Checks app health: verifies the app is deployed and running, then checks the rou
 
 ## Access Control
 
-By default, `ambit create` automatically adds the router's tag to your Tailscale ACL policy (`tagOwners` and `autoApprovers`). `ambit destroy network` automatically removes them. Pass `--manual` to either command to skip this and manage the policy yourself — useful if your API token lacks ACL write permission (`policy_file` scope).
+By default, `ambit create` automatically adds the router's tag to your Tailscale ACL policy (`tagOwners` and `autoApprovers`). `ambit destroy network` automatically removes those entries and any access rules that reference the router tag. Pass `--manual` to either command to skip this and manage the policy yourself — useful if your API token lacks ACL write permission (`policy_file` scope).
 
 If you want to lock down which users can reach which networks, two rules do the job — one for DNS queries and one for data traffic:
 
@@ -357,7 +357,7 @@ If you want to lock down which users can reach which networks, two rules do the
 }
 ```
 
-These `acls` entries are never touched automatically — ambit only manages `tagOwners` and `autoApprovers`.
+On destroy, Ambit removes access-rule references to the router tag, such as `tag:ambit-infra:53`, before removing the tag owner. Subnet-only access rules do not reference the tag and may still need manual cleanup.
 
 ## Multiple Networks
 

package/esm/cli/commands/auth.js

@@ -2,7 +2,7 @@
 // Auth Command - Manage Fly.io and Tailscale Authentication
 // =============================================================================
 import * as dntShim from "../../_dnt.shims.js";
-import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold, confirm, readSecret } from "../../lib/cli.js";
 import { checkArgs } from "../../lib/args.js";
 import { createOutput } from "../../lib/output.js";
@@ -12,7 +12,6 @@ import { createTailscaleProvider } from "../../providers/tailscale.js";
 import { getCredentialStore } from "../../util/credentials.js";
 import { TAILSCALE_API_KEY_PREFIX } from "../../util/constants.js";
 import { FlyAuthSchema } from "../../schemas/fly.js";
-import { fileExists } from "../../lib/cli.js";
 // =============================================================================
 // Helpers
 // =============================================================================
@@ -26,15 +25,6 @@ const tryFlyWhoami = async (token) => {
     const parsed = FlyAuthSchema.safeParse(auth.value);
     return parsed.success ? parsed.data.email : null;
 };
-const readFlyConfigToken = async () => {
-    const home = dntShim.Deno.env.get("HOME") || dntShim.Deno.env.get("USERPROFILE") || "";
-    const configPath = `${home}/.fly/config.yml`;
-    if (!(await fileExists(configPath)))
-        return null;
-    const content = await dntShim.Deno.readTextFile(configPath);
-    const match = content.match(/access_token:\s*(.+)/);
-    return match?.[1]?.trim() ?? null;
-};
 // =============================================================================
 // Auth Login
 // =============================================================================
@@ -59,8 +49,7 @@ ${bold("OPTIONS")}
 
 ${bold("DESCRIPTION")}
   Authenticates with both Fly.io and Tailscale. Only prompts for
-  credentials that are missing or invalid — existing valid tokens
-  are preserved.
+  credentials that are missing or invalid.
 
 ${bold("EXAMPLES")}
   ambit auth login
@@ -80,21 +69,11 @@ ${bold("EXAMPLES")}
         if (!email) {
             return out.die("Invalid Fly.io API Token");
         }
-        await credentials.setFlyToken(args["fly-api-key"]);
         out.ok(`Authenticated as ${email}`);
         flyEmail = email;
     }
     else {
-        // Adopt from ~/.fly/config.yml if it has a different token than the store
-        const storedToken = await credentials.getFlyToken();
-        const configToken = await readFlyConfigToken();
-        const bestToken = configToken && configToken !== storedToken
-            ? configToken
-            : storedToken;
-        if (bestToken && bestToken !== storedToken) {
-            await credentials.setFlyToken(bestToken);
-        }
-        const bestEmail = bestToken ? await tryFlyWhoami(bestToken) : null;
+        const bestEmail = await tryFlyWhoami();
         if (bestEmail) {
             out.ok(`Already Authenticated as ${bestEmail}`);
             flyEmail = bestEmail;
@@ -109,15 +88,10 @@ ${bold("EXAMPLES")}
             if (!loginResult.ok) {
                 return out.die("Fly.io Authentication Failed");
             }
-            const token = await readFlyConfigToken();
-            if (!token) {
-                return out.die("Could Not Read Fly.io Token After Login");
-            }
-            const email = await tryFlyWhoami(token);
+            const email = await tryFlyWhoami();
             if (!email) {
                 return out.die("Fly.io Authentication Verification Failed");
             }
-            await credentials.setFlyToken(token);
             out.ok(`Authenticated as ${email}`);
             flyEmail = email;
         }
@@ -218,13 +192,7 @@ ${bold("EXAMPLES")}
     // Step 1: Fly.io
     // =========================================================================
     let flyEmail = null;
-    const storedToken = await credentials.getFlyToken();
-    if (storedToken) {
-        flyEmail = await tryFlyWhoami(storedToken);
-    }
-    if (!flyEmail) {
-        flyEmail = await tryFlyWhoami();
-    }
+    flyEmail = await tryFlyWhoami();
     // =========================================================================
     // Step 2: Tailscale
     // =========================================================================

package/esm/cli/commands/create/index.js

@@ -1,7 +1,7 @@
 // =============================================================================
 // Create Command - Create Tailscale Subnet Router on Fly.io Custom Network
 // =============================================================================
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { createOutput } from "../../../lib/output.js";
@@ -21,12 +21,12 @@ import { createTransition, hydrateCreate, reportSkipped, } from "./machine.js";
 // =============================================================================
 const stageFlyConfig = async (out, opts) => {
     out.header("Step 1: Fly.io Configuration").blank();
-    const flyToken = await getCredentialStore().getFlyToken();
-    const fly = createFlyProvider(flyToken ?? undefined);
+    const fly = createFlyProvider();
     await fly.auth.ensureInstalled();
     const email = await fly.auth.login({ interactive: !opts.json });
     out.ok(`Authenticated as ${email}`);
     const org = await resolveOrg(fly, opts, out);
+    await fly.auth.useOrgToken(org);
     const region = opts.region || "iad";
     out.ok(`Using Region: ${region}`);
     out.blank();

package/esm/cli/commands/deploy/index.js

@@ -1,7 +1,7 @@
 // =============================================================================
 // Deploy Command - Safely Deploy a Workload App on a Custom Private Network
 // =============================================================================
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { createOutput } from "../../../lib/output.js";
@@ -24,6 +24,7 @@ const stageFlyConfig = async (out, opts) => {
     const email = await fly.auth.login({ interactive: !opts.json });
     out.ok(`Authenticated as ${email}`);
     const org = await resolveOrg(fly, opts, out);
+    await fly.auth.useOrgToken(org);
     out.blank();
     return { fly, org };
 };

package/esm/cli/commands/deploy/machine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/deploy/machine.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACvB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAM/C,MAAM,MAAM,WAAW,GACnB,YAAY,GACZ,WAAW,GACX,QAAQ,GACR,OAAO,GACP,UAAU,CAAC;AAMf,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE;QACL,mBAAmB,EAAE,MAAM,CAAC;QAC5B,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,SAAS,EAAE;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH,CAAC;AAEF,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,iBAAiB,CAAC;IACjC,KAAK,CAAC,EAAE;QACN,mBAAmB,EAAE,MAAM,CAAC;QAC5B,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH;AAaD,eAAO,MAAM,mBAAmB,GAC9B,KAAK,MAAM,CAAC,YAAY,CAAC,EACzB,YAAY,WAAW,SAMxB,CAAC;AAMF,eAAO,MAAM,aAAa,GACxB,KAAK,SAAS,KACb,OAAO,CAAC,WAAW,CAMrB,CAAC;AAMF,eAAO,MAAM,gBAAgB,GAC3B,OAAO,WAAW,EAClB,KAAK,SAAS,KACb,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAiH7B,CAAC"}
+{"version":3,"file":"machine.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/deploy/machine.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACvB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAM/C,MAAM,MAAM,WAAW,GACnB,YAAY,GACZ,WAAW,GACX,QAAQ,GACR,OAAO,GACP,UAAU,CAAC;AAMf,MAAM,MAAM,YAAY,GAAG;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE;QACL,mBAAmB,EAAE,MAAM,CAAC;QAC5B,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IACF,SAAS,EAAE;QACT,OAAO,EAAE,OAAO,CAAC;QACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH,CAAC;AAEF,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,WAAW,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,iBAAiB,CAAC;IACjC,KAAK,CAAC,EAAE;QACN,mBAAmB,EAAE,MAAM,CAAC;QAC5B,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACjE,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH;AAaD,eAAO,MAAM,mBAAmB,GAC9B,KAAK,MAAM,CAAC,YAAY,CAAC,EACzB,YAAY,WAAW,SAMxB,CAAC;AAMF,eAAO,MAAM,aAAa,GACxB,KAAK,SAAS,KACb,OAAO,CAAC,WAAW,CAMrB,CAAC;AAMF,eAAO,MAAM,gBAAgB,GAC3B,OAAO,WAAW,EAClB,KAAK,SAAS,KACb,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAmH7B,CAAC"}

package/esm/cli/commands/destroy/app.js

@@ -1,7 +1,7 @@
 // =============================================================================
 // Destroy App — Destroy a Workload App on a Network
 // =============================================================================
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold, confirm } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { createOutput } from "../../../lib/output.js";

package/esm/cli/commands/destroy/index.js

@@ -2,7 +2,7 @@
 // Destroy Command - Destroy Networks or Apps
 // =============================================================================
 import * as dntShim from "../../../_dnt.shims.js";
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { registerCommand } from "../../mod.js";

package/esm/cli/commands/destroy/network.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/destroy/network.ts"],"names":[],"mappings":"AAuVA,eAAO,MAAM,cAAc,GAAU,MAAM,MAAM,EAAE,KAAG,OAAO,CAAC,IAAI,CA0DjE,CAAC"}
+{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../../../src/cli/commands/destroy/network.ts"],"names":[],"mappings":"AA8VA,eAAO,MAAM,cAAc,GAAU,MAAM,MAAM,EAAE,KAAG,OAAO,CAAC,IAAI,CA2DjE,CAAC"}

package/esm/cli/commands/destroy/network.js

@@ -1,7 +1,7 @@
 // =============================================================================
 // Destroy Network — Tear Down Router and Clean Up Tailnet
 // =============================================================================
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold, confirm } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { createOutput } from "../../../lib/output.js";
@@ -9,7 +9,7 @@ import { Result } from "../../../lib/result.js";
 import { runMachine } from "../../../lib/machine.js";
 import { findRouterApp, listWorkloadAppsOnNetwork } from "../../../util/discovery.js";
 import { getRouterTag } from "../../../util/naming.js";
-import { isAutoApproverConfigured, isTagOwnerConfigured, unpatchAutoApprover, unpatchTagOwner, } from "../../../util/tailscale-local.js";
+import { isAutoApproverConfigured, isTagOwnerConfigured, unpatchAclTagReferences, unpatchAutoApprover, unpatchTagOwner, } from "../../../util/tailscale-local.js";
 import { initSession } from "../../../util/session.js";
 // =============================================================================
 // Phase Labels
@@ -120,6 +120,11 @@ const destroyNetworkTransition = async (phase, ctx) => {
                 return Result.ok("complete");
             }
             let changed = false;
+            const withoutAclRefs = unpatchAclTagReferences(policy, tag);
+            if (withoutAclRefs !== policy) {
+                policy = withoutAclRefs;
+                changed = true;
+            }
             if (isTagOwnerConfigured(policy, tag)) {
                 policy = unpatchTagOwner(policy, tag);
                 changed = true;
@@ -195,8 +200,8 @@ const stageSummary = (out, ctx) => {
     const tag = ctx.tag || getRouterTag(ctx.network);
     if (!ctx.manual) {
         out.blank()
-            .dim("If You Added ACL Rules Referencing This Router, Remember to Remove:")
-            .dim(`  acls: rules referencing ${tag}`)
+            .dim("If You Added Subnet-Only ACL Rules for This Router, Remember to Remove:")
+            .dim(`  acls: rules for this network's subnet`)
             .blank();
     }
     else if (ctx.tag) {
@@ -235,14 +240,15 @@ ${bold("USAGE")}
 
 ${bold("OPTIONS")}
   --org <org>        Fly.io organization slug
-  --manual           Skip automatic Tailscale ACL cleanup (tagOwners + autoApprovers)
+  --manual           Skip automatic Tailscale ACL cleanup
   -y, --yes          Skip confirmation prompts
   --json             Output as JSON
 
 ${bold("DESCRIPTION")}
   By default, ambit removes the router's tag from your Tailscale ACL
-  policy (tagOwners and autoApprovers). Use --manual if your API token
-  lacks ACL write permission or you prefer to manage the policy yourself.
+  policy (tagOwners, autoApprovers, and tag-referencing access rules).
+  Use --manual if your API token lacks ACL write permission or you prefer
+  to manage the policy yourself.
 
 ${bold("EXAMPLES")}
   ambit destroy network browsers

package/esm/cli/commands/doctor.js

@@ -1,7 +1,7 @@
 // =============================================================================
 // Doctor Command - Verify Environment and Infrastructure Health
 // =============================================================================
-import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold } from "../../lib/cli.js";
 import { checkArgs } from "../../lib/args.js";
 import { createOutput } from "../../lib/output.js";

package/esm/cli/commands/list/apps.js

@@ -1,8 +1,8 @@
 // =============================================================================
 // List Apps — List All Workload Apps on a Network
 // =============================================================================
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
-import { Table } from "../../../deps/jsr.io/@cliffy/table/1.0.0/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
+import { Table } from "../../../deps/jsr.io/@cliffy/table/1.1.0/mod.js";
 import { bold } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { createOutput } from "../../../lib/output.js";

package/esm/cli/commands/list/index.js

@@ -2,7 +2,7 @@
 // List Command - List Networks or Apps
 // =============================================================================
 import * as dntShim from "../../../_dnt.shims.js";
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { registerCommand } from "../../mod.js";

package/esm/cli/commands/list/networks.js

@@ -1,8 +1,8 @@
 // =============================================================================
 // List Networks — List All Discovered Routers Across Networks
 // =============================================================================
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
-import { Table } from "../../../deps/jsr.io/@cliffy/table/1.0.0/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
+import { Table } from "../../../deps/jsr.io/@cliffy/table/1.1.0/mod.js";
 import { bold } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { createOutput } from "../../../lib/output.js";

package/esm/cli/commands/logs.js

@@ -1,7 +1,7 @@
 // =============================================================================
 // Logs Command - Stream Logs for Workload Apps
 // =============================================================================
-import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold } from "../../lib/cli.js";
 import { checkArgs } from "../../lib/args.js";
 import { createOutput } from "../../lib/output.js";

package/esm/cli/commands/secrets.js

@@ -2,8 +2,8 @@
 // Secrets Command - Manage Secrets for Workload Apps
 // =============================================================================
 import * as dntShim from "../../_dnt.shims.js";
-import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.28/mod.js";
-import { Table } from "../../deps/jsr.io/@cliffy/table/1.0.0/mod.js";
+import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.29/mod.js";
+import { Table } from "../../deps/jsr.io/@cliffy/table/1.1.0/mod.js";
 import { bold } from "../../lib/cli.js";
 import { checkArgs } from "../../lib/args.js";
 import { createOutput } from "../../lib/output.js";

package/esm/cli/commands/share.js

@@ -1,12 +1,12 @@
 // =============================================================================
 // Share Command - Grant Members Access to a Network via Tailscale ACL
 // =============================================================================
-import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold } from "../../lib/cli.js";
 import { checkArgs } from "../../lib/args.js";
 import { createOutput } from "../../lib/output.js";
 import { registerCommand } from "../mod.js";
-import { z } from "../../deps/jsr.io/@zod/zod/4.3.6/src/index.js";
+import { z } from "../../deps/jsr.io/@zod/zod/4.4.3/src/index.js";
 import { findRouterApp, getRouterMachineInfo } from "../../util/discovery.js";
 import { getRouterTag } from "../../util/naming.js";
 import { assertAdditivePatch, isAclRuleConfigured, patchAclRule, } from "../../util/tailscale-local.js";

package/esm/cli/commands/status/app.js

@@ -1,7 +1,7 @@
 // =============================================================================
 // Status App — Show App Status
 // =============================================================================
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { createOutput } from "../../../lib/output.js";

package/esm/cli/commands/status/index.js

@@ -1,7 +1,7 @@
 // =============================================================================
 // Status Command - Show Network, App, and Router Status
 // =============================================================================
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { registerCommand } from "../../mod.js";

package/esm/cli/commands/status/network.js

@@ -1,7 +1,7 @@
 // =============================================================================
 // Status Network — Show Detailed Status for a Single Network
 // =============================================================================
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { createOutput } from "../../../lib/output.js";

package/esm/cli/commands/status/networks.js

@@ -1,8 +1,8 @@
 // =============================================================================
 // Status Networks — Summary Table of All Networks
 // =============================================================================
-import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.28/mod.js";
-import { Table } from "../../../deps/jsr.io/@cliffy/table/1.0.0/mod.js";
+import { parseArgs } from "../../../deps/jsr.io/@std/cli/1.0.29/mod.js";
+import { Table } from "../../../deps/jsr.io/@cliffy/table/1.1.0/mod.js";
 import { bold } from "../../../lib/cli.js";
 import { checkArgs } from "../../../lib/args.js";
 import { createOutput } from "../../../lib/output.js";

package/esm/cli/mod.js

@@ -2,7 +2,7 @@
 // CLI Framework - Command Parser and Router
 // =============================================================================
 import * as dntShim from "../_dnt.shims.js";
-import { parseArgs } from "../deps/jsr.io/@std/cli/1.0.28/mod.js";
+import { parseArgs } from "../deps/jsr.io/@std/cli/1.0.29/mod.js";
 import { bold, dim } from "../lib/cli.js";
 import denoConfig from "../deno.js";
 // =============================================================================

package/esm/deno.js

@@ -1,6 +1,6 @@
 export default {
     "name": "@cardelli/ambit",
-    "version": "0.4.4",
+    "version": "0.4.5",
     "description": "Deploy apps to the cloud that only you and your AI agents can reach",
     "license": "MIT",
     "tasks": {

package/esm/deps/jsr.io/@cliffy/table/{1.0.0 → 1.1.0}/_layout.d.ts

@@ -30,12 +30,16 @@ export declare class TableLayout {
      * settings.
      */
     protected createLayout(): RenderSettings;
+    private computeColumnDimensions;
+    private applyFlexShrink;
+    private applyFlexGrow;
+    private resolveColumnWeight;
     /**
      * Fills rows and cols by specified row/col span with a reference of the
      * original cell.
      */
     protected spanRows(rows: Array<RowType>): Array<Row<Cell>>;
-    protected getDeleteCount(rows: Array<Array<unknown>>, rowIndex: number, colIndex: number): 1 | 0;
+    protected getDeleteCount(rows: Array<Array<unknown>>, rowIndex: number, colIndex: number): 0 | 1;
     /**
      * Create a new row from existing row or cell array.
      * @param row Original row.

package/esm/deps/jsr.io/@cliffy/table/1.1.0/_layout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_layout.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@cliffy/table/1.1.0/_layout.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,KAAK,QAAQ,EAAkB,MAAM,WAAW,CAAC;AAEhE,OAAO,EAAE,GAAG,EAAE,KAAK,OAAO,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,KAAK,EAAiB,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAMtE,8BAA8B;AAC9B,UAAU,cAAc;IACtB,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvB,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;CACxB;AASD,6BAA6B;AAC7B,qBAAa,WAAW;;IAOpB,OAAO,CAAC,KAAK;IACb,OAAO,CAAC,OAAO;IAPjB;;;;OAIG;gBAEO,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,aAAa;IAGhC,6BAA6B;IACtB,QAAQ,IAAI,MAAM;IAKzB;;;;OAIG;IACH,SAAS,CAAC,YAAY,IAAI,cAAc;IA0DxC,OAAO,CAAC,uBAAuB;IAsC/B,OAAO,CAAC,eAAe;IA6CvB,OAAO,CAAC,aAAa;IAsCrB,OAAO,CAAC,mBAAmB;IAwC3B;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IA4D1D,SAAS,CAAC,cAAc,CACtB,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAC3B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,CAAC,GAAG,CAAC;IAOR;;;OAGG;IACH,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;IAM5C;;;;;;;OAOG;IACH,SAAS,CAAC,UAAU,CAClB,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,EACjC,GAAG,EAAE,GAAG,EACR,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,IAAI;IAcP,OAAO,CAAC,WAAW;IAInB;;;OAGG;IACH,SAAS,CAAC,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,MAAM;IAWlD;;;;;;OAMG;IACH,SAAS,CAAC,SAAS,CACjB,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EACtB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,cAAc,EACpB,WAAW,CAAC,EAAE,OAAO,GACpB,MAAM;IAwET;;;;;;OAMG;IACH,SAAS,CAAC,UAAU,CAClB,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,EACd,IAAI,EAAE,cAAc,EACpB,QAAQ,CAAC,EAAE,OAAO,GACjB,MAAM;IAqDT;;;;;OAKG;IACH,SAAS,CAAC,eAAe,CACvB,IAAI,EAAE,IAAI,EACV,SAAS,EAAE,MAAM,GAChB;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE;IAgDpC;;;;;;OAMG;IACH,SAAS,CAAC,eAAe,CACvB,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,EAC9B,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,EAC9B,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EACtB,IAAI,EAAE,cAAc,GACnB,MAAM;IA2BT;;;;;;;OAOG;IACH,SAAS,CAAC,gBAAgB,CACxB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,EAC9B,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,EAC9B,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EACtB,IAAI,EAAE,cAAc,GACnB,MAAM;CAoJV"}

package/esm/deps/jsr.io/@cliffy/table/{1.0.0 → 1.1.0}/_layout.js

@@ -2,6 +2,7 @@ import { Cell } from "./cell.js";
 import { consumeChars, consumeWords } from "./consume_words.js";
 import { Row } from "./row.js";
 import { getUnclosedAnsiRuns, longest, strLength } from "./_utils.js";
+const sum = (numList) => numList.reduce((a, b) => a + b, 0);
 /** Table layout renderer. */
 export class TableLayout {
     table;
@@ -47,34 +48,115 @@ export class TableLayout {
                 }
             }
         }
+        const { padding, width, minColWidth, maxColWidth, } = this.computeColumnDimensions(columns, rows);
+        if (isFinite(this.options.maxWidth)) {
+            const totalPadding = hasBorder
+                ? sum(padding) * 2 + (columns + 1)
+                : sum(padding.slice(0, -1));
+            const maxAllowable = this.options.maxWidth - totalPadding;
+            if (sum(width) > maxAllowable) {
+                this.applyFlexShrink(width, minColWidth, maxAllowable);
+            }
+            if (sum(width) < maxAllowable) {
+                this.applyFlexGrow(width, maxColWidth, maxAllowable);
+            }
+        }
+        return {
+            padding,
+            width,
+            rows,
+            columns,
+            hasBorder,
+            hasBodyBorder,
+            hasHeaderBorder,
+        };
+    }
+    computeColumnDimensions(columns, rows) {
         const padding = [];
         const width = [];
+        const minColWidth = [];
+        const maxColWidth = [];
         for (let colIndex = 0; colIndex < columns; colIndex++) {
             const column = this.options.columns.at(colIndex);
-            const minColWidth = column?.getMinWidth() ??
+            minColWidth[colIndex] = column?.getMinWidth() ??
                 (Array.isArray(this.options.minColWidth)
                     ? this.options.minColWidth[colIndex]
-                    : this.options.minColWidth);
-            const maxColWidth = column?.getMaxWidth() ??
+                    : this.options.minColWidth) ??
+                0;
+            maxColWidth[colIndex] = column?.getMaxWidth() ??
                 (Array.isArray(this.options.maxColWidth)
                     ? this.options.maxColWidth[colIndex]
-                    : this.options.maxColWidth);
-            const colWidth = longest(colIndex, rows, maxColWidth);
-            width[colIndex] = Math.min(maxColWidth, Math.max(minColWidth, colWidth));
+                    : this.options.maxColWidth) ??
+                Infinity;
+            const colWidth = longest(colIndex, rows, maxColWidth[colIndex]);
+            width[colIndex] = Math.min(maxColWidth[colIndex], Math.max(minColWidth[colIndex], colWidth));
             padding[colIndex] = column?.getPadding() ??
                 (Array.isArray(this.options.padding)
                     ? this.options.padding[colIndex]
-                    : this.options.padding);
+                    : this.options.padding) ??
+                0;
+        }
+        return { padding, width, minColWidth, maxColWidth };
+    }
+    applyFlexShrink(width, minColWidth, maxAllowable) {
+        const shrink = width.map((_w, i) => this.resolveColumnWeight("flexShrink", i));
+        let changed = true;
+        while (changed) {
+            changed = false;
+            if (sum(width) <= maxAllowable) {
+                break;
+            }
+            const overflow = sum(width) - maxAllowable;
+            // CSS flex-shrink: each column's reduction share is proportional to
+            // shrink × width, so wider or higher-weighted columns absorb more.
+            const scaledTotal = sum(width.map((w, i) => shrink[i] > 0 && w > minColWidth[i] ? shrink[i] * w : 0));
+            if (scaledTotal === 0) {
+                break;
+            }
+            for (let i = 0; i < width.length; i++) {
+                if (shrink[i] > 0 && width[i] > minColWidth[i]) {
+                    const target = Math.max(Math.max(1, minColWidth[i]), Math.floor(width[i] * (1 - overflow * shrink[i] / scaledTotal)));
+                    if (target !== width[i]) {
+                        width[i] = target;
+                        changed = true;
+                    }
+                }
+            }
         }
-        return {
-            padding,
-            width,
-            rows,
-            columns,
-            hasBorder,
-            hasBodyBorder,
-            hasHeaderBorder,
-        };
+    }
+    applyFlexGrow(width, maxColWidth, maxAllowable) {
+        const grow = width.map((_w, i) => this.resolveColumnWeight("flexGrow", i));
+        let changed = true;
+        while (changed) {
+            changed = false;
+            if (sum(width) >= maxAllowable) {
+                break;
+            }
+            const slack = maxAllowable - sum(width);
+            // CSS flex-grow: available slack is distributed proportionally by weight.
+            const totalWeight = sum(grow.map((g, i) => width[i] < maxColWidth[i] ? g : 0));
+            if (totalWeight === 0) {
+                break;
+            }
+            for (let i = 0; i < width.length; i++) {
+                if (grow[i] > 0 && width[i] < maxColWidth[i]) {
+                    const extra = Math.floor(slack * grow[i] / totalWeight);
+                    const newWidth = Math.min(maxColWidth[i], width[i] + extra);
+                    if (newWidth !== width[i]) {
+                        width[i] = newWidth;
+                        changed = true;
+                    }
+                }
+            }
+        }
+    }
+    resolveColumnWeight(prop, i) {
+        const getter = prop === "flexShrink" ? "getFlexShrink" : "getFlexGrow";
+        const weight = this.options.columns.at(i)?.[getter]() ??
+            (Array.isArray(this.options[prop])
+                ? this.options[prop][i]
+                : this.options[prop]);
+        return Number.isFinite(weight) && weight > 0 ? weight : 0;
     }
     #getRows() {
         const header = this.table.getHeader();
@@ -297,6 +379,9 @@ export class TableLayout {
      * @param maxLength Max length of content to render.
      */
     renderCellValue(cell, maxLength) {
+        if (maxLength <= 0) {
+            return { current: "", next: "" };
+        }
         const length = Math.min(maxLength, strLength(cell.toString()));
         let words = consumeWords(length, cell.toString());
         // break word if word is longer than max length

package/esm/deps/jsr.io/@cliffy/table/{1.0.0 → 1.1.0}/_utils.d.ts

@@ -12,18 +12,15 @@ export declare function longest(index: number, rows: Array<Array<CellType>>, max
 export declare const strLength: (str: string) => number;
 /** Regex `source` to match any relevant ANSI code. */
 export declare const ansiRegexSource: string;
+interface UnclosedAnsiRunsResult {
+    currentSuffix: string;
+    nextPrefix: string;
+}
 /**
  * Get unclosed ANSI runs in a string.
  *
  * @param text - A string segment possibly containing unclosed ANSI runs.
  */
-export declare function getUnclosedAnsiRuns(text: string): {
-    /** The suffix to be appended to the text to close all unclosed runs. */
-    currentSuffix: string;
-    /**
-     * The prefix to be appended to the next segment to continue unclosed
-     * runs if the input text forms the first segment of a multi-line string.
-     */
-    nextPrefix: string;
-};
+export declare function getUnclosedAnsiRuns(text: string): UnclosedAnsiRunsResult;
+export {};
 //# sourceMappingURL=_utils.d.ts.map

package/esm/deps/jsr.io/@cliffy/table/{1.0.0 → 1.1.0}/_utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"_utils.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@cliffy/table/1.0.0/_utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAQ,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAMhD;;GAEG;AACH,wBAAgB,OAAO,CACrB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAC5B,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM,CAmBR;AAED,eAAO,MAAM,SAAS,GAAI,KAAK,MAAM,KAAG,MAEvC,CAAC;AAEF,sDAAsD;AACtD,eAAO,MAAM,eAAe,QAGjB,CAAC;AAEZ;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM;IAwB5C,wEAAwE;;IAExE;;;OAGG;;EAGN"}
+{"version":3,"file":"_utils.d.ts","sourceRoot":"","sources":["../../../../../../src/deps/jsr.io/@cliffy/table/1.1.0/_utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAQ,KAAK,QAAQ,EAAE,MAAM,WAAW,CAAC;AAOhD;;GAEG;AACH,wBAAgB,OAAO,CACrB,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAC5B,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM,CAmBR;AAED,eAAO,MAAM,SAAS,GAAI,KAAK,MAAM,KAAG,MAEvC,CAAC;AAEF,sDAAsD;AACtD,eAAO,MAAM,eAAe,QAGjB,CAAC;AAEZ,UAAU,sBAAsB;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,sBAAsB,CAuCxE"}