@cliftonc/cfld 0.1.0

package/dist/cli.js

@@ -0,0 +1,1890 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { parseArgs } from "util";
+import pc7 from "picocolors";
+
+// src/commands/run.ts
+import { join as join5 } from "path";
+
+// src/core/state-machine.ts
+import { existsSync as existsSync2 } from "fs";
+
+// src/util/paths.ts
+import { homedir } from "os";
+import { join } from "path";
+function cloudflaredDir() {
+  return process.env.CLOUDFLARED_HOME ?? join(homedir(), ".cloudflared");
+}
+function defaultCertPath() {
+  return process.env.TUNNEL_ORIGIN_CERT ?? join(cloudflaredDir(), "cert.pem");
+}
+function cfldDir() {
+  return process.env.CFLD_HOME ?? join(homedir(), ".cfld");
+}
+function certStoreDir() {
+  return join(cfldDir(), "certs");
+}
+function certPathForZone(zone) {
+  return join(certStoreDir(), `${zone}.pem`);
+}
+function registryPath() {
+  return join(cfldDir(), "registry.json");
+}
+function credentialsPath(uuid) {
+  return join(cloudflaredDir(), `${uuid}.json`);
+}
+function ingressConfigPath(slug) {
+  return join(cloudflaredDir(), `${slug}.cfld.yml`);
+}
+var PROJECT_CONFIG_FILE = ".cfld.json";
+
+// src/util/exec.ts
+import { spawn } from "child_process";
+function exec(command, args, options = {}) {
+  return new Promise((resolve, reject) => {
+    const spawnOptions = {
+      env: { ...process.env, ...options.env },
+      cwd: options.cwd,
+      stdio: ["ignore", "pipe", "pipe"]
+    };
+    const child = spawn(command, args, spawnOptions);
+    let stdout = "";
+    let stderr = "";
+    const wire = (stream) => {
+      const source = stream === "stdout" ? child.stdout : child.stderr;
+      if (!source) return;
+      let buffer = "";
+      source.setEncoding("utf8");
+      source.on("data", (chunk) => {
+        if (stream === "stdout") stdout += chunk;
+        else stderr += chunk;
+        if (!options.onLine) return;
+        buffer += chunk;
+        let idx;
+        while ((idx = buffer.indexOf("\n")) !== -1) {
+          const line = buffer.slice(0, idx);
+          buffer = buffer.slice(idx + 1);
+          options.onLine(line, stream);
+        }
+      });
+      source.on("end", () => {
+        if (options.onLine && buffer.length > 0) options.onLine(buffer, stream);
+      });
+    };
+    wire("stdout");
+    wire("stderr");
+    child.on("error", (err) => {
+      reject(err);
+    });
+    child.on("close", (code) => {
+      resolve({ code, stdout, stderr });
+    });
+  });
+}
+
+// src/util/errors.ts
+var CfldError = class extends Error {
+  hint;
+  constructor(message, hint) {
+    super(message);
+    this.name = "CfldError";
+    this.hint = hint;
+  }
+};
+
+// src/core/cloudflared.ts
+var cachedBinary;
+async function resolveBinary() {
+  if (cachedBinary) return cachedBinary;
+  const override = process.env.CFLD_CLOUDFLARED ?? process.env.CLOUDFLARED_BIN;
+  if (override) return cachedBinary = override;
+  try {
+    const res = await exec("cloudflared", ["--version"]);
+    if (res.code === 0) return cachedBinary = "cloudflared";
+  } catch {
+  }
+  try {
+    const mod = await import("cloudflared");
+    return cachedBinary = mod.bin;
+  } catch {
+    throw new CfldError(
+      "cloudflared is not installed and the managed binary could not be loaded.",
+      "Install it with `brew install cloudflared`, or set CFLD_CLOUDFLARED to its path."
+    );
+  }
+}
+async function resolveBinaryAbsolute() {
+  const bin = await resolveBinary();
+  if (bin.includes("/")) return bin;
+  try {
+    const res = await exec("which", [bin]);
+    const path = res.stdout.trim().split("\n")[0];
+    if (res.code === 0 && path) return path;
+  } catch {
+  }
+  return bin;
+}
+async function runTunnel(subArgs, options = {}) {
+  const { originCert, ...execOptions } = options;
+  const bin = await resolveBinary();
+  const args = ["tunnel"];
+  if (originCert) args.push("--origincert", originCert);
+  args.push(...subArgs);
+  return exec(bin, args, execOptions);
+}
+async function listTunnels(originCert) {
+  const res = await runTunnel(["list", "--output", "json"], { originCert });
+  if (res.code !== 0) {
+    throw new CfldError(
+      "Failed to list Cloudflare tunnels.",
+      res.stderr.trim() || "Check that your cert is valid \u2014 try `cfld login`."
+    );
+  }
+  try {
+    const parsed = JSON.parse(res.stdout);
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
+  }
+}
+async function findTunnel(name, originCert) {
+  const tunnels = await listTunnels(originCert);
+  return tunnels.find((t) => t.name === name);
+}
+var UUID_RE = /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/i;
+async function createTunnel(name, originCert) {
+  const res = await runTunnel(["create", name], { originCert });
+  if (res.code !== 0) {
+    if (/already exists/i.test(res.stderr)) {
+      const existing = await findTunnel(name, originCert);
+      if (existing) return existing.id;
+    }
+    throw new CfldError(
+      `Failed to create tunnel "${name}".`,
+      res.stderr.trim() || void 0
+    );
+  }
+  const match = res.stdout.match(UUID_RE);
+  if (match) return match[0];
+  const created = await findTunnel(name, originCert);
+  if (created) return created.id;
+  throw new CfldError(
+    `Created tunnel "${name}" but could not determine its UUID.`
+  );
+}
+async function fetchToken(nameOrUuid, credFile, originCert) {
+  const res = await runTunnel(
+    ["token", "--cred-file", credFile, nameOrUuid],
+    { originCert }
+  );
+  if (res.code !== 0) {
+    throw new CfldError(
+      `Failed to fetch credentials for tunnel "${nameOrUuid}".`,
+      res.stderr.trim() || void 0
+    );
+  }
+}
+async function routeDns(nameOrUuid, hostname, originCert) {
+  const res = await runTunnel(
+    ["route", "dns", "--overwrite-dns", nameOrUuid, hostname],
+    { originCert }
+  );
+  if (res.code !== 0) {
+    throw new CfldError(
+      `Failed to route DNS ${hostname} \u2192 tunnel "${nameOrUuid}".`,
+      res.stderr.trim() || "The hostname's zone may not match this cert \u2014 try `cfld login --reauth`."
+    );
+  }
+}
+async function deleteTunnel(nameOrUuid, originCert) {
+  const res = await runTunnel(["delete", nameOrUuid], { originCert });
+  if (res.code !== 0) {
+    throw new CfldError(
+      `Failed to delete tunnel "${nameOrUuid}".`,
+      res.stderr.trim() || void 0
+    );
+  }
+}
+
+// src/core/dns.ts
+import { resolveCname } from "dns/promises";
+var CFARGO_RE = /([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.cfargotunnel\.com/i;
+async function existingCnameTarget(hostname) {
+  try {
+    const records = await resolveCname(hostname);
+    return records[0];
+  } catch {
+    return void 0;
+  }
+}
+function cfargoTunnelUuid(target) {
+  return target?.match(CFARGO_RE)?.[1]?.toLowerCase();
+}
+
+// src/core/config-file.ts
+import { writeFileSync } from "fs";
+function renderIngressConfig(cfg) {
+  const rules = cfg.routes.flatMap((r) => {
+    const lines = [`  - hostname: ${r.hostname}`];
+    if (r.path) lines.push(`    path: ${r.path}`);
+    lines.push(`    service: http://localhost:${r.port}`);
+    return lines;
+  });
+  return [
+    `tunnel: ${cfg.uuid}`,
+    `credentials-file: ${credentialsPath(cfg.uuid)}`,
+    `ingress:`,
+    ...rules,
+    `  - service: http_status:404`,
+    ``
+  ].join("\n");
+}
+function writeIngressConfig(cfg) {
+  const path = ingressConfigPath(cfg.slug);
+  writeFileSync(path, renderIngressConfig(cfg), "utf8");
+  return path;
+}
+
+// src/core/registry.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync as writeFileSync2 } from "fs";
+function empty() {
+  return { version: 1, tunnels: [] };
+}
+function readRegistry() {
+  const p = registryPath();
+  if (!existsSync(p)) return empty();
+  try {
+    const parsed = JSON.parse(readFileSync(p, "utf8"));
+    if (!parsed || !Array.isArray(parsed.tunnels)) return empty();
+    return parsed;
+  } catch {
+    return empty();
+  }
+}
+function writeRegistry(data) {
+  mkdirSync(cfldDir(), { recursive: true });
+  writeFileSync2(registryPath(), JSON.stringify(data, null, 2) + "\n", "utf8");
+}
+function listEntries() {
+  return readRegistry().tunnels;
+}
+function getEntry(name) {
+  return readRegistry().tunnels.find((t) => t.name === name);
+}
+function upsertEntry(entry) {
+  const data = readRegistry();
+  const idx = data.tunnels.findIndex((t) => t.name === entry.name);
+  if (idx === -1) data.tunnels.push(entry);
+  else data.tunnels[idx] = entry;
+  writeRegistry(data);
+}
+function removeEntry(name) {
+  const data = readRegistry();
+  data.tunnels = data.tunnels.filter((t) => t.name !== name);
+  writeRegistry(data);
+}
+
+// src/core/state-machine.ts
+async function reconcile(input, events = {}) {
+  const step2 = (s) => events.onStep?.(s);
+  const { tunnelName, certPath, routes, slug, zone, projectDir } = input;
+  const primary = routes[0];
+  if (!primary) throw new CfldError("At least one route is required.");
+  step2(`Resolving tunnel ${tunnelName}`);
+  const existing = await findTunnel(tunnelName, certPath);
+  let uuid;
+  let created = false;
+  if (existing) {
+    uuid = existing.id;
+    if (!existsSync2(credentialsPath(uuid))) {
+      step2("Refetching tunnel credentials");
+      await fetchToken(tunnelName, credentialsPath(uuid), certPath);
+    }
+  } else {
+    step2(`Creating tunnel ${tunnelName}`);
+    uuid = await createTunnel(tunnelName, certPath);
+    created = true;
+  }
+  const prior = getEntry(tunnelName);
+  const owned = /* @__PURE__ */ new Set([
+    prior?.hostname,
+    ...(prior?.routes ?? []).map((r) => r.hostname)
+  ]);
+  for (const route of routes) {
+    if (!input.force && !owned.has(route.hostname)) {
+      const target = await existingCnameTarget(route.hostname);
+      if (target && cfargoTunnelUuid(target) !== uuid.toLowerCase()) {
+        const ok = events.confirmOverwrite ? await events.confirmOverwrite(route.hostname, target) : false;
+        if (!ok) {
+          throw new CfldError(
+            `${route.hostname} already points to ${target}.`,
+            "Re-run with --force to repoint it, or pick another host."
+          );
+        }
+      }
+    }
+    step2(`Routing ${route.hostname}`);
+    await routeDns(tunnelName, route.hostname, certPath);
+  }
+  step2("Writing ingress config");
+  const configPath = writeIngressConfig({ slug, uuid, routes });
+  upsertEntry({
+    name: tunnelName,
+    zone,
+    certPath,
+    uuid,
+    hostname: primary.hostname,
+    port: primary.port,
+    routes,
+    projectDir,
+    createdAt: prior?.createdAt ?? nowIso(),
+    lastRun: nowIso()
+  });
+  return {
+    uuid,
+    tunnelName,
+    hostname: primary.hostname,
+    port: primary.port,
+    routes,
+    certPath,
+    configPath,
+    created
+  };
+}
+function nowIso() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+
+// src/core/cert-store.ts
+import { copyFileSync, existsSync as existsSync4, mkdirSync as mkdirSync2, readdirSync } from "fs";
+
+// src/core/cert.ts
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+var TOKEN_BLOCK_RE = /-----BEGIN ARGO TUNNEL TOKEN-----\s*([\s\S]*?)\s*-----END ARGO TUNNEL TOKEN-----/;
+function certExists(certPath) {
+  return existsSync3(certPath);
+}
+function readCertToken(certPath) {
+  if (!existsSync3(certPath)) return void 0;
+  let pem;
+  try {
+    pem = readFileSync2(certPath, "utf8");
+  } catch {
+    return void 0;
+  }
+  const match = pem.match(TOKEN_BLOCK_RE);
+  if (!match || !match[1]) return void 0;
+  try {
+    const json = Buffer.from(match[1].replace(/\s+/g, ""), "base64").toString(
+      "utf8"
+    );
+    const parsed = JSON.parse(json);
+    return parsed;
+  } catch {
+    return void 0;
+  }
+}
+function certHasZone(certPath) {
+  const token = readCertToken(certPath);
+  return Boolean(token?.zoneID);
+}
+
+// src/core/cert-store.ts
+function ensureStoreDir() {
+  mkdirSync2(certStoreDir(), { recursive: true });
+}
+function storedCertForZone(zone) {
+  const p = certPathForZone(zone);
+  return existsSync4(p) ? p : void 0;
+}
+function listStoredZones() {
+  try {
+    return readdirSync(certStoreDir()).filter((f) => f.endsWith(".pem")).map((f) => f.slice(0, -".pem".length));
+  } catch {
+    return [];
+  }
+}
+function resolveCert(zone) {
+  return storedCertForZone(zone) ?? (certExists(defaultCertPath()) ? defaultCertPath() : void 0);
+}
+function importCert(zone, fromPath = defaultCertPath()) {
+  ensureStoreDir();
+  const dest = certPathForZone(zone);
+  copyFileSync(fromPath, dest);
+  return dest;
+}
+
+// src/core/hostname.ts
+import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
+import { basename, join as join2 } from "path";
+function slugify(input) {
+  return input.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+}
+function deriveSlug(cwd, nameFlag) {
+  if (nameFlag) return slugify(nameFlag);
+  const pkgPath = join2(cwd, "package.json");
+  if (existsSync5(pkgPath)) {
+    try {
+      const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
+      if (pkg.name) {
+        const unscoped = pkg.name.replace(/^@[^/]+\//, "");
+        const slug = slugify(unscoped);
+        if (slug) return slug;
+      }
+    } catch {
+    }
+  }
+  return slugify(basename(cwd)) || "app";
+}
+function tunnelNameForSlug(slug) {
+  return `cfld-${slug}`;
+}
+function buildHostname(slug, zone) {
+  return `${slug}.${zone}`;
+}
+function zoneForHostname(hostname, knownZones) {
+  const matches = knownZones.filter((z) => hostname === z || hostname.endsWith(`.${z}`)).sort((a, b) => b.length - a.length);
+  if (matches[0]) return matches[0];
+  const labels = hostname.split(".");
+  return labels.slice(-2).join(".");
+}
+
+// src/core/port.ts
+import { createServer, Socket } from "net";
+var COMMON_DEV_PORTS = [3e3, 5173, 8080, 8e3, 5e3, 4200, 3001];
+function isPortListening(port, timeoutMs = 300) {
+  return new Promise((resolve) => {
+    const socket = new Socket();
+    let settled = false;
+    const done2 = (result) => {
+      if (settled) return;
+      settled = true;
+      socket.destroy();
+      resolve(result);
+    };
+    socket.setTimeout(timeoutMs);
+    socket.once("connect", () => done2(true));
+    socket.once("timeout", () => done2(false));
+    socket.once("error", () => done2(false));
+    socket.connect(port, "127.0.0.1");
+  });
+}
+async function detectDevPorts() {
+  const checks = await Promise.all(
+    COMMON_DEV_PORTS.map(async (p) => await isPortListening(p) ? p : null)
+  );
+  return checks.filter((p) => p !== null);
+}
+function findFreePort() {
+  return new Promise((resolve, reject) => {
+    const server = createServer();
+    server.unref();
+    server.on("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const addr = server.address();
+      if (addr && typeof addr === "object") {
+        const { port } = addr;
+        server.close(() => resolve(port));
+      } else {
+        server.close(() => reject(new Error("Could not acquire a free port")));
+      }
+    });
+  });
+}
+
+// src/core/project-config.ts
+import { existsSync as existsSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { join as join3 } from "path";
+function dotConfigPath(cwd) {
+  return join3(cwd, PROJECT_CONFIG_FILE);
+}
+function readAuthored(cwd) {
+  const pkgPath = join3(cwd, "package.json");
+  if (!existsSync6(pkgPath)) return void 0;
+  try {
+    const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
+    const c = pkg.cfld;
+    if (!c) return void 0;
+    return {
+      name: c.name,
+      zone: c.zone,
+      port: c.port,
+      hostname: c.hostname ?? c.host,
+      envKey: c.envKey,
+      routes: c.routes
+    };
+  } catch {
+    return void 0;
+  }
+}
+function readCached(cwd) {
+  const p = dotConfigPath(cwd);
+  if (!existsSync6(p)) return void 0;
+  try {
+    return JSON.parse(readFileSync4(p, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
+function readProjectConfig(cwd) {
+  const authored = readAuthored(cwd);
+  const cached = readCached(cwd);
+  if (!authored && !cached) return void 0;
+  return {
+    name: authored?.name ?? cached?.name,
+    zone: authored?.zone ?? cached?.zone,
+    port: authored?.port ?? cached?.port,
+    hostname: authored?.hostname ?? cached?.hostname,
+    envKey: authored?.envKey ?? cached?.envKey,
+    routes: authored?.routes ?? cached?.routes,
+    uuid: cached?.uuid
+    // resolved identity only ever comes from the cache
+  };
+}
+function writeProjectConfig(cwd, config) {
+  writeFileSync3(
+    dotConfigPath(cwd),
+    JSON.stringify(config, null, 2) + "\n",
+    "utf8"
+  );
+}
+
+// src/core/env-writer.ts
+import { existsSync as existsSync7, readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+function upsertEnv(envPath, key, value) {
+  const line = `${key}=${value}`;
+  const existing = existsSync7(envPath) ? readFileSync5(envPath, "utf8") : "";
+  const body = existing.replace(/\n$/, "");
+  const lines = body.length ? body.split("\n") : [];
+  const keyRe = new RegExp(`^\\s*${escapeRegExp(key)}\\s*=`);
+  let found = false;
+  let changed = false;
+  const next = lines.map((l) => {
+    if (keyRe.test(l)) {
+      found = true;
+      if (l !== line) changed = true;
+      return line;
+    }
+    return l;
+  });
+  if (!found) {
+    next.push(line);
+    changed = true;
+  }
+  if (!changed) return { changed: false };
+  writeFileSync4(envPath, next.join("\n") + "\n", "utf8");
+  return { changed: true };
+}
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+// src/process/runner.ts
+import { spawn as spawn2 } from "child_process";
+var BACKOFF_MS = [1e3, 2e3, 4e3, 8e3, 16e3, 3e4];
+var RAPID_FAILURE_MS = 3e3;
+var MAX_RAPID_FAILURES = 5;
+async function startRunner(options) {
+  const bin = await resolveBinary();
+  const args = [
+    "tunnel",
+    "--origincert",
+    options.certPath,
+    "--config",
+    options.configPath,
+    "--metrics",
+    `127.0.0.1:${options.metricsPort}`,
+    "run",
+    options.tunnelName
+  ];
+  let child;
+  let stopped = false;
+  let rapidFailures = 0;
+  let restartTimer;
+  const spawnOnce = () => {
+    const startedAt = Date.now();
+    child = spawn2(bin, args, {
+      stdio: ["ignore", "pipe", "pipe"],
+      env: { ...process.env, TUNNEL_ORIGIN_CERT: options.certPath }
+    });
+    wireLines(child, "stdout", options.onLine);
+    wireLines(child, "stderr", options.onLine);
+    child.on("exit", (code) => {
+      if (stopped) return;
+      const uptime = Date.now() - startedAt;
+      rapidFailures = uptime < RAPID_FAILURE_MS ? rapidFailures + 1 : 0;
+      if (rapidFailures >= MAX_RAPID_FAILURES) {
+        options.onFatal?.(
+          `cloudflared exited repeatedly (last code ${code}). Likely a config or credentials problem \u2014 run \`cfld doctor\`.`
+        );
+        return;
+      }
+      const delay = BACKOFF_MS[Math.min(rapidFailures, BACKOFF_MS.length - 1)];
+      options.onStatus?.("reconnecting");
+      restartTimer = setTimeout(() => {
+        if (stopped) return;
+        options.onStatus?.("connecting");
+        spawnOnce();
+      }, delay);
+      restartTimer.unref();
+    });
+  };
+  options.onStatus?.("connecting");
+  spawnOnce();
+  return {
+    stop() {
+      stopped = true;
+      if (restartTimer) clearTimeout(restartTimer);
+      options.onStatus?.("stopped");
+      const c = child;
+      if (!c || c.exitCode !== null || c.signalCode) return;
+      c.kill("SIGINT");
+      const t = setTimeout(() => {
+        if (c.exitCode === null && !c.signalCode) c.kill("SIGKILL");
+      }, 4e3);
+      t.unref();
+    }
+  };
+}
+function wireLines(child, stream, onLine) {
+  const source = stream === "stdout" ? child.stdout : child.stderr;
+  if (!source || !onLine) return;
+  let buffer = "";
+  source.setEncoding("utf8");
+  source.on("data", (chunk) => {
+    buffer += chunk;
+    let idx;
+    while ((idx = buffer.indexOf("\n")) !== -1) {
+      onLine(buffer.slice(0, idx), stream);
+      buffer = buffer.slice(idx + 1);
+    }
+  });
+}
+
+// src/process/ready.ts
+async function getReady(metricsPort) {
+  try {
+    const res = await fetch(`http://127.0.0.1:${metricsPort}/ready`);
+    if (res.status !== 200) return { ready: false, connections: 0 };
+    const body = await res.json();
+    return { ready: true, connections: body.readyConnections ?? 0 };
+  } catch {
+    return void 0;
+  }
+}
+async function waitForReady(metricsPort, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? 6e4;
+  const intervalMs = opts.intervalMs ?? 500;
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (opts.signal?.aborted) throw new Error("aborted");
+    const state = await getReady(metricsPort);
+    if (state?.ready) return state;
+    await sleep(intervalMs);
+  }
+  throw new Error("Timed out waiting for the tunnel to connect to Cloudflare.");
+}
+async function scrapeMetrics(metricsPort) {
+  try {
+    const res = await fetch(`http://127.0.0.1:${metricsPort}/metrics`);
+    if (res.status !== 200) return void 0;
+    const text = await res.text();
+    return parseMetrics(text);
+  } catch {
+    return void 0;
+  }
+}
+function parseMetrics(text) {
+  const requests = sumMetric(text, "cloudflared_tunnel_total_requests") || sumMetric(text, "cloudflared_tunnel_request_errors");
+  const durSum = sumMetric(text, "cloudflared_tunnel_request_duration_seconds_sum");
+  const durCount = sumMetric(text, "cloudflared_tunnel_request_duration_seconds_count");
+  const avgLatencyMs = durCount > 0 ? Math.round(durSum / durCount * 1e3) : void 0;
+  return {
+    connections: sumMetric(text, "cloudflared_tunnel_ha_connections"),
+    requests,
+    avgLatencyMs
+  };
+}
+function sumMetric(text, name) {
+  let total = 0;
+  for (const line of text.split("\n")) {
+    if (line.startsWith("#") || !line.startsWith(name)) continue;
+    const value = Number(line.trim().split(/\s+/).pop());
+    if (!Number.isNaN(value)) total += value;
+  }
+  return total;
+}
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+// src/process/logs.ts
+import pc from "picocolors";
+var LEVEL_RE = /level=(\w+)/;
+var MSG_RE = /msg="([^"]*)"|msg=(\S+)/;
+function parseLogLine(line) {
+  const trimmed = line.trim();
+  if (!trimmed) return void 0;
+  const level = trimmed.match(LEVEL_RE)?.[1] ?? "info";
+  const msgMatch = trimmed.match(MSG_RE);
+  const message = msgMatch?.[1] ?? msgMatch?.[2] ?? trimmed;
+  return { level, message };
+}
+function formatLogLine(line) {
+  const parsed = parseLogLine(line);
+  if (!parsed) return void 0;
+  if (/Registered tunnel connection|Unregistered tunnel connection/.test(parsed.message)) {
+    return void 0;
+  }
+  const tag = colorLevel(parsed.level);
+  return `${tag} ${parsed.message}`;
+}
+function colorLevel(level) {
+  switch (level.toLowerCase()) {
+    case "error":
+    case "fatal":
+      return pc.red("\u2716");
+    case "warn":
+      return pc.yellow("!");
+    case "debug":
+      return pc.dim("\xB7");
+    default:
+      return pc.dim("\u203A");
+  }
+}
+
+// src/commands/login.ts
+import { spawn as spawn3 } from "child_process";
+import { existsSync as existsSync8 } from "fs";
+
+// src/ui/prompts.ts
+async function clack() {
+  return import("@clack/prompts");
+}
+function ensure(value, p) {
+  if (p.isCancel(value)) throw new CfldError("Cancelled.");
+  return value;
+}
+async function askText(message, placeholder) {
+  const p = await clack();
+  const value = await p.text({ message, placeholder });
+  return ensure(value, p);
+}
+async function askSelect(message, options) {
+  const p = await clack();
+  const select = p.select;
+  const value = await select({ message, options });
+  return ensure(value, p);
+}
+async function askConfirm(message) {
+  const p = await clack();
+  const value = await p.confirm({ message });
+  return ensure(value, p);
+}
+
+// src/ui/output.ts
+import boxen from "boxen";
+import pc2 from "picocolors";
+function isInteractive() {
+  return Boolean(process.stdout.isTTY) && !process.env.CI;
+}
+function step(message) {
+  process.stderr.write(`${pc2.cyan("\u203A")} ${message}
+`);
+}
+function done(message) {
+  process.stderr.write(`${pc2.green("\u2714")} ${message}
+`);
+}
+function info(message) {
+  process.stderr.write(`  ${message}
+`);
+}
+function warn(message) {
+  process.stderr.write(`${pc2.yellow("!")} ${message}
+`);
+}
+function note(message) {
+  process.stderr.write(`${pc2.dim(message)}
+`);
+}
+function summaryBox(s) {
+  const footer = s.ephemeral ? `ephemeral \xB7 URL changes each run \xB7 run \`cfld\` for a persistent URL` : `URL preserved on Ctrl-C \xB7 re-run to resume \xB7 cfld destroy to remove`;
+  const lines = [
+    `${pc2.green("\u25CF LIVE")}   ${pc2.bold(pc2.cyan(s.url))}`,
+    `${pc2.dim("\u2192")} ${s.target}   ${pc2.dim(`${s.connections} edge conns`)}`,
+    ``,
+    pc2.dim(`tunnel: ${s.tunnelName}`),
+    pc2.dim(footer)
+  ];
+  process.stdout.write(
+    boxen(lines.join("\n"), {
+      padding: { top: 0, bottom: 0, left: 1, right: 1 },
+      borderColor: "cyan",
+      borderStyle: "round",
+      title: "cfld",
+      titleAlignment: "left"
+    }) + "\n"
+  );
+}
+function printError(err) {
+  if (err instanceof CfldError) {
+    process.stderr.write(`
+${pc2.red("\u2716")} ${err.message}
+`);
+    if (err.hint) process.stderr.write(`${pc2.dim("  " + err.hint)}
+`);
+  } else if (err instanceof Error) {
+    process.stderr.write(`
+${pc2.red("\u2716")} ${err.message}
+`);
+  } else {
+    process.stderr.write(`
+${pc2.red("\u2716")} ${String(err)}
+`);
+  }
+}
+
+// src/commands/login.ts
+function normalizeZone(input) {
+  return input.trim().toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "");
+}
+async function loginCommand(flags) {
+  const interactive = isInteractive();
+  const haveCert = certExists(defaultCertPath());
+  if (flags.reauth || !haveCert) {
+    await runLogin();
+  } else {
+    info("A Cloudflare certificate already exists. Use --reauth to authorize another domain.");
+  }
+  if (!certHasZone(defaultCertPath())) {
+    printZeroZoneGuidance();
+    throw new CfldError(
+      "Logged in, but your account has no domain to authorize.",
+      "Add a domain (see above), then run `cfld login --reauth`."
+    );
+  }
+  let zone = flags.zone ? normalizeZone(flags.zone) : void 0;
+  if (!zone) {
+    if (!interactive) {
+      throw new CfldError(
+        "Pass --zone to record which domain this cert is for.",
+        "e.g. `cfld login --zone example.com`"
+      );
+    }
+    zone = normalizeZone(await askText("Which domain did you authorize?", "example.com"));
+  }
+  importCert(zone);
+  done(`Saved cert for ${zone}. You're ready \u2014 run \`cfld\`.`);
+}
+async function runLogin() {
+  const bin = await resolveBinary();
+  step("Opening your browser to authorize with Cloudflare (no API token needed)\u2026");
+  note("  Pick the domain you want to use. Waiting for you to finish\u2026");
+  await new Promise((resolve, reject) => {
+    const child = spawn3(bin, ["tunnel", "login"], { stdio: "inherit" });
+    child.on("error", reject);
+    child.on("exit", (code) => {
+      if (code === 0 || existsSync8(defaultCertPath())) resolve();
+      else reject(new CfldError("Cloudflare login did not complete.", "Re-run `cfld login`."));
+    });
+  });
+  if (!existsSync8(defaultCertPath())) {
+    throw new CfldError(
+      "Login finished but no certificate was written.",
+      "Re-run `cfld login` and complete the browser step."
+    );
+  }
+}
+async function ensureCert(zone, opts = { interactive: true }) {
+  const existing = resolveCert(zone);
+  if (existing) return existing;
+  if (!opts.interactive) {
+    throw new CfldError(
+      `No Cloudflare certificate found for ${zone}.`,
+      "Run `cfld login` first (needs a browser), or set TUNNEL_ORIGIN_CERT."
+    );
+  }
+  await runLogin();
+  if (!certHasZone(defaultCertPath())) {
+    printZeroZoneGuidance();
+    throw new CfldError(
+      "Your Cloudflare account has no domain yet, so a persistent URL isn't possible.",
+      "Add a domain (see above), then re-run. Or use `cfld --quick` for a throwaway URL now."
+    );
+  }
+  const stored = importCert(zone);
+  info(`Saved cert for ${zone}.`);
+  return stored;
+}
+function printZeroZoneGuidance() {
+  warn("cfld can't create a permanent custom URL yet \u2014 your account has no domains.");
+  note(
+    [
+      "",
+      "  Option 1 \u2014 Add a domain you own (~5 min + DNS propagation)",
+      "    1. Own a domain at any registrar.",
+      "    2. Cloudflare dashboard \u2192 Add a Site \u2192 enter the domain.",
+      "    3. At your registrar, switch the nameservers to the ones Cloudflare shows.",
+      "       (we can't do this step for you \u2014 it's on the registrar)",
+      "    4. Wait for the zone to go Active, then: cfld login --reauth && cfld",
+      "       https://dash.cloudflare.com/?to=/:account/add-site",
+      "",
+      "  Option 2 \u2014 Buy through Cloudflare Registrar (nameservers auto-configured)",
+      "       https://dash.cloudflare.com/?to=/:account/domains/register",
+      "",
+      "  Option 3 \u2014 Just need a URL right now? (ephemeral, not persistent)",
+      "       cfld --quick",
+      ""
+    ].join("\n")
+  );
+}
+
+// src/util/gitignore.ts
+import { existsSync as existsSync9, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { join as join4 } from "path";
+function ensureGitignored(cwd, pattern) {
+  const gitignorePath = join4(cwd, ".gitignore");
+  const hasGitignore = existsSync9(gitignorePath);
+  const inRepo = hasGitignore || existsSync9(join4(cwd, ".git"));
+  if (!inRepo) return false;
+  const existing = hasGitignore ? readFileSync6(gitignorePath, "utf8") : "";
+  const present = existing.split("\n").map((l) => l.trim()).includes(pattern);
+  if (present) return false;
+  const body = existing.replace(/\n$/, "");
+  const next = body.length ? `${body}
+${pattern}
+` : `${pattern}
+`;
+  writeFileSync5(gitignorePath, next, "utf8");
+  return true;
+}
+
+// src/commands/run.ts
+async function runCommand(flags) {
+  const cwd = process.cwd();
+  const interactive = isInteractive();
+  const config = readProjectConfig(cwd);
+  const slug = deriveSlug(cwd, flags.name ?? config?.name);
+  const tunnelName = tunnelNameForSlug(slug);
+  const knownZones = Array.from(
+    /* @__PURE__ */ new Set([...listStoredZones(), ...listEntries().map((e) => e.zone)])
+  );
+  const zone = await resolveZone(flags, config?.zone, knownZones, interactive);
+  const envKey = flags.envKey ?? config?.envKey ?? "PUBLIC_URL";
+  let routes;
+  if (config?.routes?.length && !flags.host && !flags.port) {
+    routes = config.routes.map((r) => ({
+      hostname: r.host ?? buildHostname(r.name ? slugify(r.name) : slug, zone),
+      port: r.port,
+      path: r.path
+    }));
+  } else {
+    const port = await resolvePort(flags, config?.port, interactive);
+    const hostname = flags.host ?? config?.hostname ?? buildHostname(slug, zone);
+    routes = [{ hostname, port }];
+  }
+  const primary = routes[0];
+  const certPath = await ensureCert(zone, { interactive });
+  const result = await reconcile(
+    { slug, tunnelName, zone, certPath, routes, projectDir: cwd, force: flags.force },
+    {
+      onStep: (s) => step(s),
+      confirmOverwrite: interactive ? (h, t) => askConfirm(`${h} already points to ${t}. Repoint it to this tunnel?`) : void 0
+    }
+  );
+  done(result.created ? `Created tunnel ${tunnelName}` : `Reusing tunnel ${tunnelName}`);
+  for (const r of routes) done(`DNS ${r.hostname} \u2192 :${r.port}`);
+  writeProjectConfig(cwd, {
+    name: slug,
+    zone,
+    uuid: result.uuid,
+    hostname: primary.hostname,
+    port: primary.port,
+    envKey
+  });
+  if (ensureGitignored(cwd, ".cfld.json")) info("Added .cfld.json to .gitignore.");
+  await launch(result, { cwd, envKey, noEnv: flags.noEnv, port: primary.port });
+}
+async function launch(result, ctx) {
+  const metricsPort = await findFreePort();
+  const url = `https://${result.hostname}`;
+  const target = `localhost:${ctx.port}`;
+  const interactive = isInteractive();
+  let dashboard;
+  if (interactive) {
+    const { startDashboard } = await import("./dashboard-QUPY25QT.js");
+    dashboard = startDashboard({
+      url,
+      target,
+      tunnelName: result.tunnelName,
+      status: "connecting",
+      connections: 0,
+      requests: 0,
+      logs: []
+    });
+  } else {
+    step("Connecting to Cloudflare edge\u2026");
+  }
+  const emitLine = (line) => {
+    const formatted = formatLogLine(line);
+    if (!formatted) return;
+    if (dashboard) dashboard.log(formatted);
+    else process.stderr.write(formatted + "\n");
+  };
+  let stopping = false;
+  const runner = await startRunner({
+    configPath: result.configPath,
+    tunnelName: result.tunnelName,
+    certPath: result.certPath,
+    metricsPort,
+    onLine: (line) => emitLine(line),
+    onStatus: (status) => {
+      if (status === "reconnecting") dashboard?.update({ status: "reconnecting" });
+      else if (status === "connecting" && !dashboard) note("Reconnecting\u2026");
+    },
+    onFatal: (message) => {
+      dashboard?.stop();
+      warn(message);
+      process.exit(1);
+    }
+  });
+  const stop = (reason) => {
+    if (stopping) return;
+    stopping = true;
+    runner.stop();
+    dashboard?.stop();
+    note(`
+${reason}`);
+    setTimeout(() => process.exit(0), 100).unref();
+  };
+  if (!dashboard) {
+    process.once("SIGINT", () => stop("Stopping \u2014 your URL is preserved. Re-run `cfld`."));
+    process.once("SIGTERM", () => stop("Stopping \u2014 your URL is preserved."));
+  }
+  const ready = await waitForReady(metricsPort).catch((err) => {
+    runner.stop();
+    dashboard?.stop();
+    throw new CfldError(
+      "The tunnel did not connect.",
+      err instanceof Error ? err.message : void 0
+    );
+  });
+  if (!ctx.noEnv) {
+    const { changed } = upsertEnv(join5(ctx.cwd, ".env"), ctx.envKey, url);
+    if (changed && !dashboard) info(`Wrote ${ctx.envKey}=${url} to .env`);
+  }
+  if (dashboard) {
+    dashboard.update({ status: "live", connections: ready.connections });
+  } else {
+    summaryBox({ url, target, tunnelName: result.tunnelName, connections: ready.connections });
+  }
+  const poll = setInterval(async () => {
+    const m = await scrapeMetrics(metricsPort);
+    if (m && dashboard) {
+      dashboard.update({
+        connections: m.connections || ready.connections,
+        requests: m.requests,
+        avgLatencyMs: m.avgLatencyMs
+      });
+    }
+  }, dashboard ? 1e3 : 15e3);
+  poll.unref();
+  if (dashboard) {
+    await dashboard.waitUntilExit();
+    clearInterval(poll);
+    stop("Stopping \u2014 your URL is preserved. Re-run `cfld` to resume.");
+  }
+}
+async function resolveZone(flags, configZone, knownZones, interactive) {
+  const fromHost = flags.host ? zoneForHostname(flags.host, knownZones) : void 0;
+  const zone = flags.zone ?? fromHost ?? configZone ?? (knownZones.length === 1 ? knownZones[0] : void 0);
+  if (zone) return zone;
+  if (!interactive) {
+    throw new CfldError(
+      "Could not determine which Cloudflare domain to use.",
+      "Pass --zone example.com (or --host app.example.com)."
+    );
+  }
+  const answer = await askText(
+    "Which domain on Cloudflare should cfld use?",
+    "example.com"
+  );
+  return answer.trim().replace(/^https?:\/\//, "").replace(/\/.*$/, "");
+}
+async function resolvePort(flags, configPort, interactive) {
+  if (flags.port) return flags.port;
+  if (configPort) return configPort;
+  const detected = await detectDevPorts();
+  if (detected.length === 1) {
+    info(`Detected a local server on port ${detected[0]}.`);
+    return detected[0];
+  }
+  if (detected.length > 1 && interactive) {
+    return askSelect(
+      "Multiple local servers detected \u2014 which port?",
+      detected.map((p) => ({ value: p, label: String(p) }))
+    );
+  }
+  if (interactive) {
+    const answer = await askText("Which local port is your dev server on?", "3000");
+    const n = Number(answer.trim());
+    if (!Number.isInteger(n) || n <= 0) {
+      throw new CfldError(`"${answer}" is not a valid port.`);
+    }
+    return n;
+  }
+  throw new CfldError(
+    "No local port specified and none could be detected.",
+    "Pass a port, e.g. `cfld 3000`."
+  );
+}
+
+// src/process/quick.ts
+import { spawn as spawn4 } from "child_process";
+var QUICK_URL_RE = /https:\/\/[a-z0-9-]+\.trycloudflare\.com/i;
+async function startQuickTunnel(port, opts = {}) {
+  const bin = await resolveBinary();
+  const args = ["tunnel", "--url", `http://localhost:${port}`, "--no-autoupdate"];
+  if (opts.metricsPort) args.push("--metrics", `127.0.0.1:${opts.metricsPort}`);
+  const child = spawn4(bin, args, { stdio: ["ignore", "pipe", "pipe"] });
+  return new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      child.kill("SIGKILL");
+      reject(new Error("Timed out waiting for a quick tunnel URL."));
+    }, opts.timeoutMs ?? 3e4);
+    timeout.unref();
+    let settled = false;
+    const stop = () => {
+      if (child.exitCode === null && !child.signalCode) child.kill("SIGINT");
+    };
+    const scan = (chunk) => {
+      for (const line of chunk.split("\n")) {
+        if (line.trim()) opts.onLine?.(line);
+      }
+      const match = chunk.match(QUICK_URL_RE);
+      if (match && !settled) {
+        settled = true;
+        clearTimeout(timeout);
+        resolve({ url: match[0], child, stop });
+      }
+    };
+    child.stdout?.setEncoding("utf8").on("data", scan);
+    child.stderr?.setEncoding("utf8").on("data", scan);
+    child.on("error", (err) => {
+      if (!settled) {
+        settled = true;
+        clearTimeout(timeout);
+        reject(err);
+      }
+    });
+    child.on("exit", (code) => {
+      if (!settled) {
+        settled = true;
+        clearTimeout(timeout);
+        reject(new Error(`cloudflared exited (code ${code}) before a URL appeared.`));
+      }
+    });
+  });
+}
+
+// src/commands/quick.ts
+async function quickCommand(flags) {
+  const port = await resolvePort2(flags);
+  const target = `localhost:${port}`;
+  const interactive = isInteractive();
+  const metricsPort = await findFreePort();
+  if (!interactive) step(`Starting an ephemeral tunnel to ${target}\u2026`);
+  let dashboard;
+  const logBuffer = [];
+  const emitLine = (line) => {
+    const formatted = formatLogLine(line);
+    if (!formatted) return;
+    logBuffer.push(formatted);
+    if (dashboard) dashboard.log(formatted);
+    else if (!interactive) process.stderr.write(formatted + "\n");
+  };
+  const tunnel = await startQuickTunnel(port, { metricsPort, onLine: emitLine });
+  if (interactive) {
+    const { startDashboard } = await import("./dashboard-QUPY25QT.js");
+    dashboard = startDashboard({
+      url: tunnel.url,
+      target,
+      tunnelName: "quick (ephemeral)",
+      status: "live",
+      connections: 1,
+      requests: 0,
+      logs: logBuffer.slice(-12),
+      ephemeral: true
+    });
+  } else {
+    summaryBox({
+      url: tunnel.url,
+      target,
+      tunnelName: "quick (ephemeral)",
+      connections: 1,
+      ephemeral: true
+    });
+  }
+  const poll = setInterval(async () => {
+    const m = await scrapeMetrics(metricsPort);
+    if (m && dashboard) {
+      dashboard.update({
+        connections: m.connections || 1,
+        requests: m.requests,
+        avgLatencyMs: m.avgLatencyMs
+      });
+    }
+  }, dashboard ? 1e3 : 15e3);
+  poll.unref();
+  const stop = () => {
+    clearInterval(poll);
+    tunnel.stop();
+    dashboard?.stop();
+    note("\nStopped ephemeral tunnel.");
+    setTimeout(() => process.exit(0), 100).unref();
+  };
+  if (dashboard) {
+    await dashboard.waitUntilExit();
+    stop();
+  } else {
+    process.once("SIGINT", stop);
+    process.once("SIGTERM", stop);
+  }
+}
+async function resolvePort2(flags) {
+  if (flags.port) return flags.port;
+  const detected = await detectDevPorts();
+  if (detected.length >= 1) {
+    info(`Detected a local server on port ${detected[0]}.`);
+    return detected[0];
+  }
+  throw new CfldError(
+    "No port specified and none detected.",
+    "Pass a port, e.g. `cfld --quick 3000`."
+  );
+}
+
+// src/commands/init.ts
+async function initCommand(flags) {
+  if (!isInteractive()) {
+    throw new CfldError(
+      "`cfld init` is interactive.",
+      "In scripts, run `cfld` directly with --zone/--host/--name flags."
+    );
+  }
+  const cwd = process.cwd();
+  const knownZones = Array.from(
+    /* @__PURE__ */ new Set([...listStoredZones(), ...listEntries().map((e) => e.zone)])
+  );
+  let zone;
+  if (knownZones.length) {
+    const picked = await askSelect("Which Cloudflare domain?", [
+      ...knownZones.map((z) => ({ value: z, label: z })),
+      { value: "__new__", label: "Use a different domain\u2026" }
+    ]);
+    zone = picked === "__new__" ? normalizeZone(await askText("Domain (zone) on Cloudflare?", "example.com")) : picked;
+  } else {
+    zone = normalizeZone(await askText("Domain (zone) on Cloudflare?", "example.com"));
+  }
+  const certPath = await ensureCert(zone, { interactive: true });
+  const defaultSlug = deriveSlug(cwd, flags.name);
+  const name = slugify(await askText("Project name (used in the URL)", defaultSlug) || defaultSlug);
+  const detected = await detectDevPorts();
+  const portStr = await askText(
+    "Local port your dev server runs on",
+    detected[0] ? String(detected[0]) : "3000"
+  );
+  const port = Number(portStr.trim());
+  if (!Number.isInteger(port) || port <= 0) {
+    throw new CfldError(`"${portStr}" is not a valid port.`);
+  }
+  const hostname = flags.host ?? buildHostname(name, zone);
+  const result = await reconcile(
+    {
+      slug: name,
+      tunnelName: tunnelNameForSlug(name),
+      zone,
+      certPath,
+      routes: [{ hostname, port }],
+      projectDir: cwd,
+      force: flags.force
+    },
+    {
+      onStep: (s) => step(s),
+      confirmOverwrite: (h, t) => askConfirm(`${h} already points to ${t}. Repoint it to this tunnel?`)
+    }
+  );
+  writeProjectConfig(cwd, {
+    name,
+    zone,
+    uuid: result.uuid,
+    hostname,
+    port,
+    envKey: flags.envKey ?? "PUBLIC_URL"
+  });
+  if (ensureGitignored(cwd, ".cfld.json")) info("Added .cfld.json to .gitignore.");
+  done(`Configured https://${hostname} \u2192 localhost:${port}`);
+  note("Run `cfld` to go live.");
+}
+
+// src/commands/list.ts
+import pc3 from "picocolors";
+async function listCommand() {
+  const entries = listEntries();
+  if (entries.length === 0) {
+    note("No tunnels registered yet. Run `cfld` in a project to create one.");
+    return;
+  }
+  const liveByZone = /* @__PURE__ */ new Map();
+  for (const zone of new Set(entries.map((e) => e.zone))) {
+    const cert = resolveCert(zone);
+    if (!cert) continue;
+    try {
+      const tunnels = await listTunnels(cert);
+      liveByZone.set(zone, new Set(tunnels.map((t) => t.id)));
+    } catch {
+    }
+  }
+  process.stdout.write(pc3.bold("\n  cfld tunnels\n\n"));
+  for (const e of entries) {
+    const live = liveByZone.get(e.zone);
+    const status = live === void 0 ? pc3.dim("?") : live.has(e.uuid) ? pc3.green("\u25CF") : pc3.red("\u2716 missing");
+    process.stdout.write(
+      `  ${status}  ${pc3.cyan(`https://${e.hostname}`)}  ${pc3.dim(
+        `\u2192 :${e.port}`
+      )}  ${pc3.dim(e.projectDir)}
+`
+    );
+  }
+  process.stdout.write("\n");
+  info(pc3.dim("\u25CF live \xB7 \u2716 deleted remotely (re-run to recreate) \xB7 ? unknown"));
+}
+
+// src/commands/status.ts
+import pc4 from "picocolors";
+async function statusCommand(name) {
+  const entry = name ? getEntry(name) ?? getEntry(`cfld-${name}`) : resolveCurrentEntry();
+  if (!entry) {
+    if (name) {
+      throw new CfldError(
+        `No registered tunnel named "${name}".`,
+        "Run `cfld list` to see all tunnels."
+      );
+    }
+    note("No cfld tunnel configured in this directory. Run `cfld` to set one up.");
+    return;
+  }
+  const cert = resolveCert(entry.zone);
+  let liveState = pc4.dim("unknown (no cert)");
+  if (cert) {
+    try {
+      const found = await findTunnel(entry.name, cert);
+      liveState = found ? pc4.green("exists") : pc4.red("deleted remotely");
+    } catch {
+      liveState = pc4.dim("unreachable");
+    }
+  }
+  const rows = [
+    ["URL", pc4.cyan(`https://${entry.hostname}`)],
+    ["Local target", `localhost:${entry.port}`],
+    ["Tunnel", `${entry.name} (${entry.uuid})`],
+    ["Zone", entry.zone],
+    ["Cert", cert ?? pc4.red("missing")],
+    ["Remote state", liveState],
+    ["Project", entry.projectDir],
+    ["Last run", entry.lastRun ?? "never"]
+  ];
+  process.stdout.write("\n");
+  for (const [k, v] of rows) {
+    process.stdout.write(`  ${pc4.dim(k.padEnd(14))} ${v}
+`);
+  }
+  process.stdout.write("\n");
+}
+function resolveCurrentEntry() {
+  const config = readProjectConfig(process.cwd());
+  if (config?.name) {
+    const entry = getEntry(`cfld-${config.name}`);
+    if (entry) return entry;
+  }
+  return listEntries().find((e) => e.projectDir === process.cwd());
+}
+
+// src/commands/up.ts
+async function upCommand(name) {
+  const entry = getEntry(name) ?? getEntry(`cfld-${name}`);
+  if (!entry) {
+    throw new CfldError(
+      `No registered tunnel named "${name}".`,
+      "Run `cfld list` to see available tunnels."
+    );
+  }
+  const cert = resolveCert(entry.zone);
+  if (!cert) {
+    throw new CfldError(
+      `No certificate available for zone ${entry.zone}.`,
+      "Run `cfld login` to authorize it."
+    );
+  }
+  const slug = entry.name.replace(/^cfld-/, "");
+  const routes = entry.routes?.length ? entry.routes : [{ hostname: entry.hostname, port: entry.port }];
+  const result = await reconcile(
+    {
+      slug,
+      tunnelName: entry.name,
+      zone: entry.zone,
+      certPath: cert,
+      routes,
+      projectDir: entry.projectDir
+    },
+    { onStep: (s) => step(s) }
+  );
+  done(result.created ? `Created tunnel ${entry.name}` : `Reusing tunnel ${entry.name}`);
+  await launch(result, {
+    cwd: entry.projectDir,
+    envKey: "PUBLIC_URL",
+    noEnv: true,
+    // don't touch a .env we may not be sitting in
+    port: entry.port
+  });
+}
+
+// src/commands/destroy.ts
+async function destroyCommand(name, force) {
+  const entry = name ? getEntry(name) ?? getEntry(`cfld-${name}`) : resolveCurrentEntry2();
+  if (!entry) {
+    throw new CfldError(
+      name ? `No registered tunnel named "${name}".` : "No cfld tunnel found here.",
+      "Run `cfld list` to see all tunnels."
+    );
+  }
+  if (!force) {
+    if (!isInteractive()) {
+      throw new CfldError(
+        "Refusing to destroy without confirmation in a non-interactive shell.",
+        "Re-run with --force to skip the prompt."
+      );
+    }
+    const ok = await askConfirm(
+      `Delete tunnel ${entry.name} (https://${entry.hostname})? This is permanent.`
+    );
+    if (!ok) {
+      note("Aborted.");
+      return;
+    }
+  }
+  const cert = resolveCert(entry.zone);
+  if (cert) {
+    await deleteTunnel(entry.name, cert);
+    done(`Deleted tunnel ${entry.name}`);
+  } else {
+    warn(`No cert for ${entry.zone}; skipped remote delete. Remove it in the dashboard.`);
+  }
+  removeEntry(entry.name);
+  done("Removed local registry entry");
+  warn(
+    `The DNS record ${entry.hostname} may still exist \u2014 remove it in the Cloudflare dashboard, or it will be repointed automatically next time you run cfld for this project.`
+  );
+}
+function resolveCurrentEntry2() {
+  const config = readProjectConfig(process.cwd());
+  if (config?.name) {
+    const entry = getEntry(`cfld-${config.name}`);
+    if (entry) return entry;
+  }
+  return listEntries().find((e) => e.projectDir === process.cwd());
+}
+
+// src/commands/service.ts
+import pc5 from "picocolors";
+
+// src/core/service.ts
+import { existsSync as existsSync10, mkdirSync as mkdirSync3, rmSync, writeFileSync as writeFileSync6 } from "fs";
+import { homedir as homedir2, platform } from "os";
+import { join as join6 } from "path";
+function serviceSlug(name) {
+  return name.replace(/^cfld-/, "");
+}
+function launchAgentLabel(name) {
+  return `com.cfld.${serviceSlug(name)}`;
+}
+function launchAgentPath(name) {
+  return join6(homedir2(), "Library", "LaunchAgents", `${launchAgentLabel(name)}.plist`);
+}
+function systemdUnitName(name) {
+  return `cfld-${serviceSlug(name)}.service`;
+}
+function systemdUnitPath(name) {
+  return join6(homedir2(), ".config", "systemd", "user", systemdUnitName(name));
+}
+function logDir() {
+  return join6(cfldDir(), "logs");
+}
+function renderLaunchAgent(spec) {
+  const args = [
+    spec.binPath,
+    "tunnel",
+    "--origincert",
+    spec.certPath,
+    "--config",
+    spec.configPath,
+    "run",
+    spec.name
+  ];
+  const argsXml = args.map((a) => `    <string>${escapeXml(a)}</string>`).join("\n");
+  const out = join6(logDir(), `${serviceSlug(spec.name)}.out.log`);
+  const err = join6(logDir(), `${serviceSlug(spec.name)}.err.log`);
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${launchAgentLabel(spec.name)}</string>
+  <key>ProgramArguments</key>
+  <array>
+${argsXml}
+  </array>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>TUNNEL_ORIGIN_CERT</key>
+    <string>${escapeXml(spec.certPath)}</string>
+  </dict>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${escapeXml(out)}</string>
+  <key>StandardErrorPath</key>
+  <string>${escapeXml(err)}</string>
+</dict>
+</plist>
+`;
+}
+function renderSystemdUnit(spec) {
+  const execStart = [
+    spec.binPath,
+    "tunnel",
+    "--origincert",
+    spec.certPath,
+    "--config",
+    spec.configPath,
+    "run",
+    spec.name
+  ].join(" ");
+  return `[Unit]
+Description=cfld tunnel ${spec.name}
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+Environment=TUNNEL_ORIGIN_CERT=${spec.certPath}
+ExecStart=${execStart}
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=default.target
+`;
+}
+function assertSupported() {
+  const p = platform();
+  if (p === "darwin" || p === "linux") return p;
+  throw new CfldError(
+    `Service install is not supported on ${p}.`,
+    "Run `cfld` in the foreground, or use a process manager of your choice."
+  );
+}
+async function installService(spec) {
+  const p = assertSupported();
+  mkdirSync3(logDir(), { recursive: true });
+  if (p === "darwin") {
+    const path = launchAgentPath(spec.name);
+    mkdirSync3(join6(homedir2(), "Library", "LaunchAgents"), { recursive: true });
+    writeFileSync6(path, renderLaunchAgent(spec), "utf8");
+    await exec("launchctl", ["unload", path]);
+    const res = await exec("launchctl", ["load", "-w", path]);
+    if (res.code !== 0) {
+      throw new CfldError(
+        "Failed to load the LaunchAgent.",
+        res.stderr.trim() || void 0
+      );
+    }
+  } else {
+    const path = systemdUnitPath(spec.name);
+    mkdirSync3(join6(homedir2(), ".config", "systemd", "user"), { recursive: true });
+    writeFileSync6(path, renderSystemdUnit(spec), "utf8");
+    await exec("systemctl", ["--user", "daemon-reload"]);
+    const res = await exec("systemctl", [
+      "--user",
+      "enable",
+      "--now",
+      systemdUnitName(spec.name)
+    ]);
+    if (res.code !== 0) {
+      throw new CfldError(
+        "Failed to enable the systemd user service.",
+        res.stderr.trim() || "You may need `loginctl enable-linger $USER` so it runs without an active login."
+      );
+    }
+  }
+}
+async function uninstallService(name) {
+  const p = assertSupported();
+  if (p === "darwin") {
+    const path = launchAgentPath(name);
+    if (existsSync10(path)) {
+      await exec("launchctl", ["unload", "-w", path]);
+      rmSync(path, { force: true });
+    }
+  } else {
+    const unit = systemdUnitName(name);
+    await exec("systemctl", ["--user", "disable", "--now", unit]);
+    const path = systemdUnitPath(name);
+    if (existsSync10(path)) rmSync(path, { force: true });
+    await exec("systemctl", ["--user", "daemon-reload"]);
+  }
+}
+async function serviceControl(name, action) {
+  const p = assertSupported();
+  if (p === "darwin") {
+    await exec("launchctl", [action, launchAgentLabel(name)]);
+  } else {
+    await exec("systemctl", ["--user", action, systemdUnitName(name)]);
+  }
+}
+async function serviceState(name) {
+  const p = assertSupported();
+  if (p === "darwin") {
+    if (!existsSync10(launchAgentPath(name))) return "not-installed";
+    const res = await exec("launchctl", ["list", launchAgentLabel(name)]);
+    if (res.code !== 0) return "installed";
+    return /"PID"\s*=\s*\d+/.test(res.stdout) ? "running" : "installed";
+  } else {
+    if (!existsSync10(systemdUnitPath(name))) return "not-installed";
+    const res = await exec("systemctl", ["--user", "is-active", systemdUnitName(name)]);
+    return res.stdout.trim() === "active" ? "running" : "installed";
+  }
+}
+async function buildSpec(name, certPath, configPath) {
+  return { name, certPath, configPath, binPath: await resolveBinaryAbsolute() };
+}
+function escapeXml(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+
+// src/commands/resolve-entry.ts
+function resolveEntry(name) {
+  if (name) return getEntry(name) ?? getEntry(`cfld-${name}`);
+  const config = readProjectConfig(process.cwd());
+  if (config?.name) {
+    const entry = getEntry(`cfld-${config.name}`);
+    if (entry) return entry;
+  }
+  return listEntries().find((e) => e.projectDir === process.cwd());
+}
+
+// src/commands/service.ts
+var ACTIONS = ["install", "uninstall", "start", "stop", "status"];
+async function serviceCommand(action, name) {
+  if (!action || !ACTIONS.includes(action)) {
+    throw new CfldError(
+      `Usage: cfld service <${ACTIONS.join("|")}> [name]`
+    );
+  }
+  const entry = resolveEntry(name);
+  if (!entry) {
+    throw new CfldError(
+      name ? `No registered tunnel named "${name}".` : "No cfld tunnel found here.",
+      "Run `cfld` or `cfld init` for this project first, then install the service."
+    );
+  }
+  const slug = serviceSlug(entry.name);
+  switch (action) {
+    case "install": {
+      writeIngressConfig({
+        slug,
+        uuid: entry.uuid,
+        routes: entry.routes?.length ? entry.routes : [{ hostname: entry.hostname, port: entry.port }]
+      });
+      const spec = await buildSpec(entry.name, entry.certPath, ingressConfigPath(slug));
+      await installService(spec);
+      done(`Installed always-on service for ${entry.name}.`);
+      note(
+        `https://${entry.hostname} now stays up across logout/reboot. Check with \`cfld service status\`, remove with \`cfld service uninstall\`.`
+      );
+      return;
+    }
+    case "uninstall":
+      await uninstallService(entry.name);
+      done(`Removed service for ${entry.name}. (Tunnel + DNS are preserved.)`);
+      return;
+    case "start":
+      await serviceControl(entry.name, "start");
+      done(`Started ${entry.name}.`);
+      return;
+    case "stop":
+      await serviceControl(entry.name, "stop");
+      done(`Stopped ${entry.name}. (Tunnel + DNS are preserved.)`);
+      return;
+    case "status": {
+      const state = await serviceState(entry.name);
+      const label = state === "running" ? pc5.green("\u25CF running") : state === "installed" ? pc5.yellow("\u25CC installed (stopped)") : pc5.dim("\xB7 not installed");
+      info(`${entry.name}  ${label}  ${pc5.dim(`https://${entry.hostname}`)}`);
+      return;
+    }
+  }
+}
+
+// src/commands/doctor.ts
+import pc6 from "picocolors";
+async function doctorCommand() {
+  const ok = pc6.green("\u2714");
+  const bad = pc6.red("\u2716");
+  const out = (s) => process.stdout.write(s + "\n");
+  out(pc6.bold("\n  cfld doctor\n"));
+  try {
+    const bin = await resolveBinary();
+    const res = await exec(bin, ["--version"]);
+    out(`  ${ok} cloudflared: ${res.stdout.trim() || bin}`);
+  } catch {
+    out(`  ${bad} cloudflared not found (install with \`brew install cloudflared\`)`);
+  }
+  const defCert = defaultCertPath();
+  if (certExists(defCert)) {
+    out(
+      `  ${ok} default cert: ${defCert} ${certHasZone(defCert) ? pc6.dim("(zone-scoped)") : pc6.yellow("(no zone!)")}`
+    );
+  } else {
+    out(`  ${pc6.dim("\xB7")} no default cert (run \`cfld login\`)`);
+  }
+  const zones = listStoredZones();
+  if (zones.length) out(`  ${ok} cert store: ${zones.join(", ")}`);
+  else out(`  ${pc6.dim("\xB7")} cert store empty`);
+  const entries = listEntries();
+  out(`  ${ok} registry: ${entries.length} tunnel(s)`);
+  out("");
+}
+
+// src/cli.ts
+var SUBCOMMANDS = /* @__PURE__ */ new Set([
+  "login",
+  "init",
+  "list",
+  "status",
+  "up",
+  "destroy",
+  "service",
+  "doctor",
+  "help"
+]);
+var HELP = `${pc7.bold("cfld")} \u2014 persistent Cloudflare tunnels for local dev
+
+${pc7.bold("Usage")}
+  cfld [port]              Ensure + run a persistent tunnel (reuses the same URL)
+  cfld --quick [port]      Ephemeral trycloudflare.com URL (no domain needed)
+  cfld login [--reauth]    Authorize with Cloudflare in your browser
+  cfld init                Interactive setup wizard (configure, don't run)
+  cfld list                List all tunnels across projects/domains
+  cfld status [name]       Show details for a tunnel
+  cfld up <name>           Run a registered tunnel by name from anywhere
+  cfld destroy [name]      Delete a tunnel (explicit, opt-in)
+  cfld service <action>    Always-on background service (install/uninstall/start/stop/status)
+  cfld doctor              Diagnose your setup
+
+${pc7.bold("Options")}
+  --name <slug>     Override the project name (default: package.json name / dir)
+  --host <fqdn>     Explicit public hostname (e.g. api.example.com)
+  --zone <domain>   Cloudflare domain to use (e.g. example.com)
+  --env <KEY>       .env key to write the URL to (default: PUBLIC_URL)
+  --no-env          Don't write the URL to .env
+  --force           Skip confirmation (destroy)
+  -h, --help        Show this help
+  -v, --version     Show version
+`;
+async function main(argv) {
+  const { values, positionals } = parseArgs({
+    args: argv,
+    allowPositionals: true,
+    options: {
+      name: { type: "string" },
+      host: { type: "string" },
+      zone: { type: "string" },
+      env: { type: "string" },
+      "no-env": { type: "boolean" },
+      quick: { type: "boolean" },
+      force: { type: "boolean" },
+      reauth: { type: "boolean" },
+      help: { type: "boolean", short: "h" },
+      version: { type: "boolean", short: "v" }
+    }
+  });
+  if (values.version) {
+    process.stdout.write("cfld 0.1.0\n");
+    return;
+  }
+  if (values.help) {
+    process.stdout.write(HELP);
+    return;
+  }
+  const flags = {
+    name: values.name,
+    host: values.host,
+    zone: values.zone,
+    envKey: values.env,
+    noEnv: values["no-env"],
+    quick: values.quick,
+    force: values.force,
+    reauth: values.reauth
+  };
+  const [first, ...rest] = positionals;
+  if (first && SUBCOMMANDS.has(first)) {
+    switch (first) {
+      case "help":
+        process.stdout.write(HELP);
+        return;
+      case "login":
+        await loginCommand(flags);
+        return;
+      case "init":
+        await initCommand(flags);
+        return;
+      case "list":
+        await listCommand();
+        return;
+      case "status":
+        await statusCommand(rest[0]);
+        return;
+      case "up":
+        if (!rest[0]) throw new Error("Usage: cfld up <name>");
+        await upCommand(rest[0]);
+        return;
+      case "destroy":
+        await destroyCommand(rest[0], Boolean(flags.force));
+        return;
+      case "service":
+        await serviceCommand(rest[0], rest[1]);
+        return;
+      case "doctor":
+        await doctorCommand();
+        return;
+    }
+  }
+  if (first !== void 0) {
+    const port = Number(first);
+    if (Number.isInteger(port) && port > 0) flags.port = port;
+    else throw new Error(`Unknown command "${first}". Try \`cfld --help\`.`);
+  }
+  if (flags.quick) {
+    await quickCommand(flags);
+  } else {
+    await runCommand(flags);
+  }
+}
+main(process.argv.slice(2)).catch((err) => {
+  printError(err);
+  process.exit(1);
+});