@cliftonc/cfld 0.2.5 → 0.2.7

package/dist/cli.js

@@ -3,15 +3,16 @@
 // src/cli.ts
 import { parseArgs } from "util";
 import { readFileSync as readFileSync7, realpathSync } from "fs";
-import { dirname, join as join7 } from "path";
+import { dirname as dirname2, join as join9 } from "path";
 import { fileURLToPath } from "url";
 import pc7 from "picocolors";
 
 // src/commands/run.ts
-import { join as join5 } from "path";
+import { join as join7 } from "path";
 
 // src/core/state-machine.ts
-import { existsSync as existsSync2 } from "fs";
+import { copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, renameSync, unlinkSync } from "fs";
+import { dirname, join as join2 } from "path";
 
 // src/util/paths.ts
 import { homedir } from "os";
@@ -229,7 +230,8 @@ function cfargoTunnelUuid(target) {
 import { writeFileSync } from "fs";
 function renderIngressConfig(cfg) {
   const rules = cfg.routes.flatMap((r) => {
-    const lines = [`  - hostname: ${r.hostname}`];
+    const host = r.hostname.startsWith("*") ? JSON.stringify(r.hostname) : r.hostname;
+    const lines = [`  - hostname: ${host}`];
     if (r.path) lines.push(`    path: ${r.path}`);
     lines.push(`    service: http://localhost:${r.port}`);
     return lines;
@@ -300,15 +302,17 @@ async function reconcile(input, events = {}) {
   let created = false;
   if (existing) {
     uuid = existing.id;
-    if (!existsSync2(credentialsPath(uuid))) {
-      step2("Refetching tunnel credentials");
-      await fetchToken(tunnelName, credentialsPath(uuid), certPath);
-    }
   } else {
     step2(`Creating tunnel ${tunnelName}`);
     uuid = await createTunnel(tunnelName, certPath);
     created = true;
   }
+  if (!existsSync2(credentialsPath(uuid))) {
+    if (!adoptCredentialsBesideCert(uuid, certPath)) {
+      step2("Refetching tunnel credentials");
+      await fetchToken(tunnelName, credentialsPath(uuid), certPath);
+    }
+  }
   const prior = getEntry(tunnelName);
   const owned = /* @__PURE__ */ new Set([
     prior?.hostname,
@@ -358,9 +362,22 @@ async function reconcile(input, events = {}) {
 function nowIso() {
   return (/* @__PURE__ */ new Date()).toISOString();
 }
+function adoptCredentialsBesideCert(uuid, certPath) {
+  const beside = join2(dirname(certPath), `${uuid}.json`);
+  const target = credentialsPath(uuid);
+  if (beside === target || !existsSync2(beside)) return false;
+  mkdirSync2(dirname(target), { recursive: true });
+  try {
+    renameSync(beside, target);
+  } catch {
+    copyFileSync(beside, target);
+    unlinkSync(beside);
+  }
+  return true;
+}
 
 // src/core/cert-store.ts
-import { copyFileSync, existsSync as existsSync4, mkdirSync as mkdirSync2, readdirSync } from "fs";
+import { copyFileSync as copyFileSync2, existsSync as existsSync4, mkdirSync as mkdirSync3, readdirSync } from "fs";
 
 // src/core/cert.ts
 import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
@@ -392,10 +409,28 @@ function certHasZone(certPath) {
   const token = readCertToken(certPath);
   return Boolean(token?.zoneID);
 }
+async function certZoneName(certPath) {
+  const token = readCertToken(certPath);
+  if (!token?.zoneID || !token.apiToken) return void 0;
+  try {
+    const res = await fetch(
+      `https://api.cloudflare.com/client/v4/zones/${token.zoneID}`,
+      {
+        headers: { Authorization: `Bearer ${token.apiToken}` },
+        signal: AbortSignal.timeout(5e3)
+      }
+    );
+    if (!res.ok) return void 0;
+    const body = await res.json();
+    return body.result?.name?.toLowerCase();
+  } catch {
+    return void 0;
+  }
+}
 
 // src/core/cert-store.ts
 function ensureStoreDir() {
-  mkdirSync2(certStoreDir(), { recursive: true });
+  mkdirSync3(certStoreDir(), { recursive: true });
 }
 function storedCertForZone(zone) {
   const p = certPathForZone(zone);
@@ -408,25 +443,36 @@ function listStoredZones() {
     return [];
   }
 }
+function storedZoneClaiming(certPath, except) {
+  const zoneID = readCertToken(certPath)?.zoneID;
+  if (!zoneID) return void 0;
+  return listStoredZones().find(
+    (z) => z !== except && readCertToken(certPathForZone(z))?.zoneID === zoneID
+  );
+}
 function resolveCert(zone) {
-  return storedCertForZone(zone) ?? (certExists(defaultCertPath()) ? defaultCertPath() : void 0);
+  const stored = storedCertForZone(zone);
+  if (stored) return stored;
+  const def = defaultCertPath();
+  if (!certExists(def) || storedZoneClaiming(def, zone)) return void 0;
+  return def;
 }
 function importCert(zone, fromPath = defaultCertPath()) {
   ensureStoreDir();
   const dest = certPathForZone(zone);
-  copyFileSync(fromPath, dest);
+  copyFileSync2(fromPath, dest);
   return dest;
 }
 
 // src/core/hostname.ts
 import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
-import { basename, join as join2 } from "path";
+import { basename, join as join3 } from "path";
 function slugify(input) {
   return input.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function deriveSlug(cwd, nameFlag) {
   if (nameFlag) return slugify(nameFlag);
-  const pkgPath = join2(cwd, "package.json");
+  const pkgPath = join3(cwd, "package.json");
   if (existsSync5(pkgPath)) {
     try {
       const pkg = JSON.parse(readFileSync3(pkgPath, "utf8"));
@@ -512,12 +558,12 @@ function findFreePort() {
 
 // src/core/project-config.ts
 import { existsSync as existsSync6, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 function dotConfigPath(cwd) {
-  return join3(cwd, PROJECT_CONFIG_FILE);
+  return join4(cwd, PROJECT_CONFIG_FILE);
 }
 function readAuthored(cwd) {
-  const pkgPath = join3(cwd, "package.json");
+  const pkgPath = join4(cwd, "package.json");
   if (!existsSync6(pkgPath)) return void 0;
   try {
     const pkg = JSON.parse(readFileSync4(pkgPath, "utf8"));
@@ -936,7 +982,8 @@ function colorLevel(level) {
 
 // src/commands/login.ts
 import { spawn as spawn4 } from "child_process";
-import { existsSync as existsSync8 } from "fs";
+import { copyFileSync as copyFileSync3, existsSync as existsSync8, mkdirSync as mkdirSync4, renameSync as renameSync2, rmSync } from "fs";
+import { join as join5 } from "path";
 
 // src/ui/prompts.ts
 async function clack() {
@@ -1031,23 +1078,73 @@ function normalizeZone(input) {
   return input.trim().toLowerCase().replace(/^https?:\/\//, "").replace(/\/.*$/, "");
 }
 async function loginCommand(flags) {
-  const interactive = isInteractive();
   const haveCert = certExists(defaultCertPath());
+  let certPath = defaultCertPath();
   if (flags.reauth || !haveCert) {
-    await runLogin();
+    certPath = await runLogin();
   } else {
     info("A Cloudflare certificate already exists. Use --reauth to authorize another domain.");
   }
-  if (!certHasZone(defaultCertPath())) {
-    printZeroZoneGuidance();
+  try {
+    if (!certHasZone(certPath)) {
+      printZeroZoneGuidance();
+      throw new CfldError(
+        "Logged in, but your account has no domain to authorize.",
+        "Add a domain (see above), then run `cfld login --reauth`."
+      );
+    }
+    const zone = await saveCert(flags.zone ? normalizeZone(flags.zone) : void 0, certPath);
+    done(`Saved cert for ${zone}. You're ready \u2014 run \`cfld\`.`);
+  } finally {
+    discardLoginCert(certPath);
+  }
+}
+async function runLogin() {
+  const bin = await resolveBinary();
+  const def = defaultCertPath();
+  const backup = existsSync8(def) ? `${def}.cfld-backup` : void 0;
+  if (backup) renameSync2(def, backup);
+  try {
+    step("Opening your browser to authorize with Cloudflare (no API token needed)\u2026");
+    note("  Pick the domain you want to use. Waiting for you to finish\u2026");
+    await new Promise((resolve, reject) => {
+      const child = spawn4(bin, ["tunnel", "login"], { stdio: "inherit" });
+      child.on("error", reject);
+      child.on("exit", (code) => {
+        if (code === 0 || existsSync8(def)) resolve();
+        else reject(new CfldError("Cloudflare login did not complete.", "Re-run `cfld login`."));
+      });
+    });
+    if (!existsSync8(def)) {
+      throw new CfldError(
+        "Login finished but no certificate was written.",
+        "Re-run `cfld login` and complete the browser step."
+      );
+    }
+    if (!backup) return def;
+    mkdirSync4(cfldDir(), { recursive: true });
+    const fresh = join5(cfldDir(), "login-cert.tmp");
+    copyFileSync3(def, fresh);
+    rmSync(def);
+    return fresh;
+  } finally {
+    if (backup) renameSync2(backup, def);
+  }
+}
+function discardLoginCert(certPath) {
+  if (certPath !== defaultCertPath()) rmSync(certPath, { force: true });
+}
+async function saveCert(expected, certPath) {
+  const actual = await certZoneName(certPath);
+  if (expected && actual && actual !== expected) {
     throw new CfldError(
-      "Logged in, but your account has no domain to authorize.",
-      "Add a domain (see above), then run `cfld login --reauth`."
+      `You authorized ${actual} in the browser, not ${expected}.`,
+      `Run \`cfld login --reauth --zone ${expected}\` and pick ${expected} this time.`
     );
   }
-  let zone = flags.zone ? normalizeZone(flags.zone) : void 0;
+  let zone = expected ?? actual;
   if (!zone) {
-    if (!interactive) {
+    if (!isInteractive()) {
       throw new CfldError(
         "Pass --zone to record which domain this cert is for.",
         "e.g. `cfld login --zone example.com`"
@@ -1055,48 +1152,57 @@ async function loginCommand(flags) {
     }
     zone = normalizeZone(await askText("Which domain did you authorize?", "example.com"));
   }
-  importCert(zone);
-  done(`Saved cert for ${zone}. You're ready \u2014 run \`cfld\`.`);
-}
-async function runLogin() {
-  const bin = await resolveBinary();
-  step("Opening your browser to authorize with Cloudflare (no API token needed)\u2026");
-  note("  Pick the domain you want to use. Waiting for you to finish\u2026");
-  await new Promise((resolve, reject) => {
-    const child = spawn4(bin, ["tunnel", "login"], { stdio: "inherit" });
-    child.on("error", reject);
-    child.on("exit", (code) => {
-      if (code === 0 || existsSync8(defaultCertPath())) resolve();
-      else reject(new CfldError("Cloudflare login did not complete.", "Re-run `cfld login`."));
-    });
-  });
-  if (!existsSync8(defaultCertPath())) {
+  const clash = storedZoneClaiming(certPath, zone);
+  if (clash && !actual) {
     throw new CfldError(
-      "Login finished but no certificate was written.",
-      "Re-run `cfld login` and complete the browser step."
+      `That cert is for the same domain as your saved ${clash} cert, not ${zone}.`,
+      `Run \`cfld login --reauth --zone ${zone}\` and pick ${zone} in the browser.`
     );
   }
+  importCert(zone, certPath);
+  return zone;
 }
 async function ensureCert(zone, opts = { interactive: true }) {
-  const existing = resolveCert(zone);
-  if (existing) return existing;
+  const usable = await usableCert(zone);
+  if (usable) return usable;
   if (!opts.interactive) {
     throw new CfldError(
       `No Cloudflare certificate found for ${zone}.`,
-      "Run `cfld login` first (needs a browser), or set TUNNEL_ORIGIN_CERT."
+      `Run \`cfld login --reauth --zone ${zone}\` first (needs a browser), or set TUNNEL_ORIGIN_CERT.`
     );
   }
-  await runLogin();
-  if (!certHasZone(defaultCertPath())) {
-    printZeroZoneGuidance();
-    throw new CfldError(
-      "Your Cloudflare account has no domain yet, so a persistent URL isn't possible.",
-      "Add a domain (see above), then re-run. Or use `cfld --quick` for a throwaway URL now."
-    );
+  info(`No certificate for ${zone} yet \u2014 authorize it in the browser.`);
+  const fresh = await runLogin();
+  try {
+    if (!certHasZone(fresh)) {
+      printZeroZoneGuidance();
+      throw new CfldError(
+        "Your Cloudflare account has no domain yet, so a persistent URL isn't possible.",
+        "Add a domain (see above), then re-run. Or use `cfld --quick` for a throwaway URL now."
+      );
+    }
+    await saveCert(zone, fresh);
+  } finally {
+    discardLoginCert(fresh);
   }
-  const stored = importCert(zone);
   info(`Saved cert for ${zone}.`);
-  return stored;
+  return certPathForZone(zone);
+}
+async function usableCert(zone) {
+  const stored = storedCertForZone(zone);
+  if (stored) {
+    if (!storedZoneClaiming(stored, zone)) return stored;
+    const actual2 = await certZoneName(stored);
+    if (!actual2 || actual2 === zone) return stored;
+    warn(`The saved cert for ${zone} is actually for ${actual2} \u2014 discarding it.`);
+    rmSync(stored);
+  }
+  const def = defaultCertPath();
+  if (!certHasZone(def)) return void 0;
+  const actual = await certZoneName(def);
+  if (actual === zone) return importCert(zone, def);
+  if (!actual && !storedZoneClaiming(def, zone)) return def;
+  return void 0;
 }
 function printZeroZoneGuidance() {
   warn("cfld can't create a permanent custom URL yet \u2014 your account has no domains.");
@@ -1123,11 +1229,11 @@ function printZeroZoneGuidance() {
 
 // src/util/gitignore.ts
 import { existsSync as existsSync9, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
-import { join as join4 } from "path";
+import { join as join6 } from "path";
 function ensureGitignored(cwd, pattern) {
-  const gitignorePath = join4(cwd, ".gitignore");
+  const gitignorePath = join6(cwd, ".gitignore");
   const hasGitignore = existsSync9(gitignorePath);
-  const inRepo = hasGitignore || existsSync9(join4(cwd, ".git"));
+  const inRepo = hasGitignore || existsSync9(join6(cwd, ".git"));
   if (!inRepo) return false;
   const existing = hasGitignore ? readFileSync6(gitignorePath, "utf8") : "";
   const present = existing.split("\n").map((l) => l.trim()).includes(pattern);
@@ -1309,7 +1415,7 @@ ${opts.reason}`);
   );
   process.once("SIGHUP", () => shutdown({ reason: "Terminal closed \u2014 stopping." }));
   if (interactive) {
-    const { startDashboard } = await import("./dashboard-ZJVAPOTE.js");
+    const { startDashboard } = await import("./dashboard-Z4AN7H5V.js");
     dashboard = startDashboard(
       {
         url,
@@ -1376,7 +1482,7 @@ ${opts.reason}`);
     if (!up) warn(`Nothing is listening on :${ctx.port} yet \u2014 going live anyway.`);
   }
   if (!ctx.noEnv) {
-    const { changed } = upsertEnv(join5(ctx.cwd, ".env"), ctx.envKey, url);
+    const { changed } = upsertEnv(join7(ctx.cwd, ".env"), ctx.envKey, url);
     if (changed && !dashboard) info(`Wrote ${ctx.envKey}=${url} to .env`);
   }
   if (dashboard) {
@@ -1553,7 +1659,7 @@ ${opts.reason ?? "Stopped ephemeral tunnel."}`);
     });
   }
   if (interactive) {
-    const { startDashboard } = await import("./dashboard-ZJVAPOTE.js");
+    const { startDashboard } = await import("./dashboard-Z4AN7H5V.js");
     dashboard = startDashboard({
       url,
       target,
@@ -1753,20 +1859,26 @@ async function setupCommand(flags) {
     );
     return;
   }
-  await runLogin();
-  if (!certHasZone(defaultCertPath())) {
-    printZeroZoneGuidance();
-    if (await askConfirm("Start a temporary quick tunnel now instead?")) {
-      await quickCommand(flags);
-      return;
+  const fresh = await runLogin();
+  let zone;
+  try {
+    if (!certHasZone(fresh)) {
+      printZeroZoneGuidance();
+      if (await askConfirm("Start a temporary quick tunnel now instead?")) {
+        await quickCommand(flags);
+        return;
+      }
+      throw new CfldError(
+        "Your Cloudflare account has no domain yet, so a persistent URL isn't possible.",
+        "Add a domain (see above), then run `cfld setup` again."
+      );
     }
-    throw new CfldError(
-      "Your Cloudflare account has no domain yet, so a persistent URL isn't possible.",
-      "Add a domain (see above), then run `cfld setup` again."
-    );
+    const detected = await certZoneName(fresh);
+    zone = await saveCert(detected ?? await askAuthorizedZone(knownZones), fresh);
+  } finally {
+    discardLoginCert(fresh);
   }
-  const zone = await askAuthorizedZone(knownZones);
-  const certPath = importCert(zone);
+  const certPath = certPathForZone(zone);
   info(`Saved cert for ${zone}.`);
   await configureProject(flags, { zone, certPath, cwd });
   await offerGoLive(flags, zone);
@@ -1997,9 +2109,9 @@ function resolveCurrentEntry2() {
 import pc5 from "picocolors";
 
 // src/core/service.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync3, rmSync, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync5, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
 import { homedir as homedir2, platform } from "os";
-import { join as join6 } from "path";
+import { join as join8 } from "path";
 function serviceSlug(name) {
   return name.replace(/^cfld-/, "");
 }
@@ -2007,16 +2119,16 @@ function launchAgentLabel(name) {
   return `com.cfld.${serviceSlug(name)}`;
 }
 function launchAgentPath(name) {
-  return join6(homedir2(), "Library", "LaunchAgents", `${launchAgentLabel(name)}.plist`);
+  return join8(homedir2(), "Library", "LaunchAgents", `${launchAgentLabel(name)}.plist`);
 }
 function systemdUnitName(name) {
   return `cfld-${serviceSlug(name)}.service`;
 }
 function systemdUnitPath(name) {
-  return join6(homedir2(), ".config", "systemd", "user", systemdUnitName(name));
+  return join8(homedir2(), ".config", "systemd", "user", systemdUnitName(name));
 }
 function logDir() {
-  return join6(cfldDir(), "logs");
+  return join8(cfldDir(), "logs");
 }
 function renderLaunchAgent(spec) {
   const args = [
@@ -2030,8 +2142,8 @@ function renderLaunchAgent(spec) {
     spec.name
   ];
   const argsXml = args.map((a) => `    <string>${escapeXml(a)}</string>`).join("\n");
-  const out = join6(logDir(), `${serviceSlug(spec.name)}.out.log`);
-  const err = join6(logDir(), `${serviceSlug(spec.name)}.err.log`);
+  const out = join8(logDir(), `${serviceSlug(spec.name)}.out.log`);
+  const err = join8(logDir(), `${serviceSlug(spec.name)}.err.log`);
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -2096,10 +2208,10 @@ function assertSupported() {
 }
 async function installService(spec) {
   const p = assertSupported();
-  mkdirSync3(logDir(), { recursive: true });
+  mkdirSync5(logDir(), { recursive: true });
   if (p === "darwin") {
     const path = launchAgentPath(spec.name);
-    mkdirSync3(join6(homedir2(), "Library", "LaunchAgents"), { recursive: true });
+    mkdirSync5(join8(homedir2(), "Library", "LaunchAgents"), { recursive: true });
     writeFileSync6(path, renderLaunchAgent(spec), "utf8");
     await exec("launchctl", ["unload", path]);
     const res = await exec("launchctl", ["load", "-w", path]);
@@ -2111,7 +2223,7 @@ async function installService(spec) {
     }
   } else {
     const path = systemdUnitPath(spec.name);
-    mkdirSync3(join6(homedir2(), ".config", "systemd", "user"), { recursive: true });
+    mkdirSync5(join8(homedir2(), ".config", "systemd", "user"), { recursive: true });
     writeFileSync6(path, renderSystemdUnit(spec), "utf8");
     await exec("systemctl", ["--user", "daemon-reload"]);
     const res = await exec("systemctl", [
@@ -2134,13 +2246,13 @@ async function uninstallService(name) {
     const path = launchAgentPath(name);
     if (existsSync10(path)) {
       await exec("launchctl", ["unload", "-w", path]);
-      rmSync(path, { force: true });
+      rmSync2(path, { force: true });
     }
   } else {
     const unit = systemdUnitName(name);
     await exec("systemctl", ["--user", "disable", "--now", unit]);
     const path = systemdUnitPath(name);
-    if (existsSync10(path)) rmSync(path, { force: true });
+    if (existsSync10(path)) rmSync2(path, { force: true });
     await exec("systemctl", ["--user", "daemon-reload"]);
   }
 }
@@ -2260,6 +2372,14 @@ async function doctorCommand() {
   const zones = listStoredZones();
   if (zones.length) out(`  ${ok} cert store: ${zones.join(", ")}`);
   else out(`  ${pc6.dim("\xB7")} cert store empty`);
+  for (const zone of zones) {
+    const actual = await certZoneName(certPathForZone(zone));
+    if (actual && actual !== zone) {
+      out(
+        `  ${bad} ${zone}.pem is really a cert for ${actual} \u2014 fix with \`cfld login --reauth --zone ${zone}\``
+      );
+    }
+  }
   const entries = listEntries();
   out(`  ${ok} registry: ${entries.length} tunnel(s)`);
   out("");
@@ -2268,8 +2388,8 @@ async function doctorCommand() {
 // src/cli.ts
 function readVersion() {
   try {
-    const here = dirname(fileURLToPath(import.meta.url));
-    const pkg = JSON.parse(readFileSync7(join7(here, "../package.json"), "utf8"));
+    const here = dirname2(fileURLToPath(import.meta.url));
+    const pkg = JSON.parse(readFileSync7(join9(here, "../package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : "0.0.0";
   } catch {
     return "0.0.0";

package/dist/{dashboard-ZJVAPOTE.js → dashboard-Z4AN7H5V.js}

@@ -94,7 +94,12 @@ function LogColumn({
       borderLeft: Boolean(divider),
       children: [
         title ? /* @__PURE__ */ jsx(Text, { color: titleColor, bold: true, wrap: "truncate-end", children: title }) : null,
-        /* @__PURE__ */ jsx(Box, { flexDirection: "column", flexGrow: 1, justifyContent: "flex-end", overflow: "hidden", children: lines.length === 0 ? /* @__PURE__ */ jsx(Text, { dimColor: true, children: placeholder }) : lines.slice(-rows).map((line, i) => /* @__PURE__ */ jsx(Text, { wrap: "truncate-end", children: line }, i)) })
+        /* @__PURE__ */ jsx(Box, { flexDirection: "column", flexGrow: 1, justifyContent: "flex-end", overflow: "hidden", children: lines.length === 0 ? /* @__PURE__ */ jsx(Text, { dimColor: true, children: placeholder }) : (
+          // Wrap rather than truncate so long lines (e.g. magic-link / OAuth
+          // URLs) stay fully visible and selectable instead of ending in "…".
+          // The bottom-pinned box clips older wrapped lines off the top.
+          lines.slice(-rows).map((line, i) => /* @__PURE__ */ jsx(Text, { wrap: "wrap", children: line }, i))
+        ) })
       ]
     }
   );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cliftonc/cfld",
-  "version": "0.2.5",
+  "version": "0.2.7",
   "description": "Zero-token, persistent Cloudflare tunnel CLI for local dev — same public HTTPS URL every run.",
   "type": "module",
   "bin": {