@iamken/cloudtunnel 0.1.0

package/dist/index.js

@@ -0,0 +1,1245 @@
+#!/usr/bin/env node
+import {
+  listZones,
+  resolveZone
+} from "./chunk-2TCFCMJS.js";
+import {
+  createCname,
+  deleteDnsRecord,
+  findCname,
+  isManagedDns
+} from "./chunk-YLTQB4F7.js";
+import {
+  CliError,
+  binDir,
+  cfPaginate,
+  cfRequest,
+  configFile,
+  ensureDirs,
+  getCredentials,
+  loadConfig,
+  logDir,
+  profilesFile,
+  registryFile,
+  reportError,
+  resolveCf,
+  saveConfig
+} from "./chunk-UPBVRXLF.js";
+
+// src/index.ts
+import { Command } from "commander";
+import { createRequire } from "module";
+import pc2 from "picocolors";
+
+// src/commands/login.ts
+import * as clack from "@clack/prompts";
+
+// src/ui/output.ts
+import pc from "picocolors";
+import Table from "cli-table3";
+import { cancel, intro, isCancel, note, outro, select, spinner } from "@clack/prompts";
+function redactToken(token) {
+  if (!token) return "";
+  const last4 = token.length > 4 ? token.slice(-4) : token;
+  return `\u2022\u2022\u2022\u2022${last4}`;
+}
+var say = {
+  info: (msg) => console.log(msg),
+  ok: (msg) => console.log(pc.green(`\u2713 ${msg}`)),
+  warn: (msg) => console.warn(pc.yellow(`! ${msg}`)),
+  dim: (msg) => console.log(pc.dim(msg)),
+  step: (msg) => console.log(pc.cyan(`\u2192 ${msg}`))
+};
+var dim = (s) => pc.dim(s);
+function formatRoute(host, target) {
+  return `${pc.green(pc.bold(`https://${host}`))}  ${pc.dim("\u2192")}  ${pc.cyan(target)}`;
+}
+function printTable(head, rows) {
+  const table = new Table({
+    head: head.map((h) => pc.bold(h)),
+    style: { head: [], border: [] }
+  });
+  for (const row of rows) table.push(row);
+  console.log(table.toString());
+}
+async function selectOne(message, items, label) {
+  const value = await select({
+    message,
+    options: items.map((item, i) => ({ value: String(i), label: label(item) }))
+  });
+  if (isCancel(value)) {
+    cancel("Cancelled.");
+    throw new CliError("Cancelled.", { exitCode: 130 });
+  }
+  return items[Number(value)];
+}
+
+// src/config/token-url.ts
+import { spawn } from "child_process";
+var REQUIRED_SCOPES = [
+  "Account \xB7 Cloudflare Tunnel \xB7 Edit",
+  "Account \xB7 Account Settings \xB7 Read",
+  "Zone \xB7 DNS \xB7 Edit",
+  "Zone \xB7 Zone \xB7 Read"
+];
+function tokenCreateUrl() {
+  return "https://dash.cloudflare.com/profile/api-tokens?name=cloudtunnel";
+}
+function openBrowser(url) {
+  const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+  const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+  try {
+    const child = spawn(cmd, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+  } catch {
+  }
+}
+
+// src/config/resolve-identity.ts
+var API_BASE = "https://api.cloudflare.com/client/v4";
+async function cfGet(path, token) {
+  let res;
+  try {
+    res = await fetch(`${API_BASE}${path}`, {
+      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" }
+    });
+  } catch {
+    throw new CliError("Could not reach the Cloudflare API (network error).");
+  }
+  if (res.status === 401) {
+    throw new CliError("Cloudflare rejected the token (invalid or expired).", {
+      hint: `mint a new token: ${tokenCreateUrl()}`
+    });
+  }
+  if (res.status === 403) {
+    throw new CliError(`Token is missing a required scope for ${path}.`, {
+      hint: `token needs: ${REQUIRED_SCOPES.join(", ")}`
+    });
+  }
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok || !body.success) {
+    throw new CliError(`Cloudflare API error (${res.status}) on ${path}.`);
+  }
+  return body.result ?? [];
+}
+function listAccounts(token) {
+  return cfGet("/accounts?per_page=50", token);
+}
+function listZones2(token) {
+  return cfGet("/zones?per_page=50", token);
+}
+
+// src/commands/login.ts
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8").trim();
+}
+async function acquireToken(opts) {
+  const envToken = process.env.CLOUDFLARE_API_TOKEN;
+  if (envToken) {
+    say.dim("Using token from CLOUDFLARE_API_TOKEN.");
+    return { token: envToken, fromEnv: true };
+  }
+  if (opts.tokenStdin) return { token: await readStdin(), fromEnv: false };
+  if (opts.token) {
+    say.warn("--token puts the token in your shell history \u2014 prefer --token-stdin or the prompt. Rotate it if this is a shared host.");
+    return { token: opts.token, fromEnv: false };
+  }
+  if (!process.stdin.isTTY) {
+    throw new CliError("No token provided and no interactive terminal.", {
+      hint: "pipe it: `printf %s $TOKEN | cloudtunnel login --token-stdin`"
+    });
+  }
+  clack.note(REQUIRED_SCOPES.map((s) => `\u2022 ${s}`).join("\n"), "Create a token with these scopes");
+  openBrowser(tokenCreateUrl());
+  say.dim(`(opened ${tokenCreateUrl()})`);
+  const token = await clack.password({ message: "Paste your Cloudflare API token", mask: "\u2022" });
+  if (clack.isCancel(token) || !token) {
+    clack.cancel("Cancelled.");
+    throw new CliError("Cancelled.", { exitCode: 130 });
+  }
+  return { token, fromEnv: false };
+}
+async function runLoginFlow(opts = {}) {
+  if (process.stdout.isTTY) clack.intro("cloudtunnel \xB7 connect to Cloudflare");
+  const { token, fromEnv } = await acquireToken(opts);
+  const spin = clack.spinner();
+  spin.start("Verifying token\u2026");
+  const [accounts, zones] = await Promise.all([listAccounts(token), listZones2(token)]).catch((err) => {
+    spin.stop("Token check failed");
+    throw err;
+  });
+  spin.stop("Token verified");
+  if (accounts.length === 0) throw new CliError("Token can't see any Cloudflare account.");
+  let account = opts.account ? accounts.find((a) => a.id === opts.account) : void 0;
+  if (opts.account && !account) throw new CliError(`Account ${opts.account} not visible to this token.`);
+  if (!account) {
+    account = accounts.length === 1 || !process.stdin.isTTY ? accounts[0] : await selectOne("Select an account", accounts, (a) => `${a.name} (${a.id})`);
+  }
+  let defaultZone = opts.zone;
+  if (!defaultZone) {
+    if (zones.length === 1) defaultZone = zones[0].name;
+    else if (zones.length > 1 && process.stdin.isTTY) {
+      defaultZone = (await selectOne("Select a default domain", zones, (z) => z.name)).name;
+    }
+  }
+  saveConfig({ apiToken: fromEnv ? void 0 : token, accountId: account.id, defaultZone });
+  const summary = `Logged in as ${account.name}${defaultZone ? ` \xB7 default domain ${defaultZone}` : ""}`;
+  if (process.stdout.isTTY) clack.outro(summary);
+  else say.ok(summary);
+  if (!defaultZone) say.dim("No default domain set \u2014 pass -d <domain> on `up`, or re-run `login --zone <domain>`.");
+}
+function showStatus() {
+  const config = loadConfig();
+  const token = process.env.CLOUDFLARE_API_TOKEN ?? config.apiToken;
+  if (!token) {
+    say.warn("Not logged in. Run `cloudtunnel login`.");
+    return;
+  }
+  const source = process.env.CLOUDFLARE_API_TOKEN ? "env" : "config";
+  say.info(`Token:   ${redactToken(token)} (${source})`);
+  say.info(`Account: ${config.accountId ?? "(from env / unresolved)"}`);
+  say.info(`Domain:  ${config.defaultZone ?? "(none)"}`);
+  say.dim(`Config:  ${configFile}`);
+}
+function registerLogin(program) {
+  program.command("login").description("Authenticate with Cloudflare (paste a token once; account + domain auto-resolved)").option("--token-stdin", "read the API token from stdin (scriptable, avoids shell history)").option("--token <token>", "[discouraged] token as an argument (leaks into shell history)").option("--account <id>", "Cloudflare account id (auto-resolved when you have one account)").option("--zone <domain>", "default domain for new tunnels (auto-resolved when you have one)").option("--status", "show current identity (redacted) and exit").action(async (opts) => {
+    if (opts.status) return showStatus();
+    await runLoginFlow(opts);
+  });
+}
+
+// src/commands/up.ts
+import { join as join2 } from "path";
+import { readFileSync as readFileSync3 } from "fs";
+import * as clack2 from "@clack/prompts";
+
+// src/config/ensure-auth.ts
+async function ensureAuth() {
+  try {
+    return getCredentials();
+  } catch (err) {
+    if (err instanceof CliError && process.stdin.isTTY) {
+      say.info("Welcome to cloudtunnel \u2014 let's get you connected to Cloudflare first.");
+      await runLoginFlow();
+      return getCredentials();
+    }
+    throw err;
+  }
+}
+
+// src/connector/binary.ts
+import { execFileSync } from "child_process";
+import { createHash } from "crypto";
+import { chmodSync, existsSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+var PINNED_VERSION = "2025.1.0";
+var RELEASE_BASE = `https://github.com/cloudflare/cloudflared/releases/download/${PINNED_VERSION}`;
+var ASSETS = {
+  "linux-x64": { file: "cloudflared-linux-amd64", archive: false, sha256: "" },
+  "linux-arm64": { file: "cloudflared-linux-arm64", archive: false, sha256: "" },
+  "darwin-x64": { file: "cloudflared-darwin-amd64.tgz", archive: true, sha256: "" },
+  "darwin-arm64": { file: "cloudflared-darwin-arm64.tgz", archive: true, sha256: "" },
+  "win32-x64": { file: "cloudflared-windows-amd64.exe", archive: false, sha256: "" }
+};
+function binaryWorks(bin) {
+  try {
+    execFileSync(bin, ["--version"], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function cachedPath() {
+  return join(binDir, process.platform === "win32" ? "cloudflared.exe" : "cloudflared");
+}
+function isMusl() {
+  try {
+    return process.platform === "linux" && readFileSync("/usr/bin/ldd", "utf8").includes("musl");
+  } catch {
+    return false;
+  }
+}
+async function ensureCloudflared() {
+  if (binaryWorks("cloudflared")) return "cloudflared";
+  const cached = cachedPath();
+  if (existsSync(cached) && binaryWorks(cached)) return cached;
+  return downloadCloudflared(cached);
+}
+async function downloadCloudflared(dest) {
+  if (isMusl()) {
+    throw new CliError("cloudflared has no musl (Alpine) build.", {
+      hint: "install it manually: https://github.com/cloudflare/cloudflared/releases"
+    });
+  }
+  const key = `${process.platform}-${process.arch}`;
+  const asset = ASSETS[key];
+  if (!asset || !asset.sha256) {
+    throw new CliError(`Auto-install unavailable for ${key} (no pinned checksum).`, {
+      hint: "install cloudflared manually: https://github.com/cloudflare/cloudflared/releases"
+    });
+  }
+  say.step(`cloudflared not found \u2014 downloading v${PINNED_VERSION} (checksum-verified)\u2026`);
+  const res = await fetch(`${RELEASE_BASE}/${asset.file}`);
+  if (!res.ok) throw new CliError(`Download failed (HTTP ${res.status}).`);
+  const bytes = Buffer.from(await res.arrayBuffer());
+  const digest = createHash("sha256").update(bytes).digest("hex");
+  if (digest !== asset.sha256) {
+    throw new CliError("cloudflared checksum mismatch \u2014 refusing to run the download.", {
+      hint: "network tampering or an outdated pin; install manually instead"
+    });
+  }
+  ensureDirs();
+  const binary = asset.archive ? extractTgz(bytes) : bytes;
+  writeFileSync(dest, binary, { mode: 493 });
+  chmodSync(dest, 493);
+  if (!binaryWorks(dest)) throw new CliError("Downloaded cloudflared is not runnable.");
+  return dest;
+}
+function extractTgz(_bytes) {
+  throw new CliError("darwin .tgz extraction not yet wired.", {
+    hint: "install cloudflared via `brew install cloudflared`"
+  });
+}
+
+// src/connector/process.ts
+import { execFileSync as execFileSync2, spawn as spawn2 } from "child_process";
+import { openSync } from "fs";
+
+// src/connector/registry.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, renameSync, writeFileSync as writeFileSync2 } from "fs";
+import { readFile } from "fs/promises";
+import os from "os";
+import lockfile from "proper-lockfile";
+function currentBootId() {
+  try {
+    return readFileSync2("/proc/sys/kernel/random/boot_id", "utf8").trim();
+  } catch {
+    return `uptime-${Math.round(os.uptime())}-${os.hostname()}`;
+  }
+}
+function readRegistry() {
+  try {
+    return JSON.parse(readFileSync2(registryFile, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function writeRegistry(reg) {
+  ensureDirs();
+  const tmp = `${registryFile}.tmp`;
+  writeFileSync2(tmp, JSON.stringify(reg, null, 2), { mode: 384 });
+  renameSync(tmp, registryFile);
+}
+async function mutateRegistry(fn) {
+  ensureDirs();
+  if (!existsSync2(registryFile)) writeFileSync2(registryFile, "{}", { mode: 384 });
+  const release = await lockfile.lock(registryFile, { retries: { retries: 10, minTimeout: 50 } });
+  try {
+    const reg = readRegistry();
+    const result = fn(reg);
+    writeRegistry(reg);
+    return result;
+  } finally {
+    await release();
+  }
+}
+function listEntries() {
+  return Object.values(readRegistry());
+}
+function getEntry(fqdn) {
+  return readRegistry()[fqdn];
+}
+function upsertEntry(fqdn, patch) {
+  return mutateRegistry((reg) => {
+    const prev = reg[fqdn];
+    reg[fqdn] = {
+      createdAt: prev?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+      state: "provisioning",
+      ...prev,
+      ...patch
+    };
+  });
+}
+function patchEntry(fqdn, patch) {
+  return mutateRegistry((reg) => {
+    const prev = reg[fqdn];
+    if (prev) reg[fqdn] = { ...prev, ...patch };
+  });
+}
+function removeEntry(fqdn) {
+  return mutateRegistry((reg) => {
+    delete reg[fqdn];
+  });
+}
+function pidAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function isOurConnector(entry) {
+  if (!entry.pid || entry.bootId !== currentBootId()) return false;
+  if (!pidAlive(entry.pid)) return false;
+  if (process.platform === "linux") {
+    try {
+      const cmdline = await readFile(`/proc/${entry.pid}/cmdline`, "utf8");
+      return cmdline.includes("cloudflared");
+    } catch {
+      return false;
+    }
+  }
+  return true;
+}
+async function reconcile() {
+  const entries = listEntries();
+  for (const entry of entries) {
+    if (entry.state === "running" && !await isOurConnector(entry)) {
+      const fqdn = `${entry.subdomain}.${entry.zone}`;
+      await mutateRegistry((reg) => {
+        const e = reg[fqdn];
+        if (e) {
+          e.state = "stopped";
+          delete e.pid;
+        }
+      });
+    }
+  }
+  return listEntries();
+}
+
+// src/connector/process.ts
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function startConnector(opts) {
+  const args = ["tunnel", "run"];
+  const env = { ...process.env, TUNNEL_TOKEN: opts.token };
+  const fd = openSync(opts.logFile, "a", 384);
+  const child = spawn2(opts.bin, args, { env, detached: opts.detach, stdio: ["ignore", fd, fd] });
+  if (!child.pid) throw new CliError("Failed to start the cloudflared connector.");
+  if (opts.detach) {
+    child.unref();
+    return { pid: child.pid };
+  }
+  child.on("exit", (code) => opts.onExit?.(code));
+  child.on("error", () => opts.onExit?.(1));
+  return { pid: child.pid, child };
+}
+async function stopConnector(entry) {
+  if (!entry.pid || !await isOurConnector(entry)) return false;
+  const pid = entry.pid;
+  if (process.platform === "win32") {
+    try {
+      execFileSync2("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore" });
+    } catch {
+      return false;
+    }
+    return true;
+  }
+  try {
+    process.kill(pid, "SIGTERM");
+  } catch {
+    return false;
+  }
+  await sleep(3e3);
+  if (await isOurConnector(entry)) {
+    try {
+      process.kill(pid, "SIGKILL");
+    } catch {
+    }
+  }
+  return true;
+}
+
+// src/cloudflare/tunnels.ts
+var MANAGED_TUNNEL_PREFIX = "ct-";
+function isManagedTunnel(tunnel) {
+  return tunnel.name.startsWith(MANAGED_TUNNEL_PREFIX);
+}
+async function createTunnel(cf, name) {
+  const env = await cfRequest(cf.token, "POST", `/accounts/${cf.accountId}/cfd_tunnel`, {
+    name,
+    config_src: "cloudflare"
+  });
+  return env.result;
+}
+function listTunnels(cf) {
+  return cfPaginate(cf.token, `/accounts/${cf.accountId}/cfd_tunnel?is_deleted=false`);
+}
+async function getTunnel(cf, id) {
+  return (await cfRequest(cf.token, "GET", `/accounts/${cf.accountId}/cfd_tunnel/${id}`)).result;
+}
+async function deleteTunnel(cf, id) {
+  await cfRequest(cf.token, "DELETE", `/accounts/${cf.accountId}/cfd_tunnel/${id}`);
+}
+async function getTunnelToken(cf, id) {
+  return (await cfRequest(cf.token, "GET", `/accounts/${cf.accountId}/cfd_tunnel/${id}/token`)).result;
+}
+async function putIngress(cf, id, ingress) {
+  await cfRequest(cf.token, "PUT", `/accounts/${cf.accountId}/cfd_tunnel/${id}/configurations`, {
+    config: { ingress }
+  });
+}
+async function getConnections(cf, id) {
+  const env = await cfRequest(
+    cf.token,
+    "GET",
+    `/accounts/${cf.accountId}/cfd_tunnel/${id}/connections`
+  );
+  return env.result ?? [];
+}
+
+// src/connector/health.ts
+var sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
+async function waitHealthy(cf, tunnelId, opts = {}) {
+  const deadline = Date.now() + (opts.timeoutMs ?? 3e4);
+  while (Date.now() < deadline) {
+    if (opts.signal?.aborted) return "dead";
+    try {
+      const connections = await getConnections(cf, tunnelId);
+      if (connections.length > 0) return "healthy";
+    } catch {
+    }
+    await sleep2(2e3);
+  }
+  return opts.signal?.aborted ? "dead" : "provisioning";
+}
+
+// src/core/orchestrator-create.ts
+import { randomInt as randomInt2 } from "crypto";
+
+// src/core/ingress.ts
+function buildIngress(opts) {
+  return [
+    { hostname: opts.hostname, service: `${opts.proto}://localhost:${opts.port}` },
+    { service: "http_status:404" }
+  ];
+}
+
+// src/core/slug.ts
+import { randomInt } from "crypto";
+var ADJECTIVES = [
+  "brave",
+  "calm",
+  "clever",
+  "eager",
+  "gentle",
+  "happy",
+  "jolly",
+  "kind",
+  "lively",
+  "mighty",
+  "nimble",
+  "proud",
+  "quick",
+  "royal",
+  "swift",
+  "witty"
+];
+var NOUNS = [
+  "otter",
+  "falcon",
+  "maple",
+  "comet",
+  "harbor",
+  "lynx",
+  "willow",
+  "cedar",
+  "raven",
+  "meadow",
+  "pixel",
+  "quartz",
+  "river",
+  "sparrow",
+  "tiger",
+  "walnut"
+];
+var pick = (arr) => arr[randomInt(arr.length)];
+function randomSlug() {
+  const suffix = randomInt(65536).toString(16).padStart(4, "0");
+  return `${pick(ADJECTIVES)}-${pick(NOUNS)}-${suffix}`;
+}
+function resolveHostSpec(opts, defaultZone) {
+  if (opts.hostname) {
+    const dot = opts.hostname.indexOf(".");
+    if (dot <= 0) throw new CliError(`Invalid hostname: ${opts.hostname}`);
+    return {
+      subdomain: opts.hostname.slice(0, dot),
+      zone: opts.hostname.slice(dot + 1),
+      hostname: opts.hostname
+    };
+  }
+  const zone = opts.zone ?? defaultZone;
+  if (!zone) {
+    throw new CliError("No zone specified and no default zone set.", {
+      hint: "pass --zone <domain>, or run `cloudtunnel login --zone <domain>`"
+    });
+  }
+  const subdomain = opts.name ?? randomSlug();
+  return { subdomain, zone, hostname: `${subdomain}.${zone}` };
+}
+
+// src/core/orchestrator-create.ts
+var tunnelIdFromCname = (content) => content.replace(/\.cfargotunnel\.com\.?$/, "");
+async function createTunnelSubdomain(cf, opts) {
+  const host = resolveHostSpec(opts, opts.defaultZone);
+  const zone = await resolveZone(cf.token, host.zone);
+  const existing = await findCname(cf.token, zone.id, host.hostname);
+  if (existing) {
+    if (isManagedDns(existing) && !opts.force) {
+      const tunnelId2 = tunnelIdFromCname(existing.content);
+      const token = await getTunnelToken(cf, tunnelId2);
+      await putIngress(cf, tunnelId2, buildIngress({ hostname: host.hostname, port: opts.port, proto: opts.proto }));
+      await recordRunning(host, zone.id, tunnelId2, existing.id, opts);
+      say.dim(`Re-attaching to existing tunnel for ${host.hostname}.`);
+      return { host, tunnelId: tunnelId2, token, adopted: true };
+    }
+    if (!opts.force) {
+      throw new CliError(`${host.hostname} is already taken by a record not managed by cloudtunnel.`, {
+        hint: "pick another --subdomain/--hostname, or pass -f/--force to take it over"
+      });
+    }
+    await releaseHostname(cf, zone.id, existing);
+    say.dim(`Released ${host.hostname} (--force) \u2014 recreating.`);
+  }
+  await upsertEntry(host.hostname, {
+    subdomain: host.subdomain,
+    zone: host.zone,
+    zoneId: zone.id,
+    port: opts.port,
+    proto: opts.proto,
+    state: "provisioning"
+  });
+  let tunnelId;
+  let dnsRecordId;
+  try {
+    const suffix = randomInt2(65536).toString(16).padStart(4, "0");
+    const tunnel = await createTunnel(cf, `${MANAGED_TUNNEL_PREFIX}${host.subdomain}-${suffix}`);
+    tunnelId = tunnel.id;
+    const token = await getTunnelToken(cf, tunnelId);
+    await putIngress(cf, tunnelId, buildIngress({ hostname: host.hostname, port: opts.port, proto: opts.proto }));
+    const record = await createCname(cf.token, zone.id, host.hostname, tunnelId);
+    dnsRecordId = record.id;
+    await recordRunning(host, zone.id, tunnelId, dnsRecordId, opts);
+    return { host, tunnelId, token, adopted: false };
+  } catch (err) {
+    const clean = await rollback(cf, zone.id, tunnelId, dnsRecordId, host.hostname);
+    if (clean) await removeEntry(host.hostname);
+    else await patchEntry(host.hostname, { state: "orphaned" });
+    throw err;
+  }
+}
+async function recordRunning(host, zoneId, tunnelId, dnsRecordId, opts) {
+  await upsertEntry(host.hostname, {
+    subdomain: host.subdomain,
+    zone: host.zone,
+    zoneId,
+    tunnelId,
+    dnsRecordId,
+    port: opts.port,
+    proto: opts.proto,
+    bootId: currentBootId(),
+    state: "running"
+  });
+}
+async function releaseHostname(cf, zoneId, record) {
+  if (record.content.endsWith(".cfargotunnel.com")) {
+    const oldTunnelId = tunnelIdFromCname(record.content);
+    try {
+      const tunnel = await getTunnel(cf, oldTunnelId);
+      if (isManagedTunnel(tunnel)) await deleteTunnel(cf, oldTunnelId);
+    } catch {
+    }
+  }
+  await deleteDnsRecord(cf.token, zoneId, record.id);
+}
+async function rollback(cf, zoneId, tunnelId, dnsRecordId, hostname) {
+  let clean = true;
+  if (dnsRecordId) {
+    try {
+      await deleteDnsRecord(cf.token, zoneId, dnsRecordId);
+    } catch {
+      clean = false;
+      say.warn(`Left a DNS record behind for ${hostname} (${dnsRecordId}) \u2014 run \`cloudtunnel rm --force ${hostname}\`.`);
+    }
+  }
+  if (tunnelId) {
+    try {
+      await deleteTunnel(cf, tunnelId);
+    } catch {
+      clean = false;
+      say.warn(`Left tunnel ${tunnelId} behind \u2014 run \`cloudtunnel gc\`.`);
+    }
+  }
+  return clean;
+}
+
+// src/core/orchestrator-manage.ts
+var tunnelIdFromCname2 = (content) => content.replace(/\.cfargotunnel\.com\.?$/, "");
+var isNotFound = (err) => err instanceof CliError && err.status === 404;
+var zoneFromFqdn = (fqdn) => fqdn.slice(fqdn.indexOf(".") + 1);
+function resolveTarget(target) {
+  if (target.includes(".")) return { fqdn: target, entry: getEntry(target) };
+  const matches = listEntries().filter((e) => e.subdomain === target);
+  if (matches.length > 1) {
+    throw new CliError(`"${target}" matches multiple zones.`, {
+      hint: `use the full hostname: ${matches.map((m) => `${m.subdomain}.${m.zone}`).join(", ")}`
+    });
+  }
+  const entry = matches[0];
+  if (!entry) throw new CliError(`No tracked subdomain named "${target}".`, { hint: "pass a full hostname" });
+  return { fqdn: `${entry.subdomain}.${entry.zone}`, entry };
+}
+async function removeTunnelSubdomain(cf, target, opts = {}) {
+  const { fqdn, entry } = resolveTarget(target);
+  if (!entry && !opts.force) {
+    throw new CliError(`${fqdn} is not managed by cloudtunnel.`, { hint: "pass --force to delete it anyway" });
+  }
+  const zoneId = entry?.zoneId ?? (await resolveZone(cf.token, zoneFromFqdn(fqdn))).id;
+  const record = await findCname(cf.token, zoneId, fqdn);
+  if (record && !isManagedDns(record) && !opts.force) {
+    throw new CliError(`${fqdn} points to a record not managed by cloudtunnel.`, { hint: "pass --force to delete it" });
+  }
+  const tunnelId = record ? tunnelIdFromCname2(record.content) : entry?.tunnelId;
+  if (opts.dryRun) {
+    say.info(`Would delete: tunnel ${tunnelId ?? "(none)"}${record && !opts.keepDns ? `, DNS ${record.id}` : ""}`);
+    return;
+  }
+  if (entry) await stopConnector(entry);
+  if (tunnelId) {
+    let tunnel;
+    try {
+      tunnel = await getTunnel(cf, tunnelId);
+    } catch (err) {
+      if (!isNotFound(err)) throw err;
+    }
+    if (tunnel && !isManagedTunnel(tunnel) && !opts.force) {
+      throw new CliError(`Tunnel ${tunnelId} is not managed by cloudtunnel.`, { hint: "pass --force" });
+    }
+    if (tunnel) {
+      try {
+        await deleteTunnel(cf, tunnelId);
+      } catch (err) {
+        if (!isNotFound(err)) throw err;
+      }
+    }
+  }
+  if (record && !opts.keepDns) {
+    try {
+      await deleteDnsRecord(cf.token, zoneId, record.id);
+    } catch (err) {
+      if (!isNotFound(err)) throw err;
+    }
+  }
+  await removeEntry(fqdn);
+  say.ok(`Removed ${fqdn}`);
+}
+async function updateIngress(cf, target, port, proto) {
+  const { fqdn, entry } = resolveTarget(target);
+  if (!entry?.tunnelId) throw new CliError(`No tracked tunnel for ${fqdn}.`);
+  const nextProto = proto ?? entry.proto;
+  await putIngress(cf, entry.tunnelId, buildIngress({ hostname: fqdn, port, proto: nextProto }));
+  await patchEntry(fqdn, { port, proto: nextProto });
+  say.ok(`${fqdn} now points to ${nextProto}://localhost:${port} (no restart needed)`);
+}
+async function listAll(cf, opts = {}) {
+  const entries = await reconcile();
+  const tunnels = new Map((await listTunnels(cf)).map((t) => [t.id, t]));
+  const rows = entries.map((e) => ({
+    hostname: `${e.subdomain}.${e.zone}`,
+    zone: e.zone,
+    port: `${e.proto}://localhost:${e.port}`,
+    state: e.tunnelId && !tunnels.has(e.tunnelId) ? "dangling" : e.state,
+    managed: true
+  }));
+  if (opts.all) {
+    const { listCargoCnames } = await import("./dns-PAPFSYFP.js");
+    const { listZones: listZones3 } = await import("./zones-YNGQYXAF.js");
+    const tracked = new Set(entries.map((e) => `${e.subdomain}.${e.zone}`));
+    for (const zone of await listZones3(cf.token)) {
+      for (const rec of await listCargoCnames(cf.token, zone.id)) {
+        if (!tracked.has(rec.name)) {
+          rows.push({ hostname: rec.name, zone: zone.name, port: "-", state: "unmanaged", managed: false });
+        }
+      }
+    }
+  }
+  return rows;
+}
+
+// src/commands/up.ts
+function parsePort(port) {
+  const n = Number(port);
+  if (!Number.isInteger(n) || n < 1 || n > 65535) {
+    throw new CliError(`Invalid port: ${port}`, { hint: "use a number 1\u201365535, e.g. `cloudtunnel 3000`" });
+  }
+  return n;
+}
+async function resolveDomain(token, explicit, saved) {
+  if (explicit) return explicit;
+  if (saved) return saved;
+  const zones = await listZones(token);
+  if (zones.length === 0) throw new CliError("No domains found in this Cloudflare account.");
+  if (zones.length === 1) return zones[0].name;
+  if (!process.stdin.isTTY) {
+    throw new CliError("Multiple domains in this account \u2014 pick one.", { hint: "pass -d <domain>, e.g. -d example.com" });
+  }
+  const chosen = await selectOne("Choose a domain", zones, (z) => z.name);
+  saveConfig({ ...loadConfig(), defaultZone: chosen.name });
+  say.dim(`Saved ${chosen.name} as your default domain (change it with \`cloudtunnel login --zone <domain>\`).`);
+  return chosen.name;
+}
+function showLogTail(logFile) {
+  try {
+    const tail = readFileSync3(logFile, "utf8").trim().split("\n").slice(-8).join("\n");
+    if (tail) say.dim(tail);
+  } catch {
+  }
+}
+async function runUp(portArg, opts) {
+  const port = parsePort(portArg);
+  const creds = await ensureAuth();
+  const cf = resolveCf();
+  const bin = await ensureCloudflared();
+  const subdomain = opts.subdomain ?? opts.name;
+  const domain = opts.hostname ? void 0 : await resolveDomain(cf.token, opts.domain ?? opts.zone, creds.defaultZone);
+  if (process.stdout.isTTY) clack2.intro("cloudtunnel");
+  const spin = clack2.spinner();
+  let spinnerActive = true;
+  const stopSpin = (msg) => {
+    if (spinnerActive) {
+      spinnerActive = false;
+      spin.stop(msg);
+    }
+  };
+  spin.start("Creating tunnel\u2026");
+  const result = await createTunnelSubdomain(cf, {
+    port,
+    proto: opts.proto,
+    name: subdomain,
+    zone: domain,
+    hostname: opts.hostname,
+    defaultZone: creds.defaultZone,
+    force: opts.force
+  }).catch((err) => {
+    stopSpin("Failed to create the tunnel");
+    throw err;
+  });
+  const fqdn = result.host.hostname;
+  const logFile = join2(logDir, `${result.host.subdomain}.log`);
+  const target = `${opts.proto}://localhost:${port}`;
+  if (opts.detach) {
+    const started2 = startConnector({ bin, token: result.token, detach: true, logFile });
+    await patchEntry(fqdn, { pid: started2.pid, bootId: currentBootId(), logFile });
+    stopSpin("Started in the background");
+    clack2.note(formatRoute(fqdn, target), `pid ${started2.pid}`);
+    if (process.stdout.isTTY) clack2.outro(`Stop it with: cloudtunnel down ${result.host.subdomain}`);
+    return;
+  }
+  spin.message("Connecting to the Cloudflare edge\u2026");
+  const controller = new AbortController();
+  let tornDown = false;
+  const teardown = async (exitCode) => {
+    if (tornDown) return;
+    tornDown = true;
+    controller.abort();
+    stopSpin("Stopping\u2026");
+    try {
+      const entry = getEntry(fqdn);
+      if (entry) await stopConnector(entry);
+      if (opts.ephemeral) {
+        await removeTunnelSubdomain(cf, fqdn, { force: true });
+        clack2.outro(`Stopped \xB7 ${fqdn} deleted`);
+      } else {
+        clack2.outro(`Stopped \xB7 ${fqdn} kept \u2014 re-attach: cloudtunnel ${port} -s ${result.host.subdomain}`);
+      }
+    } catch (err) {
+      reportError(err);
+    } finally {
+      process.exit(exitCode);
+    }
+  };
+  const started = startConnector({
+    bin,
+    token: result.token,
+    detach: false,
+    logFile,
+    onExit: (code) => {
+      if (!tornDown) {
+        stopSpin("cloudflared exited");
+        showLogTail(logFile);
+        void teardown(code ?? 1);
+      }
+    }
+  });
+  await patchEntry(fqdn, { pid: started.pid, bootId: currentBootId(), logFile });
+  for (const sig of ["SIGINT", "SIGHUP", "SIGTERM"]) {
+    process.on(sig, () => void teardown(0));
+  }
+  const health = await waitHealthy(cf, result.tunnelId, { signal: controller.signal });
+  if (health === "healthy") {
+    stopSpin("Connected");
+    clack2.note(`${formatRoute(fqdn, target)}
+${dim("Ctrl-C stops the connector \u2014 the subdomain is kept")}`, "Live");
+  } else if (health === "provisioning") {
+    stopSpin("Provisioning");
+    say.warn(`${fqdn} is not healthy yet \u2014 it should be live shortly.`);
+  }
+}
+function registerUp(program) {
+  program.command("up").argument("<port>", "local port to expose (e.g. 3000)").description("Expose a local port at an HTTPS subdomain (also: `cloudtunnel <port>`)").option("-s, --subdomain <name>", "subdomain label (default: a friendly random slug)").option("-d, --domain <domain>", "domain to create the subdomain under (default: your default; picks interactively if unset)").option("--name <name>", "alias of --subdomain").option("--zone <domain>", "alias of --domain").option("--hostname <fqdn>", "full hostname override (instead of --subdomain + --domain)").option("--detach", "run the connector in the background").option("--ephemeral", "delete the tunnel + DNS on exit (nport-style; default keeps them)").option("-f, --force", "take over a subdomain already occupied by another record").option("--proto <proto>", "local service protocol: http | https", "http").action((port, opts) => runUp(port, opts));
+}
+
+// src/commands/ls.ts
+function registerLs(program) {
+  program.command("ls").description("List tunnel subdomains (managed by default; --all scans the whole account)").option("--all", "scan every zone in the account (slower; shows unmanaged tunnels too)").action(async (opts) => {
+    await ensureAuth();
+    const cf = resolveCf();
+    const rows = await listAll(cf, { all: opts.all });
+    if (rows.length === 0) {
+      say.info("No tunnel subdomains yet. Create one: `cloudtunnel 3000`");
+      return;
+    }
+    printTable(
+      ["SUBDOMAIN", "ZONE", "TARGET", "STATE"],
+      rows.map((r) => [r.hostname, r.zone, r.port, r.state])
+    );
+  });
+}
+
+// src/commands/rm.ts
+function registerRm(program) {
+  program.command("rm").argument("<target>", "subdomain name or full hostname to delete").description("Delete a tunnel subdomain (stops connector, removes tunnel + DNS)").option("--force", "allow deleting a resource not created by cloudtunnel").option("--dry-run", "show what would be deleted without deleting").option("--keep-dns", "delete the tunnel but leave the DNS record").action(async (target, opts) => {
+    await ensureAuth();
+    const cf = resolveCf();
+    await removeTunnelSubdomain(cf, target, opts);
+  });
+}
+
+// src/commands/update.ts
+function registerUpdate(program) {
+  program.command("update").argument("<name>", "subdomain name or full hostname to update").description("Change the local port/protocol a subdomain points to (zero-downtime)").option("--port <port>", "new local port").option("--proto <proto>", "new local protocol: http | https").action(async (name, opts) => {
+    if (!opts.port) throw new CliError("--port is required", { hint: "e.g. `cloudtunnel update myapp --port 8080`" });
+    const port = Number(opts.port);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) throw new CliError(`Invalid port: ${opts.port}`);
+    await ensureAuth();
+    const cf = resolveCf();
+    await updateIngress(cf, name, port, opts.proto);
+  });
+}
+
+// src/commands/status.ts
+function registerStatus(program) {
+  program.command("status").argument("<name>", "subdomain name or full hostname").description("Show tunnel health and connector state for a subdomain").action(async (name) => {
+    await ensureAuth();
+    const cf = resolveCf();
+    const { fqdn, entry } = resolveTarget(name);
+    if (!entry?.tunnelId) throw new CliError(`No tracked tunnel for ${fqdn}.`);
+    const connections = await getConnections(cf, entry.tunnelId);
+    const connectorAlive = await isOurConnector(entry);
+    say.info(`Host:      https://${fqdn}`);
+    say.info(`Tunnel:    ${entry.tunnelId} \u2014 ${connections.length} edge connection(s)`);
+    say.info(`Connector: ${connectorAlive ? `running (pid ${entry.pid})` : "stopped"}`);
+    say.info(`Target:    ${entry.proto}://localhost:${entry.port}`);
+  });
+}
+
+// src/commands/down.ts
+async function stopEntry(entry) {
+  const stopped = await stopConnector(entry);
+  await mutateRegistry((reg) => {
+    const e = reg[`${entry.subdomain}.${entry.zone}`];
+    if (e) {
+      e.state = "stopped";
+      delete e.pid;
+    }
+  });
+  return stopped;
+}
+function registerDown(program) {
+  program.command("down").argument("[name]", "subdomain to stop (omit with --all to stop everything)").description("Stop a running connector, leaving the tunnel + DNS intact").option("--all", "stop all running connectors").action(async (name, opts) => {
+    if (opts.all) {
+      const running = listEntries().filter((e) => e.pid);
+      let stopped = 0;
+      for (const entry2 of running) if (await stopEntry(entry2)) stopped++;
+      say.ok(`Stopped ${stopped} connector(s).`);
+      return;
+    }
+    if (!name) throw new CliError("Pass a subdomain name or --all.");
+    const { fqdn, entry } = resolveTarget(name);
+    if (!entry) throw new CliError(`No tracked subdomain for ${fqdn}.`);
+    await stopEntry(entry);
+    say.ok(`Stopped ${fqdn}.`);
+  });
+}
+
+// src/commands/gc.ts
+function registerGc(program) {
+  program.command("gc").description("Prune crash orphans (provisioning/orphaned entries) after confirmation").option("--yes", "skip the confirmation prompt").action(async (opts) => {
+    await ensureAuth();
+    const cf = resolveCf();
+    await reconcile();
+    const orphans = listEntries().filter((e) => e.state === "provisioning" || e.state === "orphaned");
+    if (orphans.length === 0) {
+      say.info("Nothing to clean up.");
+      return;
+    }
+    say.info(`Found ${orphans.length} orphaned entr${orphans.length === 1 ? "y" : "ies"}:`);
+    for (const o of orphans) say.dim(`  ${o.subdomain}.${o.zone} (${o.state})`);
+    if (!opts.yes) {
+      say.warn("Re-run with --yes to delete these tunnels/records.");
+      return;
+    }
+    for (const o of orphans) {
+      try {
+        await removeTunnelSubdomain(cf, `${o.subdomain}.${o.zone}`, { force: true });
+      } catch {
+        say.warn(`Could not fully clean ${o.subdomain}.${o.zone} \u2014 check the dashboard.`);
+      }
+    }
+  });
+}
+
+// src/commands/zones.ts
+function registerZones(program) {
+  program.command("zones").description("List the zones (domains) available in your Cloudflare account").action(async () => {
+    await ensureAuth();
+    const cf = resolveCf();
+    const zones = await listZones(cf.token);
+    if (zones.length === 0) {
+      say.info("No zones in this account.");
+      return;
+    }
+    printTable(
+      ["ZONE", "STATUS", "ID"],
+      zones.map((z) => [z.name, z.status ?? "-", z.id])
+    );
+  });
+}
+
+// src/core/profiles.ts
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+function readProfiles() {
+  try {
+    return JSON.parse(readFileSync4(profilesFile, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function writeProfiles(profiles) {
+  ensureDirs();
+  writeFileSync3(profilesFile, JSON.stringify(profiles, null, 2), { mode: 384 });
+}
+function listProfiles() {
+  return Object.entries(readProfiles()).map(([name, profile]) => ({ name, profile }));
+}
+function getProfile(name) {
+  const profile = readProfiles()[name];
+  if (!profile) {
+    throw new CliError(`No profile named "${name}".`, { hint: "list them with `cloudtunnel profiles`" });
+  }
+  return profile;
+}
+function saveProfile(name, profile) {
+  const profiles = readProfiles();
+  profiles[name] = profile;
+  writeProfiles(profiles);
+}
+function removeProfile(name) {
+  const profiles = readProfiles();
+  if (!profiles[name]) throw new CliError(`No profile named "${name}".`);
+  delete profiles[name];
+  writeProfiles(profiles);
+}
+function parseServiceSpec(spec) {
+  const [name, portStr, proto] = spec.split(":");
+  const port = Number(portStr);
+  if (!name || !Number.isInteger(port) || port < 1 || port > 65535) {
+    throw new CliError(`Invalid service "${spec}".`, { hint: "use name:port, e.g. api:3000 or web:5173:https" });
+  }
+  if (proto && proto !== "http" && proto !== "https") {
+    throw new CliError(`Invalid protocol "${proto}" in "${spec}".`, { hint: "proto must be http or https" });
+  }
+  return { name, port, proto: proto ?? "http" };
+}
+
+// src/commands/save.ts
+function registerSave(program) {
+  program.command("save").argument("<profile>", "profile name, e.g. mb").argument("[services...]", "services as name:port[:proto], e.g. api:3000 web:5173").description("Save a group of services as a profile you can `run` together").option("--from-running", "snapshot the currently tracked tunnels instead of listing services").option("-d, --domain <domain>", "default domain for this profile").action((profile, specs, opts) => {
+    let services;
+    if (opts.fromRunning) {
+      const entries = listEntries().filter((e) => e.tunnelId);
+      if (entries.length === 0) {
+        throw new CliError("No tunnels to snapshot.", { hint: "start some with `cloudtunnel up`, or pass services like api:3000" });
+      }
+      services = entries.map((e) => ({ name: e.subdomain, port: e.port, proto: e.proto, domain: e.zone }));
+    } else {
+      if (specs.length === 0) {
+        throw new CliError("No services given.", { hint: "e.g. `cloudtunnel save mb api:3000 web:5173`" });
+      }
+      services = specs.map(parseServiceSpec);
+    }
+    saveProfile(profile, { services, domain: opts.domain });
+    say.ok(`Saved profile "${profile}" (${services.length} service${services.length === 1 ? "" : "s"}). Run it: cloudtunnel run ${profile}`);
+  });
+}
+
+// src/commands/run.ts
+import { join as join3 } from "path";
+import * as clack3 from "@clack/prompts";
+async function runProfile(name, opts) {
+  const creds = await ensureAuth();
+  const cf = resolveCf();
+  const bin = await ensureCloudflared();
+  const profile = getProfile(name);
+  if (process.stdout.isTTY) clack3.intro(`cloudtunnel \xB7 profile "${name}"`);
+  const spin = clack3.spinner();
+  spin.start("Creating tunnels\u2026");
+  const started = [];
+  for (const svc of profile.services) {
+    spin.message(`Creating ${svc.name} (:${svc.port})\u2026`);
+    const result = await createTunnelSubdomain(cf, {
+      port: svc.port,
+      proto: svc.proto,
+      name: svc.name,
+      zone: svc.domain ?? opts.domain ?? profile.domain,
+      defaultZone: creds.defaultZone,
+      force: opts.force
+    });
+    const fqdn = result.host.hostname;
+    const logFile = join3(logDir, `${result.host.subdomain}.log`);
+    const conn = startConnector({
+      bin,
+      token: result.token,
+      detach: false,
+      logFile,
+      onExit: () => say.warn(`Connector for ${fqdn} exited \u2014 check \`cloudtunnel status ${result.host.subdomain}\`.`)
+    });
+    await patchEntry(fqdn, { pid: conn.pid, bootId: currentBootId(), logFile });
+    started.push({ fqdn, subdomain: result.host.subdomain, tunnelId: result.tunnelId, target: `${svc.proto}://localhost:${svc.port}` });
+  }
+  spin.message("Connecting to the Cloudflare edge\u2026");
+  const healths = await Promise.all(started.map((s) => waitHealthy(cf, s.tunnelId, { timeoutMs: 3e4 })));
+  const live = healths.filter((h) => h === "healthy").length;
+  spin.stop(`${started.length} service(s) started`);
+  const lines = started.map((s, i) => `${formatRoute(s.fqdn, s.target)}${healths[i] === "healthy" ? "" : dim(`  (${healths[i]})`)}`);
+  clack3.note(lines.join("\n"), `profile "${name}" \u2014 ${live}/${started.length} live`);
+  say.dim("Ctrl-C stops all connectors (subdomains are kept).");
+  let tornDown = false;
+  const teardownAll = async (code) => {
+    if (tornDown) return;
+    tornDown = true;
+    try {
+      for (const s of started) {
+        const entry = getEntry(s.fqdn);
+        if (entry) await stopConnector(entry);
+      }
+      if (process.stdout.isTTY) clack3.outro(`Stopped ${started.length} connector(s) \xB7 subdomains kept`);
+    } catch (err) {
+      reportError(err);
+    } finally {
+      process.exit(code);
+    }
+  };
+  for (const sig of ["SIGINT", "SIGHUP", "SIGTERM"]) {
+    process.on(sig, () => void teardownAll(0));
+  }
+}
+function registerRun(program) {
+  program.command("run").argument("<profile>", "name of a saved profile (see `cloudtunnel profiles`)").description("Start every service in a saved profile at once").option("-f, --force", "take over subdomains already occupied by another record").option("-d, --domain <domain>", "override the profile's domain for this run").action((name, opts) => runProfile(name, opts));
+}
+
+// src/commands/profiles.ts
+function registerProfiles(program) {
+  program.command("profiles").description("List saved profiles (or delete one with --rm)").option("--rm <name>", "delete a profile").action((opts) => {
+    if (opts.rm) {
+      removeProfile(opts.rm);
+      say.ok(`Deleted profile "${opts.rm}".`);
+      return;
+    }
+    const profiles = listProfiles();
+    if (profiles.length === 0) {
+      say.info("No profiles yet. Create one: `cloudtunnel save mb api:3000 web:5173`");
+      return;
+    }
+    printTable(
+      ["PROFILE", "SERVICES", "DOMAIN"],
+      profiles.map(({ name, profile }) => [
+        name,
+        profile.services.map((s) => `${s.name}:${s.port}`).join(", "),
+        profile.domain ?? "(default)"
+      ])
+    );
+  });
+}
+
+// src/index.ts
+var require2 = createRequire(import.meta.url);
+var pkg = require2("../package.json");
+var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
+  "login",
+  "up",
+  "ls",
+  "rm",
+  "update",
+  "status",
+  "down",
+  "gc",
+  "zones",
+  "save",
+  "run",
+  "profiles",
+  "help"
+]);
+function applyBarePortAlias(argv) {
+  const args = argv.slice(2);
+  const first = args[0];
+  if (first && /^\d{1,5}$/.test(first) && !KNOWN_COMMANDS.has(first)) {
+    args.unshift("up");
+  }
+  return [argv[0], argv[1], ...args];
+}
+function buildProgram() {
+  const program = new Command();
+  program.name("cloudtunnel").description("Manage Cloudflare Tunnels and subdomains account-wide, nport-style.").version(pkg.version, "-v, --version").showHelpAfterError();
+  program.addHelpText(
+    "before",
+    [
+      pc2.bold("Quickstart:"),
+      `  ${pc2.cyan("cloudtunnel login")}   once \u2014 paste a token (or set CLOUDFLARE_API_TOKEN)`,
+      `  ${pc2.cyan("cloudtunnel 3000")}    \u2192 your local :3000 goes live at an HTTPS URL`,
+      ""
+    ].join("\n")
+  );
+  for (const register of [
+    registerLogin,
+    registerUp,
+    registerLs,
+    registerRm,
+    registerUpdate,
+    registerStatus,
+    registerDown,
+    registerGc,
+    registerZones,
+    registerSave,
+    registerRun,
+    registerProfiles
+  ]) {
+    register(program);
+  }
+  return program;
+}
+async function main() {
+  const program = buildProgram();
+  try {
+    await program.parseAsync(applyBarePortAlias(process.argv));
+  } catch (err) {
+    process.exitCode = reportError(err);
+  }
+}
+void main();
+//# sourceMappingURL=index.js.map