@iamken/cloudtunnel 0.10.5 → 0.11.1

package/dist/{chunk-ZIUYW2HQ.js → chunk-7XACBYL7.js}

@@ -200,6 +200,10 @@ async function cfRequest(token, method, path, body) {
     } catch (err) {
       const reason = fetchErrorReason(err);
       say.debug(`[cf] ${method} ${base}${path} -> network error: ${reason}${viaRelay ? " (relay)" : ""}`);
+      if (attempt < MAX_ATTEMPTS) {
+        await sleep(2 ** attempt * 500);
+        continue;
+      }
       throw new CliError(`Could not reach the Cloudflare API (${reason})${viaRelay ? ` via relay ${base}` : ""}.`, {
         hint: viaRelay ? "is the relay tunnel up and the base URL correct? run with CLOUDTUNNEL_DEBUG=1" : void 0
       });
@@ -272,4 +276,4 @@ export {
   cfRequest,
   cfPaginate
 };
-//# sourceMappingURL=chunk-ZIUYW2HQ.js.map
+//# sourceMappingURL=chunk-7XACBYL7.js.map

package/dist/{chunk-ZIUYW2HQ.js.map → chunk-7XACBYL7.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/ui/errors.ts","../src/ui/output.ts","../src/config/store.ts","../src/config/paths.ts","../src/config/api-base.ts","../src/config/relay-secret.ts","../src/cloudflare/client.ts"],"sourcesContent":["import pc from \"picocolors\";\n\n/**\n * A user-facing CLI error. The message is printed as-is (no stack trace) and\n * `exitCode` drives the process exit code. Use `hint` to tell the user exactly\n * which command to run next — every error should be actionable.\n */\nexport class CliError extends Error {\n  readonly exitCode: number;\n  readonly hint?: string;\n  /** HTTP status when this wraps a Cloudflare API error (lets callers tell a\n   * genuine 404 \"already gone\" from a transient failure). */\n  readonly status?: number;\n\n  constructor(message: string, opts: { exitCode?: number; hint?: string; status?: number } = {}) {\n    super(message);\n    this.name = \"CliError\";\n    this.exitCode = opts.exitCode ?? 1;\n    this.hint = opts.hint;\n    this.status = opts.status;\n  }\n}\n\n/**\n * Best-effort concise reason from a thrown `fetch`/undici error. Node's fetch\n * throws a generic `TypeError: fetch failed` and buries the real cause (DNS,\n * refused, TLS, timeout, bad URL) in `.cause` — surface it so \"network error\"\n * becomes actionable (e.g. `ENOTFOUND`, `ECONNREFUSED`, `UND_ERR_CONNECT_TIMEOUT`,\n * `self-signed certificate`, `Invalid URL`).\n */\nexport function fetchErrorReason(err: unknown): string {\n  const cause = (err as { cause?: { code?: string; message?: string } })?.cause;\n  return cause?.code ?? cause?.message ?? (err as Error)?.message ?? \"unknown\";\n}\n\n/** Print an error and return the exit code. Known CliErrors print cleanly; the\n * rest print their message plus a note that it was unexpected. */\nexport function reportError(err: unknown): number {\n  if (err instanceof CliError) {\n    console.error(pc.red(`✗ ${err.message}`));\n    if (err.hint) console.error(pc.dim(`  → ${err.hint}`));\n    return err.exitCode;\n  }\n  const message = err instanceof Error ? err.message : String(err);\n  console.error(pc.red(`✗ ${message}`));\n  console.error(pc.dim(\"  (unexpected error — please report if this persists)\"));\n  return 1;\n}\n","import pc from \"picocolors\";\nimport Table from \"cli-table3\";\nimport { cancel, confirm as clackConfirm, intro, isCancel, note, outro, select, spinner } from \"@clack/prompts\";\nimport { CliError } from \"./errors.js\";\n\n// Re-export the clack primitives used to build modern multi-step flows.\nexport { intro, note, outro, spinner };\n\n/** Yes/no prompt (TTY). Cancel (Ctrl-C) counts as \"no\". */\nexport async function confirm(message: string): Promise<boolean> {\n  const answer = await clackConfirm({ message });\n  return !isCancel(answer) && answer === true;\n}\n\n/** Redact a secret to `••••{last4}` so tokens never appear in output/logs. */\nexport function redactToken(token: string): string {\n  if (!token) return \"\";\n  const last4 = token.length > 4 ? token.slice(-4) : token;\n  return `••••${last4}`;\n}\n\n// Lightweight one-off lines for non-flow commands (ls, zones, status, …).\nexport const say = {\n  info: (msg: string) => console.log(msg),\n  ok: (msg: string) => console.log(pc.green(`✓ ${msg}`)),\n  warn: (msg: string) => console.warn(pc.yellow(`! ${msg}`)),\n  dim: (msg: string) => console.log(pc.dim(msg)),\n  step: (msg: string) => console.log(pc.cyan(`→ ${msg}`)),\n  // Opt-in request/diagnostic trace. Gated by CLOUDTUNNEL_DEBUG and written to\n  // STDERR so it never mixes into command stdout. Never pass a secret/token here.\n  debug: (msg: string) => {\n    if (process.env.CLOUDTUNNEL_DEBUG) console.error(pc.dim(msg));\n  },\n};\n\nexport const dim = (s: string): string => pc.dim(s);\n\n/** Format a live tunnel as `https://host  →  proto://localhost:port`. */\nexport function formatRoute(host: string, target: string): string {\n  return `${pc.green(pc.bold(`https://${host}`))}  ${pc.dim(\"→\")}  ${pc.cyan(target)}`;\n}\n\n/** Render a simple table. `head` = column titles, `rows` = string cells. */\nexport function printTable(head: string[], rows: string[][]): void {\n  const table = new Table({\n    head: head.map((h) => pc.bold(h)),\n    style: { head: [], border: [] },\n  });\n  for (const row of rows) table.push(row);\n  console.log(table.toString());\n}\n\n/**\n * Modern arrow-key single-select (↑/↓ to move, Enter to choose). Callers must\n * guard non-TTY before calling. Ctrl-C cancels cleanly (exit 130).\n */\nexport async function selectOne<T>(\n  message: string,\n  items: T[],\n  label: (item: T) => string,\n): Promise<T> {\n  // Use the item index as the (primitive) option value to avoid clack's\n  // conditional Option<T> type fighting the generic, then map back.\n  const value = await select({\n    message,\n    options: items.map((item, i) => ({ value: String(i), label: label(item) })),\n  });\n  if (isCancel(value)) {\n    cancel(\"Cancelled.\");\n    throw new CliError(\"Cancelled.\", { exitCode: 130 });\n  }\n  return items[Number(value)]!;\n}\n","import { chmodSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { CliError } from \"../ui/errors.js\";\nimport { configFile, ensureDirs } from \"./paths.js\";\n\nexport interface CloudtunnelConfig {\n  apiToken?: string;\n  accountId?: string;\n  defaultZone?: string;\n  /** Override the Cloudflare API base — point at a relay when the direct control\n   * plane is blocked. See `config/api-base.ts`. */\n  apiBase?: string;\n  /** Shared secret required by / sent to the relay proxy. See `config/relay-secret.ts`. */\n  relaySecret?: string;\n}\n\nexport interface Credentials {\n  apiToken: string;\n  accountId?: string;\n  defaultZone?: string;\n}\n\n/** Read config.json (missing/invalid → empty config, never throws). */\nexport function loadConfig(): CloudtunnelConfig {\n  try {\n    return JSON.parse(readFileSync(configFile, \"utf8\")) as CloudtunnelConfig;\n  } catch {\n    return {};\n  }\n}\n\n/** Persist config.json with owner-only perms (0600). */\nexport function saveConfig(config: CloudtunnelConfig): void {\n  ensureDirs();\n  writeFileSync(configFile, JSON.stringify(config, null, 2), { mode: 0o600 });\n  chmodSync(configFile, 0o600); // enforce even if the file pre-existed\n}\n\n/**\n * Resolve credentials: env vars override the config file. Throws an actionable\n * CliError if no API token is available anywhere.\n */\nexport function getCredentials(): Credentials {\n  const config = loadConfig();\n  const apiToken = process.env.CLOUDFLARE_API_TOKEN ?? config.apiToken;\n  const accountId = process.env.CLOUDFLARE_ACCOUNT_ID ?? config.accountId;\n  if (!apiToken) {\n    throw new CliError(\"Not authenticated with Cloudflare.\", {\n      hint: \"run `cloudtunnel login` (or set CLOUDFLARE_API_TOKEN)\",\n    });\n  }\n  return { apiToken, accountId, defaultZone: config.defaultZone };\n}\n","import envPaths from \"env-paths\";\nimport { mkdirSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\n// `~/.config/cloudtunnel/` (XDG). suffix:'' avoids env-paths' default \"-nodejs\".\nconst paths = envPaths(\"cloudtunnel\", { suffix: \"\" });\n\nexport const configDir = paths.config;\nexport const configFile = join(configDir, \"config.json\");\nexport const registryFile = join(configDir, \"tunnels.json\");\nexport const scanCacheFile = join(configDir, \"unmanaged-scan.json\");\nexport const profilesFile = join(configDir, \"profiles.json\");\nexport const binDir = join(configDir, \"bin\");\nexport const logDir = join(configDir, \"logs\");\n\n/** Create the app dirs with owner-only perms (secrets live here). Idempotent. */\nexport function ensureDirs(): void {\n  for (const dir of [configDir, binDir, logDir]) {\n    mkdirSync(dir, { recursive: true, mode: 0o700 });\n  }\n}\n","import { CliError } from \"../ui/errors.js\";\nimport { loadConfig } from \"./store.js\";\n\n/** Default Cloudflare management API base — no trailing slash (callers append a\n * path that starts with `/`). */\nexport const DEFAULT_API_BASE = \"https://api.cloudflare.com/client/v4\";\n\n/**\n * Resolve the Cloudflare API base URL. Precedence: env `CLOUDTUNNEL_API_BASE` →\n * `config.apiBase` → default. A trailing slash is stripped so `${base}${path}`\n * (path starts `/`) never yields `//…`.\n *\n * Point this at a relay's `https://<relay>/client/v4` when the direct control\n * plane (api.cloudflare.com) is blocked but a data-plane tunnel to the relay is\n * not — every management call then rides the tunnel instead of hitting CF direct.\n */\nexport function getApiBase(): string {\n  // `||` (not `??`) so an empty/whitespace env or config value falls through\n  // instead of yielding a broken \"\" base.\n  const raw = (process.env.CLOUDTUNNEL_API_BASE?.trim() || loadConfig().apiBase || DEFAULT_API_BASE).replace(/\\/+$/, \"\");\n  // Fail fast on a malformed base (e.g. a scheme-less host set via env) with a\n  // clear message instead of a cryptic `fetch` \"network error\" later.\n  if (!isHttpUrl(raw)) {\n    throw new CliError(`Invalid Cloudflare API base \"${raw}\".`, {\n      hint: \"CLOUDTUNNEL_API_BASE must be a full http(s) URL, e.g. https://cfapi.example.com/client/v4\",\n    });\n  }\n  return raw;\n}\n\n/** True if `s` parses as an http(s) URL — validates `login --api-base`. */\nexport function isHttpUrl(s: string): boolean {\n  try {\n    const u = new URL(s);\n    return u.protocol === \"http:\" || u.protocol === \"https:\";\n  } catch {\n    return false;\n  }\n}\n","import { randomBytes } from \"node:crypto\";\nimport { loadConfig, saveConfig } from \"./store.js\";\n\n/** Header the CLIENT sends and the RELAY requires — the relay's shared secret.\n * Single source of truth, imported by both the client transport and the relay\n * proxy so the two sides can never drift. */\nexport const RELAY_SECRET_HEADER = \"X-CT-Relay-Secret\";\n\n/**\n * The relay shared secret, if configured. Precedence: env\n * `CLOUDTUNNEL_RELAY_SECRET` → `config.relaySecret` → undefined. The CLIENT\n * attaches it to every CF API call; the RELAY rejects calls that lack it.\n */\nexport function getRelaySecret(): string | undefined {\n  return process.env.CLOUDTUNNEL_RELAY_SECRET ?? loadConfig().relaySecret;\n}\n\n/**\n * Return the relay secret, generating + persisting one on first use so a restart\n * or boot service keeps the same value (a changed secret would break the client).\n * Persisted to 0600 config via a MERGE-save (never clobbers apiToken/apiBase).\n * An env-provided secret is returned as-is — env stays the source of truth and\n * nothing is written.\n */\nexport function ensureRelaySecret(): string {\n  const existing = getRelaySecret();\n  if (existing) return existing;\n  const secret = randomBytes(24).toString(\"base64url\"); // 192-bit, url-safe\n  const prev = loadConfig();\n  saveConfig({ ...prev, relaySecret: secret });\n  return secret;\n}\n","import { CliError, fetchErrorReason } from \"../ui/errors.js\";\nimport { say } from \"../ui/output.js\";\nimport { getCredentials } from \"../config/store.js\";\nimport { getApiBase, DEFAULT_API_BASE } from \"../config/api-base.js\";\nimport { RELAY_SECRET_HEADER, getRelaySecret } from \"../config/relay-secret.js\";\n\nconst RETRYABLE = new Set([429, 500, 502, 503, 504]);\nconst MAX_ATTEMPTS = 4;\n\n/** Resolved Cloudflare context for account-scoped calls. */\nexport interface Cf {\n  token: string;\n  accountId: string;\n}\n\ninterface CfEnvelope<T> {\n  success: boolean;\n  result: T;\n  result_info?: { page: number; total_pages?: number; per_page: number; count: number };\n  errors?: { message: string }[];\n}\n\n/** Token + account id required for tunnel ops. Throws actionably if unresolved. */\nexport function resolveCf(): Cf {\n  const creds = getCredentials();\n  if (!creds.accountId) {\n    throw new CliError(\"No Cloudflare account id resolved.\", {\n      hint: \"run `cloudtunnel login` (or set CLOUDFLARE_ACCOUNT_ID)\",\n    });\n  }\n  return { token: creds.apiToken, accountId: creds.accountId };\n}\n\nconst sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));\n\n/**\n * Single Cloudflare API call with backoff on 429/5xx (honors Retry-After).\n * Errors are sanitized — the bearer token is only ever sent in the header and\n * never appears in a thrown message.\n */\nexport async function cfRequest<T>(\n  token: string,\n  method: string,\n  path: string,\n  body?: unknown,\n): Promise<CfEnvelope<T>> {\n  // Base + relay secret resolved once per call (env → config → default). The\n  // secret header rides only when the base is actually a relay (non-default), so\n  // it's never sent to api.cloudflare.com; unset base ⇒ identical to today.\n  const base = getApiBase();\n  const viaRelay = base !== DEFAULT_API_BASE;\n  const secret = getRelaySecret();\n  const headers: Record<string, string> = {\n    Authorization: `Bearer ${token}`,\n    \"Content-Type\": \"application/json\",\n  };\n  if (secret && viaRelay) headers[RELAY_SECRET_HEADER] = secret;\n  for (let attempt = 0; ; attempt++) {\n    let res: Response;\n    try {\n      res = await fetch(`${base}${path}`, {\n        method,\n        headers,\n        body: body === undefined ? undefined : JSON.stringify(body),\n      });\n    } catch (err) {\n      const reason = fetchErrorReason(err);\n      say.debug(`[cf] ${method} ${base}${path} -> network error: ${reason}${viaRelay ? \" (relay)\" : \"\"}`);\n      throw new CliError(`Could not reach the Cloudflare API (${reason})${viaRelay ? ` via relay ${base}` : \"\"}.`, {\n        hint: viaRelay ? \"is the relay tunnel up and the base URL correct? run with CLOUDTUNNEL_DEBUG=1\" : undefined,\n      });\n    }\n    say.debug(`[cf] ${method} ${base}${path} -> ${res.status}${viaRelay ? \" (relay)\" : \"\"}`);\n    if (RETRYABLE.has(res.status) && attempt < MAX_ATTEMPTS) {\n      const retryAfter = Number(res.headers.get(\"retry-after\")) || 0;\n      await sleep(retryAfter > 0 ? retryAfter * 1000 : 2 ** attempt * 500);\n      continue;\n    }\n    const env = (await res.json().catch(() => ({}))) as CfEnvelope<T> & { error?: string };\n    if (!res.ok || !env.success) {\n      // A relay rejects with its own `{error}` shape (not CF's `{errors}`) — surface\n      // it so a relay/secret failure isn't misread as a Cloudflare API error.\n      if (viaRelay && env.error && !env.errors) {\n        throw new CliError(`Relay rejected the request (${res.status}): ${env.error}.`, {\n          status: res.status,\n          hint: res.status === 403 ? \"does CLOUDTUNNEL_RELAY_SECRET match the relay's secret?\" : `relay base: ${base}`,\n        });\n      }\n      const msg = env.errors?.[0]?.message ?? `HTTP ${res.status}`;\n      throw new CliError(`Cloudflare API error: ${msg}`, { status: res.status });\n    }\n    return env;\n  }\n}\n\n/**\n * Fetch every page of a list endpoint. Robust when `total_pages` is absent:\n * stops when a page returns fewer than per_page items.\n */\nexport async function cfPaginate<T>(token: string, basePath: string): Promise<T[]> {\n  const sep = basePath.includes(\"?\") ? \"&\" : \"?\";\n  const out: T[] = [];\n  for (let page = 1; ; page++) {\n    const env = await cfRequest<T[]>(token, \"GET\", `${basePath}${sep}per_page=50&page=${page}`);\n    const items = env.result ?? [];\n    out.push(...items);\n    const perPage = env.result_info?.per_page ?? 50;\n    const totalPages = env.result_info?.total_pages;\n    const more = totalPages ? page < totalPages : items.length === perPage;\n    if (items.length === 0 || !more) break;\n  }\n  return out;\n}\n"],"mappings":";;;;;;;;AAAA,OAAO,QAAQ;AAOR,IAAM,WAAN,cAAuB,MAAM;AAAA,EACzB;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EAET,YAAY,SAAiB,OAA8D,CAAC,GAAG;AAC7F,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,WAAW,KAAK,YAAY;AACjC,SAAK,OAAO,KAAK;AACjB,SAAK,SAAS,KAAK;AAAA,EACrB;AACF;AASO,SAAS,iBAAiB,KAAsB;AACrD,QAAM,QAAS,KAAyD;AACxE,SAAO,OAAO,QAAQ,OAAO,WAAY,KAAe,WAAW;AACrE;AAIO,SAAS,YAAY,KAAsB;AAChD,MAAI,eAAe,UAAU;AAC3B,YAAQ,MAAM,GAAG,IAAI,UAAK,IAAI,OAAO,EAAE,CAAC;AACxC,QAAI,IAAI,KAAM,SAAQ,MAAM,GAAG,IAAI,YAAO,IAAI,IAAI,EAAE,CAAC;AACrD,WAAO,IAAI;AAAA,EACb;AACA,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,UAAQ,MAAM,GAAG,IAAI,UAAK,OAAO,EAAE,CAAC;AACpC,UAAQ,MAAM,GAAG,IAAI,4DAAuD,CAAC;AAC7E,SAAO;AACT;;;AC/CA,OAAOA,SAAQ;AACf,OAAO,WAAW;AAClB,SAAS,QAAQ,WAAW,cAAc,OAAO,UAAU,MAAM,OAAO,QAAQ,eAAe;AAO/F,eAAsB,QAAQ,SAAmC;AAC/D,QAAM,SAAS,MAAM,aAAa,EAAE,QAAQ,CAAC;AAC7C,SAAO,CAAC,SAAS,MAAM,KAAK,WAAW;AACzC;AAGO,SAAS,YAAY,OAAuB;AACjD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,MAAM,SAAS,IAAI,MAAM,MAAM,EAAE,IAAI;AACnD,SAAO,2BAAO,KAAK;AACrB;AAGO,IAAM,MAAM;AAAA,EACjB,MAAM,CAAC,QAAgB,QAAQ,IAAI,GAAG;AAAA,EACtC,IAAI,CAAC,QAAgB,QAAQ,IAAIC,IAAG,MAAM,UAAK,GAAG,EAAE,CAAC;AAAA,EACrD,MAAM,CAAC,QAAgB,QAAQ,KAAKA,IAAG,OAAO,KAAK,GAAG,EAAE,CAAC;AAAA,EACzD,KAAK,CAAC,QAAgB,QAAQ,IAAIA,IAAG,IAAI,GAAG,CAAC;AAAA,EAC7C,MAAM,CAAC,QAAgB,QAAQ,IAAIA,IAAG,KAAK,UAAK,GAAG,EAAE,CAAC;AAAA;AAAA;AAAA,EAGtD,OAAO,CAAC,QAAgB;AACtB,QAAI,QAAQ,IAAI,kBAAmB,SAAQ,MAAMA,IAAG,IAAI,GAAG,CAAC;AAAA,EAC9D;AACF;AAEO,IAAM,MAAM,CAAC,MAAsBA,IAAG,IAAI,CAAC;AAG3C,SAAS,YAAY,MAAc,QAAwB;AAChE,SAAO,GAAGA,IAAG,MAAMA,IAAG,KAAK,WAAW,IAAI,EAAE,CAAC,CAAC,KAAKA,IAAG,IAAI,QAAG,CAAC,KAAKA,IAAG,KAAK,MAAM,CAAC;AACpF;AAGO,SAAS,WAAW,MAAgB,MAAwB;AACjE,QAAM,QAAQ,IAAI,MAAM;AAAA,IACtB,MAAM,KAAK,IAAI,CAAC,MAAMA,IAAG,KAAK,CAAC,CAAC;AAAA,IAChC,OAAO,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE;AAAA,EAChC,CAAC;AACD,aAAW,OAAO,KAAM,OAAM,KAAK,GAAG;AACtC,UAAQ,IAAI,MAAM,SAAS,CAAC;AAC9B;AAMA,eAAsB,UACpB,SACA,OACA,OACY;AAGZ,QAAM,QAAQ,MAAM,OAAO;AAAA,IACzB;AAAA,IACA,SAAS,MAAM,IAAI,CAAC,MAAM,OAAO,EAAE,OAAO,OAAO,CAAC,GAAG,OAAO,MAAM,IAAI,EAAE,EAAE;AAAA,EAC5E,CAAC;AACD,MAAI,SAAS,KAAK,GAAG;AACnB,WAAO,YAAY;AACnB,UAAM,IAAI,SAAS,cAAc,EAAE,UAAU,IAAI,CAAC;AAAA,EACpD;AACA,SAAO,MAAM,OAAO,KAAK,CAAC;AAC5B;;;ACxEA,SAAS,WAAW,cAAc,qBAAqB;;;ACAvD,OAAO,cAAc;AACrB,SAAS,iBAAiB;AAC1B,SAAS,YAAY;AAGrB,IAAM,QAAQ,SAAS,eAAe,EAAE,QAAQ,GAAG,CAAC;AAE7C,IAAM,YAAY,MAAM;AACxB,IAAM,aAAa,KAAK,WAAW,aAAa;AAChD,IAAM,eAAe,KAAK,WAAW,cAAc;AACnD,IAAM,gBAAgB,KAAK,WAAW,qBAAqB;AAC3D,IAAM,eAAe,KAAK,WAAW,eAAe;AACpD,IAAM,SAAS,KAAK,WAAW,KAAK;AACpC,IAAM,SAAS,KAAK,WAAW,MAAM;AAGrC,SAAS,aAAmB;AACjC,aAAW,OAAO,CAAC,WAAW,QAAQ,MAAM,GAAG;AAC7C,cAAU,KAAK,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAAA,EACjD;AACF;;;ADEO,SAAS,aAAgC;AAC9C,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,YAAY,MAAM,CAAC;AAAA,EACpD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAGO,SAAS,WAAW,QAAiC;AAC1D,aAAW;AACX,gBAAc,YAAY,KAAK,UAAU,QAAQ,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AAC1E,YAAU,YAAY,GAAK;AAC7B;AAMO,SAAS,iBAA8B;AAC5C,QAAM,SAAS,WAAW;AAC1B,QAAM,WAAW,QAAQ,IAAI,wBAAwB,OAAO;AAC5D,QAAM,YAAY,QAAQ,IAAI,yBAAyB,OAAO;AAC9D,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,SAAS,sCAAsC;AAAA,MACvD,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO,EAAE,UAAU,WAAW,aAAa,OAAO,YAAY;AAChE;;;AE9CO,IAAM,mBAAmB;AAWzB,SAAS,aAAqB;AAGnC,QAAM,OAAO,QAAQ,IAAI,sBAAsB,KAAK,KAAK,WAAW,EAAE,WAAW,kBAAkB,QAAQ,QAAQ,EAAE;AAGrH,MAAI,CAAC,UAAU,GAAG,GAAG;AACnB,UAAM,IAAI,SAAS,gCAAgC,GAAG,MAAM;AAAA,MAC1D,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAGO,SAAS,UAAU,GAAoB;AAC5C,MAAI;AACF,UAAM,IAAI,IAAI,IAAI,CAAC;AACnB,WAAO,EAAE,aAAa,WAAW,EAAE,aAAa;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACtCA,SAAS,mBAAmB;AAMrB,IAAM,sBAAsB;AAO5B,SAAS,iBAAqC;AACnD,SAAO,QAAQ,IAAI,4BAA4B,WAAW,EAAE;AAC9D;AASO,SAAS,oBAA4B;AAC1C,QAAM,WAAW,eAAe;AAChC,MAAI,SAAU,QAAO;AACrB,QAAM,SAAS,YAAY,EAAE,EAAE,SAAS,WAAW;AACnD,QAAM,OAAO,WAAW;AACxB,aAAW,EAAE,GAAG,MAAM,aAAa,OAAO,CAAC;AAC3C,SAAO;AACT;;;ACzBA,IAAM,YAAY,oBAAI,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AACnD,IAAM,eAAe;AAgBd,SAAS,YAAgB;AAC9B,QAAM,QAAQ,eAAe;AAC7B,MAAI,CAAC,MAAM,WAAW;AACpB,UAAM,IAAI,SAAS,sCAAsC;AAAA,MACvD,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO,EAAE,OAAO,MAAM,UAAU,WAAW,MAAM,UAAU;AAC7D;AAEA,IAAM,QAAQ,CAAC,OAAe,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAOlE,eAAsB,UACpB,OACA,QACA,MACA,MACwB;AAIxB,QAAM,OAAO,WAAW;AACxB,QAAM,WAAW,SAAS;AAC1B,QAAM,SAAS,eAAe;AAC9B,QAAM,UAAkC;AAAA,IACtC,eAAe,UAAU,KAAK;AAAA,IAC9B,gBAAgB;AAAA,EAClB;AACA,MAAI,UAAU,SAAU,SAAQ,mBAAmB,IAAI;AACvD,WAAS,UAAU,KAAK,WAAW;AACjC,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,GAAG,IAAI,GAAG,IAAI,IAAI;AAAA,QAClC;AAAA,QACA;AAAA,QACA,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI;AAAA,MAC5D,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,SAAS,iBAAiB,GAAG;AACnC,UAAI,MAAM,QAAQ,MAAM,IAAI,IAAI,GAAG,IAAI,sBAAsB,MAAM,GAAG,WAAW,aAAa,EAAE,EAAE;AAClG,YAAM,IAAI,SAAS,uCAAuC,MAAM,IAAI,WAAW,cAAc,IAAI,KAAK,EAAE,KAAK;AAAA,QAC3G,MAAM,WAAW,kFAAkF;AAAA,MACrG,CAAC;AAAA,IACH;AACA,QAAI,MAAM,QAAQ,MAAM,IAAI,IAAI,GAAG,IAAI,OAAO,IAAI,MAAM,GAAG,WAAW,aAAa,EAAE,EAAE;AACvF,QAAI,UAAU,IAAI,IAAI,MAAM,KAAK,UAAU,cAAc;AACvD,YAAM,aAAa,OAAO,IAAI,QAAQ,IAAI,aAAa,CAAC,KAAK;AAC7D,YAAM,MAAM,aAAa,IAAI,aAAa,MAAO,KAAK,UAAU,GAAG;AACnE;AAAA,IACF;AACA,UAAM,MAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAI,CAAC,IAAI,MAAM,CAAC,IAAI,SAAS;AAG3B,UAAI,YAAY,IAAI,SAAS,CAAC,IAAI,QAAQ;AACxC,cAAM,IAAI,SAAS,+BAA+B,IAAI,MAAM,MAAM,IAAI,KAAK,KAAK;AAAA,UAC9E,QAAQ,IAAI;AAAA,UACZ,MAAM,IAAI,WAAW,MAAM,4DAA4D,eAAe,IAAI;AAAA,QAC5G,CAAC;AAAA,MACH;AACA,YAAM,MAAM,IAAI,SAAS,CAAC,GAAG,WAAW,QAAQ,IAAI,MAAM;AAC1D,YAAM,IAAI,SAAS,yBAAyB,GAAG,IAAI,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3E;AACA,WAAO;AAAA,EACT;AACF;AAMA,eAAsB,WAAc,OAAe,UAAgC;AACjF,QAAM,MAAM,SAAS,SAAS,GAAG,IAAI,MAAM;AAC3C,QAAM,MAAW,CAAC;AAClB,WAAS,OAAO,KAAK,QAAQ;AAC3B,UAAM,MAAM,MAAM,UAAe,OAAO,OAAO,GAAG,QAAQ,GAAG,GAAG,oBAAoB,IAAI,EAAE;AAC1F,UAAM,QAAQ,IAAI,UAAU,CAAC;AAC7B,QAAI,KAAK,GAAG,KAAK;AACjB,UAAM,UAAU,IAAI,aAAa,YAAY;AAC7C,UAAM,aAAa,IAAI,aAAa;AACpC,UAAM,OAAO,aAAa,OAAO,aAAa,MAAM,WAAW;AAC/D,QAAI,MAAM,WAAW,KAAK,CAAC,KAAM;AAAA,EACnC;AACA,SAAO;AACT;","names":["pc","pc"]}
+{"version":3,"sources":["../src/ui/errors.ts","../src/ui/output.ts","../src/config/store.ts","../src/config/paths.ts","../src/config/api-base.ts","../src/config/relay-secret.ts","../src/cloudflare/client.ts"],"sourcesContent":["import pc from \"picocolors\";\n\n/**\n * A user-facing CLI error. The message is printed as-is (no stack trace) and\n * `exitCode` drives the process exit code. Use `hint` to tell the user exactly\n * which command to run next — every error should be actionable.\n */\nexport class CliError extends Error {\n  readonly exitCode: number;\n  readonly hint?: string;\n  /** HTTP status when this wraps a Cloudflare API error (lets callers tell a\n   * genuine 404 \"already gone\" from a transient failure). */\n  readonly status?: number;\n\n  constructor(message: string, opts: { exitCode?: number; hint?: string; status?: number } = {}) {\n    super(message);\n    this.name = \"CliError\";\n    this.exitCode = opts.exitCode ?? 1;\n    this.hint = opts.hint;\n    this.status = opts.status;\n  }\n}\n\n/**\n * Best-effort concise reason from a thrown `fetch`/undici error. Node's fetch\n * throws a generic `TypeError: fetch failed` and buries the real cause (DNS,\n * refused, TLS, timeout, bad URL) in `.cause` — surface it so \"network error\"\n * becomes actionable (e.g. `ENOTFOUND`, `ECONNREFUSED`, `UND_ERR_CONNECT_TIMEOUT`,\n * `self-signed certificate`, `Invalid URL`).\n */\nexport function fetchErrorReason(err: unknown): string {\n  const cause = (err as { cause?: { code?: string; message?: string } })?.cause;\n  return cause?.code ?? cause?.message ?? (err as Error)?.message ?? \"unknown\";\n}\n\n/** Print an error and return the exit code. Known CliErrors print cleanly; the\n * rest print their message plus a note that it was unexpected. */\nexport function reportError(err: unknown): number {\n  if (err instanceof CliError) {\n    console.error(pc.red(`✗ ${err.message}`));\n    if (err.hint) console.error(pc.dim(`  → ${err.hint}`));\n    return err.exitCode;\n  }\n  const message = err instanceof Error ? err.message : String(err);\n  console.error(pc.red(`✗ ${message}`));\n  console.error(pc.dim(\"  (unexpected error — please report if this persists)\"));\n  return 1;\n}\n","import pc from \"picocolors\";\nimport Table from \"cli-table3\";\nimport { cancel, confirm as clackConfirm, intro, isCancel, note, outro, select, spinner } from \"@clack/prompts\";\nimport { CliError } from \"./errors.js\";\n\n// Re-export the clack primitives used to build modern multi-step flows.\nexport { intro, note, outro, spinner };\n\n/** Yes/no prompt (TTY). Cancel (Ctrl-C) counts as \"no\". */\nexport async function confirm(message: string): Promise<boolean> {\n  const answer = await clackConfirm({ message });\n  return !isCancel(answer) && answer === true;\n}\n\n/** Redact a secret to `••••{last4}` so tokens never appear in output/logs. */\nexport function redactToken(token: string): string {\n  if (!token) return \"\";\n  const last4 = token.length > 4 ? token.slice(-4) : token;\n  return `••••${last4}`;\n}\n\n// Lightweight one-off lines for non-flow commands (ls, zones, status, …).\nexport const say = {\n  info: (msg: string) => console.log(msg),\n  ok: (msg: string) => console.log(pc.green(`✓ ${msg}`)),\n  warn: (msg: string) => console.warn(pc.yellow(`! ${msg}`)),\n  dim: (msg: string) => console.log(pc.dim(msg)),\n  step: (msg: string) => console.log(pc.cyan(`→ ${msg}`)),\n  // Opt-in request/diagnostic trace. Gated by CLOUDTUNNEL_DEBUG and written to\n  // STDERR so it never mixes into command stdout. Never pass a secret/token here.\n  debug: (msg: string) => {\n    if (process.env.CLOUDTUNNEL_DEBUG) console.error(pc.dim(msg));\n  },\n};\n\nexport const dim = (s: string): string => pc.dim(s);\n\n/** Format a live tunnel as `https://host  →  proto://localhost:port`. */\nexport function formatRoute(host: string, target: string): string {\n  return `${pc.green(pc.bold(`https://${host}`))}  ${pc.dim(\"→\")}  ${pc.cyan(target)}`;\n}\n\n/** Render a simple table. `head` = column titles, `rows` = string cells. */\nexport function printTable(head: string[], rows: string[][]): void {\n  const table = new Table({\n    head: head.map((h) => pc.bold(h)),\n    style: { head: [], border: [] },\n  });\n  for (const row of rows) table.push(row);\n  console.log(table.toString());\n}\n\n/**\n * Modern arrow-key single-select (↑/↓ to move, Enter to choose). Callers must\n * guard non-TTY before calling. Ctrl-C cancels cleanly (exit 130).\n */\nexport async function selectOne<T>(\n  message: string,\n  items: T[],\n  label: (item: T) => string,\n): Promise<T> {\n  // Use the item index as the (primitive) option value to avoid clack's\n  // conditional Option<T> type fighting the generic, then map back.\n  const value = await select({\n    message,\n    options: items.map((item, i) => ({ value: String(i), label: label(item) })),\n  });\n  if (isCancel(value)) {\n    cancel(\"Cancelled.\");\n    throw new CliError(\"Cancelled.\", { exitCode: 130 });\n  }\n  return items[Number(value)]!;\n}\n","import { chmodSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { CliError } from \"../ui/errors.js\";\nimport { configFile, ensureDirs } from \"./paths.js\";\n\nexport interface CloudtunnelConfig {\n  apiToken?: string;\n  accountId?: string;\n  defaultZone?: string;\n  /** Override the Cloudflare API base — point at a relay when the direct control\n   * plane is blocked. See `config/api-base.ts`. */\n  apiBase?: string;\n  /** Shared secret required by / sent to the relay proxy. See `config/relay-secret.ts`. */\n  relaySecret?: string;\n}\n\nexport interface Credentials {\n  apiToken: string;\n  accountId?: string;\n  defaultZone?: string;\n}\n\n/** Read config.json (missing/invalid → empty config, never throws). */\nexport function loadConfig(): CloudtunnelConfig {\n  try {\n    return JSON.parse(readFileSync(configFile, \"utf8\")) as CloudtunnelConfig;\n  } catch {\n    return {};\n  }\n}\n\n/** Persist config.json with owner-only perms (0600). */\nexport function saveConfig(config: CloudtunnelConfig): void {\n  ensureDirs();\n  writeFileSync(configFile, JSON.stringify(config, null, 2), { mode: 0o600 });\n  chmodSync(configFile, 0o600); // enforce even if the file pre-existed\n}\n\n/**\n * Resolve credentials: env vars override the config file. Throws an actionable\n * CliError if no API token is available anywhere.\n */\nexport function getCredentials(): Credentials {\n  const config = loadConfig();\n  const apiToken = process.env.CLOUDFLARE_API_TOKEN ?? config.apiToken;\n  const accountId = process.env.CLOUDFLARE_ACCOUNT_ID ?? config.accountId;\n  if (!apiToken) {\n    throw new CliError(\"Not authenticated with Cloudflare.\", {\n      hint: \"run `cloudtunnel login` (or set CLOUDFLARE_API_TOKEN)\",\n    });\n  }\n  return { apiToken, accountId, defaultZone: config.defaultZone };\n}\n","import envPaths from \"env-paths\";\nimport { mkdirSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\n// `~/.config/cloudtunnel/` (XDG). suffix:'' avoids env-paths' default \"-nodejs\".\nconst paths = envPaths(\"cloudtunnel\", { suffix: \"\" });\n\nexport const configDir = paths.config;\nexport const configFile = join(configDir, \"config.json\");\nexport const registryFile = join(configDir, \"tunnels.json\");\nexport const scanCacheFile = join(configDir, \"unmanaged-scan.json\");\nexport const profilesFile = join(configDir, \"profiles.json\");\nexport const binDir = join(configDir, \"bin\");\nexport const logDir = join(configDir, \"logs\");\n\n/** Create the app dirs with owner-only perms (secrets live here). Idempotent. */\nexport function ensureDirs(): void {\n  for (const dir of [configDir, binDir, logDir]) {\n    mkdirSync(dir, { recursive: true, mode: 0o700 });\n  }\n}\n","import { CliError } from \"../ui/errors.js\";\nimport { loadConfig } from \"./store.js\";\n\n/** Default Cloudflare management API base — no trailing slash (callers append a\n * path that starts with `/`). */\nexport const DEFAULT_API_BASE = \"https://api.cloudflare.com/client/v4\";\n\n/**\n * Resolve the Cloudflare API base URL. Precedence: env `CLOUDTUNNEL_API_BASE` →\n * `config.apiBase` → default. A trailing slash is stripped so `${base}${path}`\n * (path starts `/`) never yields `//…`.\n *\n * Point this at a relay's `https://<relay>/client/v4` when the direct control\n * plane (api.cloudflare.com) is blocked but a data-plane tunnel to the relay is\n * not — every management call then rides the tunnel instead of hitting CF direct.\n */\nexport function getApiBase(): string {\n  // `||` (not `??`) so an empty/whitespace env or config value falls through\n  // instead of yielding a broken \"\" base.\n  const raw = (process.env.CLOUDTUNNEL_API_BASE?.trim() || loadConfig().apiBase || DEFAULT_API_BASE).replace(/\\/+$/, \"\");\n  // Fail fast on a malformed base (e.g. a scheme-less host set via env) with a\n  // clear message instead of a cryptic `fetch` \"network error\" later.\n  if (!isHttpUrl(raw)) {\n    throw new CliError(`Invalid Cloudflare API base \"${raw}\".`, {\n      hint: \"CLOUDTUNNEL_API_BASE must be a full http(s) URL, e.g. https://cfapi.example.com/client/v4\",\n    });\n  }\n  return raw;\n}\n\n/** True if `s` parses as an http(s) URL — validates `login --api-base`. */\nexport function isHttpUrl(s: string): boolean {\n  try {\n    const u = new URL(s);\n    return u.protocol === \"http:\" || u.protocol === \"https:\";\n  } catch {\n    return false;\n  }\n}\n","import { randomBytes } from \"node:crypto\";\nimport { loadConfig, saveConfig } from \"./store.js\";\n\n/** Header the CLIENT sends and the RELAY requires — the relay's shared secret.\n * Single source of truth, imported by both the client transport and the relay\n * proxy so the two sides can never drift. */\nexport const RELAY_SECRET_HEADER = \"X-CT-Relay-Secret\";\n\n/**\n * The relay shared secret, if configured. Precedence: env\n * `CLOUDTUNNEL_RELAY_SECRET` → `config.relaySecret` → undefined. The CLIENT\n * attaches it to every CF API call; the RELAY rejects calls that lack it.\n */\nexport function getRelaySecret(): string | undefined {\n  return process.env.CLOUDTUNNEL_RELAY_SECRET ?? loadConfig().relaySecret;\n}\n\n/**\n * Return the relay secret, generating + persisting one on first use so a restart\n * or boot service keeps the same value (a changed secret would break the client).\n * Persisted to 0600 config via a MERGE-save (never clobbers apiToken/apiBase).\n * An env-provided secret is returned as-is — env stays the source of truth and\n * nothing is written.\n */\nexport function ensureRelaySecret(): string {\n  const existing = getRelaySecret();\n  if (existing) return existing;\n  const secret = randomBytes(24).toString(\"base64url\"); // 192-bit, url-safe\n  const prev = loadConfig();\n  saveConfig({ ...prev, relaySecret: secret });\n  return secret;\n}\n","import { CliError, fetchErrorReason } from \"../ui/errors.js\";\nimport { say } from \"../ui/output.js\";\nimport { getCredentials } from \"../config/store.js\";\nimport { getApiBase, DEFAULT_API_BASE } from \"../config/api-base.js\";\nimport { RELAY_SECRET_HEADER, getRelaySecret } from \"../config/relay-secret.js\";\n\nconst RETRYABLE = new Set([429, 500, 502, 503, 504]);\nconst MAX_ATTEMPTS = 4;\n\n/** Resolved Cloudflare context for account-scoped calls. */\nexport interface Cf {\n  token: string;\n  accountId: string;\n}\n\ninterface CfEnvelope<T> {\n  success: boolean;\n  result: T;\n  result_info?: { page: number; total_pages?: number; per_page: number; count: number };\n  errors?: { message: string }[];\n}\n\n/** Token + account id required for tunnel ops. Throws actionably if unresolved. */\nexport function resolveCf(): Cf {\n  const creds = getCredentials();\n  if (!creds.accountId) {\n    throw new CliError(\"No Cloudflare account id resolved.\", {\n      hint: \"run `cloudtunnel login` (or set CLOUDFLARE_ACCOUNT_ID)\",\n    });\n  }\n  return { token: creds.apiToken, accountId: creds.accountId };\n}\n\nconst sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));\n\n/**\n * Single Cloudflare API call with backoff on network dropouts and 429/5xx (honors Retry-After).\n * Errors are sanitized — the bearer token is only ever sent in the header and\n * never appears in a thrown message.\n */\nexport async function cfRequest<T>(\n  token: string,\n  method: string,\n  path: string,\n  body?: unknown,\n): Promise<CfEnvelope<T>> {\n  const base = getApiBase();\n  const viaRelay = base !== DEFAULT_API_BASE;\n  const secret = getRelaySecret();\n  const headers: Record<string, string> = {\n    Authorization: `Bearer ${token}`,\n    \"Content-Type\": \"application/json\",\n  };\n  if (secret && viaRelay) headers[RELAY_SECRET_HEADER] = secret;\n  for (let attempt = 0; ; attempt++) {\n    let res: Response;\n    try {\n      res = await fetch(`${base}${path}`, {\n        method,\n        headers,\n        body: body === undefined ? undefined : JSON.stringify(body),\n      });\n    } catch (err) {\n      const reason = fetchErrorReason(err);\n      say.debug(`[cf] ${method} ${base}${path} -> network error: ${reason}${viaRelay ? \" (relay)\" : \"\"}`);\n      if (attempt < MAX_ATTEMPTS) {\n        await sleep(2 ** attempt * 500);\n        continue;\n      }\n      throw new CliError(`Could not reach the Cloudflare API (${reason})${viaRelay ? ` via relay ${base}` : \"\"}.`, {\n        hint: viaRelay ? \"is the relay tunnel up and the base URL correct? run with CLOUDTUNNEL_DEBUG=1\" : undefined,\n      });\n    }\n    say.debug(`[cf] ${method} ${base}${path} -> ${res.status}${viaRelay ? \" (relay)\" : \"\"}`);\n    if (RETRYABLE.has(res.status) && attempt < MAX_ATTEMPTS) {\n      const retryAfter = Number(res.headers.get(\"retry-after\")) || 0;\n      await sleep(retryAfter > 0 ? retryAfter * 1000 : 2 ** attempt * 500);\n      continue;\n    }\n    const env = (await res.json().catch(() => ({}))) as CfEnvelope<T> & { error?: string };\n    if (!res.ok || !env.success) {\n      if (viaRelay && env.error && !env.errors) {\n        throw new CliError(`Relay rejected the request (${res.status}): ${env.error}.`, {\n          status: res.status,\n          hint: res.status === 403 ? \"does CLOUDTUNNEL_RELAY_SECRET match the relay's secret?\" : `relay base: ${base}`,\n        });\n      }\n      const msg = env.errors?.[0]?.message ?? `HTTP ${res.status}`;\n      throw new CliError(`Cloudflare API error: ${msg}`, { status: res.status });\n    }\n    return env;\n  }\n}\n\n/**\n * Fetch every page of a list endpoint. Robust when `total_pages` is absent:\n * stops when a page returns fewer than per_page items.\n */\nexport async function cfPaginate<T>(token: string, basePath: string): Promise<T[]> {\n  const sep = basePath.includes(\"?\") ? \"&\" : \"?\";\n  const out: T[] = [];\n  for (let page = 1; ; page++) {\n    const env = await cfRequest<T[]>(token, \"GET\", `${basePath}${sep}per_page=50&page=${page}`);\n    const items = env.result ?? [];\n    out.push(...items);\n    const perPage = env.result_info?.per_page ?? 50;\n    const totalPages = env.result_info?.total_pages;\n    const more = totalPages ? page < totalPages : items.length === perPage;\n    if (items.length === 0 || !more) break;\n  }\n  return out;\n}\n"],"mappings":";;;;;;;;AAAA,OAAO,QAAQ;AAOR,IAAM,WAAN,cAAuB,MAAM;AAAA,EACzB;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EAET,YAAY,SAAiB,OAA8D,CAAC,GAAG;AAC7F,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,WAAW,KAAK,YAAY;AACjC,SAAK,OAAO,KAAK;AACjB,SAAK,SAAS,KAAK;AAAA,EACrB;AACF;AASO,SAAS,iBAAiB,KAAsB;AACrD,QAAM,QAAS,KAAyD;AACxE,SAAO,OAAO,QAAQ,OAAO,WAAY,KAAe,WAAW;AACrE;AAIO,SAAS,YAAY,KAAsB;AAChD,MAAI,eAAe,UAAU;AAC3B,YAAQ,MAAM,GAAG,IAAI,UAAK,IAAI,OAAO,EAAE,CAAC;AACxC,QAAI,IAAI,KAAM,SAAQ,MAAM,GAAG,IAAI,YAAO,IAAI,IAAI,EAAE,CAAC;AACrD,WAAO,IAAI;AAAA,EACb;AACA,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,UAAQ,MAAM,GAAG,IAAI,UAAK,OAAO,EAAE,CAAC;AACpC,UAAQ,MAAM,GAAG,IAAI,4DAAuD,CAAC;AAC7E,SAAO;AACT;;;AC/CA,OAAOA,SAAQ;AACf,OAAO,WAAW;AAClB,SAAS,QAAQ,WAAW,cAAc,OAAO,UAAU,MAAM,OAAO,QAAQ,eAAe;AAO/F,eAAsB,QAAQ,SAAmC;AAC/D,QAAM,SAAS,MAAM,aAAa,EAAE,QAAQ,CAAC;AAC7C,SAAO,CAAC,SAAS,MAAM,KAAK,WAAW;AACzC;AAGO,SAAS,YAAY,OAAuB;AACjD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,QAAQ,MAAM,SAAS,IAAI,MAAM,MAAM,EAAE,IAAI;AACnD,SAAO,2BAAO,KAAK;AACrB;AAGO,IAAM,MAAM;AAAA,EACjB,MAAM,CAAC,QAAgB,QAAQ,IAAI,GAAG;AAAA,EACtC,IAAI,CAAC,QAAgB,QAAQ,IAAIC,IAAG,MAAM,UAAK,GAAG,EAAE,CAAC;AAAA,EACrD,MAAM,CAAC,QAAgB,QAAQ,KAAKA,IAAG,OAAO,KAAK,GAAG,EAAE,CAAC;AAAA,EACzD,KAAK,CAAC,QAAgB,QAAQ,IAAIA,IAAG,IAAI,GAAG,CAAC;AAAA,EAC7C,MAAM,CAAC,QAAgB,QAAQ,IAAIA,IAAG,KAAK,UAAK,GAAG,EAAE,CAAC;AAAA;AAAA;AAAA,EAGtD,OAAO,CAAC,QAAgB;AACtB,QAAI,QAAQ,IAAI,kBAAmB,SAAQ,MAAMA,IAAG,IAAI,GAAG,CAAC;AAAA,EAC9D;AACF;AAEO,IAAM,MAAM,CAAC,MAAsBA,IAAG,IAAI,CAAC;AAG3C,SAAS,YAAY,MAAc,QAAwB;AAChE,SAAO,GAAGA,IAAG,MAAMA,IAAG,KAAK,WAAW,IAAI,EAAE,CAAC,CAAC,KAAKA,IAAG,IAAI,QAAG,CAAC,KAAKA,IAAG,KAAK,MAAM,CAAC;AACpF;AAGO,SAAS,WAAW,MAAgB,MAAwB;AACjE,QAAM,QAAQ,IAAI,MAAM;AAAA,IACtB,MAAM,KAAK,IAAI,CAAC,MAAMA,IAAG,KAAK,CAAC,CAAC;AAAA,IAChC,OAAO,EAAE,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE;AAAA,EAChC,CAAC;AACD,aAAW,OAAO,KAAM,OAAM,KAAK,GAAG;AACtC,UAAQ,IAAI,MAAM,SAAS,CAAC;AAC9B;AAMA,eAAsB,UACpB,SACA,OACA,OACY;AAGZ,QAAM,QAAQ,MAAM,OAAO;AAAA,IACzB;AAAA,IACA,SAAS,MAAM,IAAI,CAAC,MAAM,OAAO,EAAE,OAAO,OAAO,CAAC,GAAG,OAAO,MAAM,IAAI,EAAE,EAAE;AAAA,EAC5E,CAAC;AACD,MAAI,SAAS,KAAK,GAAG;AACnB,WAAO,YAAY;AACnB,UAAM,IAAI,SAAS,cAAc,EAAE,UAAU,IAAI,CAAC;AAAA,EACpD;AACA,SAAO,MAAM,OAAO,KAAK,CAAC;AAC5B;;;ACxEA,SAAS,WAAW,cAAc,qBAAqB;;;ACAvD,OAAO,cAAc;AACrB,SAAS,iBAAiB;AAC1B,SAAS,YAAY;AAGrB,IAAM,QAAQ,SAAS,eAAe,EAAE,QAAQ,GAAG,CAAC;AAE7C,IAAM,YAAY,MAAM;AACxB,IAAM,aAAa,KAAK,WAAW,aAAa;AAChD,IAAM,eAAe,KAAK,WAAW,cAAc;AACnD,IAAM,gBAAgB,KAAK,WAAW,qBAAqB;AAC3D,IAAM,eAAe,KAAK,WAAW,eAAe;AACpD,IAAM,SAAS,KAAK,WAAW,KAAK;AACpC,IAAM,SAAS,KAAK,WAAW,MAAM;AAGrC,SAAS,aAAmB;AACjC,aAAW,OAAO,CAAC,WAAW,QAAQ,MAAM,GAAG;AAC7C,cAAU,KAAK,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAAA,EACjD;AACF;;;ADEO,SAAS,aAAgC;AAC9C,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,YAAY,MAAM,CAAC;AAAA,EACpD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAGO,SAAS,WAAW,QAAiC;AAC1D,aAAW;AACX,gBAAc,YAAY,KAAK,UAAU,QAAQ,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AAC1E,YAAU,YAAY,GAAK;AAC7B;AAMO,SAAS,iBAA8B;AAC5C,QAAM,SAAS,WAAW;AAC1B,QAAM,WAAW,QAAQ,IAAI,wBAAwB,OAAO;AAC5D,QAAM,YAAY,QAAQ,IAAI,yBAAyB,OAAO;AAC9D,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,SAAS,sCAAsC;AAAA,MACvD,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO,EAAE,UAAU,WAAW,aAAa,OAAO,YAAY;AAChE;;;AE9CO,IAAM,mBAAmB;AAWzB,SAAS,aAAqB;AAGnC,QAAM,OAAO,QAAQ,IAAI,sBAAsB,KAAK,KAAK,WAAW,EAAE,WAAW,kBAAkB,QAAQ,QAAQ,EAAE;AAGrH,MAAI,CAAC,UAAU,GAAG,GAAG;AACnB,UAAM,IAAI,SAAS,gCAAgC,GAAG,MAAM;AAAA,MAC1D,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAGO,SAAS,UAAU,GAAoB;AAC5C,MAAI;AACF,UAAM,IAAI,IAAI,IAAI,CAAC;AACnB,WAAO,EAAE,aAAa,WAAW,EAAE,aAAa;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACtCA,SAAS,mBAAmB;AAMrB,IAAM,sBAAsB;AAO5B,SAAS,iBAAqC;AACnD,SAAO,QAAQ,IAAI,4BAA4B,WAAW,EAAE;AAC9D;AASO,SAAS,oBAA4B;AAC1C,QAAM,WAAW,eAAe;AAChC,MAAI,SAAU,QAAO;AACrB,QAAM,SAAS,YAAY,EAAE,EAAE,SAAS,WAAW;AACnD,QAAM,OAAO,WAAW;AACxB,aAAW,EAAE,GAAG,MAAM,aAAa,OAAO,CAAC;AAC3C,SAAO;AACT;;;ACzBA,IAAM,YAAY,oBAAI,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AACnD,IAAM,eAAe;AAgBd,SAAS,YAAgB;AAC9B,QAAM,QAAQ,eAAe;AAC7B,MAAI,CAAC,MAAM,WAAW;AACpB,UAAM,IAAI,SAAS,sCAAsC;AAAA,MACvD,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO,EAAE,OAAO,MAAM,UAAU,WAAW,MAAM,UAAU;AAC7D;AAEA,IAAM,QAAQ,CAAC,OAAe,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAOlE,eAAsB,UACpB,OACA,QACA,MACA,MACwB;AACxB,QAAM,OAAO,WAAW;AACxB,QAAM,WAAW,SAAS;AAC1B,QAAM,SAAS,eAAe;AAC9B,QAAM,UAAkC;AAAA,IACtC,eAAe,UAAU,KAAK;AAAA,IAC9B,gBAAgB;AAAA,EAClB;AACA,MAAI,UAAU,SAAU,SAAQ,mBAAmB,IAAI;AACvD,WAAS,UAAU,KAAK,WAAW;AACjC,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,GAAG,IAAI,GAAG,IAAI,IAAI;AAAA,QAClC;AAAA,QACA;AAAA,QACA,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI;AAAA,MAC5D,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,SAAS,iBAAiB,GAAG;AACnC,UAAI,MAAM,QAAQ,MAAM,IAAI,IAAI,GAAG,IAAI,sBAAsB,MAAM,GAAG,WAAW,aAAa,EAAE,EAAE;AAClG,UAAI,UAAU,cAAc;AAC1B,cAAM,MAAM,KAAK,UAAU,GAAG;AAC9B;AAAA,MACF;AACA,YAAM,IAAI,SAAS,uCAAuC,MAAM,IAAI,WAAW,cAAc,IAAI,KAAK,EAAE,KAAK;AAAA,QAC3G,MAAM,WAAW,kFAAkF;AAAA,MACrG,CAAC;AAAA,IACH;AACA,QAAI,MAAM,QAAQ,MAAM,IAAI,IAAI,GAAG,IAAI,OAAO,IAAI,MAAM,GAAG,WAAW,aAAa,EAAE,EAAE;AACvF,QAAI,UAAU,IAAI,IAAI,MAAM,KAAK,UAAU,cAAc;AACvD,YAAM,aAAa,OAAO,IAAI,QAAQ,IAAI,aAAa,CAAC,KAAK;AAC7D,YAAM,MAAM,aAAa,IAAI,aAAa,MAAO,KAAK,UAAU,GAAG;AACnE;AAAA,IACF;AACA,UAAM,MAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAI,CAAC,IAAI,MAAM,CAAC,IAAI,SAAS;AAC3B,UAAI,YAAY,IAAI,SAAS,CAAC,IAAI,QAAQ;AACxC,cAAM,IAAI,SAAS,+BAA+B,IAAI,MAAM,MAAM,IAAI,KAAK,KAAK;AAAA,UAC9E,QAAQ,IAAI;AAAA,UACZ,MAAM,IAAI,WAAW,MAAM,4DAA4D,eAAe,IAAI;AAAA,QAC5G,CAAC;AAAA,MACH;AACA,YAAM,MAAM,IAAI,SAAS,CAAC,GAAG,WAAW,QAAQ,IAAI,MAAM;AAC1D,YAAM,IAAI,SAAS,yBAAyB,GAAG,IAAI,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3E;AACA,WAAO;AAAA,EACT;AACF;AAMA,eAAsB,WAAc,OAAe,UAAgC;AACjF,QAAM,MAAM,SAAS,SAAS,GAAG,IAAI,MAAM;AAC3C,QAAM,MAAW,CAAC;AAClB,WAAS,OAAO,KAAK,QAAQ;AAC3B,UAAM,MAAM,MAAM,UAAe,OAAO,OAAO,GAAG,QAAQ,GAAG,GAAG,oBAAoB,IAAI,EAAE;AAC1F,UAAM,QAAQ,IAAI,UAAU,CAAC;AAC7B,QAAI,KAAK,GAAG,KAAK;AACjB,UAAM,UAAU,IAAI,aAAa,YAAY;AAC7C,UAAM,aAAa,IAAI,aAAa;AACpC,UAAM,OAAO,aAAa,OAAO,aAAa,MAAM,WAAW;AAC/D,QAAI,MAAM,WAAW,KAAK,CAAC,KAAM;AAAA,EACnC;AACA,SAAO;AACT;","names":["pc","pc"]}

package/dist/{chunk-IDTF7SUY.js → chunk-ABLZ7XRZ.js}

@@ -3,7 +3,7 @@ import {
   CliError,
   cfPaginate,
   cfRequest
-} from "./chunk-ZIUYW2HQ.js";
+} from "./chunk-7XACBYL7.js";
 
 // src/cloudflare/dns.ts
 var MANAGED_DNS_COMMENT = "managed-by:cloudtunnel";
@@ -54,4 +54,4 @@ export {
   listCargoCnames,
   deleteDnsRecord
 };
-//# sourceMappingURL=chunk-IDTF7SUY.js.map
+//# sourceMappingURL=chunk-ABLZ7XRZ.js.map

package/dist/{chunk-NB3OEY2P.js → chunk-OT3UCBBF.js}

@@ -3,7 +3,7 @@ import {
   CliError,
   cfPaginate,
   cfRequest
-} from "./chunk-ZIUYW2HQ.js";
+} from "./chunk-7XACBYL7.js";
 
 // src/cloudflare/zones.ts
 function listZones(token) {
@@ -24,4 +24,4 @@ export {
   listZones,
   resolveZone
 };
-//# sourceMappingURL=chunk-NB3OEY2P.js.map
+//# sourceMappingURL=chunk-OT3UCBBF.js.map

package/dist/{dns-2F5SYQNX.js → dns-DKPXBRCH.js}

@@ -7,8 +7,8 @@ import {
   findCname,
   isManagedDns,
   listCargoCnames
-} from "./chunk-IDTF7SUY.js";
-import "./chunk-ZIUYW2HQ.js";
+} from "./chunk-ABLZ7XRZ.js";
+import "./chunk-7XACBYL7.js";
 export {
   MANAGED_DNS_COMMENT,
   cargoTarget,
@@ -18,4 +18,4 @@ export {
   isManagedDns,
   listCargoCnames
 };
-//# sourceMappingURL=dns-2F5SYQNX.js.map
+//# sourceMappingURL=dns-DKPXBRCH.js.map

package/dist/index.js

@@ -2,13 +2,13 @@
 import {
   listZones,
   resolveZone
-} from "./chunk-NB3OEY2P.js";
+} from "./chunk-OT3UCBBF.js";
 import {
   createCname,
   deleteDnsRecord,
   findCname,
   isManagedDns
-} from "./chunk-IDTF7SUY.js";
+} from "./chunk-ABLZ7XRZ.js";
 import {
   CliError,
   DEFAULT_API_BASE,
@@ -41,7 +41,7 @@ import {
   say,
   scanCacheFile,
   selectOne
-} from "./chunk-ZIUYW2HQ.js";
+} from "./chunk-7XACBYL7.js";
 
 // src/index.ts
 import { Command } from "commander";
@@ -143,18 +143,22 @@ function buildUpArgs(p) {
       "-d",
       p.zone,
       ...p.proto === "https" ? ["--proto", "https"] : [],
+      "--keep-alive",
       "-f",
       "-y"
     ];
   }
   const spec = formatTunnelSpec({ subdomain: p.subdomain, port: p.port, host: p.host });
+  const proto = p.protocol ?? "http2";
   return [
     "up",
     spec,
     "-d",
     p.zone,
     ...p.proto === "https" ? ["--proto", "https"] : [],
-    ...p.protocol ? ["--protocol", p.protocol] : [],
+    "--protocol",
+    proto,
+    "--keep-alive",
     "-f",
     "-y"
   ];
@@ -204,6 +208,7 @@ function buildUnit(d) {
     `Description=cloudtunnel ${d.fqdn} (Cloudflare Tunnel)`,
     "After=network-online.target",
     "Wants=network-online.target",
+    "StartLimitIntervalSec=0",
     "",
     "[Service]",
     "Type=simple",
@@ -211,7 +216,7 @@ function buildUnit(d) {
     `Environment=HOME=${d.home}`,
     `Environment=PATH=${nodeBin}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`,
     `ExecStart=${d.nodePath} ${d.scriptPath} ${d.argv.join(" ")}`,
-    "Restart=on-failure",
+    "Restart=always",
     "RestartSec=5",
     "",
     "[Install]",
@@ -297,7 +302,7 @@ var xml = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&
 function buildPlist(d) {
   const args = [d.nodePath, d.scriptPath, ...d.argv].map((a) => `    <string>${xml(a)}</string>`).join("\n");
   const nodeBin = dirname2(d.nodePath);
-  const path = `${nodeBin}:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin`;
+  const path = `${nodeBin}:/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin`;
   return [
     '<?xml version="1.0" encoding="UTF-8"?>',
     '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
@@ -381,7 +386,7 @@ function buildTaskXml(d) {
     "    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>",
     "    <StartWhenAvailable>true</StartWhenAvailable>",
     "    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>",
-    "    <RestartOnFailure><Interval>PT1M</Interval><Count>3</Count></RestartOnFailure>",
+    "    <RestartOnFailure><Interval>PT1M</Interval><Count>999</Count></RestartOnFailure>",
     "    <Enabled>true</Enabled>",
     "  </Settings>",
     '  <Actions Context="Author">',
@@ -937,6 +942,7 @@ function extractTgz(bytes) {
 
 // src/core/up-runner.ts
 import { join as join7 } from "path";
+import { readFileSync as readFileSync6, existsSync as existsSync7 } from "fs";
 import * as clack2 from "@clack/prompts";
 
 // src/connector/process.ts
@@ -1063,7 +1069,7 @@ async function reconcile() {
 // src/connector/process.ts
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 function startConnector(opts) {
-  const args = ["tunnel", "run"];
+  const args = ["tunnel", "run", "--metrics", "127.0.0.1:0"];
   if (opts.protocol) args.push("--protocol", opts.protocol);
   const env = { ...process.env, TUNNEL_TOKEN: opts.token };
   const fd = openSync(opts.logFile, "a", 384);
@@ -1171,6 +1177,34 @@ async function waitHealthy(cf, tunnelId, opts = {}) {
   }
   return opts.signal?.aborted ? "dead" : "provisioning";
 }
+function extractMetricsPort(log) {
+  const matches = [...log.matchAll(/Starting metrics server on 127\.0\.0\.1:(\d+)\/metrics/g)];
+  if (!matches.length) return void 0;
+  const last = matches[matches.length - 1];
+  const port = Number(last?.[1]);
+  return Number.isInteger(port) && port > 0 && port <= 65535 ? port : void 0;
+}
+async function checkLocalReady(port, opts = {}) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 2e3);
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}/ready`, { signal: controller.signal });
+    if (!res.ok) return { healthy: false, readyConnections: 0, status: res.status };
+    const data = await res.json().catch(() => ({}));
+    const readyConnections = Number(data.readyConnections) || 0;
+    return { healthy: readyConnections > 0, readyConnections, status: res.status };
+  } catch {
+    return { healthy: false, readyConnections: 0 };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function probeEntryState(entry, gone) {
+  if (gone || entry.state !== "running" || !entry.pid) return "down";
+  if (!entry.metricsPort) return "up";
+  const ready = await checkLocalReady(entry.metricsPort, { timeoutMs: 300 });
+  return ready.healthy ? "up" : "reconnecting";
+}
 
 // src/core/orchestrator-create.ts
 import { randomInt as randomInt2 } from "crypto";
@@ -1432,8 +1466,8 @@ async function resolveRemoteTarget(cf, target) {
   }
   const tunnel = matches[0];
   if (!tunnel) return null;
-  const { listCargoCnames } = await import("./dns-2F5SYQNX.js");
-  const { listZones: listZones3 } = await import("./zones-PCUEPXHD.js");
+  const { listCargoCnames } = await import("./dns-DKPXBRCH.js");
+  const { listZones: listZones3 } = await import("./zones-XNCXYCB4.js");
   for (const zone of await listZones3(cf.token)) {
     const rec = (await listCargoCnames(cf.token, zone.id)).find((r) => tunnelIdFromCname2(r.content) === tunnel.id);
     if (rec) return { tunnel, fqdn: rec.name };
@@ -1454,24 +1488,25 @@ async function removeTunnelById(cf, tunnel, opts = {}) {
 async function listAll(cf, opts = {}) {
   const entries = await reconcile();
   const tunnels = new Map((await listTunnels(cf)).map((t) => [t.id, t]));
-  const rows = entries.map((e) => {
+  const rows = await Promise.all(entries.map(async (e) => {
     const fqdn = entryFqdn(e);
     const gone = e.tunnelId ? !tunnels.has(e.tunnelId) : false;
     const svc = serviceState(fqdn);
+    const state4 = await probeEntryState(e, gone);
     return {
       num: e.index ? String(e.index) : "-",
       url: `https://${fqdn}`,
       target: serviceUrl(e.proto, e.host ?? "localhost", e.port),
       protocol: e.protocol ?? "auto",
-      state: !gone && e.state === "running" ? "up" : "down",
+      state: state4,
       service: svc === "none" ? "-" : svc,
       pid: e.state === "running" && e.pid ? String(e.pid) : "-",
       managed: true
     };
-  });
+  }));
   if (opts.all) {
-    const { listCargoCnames } = await import("./dns-2F5SYQNX.js");
-    const { listZones: listZones3 } = await import("./zones-PCUEPXHD.js");
+    const { listCargoCnames } = await import("./dns-DKPXBRCH.js");
+    const { listZones: listZones3 } = await import("./zones-XNCXYCB4.js");
     const tracked = new Set(entries.map(entryFqdn));
     const unmanaged = [];
     for (const zone of await listZones3(cf.token)) {
@@ -1492,9 +1527,141 @@ async function listAll(cf, opts = {}) {
   return rows;
 }
 
+// src/core/watchdog.ts
+import { readFileSync as readFileSync5, existsSync as existsSync6 } from "fs";
+var activeWatchdogs = /* @__PURE__ */ new Map();
+var sleep3 = (ms) => new Promise((r) => setTimeout(r, ms));
+function resolveMetricsPort(logFile, fallback) {
+  if (existsSync6(logFile)) {
+    try {
+      const port = extractMetricsPort(readFileSync5(logFile, "utf8"));
+      if (port) return port;
+    } catch {
+    }
+  }
+  return fallback;
+}
+async function verifyRemoteTunnel(cf, tunnelId) {
+  try {
+    await getTunnel(cf, tunnelId);
+    return true;
+  } catch (err) {
+    if (err instanceof CliError && err.status === 404) return false;
+    return true;
+  }
+}
+async function tier1Restart(ctx, state4) {
+  state4.lastRestartAt = Date.now();
+  state4.tier1Restarts++;
+  say.warn(`[watchdog] Health check failed for ${ctx.fqdn} -> restarting connector (Tier 1)...`);
+  await stopConnector({ pid: ctx.pid, bootId: currentBootId() });
+  const conn = startConnector({
+    bin: ctx.bin,
+    token: ctx.token,
+    detach: false,
+    logFile: ctx.logFile,
+    protocol: ctx.protocol,
+    onExit: () => {
+      void onConnectorExited(ctx.fqdn);
+    }
+  });
+  ctx.pid = conn.pid;
+  await sleep3(1e3);
+  ctx.metricsPort = resolveMetricsPort(ctx.logFile, ctx.metricsPort);
+  await patchEntry(ctx.fqdn, { pid: conn.pid, metricsPort: ctx.metricsPort, bootId: currentBootId() });
+  state4.consecutiveFailures = 0;
+}
+async function tier2Reprovision(ctx, state4) {
+  state4.lastRestartAt = Date.now();
+  state4.tier2Restarts++;
+  say.warn(`[watchdog] Tunnel missing or unrecoverable for ${ctx.fqdn} -> re-provisioning (Tier 2)...`);
+  await stopConnector({ pid: ctx.pid, bootId: currentBootId() });
+  const result = await createTunnelSubdomain(ctx.cf, { ...ctx.item, force: true, yes: true });
+  ctx.tunnelId = result.tunnelId;
+  ctx.token = result.token;
+  const conn = startConnector({
+    bin: ctx.bin,
+    token: ctx.token,
+    detach: false,
+    logFile: ctx.logFile,
+    protocol: ctx.protocol,
+    onExit: () => {
+      void onConnectorExited(ctx.fqdn);
+    }
+  });
+  ctx.pid = conn.pid;
+  await sleep3(1e3);
+  ctx.metricsPort = resolveMetricsPort(ctx.logFile, ctx.metricsPort);
+  await patchEntry(ctx.fqdn, { pid: conn.pid, metricsPort: ctx.metricsPort, bootId: currentBootId(), tunnelId: ctx.tunnelId });
+  state4.consecutiveFailures = 0;
+  state4.tier1Restarts = 0;
+}
+async function onConnectorExited(fqdn) {
+  const item = activeWatchdogs.get(fqdn);
+  if (!item) return;
+  const { ctx, state: state4 } = item;
+  if (Date.now() - state4.lastRestartAt < 5e3) return;
+  await tier1Restart(ctx, state4);
+}
+function startTunnelWatchdog(ctx, opts = {}) {
+  stopTunnelWatchdog(ctx.fqdn);
+  const intervalMs = opts.intervalMs ?? 15e3;
+  const cooldownMs = opts.cooldownMs ?? 5e3;
+  const state4 = { consecutiveFailures: 0, tier1Restarts: 0, tier2Restarts: 0, lastRestartAt: 0 };
+  const check = async () => {
+    if (!ctx.metricsPort) ctx.metricsPort = resolveMetricsPort(ctx.logFile, ctx.metricsPort);
+    let healthy = false;
+    if (ctx.metricsPort) {
+      const res = await checkLocalReady(ctx.metricsPort);
+      healthy = res.healthy;
+    }
+    if (healthy) {
+      state4.consecutiveFailures = 0;
+      return;
+    }
+    state4.consecutiveFailures++;
+    if (state4.consecutiveFailures >= 3 && Date.now() - state4.lastRestartAt >= cooldownMs) {
+      const remoteExists = await verifyRemoteTunnel(ctx.cf, ctx.tunnelId);
+      if (!remoteExists || state4.tier1Restarts >= 3) {
+        await tier2Reprovision(ctx, state4);
+      } else {
+        await tier1Restart(ctx, state4);
+      }
+    }
+  };
+  const timer = setInterval(() => {
+    void check();
+  }, intervalMs);
+  if (typeof timer.unref === "function") timer.unref();
+  activeWatchdogs.set(ctx.fqdn, { timer, ctx, state: state4 });
+}
+function stopTunnelWatchdog(fqdn) {
+  const item = activeWatchdogs.get(fqdn);
+  if (item) {
+    clearInterval(item.timer);
+    activeWatchdogs.delete(fqdn);
+  }
+}
+function stopAllWatchdogs() {
+  for (const [fqdn] of activeWatchdogs) stopTunnelWatchdog(fqdn);
+}
+
 // src/core/up-runner.ts
-function logFileFor(subdomain) {
-  return join7(logDir, `${subdomain === "@" ? "root" : subdomain}.log`);
+var sleep4 = (ms) => new Promise((r) => setTimeout(r, ms));
+function logFileFor(fqdn) {
+  return join7(logDir, `${serviceSlug(fqdn)}.log`);
+}
+async function createWithBootRetry(cf, item, keepAlive) {
+  const deadline = Date.now() + (keepAlive ? 3e4 : 0);
+  for (let attempt = 0; ; attempt++) {
+    try {
+      return await createTunnelSubdomain(cf, item);
+    } catch (err) {
+      if (!keepAlive || Date.now() >= deadline) throw err;
+      say.debug(`[boot-retry] Waiting for network to create ${item.name ?? "tunnel"}...`);
+      await sleep4(Math.min(2 ** attempt * 1e3, 5e3));
+    }
+  }
 }
 async function startTunnels(cf, bin, items, opts = {}) {
   const started = [];
@@ -1502,14 +1669,19 @@ async function startTunnels(cf, bin, items, opts = {}) {
   const teardownAll = async (code) => {
     if (tornDown) return;
     tornDown = true;
+    stopAllWatchdogs();
     try {
       for (const s of started) {
-        try {
-          await removeTunnelSubdomain(cf, s.fqdn, { force: true, quiet: true });
-        } catch {
+        if (opts.keepAlive) {
+          await stopConnector({ pid: s.pid, bootId: currentBootId() });
+        } else {
+          try {
+            await removeTunnelSubdomain(cf, s.fqdn, { force: true, quiet: true });
+          } catch {
+          }
         }
       }
-      if (process.stdout.isTTY) clack2.outro(`Stopped \xB7 released ${started.length} subdomain(s)`);
+      if (process.stdout.isTTY && !opts.keepAlive) clack2.outro(`Stopped \xB7 released ${started.length} subdomain(s)`);
     } catch (err) {
       reportError(err);
     } finally {
@@ -1520,9 +1692,9 @@ async function startTunnels(cf, bin, items, opts = {}) {
   spin.start(items.length > 1 ? "Creating tunnels\u2026" : "Creating tunnel\u2026");
   for (const item of items) {
     spin.message(`Creating ${item.name ?? "tunnel"} (:${item.port})\u2026`);
-    const result = await createTunnelSubdomain(cf, item);
+    const result = await createWithBootRetry(cf, item, opts.keepAlive);
     const fqdn = result.host.hostname;
-    const logFile = logFileFor(result.host.subdomain);
+    const logFile = logFileFor(fqdn);
     const conn = startConnector({
       bin,
       token: result.token,
@@ -1530,13 +1702,21 @@ async function startTunnels(cf, bin, items, opts = {}) {
       logFile,
       protocol: opts.protocol,
       onExit: opts.detach ? void 0 : (code) => {
-        if (!tornDown) {
+        if (!tornDown && !opts.keepAlive) {
           say.warn(`Connector for ${fqdn} exited.`);
           void teardownAll(code ?? 1);
         }
       }
     });
-    await patchEntry(fqdn, { pid: conn.pid, bootId: currentBootId(), logFile, protocol: opts.protocol });
+    await sleep4(600);
+    let metricsPort;
+    if (existsSync7(logFile)) {
+      try {
+        metricsPort = extractMetricsPort(readFileSync6(logFile, "utf8"));
+      } catch {
+      }
+    }
+    await patchEntry(fqdn, { pid: conn.pid, bootId: currentBootId(), logFile, metricsPort, protocol: opts.protocol });
     started.push({
       fqdn,
       subdomain: result.host.subdomain,
@@ -1544,6 +1724,20 @@ async function startTunnels(cf, bin, items, opts = {}) {
       target: serviceUrl(item.proto, item.host ?? "localhost", item.port),
       pid: conn.pid
     });
+    if (!opts.detach) {
+      startTunnelWatchdog({
+        cf,
+        bin,
+        fqdn,
+        tunnelId: result.tunnelId,
+        token: result.token,
+        logFile,
+        item,
+        pid: conn.pid,
+        metricsPort,
+        protocol: opts.protocol
+      });
+    }
   }
   if (opts.detach) {
     spin.stop(`${started.length} tunnel(s) started in the background`);
@@ -1561,7 +1755,7 @@ async function startTunnels(cf, bin, items, opts = {}) {
   spin.stop(`${started.length} tunnel(s) started`);
   const lines = started.map((s, i) => `${formatRoute(s.fqdn, s.target)}${healths[i] === "healthy" ? "" : dim(`  (${healths[i]})`)}`);
   clack2.note(lines.join("\n"), `${live}/${started.length} live`);
-  say.dim("Ctrl-C stops and releases them.");
+  say.dim(opts.keepAlive ? "Service running with auto-heal watchdog." : "Ctrl-C stops and releases them.");
 }
 
 // src/core/resolve-domain.ts
@@ -1642,7 +1836,7 @@ async function runUp(specArgs, opts) {
     await registerServices(cf, items, domain, opts.proto, protocol);
     return;
   }
-  await startTunnels(cf, bin, items, { detach: opts.detach, protocol });
+  await startTunnels(cf, bin, items, { detach: opts.detach, protocol, keepAlive: opts.keepAlive });
 }
 var SERVICE_UP_TIMEOUT_MS = 2e4;
 var delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
@@ -1688,7 +1882,7 @@ async function waitServicesUp(fqdns, timeoutMs) {
   return [...pending];
 }
 function registerUp(program) {
-  program.command("up", { isDefault: true }).argument("[specs...]", "tunnels to start: [subdomain:]port[@host]  (e.g. api:8080 web:8081@localhost)").description("Start one or more tunnels (also: `cloudtunnel 8080`)").option("-d, --domain <domain>", "domain for the subdomains (prompted from a list if unset)").option("--proto <proto>", "local service protocol: http | https", "http").option("--protocol <proto>", "cloudflared edge transport: auto | http2 | quic (http2 for UDP-hostile networks)").option("--detach", "run the connectors in the background").option("--service", "register each subdomain as a boot service (Linux systemd \xB7 macOS launchd \xB7 Windows Task Scheduler)").option("-f, --force", "replace a non-tunnel DNS record occupying the hostname").option("-y, --yes", "don't prompt; don't ask before replacing an existing record").action((specs, opts) => runUp(specs, opts));
+  program.command("up", { isDefault: true }).argument("[specs...]", "tunnels to start: [subdomain:]port[@host]  (e.g. api:8080 web:8081@localhost)").description("Start one or more tunnels (also: `cloudtunnel 8080`)").option("-d, --domain <domain>", "domain for the subdomains (prompted from a list if unset)").option("--proto <proto>", "local service protocol: http | https", "http").option("--protocol <proto>", "cloudflared edge transport: auto | http2 | quic (http2 for UDP-hostile networks)").option("--detach", "run the connectors in the background").option("--keep-alive", "supervised mode with auto-heal watchdog").option("--service", "register each subdomain as a boot service (Linux systemd \xB7 macOS launchd \xB7 Windows Task Scheduler)").option("-f, --force", "replace a non-tunnel DNS record occupying the hostname").option("-y, --yes", "don't prompt; don't ask before replacing an existing record").action((specs, opts) => runUp(specs, opts));
 }
 
 // src/commands/ls.ts
@@ -1763,9 +1957,9 @@ function registerDelete(program) {
 }
 
 // src/commands/logs.ts
-import { closeSync, existsSync as existsSync6, openSync as openSync2, readFileSync as readFileSync5, readSync, statSync, watch } from "fs";
+import { closeSync, existsSync as existsSync8, openSync as openSync2, readFileSync as readFileSync7, readSync, statSync, watch } from "fs";
 function printTail(file, n) {
-  const lines = readFileSync5(file, "utf8").split("\n");
+  const lines = readFileSync7(file, "utf8").split("\n");
   const tail = lines.slice(-n).join("\n");
   process.stdout.write(tail.endsWith("\n") ? tail : `${tail}
 `);
@@ -1797,7 +1991,7 @@ function follow(file, fromPos) {
 function registerLogs(program) {
   program.command("logs").argument("<target>", "subdomain name / hostname / id / #").description("Show the connector log for a subdomain (use -f to follow)").option("-f, --follow", "keep printing new log lines (like tail -f)").option("-n, --lines <n>", "number of lines to show", "50").action((name, opts) => {
     const { fqdn, entry } = resolveTarget(name);
-    if (!entry?.logFile || !existsSync6(entry.logFile)) {
+    if (!entry?.logFile || !existsSync8(entry.logFile)) {
       throw new CliError(`No logs for ${fqdn} yet.`, { hint: "start it with `cloudtunnel up` or `cloudtunnel run`" });
     }
     const n = Math.max(1, Number(opts.lines) || 50);