@iamken/cloudtunnel 0.11.3 → 0.11.5

package/dist/{chunk-BIGZFMQ6.js → chunk-FILVDOPL.js}

@@ -29,6 +29,14 @@ async function createCname(token, zoneId, name, tunnelId) {
   }
   return env.result;
 }
+async function findDnsRecords(token, zoneId, fqdn) {
+  const env = await cfRequest(
+    token,
+    "GET",
+    `/zones/${zoneId}/dns_records?name=${encodeURIComponent(fqdn)}`
+  );
+  return env.result ?? [];
+}
 async function findCname(token, zoneId, fqdn) {
   const env = await cfRequest(
     token,
@@ -55,8 +63,9 @@ export {
   cargoTarget,
   isManagedDns,
   createCname,
+  findDnsRecords,
   findCname,
   listCargoCnames,
   deleteDnsRecord
 };
-//# sourceMappingURL=chunk-BIGZFMQ6.js.map
+//# sourceMappingURL=chunk-FILVDOPL.js.map

package/dist/chunk-FILVDOPL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cloudflare/dns.ts"],"sourcesContent":["import { cfPaginate, cfRequest } from \"./client.js\";\nimport type { DnsRecord } from \"./types.js\";\nimport { CliError } from \"../ui/errors.js\";\n\n/** DNS records created by cloudtunnel carry this comment (ownership marker). */\nexport const MANAGED_DNS_COMMENT = \"managed-by:cloudtunnel\";\n\nexport function cargoTarget(tunnelId: string): string {\n  return `${tunnelId}.cfargotunnel.com`;\n}\n\nexport function isManagedDns(record: DnsRecord): boolean {\n  return record.comment === MANAGED_DNS_COMMENT;\n}\n\n/** Create the proxied CNAME that routes a subdomain to the tunnel. Asserts the\n * record came back orange-clouded (grey-cloud would silently break routing). */\nexport async function createCname(\n  token: string,\n  zoneId: string,\n  name: string,\n  tunnelId: string,\n): Promise<DnsRecord> {\n  const env = await cfRequest<DnsRecord>(token, \"POST\", `/zones/${zoneId}/dns_records`, {\n    type: \"CNAME\",\n    name,\n    content: cargoTarget(tunnelId),\n    proxied: true,\n    ttl: 1,\n    comment: MANAGED_DNS_COMMENT,\n  });\n  if (env.result.proxied !== true) {\n    throw new CliError(`DNS record for ${name} was created grey-clouded (not proxied).`, {\n      hint: \"cfargotunnel routing requires a proxied (orange-cloud) record\",\n    });\n  }\n  return env.result;\n}\n\nexport async function findDnsRecords(\n  token: string,\n  zoneId: string,\n  fqdn: string,\n): Promise<DnsRecord[]> {\n  const env = await cfRequest<DnsRecord[]>(\n    token,\n    \"GET\",\n    `/zones/${zoneId}/dns_records?name=${encodeURIComponent(fqdn)}`,\n  );\n  return env.result ?? [];\n}\n\nexport async function findCname(\n  token: string,\n  zoneId: string,\n  fqdn: string,\n): Promise<DnsRecord | undefined> {\n  const env = await cfRequest<DnsRecord[]>(\n    token,\n    \"GET\",\n    `/zones/${zoneId}/dns_records?type=CNAME&name=${encodeURIComponent(fqdn)}`,\n  );\n  return env.result?.[0];\n}\n\n/** CNAMEs in the zone that point at a cfargotunnel target (any tool's). */\nexport async function listCargoCnames(token: string, zoneId: string): Promise<DnsRecord[]> {\n  const all = await cfPaginate<DnsRecord>(token, `/zones/${zoneId}/dns_records?type=CNAME`);\n  return all.filter((r) => r.content.endsWith(\".cfargotunnel.com\"));\n}\n\nexport async function deleteDnsRecord(token: string, zoneId: string, recordId: string): Promise<void> {\n  try {\n    await cfRequest<unknown>(token, \"DELETE\", `/zones/${zoneId}/dns_records/${recordId}`);\n  } catch (err) {\n    if (err instanceof CliError && err.status === 404) return;\n    throw err;\n  }\n}\n"],"mappings":";;;;;;;;AAKO,IAAM,sBAAsB;AAE5B,SAAS,YAAY,UAA0B;AACpD,SAAO,GAAG,QAAQ;AACpB;AAEO,SAAS,aAAa,QAA4B;AACvD,SAAO,OAAO,YAAY;AAC5B;AAIA,eAAsB,YACpB,OACA,QACA,MACA,UACoB;AACpB,QAAM,MAAM,MAAM,UAAqB,OAAO,QAAQ,UAAU,MAAM,gBAAgB;AAAA,IACpF,MAAM;AAAA,IACN;AAAA,IACA,SAAS,YAAY,QAAQ;AAAA,IAC7B,SAAS;AAAA,IACT,KAAK;AAAA,IACL,SAAS;AAAA,EACX,CAAC;AACD,MAAI,IAAI,OAAO,YAAY,MAAM;AAC/B,UAAM,IAAI,SAAS,kBAAkB,IAAI,4CAA4C;AAAA,MACnF,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO,IAAI;AACb;AAEA,eAAsB,eACpB,OACA,QACA,MACsB;AACtB,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA,UAAU,MAAM,qBAAqB,mBAAmB,IAAI,CAAC;AAAA,EAC/D;AACA,SAAO,IAAI,UAAU,CAAC;AACxB;AAEA,eAAsB,UACpB,OACA,QACA,MACgC;AAChC,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA,UAAU,MAAM,gCAAgC,mBAAmB,IAAI,CAAC;AAAA,EAC1E;AACA,SAAO,IAAI,SAAS,CAAC;AACvB;AAGA,eAAsB,gBAAgB,OAAe,QAAsC;AACzF,QAAM,MAAM,MAAM,WAAsB,OAAO,UAAU,MAAM,yBAAyB;AACxF,SAAO,IAAI,OAAO,CAAC,MAAM,EAAE,QAAQ,SAAS,mBAAmB,CAAC;AAClE;AAEA,eAAsB,gBAAgB,OAAe,QAAgB,UAAiC;AACpG,MAAI;AACF,UAAM,UAAmB,OAAO,UAAU,UAAU,MAAM,gBAAgB,QAAQ,EAAE;AAAA,EACtF,SAAS,KAAK;AACZ,QAAI,eAAe,YAAY,IAAI,WAAW,IAAK;AACnD,UAAM;AAAA,EACR;AACF;","names":[]}

package/dist/{dns-3WHXRL6V.js → dns-BNDEFUCM.js}

@@ -5,9 +5,10 @@ import {
   createCname,
   deleteDnsRecord,
   findCname,
+  findDnsRecords,
   isManagedDns,
   listCargoCnames
-} from "./chunk-BIGZFMQ6.js";
+} from "./chunk-FILVDOPL.js";
 import "./chunk-7XACBYL7.js";
 export {
   MANAGED_DNS_COMMENT,
@@ -15,7 +16,8 @@ export {
   createCname,
   deleteDnsRecord,
   findCname,
+  findDnsRecords,
   isManagedDns,
   listCargoCnames
 };
-//# sourceMappingURL=dns-3WHXRL6V.js.map
+//# sourceMappingURL=dns-BNDEFUCM.js.map

package/dist/index.js

@@ -7,8 +7,9 @@ import {
   createCname,
   deleteDnsRecord,
   findCname,
+  findDnsRecords,
   isManagedDns
-} from "./chunk-BIGZFMQ6.js";
+} from "./chunk-FILVDOPL.js";
 import {
   CliError,
   DEFAULT_API_BASE,
@@ -246,11 +247,13 @@ function assertSupported() {
 }
 function install(d) {
   assertSupported();
-  const tmp = join2(tmpdir(), label(d.fqdn));
+  const name = label(d.fqdn);
+  const tmp = join2(tmpdir(), name);
   writeFileSync(tmp, buildUnit(d), { mode: 420 });
   privileged(["install", "-m", "0644", tmp, unitPath(d.fqdn)]);
   privileged(["systemctl", "daemon-reload"]);
-  privileged(["systemctl", "enable", "--now", label(d.fqdn)]);
+  privileged(["systemctl", "enable", name]);
+  privileged(["systemctl", "restart", name]);
 }
 function uninstall(fqdn) {
   try {
@@ -388,7 +391,7 @@ function buildTaskXml(d) {
     "    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>",
     "    <RestartOnFailure><Interval>PT1M</Interval><Count>999</Count></RestartOnFailure>",
     "    <Enabled>true</Enabled>",
-    "  </Settings>",
+    "</Settings>",
     '  <Actions Context="Author">',
     `    <Exec><Command>${xml2(d.nodePath)}</Command><Arguments>${xml2(args)}</Arguments></Exec>`,
     "  </Actions>",
@@ -408,9 +411,11 @@ function assertSupported3() {
 }
 function install3(d) {
   const file = join4(tmpdir2(), `${d.slug}.task.xml`);
+  const name = label3(d.fqdn);
   writeFileSync3(file, "\uFEFF" + buildTaskXml(d), { encoding: "utf16le" });
-  execFileSync3("schtasks", ["/Create", "/TN", label3(d.fqdn), "/XML", file, "/F"], { stdio: "inherit" });
-  schtasks(["/Run", "/TN", label3(d.fqdn)]);
+  schtasks(["/End", "/TN", name]);
+  execFileSync3("schtasks", ["/Create", "/TN", name, "/XML", file, "/F"], { stdio: "inherit" });
+  schtasks(["/Run", "/TN", name]);
 }
 function uninstall3(fqdn) {
   schtasks(["/Delete", "/TN", label3(fqdn), "/F"]);
@@ -940,17 +945,115 @@ function extractTgz(bytes) {
   });
 }
 
+// src/cloudflare/tunnels.ts
+var MANAGED_TUNNEL_PREFIX = "ct-";
+function isManagedTunnel(tunnel) {
+  return tunnel.name.startsWith(MANAGED_TUNNEL_PREFIX);
+}
+async function createTunnel(cf, name) {
+  const env = await cfRequest(cf.token, "POST", `/accounts/${cf.accountId}/cfd_tunnel`, {
+    name,
+    config_src: "cloudflare"
+  });
+  return env.result;
+}
+function listTunnels(cf) {
+  return cfPaginate(cf.token, `/accounts/${cf.accountId}/cfd_tunnel?is_deleted=false`);
+}
+async function getTunnel(cf, id) {
+  return (await cfRequest(cf.token, "GET", `/accounts/${cf.accountId}/cfd_tunnel/${id}`)).result;
+}
+async function deleteTunnel(cf, id) {
+  await cfRequest(cf.token, "DELETE", `/accounts/${cf.accountId}/cfd_tunnel/${id}`);
+}
+async function cleanupConnections(cf, id) {
+  await cfRequest(cf.token, "DELETE", `/accounts/${cf.accountId}/cfd_tunnel/${id}/connections`);
+}
+async function deleteTunnelWithConnections(cf, id) {
+  try {
+    await deleteTunnel(cf, id);
+  } catch (err) {
+    if (err instanceof CliError && /active connections/i.test(err.message)) {
+      await cleanupConnections(cf, id);
+      await deleteTunnel(cf, id);
+    } else {
+      throw err;
+    }
+  }
+}
+async function getTunnelToken(cf, id) {
+  return (await cfRequest(cf.token, "GET", `/accounts/${cf.accountId}/cfd_tunnel/${id}/token`)).result;
+}
+async function putIngress(cf, id, ingress) {
+  await cfRequest(cf.token, "PUT", `/accounts/${cf.accountId}/cfd_tunnel/${id}/configurations`, {
+    config: { ingress }
+  });
+}
+async function getConnections(cf, id) {
+  const env = await cfRequest(
+    cf.token,
+    "GET",
+    `/accounts/${cf.accountId}/cfd_tunnel/${id}/connections`
+  );
+  return env.result ?? [];
+}
+
+// src/connector/health.ts
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function waitHealthy(cf, tunnelId, opts = {}) {
+  const deadline = Date.now() + (opts.timeoutMs ?? 3e4);
+  while (Date.now() < deadline) {
+    if (opts.signal?.aborted) return "dead";
+    try {
+      const connections = await getConnections(cf, tunnelId);
+      if (connections.length > 0) return "healthy";
+    } catch {
+    }
+    await sleep(2e3);
+  }
+  return opts.signal?.aborted ? "dead" : "provisioning";
+}
+function extractMetricsPort(log) {
+  const matches = [...log.matchAll(/Starting metrics server on 127\.0\.0\.1:(\d+)\/metrics/g)];
+  if (!matches.length) return void 0;
+  const last = matches[matches.length - 1];
+  const port = Number(last?.[1]);
+  return Number.isInteger(port) && port > 0 && port <= 65535 ? port : void 0;
+}
+async function checkLocalReady(port, opts = {}) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 2e3);
+  try {
+    const res = await fetch(`http://127.0.0.1:${port}/ready`, { signal: controller.signal });
+    if (!res.ok) return { healthy: false, readyConnections: 0, status: res.status };
+    const data = await res.json().catch(() => ({}));
+    const readyConnections = Number(data.readyConnections) || 0;
+    return { healthy: readyConnections > 0, readyConnections, status: res.status };
+  } catch {
+    return { healthy: false, readyConnections: 0 };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function probeEntryState(entry, gone) {
+  if (gone || entry.state !== "running" || !entry.pid) return "down";
+  if (!entry.metricsPort) return "up";
+  const ready = await checkLocalReady(entry.metricsPort, { timeoutMs: 300 });
+  return ready.healthy ? "up" : "reconnecting";
+}
+
 // src/core/up-runner.ts
 import { join as join7 } from "path";
 import { readFileSync as readFileSync6, existsSync as existsSync7 } from "fs";
 import * as clack2 from "@clack/prompts";
 
 // src/connector/process.ts
-import { execFileSync as execFileSync6, spawn as spawn2 } from "child_process";
+import { execFileSync as execFileSync7, spawn as spawn2 } from "child_process";
 import { openSync } from "fs";
 
 // src/connector/registry.ts
 import { existsSync as existsSync5, readFileSync as readFileSync3, renameSync as renameSync2, writeFileSync as writeFileSync6 } from "fs";
+import { execFileSync as execFileSync6 } from "child_process";
 import { readFile } from "fs/promises";
 import os3 from "os";
 import lockfile from "proper-lockfile";
@@ -961,6 +1064,13 @@ function currentBootId() {
   try {
     return readFileSync3("/proc/sys/kernel/random/boot_id", "utf8").trim();
   } catch {
+    if (process.platform === "darwin") {
+      try {
+        const out = execFileSync6("sysctl", ["-n", "kern.boottime"], { encoding: "utf8" }).trim();
+        return `darwin-${out}-${os3.hostname()}`;
+      } catch {
+      }
+    }
     const bootMinute = Math.floor((Date.now() - os3.uptime() * 1e3) / 6e4);
     return `boot-${bootMinute}-${os3.hostname()}`;
   }
@@ -1047,6 +1157,14 @@ async function isOurConnector(entry) {
       return false;
     }
   }
+  if (process.platform === "darwin") {
+    try {
+      const comm = execFileSync6("ps", ["-p", String(entry.pid), "-o", "command="], { encoding: "utf8" });
+      return comm.includes("cloudflared");
+    } catch {
+      return false;
+    }
+  }
   return true;
 }
 async function reconcile() {
@@ -1067,7 +1185,7 @@ async function reconcile() {
 }
 
 // src/connector/process.ts
-var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+var sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
 function startConnector(opts) {
   const args = ["tunnel", "--metrics", "127.0.0.1:0", "run"];
   if (opts.protocol) args.push("--protocol", opts.protocol);
@@ -1088,7 +1206,7 @@ async function stopConnector(entry) {
   const pid = entry.pid;
   if (process.platform === "win32") {
     try {
-      execFileSync6("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore" });
+      execFileSync7("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore" });
     } catch {
       return false;
     }
@@ -1099,7 +1217,7 @@ async function stopConnector(entry) {
   } catch {
     return false;
   }
-  await sleep(3e3);
+  await sleep2(3e3);
   if (await isOurConnector(entry)) {
     try {
       process.kill(pid, "SIGKILL");
@@ -1109,103 +1227,6 @@ async function stopConnector(entry) {
   return true;
 }
 
-// src/cloudflare/tunnels.ts
-var MANAGED_TUNNEL_PREFIX = "ct-";
-function isManagedTunnel(tunnel) {
-  return tunnel.name.startsWith(MANAGED_TUNNEL_PREFIX);
-}
-async function createTunnel(cf, name) {
-  const env = await cfRequest(cf.token, "POST", `/accounts/${cf.accountId}/cfd_tunnel`, {
-    name,
-    config_src: "cloudflare"
-  });
-  return env.result;
-}
-function listTunnels(cf) {
-  return cfPaginate(cf.token, `/accounts/${cf.accountId}/cfd_tunnel?is_deleted=false`);
-}
-async function getTunnel(cf, id) {
-  return (await cfRequest(cf.token, "GET", `/accounts/${cf.accountId}/cfd_tunnel/${id}`)).result;
-}
-async function deleteTunnel(cf, id) {
-  await cfRequest(cf.token, "DELETE", `/accounts/${cf.accountId}/cfd_tunnel/${id}`);
-}
-async function cleanupConnections(cf, id) {
-  await cfRequest(cf.token, "DELETE", `/accounts/${cf.accountId}/cfd_tunnel/${id}/connections`);
-}
-async function deleteTunnelWithConnections(cf, id) {
-  try {
-    await deleteTunnel(cf, id);
-  } catch (err) {
-    if (err instanceof CliError && /active connections/i.test(err.message)) {
-      await cleanupConnections(cf, id);
-      await deleteTunnel(cf, id);
-    } else {
-      throw err;
-    }
-  }
-}
-async function getTunnelToken(cf, id) {
-  return (await cfRequest(cf.token, "GET", `/accounts/${cf.accountId}/cfd_tunnel/${id}/token`)).result;
-}
-async function putIngress(cf, id, ingress) {
-  await cfRequest(cf.token, "PUT", `/accounts/${cf.accountId}/cfd_tunnel/${id}/configurations`, {
-    config: { ingress }
-  });
-}
-async function getConnections(cf, id) {
-  const env = await cfRequest(
-    cf.token,
-    "GET",
-    `/accounts/${cf.accountId}/cfd_tunnel/${id}/connections`
-  );
-  return env.result ?? [];
-}
-
-// src/connector/health.ts
-var sleep2 = (ms) => new Promise((r) => setTimeout(r, ms));
-async function waitHealthy(cf, tunnelId, opts = {}) {
-  const deadline = Date.now() + (opts.timeoutMs ?? 3e4);
-  while (Date.now() < deadline) {
-    if (opts.signal?.aborted) return "dead";
-    try {
-      const connections = await getConnections(cf, tunnelId);
-      if (connections.length > 0) return "healthy";
-    } catch {
-    }
-    await sleep2(2e3);
-  }
-  return opts.signal?.aborted ? "dead" : "provisioning";
-}
-function extractMetricsPort(log) {
-  const matches = [...log.matchAll(/Starting metrics server on 127\.0\.0\.1:(\d+)\/metrics/g)];
-  if (!matches.length) return void 0;
-  const last = matches[matches.length - 1];
-  const port = Number(last?.[1]);
-  return Number.isInteger(port) && port > 0 && port <= 65535 ? port : void 0;
-}
-async function checkLocalReady(port, opts = {}) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 2e3);
-  try {
-    const res = await fetch(`http://127.0.0.1:${port}/ready`, { signal: controller.signal });
-    if (!res.ok) return { healthy: false, readyConnections: 0, status: res.status };
-    const data = await res.json().catch(() => ({}));
-    const readyConnections = Number(data.readyConnections) || 0;
-    return { healthy: readyConnections > 0, readyConnections, status: res.status };
-  } catch {
-    return { healthy: false, readyConnections: 0 };
-  } finally {
-    clearTimeout(timer);
-  }
-}
-async function probeEntryState(entry, gone) {
-  if (gone || entry.state !== "running" || !entry.pid) return "down";
-  if (!entry.metricsPort) return "up";
-  const ready = await checkLocalReady(entry.metricsPort, { timeoutMs: 300 });
-  return ready.healthy ? "up" : "reconnecting";
-}
-
 // src/core/orchestrator-create.ts
 import { randomInt as randomInt2 } from "crypto";
 
@@ -1278,9 +1299,9 @@ var tunnelIdFromCname = (content) => content.replace(/\.cfargotunnel\.com\.?$/,
 async function createTunnelSubdomain(cf, opts) {
   const host = resolveHostSpec(opts, opts.defaultZone);
   const zone = await resolveZone(cf.token, host.zone);
-  const existing = await findCname(cf.token, zone.id, host.hostname);
-  if (existing) {
-    const isTunnelRecord = existing.content.endsWith(".cfargotunnel.com");
+  const existingList = await findDnsRecords(cf.token, zone.id, host.hostname);
+  if (existingList.length > 0) {
+    const isTunnelRecord = existingList.every((r) => r.content.endsWith(".cfargotunnel.com"));
     if (!isTunnelRecord && !opts.force) {
       throw new CliError(`${host.hostname} is taken by a non-tunnel DNS record.`, {
         hint: "pick another --subdomain/--hostname, or pass -f/--force to replace it"
@@ -1292,7 +1313,14 @@ async function createTunnelSubdomain(cf, opts) {
         throw new CliError("Cancelled.", { exitCode: 130 });
       }
     }
-    await releaseHostname(cf, zone.id, existing);
+    const prev = getEntry(host.hostname);
+    if (prev) await stopConnector(prev);
+    for (const rec of existingList) {
+      await releaseHostname(cf, zone.id, rec);
+    }
+  } else {
+    const prev = getEntry(host.hostname);
+    if (prev) await stopConnector(prev);
   }
   await upsertEntry(host.hostname, {
     subdomain: host.subdomain,
@@ -1301,7 +1329,9 @@ async function createTunnelSubdomain(cf, opts) {
     port: opts.port,
     proto: opts.proto,
     host: opts.host,
-    state: "provisioning"
+    state: "provisioning",
+    pid: void 0,
+    metricsPort: void 0
   });
   let tunnelId;
   let dnsRecordId;
@@ -1466,7 +1496,7 @@ async function resolveRemoteTarget(cf, target) {
   }
   const tunnel = matches[0];
   if (!tunnel) return null;
-  const { listCargoCnames } = await import("./dns-3WHXRL6V.js");
+  const { listCargoCnames } = await import("./dns-BNDEFUCM.js");
   const { listZones: listZones3 } = await import("./zones-XNCXYCB4.js");
   for (const zone of await listZones3(cf.token)) {
     const rec = (await listCargoCnames(cf.token, zone.id)).find((r) => tunnelIdFromCname2(r.content) === tunnel.id);
@@ -1505,7 +1535,7 @@ async function listAll(cf, opts = {}) {
     };
   }));
   if (opts.all) {
-    const { listCargoCnames } = await import("./dns-3WHXRL6V.js");
+    const { listCargoCnames } = await import("./dns-BNDEFUCM.js");
     const { listZones: listZones3 } = await import("./zones-XNCXYCB4.js");
     const tracked = new Set(entries.map(entryFqdn));
     const unmanaged = [];
@@ -1838,7 +1868,7 @@ async function runUp(specArgs, opts) {
   }
   await startTunnels(cf, bin, items, { detach: opts.detach, protocol, keepAlive: opts.keepAlive });
 }
-var SERVICE_UP_TIMEOUT_MS = 2e4;
+var SERVICE_UP_TIMEOUT_MS = 3e4;
 var delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 async function registerServices(cf, items, domain, proto, protocol) {
   assertServiceSupported();
@@ -1850,6 +1880,7 @@ async function registerServices(cf, items, domain, proto, protocol) {
   for (const item of items) {
     const subdomain = item.name;
     const fqdn = subdomain === "@" ? domain : `${subdomain}.${domain}`;
+    await patchEntry(fqdn, { state: "provisioning", pid: void 0, metricsPort: void 0 });
     installServiceForSpec({ subdomain, port: item.port, host: item.host, zone: domain, proto, protocol });
     fqdns.push(fqdn);
   }
@@ -1874,11 +1905,21 @@ async function waitServicesUp(fqdns, timeoutMs) {
   while (pending.size > 0) {
     for (const fqdn of [...pending]) {
       const entry = getEntry(fqdn);
-      if (entry?.state === "running" && entry.pid) pending.delete(fqdn);
+      if (entry?.state === "running" && entry.pid && await isOurConnector(entry)) {
+        if (!entry.metricsPort || (await checkLocalReady(entry.metricsPort, { timeoutMs: 500 })).healthy) {
+          pending.delete(fqdn);
+        }
+      }
     }
     if (pending.size === 0 || Date.now() >= deadline) break;
     await delay(500);
   }
+  for (const fqdn of [...pending]) {
+    const entry = getEntry(fqdn);
+    if (entry?.state === "running" && entry.pid && await isOurConnector(entry)) {
+      pending.delete(fqdn);
+    }
+  }
   return [...pending];
 }
 function registerUp(program) {