@iamken/cloudtunnel 0.3.0 → 0.5.0

package/dist/index.js

@@ -2,15 +2,16 @@
 import {
   listZones,
   resolveZone
-} from "./chunk-2TCFCMJS.js";
+} from "./chunk-CWJA4L7J.js";
 import {
   createCname,
   deleteDnsRecord,
   findCname,
   isManagedDns
-} from "./chunk-YLTQB4F7.js";
+} from "./chunk-NZKGIDIW.js";
 import {
   CliError,
+  __export,
   binDir,
   cfPaginate,
   cfRequest,
@@ -24,15 +25,15 @@ import {
   reportError,
   resolveCf,
   saveConfig
-} from "./chunk-UPBVRXLF.js";
+} from "./chunk-RWR6VXNB.js";
 
 // src/index.ts
 import { Command } from "commander";
 import { createRequire } from "module";
 import pc2 from "picocolors";
 
-// src/commands/login.ts
-import * as clack from "@clack/prompts";
+// src/config/legacy-migrate.ts
+import { existsSync as existsSync3, readFileSync, renameSync, writeFileSync as writeFileSync4 } from "fs";
 
 // src/ui/output.ts
 import pc from "picocolors";
@@ -66,10 +67,10 @@ function printTable(head, rows) {
   for (const row of rows) table.push(row);
   console.log(table.toString());
 }
-async function selectOne(message, items, label) {
+async function selectOne(message, items, label4) {
   const value = await select({
     message,
-    options: items.map((item, i) => ({ value: String(i), label: label(item) }))
+    options: items.map((item, i) => ({ value: String(i), label: label4(item) }))
   });
   if (isCancel(value)) {
     cancel("Cancelled.");
@@ -78,6 +79,459 @@ async function selectOne(message, items, label) {
   return items[Number(value)];
 }
 
+// src/core/service-exec.ts
+import { realpathSync } from "fs";
+import os from "os";
+import { join } from "path";
+
+// src/core/ingress.ts
+var HOSTNAME_RE = /^[a-zA-Z0-9.-]+$/;
+var IPV6_RE = /^[0-9a-fA-F:.]+$/;
+function validateHost(host) {
+  let h = host.trim();
+  const bracketed = h.startsWith("[") && h.endsWith("]");
+  if (bracketed) h = h.slice(1, -1);
+  const isV6 = bracketed || h.includes("::") || (h.match(/:/g)?.length ?? 0) >= 2;
+  const ok = h.length > 0 && (isV6 ? IPV6_RE.test(h) : HOSTNAME_RE.test(h));
+  if (!ok) {
+    throw new CliError(`Invalid host "${host}".`, {
+      hint: "use a hostname, IPv4, or IPv6 literal (e.g. 192.168.1.5 or ::1) \u2014 no port, scheme, or path"
+    });
+  }
+  return h;
+}
+function serviceUrl(proto, host, port) {
+  const authority = host.includes(":") ? `[${host}]` : host;
+  return `${proto}://${authority}:${port}`;
+}
+function buildIngress(opts) {
+  return [
+    { hostname: opts.hostname, service: serviceUrl(opts.proto, opts.host ?? "localhost", opts.port) },
+    { service: "http_status:404" }
+  ];
+}
+
+// src/core/tunnel-spec.ts
+function parseTunnelSpec(spec) {
+  const raw = spec.trim();
+  const bad = (hint) => new CliError(`Invalid spec "${spec}".`, { hint });
+  if (!raw) throw bad("use [subdomain:]port[@host], e.g. api:8080 or api:8080@192.168.1.20");
+  let rest = raw;
+  let subdomain;
+  if (rest.startsWith("@")) {
+    subdomain = "@";
+    rest = rest.slice(1);
+    if (rest.startsWith(":")) rest = rest.slice(1);
+  }
+  let host;
+  const at = rest.indexOf("@");
+  if (at >= 0) {
+    host = validateHost(rest.slice(at + 1));
+    rest = rest.slice(0, at);
+  }
+  const parts = rest.split(":");
+  let portStr;
+  if (parts.length === 1) {
+    portStr = parts[0];
+  } else if (parts.length === 2) {
+    if (subdomain === void 0) {
+      if (!parts[0]) throw bad("subdomain label is empty");
+      subdomain = parts[0];
+    } else if (parts[0]) {
+      throw bad("unexpected label after '@' root marker");
+    }
+    portStr = parts[1];
+  } else {
+    throw bad("too many ':' \u2014 spec is [subdomain:]port[@host] (protocol via --proto)");
+  }
+  const port = Number(portStr);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    throw bad("port must be a number 1\u201365535");
+  }
+  if (subdomain !== void 0 && subdomain !== "@" && !/^[a-zA-Z0-9-]+$/.test(subdomain)) {
+    throw bad("subdomain may contain only letters, digits, and hyphens");
+  }
+  return { subdomain, port, ...host ? { host } : {} };
+}
+function formatTunnelSpec(s) {
+  return `${s.subdomain}:${s.port}${s.host ? `@${s.host}` : ""}`;
+}
+
+// src/core/service-exec.ts
+var fqdnFor = (subdomain, zone) => subdomain === "@" ? zone : `${subdomain}.${zone}`;
+var serviceSlug = (fqdn) => fqdn.replace(/[^a-zA-Z0-9]+/g, "-");
+function buildUpArgs(p) {
+  const spec = formatTunnelSpec({ subdomain: p.subdomain, port: p.port, host: p.host });
+  return [
+    "up",
+    spec,
+    "-d",
+    p.zone,
+    ...p.proto === "https" ? ["--proto", "https"] : [],
+    ...p.protocol ? ["--protocol", p.protocol] : [],
+    "-f",
+    "-y"
+  ];
+}
+function entryScript() {
+  const p = process.argv[1];
+  if (!p) throw new CliError("Cannot resolve the cloudtunnel executable path.");
+  return realpathSync(p);
+}
+function describeService(p) {
+  const fqdn = fqdnFor(p.subdomain, p.zone);
+  const slug = serviceSlug(fqdn);
+  return {
+    fqdn,
+    slug,
+    argv: buildUpArgs(p),
+    nodePath: process.execPath,
+    scriptPath: entryScript(),
+    user: os.userInfo().username,
+    home: os.homedir(),
+    logFile: join(logDir, `${slug}.service.log`)
+  };
+}
+
+// src/core/service-systemd.ts
+var service_systemd_exports = {};
+__export(service_systemd_exports, {
+  assertSupported: () => assertSupported,
+  buildUnit: () => buildUnit,
+  install: () => install,
+  label: () => label,
+  legacyUnitExists: () => legacyUnitExists,
+  removeLegacyUnit: () => removeLegacyUnit,
+  state: () => state,
+  uninstall: () => uninstall
+});
+import { execFileSync } from "child_process";
+import { existsSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { dirname, join as join2 } from "path";
+var label = (fqdn) => `cloudtunnel-${serviceSlug(fqdn)}.service`;
+var unitPath = (fqdn) => `/etc/systemd/system/${label(fqdn)}`;
+function buildUnit(d) {
+  const nodeBin = dirname(d.nodePath);
+  return [
+    "[Unit]",
+    `Description=cloudtunnel ${d.fqdn} (Cloudflare Tunnel)`,
+    "After=network-online.target",
+    "Wants=network-online.target",
+    "",
+    "[Service]",
+    "Type=simple",
+    `User=${d.user}`,
+    `Environment=HOME=${d.home}`,
+    `Environment=PATH=${nodeBin}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`,
+    `ExecStart=${d.nodePath} ${d.scriptPath} ${d.argv.join(" ")}`,
+    "Restart=on-failure",
+    "RestartSec=5",
+    "",
+    "[Install]",
+    "WantedBy=multi-user.target",
+    ""
+  ].join("\n");
+}
+function privileged(args) {
+  const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
+  const argv = isRoot ? args : ["sudo", ...args];
+  execFileSync(argv[0], argv.slice(1), { stdio: "inherit" });
+}
+function query(args) {
+  try {
+    return execFileSync("systemctl", args, { stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" }).trim();
+  } catch (err) {
+    const out = err.stdout;
+    return out ? out.toString().trim() : "";
+  }
+}
+function assertSupported() {
+  try {
+    execFileSync("systemctl", ["--version"], { stdio: "ignore" });
+  } catch {
+    throw new CliError("systemd (systemctl) was not found on this host.");
+  }
+}
+function install(d) {
+  assertSupported();
+  const tmp = join2(tmpdir(), label(d.fqdn));
+  writeFileSync(tmp, buildUnit(d), { mode: 420 });
+  privileged(["install", "-m", "0644", tmp, unitPath(d.fqdn)]);
+  privileged(["systemctl", "daemon-reload"]);
+  privileged(["systemctl", "enable", "--now", label(d.fqdn)]);
+}
+function uninstall(fqdn) {
+  try {
+    privileged(["systemctl", "disable", "--now", label(fqdn)]);
+  } catch {
+  }
+  privileged(["rm", "-f", unitPath(fqdn)]);
+  privileged(["systemctl", "daemon-reload"]);
+}
+function state(fqdn) {
+  const name = label(fqdn);
+  if (query(["is-active", name]) === "active") return "active";
+  const enabled = query(["is-enabled", name]);
+  if (enabled === "enabled" || enabled === "enabled-runtime") return "enabled";
+  if (enabled === "disabled" || enabled === "static") return "disabled";
+  return "none";
+}
+function legacyUnitExists(profile) {
+  return existsSync(`/etc/systemd/system/cloudtunnel-${profile}.service`);
+}
+function removeLegacyUnit(profile) {
+  const name = `cloudtunnel-${profile}.service`;
+  try {
+    privileged(["systemctl", "disable", "--now", name]);
+  } catch {
+  }
+  privileged(["rm", "-f", `/etc/systemd/system/${name}`]);
+  privileged(["systemctl", "daemon-reload"]);
+}
+
+// src/core/service-launchd.ts
+var service_launchd_exports = {};
+__export(service_launchd_exports, {
+  assertSupported: () => assertSupported2,
+  buildPlist: () => buildPlist,
+  install: () => install2,
+  label: () => label2,
+  state: () => state2,
+  uninstall: () => uninstall2
+});
+import { execFileSync as execFileSync2 } from "child_process";
+import { existsSync as existsSync2, mkdirSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, join as join3 } from "path";
+import os2 from "os";
+var label2 = (fqdn) => `com.cloudtunnel.${serviceSlug(fqdn)}`;
+var agentsDir = () => join3(os2.homedir(), "Library", "LaunchAgents");
+var plistPath = (fqdn) => join3(agentsDir(), `${label2(fqdn)}.plist`);
+var xml = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+function buildPlist(d) {
+  const args = [d.nodePath, d.scriptPath, ...d.argv].map((a) => `    <string>${xml(a)}</string>`).join("\n");
+  const nodeBin = dirname2(d.nodePath);
+  const path = `${nodeBin}:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin`;
+  return [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    '<plist version="1.0">',
+    "<dict>",
+    `  <key>Label</key><string>${xml(label2(d.fqdn))}</string>`,
+    "  <key>ProgramArguments</key>",
+    "  <array>",
+    args,
+    "  </array>",
+    "  <key>RunAtLoad</key><true/>",
+    "  <key>KeepAlive</key><true/>",
+    "  <key>EnvironmentVariables</key>",
+    "  <dict>",
+    `    <key>PATH</key><string>${xml(path)}</string>`,
+    `    <key>HOME</key><string>${xml(d.home)}</string>`,
+    "  </dict>",
+    `  <key>StandardOutPath</key><string>${xml(d.logFile)}</string>`,
+    `  <key>StandardErrorPath</key><string>${xml(d.logFile)}</string>`,
+    "</dict>",
+    "</plist>",
+    ""
+  ].join("\n");
+}
+function launchctl(args) {
+  try {
+    return execFileSync2("launchctl", args, { stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" });
+  } catch (err) {
+    const out = err.stdout;
+    return out ? out.toString() : "";
+  }
+}
+function assertSupported2() {
+}
+function install2(d) {
+  ensureDirs();
+  mkdirSync(agentsDir(), { recursive: true });
+  const plist = plistPath(d.fqdn);
+  writeFileSync2(plist, buildPlist(d), { mode: 420 });
+  launchctl(["unload", "-w", plist]);
+  execFileSync2("launchctl", ["load", "-w", plist], { stdio: "inherit" });
+}
+function uninstall2(fqdn) {
+  const plist = plistPath(fqdn);
+  launchctl(["unload", "-w", plist]);
+  rmSync(plist, { force: true });
+}
+function state2(fqdn) {
+  const info = launchctl(["list", label2(fqdn)]);
+  if (/"PID"\s*=/.test(info)) return "active";
+  return existsSync2(plistPath(fqdn)) ? "enabled" : "none";
+}
+
+// src/core/service-windows.ts
+var service_windows_exports = {};
+__export(service_windows_exports, {
+  assertSupported: () => assertSupported3,
+  buildTaskXml: () => buildTaskXml,
+  install: () => install3,
+  label: () => label3,
+  state: () => state3,
+  uninstall: () => uninstall3
+});
+import { execFileSync as execFileSync3 } from "child_process";
+import { writeFileSync as writeFileSync3 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join4 } from "path";
+var label3 = (fqdn) => `cloudtunnel\\${serviceSlug(fqdn)}`;
+var xml2 = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+function buildTaskXml(d) {
+  const args = `"${d.scriptPath}" ${d.argv.join(" ")}`;
+  return [
+    '<?xml version="1.0" encoding="UTF-16"?>',
+    '<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">',
+    `  <RegistrationInfo><Description>cloudtunnel ${xml2(d.fqdn)} (Cloudflare Tunnel)</Description></RegistrationInfo>`,
+    `  <Triggers><LogonTrigger><Enabled>true</Enabled><UserId>${xml2(d.user)}</UserId></LogonTrigger></Triggers>`,
+    `  <Principals><Principal id="Author"><UserId>${xml2(d.user)}</UserId><LogonType>InteractiveToken</LogonType><RunLevel>LeastPrivilege</RunLevel></Principal></Principals>`,
+    "  <Settings>",
+    "    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>",
+    "    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>",
+    "    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>",
+    "    <StartWhenAvailable>true</StartWhenAvailable>",
+    "    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>",
+    "    <RestartOnFailure><Interval>PT1M</Interval><Count>3</Count></RestartOnFailure>",
+    "    <Enabled>true</Enabled>",
+    "  </Settings>",
+    '  <Actions Context="Author">',
+    `    <Exec><Command>${xml2(d.nodePath)}</Command><Arguments>${xml2(args)}</Arguments></Exec>`,
+    "  </Actions>",
+    "</Task>",
+    ""
+  ].join("\r\n");
+}
+function schtasks(args) {
+  try {
+    return execFileSync3("schtasks", args, { stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" });
+  } catch (err) {
+    const out = err.stdout;
+    return out ? out.toString() : "";
+  }
+}
+function assertSupported3() {
+}
+function install3(d) {
+  const file = join4(tmpdir2(), `${d.slug}.task.xml`);
+  writeFileSync3(file, "\uFEFF" + buildTaskXml(d), { encoding: "utf16le" });
+  execFileSync3("schtasks", ["/Create", "/TN", label3(d.fqdn), "/XML", file, "/F"], { stdio: "inherit" });
+  schtasks(["/Run", "/TN", label3(d.fqdn)]);
+}
+function uninstall3(fqdn) {
+  schtasks(["/Delete", "/TN", label3(fqdn), "/F"]);
+}
+function state3(fqdn) {
+  const out = schtasks(["/Query", "/TN", label3(fqdn), "/FO", "LIST"]);
+  if (!out) return "none";
+  if (/\bRunning\b/.test(out)) return "active";
+  if (/\bDisabled\b/.test(out)) return "disabled";
+  if (/\bReady\b/.test(out)) return "enabled";
+  return "enabled";
+}
+
+// src/core/service.ts
+function pick() {
+  switch (process.platform) {
+    case "linux":
+      return service_systemd_exports;
+    case "darwin":
+      return service_launchd_exports;
+    case "win32":
+      return service_windows_exports;
+    default:
+      return null;
+  }
+}
+function required() {
+  const b = pick();
+  if (!b) {
+    throw new CliError(`Boot services aren't supported on ${process.platform}.`, {
+      hint: "run `cloudtunnel up <spec> --detach` and use your OS's own autostart"
+    });
+  }
+  return b;
+}
+function assertServiceSupported() {
+  required().assertSupported();
+}
+function serviceName(fqdn) {
+  return pick()?.label(fqdn) ?? `cloudtunnel-${fqdn}`;
+}
+function installServiceForSpec(params) {
+  const b = required();
+  b.assertSupported();
+  b.install(describeService(params));
+}
+function uninstallService(fqdn) {
+  pick()?.uninstall(fqdn);
+}
+function serviceState(fqdn) {
+  return pick()?.state(fqdn) ?? "none";
+}
+function legacyUnitExists2(profile) {
+  return process.platform === "linux" ? legacyUnitExists(profile) : false;
+}
+function removeLegacyUnit2(profile) {
+  if (process.platform === "linux") removeLegacyUnit(profile);
+}
+
+// src/config/legacy-migrate.ts
+var skipMarker = `${profilesFile}.migrate-skip`;
+async function migrateLegacyProfiles() {
+  if (!existsSync3(profilesFile) || existsSync3(skipMarker)) return;
+  let profiles;
+  try {
+    profiles = JSON.parse(readFileSync(profilesFile, "utf8"));
+  } catch {
+    return;
+  }
+  const legacy = Object.entries(profiles).filter(([name]) => legacyUnitExists2(name));
+  if (legacy.length === 0) {
+    try {
+      renameSync(profilesFile, `${profilesFile}.migrated`);
+    } catch {
+    }
+    return;
+  }
+  const ok = await confirm(`Found ${legacy.length} boot service(s) from an older cloudtunnel. Migrate them now? (needs sudo)`);
+  if (!ok) {
+    writeFileSync4(skipMarker, "");
+    say.dim(`  Skipped. Delete ${skipMarker} to be asked again.`);
+    return;
+  }
+  let migrated = 0;
+  try {
+    for (const [name, profile] of legacy) {
+      for (const svc of profile.services ?? []) {
+        const zone = svc.domain ?? profile.domain;
+        if (!zone) continue;
+        installServiceForSpec({
+          subdomain: svc.name,
+          port: svc.port,
+          host: svc.host,
+          zone,
+          proto: svc.proto,
+          protocol: profile.protocol
+        });
+        migrated++;
+      }
+      removeLegacyUnit2(name);
+    }
+    renameSync(profilesFile, `${profilesFile}.migrated`);
+    say.ok(`Migrated ${migrated} boot service(s). See them with: cloudtunnel ls`);
+  } catch (err) {
+    writeFileSync4(skipMarker, "");
+    say.warn(`Migration incomplete: ${err.message}. Won't retry automatically (delete ${skipMarker} to retry).`);
+  }
+}
+
+// src/commands/login.ts
+import * as clack from "@clack/prompts";
+
 // src/config/token-url.ts
 import { spawn } from "child_process";
 var REQUIRED_SCOPES = [
@@ -217,9 +671,7 @@ function registerLogin(program) {
 }
 
 // src/commands/up.ts
-import { join as join2 } from "path";
-import { readFileSync as readFileSync4 } from "fs";
-import * as clack2 from "@clack/prompts";
+import * as clack3 from "@clack/prompts";
 
 // src/config/ensure-auth.ts
 async function ensureAuth() {
@@ -236,10 +688,10 @@ async function ensureAuth() {
 }
 
 // src/connector/binary.ts
-import { execFileSync } from "child_process";
+import { execFileSync as execFileSync4 } from "child_process";
 import { createHash } from "crypto";
-import { chmodSync, existsSync, readFileSync, writeFileSync } from "fs";
-import { join } from "path";
+import { chmodSync, existsSync as existsSync4, readFileSync as readFileSync2, writeFileSync as writeFileSync5 } from "fs";
+import { join as join5 } from "path";
 var PINNED_VERSION = "2025.1.0";
 var RELEASE_BASE = `https://github.com/cloudflare/cloudflared/releases/download/${PINNED_VERSION}`;
 var ASSETS = {
@@ -251,18 +703,18 @@ var ASSETS = {
 };
 function binaryWorks(bin) {
   try {
-    execFileSync(bin, ["--version"], { stdio: "ignore" });
+    execFileSync4(bin, ["--version"], { stdio: "ignore" });
     return true;
   } catch {
     return false;
   }
 }
 function cachedPath() {
-  return join(binDir, process.platform === "win32" ? "cloudflared.exe" : "cloudflared");
+  return join5(binDir, process.platform === "win32" ? "cloudflared.exe" : "cloudflared");
 }
 function isMusl() {
   try {
-    return process.platform === "linux" && readFileSync("/usr/bin/ldd", "utf8").includes("musl");
+    return process.platform === "linux" && readFileSync2("/usr/bin/ldd", "utf8").includes("musl");
   } catch {
     return false;
   }
@@ -270,7 +722,7 @@ function isMusl() {
 async function ensureCloudflared() {
   if (binaryWorks("cloudflared")) return "cloudflared";
   const cached = cachedPath();
-  if (existsSync(cached) && binaryWorks(cached)) return cached;
+  if (existsSync4(cached) && binaryWorks(cached)) return cached;
   return downloadCloudflared(cached);
 }
 async function downloadCloudflared(dest) {
@@ -298,7 +750,7 @@ async function downloadCloudflared(dest) {
   }
   ensureDirs();
   const binary = asset.archive ? extractTgz(bytes) : bytes;
-  writeFileSync(dest, binary, { mode: 493 });
+  writeFileSync5(dest, binary, { mode: 493 });
   chmodSync(dest, 493);
   if (!binaryWorks(dest)) throw new CliError("Downloaded cloudflared is not runnable.");
   return dest;
@@ -309,26 +761,33 @@ function extractTgz(_bytes) {
   });
 }
 
+// src/core/up-runner.ts
+import { join as join6 } from "path";
+import * as clack2 from "@clack/prompts";
+
 // src/connector/process.ts
-import { execFileSync as execFileSync2, spawn as spawn2 } from "child_process";
+import { execFileSync as execFileSync5, spawn as spawn2 } from "child_process";
 import { openSync } from "fs";
 
 // src/connector/registry.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, renameSync, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync3, renameSync as renameSync2, writeFileSync as writeFileSync6 } from "fs";
 import { readFile } from "fs/promises";
-import os from "os";
+import os3 from "os";
 import lockfile from "proper-lockfile";
+function entryFqdn(e) {
+  return e.subdomain === "@" ? e.zone : `${e.subdomain}.${e.zone}`;
+}
 function currentBootId() {
   try {
-    return readFileSync2("/proc/sys/kernel/random/boot_id", "utf8").trim();
+    return readFileSync3("/proc/sys/kernel/random/boot_id", "utf8").trim();
   } catch {
-    const bootMinute = Math.floor((Date.now() - os.uptime() * 1e3) / 6e4);
-    return `boot-${bootMinute}-${os.hostname()}`;
+    const bootMinute = Math.floor((Date.now() - os3.uptime() * 1e3) / 6e4);
+    return `boot-${bootMinute}-${os3.hostname()}`;
   }
 }
 function readRegistry() {
   try {
-    return JSON.parse(readFileSync2(registryFile, "utf8"));
+    return JSON.parse(readFileSync3(registryFile, "utf8"));
   } catch {
     return {};
   }
@@ -336,12 +795,12 @@ function readRegistry() {
 function writeRegistry(reg) {
   ensureDirs();
   const tmp = `${registryFile}.tmp`;
-  writeFileSync2(tmp, JSON.stringify(reg, null, 2), { mode: 384 });
-  renameSync(tmp, registryFile);
+  writeFileSync6(tmp, JSON.stringify(reg, null, 2), { mode: 384 });
+  renameSync2(tmp, registryFile);
 }
 async function mutateRegistry(fn) {
   ensureDirs();
-  if (!existsSync2(registryFile)) writeFileSync2(registryFile, "{}", { mode: 384 });
+  if (!existsSync5(registryFile)) writeFileSync6(registryFile, "{}", { mode: 384 });
   const release = await lockfile.lock(registryFile, { retries: { retries: 10, minTimeout: 50 } });
   try {
     const reg = readRegistry();
@@ -414,7 +873,7 @@ async function reconcile() {
   const entries = listEntries();
   for (const entry of entries) {
     if (entry.state === "running" && !await isOurConnector(entry)) {
-      const fqdn = `${entry.subdomain}.${entry.zone}`;
+      const fqdn = entryFqdn(entry);
       await mutateRegistry((reg) => {
         const e = reg[fqdn];
         if (e) {
@@ -449,7 +908,7 @@ async function stopConnector(entry) {
   const pid = entry.pid;
   if (process.platform === "win32") {
     try {
-      execFileSync2("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore" });
+      execFileSync5("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore" });
     } catch {
       return false;
     }
@@ -542,33 +1001,6 @@ async function waitHealthy(cf, tunnelId, opts = {}) {
 // src/core/orchestrator-create.ts
 import { randomInt as randomInt2 } from "crypto";
 
-// src/core/ingress.ts
-var HOSTNAME_RE = /^[a-zA-Z0-9.-]+$/;
-var IPV6_RE = /^[0-9a-fA-F:.]+$/;
-function validateHost(host) {
-  let h = host.trim();
-  const bracketed = h.startsWith("[") && h.endsWith("]");
-  if (bracketed) h = h.slice(1, -1);
-  const isV6 = bracketed || h.includes("::") || (h.match(/:/g)?.length ?? 0) >= 2;
-  const ok = h.length > 0 && (isV6 ? IPV6_RE.test(h) : HOSTNAME_RE.test(h));
-  if (!ok) {
-    throw new CliError(`Invalid host "${host}".`, {
-      hint: "use a hostname, IPv4, or IPv6 literal (e.g. 192.168.1.5 or ::1) \u2014 no port, scheme, or path"
-    });
-  }
-  return h;
-}
-function serviceUrl(proto, host, port) {
-  const authority = host.includes(":") ? `[${host}]` : host;
-  return `${proto}://${authority}:${port}`;
-}
-function buildIngress(opts) {
-  return [
-    { hostname: opts.hostname, service: serviceUrl(opts.proto, opts.host ?? "localhost", opts.port) },
-    { service: "http_status:404" }
-  ];
-}
-
 // src/core/slug.ts
 import { randomInt } from "crypto";
 var ADJECTIVES = [
@@ -607,10 +1039,10 @@ var NOUNS = [
   "tiger",
   "walnut"
 ];
-var pick = (arr) => arr[randomInt(arr.length)];
+var pick2 = (arr) => arr[randomInt(arr.length)];
 function randomSlug() {
   const suffix = randomInt(65536).toString(16).padStart(4, "0");
-  return `${pick(ADJECTIVES)}-${pick(NOUNS)}-${suffix}`;
+  return `${pick2(ADJECTIVES)}-${pick2(NOUNS)}-${suffix}`;
 }
 function resolveHostSpec(opts, defaultZone) {
   if (opts.hostname) {
@@ -667,8 +1099,8 @@ async function createTunnelSubdomain(cf, opts) {
   let dnsRecordId;
   try {
     const suffix = randomInt2(65536).toString(16).padStart(4, "0");
-    const label = host.subdomain === "@" ? "root" : host.subdomain;
-    const tunnel = await createTunnel(cf, `${MANAGED_TUNNEL_PREFIX}${label}-${suffix}`);
+    const label4 = host.subdomain === "@" ? "root" : host.subdomain;
+    const tunnel = await createTunnel(cf, `${MANAGED_TUNNEL_PREFIX}${label4}-${suffix}`);
     tunnelId = tunnel.id;
     const token = await getTunnelToken(cf, tunnelId);
     await putIngress(cf, tunnelId, buildIngress({ hostname: host.hostname, port: opts.port, proto: opts.proto, host: opts.host }));
@@ -738,20 +1170,20 @@ function resolveTarget(target) {
   const entries = listEntries();
   if (/^\d+$/.test(target)) {
     const byIndex = entries.find((e) => e.index === Number(target));
-    if (byIndex) return { fqdn: `${byIndex.subdomain}.${byIndex.zone}`, entry: byIndex };
+    if (byIndex) return { fqdn: entryFqdn(byIndex), entry: byIndex };
   }
   const byId = entries.filter((e) => e.tunnelId?.startsWith(target));
   const matches = byId.length > 0 ? byId : entries.filter((e) => e.subdomain === target);
   if (matches.length > 1) {
     throw new CliError(`"${target}" matches multiple subdomains.`, {
-      hint: `use a full hostname or a longer id: ${matches.map((m) => `${m.subdomain}.${m.zone}`).join(", ")}`
+      hint: `use a full hostname or a longer id: ${matches.map(entryFqdn).join(", ")}`
     });
   }
   const entry = matches[0];
   if (!entry) {
     throw new CliError(`No tracked subdomain matching "${target}".`, { hint: "see `cloudtunnel ls` for the #, name, or id" });
   }
-  return { fqdn: `${entry.subdomain}.${entry.zone}`, entry };
+  return { fqdn: entryFqdn(entry), entry };
 }
 async function removeTunnelSubdomain(cf, target, opts = {}) {
   const { fqdn, entry } = resolveTarget(target);
@@ -801,24 +1233,27 @@ async function listAll(cf, opts = {}) {
   const entries = await reconcile();
   const tunnels = new Map((await listTunnels(cf)).map((t) => [t.id, t]));
   const rows = entries.map((e) => {
+    const fqdn = entryFqdn(e);
     const gone = e.tunnelId ? !tunnels.has(e.tunnelId) : false;
+    const svc = serviceState(fqdn);
     return {
       num: e.index ? String(e.index) : "-",
-      hostname: `${e.subdomain}.${e.zone}`,
-      port: serviceUrl(e.proto, e.host ?? "localhost", e.port),
+      url: `https://${fqdn}`,
+      target: serviceUrl(e.proto, e.host ?? "localhost", e.port),
       state: !gone && e.state === "running" ? "up" : "down",
+      service: svc === "none" ? "-" : svc,
       pid: e.state === "running" && e.pid ? String(e.pid) : "-",
       managed: true
     };
   });
   if (opts.all) {
-    const { listCargoCnames } = await import("./dns-PAPFSYFP.js");
-    const { listZones: listZones3 } = await import("./zones-YNGQYXAF.js");
-    const tracked = new Set(entries.map((e) => `${e.subdomain}.${e.zone}`));
+    const { listCargoCnames } = await import("./dns-5OXFAQ4D.js");
+    const { listZones: listZones3 } = await import("./zones-QYV3DSEY.js");
+    const tracked = new Set(entries.map(entryFqdn));
     for (const zone of await listZones3(cf.token)) {
       for (const rec of await listCargoCnames(cf.token, zone.id)) {
         if (!tracked.has(rec.name)) {
-          rows.push({ num: "-", hostname: rec.name, port: "-", state: "unmanaged", pid: "-", managed: false });
+          rows.push({ num: "-", url: `https://${rec.name}`, target: "-", state: "unmanaged", service: "-", pid: "-", managed: false });
         }
       }
     }
@@ -826,70 +1261,108 @@ async function listAll(cf, opts = {}) {
   return rows;
 }
 
-// src/core/profiles.ts
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync3 } from "fs";
-function parseTransportProtocol(value) {
-  if (value === "auto" || value === "http2" || value === "quic") return value;
-  throw new CliError(`Invalid protocol "${value}".`, { hint: "use auto, http2, or quic" });
+// src/core/up-runner.ts
+function logFileFor(subdomain) {
+  return join6(logDir, `${subdomain === "@" ? "root" : subdomain}.log`);
 }
-function readProfiles() {
-  try {
-    return JSON.parse(readFileSync3(profilesFile, "utf8"));
-  } catch {
-    return {};
-  }
-}
-function writeProfiles(profiles) {
-  ensureDirs();
-  writeFileSync3(profilesFile, JSON.stringify(profiles, null, 2), { mode: 384 });
-}
-function listProfiles() {
-  return Object.entries(readProfiles()).map(([name, profile]) => ({ name, profile }));
-}
-function getProfile(name) {
-  const profile = readProfiles()[name];
-  if (!profile) {
-    throw new CliError(`No profile named "${name}".`, { hint: "list them with `cloudtunnel profiles`" });
+async function startTunnels(cf, bin, items, opts = {}) {
+  const started = [];
+  let tornDown = false;
+  const teardownAll = async (code) => {
+    if (tornDown) return;
+    tornDown = true;
+    try {
+      for (const s of started) {
+        try {
+          await removeTunnelSubdomain(cf, s.fqdn, { force: true, quiet: true });
+        } catch {
+        }
+      }
+      if (process.stdout.isTTY) clack2.outro(`Stopped \xB7 released ${started.length} subdomain(s)`);
+    } catch (err) {
+      reportError(err);
+    } finally {
+      process.exit(code);
+    }
+  };
+  const spin = clack2.spinner();
+  spin.start(items.length > 1 ? "Creating tunnels\u2026" : "Creating tunnel\u2026");
+  for (const item of items) {
+    spin.message(`Creating ${item.name ?? "tunnel"} (:${item.port})\u2026`);
+    const result = await createTunnelSubdomain(cf, item);
+    const fqdn = result.host.hostname;
+    const logFile = logFileFor(result.host.subdomain);
+    const conn = startConnector({
+      bin,
+      token: result.token,
+      detach: !!opts.detach,
+      logFile,
+      protocol: opts.protocol,
+      onExit: opts.detach ? void 0 : (code) => {
+        if (!tornDown) {
+          say.warn(`Connector for ${fqdn} exited.`);
+          void teardownAll(code ?? 1);
+        }
+      }
+    });
+    await patchEntry(fqdn, { pid: conn.pid, bootId: currentBootId(), logFile });
+    started.push({
+      fqdn,
+      subdomain: result.host.subdomain,
+      tunnelId: result.tunnelId,
+      target: serviceUrl(item.proto, item.host ?? "localhost", item.port),
+      pid: conn.pid
+    });
   }
-  return profile;
-}
-function saveProfile(name, profile) {
-  const profiles = readProfiles();
-  profiles[name] = profile;
-  writeProfiles(profiles);
-}
-function removeProfile(name) {
-  const profiles = readProfiles();
-  if (!profiles[name]) throw new CliError(`No profile named "${name}".`);
-  delete profiles[name];
-  writeProfiles(profiles);
-}
-function parseServiceSpec(spec) {
-  const at = spec.indexOf("@");
-  const host = at >= 0 ? validateHost(spec.slice(at + 1)) : void 0;
-  const [name, portStr, proto] = (at >= 0 ? spec.slice(0, at) : spec).split(":");
-  const port = Number(portStr);
-  if (!name || !Number.isInteger(port) || port < 1 || port > 65535) {
-    throw new CliError(`Invalid service "${spec}".`, { hint: "use name:port, e.g. api:3000 or web:5173:https" });
+  if (opts.detach) {
+    spin.stop(`${started.length} tunnel(s) started in the background`);
+    const lines2 = started.map((s) => `${formatRoute(s.fqdn, s.target)}  ${dim(`pid ${s.pid}`)}`);
+    clack2.note(lines2.join("\n"), "running in background");
+    if (process.stdout.isTTY) clack2.outro("Stop with: cloudtunnel delete <#|--all>");
+    return;
   }
-  if (proto && proto !== "http" && proto !== "https") {
-    throw new CliError(`Invalid protocol "${proto}" in "${spec}".`, { hint: "proto must be http or https" });
+  for (const sig of ["SIGINT", "SIGHUP", "SIGTERM"]) {
+    process.on(sig, () => void teardownAll(0));
   }
-  return { name, port, proto: proto ?? "http", ...host ? { host } : {} };
+  spin.message("Connecting to the Cloudflare edge\u2026");
+  const healths = await Promise.all(started.map((s) => waitHealthy(cf, s.tunnelId, { timeoutMs: 3e4 })));
+  const live = healths.filter((h) => h === "healthy").length;
+  spin.stop(`${started.length} tunnel(s) started`);
+  const lines = started.map((s, i) => `${formatRoute(s.fqdn, s.target)}${healths[i] === "healthy" ? "" : dim(`  (${healths[i]})`)}`);
+  clack2.note(lines.join("\n"), `${live}/${started.length} live`);
+  say.dim("Ctrl-C stops and releases them.");
+}
+
+// src/core/transport-protocol.ts
+function parseTransportProtocol(value) {
+  if (value === "auto" || value === "http2" || value === "quic") return value;
+  throw new CliError(`Invalid protocol "${value}".`, { hint: "use auto, http2, or quic" });
 }
 
 // src/commands/up.ts
-function parsePort(port) {
-  const n = Number(port);
-  if (!Number.isInteger(n) || n < 1 || n > 65535) {
-    throw new CliError(`Invalid port: ${port}`, { hint: "use a number 1\u201365535, e.g. `cloudtunnel 3000`" });
+function promptOrExit(value) {
+  if (clack3.isCancel(value)) {
+    clack3.cancel("Cancelled.");
+    process.exit(130);
   }
-  return n;
+  return value;
+}
+async function promptPort() {
+  const input = promptOrExit(
+    await clack3.text({
+      message: "Port to expose",
+      placeholder: "e.g. 3000",
+      validate: (v) => {
+        const n = Number(v);
+        if (!Number.isInteger(n) || n < 1 || n > 65535) return "Enter a port 1\u201365535";
+        return void 0;
+      }
+    })
+  );
+  return Number(input);
 }
 async function resolveDomain(cf, opts, creds) {
-  if (opts.hostname) return void 0;
-  const explicit = opts.domain ?? opts.zone;
-  if (explicit) return explicit;
+  if (opts.domain) return opts.domain;
   const zones = await listZones(cf.token);
   if (zones.length === 0) throw new CliError("No domains found in this Cloudflare account.");
   if (zones.length === 1) return zones[0].name;
@@ -897,111 +1370,66 @@ async function resolveDomain(cf, opts, creds) {
   if (creds.defaultZone) return creds.defaultZone;
   throw new CliError("Multiple domains in this account \u2014 pick one.", { hint: "pass -d <domain>" });
 }
-async function resolveSubdomain(opts) {
-  const explicit = opts.subdomain ?? opts.name;
-  if (explicit || opts.hostname) return explicit;
-  if (!process.stdin.isTTY) return void 0;
-  const input = await clack2.text({ message: "Subdomain", placeholder: "blank = random \xB7 @ = root domain" });
-  if (clack2.isCancel(input)) {
-    clack2.cancel("Cancelled.");
-    process.exit(130);
-  }
+async function resolveSpecSubdomain(spec, opts) {
+  if (spec.subdomain !== void 0) return spec.subdomain;
+  if (opts.yes || !process.stdin.isTTY) return void 0;
+  const input = promptOrExit(
+    await clack3.text({ message: `Subdomain for :${spec.port}`, placeholder: "blank = random \xB7 @ = root domain" })
+  );
   return input.trim() || void 0;
 }
-function showLogTail(logFile) {
-  try {
-    const tail = readFileSync4(logFile, "utf8").trim().split("\n").slice(-8).join("\n");
-    if (tail) say.dim(tail);
-  } catch {
-  }
-}
-async function runUp(portArg, opts) {
-  const port = parsePort(portArg);
+async function runUp(specArgs, opts) {
   const protocol = opts.protocol ? parseTransportProtocol(opts.protocol) : void 0;
-  const host = opts.source ? validateHost(opts.source) : void 0;
+  const parsed = specArgs.length ? specArgs.map(parseTunnelSpec) : null;
+  if (parsed === null && !process.stdin.isTTY) {
+    throw new CliError("No tunnel spec given.", { hint: "e.g. cloudtunnel api:8080" });
+  }
   const creds = await ensureAuth();
   const cf = resolveCf();
   const bin = await ensureCloudflared();
-  if (process.stdout.isTTY) clack2.intro("cloudtunnel");
+  if (process.stdout.isTTY) clack3.intro("cloudtunnel");
+  const specs = parsed ?? [{ port: await promptPort() }];
   const domain = await resolveDomain(cf, opts, creds);
-  const subdomain = await resolveSubdomain(opts);
-  const result = await createTunnelSubdomain(cf, {
-    port,
-    proto: opts.proto,
-    name: subdomain,
-    zone: domain,
-    hostname: opts.hostname,
-    host,
-    defaultZone: creds.defaultZone,
-    force: opts.force,
-    yes: opts.yes
-  });
-  const fqdn = result.host.hostname;
-  const logLabel = result.host.subdomain === "@" ? "root" : result.host.subdomain;
-  const logFile = join2(logDir, `${logLabel}.log`);
-  const target = serviceUrl(opts.proto, host ?? "localhost", port);
-  if (opts.detach) {
-    const started2 = startConnector({ bin, token: result.token, detach: true, logFile, protocol });
-    await patchEntry(fqdn, { pid: started2.pid, bootId: currentBootId(), logFile });
-    clack2.note(formatRoute(fqdn, target), `pid ${started2.pid}`);
-    if (process.stdout.isTTY) clack2.outro(`Stop it with: cloudtunnel down ${result.host.subdomain}`);
+  const items = [];
+  for (const spec of specs) {
+    let name = await resolveSpecSubdomain(spec, opts);
+    if (opts.service && name === void 0) name = randomSlug();
+    items.push({
+      port: spec.port,
+      proto: opts.proto,
+      name,
+      zone: domain,
+      host: spec.host,
+      defaultZone: creds.defaultZone,
+      force: opts.force,
+      yes: opts.yes
+    });
+  }
+  if (opts.service) {
+    registerServices(items, domain, opts.proto, protocol);
     return;
   }
-  const spin = clack2.spinner();
-  let spinnerActive = true;
-  const stopSpin = (msg) => {
-    if (spinnerActive) {
-      spinnerActive = false;
-      spin.stop(msg);
-    }
-  };
-  spin.start("Connecting to the Cloudflare edge\u2026");
-  const controller = new AbortController();
-  let tornDown = false;
-  const teardown = async (exitCode) => {
-    if (tornDown) return;
-    tornDown = true;
-    controller.abort();
-    stopSpin("Stopping\u2026");
-    try {
-      await removeTunnelSubdomain(cf, fqdn, { force: true, quiet: true });
-      clack2.outro(`Stopped \xB7 ${fqdn} released`);
-    } catch (err) {
-      reportError(err);
-    } finally {
-      process.exit(exitCode);
-    }
-  };
-  const started = startConnector({
-    bin,
-    token: result.token,
-    detach: false,
-    logFile,
-    protocol,
-    onExit: (code) => {
-      if (!tornDown) {
-        stopSpin("cloudflared exited");
-        showLogTail(logFile);
-        void teardown(code ?? 1);
-      }
-    }
-  });
-  await patchEntry(fqdn, { pid: started.pid, bootId: currentBootId(), logFile });
-  for (const sig of ["SIGINT", "SIGHUP", "SIGTERM"]) {
-    process.on(sig, () => void teardown(0));
+  await startTunnels(cf, bin, items, { detach: opts.detach, protocol });
+}
+function registerServices(items, domain, proto, protocol) {
+  assertServiceSupported();
+  if (!protocol) {
+    say.warn("No edge protocol set \u2014 cloudflared will pick QUIC, which some networks drop.");
+    say.dim("  \u2192 add --protocol http2 for UDP-hostile networks");
   }
-  const health = await waitHealthy(cf, result.tunnelId, { signal: controller.signal });
-  if (health === "healthy") {
-    stopSpin("Connected");
-    clack2.note(`${formatRoute(fqdn, target)}
-${dim("Ctrl-C stops and releases this subdomain")}`, "Live");
-  } else if (health === "provisioning") {
-    stopSpin("Provisioning");
-    say.warn(`${fqdn} is not healthy yet \u2014 it should be live shortly.`);
+  const done = [];
+  for (const item of items) {
+    const subdomain = item.name;
+    const fqdn = subdomain === "@" ? domain : `${subdomain}.${domain}`;
+    installServiceForSpec({ subdomain, port: item.port, host: item.host, zone: domain, proto, protocol });
+    done.push(`${serviceName(fqdn)} \u2192 https://${fqdn}`);
   }
+  say.ok(`Registered ${done.length} boot service(s):`);
+  for (const line of done) say.dim(`  ${line}`);
+  say.dim("  \u2192 check them: cloudtunnel ls   \xB7   remove: cloudtunnel delete <#>");
 }
 function registerUp(program) {
-  program.command("up").argument("<port>", "local port to expose (e.g. 3000)").description("Expose a local port at an HTTPS subdomain (also: `cloudtunnel <port>`)").option("-s, --subdomain <name>", "subdomain label (prompted, or random if left blank)").option("-d, --domain <domain>", "domain to create the subdomain under (prompted from a list if unset)").option("--name <name>", "alias of --subdomain").option("--zone <domain>", "alias of --domain").option("--hostname <fqdn>", "full hostname override (instead of --subdomain + --domain)").option("--source <host>", "forward to this host/IP instead of localhost (e.g. a LAN device or ::1)").option("--detach", "run the connector in the background").option("-f, --force", "replace a non-tunnel DNS record occupying the hostname").option("-y, --yes", "don't ask before replacing an existing record").option("--proto <proto>", "local service protocol: http | https", "http").option("--protocol <proto>", "cloudflared edge transport: auto | http2 | quic (http2 for UDP-hostile networks)").action((port, opts) => runUp(port, opts));
+  program.command("up", { isDefault: true }).argument("[specs...]", "tunnels to start: [subdomain:]port[@host]  (e.g. api:8080 web:8081@localhost)").description("Start one or more tunnels (also: `cloudtunnel 8080`)").option("-d, --domain <domain>", "domain for the subdomains (prompted from a list if unset)").option("--proto <proto>", "local service protocol: http | https", "http").option("--protocol <proto>", "cloudflared edge transport: auto | http2 | quic (http2 for UDP-hostile networks)").option("--detach", "run the connectors in the background").option("--service", "register each subdomain as a boot service (Linux systemd \xB7 macOS launchd \xB7 Windows Task Scheduler)").option("-f, --force", "replace a non-tunnel DNS record occupying the hostname").option("-y, --yes", "don't prompt; don't ask before replacing an existing record").action((specs, opts) => runUp(specs, opts));
 }
 
 // src/commands/ls.ts
@@ -1015,15 +1443,23 @@ function registerLs(program) {
       return;
     }
     printTable(
-      ["#", "SUBDOMAIN", "TARGET", "STATE", "PID"],
-      rows.map((r) => [r.num, r.hostname, r.port, r.state, r.pid])
+      ["#", "URL", "TARGET", "STATE", "SERVICE", "PID"],
+      rows.map((r) => [r.num, r.url, r.target, r.state, r.service, r.pid])
     );
   });
 }
 
-// src/commands/down.ts
-function registerDown(program) {
-  program.command("down").aliases(["rm", "remove", "delete", "stop"]).argument("[target]", "subdomain name / hostname / id / # to release (omit with --all)").description("Stop and release a subdomain \u2014 removes the tunnel + DNS on Cloudflare").option("--all", "release every tracked subdomain").option("-f, --force", "release even a resource not created by cloudtunnel").option("--dry-run", "show what would be released without doing it").action(async (target, opts) => {
+// src/commands/delete.ts
+async function deleteOne(cf, fqdn, opts) {
+  const hasService = serviceState(fqdn) !== "none";
+  if (hasService && !opts.dryRun) uninstallService(fqdn);
+  await removeTunnelSubdomain(cf, fqdn, { force: opts.force, dryRun: opts.dryRun });
+  if (!hasService) return;
+  if (opts.dryRun) say.info(`Would also remove boot service ${serviceName(fqdn)}`);
+  else say.ok(`Removed boot service ${serviceName(fqdn)}`);
+}
+function registerDelete(program) {
+  program.command("delete").argument("[targets...]", "subdomains to remove by # / name / URL (omit with --all)").description("Release tunnel(s) \u2014 deletes the tunnel + DNS, and any systemd boot service").option("--all", "release every tracked subdomain").option("-f, --force", "release even a resource not created by cloudtunnel").option("--dry-run", "show what would be released without doing it").action(async (targets, opts) => {
     await ensureAuth();
     const cf = resolveCf();
     if (opts.all) {
@@ -1033,259 +1469,27 @@ function registerDown(program) {
         return;
       }
       for (const e of entries) {
+        const fqdn = entryFqdn(e);
         try {
-          await removeTunnelSubdomain(cf, `${e.subdomain}.${e.zone}`, { force: opts.force, dryRun: opts.dryRun });
+          await deleteOne(cf, fqdn, opts);
         } catch (err) {
-          say.warn(`Could not release ${e.subdomain}.${e.zone}: ${err.message}`);
+          say.warn(`Could not release ${fqdn}: ${err.message}`);
         }
       }
       return;
     }
-    if (!target) throw new CliError("Pass a subdomain (name / id / #) or --all.");
-    await removeTunnelSubdomain(cf, target, { force: opts.force, dryRun: opts.dryRun });
-  });
-}
-
-// src/commands/zones.ts
-function registerZones(program) {
-  program.command("zones").description("List the zones (domains) available in your Cloudflare account").action(async () => {
-    await ensureAuth();
-    const cf = resolveCf();
-    const zones = await listZones(cf.token);
-    if (zones.length === 0) {
-      say.info("No zones in this account.");
-      return;
-    }
-    printTable(
-      ["ZONE", "STATUS", "ID"],
-      zones.map((z) => [z.name, z.status ?? "-", z.id])
-    );
-  });
-}
-
-// src/commands/save.ts
-function registerSave(program) {
-  program.command("save").argument("<profile>", "profile name, e.g. mb").argument("[services...]", "services as name:port[:proto], e.g. api:3000 web:5173").description("Save a group of services as a profile you can `run` together").option("--from-running", "snapshot the currently tracked tunnels instead of listing services").option("-d, --domain <domain>", "default domain for this profile").option("--protocol <proto>", "edge transport for this profile: auto | http2 | quic").action((profile, specs, opts) => {
-    let services;
-    if (opts.fromRunning) {
-      const entries = listEntries().filter((e) => e.tunnelId);
-      if (entries.length === 0) {
-        throw new CliError("No tunnels to snapshot.", { hint: "start some with `cloudtunnel up`, or pass services like api:3000" });
-      }
-      services = entries.map((e) => ({ name: e.subdomain, port: e.port, proto: e.proto, domain: e.zone, ...e.host ? { host: e.host } : {} }));
-    } else {
-      if (specs.length === 0) {
-        throw new CliError("No services given.", { hint: "e.g. `cloudtunnel save mb api:3000 web:5173`" });
-      }
-      services = specs.map(parseServiceSpec);
+    if (targets.length === 0) throw new CliError("Pass a subdomain (# / name / URL) or --all.");
+    for (const target of targets) {
+      const { fqdn } = resolveTarget(target);
+      await deleteOne(cf, fqdn, opts);
     }
-    const protocol = opts.protocol ? parseTransportProtocol(opts.protocol) : void 0;
-    saveProfile(profile, { services, domain: opts.domain, protocol });
-    say.ok(`Saved profile "${profile}" (${services.length} service${services.length === 1 ? "" : "s"}). Run it: cloudtunnel run ${profile}`);
-  });
-}
-
-// src/commands/run.ts
-import { join as join3 } from "path";
-import * as clack3 from "@clack/prompts";
-async function runProfile(name, opts) {
-  const creds = await ensureAuth();
-  const cf = resolveCf();
-  const bin = await ensureCloudflared();
-  const profile = getProfile(name);
-  const protocol = opts.protocol ? parseTransportProtocol(opts.protocol) : profile.protocol;
-  if (process.stdout.isTTY) clack3.intro(`cloudtunnel \xB7 profile "${name}"`);
-  const spin = clack3.spinner();
-  spin.start("Creating tunnels\u2026");
-  const started = [];
-  for (const svc of profile.services) {
-    spin.message(`Creating ${svc.name} (:${svc.port})\u2026`);
-    const result = await createTunnelSubdomain(cf, {
-      port: svc.port,
-      proto: svc.proto,
-      name: svc.name,
-      host: svc.host,
-      zone: svc.domain ?? opts.domain ?? profile.domain,
-      defaultZone: creds.defaultZone,
-      force: opts.force,
-      yes: true
-      // batch: never prompt per service
-    });
-    const fqdn = result.host.hostname;
-    const logFile = join3(logDir, `${result.host.subdomain}.log`);
-    const conn = startConnector({
-      bin,
-      token: result.token,
-      detach: !!opts.detach,
-      logFile,
-      protocol,
-      onExit: opts.detach ? void 0 : () => say.warn(`Connector for ${fqdn} exited.`)
-    });
-    await patchEntry(fqdn, { pid: conn.pid, bootId: currentBootId(), logFile });
-    started.push({ fqdn, subdomain: result.host.subdomain, tunnelId: result.tunnelId, target: serviceUrl(svc.proto, svc.host ?? "localhost", svc.port), pid: conn.pid });
-  }
-  if (opts.detach) {
-    spin.stop(`${started.length} service(s) started in the background`);
-    const lines2 = started.map((s) => `${formatRoute(s.fqdn, s.target)}  ${dim(`pid ${s.pid}`)}`);
-    clack3.note(lines2.join("\n"), `profile "${name}" \u2014 running in background`);
-    if (process.stdout.isTTY) clack3.outro("Stop them with: cloudtunnel down --all");
-    return;
-  }
-  spin.message("Connecting to the Cloudflare edge\u2026");
-  const healths = await Promise.all(started.map((s) => waitHealthy(cf, s.tunnelId, { timeoutMs: 3e4 })));
-  const live = healths.filter((h) => h === "healthy").length;
-  spin.stop(`${started.length} service(s) started`);
-  const lines = started.map((s, i) => `${formatRoute(s.fqdn, s.target)}${healths[i] === "healthy" ? "" : dim(`  (${healths[i]})`)}`);
-  clack3.note(lines.join("\n"), `profile "${name}" \u2014 ${live}/${started.length} live`);
-  say.dim("Ctrl-C stops and releases all of them.");
-  let tornDown = false;
-  const teardownAll = async (code) => {
-    if (tornDown) return;
-    tornDown = true;
-    try {
-      for (const s of started) {
-        try {
-          await removeTunnelSubdomain(cf, s.fqdn, { force: true, quiet: true });
-        } catch {
-        }
-      }
-      if (process.stdout.isTTY) clack3.outro(`Stopped \xB7 released ${started.length} subdomain(s)`);
-    } catch (err) {
-      reportError(err);
-    } finally {
-      process.exit(code);
-    }
-  };
-  for (const sig of ["SIGINT", "SIGHUP", "SIGTERM"]) {
-    process.on(sig, () => void teardownAll(0));
-  }
-}
-function registerRun(program) {
-  program.command("run").argument("<profile>", "name of a saved profile (see `cloudtunnel profiles`)").description("Start every service in a saved profile at once").option("-f, --force", "take over subdomains already occupied by another record").option("-d, --domain <domain>", "override the profile's domain for this run").option("--detach", "run all connectors in the background (stop with `cloudtunnel down --all`)").option("--protocol <proto>", "edge transport: auto | http2 | quic (overrides the profile's saved protocol)").action((name, opts) => runProfile(name, opts));
-}
-
-// src/core/systemd.ts
-import { execFileSync as execFileSync3 } from "child_process";
-import { writeFileSync as writeFileSync4 } from "fs";
-import { tmpdir } from "os";
-import { dirname, join as join4 } from "path";
-function serviceName(profile) {
-  return `cloudtunnel-${profile}.service`;
-}
-function unitPath(profile) {
-  return `/etc/systemd/system/${serviceName(profile)}`;
-}
-function buildUnit(p) {
-  const nodeBin = dirname(p.nodePath);
-  const proto = p.protocol ? ` --protocol ${p.protocol}` : "";
-  return [
-    "[Unit]",
-    `Description=cloudtunnel profile "${p.profile}" (Cloudflare Tunnel)`,
-    "After=network-online.target",
-    "Wants=network-online.target",
-    "",
-    "[Service]",
-    "Type=simple",
-    `User=${p.user}`,
-    `Environment=HOME=${p.home}`,
-    `Environment=PATH=${nodeBin}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`,
-    `ExecStart=${p.nodePath} ${p.scriptPath} run ${p.profile} -f${proto}`,
-    "Restart=on-failure",
-    "RestartSec=5",
-    "",
-    "[Install]",
-    "WantedBy=multi-user.target",
-    ""
-  ].join("\n");
-}
-function assertSystemd() {
-  if (process.platform !== "linux") {
-    throw new CliError("Service registration is Linux/systemd only.", {
-      hint: "on macOS/Windows run `cloudtunnel run <profile> --detach` at login instead"
-    });
-  }
-  try {
-    execFileSync3("systemctl", ["--version"], { stdio: "ignore" });
-  } catch {
-    throw new CliError("systemd (systemctl) was not found on this host.");
-  }
-}
-function privileged(args) {
-  const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
-  const argv = isRoot ? args : ["sudo", ...args];
-  execFileSync3(argv[0], argv.slice(1), { stdio: "inherit" });
-}
-function query(args) {
-  try {
-    return execFileSync3("systemctl", args, {
-      stdio: ["ignore", "pipe", "ignore"],
-      encoding: "utf8"
-    }).trim();
-  } catch (err) {
-    const out = err.stdout;
-    return out ? out.toString().trim() : "";
-  }
-}
-function installService(p) {
-  assertSystemd();
-  const tmp = join4(tmpdir(), serviceName(p.profile));
-  writeFileSync4(tmp, buildUnit(p), { mode: 420 });
-  privileged(["install", "-m", "0644", tmp, unitPath(p.profile)]);
-  privileged(["systemctl", "daemon-reload"]);
-  privileged(["systemctl", "enable", "--now", serviceName(p.profile)]);
-}
-function uninstallService(profile) {
-  assertSystemd();
-  try {
-    privileged(["systemctl", "disable", "--now", serviceName(profile)]);
-  } catch {
-  }
-  privileged(["rm", "-f", unitPath(profile)]);
-  privileged(["systemctl", "daemon-reload"]);
-}
-function serviceState(profile) {
-  if (process.platform !== "linux") return "none";
-  const name = serviceName(profile);
-  if (query(["is-active", name]) === "active") return "active";
-  const enabled = query(["is-enabled", name]);
-  if (enabled === "enabled" || enabled === "enabled-runtime") return "enabled";
-  if (enabled === "disabled" || enabled === "static") return "disabled";
-  return "none";
-}
-
-// src/commands/profiles.ts
-function formatService(state) {
-  return state === "none" ? dim("\u2013") : state;
-}
-function registerProfiles(program) {
-  program.command("profiles").description("List saved profiles (or delete one with --rm)").option("--rm <name>", "delete a profile").action((opts) => {
-    if (opts.rm) {
-      removeProfile(opts.rm);
-      say.ok(`Deleted profile "${opts.rm}".`);
-      return;
-    }
-    const profiles = listProfiles();
-    if (profiles.length === 0) {
-      say.info("No profiles yet. Create one: `cloudtunnel save mb api:3000 web:5173`");
-      return;
-    }
-    printTable(
-      ["PROFILE", "SERVICES", "DOMAIN", "PROTOCOL", "SERVICE"],
-      profiles.map(({ name, profile }) => [
-        name,
-        profile.services.map((s) => `${s.name}:${s.port}${s.host ? `@${s.host}` : ""}`).join(", "),
-        profile.domain ?? "(default)",
-        profile.protocol ?? "auto",
-        formatService(serviceState(name))
-      ])
-    );
   });
 }
 
 // src/commands/logs.ts
-import { closeSync, existsSync as existsSync3, openSync as openSync2, readFileSync as readFileSync5, readSync, statSync, watch } from "fs";
+import { closeSync, existsSync as existsSync6, openSync as openSync2, readFileSync as readFileSync4, readSync, statSync, watch } from "fs";
 function printTail(file, n) {
-  const lines = readFileSync5(file, "utf8").split("\n");
+  const lines = readFileSync4(file, "utf8").split("\n");
   const tail = lines.slice(-n).join("\n");
   process.stdout.write(tail.endsWith("\n") ? tail : `${tail}
 `);
@@ -1317,7 +1521,7 @@ function follow(file, fromPos) {
 function registerLogs(program) {
   program.command("logs").argument("<target>", "subdomain name / hostname / id / #").description("Show the connector log for a subdomain (use -f to follow)").option("-f, --follow", "keep printing new log lines (like tail -f)").option("-n, --lines <n>", "number of lines to show", "50").action((name, opts) => {
     const { fqdn, entry } = resolveTarget(name);
-    if (!entry?.logFile || !existsSync3(entry.logFile)) {
+    if (!entry?.logFile || !existsSync6(entry.logFile)) {
       throw new CliError(`No logs for ${fqdn} yet.`, { hint: "start it with `cloudtunnel up` or `cloudtunnel run`" });
     }
     const n = Math.max(1, Number(opts.lines) || 50);
@@ -1326,113 +1530,39 @@ function registerLogs(program) {
   });
 }
 
-// src/commands/service.ts
-import os2 from "os";
-import { realpathSync } from "fs";
-function entryScript() {
-  const p = process.argv[1];
-  if (!p) throw new CliError("Cannot resolve the cloudtunnel executable path.");
-  return realpathSync(p);
-}
-function enable(name, opts) {
-  const profile = getProfile(name);
-  let protocol = profile.protocol;
-  if (opts.protocol) {
-    protocol = parseTransportProtocol(opts.protocol);
-    saveProfile(name, { ...profile, protocol });
-  }
-  if (!protocol) {
-    say.warn("No edge protocol set \u2014 cloudflared will pick QUIC, which some networks drop.");
-    say.dim("  \u2192 set one with: cloudtunnel service enable " + name + " --protocol http2");
-  }
-  installService({
-    profile: name,
-    user: os2.userInfo().username,
-    home: os2.homedir(),
-    nodePath: process.execPath,
-    scriptPath: entryScript(),
-    protocol
-  });
-  say.ok(`Service ${serviceName(name)} enabled \u2014 starts on boot.`);
-  say.dim(`  \u2192 check it: cloudtunnel service status ${name}`);
-}
-function disable(name) {
-  getProfile(name);
-  uninstallService(name);
-  say.ok(`Service ${serviceName(name)} disabled and removed.`);
-}
-function status(name) {
-  getProfile(name);
-  say.info(`${serviceName(name)}: ${serviceState(name)}`);
-}
-function registerService(program) {
-  const svc = program.command("service").description("Register a profile as a systemd service that starts on boot");
-  svc.command("enable").argument("<profile>", "profile to register").option("--protocol <proto>", "edge transport for the service: auto | http2 | quic").description("Install + enable a boot service for the profile (needs sudo)").action((name, opts) => enable(name, opts));
-  svc.command("disable").argument("<profile>", "profile to unregister").description("Stop, disable, and remove the profile's boot service (needs sudo)").action((name) => disable(name));
-  svc.command("status").argument("<profile>", "profile to check").description("Show the systemd state of the profile's service").action((name) => status(name));
-}
-
 // src/index.ts
 var require2 = createRequire(import.meta.url);
 var pkg = require2("../package.json");
-var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
-  "login",
-  "up",
-  "ls",
-  "ps",
-  "down",
-  "rm",
-  "remove",
-  "delete",
-  "stop",
-  "logs",
-  "zones",
-  "save",
-  "run",
-  "profiles",
-  "service",
-  "help"
-]);
-function applyBarePortAlias(argv) {
-  const args = argv.slice(2);
-  const first = args[0];
-  if (first && /^\d{1,5}$/.test(first) && !KNOWN_COMMANDS.has(first)) {
-    args.unshift("up");
-  }
-  return [argv[0], argv[1], ...args];
-}
 function buildProgram() {
   const program = new Command();
-  program.name("cloudtunnel").description("Manage Cloudflare Tunnels and subdomains account-wide, from your terminal.").version(pkg.version, "-v, --version").showHelpAfterError();
+  program.name("cloudtunnel").description("Expose local ports at HTTPS subdomains on your own Cloudflare domains.").version(pkg.version, "-v, --version").showHelpAfterError();
   program.addHelpText(
     "before",
     [
       pc2.bold("Quickstart:"),
-      `  ${pc2.cyan("cloudtunnel login")}   once \u2014 paste a token (or set CLOUDFLARE_API_TOKEN)`,
-      `  ${pc2.cyan("cloudtunnel 3000")}    \u2192 your local :3000 goes live at an HTTPS URL`,
+      `  ${pc2.cyan("cloudtunnel login")}       once \u2014 paste a token (or set CLOUDFLARE_API_TOKEN)`,
+      `  ${pc2.cyan("cloudtunnel 8080")}        your local :8080 goes live at an HTTPS URL`,
+      `  ${pc2.cyan("cloudtunnel api:8080")}    api.<domain> \u2192 localhost:8080`,
+      `  ${pc2.cyan("cloudtunnel ls")}          list tunnels   ${pc2.dim("\xB7")}   ${pc2.cyan("cloudtunnel delete <#>")}   remove one`,
       ""
     ].join("\n")
   );
-  for (const register of [
-    registerLogin,
-    registerUp,
-    registerLs,
-    registerDown,
-    registerZones,
-    registerSave,
-    registerRun,
-    registerProfiles,
-    registerService,
-    registerLogs
-  ]) {
+  for (const register of [registerLogin, registerUp, registerLs, registerDelete, registerLogs]) {
     register(program);
   }
   return program;
 }
+function shouldMigrate(argv) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
+  const rest = argv.slice(2);
+  const infoFlag = /* @__PURE__ */ new Set(["-h", "--help", "-v", "--version", "help"]);
+  return !rest.some((a) => infoFlag.has(a));
+}
 async function main() {
+  if (shouldMigrate(process.argv)) await migrateLegacyProfiles();
   const program = buildProgram();
   try {
-    await program.parseAsync(applyBarePortAlias(process.argv));
+    await program.parseAsync(process.argv);
   } catch (err) {
     process.exitCode = reportError(err);
   }