@iamken/cloudtunnel 0.4.0 → 0.6.0

package/dist/index.js

@@ -2,15 +2,16 @@
 import {
   listZones,
   resolveZone
-} from "./chunk-2TCFCMJS.js";
+} from "./chunk-CWJA4L7J.js";
 import {
   createCname,
   deleteDnsRecord,
   findCname,
   isManagedDns
-} from "./chunk-YLTQB4F7.js";
+} from "./chunk-NZKGIDIW.js";
 import {
   CliError,
+  __export,
   binDir,
   cfPaginate,
   cfRequest,
@@ -24,7 +25,7 @@ import {
   reportError,
   resolveCf,
   saveConfig
-} from "./chunk-UPBVRXLF.js";
+} from "./chunk-RWR6VXNB.js";
 
 // src/index.ts
 import { Command } from "commander";
@@ -32,7 +33,7 @@ import { createRequire } from "module";
 import pc2 from "picocolors";
 
 // src/config/legacy-migrate.ts
-import { existsSync as existsSync2, readFileSync, renameSync, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync3, readFileSync, renameSync, writeFileSync as writeFileSync4 } from "fs";
 
 // src/ui/output.ts
 import pc from "picocolors";
@@ -66,10 +67,10 @@ function printTable(head, rows) {
   for (const row of rows) table.push(row);
   console.log(table.toString());
 }
-async function selectOne(message, items, label) {
+async function selectOne(message, items, label4) {
   const value = await select({
     message,
-    options: items.map((item, i) => ({ value: String(i), label: label(item) }))
+    options: items.map((item, i) => ({ value: String(i), label: label4(item) }))
   });
   if (isCancel(value)) {
     cancel("Cancelled.");
@@ -78,11 +79,13 @@ async function selectOne(message, items, label) {
   return items[Number(value)];
 }
 
-// src/core/systemd.ts
-import { execFileSync } from "child_process";
-import { existsSync, realpathSync, writeFileSync } from "fs";
-import os, { tmpdir } from "os";
-import { dirname, join } from "path";
+// src/core/service.ts
+import { join as join5 } from "path";
+
+// src/core/service-exec.ts
+import { realpathSync } from "fs";
+import os from "os";
+import { join } from "path";
 
 // src/core/ingress.ts
 var HOSTNAME_RE = /^[a-zA-Z0-9.-]+$/;
@@ -157,29 +160,74 @@ function formatTunnelSpec(s) {
   return `${s.subdomain}:${s.port}${s.host ? `@${s.host}` : ""}`;
 }
 
-// src/core/systemd.ts
-function serviceName(fqdn) {
-  return `cloudtunnel-${fqdn.replace(/[^a-zA-Z0-9]+/g, "-")}.service`;
+// src/core/service-exec.ts
+var fqdnFor = (subdomain, zone) => subdomain === "@" ? zone : `${subdomain}.${zone}`;
+var serviceSlug = (fqdn) => fqdn.replace(/[^a-zA-Z0-9]+/g, "-");
+function buildUpArgs(p) {
+  const spec = formatTunnelSpec({ subdomain: p.subdomain, port: p.port, host: p.host });
+  return [
+    "up",
+    spec,
+    "-d",
+    p.zone,
+    ...p.proto === "https" ? ["--proto", "https"] : [],
+    ...p.protocol ? ["--protocol", p.protocol] : [],
+    "-f",
+    "-y"
+  ];
+}
+function entryScript() {
+  const p = process.argv[1];
+  if (!p) throw new CliError("Cannot resolve the cloudtunnel executable path.");
+  return realpathSync(p);
 }
-function unitPath(fqdn) {
-  return `/etc/systemd/system/${serviceName(fqdn)}`;
+function describeService(p) {
+  const fqdn = fqdnFor(p.subdomain, p.zone);
+  const slug = serviceSlug(fqdn);
+  return {
+    fqdn,
+    slug,
+    argv: buildUpArgs(p),
+    nodePath: process.execPath,
+    scriptPath: entryScript(),
+    user: os.userInfo().username,
+    home: os.homedir(),
+    logFile: join(logDir, `${slug}.service.log`)
+  };
 }
-function buildUnit(p) {
-  const nodeBin = dirname(p.nodePath);
-  const proto = p.proto === "https" ? " --proto https" : "";
-  const protocol = p.protocol ? ` --protocol ${p.protocol}` : "";
+
+// src/core/service-systemd.ts
+var service_systemd_exports = {};
+__export(service_systemd_exports, {
+  assertSupported: () => assertSupported,
+  buildUnit: () => buildUnit,
+  install: () => install,
+  label: () => label,
+  legacyUnitExists: () => legacyUnitExists,
+  removeLegacyUnit: () => removeLegacyUnit,
+  state: () => state,
+  uninstall: () => uninstall
+});
+import { execFileSync } from "child_process";
+import { existsSync, writeFileSync } from "fs";
+import { tmpdir } from "os";
+import { dirname, join as join2 } from "path";
+var label = (fqdn) => `cloudtunnel-${serviceSlug(fqdn)}.service`;
+var unitPath = (fqdn) => `/etc/systemd/system/${label(fqdn)}`;
+function buildUnit(d) {
+  const nodeBin = dirname(d.nodePath);
   return [
     "[Unit]",
-    `Description=cloudtunnel ${p.fqdn} (Cloudflare Tunnel)`,
+    `Description=cloudtunnel ${d.fqdn} (Cloudflare Tunnel)`,
     "After=network-online.target",
     "Wants=network-online.target",
     "",
     "[Service]",
     "Type=simple",
-    `User=${p.user}`,
-    `Environment=HOME=${p.home}`,
+    `User=${d.user}`,
+    `Environment=HOME=${d.home}`,
     `Environment=PATH=${nodeBin}:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`,
-    `ExecStart=${p.nodePath} ${p.scriptPath} up ${p.spec} -d ${p.zone}${proto}${protocol} -f -y`,
+    `ExecStart=${d.nodePath} ${d.scriptPath} ${d.argv.join(" ")}`,
     "Restart=on-failure",
     "RestartSec=5",
     "",
@@ -188,18 +236,6 @@ function buildUnit(p) {
     ""
   ].join("\n");
 }
-function assertSystemd() {
-  if (process.platform !== "linux") {
-    throw new CliError("Service registration is Linux/systemd only.", {
-      hint: "on macOS/Windows run `cloudtunnel up <spec> --detach` at login instead"
-    });
-  }
-  try {
-    execFileSync("systemctl", ["--version"], { stdio: "ignore" });
-  } catch {
-    throw new CliError("systemd (systemctl) was not found on this host.");
-  }
-}
 function privileged(args) {
   const isRoot = typeof process.getuid === "function" && process.getuid() === 0;
   const argv = isRoot ? args : ["sudo", ...args];
@@ -213,40 +249,37 @@ function query(args) {
     return out ? out.toString().trim() : "";
   }
 }
-function entryScript() {
-  const p = process.argv[1];
-  if (!p) throw new CliError("Cannot resolve the cloudtunnel executable path.");
-  return realpathSync(p);
+function assertSupported() {
+  try {
+    execFileSync("systemctl", ["--version"], { stdio: "ignore" });
+  } catch {
+    throw new CliError("systemd (systemctl) was not found on this host.");
+  }
 }
-function installServiceForSpec(params) {
-  assertSystemd();
-  const fqdn = params.subdomain === "@" ? params.zone : `${params.subdomain}.${params.zone}`;
-  const unit = buildUnit({
-    fqdn,
-    spec: formatTunnelSpec({ subdomain: params.subdomain, port: params.port, host: params.host }),
-    zone: params.zone,
-    proto: params.proto,
-    user: os.userInfo().username,
-    home: os.homedir(),
-    nodePath: process.execPath,
-    scriptPath: entryScript(),
-    protocol: params.protocol
-  });
-  const tmp = join(tmpdir(), serviceName(fqdn));
-  writeFileSync(tmp, unit, { mode: 420 });
-  privileged(["install", "-m", "0644", tmp, unitPath(fqdn)]);
+function install(d) {
+  assertSupported();
+  const tmp = join2(tmpdir(), label(d.fqdn));
+  writeFileSync(tmp, buildUnit(d), { mode: 420 });
+  privileged(["install", "-m", "0644", tmp, unitPath(d.fqdn)]);
   privileged(["systemctl", "daemon-reload"]);
-  privileged(["systemctl", "enable", "--now", serviceName(fqdn)]);
+  privileged(["systemctl", "enable", "--now", label(d.fqdn)]);
 }
-function uninstallService(fqdn) {
-  assertSystemd();
+function uninstall(fqdn) {
   try {
-    privileged(["systemctl", "disable", "--now", serviceName(fqdn)]);
+    privileged(["systemctl", "disable", "--now", label(fqdn)]);
   } catch {
   }
   privileged(["rm", "-f", unitPath(fqdn)]);
   privileged(["systemctl", "daemon-reload"]);
 }
+function state(fqdn) {
+  const name = label(fqdn);
+  if (query(["is-active", name]) === "active") return "active";
+  const enabled = query(["is-enabled", name]);
+  if (enabled === "enabled" || enabled === "enabled-runtime") return "enabled";
+  if (enabled === "disabled" || enabled === "static") return "disabled";
+  return "none";
+}
 function legacyUnitExists(profile) {
   return existsSync(`/etc/systemd/system/cloudtunnel-${profile}.service`);
 }
@@ -259,27 +292,219 @@ function removeLegacyUnit(profile) {
   privileged(["rm", "-f", `/etc/systemd/system/${name}`]);
   privileged(["systemctl", "daemon-reload"]);
 }
+
+// src/core/service-launchd.ts
+var service_launchd_exports = {};
+__export(service_launchd_exports, {
+  assertSupported: () => assertSupported2,
+  buildPlist: () => buildPlist,
+  install: () => install2,
+  label: () => label2,
+  state: () => state2,
+  uninstall: () => uninstall2
+});
+import { execFileSync as execFileSync2 } from "child_process";
+import { existsSync as existsSync2, mkdirSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, join as join3 } from "path";
+import os2 from "os";
+var label2 = (fqdn) => `com.cloudtunnel.${serviceSlug(fqdn)}`;
+var agentsDir = () => join3(os2.homedir(), "Library", "LaunchAgents");
+var plistPath = (fqdn) => join3(agentsDir(), `${label2(fqdn)}.plist`);
+var xml = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+function buildPlist(d) {
+  const args = [d.nodePath, d.scriptPath, ...d.argv].map((a) => `    <string>${xml(a)}</string>`).join("\n");
+  const nodeBin = dirname2(d.nodePath);
+  const path = `${nodeBin}:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin`;
+  return [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    '<plist version="1.0">',
+    "<dict>",
+    `  <key>Label</key><string>${xml(label2(d.fqdn))}</string>`,
+    "  <key>ProgramArguments</key>",
+    "  <array>",
+    args,
+    "  </array>",
+    "  <key>RunAtLoad</key><true/>",
+    "  <key>KeepAlive</key><true/>",
+    "  <key>EnvironmentVariables</key>",
+    "  <dict>",
+    `    <key>PATH</key><string>${xml(path)}</string>`,
+    `    <key>HOME</key><string>${xml(d.home)}</string>`,
+    "  </dict>",
+    `  <key>StandardOutPath</key><string>${xml(d.logFile)}</string>`,
+    `  <key>StandardErrorPath</key><string>${xml(d.logFile)}</string>`,
+    "</dict>",
+    "</plist>",
+    ""
+  ].join("\n");
+}
+function launchctl(args) {
+  try {
+    return execFileSync2("launchctl", args, { stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" });
+  } catch (err) {
+    const out = err.stdout;
+    return out ? out.toString() : "";
+  }
+}
+function assertSupported2() {
+}
+function install2(d) {
+  ensureDirs();
+  mkdirSync(agentsDir(), { recursive: true });
+  const plist = plistPath(d.fqdn);
+  writeFileSync2(plist, buildPlist(d), { mode: 420 });
+  launchctl(["unload", "-w", plist]);
+  execFileSync2("launchctl", ["load", "-w", plist], { stdio: "inherit" });
+}
+function uninstall2(fqdn) {
+  const plist = plistPath(fqdn);
+  launchctl(["unload", "-w", plist]);
+  rmSync(plist, { force: true });
+}
+function state2(fqdn) {
+  const info = launchctl(["list", label2(fqdn)]);
+  if (/"PID"\s*=/.test(info)) return "active";
+  return existsSync2(plistPath(fqdn)) ? "enabled" : "none";
+}
+
+// src/core/service-windows.ts
+var service_windows_exports = {};
+__export(service_windows_exports, {
+  assertSupported: () => assertSupported3,
+  buildTaskXml: () => buildTaskXml,
+  install: () => install3,
+  label: () => label3,
+  state: () => state3,
+  uninstall: () => uninstall3
+});
+import { execFileSync as execFileSync3 } from "child_process";
+import { writeFileSync as writeFileSync3 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join4 } from "path";
+var label3 = (fqdn) => `cloudtunnel\\${serviceSlug(fqdn)}`;
+var xml2 = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+function buildTaskXml(d) {
+  const args = `"${d.scriptPath}" ${d.argv.join(" ")}`;
+  return [
+    '<?xml version="1.0" encoding="UTF-16"?>',
+    '<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">',
+    `  <RegistrationInfo><Description>cloudtunnel ${xml2(d.fqdn)} (Cloudflare Tunnel)</Description></RegistrationInfo>`,
+    `  <Triggers><LogonTrigger><Enabled>true</Enabled><UserId>${xml2(d.user)}</UserId></LogonTrigger></Triggers>`,
+    `  <Principals><Principal id="Author"><UserId>${xml2(d.user)}</UserId><LogonType>InteractiveToken</LogonType><RunLevel>LeastPrivilege</RunLevel></Principal></Principals>`,
+    "  <Settings>",
+    "    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>",
+    "    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>",
+    "    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>",
+    "    <StartWhenAvailable>true</StartWhenAvailable>",
+    "    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>",
+    "    <RestartOnFailure><Interval>PT1M</Interval><Count>3</Count></RestartOnFailure>",
+    "    <Enabled>true</Enabled>",
+    "  </Settings>",
+    '  <Actions Context="Author">',
+    `    <Exec><Command>${xml2(d.nodePath)}</Command><Arguments>${xml2(args)}</Arguments></Exec>`,
+    "  </Actions>",
+    "</Task>",
+    ""
+  ].join("\r\n");
+}
+function schtasks(args) {
+  try {
+    return execFileSync3("schtasks", args, { stdio: ["ignore", "pipe", "ignore"], encoding: "utf8" });
+  } catch (err) {
+    const out = err.stdout;
+    return out ? out.toString() : "";
+  }
+}
+function assertSupported3() {
+}
+function install3(d) {
+  const file = join4(tmpdir2(), `${d.slug}.task.xml`);
+  writeFileSync3(file, "\uFEFF" + buildTaskXml(d), { encoding: "utf16le" });
+  execFileSync3("schtasks", ["/Create", "/TN", label3(d.fqdn), "/XML", file, "/F"], { stdio: "inherit" });
+  schtasks(["/Run", "/TN", label3(d.fqdn)]);
+}
+function uninstall3(fqdn) {
+  schtasks(["/Delete", "/TN", label3(fqdn), "/F"]);
+}
+function state3(fqdn) {
+  const out = schtasks(["/Query", "/TN", label3(fqdn), "/FO", "LIST"]);
+  if (!out) return "none";
+  if (/\bRunning\b/.test(out)) return "active";
+  if (/\bDisabled\b/.test(out)) return "disabled";
+  if (/\bReady\b/.test(out)) return "enabled";
+  return "enabled";
+}
+
+// src/core/service.ts
+function pick() {
+  switch (process.platform) {
+    case "linux":
+      return service_systemd_exports;
+    case "darwin":
+      return service_launchd_exports;
+    case "win32":
+      return service_windows_exports;
+    default:
+      return null;
+  }
+}
+function required() {
+  const b = pick();
+  if (!b) {
+    throw new CliError(`Boot services aren't supported on ${process.platform}.`, {
+      hint: "run `cloudtunnel up <spec> --detach` and use your OS's own autostart"
+    });
+  }
+  return b;
+}
+function assertServiceSupported() {
+  required().assertSupported();
+}
+function serviceName(fqdn) {
+  return pick()?.label(fqdn) ?? `cloudtunnel-${fqdn}`;
+}
+function installServiceForSpec(params) {
+  const b = required();
+  b.assertSupported();
+  b.install(describeService(params));
+}
+function uninstallService(fqdn) {
+  pick()?.uninstall(fqdn);
+}
 function serviceState(fqdn) {
-  if (process.platform !== "linux") return "none";
-  const name = serviceName(fqdn);
-  if (query(["is-active", name]) === "active") return "active";
-  const enabled = query(["is-enabled", name]);
-  if (enabled === "enabled" || enabled === "enabled-runtime") return "enabled";
-  if (enabled === "disabled" || enabled === "static") return "disabled";
-  return "none";
+  return pick()?.state(fqdn) ?? "none";
+}
+function serviceLogsHint(fqdn) {
+  switch (process.platform) {
+    case "linux":
+      return `journalctl -u ${serviceName(fqdn)} -n 50 --no-pager`;
+    case "darwin":
+      return `tail ${join5(logDir, `${serviceSlug(fqdn)}.service.log`)}`;
+    case "win32":
+      return `schtasks /Query /TN "${serviceName(fqdn)}" /V /FO LIST`;
+    default:
+      return "check your OS service logs";
+  }
+}
+function legacyUnitExists2(profile) {
+  return process.platform === "linux" ? legacyUnitExists(profile) : false;
+}
+function removeLegacyUnit2(profile) {
+  if (process.platform === "linux") removeLegacyUnit(profile);
 }
 
 // src/config/legacy-migrate.ts
 var skipMarker = `${profilesFile}.migrate-skip`;
 async function migrateLegacyProfiles() {
-  if (!existsSync2(profilesFile) || existsSync2(skipMarker)) return;
+  if (!existsSync3(profilesFile) || existsSync3(skipMarker)) return;
   let profiles;
   try {
     profiles = JSON.parse(readFileSync(profilesFile, "utf8"));
   } catch {
     return;
   }
-  const legacy = Object.entries(profiles).filter(([name]) => legacyUnitExists(name));
+  const legacy = Object.entries(profiles).filter(([name]) => legacyUnitExists2(name));
   if (legacy.length === 0) {
     try {
       renameSync(profilesFile, `${profilesFile}.migrated`);
@@ -289,7 +514,7 @@ async function migrateLegacyProfiles() {
   }
   const ok = await confirm(`Found ${legacy.length} boot service(s) from an older cloudtunnel. Migrate them now? (needs sudo)`);
   if (!ok) {
-    writeFileSync2(skipMarker, "");
+    writeFileSync4(skipMarker, "");
     say.dim(`  Skipped. Delete ${skipMarker} to be asked again.`);
     return;
   }
@@ -309,12 +534,12 @@ async function migrateLegacyProfiles() {
         });
         migrated++;
       }
-      removeLegacyUnit(name);
+      removeLegacyUnit2(name);
     }
     renameSync(profilesFile, `${profilesFile}.migrated`);
     say.ok(`Migrated ${migrated} boot service(s). See them with: cloudtunnel ls`);
   } catch (err) {
-    writeFileSync2(skipMarker, "");
+    writeFileSync4(skipMarker, "");
     say.warn(`Migration incomplete: ${err.message}. Won't retry automatically (delete ${skipMarker} to retry).`);
   }
 }
@@ -478,10 +703,10 @@ async function ensureAuth() {
 }
 
 // src/connector/binary.ts
-import { execFileSync as execFileSync2 } from "child_process";
+import { execFileSync as execFileSync4 } from "child_process";
 import { createHash } from "crypto";
-import { chmodSync, existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
-import { join as join2 } from "path";
+import { chmodSync, existsSync as existsSync4, readFileSync as readFileSync2, writeFileSync as writeFileSync5 } from "fs";
+import { join as join6 } from "path";
 var PINNED_VERSION = "2025.1.0";
 var RELEASE_BASE = `https://github.com/cloudflare/cloudflared/releases/download/${PINNED_VERSION}`;
 var ASSETS = {
@@ -493,14 +718,14 @@ var ASSETS = {
 };
 function binaryWorks(bin) {
   try {
-    execFileSync2(bin, ["--version"], { stdio: "ignore" });
+    execFileSync4(bin, ["--version"], { stdio: "ignore" });
     return true;
   } catch {
     return false;
   }
 }
 function cachedPath() {
-  return join2(binDir, process.platform === "win32" ? "cloudflared.exe" : "cloudflared");
+  return join6(binDir, process.platform === "win32" ? "cloudflared.exe" : "cloudflared");
 }
 function isMusl() {
   try {
@@ -512,7 +737,7 @@ function isMusl() {
 async function ensureCloudflared() {
   if (binaryWorks("cloudflared")) return "cloudflared";
   const cached = cachedPath();
-  if (existsSync3(cached) && binaryWorks(cached)) return cached;
+  if (existsSync4(cached) && binaryWorks(cached)) return cached;
   return downloadCloudflared(cached);
 }
 async function downloadCloudflared(dest) {
@@ -540,7 +765,7 @@ async function downloadCloudflared(dest) {
   }
   ensureDirs();
   const binary = asset.archive ? extractTgz(bytes) : bytes;
-  writeFileSync3(dest, binary, { mode: 493 });
+  writeFileSync5(dest, binary, { mode: 493 });
   chmodSync(dest, 493);
   if (!binaryWorks(dest)) throw new CliError("Downloaded cloudflared is not runnable.");
   return dest;
@@ -552,17 +777,17 @@ function extractTgz(_bytes) {
 }
 
 // src/core/up-runner.ts
-import { join as join3 } from "path";
+import { join as join7 } from "path";
 import * as clack2 from "@clack/prompts";
 
 // src/connector/process.ts
-import { execFileSync as execFileSync3, spawn as spawn2 } from "child_process";
+import { execFileSync as execFileSync5, spawn as spawn2 } from "child_process";
 import { openSync } from "fs";
 
 // src/connector/registry.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3, renameSync as renameSync2, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync3, renameSync as renameSync2, writeFileSync as writeFileSync6 } from "fs";
 import { readFile } from "fs/promises";
-import os2 from "os";
+import os3 from "os";
 import lockfile from "proper-lockfile";
 function entryFqdn(e) {
   return e.subdomain === "@" ? e.zone : `${e.subdomain}.${e.zone}`;
@@ -571,8 +796,8 @@ function currentBootId() {
   try {
     return readFileSync3("/proc/sys/kernel/random/boot_id", "utf8").trim();
   } catch {
-    const bootMinute = Math.floor((Date.now() - os2.uptime() * 1e3) / 6e4);
-    return `boot-${bootMinute}-${os2.hostname()}`;
+    const bootMinute = Math.floor((Date.now() - os3.uptime() * 1e3) / 6e4);
+    return `boot-${bootMinute}-${os3.hostname()}`;
   }
 }
 function readRegistry() {
@@ -585,12 +810,12 @@ function readRegistry() {
 function writeRegistry(reg) {
   ensureDirs();
   const tmp = `${registryFile}.tmp`;
-  writeFileSync4(tmp, JSON.stringify(reg, null, 2), { mode: 384 });
+  writeFileSync6(tmp, JSON.stringify(reg, null, 2), { mode: 384 });
   renameSync2(tmp, registryFile);
 }
 async function mutateRegistry(fn) {
   ensureDirs();
-  if (!existsSync4(registryFile)) writeFileSync4(registryFile, "{}", { mode: 384 });
+  if (!existsSync5(registryFile)) writeFileSync6(registryFile, "{}", { mode: 384 });
   const release = await lockfile.lock(registryFile, { retries: { retries: 10, minTimeout: 50 } });
   try {
     const reg = readRegistry();
@@ -698,7 +923,7 @@ async function stopConnector(entry) {
   const pid = entry.pid;
   if (process.platform === "win32") {
     try {
-      execFileSync3("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore" });
+      execFileSync5("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore" });
     } catch {
       return false;
     }
@@ -829,10 +1054,10 @@ var NOUNS = [
   "tiger",
   "walnut"
 ];
-var pick = (arr) => arr[randomInt(arr.length)];
+var pick2 = (arr) => arr[randomInt(arr.length)];
 function randomSlug() {
   const suffix = randomInt(65536).toString(16).padStart(4, "0");
-  return `${pick(ADJECTIVES)}-${pick(NOUNS)}-${suffix}`;
+  return `${pick2(ADJECTIVES)}-${pick2(NOUNS)}-${suffix}`;
 }
 function resolveHostSpec(opts, defaultZone) {
   if (opts.hostname) {
@@ -889,8 +1114,8 @@ async function createTunnelSubdomain(cf, opts) {
   let dnsRecordId;
   try {
     const suffix = randomInt2(65536).toString(16).padStart(4, "0");
-    const label = host.subdomain === "@" ? "root" : host.subdomain;
-    const tunnel = await createTunnel(cf, `${MANAGED_TUNNEL_PREFIX}${label}-${suffix}`);
+    const label4 = host.subdomain === "@" ? "root" : host.subdomain;
+    const tunnel = await createTunnel(cf, `${MANAGED_TUNNEL_PREFIX}${label4}-${suffix}`);
     tunnelId = tunnel.id;
     const token = await getTunnelToken(cf, tunnelId);
     await putIngress(cf, tunnelId, buildIngress({ hostname: host.hostname, port: opts.port, proto: opts.proto, host: opts.host }));
@@ -1037,8 +1262,8 @@ async function listAll(cf, opts = {}) {
     };
   });
   if (opts.all) {
-    const { listCargoCnames } = await import("./dns-PAPFSYFP.js");
-    const { listZones: listZones3 } = await import("./zones-YNGQYXAF.js");
+    const { listCargoCnames } = await import("./dns-5OXFAQ4D.js");
+    const { listZones: listZones3 } = await import("./zones-QYV3DSEY.js");
     const tracked = new Set(entries.map(entryFqdn));
     for (const zone of await listZones3(cf.token)) {
       for (const rec of await listCargoCnames(cf.token, zone.id)) {
@@ -1053,7 +1278,7 @@ async function listAll(cf, opts = {}) {
 
 // src/core/up-runner.ts
 function logFileFor(subdomain) {
-  return join3(logDir, `${subdomain === "@" ? "root" : subdomain}.log`);
+  return join7(logDir, `${subdomain === "@" ? "root" : subdomain}.log`);
 }
 async function startTunnels(cf, bin, items, opts = {}) {
   const started = [];
@@ -1196,30 +1421,56 @@ async function runUp(specArgs, opts) {
     });
   }
   if (opts.service) {
-    registerServices(items, domain, opts.proto, protocol);
+    await registerServices(cf, items, domain, opts.proto, protocol);
     return;
   }
   await startTunnels(cf, bin, items, { detach: opts.detach, protocol });
 }
-function registerServices(items, domain, proto, protocol) {
-  assertSystemd();
+var SERVICE_UP_TIMEOUT_MS = 2e4;
+var delay = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function registerServices(cf, items, domain, proto, protocol) {
+  assertServiceSupported();
   if (!protocol) {
     say.warn("No edge protocol set \u2014 cloudflared will pick QUIC, which some networks drop.");
     say.dim("  \u2192 add --protocol http2 for UDP-hostile networks");
   }
-  const done = [];
+  const fqdns = [];
   for (const item of items) {
     const subdomain = item.name;
     const fqdn = subdomain === "@" ? domain : `${subdomain}.${domain}`;
     installServiceForSpec({ subdomain, port: item.port, host: item.host, zone: domain, proto, protocol });
-    done.push(`${serviceName(fqdn)} \u2192 https://${fqdn}`);
+    fqdns.push(fqdn);
+  }
+  say.ok(`Registered ${fqdns.length} boot service(s) \u2014 waiting for them to come up\u2026`);
+  const notUp = await waitServicesUp(fqdns, SERVICE_UP_TIMEOUT_MS);
+  const rows = await listAll(cf);
+  if (rows.length) {
+    printTable(
+      ["#", "URL", "TARGET", "STATE", "SERVICE", "PID"],
+      rows.map((r) => [r.num, r.url, r.target, r.state, r.service, r.pid])
+    );
+  }
+  if (notUp.length) {
+    say.warn(`${notUp.length} service(s) didn't report up within ${SERVICE_UP_TIMEOUT_MS / 1e3}s:`);
+    for (const fqdn of notUp) say.dim(`  ${fqdn} \u2192 ${serviceLogsHint(fqdn)}`);
   }
-  say.ok(`Registered ${done.length} boot service(s):`);
-  for (const line of done) say.dim(`  ${line}`);
-  say.dim("  \u2192 check them: cloudtunnel ls   \xB7   remove: cloudtunnel delete <#>");
+  say.dim("  \u2192 manage: cloudtunnel ls   \xB7   remove: cloudtunnel delete <#>");
+}
+async function waitServicesUp(fqdns, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  const pending = new Set(fqdns);
+  while (pending.size > 0) {
+    for (const fqdn of [...pending]) {
+      const entry = getEntry(fqdn);
+      if (entry?.state === "running" && entry.pid) pending.delete(fqdn);
+    }
+    if (pending.size === 0 || Date.now() >= deadline) break;
+    await delay(500);
+  }
+  return [...pending];
 }
 function registerUp(program) {
-  program.command("up", { isDefault: true }).argument("[specs...]", "tunnels to start: [subdomain:]port[@host]  (e.g. api:8080 web:8081@localhost)").description("Start one or more tunnels (also: `cloudtunnel 8080`)").option("-d, --domain <domain>", "domain for the subdomains (prompted from a list if unset)").option("--proto <proto>", "local service protocol: http | https", "http").option("--protocol <proto>", "cloudflared edge transport: auto | http2 | quic (http2 for UDP-hostile networks)").option("--detach", "run the connectors in the background").option("--service", "register each subdomain as a systemd boot service (Linux; needs sudo)").option("-f, --force", "replace a non-tunnel DNS record occupying the hostname").option("-y, --yes", "don't prompt; don't ask before replacing an existing record").action((specs, opts) => runUp(specs, opts));
+  program.command("up", { isDefault: true }).argument("[specs...]", "tunnels to start: [subdomain:]port[@host]  (e.g. api:8080 web:8081@localhost)").description("Start one or more tunnels (also: `cloudtunnel 8080`)").option("-d, --domain <domain>", "domain for the subdomains (prompted from a list if unset)").option("--proto <proto>", "local service protocol: http | https", "http").option("--protocol <proto>", "cloudflared edge transport: auto | http2 | quic (http2 for UDP-hostile networks)").option("--detach", "run the connectors in the background").option("--service", "register each subdomain as a boot service (Linux systemd \xB7 macOS launchd \xB7 Windows Task Scheduler)").option("-f, --force", "replace a non-tunnel DNS record occupying the hostname").option("-y, --yes", "don't prompt; don't ask before replacing an existing record").action((specs, opts) => runUp(specs, opts));
 }
 
 // src/commands/ls.ts
@@ -1241,14 +1492,12 @@ function registerLs(program) {
 
 // src/commands/delete.ts
 async function deleteOne(cf, fqdn, opts) {
+  const hasService = serviceState(fqdn) !== "none";
+  if (hasService && !opts.dryRun) uninstallService(fqdn);
   await removeTunnelSubdomain(cf, fqdn, { force: opts.force, dryRun: opts.dryRun });
-  if (serviceState(fqdn) === "none") return;
-  if (opts.dryRun) {
-    say.info(`Would also remove boot service ${serviceName(fqdn)}`);
-    return;
-  }
-  uninstallService(fqdn);
-  say.ok(`Removed boot service ${serviceName(fqdn)}`);
+  if (!hasService) return;
+  if (opts.dryRun) say.info(`Would also remove boot service ${serviceName(fqdn)}`);
+  else say.ok(`Removed boot service ${serviceName(fqdn)}`);
 }
 function registerDelete(program) {
   program.command("delete").argument("[targets...]", "subdomains to remove by # / name / URL (omit with --all)").description("Release tunnel(s) \u2014 deletes the tunnel + DNS, and any systemd boot service").option("--all", "release every tracked subdomain").option("-f, --force", "release even a resource not created by cloudtunnel").option("--dry-run", "show what would be released without doing it").action(async (targets, opts) => {
@@ -1279,7 +1528,7 @@ function registerDelete(program) {
 }
 
 // src/commands/logs.ts
-import { closeSync, existsSync as existsSync5, openSync as openSync2, readFileSync as readFileSync4, readSync, statSync, watch } from "fs";
+import { closeSync, existsSync as existsSync6, openSync as openSync2, readFileSync as readFileSync4, readSync, statSync, watch } from "fs";
 function printTail(file, n) {
   const lines = readFileSync4(file, "utf8").split("\n");
   const tail = lines.slice(-n).join("\n");
@@ -1313,7 +1562,7 @@ function follow(file, fromPos) {
 function registerLogs(program) {
   program.command("logs").argument("<target>", "subdomain name / hostname / id / #").description("Show the connector log for a subdomain (use -f to follow)").option("-f, --follow", "keep printing new log lines (like tail -f)").option("-n, --lines <n>", "number of lines to show", "50").action((name, opts) => {
     const { fqdn, entry } = resolveTarget(name);
-    if (!entry?.logFile || !existsSync5(entry.logFile)) {
+    if (!entry?.logFile || !existsSync6(entry.logFile)) {
       throw new CliError(`No logs for ${fqdn} yet.`, { hint: "start it with `cloudtunnel up` or `cloudtunnel run`" });
     }
     const n = Math.max(1, Number(opts.lines) || 50);