@iamken/cloudtunnel 0.9.0 → 0.10.0

package/README.md

@@ -69,6 +69,7 @@ Run `cloudtunnel` with no arguments and it guides you (port → subdomain → do
 | `cloudtunnel ls` · `ps` | List tunnels — `# · URL · TARGET · PROTOCOL · STATE · SERVICE · PID`. `--all` scans the whole account and numbers unmanaged tunnels too. |
 | `cloudtunnel delete <target…>` | Release tunnel(s) — stop connector + delete tunnel + DNS + any boot service. `--all`, `--dry-run`, `-f`. |
 | `cloudtunnel logs <target>` | Show a connector's log. `-f` to follow, `-n` for line count. |
+| `cloudtunnel relay [sub]` | Expose a locked Cloudflare-API reverse proxy via a tunnel — lets a client behind a CF-API block manage tunnels through this host. `-d`, `--detach`, `--service`. |
 
 > A **`<target>`** is a `#` number, a subdomain name, a full hostname/URL, or a tunnel-id prefix. Tunnels **not tracked locally** (created elsewhere, or leaked by a failed run) work too: use the `#` a `ls --all` scan gave them, or their id — and pair with `-f` when they aren't cloudtunnel-managed.
 
@@ -102,6 +103,64 @@ alike, and each tunnel's transport shows in the `ls`/`ps` **PROTOCOL** column.
 
 ---
 
+## 🛰️ Blocked Cloudflare API? Relay it (`relay`)
+
+Some networks block **`api.cloudflare.com`** (the management API cloudtunnel calls
+to create tunnels + DNS) while leaving the **data plane** (`*.your-domain.com` via
+the Cloudflare edge) reachable. Run a **relay** on a host that _can_ reach the API,
+then point the blocked client's API base at it — every `login`/`up`/`ls`/`delete`
+rides the data-plane tunnel instead of hitting the API directly.
+
+```
+CLIENT (api.cloudflare.com blocked)            RELAY (api.cloudflare.com OK)
+  CLOUDTUNNEL_API_BASE=https://cfapi.you.com/client/v4
+        │  data-plane tunnel — NOT blocked
+        ▼
+  cfapi.you.com ─(CF edge)─►  relay reverse-proxy ─►  https://api.cloudflare.com
+```
+
+**On the relay host** — one command starts a locked, secret-gated reverse proxy on
+loopback and exposes it through a normal tunnel:
+
+```bash
+cloudtunnel relay cfapi -d you.com            # → https://cfapi.you.com  + prints a shared secret
+cloudtunnel relay cfapi -d you.com --detach   # background
+cloudtunnel relay cfapi -d you.com --service  # run on boot
+```
+
+**On the blocked client** — set the base + secret, then use cloudtunnel normally:
+
+```bash
+export CLOUDTUNNEL_API_BASE=https://cfapi.you.com/client/v4
+export CLOUDTUNNEL_RELAY_SECRET=<secret-from-the-relay>
+printf %s "$CF_TOKEN" | cloudtunnel login --token-stdin   # mint the token on an unblocked host
+cloudtunnel up web:8080 -d you.com                        # now manages tunnels through the relay
+```
+
+Or persist it instead of env vars:
+`cloudtunnel login --api-base https://cfapi.you.com/client/v4 --relay-secret-stdin`
+(pipe the secret on stdin). `cloudtunnel login --status` shows the active **Base** and
+whether a **Relay secret** is set (never the value).
+
+The proxy forwards to **`api.cloudflare.com` only** (no open-proxy / SSRF) and
+returns `403` to any request missing the shared secret.
+
+> 🔒 **Trust model.** The relay sees the client's Cloudflare **token in plaintext**
+> (it terminates the tunnel) — only relay through a host **you control**, and use a
+> least-privilege token (the four scopes under [Authentication](#-authentication)).
+> The token-mint page (`dash.cloudflare.com`) is usually blocked on the client too —
+> create the token on the relay/any unblocked host and paste it via `--token-stdin`.
+
+**Precedence** — API base: `CLOUDTUNNEL_API_BASE` env → `config.apiBase` → default
+`api.cloudflare.com`. Relay secret: `CLOUDTUNNEL_RELAY_SECRET` env → `config.relaySecret`.
+
+> ℹ️ The secret is printed only to an interactive terminal (never to a logfile or
+> journald). A **non-interactive** `relay --detach`/`--service` first run won't show
+> the auto-generated secret — set `CLOUDTUNNEL_RELAY_SECRET` yourself in scripts, or
+> read it back from `config.json`.
+
+---
+
 ## 🔁 Run on boot (`--service`)
 
 Add **`--service`** to register each subdomain as a native OS service so it comes

package/dist/{chunk-3KBLIPKG.js → chunk-HVBIMS4W.js}

@@ -79,8 +79,37 @@ function getCredentials() {
   return { apiToken, accountId, defaultZone: config.defaultZone };
 }
 
+// src/config/api-base.ts
+var DEFAULT_API_BASE = "https://api.cloudflare.com/client/v4";
+function getApiBase() {
+  const raw = process.env.CLOUDTUNNEL_API_BASE?.trim() || loadConfig().apiBase || DEFAULT_API_BASE;
+  return raw.replace(/\/+$/, "");
+}
+function isHttpUrl(s) {
+  try {
+    const u = new URL(s);
+    return u.protocol === "http:" || u.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+
+// src/config/relay-secret.ts
+import { randomBytes } from "crypto";
+var RELAY_SECRET_HEADER = "X-CT-Relay-Secret";
+function getRelaySecret() {
+  return process.env.CLOUDTUNNEL_RELAY_SECRET ?? loadConfig().relaySecret;
+}
+function ensureRelaySecret() {
+  const existing = getRelaySecret();
+  if (existing) return existing;
+  const secret = randomBytes(24).toString("base64url");
+  const prev = loadConfig();
+  saveConfig({ ...prev, relaySecret: secret });
+  return secret;
+}
+
 // src/cloudflare/client.ts
-var API_BASE = "https://api.cloudflare.com/client/v4";
 var RETRYABLE = /* @__PURE__ */ new Set([429, 500, 502, 503, 504]);
 var MAX_ATTEMPTS = 4;
 function resolveCf() {
@@ -94,12 +123,19 @@ function resolveCf() {
 }
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 async function cfRequest(token, method, path, body) {
+  const base = getApiBase();
+  const secret = getRelaySecret();
+  const headers = {
+    Authorization: `Bearer ${token}`,
+    "Content-Type": "application/json"
+  };
+  if (secret && base !== DEFAULT_API_BASE) headers[RELAY_SECRET_HEADER] = secret;
   for (let attempt = 0; ; attempt++) {
     let res;
     try {
-      res = await fetch(`${API_BASE}${path}`, {
+      res = await fetch(`${base}${path}`, {
         method,
-        headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+        headers,
         body: body === void 0 ? void 0 : JSON.stringify(body)
       });
     } catch {
@@ -147,8 +183,14 @@ export {
   loadConfig,
   saveConfig,
   getCredentials,
+  DEFAULT_API_BASE,
+  getApiBase,
+  isHttpUrl,
+  RELAY_SECRET_HEADER,
+  getRelaySecret,
+  ensureRelaySecret,
   resolveCf,
   cfRequest,
   cfPaginate
 };
-//# sourceMappingURL=chunk-3KBLIPKG.js.map
+//# sourceMappingURL=chunk-HVBIMS4W.js.map

package/dist/chunk-HVBIMS4W.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/ui/errors.ts","../src/config/store.ts","../src/config/paths.ts","../src/config/api-base.ts","../src/config/relay-secret.ts","../src/cloudflare/client.ts"],"sourcesContent":["import pc from \"picocolors\";\n\n/**\n * A user-facing CLI error. The message is printed as-is (no stack trace) and\n * `exitCode` drives the process exit code. Use `hint` to tell the user exactly\n * which command to run next — every error should be actionable.\n */\nexport class CliError extends Error {\n  readonly exitCode: number;\n  readonly hint?: string;\n  /** HTTP status when this wraps a Cloudflare API error (lets callers tell a\n   * genuine 404 \"already gone\" from a transient failure). */\n  readonly status?: number;\n\n  constructor(message: string, opts: { exitCode?: number; hint?: string; status?: number } = {}) {\n    super(message);\n    this.name = \"CliError\";\n    this.exitCode = opts.exitCode ?? 1;\n    this.hint = opts.hint;\n    this.status = opts.status;\n  }\n}\n\n/** Print an error and return the exit code. Known CliErrors print cleanly; the\n * rest print their message plus a note that it was unexpected. */\nexport function reportError(err: unknown): number {\n  if (err instanceof CliError) {\n    console.error(pc.red(`✗ ${err.message}`));\n    if (err.hint) console.error(pc.dim(`  → ${err.hint}`));\n    return err.exitCode;\n  }\n  const message = err instanceof Error ? err.message : String(err);\n  console.error(pc.red(`✗ ${message}`));\n  console.error(pc.dim(\"  (unexpected error — please report if this persists)\"));\n  return 1;\n}\n","import { chmodSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { CliError } from \"../ui/errors.js\";\nimport { configFile, ensureDirs } from \"./paths.js\";\n\nexport interface CloudtunnelConfig {\n  apiToken?: string;\n  accountId?: string;\n  defaultZone?: string;\n  /** Override the Cloudflare API base — point at a relay when the direct control\n   * plane is blocked. See `config/api-base.ts`. */\n  apiBase?: string;\n  /** Shared secret required by / sent to the relay proxy. See `config/relay-secret.ts`. */\n  relaySecret?: string;\n}\n\nexport interface Credentials {\n  apiToken: string;\n  accountId?: string;\n  defaultZone?: string;\n}\n\n/** Read config.json (missing/invalid → empty config, never throws). */\nexport function loadConfig(): CloudtunnelConfig {\n  try {\n    return JSON.parse(readFileSync(configFile, \"utf8\")) as CloudtunnelConfig;\n  } catch {\n    return {};\n  }\n}\n\n/** Persist config.json with owner-only perms (0600). */\nexport function saveConfig(config: CloudtunnelConfig): void {\n  ensureDirs();\n  writeFileSync(configFile, JSON.stringify(config, null, 2), { mode: 0o600 });\n  chmodSync(configFile, 0o600); // enforce even if the file pre-existed\n}\n\n/**\n * Resolve credentials: env vars override the config file. Throws an actionable\n * CliError if no API token is available anywhere.\n */\nexport function getCredentials(): Credentials {\n  const config = loadConfig();\n  const apiToken = process.env.CLOUDFLARE_API_TOKEN ?? config.apiToken;\n  const accountId = process.env.CLOUDFLARE_ACCOUNT_ID ?? config.accountId;\n  if (!apiToken) {\n    throw new CliError(\"Not authenticated with Cloudflare.\", {\n      hint: \"run `cloudtunnel login` (or set CLOUDFLARE_API_TOKEN)\",\n    });\n  }\n  return { apiToken, accountId, defaultZone: config.defaultZone };\n}\n","import envPaths from \"env-paths\";\nimport { mkdirSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\n// `~/.config/cloudtunnel/` (XDG). suffix:'' avoids env-paths' default \"-nodejs\".\nconst paths = envPaths(\"cloudtunnel\", { suffix: \"\" });\n\nexport const configDir = paths.config;\nexport const configFile = join(configDir, \"config.json\");\nexport const registryFile = join(configDir, \"tunnels.json\");\nexport const scanCacheFile = join(configDir, \"unmanaged-scan.json\");\nexport const profilesFile = join(configDir, \"profiles.json\");\nexport const binDir = join(configDir, \"bin\");\nexport const logDir = join(configDir, \"logs\");\n\n/** Create the app dirs with owner-only perms (secrets live here). Idempotent. */\nexport function ensureDirs(): void {\n  for (const dir of [configDir, binDir, logDir]) {\n    mkdirSync(dir, { recursive: true, mode: 0o700 });\n  }\n}\n","import { loadConfig } from \"./store.js\";\n\n/** Default Cloudflare management API base — no trailing slash (callers append a\n * path that starts with `/`). */\nexport const DEFAULT_API_BASE = \"https://api.cloudflare.com/client/v4\";\n\n/**\n * Resolve the Cloudflare API base URL. Precedence: env `CLOUDTUNNEL_API_BASE` →\n * `config.apiBase` → default. A trailing slash is stripped so `${base}${path}`\n * (path starts `/`) never yields `//…`.\n *\n * Point this at a relay's `https://<relay>/client/v4` when the direct control\n * plane (api.cloudflare.com) is blocked but a data-plane tunnel to the relay is\n * not — every management call then rides the tunnel instead of hitting CF direct.\n */\nexport function getApiBase(): string {\n  // `||` (not `??`) so an empty/whitespace env or config value falls through\n  // instead of yielding a broken \"\" base.\n  const raw = process.env.CLOUDTUNNEL_API_BASE?.trim() || loadConfig().apiBase || DEFAULT_API_BASE;\n  return raw.replace(/\\/+$/, \"\");\n}\n\n/** True if `s` parses as an http(s) URL — validates `login --api-base`. */\nexport function isHttpUrl(s: string): boolean {\n  try {\n    const u = new URL(s);\n    return u.protocol === \"http:\" || u.protocol === \"https:\";\n  } catch {\n    return false;\n  }\n}\n","import { randomBytes } from \"node:crypto\";\nimport { loadConfig, saveConfig } from \"./store.js\";\n\n/** Header the CLIENT sends and the RELAY requires — the relay's shared secret.\n * Single source of truth, imported by both the client transport and the relay\n * proxy so the two sides can never drift. */\nexport const RELAY_SECRET_HEADER = \"X-CT-Relay-Secret\";\n\n/**\n * The relay shared secret, if configured. Precedence: env\n * `CLOUDTUNNEL_RELAY_SECRET` → `config.relaySecret` → undefined. The CLIENT\n * attaches it to every CF API call; the RELAY rejects calls that lack it.\n */\nexport function getRelaySecret(): string | undefined {\n  return process.env.CLOUDTUNNEL_RELAY_SECRET ?? loadConfig().relaySecret;\n}\n\n/**\n * Return the relay secret, generating + persisting one on first use so a restart\n * or boot service keeps the same value (a changed secret would break the client).\n * Persisted to 0600 config via a MERGE-save (never clobbers apiToken/apiBase).\n * An env-provided secret is returned as-is — env stays the source of truth and\n * nothing is written.\n */\nexport function ensureRelaySecret(): string {\n  const existing = getRelaySecret();\n  if (existing) return existing;\n  const secret = randomBytes(24).toString(\"base64url\"); // 192-bit, url-safe\n  const prev = loadConfig();\n  saveConfig({ ...prev, relaySecret: secret });\n  return secret;\n}\n","import { CliError } from \"../ui/errors.js\";\nimport { getCredentials } from \"../config/store.js\";\nimport { getApiBase, DEFAULT_API_BASE } from \"../config/api-base.js\";\nimport { RELAY_SECRET_HEADER, getRelaySecret } from \"../config/relay-secret.js\";\n\nconst RETRYABLE = new Set([429, 500, 502, 503, 504]);\nconst MAX_ATTEMPTS = 4;\n\n/** Resolved Cloudflare context for account-scoped calls. */\nexport interface Cf {\n  token: string;\n  accountId: string;\n}\n\ninterface CfEnvelope<T> {\n  success: boolean;\n  result: T;\n  result_info?: { page: number; total_pages?: number; per_page: number; count: number };\n  errors?: { message: string }[];\n}\n\n/** Token + account id required for tunnel ops. Throws actionably if unresolved. */\nexport function resolveCf(): Cf {\n  const creds = getCredentials();\n  if (!creds.accountId) {\n    throw new CliError(\"No Cloudflare account id resolved.\", {\n      hint: \"run `cloudtunnel login` (or set CLOUDFLARE_ACCOUNT_ID)\",\n    });\n  }\n  return { token: creds.apiToken, accountId: creds.accountId };\n}\n\nconst sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));\n\n/**\n * Single Cloudflare API call with backoff on 429/5xx (honors Retry-After).\n * Errors are sanitized — the bearer token is only ever sent in the header and\n * never appears in a thrown message.\n */\nexport async function cfRequest<T>(\n  token: string,\n  method: string,\n  path: string,\n  body?: unknown,\n): Promise<CfEnvelope<T>> {\n  // Base + relay secret resolved once per call (env → config → default). The\n  // secret header rides only when the base is actually a relay (non-default), so\n  // it's never sent to api.cloudflare.com; unset base ⇒ identical to today.\n  const base = getApiBase();\n  const secret = getRelaySecret();\n  const headers: Record<string, string> = {\n    Authorization: `Bearer ${token}`,\n    \"Content-Type\": \"application/json\",\n  };\n  if (secret && base !== DEFAULT_API_BASE) headers[RELAY_SECRET_HEADER] = secret;\n  for (let attempt = 0; ; attempt++) {\n    let res: Response;\n    try {\n      res = await fetch(`${base}${path}`, {\n        method,\n        headers,\n        body: body === undefined ? undefined : JSON.stringify(body),\n      });\n    } catch {\n      throw new CliError(\"Could not reach the Cloudflare API (network error).\");\n    }\n    if (RETRYABLE.has(res.status) && attempt < MAX_ATTEMPTS) {\n      const retryAfter = Number(res.headers.get(\"retry-after\")) || 0;\n      await sleep(retryAfter > 0 ? retryAfter * 1000 : 2 ** attempt * 500);\n      continue;\n    }\n    const env = (await res.json().catch(() => ({}))) as CfEnvelope<T>;\n    if (!res.ok || !env.success) {\n      const msg = env.errors?.[0]?.message ?? `HTTP ${res.status}`;\n      throw new CliError(`Cloudflare API error: ${msg}`, { status: res.status });\n    }\n    return env;\n  }\n}\n\n/**\n * Fetch every page of a list endpoint. Robust when `total_pages` is absent:\n * stops when a page returns fewer than per_page items.\n */\nexport async function cfPaginate<T>(token: string, basePath: string): Promise<T[]> {\n  const sep = basePath.includes(\"?\") ? \"&\" : \"?\";\n  const out: T[] = [];\n  for (let page = 1; ; page++) {\n    const env = await cfRequest<T[]>(token, \"GET\", `${basePath}${sep}per_page=50&page=${page}`);\n    const items = env.result ?? [];\n    out.push(...items);\n    const perPage = env.result_info?.per_page ?? 50;\n    const totalPages = env.result_info?.total_pages;\n    const more = totalPages ? page < totalPages : items.length === perPage;\n    if (items.length === 0 || !more) break;\n  }\n  return out;\n}\n"],"mappings":";;;;;;;;AAAA,OAAO,QAAQ;AAOR,IAAM,WAAN,cAAuB,MAAM;AAAA,EACzB;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EAET,YAAY,SAAiB,OAA8D,CAAC,GAAG;AAC7F,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,WAAW,KAAK,YAAY;AACjC,SAAK,OAAO,KAAK;AACjB,SAAK,SAAS,KAAK;AAAA,EACrB;AACF;AAIO,SAAS,YAAY,KAAsB;AAChD,MAAI,eAAe,UAAU;AAC3B,YAAQ,MAAM,GAAG,IAAI,UAAK,IAAI,OAAO,EAAE,CAAC;AACxC,QAAI,IAAI,KAAM,SAAQ,MAAM,GAAG,IAAI,YAAO,IAAI,IAAI,EAAE,CAAC;AACrD,WAAO,IAAI;AAAA,EACb;AACA,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,UAAQ,MAAM,GAAG,IAAI,UAAK,OAAO,EAAE,CAAC;AACpC,UAAQ,MAAM,GAAG,IAAI,4DAAuD,CAAC;AAC7E,SAAO;AACT;;;ACnCA,SAAS,WAAW,cAAc,qBAAqB;;;ACAvD,OAAO,cAAc;AACrB,SAAS,iBAAiB;AAC1B,SAAS,YAAY;AAGrB,IAAM,QAAQ,SAAS,eAAe,EAAE,QAAQ,GAAG,CAAC;AAE7C,IAAM,YAAY,MAAM;AACxB,IAAM,aAAa,KAAK,WAAW,aAAa;AAChD,IAAM,eAAe,KAAK,WAAW,cAAc;AACnD,IAAM,gBAAgB,KAAK,WAAW,qBAAqB;AAC3D,IAAM,eAAe,KAAK,WAAW,eAAe;AACpD,IAAM,SAAS,KAAK,WAAW,KAAK;AACpC,IAAM,SAAS,KAAK,WAAW,MAAM;AAGrC,SAAS,aAAmB;AACjC,aAAW,OAAO,CAAC,WAAW,QAAQ,MAAM,GAAG;AAC7C,cAAU,KAAK,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAAA,EACjD;AACF;;;ADEO,SAAS,aAAgC;AAC9C,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,YAAY,MAAM,CAAC;AAAA,EACpD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAGO,SAAS,WAAW,QAAiC;AAC1D,aAAW;AACX,gBAAc,YAAY,KAAK,UAAU,QAAQ,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AAC1E,YAAU,YAAY,GAAK;AAC7B;AAMO,SAAS,iBAA8B;AAC5C,QAAM,SAAS,WAAW;AAC1B,QAAM,WAAW,QAAQ,IAAI,wBAAwB,OAAO;AAC5D,QAAM,YAAY,QAAQ,IAAI,yBAAyB,OAAO;AAC9D,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,SAAS,sCAAsC;AAAA,MACvD,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO,EAAE,UAAU,WAAW,aAAa,OAAO,YAAY;AAChE;;;AE/CO,IAAM,mBAAmB;AAWzB,SAAS,aAAqB;AAGnC,QAAM,MAAM,QAAQ,IAAI,sBAAsB,KAAK,KAAK,WAAW,EAAE,WAAW;AAChF,SAAO,IAAI,QAAQ,QAAQ,EAAE;AAC/B;AAGO,SAAS,UAAU,GAAoB;AAC5C,MAAI;AACF,UAAM,IAAI,IAAI,IAAI,CAAC;AACnB,WAAO,EAAE,aAAa,WAAW,EAAE,aAAa;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AC9BA,SAAS,mBAAmB;AAMrB,IAAM,sBAAsB;AAO5B,SAAS,iBAAqC;AACnD,SAAO,QAAQ,IAAI,4BAA4B,WAAW,EAAE;AAC9D;AASO,SAAS,oBAA4B;AAC1C,QAAM,WAAW,eAAe;AAChC,MAAI,SAAU,QAAO;AACrB,QAAM,SAAS,YAAY,EAAE,EAAE,SAAS,WAAW;AACnD,QAAM,OAAO,WAAW;AACxB,aAAW,EAAE,GAAG,MAAM,aAAa,OAAO,CAAC;AAC3C,SAAO;AACT;;;AC1BA,IAAM,YAAY,oBAAI,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,CAAC;AACnD,IAAM,eAAe;AAgBd,SAAS,YAAgB;AAC9B,QAAM,QAAQ,eAAe;AAC7B,MAAI,CAAC,MAAM,WAAW;AACpB,UAAM,IAAI,SAAS,sCAAsC;AAAA,MACvD,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO,EAAE,OAAO,MAAM,UAAU,WAAW,MAAM,UAAU;AAC7D;AAEA,IAAM,QAAQ,CAAC,OAAe,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC;AAOlE,eAAsB,UACpB,OACA,QACA,MACA,MACwB;AAIxB,QAAM,OAAO,WAAW;AACxB,QAAM,SAAS,eAAe;AAC9B,QAAM,UAAkC;AAAA,IACtC,eAAe,UAAU,KAAK;AAAA,IAC9B,gBAAgB;AAAA,EAClB;AACA,MAAI,UAAU,SAAS,iBAAkB,SAAQ,mBAAmB,IAAI;AACxE,WAAS,UAAU,KAAK,WAAW;AACjC,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,GAAG,IAAI,GAAG,IAAI,IAAI;AAAA,QAClC;AAAA,QACA;AAAA,QACA,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI;AAAA,MAC5D,CAAC;AAAA,IACH,QAAQ;AACN,YAAM,IAAI,SAAS,qDAAqD;AAAA,IAC1E;AACA,QAAI,UAAU,IAAI,IAAI,MAAM,KAAK,UAAU,cAAc;AACvD,YAAM,aAAa,OAAO,IAAI,QAAQ,IAAI,aAAa,CAAC,KAAK;AAC7D,YAAM,MAAM,aAAa,IAAI,aAAa,MAAO,KAAK,UAAU,GAAG;AACnE;AAAA,IACF;AACA,UAAM,MAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAI,CAAC,IAAI,MAAM,CAAC,IAAI,SAAS;AAC3B,YAAM,MAAM,IAAI,SAAS,CAAC,GAAG,WAAW,QAAQ,IAAI,MAAM;AAC1D,YAAM,IAAI,SAAS,yBAAyB,GAAG,IAAI,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3E;AACA,WAAO;AAAA,EACT;AACF;AAMA,eAAsB,WAAc,OAAe,UAAgC;AACjF,QAAM,MAAM,SAAS,SAAS,GAAG,IAAI,MAAM;AAC3C,QAAM,MAAW,CAAC;AAClB,WAAS,OAAO,KAAK,QAAQ;AAC3B,UAAM,MAAM,MAAM,UAAe,OAAO,OAAO,GAAG,QAAQ,GAAG,GAAG,oBAAoB,IAAI,EAAE;AAC1F,UAAM,QAAQ,IAAI,UAAU,CAAC;AAC7B,QAAI,KAAK,GAAG,KAAK;AACjB,UAAM,UAAU,IAAI,aAAa,YAAY;AAC7C,UAAM,aAAa,IAAI,aAAa;AACpC,UAAM,OAAO,aAAa,OAAO,aAAa,MAAM,WAAW;AAC/D,QAAI,MAAM,WAAW,KAAK,CAAC,KAAM;AAAA,EACnC;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-VR5RHOTJ.js → chunk-JBKEAGXV.js}

@@ -3,7 +3,7 @@ import {
   CliError,
   cfPaginate,
   cfRequest
-} from "./chunk-3KBLIPKG.js";
+} from "./chunk-HVBIMS4W.js";
 
 // src/cloudflare/zones.ts
 function listZones(token) {
@@ -24,4 +24,4 @@ export {
   listZones,
   resolveZone
 };
-//# sourceMappingURL=chunk-VR5RHOTJ.js.map
+//# sourceMappingURL=chunk-JBKEAGXV.js.map

package/dist/{chunk-LG5ST75Z.js → chunk-ZTOVYAS4.js}

@@ -3,7 +3,7 @@ import {
   CliError,
   cfPaginate,
   cfRequest
-} from "./chunk-3KBLIPKG.js";
+} from "./chunk-HVBIMS4W.js";
 
 // src/cloudflare/dns.ts
 var MANAGED_DNS_COMMENT = "managed-by:cloudtunnel";
@@ -54,4 +54,4 @@ export {
   listCargoCnames,
   deleteDnsRecord
 };
-//# sourceMappingURL=chunk-LG5ST75Z.js.map
+//# sourceMappingURL=chunk-ZTOVYAS4.js.map

package/dist/{dns-C7WXQOED.js → dns-43EGJW7E.js}

@@ -7,8 +7,8 @@ import {
   findCname,
   isManagedDns,
   listCargoCnames
-} from "./chunk-LG5ST75Z.js";
-import "./chunk-3KBLIPKG.js";
+} from "./chunk-ZTOVYAS4.js";
+import "./chunk-HVBIMS4W.js";
 export {
   MANAGED_DNS_COMMENT,
   cargoTarget,
@@ -18,4 +18,4 @@ export {
   isManagedDns,
   listCargoCnames
 };
-//# sourceMappingURL=dns-C7WXQOED.js.map
+//# sourceMappingURL=dns-43EGJW7E.js.map

package/dist/index.js

@@ -2,22 +2,28 @@
 import {
   listZones,
   resolveZone
-} from "./chunk-VR5RHOTJ.js";
+} from "./chunk-JBKEAGXV.js";
 import {
   createCname,
   deleteDnsRecord,
   findCname,
   isManagedDns
-} from "./chunk-LG5ST75Z.js";
+} from "./chunk-ZTOVYAS4.js";
 import {
   CliError,
+  DEFAULT_API_BASE,
+  RELAY_SECRET_HEADER,
   __export,
   binDir,
   cfPaginate,
   cfRequest,
   configFile,
   ensureDirs,
+  ensureRelaySecret,
+  getApiBase,
   getCredentials,
+  getRelaySecret,
+  isHttpUrl,
   loadConfig,
   logDir,
   profilesFile,
@@ -26,12 +32,12 @@ import {
   resolveCf,
   saveConfig,
   scanCacheFile
-} from "./chunk-3KBLIPKG.js";
+} from "./chunk-HVBIMS4W.js";
 
 // src/index.ts
 import { Command } from "commander";
 import { createRequire } from "module";
-import pc2 from "picocolors";
+import pc3 from "picocolors";
 
 // src/config/legacy-migrate.ts
 import { existsSync as existsSync3, readFileSync, renameSync, writeFileSync as writeFileSync4 } from "fs";
@@ -165,6 +171,17 @@ function formatTunnelSpec(s) {
 var fqdnFor = (subdomain, zone) => subdomain === "@" ? zone : `${subdomain}.${zone}`;
 var serviceSlug = (fqdn) => fqdn.replace(/[^a-zA-Z0-9]+/g, "-");
 function buildUpArgs(p) {
+  if (p.command === "relay") {
+    return [
+      "relay",
+      p.subdomain,
+      "-d",
+      p.zone,
+      ...p.proto === "https" ? ["--proto", "https"] : [],
+      "-f",
+      "-y"
+    ];
+  }
   const spec = formatTunnelSpec({ subdomain: p.subdomain, port: p.port, host: p.host });
   return [
     "up",
@@ -572,13 +589,17 @@ function openBrowser(url) {
 }
 
 // src/config/resolve-identity.ts
-var API_BASE = "https://api.cloudflare.com/client/v4";
 async function cfGet(path, token) {
+  const base = getApiBase();
+  const secret = getRelaySecret();
+  const headers = {
+    Authorization: `Bearer ${token}`,
+    "Content-Type": "application/json"
+  };
+  if (secret && base !== DEFAULT_API_BASE) headers[RELAY_SECRET_HEADER] = secret;
   let res;
   try {
-    res = await fetch(`${API_BASE}${path}`, {
-      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" }
-    });
+    res = await fetch(`${base}${path}`, { headers });
   } catch {
     throw new CliError("Could not reach the Cloudflare API (network error).");
   }
@@ -638,6 +659,22 @@ async function acquireToken(opts) {
   return { token, fromEnv: false };
 }
 async function runLoginFlow(opts = {}) {
+  if (opts.apiBase && !isHttpUrl(opts.apiBase)) {
+    throw new CliError(`Invalid --api-base "${opts.apiBase}".`, {
+      hint: "must be an http(s) URL, e.g. https://cfapi.example.com/client/v4"
+    });
+  }
+  if (opts.tokenStdin && opts.relaySecretStdin) {
+    throw new CliError("Can't read both the token and the relay secret from stdin.", {
+      hint: "run login twice, or set one via env (CLOUDFLARE_API_TOKEN / CLOUDTUNNEL_RELAY_SECRET)"
+    });
+  }
+  if (opts.apiBase) process.env.CLOUDTUNNEL_API_BASE = opts.apiBase;
+  let relaySecretInput;
+  if (opts.relaySecretStdin) {
+    relaySecretInput = await readStdin();
+    if (relaySecretInput) process.env.CLOUDTUNNEL_RELAY_SECRET = relaySecretInput;
+  }
   if (process.stdout.isTTY) clack.intro("cloudtunnel \xB7 connect to Cloudflare");
   const { token, fromEnv } = await acquireToken(opts);
   const spin = clack.spinner();
@@ -660,12 +697,29 @@ async function runLoginFlow(opts = {}) {
       defaultZone = (await selectOne("Select a default domain", zones, (z) => z.name)).name;
     }
   }
-  saveConfig({ apiToken: fromEnv ? void 0 : token, accountId: account.id, defaultZone });
+  saveConfig(buildMergedConfig(loadConfig(), {
+    token,
+    fromEnv,
+    accountId: account.id,
+    defaultZone,
+    apiBase: opts.apiBase,
+    relaySecret: relaySecretInput
+  }));
   const summary = `Logged in as ${account.name}${defaultZone ? ` \xB7 default domain ${defaultZone}` : ""}`;
   if (process.stdout.isTTY) clack.outro(summary);
   else say.ok(summary);
   if (!defaultZone) say.dim("No default domain set \u2014 pass -d <domain> on `up`, or re-run `login --zone <domain>`.");
 }
+function buildMergedConfig(prev, args) {
+  return {
+    ...prev,
+    apiToken: args.fromEnv ? void 0 : args.token,
+    accountId: args.accountId,
+    defaultZone: args.defaultZone ?? prev.defaultZone,
+    apiBase: args.apiBase ?? prev.apiBase,
+    relaySecret: args.relaySecret ?? prev.relaySecret
+  };
+}
 function showStatus() {
   const config = loadConfig();
   const token = process.env.CLOUDFLARE_API_TOKEN ?? config.apiToken;
@@ -677,10 +731,14 @@ function showStatus() {
   say.info(`Token:   ${redactToken(token)} (${source})`);
   say.info(`Account: ${config.accountId ?? "(from env / unresolved)"}`);
   say.info(`Domain:  ${config.defaultZone ?? "(none)"}`);
+  const baseSrc = process.env.CLOUDTUNNEL_API_BASE ? "env" : config.apiBase ? "config" : "default";
+  say.info(`Base:    ${getApiBase()} (${baseSrc})`);
+  const secretSrc = process.env.CLOUDTUNNEL_RELAY_SECRET ? "env" : config.relaySecret ? "config" : void 0;
+  say.info(`Relay secret: ${secretSrc ? `set (${secretSrc})` : "(none)"}`);
   say.dim(`Config:  ${configFile}`);
 }
 function registerLogin(program) {
-  program.command("login").description("Authenticate with Cloudflare (paste a token once; account + domain auto-resolved)").option("--token-stdin", "read the API token from stdin (scriptable, avoids shell history)").option("--token <token>", "[discouraged] token as an argument (leaks into shell history)").option("--account <id>", "Cloudflare account id (auto-resolved when you have one account)").option("--zone <domain>", "default domain for new tunnels (auto-resolved when you have one)").option("--status", "show current identity (redacted) and exit").action(async (opts) => {
+  program.command("login").description("Authenticate with Cloudflare (paste a token once; account + domain auto-resolved)").option("--token-stdin", "read the API token from stdin (scriptable, avoids shell history)").option("--token <token>", "[discouraged] token as an argument (leaks into shell history)").option("--account <id>", "Cloudflare account id (auto-resolved when you have one account)").option("--zone <domain>", "default domain for new tunnels (auto-resolved when you have one)").option("--api-base <url>", "route the CF API through a relay (when api.cloudflare.com is blocked)").option("--relay-secret-stdin", "read the relay shared secret from stdin (pairs with --api-base)").option("--status", "show current identity (redacted) and exit").action(async (opts) => {
     if (opts.status) return showStatus();
     await runLoginFlow(opts);
   });
@@ -1301,8 +1359,8 @@ async function resolveRemoteTarget(cf, target) {
   }
   const tunnel = matches[0];
   if (!tunnel) return null;
-  const { listCargoCnames } = await import("./dns-C7WXQOED.js");
-  const { listZones: listZones3 } = await import("./zones-KPRAW4JL.js");
+  const { listCargoCnames } = await import("./dns-43EGJW7E.js");
+  const { listZones: listZones3 } = await import("./zones-QZPJFIDD.js");
   for (const zone of await listZones3(cf.token)) {
     const rec = (await listCargoCnames(cf.token, zone.id)).find((r) => tunnelIdFromCname2(r.content) === tunnel.id);
     if (rec) return { tunnel, fqdn: rec.name };
@@ -1339,8 +1397,8 @@ async function listAll(cf, opts = {}) {
     };
   });
   if (opts.all) {
-    const { listCargoCnames } = await import("./dns-C7WXQOED.js");
-    const { listZones: listZones3 } = await import("./zones-KPRAW4JL.js");
+    const { listCargoCnames } = await import("./dns-43EGJW7E.js");
+    const { listZones: listZones3 } = await import("./zones-QZPJFIDD.js");
     const tracked = new Set(entries.map(entryFqdn));
     const unmanaged = [];
     for (const zone of await listZones3(cf.token)) {
@@ -1433,6 +1491,17 @@ async function startTunnels(cf, bin, items, opts = {}) {
   say.dim("Ctrl-C stops and releases them.");
 }
 
+// src/core/resolve-domain.ts
+async function resolveDomain(cf, opts, creds) {
+  if (opts.domain) return opts.domain;
+  const zones = await listZones(cf.token);
+  if (zones.length === 0) throw new CliError("No domains found in this Cloudflare account.");
+  if (zones.length === 1) return zones[0].name;
+  if (process.stdin.isTTY) return (await selectOne("Choose a domain", zones, (z) => z.name)).name;
+  if (creds.defaultZone) return creds.defaultZone;
+  throw new CliError("Multiple domains in this account \u2014 pick one.", { hint: "pass -d <domain>" });
+}
+
 // src/core/transport-protocol.ts
 function parseTransportProtocol(value) {
   if (value === "auto" || value === "http2" || value === "quic") return value;
@@ -1461,15 +1530,6 @@ async function promptPort() {
   );
   return Number(input);
 }
-async function resolveDomain(cf, opts, creds) {
-  if (opts.domain) return opts.domain;
-  const zones = await listZones(cf.token);
-  if (zones.length === 0) throw new CliError("No domains found in this Cloudflare account.");
-  if (zones.length === 1) return zones[0].name;
-  if (process.stdin.isTTY) return (await selectOne("Choose a domain", zones, (z) => z.name)).name;
-  if (creds.defaultZone) return creds.defaultZone;
-  throw new CliError("Multiple domains in this account \u2014 pick one.", { hint: "pass -d <domain>" });
-}
 async function resolveSpecSubdomain(spec, opts) {
   if (spec.subdomain !== void 0) return spec.subdomain;
   if (opts.yes || !process.stdin.isTTY) return void 0;
@@ -1673,6 +1733,173 @@ function registerLogs(program) {
   });
 }
 
+// src/commands/relay.ts
+import { openSync as openSync3 } from "fs";
+import { spawn as spawn3 } from "child_process";
+import { join as join8 } from "path";
+import pc2 from "picocolors";
+
+// src/core/api-proxy-server.ts
+import http from "http";
+var DEFAULT_UPSTREAM = "https://api.cloudflare.com";
+var SECRET_HEADER_LC = RELAY_SECRET_HEADER.toLowerCase();
+var HOP_BY_HOP = /* @__PURE__ */ new Set([
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade",
+  "host",
+  "content-length"
+]);
+function send(res, code, body) {
+  res.writeHead(code, { "content-type": "application/json" });
+  res.end(body === void 0 ? "" : JSON.stringify(body));
+}
+function startProxy(opts) {
+  const upstream = opts.upstream ?? DEFAULT_UPSTREAM;
+  const upstreamOrigin = new URL(upstream).origin;
+  const server = http.createServer((req, res) => {
+    handle(req, res).catch(() => {
+      if (!res.headersSent) send(res, 500, { error: "relay internal error" });
+      else res.end();
+    });
+  });
+  async function handle(req, res) {
+    if (req.method === "CONNECT" || !req.url || !req.url.startsWith("/")) {
+      return send(res, 400, { error: "origin-form request required" });
+    }
+    let target;
+    try {
+      target = new URL(req.url, upstream);
+    } catch {
+      return send(res, 400, { error: "bad request path" });
+    }
+    if (target.origin !== upstreamOrigin) {
+      return send(res, 400, { error: "path escapes upstream" });
+    }
+    if (req.headers[SECRET_HEADER_LC] !== opts.secret) {
+      return send(res, 403, { error: "relay secret missing or invalid" });
+    }
+    const hasBody = req.method !== "GET" && req.method !== "HEAD";
+    let body;
+    if (hasBody) {
+      const chunks = [];
+      for await (const c of req) chunks.push(c);
+      body = chunks.length ? Buffer.concat(chunks) : void 0;
+    }
+    const headers = {};
+    for (const [k, v] of Object.entries(req.headers)) {
+      if (v === void 0) continue;
+      const lk = k.toLowerCase();
+      if (HOP_BY_HOP.has(lk) || lk === SECRET_HEADER_LC) continue;
+      headers[k] = Array.isArray(v) ? v.join(", ") : v;
+    }
+    let up;
+    try {
+      up = await fetch(target.href, { method: req.method, headers, body, redirect: "manual" });
+    } catch {
+      return send(res, 502, { error: "relay upstream unreachable" });
+    }
+    const outHeaders = {
+      "content-type": up.headers.get("content-type") ?? "application/json"
+    };
+    const retryAfter = up.headers.get("retry-after");
+    if (retryAfter) outHeaders["retry-after"] = retryAfter;
+    res.writeHead(up.status, outHeaders);
+    res.end(Buffer.from(await up.arrayBuffer()));
+  }
+  return new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", () => {
+      const port = server.address().port;
+      resolve({
+        port,
+        url: `http://127.0.0.1:${port}`,
+        close: () => new Promise((res) => server.close(() => res()))
+      });
+    });
+  });
+}
+
+// src/commands/relay.ts
+var DEFAULT_SUB = "cfapi";
+function fqdnFor2(sub, domain) {
+  return sub === "@" ? domain : `${sub}.${domain}`;
+}
+function spawnDetachedRelay(sub, domain) {
+  const script = process.argv[1];
+  if (!script) throw new CliError("Cannot resolve the cloudtunnel executable path.");
+  ensureDirs();
+  const logFile = join8(logDir, `relay-${sub === "@" ? "root" : sub}.log`);
+  const fd = openSync3(logFile, "a", 384);
+  const args = [script, "relay", sub, "-d", domain, "-f", "-y"];
+  const child = spawn3(process.execPath, args, { detached: true, stdio: ["ignore", fd, fd] });
+  child.unref();
+}
+function relayReadyLines(fqdn, secret, tty) {
+  const url = `https://${fqdn}`;
+  if (!tty) return [`relay ready at ${url}`];
+  const base = `${url}/client/v4`;
+  return [
+    `URL     ${pc2.green(url)}`,
+    `Secret  ${pc2.bold(secret)}  ${pc2.dim("(store it \u2014 the client needs it, shown once)")}`,
+    "",
+    pc2.bold("On the blocked client:"),
+    `  export CLOUDTUNNEL_API_BASE=${base}`,
+    `  export CLOUDTUNNEL_RELAY_SECRET=${secret}`,
+    `  printf %s "$CF_TOKEN" | cloudtunnel login --token-stdin`,
+    pc2.dim("  (mint the CF token on an unblocked host \u2014 dash.cloudflare.com is blocked too)")
+  ];
+}
+function printRelayReady(fqdn, secret, kind) {
+  const tty = !!process.stdout.isTTY;
+  const lines = relayReadyLines(fqdn, secret, tty);
+  if (tty) note(lines.join("\n"), "relay ready");
+  else say.dim(lines[0]);
+  if (tty && kind === "detach") say.dim("  \u2192 running in background \xB7 stop with: cloudtunnel delete " + fqdn);
+  if (tty && kind === "service") say.dim("  \u2192 boot service installed \xB7 view: cloudtunnel ls \xB7 remove: cloudtunnel delete " + fqdn);
+}
+async function runRelay(sub, opts) {
+  const creds = await ensureAuth();
+  const cf = resolveCf();
+  const domain = await resolveDomain(cf, opts, creds);
+  const fqdn = fqdnFor2(sub, domain);
+  if (opts.service) {
+    assertServiceSupported();
+    const secret2 = ensureRelaySecret();
+    installServiceForSpec({ command: "relay", subdomain: sub, port: 0, zone: domain, proto: "http" });
+    printRelayReady(fqdn, secret2, "service");
+    return;
+  }
+  if (opts.detach) {
+    const secret2 = ensureRelaySecret();
+    spawnDetachedRelay(sub, domain);
+    printRelayReady(fqdn, secret2, "detach");
+    return;
+  }
+  const bin = await ensureCloudflared();
+  const secret = ensureRelaySecret();
+  const proxy = await startProxy({ secret });
+  const item = {
+    port: proxy.port,
+    proto: "http",
+    name: sub,
+    zone: domain,
+    defaultZone: creds.defaultZone,
+    force: opts.force,
+    yes: opts.yes
+  };
+  await startTunnels(cf, bin, [item], {});
+  printRelayReady(fqdn, secret, "foreground");
+}
+function registerRelay(program) {
+  program.command("relay [subdomain]").description("Expose a locked Cloudflare-API reverse proxy via a tunnel (for clients that can't reach api.cloudflare.com directly)").option("-d, --domain <domain>", "domain for the relay subdomain (prompted from a list if unset)").option("--detach", "run the relay in the background").option("--service", "register the relay as a boot service (systemd \xB7 launchd \xB7 Task Scheduler)").option("-f, --force", "replace a non-tunnel DNS record occupying the hostname").option("-y, --yes", "don't prompt before replacing an existing record").action((subdomain, opts) => runRelay(subdomain ?? DEFAULT_SUB, opts));
+}
+
 // src/index.ts
 var require2 = createRequire(import.meta.url);
 var pkg = require2("../package.json");
@@ -1682,15 +1909,15 @@ function buildProgram() {
   program.addHelpText(
     "before",
     [
-      pc2.bold("Quickstart:"),
-      `  ${pc2.cyan("cloudtunnel login")}       once \u2014 paste a token (or set CLOUDFLARE_API_TOKEN)`,
-      `  ${pc2.cyan("cloudtunnel 8080")}        your local :8080 goes live at an HTTPS URL`,
-      `  ${pc2.cyan("cloudtunnel api:8080")}    api.<domain> \u2192 localhost:8080`,
-      `  ${pc2.cyan("cloudtunnel ls")}          list tunnels   ${pc2.dim("\xB7")}   ${pc2.cyan("cloudtunnel delete <#>")}   remove one`,
+      pc3.bold("Quickstart:"),
+      `  ${pc3.cyan("cloudtunnel login")}       once \u2014 paste a token (or set CLOUDFLARE_API_TOKEN)`,
+      `  ${pc3.cyan("cloudtunnel 8080")}        your local :8080 goes live at an HTTPS URL`,
+      `  ${pc3.cyan("cloudtunnel api:8080")}    api.<domain> \u2192 localhost:8080`,
+      `  ${pc3.cyan("cloudtunnel ls")}          list tunnels   ${pc3.dim("\xB7")}   ${pc3.cyan("cloudtunnel delete <#>")}   remove one`,
       ""
     ].join("\n")
   );
-  for (const register of [registerLogin, registerUp, registerLs, registerDelete, registerLogs]) {
+  for (const register of [registerLogin, registerUp, registerLs, registerDelete, registerLogs, registerRelay]) {
     register(program);
   }
   return program;