tunelo 0.0.0-stage → 1.6.2

package/cli.js

@@ -0,0 +1,2163 @@
+#!/usr/bin/env node
+// Tunelo CLI — bundled with esbuild
+
+// packages/client/src/cli.ts
+import { program } from "commander";
+
+// packages/client/src/cli-login-command.ts
+import { randomUUID } from "node:crypto";
+import { hostname } from "node:os";
+
+// packages/client/src/api-client.ts
+var ApiClientError = class extends Error {
+  constructor(code, message, statusCode) {
+    super(message);
+    this.code = code;
+    this.statusCode = statusCode;
+    this.name = "ApiClientError";
+  }
+};
+function getApiBaseUrl(serverUrl) {
+  return serverUrl.replace(/^wss:\/\//, "https://").replace(/^ws:\/\//, "http://").replace(/\/$/, "");
+}
+async function request(baseUrl, path3, options = {}) {
+  const headers = {};
+  if (options.apiKey) headers.Authorization = `Bearer ${options.apiKey}`;
+  if (options.body !== void 0) headers["Content-Type"] = "application/json";
+  const res = await fetch(`${baseUrl}/api${path3}`, {
+    method: options.method ?? "GET",
+    headers,
+    body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
+  });
+  const text = await res.text();
+  let data;
+  try {
+    data = JSON.parse(text);
+  } catch {
+    throw new ApiClientError(
+      "TUNELO_UNKNOWN",
+      text || `HTTP ${res.status}`,
+      res.status
+    );
+  }
+  if (!res.ok) {
+    throw new ApiClientError(
+      data.error?.code ?? "TUNELO_UNKNOWN",
+      data.error?.message ?? `HTTP ${res.status}`,
+      res.status
+    );
+  }
+  return data;
+}
+async function initDeviceLogin(baseUrl, deviceId, name) {
+  const data = await request(baseUrl, "/device/init", {
+    method: "POST",
+    body: { deviceId, name }
+  });
+  return data.requestId;
+}
+async function pollDeviceLogin(baseUrl, requestId) {
+  return request(baseUrl, "/device/poll", {
+    method: "POST",
+    body: { req: requestId }
+  });
+}
+async function verifyKey(baseUrl, key) {
+  try {
+    await request(baseUrl, "/verify", { apiKey: key });
+    return true;
+  } catch (err) {
+    if (err instanceof ApiClientError && err.statusCode === 401) return false;
+    throw err;
+  }
+}
+
+// packages/client/src/config.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+function getConfigDir() {
+  return join(homedir(), ".tunelo");
+}
+function getConfigPath() {
+  return join(getConfigDir(), "config.json");
+}
+function loadConfig() {
+  try {
+    return JSON.parse(readFileSync(getConfigPath(), "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function saveConfig(config) {
+  const dir = getConfigDir();
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  writeFileSync(getConfigPath(), JSON.stringify(config, null, 2));
+}
+
+// packages/client/src/cli-login-command.ts
+function getServerBaseUrl() {
+  const config = loadConfig();
+  const serverUrl = process.env.TUNELO_SERVER ?? config.server ?? "wss://tunnel.inetdev.io.vn";
+  return getApiBaseUrl(serverUrl);
+}
+function getDeviceId() {
+  const config = loadConfig();
+  if (config.deviceId) return config.deviceId;
+  const deviceId = randomUUID();
+  saveConfig({ ...config, deviceId });
+  return deviceId;
+}
+function saveKey(token) {
+  saveConfig({ ...loadConfig(), key: token });
+}
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+async function openBrowser(url) {
+  const { execFile } = await import("node:child_process");
+  const { promisify } = await import("node:util");
+  const run = promisify(execFile);
+  try {
+    if (process.platform === "darwin") await run("open", [url]);
+    else if (process.platform === "win32")
+      await run("cmd", ["/c", "start", "", url]);
+    else await run("xdg-open", [url]);
+  } catch {
+  }
+}
+function registerLoginCommands(program2) {
+  program2.command("login").description("Authorize this device via the browser").option("-k, --key <token>", "Use an existing access token (skip browser)").option("-f, --force", "Re-authorize even if already signed in").action(async (options) => {
+    const baseUrl = getServerBaseUrl();
+    if (options.key) {
+      if (!await verifyKey(baseUrl, options.key).catch(() => false)) {
+        console.error("  Invalid access token.");
+        process.exit(1);
+      }
+      saveKey(options.key);
+      console.log("  \u2713 Verified & saved. Run: tunelo http <port>");
+      return;
+    }
+    const existing = loadConfig().key;
+    if (existing && !options.force) {
+      if (await verifyKey(baseUrl, existing).catch(() => false)) {
+        console.log(
+          "  Already authorized on this device. (use --force to redo)"
+        );
+        return;
+      }
+    }
+    const deviceId = getDeviceId();
+    let requestId;
+    try {
+      requestId = await initDeviceLogin(baseUrl, deviceId, hostname());
+    } catch (err) {
+      console.error(`  Could not reach server: ${err.message}`);
+      process.exit(1);
+    }
+    const url = `${baseUrl}/login?req=${encodeURIComponent(requestId)}`;
+    console.log();
+    console.log("  Opening browser to authorize this device...");
+    console.log(`  ${url}`);
+    console.log();
+    console.log("  Waiting for approval in the browser...");
+    await openBrowser(url);
+    const deadline = Date.now() + 5 * 60 * 1e3;
+    while (Date.now() < deadline) {
+      await sleep(2e3);
+      let result;
+      try {
+        result = await pollDeviceLogin(baseUrl, requestId);
+      } catch {
+        continue;
+      }
+      if (result.status === "approved") {
+        saveKey(result.token);
+        console.log(
+          "  \u2713 Device authorized & signed in. Run: tunelo http <port>"
+        );
+        return;
+      }
+      if (result.status === "expired") {
+        console.error("  Login request expired. Run `tunelo login` again.");
+        process.exit(1);
+      }
+    }
+    console.error("  Timed out waiting for approval.");
+    process.exit(1);
+  });
+  program2.command("logout").description("Remove the saved access token").action(() => {
+    const config = loadConfig();
+    if (!config.key) {
+      console.log("  Not logged in.");
+      return;
+    }
+    saveConfig({ ...config, key: void 0 });
+    console.log("  Logged out. Access token removed.");
+  });
+}
+
+// packages/client/src/run-registry.ts
+import {
+  existsSync as existsSync2,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync2,
+  readdirSync,
+  rmSync,
+  writeFileSync as writeFileSync2
+} from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import { join as join2 } from "node:path";
+function getRunDir() {
+  return join2(homedir2(), ".tunelo", "running");
+}
+function recordPath(pid) {
+  return join2(getRunDir(), `${pid}.json`);
+}
+function isAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+function saveRecord(record) {
+  const dir = getRunDir();
+  if (!existsSync2(dir)) mkdirSync2(dir, { recursive: true });
+  writeFileSync2(recordPath(record.pid), JSON.stringify(record));
+}
+function removeRecord(pid) {
+  rmSync(recordPath(pid), { force: true });
+}
+function listRecords() {
+  const dir = getRunDir();
+  if (!existsSync2(dir)) return [];
+  const records = [];
+  for (const file of readdirSync(dir)) {
+    if (!file.endsWith(".json")) continue;
+    const path3 = join2(dir, file);
+    let record;
+    try {
+      record = JSON.parse(readFileSync2(path3, "utf-8"));
+    } catch {
+      rmSync(path3, { force: true });
+      continue;
+    }
+    if (!isAlive(record.pid)) {
+      rmSync(path3, { force: true });
+      continue;
+    }
+    records.push(record);
+  }
+  return records.sort((a, b) => a.startedAt - b.startedAt);
+}
+function startRunRecord(kind, server) {
+  const pid = process.pid;
+  const record = {
+    pid,
+    kind,
+    startedAt: Date.now(),
+    server,
+    tunnels: []
+  };
+  saveRecord(record);
+  const cleanup = () => removeRecord(pid);
+  process.on("exit", cleanup);
+  process.on("SIGTERM", () => {
+    cleanup();
+    process.exit(0);
+  });
+  return {
+    update(tunnels) {
+      record.tunnels = tunnels;
+      saveRecord(record);
+    }
+  };
+}
+
+// packages/client/src/cli-status-commands.ts
+function formatUptime(ms) {
+  const s = Math.floor(ms / 1e3);
+  if (s < 60) return `${s}s`;
+  const m = Math.floor(s / 60);
+  if (m < 60) return `${m}m ${s % 60}s`;
+  return `${Math.floor(m / 60)}h ${m % 60}m`;
+}
+function registerStatusCommands(program2) {
+  program2.command("status").description("List tunnels running on this machine").action(() => {
+    const records = listRecords();
+    if (records.length === 0) {
+      console.log("No tunnels running.");
+      return;
+    }
+    const now = Date.now();
+    for (const r of records) {
+      const tunnels = r.tunnels.length ? r.tunnels.map((t) => `${t.url} \u2192 :${t.localPort}`).join(", ") : "(connecting\u2026)";
+      console.log(
+        `PID ${r.pid}  [${r.kind}]  up ${formatUptime(now - r.startedAt)}  ${tunnels}`
+      );
+    }
+  });
+  program2.command("kill <target>").description("Stop a running tunnel by PID, subdomain/URL, or 'all'").action((target) => {
+    const records = listRecords();
+    const matches = target === "all" ? records : records.filter(
+      (r) => String(r.pid) === target || r.tunnels.some((t) => t.url.includes(target))
+    );
+    if (matches.length === 0) {
+      console.log(`No running tunnel matches "${target}".`);
+      return;
+    }
+    for (const r of matches) {
+      try {
+        process.kill(r.pid, "SIGTERM");
+        console.log(`Stopped PID ${r.pid} (${r.kind}).`);
+      } catch {
+        removeRecord(r.pid);
+        console.log(`PID ${r.pid} was not running \u2014 removed stale record.`);
+      }
+    }
+  });
+}
+
+// packages/client/src/tcp-proxy.ts
+import net from "node:net";
+var TcpProxy = class {
+  connections = /* @__PURE__ */ new Map();
+  client;
+  localPort;
+  localHost;
+  constructor(client, localPort, localHost = "127.0.0.1") {
+    this.client = client;
+    this.localPort = localPort;
+    this.localHost = localHost;
+    this.setupHandlers();
+  }
+  setupHandlers() {
+    this.client.on("tcp-connection-open", (msg) => {
+      this.handleConnectionOpen(msg);
+    });
+    this.client.on("tcp-data", (msg) => {
+      this.handleData(msg);
+    });
+    this.client.on("tcp-connection-close", (msg) => {
+      this.handleConnectionClose(msg);
+    });
+  }
+  handleConnectionOpen(msg) {
+    const localSocket = net.createConnection({
+      host: this.localHost,
+      port: this.localPort
+    });
+    const conn = {
+      socket: localSocket,
+      connectionId: msg.connectionId
+    };
+    this.connections.set(msg.connectionId, conn);
+    localSocket.on("data", (chunk) => {
+      this.client.sendMsg({
+        type: "tcp-data",
+        connectionId: msg.connectionId,
+        data: chunk.toString("base64")
+      });
+    });
+    localSocket.on("close", () => {
+      this.connections.delete(msg.connectionId);
+      this.client.sendMsg({
+        type: "tcp-connection-close",
+        connectionId: msg.connectionId
+      });
+    });
+    localSocket.on("error", () => {
+      localSocket.destroy();
+      this.connections.delete(msg.connectionId);
+      this.client.sendMsg({
+        type: "tcp-connection-close",
+        connectionId: msg.connectionId
+      });
+    });
+  }
+  handleData(msg) {
+    const conn = this.connections.get(msg.connectionId);
+    if (conn) {
+      conn.socket.write(Buffer.from(msg.data, "base64"));
+    }
+  }
+  handleConnectionClose(msg) {
+    const conn = this.connections.get(msg.connectionId);
+    if (conn) {
+      conn.socket.destroy();
+      this.connections.delete(msg.connectionId);
+    }
+  }
+  close() {
+    for (const [, conn] of this.connections) {
+      conn.socket.destroy();
+    }
+    this.connections.clear();
+  }
+};
+
+// packages/client/src/tunnel-client.ts
+import { EventEmitter } from "node:events";
+
+// packages/shared/src/protocol.ts
+function parseMessage(data) {
+  return JSON.parse(data);
+}
+
+// packages/shared/src/constants.ts
+var DEFAULTS = {
+  SERVER_PORT: 3001,
+  WS_PATH: "/tunnel",
+  HEALTH_PATH: "/health",
+  MAX_BODY_SIZE: 50 * 1024 * 1024,
+  REQUEST_TIMEOUT_MS: 3e4,
+  /** Idle timeout (ms) for a relayed response stream — reset on every frame so SSE/long downloads stay open */
+  STREAM_IDLE_TIMEOUT_MS: 6e4,
+  PING_INTERVAL_MS: 3e4,
+  /** Cap on the WS handshake, TCP connect included. Without one, a blackholed
+   *  SYN stalls the attempt for the kernel's whole retry budget (~135s
+   *  measured), and the reconnect backoff sits idle for all of it. */
+  CONNECT_TIMEOUT_MS: 1e4,
+  RECONNECT_BASE_MS: 1e3,
+  RECONNECT_MAX_MS: 3e4,
+  MAX_SUBDOMAIN_LENGTH: 63,
+  /** Max WebSocket messages per second per connection */
+  WS_RATE_LIMIT: 1e3,
+  /** Grace period (ms) to wait for client reconnect before rejecting pending requests */
+  RECONNECT_GRACE_MS: 5e3,
+  /** TCP tunnel port range start */
+  TCP_PORT_MIN: 1e4,
+  /** TCP tunnel port range end */
+  TCP_PORT_MAX: 10999,
+  /** Max TCP tunnels per server */
+  TCP_MAX_TUNNELS: 100,
+  /** Max concurrent TCP connections per tunnel */
+  TCP_MAX_CONNECTIONS_PER_TUNNEL: 50,
+  /** TCP idle connection timeout (ms) — 10 minutes */
+  TCP_IDLE_TIMEOUT_MS: 10 * 60 * 1e3,
+  /** Max new TCP connections per second per tunnel */
+  TCP_CONNECT_RATE_LIMIT: 10,
+  /** Max concurrent browser WebSocket connections per tunnel */
+  WS_APP_MAX_PER_TUNNEL: 50,
+  /** Local WS handshake timeout (ms) for the browser→app relay */
+  WS_APP_HANDSHAKE_TIMEOUT_MS: 1e4,
+  /** Max frames buffered before the local WS finishes opening */
+  WS_APP_PREOPEN_QUEUE_MAX: 64
+};
+var SUBDOMAIN_REGEX = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
+
+// packages/shared/src/http-headers.ts
+var HOP_BY_HOP = /* @__PURE__ */ new Set([
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailers",
+  "transfer-encoding",
+  "upgrade"
+]);
+function stripHopByHopHeaders(headers) {
+  const out = {};
+  for (const [key, value] of Object.entries(headers)) {
+    if (!HOP_BY_HOP.has(key.toLowerCase())) out[key] = value;
+  }
+  return out;
+}
+
+// packages/client/src/tunnel-client.ts
+import WebSocket2 from "ws";
+
+// packages/client/src/http-stream.ts
+import http from "node:http";
+var INSPECTOR_PREVIEW_CAP = 256 * 1024;
+var FRAME_BYTES = 256 * 1024;
+var HIGH_WATER = 4 * 1024 * 1024;
+var LOW_WATER = 1 * 1024 * 1024;
+function proxyRequestStream(request2, localPort, transport, localHost = "localhost") {
+  const id = request2.id;
+  let settled = false;
+  let started = false;
+  let resStream = null;
+  let resolveDone;
+  const done = new Promise((r) => {
+    resolveDone = r;
+  });
+  const previewChunks = [];
+  let previewSize = 0;
+  let truncated = false;
+  let status = 502;
+  let headers = {};
+  function capturePreview(chunk) {
+    if (truncated) return;
+    const remaining = INSPECTOR_PREVIEW_CAP - previewSize;
+    if (remaining <= 0) {
+      truncated = true;
+      return;
+    }
+    const slice = chunk.length > remaining ? chunk.subarray(0, remaining) : chunk;
+    previewChunks.push(slice);
+    previewSize += slice.length;
+    if (chunk.length > remaining) truncated = true;
+  }
+  function finish() {
+    if (settled) return;
+    settled = true;
+    resolveDone({
+      status,
+      headers,
+      bodyPreview: previewChunks.length ? Buffer.concat(previewChunks).toString("base64") : null,
+      truncated
+    });
+  }
+  function fail(message) {
+    if (settled) return;
+    if (started) {
+      transport.send({ type: "stream-error", id, message });
+    } else {
+      status = 502;
+      headers = { "content-type": "text/plain" };
+      const payload = Buffer.from(message);
+      capturePreview(payload);
+      transport.send({ type: "stream-start", id, status, headers });
+      transport.send({
+        type: "stream-data",
+        id,
+        data: payload.toString("base64")
+      });
+      transport.send({ type: "stream-end", id });
+    }
+    finish();
+  }
+  let pending = [];
+  let pendingBytes = 0;
+  let flushScheduled = false;
+  function flushNow() {
+    if (pending.length === 0 || settled) return;
+    const buf = Buffer.concat(pending);
+    pending = [];
+    pendingBytes = 0;
+    transport.send({ type: "stream-data", id, data: buf.toString("base64") });
+    applyBackpressure();
+  }
+  function scheduleFlush() {
+    if (flushScheduled) return;
+    flushScheduled = true;
+    setImmediate(() => {
+      flushScheduled = false;
+      flushNow();
+    });
+  }
+  function applyBackpressure() {
+    if (!resStream || resStream.isPaused()) return;
+    if (transport.bufferedAmount() <= HIGH_WATER) return;
+    resStream.pause();
+    const timer = setInterval(() => {
+      if (settled) {
+        clearInterval(timer);
+        return;
+      }
+      if (transport.bufferedAmount() <= LOW_WATER) {
+        clearInterval(timer);
+        resStream?.resume();
+      }
+    }, 25);
+  }
+  const body = request2.body ? Buffer.from(request2.body, "base64") : null;
+  const proxyReq = http.request(
+    {
+      hostname: localHost,
+      port: localPort,
+      path: request2.path,
+      method: request2.method,
+      headers: stripHopByHopHeaders(request2.headers)
+    },
+    (proxyRes) => {
+      if (settled) return;
+      resStream = proxyRes;
+      status = proxyRes.statusCode ?? 502;
+      headers = stripHopByHopHeaders(
+        proxyRes.headers
+      );
+      started = true;
+      transport.send({ type: "stream-start", id, status, headers });
+      proxyRes.on("data", (chunk) => {
+        if (settled) return;
+        capturePreview(chunk);
+        pending.push(chunk);
+        pendingBytes += chunk.length;
+        if (pendingBytes >= FRAME_BYTES) flushNow();
+        else scheduleFlush();
+      });
+      proxyRes.on("end", () => {
+        if (settled) return;
+        flushNow();
+        transport.send({ type: "stream-end", id });
+        finish();
+      });
+      proxyRes.on("error", () => fail("Local response error"));
+      proxyRes.on("aborted", () => fail("Local response aborted"));
+    }
+  );
+  proxyReq.on("error", (err) => {
+    const code = err.code;
+    fail(code === "ECONNREFUSED" ? "Local service unavailable" : err.message);
+  });
+  proxyReq.setTimeout(DEFAULTS.STREAM_IDLE_TIMEOUT_MS, () => {
+    fail("Local service timeout");
+    proxyReq.destroy();
+  });
+  if (body) proxyReq.write(body);
+  proxyReq.end();
+  return {
+    cancel() {
+      if (settled) return;
+      settled = true;
+      proxyReq.destroy();
+      resolveDone({
+        status,
+        headers,
+        bodyPreview: previewChunks.length ? Buffer.concat(previewChunks).toString("base64") : null,
+        truncated
+      });
+    },
+    done
+  };
+}
+
+// packages/client/src/ws-app-proxy.ts
+import WebSocket from "ws";
+function toBuffer(data) {
+  if (Buffer.isBuffer(data)) return data;
+  if (Array.isArray(data)) return Buffer.concat(data);
+  return Buffer.from(data);
+}
+function safeClose(ws, code, reason) {
+  try {
+    if (code && code >= 1e3 && code <= 4999) ws.close(code, reason);
+    else ws.close();
+  } catch {
+    ws.terminate();
+  }
+}
+var WS_HANDSHAKE_HEADERS = [
+  "host",
+  "sec-websocket-key",
+  "sec-websocket-version",
+  "sec-websocket-extensions",
+  "sec-websocket-protocol",
+  "content-length"
+];
+var WsAppProxy = class {
+  constructor(send, resolvePort) {
+    this.send = send;
+    this.resolvePort = resolvePort;
+  }
+  conns = /* @__PURE__ */ new Map();
+  open(msg) {
+    const port = this.resolvePort(msg.subdomain);
+    const headers = stripHopByHopHeaders(msg.headers);
+    for (const h of WS_HANDSHAKE_HEADERS) delete headers[h];
+    const url = `ws://localhost:${port}${msg.path}`;
+    const protocols = msg.protocol ? msg.protocol.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+    const opts = {
+      headers,
+      handshakeTimeout: DEFAULTS.WS_APP_HANDSHAKE_TIMEOUT_MS
+    };
+    const local = protocols ? new WebSocket(url, protocols, opts) : new WebSocket(url, opts);
+    const conn = { ws: local, ready: false, queue: [] };
+    this.conns.set(msg.id, conn);
+    local.on("open", () => {
+      conn.ready = true;
+      for (const q of conn.queue) {
+        local.send(Buffer.from(q.data, "base64"), { binary: q.binary });
+      }
+      conn.queue = [];
+    });
+    local.on("message", (data, isBinary) => {
+      this.send({
+        type: "ws-data",
+        id: msg.id,
+        data: toBuffer(data).toString("base64"),
+        binary: isBinary
+      });
+    });
+    local.on("close", (code, reason) => {
+      if (!this.conns.delete(msg.id)) return;
+      this.send({
+        type: "ws-close",
+        id: msg.id,
+        code,
+        reason: reason.toString()
+      });
+    });
+    local.on("error", () => {
+    });
+  }
+  data(msg) {
+    const conn = this.conns.get(msg.id);
+    if (!conn) return;
+    if (conn.ready && conn.ws.readyState === WebSocket.OPEN) {
+      conn.ws.send(Buffer.from(msg.data, "base64"), { binary: msg.binary });
+      return;
+    }
+    if (conn.queue.length >= DEFAULTS.WS_APP_PREOPEN_QUEUE_MAX) {
+      conn.ws.close();
+      return;
+    }
+    conn.queue.push(msg);
+  }
+  close(msg) {
+    const conn = this.conns.get(msg.id);
+    if (!conn) return;
+    this.conns.delete(msg.id);
+    safeClose(conn.ws, msg.code, msg.reason);
+  }
+  /** Control socket dropped — tear down all local WS connections. */
+  closeAll() {
+    for (const conn of this.conns.values()) conn.ws.close();
+    this.conns.clear();
+  }
+};
+
+// packages/client/src/tunnel-client.ts
+var TunnelClient = class extends EventEmitter {
+  socket = null;
+  stopped = false;
+  attempts = 0;
+  /** Guards against more than one retry loop running at a time. */
+  reconnecting = false;
+  options;
+  /** Maps subdomain → local port for multi-tunnel routing */
+  subdomainPortMap = /* @__PURE__ */ new Map();
+  /** In-flight response streams keyed by request id (for cancel/cleanup). */
+  activeStreams = /* @__PURE__ */ new Map();
+  /** Browser→app WebSocket relay: opens a local WS per `ws-open` and bridges frames. */
+  wsAppProxy = new WsAppProxy(
+    (msg) => this.socket?.send(JSON.stringify(msg)),
+    (subdomain) => this.subdomainPortMap.get(subdomain) ?? this.options.localPort
+  );
+  constructor(options) {
+    super();
+    this.options = options;
+  }
+  connect() {
+    return new Promise((resolve, reject) => {
+      const wsUrl = this.buildWsUrl();
+      const socket = new WebSocket2(wsUrl, {
+        handshakeTimeout: this.options.connectTimeoutMs ?? DEFAULTS.CONNECT_TIMEOUT_MS
+      });
+      this.socket = socket;
+      let authResolved = false;
+      let authAccepted = false;
+      let keepalive = null;
+      let alive = true;
+      socket.on("pong", () => {
+        alive = true;
+      });
+      socket.on("open", () => {
+        const authMsg = {
+          type: "auth",
+          key: this.options.apiKey,
+          subdomain: this.options.subdomain ?? "",
+          auth: this.options.auth
+        };
+        socket.send(JSON.stringify(authMsg));
+        keepalive = setInterval(() => {
+          if (socket.readyState !== WebSocket2.OPEN) return;
+          if (!alive) {
+            socket.terminate();
+            return;
+          }
+          alive = false;
+          socket.ping();
+        }, this.options.pingIntervalMs ?? DEFAULTS.PING_INTERVAL_MS);
+        keepalive.unref?.();
+      });
+      socket.on("message", (data) => {
+        let msg;
+        try {
+          msg = parseMessage(data.toString());
+        } catch {
+          return;
+        }
+        switch (msg.type) {
+          case "auth-result":
+            this.handleAuthResult(msg, authResolved, socket, resolve, reject);
+            if (!authResolved) authResolved = true;
+            if (msg.success) authAccepted = true;
+            break;
+          case "register-tunnel-result":
+            this.handleRegisterTunnelResult(msg);
+            break;
+          case "tcp-register-result":
+            this.handleTcpRegisterResult(msg);
+            break;
+          case "request":
+            this.handleRequest(msg);
+            break;
+          case "stream-error":
+            this.activeStreams.get(msg.id)?.cancel();
+            this.activeStreams.delete(msg.id);
+            break;
+          case "tcp-connection-open":
+            this.emit("tcp-connection-open", msg);
+            break;
+          case "tcp-data":
+            this.emit("tcp-data", msg);
+            break;
+          case "tcp-connection-close":
+            this.emit("tcp-connection-close", msg);
+            break;
+          case "ws-open":
+            this.wsAppProxy.open(msg);
+            break;
+          case "ws-data":
+            this.wsAppProxy.data(msg);
+            break;
+          case "ws-close":
+            this.wsAppProxy.close(msg);
+            break;
+          default:
+            break;
+        }
+      });
+      socket.on("close", () => {
+        if (keepalive) {
+          clearInterval(keepalive);
+          keepalive = null;
+        }
+        if (this.socket !== socket) return;
+        for (const stream of this.activeStreams.values()) stream.cancel();
+        this.activeStreams.clear();
+        this.wsAppProxy.closeAll();
+        this.emit("disconnected");
+        if (!this.stopped && authAccepted) {
+          this.reconnect();
+        }
+      });
+      socket.on("error", (err) => {
+        if (!authResolved) {
+          authResolved = true;
+          reject(err);
+        }
+        this.emit("error", err);
+      });
+    });
+  }
+  disconnect() {
+    this.stopped = true;
+    this.socket?.close();
+  }
+  /** Register a TCP tunnel after auth */
+  registerTcp(localPort, remotePort) {
+    const msg = {
+      type: "tcp-register",
+      localPort,
+      remotePort
+    };
+    this.sendMsg(msg);
+  }
+  /** Get raw socket for TcpProxy to attach handlers */
+  getSocket() {
+    return this.socket;
+  }
+  /** Send a JSON message over the WebSocket */
+  sendMsg(msg) {
+    if (this.socket?.readyState === WebSocket2.OPEN) {
+      this.socket.send(JSON.stringify(msg));
+    }
+  }
+  buildWsUrl() {
+    const url = this.options.serverUrl.replace(/^https:\/\//, "wss://").replace(/^http:\/\//, "ws://");
+    return `${url}${DEFAULTS.WS_PATH}`;
+  }
+  handleAuthResult(result, alreadyResolved, socket, resolve, reject) {
+    if (alreadyResolved) return;
+    if (!result.success) {
+      socket.close();
+      reject(new Error(result.error ?? "Auth failed"));
+      return;
+    }
+    this.attempts = 0;
+    this.subdomainPortMap.set(result.subdomain, this.options.localPort);
+    this.emit("connected", result);
+    this.registerAdditionalTunnels();
+    resolve(result);
+  }
+  handleRegisterTunnelResult(result) {
+    if (result.success) {
+      this.subdomainPortMap.set(result.subdomain, result.localPort);
+      this.emit("tunnel-registered", result);
+    } else {
+      this.emit("tunnel-register-error", result);
+    }
+  }
+  handleTcpRegisterResult(result) {
+    if (result.success) {
+      this.emit("tcp-registered", result);
+    } else {
+      this.emit("tcp-register-error", result);
+    }
+  }
+  registerAdditionalTunnels() {
+    const tunnels = this.options.additionalTunnels;
+    if (!tunnels?.length) return;
+    for (const tunnel of tunnels) {
+      const msg = {
+        type: "register-tunnel",
+        subdomain: tunnel.subdomain,
+        localPort: tunnel.port,
+        auth: this.options.auth
+      };
+      this.sendMsg(msg);
+    }
+  }
+  async handleRequest(request2) {
+    const start = Date.now();
+    const targetPort = request2.subdomain ? this.subdomainPortMap.get(request2.subdomain) ?? this.options.localPort : this.options.localPort;
+    const stream = proxyRequestStream(
+      request2,
+      targetPort,
+      {
+        send: (msg) => this.sendMsg(msg),
+        bufferedAmount: () => this.socket?.bufferedAmount ?? 0
+      },
+      this.options.localHost
+    );
+    this.activeStreams.set(request2.id, stream);
+    const result = await stream.done;
+    this.activeStreams.delete(request2.id);
+    const durationMs = Date.now() - start;
+    this.emit("request", {
+      method: request2.method,
+      path: request2.path,
+      status: result.status,
+      durationMs,
+      subdomain: request2.subdomain
+    });
+    this.emit("inspector-entry", {
+      id: request2.id,
+      timestamp: start,
+      subdomain: request2.subdomain,
+      method: request2.method,
+      path: request2.path,
+      requestHeaders: request2.headers,
+      requestBody: request2.body,
+      status: result.status,
+      responseHeaders: result.headers,
+      responseBody: result.bodyPreview,
+      durationMs,
+      entryType: "normal"
+    });
+  }
+  async reconnect() {
+    if (this.reconnecting) return;
+    this.reconnecting = true;
+    this.subdomainPortMap.clear();
+    let delay = DEFAULTS.RECONNECT_BASE_MS;
+    try {
+      while (!this.stopped) {
+        this.attempts++;
+        const wait = Math.round(delay * (0.5 + Math.random() / 2));
+        this.emit("reconnecting", { attempt: this.attempts, delay: wait });
+        await new Promise((r) => setTimeout(r, wait));
+        try {
+          await this.connect();
+          return;
+        } catch {
+          delay = Math.min(delay * 2, DEFAULTS.RECONNECT_MAX_MS);
+        }
+      }
+    } finally {
+      this.reconnecting = false;
+    }
+  }
+};
+
+// packages/client/src/version.ts
+var VERSION = "1.6.2";
+var PACKAGE_NAME = "tunelo";
+
+// packages/client/src/cli-tcp-command.ts
+function registerTcpCommand(program2, display2) {
+  program2.command("tcp <port>").description("Create TCP tunnel to local port").option("-k, --key <apikey>", "API key for authentication").option("--server <url>", "Tunnel server URL").option("--remote-port <port>", "Request specific remote port").action(
+    async (portStr, options) => {
+      const port = Number(portStr);
+      if (Number.isNaN(port) || port < 1 || port > 65535) {
+        display2.showError("Invalid port number");
+        process.exit(1);
+      }
+      const config = loadConfig();
+      const apiKey = options.key ?? process.env.TUNELO_KEY ?? config.key;
+      const serverUrl = options.server ?? process.env.TUNELO_SERVER ?? config.server ?? "wss://tunnel.inetdev.io.vn";
+      if (!apiKey) {
+        display2.showError("API key required.");
+        process.exit(1);
+      }
+      display2.showBanner(VERSION);
+      display2.showConnecting(serverUrl);
+      const client = new TunnelClient({ serverUrl, apiKey, localPort: port });
+      client.on("connected", () => {
+        const remotePort = options.remotePort ? Number(options.remotePort) : void 0;
+        client.registerTcp(port, remotePort);
+      });
+      client.on("tcp-registered", (result) => {
+        display2.showTcpTunnel(result.url, port);
+        new TcpProxy(client, port);
+      });
+      client.on("tcp-register-error", (result) => {
+        display2.showError(`TCP tunnel failed: ${result.error}`);
+      });
+      client.on("disconnected", () => display2.showDisconnected());
+      client.on(
+        "reconnecting",
+        (info) => {
+          display2.showReconnecting(info.attempt, info.delay);
+        }
+      );
+      client.on("error", (err) => display2.showError(err.message));
+      try {
+        await client.connect();
+      } catch (err) {
+        display2.showError(err.message);
+        process.exit(1);
+      }
+      process.on("SIGINT", () => {
+        client.disconnect();
+        display2.showStats();
+        process.exit(0);
+      });
+    }
+  );
+}
+
+// packages/client/src/cli-update-command.ts
+import { spawn } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import chalk from "chalk";
+var isWindows = process.platform === "win32";
+function detectPackageManager(modulePath) {
+  const normalized = modulePath.split(path.win32.sep).join(path.posix.sep);
+  return normalized.includes("/pnpm/") ? "pnpm" : "npm";
+}
+function compareVersions(a, b) {
+  const parse = (v) => v.replace(/^v/, "").split("-")[0].split(".").map((part) => Number.parseInt(part, 10) || 0);
+  const left = parse(a);
+  const right = parse(b);
+  for (let i = 0; i < Math.max(left.length, right.length); i++) {
+    const diff = (left[i] ?? 0) - (right[i] ?? 0);
+    if (diff !== 0) return diff;
+  }
+  return 0;
+}
+function buildInstallArgs(manager, target) {
+  return manager === "pnpm" ? ["add", "-g", target] : ["install", "-g", target];
+}
+function spawnManager(manager, args, options) {
+  return isWindows ? spawn([manager, ...args].join(" "), { ...options, shell: true }) : spawn(manager, args, options);
+}
+function fetchLatestVersion(manager) {
+  return new Promise((resolve, reject) => {
+    const child = spawnManager(manager, ["view", PACKAGE_NAME, "version"], {
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: 6e4
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.on("error", reject);
+    child.on("close", (code) => {
+      if (code !== 0) {
+        reject(new Error(stderr.trim().split("\n").pop() ?? `exit ${code}`));
+        return;
+      }
+      const version = stdout.trim().split("\n").pop()?.trim();
+      if (!version) {
+        reject(new Error("Registry returned no version"));
+        return;
+      }
+      resolve(version);
+    });
+  });
+}
+function runInstall(manager, target) {
+  return new Promise((resolve, reject) => {
+    const child = spawnManager(manager, buildInstallArgs(manager, target), {
+      stdio: "inherit"
+    });
+    child.on("error", reject);
+    child.on("close", (code) => resolve(code ?? 1));
+  });
+}
+function registerUpdateCommand(program2) {
+  program2.command("update").description("Update tunelo to the latest published version").option("--check", "Only report whether an update exists").action(async (options) => {
+    const manager = detectPackageManager(fileURLToPath(import.meta.url));
+    let latest;
+    try {
+      console.log(chalk.gray("  Checking registry..."));
+      latest = await fetchLatestVersion(manager);
+    } catch (err) {
+      console.log(
+        chalk.red(
+          `  Error: cannot reach registry \u2014 ${err.message}`
+        )
+      );
+      console.log(
+        chalk.gray(
+          `  Update manually: ${manager} ${buildInstallArgs(manager, `${PACKAGE_NAME}@latest`).join(" ")}`
+        )
+      );
+      process.exitCode = 1;
+      return;
+    }
+    if (compareVersions(latest, VERSION) <= 0) {
+      console.log(
+        `  ${chalk.green("Already up to date")} \u2014 v${VERSION} is the latest.`
+      );
+      return;
+    }
+    console.log(
+      `  Update available: ${chalk.gray(`v${VERSION}`)} \u2192 ${chalk.cyan(`v${latest}`)}`
+    );
+    if (options.check) {
+      console.log(chalk.gray("  Run `tunelo update` to install it."));
+      return;
+    }
+    console.log(chalk.gray(`  Installing via ${manager}...`));
+    let code;
+    try {
+      code = await runInstall(manager, `${PACKAGE_NAME}@latest`);
+    } catch (err) {
+      console.log(
+        chalk.red(
+          `  Error: ${manager} failed to start \u2014 ${err.message}`
+        )
+      );
+      process.exitCode = 1;
+      return;
+    }
+    if (code !== 0) {
+      console.log(chalk.red(`  Update failed (${manager} exited ${code}).`));
+      process.exitCode = code;
+      return;
+    }
+    console.log(`  ${chalk.green("Updated")} to v${latest}.`);
+    console.log(chalk.gray("  Restart any running tunnels to apply."));
+  });
+}
+
+// packages/client/src/display.ts
+import chalk2 from "chalk";
+function maskKey(key) {
+  if (key.length <= 8) return "****";
+  return `${key.slice(0, 4)}...${key.slice(-4)}`;
+}
+function formatUptime2(ms) {
+  const seconds = Math.floor(ms / 1e3);
+  const minutes = Math.floor(seconds / 60);
+  const hours = Math.floor(minutes / 60);
+  if (hours > 0) return `${hours}h ${minutes % 60}m ${seconds % 60}s`;
+  if (minutes > 0) return `${minutes}m ${seconds % 60}s`;
+  return `${seconds}s`;
+}
+function portFallbackNote(port, requestedPort) {
+  if (requestedPort === void 0 || requestedPort === port) return "";
+  return chalk2.gray(` (${requestedPort} in use)`);
+}
+var Display = class {
+  logLevel = "normal";
+  startTime = 0;
+  totalRequests = 0;
+  errorRequests = 0;
+  setLogLevel(level) {
+    this.logLevel = level;
+  }
+  showBanner(version) {
+    console.log(chalk2.bold(`
+  tunelo v${version}
+`));
+  }
+  showConnecting(server) {
+    console.log(chalk2.yellow(`  Connecting to ${server}...`));
+  }
+  showConnected(tunnelUrl, localUrl, apiKey, authEnabled = false) {
+    this.startTime = Date.now();
+    console.log(chalk2.green("  Status:    ") + chalk2.bold.green("Online"));
+    console.log(chalk2.green("  Tunnel:    ") + chalk2.cyan(tunnelUrl));
+    console.log(`${chalk2.green("  Forwarding:")} ${localUrl}`);
+    if (apiKey) {
+      console.log(chalk2.green("  API Key:   ") + chalk2.gray(maskKey(apiKey)));
+    }
+    if (authEnabled) {
+      console.log(chalk2.green("  Auth:      ") + chalk2.yellow("enabled"));
+    }
+    console.log(chalk2.gray("  \u2500".repeat(20)));
+  }
+  showInspector(port, requestedPort) {
+    console.log(
+      chalk2.green("  Inspector: ") + chalk2.cyan(`http://localhost:${port}`) + portFallbackNote(port, requestedPort)
+    );
+  }
+  showPortal(port, requestedPort) {
+    console.log(
+      chalk2.green("  Portal:    ") + chalk2.cyan(`http://localhost:${port}`) + portFallbackNote(port, requestedPort)
+    );
+  }
+  showTunnelRegistered(subdomain, url, localPort) {
+    console.log(
+      `${chalk2.green("  + Tunnel:  ") + chalk2.cyan(url)} \u2192 http://localhost:${localPort}`
+    );
+  }
+  showTcpTunnel(url, localPort) {
+    console.log(
+      `${chalk2.green("  TCP:       ") + chalk2.cyan(url)} \u2192 localhost:${localPort}`
+    );
+  }
+  showDisconnected(reason) {
+    console.log(chalk2.red(`  Disconnected${reason ? `: ${reason}` : ""}`));
+  }
+  showReconnecting(attempt, delayMs) {
+    console.log(
+      chalk2.yellow(`  Reconnecting (attempt ${attempt}, ${delayMs}ms)...`)
+    );
+  }
+  logRequest(method, path3, status, durationMs, bodySize, subdomain) {
+    this.totalRequests++;
+    if (status >= 500) this.errorRequests++;
+    if (this.logLevel === "quiet") return;
+    const statusColor = status < 300 ? chalk2.green : status < 500 ? chalk2.yellow : chalk2.red;
+    const methodStr = method.padEnd(7);
+    const pathStr = path3.length > 40 ? `${path3.slice(0, 37)}...` : path3;
+    const prefix = subdomain ? chalk2.magenta(`[${subdomain}] `) : "";
+    let line = `  ${prefix}${chalk2.bold(methodStr)} ${pathStr.padEnd(42)} ${statusColor(String(status))}  ${chalk2.gray(`${durationMs}ms`)}`;
+    if (this.logLevel === "verbose" && bodySize !== void 0) {
+      const sizeStr = bodySize > 1024 ? `${(bodySize / 1024).toFixed(1)}KB` : `${bodySize}B`;
+      line += chalk2.gray(`  ${sizeStr}`);
+    }
+    console.log(line);
+  }
+  showStats() {
+    const uptime = this.startTime ? formatUptime2(Date.now() - this.startTime) : "0s";
+    console.log("");
+    console.log(chalk2.gray("  \u2500".repeat(20)));
+    console.log(chalk2.bold("  Session Summary"));
+    console.log(`  Uptime:    ${chalk2.cyan(uptime)}`);
+    console.log(`  Requests:  ${chalk2.green(String(this.totalRequests))}`);
+    if (this.errorRequests > 0) {
+      console.log(`  Errors:    ${chalk2.red(String(this.errorRequests))}`);
+    }
+    console.log("");
+  }
+  showError(message) {
+    console.log(chalk2.red(`  Error: ${message}`));
+  }
+};
+
+// packages/client/src/inspector-server.ts
+import http2 from "node:http";
+
+// packages/client/src/inspector-ui.ts
+function getInspectorHtml() {
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Tunelo Inspector</title>
+<style>
+:root{--bg:#0f172a;--bg2:#1e293b;--bg3:#334155;--fg:#e2e8f0;--fg2:#94a3b8;--accent:#38bdf8;--green:#4ade80;--yellow:#fbbf24;--red:#f87171;--border:#475569;font-family:system-ui,-apple-system,sans-serif}
+*{margin:0;padding:0;box-sizing:border-box}
+body{background:var(--bg);color:var(--fg);font-size:14px;height:100vh;display:flex;flex-direction:column}
+header{background:var(--bg2);padding:8px 16px;display:flex;align-items:center;gap:12px;border-bottom:1px solid var(--border)}
+header h1{font-size:16px;color:var(--accent);font-weight:600}
+header .stats{color:var(--fg2);font-size:12px;margin-left:auto}
+.filters{background:var(--bg2);padding:6px 16px;display:flex;gap:8px;border-bottom:1px solid var(--border)}
+.filters select,.filters input{background:var(--bg3);color:var(--fg);border:1px solid var(--border);padding:4px 8px;border-radius:4px;font-size:12px}
+.filters input{flex:1;max-width:250px}
+.filters button{background:var(--bg3);color:var(--fg2);border:1px solid var(--border);padding:4px 12px;border-radius:4px;cursor:pointer;font-size:12px}
+.filters button:hover{background:var(--border)}
+.main{flex:1;display:flex;overflow:hidden}
+.list{flex:1;overflow-y:auto;min-width:0}
+.detail{width:45%;border-left:1px solid var(--border);overflow-y:auto;display:none}
+.detail.open{display:block}
+table{width:100%;border-collapse:collapse}
+th{background:var(--bg2);position:sticky;top:0;text-align:left;padding:6px 10px;font-size:11px;color:var(--fg2);text-transform:uppercase;letter-spacing:.5px}
+tr.row{cursor:pointer;border-bottom:1px solid var(--bg2)}
+tr.row:hover{background:var(--bg2)}
+tr.row.active{background:var(--bg3)}
+tr.row.replay{opacity:.8;font-style:italic}
+td{padding:6px 10px;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;max-width:300px;font-size:13px}
+.method{font-weight:700;font-family:monospace}
+.s2xx{color:var(--green)}.s3xx{color:var(--accent)}.s4xx{color:var(--yellow)}.s5xx{color:var(--red)}
+.badge{font-size:10px;padding:1px 5px;border-radius:3px;background:var(--bg3);color:var(--fg2);margin-left:4px}
+.badge.replay{background:#7c3aed;color:#fff}
+.detail-header{padding:12px 16px;background:var(--bg2);border-bottom:1px solid var(--border);display:flex;justify-content:space-between;align-items:center}
+.detail-header h2{font-size:14px;font-weight:600}
+.tabs{display:flex;gap:0;border-bottom:1px solid var(--border)}
+.tabs button{background:none;border:none;color:var(--fg2);padding:8px 16px;cursor:pointer;font-size:12px;border-bottom:2px solid transparent}
+.tabs button.active{color:var(--accent);border-bottom-color:var(--accent)}
+.tab-content{padding:12px 16px;font-family:monospace;font-size:12px;white-space:pre-wrap;word-break:break-all;line-height:1.5}
+.empty{text-align:center;padding:60px 20px;color:var(--fg2)}
+.empty h2{font-size:18px;margin-bottom:8px;color:var(--fg)}
+.modal-overlay{display:none;position:fixed;top:0;left:0;right:0;bottom:0;background:rgba(0,0,0,.6);z-index:100;align-items:center;justify-content:center}
+.modal-overlay.open{display:flex}
+.modal{background:var(--bg2);border:1px solid var(--border);border-radius:8px;width:600px;max-height:80vh;display:flex;flex-direction:column}
+.modal h3{padding:12px 16px;border-bottom:1px solid var(--border);font-size:14px}
+.modal-body{padding:12px 16px;overflow-y:auto;flex:1;display:flex;flex-direction:column;gap:8px}
+.modal-body label{font-size:11px;color:var(--fg2);text-transform:uppercase}
+.modal-body input,.modal-body textarea,.modal-body select{background:var(--bg3);color:var(--fg);border:1px solid var(--border);padding:6px 8px;border-radius:4px;font-family:monospace;font-size:12px;width:100%}
+.modal-body textarea{min-height:120px;resize:vertical}
+.modal-footer{padding:12px 16px;border-top:1px solid var(--border);display:flex;gap:8px;justify-content:flex-end}
+.modal-footer button{padding:6px 16px;border-radius:4px;cursor:pointer;font-size:12px;border:none}
+.btn-primary{background:var(--accent);color:#000}.btn-secondary{background:var(--bg3);color:var(--fg)}
+@media(prefers-color-scheme:light){:root{--bg:#f8fafc;--bg2:#e2e8f0;--bg3:#cbd5e1;--fg:#0f172a;--fg2:#475569;--border:#94a3b8}}
+</style>
+</head>
+<body>
+<header>
+<h1>tunelo inspector</h1>
+<span class="stats" id="stats">0 requests</span>
+</header>
+<div class="filters">
+<select id="fSub"><option value="">All tunnels</option></select>
+<select id="fStatus"><option value="">All status</option><option value="2">2xx</option><option value="3">3xx</option><option value="4">4xx</option><option value="5">5xx</option></select>
+<input id="fSearch" type="text" placeholder="Search path...">
+<button id="btnClear">Clear</button>
+</div>
+<div class="main">
+<div class="list"><table><thead><tr><th>Method</th><th>Path</th><th>Status</th><th>Duration</th><th>Time</th><th>Subdomain</th></tr></thead><tbody id="tbody"></tbody></table>
+<div class="empty" id="empty"><h2>Waiting for requests...</h2><p>Send a request through your tunnel to see it here</p></div>
+</div>
+<div class="detail" id="detail">
+<div class="detail-header"><h2 id="dTitle">Request</h2><div style="display:flex;gap:6px"><button id="btnEditReplay" style="background:var(--bg3);color:var(--fg);border:1px solid var(--border);padding:4px 12px;border-radius:4px;cursor:pointer;font-size:12px">Edit & Replay</button><button id="btnReplay" style="background:var(--accent);color:#000;border:none;padding:4px 12px;border-radius:4px;cursor:pointer;font-size:12px">Replay</button></div></div>
+<div class="tabs"><button class="active" data-tab="req-headers">Req Headers</button><button data-tab="req-body">Req Body</button><button data-tab="res-headers">Res Headers</button><button data-tab="res-body">Res Body</button></div>
+<div class="tab-content" id="tabContent"></div>
+</div>
+</div>
+<div class="modal-overlay" id="editModal">
+<div class="modal">
+<h3>Edit & Replay</h3>
+<div class="modal-body">
+<label>Method</label><select id="mMethod"><option>GET</option><option>POST</option><option>PUT</option><option>PATCH</option><option>DELETE</option></select>
+<label>Path</label><input id="mPath" type="text">
+<label>Headers (JSON)</label><textarea id="mHeaders"></textarea>
+<label>Body</label><textarea id="mBody"></textarea>
+</div>
+<div class="modal-footer"><button class="btn-secondary" id="mCancel">Cancel</button><button class="btn-primary" id="mSend">Send</button></div>
+</div>
+</div>
+<script>
+const tbody=document.getElementById("tbody"),detail=document.getElementById("detail"),empty=document.getElementById("empty"),stats=document.getElementById("stats"),tabContent=document.getElementById("tabContent"),dTitle=document.getElementById("dTitle"),fSub=document.getElementById("fSub"),fStatus=document.getElementById("fStatus"),fSearch=document.getElementById("fSearch"),btnClear=document.getElementById("btnClear"),btnReplay=document.getElementById("btnReplay"),btnEditReplay=document.getElementById("btnEditReplay"),editModal=document.getElementById("editModal"),mMethod=document.getElementById("mMethod"),mPath=document.getElementById("mPath"),mHeaders=document.getElementById("mHeaders"),mBody=document.getElementById("mBody"),mCancel=document.getElementById("mCancel"),mSend=document.getElementById("mSend");
+let entries=[],selected=null,activeTab="req-headers",knownSubs=new Set();
+
+function statusClass(s){if(s<300)return"s2xx";if(s<400)return"s3xx";if(s<500)return"s4xx";return"s5xx"}
+function fmtTime(ts){return new Date(ts).toLocaleTimeString()}
+function tryJson(s){if(!s)return"(empty)";try{const b=atob(s);const j=JSON.parse(b);return JSON.stringify(j,null,2)}catch{try{return atob(s)}catch{return s}}}
+function fmtHeaders(h){if(!h)return"(none)";return Object.entries(h).map(([k,v])=>k+": "+(Array.isArray(v)?v.join(", "):v)).join("\\n")}
+
+function render(){
+const sub=fSub.value,st=fStatus.value,q=fSearch.value.toLowerCase();
+let filtered=entries;
+if(sub)filtered=filtered.filter(e=>e.subdomain===sub);
+if(st)filtered=filtered.filter(e=>String(e.status).startsWith(st));
+if(q)filtered=filtered.filter(e=>e.path.toLowerCase().includes(q)||e.method.toLowerCase().includes(q));
+tbody.innerHTML="";
+empty.style.display=filtered.length?"none":"block";
+stats.textContent=entries.length+" requests";
+for(const e of filtered){
+const tr=document.createElement("tr");tr.className="row"+(e.id===selected?" active":"")+(e.entryType==="replay"?" replay":"");
+tr.innerHTML='<td class="method">'+e.method+'</td><td>'+e.path+(e.entryType==="replay"?'<span class="badge replay">replay</span>':"")+'</td><td class="'+statusClass(e.status)+'">'+e.status+"</td><td>"+e.durationMs+"ms</td><td>"+fmtTime(e.timestamp)+"</td><td>"+(e.subdomain||"-")+"</td>";
+tr.onclick=()=>showDetail(e.id);tbody.appendChild(tr);
+}}
+
+function showDetail(id){
+selected=id;render();
+const e=entries.find(x=>x.id===id);if(!e){detail.classList.remove("open");return}
+detail.classList.add("open");
+dTitle.textContent=e.method+" "+e.path;
+fetch("/api/requests/"+id).then(r=>r.json()).then(full=>{
+window._detail=full;showTab(activeTab);
+}).catch(()=>{window._detail=e;showTab(activeTab)});
+}
+
+function showTab(tab){
+activeTab=tab;
+document.querySelectorAll(".tabs button").forEach(b=>b.classList.toggle("active",b.dataset.tab===tab));
+const d=window._detail||{};
+if(tab==="req-headers")tabContent.textContent=fmtHeaders(d.requestHeaders);
+else if(tab==="req-body")tabContent.textContent=tryJson(d.requestBody);
+else if(tab==="res-headers")tabContent.textContent=fmtHeaders(d.responseHeaders);
+else tabContent.textContent=tryJson(d.responseBody);
+}
+
+document.querySelector(".tabs").addEventListener("click",e=>{if(e.target.dataset.tab)showTab(e.target.dataset.tab)});
+fSub.onchange=fStatus.onchange=fSearch.oninput=render;
+btnClear.onclick=()=>fetch("/api/requests",{method:"DELETE"}).then(()=>{entries=[];selected=null;detail.classList.remove("open");render()});
+btnReplay.onclick=()=>{if(!selected)return;fetch("/api/requests/"+selected+"/replay",{method:"POST"}).catch(()=>{})};
+btnEditReplay.onclick=()=>{
+if(!selected||!window._detail)return;
+const d=window._detail;
+mMethod.value=d.method||"GET";mPath.value=d.path||"/";
+try{mHeaders.value=JSON.stringify(d.requestHeaders||{},null,2)}catch{mHeaders.value="{}"}
+try{mBody.value=d.requestBody?atob(d.requestBody):""}catch{mBody.value=d.requestBody||""}
+editModal.classList.add("open");
+};
+mCancel.onclick=()=>editModal.classList.remove("open");
+mSend.onclick=()=>{
+let headers;try{headers=JSON.parse(mHeaders.value)}catch{headers={}}
+const body=mBody.value?btoa(mBody.value):null;
+fetch("/api/replay",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({method:mMethod.value,path:mPath.value,headers,body})}).then(()=>editModal.classList.remove("open")).catch(()=>{});
+};
+
+// SSE real-time updates
+const sse=new EventSource("/api/events");
+sse.onmessage=e=>{
+const entry=JSON.parse(e.data);
+entries.unshift(entry);
+if(entry.subdomain&&!knownSubs.has(entry.subdomain)){knownSubs.add(entry.subdomain);const o=document.createElement("option");o.value=entry.subdomain;o.textContent=entry.subdomain;fSub.appendChild(o)}
+render();
+};
+
+// Load initial data
+fetch("/api/requests").then(r=>r.json()).then(data=>{entries=data;data.forEach(e=>{if(e.subdomain)knownSubs.add(e.subdomain)});knownSubs.forEach(s=>{const o=document.createElement("option");o.value=s;o.textContent=s;fSub.appendChild(o)});render()});
+</script>
+</body>
+</html>`;
+}
+
+// packages/client/src/listen-with-port-fallback.ts
+var DEFAULT_HOST = "127.0.0.1";
+var DEFAULT_MAX_ATTEMPTS = 20;
+var MAX_PORT = 65535;
+async function listenWithPortFallback(server, preferredPort, options = {}) {
+  const host = options.host ?? DEFAULT_HOST;
+  const maxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+  for (let attempt = 0; attempt < maxAttempts; attempt++) {
+    const candidate = preferredPort + attempt;
+    if (candidate > MAX_PORT) break;
+    if (await tryListen(server, candidate, host)) {
+      return {
+        port: resolveBoundPort(server, candidate),
+        fellBack: attempt > 0
+      };
+    }
+  }
+  if (await tryListen(server, 0, host)) {
+    return { port: resolveBoundPort(server, 0), fellBack: true };
+  }
+  throw new Error(
+    `No free port available near ${preferredPort} on ${host} (tried ${maxAttempts} ports + ephemeral)`
+  );
+}
+function tryListen(server, port, host) {
+  return new Promise((resolve, reject) => {
+    const onError = (err) => {
+      server.removeListener("listening", onListening);
+      if (err.code === "EADDRINUSE" || err.code === "EACCES") {
+        resolve(false);
+        return;
+      }
+      reject(err);
+    };
+    const onListening = () => {
+      server.removeListener("error", onError);
+      resolve(true);
+    };
+    server.once("error", onError);
+    server.once("listening", onListening);
+    server.listen(port, host);
+  });
+}
+function resolveBoundPort(server, requested) {
+  const address = server.address();
+  if (address && typeof address === "object") return address.port;
+  return requested;
+}
+
+// packages/client/src/inspector-server.ts
+function createRateLimiter(maxPerSec) {
+  let count = 0;
+  setInterval(() => {
+    count = 0;
+  }, 1e3);
+  return {
+    allow() {
+      if (count >= maxPerSec) return false;
+      count++;
+      return true;
+    }
+  };
+}
+async function startInspectorServer(options) {
+  const { port, store, onReplay, onReplayCustom, getTunnels } = options;
+  const sseClients = /* @__PURE__ */ new Set();
+  const replayLimiter = createRateLimiter(10);
+  store.onAdd((entry) => {
+    const data = `data: ${JSON.stringify(toSummary(entry))}
+
+`;
+    for (const client of sseClients) {
+      client.write(data);
+    }
+  });
+  const server = http2.createServer((req, res) => {
+    const url = new URL(req.url ?? "/", "http://localhost");
+    const pathname = url.pathname;
+    res.setHeader("Access-Control-Allow-Origin", "*");
+    res.setHeader("Access-Control-Allow-Methods", "GET,POST,DELETE,OPTIONS");
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type");
+    if (req.method === "OPTIONS") {
+      res.writeHead(204);
+      res.end();
+      return;
+    }
+    if (pathname === "/" && req.method === "GET") {
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+      res.end(getInspectorHtml());
+      return;
+    }
+    if (pathname === "/api/tunnels" && req.method === "GET") {
+      const tunnels = getTunnels?.() ?? [];
+      sendJson(res, 200, tunnels);
+      return;
+    }
+    if (pathname === "/api/requests" && req.method === "GET") {
+      const filter = {
+        subdomain: url.searchParams.get("subdomain") ?? void 0,
+        status: url.searchParams.get("status") ?? void 0,
+        q: url.searchParams.get("q") ?? void 0
+      };
+      sendJson(res, 200, store.list(filter));
+      return;
+    }
+    if (pathname === "/api/requests" && req.method === "DELETE") {
+      store.clear();
+      sendJson(res, 200, { ok: true });
+      return;
+    }
+    if (pathname === "/api/events" && req.method === "GET") {
+      res.writeHead(200, {
+        "content-type": "text/event-stream",
+        "cache-control": "no-cache",
+        connection: "keep-alive"
+      });
+      res.write(":ok\n\n");
+      sseClients.add(res);
+      req.on("close", () => sseClients.delete(res));
+      return;
+    }
+    const detailMatch = pathname.match(/^\/api\/requests\/([^/]+)$/);
+    if (detailMatch && req.method === "GET") {
+      const entry = store.get(detailMatch[1]);
+      if (!entry) {
+        sendJson(res, 404, { error: "Not found" });
+        return;
+      }
+      sendJson(res, 200, entry);
+      return;
+    }
+    const replayMatch = pathname.match(/^\/api\/requests\/([^/]+)\/replay$/);
+    if (replayMatch && req.method === "POST") {
+      if (!replayLimiter.allow()) {
+        sendJson(res, 429, {
+          error: "Replay rate limit exceeded (max 10/sec)"
+        });
+        return;
+      }
+      if (!onReplay) {
+        sendJson(res, 501, { error: "Replay not available" });
+        return;
+      }
+      onReplay(replayMatch[1]).then((entry) => {
+        if (!entry) {
+          sendJson(res, 404, { error: "Original request not found" });
+          return;
+        }
+        sendJson(res, 200, toSummary(entry));
+      }).catch((err) => {
+        sendJson(res, 500, { error: err.message });
+      });
+      return;
+    }
+    if (pathname === "/api/replay" && req.method === "POST") {
+      if (!replayLimiter.allow()) {
+        sendJson(res, 429, {
+          error: "Replay rate limit exceeded (max 10/sec)"
+        });
+        return;
+      }
+      if (!onReplayCustom) {
+        sendJson(res, 501, { error: "Custom replay not available" });
+        return;
+      }
+      collectBody(req, (body) => {
+        try {
+          const data = JSON.parse(body);
+          onReplayCustom(data).then((entry) => {
+            if (!entry) {
+              sendJson(res, 500, { error: "Replay failed" });
+              return;
+            }
+            sendJson(res, 200, toSummary(entry));
+          }).catch((err) => {
+            sendJson(res, 500, { error: err.message });
+          });
+        } catch {
+          sendJson(res, 400, { error: "Invalid JSON" });
+        }
+      });
+      return;
+    }
+    res.writeHead(404, { "content-type": "text/plain" });
+    res.end("Not Found");
+  });
+  const { port: boundPort, fellBack } = await listenWithPortFallback(
+    server,
+    port
+  );
+  return { server, port: boundPort, fellBack };
+}
+function sendJson(res, status, data) {
+  res.writeHead(status, { "content-type": "application/json" });
+  res.end(JSON.stringify(data));
+}
+var MAX_REPLAY_BODY = 1024 * 1024;
+function collectBody(req, cb, onError) {
+  const chunks = [];
+  let size = 0;
+  req.on("data", (chunk) => {
+    size += chunk.length;
+    if (size > MAX_REPLAY_BODY) {
+      req.destroy();
+      onError?.("Request body too large");
+      return;
+    }
+    chunks.push(chunk);
+  });
+  req.on("end", () => cb(Buffer.concat(chunks).toString("utf-8")));
+}
+function toSummary(entry) {
+  const {
+    requestBody,
+    responseBody,
+    requestHeaders,
+    responseHeaders,
+    ...summary
+  } = entry;
+  return summary;
+}
+
+// packages/client/src/local-proxy.ts
+import http3 from "node:http";
+var HOP_HEADERS = /* @__PURE__ */ new Set([
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailers",
+  "transfer-encoding",
+  "upgrade"
+]);
+function filterHeaders(headers) {
+  const filtered = {};
+  for (const [key, value] of Object.entries(headers)) {
+    if (!HOP_HEADERS.has(key.toLowerCase())) {
+      filtered[key] = value;
+    }
+  }
+  return filtered;
+}
+function proxyRequest(request2, localPort, localHost = "localhost") {
+  return new Promise((resolve) => {
+    const body = request2.body ? Buffer.from(request2.body, "base64") : null;
+    const headers = filterHeaders(request2.headers);
+    const proxyReq = http3.request(
+      {
+        hostname: localHost,
+        port: localPort,
+        path: request2.path,
+        method: request2.method,
+        headers
+      },
+      (proxyRes) => {
+        const chunks = [];
+        let bodySize = 0;
+        proxyRes.on("data", (chunk) => {
+          bodySize += chunk.length;
+          if (bodySize > DEFAULTS.MAX_BODY_SIZE) {
+            proxyReq.destroy();
+            resolve({
+              type: "response",
+              id: request2.id,
+              status: 502,
+              headers: { "content-type": "text/plain" },
+              body: Buffer.from("Response body too large").toString("base64")
+            });
+            return;
+          }
+          chunks.push(chunk);
+        });
+        proxyRes.on("end", () => {
+          const responseBody = chunks.length > 0 ? Buffer.concat(chunks).toString("base64") : null;
+          resolve({
+            type: "response",
+            id: request2.id,
+            status: proxyRes.statusCode ?? 502,
+            headers: proxyRes.headers,
+            body: responseBody
+          });
+        });
+      }
+    );
+    proxyReq.on("error", (err) => {
+      const isRefused = err.code === "ECONNREFUSED";
+      resolve({
+        type: "response",
+        id: request2.id,
+        status: isRefused ? 502 : 502,
+        headers: { "content-type": "text/plain" },
+        body: Buffer.from(
+          isRefused ? "Local service unavailable" : err.message
+        ).toString("base64")
+      });
+    });
+    proxyReq.setTimeout(3e4, () => {
+      proxyReq.destroy();
+      resolve({
+        type: "response",
+        id: request2.id,
+        status: 504,
+        headers: { "content-type": "text/plain" },
+        body: Buffer.from("Local service timeout").toString("base64")
+      });
+    });
+    if (body) proxyReq.write(body);
+    proxyReq.end();
+  });
+}
+
+// packages/client/src/request-store.ts
+var DEFAULT_MAX_SIZE = 500;
+var MAX_BODY_BYTES = 1024 * 1024;
+var RequestStore = class {
+  entries = [];
+  maxSize;
+  listeners = [];
+  constructor(maxSize = DEFAULT_MAX_SIZE) {
+    this.maxSize = maxSize;
+  }
+  add(entry) {
+    if (entry.requestBody && Buffer.byteLength(entry.requestBody, "utf-8") > MAX_BODY_BYTES) {
+      entry.requestBody = entry.requestBody.slice(0, MAX_BODY_BYTES);
+    }
+    if (entry.responseBody && Buffer.byteLength(entry.responseBody, "utf-8") > MAX_BODY_BYTES) {
+      entry.responseBody = entry.responseBody.slice(0, MAX_BODY_BYTES);
+    }
+    this.entries.push(entry);
+    if (this.entries.length > this.maxSize) {
+      this.entries.shift();
+    }
+    for (const listener of this.listeners) {
+      listener(entry);
+    }
+  }
+  list(filter) {
+    let result = this.entries;
+    if (filter?.subdomain) {
+      result = result.filter((e) => e.subdomain === filter.subdomain);
+    }
+    if (filter?.status) {
+      const statusPrefix = filter.status.replace(/x/gi, "");
+      result = result.filter((e) => String(e.status).startsWith(statusPrefix));
+    }
+    if (filter?.q) {
+      const q = filter.q.toLowerCase();
+      result = result.filter(
+        (e) => e.path.toLowerCase().includes(q) || e.method.toLowerCase().includes(q)
+      );
+    }
+    return result.map(
+      ({
+        requestBody,
+        responseBody,
+        requestHeaders,
+        responseHeaders,
+        ...summary
+      }) => summary
+    ).reverse();
+  }
+  get(id) {
+    return this.entries.find((e) => e.id === id);
+  }
+  clear() {
+    this.entries = [];
+  }
+  onAdd(callback) {
+    this.listeners.push(callback);
+  }
+  removeListener(callback) {
+    this.listeners = this.listeners.filter((l) => l !== callback);
+  }
+  get size() {
+    return this.entries.length;
+  }
+  getSubdomains() {
+    const set = /* @__PURE__ */ new Set();
+    for (const entry of this.entries) {
+      if (entry.subdomain) set.add(entry.subdomain);
+    }
+    return [...set];
+  }
+};
+
+// packages/client/src/inspector-integration.ts
+function createInspectorIntegration(options) {
+  const { inspectPort, subdomainPortMap, defaultPort } = options;
+  const store = new RequestStore();
+  async function start() {
+    const handle = await startInspectorServer({
+      port: inspectPort,
+      store,
+      onReplay: async (id) => {
+        const original = store.get(id);
+        if (!original) return null;
+        const port = original.subdomain ? subdomainPortMap.get(original.subdomain) ?? defaultPort : defaultPort;
+        const start2 = Date.now();
+        const response = await proxyRequest(
+          {
+            type: "request",
+            id: `replay_${Date.now().toString(36)}`,
+            method: original.method,
+            path: original.path,
+            headers: original.requestHeaders,
+            body: original.requestBody
+          },
+          port
+        );
+        const entry = {
+          id: `replay_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 6)}`,
+          timestamp: start2,
+          subdomain: original.subdomain,
+          method: original.method,
+          path: original.path,
+          requestHeaders: original.requestHeaders,
+          requestBody: original.requestBody,
+          status: response.status,
+          responseHeaders: response.headers,
+          responseBody: response.body,
+          durationMs: Date.now() - start2,
+          entryType: "replay",
+          originalId: id
+        };
+        store.add(entry);
+        return entry;
+      },
+      onReplayCustom: async (req) => {
+        const start2 = Date.now();
+        const response = await proxyRequest(
+          {
+            type: "request",
+            id: `custom_${Date.now().toString(36)}`,
+            method: req.method,
+            path: req.path,
+            headers: req.headers,
+            body: req.body
+          },
+          defaultPort
+        );
+        const entry = {
+          id: `custom_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 6)}`,
+          timestamp: start2,
+          method: req.method,
+          path: req.path,
+          requestHeaders: req.headers,
+          requestBody: req.body,
+          status: response.status,
+          responseHeaders: response.headers,
+          responseBody: response.body,
+          durationMs: Date.now() - start2,
+          entryType: "replay"
+        };
+        store.add(entry);
+        return entry;
+      },
+      getTunnels: () => [...subdomainPortMap.entries()].map(([subdomain, localPort]) => ({
+        subdomain,
+        localPort,
+        url: `https://${subdomain}.tunnel.inetdev.io.vn`
+      }))
+    });
+    return handle.port;
+  }
+  return { store, start };
+}
+
+// packages/client/src/portal-server.ts
+import fs from "node:fs";
+import http4 from "node:http";
+import path2 from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+var __dirname = path2.dirname(fileURLToPath2(import.meta.url));
+var MIME_TYPES = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "application/javascript",
+  ".css": "text/css",
+  ".json": "application/json",
+  ".png": "image/png",
+  ".svg": "image/svg+xml",
+  ".ico": "image/x-icon",
+  ".woff2": "font/woff2",
+  ".woff": "font/woff"
+};
+var activeServer = null;
+function resolveDistDir() {
+  return path2.resolve(__dirname, "..", "portal-dist");
+}
+function serveFile(res, filePath, fallbackPath) {
+  const ext = path2.extname(filePath);
+  const contentType = MIME_TYPES[ext] ?? "application/octet-stream";
+  fs.readFile(filePath, (err, data) => {
+    if (err) {
+      fs.readFile(fallbackPath, (fallbackErr, fallbackData) => {
+        if (fallbackErr) {
+          res.writeHead(404, { "content-type": "text/plain" });
+          res.end("Portal not built. Run: pnpm build:portal");
+          return;
+        }
+        res.writeHead(200, {
+          "content-type": "text/html; charset=utf-8"
+        });
+        res.end(fallbackData);
+      });
+      return;
+    }
+    res.writeHead(200, { "content-type": contentType });
+    res.end(data);
+  });
+}
+async function startPortalServer(port) {
+  const distDir = resolveDistDir();
+  const indexPath = path2.join(distDir, "index.html");
+  const server = http4.createServer((req, res) => {
+    const rawPath = new URL(req.url ?? "/", "http://localhost").pathname;
+    const safePath = path2.normalize(rawPath).replace(/^(\.\.[/\\])+/, "");
+    const filePath = path2.join(distDir, safePath);
+    if (!filePath.startsWith(distDir)) {
+      res.writeHead(403, { "content-type": "text/plain" });
+      res.end("Forbidden");
+      return;
+    }
+    const targetPath = safePath === "/" || safePath.endsWith("/") ? indexPath : filePath;
+    serveFile(res, targetPath, indexPath);
+  });
+  const { port: boundPort } = await listenWithPortFallback(server, port);
+  activeServer = server;
+  return boundPort;
+}
+function stopPortalServer() {
+  return new Promise((resolve) => {
+    if (!activeServer) {
+      resolve();
+      return;
+    }
+    activeServer.close(() => {
+      activeServer = null;
+      resolve();
+    });
+  });
+}
+
+// packages/client/src/tunnel-config-parser.ts
+function parseTunnelArg(arg) {
+  const parts = arg.split(":");
+  if (parts.length === 1) {
+    const port = validatePort(parts[0]);
+    return { port };
+  }
+  if (parts.length === 2) {
+    const port = validatePort(parts[0]);
+    const subdomain = parts[1];
+    if (!SUBDOMAIN_REGEX.test(subdomain)) {
+      throw new Error(`Invalid subdomain format: "${subdomain}"`);
+    }
+    return { port, subdomain };
+  }
+  throw new Error(
+    `Invalid tunnel format: "${arg}". Use <port> or <port>:<subdomain>`
+  );
+}
+function parseTunnelArgs(args) {
+  if (args.length === 0) throw new Error("At least one port is required");
+  return args.map(parseTunnelArg);
+}
+function validatePort(portStr) {
+  const port = Number(portStr);
+  if (Number.isNaN(port) || port < 1 || port > 65535) {
+    throw new Error(`Invalid port: "${portStr}" (must be 1-65535)`);
+  }
+  return port;
+}
+
+// packages/client/src/cli.ts
+var display = new Display();
+program.name("tunelo").version(VERSION).description("Expose local services to the internet");
+program.command("http <ports...>").description("Create HTTP tunnel(s). Format: <port> or <port>:<subdomain>").option(
+  "-s, --subdomain <name>",
+  "Request specific subdomain (single tunnel only)"
+).option("-k, --key <apikey>", "API key for authentication").option("--server <url>", "Tunnel server URL").option("-a, --auth <user:pass>", "Protect tunnel(s) with Basic Auth").option(
+  "--inspect-port <port>",
+  "Inspector UI port; next free port is used if taken (default: 4040)",
+  "4040"
+).option("--no-inspect", "Disable request inspector").option(
+  "--portal-port <port>",
+  "Portal server port; next free port is used if taken (default: 4041)",
+  "4041"
+).option("--no-portal", "Disable the portal server").option("-q, --quiet", "Suppress request logging").option("-v, --verbose", "Show extra details (body size)").action(
+  async (portArgs, options) => {
+    let tunnels;
+    try {
+      tunnels = parseTunnelArgs(portArgs);
+    } catch (err) {
+      display.showError(err.message);
+      process.exit(1);
+    }
+    const config = loadConfig();
+    const apiKey = options.key ?? process.env.TUNELO_KEY ?? config.key;
+    const serverUrl = options.server ?? process.env.TUNELO_SERVER ?? config.server ?? "wss://tunnel.inetdev.io.vn";
+    if (!apiKey) {
+      display.showError(
+        "API key required. Use --key, TUNELO_KEY env, or `tunelo config --key <key>`"
+      );
+      process.exit(1);
+    }
+    if (options.quiet) display.setLogLevel("quiet");
+    else if (options.verbose) display.setLogLevel("verbose");
+    display.showBanner(VERSION);
+    display.showConnecting(serverUrl);
+    const primary = tunnels[0];
+    const additional = tunnels.slice(1);
+    const subdomainPortMap = /* @__PURE__ */ new Map();
+    const inspectPort = Number(options.inspectPort) || 4040;
+    const inspector = options.inspect !== false ? createInspectorIntegration({
+      inspectPort,
+      subdomainPortMap,
+      defaultPort: primary.port
+    }) : null;
+    const client = new TunnelClient({
+      serverUrl,
+      apiKey,
+      subdomain: options.subdomain ?? primary.subdomain,
+      localPort: primary.port,
+      auth: options.auth,
+      additionalTunnels: additional
+    });
+    const run = startRunRecord("http", serverUrl);
+    const runTunnels = [];
+    const portalPort = Number(options.portalPort) || 4041;
+    const portalEnabled = options.portal !== false;
+    client.on("connected", (result) => {
+      subdomainPortMap.set(result.subdomain, primary.port);
+      runTunnels.push({ url: result.url, localPort: primary.port });
+      run.update(runTunnels);
+      display.showConnected(
+        result.url,
+        `http://localhost:${primary.port}`,
+        apiKey,
+        options.auth !== void 0
+      );
+      if (inspector) {
+        inspector.start().then((boundPort) => {
+          display.showInspector(boundPort, inspectPort);
+        }).catch((err) => {
+          display.showError(`Inspector failed to start: ${err.message}`);
+        });
+      }
+      if (portalEnabled) {
+        startPortalServer(portalPort).then((boundPort) => {
+          display.showPortal(boundPort, portalPort);
+        }).catch((err) => {
+          display.showError(
+            `Portal server failed to start: ${err.message}`
+          );
+        });
+      }
+    });
+    client.on("tunnel-registered", (result) => {
+      subdomainPortMap.set(result.subdomain, result.localPort);
+      runTunnels.push({ url: result.url, localPort: result.localPort });
+      run.update(runTunnels);
+      display.showTunnelRegistered(
+        result.subdomain,
+        result.url,
+        result.localPort
+      );
+    });
+    client.on("tunnel-register-error", (result) => {
+      display.showError(`Tunnel ${result.subdomain}: ${result.error}`);
+    });
+    if (inspector) {
+      client.on("inspector-entry", (entry) => {
+        inspector.store.add(entry);
+      });
+    }
+    client.on("disconnected", () => display.showDisconnected());
+    client.on("reconnecting", (info) => {
+      display.showReconnecting(info.attempt, info.delay);
+    });
+    client.on(
+      "request",
+      (info) => {
+        display.logRequest(
+          info.method,
+          info.path,
+          info.status,
+          info.durationMs,
+          void 0,
+          info.subdomain
+        );
+      }
+    );
+    client.on("error", (err) => display.showError(err.message));
+    try {
+      await client.connect();
+    } catch (err) {
+      display.showError(err.message);
+      process.exit(1);
+    }
+    process.on("SIGINT", () => {
+      client.disconnect();
+      if (portalEnabled) void stopPortalServer();
+      display.showStats();
+      process.exit(0);
+    });
+  }
+);
+registerTcpCommand(program, display);
+registerLoginCommands(program);
+registerStatusCommands(program);
+registerUpdateCommand(program);
+program.command("config").description("Set default configuration").option("-k, --key <apikey>", "Set default API key").option("-s, --server <url>", "Set default server URL").option("--show", "Show current config").action((options) => {
+  if (options.show) {
+    const config2 = loadConfig();
+    console.log(`Config path: ${getConfigPath()}`);
+    console.log(JSON.stringify(config2, null, 2));
+    return;
+  }
+  const config = loadConfig();
+  if (options.key) config.key = options.key;
+  if (options.server) config.server = options.server;
+  saveConfig(config);
+  console.log("Config saved.");
+});
+program.parse();
+//# sourceMappingURL=cli.js.map