@jeffusion/bungee 5.4.5 → 5.5.0

package/dist/index.js

@@ -2145,6 +2145,10 @@ var {
   Help: Help2
 } = exports_commander;
 
+// src/commands/recover.ts
+import { resolve as resolve4, join as join7 } from "node:path";
+import { spawn as spawn3 } from "node:child_process";
+
 // src/config/paths.ts
 import path from "path";
 import os from "os";
@@ -2171,16 +2175,6 @@ class ConfigPaths {
   }
 }
 
-// src/commands/init.ts
-async function initCommand() {
-  ConfigPaths.ensureDataDir();
-  ConfigPaths.ensureLogsDir();
-  console.log(`Bungee data directory initialized at: ${ConfigPaths.DATA_DIR}`);
-  console.log(`Configuration database: ${ConfigPaths.DATA_DIR}/bungee.db`);
-  console.log(`Telemetry database: ${ConfigPaths.LOGS_DIR}/access.db`);
-  console.log("Start Bungee with: bungee start");
-}
-
 // src/daemon/manager.ts
 import fs2 from "node:fs";
 import { readFile as readFile3 } from "node:fs/promises";
@@ -3195,7 +3189,7 @@ function aclEnvironment(path, sid, kind) {
 function defaultWindowsAclAdapter(deadlineMs = WINDOWS_ACL_DEADLINE_MS) {
   const phase = (value) => `[Console]::Error.WriteLine('${WINDOWS_ACL_PHASE_PREFIX}${value}');`;
   const moduleBootstrap = '$env:PSModulePath=[System.IO.Path]::Combine($PSHOME,"Modules");' + "Import-Module Microsoft.PowerShell.Security -ErrorAction Stop;";
-  const readScript = phase("started") + moduleBootstrap + phase("before_get_acl") + "$item=Get-Item -LiteralPath $env:BUNGEE_DAEMON_ACL_PATH -Force;" + "$a=if($item -is [System.IO.DirectoryInfo]){[System.IO.FileSystemAclExtensions]::GetAccessControl([System.IO.DirectoryInfo]$item,[System.Security.AccessControl.AccessControlSections]::Access)}" + "elseif($item -is [System.IO.FileInfo]){[System.IO.FileSystemAclExtensions]::GetAccessControl([System.IO.FileInfo]$item,[System.Security.AccessControl.AccessControlSections]::Access)}" + 'else{throw "Windows ACL target is not a file or directory"};' + phase("after_get_acl") + "$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value;" + "$e=@($a.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier])|ForEach-Object { @{sid=$_.IdentityReference.Value;" + 'access=$(if([int]$_.AccessControlType -eq 0){"allow"}else{"deny"});rights=[int]$_.FileSystemRights;' + "inheritance=[int]$_.InheritanceFlags;propagation=[int]$_.PropagationFlags;inherited=[bool]$_.IsInherited} });" + "[Console]::Out.Write((ConvertTo-Json -Compress -Depth 4 @{currentSid=$sid;entries=$e}))";
+  const readScript = phase("started") + moduleBootstrap + phase("before_get_acl") + "$item=Get-Item -LiteralPath $env:BUNGEE_DAEMON_ACL_PATH -Force;" + "$a=if($item -is [System.IO.DirectoryInfo]){[System.IO.FileSystemAclExtensions]::GetAccessControl([System.IO.DirectoryInfo]$item,([System.Security.AccessControl.AccessControlSections]::Access -bor [System.Security.AccessControl.AccessControlSections]::Owner))}" + "elseif($item -is [System.IO.FileInfo]){[System.IO.FileSystemAclExtensions]::GetAccessControl([System.IO.FileInfo]$item,([System.Security.AccessControl.AccessControlSections]::Access -bor [System.Security.AccessControl.AccessControlSections]::Owner))}" + 'else{throw "Windows ACL target is not a file or directory"};' + phase("after_get_acl") + "$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value;" + "$e=@($a.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier])|ForEach-Object { @{sid=$_.IdentityReference.Value;" + 'access=$(if([int]$_.AccessControlType -eq 0){"allow"}else{"deny"});rights=[int]$_.FileSystemRights;' + "inheritance=[int]$_.InheritanceFlags;propagation=[int]$_.PropagationFlags;inherited=[bool]$_.IsInherited} });" + "[Console]::Out.Write((ConvertTo-Json -Compress -Depth 4 @{currentSid=$sid;ownerSid=$a.GetOwner([System.Security.Principal.SecurityIdentifier]).Value;entries=$e}))";
   const setScript = phase("started") + moduleBootstrap + "$p=$env:BUNGEE_DAEMON_ACL_PATH;$u=$env:BUNGEE_DAEMON_ACL_SID;" + '$k=$env:BUNGEE_DAEMON_ACL_KIND;$a=if($k -eq "directory"){[System.Security.AccessControl.DirectorySecurity]::new()}else{[System.Security.AccessControl.FileSecurity]::new()};' + '$a.SetAccessRuleProtection($true,$false);$i=if($k -eq "directory"){[System.Security.AccessControl.InheritanceFlags]::ObjectInherit -bor [System.Security.AccessControl.InheritanceFlags]::ContainerInherit}else{[System.Security.AccessControl.InheritanceFlags]::None};' + '@($u,"S-1-5-18","S-1-5-32-544")|ForEach-Object {$a.AddAccessRule([System.Security.AccessControl.FileSystemAccessRule]::new([System.Security.Principal.SecurityIdentifier]::new($_),[System.Security.AccessControl.FileSystemRights]::FullControl,$i,[System.Security.AccessControl.PropagationFlags]::None,[System.Security.AccessControl.AccessControlType]::Allow))};' + phase("before_set_acl") + 'if($k -eq "directory"){[System.IO.FileSystemAclExtensions]::SetAccessControl([System.IO.DirectoryInfo]::new($p),$a)}else{[System.IO.FileSystemAclExtensions]::SetAccessControl([System.IO.FileInfo]::new($p),$a)};' + phase("after_set_acl");
   const readBlock = phase("before_get_acl") + "$item=Get-Item -LiteralPath $p -Force;" + "$a=if($item -is [System.IO.DirectoryInfo]){[System.IO.FileSystemAclExtensions]::GetAccessControl([System.IO.DirectoryInfo]$item,[System.Security.AccessControl.AccessControlSections]::Access)}" + "elseif($item -is [System.IO.FileInfo]){[System.IO.FileSystemAclExtensions]::GetAccessControl([System.IO.FileInfo]$item,[System.Security.AccessControl.AccessControlSections]::Access)}" + 'else{throw "Windows ACL target is not a file or directory"};' + "$sid=[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value;" + "$e=@($a.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier])|ForEach-Object { @{sid=$_.IdentityReference.Value;" + 'access=$(if([int]$_.AccessControlType -eq 0){"allow"}else{"deny"});rights=[int]$_.FileSystemRights;' + "inheritance=[int]$_.InheritanceFlags;propagation=[int]$_.PropagationFlags;inherited=[bool]$_.IsInherited} });" + phase("after_get_acl") + "@{currentSid=$sid;entries=$e}";
   const ensureScript = "$ErrorActionPreference='Stop';" + phase("started") + moduleBootstrap + "$p=$env:BUNGEE_DAEMON_ACL_PATH;$k=$env:BUNGEE_DAEMON_ACL_KIND;" + "$readAcl={ " + readBlock + " };$before=&$readAcl;$sid=$before.currentSid;" + `$parts=$sid -split "-";$validSid=($sid -cmatch '^S-[0-9]+(?:-[0-9]+)+$') -and (@($parts|Select-Object -Skip 1|Where-Object { $_.Length -gt 1 -and $_.StartsWith("0") }).Count -eq 0);` + '$allowed=@($sid,"S-1-5-18","S-1-5-32-544");$inheritance=if($k -eq "directory"){3}else{0};$missing=@{};$repair=$false;' + "if($validSid){foreach($name in $allowed){$missing[$name]=$true};foreach($r in @($before.entries)){" + "if($allowed -notcontains $r.sid){$repair=$true;continue};$missing.Remove($r.sid);" + 'if($r.access -ne "allow" -or [int]$r.rights -ne 2032127 -or [int]$r.inheritance -ne $inheritance -or [int]$r.propagation -ne 0 -or [bool]$r.inherited){$repair=$true}};' + "if($missing.Count -ne 0){$repair=$true}};" + 'if($repair){$a=if($k -eq "directory"){[System.Security.AccessControl.DirectorySecurity]::new()}else{[System.Security.AccessControl.FileSecurity]::new()};' + '$a.SetAccessRuleProtection($true,$false);$i=if($k -eq "directory"){[System.Security.AccessControl.InheritanceFlags]::ObjectInherit -bor [System.Security.AccessControl.InheritanceFlags]::ContainerInherit}else{[System.Security.AccessControl.InheritanceFlags]::None};' + '@($sid,"S-1-5-18","S-1-5-32-544")|ForEach-Object {$a.AddAccessRule([System.Security.AccessControl.FileSystemAccessRule]::new([System.Security.Principal.SecurityIdentifier]::new($_),[System.Security.AccessControl.FileSystemRights]::FullControl,$i,[System.Security.AccessControl.PropagationFlags]::None,[System.Security.AccessControl.AccessControlType]::Allow))};' + phase("before_set_acl") + 'if($k -eq "directory"){[System.IO.FileSystemAclExtensions]::SetAccessControl([System.IO.DirectoryInfo]::new($p),$a)}else{[System.IO.FileSystemAclExtensions]::SetAccessControl([System.IO.FileInfo]::new($p),$a)};' + phase("after_set_acl") + "};" + "$after=&$readAcl;[Console]::Out.Write((ConvertTo-Json -Compress -Depth 6 @{before=$before;after=$after;repaired=$repair}))";
@@ -3255,6 +3249,14 @@ function defaultWindowsAclAdapter(deadlineMs = WINDOWS_ACL_DEADLINE_MS) {
     }
   };
 }
+async function assertWindowsOwnerOnlyFileAcl(path, adapter = defaultWindowsAclAdapter()) {
+  const snapshot = await adapter.read(path);
+  if (!canonicalSid(snapshot.ownerSid) || snapshot.ownerSid !== snapshot.currentSid)
+    fail2("acl", "Recovery input must be owned by the current user");
+  const validation = windowsAclSecure(snapshot, "file");
+  if (validation !== null)
+    throw new WindowsAclValidationError(validation);
+}
 async function fsyncDirectory(root, platform, options) {
   const unsupported = platform === "win32" ? WINDOWS_UNSUPPORTED_FSYNC : POSIX_UNSUPPORTED_FSYNC;
   let handle;
@@ -3395,7 +3397,7 @@ import { createInterface } from "node:readline";
 // package.json
 var package_default = {
   name: "@jeffusion/bungee",
-  version: "5.4.5",
+  version: "5.5.0",
   description: "High-performance reverse proxy server CLI",
   type: "module",
   bin: {
@@ -3677,7 +3679,7 @@ class BinaryManager {
 }
 
 // src/daemon/runtime.ts
-import { isAbsolute as isAbsolute2, join as join4 } from "node:path";
+import { isAbsolute as isAbsolute2, join as join4, resolve as resolve2 } from "node:path";
 function createDaemonRuntime(options) {
   if (!isAbsolute2(options.dataDirectory))
     throw new Error("Daemon data directory must be absolute");
@@ -3694,7 +3696,7 @@ function createDaemonRuntime(options) {
     cwd: options.dataDirectory,
     env: {
       ...inheritedEnvironment,
-      BUNGEE_CONFIG_DB_PATH: join4(options.dataDirectory, "bungee.db"),
+      BUNGEE_CONFIG_DB_PATH: options.inheritedEnvironment?.BUNGEE_CONFIG_DB_PATH ? resolve2(options.inheritedEnvironment.BUNGEE_CONFIG_DB_PATH) : join4(options.dataDirectory, "bungee.db"),
       BUNGEE_ACCESS_DB_PATH: join4(options.logsDirectory, "access.db"),
       WORKER_COUNT: options.workers ?? "2",
       DAEMON_MODE: "true",
@@ -3706,7 +3708,7 @@ function createDaemonRuntime(options) {
 // src/daemon/pid-mirror.ts
 import { constants as fsConstants2 } from "node:fs";
 import { lstat as lstat2, open as open2, rename as rename2, unlink as unlink2 } from "node:fs/promises";
-import { dirname, isAbsolute as isAbsolute3, parse as parse2, resolve as resolve2 } from "node:path";
+import { dirname, isAbsolute as isAbsolute3, parse as parse2, resolve as resolve3 } from "node:path";
 import { randomBytes } from "node:crypto";
 var MAX_PID_BYTES = 64;
 var UNSUPPORTED_DIR_FSYNC = new Set(["EINVAL", "ENOTSUP", "EOPNOTSUPP", "ENOSYS", "EPERM", "EISDIR"]);
@@ -3720,11 +3722,11 @@ function regular(stat) {
   return stat.isFile() && stat.nlink === 1;
 }
 async function rejectSymlinkComponents2(path) {
-  const absolute = resolve2(path);
+  const absolute = resolve3(path);
   const root = parse2(absolute).root;
   let current = root;
   for (const part of absolute.slice(root.length).split(/[\\/]+/).filter(Boolean)) {
-    current = resolve2(current, part);
+    current = resolve3(current, part);
     try {
       if ((await lstat2(current)).isSymbolicLink())
         throw new Error("PID mirror path contains a symlink");
@@ -3807,7 +3809,7 @@ async function deleteLegacyPidFile(path, expected) {
 async function writeLegacyPidMirror(path, pid, options = {}) {
   if (!Number.isSafeInteger(pid) || pid <= 0 || !isAbsolute3(path) || path.includes("\x00"))
     throw new Error("invalid PID mirror target");
-  const target = resolve2(path);
+  const target = resolve3(path);
   const directory = dirname(target);
   await rejectSymlinkComponents2(directory);
   const temporary = `${target}.${process.pid}.${randomBytes(16).toString("hex")}.tmp`;
@@ -4990,6 +4992,17 @@ function canonicalLaunchDescriptor(descriptor) {
     throw new Error(`Daemon entrypoint cannot be canonicalized: ${errorText(error)}`);
   }
 }
+async function resolveCoreLaunchDescriptor(options = {}) {
+  const direct = options.directLaunch ?? options.launchDescriptor;
+  if (direct !== undefined)
+    return canonicalLaunchDescriptor(direct);
+  const binaryPath = await BinaryManager.ensureBinary({ autoUpgrade: options.autoUpgrade });
+  try {
+    return { executable: realpathSync2.native(binaryPath), entrypoint: null };
+  } catch (error) {
+    throw new Error(`Daemon executable cannot be canonicalized: ${errorText(error)}`);
+  }
+}
 
 class DaemonManager {
   spawnDaemon;
@@ -5171,18 +5184,7 @@ class DaemonManager {
     }, this.fileOptions());
   }
   async launchDescriptor(options) {
-    if (options.directLaunch !== undefined)
-      return canonicalLaunchDescriptor(options.directLaunch);
-    if (options.launchDescriptor !== undefined)
-      return canonicalLaunchDescriptor(options.launchDescriptor);
-    if (this.injectedLaunch !== undefined)
-      return canonicalLaunchDescriptor(this.injectedLaunch);
-    const binaryPath = await BinaryManager.ensureBinary({ autoUpgrade: options.autoUpgrade });
-    try {
-      return { executable: realpathSync2.native(binaryPath), entrypoint: null };
-    } catch (error) {
-      throw new Error(`Daemon executable cannot be canonicalized: ${errorText(error)}`);
-    }
+    return resolveCoreLaunchDescriptor({ ...options, launchDescriptor: options.launchDescriptor ?? this.injectedLaunch });
   }
   async cleanupAfterChildExit(state, childDead = false) {
     if (state.state === "launching") {
@@ -5761,6 +5763,73 @@ class DaemonManager {
   }
 }
 
+// src/commands/recovery-file.ts
+import { constants } from "node:fs";
+import { lstat as lstat4, open as open3 } from "node:fs/promises";
+var UNSAFE_INPUT = "Recovery input must be an owner-only regular file of at most 8192 bytes";
+async function openRecoveryInputFile(path, options = {}) {
+  const platform = options.platform ?? process.platform;
+  const before = await lstat4(path);
+  if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1)
+    throw new Error(UNSAFE_INPUT);
+  const file = await open3(path, constants.O_RDONLY | (platform === "win32" ? 0 : constants.O_NOFOLLOW | constants.O_NONBLOCK));
+  try {
+    const opened = await file.stat();
+    if (!opened.isFile() || opened.nlink !== 1 || opened.dev !== before.dev || opened.ino !== before.ino || opened.size > 8192)
+      throw new Error(UNSAFE_INPUT);
+    if (platform === "win32")
+      await assertWindowsOwnerOnlyFileAcl(path, options.windowsAcl);
+    else if ((opened.mode & 511) !== 384 || process.getuid && opened.uid !== process.getuid())
+      throw new Error(UNSAFE_INPUT);
+    const after = await lstat4(path);
+    const final = await file.stat();
+    if (!after.isFile() || after.isSymbolicLink() || after.nlink !== 1 || after.dev !== opened.dev || after.ino !== opened.ino || final.nlink !== 1 || final.size > 8192 || final.size !== opened.size || platform !== "win32" && ((final.mode & 511) !== 384 || process.getuid && final.uid !== process.getuid()))
+      throw new Error(UNSAFE_INPUT);
+    return file;
+  } catch (error) {
+    await file.close();
+    throw error;
+  }
+}
+
+// src/commands/recover.ts
+async function recoverCommand(options = {}) {
+  const launch = await resolveCoreLaunchDescriptor(options);
+  const db = resolve4(process.env.BUNGEE_CONFIG_DB_PATH ?? join7(ConfigPaths.DATA_DIR, "bungee.db"));
+  let file;
+  try {
+    if (options.file) {
+      file = await openRecoveryInputFile(options.file);
+    }
+    await new Promise((accept, reject) => {
+      const child = spawn3(launch.executable, [...launch.entrypoint === null ? [] : [launch.entrypoint], "--recover", db], { cwd: ConfigPaths.DATA_DIR, stdio: [file?.fd ?? "inherit", "inherit", "inherit"], env: { ...process.env, BUNGEE_ROLE: "master" } });
+      child.once("error", reject);
+      child.once("exit", (code) => code === 0 ? accept() : reject(new Error("Offline recovery failed")));
+    });
+  } finally {
+    await file?.close();
+  }
+}
+
+// src/commands/init.ts
+import { resolve as resolve5, join as join8 } from "node:path";
+import { spawn as spawn4 } from "node:child_process";
+async function initCommand(options = {}) {
+  ConfigPaths.ensureDataDir();
+  ConfigPaths.ensureLogsDir();
+  const configDbPath = resolve5(process.env.BUNGEE_CONFIG_DB_PATH ?? join8(ConfigPaths.DATA_DIR, "bungee.db"));
+  const launch = await resolveCoreLaunchDescriptor(options);
+  await new Promise((accept, reject) => {
+    const child = spawn4(launch.executable, [...launch.entrypoint === null ? [] : [launch.entrypoint], "--initialize-config", configDbPath], { cwd: ConfigPaths.DATA_DIR, stdio: "inherit", env: { ...process.env, BUNGEE_ROLE: "master" } });
+    child.once("error", reject);
+    child.once("exit", (code) => code === 0 ? accept() : reject(new Error(`Configuration initialization failed (${code})`)));
+  });
+  console.log(`Bungee data directory initialized at: ${ConfigPaths.DATA_DIR}`);
+  console.log(`Configuration database: ${configDbPath}`);
+  console.log(`Telemetry database: ${ConfigPaths.LOGS_DIR}/access.db`);
+  console.log("Start Bungee with: bungee start");
+}
+
 // src/commands/start.ts
 async function startCommand(options = {}) {
   const daemonManager = new DaemonManager;
@@ -5916,10 +5985,9 @@ function endpoint(options, path) {
 async function writeFile(path, content) {
   await Bun.write(path, content);
 }
-function headers(token, nextToken) {
+function headers(token) {
   return {
-    ...token === undefined ? {} : { authorization: `Bearer ${token}` },
-    ...nextToken === undefined ? {} : { "x-bungee-next-authorization": `Bearer ${nextToken}` }
+    ...token === undefined ? {} : { authorization: `Bearer ${token}` }
   };
 }
 async function exportCommand(options) {
@@ -5937,7 +6005,7 @@ async function importCommand(options) {
   const snapshot = await Bun.file(options.file).text();
   const response = await fetch(endpoint(options, "import"), {
     method: "POST",
-    headers: { ...headers(options.token, options.nextToken), "content-type": "application/json" },
+    headers: { ...headers(options.token), "content-type": "application/json" },
     body: snapshot
   });
   if (!response.ok) {
@@ -5964,7 +6032,7 @@ async function importCommand(options) {
       throw new Error(`Import failed: operation ${accepted.operation_id} timed out after ${OPERATION_TIMEOUT_MS}ms`);
     }
     const poll = await fetch(endpoint(options, `operations/${accepted.operation_id}`), {
-      headers: headers(options.nextToken ?? options.token),
+      headers: headers(options.token),
       signal: AbortSignal.timeout(remainingMs)
     });
     if (!poll.ok) {
@@ -5982,6 +6050,12 @@ async function importCommand(options) {
 function createProgram() {
   const program = new Command2().name("bungee").description("High-performance reverse proxy server built with Bun and TypeScript").version(package_default.version);
   program.command("init").description("Initialize the Bungee SQLite data directory").action(initCommand);
+  program.command("recover").description("Recover a stopped instance using bounded JSON from stdin or a 0600 file").option("--file <path>", "Owner-only 0600 recovery JSON input file").addHelpText("after", `
+Stop the instance first. Supply one JSON object via stdin or bungee recover --file recovery.json (chmod 600).
+Administrator identity: {"kind":"identity","plugin":"local-accounts","payload":{"username":"admin","password":"<new password, 15-128 characters>","reason":"Lost credentials"}}
+Unresolved usage: {"kind":"plugin-state","plugin":"token-budget","payload":{"keyId":"KEY_ID","requestId":"REQUEST_ID","attemptId":"ATTEMPT_ID","inputTokens":100,"outputTokens":200,"reason":"Verified usage evidence"}}
+Usage counts are replacement totals for the specified attempt, applied to its original period.
+`).action(recoverCommand);
   program.command("start").description("Start proxy server as daemon").option("-p, --port <port>", "Override default port").option("-w, --workers <count>", "Number of worker processes", "2").option("-d, --detach", "Run as daemon (default)", true).option("--auto-upgrade", "Automatically upgrade binary if version mismatch").action(startCommand);
   program.command("stop").description("Stop proxy server daemon").action(stopCommand);
   program.command("restart").description("Restart proxy server daemon").option("-p, --port <port>", "Override default port").option("-w, --workers <count>", "Number of worker processes", "2").option("--auto-upgrade", "Automatically upgrade binary if version mismatch").action(restartCommand);
@@ -5989,7 +6063,7 @@ function createProgram() {
   program.command("logs").description("Show daemon logs").option("-f, --follow", "Follow log output").option("-n, --lines <number>", "Number of lines to show", "50").action(logsCommand);
   program.command("ui").description("Open web dashboard from the Management server").option("-p, --port <port>", "Management server port", DEFAULT_MANAGEMENT_PORT).option("-H, --host <host>", "Management server host", "localhost").action(uiCommand);
   program.command("export").description("Export current configuration from the Management server as a versioned snapshot JSON").requiredOption("-o, --file <path>", "Output file path").option("-p, --port <port>", "Management server port", DEFAULT_MANAGEMENT_PORT).option("-H, --host <host>", "Management server host", "localhost").option("-t, --token <token>", "Management auth token").action(exportCommand);
-  program.command("import").description("Restore configuration on the Management server from a versioned snapshot JSON").requiredOption("-f, --file <path>", "Snapshot file path").option("-p, --port <port>", "Management server port", DEFAULT_MANAGEMENT_PORT).option("-H, --host <host>", "Management server host", "localhost").option("-t, --token <token>", "Management auth token").option("--next-token <token>", "Next management token when the imported config rotates auth").action(importCommand);
+  program.command("import").description("Restore configuration on the Management server from a versioned snapshot JSON").requiredOption("-f, --file <path>", "Snapshot file path").option("-p, --port <port>", "Management server port", DEFAULT_MANAGEMENT_PORT).option("-H, --host <host>", "Management server host", "localhost").option("-t, --token <token>", "Management auth token").action(importCommand);
   program.command("upgrade").description("Upgrade Bungee binary to the latest version").option("-f, --force", "Force re-download even if already up to date").action(upgradeCommand);
   return program;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jeffusion/bungee",
-  "version": "5.4.5",
+  "version": "5.5.0",
   "description": "High-performance reverse proxy server CLI",
   "type": "module",
   "bin": {
@@ -13,8 +13,8 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@jeffusion/bungee-core": "^5.4.5",
-    "@jeffusion/bungee-types": "^5.4.5",
+    "@jeffusion/bungee-core": "^5.5.0",
+    "@jeffusion/bungee-types": "^5.5.0",
     "cli-progress": "^3.12.0",
     "commander": "^14.0.1"
   },