pinggy 0.5.1 → 0.5.3

package/dist/{chunk-BFARGPGP.js → chunk-5YHD6M35.js}

@@ -21,6 +21,14 @@ var Route = {
   SetTunnelLogging: "POST /config/tunnel-logging",
   GetLogPaths: "GET /logs/paths"
 };
+var DaemonHost = {
+  CLI: "cli",
+  APP: "app"
+};
+var ShutdownStatus = {
+  ShuttingDown: "shutting_down",
+  RefusedInApp: "refused_in_app"
+};
 var SessionMode = {
   Foreground: "foreground",
   Detached: "detached"
@@ -159,6 +167,8 @@ var IPCClient = class {
 
 export {
   Route,
+  DaemonHost,
+  ShutdownStatus,
   SessionMode,
   IPCClient
 };

package/dist/{chunk-Y65A4BL2.js → chunk-BBPR2LJB.js}

@@ -10,29 +10,33 @@ import {
   startDaemon,
   startRemoteManagement,
   stopDaemon
-} from "./chunk-VJ4VSZGX.js";
+} from "./chunk-GK2PQ7KX.js";
 import {
   readDaemonConfig
 } from "./chunk-MT44NAXX.js";
 import {
+  DaemonHost,
   Route,
-  SessionMode
-} from "./chunk-BFARGPGP.js";
+  SessionMode,
+  ShutdownStatus
+} from "./chunk-5YHD6M35.js";
 import {
   ConfigVerb,
   SUBCOMMANDS,
   Subcommand,
   deleteConfig,
   findConfig,
+  findConfigByName,
   getAutoStartConfigs,
   listSavedConfigs,
   printConfigDetail,
   printConfigList,
+  sanitizeName,
   saveConfig,
   updateConfigAutoStart,
   updateTunnelConfig,
   validateName
-} from "./chunk-HUP6YWH6.js";
+} from "./chunk-WM7I57AA.js";
 import {
   TunnelManager,
   detachAllTunnelLoggers,
@@ -757,6 +761,13 @@ function parseToken(finalConfig, explicitToken) {
     finalConfig.token = explicitToken;
   }
 }
+function normalizeForwardingToArray(finalConfig, type) {
+  const fwd = finalConfig.forwarding;
+  if (typeof fwd !== "string") {
+    return;
+  }
+  finalConfig.forwarding = fwd.trim() === "" ? [] : [{ type: type || TunnelType.Http, address: fwd.trim() }];
+}
 function parseArgs2(finalConfig, remainingPositionals) {
   let localserverTls = "";
   localserverTls = parseExtendedOptions(remainingPositionals, finalConfig, localserverTls);
@@ -877,6 +888,7 @@ function buildFinalConfig(values, positionals, baseConfig) {
   if (forceFlag || values.force) {
     finalConfig.force = true;
   }
+  normalizeForwardingToArray(finalConfig, type);
   parseArgs2(finalConfig, remainingPositionals);
   storeJson(finalConfig, saveconf);
   return finalConfig;
@@ -1298,7 +1310,7 @@ async function startBackgroundTunnels(configs, values, positionals) {
   client.close();
 }
 async function startAutoStartTunnels() {
-  const { getAutoStartConfigs: getAutoStartConfigs2 } = await import("./configStore-TSGRNOE3.js");
+  const { getAutoStartConfigs: getAutoStartConfigs2 } = await import("./configStore-HP3NXPH4.js");
   const configs = getAutoStartConfigs2();
   if (configs.length === 0) {
     printer_default.warn("No configs marked for auto-start. Use: pinggy config auto <name>");
@@ -1767,6 +1779,8 @@ async function handleDaemonStop() {
   const result = await stopDaemon();
   if (result.ok) {
     printer_default.success("Daemon stopped.");
+  } else if (result.reason === DaemonHost.APP) {
+    printer_default.print(pico2.yellow("The Pinggy daemon is running inside the Pinggy desktop app. Please quit the Pinggy app to stop it."));
   } else {
     printer_default.error(result.error);
   }
@@ -1787,6 +1801,7 @@ function handleDaemonStatus() {
   printer_default.print(`  Port:      ${info.port}`);
   printer_default.print(`  Started:   ${info.startedAt}`);
   printer_default.print(`  Uptime:    ${uptimeStr}`);
+  printer_default.print(`  Host:      ${info.host === DaemonHost.APP ? "Pinggy app (in-process)" : "standalone (CLI)"}`);
 }
 
 // src/cli/subcommand/handlers/psCommand.ts
@@ -2217,10 +2232,10 @@ function handleConfig(args) {
       printConfigList();
       return;
     case ConfigVerb.Show: {
-      const names = requireNames(rest, "config show");
+      const names = clubSpacedName(requireNames(rest, "config show"));
       for (const name of names) {
-        const saved2 = resolveConfig(name);
-        if (saved2) printConfigDetail(saved2);
+        const saved = resolveConfig(name, "config show");
+        if (saved) printConfigDetail(saved);
       }
       return;
     }
@@ -2230,7 +2245,7 @@ function handleConfig(args) {
       return;
     }
     case ConfigVerb.Delete: {
-      const names = requireNames(rest, "config delete");
+      const names = clubSpacedName(requireNames(rest, "config delete"));
       for (const name of names) {
         const deletedName = deleteConfig(name);
         if (deletedName) {
@@ -2247,7 +2262,7 @@ function handleConfig(args) {
       return;
     }
     case ConfigVerb.Auto: {
-      const names = requireNames(rest, "config auto");
+      const names = clubSpacedName(requireNames(rest, "config auto"));
       for (const name of names) {
         const updated = updateConfigAutoStart(name, true);
         if (updated) {
@@ -2259,7 +2274,7 @@ function handleConfig(args) {
       return;
     }
     case ConfigVerb.Noauto: {
-      const names = requireNames(rest, "config noauto");
+      const names = clubSpacedName(requireNames(rest, "config noauto"));
       for (const name of names) {
         const updated = updateConfigAutoStart(name, false);
         if (updated) {
@@ -2270,10 +2285,14 @@ function handleConfig(args) {
       }
       return;
     }
-    default:
-      const saved = resolveConfig(verb);
-      if (saved) printConfigDetail(saved);
+    default: {
+      const names = clubSpacedName([verb, ...rest]);
+      for (const name of names) {
+        const saved = resolveConfig(name, "config");
+        if (saved) printConfigDetail(saved);
+      }
       return;
+    }
   }
 }
 function handleConfigSave(name, remainingArgs) {
@@ -2291,7 +2310,7 @@ function handleConfigSave(name, remainingArgs) {
   printer_default.success(`Config "${name}" saved.`);
 }
 function handleConfigUpdate(nameOrId, remainingArgs) {
-  const saved = resolveConfig(nameOrId);
+  const saved = resolveConfig(nameOrId, "config update");
   if (!saved) return;
   const { values, positionals } = parseCliArgs(cliOptions, remainingArgs);
   logger.debug("Building updated config", { nameOrId, values, positionals });
@@ -2325,7 +2344,7 @@ async function handleStart(args) {
     return;
   }
   const resolved = [];
-  for (const name of names) {
+  for (const name of clubSpacedName(names)) {
     const saved = resolveConfig(name);
     if (!saved) return;
     resolved.push(saved);
@@ -2350,13 +2369,34 @@ async function handleStart(args) {
     await startMultipleForegroundViaDaemon(resolved, values, positionals);
   }
 }
-function resolveConfig(nameOrId) {
-  const saved = findConfig(nameOrId);
-  if (!saved) {
-    printer_default.error(`No config found matching "${nameOrId}". Use: pinggy config list`);
-    return null;
+function clubSpacedName(names) {
+  if (names.length > 1) {
+    const joined = names.join(" ");
+    if (findConfig(joined) ?? findConfigByName(joined)) {
+      return [joined];
+    }
   }
-  return saved;
+  return names;
+}
+function resolveConfig(nameOrId, command = "start") {
+  const saved = findConfig(nameOrId) ?? findConfigByName(nameOrId);
+  if (saved) return saved;
+  const sanitizedQuery = sanitizeName(nameOrId);
+  const suggestions = listSavedConfigs().filter(
+    (c) => c.name !== nameOrId && sanitizeName(c.name) === sanitizedQuery
+  );
+  printer_default.error(`No config found matching "${nameOrId}".`);
+  if (suggestions.length > 0) {
+    for (const c of suggestions.slice(0, 3)) {
+      printer_default.info(`  Did you mean "${c.name}"?  \u2192  pinggy ${command} "${c.name}"`);
+    }
+    if (suggestions.length > 3) {
+      printer_default.info(`  \u2026and ${suggestions.length - 3} more. Use: pinggy config list`);
+    }
+  } else {
+    printer_default.info("  Use: pinggy config list");
+  }
+  return null;
 }
 function requireName(args, command) {
   if (args.length === 0 || args[0].startsWith("-")) {
@@ -2662,6 +2702,10 @@ var IPCServer = class {
       },
       [Route.Shutdown]: () => {
         logger.info("Daemon shutdown requested via IPC");
+        if (getDaemonHost() === DaemonHost.APP) {
+          logger.info("Shutdown refused: daemon is hosted in-process by the Pinggy app");
+          return { status: ShutdownStatus.RefusedInApp, errors: [] };
+        }
         const errors = [];
         const step = (label, fn) => {
           try {
@@ -2676,7 +2720,7 @@ var IPCServer = class {
         step("clearDaemonState", clearDaemonState);
         step("stopAllTunnels", () => TunnelManager.getInstance().stopAllTunnels());
         setTimeout(() => process.exit(0), 200);
-        return { status: "shutting_down", errors };
+        return { status: ShutdownStatus.ShuttingDown, errors };
       }
     };
   }
@@ -3119,6 +3163,10 @@ var SessionTracker = class {
 
 // src/daemon/lifecycle/daemonChild.ts
 var daemonState = { tunnels: [], lastUpdated: "" };
+var daemonHost = DaemonHost.CLI;
+function getDaemonHost() {
+  return daemonHost;
+}
 var sessionTrackerRef = null;
 function setDaemonSessionTracker(st) {
   sessionTrackerRef = st;
@@ -3248,6 +3296,7 @@ async function restoreCrashedTunnels(manager) {
 async function runDaemonChild(opts = {}) {
   const installSignalHandlers = opts.installSignalHandlers ?? true;
   const exitOnFailure = opts.exitOnFailure ?? true;
+  daemonHost = opts.host ?? DaemonHost.CLI;
   ensurePinggyConfigDir();
   const persistedLevel = readDaemonConfig()?.logLevel;
   const envLevel = process.env.PINGGY_LOG_LEVEL;
@@ -3323,7 +3372,8 @@ async function runDaemonChild(opts = {}) {
     const info = {
       pid: process.pid,
       port,
-      startedAt: (/* @__PURE__ */ new Date()).toISOString()
+      startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      host: daemonHost
     };
     writeDaemonInfo(info);
     logger.info("Daemon info written", info);
@@ -3364,7 +3414,7 @@ async function main() {
     const { values, positionals, hasAnyArgs } = parseCliArgs(cliOptions);
     configureLogger(values);
     if (values["_daemon-child"]) {
-      const { runDaemonChild: runDaemonChild2 } = await import("./daemonChild-KXERF36J.js");
+      const { runDaemonChild: runDaemonChild2 } = await import("./daemonChild-WIRWKBKB.js");
       await runDaemonChild2();
       return;
     }
@@ -3398,6 +3448,7 @@ if (entryFile && entryFile === currentFile) {
 }
 
 export {
+  getDaemonHost,
   setDaemonSessionTracker,
   removeDaemonInfo,
   trackTunnelStart,

package/dist/{chunk-VJ4VSZGX.js → chunk-GK2PQ7KX.js}

@@ -1,7 +1,9 @@
 import {
+  DaemonHost,
   IPCClient,
-  SessionMode
-} from "./chunk-BFARGPGP.js";
+  SessionMode,
+  ShutdownStatus
+} from "./chunk-5YHD6M35.js";
 import {
   TunnelAlreadyRunningError,
   TunnelManager,
@@ -209,11 +211,23 @@ var ForwardingEntryV2Schema = z.object({
   address: z.string(),
   type: z.enum([TunnelType.Http, TunnelType.Tcp, TunnelType.Udp, TunnelType.Tls, TunnelType.TlsTcp])
 });
+var OptionalSchema = z.object({
+  sniServerName: z.string().optional(),
+  ssl: z.boolean().optional(),
+  additionalArguments: z.string().optional(),
+  serve: z.string().optional(),
+  manage: z.string().optional(),
+  remoteManagement: z.object({ serverUrl: z.string(), apiKey: z.string() }).optional(),
+  noTui: z.boolean().optional()
+}).catchall(z.unknown());
 var TunnelConfigV1Schema = z.object({
   // Meta Info
   version: z.string(),
   name: z.string(),
   configId: z.string(),
+  hostKeyCheck: z.boolean().optional(),
+  platformValue: z.string().optional(),
+  isQRCode: z.boolean().optional(),
   // General tunnel configurations
   serverAddress: z.string().optional(),
   token: z.string().optional(),
@@ -239,9 +253,11 @@ var TunnelConfigV1Schema = z.object({
   httpsOnly: z.boolean().optional(),
   originalRequestUrl: z.boolean().optional(),
   allowPreflight: z.boolean().optional(),
-  serve: z.string().optional(),
-  optional: z.record(z.string(), z.unknown()).optional()
+  optional: OptionalSchema.optional()
 });
+var TUNNEL_CONFIG_V1_KEYS = Object.keys(
+  TunnelConfigV1Schema.shape
+);
 var StartV2Schema = z.object({
   tunnelID: z.string().nullable().optional(),
   tunnelConfig: TunnelConfigV1Schema
@@ -490,11 +506,11 @@ var TunnelOperations = class {
         startPromise.catch((err) => {
           logger.error("No-wait startTunnel failed", { tunnelid, err: String(err) });
         });
-        return this.buildPendingTunnelResponseV2(tunnelid, tunnelConfig, config, config.configId, config.name, config.serve);
+        return this.buildPendingTunnelResponseV2(tunnelid, tunnelConfig, config, config.configId, config.name, config.optional?.serve);
       }
       await startPromise;
       const tunnelPconfig = await this.tunnelManager.getTunnelConfig("", tunnelid);
-      return this.buildTunnelResponseV2(tunnelid, tunnelPconfig, config, config.configId, config.name, config.serve);
+      return this.buildTunnelResponseV2(tunnelid, tunnelPconfig, config, config.configId, config.name, config.optional?.serve);
     } catch (err) {
       if (err instanceof TunnelAlreadyRunningError) {
         return this.error(ErrorCode.TunnelAlreadyRunningError, err, err.message);
@@ -1491,16 +1507,18 @@ async function ensureDaemonRunning() {
   const existing = getDaemonInfo();
   if (existing) return existing;
   if (process.versions.electron) {
-    const { runDaemonChild } = await import("./daemonChild-KXERF36J.js");
+    const { runDaemonChild } = await import("./daemonChild-WIRWKBKB.js");
     const handle = await runDaemonChild({
       installSignalHandlers: false,
-      exitOnFailure: false
+      exitOnFailure: false,
+      host: DaemonHost.APP
     });
     inProcessHandle = handle;
     return getDaemonInfo() ?? {
       pid: handle.pid,
       port: handle.port,
-      startedAt: (/* @__PURE__ */ new Date()).toISOString()
+      startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      host: DaemonHost.APP
     };
   }
   return startDaemon();
@@ -1511,7 +1529,7 @@ function getInProcessDaemonHandle() {
 async function getActiveTunnelSummaries(origin = "app") {
   const info = getDaemonInfo();
   if (!info) return [];
-  const { IPCClient: IPCClient2 } = await import("./ipcClient-LZQCCNMR.js");
+  const { IPCClient: IPCClient2 } = await import("./ipcClient-Z2RXDQUQ.js");
   const client = new IPCClient2(info.port, origin);
   let tunnels;
   try {
@@ -1558,10 +1576,17 @@ async function stopDaemon() {
   if (!info) return { ok: false, error: "No daemon is running." };
   let daemonErrors = [];
   try {
-    const { IPCClient: IPCClient2 } = await import("./ipcClient-LZQCCNMR.js");
+    const { IPCClient: IPCClient2 } = await import("./ipcClient-Z2RXDQUQ.js");
     const client = new IPCClient2(info.port);
     const result = await client.shutdown();
     logger.debug("Sent shutdown command to daemon", { result });
+    if (result?.status === ShutdownStatus.RefusedInApp) {
+      return {
+        ok: false,
+        reason: DaemonHost.APP,
+        error: "The daemon is running inside the Pinggy app."
+      };
+    }
     if (Array.isArray(result?.errors)) daemonErrors = result.errors;
   } catch (e) {
     return { ok: false, error: `Failed to reach daemon: ${errorMessage(e)}` };
@@ -1847,6 +1872,13 @@ var DaemonHealth = class {
   bindPid(pid) {
     this.originalPid = pid;
   }
+  /**
+   * Forget a previous loss verdict. Called when the client re-binds to a
+   * live daemon via ensureDaemon():
+   */
+  reset() {
+    this.lost = false;
+  }
   isLost() {
     return this.lost;
   }
@@ -1951,6 +1983,7 @@ var TunnelClient = class _TunnelClient {
     const info = await ensureDaemonRunning();
     this.ipc = new IPCClient(info.port, this.origin);
     this.health.bindPid(info.pid);
+    this.health.reset();
   }
   static async forRemoteManagement() {
     const client = new _TunnelClient({ origin: "remote" });
@@ -2024,6 +2057,21 @@ var TunnelClient = class _TunnelClient {
     await this.ipc.shutdown();
     this.close();
   }
+  /**
+   * Tear down the daemon hosted in THIS process, if any. Stops all tunnels
+   * and removes daemon.json + daemon-state.json so the next CLI run doesn't
+   * "crash-recover" tunnels that died with the host application. 
+   */
+  shutdownInProcessDaemon() {
+    const handle = getInProcessDaemonHandle();
+    if (!handle) return false;
+    try {
+      this.close();
+    } catch {
+    }
+    handle.shutdown();
+    return true;
+  }
   async getLogLevel() {
     this.assertClient();
     const res = await this.ipc.getLogLevel();
@@ -2139,6 +2187,8 @@ export {
   TunnelWarningCode,
   ErrorCode,
   isErrorResponse,
+  TunnelConfigV1Schema,
+  TUNNEL_CONFIG_V1_KEYS,
   TunnelOperations,
   RemoteManagementUnauthorizedError,
   buildRemoteManagementWsUrl,

package/dist/{chunk-HUP6YWH6.js → chunk-WM7I57AA.js}

@@ -10,6 +10,14 @@ import {
 import fs from "fs";
 import path from "path";
 import pico from "picocolors";
+var storageLogger = {
+  info: (message, ...meta) => logger.info(message, ...meta),
+  warn: (message, ...meta) => logger.warn(message, ...meta),
+  error: (message, ...meta) => logger.error(message, ...meta)
+};
+function configureStorageLogger(l) {
+  storageLogger = l;
+}
 function buildFilename(name, configId) {
   return `${name}_${configId}.json`;
 }
@@ -41,7 +49,7 @@ var ConfigVerb = {
 var SUBCOMMANDS = Object.values(Subcommand);
 var CONFIG_VERBS = Object.values(ConfigVerb);
 var RESERVED_NAMES = /* @__PURE__ */ new Set([...SUBCOMMANDS, ...CONFIG_VERBS]);
-function validateName(name) {
+function validateNameStrict(name) {
   if (!name || name.trim().length === 0) {
     return new Error("Tunnel name cannot be empty.");
   }
@@ -56,17 +64,39 @@ function validateName(name) {
   }
   return null;
 }
+function validateNameForStorage(name) {
+  if (!name || name.trim().length === 0) {
+    return new Error("Tunnel name cannot be empty.");
+  }
+  if (/[\u0000-\u001F\/\\]/.test(name)) {
+    return new Error("Tunnel name cannot contain path separators or control characters.");
+  }
+  if (RESERVED_NAMES.has(name.toLowerCase())) {
+    return new Error(`"${name}" is a reserved subcommand name. Use a different name.`);
+  }
+  return null;
+}
+var validateName = validateNameStrict;
 function readConfigFile(filePath) {
   try {
     const data = fs.readFileSync(filePath, { encoding: "utf-8" });
     return JSON.parse(data);
   } catch (err) {
-    logger.warn(`Failed to read config file ${filePath}:`, err);
+    storageLogger.warn(`Failed to read config file ${filePath}: ${String(err)}`);
     return null;
   }
 }
 function writeConfigFile(filePath, config) {
-  fs.writeFileSync(filePath, JSON.stringify(config, null, 2), { encoding: "utf-8" });
+  const tmp = `${filePath}.tmp.${process.pid}`;
+  fs.writeFileSync(tmp, JSON.stringify(config, null, 2), { encoding: "utf-8" });
+  fs.renameSync(tmp, filePath);
+}
+function nextTimestamp(prev) {
+  const ts = (/* @__PURE__ */ new Date()).toISOString();
+  if (prev && ts <= prev) {
+    return new Date(new Date(prev).getTime() + 1).toISOString();
+  }
+  return ts;
 }
 function listSavedConfigs() {
   const dir = getTunnelConfigDir();
@@ -88,15 +118,15 @@ function findConfigFile(nameOrId) {
   if (!fs.existsSync(dir)) return null;
   const files = fs.readdirSync(dir).filter((f) => f.endsWith(".json"));
   const sanitized = sanitizeName(nameOrId);
-  const nameMatch = files.find((f) => f.startsWith(sanitized + "_"));
-  if (nameMatch) {
-    const filePath = path.join(dir, nameMatch);
+  const nameCandidates = files.filter((f) => f.startsWith(sanitized + "_"));
+  for (const f of nameCandidates) {
+    const filePath = path.join(dir, f);
     const config = readConfigFile(filePath);
     if (config && config.name === nameOrId) return { filePath, config };
   }
   const idCandidates = files.filter((f) => {
     const withoutExt = f.replace(/\.json$/, "");
-    const lastUnderscore = withoutExt.indexOf("_");
+    const lastUnderscore = withoutExt.lastIndexOf("_");
     if (lastUnderscore === -1) return false;
     const idPart = withoutExt.slice(lastUnderscore + 1);
     return idPart.startsWith(nameOrId);
@@ -108,15 +138,33 @@ function findConfigFile(nameOrId) {
   }
   return null;
 }
+function findConfigFileByConfigId(configId) {
+  const dir = getTunnelConfigDir();
+  if (!fs.existsSync(dir)) return null;
+  const files = fs.readdirSync(dir).filter((f) => f.endsWith(".json"));
+  for (const file of files) {
+    const filePath = path.join(dir, file);
+    const config = readConfigFile(filePath);
+    if (config && config.configId === configId) {
+      return { filePath, config };
+    }
+  }
+  return null;
+}
 function findConfigByName(name) {
-  const resolved = findConfigFile(name);
-  return resolved?.config.name === name ? resolved.config : null;
+  const dir = getTunnelConfigDir();
+  if (!fs.existsSync(dir)) return null;
+  const prefix = `${sanitizeName(name)}_`;
+  const matches = fs.readdirSync(dir).filter((f) => f.endsWith(".json") && f.startsWith(prefix)).map((f) => readConfigFile(path.join(dir, f))).filter((c) => c !== null && c.name === name);
+  if (matches.length === 0) return null;
+  return matches.sort((a, b) => (b.updatedAt || "").localeCompare(a.updatedAt || ""))[0];
 }
 function findConfig(nameOrId) {
   return findConfigFile(nameOrId)?.config ?? null;
 }
-function saveConfig(name, configId, tunnelConfig, autoStart = false) {
-  const nameErr = validateName(name);
+function saveConfig(name, configId, tunnelConfig, autoStart = false, options = {}) {
+  const { strict = true } = options;
+  const nameErr = strict ? validateNameStrict(name) : validateNameForStorage(name);
   if (nameErr) {
     throw nameErr;
   }
@@ -136,12 +184,58 @@ function saveConfig(name, configId, tunnelConfig, autoStart = false) {
     updatedAt: now,
     tunnelConfig
   };
-  const filename = buildFilename(sanitizeName(name), configId);
-  const filePath = path.join(dir, filename);
-  fs.writeFileSync(filePath, JSON.stringify(saved, null, 2), { encoding: "utf-8" });
-  logger.info(`Config "${name}" saved to ${filePath}`);
+  const filePath = path.join(dir, buildFilename(sanitizeName(name), configId));
+  writeConfigFile(filePath, saved);
+  storageLogger.info(`Config "${name}" saved to ${filePath}`);
   return saved;
 }
+function upsertConfig(saved, options = {}) {
+  const { strict = true } = options;
+  const dir = ensureTunnelConfigDir();
+  const targetPath = path.join(dir, buildFilename(sanitizeName(saved.name), saved.configId));
+  const existing = findConfigFileByConfigId(saved.configId);
+  if (existing) {
+    if (path.resolve(existing.filePath) !== path.resolve(targetPath)) {
+      try {
+        fs.unlinkSync(existing.filePath);
+      } catch (err) {
+        storageLogger.warn(`upsertConfig: failed to remove old file ${existing.filePath}: ${String(err)}`);
+      }
+    }
+    writeConfigFile(targetPath, saved);
+    storageLogger.info(`Config "${saved.name}" (${saved.configId}) updated at ${targetPath}`);
+    return saved;
+  }
+  const nameErr = strict ? validateNameStrict(saved.name) : validateNameForStorage(saved.name);
+  if (nameErr) {
+    throw nameErr;
+  }
+  writeConfigFile(targetPath, saved);
+  storageLogger.info(`Config "${saved.name}" (${saved.configId}) saved to ${targetPath}`);
+  return saved;
+}
+function bulkReplace(configs, knownConfigIds, options = {}) {
+  const written = [];
+  const deleted = [];
+  const incomingIds = /* @__PURE__ */ new Set();
+  for (const cfg of configs) {
+    upsertConfig(cfg, options);
+    written.push(cfg.configId);
+    incomingIds.add(cfg.configId);
+  }
+  for (const id of knownConfigIds) {
+    if (incomingIds.has(id)) continue;
+    const existing = findConfigFileByConfigId(id);
+    if (!existing) continue;
+    try {
+      fs.unlinkSync(existing.filePath);
+      deleted.push(id);
+    } catch (err) {
+      storageLogger.warn(`bulkReplace: failed to delete ${existing.filePath}: ${String(err)}`);
+    }
+  }
+  return { written, deleted };
+}
 function loadConfigByName(name) {
   return findConfigByName(name);
 }
@@ -149,25 +243,25 @@ function deleteConfig(nameOrId) {
   const resolved = findConfigFile(nameOrId);
   if (!resolved) return null;
   fs.unlinkSync(resolved.filePath);
-  logger.info(`Config "${resolved.config.name}" deleted.`);
+  storageLogger.info(`Config "${resolved.config.name}" deleted.`);
   return resolved.config.name;
 }
 function updateConfigAutoStart(nameOrId, autoStart) {
   const resolved = findConfigFile(nameOrId);
   if (!resolved) return null;
   resolved.config.autoStart = autoStart;
-  resolved.config.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  resolved.config.updatedAt = nextTimestamp(resolved.config.updatedAt);
   writeConfigFile(resolved.filePath, resolved.config);
-  logger.info(`Config "${resolved.config.name}" auto-start set to ${autoStart}`);
+  storageLogger.info(`Config "${resolved.config.name}" auto-start set to ${autoStart}`);
   return resolved.config;
 }
 function updateTunnelConfig(nameOrId, tunnelConfig) {
   const resolved = findConfigFile(nameOrId);
   if (!resolved) return null;
   resolved.config.tunnelConfig = tunnelConfig;
-  resolved.config.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  resolved.config.updatedAt = nextTimestamp(resolved.config.updatedAt);
   writeConfigFile(resolved.filePath, resolved.config);
-  logger.info(`Config "${resolved.config.name}" tunnel configuration updated`);
+  storageLogger.info(`Config "${resolved.config.name}" tunnel configuration updated`);
   return resolved.config;
 }
 function getAutoStartConfigs() {
@@ -248,17 +342,22 @@ Tunnel Config: ${pico.cyanBright(config.name)}`));
 }
 
 export {
+  configureStorageLogger,
   sanitizeName,
   Subcommand,
   ConfigVerb,
   SUBCOMMANDS,
   CONFIG_VERBS,
   RESERVED_NAMES,
+  validateNameStrict,
+  validateNameForStorage,
   validateName,
   listSavedConfigs,
   findConfigByName,
   findConfig,
   saveConfig,
+  upsertConfig,
+  bulkReplace,
   loadConfigByName,
   deleteConfig,
   updateConfigAutoStart,