@tinycloud/cli 1.0.1-beta.0 → 1.0.1-beta.2

package/dist/legacy-entry.js

@@ -37,7 +37,7 @@ import {
   tinycloudConfigPath,
   tinycloudHomePath
 } from "@tinycloud/operations/state";
-var CONFIG_DIR, PROFILES_DIR, CONFIG_FILE, DEFAULT_HOST, DEFAULT_OPENKEY_HOST, DEFAULT_OPENKEY_DEVICE_API_HOST, DEFAULT_SHARE_ORIGIN, DEFAULT_PROFILE, DEFAULT_CHAIN_ID, ExitCode;
+var CONFIG_DIR, PROFILES_DIR, CONFIG_FILE, DEFAULT_HOST, DEFAULT_OPENKEY_HOST, DEFAULT_OPENKEY_DEVICE_API_HOST, DEFAULT_SHARE_ORIGIN, DEFAULT_PROFILE, DEFAULT_CHAIN_ID, PROFILE_COMMIT_LOCK_TIMEOUT_MS, ExitCode;
 var init_constants = __esm({
   "src/config/constants.ts"() {
     "use strict";
@@ -50,6 +50,7 @@ var init_constants = __esm({
     DEFAULT_SHARE_ORIGIN = "https://share.tinycloud.xyz";
     DEFAULT_PROFILE = "default";
     DEFAULT_CHAIN_ID = 1;
+    PROFILE_COMMIT_LOCK_TIMEOUT_MS = 45e3;
     ExitCode = {
       SUCCESS: 0,
       ERROR: 1,
@@ -104,9 +105,6 @@ async function fileExists(filePath) {
 async function ensureDir(dirPath) {
   await mkdir(dirPath, { recursive: true, mode: PRIVATE_DIR_MODE });
 }
-async function removeDir(dirPath) {
-  await rm(dirPath, { recursive: true, force: true });
-}
 async function listDirs(dirPath) {
   try {
     const entries = await readdir(dirPath, { withFileTypes: true });
@@ -641,9 +639,10 @@ var init_host = __esm({
 });
 
 // src/config/profiles.ts
-import { chmod, rm as rm2 } from "fs/promises";
+import { chmod, lstat, readdir as readdir2, rm as rm2, rmdir } from "fs/promises";
 import { join as join3 } from "path";
 import {
+  profilePath,
   readSession,
   removeSession,
   withProfileLock,
@@ -719,8 +718,8 @@ var init_profiles = __esm({
        * Throws CLIError if the profile doesn't exist.
        */
       static async getProfile(name) {
-        const profilePath = join3(PROFILES_DIR, name, "profile.json");
-        const profile = await readJson(profilePath);
+        const profilePath2 = join3(PROFILES_DIR, name, "profile.json");
+        const profile = await readJson(profilePath2);
         if (!profile) {
           throw new CLIError(
             "PROFILE_NOT_FOUND",
@@ -755,10 +754,27 @@ var init_profiles = __esm({
         return listDirs(PROFILES_DIR);
       }
       /**
-       * Deletes a profile directory.
-       * Throws if trying to delete the current default profile.
+       * Deletes a profile. Its key, session, settings, stores and cache are
+       * removed while holding the profile lock, so another writer's critical
+       * section never sees them vanish midway: session and key first, settings
+       * last, so a crash midway never leaves a session or key without its
+       * profile. `.lock` itself is left to the lock's release; the then-empty
+       * directory is removed afterwards unless another writer took the lock (or
+       * wrote) meanwhile. A profile directory that is a symlink is unlinked, its
+       * target left alone.
+       * Throws if the name is not one path segment or names the default profile.
        */
       static async deleteProfile(name) {
+        let profileDir;
+        try {
+          profileDir = profilePath(name);
+        } catch {
+          throw new CLIError(
+            "INVALID_PROFILE_NAME",
+            `Invalid profile name "${name}": a profile name is one path segment (no "/", "\\", "." or "..").`,
+            ExitCode.USAGE_ERROR
+          );
+        }
         const config = await _ProfileManager.getConfig();
         if (config.defaultProfile === name) {
           throw new CLIError(
@@ -766,8 +782,24 @@ var init_profiles = __esm({
             `Cannot delete the default profile "${name}". Change the default first with \`tc profile default <other>\`.`
           );
         }
-        const profileDir = join3(PROFILES_DIR, name);
-        await removeDir(profileDir);
+        const isLink = await lstat(profileDir).then((stats) => stats.isSymbolicLink(), (error) => {
+          if (error.code === "ENOENT") return false;
+          throw error;
+        });
+        if (isLink) {
+          await rm2(profileDir, { force: true });
+          return;
+        }
+        await _ProfileManager.withLock(name, async () => {
+          for (const file of ["session.json", "key.json"]) await rm2(join3(profileDir, file), { force: true });
+          for (const entry of await readdir2(profileDir)) {
+            if (entry !== ".lock" && entry !== "profile.json") await rm2(join3(profileDir, entry), { recursive: true, force: true });
+          }
+          await rm2(join3(profileDir, "profile.json"), { force: true });
+        });
+        await rmdir(profileDir).catch((error) => {
+          if (error.code !== "ENOENT" && error.code !== "ENOTEMPTY" && error.code !== "EEXIST") throw error;
+        });
       }
       // ── Key management ──────────────────────────────────────────────────
       /**
@@ -7250,7 +7282,7 @@ var KVService = class extends BaseService {
       return err(
         storageQuotaExceededError(
           "kv",
-          `Storage quota exceeded for key "${key}": ${errorText}`,
+          `Storage quota exceeded for key ${JSON.stringify(key)}: ${errorText}`,
           {
             status: response.status,
             ...quotaInfo ? { usedBytes: quotaInfo.usedBytes, limitBytes: quotaInfo.limitBytes } : {}
@@ -7263,7 +7295,7 @@ var KVService = class extends BaseService {
       return err(
         storageLimitReachedError(
           "kv",
-          `Storage limit reached for key "${key}": ${errorText}`,
+          `Storage limit reached for key ${JSON.stringify(key)}: ${errorText}`,
           {
             status: response.status,
             ...quotaInfo ? { usedBytes: quotaInfo.usedBytes, limitBytes: quotaInfo.limitBytes } : {}
@@ -7549,12 +7581,11 @@ var KVService = class extends BaseService {
       if (!response.ok) {
         const errorText = await response.text();
         if (response.status === 401 || response.status === 403) {
-          const { resource, action: requiredAction } = parseAuthError(errorText);
-          return err(authUnauthorizedError("kv", errorText, {
-            status: response.status,
-            ...requiredAction && { requiredAction },
-            ...resource && { resource }
-          }));
+          return this.authorizationFailure(
+            `Failed to batch read ${keys.length} key(s)`,
+            response,
+            errorText
+          );
         }
         if (response.status === 413) {
           return err(serviceError(
@@ -7653,23 +7684,39 @@ var KVService = class extends BaseService {
     } catch {
     }
     if (response.status === 401 || response.status === 403) {
-      const { resource, action } = parseAuthError(errorText);
-      return err(authUnauthorizedError("kv", errorText, {
-        status: response.status,
-        ...action && { requiredAction: action },
-        ...resource && { resource }
-      }));
+      return this.authorizationFailure(
+        `Failed to create signed read URL for key ${JSON.stringify(key)}`,
+        response,
+        errorText
+      );
     }
     const code2 = response.status === 400 ? ErrorCodes.INVALID_INPUT : ErrorCodes.NETWORK_ERROR;
     return err(
       serviceError(
         code2,
-        `Failed to create signed read URL for key "${key}": ${response.status} - ${errorText}`,
+        `Failed to create signed read URL for key ${JSON.stringify(key)}: ${response.status} - ${errorText}`,
         "kv",
         { meta: { status: response.status, statusText: response.statusText } }
       )
     );
   }
+  /**
+   * AUTH_UNAUTHORIZED for a 401/403 response. The message keeps the HTTP
+   * status and the server text (`<context>: <status> - <text>`, the same
+   * shape as every other KV failure) so callers that rethrow only the message
+   * still see the status; `meta.status` carries it for typed callers.
+   * Resource/ability hints are parsed from the raw body, never the message.
+   */
+  authorizationFailure(context, response, errorText, extraMeta = {}) {
+    const { resource, action } = parseAuthError(errorText);
+    const detail = errorText.trim().length > 0 ? errorText : response.statusText || "authorization failed";
+    return err(authUnauthorizedError("kv", `${context}: ${response.status} - ${detail}`, {
+      status: response.status,
+      ...action && { requiredAction: action },
+      ...resource && { resource },
+      ...extraMeta
+    }));
+  }
   normalizeSignedReadUrlResponse(data) {
     if (!data || typeof data !== "object") {
       return void 0;
@@ -7712,14 +7759,13 @@ var KVService = class extends BaseService {
         if (!response.ok) {
           if (response.status === 401 || response.status === 403) {
             const errorText2 = await response.text();
-            const { resource, action } = parseAuthError(errorText2);
             const permissionHint = parsePermissionHintFromErrorText(errorText2);
-            return err(authUnauthorizedError("kv", errorText2, {
-              status: response.status,
-              ...action && { requiredAction: action },
-              ...resource && { resource },
-              ...permissionHint === void 0 ? {} : { permissionHint }
-            }));
+            return this.authorizationFailure(
+              `Failed to get key ${JSON.stringify(key)}`,
+              response,
+              errorText2,
+              permissionHint === void 0 ? {} : { permissionHint }
+            );
           }
           if (response.status === 404) {
             return this.classifyNotFound(response, key);
@@ -7728,7 +7774,7 @@ var KVService = class extends BaseService {
           if (response.status === 413) {
             return err(serviceError(
               ErrorCodes.KV_RESPONSE_TOO_LARGE,
-              `KV value at key "${key}" exceeds the requested response limit`,
+              `KV value at key ${JSON.stringify(key)} exceeds the requested response limit`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             ));
@@ -7736,7 +7782,7 @@ var KVService = class extends BaseService {
           return err(
             serviceError(
               ErrorCodes.NETWORK_ERROR,
-              `Failed to get key "${key}": ${response.status} - ${errorText}`,
+              `Failed to get key ${JSON.stringify(key)}: ${response.status} - ${errorText}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             )
@@ -7792,21 +7838,18 @@ var KVService = class extends BaseService {
           }
         );
         if (response.status === 401 || response.status === 403) {
-          const errorText = await response.text();
-          const message = errorText.trim().length > 0 ? errorText : `Failed to put key "${key}": ${response.status} - ${response.statusText || "authorization failed"}`;
-          const { resource, action: requiredAction } = parseAuthError(errorText);
-          return err(authUnauthorizedError("kv", message, {
-            status: response.status,
-            ...requiredAction && { requiredAction },
-            ...resource && { resource }
-          }));
+          return this.authorizationFailure(
+            `Failed to put key ${JSON.stringify(key)}`,
+            response,
+            await response.text()
+          );
         }
         if (!response.ok) {
           const errorText = await response.text();
           if (response.status === 412) {
             return err(serviceError(
               ErrorCodes.KV_PRECONDITION_FAILED,
-              `KV precondition failed for key "${key}"`,
+              `KV precondition failed for key ${JSON.stringify(key)}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             ));
@@ -7814,7 +7857,7 @@ var KVService = class extends BaseService {
           if (response.status === 503 && (options?.ifMatch !== void 0 || options?.ifNoneMatch !== void 0)) {
             return err(serviceError(
               ErrorCodes.KV_CONFLICT,
-              `Concurrent KV update conflicted for key "${key}"`,
+              `Concurrent KV update conflicted for key ${JSON.stringify(key)}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             ));
@@ -7830,7 +7873,7 @@ var KVService = class extends BaseService {
           return err(
             serviceError(
               ErrorCodes.KV_WRITE_FAILED,
-              `Failed to put key "${key}": ${response.status} - ${errorText}`,
+              `Failed to put key ${JSON.stringify(key)}: ${response.status} - ${errorText}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             )
@@ -7924,12 +7967,11 @@ var KVService = class extends BaseService {
             );
           }
           if (response.status === 401 || response.status === 403) {
-            const { resource, action } = parseAuthError(errorText);
-            return err(authUnauthorizedError("kv", errorText, {
-              status: response.status,
-              ...action && { requiredAction: action },
-              ...resource && { resource }
-            }));
+            return this.authorizationFailure(
+              `Failed to batch put ${items.length} key(s)`,
+              response,
+              errorText
+            );
           }
           const quotaError = this.handleQuotaErrorResponse(
             response,
@@ -8050,13 +8092,11 @@ var KVService = class extends BaseService {
         );
         if (!response.ok) {
           if (response.status === 401) {
-            const errorText2 = await response.text();
-            const { resource, action } = parseAuthError(errorText2);
-            return err(authUnauthorizedError("kv", errorText2, {
-              status: response.status,
-              ...action && { requiredAction: action },
-              ...resource && { resource }
-            }));
+            return this.authorizationFailure(
+              "Failed to list keys",
+              response,
+              await response.text()
+            );
           }
           const errorText = await response.text();
           return err(
@@ -8105,13 +8145,11 @@ var KVService = class extends BaseService {
         );
         if (!response.ok) {
           if (response.status === 401) {
-            const errorText2 = await response.text();
-            const { resource, action } = parseAuthError(errorText2);
-            return err(authUnauthorizedError("kv", errorText2, {
-              status: response.status,
-              ...action && { requiredAction: action },
-              ...resource && { resource }
-            }));
+            return this.authorizationFailure(
+              `Failed to delete key ${JSON.stringify(key)}`,
+              response,
+              await response.text()
+            );
           }
           if (response.status === 404) {
             return this.classifyNotFound(response, key);
@@ -8120,7 +8158,7 @@ var KVService = class extends BaseService {
           if (response.status === 412) {
             return err(serviceError(
               ErrorCodes.KV_PRECONDITION_FAILED,
-              `KV precondition failed for key "${key}"`,
+              `KV precondition failed for key ${JSON.stringify(key)}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             ));
@@ -8128,7 +8166,7 @@ var KVService = class extends BaseService {
           if (response.status === 503 && options?.ifMatch !== void 0) {
             return err(serviceError(
               ErrorCodes.KV_CONFLICT,
-              `Concurrent KV delete conflicted for key "${key}"`,
+              `Concurrent KV delete conflicted for key ${JSON.stringify(key)}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             ));
@@ -8136,7 +8174,7 @@ var KVService = class extends BaseService {
           return err(
             serviceError(
               ErrorCodes.NETWORK_ERROR,
-              `Failed to delete key "${key}": ${response.status} - ${errorText}`,
+              `Failed to delete key ${JSON.stringify(key)}: ${response.status} - ${errorText}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             )
@@ -8169,13 +8207,11 @@ var KVService = class extends BaseService {
         );
         if (!response.ok) {
           if (response.status === 401) {
-            const errorText2 = await response.text();
-            const { resource, action } = parseAuthError(errorText2);
-            return err(authUnauthorizedError("kv", errorText2, {
-              status: response.status,
-              ...action && { requiredAction: action },
-              ...resource && { resource }
-            }));
+            return this.authorizationFailure(
+              `Failed to get metadata for key ${JSON.stringify(key)}`,
+              response,
+              await response.text()
+            );
           }
           if (response.status === 404) {
             return this.classifyNotFound(response, key);
@@ -8184,7 +8220,7 @@ var KVService = class extends BaseService {
           return err(
             serviceError(
               ErrorCodes.NETWORK_ERROR,
-              `Failed to get metadata for key "${key}": ${response.status} - ${errorText}`,
+              `Failed to get metadata for key ${JSON.stringify(key)}: ${response.status} - ${errorText}`,
               "kv",
               { meta: { status: response.status, statusText: response.statusText } }
             )
@@ -9643,10 +9679,14 @@ async function responseError(service, message, response) {
     }
   } catch {
   }
-  return wrapError2(
+  const error = wrapError2(
     service,
     new Error(`${message}: ${response.status} ${detail}`)
   );
+  return {
+    ...error,
+    meta: { ...error.meta, status: response.status, statusText: response.statusText }
+  };
 }
 function isAbortError(error) {
   return error instanceof DOMException && error.name === "AbortError";
@@ -13493,39 +13533,89 @@ async function createSDKInstance(ctx, options) {
   return node;
 }
 async function bootstrapDelegatedSession(ctx, delegation) {
-  const profile = await ProfileManager.getProfile(ctx.profile);
-  if (resolveProfilePosture(profile) !== "delegate-session") {
-    throw new CLIError(
-      "AUTH_REQUIRED",
-      `Profile "${ctx.profile}" is not a delegate-session profile.`,
-      ExitCode.AUTH_REQUIRED
-    );
-  }
-  const sessionDid = profile.sessionDid ?? profile.did;
-  if (delegation.delegateDID.split("#", 1)[0] !== sessionDid.split("#", 1)[0]) {
-    throw new CLIError(
-      "DELEGATION_AUDIENCE_MISMATCH",
-      `Delegation targets ${delegation.delegateDID}, but profile "${ctx.profile}" uses ${sessionDid}.`,
-      ExitCode.PERMISSION_DENIED
-    );
-  }
-  const key = await ProfileManager.getKey(ctx.profile);
-  const jwk = signerJwkForProfile(ctx.profile, void 0, key);
-  await ProfileManager.withLock(ctx.profile, async () => {
-    await ProfileManager.setSession(ctx.profile, {
+  const written = await ProfileManager.withLock(ctx.profile, async () => {
+    const previousProfile = await ProfileManager.getProfile(ctx.profile);
+    if (resolveProfilePosture(previousProfile) !== "delegate-session") {
+      throw new CLIError(
+        "AUTH_REQUIRED",
+        `Profile "${ctx.profile}" is not a delegate-session profile.`,
+        ExitCode.AUTH_REQUIRED
+      );
+    }
+    const sessionDid = previousProfile.sessionDid ?? previousProfile.did;
+    if (delegation.delegateDID.split("#", 1)[0] !== sessionDid.split("#", 1)[0]) {
+      throw new CLIError(
+        "DELEGATION_AUDIENCE_MISMATCH",
+        `Delegation targets ${delegation.delegateDID}, but profile "${ctx.profile}" uses ${sessionDid}.`,
+        ExitCode.PERMISSION_DENIED
+      );
+    }
+    if (await ProfileManager.getSession(ctx.profile) !== null) {
+      throw new CLIError(
+        "PROFILE_CHANGED_DURING_IMPORT",
+        `Profile "${ctx.profile}" gained a session (another login or import) after this import checked it. Nothing was saved; run the import again.`,
+        ExitCode.ERROR
+      );
+    }
+    const jwk = signerJwkForProfile(ctx.profile, void 0, await ProfileManager.getKey(ctx.profile));
+    const session = {
       delegationHeader: delegation.delegationHeader,
       delegationCid: delegation.cid,
       spaceId: delegation.spaceId,
       jwk,
       verificationMethod: sessionDid
-    });
-    await ProfileManager.updateProfile(ctx.profile, (current) => ({
-      ...current,
-      sessionDid,
-      spaceId: delegation.spaceId
-    }));
+    };
+    const profile = { ...previousProfile, sessionDid, spaceId: delegation.spaceId };
+    try {
+      await ProfileManager.setSession(ctx.profile, session);
+      await ProfileManager.setProfile(ctx.profile, profile);
+    } catch (error) {
+      throw annotate(error, await restoreBeforeBootstrap(ctx.profile, previousProfile));
+    }
+    return { previousProfile, profile, session };
   });
-  return createSDKInstance(ctx);
+  const abandon = async (cause) => {
+    const note = await ProfileManager.withLock(ctx.profile, async () => {
+      const profile = await ProfileManager.getProfile(ctx.profile).catch((error) => {
+        if (error instanceof CLIError && error.code === "PROFILE_NOT_FOUND") return null;
+        throw error;
+      });
+      const session = await ProfileManager.getSession(ctx.profile);
+      if (JSON.stringify(profile) !== JSON.stringify(written.profile) || JSON.stringify(session) !== JSON.stringify(written.session)) {
+        return `Profile "${ctx.profile}" changed while the import was pending (another login, logout or profile update), so its newer state was kept and the provisional session was not rolled back.`;
+      }
+      return restoreBeforeBootstrap(ctx.profile, written.previousProfile);
+    }, { timeoutMs: PROFILE_COMMIT_LOCK_TIMEOUT_MS }).catch((error) => (
+      // The lock or a read failed: the import's error stays the one reported.
+      `Rolling back the provisional session of profile "${ctx.profile}" could not run (${error instanceof Error ? error.message : String(error)}); check \`tc --profile ${ctx.profile} context\`.`
+    ));
+    throw annotate(cause, note);
+  };
+  let node;
+  try {
+    node = await createSDKInstance(ctx);
+  } catch (error) {
+    return abandon(error);
+  }
+  return { node, abandon };
+}
+async function restoreBeforeBootstrap(profileName, previousProfile) {
+  const failures = [];
+  for (const write of [
+    () => ProfileManager.clearSession(profileName),
+    () => ProfileManager.setProfile(profileName, previousProfile)
+  ]) {
+    await write().catch((error) => {
+      failures.push(error instanceof Error ? error.message : String(error));
+    });
+  }
+  if (failures.length === 0) return void 0;
+  return `Rolling back the provisional session of profile "${profileName}" failed too (${failures.join("; ")}); check \`tc --profile ${profileName} context\`.`;
+}
+function annotate(error, note) {
+  if (note === void 0) return error;
+  const cause = wrapError(error);
+  return new CLIError(cause.code, `${cause.message} ${note}`, cause.exitCode, cause.metadata);
 }
 async function ensureAuthenticated(ctx, options) {
   if (options?.privateKey) {
@@ -14590,7 +14680,6 @@ function assertSessionReplaceable(profileName, snapshot, ownerDid, scope, newExp
     ExitCode.USAGE_ERROR
   );
 }
-var COMMIT_LOCK_TIMEOUT_MS = 45e3;
 async function restore(profileName, state) {
   const writes = [
     () => state.key === null ? ProfileManager.removeKey(profileName) : ProfileManager.setKey(profileName, state.key),
@@ -14616,7 +14705,7 @@ async function commitLogin(profileName, snapshot, commit) {
     if (canonicalJson(current.profile) !== canonicalJson(snapshot.profile) || canonicalJson(current.key) !== canonicalJson(snapshot.key) || canonicalJson(current.session) !== canonicalJson(snapshot.session)) {
       throw new CLIError(
         "PROFILE_CHANGED_DURING_LOGIN",
-        `Profile "${profileName}" changed while waiting for approval (another login, key rotation or logout). Nothing was saved; check \`tc --profile ${profileName} context\` and run the login again if it is still needed.`,
+        `Profile "${profileName}" changed while this login was in progress (another login, key rotation or logout). Nothing was saved; check \`tc --profile ${profileName} context\` and run the login again if it is still needed.`,
         ExitCode.ERROR
       );
     }
@@ -14637,11 +14726,11 @@ async function commitLogin(profileName, snapshot, commit) {
         ExitCode.ERROR
       );
     }
-  }, { timeoutMs: COMMIT_LOCK_TIMEOUT_MS }).catch((error) => {
+  }, { timeoutMs: PROFILE_COMMIT_LOCK_TIMEOUT_MS }).catch((error) => {
     if (!(error instanceof ProfileLockTimeoutError2)) throw error;
     throw new CLIError(
       "PROFILE_LOCK_TIMEOUT",
-      `Another tc process kept profile "${profileName}" locked for ${COMMIT_LOCK_TIMEOUT_MS / 1e3} s, so the approved login was not saved. Wait for it to finish (a crashed process's lock is reclaimed after 30 s) and run the login again.`,
+      `Another tc process kept profile "${profileName}" locked for ${PROFILE_COMMIT_LOCK_TIMEOUT_MS / 1e3} s, so the approved login was not saved. Wait for it to finish (a crashed process's lock is reclaimed after 30 s) and run the login again.`,
       ExitCode.ERROR
     );
   });
@@ -15432,7 +15521,7 @@ function registerAuthCommand(program) {
         const profile = await ProfileManager.getProfile(ctx.profile);
         const session = await ProfileManager.getSession(ctx.profile);
         if (session || resolveProfilePosture(profile) !== "delegate-session") throw error;
-        node = await bootstrapDelegatedSession(ctx, imported.delegation);
+        node = (await bootstrapDelegatedSession(ctx, imported.delegation)).node;
       }
       await appendAdditionalDelegation(ctx.profile, storedAdditionalDelegation(
         imported.delegation,
@@ -15757,15 +15846,11 @@ async function importRequestBoundDelegationWithBootstrap(ctx, artifact) {
   }
   const candidate = artifact;
   const delegation = normalizePortableDelegation(candidate.delegation);
+  const bootstrap = await bootstrapDelegatedSession(ctx, delegation);
   try {
-    await bootstrapDelegatedSession(ctx, delegation);
     await importRequestBoundDelegation(ctx, artifact);
   } catch (error) {
-    await ProfileManager.withLock(ctx.profile, async () => {
-      await ProfileManager.clearSession(ctx.profile);
-      await ProfileManager.setProfile(ctx.profile, profile);
-    });
-    throw error;
+    await bootstrap.abandon(error);
   }
 }
 async function importRequestBoundDelegation(ctx, artifact) {
@@ -16079,7 +16164,6 @@ async function rotateAuthKey(profileName, host, options = {}) {
         ExitCode.AUTH_REQUIRED
       );
     }
-    await ProfileManager.clearSession(profileName);
     const result2 = await handleLocalAuth(profileName, host, {
       emitOutput: false,
       forceSessionKey: true
@@ -17643,7 +17727,7 @@ init_errors();
 init_constants();
 init_storage();
 import { randomUUID as randomUUID2 } from "crypto";
-import { lstat, open as open2, readFile as readFile8, rename as rename2, rm as rm3 } from "fs/promises";
+import { lstat as lstat2, open as open2, readFile as readFile8, rename as rename2, rm as rm3 } from "fs/promises";
 import { basename as basename2, dirname as dirname3, join as join5 } from "path";
 import { homedir } from "os";
 import { invokeOperation as invokeOperation2 } from "@tinycloud/operations";
@@ -17817,7 +17901,7 @@ function scopedSecretLoginHint(profileName) {
 }
 async function validateSecretOutput(path) {
   try {
-    const destination = await lstat(path);
+    const destination = await lstat2(path);
     if (!destination.isFile()) {
       throw new CLIError("INVALID_ARGUMENT", `Secret output "${path}" must be a regular file, not a symlink, directory, or device.`, ExitCode.USAGE_ERROR);
     }
@@ -17825,7 +17909,7 @@ async function validateSecretOutput(path) {
     if (!isMissingFileError(error)) throw error;
   }
   try {
-    const parent = await lstat(dirname3(path));
+    const parent = await lstat2(dirname3(path));
     if (!parent.isDirectory()) {
       throw new CLIError("INVALID_ARGUMENT", `Secret output "${path}" requires an existing directory parent.`, ExitCode.USAGE_ERROR);
     }
@@ -27477,7 +27561,7 @@ function receiveJson(result, path) {
 
 // src/share/io.ts
 import { constants } from "fs";
-import { lstat as lstat2, mkdir as mkdir3, mkdtemp, open as open4, readFile as readFile9, realpath, stat as stat2, link, rename as rename3, rm as rm4, unlink } from "fs/promises";
+import { lstat as lstat3, mkdir as mkdir3, mkdtemp, open as open4, readFile as readFile9, realpath, stat as stat2, link, rename as rename3, rm as rm4, unlink } from "fs/promises";
 import { randomBytes as randomBytes4 } from "crypto";
 import { basename as basename3, join as join6, resolve as resolve2, sep } from "path";
 init_errors();
@@ -27535,7 +27619,7 @@ async function assertDirectory(path) {
   for (const segment of segments) {
     current = current === sep ? join6(current, segment) : join6(current, segment);
     try {
-      const info = await lstat2(current);
+      const info = await lstat3(current);
       if (info.isSymbolicLink()) {
         const canonical = await realpath(current);
         if (current !== "/tmp" && current !== "/var") throw new Error("OUTPUT_EXISTS");
@@ -27544,7 +27628,7 @@ async function assertDirectory(path) {
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
       await mkdir3(current, { mode: 448 });
-      const created = await lstat2(current);
+      const created = await lstat3(current);
       if (created.isSymbolicLink() || !created.isDirectory()) throw new Error("OUTPUT_EXISTS");
     }
   }
@@ -27563,7 +27647,7 @@ async function writeShareOutput(directory, filename, bytes, force) {
   };
   await assertStableDirectory();
   const stagingDirectory = await mkdtemp(join6(stableDirectory, ".tinycloud-share-stage-"));
-  const stagingInfo = await lstat2(stagingDirectory);
+  const stagingInfo = await lstat3(stagingDirectory);
   if (!stagingInfo.isDirectory() || (stagingInfo.mode & 511) !== 448) throw new Error("OUTPUT_EXISTS");
   const stagingPath = join6(stagingDirectory, `.tinycloud-share-${randomBytes4(16).toString("hex")}.tmp`);
   let temporaryPath;
@@ -27571,7 +27655,7 @@ async function writeShareOutput(directory, filename, bytes, force) {
   try {
     await assertStableDirectory();
     try {
-      const existing = await lstat2(outputPath);
+      const existing = await lstat3(outputPath);
       if (existing.isSymbolicLink()) throw new Error("UNSAFE_FILENAME");
     } catch (error) {
       if (error.code !== "ENOENT") throw error;