@tinycloud/cli 1.1.0-beta.8 → 1.1.0

package/dist/index.js

@@ -32,7 +32,9 @@ var init_constants = __esm({
       NOT_FOUND: 4,
       PERMISSION_DENIED: 5,
       NETWORK_ERROR: 6,
-      NODE_ERROR: 7
+      NODE_ERROR: 7,
+      /** A write was refused because the owner's TinyCloud storage is full. */
+      STORAGE_FULL: 10
     };
   }
 });
@@ -72,8 +74,14 @@ var init_theme = __esm({
 
 // src/output/formatter.ts
 import ora from "ora";
-function outputError(code3, message, hint) {
-  if (isInteractive()) {
+function warningLine(warnings) {
+  const which = warnings.map((warning) => `${warning.grantCid ?? "unidentified"}: ${warning.reason}`).join(", ");
+  const subject = warnings.length === 1 ? "A stored grant was" : `${warnings.length} stored grants were`;
+  return `${subject} not used (${which}). Approve access again when a command needs it; the old grant expires on its own.`;
+}
+function outputError(code3, message, hint, details = {}) {
+  const { meta, warnings = [] } = details;
+  if (!shouldOutputJson()) {
     process.stderr.write(
       `${theme.error("\u2717")} ${theme.label(code3)}: ${message}
 `
@@ -84,26 +92,127 @@ function outputError(code3, message, hint) {
 `);
       }
     }
+    if (warnings.length > 0) process.stderr.write(`  ${theme.warn(warningLine(warnings))}
+`);
   } else {
     const payload = {
       error: { code: code3, message }
     };
     if (hint) payload.error.hint = hint;
+    if (meta) payload.error.meta = meta;
+    if (warnings.length > 0) payload.error.warnings = warnings;
     process.stderr.write(JSON.stringify(payload, null, 2) + "\n");
   }
 }
+function operationWarnings(value) {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((warning) => {
+    if (warning === null || typeof warning !== "object") return [];
+    const { code: code3, reason, grantCid } = warning;
+    if (typeof code3 !== "string" || !WARNING_CODE.test(code3) || typeof reason !== "string" || !WARNING_REASON.test(reason)) {
+      return [];
+    }
+    return [{ code: code3, reason, ...typeof grantCid === "string" && DELEGATION_CID.test(grantCid) ? { grantCid } : {} }];
+  });
+}
 function isInteractive() {
   return Boolean(process.stdout.isTTY);
 }
-function formatBytes(bytes) {
-  if (bytes < 1024) return `${bytes} B`;
-  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
-  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+function setJsonOutputRequested(requested) {
+  globalThis[JSON_REQUESTED] = requested;
 }
+function shouldOutputJson() {
+  return !isInteractive() || (globalThis[JSON_REQUESTED] ?? process.argv.includes("--json"));
+}
+var WARNING_CODE, WARNING_REASON, DELEGATION_CID, JSON_REQUESTED;
 var init_formatter = __esm({
   "src/output/formatter.ts"() {
     "use strict";
     init_theme();
+    WARNING_CODE = /^[A-Z][A-Z_]{0,63}$/;
+    WARNING_REASON = /^[a-z][a-z_]{0,63}$/;
+    DELEGATION_CID = /^bafkr4i[a-z2-7]{52}$/;
+    JSON_REQUESTED = /* @__PURE__ */ Symbol.for("tinycloud.cli.jsonOutputRequested");
+  }
+});
+
+// src/output/storage.ts
+function storageRejection(error) {
+  let node = error;
+  for (let depth = 0; depth < MAX_CAUSE_DEPTH && typeof node === "object" && node !== null; depth += 1) {
+    const record = node;
+    let code3;
+    if (record.code === "STORAGE_QUOTA_EXCEEDED" || record.code === "STORAGE_LIMIT_REACHED") {
+      code3 = record.code;
+    } else if (record.code !== void 0) {
+      return void 0;
+    } else if (isStorageStatus(record)) {
+      code3 = storageCodeFromText(record.message);
+    }
+    if (code3) {
+      const account = accountTotals(record) ?? accountTotals(record.meta) ?? accountTotals(record.metadata);
+      return account ? { code: code3, account } : { code: code3 };
+    }
+    node = record.cause;
+  }
+  return void 0;
+}
+function describeStorageRejection(rejection, progress) {
+  const reason = rejection.code === "STORAGE_LIMIT_REACHED" ? "This write is larger than the TinyCloud storage you have left" : "TinyCloud storage is full";
+  const message = progress ? `${progress}${reason}.` : `${reason}; nothing was written.`;
+  const { account } = rejection;
+  const totals = account ? `${formatStorageBytes(account.usedBytes)} used of ${formatStorageBytes(account.limitBytes)}${account.plan ? ` (${account.plan} plan)` : ""}. ` : "";
+  return {
+    message,
+    hint: `${totals}Reading still works.
+Free up space or upgrade: ${MANAGE_STORAGE_URL}`
+  };
+}
+function formatStorageBytes(bytes) {
+  const units = ["KiB", "MiB", "GiB", "TiB"];
+  if (bytes < 1024) return `${bytes} B`;
+  let value = bytes / 1024;
+  let unit = 0;
+  while (value >= 1024 && unit < units.length - 1) {
+    value /= 1024;
+    unit += 1;
+  }
+  return `${value.toFixed(1).replace(/\.0$/, "")} ${units[unit]}`;
+}
+function storageCodeFromText(message) {
+  if (typeof message !== "string") return void 0;
+  if (message.includes("larger than the TinyCloud storage you have left")) return "STORAGE_LIMIT_REACHED";
+  if (message.includes("TinyCloud storage is full") || /storage quota exceeded/i.test(message)) {
+    return "STORAGE_QUOTA_EXCEEDED";
+  }
+  return void 0;
+}
+function isStorageStatus(record) {
+  const meta = "meta" in record && typeof record.meta === "object" && record.meta !== null ? record.meta : {};
+  const statuses = [
+    "status" in record ? record.status : void 0,
+    "statusCode" in record ? record.statusCode : void 0,
+    "status" in meta ? meta.status : void 0
+  ];
+  return statuses.some((value) => value === 402 || value === 413);
+}
+function accountTotals(meta) {
+  if (typeof meta !== "object" || meta === null) return void 0;
+  const account = meta.account;
+  if (typeof account !== "object" || account === null) return void 0;
+  const { usedBytes, limitBytes, plan } = account;
+  if (!isByteCount(usedBytes) || !isByteCount(limitBytes) || limitBytes === 0) return void 0;
+  return typeof plan === "string" && /^[A-Za-z0-9][A-Za-z0-9 _.-]{0,31}$/.test(plan) ? { usedBytes, limitBytes, plan } : { usedBytes, limitBytes };
+}
+function isByteCount(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+var MANAGE_STORAGE_URL, MAX_CAUSE_DEPTH;
+var init_storage = __esm({
+  "src/output/storage.ts"() {
+    "use strict";
+    MANAGE_STORAGE_URL = "https://account.tinycloud.xyz/billing";
+    MAX_CAUSE_DEPTH = 4;
   }
 });
 
@@ -111,23 +220,25 @@ var init_formatter = __esm({
 import { readFileSync, readdirSync } from "fs";
 import { join } from "path";
 import { ProfileDeletedError, ProfileLockTimeoutError } from "@tinycloud/operations/state";
+import { authorizationVerdictOf, parseCapabilityResource, SERVICE_LONG_TO_SHORT, validatedCapabilityOf } from "@tinycloud/sdk-core";
 function setActiveProfileName(name) {
   activeProfileName = name;
 }
 function wrapError(error) {
+  const storageFull = storageFullError(error);
+  if (storageFull) return storageFull;
+  if (error instanceof CLIError) return error;
   const message = error instanceof Error ? error.message : String(error);
-  if (message.includes("Missing private key parameter in JWK")) {
-    const profileName = activeProfileName ?? process.env.TC_PROFILE ?? DEFAULT_PROFILE;
-    return new CLIError(
-      "AUTH_REQUIRED",
-      `Profile "${profileName}" cannot restore its session because its private key material is missing.`,
-      ExitCode.AUTH_REQUIRED,
-      {
-        hint: `Sign in again with: tc --profile ${profileName} auth login --method openkey`
-      }
-    );
+  const verdict = authorizationVerdictOf(error);
+  if (verdict === "unauthenticated") {
+    return new CLIError("AUTH_REQUIRED", message, ExitCode.AUTH_REQUIRED);
+  }
+  if (verdict === "forbidden") {
+    return new CLIError("PERMISSION_DENIED", message, ExitCode.PERMISSION_DENIED);
+  }
+  if (verdict === void 0 && message.includes("Missing private key parameter in JWK")) {
+    return missingPrivateKeyError();
   }
-  if (error instanceof CLIError) return error;
   if (error instanceof ProfileLockTimeoutError) {
     return new CLIError(
       "PROFILE_LOCK_TIMEOUT",
@@ -139,13 +250,13 @@ function wrapError(error) {
   if (error instanceof ProfileDeletedError) {
     return new CLIError("PROFILE_NOT_FOUND", message);
   }
-  if (message.includes("Not signed in") || message.includes("AUTH_EXPIRED") || message.includes("Session expired")) {
+  if (verdict === void 0 && (message.includes("Not signed in") || message.includes("AUTH_EXPIRED") || message.includes("Session expired"))) {
     return new CLIError("AUTH_REQUIRED", message, ExitCode.AUTH_REQUIRED);
   }
   if (message.includes("NOT_FOUND") || message.includes("KV_NOT_FOUND")) {
     return new CLIError("NOT_FOUND", message, ExitCode.NOT_FOUND);
   }
-  if (message.includes("PERMISSION_DENIED")) {
+  if (verdict === void 0 && message.includes("PERMISSION_DENIED")) {
     return new CLIError("PERMISSION_DENIED", message, ExitCode.PERMISSION_DENIED);
   }
   if (message.includes("ECONNREFUSED") || message.includes("ETIMEDOUT") || message.includes("fetch failed")) {
@@ -153,39 +264,61 @@ function wrapError(error) {
   }
   return new CLIError("ERROR", message, ExitCode.ERROR);
 }
+function missingPrivateKeyError() {
+  const profileName = activeProfileName ?? process.env.TC_PROFILE ?? DEFAULT_PROFILE;
+  return new CLIError(
+    "AUTH_REQUIRED",
+    `Profile "${profileName}" cannot restore its session because its private key material is missing.`,
+    ExitCode.AUTH_REQUIRED,
+    { hint: `Sign in again with: tc --profile ${profileName} auth login --method openkey` }
+  );
+}
+function storageFullError(error, progress) {
+  if (error instanceof CLIError && error.exitCode === ExitCode.STORAGE_FULL) return error;
+  const rejection = storageRejection(error);
+  if (!rejection) return void 0;
+  const { message, hint } = describeStorageRejection(rejection, progress);
+  return new CLIError(rejection.code, message, ExitCode.STORAGE_FULL, { hint });
+}
 function handleError(error) {
   const cliError = wrapError(error);
   const prebuilt = typeof cliError.metadata?.hint === "string" ? cliError.metadata.hint : void 0;
   const hint = prebuilt ?? buildAuthHint(cliError) ?? (cliError.code === "NETWORK_ERROR" ? buildNetworkHint() : void 0);
-  outputError(cliError.code, cliError.message, hint);
+  const authMeta = cliError.code === "AUTH_REQUIRED" || cliError.code === "PERMISSION_DENIED" ? cliError.metadata : void 0;
+  const meta = {};
+  if (cliError.status !== void 0 && authMeta !== void 0) meta.status = cliError.status;
+  const capability = validatedCapabilityOf({ meta: authMeta });
+  if (capability) {
+    meta.resource = capability.resource;
+    meta.requiredAction = capability.requiredAction;
+  }
+  outputError(cliError.code, cliError.message, hint, {
+    ...Object.keys(meta).length ? { meta } : {},
+    warnings: operationWarnings(cliError.metadata?.warnings)
+  });
   process.exit(cliError.exitCode);
 }
 function buildAuthHint(error) {
-  const resource = error.metadata?.resource;
-  const requiredAction = error.metadata?.requiredAction;
-  if (typeof resource !== "string" || typeof requiredAction !== "string") {
-    return void 0;
-  }
-  const spec = capSpecFromAuthMeta(resource, requiredAction);
+  const capability = validatedCapabilityOf({ meta: error.metadata });
+  if (!capability) return void 0;
+  const spec = capSpecFromAuthMeta(capability.resource, capability.requiredAction);
   if (!spec) return void 0;
   return [
     "The active session is missing a TinyCloud capability.",
-    `Request it with: tc auth request --cap "${spec}"`,
+    `Request it with: tc auth request --cap '${spec.replaceAll("'", "'\\''")}'`,
     "Then retry the original command."
   ].join("\n");
 }
 function capSpecFromAuthMeta(resource, action) {
-  const slash = resource.indexOf("/");
-  if (slash <= 0 || slash === resource.length - 1) return void 0;
-  const spaceUri = resource.slice(0, slash);
-  const rest = resource.slice(slash + 1);
-  const nextSlash = rest.indexOf("/");
-  if (nextSlash <= 0) return void 0;
-  const serviceShort = rest.slice(0, nextSlash);
-  const path = rest.slice(nextSlash + 1);
-  const actionName = action.includes("/") ? action.slice(action.indexOf("/") + 1) : action;
-  const spaceName = spaceUri.startsWith("tinycloud:") ? spaceUri.slice(spaceUri.lastIndexOf(":") + 1) : spaceUri;
-  return `tinycloud.${serviceShort}:${spaceName}:${path}:${actionName}`;
+  const slash = action.indexOf("/");
+  if (slash < 0) return void 0;
+  const longService = action.slice(0, slash);
+  const serviceShort = SERVICE_LONG_TO_SHORT[longService];
+  if (!serviceShort) return void 0;
+  const parsed = parseCapabilityResource(resource, serviceShort);
+  if (!parsed) return void 0;
+  const spaceName = parsed.space.slice(parsed.space.lastIndexOf(":") + 1);
+  return `${longService}:${spaceName}:${parsed.path}:${action.slice(slash + 1)}`;
 }
 function buildNetworkHint() {
   const readHost = (name) => {
@@ -232,6 +365,7 @@ var init_errors = __esm({
     "use strict";
     init_constants();
     init_formatter();
+    init_storage();
     CLIError = class extends Error {
       constructor(code3, message, exitCode = ExitCode.ERROR, metadata) {
         super(message);
@@ -239,7 +373,9 @@ var init_errors = __esm({
         this.exitCode = exitCode;
         this.metadata = metadata;
         this.name = "CLIError";
+        if (typeof metadata?.status === "number" && Number.isInteger(metadata.status) && metadata.status >= 400 && metadata.status <= 599) this.status = metadata.status;
       }
+      status;
     };
   }
 });
@@ -297,7 +433,7 @@ async function listDirs(dirPath) {
   }
 }
 var PRIVATE_FILE_MODE, PRIVATE_DIR_MODE;
-var init_storage = __esm({
+var init_storage2 = __esm({
   "src/config/storage.ts"() {
     "use strict";
     PRIVATE_FILE_MODE = 384;
@@ -555,7 +691,7 @@ var init_profiles = __esm({
   "src/config/profiles.ts"() {
     "use strict";
     init_constants();
-    init_storage();
+    init_storage2();
     init_errors();
     ProfileManager = class _ProfileManager {
       // ── Initialization ──────────────────────────────────────────────────
@@ -625,7 +761,7 @@ var init_profiles = __esm({
         if (!profile) {
           throw new CLIError(
             "PROFILE_NOT_FOUND",
-            `Profile "${name}" does not exist. Run \`tc init\` or \`tc profile create ${name}\` first.`
+            `Profile "${name}" does not exist. Create it with \`tc init --name ${name}\`.`
           );
         }
         return profile;
@@ -5636,6 +5772,37 @@ var init_zod = __esm({
   }
 });
 
+// src/auth/session-expired.ts
+function signInAgainHint(profileName, posture) {
+  if (posture === "local-owner-key") {
+    return `Sign in again with: tc --profile ${profileName} auth login --method local`;
+  }
+  if (posture === "delegate-session") {
+    return `Have the owner approve a new scoped login: tc --profile ${profileName} auth login --method openkey --paste --manifest <manifest.json>. Pass the owner's code on stdin, newline-terminated.`;
+  }
+  return `Sign in again with: tc --profile ${profileName} auth login --method openkey`;
+}
+function sessionExpiredError(profileName, posture) {
+  return new CLIError(
+    "AUTH_REQUIRED",
+    `The session for profile "${profileName}" has expired or is no longer valid.`,
+    ExitCode.AUTH_REQUIRED,
+    { hint: signInAgainHint(profileName, posture), reason: SESSION_EXPIRED_REASON }
+  );
+}
+function isSessionExpiredError(error) {
+  return error instanceof CLIError && error.metadata?.reason === SESSION_EXPIRED_REASON;
+}
+var SESSION_EXPIRED_REASON;
+var init_session_expired = __esm({
+  "src/auth/session-expired.ts"() {
+    "use strict";
+    init_constants();
+    init_errors();
+    SESSION_EXPIRED_REASON = "session_expired";
+  }
+});
+
 // src/lib/raw-encryption.ts
 var init_raw_encryption = __esm({
   "src/lib/raw-encryption.ts"() {
@@ -5698,13 +5865,14 @@ async function replayAdditionalDelegations(node, profile, options) {
   for (const stored of entries) {
     const kind = storedDelegationKind(stored);
     if (kind === "compact" || kind === "signed-login") {
-      const installed = await replayStoredDelegation(activator, stored, {
+      const replay = await replayStoredDelegation(activator, stored, {
         host: options.host,
         migrated,
         resolveSpace
       });
-      if (installed === void 0 && process.env.TC_DEBUG_REPLAY === "1") {
-        process.stderr.write("[replay] skipping a stored delegation refused by validation or its request binding\n");
+      if (replay.status === "skipped" && process.env.TC_DEBUG_REPLAY === "1") {
+        process.stderr.write(`[replay] skipping a stored delegation: ${replay.reason}
+`);
       }
       continue;
     }
@@ -5735,7 +5903,7 @@ var init_permissions = __esm({
   "src/lib/permissions.ts"() {
     "use strict";
     init_constants();
-    init_storage();
+    init_storage2();
     init_profiles();
     init_errors();
     init_constants();
@@ -5782,6 +5950,16 @@ function signerJwkForProfile(profileName, sessionJwk, key) {
     }
   );
 }
+async function restoreProfileSession(node, profileName, profile, sessionData) {
+  try {
+    await node.restoreSession(sessionData);
+  } catch (error) {
+    if (typeof error === "object" && error !== null && "code" in error && error.code === "AUTH_EXPIRED") {
+      throw sessionExpiredError(profileName, profile === null ? void 0 : resolveProfilePosture(profile));
+    }
+    throw error;
+  }
+}
 async function createSDKInstance(ctx, options) {
   const profile = options?.privateKey ? await ProfileManager.getProfile(ctx.profile).catch(() => null) : await ProfileManager.getProfile(ctx.profile);
   const session = await ProfileManager.getSession(ctx.profile);
@@ -5790,7 +5968,7 @@ async function createSDKInstance(ctx, options) {
   if (!key && !effectivePrivateKey && !(profile?.authMethod === "openkey" && session !== null)) {
     throw new CLIError(
       "AUTH_REQUIRED",
-      `No key found for profile "${ctx.profile}". Run \`tc init\` first.`,
+      `No key found for profile "${ctx.profile}". Run \`tc --profile ${ctx.profile} auth rotate\` to create a new key and sign in.`,
       ExitCode.AUTH_REQUIRED
     );
   }
@@ -5801,7 +5979,7 @@ async function createSDKInstance(ctx, options) {
     });
     let restoredOwnSession2 = false;
     if (session && session.delegationHeader && session.delegationCid && session.spaceId) {
-      await node2.restoreSession({
+      await restoreProfileSession(node2, ctx.profile, profile, {
         delegationHeader: session.delegationHeader,
         delegationCid: session.delegationCid,
         spaceId: session.spaceId,
@@ -5831,7 +6009,7 @@ async function createSDKInstance(ctx, options) {
   if (options?.privateKey) {
     await node.signIn();
   } else if (session && session.delegationHeader && session.delegationCid && session.spaceId) {
-    await node.restoreSession({
+    await restoreProfileSession(node, ctx.profile, profile, {
       delegationHeader: session.delegationHeader,
       delegationCid: session.delegationCid,
       spaceId: session.spaceId,
@@ -5975,6 +6153,7 @@ var init_sdk = __esm({
     init_errors();
     init_constants();
     init_permissions();
+    init_session_expired();
     BOOTSTRAP_PROFILE_FIELDS = ["sessionDid", "spaceId"];
   }
 });
@@ -6073,7 +6252,7 @@ function formatBannerLine(version2) {
 }
 function emitBanner(version2) {
   if (bannerEmitted) return;
-  if (!isInteractive()) return;
+  if (shouldOutputJson()) return;
   if (process.env.TC_HIDE_BANNER === "1") return;
   bannerEmitted = true;
   process.stderr.write(formatBannerLine(version2) + "\n\n");
@@ -15019,7 +15198,6 @@ async function notifyShare(input) {
     };
   }
   let attempts = 0;
-  let lastError;
   while (attempts < attemptsLimit) {
     if (input.signal?.aborted) throw new ShareNotifyError("share delivery was cancelled");
     attempts += 1;
@@ -15046,10 +15224,19 @@ async function notifyShare(input) {
           reason: "delivery-window-expired"
         };
       }
-      lastError = error;
+      if (error !== null && typeof error === "object" && "status" in error && (error.status === 401 || error.status === 403)) {
+        return {
+          protocol: "tinycloud-share",
+          version: 1,
+          shareId: input.shareId,
+          state: "partial-failure",
+          idempotencyKey,
+          attempts,
+          retryable: false
+        };
+      }
     }
   }
-  void lastError;
   return { protocol: "tinycloud-share", version: 1, shareId: input.shareId, state: "partial-failure", idempotencyKey, attempts, retryable: true };
 }
 async function defaultIdempotencyKey(shareId, recipient) {
@@ -16676,7 +16863,6 @@ function parseDuration(input) {
 }
 
 // src/commands/share.ts
-init_formatter();
 init_errors();
 
 // src/share/output.ts
@@ -16942,9 +17128,8 @@ function shareCliError(error, operation = "publish") {
     if (failure.kind === "registry-rejected") {
       return new CLIError("REGISTRY_REJECTED", "the TinyCloud location registry rejected this session's location record, so nothing was shared; retrying will not help. Log in again, and report the problem if it persists", 6);
     }
-    if (failure.kind === "storage-quota-exceeded") {
-      const sizes = failure.usedBytes === void 0 || failure.limitBytes === void 0 ? "" : ` (${formatBytes(failure.usedBytes)} used of ${formatBytes(failure.limitBytes)} limit)`;
-      return new CLIError("STORAGE_QUOTA_EXCEEDED", `storage quota exceeded${sizes}; nothing was shared`, 4);
+    if (failure.kind === "storage-full") {
+      return storageFullError(failure);
     }
     if (failure.kind === "upload-failed") {
       return new CLIError("UPLOAD_FAILED", "share source upload failed; nothing was shared", 4);
@@ -16964,6 +17149,8 @@ function shareCliError(error, operation = "publish") {
     const code3 = error.code === "fetch-failed" ? "NOT_FOUND" : error.code.replaceAll("-", "_").toUpperCase();
     return new CLIError(code3, error.message, exit);
   }
+  const storageFull = storageFullError(error);
+  if (storageFull) return storageFull;
   const message = error instanceof Error ? error.message : String(error);
   const nodeCode = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
   const known = {
@@ -17257,8 +17444,10 @@ function registerShareCommand(program2) {
 }
 
 // src/share/adapters.ts
+init_storage();
 init_profiles();
 init_constants();
+init_session_expired();
 import { readFile as readFile4 } from "fs/promises";
 import { join as join6 } from "path";
 import { createHash } from "crypto";
@@ -17270,15 +17459,9 @@ function requiredKvAction(meta) {
   const action = meta.requiredAction;
   return action === "tinycloud.kv/put" || action === "tinycloud.kv/get" ? action : void 0;
 }
-function isByteCount(value) {
-  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
-}
 function throwKvUploadFailure(error) {
-  if (typeof error === "object" && error !== null && "code" in error && error.code === "STORAGE_QUOTA_EXCEEDED") {
-    const meta = "meta" in error && typeof error.meta === "object" && error.meta !== null ? error.meta : {};
-    const { usedBytes, limitBytes } = meta;
-    throw new SharePublishAuthorityError(isByteCount(usedBytes) && isByteCount(limitBytes) ? { kind: "storage-quota-exceeded", usedBytes, limitBytes } : { kind: "storage-quota-exceeded" });
-  }
+  const rejection = storageRejection(error);
+  if (rejection) throw new SharePublishAuthorityError({ kind: "storage-full", ...rejection });
   throw new SharePublishAuthorityError({ kind: "upload-failed" });
 }
 var DEFAULT_SHARE_ORIGIN = "https://share.tinycloud.xyz";
@@ -17577,7 +17760,7 @@ function createShareAuthorityAdapters(input = {}) {
     } catch (error) {
       const profileConfig = await ProfileManager.getProfile(profile).catch(() => void 0);
       const code3 = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
-      if (error instanceof InvalidRestoredSessionError || code3 === "AUTH_EXPIRED") {
+      if (error instanceof InvalidRestoredSessionError || code3 === "AUTH_EXPIRED" || isSessionExpiredError(error)) {
         throw new SharePublishAuthorityError({
           kind: "owner-space-unresolved",
           localKey: profileConfig?.authMethod === "local",
@@ -17939,6 +18122,7 @@ function selectedShareProfile() {
 program.name("tc").description("TinyCloud CLI \u2014 self-sovereign storage from the terminal").version(version).option("-p, --profile <name>", "Profile to use").option("-H, --host <url>", "TinyCloud node URL").option("-v, --verbose", "Enable verbose output").option("--no-cache", "Disable caching").option("-q, --quiet", "Suppress non-essential output").option("--json", "Force JSON output");
 program.hook("preAction", async (thisCommand) => {
   const opts = thisCommand.optsWithGlobals();
+  setJsonOutputRequested(opts.json === true);
   const parentName = thisCommand.parent?.name();
   const isShareCommand = parentName === "share" || thisCommand.name() === "share";
   if (!opts.quiet && !isShareCommand) {
@@ -17947,7 +18131,7 @@ program.hook("preAction", async (thisCommand) => {
   const commandName = thisCommand.name();
   const fullCommand = parentName && parentName !== "tc" ? `${parentName} ${commandName}` : commandName;
   const skipGuard = ["tc", "init", "doctor", "completion", "help", "upgrade", "status"].includes(commandName) || fullCommand === "profile create";
-  if (!skipGuard && !opts.quiet && isInteractive()) {
+  if (!skipGuard && !opts.quiet && !shouldOutputJson()) {
     try {
       const config = await ProfileManager.getConfig();
       const profileName = opts.profile || config.defaultProfile;