@tinycloud/cli 1.1.0-beta.9 → 1.2.0-beta.0

package/dist/index.js

@@ -32,7 +32,9 @@ var init_constants = __esm({
       NOT_FOUND: 4,
       PERMISSION_DENIED: 5,
       NETWORK_ERROR: 6,
-      NODE_ERROR: 7
+      NODE_ERROR: 7,
+      /** A write was refused because the owner's TinyCloud storage is full. */
+      STORAGE_FULL: 10
     };
   }
 });
@@ -70,10 +72,55 @@ var init_theme = __esm({
   }
 });
 
+// src/output/warnings.ts
+function warningKey(warning) {
+  return JSON.stringify([warning.code, warning.reason, warning.grantCid ?? null]);
+}
+function mergeWarnings(first, second) {
+  const merged = [...first];
+  const counts = /* @__PURE__ */ new Map();
+  for (const warning of first) {
+    const key = warningKey(warning);
+    counts.set(key, (counts.get(key) ?? 0) + 1);
+  }
+  const seen = /* @__PURE__ */ new Map();
+  for (const warning of second) {
+    const key = warningKey(warning);
+    const occurrence = (seen.get(key) ?? 0) + 1;
+    seen.set(key, occurrence);
+    if (occurrence > (counts.get(key) ?? 0)) merged.push(warning);
+  }
+  return merged;
+}
+function recordWarnings(warnings) {
+  if (warnings.length === 0) return;
+  const holder = globalThis;
+  holder[PENDING_WARNINGS] = mergeWarnings(holder[PENDING_WARNINGS] ?? [], warnings);
+}
+function drainWarnings() {
+  const holder = globalThis;
+  const warnings = holder[PENDING_WARNINGS] ?? [];
+  delete holder[PENDING_WARNINGS];
+  return warnings;
+}
+var PENDING_WARNINGS;
+var init_warnings = __esm({
+  "src/output/warnings.ts"() {
+    "use strict";
+    PENDING_WARNINGS = /* @__PURE__ */ Symbol.for("tinycloud.cli.pendingWarnings.v1");
+  }
+});
+
 // src/output/formatter.ts
 import ora from "ora";
-function outputError(code3, message, hint, meta) {
-  if (isInteractive()) {
+function warningLine(warnings) {
+  const which = warnings.map((warning) => `${warning.grantCid ?? "unidentified"}: ${warning.reason}`).join(", ");
+  const subject = warnings.length === 1 ? "A stored grant was" : `${warnings.length} stored grants were`;
+  return `${subject} not used (${which}). Approve access again when a command needs it; remove the old grant with tc auth grants remove <cid>.`;
+}
+function outputError(code3, message, hint, details = {}) {
+  const { meta, warnings = [] } = details;
+  if (!shouldOutputJson()) {
     process.stderr.write(
       `${theme.error("\u2717")} ${theme.label(code3)}: ${message}
 `
@@ -84,27 +131,135 @@ function outputError(code3, message, hint, meta) {
 `);
       }
     }
+    if (warnings.length > 0) process.stderr.write(`  ${theme.warn("!")} ${warningLine(warnings)}
+`);
   } else {
     const payload = {
       error: { code: code3, message }
     };
     if (hint) payload.error.hint = hint;
     if (meta) payload.error.meta = meta;
+    if (warnings.length > 0) payload.error.warnings = warnings;
     process.stderr.write(JSON.stringify(payload, null, 2) + "\n");
   }
 }
+function outputWarnings(warnings) {
+  const combined = mergeWarnings(drainWarnings(), operationWarnings(warnings));
+  if (combined.length === 0) return;
+  process.stderr.write(shouldOutputJson() ? `${JSON.stringify({ warnings: combined })}
+` : `${theme.warn("!")} ${warningLine(combined)}
+`);
+}
+function operationWarnings(value) {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((warning) => {
+    if (warning === null || typeof warning !== "object") return [];
+    const { code: code3, reason, grantCid } = warning;
+    if (typeof code3 !== "string" || !WARNING_CODE.test(code3) || typeof reason !== "string" || !WARNING_REASON.test(reason)) {
+      return [];
+    }
+    return [{ code: code3, reason, ...typeof grantCid === "string" && DELEGATION_CID.test(grantCid) ? { grantCid } : {} }];
+  });
+}
 function isInteractive() {
   return Boolean(process.stdout.isTTY);
 }
-function formatBytes(bytes) {
-  if (bytes < 1024) return `${bytes} B`;
-  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
-  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+function setJsonOutputRequested(requested) {
+  globalThis[JSON_REQUESTED] = requested;
+}
+function shouldOutputJson() {
+  return !isInteractive() || (globalThis[JSON_REQUESTED] ?? process.argv.includes("--json"));
 }
+var WARNING_CODE, WARNING_REASON, DELEGATION_CID, JSON_REQUESTED;
 var init_formatter = __esm({
   "src/output/formatter.ts"() {
     "use strict";
     init_theme();
+    init_warnings();
+    WARNING_CODE = /^[A-Z][A-Z_]{0,63}$/;
+    WARNING_REASON = /^[a-z][a-z_]{0,63}$/;
+    DELEGATION_CID = /^bafkr4i[a-z2-7]{52}$/;
+    JSON_REQUESTED = /* @__PURE__ */ Symbol.for("tinycloud.cli.jsonOutputRequested");
+  }
+});
+
+// src/output/storage.ts
+function storageRejection(error) {
+  let node = error;
+  for (let depth = 0; depth < MAX_CAUSE_DEPTH && typeof node === "object" && node !== null; depth += 1) {
+    const record = node;
+    let code3;
+    if (record.code === "STORAGE_QUOTA_EXCEEDED" || record.code === "STORAGE_LIMIT_REACHED") {
+      code3 = record.code;
+    } else if (record.code !== void 0) {
+      return void 0;
+    } else if (isStorageStatus(record)) {
+      code3 = storageCodeFromText(record.message);
+    }
+    if (code3) {
+      const account = accountTotals(record) ?? accountTotals(record.meta) ?? accountTotals(record.metadata);
+      return account ? { code: code3, account } : { code: code3 };
+    }
+    node = record.cause;
+  }
+  return void 0;
+}
+function describeStorageRejection(rejection, progress) {
+  const reason = rejection.code === "STORAGE_LIMIT_REACHED" ? "This write is larger than the TinyCloud storage you have left" : "TinyCloud storage is full";
+  const message = progress ? `${progress}${reason}.` : `${reason}; nothing was written.`;
+  const { account } = rejection;
+  const totals = account ? `${formatStorageBytes(account.usedBytes)} used of ${formatStorageBytes(account.limitBytes)}${account.plan ? ` (${account.plan} plan)` : ""}. ` : "";
+  return {
+    message,
+    hint: `${totals}Reading still works.
+Free up space or upgrade: ${MANAGE_STORAGE_URL}`
+  };
+}
+function formatStorageBytes(bytes) {
+  const units = ["KiB", "MiB", "GiB", "TiB"];
+  if (bytes < 1024) return `${bytes} B`;
+  let value = bytes / 1024;
+  let unit = 0;
+  while (value >= 1024 && unit < units.length - 1) {
+    value /= 1024;
+    unit += 1;
+  }
+  return `${value.toFixed(1).replace(/\.0$/, "")} ${units[unit]}`;
+}
+function storageCodeFromText(message) {
+  if (typeof message !== "string") return void 0;
+  if (message.includes("larger than the TinyCloud storage you have left")) return "STORAGE_LIMIT_REACHED";
+  if (message.includes("TinyCloud storage is full") || /storage quota exceeded/i.test(message)) {
+    return "STORAGE_QUOTA_EXCEEDED";
+  }
+  return void 0;
+}
+function isStorageStatus(record) {
+  const meta = "meta" in record && typeof record.meta === "object" && record.meta !== null ? record.meta : {};
+  const statuses = [
+    "status" in record ? record.status : void 0,
+    "statusCode" in record ? record.statusCode : void 0,
+    "status" in meta ? meta.status : void 0
+  ];
+  return statuses.some((value) => value === 402 || value === 413);
+}
+function accountTotals(meta) {
+  if (typeof meta !== "object" || meta === null) return void 0;
+  const account = meta.account;
+  if (typeof account !== "object" || account === null) return void 0;
+  const { usedBytes, limitBytes, plan } = account;
+  if (!isByteCount(usedBytes) || !isByteCount(limitBytes) || limitBytes === 0) return void 0;
+  return typeof plan === "string" && /^[A-Za-z0-9][A-Za-z0-9 _.-]{0,31}$/.test(plan) ? { usedBytes, limitBytes, plan } : { usedBytes, limitBytes };
+}
+function isByteCount(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+var MANAGE_STORAGE_URL, MAX_CAUSE_DEPTH;
+var init_storage = __esm({
+  "src/output/storage.ts"() {
+    "use strict";
+    MANAGE_STORAGE_URL = "https://account.tinycloud.xyz/billing";
+    MAX_CAUSE_DEPTH = 4;
   }
 });
 
@@ -117,6 +272,8 @@ function setActiveProfileName(name) {
   activeProfileName = name;
 }
 function wrapError(error) {
+  const storageFull = storageFullError(error);
+  if (storageFull) return storageFull;
   if (error instanceof CLIError) return error;
   const message = error instanceof Error ? error.message : String(error);
   const verdict = authorizationVerdictOf(error);
@@ -163,19 +320,32 @@ function missingPrivateKeyError() {
     { hint: `Sign in again with: tc --profile ${profileName} auth login --method openkey` }
   );
 }
+function storageFullError(error, progress) {
+  if (error instanceof CLIError && error.exitCode === ExitCode.STORAGE_FULL) return error;
+  const rejection = storageRejection(error);
+  if (!rejection) return void 0;
+  const { message, hint } = describeStorageRejection(rejection, progress);
+  return new CLIError(rejection.code, message, ExitCode.STORAGE_FULL, { hint });
+}
 function handleError(error) {
   const cliError = wrapError(error);
   const prebuilt = typeof cliError.metadata?.hint === "string" ? cliError.metadata.hint : void 0;
   const hint = prebuilt ?? buildAuthHint(cliError) ?? (cliError.code === "NETWORK_ERROR" ? buildNetworkHint() : void 0);
   const authMeta = cliError.code === "AUTH_REQUIRED" || cliError.code === "PERMISSION_DENIED" ? cliError.metadata : void 0;
   const meta = {};
+  if (cliError.code === "GRANT_REVOKED_LOCAL_REMOVE_FAILED" && typeof cliError.metadata?.causeCode === "string" && /^[A-Z][A-Z0-9_]{0,63}$/.test(cliError.metadata.causeCode)) {
+    meta.causeCode = cliError.metadata.causeCode;
+  }
   if (cliError.status !== void 0 && authMeta !== void 0) meta.status = cliError.status;
   const capability = validatedCapabilityOf({ meta: authMeta });
   if (capability) {
     meta.resource = capability.resource;
     meta.requiredAction = capability.requiredAction;
   }
-  outputError(cliError.code, cliError.message, hint, Object.keys(meta).length ? meta : void 0);
+  outputError(cliError.code, cliError.message, hint, {
+    ...Object.keys(meta).length ? { meta } : {},
+    warnings: mergeWarnings(drainWarnings(), operationWarnings(cliError.metadata?.warnings))
+  });
   process.exit(cliError.exitCode);
 }
 function buildAuthHint(error) {
@@ -245,6 +415,8 @@ var init_errors = __esm({
     "use strict";
     init_constants();
     init_formatter();
+    init_storage();
+    init_warnings();
     CLIError = class extends Error {
       constructor(code3, message, exitCode = ExitCode.ERROR, metadata) {
         super(message);
@@ -312,7 +484,7 @@ async function listDirs(dirPath) {
   }
 }
 var PRIVATE_FILE_MODE, PRIVATE_DIR_MODE;
-var init_storage = __esm({
+var init_storage2 = __esm({
   "src/config/storage.ts"() {
     "use strict";
     PRIVATE_FILE_MODE = 384;
@@ -570,7 +742,7 @@ var init_profiles = __esm({
   "src/config/profiles.ts"() {
     "use strict";
     init_constants();
-    init_storage();
+    init_storage2();
     init_errors();
     ProfileManager = class _ProfileManager {
       // ── Initialization ──────────────────────────────────────────────────
@@ -640,7 +812,7 @@ var init_profiles = __esm({
         if (!profile) {
           throw new CLIError(
             "PROFILE_NOT_FOUND",
-            `Profile "${name}" does not exist. Run \`tc init\` or \`tc profile create ${name}\` first.`
+            `Profile "${name}" does not exist. Create it with \`tc init --name ${name}\`.`
           );
         }
         return profile;
@@ -5651,6 +5823,37 @@ var init_zod = __esm({
   }
 });
 
+// src/auth/session-expired.ts
+function signInAgainHint(profileName, posture) {
+  if (posture === "local-owner-key") {
+    return `Sign in again with: tc --profile ${profileName} auth login --method local`;
+  }
+  if (posture === "delegate-session") {
+    return `Have the owner approve a new scoped login: tc --profile ${profileName} auth login --method openkey --paste --manifest <manifest.json>. Pass the owner's code on stdin, newline-terminated.`;
+  }
+  return `Sign in again with: tc --profile ${profileName} auth login --method openkey`;
+}
+function sessionExpiredError(profileName, posture) {
+  return new CLIError(
+    "AUTH_REQUIRED",
+    `The session for profile "${profileName}" has expired or is no longer valid.`,
+    ExitCode.AUTH_REQUIRED,
+    { hint: signInAgainHint(profileName, posture), reason: SESSION_EXPIRED_REASON }
+  );
+}
+function isSessionExpiredError(error) {
+  return error instanceof CLIError && error.metadata?.reason === SESSION_EXPIRED_REASON;
+}
+var SESSION_EXPIRED_REASON;
+var init_session_expired = __esm({
+  "src/auth/session-expired.ts"() {
+    "use strict";
+    init_constants();
+    init_errors();
+    SESSION_EXPIRED_REASON = "session_expired";
+  }
+});
+
 // src/lib/raw-encryption.ts
 var init_raw_encryption = __esm({
   "src/lib/raw-encryption.ts"() {
@@ -5693,64 +5896,20 @@ import {
   withProfileLock as withProfileLock2,
   writeJsonAtomic
 } from "@tinycloud/operations/state";
-async function loadAdditionalDelegations(profile) {
-  return readAdditionalDelegations(profile);
-}
 async function replayAdditionalDelegations(node, profile, options) {
-  const {
-    operationSpaceResolver,
-    prepareStoredDelegationReplay,
-    replayStoredDelegation,
-    storedDelegationKind
-  } = await import("@tinycloud/operations/delegation-binding");
-  const activator = node;
-  const migrated = await prepareStoredDelegationReplay(profile, activator, {
+  const { operationSpaceResolver, replayProfileDelegations } = await import("@tinycloud/operations/delegation-binding");
+  const { warnings } = await replayProfileDelegations(profile, node, {
     host: options.host,
-    migrate: options.migrate
+    migrate: options.migrate,
+    resolveSpace: operationSpaceResolver(node, options.ownerSpace)
   });
-  const resolveSpace = operationSpaceResolver(node, options.ownerSpace);
-  const entries = await loadAdditionalDelegations(profile);
-  for (const stored of entries) {
-    const kind = storedDelegationKind(stored);
-    if (kind === "compact" || kind === "signed-login") {
-      const installed = await replayStoredDelegation(activator, stored, {
-        host: options.host,
-        migrated,
-        resolveSpace
-      });
-      if (installed === void 0 && process.env.TC_DEBUG_REPLAY === "1") {
-        process.stderr.write("[replay] skipping a stored delegation refused by validation or its request binding\n");
-      }
-      continue;
-    }
-    if (kind === "refused") {
-      if (process.env.TC_DEBUG_REPLAY === "1") {
-        process.stderr.write("[replay] skipping a malformed stored record or one bound to a request it cannot be held to\n");
-      }
-      continue;
-    }
-    const entry = stored;
-    const expiry = entry.delegation.expiry instanceof Date ? entry.delegation.expiry : new Date(entry.delegation.expiry);
-    if (expiry.getTime() <= Date.now()) continue;
-    try {
-      await node.useRuntimeDelegation({
-        ...entry.delegation,
-        delegationHeader: { Authorization: entry.delegation.delegationHeader.Authorization },
-        expiry
-      });
-    } catch (err) {
-      if (process.env.TC_DEBUG_REPLAY === "1") {
-        process.stderr.write(`[replay] skipping ${entry.delegation.cid}: ${err.message}
-`);
-      }
-    }
-  }
+  return warnings;
 }
 var init_permissions = __esm({
   "src/lib/permissions.ts"() {
     "use strict";
     init_constants();
-    init_storage();
+    init_storage2();
     init_profiles();
     init_errors();
     init_constants();
@@ -5769,6 +5928,7 @@ __export(sdk_exports, {
   createSDKInstance: () => createSDKInstance,
   ensureAuthenticated: () => ensureAuthenticated,
   jwkHasPrivateParameter: () => jwkHasPrivateParameter,
+  restoreProfileSessionNode: () => restoreProfileSessionNode,
   selectSignerJwk: () => selectSignerJwk
 });
 import { TinyCloudNode } from "@tinycloud/node-sdk";
@@ -5797,6 +5957,54 @@ function signerJwkForProfile(profileName, sessionJwk, key) {
     }
   );
 }
+async function restoreProfileSession(node, profileName, profile, sessionData) {
+  try {
+    await node.restoreSession(sessionData);
+  } catch (error) {
+    if (typeof error === "object" && error !== null && "code" in error && error.code === "AUTH_EXPIRED") {
+      throw sessionExpiredError(profileName, profile === null ? void 0 : resolveProfilePosture(profile));
+    }
+    throw error;
+  }
+}
+function persistedSessionData(profileName, profile, session, key) {
+  return {
+    delegationHeader: session.delegationHeader,
+    delegationCid: session.delegationCid,
+    spaceId: session.spaceId,
+    jwk: signerJwkForProfile(profileName, session.jwk, key),
+    verificationMethod: session.verificationMethod ?? profile.sessionDid ?? profile.did,
+    address: session.address,
+    chainId: session.chainId,
+    siwe: session.siwe,
+    signature: session.signature
+  };
+}
+async function restoreProfileSessionNode(ctx) {
+  const profile = await ProfileManager.getProfile(ctx.profile);
+  const session = await ProfileManager.getSession(ctx.profile);
+  if (!session) return { unavailable: "session_missing" };
+  if (typeof session.delegationCid !== "string" || typeof session.spaceId !== "string" || session.delegationHeader === null || typeof session.delegationHeader !== "object" || !("Authorization" in session.delegationHeader) || typeof session.delegationHeader.Authorization !== "string") {
+    return { unavailable: "session_invalid" };
+  }
+  if (typeof session.expiresAt === "string" && Date.parse(session.expiresAt) <= Date.now()) {
+    return { unavailable: "session_expired" };
+  }
+  const key = await ProfileManager.getKey(ctx.profile);
+  try {
+    const node = new TinyCloudNode({
+      host: ctx.host,
+      ...profile.authMethod === "local" && profile.privateKey ? { privateKey: profile.privateKey } : {}
+    });
+    await restoreProfileSession(node, ctx.profile, profile, persistedSessionData(ctx.profile, profile, session, key));
+    return { node };
+  } catch (error) {
+    if (error instanceof CLIError && error.metadata?.reason === "session_expired") {
+      return { unavailable: "session_expired" };
+    }
+    return { unavailable: "session_invalid" };
+  }
+}
 async function createSDKInstance(ctx, options) {
   const profile = options?.privateKey ? await ProfileManager.getProfile(ctx.profile).catch(() => null) : await ProfileManager.getProfile(ctx.profile);
   const session = await ProfileManager.getSession(ctx.profile);
@@ -5805,7 +6013,7 @@ async function createSDKInstance(ctx, options) {
   if (!key && !effectivePrivateKey && !(profile?.authMethod === "openkey" && session !== null)) {
     throw new CLIError(
       "AUTH_REQUIRED",
-      `No key found for profile "${ctx.profile}". Run \`tc init\` first.`,
+      `No key found for profile "${ctx.profile}". Run \`tc --profile ${ctx.profile} auth rotate\` to create a new key and sign in.`,
       ExitCode.AUTH_REQUIRED
     );
   }
@@ -5814,56 +6022,35 @@ async function createSDKInstance(ctx, options) {
       host: ctx.host,
       privateKey: effectivePrivateKey
     });
-    let restoredOwnSession2 = false;
-    if (session && session.delegationHeader && session.delegationCid && session.spaceId) {
-      await node2.restoreSession({
-        delegationHeader: session.delegationHeader,
-        delegationCid: session.delegationCid,
-        spaceId: session.spaceId,
-        jwk: signerJwkForProfile(ctx.profile, session.jwk, key),
-        verificationMethod: session.verificationMethod ?? profile?.sessionDid ?? profile?.did,
-        address: session.address,
-        chainId: session.chainId,
-        siwe: session.siwe,
-        signature: session.signature
-      });
-      restoredOwnSession2 = true;
+    const restoredOwnSession = Boolean(session && session.delegationHeader && session.delegationCid && session.spaceId);
+    if (restoredOwnSession) {
+      await restoreProfileSession(node2, ctx.profile, profile, persistedSessionData(ctx.profile, profile, session, key));
     } else {
       await node2.signIn();
     }
-    await replayAdditionalDelegations(node2, ctx.profile, {
-      host: ctx.host,
-      ownerSpace: profile.spaceId,
-      migrate: restoredOwnSession2 && options?.privateKey === void 0
-    });
+    if (restoredOwnSession) {
+      recordWarnings(await replayAdditionalDelegations(node2, ctx.profile, {
+        host: ctx.host,
+        ownerSpace: profile.spaceId,
+        migrate: options?.privateKey === void 0
+      }));
+    }
     return node2;
   }
   const node = new TinyCloudNode({
     host: ctx.host,
     privateKey: options?.privateKey
   });
-  let restoredOwnSession = false;
   if (options?.privateKey) {
     await node.signIn();
   } else if (session && session.delegationHeader && session.delegationCid && session.spaceId) {
-    await node.restoreSession({
-      delegationHeader: session.delegationHeader,
-      delegationCid: session.delegationCid,
-      spaceId: session.spaceId,
-      jwk: signerJwkForProfile(ctx.profile, session.jwk, key),
-      verificationMethod: session.verificationMethod ?? profile?.did,
-      address: session.address,
-      chainId: session.chainId,
-      siwe: session.siwe,
-      signature: session.signature
-    });
-    restoredOwnSession = true;
+    await restoreProfileSession(node, ctx.profile, profile, persistedSessionData(ctx.profile, profile, session, key));
+    recordWarnings(await replayAdditionalDelegations(node, ctx.profile, {
+      host: ctx.host,
+      ownerSpace: profile?.spaceId,
+      migrate: true
+    }));
   }
-  await replayAdditionalDelegations(node, ctx.profile, {
-    host: ctx.host,
-    ownerSpace: profile?.spaceId,
-    migrate: restoredOwnSession
-  });
   return node;
 }
 async function bootstrapDelegatedSession(ctx, delegation) {
@@ -5990,6 +6177,8 @@ var init_sdk = __esm({
     init_errors();
     init_constants();
     init_permissions();
+    init_session_expired();
+    init_warnings();
     BOOTSTRAP_PROFILE_FIELDS = ["sessionDid", "spaceId"];
   }
 });
@@ -6088,7 +6277,7 @@ function formatBannerLine(version2) {
 }
 function emitBanner(version2) {
   if (bannerEmitted) return;
-  if (!isInteractive()) return;
+  if (shouldOutputJson()) return;
   if (process.env.TC_HIDE_BANNER === "1") return;
   bannerEmitted = true;
   process.stderr.write(formatBannerLine(version2) + "\n\n");
@@ -16699,7 +16888,6 @@ function parseDuration(input) {
 }
 
 // src/commands/share.ts
-init_formatter();
 init_errors();
 
 // src/share/output.ts
@@ -16965,9 +17153,8 @@ function shareCliError(error, operation = "publish") {
     if (failure.kind === "registry-rejected") {
       return new CLIError("REGISTRY_REJECTED", "the TinyCloud location registry rejected this session's location record, so nothing was shared; retrying will not help. Log in again, and report the problem if it persists", 6);
     }
-    if (failure.kind === "storage-quota-exceeded") {
-      const sizes = failure.usedBytes === void 0 || failure.limitBytes === void 0 ? "" : ` (${formatBytes(failure.usedBytes)} used of ${formatBytes(failure.limitBytes)} limit)`;
-      return new CLIError("STORAGE_QUOTA_EXCEEDED", `storage quota exceeded${sizes}; nothing was shared`, 4);
+    if (failure.kind === "storage-full") {
+      return storageFullError(failure);
     }
     if (failure.kind === "upload-failed") {
       return new CLIError("UPLOAD_FAILED", "share source upload failed; nothing was shared", 4);
@@ -16987,6 +17174,8 @@ function shareCliError(error, operation = "publish") {
     const code3 = error.code === "fetch-failed" ? "NOT_FOUND" : error.code.replaceAll("-", "_").toUpperCase();
     return new CLIError(code3, error.message, exit);
   }
+  const storageFull = storageFullError(error);
+  if (storageFull) return storageFull;
   const message = error instanceof Error ? error.message : String(error);
   const nodeCode = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
   const known = {
@@ -17280,8 +17469,10 @@ function registerShareCommand(program2) {
 }
 
 // src/share/adapters.ts
+init_storage();
 init_profiles();
 init_constants();
+init_session_expired();
 import { readFile as readFile4 } from "fs/promises";
 import { join as join6 } from "path";
 import { createHash } from "crypto";
@@ -17293,15 +17484,9 @@ function requiredKvAction(meta) {
   const action = meta.requiredAction;
   return action === "tinycloud.kv/put" || action === "tinycloud.kv/get" ? action : void 0;
 }
-function isByteCount(value) {
-  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
-}
 function throwKvUploadFailure(error) {
-  if (typeof error === "object" && error !== null && "code" in error && error.code === "STORAGE_QUOTA_EXCEEDED") {
-    const meta = "meta" in error && typeof error.meta === "object" && error.meta !== null ? error.meta : {};
-    const { usedBytes, limitBytes } = meta;
-    throw new SharePublishAuthorityError(isByteCount(usedBytes) && isByteCount(limitBytes) ? { kind: "storage-quota-exceeded", usedBytes, limitBytes } : { kind: "storage-quota-exceeded" });
-  }
+  const rejection = storageRejection(error);
+  if (rejection) throw new SharePublishAuthorityError({ kind: "storage-full", ...rejection });
   throw new SharePublishAuthorityError({ kind: "upload-failed" });
 }
 var DEFAULT_SHARE_ORIGIN = "https://share.tinycloud.xyz";
@@ -17600,7 +17785,7 @@ function createShareAuthorityAdapters(input = {}) {
     } catch (error) {
       const profileConfig = await ProfileManager.getProfile(profile).catch(() => void 0);
       const code3 = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
-      if (error instanceof InvalidRestoredSessionError || code3 === "AUTH_EXPIRED") {
+      if (error instanceof InvalidRestoredSessionError || code3 === "AUTH_EXPIRED" || isSessionExpiredError(error)) {
         throw new SharePublishAuthorityError({
           kind: "owner-space-unresolved",
           localKey: profileConfig?.authMethod === "local",
@@ -17962,6 +18147,7 @@ function selectedShareProfile() {
 program.name("tc").description("TinyCloud CLI \u2014 self-sovereign storage from the terminal").version(version).option("-p, --profile <name>", "Profile to use").option("-H, --host <url>", "TinyCloud node URL").option("-v, --verbose", "Enable verbose output").option("--no-cache", "Disable caching").option("-q, --quiet", "Suppress non-essential output").option("--json", "Force JSON output");
 program.hook("preAction", async (thisCommand) => {
   const opts = thisCommand.optsWithGlobals();
+  setJsonOutputRequested(opts.json === true);
   const parentName = thisCommand.parent?.name();
   const isShareCommand = parentName === "share" || thisCommand.name() === "share";
   if (!opts.quiet && !isShareCommand) {
@@ -17970,7 +18156,7 @@ program.hook("preAction", async (thisCommand) => {
   const commandName = thisCommand.name();
   const fullCommand = parentName && parentName !== "tc" ? `${parentName} ${commandName}` : commandName;
   const skipGuard = ["tc", "init", "doctor", "completion", "help", "upgrade", "status"].includes(commandName) || fullCommand === "profile create";
-  if (!skipGuard && !opts.quiet && isInteractive()) {
+  if (!skipGuard && !opts.quiet && !shouldOutputJson()) {
     try {
       const config = await ProfileManager.getConfig();
       const profileName = opts.profile || config.defaultProfile;
@@ -17987,6 +18173,9 @@ program.hook("preAction", async (thisCommand) => {
     }
   }
 });
+program.hook("postAction", () => {
+  outputWarnings([]);
+});
 configureShareCommandServices({
   targetAdapter: shareAuthority.targetAdapter,
   records: shareAuthority.records,