@tinycloud/operations 0.5.2 → 0.5.3-beta.0

package/dist/index.cjs

@@ -35,6 +35,16 @@ var __toESM = (mod2, isNodeMode, target) => (target = mod2 != null ? __create(__
 var __toCommonJS = (mod2) => __copyProps(__defProp({}, "__esModule", { value: true }), mod2);
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 
+// src/cli-name.ts
+var import_node_path, CLI_NAME;
+var init_cli_name = __esm({
+  "src/cli-name.ts"() {
+    "use strict";
+    import_node_path = require("path");
+    CLI_NAME = (0, import_node_path.basename)(process.argv[1] ?? "") === "tinycloud" ? "tinycloud" : "tc";
+  }
+});
+
 // ../sdk-core/src/policy/errors.ts
 var SignedObjectProfileError, SignedObjectCanonicalizationError;
 var init_errors = __esm({
@@ -4302,8 +4312,8 @@ async function bindLiveness(directory) {
     await (0, import_promises.rename)(pinned.path(`${socket}.new`), pinned.path(socket));
     const stats = await (0, import_promises.lstat)(pinned.path(socket), { bigint: true });
     if (!stats.isSocket()) throw new Error(`${socket} is not a socket`);
-    await waitForTestBarrier(TEST_LOCK_LIVENESS_BARRIER_DIR, (0, import_node_path.basename)(directory));
-    return { record: { socket, dev: String(stats.dev), ino: String(stats.ino) }, path: (0, import_node_path.join)(directory, socket), server };
+    await waitForTestBarrier(TEST_LOCK_LIVENESS_BARRIER_DIR, (0, import_node_path2.basename)(directory));
+    return { record: { socket, dev: String(stats.dev), ino: String(stats.ino) }, path: (0, import_node_path2.join)(directory, socket), server };
   } catch {
     if (bound) {
       server.close();
@@ -4393,26 +4403,26 @@ async function sweepLiveness(acquisition) {
 }
 function tinycloudHomePath() {
   const home = invocationStateRoot.getStore() ?? process.env.TC_HOME ?? process.env.HOME ?? process.env.USERPROFILE ?? (0, import_node_os.homedir)();
-  return (0, import_node_path.join)(home, ".tinycloud");
+  return (0, import_node_path2.join)(home, ".tinycloud");
 }
 function withTinyCloudStateRoot(stateRoot, action) {
   if (stateRoot === void 0) return action();
-  if (!(0, import_node_path.isAbsolute)(stateRoot) || stateRoot.includes("\0")) {
+  if (!(0, import_node_path2.isAbsolute)(stateRoot) || stateRoot.includes("\0")) {
     throw new TypeError("The TinyCloud state root must be an absolute path.");
   }
-  return invocationStateRoot.run((0, import_node_path.resolve)(stateRoot), action);
+  return invocationStateRoot.run((0, import_node_path2.resolve)(stateRoot), action);
 }
 function tinycloudConfigPath() {
-  return (0, import_node_path.join)(tinycloudHomePath(), "config.json");
+  return (0, import_node_path2.join)(tinycloudHomePath(), "config.json");
 }
 function profilesPath() {
-  return (0, import_node_path.join)(tinycloudHomePath(), "profiles");
+  return (0, import_node_path2.join)(tinycloudHomePath(), "profiles");
 }
 function profilePath(profile) {
-  return (0, import_node_path.join)(profilesPath(), validateProfileName(profile));
+  return (0, import_node_path2.join)(profilesPath(), validateProfileName(profile));
 }
 function profileConfigPath(profile) {
-  return (0, import_node_path.join)(profilePath(profile), "profile.json");
+  return (0, import_node_path2.join)(profilePath(profile), "profile.json");
 }
 function sessionPath(profile) {
   return profileStorePath(profile, "session");
@@ -4421,16 +4431,16 @@ function additionalDelegationsPath(profile) {
   return profileStorePath(profile, "additional-delegations");
 }
 function profileStorePath(profile, store) {
-  return (0, import_node_path.join)(profilePath(profile), `${store}.json`);
+  return (0, import_node_path2.join)(profilePath(profile), `${store}.json`);
 }
 function profileStoreMetadataPath(profile, store) {
   return `${profileStorePath(profile, store)}.metadata.json`;
 }
 function profileLockPath(profile) {
-  return (0, import_node_path.join)(profilePath(profile), ".lock");
+  return (0, import_node_path2.join)(profilePath(profile), ".lock");
 }
 function profileTurnLockPath(profile) {
-  return (0, import_node_path.join)(tinycloudHomePath(), "profile-locks", validateProfileName(profile));
+  return (0, import_node_path2.join)(tinycloudHomePath(), "profile-locks", validateProfileName(profile));
 }
 async function readJson(filePath) {
   try {
@@ -4444,10 +4454,10 @@ async function writeJsonAtomic(filePath, value) {
   await replaceJson(filePath, value, false);
 }
 async function replaceJson(filePath, value, durable) {
-  const directory = (0, import_node_path.dirname)(filePath);
-  const temporaryPath = (0, import_node_path.join)(
+  const directory = (0, import_node_path2.dirname)(filePath);
+  const temporaryPath = (0, import_node_path2.join)(
     directory,
-    `.${(0, import_node_path.basename)(filePath)}.${process.pid}.${(0, import_node_crypto.randomUUID)()}.tmp`
+    `.${(0, import_node_path2.basename)(filePath)}.${process.pid}.${(0, import_node_crypto.randomUUID)()}.tmp`
   );
   const contents = `${JSON.stringify(value, null, 2)}
 `;
@@ -4560,7 +4570,7 @@ async function acquireProfileLock(profile, options) {
   const directory = profilePath(profile);
   if (options.requireProfile && !await exists(profileConfigPath(profile))) throw new ProfileDeletedError(profile);
   if (!options.requireProfile) await (0, import_promises.mkdir)(directory, { recursive: true, mode: PRIVATE_DIR_MODE });
-  await (0, import_promises.mkdir)((0, import_node_path.dirname)(turnDirectory), { recursive: true, mode: PRIVATE_DIR_MODE });
+  await (0, import_promises.mkdir)((0, import_node_path2.dirname)(turnDirectory), { recursive: true, mode: PRIVATE_DIR_MODE });
   for (const path of [tinycloudHomePath(), profilesPath(), directory]) {
     await (0, import_promises.chmod)(path, PRIVATE_DIR_MODE).catch((error) => {
       if (path !== directory || !isErrno(error, "ENOENT")) throw error;
@@ -4583,7 +4593,7 @@ async function acquireProfileLock(profile, options) {
       await (0, import_promises.rmdir)(directory).catch(() => void 0);
       throw new ProfileDeletedError(profile);
     }
-    const deletion = await readJson((0, import_node_path.join)(turnDirectory, "deleted.json")).catch(() => null);
+    const deletion = await readJson((0, import_node_path2.join)(turnDirectory, "deleted.json")).catch(() => null);
     const deletedWhileWaiting = typeof deletion?.slot === "number" && deletion.slot >= firstWaitedTurn;
     while (true) {
       const token = (0, import_node_crypto.randomUUID)();
@@ -4676,10 +4686,10 @@ async function readLatestTurn(directory) {
   return turn === "damaged" ? slot : turn;
 }
 async function readTurn(directory, slot) {
-  const path = (0, import_node_path.join)(directory, String(slot));
+  const path = (0, import_node_path2.join)(directory, String(slot));
   let text;
   try {
-    text = await (0, import_promises.readFile)((0, import_node_path.join)(path, "owner.json"), "utf8");
+    text = await (0, import_promises.readFile)((0, import_node_path2.join)(path, "owner.json"), "utf8");
   } catch (error) {
     if (!isErrno(error, "ENOENT") && !isErrno(error, "ENOTDIR")) throw error;
     return await exists(path) ? "damaged" : null;
@@ -4693,8 +4703,8 @@ async function readTurn(directory, slot) {
   if (owner === null || typeof owner !== "object" || typeof owner.token !== "string" || typeof owner.pid !== "number") {
     return "damaged";
   }
-  const done = await exists((0, import_node_path.join)(path, `${owner.token}.done`));
-  const held = await exists((0, import_node_path.join)(path, `${owner.token}.held`));
+  const done = await exists((0, import_node_path2.join)(path, `${owner.token}.done`));
+  const held = await exists((0, import_node_path2.join)(path, `${owner.token}.held`));
   return {
     ...owner,
     slot,
@@ -4713,12 +4723,12 @@ async function isFinishedTurn(directory, slot, token) {
 async function takeTurn(profile, directory, latest, liveness) {
   const token = (0, import_node_crypto.randomUUID)();
   const slot = latest.slot + 1;
-  const path = (0, import_node_path.join)(directory, String(slot));
+  const path = (0, import_node_path2.join)(directory, String(slot));
   const owner = { pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token, after: latest.token, ...processOwner(liveness) };
   let published = false;
   try {
     published = await publishDirectory(
-      (0, import_node_path.join)(directory, `.stage-${process.pid}-${token}`),
+      (0, import_node_path2.join)(directory, `.stage-${process.pid}-${token}`),
       path,
       { "owner.json": `${JSON.stringify(owner, null, 2)}
 ` },
@@ -4735,7 +4745,7 @@ async function takeTurn(profile, directory, latest, liveness) {
   }
 }
 async function settleAbandonedTurn(directory, abandoned) {
-  const path = (0, import_node_path.join)(directory, String(abandoned.slot));
+  const path = (0, import_node_path2.join)(directory, String(abandoned.slot));
   if (!abandoned.held && abandoned.after !== null && await isFinishedTurn(directory, abandoned.slot - 1, abandoned.after)) {
     await markTurn(path, abandoned.token, "held");
   }
@@ -4756,7 +4766,7 @@ function settleOwnTurn(directory, slot, token, retries = SETTLE_RETRIES) {
 async function markTurn(path, token, kind) {
   for (let attempt = 0; ; attempt++) {
     try {
-      await (0, import_promises.writeFile)((0, import_node_path.join)(path, `${token}.${kind}`), "", { mode: PRIVATE_FILE_MODE, flag: "wx" });
+      await (0, import_promises.writeFile)((0, import_node_path2.join)(path, `${token}.${kind}`), "", { mode: PRIVATE_FILE_MODE, flag: "wx" });
       return true;
     } catch (error) {
       if (isErrno(error, "EEXIST")) return true;
@@ -4769,7 +4779,7 @@ async function markTurn(path, token, kind) {
 async function createTurnDirectory(directory) {
   const token = (0, import_node_crypto.randomUUID)();
   const owner = { pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token, after: null, ...processOwner(null) };
-  await publishDirectory((0, import_node_path.join)((0, import_node_path.dirname)(directory), `.stage-${(0, import_node_path.basename)(directory)}-${process.pid}-${token}`), directory, {
+  await publishDirectory((0, import_node_path2.join)((0, import_node_path2.dirname)(directory), `.stage-${(0, import_node_path2.basename)(directory)}-${process.pid}-${token}`), directory, {
     "0/owner.json": `${JSON.stringify(owner, null, 2)}
 `,
     [`0/${token}.held`]: "",
@@ -4779,8 +4789,8 @@ async function createTurnDirectory(directory) {
 async function publishDirectory(stage, target, files, beforeRename) {
   try {
     for (const [name, contents] of Object.entries(files)) {
-      await (0, import_promises.mkdir)((0, import_node_path.dirname)((0, import_node_path.join)(stage, name)), { recursive: true, mode: PRIVATE_DIR_MODE });
-      await writeFileDurably((0, import_node_path.join)(stage, name), contents);
+      await (0, import_promises.mkdir)((0, import_node_path2.dirname)((0, import_node_path2.join)(stage, name)), { recursive: true, mode: PRIVATE_DIR_MODE });
+      await writeFileDurably((0, import_node_path2.join)(stage, name), contents);
     }
     await beforeRename?.();
     await (0, import_promises.rename)(stage, target);
@@ -4794,7 +4804,7 @@ async function publishDirectory(stage, target, files, beforeRename) {
 }
 async function releaseTurn(profile, turn, liveness) {
   try {
-    await markTurn((0, import_node_path.join)(turn.directory, String(turn.slot)), turn.token, "done");
+    await markTurn((0, import_node_path2.join)(turn.directory, String(turn.slot)), turn.token, "done");
   } catch {
     settleOwnTurn(turn.directory, turn.slot, turn.token);
     return;
@@ -4806,13 +4816,13 @@ async function isAbandonedTurnEntry(directory, name, liveness) {
   const writer = /^\.(?:stage|deleted\.json)[-.]([0-9]+)[-.]/.exec(name)?.[1];
   if (writer === void 0) return false;
   if (Number(writer) !== process.pid) return !await isRecordedProcessAlive({ pid: Number(writer) }, liveness);
-  return name.startsWith(".stage-") && await isStagedOwnerGone((0, import_node_path.join)(directory, name, "owner.json"), liveness);
+  return name.startsWith(".stage-") && await isStagedOwnerGone((0, import_node_path2.join)(directory, name, "owner.json"), liveness);
 }
 async function isAbandonedTurnDirectoryStage(directory, name, liveness) {
   const writer = /^\.stage-.+-([0-9]+)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.exec(name)?.[1];
   if (writer === void 0) return false;
   if (Number(writer) !== process.pid) return !await isRecordedProcessAlive({ pid: Number(writer) }, liveness);
-  return isStagedOwnerGone((0, import_node_path.join)(directory, name, "0", "owner.json"), liveness);
+  return isStagedOwnerGone((0, import_node_path2.join)(directory, name, "0", "owner.json"), liveness);
 }
 async function isStagedOwnerGone(recordPath, liveness) {
   const owner = await readJson(recordPath).catch(() => null);
@@ -4821,10 +4831,10 @@ async function isStagedOwnerGone(recordPath, liveness) {
 async function collectTurns(profile, turn, liveness) {
   for (const [directory, abandoned] of [
     [turn.directory, isAbandonedTurnEntry],
-    [(0, import_node_path.dirname)(turn.directory), isAbandonedTurnDirectoryStage]
+    [(0, import_node_path2.dirname)(turn.directory), isAbandonedTurnDirectoryStage]
   ]) {
     for (const name of await (0, import_promises.readdir)(directory)) {
-      if (await abandoned(directory, name, liveness)) await (0, import_promises.rm)((0, import_node_path.join)(directory, name), { recursive: true, force: true }).catch(() => void 0);
+      if (await abandoned(directory, name, liveness)) await (0, import_promises.rm)((0, import_node_path2.join)(directory, name), { recursive: true, force: true }).catch(() => void 0);
     }
   }
   const older = (await (0, import_promises.readdir)(turn.directory)).filter((name) => TURN.test(name)).map(Number).filter((slot) => slot < turn.slot).sort((left, right) => left - right);
@@ -4832,13 +4842,13 @@ async function collectTurns(profile, turn, liveness) {
     const candidate = await readTurn(turn.directory, slot);
     if (candidate === null || candidate === "damaged" || !candidate.done) continue;
     if (candidate.held) {
-      if (await exists((0, import_node_path.join)(turn.directory, String(slot - 1)))) continue;
+      if (await exists((0, import_node_path2.join)(turn.directory, String(slot - 1)))) continue;
       const next = await readTurn(turn.directory, slot + 1);
       if (next === null || next === "damaged" || !next.held || !next.done) continue;
     }
     await waitForTestBarrier(TEST_LOCK_TURN_COLLECT_BARRIER_DIR, profile);
-    const trash = (0, import_node_path.join)(turn.directory, `.trash-${(0, import_node_crypto.randomUUID)()}`);
-    if (await (0, import_promises.rename)((0, import_node_path.join)(turn.directory, String(slot)), trash).then(() => true, () => false)) {
+    const trash = (0, import_node_path2.join)(turn.directory, `.trash-${(0, import_node_crypto.randomUUID)()}`);
+    if (await (0, import_promises.rename)((0, import_node_path2.join)(turn.directory, String(slot)), trash).then(() => true, () => false)) {
       await (0, import_promises.rm)(trash, { recursive: true, force: true }).catch(() => void 0);
     }
   }
@@ -4855,8 +4865,8 @@ async function publishProfileLock(profile, lockPath, token, requireProfile, live
     return false;
   }
   await waitForTestBarrier(TEST_LOCK_PUBLISH_BARRIER_DIR, profile);
-  const ownerPath = (0, import_node_path.join)(lockPath, "owner.json");
-  const staged = (0, import_node_path.join)((0, import_node_path.dirname)(lockPath), `.lock-owner-${token}.tmp`);
+  const ownerPath = (0, import_node_path2.join)(lockPath, "owner.json");
+  const staged = (0, import_node_path2.join)((0, import_node_path2.dirname)(lockPath), `.lock-owner-${token}.tmp`);
   const owner = `${JSON.stringify({ pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString(), token, ...processOwner(liveness) }, null, 2)}
 `;
   try {
@@ -4880,7 +4890,7 @@ function lacksHardLinks(error) {
   return typeof error === "object" && error !== null && "code" in error && NO_HARD_LINK_ERRORS.has(String(error.code));
 }
 async function releaseProfileLock(profile, lockPath, token) {
-  const ownerPath = (0, import_node_path.join)(lockPath, "owner.json");
+  const ownerPath = (0, import_node_path2.join)(lockPath, "owner.json");
   const owner = await readJson(ownerPath).catch(() => null);
   if (owner?.token !== token) return;
   await (0, import_promises.rm)(ownerPath, { force: true });
@@ -4892,9 +4902,9 @@ async function signalTestLockContention(profile) {
   const configuredPath = process.env[TEST_LOCK_CONTENTION_SIGNAL_PATH];
   const configuredHome = process.env.TC_HOME;
   if (!configuredPath || !configuredHome) return;
-  const home = (0, import_node_path.resolve)(configuredHome);
-  const signalPath = (0, import_node_path.resolve)(configuredPath);
-  const pathFromHome = (0, import_node_path.relative)(home, signalPath);
+  const home = (0, import_node_path2.resolve)(configuredHome);
+  const signalPath = (0, import_node_path2.resolve)(configuredPath);
+  const pathFromHome = (0, import_node_path2.relative)(home, signalPath);
   if (pathFromHome === "" || pathFromHome === ".." || pathFromHome.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || pathFromHome.startsWith("../") || pathFromHome.startsWith("..\\")) {
     return;
   }
@@ -4917,15 +4927,15 @@ async function recoverOwnerlessLock(profile, lockPath, liveness, staleAfterMs) {
     const onlyOrphanedClaims = entries.length > 0 && entries.every((entry) => RECOVERY_CLAIM.test(entry));
     if (!onlyOrphanedClaims && (!aged || recoveryFenced(checkedAt, staleAfterMs))) return false;
     for (const name of entries.filter((entry) => RECOVERY_CLAIM.test(entry))) {
-      const claimPath = (0, import_node_path.join)(lockPath, name);
+      const claimPath = (0, import_node_path2.join)(lockPath, name);
       if (await hasLiveRecoveryOwner(claimPath, liveness)) {
-        if (!await exists((0, import_node_path.join)(lockPath, "owner.json"))) await (0, import_promises.rename)(claimPath, (0, import_node_path.join)(lockPath, "owner.json"));
+        if (!await exists((0, import_node_path2.join)(lockPath, "owner.json"))) await (0, import_promises.rename)(claimPath, (0, import_node_path2.join)(lockPath, "owner.json"));
         return false;
       }
       await (0, import_promises.rm)(claimPath, { force: true });
     }
     for (const name of entries.filter((entry) => ABANDONED_CLAIM.test(entry))) {
-      await (0, import_promises.rm)((0, import_node_path.join)(lockPath, name), { force: true });
+      await (0, import_promises.rm)((0, import_node_path2.join)(lockPath, name), { force: true });
     }
     await (0, import_promises.rmdir)(lockPath);
   } catch {
@@ -4955,21 +4965,21 @@ function recoveryFenced(since, staleAfterMs) {
   return performance.now() - since >= staleAfterMs / 2;
 }
 async function removeAgedOwnerFiles(lockPath, staleAfterMs) {
-  const directory = (0, import_node_path.dirname)(lockPath);
+  const directory = (0, import_node_path2.dirname)(lockPath);
   const names = await (0, import_promises.readdir)(directory).catch(() => []);
   for (const name of names.filter((entry) => STAGED_OWNER.test(entry))) {
-    const path = (0, import_node_path.join)(directory, name);
+    const path = (0, import_node_path2.join)(directory, name);
     const aged = await (0, import_promises.stat)(path).then(({ mtimeMs }) => Date.now() - mtimeMs >= staleAfterMs, () => false);
     if (aged) await (0, import_promises.rm)(path, { force: true }).catch(() => void 0);
   }
 }
 async function recoverStaleLock(profile, lockPath, liveness, staleAfterMs) {
-  const ownerPath = (0, import_node_path.join)(lockPath, "owner.json");
+  const ownerPath = (0, import_node_path2.join)(lockPath, "owner.json");
   const observed = await (0, import_promises.readFile)(ownerPath, "utf8").catch(() => null);
   if (observed === null) return recoverOwnerlessLock(profile, lockPath, liveness, staleAfterMs);
   if (!await isAbandonedOwner(observed, ownerPath, liveness, staleAfterMs)) return false;
   await waitForTestBarrier(TEST_LOCK_RECOVERY_BARRIER_DIR, profile);
-  const claimPath = (0, import_node_path.join)(lockPath, `.recover-${(0, import_node_crypto.randomUUID)()}.json`);
+  const claimPath = (0, import_node_path2.join)(lockPath, `.recover-${(0, import_node_crypto.randomUUID)()}.json`);
   let moved = false;
   try {
     await (0, import_promises.link)(ownerPath, claimPath);
@@ -4997,7 +5007,7 @@ async function recoverStaleLock(profile, lockPath, liveness, staleAfterMs) {
   await waitForTestBarrier(TEST_LOCK_CLAIM_BARRIER_DIR, profile);
   await waitForTestBarrier(TEST_LOCK_CLAIMED_BARRIER_DIR, profile);
   for (const name of (await (0, import_promises.readdir)(lockPath).catch(() => [])).filter((entry) => RECOVERY_CLAIM.test(entry))) {
-    if ((0, import_node_path.join)(lockPath, name) !== claimPath) await (0, import_promises.rm)((0, import_node_path.join)(lockPath, name), { force: true });
+    if ((0, import_node_path2.join)(lockPath, name) !== claimPath) await (0, import_promises.rm)((0, import_node_path2.join)(lockPath, name), { force: true });
   }
   if (await (0, import_promises.unlink)(claimPath).then(() => true, () => false)) await (0, import_promises.rmdir)(lockPath).catch(() => void 0);
   await removeAgedOwnerFiles(lockPath, staleAfterMs);
@@ -5021,9 +5031,9 @@ async function waitForTestBarrier(environmentName, profile) {
   const barrierDirectory = process.env[environmentName];
   if (!barrierDirectory) return;
   await (0, import_promises.mkdir)(barrierDirectory, { recursive: true });
-  const readyPath = (0, import_node_path.join)(barrierDirectory, `ready-${process.pid}-${profile}`);
+  const readyPath = (0, import_node_path2.join)(barrierDirectory, `ready-${process.pid}-${profile}`);
   await (0, import_promises.writeFile)(readyPath, "ready\n", { encoding: "utf8", flag: "wx" }).catch(() => void 0);
-  const releasePath = (0, import_node_path.join)(barrierDirectory, "release");
+  const releasePath = (0, import_node_path2.join)(barrierDirectory, "release");
   while (true) {
     try {
       await (0, import_promises.readFile)(releasePath, "utf8");
@@ -5080,7 +5090,7 @@ function isErrno(error, code) {
 function sleep(milliseconds) {
   return new Promise((resolve2) => setTimeout(resolve2, milliseconds));
 }
-var import_node_crypto, import_node_async_hooks, import_node_fs, import_promises, import_node_net, import_node_os, import_node_path, DEFAULT_PROFILE, DEFAULT_LOCK_TIMEOUT_MS, DEFAULT_LOCK_RETRY_MS, DEFAULT_STALE_LOCK_MS, TEST_LOCK_CONTENTION_SIGNAL_PATH, PRIVATE_FILE_MODE, PRIVATE_DIR_MODE, TEST_LOCK_RECOVERY_BARRIER_DIR, TEST_LOCK_OWNERLESS_BARRIER_DIR, TEST_LOCK_PUBLISH_BARRIER_DIR, TEST_LOCK_RELEASE_BARRIER_DIR, TEST_LOCK_CLAIM_BARRIER_DIR, TEST_LOCK_CLAIMED_BARRIER_DIR, TEST_LOCK_VERIFIED_BARRIER_DIR, TEST_LOCK_MOVED_BARRIER_DIR, TEST_LOCK_TURN_PUBLISH_BARRIER_DIR, TEST_LOCK_TURN_SETTLE_BARRIER_DIR, TEST_LOCK_TURN_COLLECT_BARRIER_DIR, TEST_LOCK_LIVENESS_BARRIER_DIR, invocationStateRoot, heldProfileLocks, _a2, processInstanceId, cachedProcessOrigin, LIVENESS_SOCKET, LIVENESS_PROBE_TIMEOUT_MS, ProfileLockTimeoutError, ProfileDeletedError, TURN, _a3, relinquishedTurns, MARKER_RETRY_DELAYS_MS, SETTLE_RETRY_MS, SETTLE_RETRIES, NO_HARD_LINK_ERRORS, ABANDONED_CLAIM, RECOVERY_CLAIM, STAGED_OWNER;
+var import_node_crypto, import_node_async_hooks, import_node_fs, import_promises, import_node_net, import_node_os, import_node_path2, DEFAULT_PROFILE, DEFAULT_LOCK_TIMEOUT_MS, DEFAULT_LOCK_RETRY_MS, DEFAULT_STALE_LOCK_MS, TEST_LOCK_CONTENTION_SIGNAL_PATH, PRIVATE_FILE_MODE, PRIVATE_DIR_MODE, TEST_LOCK_RECOVERY_BARRIER_DIR, TEST_LOCK_OWNERLESS_BARRIER_DIR, TEST_LOCK_PUBLISH_BARRIER_DIR, TEST_LOCK_RELEASE_BARRIER_DIR, TEST_LOCK_CLAIM_BARRIER_DIR, TEST_LOCK_CLAIMED_BARRIER_DIR, TEST_LOCK_VERIFIED_BARRIER_DIR, TEST_LOCK_MOVED_BARRIER_DIR, TEST_LOCK_TURN_PUBLISH_BARRIER_DIR, TEST_LOCK_TURN_SETTLE_BARRIER_DIR, TEST_LOCK_TURN_COLLECT_BARRIER_DIR, TEST_LOCK_LIVENESS_BARRIER_DIR, invocationStateRoot, heldProfileLocks, _a2, processInstanceId, cachedProcessOrigin, LIVENESS_SOCKET, LIVENESS_PROBE_TIMEOUT_MS, ProfileLockTimeoutError, ProfileDeletedError, TURN, _a3, relinquishedTurns, MARKER_RETRY_DELAYS_MS, SETTLE_RETRY_MS, SETTLE_RETRIES, NO_HARD_LINK_ERRORS, ABANDONED_CLAIM, RECOVERY_CLAIM, STAGED_OWNER;
 var init_state = __esm({
   "src/state.ts"() {
     "use strict";
@@ -5090,7 +5100,7 @@ var init_state = __esm({
     import_promises = require("fs/promises");
     import_node_net = require("net");
     import_node_os = require("os");
-    import_node_path = require("path");
+    import_node_path2 = require("path");
     DEFAULT_PROFILE = "default";
     DEFAULT_LOCK_TIMEOUT_MS = 2e3;
     DEFAULT_LOCK_RETRY_MS = 25;
@@ -5443,7 +5453,7 @@ function isSafeRecovery(value, action) {
   if (!("command" in record)) return true;
   const command = record.command;
   if (typeof command !== "string") return false;
-  const profile = /^tc --profile (\S+) /.exec(command)?.[1];
+  const profile = /^\S+ --profile (\S+) /.exec(command)?.[1];
   if (profile === void 0 || !SAFE_PROFILE_TOKEN.test(profile)) return false;
   return action === "sign_in" ? Object.values(SIGN_IN_TEMPLATES).some((template) => template(profile) === command) : migrationCommand(profile) === command;
 }
@@ -5451,14 +5461,15 @@ var SAFE_PROFILE_TOKEN, MIGRATION_OPERATION_ID, SIGN_IN_TEMPLATES, migrationComm
 var init_recovery = __esm({
   "src/recovery.ts"() {
     "use strict";
+    init_cli_name();
     SAFE_PROFILE_TOKEN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
     MIGRATION_OPERATION_ID = "tinycloud.auth.capabilities";
     SIGN_IN_TEMPLATES = {
-      local: (profile) => `tc --profile ${profile} auth login --method local`,
-      openkey: (profile) => `tc --profile ${profile} auth login --method openkey`,
-      scoped: (profile) => `tc --profile ${profile} auth login --method openkey --paste --manifest <manifest.json>`
+      local: (profile) => `${CLI_NAME} --profile ${profile} auth login --method local`,
+      openkey: (profile) => `${CLI_NAME} --profile ${profile} auth login --method openkey`,
+      scoped: (profile) => `${CLI_NAME} --profile ${profile} auth login --method openkey --paste --manifest <manifest.json>`
     };
-    migrationCommand = (profile) => `tc --profile ${profile} auth caps`;
+    migrationCommand = (profile) => `${CLI_NAME} --profile ${profile} auth caps`;
   }
 });
 
@@ -6960,7 +6971,7 @@ function ownerOfSpace(space) {
   return ownerOrUndefined(`did:pkh:eip155:${match[1]}:${match[2].toLowerCase()}`);
 }
 function putCommands(names, scope) {
-  return dedupe(names).map((name) => `tc secrets put ${name}${scope === void 0 ? "" : ` --scope ${scope}`} --stdin`).join("; ");
+  return dedupe(names).map((name) => `${CLI_NAME} secrets put ${name}${scope === void 0 ? "" : ` --scope ${scope}`} --stdin`).join("; ");
 }
 function dedupe(names) {
   return [...new Set(names)];
@@ -6973,6 +6984,7 @@ var init_secret_request = __esm({
   "src/secret-request.ts"() {
     "use strict";
     nodeSdk3 = __toESM(require("@tinycloud/node-sdk"), 1);
+    init_cli_name();
     SECRET_MANAGER_ORIGIN = "https://secrets.tinycloud.xyz";
     SECRET_REQUEST_MAX_NAMES = 10;
     SECRET_REQUEST_MAX_URL_LENGTH = 8192;
@@ -7081,7 +7093,7 @@ function classifySecretRead(reference, result, localOwner) {
         approval: {
           kind: "openkey",
           requestId: "runtime-hint",
-          fallback: "tc auth grant <request-artifact>"
+          fallback: `${CLI_NAME} auth grant <request-artifact>`
         }
       };
     case "node_unreachable":
@@ -7184,6 +7196,7 @@ var init_secrets_get = __esm({
   "src/operations/secrets-get.ts"() {
     "use strict";
     import_zod5 = require("zod");
+    init_cli_name();
     init_errors2();
     init_secret_request();
     init_secrets();
@@ -7996,7 +8009,7 @@ var init_contract = __esm({
 
 // src/delegation-binding.ts
 function bindingMigrationPath(profile) {
-  return (0, import_node_path2.join)(profilePath(profile), "delegation-binding-migration.json");
+  return (0, import_node_path3.join)(profilePath(profile), "delegation-binding-migration.json");
 }
 function storedDelegationKind(entry) {
   if (!isRecord4(entry)) return "refused";
@@ -8251,11 +8264,11 @@ function recordKey(entry) {
 function isRecord4(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-var import_node_path2, nodeSdk5, REQUEST_ID_PREFIX, BINDING_NOTES, MIGRATION_LOCK_TIMEOUT_MS, NOT_REPLAYED, DELEGATION_CID;
+var import_node_path3, nodeSdk5, REQUEST_ID_PREFIX, BINDING_NOTES, MIGRATION_LOCK_TIMEOUT_MS, NOT_REPLAYED, DELEGATION_CID;
 var init_delegation_binding = __esm({
   "src/delegation-binding.ts"() {
     "use strict";
-    import_node_path2 = require("path");
+    import_node_path3 = require("path");
     init_operations_bundle();
     nodeSdk5 = __toESM(require("@tinycloud/node-sdk"), 1);
     init_artifacts();
@@ -8812,7 +8825,7 @@ async function createRestoredRuntime(target, resolved) {
       )) {
         return failed(summary, operationError(
           "PROFILE_MIGRATION_REQUIRED",
-          `Profile "${profileName}" has a one-time stored-grant upgrade to finish. Run one authenticated command on it (tc --profile <profile> auth caps), then retry.`,
+          `Profile "${profileName}" has a one-time stored-grant upgrade to finish. Run one authenticated command on it (${CLI_NAME} --profile <profile> auth caps), then retry.`,
           { retryable: false, details: { recovery: migrationRecovery(profileName) } }
         ));
       }
@@ -8923,6 +8936,7 @@ var nodeSdk6;
 var init_runtime = __esm({
   "src/runtime.ts"() {
     "use strict";
+    init_cli_name();
     nodeSdk6 = __toESM(require("@tinycloud/node-sdk"), 1);
     init_authority();
     init_errors2();
@@ -8943,7 +8957,8 @@ module.exports = __toCommonJS(index_exports);
 
 // src/invoke.ts
 var import_node_crypto3 = require("crypto");
-var import_node_path3 = require("path");
+var import_node_path4 = require("path");
+init_cli_name();
 var import_node_sdk = require("@tinycloud/node-sdk");
 init_jcs();
 init_errors2();
@@ -9515,7 +9530,7 @@ function normalizeInvocationTarget(target) {
     const stateRoot = candidate.stateRoot;
     const allowOwnerProfile = candidate.allowOwnerProfile;
     const privateKey = candidate.privateKey;
-    if (profile !== void 0 && typeof profile !== "string" || host !== void 0 && typeof host !== "string" || stateRoot !== void 0 && (typeof stateRoot !== "string" || !(0, import_node_path3.isAbsolute)(stateRoot)) || allowOwnerProfile !== void 0 && typeof allowOwnerProfile !== "boolean" || privateKey !== void 0 && typeof privateKey !== "string") {
+    if (profile !== void 0 && typeof profile !== "string" || host !== void 0 && typeof host !== "string" || stateRoot !== void 0 && (typeof stateRoot !== "string" || !(0, import_node_path4.isAbsolute)(stateRoot)) || allowOwnerProfile !== void 0 && typeof allowOwnerProfile !== "boolean" || privateKey !== void 0 && typeof privateKey !== "string") {
       return void 0;
     }
     return {
@@ -9636,7 +9651,7 @@ function approvalAction(request, node) {
     kind: "openkey",
     requestId: request.requestId,
     ...url === void 0 ? {} : { url },
-    fallback: "tc auth grant <request-artifact>"
+    fallback: `${CLI_NAME} auth grant <request-artifact>`
   };
 }
 function exactCapabilities2(value) {