turnzero 0.12.1 → 0.13.0

package/dist/turnzero-cloud.mjs

@@ -109,7 +109,7 @@ var UPLOAD_GRANT_FORM = new RegExp(`^${UPLOAD_GRANT_PREFIX}[A-Za-z0-9_-]{43}$`);
 var commandUserAgent = (version, appended) => `${TURNZERO_CLOUD_PACKAGE}/${version}${appended ? ` ${appended}` : ""}`;
 var COMMAND_STATUS = Object.freeze({ done: 0, failed: 1, unknown: 2, nothing_started: 3 });
 var COMMAND_NODE_FLOOR = 24;
-var nodeFloorSentence = (found) => `The command needs Node.js ${COMMAND_NODE_FLOOR} or later, and this machine runs Node.js ${found}, so nothing was read and nothing was started. Install Node.js ${COMMAND_NODE_FLOOR} or later, then run the line again.`;
+var nodeFloorSentence = (version, found) => `${TURNZERO_CLOUD_PACKAGE} ${version} needs Node.js ${COMMAND_NODE_FLOOR} or later, and this machine runs Node.js ${found}, so nothing was read and nothing was started. Install Node.js ${COMMAND_NODE_FLOOR} or later, then run the line again.`;
 var MINTED_TOKEN_VARIABLE = "TURNZERO_CLOUD_MINTED_TOKEN";
 var ORIGIN_VARIABLE = "TURNZERO_CLOUD_ORIGIN";
 var MINTED_TOKEN_PREFIX = TOKEN_PREFIX;
@@ -191,12 +191,15 @@ var SCAFFOLD_FIELD_NAME_FORM = /^[a-z][a-z0-9_]{0,29}$/;
 var SCAFFOLD_FIELD_KINDS = Object.freeze(["text", "integer", "boolean", "timestamp"]);
 var SCAFFOLD_FIELDS_MAX = 20;
 var SCAFFOLD_FIELD_RESERVED = Object.freeze(["id"]);
-var SCAFFOLD_TEMPLATES = Object.freeze(["hello-world", "database-service", "scheduled-job"]);
+var SCAFFOLD_TEMPLATES = Object.freeze(["hello-world", "database-service", "scheduled-job", "web-app"]);
 var SCAFFOLD_DEFAULT_TEMPLATE = "hello-world";
 var SCAFFOLD_TEMPLATE_ENTRIES = Object.freeze({
-  "hello-world": null,
-  "database-service": Object.freeze({ entry: "database", writes: "database-backed service" }),
-  "scheduled-job": Object.freeze({ entry: "schedule", writes: "service that runs a scheduled job" })
+  "hello-world": Object.freeze([]),
+  "database-service": Object.freeze([Object.freeze({ entry: "database", writes: "database-backed service" })]),
+  "scheduled-job": Object.freeze([Object.freeze({ entry: "schedule", writes: "service that runs a scheduled job" })]),
+  "web-app": Object.freeze(
+    ["database", "account", "ai_allowance"].map((entry) => Object.freeze({ entry, writes: "web app with sign-in, a database, and the AI allowance" }))
+  )
 });
 var scaffoldLineOf = (call) => commandLineOf(call.origin, SCAFFOLD_SUBCOMMAND, {
   options: [
@@ -322,6 +325,33 @@ var settingsOf = (text) => {
   return { settings: [...settings] };
 };
 
+// src/wire_version.ts
+var WIRE_VERSION = /^(\d{4}-\d{2}-\d{2})\.(\d+)$/;
+var PLANE_WIRE_KEYS = ["action_payloads", "management_api", "wire_errors"];
+function parseWireVersion(value) {
+  if (typeof value !== "string") return null;
+  const match = WIRE_VERSION.exec(value);
+  if (!match) return null;
+  const counter = Number(match[2]);
+  if (!Number.isSafeInteger(counter)) return null;
+  return { date: match[1], counter };
+}
+var isWireVersion = (value) => parseWireVersion(value) !== null;
+function compareWireVersions(a, b) {
+  const x2 = parseWireVersion(a);
+  const y = parseWireVersion(b);
+  if (!x2 || !y) throw new Error("a wire version is a date, a dot, and a counter (MAPI-02).");
+  if (x2.date !== y.date) return x2.date < y.date ? -1 : 1;
+  return x2.counter === y.counter ? 0 : x2.counter < y.counter ? -1 : 1;
+}
+
+// src/turnzero_cloud_command/plane_wire.ts
+var PLANE_WIRE_NEEDED = Object.freeze({
+  action_payloads: "2026-10-10.11",
+  management_api: "2026-10-10.5",
+  wire_errors: "2026-10-10.6"
+});
+
 // src/turnzero_cloud_command/version.ts
 import { readFileSync } from "node:fs";
 var MANIFEST_BESIDE_BUNDLE = "../package.json";
@@ -362,10 +392,12 @@ var commandOriginOf = (text) => {
 };
 var MINTED_TOKEN_OUTSIDE_OPENING = `${DEPLOY_OPTION.origin} names an address this run does not send its minted token to.`;
 var firstPartyOriginWayOn = (origin) => `Set ${ORIGIN_VARIABLE} to ${origin} beside ${MINTED_TOKEN_VARIABLE} and run the line again, since that variable, never the line, states where the minted token goes.`;
+var MINTED_TOKEN_HELD_ALONE = `${MINTED_TOKEN_OUTSIDE_OPENING} Where ${ORIGIN_VARIABLE} is set, a line run by a tool connected by a minted token, or by a job, sends the token in ${MINTED_TOKEN_VARIABLE} only to the address that variable holds, so ${DEPLOY_OPTION.origin} may name that address alone. Where the platform is at another address, set ${ORIGIN_VARIABLE} to it beside the token, or unset the variable for the command's default address, and run the line again.`;
 var mintedTokenOriginOf = (env, named, closing) => {
   const held = heldOriginOf(env, named, closing, {
     variable: "a line run by a tool connected by a minted token, or by a job, sends the minted token to the address the variable names",
-    outside: `${MINTED_TOKEN_OUTSIDE_OPENING} A line run by a tool connected by a minted token, or by a job, sends the token in ${MINTED_TOKEN_VARIABLE} only to ${DEFAULT_COMMAND_ORIGIN} or to the address ${ORIGIN_VARIABLE} holds in the same environment. Where the platform is at another address, set ${ORIGIN_VARIABLE} to it beside the token, and run the line again.`
+    outside: `${MINTED_TOKEN_OUTSIDE_OPENING} A line run by a tool connected by a minted token, or by a job, sends the token in ${MINTED_TOKEN_VARIABLE} only to ${DEFAULT_COMMAND_ORIGIN} or to the address ${ORIGIN_VARIABLE} holds in the same environment. Where the platform is at another address, set ${ORIGIN_VARIABLE} to it beside the token, and run the line again.`,
+    heldAlone: MINTED_TOKEN_HELD_ALONE
   });
   if (!("refusal" in held) || named === void 0 || (env[ORIGIN_VARIABLE] ?? "").trim() !== "") return held;
   const given = originOf(named);
@@ -383,6 +415,9 @@ var heldOriginOf = (env, named, closing, words) => {
   if (named === void 0) return { origin: fromEnvironment ?? DEFAULT_COMMAND_ORIGIN };
   const given = commandOriginOf(named);
   if ("refusal" in given) return given;
+  if (fromEnvironment !== null && words.heldAlone !== void 0) {
+    return given.origin === fromEnvironment ? given : { refusal: `${words.heldAlone} ${closing}` };
+  }
   if (given.origin === DEFAULT_COMMAND_ORIGIN || given.origin === fromEnvironment || (words.admitted ?? []).includes(given.origin)) return given;
   return { refusal: `${words.outside} ${closing}` };
 };
@@ -444,6 +479,49 @@ var refusalLines = (act, status, refusal) => [
 ];
 var PLATFORM_FAILURE_STATUS = 500;
 var failureLines = (act, status, said) => said === null ? [`The ${act} was answered HTTP ${status}, a failure of the platform's or of a server between.`] : [answerLineOf(act, "failed", status, said.error), ...said.detail !== null ? [oneLine(said.detail)] : []];
+var HEALTH_READ_PATH = "/healthz";
+var PLANE_CHECK_BOUND_SECONDS = 10;
+var WIRE_FILE_NOUNS = Object.freeze({
+  action_payloads: "action forms",
+  management_api: "actions",
+  wire_errors: "refusals"
+});
+var PLANE_OLDER_WAY_ON = "Nothing was started: run this command again once the origin serves a newer release.";
+var PLANE_OLDER_FIRST_ACT_WAY_ON = "Nothing was started: once the origin serves a newer release, start again with the first act.";
+var planeOlderSentence = (version, origin, key, needs, served, tokenCodeUnread) => `${TURNZERO_CLOUD_PACKAGE} ${version} needs ${WIRE_FILE_NOUNS[key]} of ${needs} or later, and ${origin} serves ${served}, an older Turn Zero Cloud. ${tokenCodeUnread === void 0 ? PLANE_OLDER_WAY_ON : `${PLANE_OLDER_FIRST_ACT_WAY_ON} ${tokenCodeUnread}`}`;
+var servedWireOf = async (io2, origin) => {
+  const controller = new AbortController();
+  const cancel = io2.schedule(PLANE_CHECK_BOUND_SECONDS * 1e3, () => controller.abort());
+  try {
+    const response = await io2.fetch(`${origin}${HEALTH_READ_PATH}`, { method: "GET", redirect: "manual", signal: controller.signal });
+    if (response.status !== 200 || redirected(response)) {
+      await response.body?.cancel().catch(() => void 0);
+      return null;
+    }
+    const wire = planeObjectOf(await response.text())?.wire;
+    if (wire === null || typeof wire !== "object" || Array.isArray(wire)) return null;
+    return Object.fromEntries(Object.entries(wire).filter((entry) => typeof entry[1] === "string"));
+  } catch {
+    return null;
+  } finally {
+    cancel();
+  }
+};
+var olderMemberOf = (served, needed = PLANE_WIRE_NEEDED) => {
+  for (const key of PLANE_WIRE_KEYS) {
+    const needs = needed[key];
+    const have = Object.prototype.hasOwnProperty.call(served, key) ? served[key] : void 0;
+    if (!isWireVersion(needs) || !isWireVersion(have)) continue;
+    if (compareWireVersions(have, needs) < 0) return { key, needs, served: have };
+  }
+  return null;
+};
+var planeWireRefusal = async (io2, origin, tokenCodeUnread) => {
+  const served = await servedWireOf(io2, origin);
+  if (served === null) return null;
+  const older = olderMemberOf(served);
+  return older === null ? null : planeOlderSentence(commandVersion(), origin, older.key, older.needs, older.served, tokenCodeUnread);
+};
 
 // src/turnzero_cloud_command/credential_file.ts
 var CREDENTIAL_FILE_VERSION = 1;
@@ -704,8 +782,8 @@ var VARIABLE_ROUTE_SENTENCES = `A tool connected by a minted token, or a job, ca
 var SIGNED_IN_ROUTE_OPENER = "A tool signed in to the platform authorizes this computer instead:";
 
 // src/turnzero_cloud_command/guard.ts
-var GRANT_TEXT = new RegExp(`${UPLOAD_GRANT_PREFIX}[A-Za-z0-9_-]*`, "g");
-var TOKEN_TEXT = new RegExp(`${MINTED_TOKEN_PREFIX}[A-Za-z0-9_-]*`, "g");
+var GRANT_TEXT = new RegExp(`${UPLOAD_GRANT_PREFIX}[A-Za-z0-9_-]*(?:\\.[A-Za-z0-9_-]+)*`, "g");
+var TOKEN_TEXT = new RegExp(`${MINTED_TOKEN_PREFIX}[A-Za-z0-9_-]*(?:\\.[A-Za-z0-9_-]+)*`, "g");
 var REDACTED_GRANT = "<grant>";
 var REDACTED_VALUE = "<value>";
 var REDACTED_TOKEN_CODE = "<token code>";
@@ -756,8 +834,10 @@ var guarded = (io2) => {
 // src/turnzero_cloud_command/authorize.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
 import { hostname } from "node:os";
-var TOKEN_CODE_UNREAD = "A token code the line carried was not read or not presented: it is live until it expires, and it mints nothing without this computer's verifier. Run the line again once the cause above is put right.";
-var tokenCodeFloorSentence = (found) => `The command needs Node.js ${COMMAND_NODE_FLOOR} or later, and this machine runs Node.js ${found}, so nothing was read and nothing was started. A token code the line carried was not read: it is live until it expires, and it mints nothing without this computer's verifier. Install Node.js ${COMMAND_NODE_FLOOR} or later, then run the line again.`;
+var TOKEN_CODE_UNREAD_FIRST = "A token code the line carried was not read or not presented: it is live until it expires, and it mints nothing without this computer's verifier.";
+var TOKEN_CODE_RUN_AGAIN = "Run the line again once the cause above is put right.";
+var TOKEN_CODE_UNREAD = `${TOKEN_CODE_UNREAD_FIRST} ${TOKEN_CODE_RUN_AGAIN}`;
+var tokenCodeFloorSentence = (version, found) => `${TURNZERO_CLOUD_PACKAGE} ${version} needs Node.js ${COMMAND_NODE_FLOOR} or later, and this machine runs Node.js ${found}, so nothing was read and nothing was started. A token code the line carried was not read: it is live until it expires, and it mints nothing without this computer's verifier. Install Node.js ${COMMAND_NODE_FLOOR} or later, then run the line again.`;
 var NOTHING_SENT = "Nothing was sent and nothing was started.";
 var carriesTokenCode = (argv2) => argv2[0] === AUTHORIZE_SUBCOMMAND || argv2[0] === TOKEN_SUBCOMMAND && argv2[1] === TOKEN_CLAIM_ACT;
 var LABEL_FALLBACK = "authorized computer";
@@ -788,8 +868,12 @@ var mintCallMembers = (kind, challenge, label) => kind === "authorized computer"
 ] : [[CODE_CHALLENGE_MEMBER, challenge]];
 var firstActWayOn = (kind) => kind === "authorized computer" ? `Where the platform refuses ${CODE_CHALLENGE_MEMBER}, it does not yet serve this authorization: deploy by the line your tool's deploy call answers until the platform's next release.` : `Where the platform refuses ${CODE_CHALLENGE_MEMBER}, it does not yet serve this mint: until the platform's next release, ${MINT_TOKEN_ACTION} without it answers the token's value as it does today.`;
 var firstActNamed = (kind, origin = DEFAULT_COMMAND_ORIGIN) => `${kind === "authorized computer" ? AUTHORIZE_SUBCOMMAND : `${TOKEN_SUBCOMMAND} ${TOKEN_REQUEST_ACT}`}${originWordsOf(origin)}`;
+var noConnectionLine = (origin) => `Where your tool holds no connection signed in to ${origin}, ${MINT_TOKEN_ACTION} is not among its tools: a person connects the tool and signs in, in a browser, before the call.`;
 var firstActLines = (origin, kind, pending, label) => [
   kind === "authorized computer" ? `To authorize this computer at ${origin}, call ${MINT_TOKEN_ACTION} from your tool, through the connection you signed in with, naming the members below and no others, then run the line it answers once, as given, on this computer.` : `To mint a token whose value never passes through the chat, call ${MINT_TOKEN_ACTION} at ${origin} from your tool, through the connection you signed in with, naming the member below beside the scope_kind, application, grants, label, and expires_in_days the task needs.`,
+  // The case this command cannot see (#4273): a tool with no signed-in
+  // connection holds no mint_token, and only a person's sign-in mends it.
+  noConnectionLine(origin),
   `${CHALLENGE_LINE_HEAD}${pending.challenge}`,
   CALL_LINE_HEAD,
   ...mintCallMembers(kind, pending.challenge, label).map(([name, value]) => `  ${name}: ${JSON.stringify(value)}`),
@@ -941,6 +1025,12 @@ async function completeAct(io2, origin, kind, code, userAgent, say, deliver = ()
       return COMMAND_STATUS.nothing_started;
     }
     if (stage.ended) return COMMAND_STATUS.nothing_started;
+    const older = await planeWireRefusal(io2, origin, TOKEN_CODE_UNREAD_FIRST);
+    if (stage.ended) return COMMAND_STATUS.nothing_started;
+    if (older !== null) {
+      say(older);
+      return COMMAND_STATUS.nothing_started;
+    }
     stage.now = "sent";
     const answered = await postAction(io2, origin, MINT_TOKEN_ACTION, code, userAgent, exchangeBodyOf(pending.verifier));
     if (stage.ended) {
@@ -1090,7 +1180,7 @@ var AUTHORIZE_ROW = Object.freeze({
     done: "the challenge printed, or this computer authorized",
     failed: "a token was minted and not kept, or the token this computer held before was not revoked: the printed lines name revoke_token",
     unknown: "the exchange drew no answer, or an answer that is not a refusal: list_tokens shows whether a token was minted",
-    nothing_started: "nothing was minted: an option, the credential file, or the token code was refused, no request was pending, or the exchange was refused"
+    nothing_started: "nothing was minted: an option, the credential file, or the token code was refused, no request was pending, the platform was too old, or the exchange was refused"
   },
   variables: [[ORIGIN_VARIABLE, AUTHORIZATION_ORIGIN_VARIABLE_LINE]],
   note: [
@@ -1549,6 +1639,11 @@ async function exportDownload(call, io2) {
     }
     index = earlier;
   }
+  const older = await planeWireRefusal(io2, options.origin);
+  if (older !== null) {
+    io2.print(older);
+    return COMMAND_STATUS.nothing_started;
+  }
   const headers = { authorization: `Bearer ${grant.credential}`, "user-agent": agent.userAgent, "accept-encoding": "identity" };
   const exportArea = exportAreaName(options.application);
   let pause = null;
@@ -1819,7 +1914,7 @@ var EXPORT_DOWNLOAD_ROW = Object.freeze({
     done: "every file the manifest names on disk, moved ones reported",
     failed: "a file failed, cut short or refused: the closing lines name the line run again, or a fresh export where a file was answered as an absent name",
     unknown: `the run stopped before the end: a fresh line from ${DOWNLOAD_GRANT_ACTION} resumes it`,
-    nothing_started: "an option, the grant, the folder, or the manifest was refused, and nothing was written"
+    nothing_started: "an option, the grant, the folder, or the manifest was refused, or the platform was too old, and nothing was written"
   },
   note: [`Run the ${EXPORT_SUBCOMMAND} download line a ${DOWNLOAD_GRANT_ACTION} call answers as given, before its grant expires, from a folder that is not an application's, or with ${EXPORT_OPTION.path} naming one outside it. It writes into a new or empty folder, or one an earlier run of the same export wrote, whose files on disk it skips.`],
   afterOwnError: EXPORT_AFTER_OWN_ERROR,
@@ -2644,7 +2739,7 @@ var DEPLOY_OPTIONS = Object.freeze([
     name: DEPLOY_OPTION.origin,
     value: "<origin>",
     required: false,
-    description: `The platform's address. Where absent, the address ${ORIGIN_VARIABLE} holds, or ${DEFAULT_COMMAND_ORIGIN} where it is unset. Under ${MINTED_TOKEN_VARIABLE} the token is sent only to ${DEFAULT_COMMAND_ORIGIN} or to the address ${ORIGIN_VARIABLE} holds. Otherwise it names the address whose token the command reads from this computer's credential file, and that token is sent to that address alone.`
+    description: `The platform's address. Where absent, the address ${ORIGIN_VARIABLE} holds, or ${DEFAULT_COMMAND_ORIGIN} where it is unset. Under ${MINTED_TOKEN_VARIABLE} the token is sent only to the address ${ORIGIN_VARIABLE} holds, or to ${DEFAULT_COMMAND_ORIGIN} where it is unset. Otherwise it names the address whose token the command reads from this computer's credential file, and that token is sent to that address alone.`
   },
   {
     name: DEPLOY_OPTION.path,
@@ -3139,6 +3234,11 @@ async function deploy(named, io2, flags = /* @__PURE__ */ new Set()) {
   io2.print(zipped.line);
   for (const line of noteLinesOf(zipped.notes, true, zipped.files)) io2.print(line);
   const commit = zipped.source === "folder" ? commitOfZippedFolder(options.path) : null;
+  const older = await planeWireRefusal(io2, origin);
+  if (older !== null) {
+    io2.print(older);
+    return PROGRESS_EXIT_STATUS.nothing_started;
+  }
   const prepared = await prepareDeploy(io2, { ...options, origin }, zipped.sha256, credential.credential, agent.userAgent, refused);
   if ("status" in prepared) return prepared.status;
   const unserved = healthPathRefusalOf(prepared, zipped.zip, zipped.places);
@@ -3291,7 +3391,7 @@ var DEPLOY_ROW = Object.freeze({
     done: `the version deployed, or the deploy started where ${DEPLOY_NO_WAIT_VARIABLE} is set`,
     failed: "the deploy failed",
     unknown: "the wait stopped, or the start drew no answer: the deploy may go on, and read_status reads it",
-    nothing_started: "an option, the credential, or the folder was refused, no credential was read, the preparing call answered no usable upload, the zip holds no file at the health path, the upload or the start was refused, or the upload drew no answer"
+    nothing_started: "an option, the credential, or the folder was refused, no credential was read, the platform was too old, no usable upload was answered, no zipped file names the health path, the upload or start was refused, or the upload drew no answer"
   },
   variables: [[DEPLOY_NO_WAIT_VARIABLE, "any value returns the command once the deploy has started, without waiting for it."]],
   note: [
@@ -3299,7 +3399,7 @@ var DEPLOY_ROW = Object.freeze({
     `On a computer with no token for that address, or one that has expired, it sends nothing, ends 3, and prints two routes, in this order. A tool connected by a minted token, or a job with no tool, such as a CI job's, cannot use ${MINT_TOKEN_ACTION}: it sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, such as the job's secret store, never by writing the value in a line, and ${ORIGIN_VARIABLE} to the address that minted the token where that is not ${DEFAULT_COMMAND_ORIGIN}, then runs the deploy line again.`,
     `A tool signed in to the platform makes the ${MINT_TOKEN_ACTION} call the run prints with its challenge, runs the line that call answers, then runs the deploy line again. The credential file is ${CREDENTIAL_FILE_WORDS}.`,
     `A tool sets ${MINTED_TOKEN_VARIABLE} for the deploy or check line alone and unsets it once that line ends, since the command cannot unset a variable of the shell that started it. A job's token is minted for the application, with an expiry. The variable's token wins over the credential file: the command makes the preparing call under that token, and sends the token in no other request.`,
-    `Under the variable, the command sends its token only to ${DEFAULT_COMMAND_ORIGIN} or to the address ${ORIGIN_VARIABLE} holds, an address of this machine among them only where the variable names it: under the token, ${DEPLOY_OPTION.origin} must name one of those, and where the line names none the command addresses ${ORIGIN_VARIABLE}'s address. ${DEPLOY_OPTION.env} names the environment where a line names one, ${COMMAND_ENVIRONMENTS.join(" or ")}; where none is named, the platform chooses, and the command deploys to the environment the platform answers.`,
+    `Under the variable, the command sends its token only to the address ${ORIGIN_VARIABLE} holds, or to ${DEFAULT_COMMAND_ORIGIN} where that variable is unset: under the token, ${DEPLOY_OPTION.origin} may name that address alone, and where the line names none the command addresses it. ${DEPLOY_OPTION.env} names the environment where a line names one, ${COMMAND_ENVIRONMENTS.join(" or ")}; where none is named, the platform chooses, and the command deploys to the environment the platform answers.`,
     `A progress read answered 502, 503, or 504, which is often temporary, is made again, at most three more times, and an upload answered 503 credential_lookup_busy, which wrote nothing, is made again after the wait it names, at most twice.`,
     `After its zip line, ${DEPLOY_SUBCOMMAND} prints the folder's top-level entries the zip holds on one line, at most ten and then the count of the rest, and ${HASH_SUBCOMMAND} ${HASH_OPTION.list} names every file; no such line prints for a .zip file.`,
     `Then it prints the paths the zip left out, a warning for a .zip file at the folder's root, a warning for a file that looks like a key or a credential, and a warning for a health path that no file names, package files and documentation set aside, each on a line of its own and only where there is something to name. The health warning refuses nothing.`,
@@ -3349,7 +3449,7 @@ var CHECK_OPTIONS = Object.freeze([
     name: CHECK_OPTION.origin,
     value: "<origin>",
     required: false,
-    description: `The platform's address. Where absent, the address ${ORIGIN_VARIABLE} holds, or ${DEFAULT_COMMAND_ORIGIN} where it is unset. Under ${MINTED_TOKEN_VARIABLE} the token is sent only to ${DEFAULT_COMMAND_ORIGIN} or to the address ${ORIGIN_VARIABLE} holds. Otherwise it names the address whose token the command reads from this computer's credential file, and that token is sent to that address alone.`
+    description: `The platform's address. Where absent, the address ${ORIGIN_VARIABLE} holds, or ${DEFAULT_COMMAND_ORIGIN} where it is unset. Under ${MINTED_TOKEN_VARIABLE} the token is sent only to the address ${ORIGIN_VARIABLE} holds, or to ${DEFAULT_COMMAND_ORIGIN} where it is unset. Otherwise it names the address whose token the command reads from this computer's credential file, and that token is sent to that address alone.`
   },
   {
     name: CHECK_OPTION.path,
@@ -3505,6 +3605,11 @@ async function check(named, io2) {
     return COMMAND_STATUS.nothing_started;
   }
   io2.print(zipped.line);
+  const older = await planeWireRefusal(io2, origin);
+  if (older !== null) {
+    io2.print(older);
+    return COMMAND_STATUS.nothing_started;
+  }
   const answer = await callCheck(io2, { ...options, origin }, credential.credential, agent.userAgent, refused);
   if ("status" in answer) return answer.status;
   for (const line of noteLinesOf(zipped.notes, !answer.firstDeploy, zipped.files)) io2.print(line);
@@ -3526,7 +3631,7 @@ var CHECK_ROW = Object.freeze({
   statuses: {
     done: "none of the checks would refuse a deploy now",
     failed: "a deploy would be refused now, the refused: lines naming each refusal",
-    nothing_started: "nothing was checked: an option, the credential, or the folder was refused, no credential was read and the two routes to one were printed, or the check call was refused, drew no answer, was redirected, or was answered by a failure"
+    nothing_started: "nothing was checked: an option, the credential, or the folder was refused, no credential was read and the two routes to one were printed, the platform was too old, or the check call was refused, drew no answer, was redirected, or failed"
   },
   note: [
     `A check is one line, which carries no credential: run the line your tool's ${CHECK_ACTION} call answers, or ${CHECK_SUBCOMMAND} ${CHECK_OPTION.application} <application id>, from the application's folder, before a first deploy and after each fix. It reads its credential and the platform's address as ${DEPLOY_SUBCOMMAND} does, builds the zip ${DEPLOY_SUBCOMMAND} builds, and sends the platform the application alone, no byte of the zip and no hash. It uploads nothing and starts nothing.`,
@@ -3570,7 +3675,7 @@ async function hash(named, io2, flags = /* @__PURE__ */ new Set()) {
 }
 var HASH_ROW = Object.freeze({
   name: HASH_SUBCOMMAND,
-  summary: `Prints ${HASH_LINE_HEAD}<hash> on its first line: the SHA-256 of the zip deploy uploads from the same folder, or of a .zip file's bytes. It reads what a deploy from the folder would upload, and no deploy needs it first. A further line follows only where there is something to name: the paths the zip left out, a .zip file at the folder's root, a file that looks like a key or a credential, or a health path of manifest.json that no file names, package files and documentation set aside. With ${HASH_OPTION.list}, one line follows for each file the zip holds. It reads no grant and sends nothing, so a ${HASH_OPTION.origin} the line carries is checked and set aside.`,
+  summary: `Prints ${HASH_LINE_HEAD}<hash> on the line after the version line: the SHA-256 of the zip deploy uploads from the same folder, or of a .zip file's bytes. It reads what a deploy from the folder would upload, and no deploy needs it first. A further line follows only where there is something to name: the paths the zip left out, a .zip file at the folder's root, a file that looks like a key or a credential, or a health path of manifest.json that no file names, package files and documentation set aside. With ${HASH_OPTION.list}, one line follows for each file the zip holds. It reads no grant and sends nothing, so a ${HASH_OPTION.origin} the line carries is checked and set aside.`,
   options: HASH_OPTIONS,
   credential: null,
   statuses: { done: "the hash printed", nothing_started: "no hash was printed" },
@@ -3699,7 +3804,9 @@ var SECRET_OPTIONS = Object.freeze([
     name: SECRET_OPTION.valueVariable,
     value: "<variable name>",
     required: false,
-    description: "The name of an environment variable that holds the value, for a run where a machine sets it, such as a hosted run's secrets store. The line names the variable, never its value, and an unset or empty variable is refused."
+    // The refusal of the command's own credential variables is value.ts's
+    // valueVariableFault (PLD-L0-97), named here from the same list.
+    description: `The name of an environment variable that holds the value, for a run where a machine sets it, such as a hosted run's secrets store. The line names the variable, never its value, and an unset or empty variable is refused. So is a name of the command's own credential variables, ${COMMAND_CREDENTIAL_VARIABLES.join(" or ")}, in any case.`
   },
   {
     name: SECRET_OPTION.valuePrompt,
@@ -3834,6 +3941,11 @@ async function secret(call, io2) {
   }
   io2.hide(read2.value, REDACTED_VALUE);
   if (options.valueFile !== null && valueFileWouldDeploy(io2, io2.cwd, options.valueFile)) io2.print(VALUE_FILE_WARNING);
+  const older = await planeWireRefusal(io2, sent.origin);
+  if (older !== null) {
+    io2.print(older);
+    return COMMAND_STATUS.nothing_started;
+  }
   if (credential.source === "credential_file") io2.print(underTokenLine(credential.origin));
   const unknown = secretUnknownSentence(options.act);
   let answered;
@@ -3990,6 +4102,11 @@ async function put(call, io2) {
     io2.print(`The file ${PUT_OPTION.path} names could not be read (${errorCodeOf(error)}). ${PUT_NOTHING_SENT}`);
     return COMMAND_STATUS.nothing_started;
   }
+  const older = await planeWireRefusal(io2, options.origin);
+  if (older !== null) {
+    io2.print(older);
+    return COMMAND_STATUS.nothing_started;
+  }
   let answered;
   try {
     answered = await writeAgain(
@@ -4517,13 +4634,16 @@ var withDependency = (text, parsed, name, spec) => {
 `;
 };
 var MAKE_PACKAGE_FILE = "Make the application's package.json first, in app/ or at the project's root, then run this line again.";
-var templateTakingOf = (name) => SCAFFOLD_TEMPLATES.find((template) => SCAFFOLD_TEMPLATE_ENTRIES[template]?.entry === name) ?? null;
+var templateTakingOf = (name) => {
+  const taking = SCAFFOLD_TEMPLATES.filter((template) => SCAFFOLD_TEMPLATE_ENTRIES[template].some((row) => row.entry === name));
+  return taking.find((template) => SCAFFOLD_TEMPLATE_ENTRIES[template].length === 1) ?? taking[0] ?? null;
+};
 var OTHER_WAY_ON = Object.freeze({ clause: MAKE_PACKAGE_FILE, after: null });
 var MAKE_OWN_PACKAGE_FILE = "For an application you already have, make its package.json first, then run this line again.";
 var noPackageWayOnOf = (io2, options, name) => {
   const template = templateTakingOf(name);
-  const taking = template === null ? null : SCAFFOLD_TEMPLATE_ENTRIES[template];
-  if (template === null || taking === null) return OTHER_WAY_ON;
+  const taking = template === null ? void 0 : SCAFFOLD_TEMPLATE_ENTRIES[template].find((row) => row.entry === name);
+  if (template === null || taking === void 0) return OTHER_WAY_ON;
   const app = join7(options.root, "app");
   let empty;
   try {
@@ -4726,7 +4846,7 @@ var committedFilesOf = (copied, written) => {
 var COPY_PACKAGES_CLAUSE = "copy the packages line into the application manifest's packages member at each submission; ";
 var installFailedSentence = (folder) => `npm install in ${folder} did not finish: the entry, its row, and the copy are written. Run npm install there again; running this line again takes the entry again whole.`;
 var LIBRARY_AFTER_OWN_ERROR = "the entry's folder, its manifest row, or the application's copy may stand in part, and running the line again replaces each whole";
-async function readTake(io2, options, userAgent, planOf) {
+async function readTake(io2, options, userAgent, planOf, planeChecked = false) {
   const refuse = (...lines) => ({ lines });
   const found = libraryFolderOf(io2, options.root);
   if ("refusal" in found) return refuse(found.refusal);
@@ -4742,6 +4862,10 @@ async function readTake(io2, options, userAgent, planOf) {
   const manifest = found.fresh ? { rows: null, stood: null } : manifestRowsOf(io2, library);
   if ("refusal" in manifest) return refuse(manifest.refusal);
   if (manifest.rows === null && !found.fresh && entryFoldersIn(io2, library).length > 0) return refuse(sourceSentence(`holds entries and no ${MANIFEST_FILE2}`));
+  if (!planeChecked) {
+    const older = await planeWireRefusal(io2, options.origin);
+    if (older !== null) return refuse(older);
+  }
   const list = await readOf(io2, options.origin, userAgent, { name: options.entry }, LIST_READ);
   if ("lines" in list) return refuse(...list.lines);
   const entry = listedEntryOf(list.answer, options.entry);
@@ -5005,7 +5129,7 @@ var PROVISION_OPTIONS = Object.freeze([
     name: PROVISION_OPTION.origin,
     value: "<origin>",
     required: false,
-    description: `The platform's address, which is also written as ${LOCAL_RUN_SETTING.api} and ${LOCAL_RUN_SETTING.gatewayUrl}. Where absent, ${DEFAULT_COMMAND_ORIGIN}.`
+    description: `The platform's address, which is also written as ${LOCAL_RUN_SETTING.api} and ${LOCAL_RUN_SETTING.gatewayUrl}. Where absent, ${DEFAULT_COMMAND_ORIGIN}; with no grant piped, the address ${ORIGIN_VARIABLE} holds where it is set. Under ${MINTED_TOKEN_VARIABLE} the token is sent only to the address ${ORIGIN_VARIABLE} holds, or to ${DEFAULT_COMMAND_ORIGIN} where it is unset. Otherwise, with no grant piped, it names the address whose token the command reads from this computer's credential file, and that token is sent to that address alone.`
   }
 ]);
 var PROVISION_CREDENTIAL = Object.freeze({
@@ -5164,6 +5288,11 @@ async function provision(call, io2) {
     dropWritingFile(io2, options.envFile);
   });
   try {
+    const older = await planeWireRefusal(io2, sent.origin);
+    if (older !== null) {
+      io2.print(older);
+      return COMMAND_STATUS.nothing_started;
+    }
     return await remintAndWrite(io2, sent, agent.userAgent, read2, standing.text, reminted);
   } finally {
     release();
@@ -5858,6 +5987,684 @@ var SCAFFOLD_TEMPLATE_FILES = Object.freeze({
       "});",
       ""
     ].join("\n")]
+  ]),
+  "web-app": Object.freeze([
+    [".gitignore", [
+      "node_modules/",
+      ".env",
+      ".env.*",
+      ""
+    ].join("\n")],
+    ["AGENTS.md", [
+      "# This service runs on Turn Zero Cloud",
+      "",
+      "The service in this folder is hosted on Turn Zero Cloud. It started from the platform's `web-app` template: a Node.js service with a web page, sign-in for its users, each user's own rows in the platform's database, and an AI model under the plan's allowance.",
+      "",
+      "## Where you build",
+      "",
+      "- The page: `client/`, plain HTML, CSS, and script, which the platform serves at the application's address.",
+      "- The routes: `src/server.mjs`. Each route under `/api/` reads the signed-in user, and keeps and lists that user's own rows.",
+      "- The AI model: `src/ai.mjs`, which calls it under the plan's allowance, with no key of your own.",
+      "- The tables: `migrations/`, one file for each change, applied in order at each start.",
+      "",
+      "## Where the rules are",
+      "",
+      "Turn Zero Cloud serves its rules to a coding tool through its MCP server, `turnzero-cloud`, and they change with the platform, so none is repeated here.",
+      "",
+      `- Where the server is not connected, connect it first. The platform's page "Connect your tool" says how.`,
+      "- Before you change or deploy this service, read the server's `deploy` skill, and before you change its sign-in or its AI call, the server's `add-sign-in` or `use-ai-allowance` skill.",
+      "",
+      "## What you run here",
+      "",
+      "- The tests: `npm test`, in this folder.",
+      "- A local run and a deploy: the `deploy` skill gives each step and the line to run, in this order: `submit_manifest`, the local run, `deploy`.",
+      "- Sign-in is on the deployed application's own address, also during a local run, since the page a local run serves has no sign-in routes. A local run's API routes take a session as a Bearer.",
+      ""
+    ].join("\n")],
+    ["client/app.js", [
+      "// client/app.js: the page's script. It calls the backend on the same",
+      "// address, so the browser sends the sign-in cookie with each request.",
+      "",
+      "// The rows' name, and the route that adds and lists the signed-in user's rows.",
+      "const PLURAL = 'notes';",
+      "const ROUTE = '/api/notes';",
+      "",
+      "// The fields of one row, each with its kind: the form's inputs and the list's columns.",
+      "const FIELDS = [{ name: 'title', kind: 'text' }];",
+      "",
+      "// The input each kind of field takes.",
+      "const INPUT_TYPES = { text: 'text', integer: 'number', boolean: 'checkbox', timestamp: 'datetime-local' };",
+      "",
+      "// Why the AI model gave no answer, by the error the route answers with 503.",
+      "const UNANSWERED = {",
+      `  allowance_drawn: "This month's AI allowance is drawn, so the model gives no answer until it resets.",`,
+      "  allowance_unavailable: 'The platform holds no key for the AI allowance yet, so the model gives no answer now.',",
+      "  upstream_quota: 'The AI model is out of capacity now: ask again in a while.',",
+      "};",
+      "",
+      "const byId = (id) => document.getElementById(id);",
+      "",
+      "// A field's value as the route takes it: a string, a number, true or false, or an ISO time.",
+      "function valueOf(field, input) {",
+      "  if (field.kind === 'boolean') return input.checked;",
+      "  if (input.value === '') return field.kind === 'text' ? '' : null;",
+      "  if (field.kind === 'integer') return Number(input.value);",
+      "  if (field.kind === 'timestamp') return new Date(input.value).toISOString();",
+      "  return input.value;",
+      "}",
+      "",
+      "// The signed-in user, from the platform's own route: null where no one is signed in.",
+      "async function signedInUser() {",
+      "  const response = await fetch('/__account/me');",
+      "  if (response.status === 200) return (await response.json()).user;",
+      "  if (response.status === 404) {",
+      `    byId('who').textContent = "This address serves no sign-in. Sign-in is on the application's deployed address; a local run's API routes take a session as a Bearer.";`,
+      "    return undefined;",
+      "  }",
+      "  return null;",
+      "}",
+      "",
+      "async function showRows() {",
+      "  const response = await fetch(ROUTE);",
+      "  const list = byId('rows');",
+      "  list.replaceChildren();",
+      "  if (response.status !== 200) return;",
+      "  for (const row of await response.json()) {",
+      "    const item = document.createElement('li');",
+      "    item.textContent = FIELDS.map((field) => (FIELDS.length === 1 ? String(row[field.name]) : `${field.name}: ${row[field.name]}`)).join(', ');",
+      "    list.append(item);",
+      "  }",
+      "}",
+      "",
+      "function buildForm() {",
+      "  const inputs = FIELDS.map((field) => {",
+      "    const label = document.createElement('label');",
+      "    label.textContent = field.name;",
+      "    const input = document.createElement('input');",
+      "    input.type = INPUT_TYPES[field.kind];",
+      "    input.name = field.name;",
+      "    if (field.kind !== 'boolean') input.required = true;",
+      "    label.append(input);",
+      "    byId('fields').append(label);",
+      "    return input;",
+      "  });",
+      "  byId('add').addEventListener('submit', async (event) => {",
+      "    event.preventDefault();",
+      "    const row = Object.fromEntries(FIELDS.map((field, index) => [field.name, valueOf(field, inputs[index])]));",
+      "    const response = await fetch(ROUTE, { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify(row) });",
+      "    const error = byId('add-error');",
+      "    error.hidden = response.status === 201;",
+      "    if (response.status !== 201) {",
+      "      error.textContent = `The row was not added (status ${response.status}).`;",
+      "      return;",
+      "    }",
+      "    byId('add').reset();",
+      "    await showRows();",
+      "  });",
+      "}",
+      "",
+      "function buildAsk() {",
+      "  byId('ask').addEventListener('submit', async (event) => {",
+      "    event.preventDefault();",
+      "    const answer = byId('answer');",
+      "    answer.textContent = 'Asking.';",
+      "    const response = await fetch('/api/ask', { method: 'POST', headers: { 'content-type': 'application/json' }, body: JSON.stringify({ question: byId('question').value }) });",
+      "    if (response.status === 200) answer.textContent = (await response.json()).answer;",
+      "    else if (response.status === 503) answer.textContent = UNANSWERED[(await response.json()).error] ?? 'The AI model gave no answer now.';",
+      "    else answer.textContent = `The question was not answered (status ${response.status}).`;",
+      "  });",
+      "}",
+      "",
+      "async function start() {",
+      "  const user = await signedInUser();",
+      "  if (user === undefined) return;",
+      "  if (user === null) {",
+      "    byId('who').textContent = 'No one is signed in.';",
+      "    byId('sign-in').hidden = false;",
+      "    return;",
+      "  }",
+      "  const address = user.addresses?.find((held) => held.verified)?.email;",
+      "  byId('who').textContent = `Signed in as ${address ?? user.id}.`;",
+      "  byId('sign-out').hidden = false;",
+      "  byId('rows-title').textContent = `Your ${PLURAL}`;",
+      "  byId('signed-in').hidden = false;",
+      "  buildForm();",
+      "  buildAsk();",
+      "  await showRows();",
+      "}",
+      "",
+      "start();",
+      ""
+    ].join("\n")],
+    ["client/index.html", [
+      "<!doctype html>",
+      '<html lang="en">',
+      "<head>",
+      '  <meta charset="utf-8">',
+      '  <meta name="viewport" content="width=device-width, initial-scale=1">',
+      "  <title>Web app</title>",
+      '  <link rel="stylesheet" href="/styles.css">',
+      "</head>",
+      "<body>",
+      "  <header>",
+      "    <h1>Web app</h1>",
+      '    <p id="who">Reading who is signed in.</p>',
+      "    <nav>",
+      '      <a id="sign-in" href="/__account/signin" hidden>Sign in</a>',
+      '      <a id="sign-out" href="/__account/signout" hidden>Sign out</a>',
+      "    </nav>",
+      "  </header>",
+      '  <main id="signed-in" hidden>',
+      "    <section>",
+      '      <h2 id="rows-title">Your rows</h2>',
+      '      <form id="add">',
+      '        <div id="fields"></div>',
+      '        <button type="submit">Add</button>',
+      "      </form>",
+      '      <p id="add-error" class="error" hidden></p>',
+      '      <ul id="rows"></ul>',
+      "    </section>",
+      "    <section>",
+      "      <h2>Ask the AI model</h2>",
+      '      <form id="ask">',
+      '        <textarea id="question" rows="3" required></textarea>',
+      '        <button type="submit">Ask</button>',
+      "      </form>",
+      '      <p id="answer"></p>',
+      "    </section>",
+      "  </main>",
+      '  <script src="/app.js"></script>',
+      "</body>",
+      "</html>",
+      ""
+    ].join("\n")],
+    ["client/styles.css", [
+      "/* client/styles.css */",
+      ":root {",
+      "  color-scheme: light dark;",
+      "  font-family: system-ui, sans-serif;",
+      "  line-height: 1.5;",
+      "}",
+      "",
+      "body {",
+      "  max-width: 40rem;",
+      "  margin: 0 auto;",
+      "  padding: 1rem;",
+      "}",
+      "",
+      "header nav a {",
+      "  margin-right: 1rem;",
+      "}",
+      "",
+      "form {",
+      "  display: grid;",
+      "  gap: 0.5rem;",
+      "  margin: 1rem 0;",
+      "}",
+      "",
+      "label {",
+      "  display: grid;",
+      "  gap: 0.25rem;",
+      "}",
+      "",
+      "input,",
+      "textarea,",
+      "button {",
+      "  font: inherit;",
+      "  padding: 0.4rem;",
+      "}",
+      "",
+      "button {",
+      "  justify-self: start;",
+      "}",
+      "",
+      "ul {",
+      "  padding-left: 1.2rem;",
+      "}",
+      "",
+      ".error {",
+      "  color: #b00020;",
+      "}",
+      ""
+    ].join("\n")],
+    ["manifest.json", [
+      "{",
+      '  "manifest_version": 1,',
+      '  "services": [{ "kind": "database" }, { "kind": "accounts" }],',
+      '  "health": "/health",',
+      '  "region": "usa",',
+      '  "egress": [],',
+      '  "audience": { "kind": "public" },',
+      '  "packages": []',
+      "}",
+      ""
+    ].join("\n")],
+    ["migrations/0001_notes.sql", [
+      "-- migrations/0001_notes.sql: each row is kept for the user who added it, its owner.",
+      'CREATE TABLE "notes" (',
+      "  id bigserial PRIMARY KEY,",
+      "  owner text NOT NULL,",
+      "  title text NOT NULL CHECK (title <> '')",
+      ");",
+      'CREATE INDEX ON "notes" (owner, id);',
+      ""
+    ].join("\n")],
+    ["package.json", [
+      "{",
+      '  "name": "web-app",',
+      '  "private": true,',
+      '  "type": "module",',
+      '  "scripts": {',
+      '    "start": "node src/main.mjs",',
+      '    "test": "node --test"',
+      "  },",
+      '  "dependencies": {',
+      '    "@turnzero/account": "file:lib/account",',
+      '    "@turnzero/ai_allowance": "file:lib/ai_allowance",',
+      '    "@turnzero/database": "file:lib/database",',
+      '    "pg": "^8.22.0"',
+      "  },",
+      '  "devDependencies": {',
+      '    "@electric-sql/pglite": "0.5.8"',
+      "  }",
+      "}",
+      ""
+    ].join("\n")],
+    ["src/ai.mjs", [
+      "// src/ai.mjs: an answer from an AI model under the plan's AI allowance, with",
+      "// no key of your own, as the guide Call an AI model under the allowance shows.",
+      "import { AllowanceRefusal, AllowanceUpstreamError, generateText } from '@turnzero/ai_allowance';",
+      "",
+      "// The live transport, which only the process entry opens: the platform's",
+      "// origin and this copy's credential, from the settings it receives. A local",
+      "// run receives the development credential, so the same transport works there.",
+      "export function liveTransport() {",
+      "  const origin = process.env.TURNZERO_CLOUD_GATEWAY_URL ?? process.env.TURNZERO_CLOUD_API;",
+      "  return (path, init = {}) =>",
+      "    fetch(origin + path, { ...init, headers: { ...init.headers, authorization: `Bearer ${process.env.TURNZERO_CLOUD_TOKEN}` } });",
+      "}",
+      "",
+      "// The asker over any transport: the live one, or a test double's. It answers",
+      "// { answer } for one question, or { unanswered } naming why the model gave",
+      "// none: allowance_drawn, the month's units are drawn (the refusal",
+      "// allowance_exhausted); allowance_unavailable, the platform's key is not in",
+      "// place; or upstream_quota, the provider is out of capacity.",
+      "export function createAsker(transport) {",
+      "  return async (question) => {",
+      "    try {",
+      "      const answer = await generateText(transport, {",
+      "        system: 'Answer the question in a few sentences.',",
+      "        messages: [{ role: 'user', content: question }],",
+      "        maxOutputTokens: 400,",
+      "      });",
+      "      const { used, quota } = answer.allowance;",
+      "      if (typeof used === 'number' && typeof quota === 'number') console.log(`AI allowance: ${quota - used} of ${quota} units left before this call`);",
+      "      return { answer: answer.text };",
+      "    } catch (error) {",
+      "      // Choose the fallback by the refusal's name, never by its message.",
+      "      const refusal = error instanceof AllowanceRefusal ? error.refusal : null;",
+      "      if (refusal === 'allowance_exhausted') return { unanswered: 'allowance_drawn' };",
+      "      if (refusal === 'allowance_unavailable') return { unanswered: 'allowance_unavailable' };",
+      "      const providerFull = error instanceof AllowanceUpstreamError && error.quota;",
+      "      if (providerFull) return { unanswered: 'upstream_quota' };",
+      "      throw error;",
+      "    }",
+      "  };",
+      "}",
+      ""
+    ].join("\n")],
+    ["src/db.mjs", [
+      "// src/db.mjs",
+      "import { readdirSync, readFileSync } from 'node:fs';",
+      "import { join } from 'node:path';",
+      "import { fileURLToPath } from 'node:url';",
+      "import pg from 'pg';",
+      "import { bootWalk, createFailoverPool } from '@turnzero/database';",
+      "",
+      "const MIGRATIONS = fileURLToPath(new URL('../migrations/', import.meta.url));",
+      "const HEALTH_READ_MS = 2_000;",
+      "",
+      "// The live pool, which only the process entry opens: the package's failover",
+      "// pool over a pg pool. Its maximum is the plan's connection_limit, which the",
+      "// platform injects and the turnzero command's provision writes; one",
+      "// connection where the setting is absent.",
+      "export function openLivePool() {",
+      "  const url = process.env.APP_DATABASE_URL;",
+      "  if (!url) throw new Error('APP_DATABASE_URL is not set');",
+      "  const limit = process.env.APP_DATABASE_CONNECTION_LIMIT ?? '';",
+      "  const max = /^[1-9][0-9]*$/.test(limit) ? Number(limit) : 1;",
+      "  return createFailoverPool({",
+      "    // settings is { max, connectionTimeoutMillis }: the maximum and the five-second connect limit.",
+      "    connect: (settings) => new pg.Pool({ connectionString: url, ...settings }),",
+      "    max,",
+      "    onConnectionLoss: (error) => console.warn('database session ended:', error.message),",
+      "  });",
+      "}",
+      "",
+      "// The migrations through the package's boot walk: a lost connection retried",
+      "// every second for up to 120 seconds, and any other failure ends the start.",
+      "export function migrate(pool) {",
+      "  const files = { list: () => readdirSync(MIGRATIONS), read: (name) => readFileSync(join(MIGRATIONS, name), 'utf8') };",
+      "  return bootWalk(pool, files, {",
+      "    onRetry: (error, attempt) => {",
+      "      if (attempt === 1) console.warn('database unreachable at start; retrying:', error.message);",
+      "    },",
+      "  });",
+      "}",
+      "",
+      "// The data layer over any pool with the pg.Pool shape: the live one, or a test double's.",
+      "// Each row belongs to the signed-in user who added it, its owner, and is listed to that user alone.",
+      "export function createDataLayer(pool) {",
+      "  return {",
+      "    // One read over the connection, bounded so a probe never waits on a lost database.",
+      "    async reachable() {",
+      "      let timer;",
+      "      const late = new Promise((resolve) => { timer = setTimeout(resolve, HEALTH_READ_MS, 'late'); });",
+      "      try {",
+      "        return (await Promise.race([pool.query('SELECT 1'), late])) !== 'late';",
+      "      } catch {",
+      "        return false;",
+      "      } finally {",
+      "        clearTimeout(timer);",
+      "      }",
+      "    },",
+      "    async addNote(owner, title) {",
+      `      const { rows } = await pool.query('INSERT INTO "notes" (owner, title) VALUES ($1, $2) RETURNING id, title', [owner, title]);`,
+      "      return rows[0];",
+      "    },",
+      "    async listNotes(owner) {",
+      `      const { rows } = await pool.query('SELECT id, title FROM "notes" WHERE owner = $1 ORDER BY id', [owner]);`,
+      "      return rows;",
+      "    },",
+      "  };",
+      "}",
+      ""
+    ].join("\n")],
+    ["src/main.mjs", [
+      "// src/main.mjs, the process entry the start script runs",
+      "import { createAsker, liveTransport } from './ai.mjs';",
+      "import { createDataLayer, migrate, openLivePool } from './db.mjs';",
+      "import { createUserReader, openLiveAccounts } from './session.mjs';",
+      "import { createAppServer } from './server.mjs';",
+      "",
+      "const pool = openLivePool();",
+      "const applied = await migrate(pool);",
+      "console.log(applied.length > 0 ? `migrations applied at this start: ${applied.join(', ')}` : 'migrations: none pending at this start');",
+      "const port = Number(process.env.PORT ?? 8080);",
+      "const server = createAppServer({ db: createDataLayer(pool), userIdOf: createUserReader(openLiveAccounts()), ask: createAsker(liveTransport()) });",
+      "server.listen(port, () => console.log(`listening on ${port}`));",
+      ""
+    ].join("\n")],
+    ["src/server.mjs", [
+      "// src/server.mjs",
+      "import { createServer } from 'node:http';",
+      "import { readFile } from 'node:fs/promises';",
+      "",
+      "// The web client's three files, by the path a browser asks for them. On the",
+      "// platform, the deploy serves them from client/ ahead of these routes. A",
+      "// local run has nothing in front of it, so this server answers them itself.",
+      "const CLIENT_FILES = Object.freeze({",
+      "  '/': ['index.html', 'text/html; charset=utf-8'],",
+      "  '/index.html': ['index.html', 'text/html; charset=utf-8'],",
+      "  '/app.js': ['app.js', 'text/javascript; charset=utf-8'],",
+      "  '/styles.css': ['styles.css', 'text/css; charset=utf-8'],",
+      "});",
+      "",
+      "const readBody = async (request) => {",
+      "  // One decoder for the whole body: a character whose bytes arrive in two chunks is read whole.",
+      "  request.setEncoding('utf8');",
+      "  let text = '';",
+      "  for await (const chunk of request) text += chunk;",
+      "  return text;",
+      "};",
+      "",
+      "// The server over its three parts: db, the data layer; userIdOf, which reads",
+      "// the signed-in user's id from a request, or null; and ask, which answers a",
+      "// question under the AI allowance, or names why the model gave no answer.",
+      "export function createAppServer({ db, userIdOf, ask }) {",
+      "  return createServer(async (request, response) => {",
+      "    // The deployed runtime's abort signal: end the response when it fires.",
+      "    request.signal?.addEventListener('abort', () => response.destroy(), { once: true });",
+      "    const send = (status, body) => {",
+      "      if (response.destroyed) return;",
+      "      response.writeHead(status, { 'content-type': 'application/json' });",
+      "      response.end(JSON.stringify(body));",
+      "    };",
+      "    try {",
+      "      // A target that does not parse as a URL names no route, so it is answered 404 below.",
+      "      let pathname = null;",
+      "      try {",
+      "        pathname = new URL(request.url, 'http://localhost').pathname;",
+      "      } catch {}",
+      "      if (request.method === 'GET' && pathname === '/health') {",
+      "        return (await db.reachable()) ? send(200, { ok: true }) : send(503, { ok: false });",
+      "      }",
+      "      if (request.method === 'GET' && Object.hasOwn(CLIENT_FILES, pathname)) {",
+      "        const [file, type] = CLIENT_FILES[pathname];",
+      "        try {",
+      "          const body = await readFile(new URL(`../client/${file}`, import.meta.url));",
+      "          if (!response.destroyed) response.writeHead(200, { 'content-type': type }).end(body);",
+      "          return;",
+      "        } catch (error) {",
+      "          if (error?.code === 'ENOENT') return send(404, { error: 'not_found' });",
+      "          throw error;",
+      "        }",
+      "      }",
+      "      // Every route under /api/ answers the signed-in user alone.",
+      "      if (pathname === '/api/notes' || pathname === '/api/ask') {",
+      "        const user = await userIdOf(request);",
+      "        if (user === null) return send(401, { error: 'sign_in_required' });",
+      "        if (request.method === 'GET' && pathname === '/api/notes') return send(200, await db.listNotes(user));",
+      "        if (request.method === 'POST' && pathname === '/api/notes') {",
+      "          const posted = JSON.parse(await readBody(request));",
+      "          return send(201, await db.addNote(user, String(posted?.title ?? '')));",
+      "        }",
+      "        if (request.method === 'POST' && pathname === '/api/ask') {",
+      "          let question = '';",
+      "          try {",
+      "            question = String(JSON.parse(await readBody(request))?.question ?? '').trim();",
+      "          } catch {}",
+      "          if (question === '') return send(400, { error: 'invalid_question' });",
+      "          // 503 names why the model gave no answer: allowance_drawn,",
+      "          // allowance_unavailable, or upstream_quota (src/ai.mjs).",
+      "          const asked = await ask(question);",
+      "          return 'answer' in asked ? send(200, { answer: asked.answer }) : send(503, { error: asked.unanswered });",
+      "        }",
+      "      }",
+      "      send(404, { error: 'not_found' });",
+      "    } catch (error) {",
+      "      const refused = error instanceof SyntaxError || error?.code === '23514';",
+      "      if (!refused) console.error(error);",
+      "      send(refused ? 400 : 500, { error: refused ? 'invalid_note' : 'internal' });",
+      "    }",
+      "  });",
+      "}",
+      ""
+    ].join("\n")],
+    ["src/session.mjs", [
+      "// src/session.mjs: the signed-in user who sent a request, as the guide Add",
+      "// sign-in to your app shows it.",
+      "import { makeVerifyClient } from '@turnzero/account';",
+      "",
+      "// The cookie a signed-in browser sends with each request to the application's address.",
+      "const SESSION_COOKIE = '__Host-turnzero_cloud_realm';",
+      "",
+      "// The live client, which only the process entry opens. A deployed copy",
+      "// receives all three settings. A local run has no TURNZERO_CLOUD_REALM_KEYS,",
+      "// so the client is built without keys there and verifies through the",
+      "// platform's route.",
+      "export function openLiveAccounts() {",
+      "  const keys = process.env.TURNZERO_CLOUD_REALM_KEYS;",
+      "  return makeVerifyClient({",
+      "    baseUrl: process.env.TURNZERO_CLOUD_API,",
+      "    credential: process.env.TURNZERO_CLOUD_TOKEN,",
+      "    ...(keys ? { realmKeys: keys } : {}),",
+      "  });",
+      "}",
+      "",
+      "// The session token: the cookie's value from a browser, or the bearer from a",
+      "// native app or a local run.",
+      "export function sessionOf(request) {",
+      "  const auth = request.headers.authorization ?? '';",
+      "  if (auth.startsWith('Bearer ')) return auth.slice('Bearer '.length);",
+      "  for (const part of (request.headers.cookie ?? '').split(';')) {",
+      "    const at = part.indexOf('=');",
+      "    if (at > 0 && part.slice(0, at).trim() === SESSION_COOKIE) return part.slice(at + 1).trim();",
+      "  }",
+      "  return null;",
+      "}",
+      "",
+      "// The reader of a request's user: the signed-in user's id, or null with no",
+      "// live session. The token is verified by the Account package's client, with",
+      "// the x-turnzero-cloud-session header the serving router sets on each",
+      "// request it forwards.",
+      "export function createUserReader(accounts) {",
+      "  return async (request) => {",
+      "    const verdict = await accounts.verifySession(sessionOf(request), {",
+      "      sessionHeader: request.headers['x-turnzero-cloud-session'] ?? null,",
+      "    });",
+      "    return 'user' in verdict ? verdict.user.id : null;",
+      "  };",
+      "}",
+      ""
+    ].join("\n")],
+    ["test/app.test.mjs", [
+      "// test/app.test.mjs",
+      "import assert from 'node:assert/strict';",
+      "import { after, before, beforeEach, test } from 'node:test';",
+      "import { fileURLToPath } from 'node:url';",
+      "import { PGlite } from '@electric-sql/pglite';",
+      "import { createAccountDouble } from '@turnzero/account/testing';",
+      "import { createAiAllowanceDouble } from '@turnzero/ai_allowance/testing';",
+      "import { createDatabaseDouble, migrationsFrom } from '@turnzero/database/testing';",
+      "import { createAsker } from '../src/ai.mjs';",
+      "import { createDataLayer } from '../src/db.mjs';",
+      "import { createAppServer } from '../src/server.mjs';",
+      "import { createUserReader } from '../src/session.mjs';",
+      "",
+      "const MIGRATIONS = fileURLToPath(new URL('../migrations/', import.meta.url));",
+      "",
+      "// The packages' three test doubles for the file: a PostgreSQL engine inside",
+      "// this process, with the migrations applied; the realm's sign-in; and the AI",
+      "// allowance. The server runs over them on a port of this machine.",
+      "let double;",
+      "let accounts;",
+      "let ai;",
+      "let db;",
+      "let server;",
+      "let base;",
+      "// Two signed-in users, and the headers a browser of each sends.",
+      "let sam;",
+      "let kim;",
+      "const signedIn = (user) => ({ cookie: `__Host-turnzero_cloud_realm=${user.session}`, 'x-turnzero-cloud-session': user.header });",
+      "",
+      "before(async () => {",
+      "  double = await createDatabaseDouble({ engine: new PGlite(), files: migrationsFrom(MIGRATIONS) });",
+      "  accounts = await createAccountDouble();",
+      "  ai = createAiAllowanceDouble();",
+      "  db = createDataLayer(double.pool);",
+      "  server = createAppServer({ db, userIdOf: createUserReader(accounts.client()), ask: createAsker(ai.transport) });",
+      "  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));",
+      "  base = `http://127.0.0.1:${server.address().port}`;",
+      "  sam = accounts.signIn({ id: 'user-sam' });",
+      "  kim = accounts.signIn({ id: 'user-kim' });",
+      "});",
+      "",
+      "// Every table emptied and the allowance's answers cleared between tests, so each test starts from empty.",
+      "beforeEach(() => {",
+      "  ai.reset();",
+      "  return double.reset();",
+      "});",
+      "",
+      "after(async () => {",
+      "  await new Promise((resolve) => server.close(resolve));",
+      "  await double.close();",
+      "});",
+      "",
+      "test('the migration applies', () => {",
+      "  assert.deepEqual(double.applied, ['0001_notes.sql']);",
+      "});",
+      "",
+      "test('the data layer adds a row for its owner and lists it to that owner alone', async () => {",
+      "  assert.deepEqual(await db.addNote('user-sam', 'first'), { id: '1', title: 'first' });",
+      "  assert.deepEqual(await db.listNotes('user-sam'), [{ id: '1', title: 'first' }]);",
+      "  assert.deepEqual(await db.listNotes('user-kim'), []);",
+      "});",
+      "",
+      "test('GET /health reads the database and returns 200', async () => {",
+      "  const response = await fetch(`${base}/health`);",
+      "  assert.equal(response.status, 200);",
+      "  assert.deepEqual(await response.json(), { ok: true });",
+      "});",
+      "",
+      "test('a local run serves the page, its script, and its stylesheet from client/', async () => {",
+      "  for (const [path, type] of [['/', 'text/html'], ['/app.js', 'text/javascript'], ['/styles.css', 'text/css']]) {",
+      "    const response = await fetch(`${base}${path}`);",
+      "    assert.equal(response.status, 200, path);",
+      "    assert.ok(response.headers.get('content-type').startsWith(type), path);",
+      "    assert.ok((await response.text()).length > 0, path);",
+      "  }",
+      "});",
+      "",
+      "test('the API answers 401 to a request with no session, and reads a session sent as a Bearer', async () => {",
+      "  for (const path of ['/api/notes', '/api/ask']) {",
+      "    const response = await fetch(`${base}${path}`, { method: path === '/api/ask' ? 'POST' : 'GET' });",
+      "    assert.equal(response.status, 401, path);",
+      "    assert.deepEqual(await response.json(), { error: 'sign_in_required' });",
+      "  }",
+      "  const bearer = await fetch(`${base}/api/notes`, { headers: { authorization: `Bearer ${sam.session}`, 'x-turnzero-cloud-session': sam.header } });",
+      "  assert.equal(bearer.status, 200);",
+      "});",
+      "",
+      "test('POST /api/notes keeps a title with characters outside ASCII for the signed-in user, and GET /api/notes returns it to that user alone', async () => {",
+      "  const title = 'caf\xE9 \u2615 \u6771\u4EAC';",
+      "  const response = await fetch(`${base}/api/notes`, {",
+      "    method: 'POST',",
+      "    headers: { 'content-type': 'application/json', ...signedIn(sam) },",
+      "    body: JSON.stringify({ title }),",
+      "  });",
+      "  assert.equal(response.status, 201);",
+      "  assert.equal((await response.json()).title, title);",
+      "  const listed = await fetch(`${base}/api/notes`, { headers: signedIn(sam) });",
+      "  assert.equal(listed.status, 200);",
+      "  assert.deepEqual((await listed.json()).map((row) => row.title), [title]);",
+      "  assert.deepEqual(await (await fetch(`${base}/api/notes`, { headers: signedIn(kim) })).json(), []);",
+      "});",
+      "",
+      "test('POST /api/notes refuses an empty title, and GET /api/notes returns no row', async () => {",
+      "  const response = await fetch(`${base}/api/notes`, {",
+      "    method: 'POST',",
+      "    headers: { 'content-type': 'application/json', ...signedIn(sam) },",
+      "    body: JSON.stringify({ title: '' }),",
+      "  });",
+      "  assert.equal(response.status, 400);",
+      "  assert.deepEqual(await response.json(), { error: 'invalid_note' });",
+      "  assert.deepEqual(await (await fetch(`${base}/api/notes`, { headers: signedIn(sam) })).json(), []);",
+      "});",
+      "",
+      "test('POST /api/ask answers under the AI allowance, and answers 503 naming why the model gave no answer: the allowance drawn, no key in place, or the provider out of capacity', async () => {",
+      "  ai.prime({ text: 'Lunch is at noon.', usage: { input: 40, output: 12 } });",
+      "  const ask = (question) =>",
+      "    fetch(`${base}/api/ask`, { method: 'POST', headers: { 'content-type': 'application/json', ...signedIn(sam) }, body: JSON.stringify({ question }) });",
+      "  const answered = await ask('When is lunch?');",
+      "  assert.equal(answered.status, 200);",
+      "  assert.deepEqual(await answered.json(), { answer: 'Lunch is at noon.' });",
+      "  const unanswered = async (error) => {",
+      "    const response = await ask('When is lunch?');",
+      "    assert.equal(response.status, 503, error);",
+      "    assert.deepEqual(await response.json(), { error });",
+      "  };",
+      "  ai.refuseNext('allowance_exhausted');",
+      "  await unanswered('allowance_drawn');",
+      "  ai.refuseNext('allowance_unavailable');",
+      "  await unanswered('allowance_unavailable');",
+      "  ai.prime({ status: 429, json: { error: { status: 'RESOURCE_EXHAUSTED' } } });",
+      "  await unanswered('upstream_quota');",
+      "  const empty = await ask('');",
+      "  assert.equal(empty.status, 400);",
+      "});",
+      ""
+    ].join("\n")]
   ])
 });
 
@@ -5869,13 +6676,31 @@ var CREATE_STEP = "Call create_application from your tool for this new service,
 var runLineOf = (origin, windows) => machineLineOf(commandLineOf(origin, RUN_SUBCOMMAND, origin !== DEFAULT_COMMAND_ORIGIN ? { origin } : {}), windows);
 var DEPLOY_STEP = `Call deploy from your tool with the application, naming no environment and neither artifact nor upload, and run the line it answers in ${APPLICATION_FOLDER}/. A new application has one environment, production, so that deploy goes there; call create_environment first and follow its answer to try versions on development.`;
 var SHAPE_STEP = `Shape the service to your own before the first deploy: the table and its migration in ${APPLICATION_FOLDER}/migrations, the routes in ${APPLICATION_FOLDER}/src, and the tests, which cover those routes as written.`;
+var WEB_SHAPE_STEP = `Shape the app to your own before the first deploy: the page in ${APPLICATION_FOLDER}/client, the table and its migration in ${APPLICATION_FOLDER}/migrations, the routes in ${APPLICATION_FOLDER}/src, and the tests, which cover those routes as written.`;
+var WEB_OPEN_STEP = "Open the address the deploy answers in a browser and sign in there: the page lists the signed-in user's own rows, adds one, and answers a question under the plan's AI allowance.";
 var SUBMIT_NO_SETTING_STEP = `Call submit_manifest from your tool with the application and its manifest, ${APPLICATION_FOLDER}/${APPLICATION_MANIFEST}, naming no local_run, since the service reads no setting.`;
 var RUN_STEP_BACKGROUND = "The line runs until the application ends, so start it as a background process and read its lines";
 var SCHEDULED_JOB_SCHEDULE = "heartbeat";
+var ENTRY_PAGES = Object.freeze({
+  database: Object.freeze({ follow: "the guide Add a database", page: "/cloud/guides/add-a-database/" }),
+  // The Schedule package's own page: its section What an application must do
+  // says how an application passes its declared handlers to the package's
+  // router, and the page links the guide that declares a schedule.
+  schedule: Object.freeze({ follow: "the Schedule package's page", page: "/cloud/backend-packages/schedule/" }),
+  account: Object.freeze({ follow: "the guide Add sign-in to your app", page: "/cloud/guides/add-sign-in-to-your-app/" }),
+  ai_allowance: Object.freeze({ follow: "the guide Call an AI model under the allowance", page: "/cloud/guides/call-an-ai-model-under-the-allowance/" })
+});
+var takesOf = (template) => Object.freeze(
+  SCAFFOLD_TEMPLATE_ENTRIES[template].map(({ entry }) => {
+    const page = ENTRY_PAGES[entry];
+    if (page === void 0) throw new Error(`the ${entry} entry has no page to follow`);
+    return Object.freeze({ entry, ...page });
+  })
+);
 var TEMPLATE_FACTS = Object.freeze({
   "hello-world": Object.freeze({
     is: "the smallest service that deploys, whose one API route, GET /api/hello, answers hello world",
-    take: null,
+    takes: takesOf("hello-world"),
     kept: null,
     // submit_manifest names no local_run, since the service reads no setting.
     steps: (origin, windows) => [
@@ -5887,14 +6712,11 @@ var TEMPLATE_FACTS = Object.freeze({
   }),
   "database-service": Object.freeze({
     is: "a notes service that keeps its data in the platform's database",
-    take: Object.freeze({
-      entry: SCAFFOLD_TEMPLATE_ENTRIES["database-service"].entry,
-      follow: "the guide Add a database",
-      page: "/cloud/guides/add-a-database/"
-    }),
+    takes: takesOf("database-service"),
     kept: Object.freeze({
       resource: Object.freeze({ plural: "notes", singular: "note" }),
-      routes: Object.freeze(["health"])
+      routes: Object.freeze(["health"]),
+      columns: SCAFFOLD_FIELD_RESERVED
     }),
     // submit_manifest naming local_run, and the provision line that answer
     // gives, in the words `provision` prints for a fresh line (provision.ts);
@@ -5910,15 +6732,7 @@ var TEMPLATE_FACTS = Object.freeze({
   }),
   "scheduled-job": Object.freeze({
     is: "the hello-world service with one handler, which the platform runs each hour through the Schedule package",
-    take: Object.freeze({
-      entry: SCAFFOLD_TEMPLATE_ENTRIES["scheduled-job"].entry,
-      // The Schedule package's own page: its section What an application
-      // must do says how an application passes its declared handlers to the
-      // package's router, and the page links the guide that declares a
-      // schedule.
-      follow: "the Schedule package's page",
-      page: "/cloud/backend-packages/schedule/"
-    }),
+    takes: takesOf("scheduled-job"),
     kept: null,
     // hello-world's four, its run step saying no schedule fires on this
     // machine, and a fifth: a run fired on the platform, and its readings,
@@ -5930,15 +6744,40 @@ var TEMPLATE_FACTS = Object.freeze({
       DEPLOY_STEP,
       `Call run_schedule from your tool with the application, the schedule ${SCHEDULED_JOB_SCHEDULE}, and wait_seconds, which fires the handler now and answers how the run ended. A settled answer carries the handler's lines in console, and its more names the read_logs call where the lines were cut, may still be arriving, or could not be read. An answer not yet settled carries no console and names read_schedules, which lists every run.`
     ]
+  }),
+  "web-app": Object.freeze({
+    is: "a web page with sign-in, each user's own notes in the platform's database, and an AI model under the plan's allowance, in plain HTML and script",
+    takes: takesOf("web-app"),
+    kept: Object.freeze({
+      resource: Object.freeze({ plural: "notes", singular: "note" }),
+      // /api/ask is the template's own route beside the resource's.
+      routes: Object.freeze(["health", "ask"]),
+      // owner holds the id of the signed-in user who added the row.
+      columns: Object.freeze([...SCAFFOLD_FIELD_RESERVED, "owner"])
+    }),
+    // database-service's five, its run step saying where sign-in is and how
+    // a local run's API routes take a session, its shaping step naming the
+    // page first, and a sixth: the page opened on the deployed address.
+    steps: (origin, windows) => [
+      CREATE_STEP,
+      `${PROVISION_AGAIN} The manifest is ${APPLICATION_FOLDER}/${APPLICATION_MANIFEST}, and the line it answers is the provision line, which runs in ${APPLICATION_FOLDER}/.`,
+      `In ${APPLICATION_FOLDER}/, start the application on this machine, where its page then answers at / and its API routes take a session as a Bearer; sign-in is on the deployed application's own address. ${RUN_STEP_BACKGROUND}: ${runLineOf(origin, windows)}`,
+      WEB_SHAPE_STEP,
+      DEPLOY_STEP,
+      WEB_OPEN_STEP
+    ]
   })
 });
-var RESOURCE_TEMPLATE = "database-service";
+var RESOURCE_TEMPLATES = Object.freeze(SCAFFOLD_TEMPLATES.filter((template) => TEMPLATE_FACTS[template].kept !== null));
 var keptOf = (template) => {
   const kept2 = TEMPLATE_FACTS[template].kept;
   if (kept2 === null) throw new Error(`the ${template} template keeps no resource`);
   return kept2;
 };
 var listedAnd = (names) => names.length < 3 ? names.join(" and ") : `${names.slice(0, -1).join(", ")}, and ${names[names.length - 1]}`;
+var RESOURCE_TEMPLATES_NAMED = `the ${listedAnd(RESOURCE_TEMPLATES)} template${RESOURCE_TEMPLATES.length === 1 ? "" : "s"}`;
+var RESOURCE_TEMPLATE_CHOICES = RESOURCE_TEMPLATES.map((template) => `${SCAFFOLD_OPTION.template} ${template}`).join(" or ");
+var perResourceTemplate = (of) => listedAnd(RESOURCE_TEMPLATES.map((template) => `${orListed(of(keptOf(template)))} under ${template}`));
 var orListed = (names) => names.length < 3 ? names.join(" or ") : `${names.slice(0, -1).join(", ")}, or ${names[names.length - 1]}`;
 var andListed = (names) => names.length < 3 ? names.join(" and ") : `${names.slice(0, -1).join(", ")}, and ${names[names.length - 1]}`;
 var templatesDescribed = () => [
@@ -5956,7 +6795,7 @@ var SCAFFOLD_OPTIONS = Object.freeze([
     name: SCAFFOLD_OPTION.resource,
     value: "<plural>",
     required: false,
-    description: `Under the ${RESOURCE_TEMPLATE} template, the resource the service keeps, by its plural, the word of its table and its route: an ASCII lower-case letter, then ASCII lower-case letters and digits, at most 30 characters, and never ${keptOf(RESOURCE_TEMPLATE).routes.join(" or ")}. The files are written under its names where the template names notes, note, Notes, and Note, two file names among them. Where absent, the service keeps notes. A template that keeps no resource refuses it.`
+    description: `Under ${RESOURCE_TEMPLATES_NAMED}, the resource the service keeps, by its plural, the word of its table and its route: an ASCII lower-case letter, then ASCII lower-case letters and digits, at most 30 characters. It is never the word of the template's own route: ${perResourceTemplate((kept2) => kept2.routes)}. The files are written under its names where the template names notes, note, Notes, and Note, file names among them. Where absent, the service keeps notes. A template that keeps no resource refuses it.`
   },
   {
     name: SCAFFOLD_OPTION.singular,
@@ -5968,7 +6807,7 @@ var SCAFFOLD_OPTIONS = Object.freeze([
     name: SCAFFOLD_OPTION.fields,
     value: "<list>",
     required: false,
-    description: `Under the ${RESOURCE_TEMPLATE} template, the resource's columns: fields separated by commas, each a name, a colon, and a kind, such as "name:text,message:text", written between double quotes. A name is an ASCII lower-case letter, then ASCII lower-case letters, digits, and underscores, at most 30 characters, and never id. A kind is ${orListed(SCAFFOLD_FIELD_KINDS)}. Every column is required, and a list holds one to ${SCAFFOLD_FIELDS_MAX} fields. Where absent, the service keeps one text column, title. A template that keeps no resource refuses it.`
+    description: `Under ${RESOURCE_TEMPLATES_NAMED}, the resource's columns: fields separated by commas, each a name, a colon, and a kind, such as "name:text,message:text", written between double quotes. A name is an ASCII lower-case letter, then ASCII lower-case letters, digits, and underscores, at most 30 characters. It is never a column the migration writes itself: ${perResourceTemplate((kept2) => kept2.columns)}. A kind is ${orListed(SCAFFOLD_FIELD_KINDS)}. Every column is required, and a list holds one to ${SCAFFOLD_FIELDS_MAX} fields. Where absent, the service keeps one text column, title. A template that keeps no resource refuses it.`
   },
   {
     name: SCAFFOLD_OPTION.path,
@@ -6019,7 +6858,7 @@ var RESOURCE_REFUSAL = Object.freeze({
   /** The plural `s` alone, with no `--singular`: its singular would be empty. */
   emptySingular: `${SCAFFOLD_OPTION.resource} takes a plural longer than s alone where the line names no ${SCAFFOLD_OPTION.singular}, since the singular, the plural without its closing s, is never empty: name the singular with ${SCAFFOLD_OPTION.singular}, or a longer plural. ${NOTHING_WRITTEN2}`
 });
-var RESOURCE_NONE_KEPT = `${SCAFFOLD_OPTION.resource} and ${SCAFFOLD_OPTION.singular} name the resource the ${RESOURCE_TEMPLATE} template keeps, and the template this line writes keeps none: leave them out, or name ${SCAFFOLD_OPTION.template} ${RESOURCE_TEMPLATE}. ${NOTHING_WRITTEN2}`;
+var RESOURCE_NONE_KEPT = `${SCAFFOLD_OPTION.resource} and ${SCAFFOLD_OPTION.singular} name the resource ${RESOURCE_TEMPLATES_NAMED} keep, and the template this line writes keeps none: leave them out, or name ${RESOURCE_TEMPLATE_CHOICES}. ${NOTHING_WRITTEN2}`;
 var UNKNOWN_TEMPLATE = `${SCAFFOLD_OPTION.template} names the template to write, and the command has no template of that name: it has ${listedAnd(SCAFFOLD_TEMPLATES)}, and it writes ${SCAFFOLD_DEFAULT_TEMPLATE} where the line names none. ${NOTHING_WRITTEN2}`;
 var ownRouteRefusal = (word) => `${SCAFFOLD_OPTION.resource} takes a plural other than ${word}, the word of a route the template serves itself: name another plural. ${NOTHING_WRITTEN2}`;
 var resourceNamesOf = (call, template) => {
@@ -6039,6 +6878,8 @@ var resourceNamesOf = (call, template) => {
 };
 var CARRIED_FIELDS = Object.freeze([Object.freeze({ name: "title", kind: "text" })]);
 var FIELD_KINDS_CLAUSE = `the kind ${orListed(SCAFFOLD_FIELD_KINDS)}`;
+var COLUMN_MEANING = Object.freeze({ id: "the key column", owner: "the column of the row's owner" });
+var reservedFieldRefusal = (columns) => `${SCAFFOLD_OPTION.fields} takes a field name other than ${columns.join(" or ")}, ${listedAnd(columns.map((column) => COLUMN_MEANING[column] ?? `the column ${column}`))} the migration writes itself, and ${FIELD_KINDS_CLAUSE}: name the field another way. ${NOTHING_WRITTEN2}`;
 var FIELD_REFUSAL = Object.freeze({
   /** A field with no colon or more than one, an empty field among them. */
   listForm: `${SCAFFOLD_OPTION.fields} takes fields separated by commas, each a name, a colon, and a kind, such as name:text,message:text, ${FIELD_KINDS_CLAUSE}. ${NOTHING_WRITTEN2}`,
@@ -6047,17 +6888,18 @@ var FIELD_REFUSAL = Object.freeze({
   /** A name outside SCAFFOLD_FIELD_NAME_FORM. */
   nameForm: `${SCAFFOLD_OPTION.fields} takes each field's name as an ASCII lower-case letter, then ASCII lower-case letters, digits, and underscores, at most 30 characters, such as due_date, and ${FIELD_KINDS_CLAUSE}. ${NOTHING_WRITTEN2}`,
   /** A name of SCAFFOLD_FIELD_RESERVED. */
-  reservedName: `${SCAFFOLD_OPTION.fields} takes a field name other than ${SCAFFOLD_FIELD_RESERVED.join(" or ")}, the key column the migration writes itself, and ${FIELD_KINDS_CLAUSE}: name the field another way. ${NOTHING_WRITTEN2}`,
+  reservedName: reservedFieldRefusal(SCAFFOLD_FIELD_RESERVED),
   /** A kind outside SCAFFOLD_FIELD_KINDS. */
   kindUnknown: `${SCAFFOLD_OPTION.fields} takes each field's kind after its name and a colon, ${FIELD_KINDS_CLAUSE}, such as count:integer. ${NOTHING_WRITTEN2}`,
   /** Two fields under one name. */
   duplicate: `${SCAFFOLD_OPTION.fields} takes each field's name once, and two fields of the list share a name, ${FIELD_KINDS_CLAUSE} after each: name each field once. ${NOTHING_WRITTEN2}`
 });
-var FIELDS_NONE_KEPT = `${SCAFFOLD_OPTION.fields} names the columns of the resource the ${RESOURCE_TEMPLATE} template keeps, and the template this line writes keeps none: leave it out, or name ${SCAFFOLD_OPTION.template} ${RESOURCE_TEMPLATE}. ${NOTHING_WRITTEN2}`;
+var FIELDS_NONE_KEPT = `${SCAFFOLD_OPTION.fields} names the columns of the resource ${RESOURCE_TEMPLATES_NAMED} keep, and the template this line writes keeps none: leave it out, or name ${RESOURCE_TEMPLATE_CHOICES}. ${NOTHING_WRITTEN2}`;
 var fieldsOf = (call, template) => {
   const list = call.named[SCAFFOLD_OPTION.fields];
   if (list === void 0) return null;
-  if (TEMPLATE_FACTS[template].kept === null) return { refusal: FIELDS_NONE_KEPT };
+  const { kept: kept2 } = TEMPLATE_FACTS[template];
+  if (kept2 === null) return { refusal: FIELDS_NONE_KEPT };
   if (list === "") return { refusal: FIELD_REFUSAL.count };
   const items = list.split(",");
   if (items.length > SCAFFOLD_FIELDS_MAX) return { refusal: FIELD_REFUSAL.count };
@@ -6067,7 +6909,7 @@ var fieldsOf = (call, template) => {
     if (parts.length !== 2) return { refusal: FIELD_REFUSAL.listForm };
     const [name, kind] = parts;
     if (!SCAFFOLD_FIELD_NAME_FORM.test(name)) return { refusal: FIELD_REFUSAL.nameForm };
-    if (SCAFFOLD_FIELD_RESERVED.includes(name)) return { refusal: FIELD_REFUSAL.reservedName };
+    if (kept2.columns.includes(name)) return { refusal: reservedFieldRefusal(kept2.columns) };
     const known = SCAFFOLD_FIELD_KINDS.find((held) => held === kind);
     if (known === void 0) return { refusal: FIELD_REFUSAL.kindUnknown };
     if (fields.some((field) => field.name === name)) return { refusal: FIELD_REFUSAL.duplicate };
@@ -6121,7 +6963,7 @@ var FIELD_REFUSED_CODES = Object.freeze(["23514", "23502", "22P02", "22003", "22
 var quotedField = (field) => `"${field.name}"`;
 var membersOf = (fields, value) => fields.map((field) => `${field.name}: ${value(field)}`).join(", ");
 var objectOf = (members) => members === "" ? "{}" : `{ ${members} }`;
-var FIELD_PLACES = Object.freeze([
+var DATABASE_SERVICE_PLACES = Object.freeze([
   {
     path: "migrations/0001_notes.sql",
     what: "column line",
@@ -6234,13 +7076,141 @@ var FIELD_PLACES = Object.freeze([
     }
   }
 ]);
-var fieldFilesOf = (files, fields, names) => {
-  const own = keptOf(RESOURCE_TEMPLATE).resource;
+var WEB_ROUTE_TESTS = [
+  "test('POST /api/notes keeps a title with characters outside ASCII for the signed-in user, and GET /api/notes returns it to that user alone', async () => {",
+  "  const title = 'caf\xE9 \u2615 \u6771\u4EAC';",
+  "  const response = await fetch(`${base}/api/notes`, {",
+  "    method: 'POST',",
+  "    headers: { 'content-type': 'application/json', ...signedIn(sam) },",
+  "    body: JSON.stringify({ title }),",
+  "  });",
+  "  assert.equal(response.status, 201);",
+  "  assert.equal((await response.json()).title, title);",
+  "  const listed = await fetch(`${base}/api/notes`, { headers: signedIn(sam) });",
+  "  assert.equal(listed.status, 200);",
+  "  assert.deepEqual((await listed.json()).map((row) => row.title), [title]);",
+  "  assert.deepEqual(await (await fetch(`${base}/api/notes`, { headers: signedIn(kim) })).json(), []);",
+  "});",
+  "",
+  "test('POST /api/notes refuses an empty title, and GET /api/notes returns no row', async () => {",
+  "  const response = await fetch(`${base}/api/notes`, {",
+  "    method: 'POST',",
+  "    headers: { 'content-type': 'application/json', ...signedIn(sam) },",
+  "    body: JSON.stringify({ title: '' }),",
+  "  });",
+  "  assert.equal(response.status, 400);",
+  "  assert.deepEqual(await response.json(), { error: 'invalid_note' });",
+  "  assert.deepEqual(await (await fetch(`${base}/api/notes`, { headers: signedIn(sam) })).json(), []);",
+  "});"
+].join("\n");
+var WEB_APP_PLACES = Object.freeze([
+  {
+    path: "client/app.js",
+    what: "field list",
+    carried: "const FIELDS = [{ name: 'title', kind: 'text' }];",
+    render: (fields) => `const FIELDS = [${fields.map((field) => `{ name: '${field.name}', kind: '${field.kind}' }`).join(", ")}];`
+  },
+  { ...DATABASE_SERVICE_PLACES[0] },
+  {
+    path: "src/db.mjs",
+    what: "add signature",
+    carried: "    async addNote(owner, title) {",
+    render: (_fields, forms) => `    async add${forms.Singular}(owner, row) {`
+  },
+  {
+    path: "src/db.mjs",
+    what: "insert",
+    carried: `pool.query('INSERT INTO "notes" (owner, title) VALUES ($1, $2) RETURNING id, title', [owner, title])`,
+    render: (fields, forms) => {
+      const columns = fields.map(quotedField).join(", ");
+      const values = fields.map((_field, index) => `$${index + 2}`).join(", ");
+      return `pool.query('INSERT INTO "${forms.plural}" (owner, ${columns}) VALUES ($1, ${values}) RETURNING id, ${columns}', [owner, ${fields.map((field) => `row.${field.name}`).join(", ")}])`;
+    }
+  },
+  {
+    path: "src/db.mjs",
+    what: "select",
+    carried: `pool.query('SELECT id, title FROM "notes" WHERE owner = $1 ORDER BY id', [owner])`,
+    render: (fields, forms) => `pool.query('SELECT id, ${fields.map(quotedField).join(", ")} FROM "${forms.plural}" WHERE owner = $1 ORDER BY id', [owner])`
+  },
+  {
+    path: "src/server.mjs",
+    what: "add call",
+    carried: "db.addNote(user, String(posted?.title ?? ''))",
+    render: (fields, forms) => `db.add${forms.Singular}(user, ${objectOf(membersOf(fields, (field) => field.kind === "text" ? `String(posted?.${field.name} ?? '')` : `posted?.${field.name} ?? null`))})`
+  },
+  { ...DATABASE_SERVICE_PLACES[5] },
+  {
+    path: "test/app.test.mjs",
+    what: "sample row",
+    carried: [
+      "  assert.deepEqual(await db.addNote('user-sam', 'first'), { id: '1', title: 'first' });",
+      "  assert.deepEqual(await db.listNotes('user-sam'), [{ id: '1', title: 'first' }]);"
+    ].join("\n"),
+    render: (fields, forms) => {
+      const added = membersOf(fields, (field) => FIELD_SAMPLE[field.kind].added);
+      return [
+        `  assert.deepEqual(await db.add${forms.Singular}('user-sam', { ${added} }), { id: '1', ${added} });`,
+        `  assert.deepEqual(await db.list${forms.Plural}('user-sam'), [{ id: '1', ${added} }]);`
+      ].join("\n");
+    }
+  },
+  {
+    path: "test/app.test.mjs",
+    what: "pair of route tests",
+    carried: WEB_ROUTE_TESTS,
+    render: (fields, forms) => {
+      const route = "`${base}/api/" + forms.plural + "`";
+      const first = fields[0];
+      const kept2 = fields.some((field) => field.kind === "text") ? " with characters outside ASCII in its text" : "";
+      return [
+        `test('POST /api/${forms.plural} keeps a row${kept2} for the signed-in user, and GET /api/${forms.plural} returns it to that user alone', async () => {`,
+        `  const row = ${objectOf(membersOf(fields, (field) => FIELD_SAMPLE[field.kind].posted))};`,
+        `  const response = await fetch(${route}, {`,
+        "    method: 'POST',",
+        "    headers: { 'content-type': 'application/json', ...signedIn(sam) },",
+        "    body: JSON.stringify(row),",
+        "  });",
+        "  assert.equal(response.status, 201);",
+        "  const { id, ...added } = await response.json();",
+        "  assert.deepEqual(added, row);",
+        `  const listed = await fetch(${route}, { headers: signedIn(sam) });`,
+        "  assert.equal(listed.status, 200);",
+        "  assert.deepEqual((await listed.json()).map(({ id, ...kept }) => kept), [row]);",
+        `  assert.deepEqual(await (await fetch(${route}, { headers: signedIn(kim) })).json(), []);`,
+        "});",
+        "",
+        `test('POST /api/${forms.plural} refuses a ${forms.singular} without its ${first.name} field, and GET /api/${forms.plural} returns no row', async () => {`,
+        `  const response = await fetch(${route}, {`,
+        "    method: 'POST',",
+        "    headers: { 'content-type': 'application/json', ...signedIn(sam) },",
+        `    body: JSON.stringify(${objectOf(membersOf(fields.slice(1), (field) => FIELD_SAMPLE[field.kind].posted))}),`,
+        "  });",
+        "  assert.equal(response.status, 400);",
+        `  assert.deepEqual(await response.json(), { error: 'invalid_${forms.singular}' });`,
+        `  assert.deepEqual(await (await fetch(${route}, { headers: signedIn(sam) })).json(), []);`,
+        "});"
+      ].join("\n");
+    }
+  }
+]);
+var FIELD_PLACES = Object.freeze({
+  "database-service": DATABASE_SERVICE_PLACES,
+  "web-app": WEB_APP_PLACES
+});
+var fieldPlacesOf = (template) => {
+  const places = FIELD_PLACES[template];
+  if (places === void 0) throw new Error(`the ${template} template keeps no resource`);
+  return places;
+};
+var fieldFilesOf = (files, fields, names, template = "database-service") => {
+  const own = keptOf(template).resource;
   const to = names ?? own;
   const [plural, singular, Plural, Singular] = resourceFormsOf(to);
   const forms = { plural, singular, Plural, Singular };
+  const places = fieldPlacesOf(template);
   return files.map(([path, text]) => {
-    const found = FIELD_PLACES.filter((place) => resourceTextOf(place.path, own, to) === path).map((place) => {
+    const found = places.filter((place) => resourceTextOf(place.path, own, to) === path).map((place) => {
       const carried = resourceTextOf(place.carried, own, to);
       const around = text.split(carried);
       if (around.length !== 2) throw new Error(`the template's ${place.path} does not hold its ${place.what} exactly once`);
@@ -6259,7 +7229,7 @@ var fieldFilesOf = (files, fields, names) => {
 var writtenFilesOf = (template, names, fields = null) => {
   const files = SCAFFOLD_TEMPLATE_FILES[template];
   const named = names === null ? files : resourceFilesOf(files, keptOf(template).resource, names);
-  return fields === null ? named : fieldFilesOf(named, fields, names);
+  return fields === null ? named : fieldFilesOf(named, fields, names, template);
 };
 var manifestWithPackages = (text, rows) => {
   const around = text.split(EMPTY_PACKAGES);
@@ -6339,14 +7309,21 @@ var standsAt = (io2, folder, name) => {
 };
 var noFolderSentence = (name, where) => `Something that is no folder stands at ${name} in the project's root, where ${where}: move it, then run the line again. ${NOTHING_WRITTEN2}`;
 var scaffoldLinkSentence = (what) => `${what} stands on a link that leads outside the project's root, and the scaffold never writes through one. Put a folder in the link's place, or remove it, then run the line again. ${NOTHING_WRITTEN2}`;
-var applicationStandsLines = (template, takeLine) => {
-  const { take } = TEMPLATE_FACTS[template];
+var listOf = (value) => value === null ? [] : Array.isArray(value) ? value : [value];
+var applicationStandsLines = (template, takeLines) => {
+  const { takes } = TEMPLATE_FACTS[template];
+  const lines = listOf(takeLines);
   const first = `The project's root holds ${APPLICATION_FOLDER}/ with files in it, so an application stands there, and ${SCAFFOLD_SUBCOMMAND} starts a new application and writes over none. ${NOTHING_WRITTEN2}`;
-  if (take === null || takeLine === null) return [first];
-  return [first, `To add the ${take.entry} package to the application that stands, run this line at the project's root, then follow ${take.follow}, read_documentation's page ${take.page}: ${takeLine}`];
+  if (takes.length === 0 || lines.length !== takes.length) return [first];
+  return [
+    first,
+    ...takes.map(
+      (take, index) => `To add the ${take.entry} package to the application that stands, run this line at the project's root, then follow ${take.follow}, read_documentation's page ${take.page}: ${lines[index]}`
+    )
+  ];
 };
 var STAGE_NOT_OWN = `Something that is not this run's own stands at ${STAGE_FOLDER} in the project's root, the name the scaffold writes under, an earlier run's files under another template or another resource name among it: move or remove ${STAGE_FOLDER}, then run the line again. ${NOTHING_WRITTEN2}`;
-var folderRefusalOf = (io2, options, files, takeLine) => {
+var folderRefusalOf = (io2, options, files, takeLines) => {
   const { root } = options;
   for (let at = root; ; at = dirname5(at)) {
     const standing2 = io2.stat(at);
@@ -6361,7 +7338,7 @@ var folderRefusalOf = (io2, options, files, takeLine) => {
   const notOwn = STAGE_NOT_OWN;
   const standing = io2.stat(app);
   if (standing === null ? danglingAt(io2, root, APPLICATION_FOLDER) : !standing.folder) return [noFolderSentence(APPLICATION_FOLDER, "the scaffold writes the application")];
-  if (standing !== null && (io2.listFolder(app) ?? []).length > 0) return applicationStandsLines(options.template, takeLine);
+  if (standing !== null && (io2.listFolder(app) ?? []).length > 0) return applicationStandsLines(options.template, takeLines);
   if (!heldInside(io2, root, app)) return [scaffoldLinkSentence(`The application's folder, ${APPLICATION_FOLDER}/,`)];
   const staged = io2.stat(stage);
   if (staged === null && danglingAt(io2, root, STAGE_FOLDER)) return [notOwn];
@@ -6372,17 +7349,39 @@ var folderRefusalOf = (io2, options, files, takeLine) => {
 };
 var RUN_AGAIN = "Run the same line again.";
 var finishSentence = (entry, takeLine) => `To finish, run this line at the project's root, which takes the ${entry} entry again whole and installs, then run npm test in ${APPLICATION_FOLDER}/: ${takeLine}`;
+var LINE_COUNT_WORDS = Object.freeze({ 2: "two", 3: "three", 4: "four" });
+var finishEachSentence = (entries, takeLines) => [
+  `To finish, run each of these ${LINE_COUNT_WORDS[takeLines.length] ?? takeLines.length} lines at the project's root, in order, which take the ${listedAnd(entries)} entries again whole and install, then run npm test in ${APPLICATION_FOLDER}/:`,
+  ...takeLines
+].join("\n");
 var FINISH_UNTAKEN = `To finish, run npm install and then npm test in ${APPLICATION_FOLDER}/.`;
-var finishOf = (entry, takeLine) => entry === null || takeLine === null ? FINISH_UNTAKEN : finishSentence(entry, takeLine);
-var writtenClause = (entry) => entry === null ? "the service's files are written" : `the service's files, the ${entry} entry, its row, and the copy are written`;
+var finishOf = (entry, takeLine) => {
+  const [entries, lines] = [listOf(entry), listOf(takeLine)];
+  if (entries.length === 0 || lines.length !== entries.length) return FINISH_UNTAKEN;
+  return entries.length === 1 ? finishSentence(entries[0], lines[0]) : finishEachSentence(entries, lines);
+};
+var writtenClause = (entry) => {
+  const entries = listOf(entry);
+  if (entries.length === 0) return "the service's files are written";
+  return entries.length === 1 ? `the service's files, the ${entries[0]} entry, its row, and the copy are written` : `the service's files, the ${listedAnd(entries)} entries, their rows, and the copies are written`;
+};
 var installFailedLine = (entry, takeLine) => `npm install in ${APPLICATION_FOLDER}/ did not finish: ${writtenClause(entry)}. ${finishOf(entry, takeLine)}`;
 var servedEntryOf = (entry, version) => version === null ? `${entry}, at no version,` : `${entry} ${shownWhole(version)}`;
-var testsFailedLine = (entry, version) => {
-  const served = servedEntryOf(entry, version);
-  return `npm test failed in ${APPLICATION_FOLDER}/ on the files as written, before any edit, with ${served} as the library served it. The failure is the platform's and not yours: report it, naming ${served}.`;
+var servedListOf = (served) => ({
+  named: listedAnd(served.map(({ entry, version }) => servedEntryOf(entry, version))),
+  it: served.length === 1 ? "it" : "them"
+});
+var takenTestsFailedLine = (served) => {
+  const { named, it } = servedListOf(served);
+  return `npm test failed in ${APPLICATION_FOLDER}/ on the files as written, before any edit, with ${named} as the library served ${it}. The failure is the platform's and not yours: report it, naming ${named}.`;
 };
 var untakenTestsFailedLine = (template) => `npm test failed in ${APPLICATION_FOLDER}/ on the files as written, before any edit. The failure is the platform's and not yours: report it, naming the ${template} template and ${TURNZERO_CLOUD_PACKAGE} ${commandVersion()}.`;
-var testedLine = (served) => `${SCAFFOLD_LINE_HEAD.tested}npm test passed in ${APPLICATION_FOLDER}/ on the files as written${served === null ? "" : `, with ${servedEntryOf(served.entry, served.version)} as the library served it`}.`;
+var testedLine = (served) => {
+  const entries = listOf(served);
+  if (entries.length === 0) return `${SCAFFOLD_LINE_HEAD.tested}npm test passed in ${APPLICATION_FOLDER}/ on the files as written.`;
+  const { named, it } = servedListOf(entries);
+  return `${SCAFFOLD_LINE_HEAD.tested}npm test passed in ${APPLICATION_FOLDER}/ on the files as written, with ${named} as the library served ${it}.`;
+};
 var notStartedLine = (what, code, entry, takeLine) => `${what} could not be started in ${APPLICATION_FOLDER}/ (${code}): npm stands beside Node.js and must be on the PATH. ${finishOf(entry, takeLine)}`;
 var stoppedLine = (what, ended, testsLeft, entry, takeLine) => `${what} in ${APPLICATION_FOLDER}/ was ${ended.interrupted === true ? "interrupted" : `ended by ${ended.signal ?? "a signal"}`}${testsLeft ? ", and the tests were not started" : ""}: ${writtenClause(entry)}. ${finishOf(entry, takeLine)}`;
 var errorWordOf = (error) => {
@@ -6400,36 +7399,39 @@ var applicationStateOf = (io2, app) => {
     return "unread";
   }
 };
-var standsWayOn = (template, takeLine) => {
-  const lines = applicationStandsLines(template, takeLine);
-  return lines.length > 1 ? `. ${lines[1]}` : `: ${SCAFFOLD_SUBCOMMAND} starts a new application and writes over none.`;
+var standsWayOn = (template, takeLines) => {
+  const lines = applicationStandsLines(template, takeLines);
+  return lines.length > 1 ? `. ${lines.slice(1).join("\n")}` : `: ${SCAFFOLD_SUBCOMMAND} starts a new application and writes over none.`;
 };
-var stoppedCloseOf = (state, template, takeLine) => {
+var stoppedCloseOf = (state, template, takeLines) => {
   const before = `before ${APPLICATION_FOLDER}/ was written`;
   switch (state) {
     case "template":
-      return `after ${APPLICATION_FOLDER}/ was written. ${finishOf(TEMPLATE_FACTS[template].take?.entry ?? null, takeLine)}`;
+      return `after ${APPLICATION_FOLDER}/ was written. ${finishOf(TEMPLATE_FACTS[template].takes.map((take) => take.entry), takeLines)}`;
     case "absent":
       return `${before}, and no ${APPLICATION_FOLDER}/ stands. ${RUN_AGAIN}`;
     case "empty":
       return `${before}, and ${APPLICATION_FOLDER}/ stands empty. ${RUN_AGAIN}`;
     case "held":
-      return `${before}, and ${APPLICATION_FOLDER}/ holds files, so an application stands there and the template was not written${standsWayOn(template, takeLine)}`;
+      return `${before}, and ${APPLICATION_FOLDER}/ holds files, so an application stands there and the template was not written${standsWayOn(template, takeLines)}`;
     case "no folder":
       return `${before}, and something that is no folder stands at ${APPLICATION_FOLDER}: move it, then run the same line again.`;
     case "unread":
       return `${before}, and what stands at ${APPLICATION_FOLDER} could not be read: make it readable or move it, then run the same line again.`;
   }
 };
-var ownErrorLine = (error, state, template, takeLine) => `The command stopped on an error of its own (${errorWordOf(error)}) ${stoppedCloseOf(state, template, takeLine)}`;
-var signalEndedLine = (state, template, takeLine) => `A signal ended the command ${stoppedCloseOf(state, template, takeLine)}`;
+var ownErrorLine = (error, state, template, takeLines) => `The command stopped on an error of its own (${errorWordOf(error)}) ${stoppedCloseOf(state, template, takeLines)}`;
+var signalEndedLine = (state, template, takeLines) => `A signal ended the command ${stoppedCloseOf(state, template, takeLines)}`;
 var ApplicationArrived = class extends Error {
 };
-var arrivedLine = (template, takeLine) => `${APPLICATION_FOLDER}/ took a file or a folder while the scaffold ran, so an application stands there and the template was not written${standsWayOn(template, takeLine)}`;
+var arrivedLine = (template, takeLines) => `${APPLICATION_FOLDER}/ took a file or a folder while the scaffold ran, so an application stands there and the template was not written${standsWayOn(template, takeLines)}`;
 var ARRIVED_NO_FOLDER_LINE = `Something that is no folder came to stand at ${APPLICATION_FOLDER} while the scaffold ran, and the template was not written: move it, then run the same line again.`;
-var SCAFFOLD_AFTER_OWN_ERROR = `where the project's root holds no ${APPLICATION_FOLDER}/, or an empty one, the application was not written, and the same line run again writes it; where ${APPLICATION_FOLDER}/ holds the service's files, the ${LIBRARY_SUBCOMMAND} take line for the template's entry, run at the project's root, then npm test in ${APPLICATION_FOLDER}/, finish it where the template takes an entry, and npm install and then npm test in ${APPLICATION_FOLDER}/ finish it where it takes none`;
-var STEP_COUNT_WORDS = Object.freeze({ 4: "four", 5: "five", 6: "six", 7: "seven" });
-var nextStepLines = (origin, windows = LINES_IN_WINDOWS_FORM, left = NEITHER_LEFT, template = RESOURCE_TEMPLATE) => {
+var SCAFFOLD_AFTER_OWN_ERROR = `where the project's root holds no ${APPLICATION_FOLDER}/, or an empty one, the application was not written, and the same line run again writes it; where ${APPLICATION_FOLDER}/ holds the service's files, the ${LIBRARY_SUBCOMMAND} take line for each entry the template takes, run at the project's root, then npm test in ${APPLICATION_FOLDER}/, finish it where the template takes entries, and npm install and then npm test in ${APPLICATION_FOLDER}/ finish it where it takes none`;
+var printEach = (io2, text) => {
+  for (const line of text.split("\n")) io2.print(line);
+};
+var STEP_COUNT_WORDS = Object.freeze({ 4: "four", 5: "five", 6: "six", 7: "seven", 8: "eight" });
+var nextStepLines = (origin, windows = LINES_IN_WINDOWS_FORM, left = NEITHER_LEFT, template = "database-service") => {
   const steps = [
     ...left.tools === "stands" ? [ROOT_TOOLS_STEP] : left.tools === "failed" ? [ROOT_TOOLS_FAILED_STEP] : [],
     ...left.claude ? [ROOT_CLAUDE_STEP] : [],
@@ -6480,6 +7482,22 @@ var untakenLibraryOf = (io2, root, over) => {
   return { library: found.folder, fresh: found.fresh, packages: heldPackagesOf(manifest.rows) };
 };
 var LOOP_TURN_MS = 0;
+var takenPackagesOf = (checks) => {
+  let rows = checks[0]?.rows ?? null;
+  let text = "";
+  for (const { entry } of checks) {
+    text = manifestTextOf(rows, { name: entry.name, version: entry.version, closure_hash: entry.closure_hash, source_commit: entry.source_commit, fetched_at: "" });
+    rows = JSON.parse(text).entries;
+  }
+  return checks.length === 0 ? [] : packagesOf(text);
+};
+var writeTakes = (io2, root, checks) => {
+  let written = null;
+  for (const check2 of checks) {
+    const reading = written === null ? check2 : { ...check2, rows: JSON.parse(written).entries, manifestStood: Buffer.from(written, "utf8") };
+    written = writeTake(io2, root, reading);
+  }
+};
 async function scaffold(call, io2) {
   const minute = runMinuteOf(io2.clock());
   const options = scaffoldOptionsOf(call, io2.cwd);
@@ -6491,12 +7509,12 @@ async function scaffold(call, io2) {
   const agent = userAgentOf(io2.env);
   if ("refusal" in agent) return refuse(agent.refusal);
   const { root, origin, template } = options;
-  const { take } = TEMPLATE_FACTS[template];
+  const { takes } = TEMPLATE_FACTS[template];
   const defaulted = call.named[SCAFFOLD_OPTION.template] === void 0;
   const files = writtenFilesOf(template, options.names, options.fields);
   const app = join8(root, APPLICATION_FOLDER);
   const stage = join8(root, STAGE_FOLDER);
-  const takeLine = take === null ? null : machineLineOf(libraryTakeLineOf({ origin, entry: take.entry }), io2.windows ?? LINES_IN_WINDOWS_FORM);
+  const takeLines = takes.map((take) => machineLineOf(libraryTakeLineOf({ origin, entry: take.entry }), io2.windows ?? LINES_IN_WINDOWS_FORM));
   let reached = "checks";
   const stateNow = () => {
     if (reached === "template") return "template";
@@ -6514,33 +7532,35 @@ async function scaffold(call, io2) {
   };
   let release = () => void 0;
   try {
-    const refused = folderRefusalOf(io2, options, files, takeLine);
+    const refused = folderRefusalOf(io2, options, files, takeLines);
     if (refused !== null) return refuse(...refused);
-    let checked = null;
+    const checks = [];
     let held;
-    if (take === null) {
+    if (takes.length === 0) {
       const found = untakenLibraryOf(io2, root, (library) => writesOver(library, app));
       if ("lines" in found) return refuse(...found.lines);
       held = found;
     } else {
-      const copy = join8(app, "lib", take.entry);
-      const planOf = (library) => writesOver(library, copy) ? { refusal: LIBRARY_OVER_APPLICATION } : { application: app, copy, declared: null, declaredAt: null };
-      const read2 = await readTake(io2, { entry: take.entry, root, named: options.named, origin }, agent.userAgent, planOf);
-      if ("lines" in read2) return refuse(...read2.lines);
-      if (read2.plan === null) {
-        return refuse(`The ${take.entry} entry the library served carries no compiled modules, which the service's package file declares and installs. That is the platform's to fix: report it. ${NOTHING_WRITTEN2}`);
+      for (const take of takes) {
+        const copy = join8(app, "lib", take.entry);
+        const planOf = (library) => writesOver(library, copy) ? { refusal: LIBRARY_OVER_APPLICATION } : { application: app, copy, declared: null, declaredAt: null };
+        const read2 = await readTake(io2, { entry: take.entry, root, named: options.named, origin }, agent.userAgent, planOf, checks.length > 0);
+        if ("lines" in read2) return refuse(...read2.lines);
+        if (read2.plan === null) {
+          return refuse(`The ${take.entry} entry the library served carries no compiled modules, which the service's package file declares and installs. That is the platform's to fix: report it. ${NOTHING_WRITTEN2}`);
+        }
+        checks.push(read2);
       }
-      checked = read2;
-      held = { library: read2.library, fresh: read2.fresh, packages: read2.packages };
+      held = { library: checks[0].library, fresh: checks[0].fresh, packages: takenPackagesOf(checks) };
     }
-    const arrived = folderRefusalOf(io2, options, files, takeLine);
+    const arrived = folderRefusalOf(io2, options, files, takeLines);
     if (arrived !== null) return refuse(...arrived);
     const toolsStands = standsAt(io2, root, TOOLS_FILE);
     const claudeStands = standsAt(io2, root, CLAUDE_FILE);
     let ended = false;
     release = io2.whenEnded(() => {
       ended = true;
-      io2.print(signalEndedLine(stateNow(), template, takeLine));
+      printEach(io2, signalEndedLine(stateNow(), template, takeLines));
     });
     reached = "writes";
     if (io2.stat(root) === null) io2.makeFolder(root);
@@ -6552,24 +7572,24 @@ async function scaffold(call, io2) {
     for (const [path] of files) io2.print(`${SCAFFOLD_LINE_HEAD.written}${APPLICATION_FOLDER}/${path}`);
     io2.print(tools === "written" ? `${SCAFFOLD_LINE_HEAD.written}${TOOLS_FILE}` : tools === "stands" ? ROOT_TOOLS_UNCHANGED : ROOT_TOOLS_FAILED);
     if (claudeStands) io2.print(ROOT_CLAUDE_UNCHANGED);
-    if (checked !== null) writeTake(io2, root, checked);
+    writeTakes(io2, root, checks);
     await io2.sleep(LOOP_TURN_MS);
     release();
     if (ended) return COMMAND_STATUS.unknown;
-    const taken = take === null || checked === null || takeLine === null ? null : { entry: take.entry, version: checked.entry.version, line: takeLine };
+    const taken = checks.map((check2, index) => ({ entry: takes[index].entry, version: check2.entry.version, line: takeLines[index] }));
     return await installAndTest(io2, app, template, taken, origin, { tools, claude: claudeStands });
   } catch (error) {
     const state = stateNow();
     const arrivedAs = error instanceof ApplicationArrived ? state : null;
-    io2.print(arrivedAs === "held" ? arrivedLine(template, takeLine) : arrivedAs === "no folder" ? ARRIVED_NO_FOLDER_LINE : ownErrorLine(error, state, template, takeLine));
+    printEach(io2, arrivedAs === "held" ? arrivedLine(template, takeLines) : arrivedAs === "no folder" ? ARRIVED_NO_FOLDER_LINE : ownErrorLine(error, state, template, takeLines));
     return COMMAND_STATUS.unknown;
   } finally {
     release();
   }
 }
 async function installAndTest(io2, app, template, taken, origin, left) {
-  const entry = taken?.entry ?? null;
-  const takeLine = taken?.line ?? null;
+  const entries = taken.map(({ entry }) => entry);
+  const takeLines = taken.map(({ line }) => line);
   const env = installEnvironmentOf(io2.env);
   const printError = io2.printError ?? io2.print;
   const npmEntry = NPM_NEEDS_SHELL ? npmEntryOf(io2, process.execPath) : null;
@@ -6583,24 +7603,24 @@ async function installAndTest(io2, app, template, taken, origin, left) {
   const stopped = (ended) => ended.interrupted === true || ended.error === null && ended.status === null;
   const stop = (what, ended, testsLeft) => {
     printAfterInterrupt(io2, afterInterruptedChildLineOf(ended, what, io2.windows ?? NPM_NEEDS_SHELL));
-    io2.print(stoppedLine(what, ended, testsLeft, entry, takeLine));
+    printEach(io2, stoppedLine(what, ended, testsLeft, entries, takeLines));
     return COMMAND_STATUS.unknown;
   };
   const installed = await child(INSTALL_ARGS);
   if (stopped(installed)) return stop("npm install", installed, true);
   if (installed.error !== null || installed.status !== 0) {
-    io2.print(installFailedLine(entry, takeLine));
+    printEach(io2, installFailedLine(entries, takeLines));
     return COMMAND_STATUS.failed;
   }
   io2.print(`${SCAFFOLD_LINE_HEAD.installed}npm install ran in ${APPLICATION_FOLDER}/.`);
   const tested = await child(TEST_ARGS);
   if (stopped(tested)) return stop("npm test", tested, false);
   if (tested.error !== null) {
-    io2.print(notStartedLine("npm test", tested.error, entry, takeLine));
+    printEach(io2, notStartedLine("npm test", tested.error, entries, takeLines));
     return COMMAND_STATUS.failed;
   }
   if (tested.status !== 0) {
-    io2.print(taken === null ? untakenTestsFailedLine(template) : testsFailedLine(taken.entry, taken.version));
+    io2.print(taken.length === 0 ? untakenTestsFailedLine(template) : takenTestsFailedLine(taken));
     return COMMAND_STATUS.failed;
   }
   io2.print(testedLine(taken));
@@ -6609,21 +7629,21 @@ async function installAndTest(io2, app, template, taken, origin, left) {
 }
 var SCAFFOLD_ROW = Object.freeze({
   name: SCAFFOLD_SUBCOMMAND,
-  summary: `Writes a new service from a template into a project, ${SCAFFOLD_DEFAULT_TEMPLATE} where the line names no ${SCAFFOLD_OPTION.template}. A template that takes a library entry, as ${RESOURCE_TEMPLATE} takes the Database entry, takes it as library take does, checking each file's SHA-256 and the entry's closure hash before it writes anything. It then writes the template's files under app/, the manifest's packages member filled from the library folder's rows, runs npm install and npm test there, and prints the next steps. It starts a new application and writes over none. It reads no credential.`,
+  summary: `Writes a new service from a template into a project, ${SCAFFOLD_DEFAULT_TEMPLATE} where the line names no ${SCAFFOLD_OPTION.template}. A template that takes library entries, as database-service takes the Database entry and web-app takes three, takes each as library take does, checking each file's SHA-256 and each entry's closure hash before it writes anything. It then writes the template's files under app/, the manifest's packages member filled from the library folder's rows, runs npm install and npm test there, and prints the next steps. It starts a new application and writes over none. It reads no credential.`,
   options: SCAFFOLD_OPTIONS,
   credential: null,
   statuses: {
-    done: "the files written and installed, the entry taken where the template takes one, and the tests passed",
+    done: "the files written and installed, the entries taken where the template takes any, and the tests passed",
     failed: "the files written, and npm install or the tests failed",
     unknown: "the run stopped before its end, by an interrupt or another signal that ended npm, by an error of the command's own, or by something that came to stand at app while it wrote: the printed sentence names the way on",
     nothing_started: "nothing was written"
   },
   note: [
     `Run the ${SCAFFOLD_SUBCOMMAND} line at the root of a new project, or name the root with ${SCAFFOLD_OPTION.path}, which the command makes where it does not stand. A line that names no ${SCAFFOLD_OPTION.template} writes ${SCAFFOLD_DEFAULT_TEMPLATE}, which takes no library entry and makes no request, and says so in a line before the files it wrote. Under scheduled-job, the minute of the schedule's cron in the manifest is the minute of the hour, in UTC, at which the run started.`,
-    `Under ${RESOURCE_TEMPLATE}, with ${SCAFFOLD_OPTION.resource}, and ${SCAFFOLD_OPTION.singular} where the singular is not the plural without its closing s, it writes the same service under the resource's names, its table, its route, its functions, and two file names among them, and runs the tests on the files as written. It refuses, writing nothing, where the root's ${APPLICATION_FOLDER}/ holds any file or folder, and it takes no option that overwrites: where the template takes an entry, its sentence names the ${LIBRARY_SUBCOMMAND} take line, which adds the package to an application that stands.`,
+    `Under ${listedAnd(RESOURCE_TEMPLATES)}, with ${SCAFFOLD_OPTION.resource}, and ${SCAFFOLD_OPTION.singular} where the singular is not the plural without its closing s, it writes the same service under the resource's names, its table, its route, its functions, and its file names among them, and runs the tests on the files as written. It refuses, writing nothing, where the root's ${APPLICATION_FOLDER}/ holds any file or folder, and it takes no option that overwrites: where the template takes entries, its sentence names the ${LIBRARY_SUBCOMMAND} take line for each, which adds the package to an application that stands.`,
     `A root that holds neither ${LIBRARY_FOLDER}/ nor ${POINTER_FILE} takes a ${LIBRARY_FOLDER}/ of its own. Where the root holds no ${TOOLS_FILE}, it writes one of one sentence, which sends a coding tool to ${APPLICATION_FOLDER}/${TOOLS_FILE}; it changes no file that stands at the root, and where an ${TOOLS_FILE} or a ${CLAUDE_FILE} stands there it prints the sentence to add.`,
     `${SCAFFOLD_SUBCOMMAND} leaves ${COMMAND_CREDENTIAL_VARIABLES.join(" and ")} out of what npm install and npm test receive. An interrupt reaches npm, the command ends after it, and after an interrupted install the tests are not started. A signal that arrives after the command's first write and before npm starts is acted on once the writes are made: the command prints the way on, starts no npm, and ends with 128 and the signal's number.`,
-    `Where the tests fail, they failed on the files as written, and the printed line says to report it, naming the version the library served where the template takes an entry, and the template and the command's version where it takes none.`
+    `Where the tests fail, they failed on the files as written, and the printed line says to report it, naming the versions the library served where the template takes entries, and the template and the command's version where it takes none.`
   ],
   afterOwnError: SCAFFOLD_AFTER_OWN_ERROR,
   run: scaffold
@@ -6692,7 +7712,7 @@ var TOKEN_ROW = Object.freeze({
     done: "the challenge printed, or the value printed once",
     failed: "the token minted was an authorized computer's, and is revoked where it could be: the printed lines name revoke_token",
     unknown: "the exchange drew no answer, or an answer that is not a refusal: list_tokens shows whether a token was minted",
-    nothing_started: "nothing was minted: an option, the credential file, the token code, or a standard error that is no terminal was refused, no request was pending, or the exchange was refused"
+    nothing_started: "nothing was minted: an option, the credential file, the token code, or a standard error that is no terminal was refused, no request was pending, the platform was too old, or the exchange was refused"
   },
   variables: [[ORIGIN_VARIABLE, AUTHORIZATION_ORIGIN_VARIABLE_LINE]],
   note: [`${TOKEN_SUBCOMMAND} ${TOKEN_ACTS[0]} may run in a tool, since it prints nothing secret. ${TOKEN_SUBCOMMAND} ${TOKEN_ACTS[1]} is yours, run in a terminal outside the AI tool on the same computer as the same user, and never by a tool: it runs only where its standard error is a terminal, which yours stays when you pipe its standard output into your secret store's command, such as gh secret set ${MINTED_TOKEN_VARIABLE}. Read the line's origin before you run it.`],
@@ -7024,7 +8044,7 @@ var usageText = (version = commandVersion()) => {
   if (unattended.length > 0) {
     lines.push(
       `  ${MINTED_TOKEN_VARIABLE}  under ${listed(unattended)}, a minted token for a tool connected by a minted token or an unattended run, set for the one line from where the tool keeps it or from your CI's secret store. Where it is set, it wins over this computer's credential file.`,
-      `  ${ORIGIN_VARIABLE}  under ${listed(unattended)}, in an unattended run, the platform's address the minted token is sent to where the line names no ${DEPLOY_OPTION.origin}. Under the token, a ${DEPLOY_OPTION.origin} the line names must be that address or ${DEFAULT_COMMAND_ORIGIN}; an address of this machine is admitted only where this variable names it. Where ${MINTED_TOKEN_VARIABLE} is not set and the line names no ${DEPLOY_OPTION.origin}, this variable names the address whose token the command reads from this computer's credential file${computerOnly.length > 0 ? `, under ${listed(computerOnly)} too where no grant is piped` : ""}. A run under a grant does not read it.`
+      `  ${ORIGIN_VARIABLE}  under ${listed(unattended)}, in an unattended run, the platform's address the minted token is sent to where the line names no ${DEPLOY_OPTION.origin}. Under the token, a ${DEPLOY_OPTION.origin} the line names must be that address, or ${DEFAULT_COMMAND_ORIGIN} where this variable is unset. Where ${MINTED_TOKEN_VARIABLE} is not set and the line names no ${DEPLOY_OPTION.origin}, this variable names the address whose token the command reads from this computer's credential file${computerOnly.length > 0 ? `, under ${listed(computerOnly)} too where no grant is piped` : ""}. A run under a grant does not read it.`
     );
   }
   lines.push(`  ${USER_AGENT_VARIABLE}  text appended to the command's user agent on each request.`, "", "Statuses:");
@@ -7114,34 +8134,36 @@ var nodeMajorOf = (version) => {
   const major = /^v?(\d+)(?:\.|$)/.exec(version);
   return major === null ? null : Number(major[1]);
 };
-var nodeFloorRefusal = (version) => {
-  const major = nodeMajorOf(version);
-  return major !== null && major < COMMAND_NODE_FLOOR ? nodeFloorSentence(version) : null;
+var nodeFloorRefusal = (found, version = commandVersion()) => {
+  const major = nodeMajorOf(found);
+  return major !== null && major < COMMAND_NODE_FLOOR ? nodeFloorSentence(version, found) : null;
 };
+var versionLineOf = (version, found) => `${TURNZERO_CLOUD_PACKAGE} ${version} (Node.js ${found})`;
 async function runGuarded(argv2, io2) {
   const found = io2.nodeVersion ?? process.versions.node;
-  const belowFloor = nodeFloorRefusal(found);
+  const version = commandVersion();
+  const belowFloor = nodeFloorRefusal(found, version);
   if (belowFloor !== null) {
-    outputOf(argv2, io2)(carriesTokenCode(argv2) ? tokenCodeFloorSentence(found) : belowFloor);
+    outputOf(argv2, io2)(carriesTokenCode(argv2) ? tokenCodeFloorSentence(version, found) : belowFloor);
     return COMMAND_STATUS.nothing_started;
   }
   const parsed = parseArguments(argv2, io2.windows ?? ON_WINDOWS);
-  switch (parsed.kind) {
-    case "help":
-      io2.print(usageText());
-      return COMMAND_STATUS.done;
-    case "version":
-      io2.print(commandVersion());
-      return COMMAND_STATUS.done;
-    case "refused": {
-      const say = outputOf(argv2, io2);
-      say(carriesTokenCode(argv2) ? `${parsed.sentence} ${TOKEN_CODE_UNREAD}` : parsed.sentence);
-      say(`${SERVED} --help prints the usage.`);
-      return COMMAND_STATUS.nothing_started;
-    }
-    case "run":
-      return parsed.subcommand.run(parsed.call, io2);
+  if (parsed.kind === "help") {
+    io2.print(usageText(version));
+    return COMMAND_STATUS.done;
+  }
+  if (parsed.kind === "version") {
+    io2.print(version);
+    return COMMAND_STATUS.done;
+  }
+  const say = outputOf(argv2, io2);
+  say(versionLineOf(version, found));
+  if (parsed.kind === "refused") {
+    say(carriesTokenCode(argv2) ? `${parsed.sentence} ${TOKEN_CODE_UNREAD}` : parsed.sentence);
+    say(`${SERVED} --help prints the usage.`);
+    return COMMAND_STATUS.nothing_started;
   }
+  return parsed.subcommand.run(parsed.call, io2);
 }
 var outputOf = (argv2, io2) => argv2[0] === TOKEN_SUBCOMMAND && argv2[1] === TOKEN_CLAIM_ACT ? io2.printError ?? io2.print : io2.print;
 var NOTHING_REACHED = "no subcommand was reached, so nothing was started";