turnzero 0.13.0 → 0.14.0

package/README.md

@@ -2,13 +2,13 @@
 
 Turn Zero Cloud connects to your AI coding tool through a Model Context Protocol (MCP) server. Once connected, your AI can code, build, and test backends, connect them to your app, and host your code in the cloud.
 
-Turn Zero Cloud is for developers who build with an AI coding tool and do not want to run servers. Your tool writes, builds, and tests the application on your computer. The platform builds it, runs it in production at the application's address, and records its logs, counters, and usage. To start, connect your AI tool: https://turnzero.ai/cloud/getting-started/connect-your-tool/
+Turn Zero Cloud is for developers who build with an AI coding tool and do not want to run servers. Your tool writes, builds, and tests the application on your computer. The platform builds it, runs it in production at the application's address, and records its logs, counters, and usage. To start, connect your AI coding tool: https://turnzero.ai/cloud/getting-started/connect-your-tool/
 
 ## What this package is
 
-The turnzero command-line tool is used by the Turn Zero Cloud MCP server. Your AI tool runs it on your computer for the work the platform cannot do from the cloud: reading your files, writing files, and starting your application.
+The turnzero command-line tool is used by the Turn Zero Cloud MCP server. Your AI coding tool runs it on your computer for the work the platform cannot do from the cloud: reading your files, writing files, and starting your application.
 
-You do not install it. The MCP server gives your AI tool each command line to run, and `npx` fetches this package from npm when that line runs. It needs Node.js 24 or later.
+Install it once with `npm install -g turnzero`, then run `turnzero login` once in a terminal of your own and approve the login in your browser. The MCP server then gives your AI coding tool each command line to run, such as `turnzero deploy --application <id>`. On Windows the lines run `turnzero.cmd`. Where the command is not installed, the same line runs through npx as `npx -y turnzero@latest`. It needs Node.js 24 or later.
 
 ## Subcommands
 
@@ -22,7 +22,8 @@ You do not install it. The MCP server gives your AI tool each command line to ru
 - `provision` gets new development credentials for your application and writes them to its environment file.
 - `run` starts your application on your computer with that file's settings.
 - `scaffold` writes a new service into your project from a template, installs it, and runs its tests.
-- `authorize` gives this computer a token to act on your account, and `logout` revokes it.
+- `login` logs this computer in through your browser, and `logout` revokes its token.
+- `authorize` gives this computer a token through your tool, where you ask your tool to.
 - `token request` and `token claim` get a token for another computer or for an unattended run.
 
 Every subcommand's options, statuses, and output are on the reference page: https://turnzero.ai/cloud/reference/turnzero-command/

package/dist/turnzero-cloud.mjs

@@ -61,6 +61,20 @@ var startBodyOf = (application, upload, environment = UPLOAD_ENVIRONMENT) => ({
   upload
 });
 var TURNZERO_CLOUD_PACKAGE = "turnzero";
+var LOGIN_SUBCOMMAND = "login";
+var LOGIN_OPTION = Object.freeze({ origin: "--origin", noBrowser: "--no-browser" });
+var loginLineOf = (origin) => commandLineOf(origin, LOGIN_SUBCOMMAND, origin !== DEFAULT_COMMAND_ORIGIN ? { origin } : {});
+var COMPUTER_LOGIN_PATH = "/approve/computer";
+var COMPUTER_LOGIN_QUERY = Object.freeze({ challenge: "challenge", state: "state", port: "port", label: "label" });
+var LOGIN_STATE_FORM = /^[A-Za-z0-9_-]{43}$/;
+var computerLoginAddressOf = (origin, login2) => {
+  const query = new URLSearchParams();
+  query.set(COMPUTER_LOGIN_QUERY.challenge, login2.challenge);
+  query.set(COMPUTER_LOGIN_QUERY.state, login2.state);
+  if (login2.port !== null) query.set(COMPUTER_LOGIN_QUERY.port, String(login2.port));
+  query.set(COMPUTER_LOGIN_QUERY.label, login2.label);
+  return `${origin}${COMPUTER_LOGIN_PATH}?${query.toString()}`;
+};
 var DEPLOY_SUBCOMMAND = "deploy";
 var CHECK_SUBCOMMAND = "check";
 var CHECK_ACTION = "check_deploy";
@@ -70,26 +84,43 @@ var DEPLOY_OPTION = Object.freeze({ env: "--env", upload: "--upload", path: "--p
 var CHECK_OPTION = { application: "--application", path: "--path", origin: "--origin" };
 var HASH_OPTION = Object.freeze({ path: DEPLOY_OPTION.path, list: "--list", origin: DEPLOY_OPTION.origin });
 var HASH_LINE_HEAD = "sha256: ";
-var LINE_PROGRAM = "npx";
-var WINDOWS_LINE_PROGRAM = "npx.cmd";
-var LINE_RUNNER = `${LINE_PROGRAM} -y`;
-var WINDOWS_LINE_RUNNER = `${WINDOWS_LINE_PROGRAM} -y`;
-var LINE_GRANT_HEAD = /^echo \S+ \| $/;
-var windowsLineOf = (line) => {
+var LINE_PROGRAM = TURNZERO_CLOUD_PACKAGE;
+var WINDOWS_LINE_PROGRAM = `${TURNZERO_CLOUD_PACKAGE}.cmd`;
+var LINE_RUNNER = LINE_PROGRAM;
+var WINDOWS_LINE_RUNNER = WINDOWS_LINE_PROGRAM;
+var NPX_LINE_RUNNER = "npx -y";
+var NPX_WINDOWS_LINE_RUNNER = "npx.cmd -y";
+var installLineOf = (origin) => `npm install -g ${TURNZERO_CLOUD_PACKAGE}${origin === DEFAULT_COMMAND_ORIGIN ? "" : `@${commandTagOf(origin)}`}`;
+var npxFormOf = (line, origin) => {
   const runner = `${LINE_RUNNER} `;
   const at = line.indexOf(runner);
   const before = at < 0 ? null : line.slice(0, at);
   if (before === null || before !== "" && !LINE_GRANT_HEAD.test(before)) {
-    throw new Error(`a line's Windows form was asked for a line that does not open with ${LINE_RUNNER}, after an optional echo of a grant`);
+    throw new Error(`a line's npx form was asked for a line that does not open with ${LINE_RUNNER}, after an optional echo of a grant`);
   }
-  return `${before}${WINDOWS_LINE_RUNNER} ${line.slice(at + runner.length)}`;
+  return `${before}${commandRunnerOf(commandTagOf(origin))} ${line.slice(at + runner.length)}`;
+};
+var LINE_GRANT_HEAD = /^echo \S+ \| $/;
+var windowsLineOf = (line) => {
+  for (const [head, windows] of [
+    [LINE_RUNNER, WINDOWS_LINE_RUNNER],
+    [NPX_LINE_RUNNER, NPX_WINDOWS_LINE_RUNNER]
+  ]) {
+    const runner = `${head} `;
+    const at = line.indexOf(runner);
+    if (at < 0) continue;
+    const before = line.slice(0, at);
+    if (before !== "" && !LINE_GRANT_HEAD.test(before)) continue;
+    return `${before}${windows} ${line.slice(at + runner.length)}`;
+  }
+  throw new Error(`a line's Windows form was asked for a line that does not open with ${LINE_RUNNER} or ${NPX_LINE_RUNNER}, after an optional echo of a grant`);
 };
 var originWord = (word) => word.includes("[") ? `"${word}"` : word;
-var commandRunnerOf = (tag) => `${LINE_RUNNER} ${TURNZERO_CLOUD_PACKAGE}@${tag}`;
+var commandRunnerOf = (tag) => `${NPX_LINE_RUNNER} ${TURNZERO_CLOUD_PACKAGE}@${tag}`;
 var COMMAND_TAGS = Object.freeze({ production: "latest", other: "next" });
 var commandTagOf = (origin) => origin === DEFAULT_COMMAND_ORIGIN ? COMMAND_TAGS.production : COMMAND_TAGS.other;
 var commandLineOf = (addressOrigin, subcommand, parts = {}) => [
-  commandRunnerOf(commandTagOf(addressOrigin)),
+  (void addressOrigin, LINE_RUNNER),
   subcommand,
   ...parts.act !== void 0 ? [parts.act] : [],
   ...(parts.options ?? []).map(([name, value]) => `${name} ${value}`),
@@ -347,7 +378,7 @@ function compareWireVersions(a, b) {
 
 // src/turnzero_cloud_command/plane_wire.ts
 var PLANE_WIRE_NEEDED = Object.freeze({
-  action_payloads: "2026-10-10.11",
+  action_payloads: "2026-10-13.10",
   management_api: "2026-10-10.5",
   wire_errors: "2026-10-10.6"
 });
@@ -530,6 +561,8 @@ var CREDENTIAL_FILE_NAME = "credentials.json";
 var CREDENTIAL_FOLDER_MODE = 448;
 var CONFIG_HOME_VARIABLE = "XDG_CONFIG_HOME";
 var CONFIG_HOME_FALLBACK = ".config";
+var WINDOWS_CREDENTIAL_FOLDER_NAME = ".turnzero-cloud";
+var PROFILE_VARIABLE = "USERPROFILE";
 var LOCAL_APP_DATA_VARIABLE = "LOCALAPPDATA";
 var LOCAL_APP_DATA_FALLBACK = ["AppData", "Local"];
 var PENDING_REQUEST_MS = 10 * 6e4;
@@ -537,11 +570,20 @@ var credentialFileOf = (io2) => {
   const windows = io2.windows ?? process.platform === "win32";
   const home = io2.homeFolder ?? homedir();
   const paths = windows ? win32 : posix;
-  const named = (io2.env[windows ? LOCAL_APP_DATA_VARIABLE : CONFIG_HOME_VARIABLE] ?? "").trim();
-  const base = named !== "" && paths.isAbsolute(named) ? named : windows ? paths.join(home, ...LOCAL_APP_DATA_FALLBACK) : paths.join(home, CONFIG_HOME_FALLBACK);
-  const folder = paths.join(base, CREDENTIAL_FOLDER_NAME);
+  const named = (io2.env[windows ? PROFILE_VARIABLE : CONFIG_HOME_VARIABLE] ?? "").trim();
+  const base = named !== "" && paths.isAbsolute(named) ? named : windows ? home : paths.join(home, CONFIG_HOME_FALLBACK);
+  const folder = paths.join(base, windows ? WINDOWS_CREDENTIAL_FOLDER_NAME : CREDENTIAL_FOLDER_NAME);
   return { folder, path: paths.join(folder, CREDENTIAL_FILE_NAME) };
 };
+var oldCredentialFileOf = (io2) => {
+  const windows = io2.windows ?? process.platform === "win32";
+  if (!windows) return null;
+  const home = io2.homeFolder ?? homedir();
+  const named = (io2.env[LOCAL_APP_DATA_VARIABLE] ?? "").trim();
+  const base = named !== "" && win32.isAbsolute(named) ? named : win32.join(home, ...LOCAL_APP_DATA_FALLBACK);
+  const folder = win32.join(base, CREDENTIAL_FOLDER_NAME);
+  return { folder, path: win32.join(folder, CREDENTIAL_FILE_NAME) };
+};
 var EMPTY_CREDENTIAL_STATE = Object.freeze({ origins: /* @__PURE__ */ new Map(), pending: /* @__PURE__ */ new Map() });
 var INSTANT_FORM = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/;
 var LABEL_FORM = /^[^\u0000-\u001f\u007f-\u009f]{1,512}$/;
@@ -611,7 +653,7 @@ var readCredentialFile = (io2, path) => {
 var unreadableFileSentence = (path, code) => `The credential file ${path} could not be read (${code}), so nothing was sent and nothing was changed.`;
 var malformedFileSentence = (path) => `The credential file ${path} is not in the form this command writes, so nothing was sent and nothing was changed; what it holds is not shown. Move it aside or delete it, and authorize this computer again: a token it held works until it expires, list_tokens from your tool shows it by its label, and revoke_token ends it.`;
 var unwritableFileSentence = (path, code) => `The credential file ${path} could not be written (${code}): its folder must stand or be one the command can make, and admit a write.`;
-var readRefusalOf = (read2, path) => "malformed" in read2 ? malformedFileSentence(path) : "unreadable" in read2 ? unreadableFileSentence(path, read2.unreadable) : null;
+var readRefusalOf = (read2, path) => "malformed" in read2 ? malformedFileSentence(read2.path ?? path) : "unreadable" in read2 ? unreadableFileSentence(read2.path ?? path, read2.unreadable) : null;
 var runTagOf = () => randomBytes(6).toString("hex");
 var prepareCredentialFile = (io2, place, tag) => {
   try {
@@ -645,6 +687,59 @@ var withoutOrigin = (origin) => (state) => ({
   pending: new Map([...state.pending].filter(([key]) => key !== origin))
 });
 var pendingLives = (entry, now) => Date.parse(entry.expires_at) > now.getTime();
+var withOldEntries = (old) => (state) => ({
+  origins: new Map([...old.origins].filter(([origin]) => !state.origins.has(origin)).concat([...state.origins])),
+  pending: new Map([...old.pending].filter(([origin]) => !state.pending.has(origin)).concat([...state.pending]))
+});
+var droppedEntriesSentence = (oldPath, path, dropped) => `The credential file at its old place, ${oldPath}, held ${dropped.length === 1 ? "a token" : "tokens"} for ${dropped.length === 1 ? "an address" : "addresses"} ${path} also holds one for, so ${dropped.length === 1 ? "it was" : "they were"} not brought over: revoke_token from your tool with id ${dropped.map((entry) => entry.token_id).join(", then with id ")} ends ${dropped.length === 1 ? "it" : "each"}.`;
+var unmovedSentence = (oldPath, path, code) => `The credential file could not be moved from its old place, ${oldPath}, to ${path} (${code}), so this run reads it where it stands; the next run moves it again.`;
+var movesWith = (io2) => io2.writeFile !== void 0 && io2.rename !== void 0 && io2.copyMode !== void 0 && io2.makeFolder !== void 0 && io2.removeFile !== void 0 && io2.stat !== void 0;
+var MOVES = /* @__PURE__ */ new WeakMap();
+var readMovingCredentialFile = (io2, place, say) => {
+  const old = oldCredentialFileOf(io2);
+  if (old === null || old.path === place.path || !movesWith(io2)) return readCredentialFile(io2, place.path);
+  const made = MOVES.get(io2);
+  if (made !== void 0) {
+    const read3 = readCredentialFile(io2, place.path);
+    return made.unmoved !== null && "state" in read3 ? { state: withOldEntries(made.unmoved)(read3.state) } : read3;
+  }
+  MOVES.set(io2, { unmoved: null });
+  let standing;
+  try {
+    standing = io2.stat(old.path);
+  } catch {
+    standing = null;
+  }
+  if (standing === null || standing.folder) return readCredentialFile(io2, place.path);
+  const oldRead = readCredentialFile(io2, old.path);
+  if ("malformed" in oldRead) return { malformed: true, path: old.path };
+  if ("unreadable" in oldRead) return { unreadable: oldRead.unreadable, path: old.path };
+  const read2 = readCredentialFile(io2, place.path);
+  if (!("state" in read2)) return read2;
+  const tag = runTagOf();
+  let moved;
+  try {
+    const prepared = prepareCredentialFile(io2, place, tag);
+    moved = "unwritten" in prepared ? prepared : updateCredentialFile(io2, place, tag, withOldEntries(oldRead.state));
+  } finally {
+    dropCredentialWriting(io2, place, tag);
+  }
+  if (!("written" in moved)) {
+    if ("unwritten" in moved) {
+      MOVES.set(io2, { unmoved: oldRead.state });
+      say(unmovedSentence(old.path, place.path, moved.unwritten));
+      return { state: withOldEntries(oldRead.state)(read2.state) };
+    }
+    return moved;
+  }
+  const dropped = [...oldRead.state.origins].filter(([origin]) => moved.before.origins.has(origin)).map(([, entry]) => entry);
+  try {
+    io2.removeFile(old.path);
+  } catch {
+  }
+  if (dropped.length > 0) say(droppedEntriesSentence(old.path, place.path, dropped));
+  return readCredentialFile(io2, place.path);
+};
 
 // src/turnzero_cloud_command/grant.ts
 var GRANT_READ_BOUND_MS = 1e4;
@@ -689,11 +784,23 @@ var unendedReadSentence = (what, reading, closing, wayOn) => `${reading === "err
 var NOTHING_PIPED_WAY_ON = "or, to run with nothing piped, close standard input or redirect it from an empty source";
 var pipeWholeWayOn = (aWhat, call, nothingPiped = false) => `Pipe ${aWhat} whole and end the input, as the line ${call} answers does${nothingPiped ? `, ${NOTHING_PIPED_WAY_ON}` : ""}.`;
 
+// src/turnzero_cloud_command/line_form.ts
+var onWindows = (io2) => io2.windows ?? process.platform === "win32";
+var ranThroughNpx = (io2) => io2.ranThroughNpx ?? false;
+var loginLineFor = (io2, origin) => {
+  const line = loginLineOf(origin);
+  return onWindows(io2) ? windowsLineOf(line) : line;
+};
+var loginLinesFor = (io2, origin) => [
+  ...ranThroughNpx(io2) ? [installLineOf(origin)] : [],
+  loginLineFor(io2, origin)
+];
+
 // src/turnzero_cloud_command/credential.ts
 var REDACTED_TOKEN = "<minted token>";
 var MINTED_TOKEN_PREFIX_WORDS = `${MINTED_TOKEN_PREFIX.slice(0, -1)} and an underscore`;
 var CREDENTIAL_SOURCES = Object.freeze(["standard_input", "minted_token_variable", "credential_file"]);
-var credentialPlaces = (declared) => declared.places ?? `the command reads the grant from its standard input, as the line ${declared.call} answers pipes it in${declared.mintedToken ? `, and otherwise a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, or this computer's token for the platform's address from its credential file, which authorize writes` : declared.computerToken === true ? `, and otherwise this computer's token for the platform's address from its credential file, which authorize writes, and never a minted token from ${MINTED_TOKEN_VARIABLE}` : ""}.`;
+var credentialPlaces = (declared) => declared.places ?? `the command reads the grant from its standard input, as the line ${declared.call} answers pipes it in${declared.mintedToken ? `, and otherwise a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, or this computer's token for the platform's address from its credential file, which login and authorize write` : declared.computerToken === true ? `, and otherwise this computer's token for the platform's address from its credential file, which login and authorize write, and never a minted token from ${MINTED_TOKEN_VARIABLE}` : ""}.`;
 var unsetVariableWayOn = (declared) => `To run a line you wrote yourself under this computer's token, unset ${MINTED_TOKEN_VARIABLE} and run it again; or pipe ${declared.aGrant}.`;
 var grantWaysOn = (declared) => `Pipe ${declared.aGrant}, as the line ${declared.call} answers pipes it, or, where you wrote the line yourself, pipe nothing to run it under this computer's token.`;
 var emptyGrantRefusal = (declared) => `The ${declared.grant} piped to the command was empty, so nothing was sent and nothing was started. ${grantWaysOn(declared)}`;
@@ -740,7 +847,7 @@ async function readCredential(io2, declared, again, line = { named: void 0, clos
   const origin = entryOriginOf(io2.env, line.named, line.closing);
   if ("refusal" in origin) return origin;
   const place = credentialFileOf(io2);
-  const read2 = readCredentialFile(io2, place.path);
+  const read2 = readMovingCredentialFile(io2, place, io2.print ?? (() => void 0));
   if (!("state" in read2)) return { refusal: readRefusalOf(read2, place.path) };
   const entry = read2.state.origins.get(origin.origin);
   const unauthorized = (expiredAt) => ({
@@ -756,8 +863,8 @@ var credentialOriginOf = (env, read2, line) => {
   if (read2.source === "minted_token_variable") return mintedTokenOriginOf(env, line.named, line.closing);
   return commandOriginOf(line.named ?? DEFAULT_COMMAND_ORIGIN);
 };
-var fileStandingOf = (io2, origin) => {
-  const read2 = readCredentialFile(io2, credentialFileOf(io2).path);
+var fileStandingOf = (io2, origin, say) => {
+  const read2 = readMovingCredentialFile(io2, credentialFileOf(io2), say);
   if (!("state" in read2)) return "unread";
   const entry = read2.state.origins.get(origin);
   if (entry === void 0) return "none";
@@ -776,10 +883,22 @@ var variableReadSentence = (origin, standing) => {
       return `${opening}; that file could not be read.`;
   }
 };
-var fileReadSentence = (origin) => `The credential this run read was this computer's token for ${origin}, from its credential file: where the platform no longer accepts it, run ${AUTHORIZE_SUBCOMMAND}${originWordsOf(origin)} to authorize this computer again.`;
+var fileReadSentence = (origin) => `The credential this run read was this computer's token for ${origin}, from its credential file: where the platform no longer accepts it, run ${LOGIN_SUBCOMMAND}${originWordsOf(origin)} to authorize this computer again.`;
 var noTokenSentence = (origin, expiredAt) => expiredAt === null ? `No credential was read, so nothing was sent: ${MINTED_TOKEN_VARIABLE} is not set, and this computer's credential file holds no token for ${origin}.` : `No credential was read, so nothing was sent: ${MINTED_TOKEN_VARIABLE} is not set, and this computer's token for ${origin} in its credential file expired at ${expiredAt}.`;
 var VARIABLE_ROUTE_SENTENCES = `A tool connected by a minted token, or a job, cannot use ${MINT_TOKEN_ACTION}, which takes a sign-in alone. It sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, never by writing the value in a line, and ${ORIGIN_VARIABLE} to the address that minted the token where that is not ${DEFAULT_COMMAND_ORIGIN}, then runs the line again. A tool sets ${MINTED_TOKEN_VARIABLE} for the deploy or check line alone and unsets it once that line ends.`;
-var SIGNED_IN_ROUTE_OPENER = "A tool signed in to the platform authorizes this computer instead:";
+var LOGIN_ROUTE_OPENER = "A person logs this computer in once, in a terminal of their own, and its token then stays on this computer for 30 days:";
+var DEPLOY_FILES_ROUTE_SENTENCE = "A folder within the caps of your tool's deploy_files call deploys now through deploy_files, with no login.";
+var loginRouteLines = (io2, origin) => [LOGIN_ROUTE_OPENER, ...loginLinesFor(io2, origin), DEPLOY_FILES_ROUTE_SENTENCE];
+var loginRouteRefusalOf = (io2, closing) => {
+  const place = credentialFileOf(io2);
+  const tag = runTagOf();
+  try {
+    const prepared = prepareCredentialFile(io2, place, tag);
+    return "unwritten" in prepared ? `${unwritableFileSentence(place.path, prepared.unwritten)} ${closing}` : null;
+  } finally {
+    dropCredentialWriting(io2, place, tag);
+  }
+};
 
 // src/turnzero_cloud_command/guard.ts
 var GRANT_TEXT = new RegExp(`${UPLOAD_GRANT_PREFIX}[A-Za-z0-9_-]*(?:\\.[A-Za-z0-9_-]+)*`, "g");
@@ -869,7 +988,8 @@ var mintCallMembers = (kind, challenge, label) => kind === "authorized computer"
 var firstActWayOn = (kind) => kind === "authorized computer" ? `Where the platform refuses ${CODE_CHALLENGE_MEMBER}, it does not yet serve this authorization: deploy by the line your tool's deploy call answers until the platform's next release.` : `Where the platform refuses ${CODE_CHALLENGE_MEMBER}, it does not yet serve this mint: until the platform's next release, ${MINT_TOKEN_ACTION} without it answers the token's value as it does today.`;
 var firstActNamed = (kind, origin = DEFAULT_COMMAND_ORIGIN) => `${kind === "authorized computer" ? AUTHORIZE_SUBCOMMAND : `${TOKEN_SUBCOMMAND} ${TOKEN_REQUEST_ACT}`}${originWordsOf(origin)}`;
 var noConnectionLine = (origin) => `Where your tool holds no connection signed in to ${origin}, ${MINT_TOKEN_ACTION} is not among its tools: a person connects the tool and signs in, in a browser, before the call.`;
-var firstActLines = (origin, kind, pending, label) => [
+var loginWaySentence = (loginLines) => `A person can instead log this computer in themselves, in a terminal of their own, by running ${loginLines.join(", then ")}, and approving the login in the browser.`;
+var firstActLines = (origin, kind, pending, label, loginLines = []) => [
   kind === "authorized computer" ? `To authorize this computer at ${origin}, call ${MINT_TOKEN_ACTION} from your tool, through the connection you signed in with, naming the members below and no others, then run the line it answers once, as given, on this computer.` : `To mint a token whose value never passes through the chat, call ${MINT_TOKEN_ACTION} at ${origin} from your tool, through the connection you signed in with, naming the member below beside the scope_kind, application, grants, label, and expires_in_days the task needs.`,
   // The case this command cannot see (#4273): a tool with no signed-in
   // connection holds no mint_token, and only a person's sign-in mends it.
@@ -877,20 +997,38 @@ var firstActLines = (origin, kind, pending, label) => [
   `${CHALLENGE_LINE_HEAD}${pending.challenge}`,
   CALL_LINE_HEAD,
   ...mintCallMembers(kind, pending.challenge, label).map(([name, value]) => `  ${name}: ${JSON.stringify(value)}`),
-  kind === "authorized computer" ? `The line keeps the token it mints in this computer's credential file and revokes the one this computer held there before. The token is account-scoped and works from any computer until it expires or revoke_token ends it, and list_tokens shows it by its label. The request is pending until ${pending.expires_at}: ${firstActNamed(kind, origin)} run again before then prints this challenge again.` : `It answers a ${TOKEN_SUBCOMMAND} ${TOKEN_CLAIM_ACT} line, which is yours to run in a terminal outside the AI tool, on this computer as this user, and never through the tool: it prints the token's value once to standard output, so pipe it into your secret store's command where the token is a job's. The request is pending until ${pending.expires_at}: ${firstActNamed(kind, origin)} run again before then prints this challenge again.`,
+  kind === "authorized computer" ? `The line keeps the token it mints in this computer's credential file and revokes the one this computer held there before. The token is account-scoped and works from any computer until it expires or revoke_token ends it, and list_tokens shows it by its label. The request is pending until ${pending.expires_at}: ${firstActNamed(kind, origin)} run again before then prints this challenge again.` : `It answers a ${TOKEN_SUBCOMMAND} ${TOKEN_CLAIM_ACT} line, which is yours to run in a terminal outside the AI coding tool, on this computer as this user, and never through the tool: it prints the token's value once to standard output, so pipe it into your secret store's command where the token is a job's. The request is pending until ${pending.expires_at}: ${firstActNamed(kind, origin)} run again before then prints this challenge again.`,
+  ...kind === "authorized computer" && loginLines.length > 0 ? [loginWaySentence(loginLines)] : [],
   firstActWayOn(kind)
 ];
 var reusedRequestSentence = (origin, pending) => `A request for ${origin} is pending until ${pending.expires_at}, so its challenge is printed again and no new verifier was made.`;
 var replacedRequestSentence = (origin, expired2) => `The request pending for ${origin} expired at ${expired2.expires_at}, so a new one replaces it: a line minted against the old challenge is refused at its exchange, and a ${MINT_TOKEN_ACTION} call naming the new challenge below answers a fresh one.`;
 async function firstAct(io2, origin, kind, say, opener = null) {
+  const kept2 = keepPendingRequest(io2, origin, say);
+  if ("status" in kept2) return kept2.status;
+  const { pending, opening } = kept2;
+  const label = computerLabelOf(io2.hostName ?? hostname());
+  const lines = [
+    ...opener !== null ? [opener] : [],
+    ...opening !== "" ? [opening] : [],
+    ...firstActLines(origin, kind, pending, label, kind === "authorized computer" ? loginLinesFor(io2, origin) : [])
+  ];
+  let last = -1;
+  for (const [index, line] of lines.entries()) if (line.includes(pending.challenge)) last = index;
+  for (const [index, line] of lines.entries()) {
+    say(line);
+    if (index === last) io2.hide(pending.challenge, REDACTED_CHALLENGE);
+  }
+  return COMMAND_STATUS.done;
+}
+function keepPendingRequest(io2, origin, say) {
   const place = credentialFileOf(io2);
-  const read2 = readCredentialFile(io2, place.path);
+  const read2 = readMovingCredentialFile(io2, place, say);
   if (!("state" in read2)) {
     say(readRefusalOf(read2, place.path));
-    return COMMAND_STATUS.nothing_started;
+    return { status: COMMAND_STATUS.nothing_started };
   }
   hideStandingTokens(io2, read2.state);
-  const label = computerLabelOf(io2.hostName ?? hostname());
   const now = io2.clock();
   const standing = read2.state.pending.get(origin);
   let pending;
@@ -908,12 +1046,12 @@ async function firstAct(io2, origin, kind, say, opener = null) {
       const prepared = prepareCredentialFile(io2, place, tag);
       if ("unwritten" in prepared) {
         say(`${unwritableFileSentence(place.path, prepared.unwritten)} Nothing was sent, and no request is pending.`);
-        return COMMAND_STATUS.nothing_started;
+        return { status: COMMAND_STATUS.nothing_started };
       }
       const written = updateCredentialFile(io2, place, tag, withPending(origin, pending));
       if (!("written" in written)) {
         say("unwritten" in written ? `${unwritableFileSentence(place.path, written.unwritten)} Nothing was sent, and no request is pending.` : readRefusalOf(written, place.path));
-        return COMMAND_STATUS.nothing_started;
+        return { status: COMMAND_STATUS.nothing_started };
       }
     } finally {
       release();
@@ -921,14 +1059,7 @@ async function firstAct(io2, origin, kind, say, opener = null) {
     }
     opening = standing !== void 0 ? replacedRequestSentence(origin, standing) : "";
   }
-  const lines = [...opener !== null ? [opener] : [], ...opening !== "" ? [opening] : [], ...firstActLines(origin, kind, pending, label)];
-  let last = -1;
-  for (const [index, line] of lines.entries()) if (line.includes(pending.challenge)) last = index;
-  for (const [index, line] of lines.entries()) {
-    say(line);
-    if (index === last) io2.hide(pending.challenge, REDACTED_CHALLENGE);
-  }
-  return COMMAND_STATUS.done;
+  return { pending, opening };
 }
 var TOKEN_CALL_BOUND_SECONDS = 60;
 var EXCHANGE_ACT = "exchange";
@@ -987,16 +1118,16 @@ var mintedTokenOf = (answer) => {
     authorizedComputer: view[AUTHORIZED_COMPUTER_MEMBER] === true
   };
 };
-var mintAgainSentence = (kind, origin = DEFAULT_COMMAND_ORIGIN) => `Call ${MINT_TOKEN_ACTION} from your tool again with the challenge ${firstActNamed(kind, origin)} prints, and run the line it answers.`;
-var exchangeUnknownSentence = (kind, origin = DEFAULT_COMMAND_ORIGIN) => `Whether a token was minted is unknown: list_tokens from your tool shows each token by its label, and revoke_token ends one nothing holds. ${mintAgainSentence(kind, origin)}`;
+var mintAgainSentence = (kind, origin = DEFAULT_COMMAND_ORIGIN, login2 = null) => login2 !== null ? `Run ${login2} again to log this computer in.` : `Call ${MINT_TOKEN_ACTION} from your tool again with the challenge ${firstActNamed(kind, origin)} prints, and run the line it answers.`;
+var exchangeUnknownSentence = (kind, origin = DEFAULT_COMMAND_ORIGIN, login2 = null) => `Whether a token was minted is unknown: list_tokens from your tool shows each token by its label, and revoke_token ends one nothing holds. ${mintAgainSentence(kind, origin, login2)}`;
 var noPendingSentence = (origin, kind) => `No request is pending for ${origin} on this computer, so the token code was not presented and nothing was sent: the verifier it needs is kept only on the computer whose ${firstActNamed(kind)} printed its challenge. Run ${firstActNamed(kind, origin)} on this computer, call ${MINT_TOKEN_ACTION} from your tool with the challenge it prints, and run the line it answers.`;
 var markerDisagreesSentence = (kind, origin = DEFAULT_COMMAND_ORIGIN) => kind === "authorized computer" ? `The exchange minted a token that is not an authorized computer's, and ${AUTHORIZE_SUBCOMMAND} keeps only an authorized computer's, so nothing of its value was printed or kept. Call ${MINT_TOKEN_ACTION} from your tool again naming ${AUTHORIZED_COMPUTER_MEMBER}: true, as ${AUTHORIZE_SUBCOMMAND} prints it, and run the line it answers.` : `The exchange minted an authorized computer's token, and ${TOKEN_SUBCOMMAND} ${TOKEN_CLAIM_ACT} prints only a token that is not one, so nothing of its value was printed or kept. Call ${MINT_TOKEN_ACTION} from your tool again without ${AUTHORIZED_COMPUTER_MEMBER}, as ${TOKEN_SUBCOMMAND} ${TOKEN_REQUEST_ACT} prints it, and run the line it answers; to authorize this computer, run ${AUTHORIZE_SUBCOMMAND}${originWordsOf(origin)}.`;
 var mintedRevocationLines = (revocation, minted) => "lines" in revocation ? [...revocation.lines, standsSentence(`The token it minted, ${minted.id},`, minted.id, minted.expiresAt)] : [`The token it minted, ${minted.id}, is revoked.`];
 var authorizedLineOf = (origin, entry) => `${AUTHORIZED_LINE_HEAD}${origin}, label ${entry.label !== null ? JSON.stringify(entry.label) : "none"}, its token expiring ${entry.expires_at !== null ? `at ${entry.expires_at}` : "never"}`;
 var CLAIMED_LINE_HEAD = "claimed: ";
-async function completeAct(io2, origin, kind, code, userAgent, say, deliver = () => void 0) {
+async function completeAct(io2, origin, kind, code, userAgent, say, deliver = () => void 0, login2 = null) {
   const place = credentialFileOf(io2);
-  const read2 = readCredentialFile(io2, place.path);
+  const read2 = readMovingCredentialFile(io2, place, say);
   if (!("state" in read2)) {
     say(`${readRefusalOf(read2, place.path)} ${TOKEN_CODE_UNREAD}`);
     return COMMAND_STATUS.nothing_started;
@@ -1014,7 +1145,7 @@ async function completeAct(io2, origin, kind, code, userAgent, say, deliver = ()
   const release = io2.whenEnded(() => {
     stage.ended = true;
     say(
-      stage.now === "unsent" ? `The run was ended before its exchange. ${TOKEN_CODE_UNREAD}` : stage.now === "sent" ? `The run was ended during its exchange. ${exchangeUnknownSentence(kind, origin)}` : `The run was ended after its exchange minted a token, which may not have been ${kind === "authorized computer" ? "kept" : "printed"}: list_tokens from your tool shows it by its label, and revoke_token ends it.`
+      stage.now === "unsent" ? `The run was ended before its exchange. ${TOKEN_CODE_UNREAD}` : stage.now === "sent" ? `The run was ended during its exchange. ${exchangeUnknownSentence(kind, origin, login2)}` : `The run was ended after its exchange minted a token, which may not have been ${kind === "authorized computer" ? "kept" : "printed"}: list_tokens from your tool shows it by its label, and revoke_token ends it.`
     );
     dropCredentialWriting(io2, place, tag);
   });
@@ -1038,7 +1169,7 @@ async function completeAct(io2, origin, kind, code, userAgent, say, deliver = ()
       if (late !== null && typeof late.value === "string") io2.hide(late.value, REDACTED_TOKEN);
       return COMMAND_STATUS.unknown;
     }
-    const unknown = exchangeUnknownSentence(kind, origin);
+    const unknown = exchangeUnknownSentence(kind, origin, login2);
     if (answered === null) {
       say("The exchange drew no answer.");
       say(unknown);
@@ -1064,7 +1195,7 @@ async function completeAct(io2, origin, kind, code, userAgent, say, deliver = ()
         return COMMAND_STATUS.unknown;
       }
       for (const line of refusalLines(EXCHANGE_ACT, answered.status, refusal)) say(line);
-      say(answered.status === 429 ? "Nothing was minted, and the token code was not spent: run the line again after the wait the answer names." : `Nothing was minted. ${mintAgainSentence(kind, origin)}`);
+      say(answered.status === 429 ? "Nothing was minted, and the token code was not spent: run the line again after the wait the answer names." : `Nothing was minted. ${mintAgainSentence(kind, origin, login2)}`);
       return COMMAND_STATUS.nothing_started;
     }
     const minted = answer === null ? null : mintedTokenOf(answer);
@@ -1144,7 +1275,7 @@ var AUTHORIZE_CREDENTIAL = Object.freeze({
   bare: `with nothing piped, it keeps a verifier and prints the challenge and the ${MINT_TOKEN_ACTION} call that authorize this computer`
 });
 var AUTHORIZATION_ORIGIN_VARIABLE_LINE = `the platform's address the authorization reaches where the line names no ${DEPLOY_OPTION.origin}, and the one address beside ${DEFAULT_COMMAND_ORIGIN} and ${DEVELOPMENT_COMMAND_ORIGIN} a ${DEPLOY_OPTION.origin} may name, an address of this machine only where it names it.`;
-var CREDENTIAL_FILE_WORDS = `${CREDENTIAL_FILE_NAME} in a folder ${CREDENTIAL_FOLDER_NAME} under ${CONFIG_HOME_VARIABLE}, or under .config in your home folder where that is unset, readable by you alone; on Windows under ${LOCAL_APP_DATA_VARIABLE}`;
+var CREDENTIAL_FILE_WORDS = `${CREDENTIAL_FILE_NAME} in a folder ${CREDENTIAL_FOLDER_NAME} under ${CONFIG_HOME_VARIABLE}, or under .config in your home folder where that is unset, readable by you alone; on Windows in a folder ${WINDOWS_CREDENTIAL_FOLDER_NAME} under your profile folder, ${PROFILE_VARIABLE}, where a file under ${LOCAL_APP_DATA_VARIABLE} from an older version is moved once`;
 var AUTHORIZE_AFTER_OWN_ERROR = "a token code the line carried may not have been presented, and it is live until it expires and mints nothing without this computer's verifier; where a token was minted, list_tokens from your tool shows it by its label, and revoke_token ends it";
 async function authorize(call, io2) {
   const origin = authorizationOriginOf(io2.env, call.named[DEPLOY_OPTION.origin], NOTHING_SENT);
@@ -1184,7 +1315,7 @@ var AUTHORIZE_ROW = Object.freeze({
   },
   variables: [[ORIGIN_VARIABLE, AUTHORIZATION_ORIGIN_VARIABLE_LINE]],
   note: [
-    `Authorizing this computer takes three acts once for each platform address. ${AUTHORIZE_SUBCOMMAND} run with nothing piped prints a challenge and the ${MINT_TOKEN_ACTION} call to make; your tool makes that call through the connection you signed in with, and runs the line it answers once, as given, on this computer, which keeps the token.`,
+    `Authorizing this computer takes three acts once for each platform address, where you ask your tool to authorize it; login, run in a terminal of your own, is your own way. ${AUTHORIZE_SUBCOMMAND} run with nothing piped prints a challenge and the ${MINT_TOKEN_ACTION} call to make; your tool makes that call through the connection you signed in with, and runs the line it answers once, as given, on this computer, which keeps the token.`,
     `The token is account-scoped and works from any computer until it expires or revoke_token ends it: keep it as you would a password, list_tokens shows it by this computer's host name, and logout ends it. The credential file is ${CREDENTIAL_FILE_WORDS}.`
   ],
   afterOwnError: AUTHORIZE_AFTER_OWN_ERROR,
@@ -1548,9 +1679,9 @@ var percentOf = (character) => [...Buffer.from(character, "utf8")].map((byte) =>
 var escapedSegment = (segment) => {
   if (segment === "") return "_";
   if (segment === "." || segment === "..") return segment.replace(/\./g, percentOf("."));
-  let escaped = segment.replace(UNSAFE_CHARACTER, percentOf);
-  escaped = escaped.replace(/[. ]+$/u, (run) => [...run].map(percentOf).join(""));
-  return DEVICE_NAME.test(escaped) ? `_${escaped}` : escaped;
+  let escaped2 = segment.replace(UNSAFE_CHARACTER, percentOf);
+  escaped2 = escaped2.replace(/[. ]+$/u, (run) => [...run].map(percentOf).join(""));
+  return DEVICE_NAME.test(escaped2) ? `_${escaped2}` : escaped2;
 };
 var shownName = (name) => name.replace(UNSEEN_CHARACTER, percentOf);
 var folded = (path) => path.normalize("NFC").toLowerCase();
@@ -3020,10 +3151,10 @@ var DEPLOY_CREDENTIAL = Object.freeze({
   call: "the deploy call",
   mintedToken: true,
   piped: false,
-  places: `the command reads no standard input: it reads a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, as a tool connected by a minted token sets it from where its token is kept, or a job with no tool from its secret store, and otherwise this computer's token for the platform's address from its credential file, which ${AUTHORIZE_SUBCOMMAND} writes.`
+  places: `the command reads no standard input: it reads a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, as a tool connected by a minted token sets it from where its token is kept, or a job with no tool from its secret store, and otherwise this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write.`
 });
-var DEPLOY_READS = `no standard input: a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, and otherwise this computer's token for the platform's address from its credential file, which ${AUTHORIZE_SUBCOMMAND} writes, sent only to that address; with neither, it prints the variable route first and then, where the address is admitted, how to authorize this computer`;
-var DEPLOY_AFTER_AUTHORIZE = `Once the line the ${MINT_TOKEN_ACTION} call answers has printed authorized:, run this deploy line again. ${NOTHING_SENT_OR_STARTED}`;
+var DEPLOY_READS = `no standard input: a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, and otherwise this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write, sent only to that address; with neither, it prints the variable route first and then, where the address is admitted, the login route`;
+var DEPLOY_AFTER_LOGIN = `Once login has printed authorized:, run this deploy line again. ${NOTHING_SENT_OR_STARTED}`;
 var PREPARE_ACT = "prepare";
 var PREPARE_AGAIN = "Nothing was started. Run the line again: it prepares a fresh upload, which replaces any upload this run prepared.";
 var DEPLOY_CALL_BOUND_SECONDS = 60;
@@ -3209,9 +3340,13 @@ async function deploy(named, io2, flags = /* @__PURE__ */ new Set()) {
       io2.print(origin2.refusal);
       return PROGRESS_EXIT_STATUS.nothing_started;
     }
-    if (await firstAct(io2, origin2.origin, "authorized computer", io2.print, SIGNED_IN_ROUTE_OPENER) === COMMAND_STATUS.done) {
-      io2.print(DEPLOY_AFTER_AUTHORIZE);
+    const unwritable = loginRouteRefusalOf(io2, NOTHING_SENT_OR_STARTED);
+    if (unwritable !== null) {
+      io2.print(unwritable);
+      return PROGRESS_EXIT_STATUS.nothing_started;
     }
+    for (const line of loginRouteLines(io2, origin2.origin)) io2.print(line);
+    io2.print(DEPLOY_AFTER_LOGIN);
     return PROGRESS_EXIT_STATUS.nothing_started;
   }
   if ("refusal" in credential) {
@@ -3225,7 +3360,7 @@ async function deploy(named, io2, flags = /* @__PURE__ */ new Set()) {
     return PROGRESS_EXIT_STATUS.nothing_started;
   }
   const origin = sent.origin;
-  const refused = () => credential.source === "credential_file" ? fileReadSentence(origin) : variableReadSentence(origin, fileStandingOf(io2, origin));
+  const refused = () => credential.source === "credential_file" ? fileReadSentence(origin) : variableReadSentence(origin, fileStandingOf(io2, origin, io2.print));
   const zipped = zipOf(options.path, io2, NOTHING_STARTED, named[DEPLOY_OPTION.path] !== void 0);
   if ("refusal" in zipped) {
     io2.print(zipped.refusal);
@@ -3383,7 +3518,7 @@ async function deploy(named, io2, flags = /* @__PURE__ */ new Set()) {
 var DEPLOY_AFTER_OWN_ERROR = "the deploy may or may not have started: call read_status from your tool first, make the start-only retry a pending upload it answers carries, and run the line again only where it shows neither";
 var DEPLOY_ROW = Object.freeze({
   name: DEPLOY_SUBCOMMAND,
-  summary: "Zips the application folder (or takes a .zip file), makes the preparing deploy call under this computer's token or, for a tool connected by a minted token or a job with no tool, under a minted token, then uploads the zip under the upload grant that call answers, starts the deploy, and waits for it, printing each step and the outcome. With no credential, it sends nothing and prints the two routes to one: the minted token's variables first, then, where the address is admitted, how to authorize this computer.",
+  summary: "Zips the application folder (or takes a .zip file), makes the preparing deploy call under this computer's token or, for a tool connected by a minted token or a job with no tool, under a minted token, then uploads the zip under the upload grant that call answers, starts the deploy, and waits for it, printing each step and the outcome. With no credential, it sends nothing and prints the two routes to one: the minted token's variables first, then, where the address is admitted, the login route.",
   options: DEPLOY_OPTIONS,
   credential: DEPLOY_CREDENTIAL,
   reads: DEPLOY_READS,
@@ -3395,9 +3530,9 @@ var DEPLOY_ROW = Object.freeze({
   },
   variables: [[DEPLOY_NO_WAIT_VARIABLE, "any value returns the command once the deploy has started, without waiting for it."]],
   note: [
-    `A deploy is one line, which carries no credential: run the line your tool's deploy call answers, or ${DEPLOY_SUBCOMMAND} ${DEPLOY_OPTION.application} <application id>, from the application's folder. It reads no standard input. On an authorized computer it runs under this computer's token, which ${AUTHORIZE_SUBCOMMAND} keeps in the credential file for each platform address, and sends it only to the address it is kept under: ${DEPLOY_OPTION.origin} where the line names one, else the address ${ORIGIN_VARIABLE} holds, else ${DEFAULT_COMMAND_ORIGIN}.`,
+    `A deploy is one line, which carries no credential: run the line your tool's deploy call answers, or ${DEPLOY_SUBCOMMAND} ${DEPLOY_OPTION.application} <application id>, from the application's folder. It reads no standard input. On an authorized computer it runs under this computer's token, which ${LOGIN_SUBCOMMAND} or ${AUTHORIZE_SUBCOMMAND} keeps in the credential file for each platform address, and sends it only to the address it is kept under: ${DEPLOY_OPTION.origin} where the line names one, else the address ${ORIGIN_VARIABLE} holds, else ${DEFAULT_COMMAND_ORIGIN}.`,
     `On a computer with no token for that address, or one that has expired, it sends nothing, ends 3, and prints two routes, in this order. A tool connected by a minted token, or a job with no tool, such as a CI job's, cannot use ${MINT_TOKEN_ACTION}: it sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, such as the job's secret store, never by writing the value in a line, and ${ORIGIN_VARIABLE} to the address that minted the token where that is not ${DEFAULT_COMMAND_ORIGIN}, then runs the deploy line again.`,
-    `A tool signed in to the platform makes the ${MINT_TOKEN_ACTION} call the run prints with its challenge, runs the line that call answers, then runs the deploy line again. The credential file is ${CREDENTIAL_FILE_WORDS}.`,
+    `Otherwise a person logs this computer in once with ${LOGIN_SUBCOMMAND}, in a terminal of their own, then runs the deploy line again; a folder within the caps of the tool's deploy_files call deploys now through deploy_files, with no login. The credential file is ${CREDENTIAL_FILE_WORDS}.`,
     `A tool sets ${MINTED_TOKEN_VARIABLE} for the deploy or check line alone and unsets it once that line ends, since the command cannot unset a variable of the shell that started it. A job's token is minted for the application, with an expiry. The variable's token wins over the credential file: the command makes the preparing call under that token, and sends the token in no other request.`,
     `Under the variable, the command sends its token only to the address ${ORIGIN_VARIABLE} holds, or to ${DEFAULT_COMMAND_ORIGIN} where that variable is unset: under the token, ${DEPLOY_OPTION.origin} may name that address alone, and where the line names none the command addresses it. ${DEPLOY_OPTION.env} names the environment where a line names one, ${COMMAND_ENVIRONMENTS.join(" or ")}; where none is named, the platform chooses, and the command deploys to the environment the platform answers.`,
     `A progress read answered 502, 503, or 504, which is often temporary, is made again, at most three more times, and an upload answered 503 credential_lookup_busy, which wrote nothing, is made again after the wait it names, at most twice.`,
@@ -3426,7 +3561,7 @@ var checkNotThePlatform = (status) => `The check call was answered HTTP ${status
 var checkAnswerUnusable = (status) => `The check call was answered HTTP ${status} with no answer the command can use: refusals, first_deploy, and recorded_health_path, each in its form. Nothing of the answer was printed or used.`;
 var CHECK_AGAIN = `${NOTHING_CHECKED} Run the line again.`;
 var CHECK_RATE_CAPPED = `${NOTHING_CHECKED} Run the line again after the wait the answer names.`;
-var CHECK_AFTER_AUTHORIZE = `Once the line the ${MINT_TOKEN_ACTION} call answers has printed authorized:, run this check line again. ${NOTHING_SENT_OR_CHECKED}`;
+var CHECK_AFTER_LOGIN = `Once login has printed authorized:, run this check line again. ${NOTHING_SENT_OR_CHECKED}`;
 var checkOptionsOf = (named, cwd) => {
   const application = named[CHECK_OPTION.application];
   if (application === void 0 || !UPLOAD_ID.test(application)) {
@@ -3464,9 +3599,9 @@ var CHECK_CREDENTIAL = Object.freeze({
   call: `the ${CHECK_ACTION} call`,
   mintedToken: true,
   piped: false,
-  places: `the command reads no standard input: it reads a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, as a tool connected by a minted token sets it from where its token is kept, or a job with no tool from its secret store, and otherwise this computer's token for the platform's address from its credential file, which ${AUTHORIZE_SUBCOMMAND} writes.`
+  places: `the command reads no standard input: it reads a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, as a tool connected by a minted token sets it from where its token is kept, or a job with no tool from its secret store, and otherwise this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write.`
 });
-var CHECK_READS = `no standard input: a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, and otherwise this computer's token for the platform's address from its credential file, which ${AUTHORIZE_SUBCOMMAND} writes, sent only to that address; with neither, it prints the variable route first and then, where the address is admitted, how to authorize this computer`;
+var CHECK_READS = `no standard input: a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, and otherwise this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write, sent only to that address; with neither, it prints the variable route first and then, where the address is admitted, the login route`;
 var checkAnswerOf = (answer) => {
   const { refusals, first_deploy: firstDeploy, recorded_health_path: recordedHealthPath } = answer;
   if (!Array.isArray(refusals) || typeof firstDeploy !== "boolean" || typeof recordedHealthPath !== "string") return null;
@@ -3582,9 +3717,13 @@ async function check(named, io2) {
       io2.print(origin2.refusal);
       return COMMAND_STATUS.nothing_started;
     }
-    if (await firstAct(io2, origin2.origin, "authorized computer", io2.print, SIGNED_IN_ROUTE_OPENER) === COMMAND_STATUS.done) {
-      io2.print(CHECK_AFTER_AUTHORIZE);
+    const unwritable = loginRouteRefusalOf(io2, NOTHING_SENT_OR_CHECKED);
+    if (unwritable !== null) {
+      io2.print(unwritable);
+      return COMMAND_STATUS.nothing_started;
     }
+    for (const line of loginRouteLines(io2, origin2.origin)) io2.print(line);
+    io2.print(CHECK_AFTER_LOGIN);
     return COMMAND_STATUS.nothing_started;
   }
   if ("refusal" in credential) {
@@ -3598,7 +3737,7 @@ async function check(named, io2) {
     return COMMAND_STATUS.nothing_started;
   }
   const origin = sent.origin;
-  const refused = () => credential.source === "credential_file" ? fileReadSentence(origin) : variableReadSentence(origin, fileStandingOf(io2, origin));
+  const refused = () => credential.source === "credential_file" ? fileReadSentence(origin) : variableReadSentence(origin, fileStandingOf(io2, origin, io2.print));
   const zipped = zipOf(options.path, io2, NOTHING_CHECKED, named[CHECK_OPTION.path] !== void 0, null, "checked");
   if ("refusal" in zipped) {
     io2.print(zipped.refusal);
@@ -4318,8 +4457,8 @@ var npmEntryOf = (io2, nodePath) => npmEntryCandidatesOf(io2.env, nodePath).find
 var npmStartOf = (viaShell = NPM_NEEDS_SHELL, entry = null, nodePath = process.execPath) => entry !== null ? { command: nodePath, args: [entry, "start"] } : viaShell ? { command: "npm start", args: [], shell: true } : { command: "npm", args: ["start"] };
 var npmRunOf = (words, viaShell = NPM_NEEDS_SHELL, entry = null, nodePath = process.execPath) => entry !== null ? { command: nodePath, args: [entry, ...words] } : viaShell ? { command: ["npm", ...words].join(" "), args: [], shell: true } : { command: "npm", args: words };
 var INTERRUPTED_ON_WINDOWS = 'The application has ended. cmd may ask "Terminate batch job (Y/N)?" next: either answer returns the prompt.';
-var afterInterruptLineOf = (ended, onWindows = NPM_NEEDS_SHELL) => onWindows && ended.interrupted === true ? INTERRUPTED_ON_WINDOWS : null;
-var afterInterruptedChildLineOf = (ended, what, onWindows = NPM_NEEDS_SHELL) => afterInterruptLineOf(ended, onWindows) === null ? null : `${what} has ended. cmd may ask "Terminate batch job (Y/N)?" next: either answer returns the prompt.`;
+var afterInterruptLineOf = (ended, onWindows2 = NPM_NEEDS_SHELL) => onWindows2 && ended.interrupted === true ? INTERRUPTED_ON_WINDOWS : null;
+var afterInterruptedChildLineOf = (ended, what, onWindows2 = NPM_NEEDS_SHELL) => afterInterruptLineOf(ended, onWindows2) === null ? null : `${what} has ended. cmd may ask "Terminate batch job (Y/N)?" next: either answer returns the prompt.`;
 var printAfterInterrupt = (io2, line) => {
   if (line === null) return;
   io2.print("");
@@ -4428,7 +4567,11 @@ var LIBRARY_TAKE_OPTIONS = Object.freeze([
 ]);
 var NOTHING_WRITTEN2 = "Nothing was written.";
 var LINES_IN_WINDOWS_FORM = process.platform === "win32";
-var machineLineOf = (line, windows = LINES_IN_WINDOWS_FORM) => windows ? windowsLineOf(line) : line;
+var machineLineOf = (line, form = LINES_IN_WINDOWS_FORM, origin = DEFAULT_COMMAND_ORIGIN) => {
+  const windows = typeof form === "boolean" ? form : form.windows;
+  const run = typeof form !== "boolean" && form.npx ? npxFormOf(line, origin) : line;
+  return windows ? windowsLineOf(run) : run;
+};
 var LIBRARY_FOLDER = "system";
 var POINTER_FILE = "system.json";
 var MANIFEST_FILE2 = "manifest.json";
@@ -4653,7 +4796,7 @@ var noPackageWayOnOf = (io2, options, name) => {
     empty = false;
   }
   if (!empty) return OTHER_WAY_ON;
-  const line = machineLineOf(scaffoldLineOf({ origin: options.origin, template }), io2.windows ?? LINES_IN_WINDOWS_FORM);
+  const line = machineLineOf(scaffoldLineOf({ origin: options.origin, template }), { windows: io2.windows ?? LINES_IN_WINDOWS_FORM, npx: ranThroughNpx({ env: io2.env ?? {}, ranThroughNpx: io2.ranThroughNpx }) }, options.origin);
   return {
     clause: MAKE_OWN_PACKAGE_FILE,
     after: `For a new ${taking.writes}, run the scaffold line at the project's root instead, which writes the application and takes this entry: ${line}`
@@ -5018,6 +5161,267 @@ var LIBRARY_ROW = Object.freeze({
   run: libraryTake
 });
 
+// src/turnzero_cloud_command/login.ts
+import { randomBytes as randomBytes3 } from "node:crypto";
+import { hostname as hostname2 } from "node:os";
+var NOTHING_SENT3 = "Nothing was sent and nothing was started.";
+var LOGIN_ADDRESS_PATH_MAX = 512;
+var LOGIN_SEND_WAIT_SECONDS = 120;
+var OPENER_WAIT_MS = 5e3;
+var newLoginState = () => randomBytes3(32).toString("base64url");
+var loginAddressOf = (origin, login2) => {
+  const fits = (label) => {
+    const address = computerLoginAddressOf(origin, { ...login2, label });
+    return address.length - origin.length <= LOGIN_ADDRESS_PATH_MAX ? address : null;
+  };
+  let characters = [...login2.label];
+  while (characters.length > 0) {
+    const label = characters.join("").trimEnd();
+    if (label !== "") {
+      const address = fits(label);
+      if (address !== null) return address;
+    }
+    characters = characters.slice(0, -1);
+  }
+  return fits(LABEL_FALLBACK) ?? computerLoginAddressOf(origin, { ...login2, label: LABEL_FALLBACK });
+};
+var openerOf = (platform, address) => platform === "darwin" ? { command: "open", args: [address] } : platform === "win32" ? { command: "rundll32", args: ["url.dll,FileProtocolHandler", address] } : { command: "xdg-open", args: [address] };
+var openerEnvironmentOf = (env) => Object.fromEntries(Object.entries(env).filter(([name]) => !name.toUpperCase().startsWith("TURNZERO_CLOUD_")));
+var openerRunOf = (io2, address) => {
+  const platform = io2.platform ?? (onWindows(io2) ? "win32" : process.platform);
+  const opener = openerOf(onWindows(io2) ? "win32" : platform, address);
+  return { command: opener.command, args: opener.args, cwd: io2.cwd, env: openerEnvironmentOf(io2.env), output: () => void 0 };
+};
+var openBrowser = async (io2, address) => {
+  let cancel = () => void 0;
+  const waited = new Promise((resolve12) => {
+    cancel = io2.schedule(OPENER_WAIT_MS, () => resolve12("waiting"));
+  });
+  const ended = await Promise.race([io2.child(openerRunOf(io2, address)), waited]);
+  cancel();
+  return ended === "waiting" || ended.error === null && ended.status === 0;
+};
+var addressLeadSentence = (origin) => `To log this computer in at ${origin}, approve the login on this page:`;
+var minutesWords = (minutes) => `${minutes} minute${minutes === 1 ? "" : "s"}`;
+var minutesLeftOf = (expiresAt, now) => Math.max(1, Math.ceil((Date.parse(expiresAt) - now.getTime()) / 6e4));
+var openingSentence = (minutes) => `Opening it in your browser. This command waits up to ${minutesWords(minutes)} for the approval.`;
+var noBrowserSentence = "Open the address in a browser on any computer, approve the login, and paste here the code the page shows.";
+var unboundSentence = "No port on this computer could be bound for the browser to answer, so paste here the code the page shows once you approve.";
+var unopenedSentence = "The browser could not be opened here: open the address yourself, approve the login, and paste here the code the page shows if it shows one.";
+var noSendSentence = (seconds) => `No answer has come from the browser in ${seconds} seconds. Where the page shows a code, paste it here; the browser's answer still completes the login.`;
+var noTerminalSentence2 = "This run has no terminal to paste a code into, so it waits for the browser's answer alone.";
+var noWayInSentence = (line, minutes = PENDING_REQUEST_MS / 6e4) => `This run has no terminal to paste a code into and no port for the browser to answer, so nothing was minted and the request stays pending for ${minutesWords(minutes)}. Run ${line} in a terminal of your own.`;
+var endedSentence = (minutes, line) => `No approval arrived within ${minutesWords(minutes)}, so nothing was minted and nothing was changed. Run ${line} again to log this computer in.`;
+var stoppedSentence = (line) => `The code prompt was stopped, so nothing was minted. Run ${line} again to log this computer in.`;
+var notCodeSentence = (line) => `What was pasted is not a token code, so nothing was sent and nothing was minted. Run ${line} again to log this computer in.`;
+var CODE_PROMPT_WORDS = "Code (not shown), then Enter: ";
+var escaped = (text) => text.replace(/[&<>"']/g, (character) => `&#${character.charCodeAt(0)};`);
+var browserPageOf = (title, sentence) => `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escaped(title)}</title></head><body style="font-family: system-ui, sans-serif; max-width: 36rem; margin: 3rem auto; padding: 0 1rem; line-height: 1.5"><h1>${escaped(title)}</h1><p>${escaped(sentence)}</p></body></html>`;
+var answerHeaders = (origin, html) => ({
+  "access-control-allow-origin": origin,
+  "access-control-allow-private-network": "true",
+  "cache-control": "no-store",
+  ...html ? { "content-type": "text/html; charset=utf-8" } : {}
+});
+var probeAnswer = (origin) => ({ status: 204, headers: answerHeaders(origin, false), body: "" });
+var outcomeAnswer = (origin, authorized) => ({
+  status: 200,
+  headers: answerHeaders(origin, true),
+  body: authorized ? browserPageOf("This computer is logged in", `The turnzero command on this computer is logged in at ${origin}. You can close this tab.`) : browserPageOf("The login did not complete", "The turnzero command on this computer did not complete the login; its terminal says why and what to run next. You can close this tab.")
+});
+var wrongStateAnswer = (origin) => ({
+  status: 400,
+  headers: answerHeaders(origin, true),
+  body: browserPageOf("Not this login", "This address is not the login the turnzero command on this computer is waiting for. Nothing was changed.")
+});
+var endedAnswer = (origin) => ({
+  status: 410,
+  headers: answerHeaders(origin, true),
+  body: browserPageOf("This login has ended", "The turnzero command on this computer is no longer waiting for this login. Run turnzero login again.")
+});
+var notFoundAnswer = (origin) => ({ status: 404, headers: answerHeaders(origin, false), body: "" });
+var loopbackHandlerOf = (origin, state, arrive) => {
+  return async (request) => {
+    if (request.path !== "/") return notFoundAnswer(origin);
+    if (request.method === "OPTIONS") return probeAnswer(origin);
+    if (request.method !== "GET") return notFoundAnswer(origin);
+    const named = request.query[COMPUTER_LOGIN_QUERY.state];
+    if (named === void 0 || !LOGIN_STATE_FORM.test(named) || named !== state) return wrongStateAnswer(origin);
+    const code = request.query.code;
+    if (code === void 0) return probeAnswer(origin);
+    const outcome = arrive(code);
+    if (outcome === null) return endedAnswer(origin);
+    return outcomeAnswer(origin, await outcome);
+  };
+};
+async function login(call, io2) {
+  const origin = authorizationOriginOf(io2.env, call.named[LOGIN_OPTION.origin], NOTHING_SENT3);
+  if ("refusal" in origin) {
+    io2.print(origin.refusal);
+    return COMMAND_STATUS.nothing_started;
+  }
+  const agent = userAgentOf(io2.env);
+  if ("refusal" in agent) {
+    io2.print(agent.refusal);
+    return COMMAND_STATUS.nothing_started;
+  }
+  const kept2 = keepPendingRequest(io2, origin.origin, io2.print);
+  if ("status" in kept2) return kept2.status;
+  const { pending } = kept2;
+  const again = loginLinesFor(io2, origin.origin).join(", then ");
+  const noBrowser = call.flags.has(LOGIN_OPTION.noBrowser);
+  const state = newLoginState();
+  const endMs = Math.max(1e3, Date.parse(pending.expires_at) - io2.clock().getTime());
+  const minutes = minutesLeftOf(pending.expires_at, io2.clock());
+  let settle = () => void 0;
+  const arrived = new Promise((resolve12) => {
+    settle = resolve12;
+  });
+  let taken = false;
+  let outcome = () => void 0;
+  const outcomeKnown = new Promise((resolve12) => {
+    outcome = resolve12;
+  });
+  const take = (arrival2) => {
+    if (taken) return false;
+    taken = true;
+    settle(arrival2);
+    return true;
+  };
+  let listener = null;
+  if (!noBrowser && io2.listen !== void 0) {
+    listener = await io2.listen(
+      loopbackHandlerOf(origin.origin, state, (code) => {
+        io2.hide(code, REDACTED_TOKEN_CODE);
+        return take({ code, from: "send" }) ? outcomeKnown : null;
+      })
+    );
+  }
+  const label = computerLabelOf(io2.hostName ?? hostname2());
+  const address = loginAddressOf(origin.origin, { challenge: pending.challenge, state, port: listener?.port ?? null, label });
+  io2.print(addressLeadSentence(origin.origin));
+  io2.print(address);
+  io2.hide(pending.challenge, REDACTED_CHALLENGE);
+  let prompt = null;
+  const paste = () => {
+    if (taken || prompt !== null) return;
+    const terminal = io2.terminal();
+    if (terminal === null) {
+      if (listener === null) take({ ended: "no way in" });
+      else io2.print(noTerminalSentence2);
+      return;
+    }
+    let typed = "";
+    let open = true;
+    const close = () => {
+      if (!open) return;
+      open = false;
+      terminal.write("\n");
+      terminal.close();
+    };
+    prompt = { close };
+    terminal.write(CODE_PROMPT_WORDS);
+    terminal.keys((chunk) => {
+      if (!open || taken) return;
+      const step = promptKeys(typed, chunk, "the code prompt", "a fresh login");
+      if ("refusal" in step) {
+        close();
+        take({ ended: "stopped" });
+        return;
+      }
+      typed = step.typed;
+      if (!step.ended) return;
+      close();
+      const code = typed.trim();
+      if (code === "") return;
+      io2.hide(code, REDACTED_TOKEN_CODE);
+      take(isTokenCode(code) ? { code, from: "paste" } : { ended: "not code" });
+    });
+  };
+  const cancels = [];
+  cancels.push(io2.schedule(endMs, () => take({ ended: "time" })));
+  if (noBrowser) {
+    io2.print(noBrowserSentence);
+    paste();
+  } else if (listener === null) {
+    io2.print(unboundSentence);
+    paste();
+  } else if (!await openBrowser(io2, address)) {
+    io2.print(unopenedSentence);
+    paste();
+  } else {
+    io2.print(openingSentence(minutes));
+    cancels.push(
+      io2.schedule(LOGIN_SEND_WAIT_SECONDS * 1e3, () => {
+        if (taken) return;
+        io2.print(noSendSentence(LOGIN_SEND_WAIT_SECONDS));
+        paste();
+      })
+    );
+  }
+  const arrival = await arrived;
+  for (const cancel of cancels) cancel();
+  prompt?.close();
+  try {
+    if ("ended" in arrival) {
+      outcome(false);
+      io2.print(
+        arrival.ended === "time" ? endedSentence(minutes, again) : arrival.ended === "stopped" ? stoppedSentence(again) : arrival.ended === "no way in" ? noWayInSentence(again, minutes) : notCodeSentence(again)
+      );
+      return COMMAND_STATUS.nothing_started;
+    }
+    if (!isTokenCode(arrival.code)) {
+      outcome(false);
+      io2.print(notCodeSentence(again));
+      return COMMAND_STATUS.nothing_started;
+    }
+    const status = await completeAct(io2, origin.origin, "authorized computer", arrival.code, agent.userAgent, io2.print, () => void 0, again);
+    outcome(status === COMMAND_STATUS.done);
+    return status;
+  } finally {
+    if (listener !== null) {
+      await io2.sleep(100);
+      listener.close();
+    }
+  }
+}
+var LOGIN_OPTIONS = Object.freeze([
+  {
+    name: LOGIN_OPTION.origin,
+    value: "<origin>",
+    required: false,
+    description: `The platform's address this computer logs in at. Where absent, the address ${ORIGIN_VARIABLE} holds, or ${DEFAULT_COMMAND_ORIGIN} where it is unset. A ${LOGIN_OPTION.origin} the line names must be ${DEFAULT_COMMAND_ORIGIN}, ${DEVELOPMENT_COMMAND_ORIGIN}, or the address ${ORIGIN_VARIABLE} holds.`
+  },
+  {
+    name: LOGIN_OPTION.noBrowser,
+    value: "",
+    required: false,
+    flag: true,
+    description: "Opens no browser and binds no port: open the printed address in a browser on any computer, approve, and paste the code the page shows."
+  }
+]);
+var LOGIN_AFTER_OWN_ERROR = "the login may not have completed; where a token was minted, list_tokens from your tool shows it by its label, and revoke_token ends it; run login again to log this computer in";
+var LOGIN_ROW = Object.freeze({
+  name: LOGIN_SUBCOMMAND,
+  summary: `Logs this computer in at the platform's address: it opens the platform's computer login page (${COMPUTER_LOGIN_PATH}) in your browser, where you approve the login under your sign-in, and keeps the token the platform mints in this computer's credential file, then prints authorized:. Where the browser cannot answer, it asks for the code the page shows. It prints no token, code, or verifier.`,
+  options: LOGIN_OPTIONS,
+  credential: null,
+  reads: "nothing from standard input; with the browser it waits for the page to answer on a port of this computer, and with --no-browser it reads the code the page shows from the terminal, hidden",
+  statuses: {
+    done: "this computer logged in",
+    failed: "a token was minted and not kept, or the token this computer held before was not revoked: the printed lines name revoke_token",
+    unknown: "the exchange drew no answer, or an answer that is not a refusal: list_tokens shows whether a token was minted",
+    nothing_started: "nothing was minted: an option or the credential file was refused, no code arrived in time or could arrive, the prompt was stopped or given none, the platform was too old, or the exchange was refused"
+  },
+  variables: [[ORIGIN_VARIABLE, AUTHORIZATION_ORIGIN_VARIABLE_LINE]],
+  note: [
+    `login is your own way to authorize this computer, run once in a terminal of your own; your tool runs it only where you ask it to. The token is account-scoped and works from any computer for 30 days or until revoke_token or logout ends it: list_tokens shows it by this computer's host name.`,
+    `The credential file is ${CREDENTIAL_FILE_WORDS}.`
+  ],
+  afterOwnError: LOGIN_AFTER_OWN_ERROR,
+  run: login
+});
+
 // src/turnzero_cloud_command/logout.ts
 var LOGOUT_OPTIONS = Object.freeze([
   {
@@ -5042,7 +5446,7 @@ async function logout(call, io2) {
     return COMMAND_STATUS.nothing_started;
   }
   const place = credentialFileOf(io2);
-  const read2 = readCredentialFile(io2, place.path);
+  const read2 = readMovingCredentialFile(io2, place, io2.print);
   if (!("state" in read2)) {
     io2.print(readRefusalOf(read2, place.path));
     return COMMAND_STATUS.nothing_started;
@@ -5111,6 +5515,106 @@ var LOGOUT_ROW = Object.freeze({
   run: logout
 });
 
+// src/turnzero_cloud_command/upgrade_check.ts
+import { posix as posix3, win32 as win324 } from "node:path";
+var UPGRADE_CHECK_SUBCOMMANDS = Object.freeze([DEPLOY_SUBCOMMAND, CHECK_SUBCOMMAND, LOGIN_SUBCOMMAND]);
+var UPGRADE_CHECK_SKIP_VARIABLES = Object.freeze([MINTED_TOKEN_VARIABLE, "CI"]);
+var UPGRADE_CHECK_FILE_NAME = "upgrade_check.json";
+var UPGRADE_READ_BOUND_MS = 3e3;
+var UPGRADE_READ_EVERY_MS = 24 * 60 * 6e4;
+var DIST_TAGS_ADDRESS = `https://registry.npmjs.org/-/package/${TURNZERO_CLOUD_PACKAGE}/dist-tags`;
+var upgradeLineOf = (tag, version, running) => `A newer turnzero, ${version}, is published under ${tag} (this is ${running}): npm install -g ${TURNZERO_CLOUD_PACKAGE}@${tag} installs it.`;
+var VERSION_FORM2 = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?$/;
+var newerVersion = (candidate, running) => {
+  const a = VERSION_FORM2.exec(candidate);
+  const b = VERSION_FORM2.exec(running);
+  if (a === null || b === null) return false;
+  for (let index = 1; index <= 3; index += 1) {
+    const difference = Number(a[index]) - Number(b[index]);
+    if (difference !== 0) return difference > 0;
+  }
+  const pa = a[4];
+  const pb = b[4];
+  if (pa === void 0 || pb === void 0) return pa === void 0 && pb !== void 0;
+  const ia = pa.split(".");
+  const ib = pb.split(".");
+  for (let index = 0; index < Math.max(ia.length, ib.length); index += 1) {
+    const x2 = ia[index];
+    const y = ib[index];
+    if (x2 === void 0) return false;
+    if (y === void 0) return true;
+    if (x2 === y) continue;
+    const nx = /^\d+$/.test(x2);
+    const ny = /^\d+$/.test(y);
+    if (nx && ny) return Number(x2) > Number(y);
+    if (nx !== ny) return !nx;
+    return x2 > y;
+  }
+  return false;
+};
+var cacheOf = (text) => {
+  try {
+    const parsed = JSON.parse(text);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return {};
+    const entries = {};
+    for (const [tag, entry] of Object.entries(parsed)) {
+      if (entry !== null && typeof entry === "object" && typeof entry.read_at === "string" && typeof entry.version === "string") {
+        entries[tag] = entry;
+      }
+    }
+    return entries;
+  } catch {
+    return {};
+  }
+};
+var NO_CHECK = Object.freeze({ finish: () => null });
+var startUpgradeCheck = (io2, subcommand, named, running) => {
+  const read2 = io2.registryFetch;
+  if (read2 === void 0 || !UPGRADE_CHECK_SUBCOMMANDS.includes(subcommand)) return NO_CHECK;
+  if (UPGRADE_CHECK_SKIP_VARIABLES.some((name) => io2.env[name] !== void 0)) return NO_CHECK;
+  const origin = named[DEPLOY_OPTION.origin] ?? io2.env[ORIGIN_VARIABLE] ?? DEFAULT_COMMAND_ORIGIN;
+  const tag = commandTagOf(origin);
+  const place = credentialFileOf(io2);
+  const path = (onWindows(io2) ? win324 : posix3).join(place.folder, UPGRADE_CHECK_FILE_NAME);
+  const now = io2.clock();
+  let cache = {};
+  try {
+    cache = cacheOf(io2.readFile(path).toString("utf8"));
+  } catch {
+    cache = {};
+  }
+  const last = cache[tag];
+  if (last !== void 0 && now.getTime() - Date.parse(last.read_at) < UPGRADE_READ_EVERY_MS) return NO_CHECK;
+  let arrived = null;
+  const controller = new AbortController();
+  const cancel = io2.schedule(UPGRADE_READ_BOUND_MS, () => controller.abort());
+  void (async () => {
+    try {
+      const response = await read2(DIST_TAGS_ADDRESS, { redirect: "error", signal: controller.signal, headers: { accept: "application/json" } });
+      if (!response.ok) return;
+      const tags = await response.json();
+      const version = tags !== null && typeof tags === "object" ? tags[tag] : void 0;
+      if (typeof version !== "string" || !VERSION_FORM2.test(version)) return;
+      arrived = version;
+      try {
+        io2.makeFolder(place.folder, CREDENTIAL_FOLDER_MODE);
+        io2.writeFile(path, `${JSON.stringify({ ...cache, [tag]: { read_at: io2.clock().toISOString(), version } }, null, 2)}
+`);
+      } catch {
+      }
+    } catch {
+    } finally {
+      cancel();
+    }
+  })();
+  return {
+    finish: () => {
+      controller.abort();
+      return arrived !== null && newerVersion(arrived, running) ? upgradeLineOf(tag, arrived, running) : null;
+    }
+  };
+};
+
 // src/turnzero_cloud_command/provision.ts
 var PROVISION_OPTIONS = Object.freeze([
   {
@@ -5186,9 +5690,9 @@ var NAMED_ADDRESS = "the platform's address";
 var unreachedLine = (origin, error) => {
   let said = transportText(error);
   if (origin !== DEFAULT_COMMAND_ORIGIN) {
-    const { host, hostname: hostname2, port } = new URL(origin);
-    const bare = hostname2.replace(/^\[|\]$/g, "");
-    for (const given of [origin, host, ...port !== "" ? [`${bare}:${port}`] : [], hostname2, bare]) if (given !== "") said = said.split(given).join(NAMED_ADDRESS);
+    const { host, hostname: hostname3, port } = new URL(origin);
+    const bare = hostname3.replace(/^\[|\]$/g, "");
+    for (const given of [origin, host, ...port !== "" ? [`${bare}:${port}`] : [], hostname3, bare]) if (given !== "") said = said.split(given).join(NAMED_ADDRESS);
   }
   return `${PROVISION_ACTION}: the platform could not be reached: ${said}`;
 };
@@ -6673,8 +7177,9 @@ var APPLICATION_FOLDER = "app";
 var STAGE_FOLDER = "app.scaffold";
 var APPLICATION_MANIFEST = "manifest.json";
 var CREATE_STEP = "Call create_application from your tool for this new service, and skip this step where you already created its application.";
-var runLineOf = (origin, windows) => machineLineOf(commandLineOf(origin, RUN_SUBCOMMAND, origin !== DEFAULT_COMMAND_ORIGIN ? { origin } : {}), windows);
-var DEPLOY_STEP = `Call deploy from your tool with the application, naming no environment and neither artifact nor upload, and run the line it answers in ${APPLICATION_FOLDER}/. A new application has one environment, production, so that deploy goes there; call create_environment first and follow its answer to try versions on development.`;
+var DEPLOY_TARGET_SENTENCE = "The deploy goes to the application's deploy target: production on an application with one environment, as a new one has, and development on one with two, where production receives a version through promote. To try versions on development, call create_environment first and follow its answer.";
+var runLineOf = (origin, windows) => machineLineOf(commandLineOf(origin, RUN_SUBCOMMAND, origin !== DEFAULT_COMMAND_ORIGIN ? { origin } : {}), windows, origin);
+var DEPLOY_STEP = `Call deploy from your tool with the application, naming no environment and neither artifact nor upload, and run the line it answers in ${APPLICATION_FOLDER}/. ${DEPLOY_TARGET_SENTENCE}`;
 var SHAPE_STEP = `Shape the service to your own before the first deploy: the table and its migration in ${APPLICATION_FOLDER}/migrations, the routes in ${APPLICATION_FOLDER}/src, and the tests, which cover those routes as written.`;
 var WEB_SHAPE_STEP = `Shape the app to your own before the first deploy: the page in ${APPLICATION_FOLDER}/client, the table and its migration in ${APPLICATION_FOLDER}/migrations, the routes in ${APPLICATION_FOLDER}/src, and the tests, which cover those routes as written.`;
 var WEB_OPEN_STEP = "Open the address the deploy answers in a browser and sign in there: the page lists the signed-in user's own rows, adds one, and answers a question under the plan's AI allowance.";
@@ -7514,7 +8019,7 @@ async function scaffold(call, io2) {
   const files = writtenFilesOf(template, options.names, options.fields);
   const app = join8(root, APPLICATION_FOLDER);
   const stage = join8(root, STAGE_FOLDER);
-  const takeLines = takes.map((take) => machineLineOf(libraryTakeLineOf({ origin, entry: take.entry }), io2.windows ?? LINES_IN_WINDOWS_FORM));
+  const takeLines = takes.map((take) => machineLineOf(libraryTakeLineOf({ origin, entry: take.entry }), { windows: io2.windows ?? LINES_IN_WINDOWS_FORM, npx: ranThroughNpx(io2) }, origin));
   let reached = "checks";
   const stateNow = () => {
     if (reached === "template") return "template";
@@ -7624,7 +8129,7 @@ async function installAndTest(io2, app, template, taken, origin, left) {
     return COMMAND_STATUS.failed;
   }
   io2.print(testedLine(taken));
-  for (const line of nextStepLines(origin, io2.windows ?? LINES_IN_WINDOWS_FORM, left, template)) io2.print(line);
+  for (const line of nextStepLines(origin, { windows: io2.windows ?? LINES_IN_WINDOWS_FORM, npx: ranThroughNpx(io2) }, left, template)) io2.print(line);
   return COMMAND_STATUS.done;
 }
 var SCAFFOLD_ROW = Object.freeze({
@@ -7665,7 +8170,7 @@ var TOKEN_CREDENTIAL = Object.freeze({
   mintedToken: false,
   bare: `under ${TOKEN_ACTS[0]}, it reads none, and prints the challenge for a ${MINT_TOKEN_ACTION} call`
 });
-var TERMINAL_RULE_SENTENCE = `${TOKEN_SUBCOMMAND} ${TOKEN_CLAIM_ACT} prints a token's value, so it runs only where its standard error is a terminal, as in a terminal of your own outside the AI tool, its standard output piped or not; here it is not, as under an AI tool's shell, so nothing was read and nothing was sent. Run the line yourself in a terminal outside the AI tool, piping it into your secret store's command where the token is a job's.`;
+var TERMINAL_RULE_SENTENCE = `${TOKEN_SUBCOMMAND} ${TOKEN_CLAIM_ACT} prints a token's value, so it runs only where its standard error is a terminal, as in a terminal of your own outside the AI coding tool, its standard output piped or not; here it is not, as under an AI coding tool's shell, so nothing was read and nothing was sent. Run the line yourself in a terminal outside the AI coding tool, piping it into your secret store's command where the token is a job's.`;
 async function token(call, io2) {
   const claim = call.act === TOKEN_CLAIM_ACT;
   const say = claim ? io2.printError ?? io2.print : io2.print;
@@ -7705,7 +8210,7 @@ async function token(call, io2) {
 var TOKEN_ROW = Object.freeze({
   name: TOKEN_SUBCOMMAND,
   acts: TOKEN_ACTS,
-  summary: `Mints a token that is not this computer's, its value never in the chat, in two acts around one ${MINT_TOKEN_ACTION} call your tool makes. ${TOKEN_ACTS[0]} keeps a verifier in this computer's credential file and prints the challenge and the call. ${TOKEN_ACTS[1]}, run by you in a terminal outside the AI tool with the token code the call's line pipes in, presents the code with the verifier and prints the token's value once to standard output, every other line on standard error.`,
+  summary: `Mints a token that is not this computer's, its value never in the chat, in two acts around one ${MINT_TOKEN_ACTION} call your tool makes. ${TOKEN_ACTS[0]} keeps a verifier in this computer's credential file and prints the challenge and the call. ${TOKEN_ACTS[1]}, run by you in a terminal outside the AI coding tool with the token code the call's line pipes in, presents the code with the verifier and prints the token's value once to standard output, every other line on standard error.`,
   options: TOKEN_OPTIONS,
   credential: TOKEN_CREDENTIAL,
   statuses: {
@@ -7715,7 +8220,7 @@ var TOKEN_ROW = Object.freeze({
     nothing_started: "nothing was minted: an option, the credential file, the token code, or a standard error that is no terminal was refused, no request was pending, the platform was too old, or the exchange was refused"
   },
   variables: [[ORIGIN_VARIABLE, AUTHORIZATION_ORIGIN_VARIABLE_LINE]],
-  note: [`${TOKEN_SUBCOMMAND} ${TOKEN_ACTS[0]} may run in a tool, since it prints nothing secret. ${TOKEN_SUBCOMMAND} ${TOKEN_ACTS[1]} is yours, run in a terminal outside the AI tool on the same computer as the same user, and never by a tool: it runs only where its standard error is a terminal, which yours stays when you pipe its standard output into your secret store's command, such as gh secret set ${MINTED_TOKEN_VARIABLE}. Read the line's origin before you run it.`],
+  note: [`${TOKEN_SUBCOMMAND} ${TOKEN_ACTS[0]} may run in a tool, since it prints nothing secret. ${TOKEN_SUBCOMMAND} ${TOKEN_ACTS[1]} is yours, run in a terminal outside the AI coding tool on the same computer as the same user, and never by a tool: it runs only where its standard error is a terminal, which yours stays when you pipe its standard output into your secret store's command, such as gh secret set ${MINTED_TOKEN_VARIABLE}. Read the line's origin before you run it.`],
   afterOwnError: AUTHORIZE_AFTER_OWN_ERROR,
   run: token
 });
@@ -7724,8 +8229,49 @@ var TOKEN_ROW = Object.freeze({
 import { spawn } from "node:child_process";
 import { chmodSync, closeSync, openSync, readFileSync as readFileSync5, realpathSync as realpathSync2, writeFileSync, writeSync } from "node:fs";
 import { mkdirSync, readdirSync as readdirSync2, renameSync, rmSync, statSync as statSync4, write as writeAt } from "node:fs";
+import { createServer } from "node:http";
 import { constants as constants2 } from "node:os";
+import { sep as sep4 } from "node:path";
 import { ReadStream, isatty } from "node:tty";
+var listenLoopback = (answer) => new Promise((resolve12) => {
+  const server = createServer((request, response) => {
+    const url = new URL(request.url ?? "/", "http://127.0.0.1");
+    const query = {};
+    for (const [name, value] of url.searchParams) if (!(name in query)) query[name] = value;
+    const origin = typeof request.headers.origin === "string" ? request.headers.origin : null;
+    answer({ method: request.method ?? "GET", path: url.pathname, query, origin }).then(
+      (answered) => {
+        response.writeHead(answered.status, { ...answered.headers, connection: "close" });
+        response.end(answered.body);
+      },
+      () => {
+        response.writeHead(500, { connection: "close" });
+        response.end();
+      }
+    );
+  });
+  server.once("error", () => resolve12(null));
+  server.listen(0, "127.0.0.1", () => {
+    const address = server.address();
+    if (address === null || typeof address === "string") {
+      server.close();
+      resolve12(null);
+      return;
+    }
+    let closed = false;
+    resolve12({
+      port: address.port,
+      close: () => {
+        if (closed) return;
+        closed = true;
+        server.close();
+        server.closeIdleConnections();
+        setTimeout(() => server.closeAllConnections(), 2e3).unref();
+      }
+    });
+  });
+});
+var ranThroughNpxOf = (entry) => entry !== void 0 && entry.includes(`${sep4}_npx${sep4}`);
 var TERMINAL = process.platform === "win32" ? { input: "\\\\.\\CONIN$", output: "\\\\.\\CONOUT$", inputFlags: "r+" } : { input: "/dev/tty", output: "/dev/tty", inputFlags: "r" };
 var terminalFor = (outputIsTerminal, open) => outputIsTerminal ? open() : null;
 var openTerminal = () => {
@@ -7894,6 +8440,11 @@ var processIo = () => ({
   writeNewFile: (path, bytes) => writeFileSync(path, bytes, { flag: "wx" }),
   terminal: () => terminalFor(process.stdout.isTTY === true, openTerminal),
   child: runChild,
+  // The login release's seams (io.ts's LoginSeams; PLD-L0-94; PLD-L0-104).
+  listen: listenLoopback,
+  platform: process.platform,
+  ranThroughNpx: ranThroughNpxOf(process.argv[1]),
+  registryFetch: globalThis.fetch,
   ...folderSeams(),
   // The end waits for what the held act printed to leave the process
   // (endAfterOutput).
@@ -7991,9 +8542,11 @@ var SUBCOMMANDS = Object.freeze([
   SCAFFOLD_ROW,
   AUTHORIZE_ROW,
   LOGOUT_ROW,
-  TOKEN_ROW
+  TOKEN_ROW,
+  LOGIN_ROW
 ]);
-var SERVED = commandRunnerOf("latest");
+var SERVED = LINE_RUNNER;
+var NPX_FORM_SENTENCE = `Where the command is not installed, install it with ${installLineOf(DEFAULT_COMMAND_ORIGIN)}, or run the same line through npx: write ${commandRunnerOf("latest")} for ${LINE_RUNNER}, with next in place of latest on Turn Zero's development platform.`;
 var namedWithActs = (subcommand) => subcommand.acts ? `${subcommand.name} ${subcommand.acts.join("|")}` : subcommand.name;
 var shown = (option) => option.flag ? option.name : `${option.name} ${option.value}`;
 var listed = (names) => names.length < 3 ? names.join(" and ") : `${names.slice(0, -1).join(", ")}, and ${names[names.length - 1]}`;
@@ -8016,11 +8569,11 @@ var usageLineOf = (subcommand) => {
   const optional = subcommand.options.filter((option) => !option.required).map((option) => `[${shown(option)}]`);
   return `${pipedHead(subcommand)}${SERVED} ${[namedWithActs(subcommand), ...required, ...optional].join(" ")}`;
 };
-var usageHeadOf = (version) => `${TURNZERO_CLOUD_PACKAGE} ${version}: the Turn Zero Cloud command, run through npx from the public npm registry by your platform's tag, latest on production and next on development.`;
+var usageHeadOf = (version) => `${TURNZERO_CLOUD_PACKAGE} ${version}: the Turn Zero Cloud command, installed from the public npm registry by your platform's tag, latest on production and next on development.`;
 var usageText = (version = commandVersion()) => {
   const lines = [usageHeadOf(version), "", "Usage:"];
   for (const subcommand of SUBCOMMANDS) lines.push(`  ${usageLineOf(subcommand)}`);
-  lines.push(`  ${SERVED} --version`, `  ${SERVED} --help`, "", WINDOWS_SENTENCE, "", QUOTED_PATH_SENTENCE, "");
+  lines.push(`  ${SERVED} --version`, `  ${SERVED} --help`, "", WINDOWS_SENTENCE, "", NPX_FORM_SENTENCE, "", QUOTED_PATH_SENTENCE, "");
   for (const subcommand of SUBCOMMANDS) {
     lines.push(`${namedWithActs(subcommand)}: ${subcommand.summary}`, "", "Options:");
     for (const option of subcommand.options) lines.push(`  ${shown(option)}${option.required ? " (required)" : ""}`, `      ${option.description}`);
@@ -8075,7 +8628,7 @@ var valuePlacesOf = (argv2) => {
   }
   return places;
 };
-var parseArguments = (argv2, onWindows = ON_WINDOWS) => {
+var parseArguments = (argv2, onWindows2 = ON_WINDOWS) => {
   if (argv2.some((argument) => argument.includes(UPLOAD_GRANT_PREFIX))) return { kind: "refused", sentence: grantArgumentSentence() };
   if (argv2.some((argument) => argument.includes(MINTED_TOKEN_PREFIX))) return { kind: "refused", sentence: tokenArgumentSentence() };
   const values = valuePlacesOf(argv2);
@@ -8125,7 +8678,7 @@ var parseArguments = (argv2, onWindows = ON_WINDOWS) => {
     }
     const value = given === void 0 ? void 0 : unquoted(given);
     if (value === void 0 || value === "") return { kind: "refused", sentence: `${name} takes a value. ${NOTHING_STARTED2}` };
-    if (onWindows && PATH_OPTION_NAMES.includes(name) && value.includes('"')) return { kind: "refused", sentence: quoteInPathSentence(name) };
+    if (onWindows2 && PATH_OPTION_NAMES.includes(name) && value.includes('"')) return { kind: "refused", sentence: quoteInPathSentence(name) };
     named[name] = value;
   }
   return { kind: "run", subcommand, call: { act, named, flags } };
@@ -8160,10 +8713,16 @@ async function runGuarded(argv2, io2) {
   say(versionLineOf(version, found));
   if (parsed.kind === "refused") {
     say(carriesTokenCode(argv2) ? `${parsed.sentence} ${TOKEN_CODE_UNREAD}` : parsed.sentence);
-    say(`${SERVED} --help prints the usage.`);
+    const npx = "ranThroughNpx" in io2 && io2.ranThroughNpx === true;
+    const help = npx ? npxFormOf(`${SERVED} --help`, io2.env[ORIGIN_VARIABLE] ?? DEFAULT_COMMAND_ORIGIN) : `${SERVED} --help`;
+    say(`${io2.windows ?? ON_WINDOWS ? windowsLineOf(help) : help} prints the usage.`);
     return COMMAND_STATUS.nothing_started;
   }
-  return parsed.subcommand.run(parsed.call, io2);
+  const upgrade = startUpgradeCheck(io2, parsed.subcommand.name, parsed.call.named, version);
+  const status = await parsed.subcommand.run(parsed.call, io2);
+  const notice = upgrade.finish();
+  if (notice !== null) say(notice);
+  return status;
 }
 var outputOf = (argv2, io2) => argv2[0] === TOKEN_SUBCOMMAND && argv2[1] === TOKEN_CLAIM_ACT ? io2.printError ?? io2.print : io2.print;
 var NOTHING_REACHED = "no subcommand was reached, so nothing was started";

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "turnzero",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "type": "module",
-  "description": "The Turn Zero Cloud command, which an AI tool runs on your machine to deploy an application, store a secret, upload a file, download an export, take a library entry, write a local run's settings, start the application locally, and scaffold a new service from a template.",
+  "description": "The Turn Zero Cloud command, which an AI coding tool runs on your machine to deploy an application, store a secret, upload a file, download an export, take a library entry, write a local run's settings, start the application locally, and scaffold a new service from a template.",
   "license": "Apache-2.0",
   "engines": {
     "node": ">=24"
   },
   "plane_wire": {
-    "action_payloads": "2026-10-10.11",
+    "action_payloads": "2026-10-13.10",
     "management_api": "2026-10-10.5",
     "wire_errors": "2026-10-10.6"
   },