turnzero 0.16.1 → 0.17.0

package/dist/turnzero-cloud.mjs

@@ -201,6 +201,11 @@ var LOCAL_RUN_SETTING = Object.freeze({
 var LOCAL_RUN_ENVIRONMENT = "local";
 var LOCAL_RUN_CREDENTIAL_SETTINGS = Object.freeze([LOCAL_RUN_SETTING.platformCredential, LOCAL_RUN_SETTING.databaseConnection]);
 var ENVIRONMENT_FILE_NAME = ".env";
+var provisionBareLineOf = (call) => commandLineOf(call.origin, PROVISION_SUBCOMMAND, {
+  options: [[PROVISION_OPTION.application, call.application]],
+  ...call.origin !== DEFAULT_COMMAND_ORIGIN ? { origin: call.origin } : {},
+  ...call.envFile !== void 0 ? { quoted: [[PROVISION_OPTION.envFile, call.envFile]] } : {}
+});
 var DEPLOY_ROTATE_FLAG = "--rotate-database-credential";
 var DEPLOY_PREPARED_LINE_HEAD = "prepared: ";
 var CREDENTIAL_LOOKUP_BUSY = "credential_lookup_busy";
@@ -368,7 +373,7 @@ function compareWireVersions(a, b) {
 
 // src/turnzero_cloud_command/plane_wire.ts
 var PLANE_WIRE_NEEDED = Object.freeze({
-  action_payloads: "2026-10-13.10",
+  action_payloads: "2026-10-14.2",
   management_api: "2026-10-10.5",
   wire_errors: "2026-10-10.6"
 });
@@ -777,6 +782,11 @@ var pipeWholeWayOn = (aWhat, call, nothingPiped = false) => `Pipe ${aWhat} whole
 // src/turnzero_cloud_command/line_form.ts
 var onWindows = (io2) => io2.windows ?? process.platform === "win32";
 var ranThroughNpx = (io2) => io2.ranThroughNpx ?? false;
+var printedLineOf = (io2, line, origin) => {
+  const run = ranThroughNpx(io2) ? npxFormOf(line, origin) : line;
+  return onWindows(io2) ? windowsLineOf(run) : run;
+};
+var provisionLineFor = (io2, call) => printedLineOf(io2, provisionBareLineOf(call), call.origin);
 var loginLineFor = (io2, origin) => {
   const line = loginLineOf(origin);
   return onWindows(io2) ? windowsLineOf(line) : line;
@@ -801,6 +811,7 @@ var unendedReadRefusal = (declared, reading, nothingArrived = false) => unendedR
   declared.computerToken === true ? grantWaysOn(declared) : pipeWholeWayOn(declared.aGrant, declared.call, declared.mintedToken && nothingArrived)
 );
 var emptyTokenVariableRefusal = () => `${MINTED_TOKEN_VARIABLE} is set but empty, so nothing was sent and nothing was started: the read that set it for this line found no token. Set it to your minted token from where your tool keeps it, or unset it to use this computer's token.`;
+var noCredentialRefusal = (declared, origin, expiredAt, again) => `No ${declared.grant} was read, so nothing was started: ${credentialPlaces(declared)} ${expiredAt === null ? `This computer's credential file holds no token for ${origin}.` : `This computer's token for ${origin} in its credential file expired at ${expiredAt}.`} ${again}`.trimEnd();
 var expired = (expiresAt, now) => expiresAt !== null && Date.parse(expiresAt) <= now.getTime();
 async function readCredential(io2, declared, again, line = { named: void 0, closing: "" }) {
   if (declared.piped !== false) {
@@ -841,7 +852,7 @@ async function readCredential(io2, declared, again, line = { named: void 0, clos
   if (!("state" in read2)) return { refusal: readRefusalOf(read2, place.path) };
   const entry = read2.state.origins.get(origin.origin);
   const unauthorized = (expiredAt) => ({
-    refusal: `No ${declared.grant} was read, so nothing was started: ${credentialPlaces(declared)} ${expiredAt === null ? `This computer's credential file holds no token for ${origin.origin}.` : `This computer's token for ${origin.origin} in its credential file expired at ${expiredAt}.`} ${again}`.trimEnd(),
+    refusal: noCredentialRefusal(declared, origin.origin, expiredAt, again),
     unauthorized: { origin: origin.origin, expiredAt }
   });
   if (entry === void 0) return unauthorized(null);
@@ -1048,8 +1059,9 @@ function keepPendingRequest(io2, origin, say) {
       dropCredentialWriting(io2, place, tag);
     }
     opening = standing !== void 0 ? replacedRequestSentence(origin, standing) : "";
+    return { pending, opening, standing: standing !== void 0 ? { kind: "replaced", expired: standing } : { kind: "new" } };
   }
-  return { pending, opening };
+  return { pending, opening, standing: { kind: "reused" } };
 }
 var TOKEN_CALL_BOUND_SECONDS = 60;
 var EXCHANGE_ACT = "exchange";
@@ -2848,6 +2860,7 @@ var headCommitOf = (folder, reads = FILE_SYSTEM_READS) => {
 };
 
 // src/turnzero_cloud_command/options.ts
+var afterOwnErrorOf = (row, call, io2) => typeof row.afterOwnError === "function" ? row.afterOwnError(call, io2) : row.afterOwnError;
 var PATH_OPTION_NAMES = Object.freeze([DEPLOY_OPTION.path, SECRET_OPTION.valueFile, PROVISION_OPTION.envFile]);
 var DEPLOY_OPTIONS = Object.freeze([
   {
@@ -3252,7 +3265,6 @@ async function prepareDeploy(io2, options, zipSha256Value, bearer, userAgent, re
     io2.print(PREPARE_AGAIN);
     return nothingStarted;
   }
-  io2.print(preparedLineOf(prepared));
   return prepared;
 }
 var NOTHING_STARTED = "Nothing was started.";
@@ -3372,6 +3384,7 @@ async function deploy(named, io2, flags = /* @__PURE__ */ new Set()) {
     for (const line of unserved) io2.print(line);
     return PROGRESS_EXIT_STATUS.nothing_started;
   }
+  io2.print(preparedLineOf(prepared));
   const { upload, grant, environment } = prepared;
   const headers = { authorization: `Bearer ${grant}`, "user-agent": agent.userAgent };
   const stop = commandStopSentence(options.application, environment);
@@ -3529,7 +3542,7 @@ var DEPLOY_ROW = Object.freeze({
     `A progress read answered 502, 503, or 504, which is often temporary, is made again, at most three more times, and an upload answered 503 credential_lookup_busy, which wrote nothing, is made again after the wait it names, at most twice.`,
     `After its zip line, ${DEPLOY_SUBCOMMAND} prints the folder's top-level entries the zip holds on one line, at most ten and then the count of the rest, and ${HASH_SUBCOMMAND} ${HASH_OPTION.list} names every file; no such line prints for a .zip file.`,
     `Then it prints the paths the zip left out, a warning for a .zip file at the folder's root, a warning for a file that looks like a key or a credential, and a warning for a health path that no file names, package files and documentation set aside, each on a line of its own and only where there is something to name. The health warning refuses nothing.`,
-    `After the ${PREPARED_LINE_HEAD.trimEnd()} line, where the platform's answer names the recorded manifest's health path and says the environment serves no version, and no file of the folder's zip names that path, ${DEPLOY_SUBCOMMAND} prints the platform's own refusal, then that nothing was uploaded and nothing was started, and ends 3, as the start would refuse it. A .zip file the line names is not read for it, and the start's own refusal stands.`
+    `After the preparing call, where the platform's answer names the recorded manifest's health path and says the environment serves no version, and no file of the folder's zip names that path, ${DEPLOY_SUBCOMMAND} prints the platform's own refusal, then that nothing was uploaded and nothing was started, and ends 3 with no ${PREPARED_LINE_HEAD.trimEnd()} line, as the start would refuse it. A .zip file the line names is not read for it, and the start's own refusal stands.`
   ],
   afterOwnError: DEPLOY_AFTER_OWN_ERROR,
   run: (call, io2) => deploy(call.named, io2, call.flags)
@@ -3970,7 +3983,7 @@ var freshLineSteps = (act) => `${SECRET_ACTION[act]} from your tool with the nam
 var secretAgain = (act) => `Call ${freshLineSteps(act)}`;
 var RESTART_UNDER_STORE = `${SECRET_OPTION.restart} goes with ${SECRET_SUBCOMMAND} rotate alone: a store restarts nothing. ${NOTHING_SENT2}`;
 var RESTART_UNDER_GRANT = `${SECRET_OPTION.restart} asks for a restart, and a write under a secret grant writes the value alone. Run the line without ${SECRET_OPTION.restart} and then make the restart_application call the answer's next names, or, where you wrote the line yourself, run it with no grant piped, under this computer's token. ${NOTHING_SENT2}`;
-var PLATFORM_MINTED_UNDER_TOKEN = `${SECRET_OPTION.name} names a credential the platform minted for that application, which a rotation under this computer's token would re-mint and answer a value the command never prints. The ${PROVISION_SUBCOMMAND} line a submit_manifest call naming local_run answers re-mints it and writes it into the environment file. ${NOTHING_SENT2}`;
+var platformMintedUnderToken = (line) => `${SECRET_OPTION.name} names a credential the platform minted for that application, which a rotation under this computer's token would re-mint and answer a value the command never prints. ${line}, run in the folder the application runs in, re-mints it and writes it into the environment file. ${NOTHING_SENT2}`;
 var underTokenLine = (origin) => `No secret grant was piped, so this line runs under this computer's token for ${origin}.`;
 var sentLine = (act, underGrant) => `The ${SECRET_ACTION[act]} write is being sent; wait for its answer. Before any second run, call list_secrets from your tool, whose row for the name shows when it was last written, so whether this write landed.${underGrant ? " The secret grant serves once: where this write landed, a second run of this line is normally refused secret_grant_spent." : ""}`;
 var secretOptionsOf = (call, cwd) => {
@@ -4056,7 +4069,7 @@ async function secret(call, io2) {
     return COMMAND_STATUS.nothing_started;
   }
   if (credential.source === "credential_file" && options.act === "rotate" && options.application !== null && (options.name === databaseCredentialNameOf(options.application) || options.name === platformCredentialNameOf(options.application))) {
-    io2.print(PLATFORM_MINTED_UNDER_TOKEN);
+    io2.print(platformMintedUnderToken(provisionLineFor(io2, { origin: credential.origin, application: options.application })));
     return COMMAND_STATUS.nothing_started;
   }
   const sent = credentialOriginOf(io2.env, credential, line);
@@ -5645,14 +5658,17 @@ var PROVISION_CREDENTIAL = Object.freeze({
   grant: "secret grant",
   aGrant: "a secret grant",
   call: "the submit_manifest call naming local_run",
-  mintedToken: true
+  mintedToken: true,
+  bare: `with nothing piped and neither token, it keeps a verifier and prints the challenge and the submit_manifest call naming local_run and ${CODE_CHALLENGE_MEMBER}, and a grant piped is presented with that verifier`
 });
 var NOTHING_REMINTED = "Nothing was re-minted, and the environment file is as it stood.";
-var FRESH_LINE_STEPS = "submit_manifest from your tool with the application, its manifest, and local_run, and run the line it answers as given";
-var PROVISION_AGAIN = `Call ${FRESH_LINE_STEPS}.`;
-var againSteps = (kind) => kind === "grant" ? `call ${FRESH_LINE_STEPS}` : "run the line again";
-var remintAgainSentence = (kind) => {
-  const steps = againSteps(kind);
+var PROVISION_BARE_LINE_WORDS = commandLineOf(DEFAULT_COMMAND_ORIGIN, PROVISION_SUBCOMMAND, { options: [[PROVISION_OPTION.application, "<application id>"]] });
+var freshLineOf = (io2, application, origin, envFile) => provisionLineFor(io2, { origin, application, ...envFile !== void 0 ? { envFile } : {} });
+var freshLineSteps2 = (line) => `${line} with nothing piped, and where it prints a submit_manifest call, make that call from your tool and run the line it answers as given`;
+var provisionAgainOf = (line) => `Run ${freshLineSteps2(line)}.`;
+var againSteps = (kind, line) => kind === "grant" ? `run ${freshLineSteps2(line)}` : "run the line again";
+var remintAgainSentence = (kind, line) => {
+  const steps = againSteps(kind, line);
   return `${steps[0].toUpperCase()}${steps.slice(1)}: it re-mints both credentials and writes the file.`;
 };
 var envFileNameRefusalOf = (standing) => `${PROVISION_OPTION.envFile} names the environment file ${ENVIRONMENT_FILE_NAME} or ${ENVIRONMENT_FILE_NAME}.<name>, the names every zip the command or deploy_files builds leaves out, so the credentials it holds never ride one.${standing ? ` A file stands at the name given, and an earlier run may have written credentials into it: move its lines into ${ENVIRONMENT_FILE_NAME} and delete it.` : ""} ${NOTHING_REMINTED}`;
@@ -5704,13 +5720,13 @@ var unreachedLine = (origin, error) => {
   }
   return `${PROVISION_ACTION}: the platform could not be reached: ${said}`;
 };
-async function remint(io2, origin, credential, userAgent, application, name) {
+async function remint(io2, origin, credential, userAgent, application, name, verifier = null) {
   let response;
   try {
     response = await io2.fetch(`${origin}${actionPathOf(PROVISION_ACTION)}`, {
       method: "POST",
       headers: { authorization: `Bearer ${credential}`, "user-agent": userAgent, "content-type": "application/json" },
-      body: JSON.stringify({ name, application, environment: PROVISION_ENVIRONMENT }),
+      body: JSON.stringify({ name, application, environment: PROVISION_ENVIRONMENT, ...verifier !== null ? { [CODE_VERIFIER_MEMBER]: verifier } : {} }),
       redirect: "manual"
     });
   } catch (error) {
@@ -5753,7 +5769,20 @@ var factsOf = (member) => {
 };
 var connectionSettingOf = (facts, password) => `postgresql://${encodeURIComponent(facts.roleName)}:${encodeURIComponent(password)}@${facts.host}:5432/${encodeURIComponent(facts.dbName)}?sslmode=verify-full`;
 var LIMIT_SHOWN_MAX = 80;
-var PROVISION_AFTER_OWN_ERROR = "a credential may or may not have been re-minted, and the environment file may not hold its value: a submit_manifest call naming local_run answers a fresh line, which re-mints both and writes the file";
+var UNATTENDED_JOB_VARIABLE = "CI";
+var afterOwnErrorBy = (line) => `a credential may or may not have been re-minted, and the environment file may not hold its value: ${line} run again with nothing piped re-mints both and writes the file, or prints the submit_manifest call whose line does`;
+var PROVISION_AFTER_OWN_ERROR = afterOwnErrorBy(`${PROVISION_BARE_LINE_WORDS}, with the ${PROVISION_OPTION.origin} and ${PROVISION_OPTION.envFile} the line named,`);
+var provisionAfterOwnError = (call, io2) => {
+  try {
+    const application = call.named[PROVISION_OPTION.application];
+    if (application === void 0 || !UPLOAD_ID.test(application)) return PROVISION_AFTER_OWN_ERROR;
+    const origin = commandOriginOf(call.named[PROVISION_OPTION.origin] ?? DEFAULT_COMMAND_ORIGIN);
+    if ("refusal" in origin) return PROVISION_AFTER_OWN_ERROR;
+    return afterOwnErrorBy(`${freshLineOf(io2, application, origin.origin, call.named[PROVISION_OPTION.envFile])},`);
+  } catch {
+    return PROVISION_AFTER_OWN_ERROR;
+  }
+};
 var remintUnknownSentence = (which) => `Whether the development ${which} credential was re-minted is unknown, and no value was written.`;
 var DATABASE_VALUE_LOST = "The development database credential was re-minted and its value was not written, so a connection setting an earlier run wrote no longer connects.";
 var PLATFORM_VALUE_LOST = `The development platform credential was re-minted and its value was not written, so a ${LOCAL_RUN_SETTING.platformCredential} an earlier run wrote is revoked.`;
@@ -5781,7 +5810,18 @@ async function provision(call, io2) {
     );
     return COMMAND_STATUS.nothing_started;
   }
-  const read2 = await readCredential(io2, PROVISION_CREDENTIAL, PROVISION_AGAIN, { named: call.named[PROVISION_OPTION.origin], closing: NOTHING_REMINTED });
+  const namedEnvFile = call.named[PROVISION_OPTION.envFile];
+  const read2 = await readCredential(io2, PROVISION_CREDENTIAL, provisionAgainOf(freshLineOf(io2, options.application, options.origin, namedEnvFile)), {
+    named: call.named[PROVISION_OPTION.origin],
+    closing: NOTHING_REMINTED
+  });
+  if ("unauthorized" in read2) {
+    if (io2.env[UNATTENDED_JOB_VARIABLE] !== void 0) {
+      io2.print(noCredentialRefusal(PROVISION_CREDENTIAL, read2.unauthorized.origin, read2.unauthorized.expiredAt, ""));
+      return COMMAND_STATUS.nothing_started;
+    }
+    return firstProvisionAct(io2, call, options.application, namedEnvFile, read2.unauthorized);
+  }
   if ("refusal" in read2) {
     io2.print(read2.refusal);
     return COMMAND_STATUS.nothing_started;
@@ -5793,6 +5833,8 @@ async function provision(call, io2) {
     return COMMAND_STATUS.nothing_started;
   }
   const sent = { ...options, origin: where.origin };
+  const again = freshLineOf(io2, options.application, sent.origin, namedEnvFile);
+  const verifier = read2.kind === "grant" ? pendingVerifierOf(io2, sent.origin) : null;
   const tried = tryEnvironmentFile(io2, options.envFile);
   if ("unwritten" in tried) {
     io2.print(
@@ -5802,7 +5844,7 @@ async function provision(call, io2) {
   }
   const reminted = { database: "no", platform: "no" };
   const release = io2.whenEnded(() => {
-    for (const line of signalEndedLines(reminted, read2.kind)) io2.print(line);
+    for (const line of signalEndedLines(reminted, read2.kind, again)) io2.print(line);
     dropWritingFile(io2, options.envFile);
   });
   try {
@@ -5811,29 +5853,72 @@ async function provision(call, io2) {
       io2.print(older);
       return COMMAND_STATUS.nothing_started;
     }
-    return await remintAndWrite(io2, sent, agent.userAgent, read2, standing.text, reminted);
+    return await remintAndWrite(io2, sent, agent.userAgent, { ...read2, verifier, again }, standing.text, reminted);
   } finally {
     release();
     dropWritingFile(io2, options.envFile);
   }
 }
-var signalEndedLines = (reminted, kind) => {
+var signalEndedLines = (reminted, kind, line) => {
   const lost = [
     ...reminted.database === "answered" ? [DATABASE_VALUE_LOST] : reminted.database === "unknown" ? [remintUnknownSentence("database")] : [],
     ...reminted.platform === "answered" ? [PLATFORM_VALUE_LOST] : reminted.platform === "unknown" ? [remintUnknownSentence("platform")] : []
   ];
-  return lost.length === 0 ? [NOTHING_REMINTED] : [...lost, remintAgainSentence(kind)];
+  return lost.length === 0 ? [NOTHING_REMINTED] : [...lost, remintAgainSentence(kind, line)];
 };
+var pendingVerifierOf = (io2, origin) => {
+  const read2 = readMovingCredentialFile(io2, credentialFileOf(io2), io2.print);
+  if (!("state" in read2)) return null;
+  hideStandingTokens(io2, read2.state);
+  const pending = read2.state.pending.get(origin);
+  if (pending === void 0) return null;
+  io2.hide(pending.verifier, REDACTED_VERIFIER);
+  return pending.verifier;
+};
+var PROVISION_CHALLENGE_HEAD = "challenge: ";
+var PROVISION_CALL_HEAD = "call submit_manifest with:";
+var MANIFEST_MEMBER_WORDS = "the application's manifest, as your tool submits it";
+var replacedProvisionRequestSentence = (origin, expiredAt) => `The request pending for ${origin} expired at ${expiredAt}, so a new one replaces it: a line answered against the old challenge is refused using nothing, and the submit_manifest call naming the new challenge below answers a fresh one.`;
+var provisionFirstActLines = (origin, application, challenge, expiresAt, line) => [
+  `To write this application's development settings from ${origin}, call submit_manifest from your tool naming the members below, then run the line it answers once, as given, in this folder, before its grant expires.`,
+  `${PROVISION_CHALLENGE_HEAD}${challenge}`,
+  PROVISION_CALL_HEAD,
+  `  application: ${JSON.stringify(application)}`,
+  `  manifest: ${MANIFEST_MEMBER_WORDS}`,
+  "  local_run: true",
+  `  ${CODE_CHALLENGE_MEMBER}: ${JSON.stringify(challenge)}`,
+  `That line presents its grant with this computer's verifier, so a copy of it re-mints nothing elsewhere; it re-mints the development credentials and writes them into the environment file. The request is pending until ${expiresAt}: ${line} run again before then prints this challenge again.`
+];
+async function firstProvisionAct(io2, call, application, envFile, unauthorized) {
+  io2.print(noTokenSentence(unauthorized.origin, unauthorized.expiredAt));
+  const origin = authorizationOriginOf(io2.env, call.named[PROVISION_OPTION.origin], NOTHING_REMINTED);
+  if ("refusal" in origin) {
+    io2.print(origin.refusal);
+    return COMMAND_STATUS.nothing_started;
+  }
+  const kept2 = keepPendingRequest(io2, origin.origin, io2.print);
+  if ("status" in kept2) return kept2.status;
+  const { pending, standing } = kept2;
+  const opening = standing.kind === "reused" ? kept2.opening : standing.kind === "replaced" ? replacedProvisionRequestSentence(origin.origin, standing.expired.expires_at) : null;
+  const lines = [...opening !== null ? [opening] : [], ...provisionFirstActLines(origin.origin, application, pending.challenge, pending.expires_at, freshLineOf(io2, application, origin.origin, envFile))];
+  let last = -1;
+  for (const [index, line] of lines.entries()) if (line.includes(pending.challenge)) last = index;
+  for (const [index, line] of lines.entries()) {
+    io2.print(line);
+    if (index === last) io2.hide(pending.challenge, REDACTED_CHALLENGE);
+  }
+  return COMMAND_STATUS.done;
+}
 async function remintAndWrite(io2, { application, envFile, origin }, userAgent, read2, standing, reminted = { database: "no", platform: "no" }) {
   const untouched = (lines2) => {
     for (const line of [...lines2, NOTHING_REMINTED]) io2.print(line);
     return COMMAND_STATUS.nothing_started;
   };
   const lost = (lines2) => {
-    for (const line of [...lines2, remintAgainSentence(read2.kind)]) io2.print(line);
+    for (const line of [...lines2, remintAgainSentence(read2.kind, read2.again)]) io2.print(line);
     return COMMAND_STATUS.unknown;
   };
-  const database = await remint(io2, origin, read2.credential, userAgent, application, databaseCredentialNameOf(application));
+  const database = await remint(io2, origin, read2.credential, userAgent, application, databaseCredentialNameOf(application), read2.verifier);
   reminted.database = database.kind === "answered" || database.kind === "unknown" ? database.kind : "no";
   if (database.kind === "unsent") return untouched(database.lines);
   if (database.kind === "unknown") return lost([...database.lines, remintUnknownSentence("database")]);
@@ -5850,7 +5935,7 @@ async function remintAndWrite(io2, { application, envFile, origin }, userAgent,
     io2.hide(password, settingMark(facts.setting));
     io2.hide(encodeURIComponent(password), settingMark(facts.setting));
   }
-  const platform = await remint(io2, origin, read2.credential, userAgent, application, platformCredentialNameOf(application));
+  const platform = await remint(io2, origin, read2.credential, userAgent, application, platformCredentialNameOf(application), read2.verifier);
   reminted.platform = platform.kind === "answered" || platform.kind === "unknown" ? platform.kind : "no";
   const databaseLost = url !== null ? [DATABASE_VALUE_LOST] : [];
   if (platform.kind === "unsent" || platform.kind === "refused") return url !== null ? lost([...platform.lines, ...databaseLost]) : untouched(platform.lines);
@@ -5888,7 +5973,7 @@ async function remintAndWrite(io2, { application, envFile, origin }, userAgent,
   if (facts !== null && limitCarried !== null) {
     const cause = limitMember ? "the plan's database-connection-limit holds no usable quantity, which platform staff set with set_plan_quota" : "the platform that answered serves no such member yet";
     io2.print(
-      `${envFile} holds ${facts.setting} and the platform settings this run re-minted, and no ${LOCAL_RUN_SETTING.databaseConnectionLimit}: ${PROVISION_ACTION}'s development_database answer carried ${limitCarried}, where the pool's maximum is a positive integer, so ${cause}. Until that changes the application's pool holds one connection; once it has, ${againSteps(read2.kind)}.`
+      `${envFile} holds ${facts.setting} and the platform settings this run re-minted, and no ${LOCAL_RUN_SETTING.databaseConnectionLimit}: ${PROVISION_ACTION}'s development_database answer carried ${limitCarried}, where the pool's maximum is a positive integer, so ${cause}. Until that changes the application's pool holds one connection; once it has, ${againSteps(read2.kind, read2.again)}.`
     );
     return COMMAND_STATUS.failed;
   }
@@ -5907,13 +5992,16 @@ var PROVISION_ROW = Object.freeze({
   options: PROVISION_OPTIONS,
   credential: PROVISION_CREDENTIAL,
   statuses: {
-    done: "the settings written",
+    done: "the settings written, or the first act printed its challenge and call",
     failed: "the settings written without a connection limit, which the platform's answer did not carry",
     unknown: "a credential was re-minted, or may have been, and its value was not written: the printed sentence names the run that re-mints again",
     nothing_started: "nothing was re-minted"
   },
-  note: [`Run the ${PROVISION_SUBCOMMAND} line a submit_manifest call naming local_run answers as given, before its grant expires, from the folder the application runs in. Each run revokes the development credentials the application had before it. A deployed development environment holds the revoked values until it restarts, so call restart_application on development afterwards. Its redeploy takes both re-minted credentials from custody, the connection string and the platform credential, and spends no deploy of the day. ${PROVISION_SUBCOMMAND} writes no ${PORT_SETTING}: ${RUN_SUBCOMMAND} sets it from ${RUN_OPTION.port}.`],
-  afterOwnError: PROVISION_AFTER_OWN_ERROR,
+  note: [
+    `Run ${PROVISION_BARE_LINE_WORDS} from the folder the application runs in. With nothing piped and no token for the address, it prints a challenge and the submit_manifest call naming local_run and ${CODE_CHALLENGE_MEMBER}; your tool makes that call and runs the line it answers once, as given, before its grant expires, which presents the grant with this computer's verifier. On a computer logged in, the bare line re-mints at once.`,
+    `Each run revokes the development credentials the application had before it. A deployed development environment holds the revoked values until it restarts, so call restart_application on development afterwards. Its redeploy takes both re-minted credentials from custody, the connection string and the platform credential, and spends no deploy of the day. ${PROVISION_SUBCOMMAND} writes no ${PORT_SETTING}: ${RUN_SUBCOMMAND} sets it from ${RUN_OPTION.port}.`
+  ],
+  afterOwnError: provisionAfterOwnError,
   run: provision
 });
 
@@ -7198,6 +7286,8 @@ var SHAPE_STEP = `Shape the service to your own before the first deploy: the tab
 var WEB_SHAPE_STEP = `Shape the app to your own before the first deploy: the page in ${APPLICATION_FOLDER}/client, the table and its migration in ${APPLICATION_FOLDER}/migrations, the routes in ${APPLICATION_FOLDER}/src, and the tests, which cover those routes as written.`;
 var WEB_OPEN_STEP = "Open the address the deploy answers in a browser and sign in there: the page lists the signed-in user's own rows, adds one, and answers a question under the plan's AI allowance.";
 var SUBMIT_NO_SETTING_STEP = `Call submit_manifest from your tool with the application and its manifest, ${APPLICATION_FOLDER}/${APPLICATION_MANIFEST}, naming no local_run, since the service reads no setting.`;
+var provisionStepLineOf = (origin, windows) => machineLineOf(provisionBareLineOf({ origin, application: "<application id>" }), windows, origin);
+var provisionStepOf = (origin, windows) => `Call submit_manifest from your tool with the application and its manifest, ${APPLICATION_FOLDER}/${APPLICATION_MANIFEST}, naming no local_run. Then run ${freshLineSteps2("the provision line below")}, all in ${APPLICATION_FOLDER}/. The provision line: ${provisionStepLineOf(origin, windows)}`;
 var RUN_STEP_BACKGROUND = "The line runs until the application ends, so start it as a background process and read its lines";
 var SCHEDULED_JOB_SCHEDULE = "heartbeat";
 var ENTRY_PAGES = Object.freeze({
@@ -7237,13 +7327,14 @@ var TEMPLATE_FACTS = Object.freeze({
       routes: Object.freeze(["health"]),
       columns: SCAFFOLD_FIELD_RESERVED
     }),
-    // submit_manifest naming local_run, and the provision line that answer
-    // gives, in the words `provision` prints for a fresh line (provision.ts);
-    // the run line; the shaping step, so the first deploy ships the service
+    // submit_manifest naming no local_run, then the bare provision line, the
+    // call its first act prints and the line that call answers, in the
+    // words `provision` prints for a fresh line (provisionStepOf); the run
+    // line; the shaping step, so the first deploy ships the service
     // its author means and not the template (cloud:PLD-L0-103); and deploy.
     steps: (origin, windows) => [
       CREATE_STEP,
-      `${PROVISION_AGAIN} The manifest is ${APPLICATION_FOLDER}/${APPLICATION_MANIFEST}, and the line it answers is the provision line, which runs in ${APPLICATION_FOLDER}/.`,
+      provisionStepOf(origin, windows),
       `In ${APPLICATION_FOLDER}/, start the application on this machine. ${RUN_STEP_BACKGROUND}: ${runLineOf(origin, windows)}`,
       SHAPE_STEP,
       DEPLOY_STEP
@@ -7279,7 +7370,7 @@ var TEMPLATE_FACTS = Object.freeze({
     // page first, and a sixth: the page opened on the deployed address.
     steps: (origin, windows) => [
       CREATE_STEP,
-      `${PROVISION_AGAIN} The manifest is ${APPLICATION_FOLDER}/${APPLICATION_MANIFEST}, and the line it answers is the provision line, which runs in ${APPLICATION_FOLDER}/.`,
+      provisionStepOf(origin, windows),
       `In ${APPLICATION_FOLDER}/, start the application on this machine, where its page then answers at / and its API routes take a session as a Bearer; sign-in is on the deployed application's own address. ${RUN_STEP_BACKGROUND}: ${runLineOf(origin, windows)}`,
       WEB_SHAPE_STEP,
       DEPLOY_STEP,
@@ -8743,7 +8834,7 @@ var NOTHING_REACHED = "no subcommand was reached, so nothing was started";
 var ownErrorSentence = (error, afterOwnError = NOTHING_REACHED) => `The command stopped on an error of its own (${error instanceof Error ? error.message : String(error)}); ${afterOwnError}.`;
 var ownErrorLineOf = (argv2, io2, error) => {
   const parsed = parseArguments(argv2, io2.windows ?? ON_WINDOWS);
-  return ownErrorSentence(error, parsed.kind === "run" ? parsed.subcommand.afterOwnError : NOTHING_REACHED);
+  return ownErrorSentence(error, parsed.kind === "run" ? afterOwnErrorOf(parsed.subcommand, parsed.call, io2) : NOTHING_REACHED);
 };
 async function runProcess(argv2, unguarded2, io2 = guarded(unguarded2)) {
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "turnzero",
-  "version": "0.16.1",
+  "version": "0.17.0",
   "type": "module",
   "description": "The Turn Zero Cloud command, which an AI coding tool runs on your machine to deploy an application, store a secret, upload a file, download an export, take a library entry, write a local run's settings, start the application locally, and scaffold a new service from a template.",
   "license": "Apache-2.0",
@@ -8,7 +8,7 @@
     "node": ">=24"
   },
   "plane_wire": {
-    "action_payloads": "2026-10-13.10",
+    "action_payloads": "2026-10-14.2",
     "management_api": "2026-10-10.5",
     "wire_errors": "2026-10-10.6"
   },