turnzero 0.17.0 → 0.18.1-next.1

package/README.md

@@ -22,7 +22,7 @@ Install it once with `npm install -g turnzero`, then run `turnzero login` once i
 - `provision` gets new development credentials for your application and writes them to its environment file.
 - `run` starts your application on your computer with that file's settings.
 - `scaffold` writes a new service into your project from a template, installs it, and runs its tests.
-- `login` logs this computer in through your browser, and `logout` revokes its token.
+- `login` logs this computer in through your browser, `whoami` names the account its token acts as, and `logout` revokes its token.
 - `authorize` gives this computer a token through your tool, where you ask your tool to.
 - `token request` and `token claim` get a token for another computer or for an unattended run.
 

package/dist/turnzero-cloud.mjs

@@ -192,12 +192,13 @@ var databaseCredentialNameOf = (application) => `database-${application}`;
 var LOCAL_RUN_SETTING = Object.freeze({
   databaseConnection: "APP_DATABASE_URL",
   databaseConnectionLimit: "APP_DATABASE_CONNECTION_LIMIT",
-  platformCredential: "TURNZERO_CLOUD_TOKEN",
+  platformCredential: "TURNZERO_CLOUD_APP_TOKEN",
   environment: "APP_ENVIRONMENT",
   api: "TURNZERO_CLOUD_API",
   gatewayUrl: "TURNZERO_CLOUD_GATEWAY_URL",
   application: "TURNZERO_CLOUD_APPLICATION"
 });
+var RETIRED_PLATFORM_CREDENTIAL_SETTING = "TURNZERO_CLOUD_TOKEN";
 var LOCAL_RUN_ENVIRONMENT = "local";
 var LOCAL_RUN_CREDENTIAL_SETTINGS = Object.freeze([LOCAL_RUN_SETTING.platformCredential, LOCAL_RUN_SETTING.databaseConnection]);
 var ENVIRONMENT_FILE_NAME = ".env";
@@ -247,6 +248,7 @@ var CODE_VERIFIER_MEMBER = "code_verifier";
 var AUTHORIZED_COMPUTER_MEMBER = "authorized_computer";
 var AUTHORIZE_SUBCOMMAND = "authorize";
 var LOGOUT_SUBCOMMAND = "logout";
+var WHOAMI_SUBCOMMAND = "whoami";
 var TOKEN_SUBCOMMAND = "token";
 var TOKEN_REQUEST_ACT = "request";
 var TOKEN_CLAIM_ACT = "claim";
@@ -350,6 +352,13 @@ var settingsOf = (text) => {
   }
   return { settings: [...settings] };
 };
+var settingNameOf = (line) => {
+  const opened = line.startsWith(BYTE_ORDER_MARK) ? line.slice(BYTE_ORDER_MARK.length) : line;
+  const read2 = opened.endsWith("\r") ? opened.slice(0, -1) : opened;
+  if (SKIPPED_LINE.test(read2) || read2.includes("\0")) return null;
+  return SETTING_LINE.exec(read2)?.[1] ?? null;
+};
+var withoutReadSetting = (lines, name) => lines.filter((line) => settingNameOf(line) !== name);
 
 // src/wire_version.ts
 var WIRE_VERSION = /^(\d{4}-\d{2}-\d{2})\.(\d+)$/;
@@ -1125,7 +1134,33 @@ var exchangeUnknownSentence = (kind, origin = DEFAULT_COMMAND_ORIGIN, login2 = n
 var noPendingSentence = (origin, kind) => `No request is pending for ${origin} on this computer, so the token code was not presented and nothing was sent: the verifier it needs is kept only on the computer whose ${firstActNamed(kind)} printed its challenge. Run ${firstActNamed(kind, origin)} on this computer, call ${MINT_TOKEN_ACTION} from your tool with the challenge it prints, and run the line it answers.`;
 var markerDisagreesSentence = (kind, origin = DEFAULT_COMMAND_ORIGIN) => kind === "authorized computer" ? `The exchange minted a token that is not an authorized computer's, and ${AUTHORIZE_SUBCOMMAND} keeps only an authorized computer's, so nothing of its value was printed or kept. Call ${MINT_TOKEN_ACTION} from your tool again naming ${AUTHORIZED_COMPUTER_MEMBER}: true, as ${AUTHORIZE_SUBCOMMAND} prints it, and run the line it answers.` : `The exchange minted an authorized computer's token, and ${TOKEN_SUBCOMMAND} ${TOKEN_CLAIM_ACT} prints only a token that is not one, so nothing of its value was printed or kept. Call ${MINT_TOKEN_ACTION} from your tool again without ${AUTHORIZED_COMPUTER_MEMBER}, as ${TOKEN_SUBCOMMAND} ${TOKEN_REQUEST_ACT} prints it, and run the line it answers; to authorize this computer, run ${AUTHORIZE_SUBCOMMAND}${originWordsOf(origin)}.`;
 var mintedRevocationLines = (revocation, minted) => "lines" in revocation ? [...revocation.lines, standsSentence(`The token it minted, ${minted.id},`, minted.id, minted.expiresAt)] : [`The token it minted, ${minted.id}, is revoked.`];
-var authorizedLineOf = (origin, entry) => `${AUTHORIZED_LINE_HEAD}${origin}, label ${entry.label !== null ? JSON.stringify(entry.label) : "none"}, its token expiring ${entry.expires_at !== null ? `at ${entry.expires_at}` : "never"}`;
+var authorizedLineOf = (origin, entry, account = null) => `${AUTHORIZED_LINE_HEAD}${origin}${account !== null ? ` as ${accountWordsOf(account)}` : ""}, label ${entry.label !== null ? JSON.stringify(entry.label) : "none"}, its token expiring ${entry.expires_at !== null ? `at ${entry.expires_at}` : "never"}`;
+var READ_ACCOUNT_ACTION = "read_account";
+var ACCOUNT_READ_ACT = "account read";
+var accountWordsOf = (account) => account.address !== null ? oneLine(account.address) : `account ${oneLine(account.id)}`;
+var ACCOUNT_MEMBER_MAX = 320;
+var accountOf = (answer) => {
+  const account = answer?.account;
+  if (account === null || typeof account !== "object" || Array.isArray(account)) return null;
+  const { id, address } = account;
+  if (typeof id !== "string" || id === "" || id.length > ACCOUNT_MEMBER_MAX) return null;
+  return { id, address: typeof address === "string" && address !== "" && address.length <= ACCOUNT_MEMBER_MAX ? address : null };
+};
+async function readAccountUnder(io2, origin, token2, userAgent) {
+  const answered = await postAction(io2, origin, READ_ACCOUNT_ACTION, token2, userAgent, {});
+  if (answered === null) return { lines: [`The ${ACCOUNT_READ_ACT} drew no answer.`], refused: false };
+  if (answered.redirected) return { lines: [`The ${ACCOUNT_READ_ACT} was answered ${answeredHow(answered.status)}, which the command never follows.`], refused: false };
+  if (answered.status >= PLATFORM_FAILURE_STATUS) return { lines: failureLines(ACCOUNT_READ_ACT, answered.status, planeRefusalOf(answered.text)), refused: false };
+  if (answered.status >= 200 && answered.status <= 299) {
+    const account = accountOf(planeObjectOf(answered.text));
+    return account !== null ? { account } : { lines: [`The ${ACCOUNT_READ_ACT} was answered HTTP ${answered.status} with no account the command can read.`], refused: false };
+  }
+  const refusal = planeRefusalOf(answered.text);
+  if (refusal === null) return { lines: [`The ${ACCOUNT_READ_ACT} was answered HTTP ${answered.status}, not by the platform.`], refused: false };
+  return { lines: refusalLines(ACCOUNT_READ_ACT, answered.status, refusal), refused: true };
+}
+var whoamiLineFor = (io2, origin) => printedLineOf(io2, commandLineOf(origin, WHOAMI_SUBCOMMAND, origin !== DEFAULT_COMMAND_ORIGIN ? { origin } : {}), origin);
+var accountUnreadSentence = (whoami2) => `The account this computer's token acts as was not read, and the token is kept: run ${whoami2} to read it.`;
 var CLAIMED_LINE_HEAD = "claimed: ";
 async function completeAct(io2, origin, kind, code, userAgent, say, deliver = () => void 0, login2 = null) {
   const place = credentialFileOf(io2);
@@ -1214,7 +1249,7 @@ async function completeAct(io2, origin, kind, code, userAgent, say, deliver = ()
       return COMMAND_STATUS.failed;
     }
     if (kind === "general") return claimed(io2, place, tag, origin, minted, say, deliver);
-    return await kept(io2, place, tag, origin, minted, userAgent, say);
+    return await kept(io2, place, tag, origin, minted, userAgent, say, login2 !== null);
   } finally {
     release();
     dropCredentialWriting(io2, place, tag);
@@ -1229,7 +1264,7 @@ function claimed(io2, place, tag, origin, minted, say, deliver) {
   if (!("written" in ended)) say(`The request pending for ${origin} stands in the credential file, which could not be written now: it ends at its expiry, or when ${firstActNamed("general", origin)} replaces it.`);
   return COMMAND_STATUS.done;
 }
-async function kept(io2, place, tag, origin, minted, userAgent, say) {
+async function kept(io2, place, tag, origin, minted, userAgent, say, named = false) {
   const now = io2.clock();
   const entry = { token: minted.value, token_id: minted.id, label: minted.label, expires_at: minted.expiresAt, authorized_at: now.toISOString() };
   const written = updateCredentialFile(io2, place, tag, withAuthorized(origin, entry));
@@ -1240,7 +1275,9 @@ async function kept(io2, place, tag, origin, minted, userAgent, say) {
     for (const line of mintedRevocationLines(await revokeUnder(io2, origin, minted.value, minted.id, userAgent), minted)) say(line);
     return COMMAND_STATUS.failed;
   }
-  say(authorizedLineOf(origin, entry));
+  const account = named ? await readAccountUnder(io2, origin, minted.value, userAgent) : null;
+  say(authorizedLineOf(origin, entry, account !== null && "account" in account ? account.account : null));
+  if (account !== null && "lines" in account) say(accountUnreadSentence(whoamiLineFor(io2, origin)));
   const before = written.before.origins.get(origin);
   if (before === void 0 || before.token === entry.token || before.expires_at !== null && Date.parse(before.expires_at) <= now.getTime()) return COMMAND_STATUS.done;
   io2.hide(before.token, REDACTED_TOKEN);
@@ -2948,7 +2985,19 @@ import { readdirSync, readFileSync as readFileSync3, statSync as statSync2 } fro
 import { join as join4 } from "node:path";
 import * as zlib from "node:zlib";
 import { deflateRawSync, inflateRawSync as inflateRawSync2 } from "node:zlib";
-var LEFT_OUT_NAMES = Object.freeze(["node_modules", ".git"]);
+var AI_TOOL_NAMES = Object.freeze([
+  ".claude",
+  ".mcp.json",
+  ".codex",
+  ".cursor",
+  ".gemini",
+  ".continue",
+  ".roo",
+  ".kiro",
+  ".amazonq",
+  ".aider.conf.yml"
+]);
+var LEFT_OUT_NAMES = Object.freeze(["node_modules", ".git", ...AI_TOOL_NAMES]);
 var environmentFileName = (name) => {
   const lower = name.toLowerCase();
   return lower === ".env" || lower.startsWith(".env.");
@@ -2986,7 +3035,7 @@ var walkFolder = (root, limit, leftOut) => {
   return found;
 };
 var linkRefusalSentence = (name) => `${shownNoteName(name)} is a symbolic link, which the deploy does not follow: replace it with the file or folder it points to, or remove it.`;
-var entryBoundSentence = () => `The folder holds more than ${ARTIFACT_ENTRIES_MAX} files after node_modules, .git, and .env files are left out, the most a deploy reads. Deploy a smaller folder, building it into fewer files first.`;
+var entryBoundSentence = () => `The folder holds more than ${ARTIFACT_ENTRIES_MAX} files after node_modules, .git, .env files, and the AI coding tools' own files are left out, the most a deploy reads. Deploy a smaller folder, building it into fewer files first.`;
 var zippedBytesOf = (zip, place) => {
   const start = place.offset + 30 + Buffer.byteLength(place.name, "utf8");
   const end = start + place.compressedSize;
@@ -4402,13 +4451,17 @@ var applicationEnvironmentOf = (shell, settings, port, caseless = ENVIRONMENT_NA
   return { env, overridden: overridden.filter((name) => !COMMAND_CREDENTIAL_VARIABLES.some((variable) => same(name, variable))) };
 };
 var CONNECTION_PASSWORD = /^[A-Za-z][A-Za-z0-9+.-]*:\/\/[^/?#@:]*:([^/?#@]*)@/;
+var HIDDEN_SETTINGS = Object.freeze([
+  ...LOCAL_RUN_CREDENTIAL_SETTINGS.map((setting) => [setting, setting]),
+  [RETIRED_PLATFORM_CREDENTIAL_SETTING, LOCAL_RUN_SETTING.platformCredential]
+]);
 var hiddenTextsOf = (received, caseless = ENVIRONMENT_NAMES_CASELESS) => {
   const hidden = [];
   const hide = (text, name) => {
     if (text !== "" && !hidden.some(([held]) => held === text)) hidden.push([text, settingMark(name)]);
   };
   const same = (held, name) => caseless ? held.toUpperCase() === name.toUpperCase() : held === name;
-  for (const setting of LOCAL_RUN_CREDENTIAL_SETTINGS) for (const [name, value] of received) if (same(name, setting)) hide(value, setting);
+  for (const [setting, shown2] of HIDDEN_SETTINGS) for (const [name, value] of received) if (same(name, setting)) hide(value, shown2);
   for (const [name, value] of received) {
     const written = CONNECTION_PASSWORD.exec(value)?.[1];
     if (written === void 0 || written === "") continue;
@@ -4531,7 +4584,7 @@ async function localRun(call, io2) {
 }
 var RUN_ROW = Object.freeze({
   name: RUN_SUBCOMMAND,
-  summary: `Starts the application on this machine as the platform starts it, with npm start, and hands it the shell's environment with every setting of the environment file laid over it, the file's line winning. It passes the application's output through, with the value of a credential setting, and a connection string that holds a password, replaced by the setting's name between angle brackets. It reads no credential and sends nothing. ${RUN_BACKGROUND_SENTENCE}`,
+  summary: `Starts the application on this machine as the platform starts it, with npm start, and hands it the shell's environment with every setting of the environment file laid over it, the file's line winning. It passes the application's output through, with the value of a credential setting, and a connection string that holds a password, replaced by the setting's name between angle brackets, and a value under ${RETIRED_PLATFORM_CREDENTIAL_SETTING}, the platform credential's earlier name, by <${LOCAL_RUN_SETTING.platformCredential}>. It reads no credential and sends nothing. ${RUN_BACKGROUND_SENTENCE}`,
   options: RUN_OPTIONS,
   credential: null,
   statuses: {
@@ -5216,7 +5269,7 @@ var openBrowser = async (io2, address) => {
 var addressLeadSentence = (origin) => `To log this computer in at ${origin}, approve the login on this page:`;
 var minutesWords = (minutes) => `${minutes} minute${minutes === 1 ? "" : "s"}`;
 var minutesLeftOf = (expiresAt, now) => Math.max(1, Math.ceil((Date.parse(expiresAt) - now.getTime()) / 6e4));
-var openingSentence = (minutes) => `Opening it in your browser. This command waits up to ${minutesWords(minutes)} for the approval.`;
+var openingSentence = (minutes) => `Opening it in your default browser. If you use another one, copy the address above into it. This command waits up to ${minutesWords(minutes)} for the approval.`;
 var noBrowserSentence = "Open the address in a browser on any computer, approve the login, and paste here the code the page shows.";
 var unboundSentence = "No port on this computer could be bound for the browser to answer, so paste here the code the page shows once you approve.";
 var unopenedSentence = "The browser could not be opened here: open the address yourself, approve the login, and paste here the code the page shows if it shows one.";
@@ -5420,10 +5473,10 @@ var LOGIN_OPTIONS = Object.freeze([
 var LOGIN_AFTER_OWN_ERROR = "the login may not have completed; where a token was minted, list_tokens from your tool shows it by its label, and revoke_token ends it; run login again to log this computer in";
 var LOGIN_ROW = Object.freeze({
   name: LOGIN_SUBCOMMAND,
-  summary: `Logs this computer in at the platform's address: it opens the platform's computer login page (${COMPUTER_LOGIN_PATH}) in your browser, where you approve the login under your sign-in, and keeps the token the platform mints in this computer's credential file, then prints authorized:. Where the browser cannot answer, it asks for the code the page shows. It prints no token, code, or verifier.`,
+  summary: `Logs this computer in at the platform's address: it opens the platform's computer login page (${COMPUTER_LOGIN_PATH}) in your default browser, where you approve the login under your sign-in, and keeps the token the platform mints in this computer's credential file. It then reads the account the token acts as and prints authorized: with the address, the account's sign-in address, or its id where it has none, the token's label, and its expiry. Where the browser cannot answer, it asks for the code the page shows. It prints no token, code, or verifier.`,
   options: LOGIN_OPTIONS,
   credential: null,
-  reads: "nothing from standard input; with the browser it waits for the page to answer on a port of this computer, and with --no-browser it reads the code the page shows from the terminal, hidden",
+  reads: "nothing from standard input; with the browser it waits for the page to answer on a port of this computer, and with --no-browser it reads the code the page shows from the terminal, hidden; once the token is kept, it reads the account through read_account under it",
   statuses: {
     done: "this computer logged in",
     failed: "a token was minted and not kept, or the token this computer held before was not revoked: the printed lines name revoke_token",
@@ -5532,6 +5585,92 @@ var LOGOUT_ROW = Object.freeze({
   run: logout
 });
 
+// src/turnzero_cloud_command/whoami.ts
+var NOTHING_SENT_OR_READ = "Nothing was sent and nothing was read.";
+var WHOAMI_OPTIONS = Object.freeze([
+  {
+    name: DEPLOY_OPTION.origin,
+    value: "<origin>",
+    required: false,
+    description: `The platform's address whose token this computer reads. Where absent, the address ${ORIGIN_VARIABLE} holds, or ${DEFAULT_COMMAND_ORIGIN} where it is unset.`
+  }
+]);
+var WHOAMI_LINE_HEADS = Object.freeze({ origin: "origin: ", account: "account: ", token: "token: " });
+var whoamiLinesOf = (origin, account, entry) => [
+  `${WHOAMI_LINE_HEADS.origin}${origin}`,
+  `${WHOAMI_LINE_HEADS.account}${account.address !== null ? `${oneLine(account.address)}, id ${oneLine(account.id)}` : `id ${oneLine(account.id)}, with no sign-in address answered`}`,
+  `${WHOAMI_LINE_HEADS.token}label ${entry.label !== null ? JSON.stringify(entry.label) : "none"}, expiring ${entry.expires_at !== null ? `at ${entry.expires_at}` : "never"}`
+];
+var noComputerTokenSentence = (origin, expiredAt) => expiredAt === null ? `This computer's credential file holds no token for ${origin}, so nothing was sent.` : `This computer's token for ${origin} in its credential file expired at ${expiredAt}, so nothing was sent.`;
+var whoamiAfterLoginSentence = (whoami2) => `Once login has printed authorized:, run ${whoami2} again.`;
+async function whoami(call, io2) {
+  const origin = entryOriginOf(io2.env, call.named[DEPLOY_OPTION.origin], NOTHING_SENT_OR_READ);
+  if ("refusal" in origin) {
+    io2.print(origin.refusal);
+    return COMMAND_STATUS.nothing_started;
+  }
+  const agent = userAgentOf(io2.env);
+  if ("refusal" in agent) {
+    io2.print(agent.refusal);
+    return COMMAND_STATUS.nothing_started;
+  }
+  const place = credentialFileOf(io2);
+  const read2 = readMovingCredentialFile(io2, place, io2.print);
+  if (!("state" in read2)) {
+    io2.print(`${readRefusalOf(read2, place.path)} ${NOTHING_SENT_OR_READ}`);
+    return COMMAND_STATUS.nothing_started;
+  }
+  hideStandingTokens(io2, read2.state);
+  const entry = read2.state.origins.get(origin.origin);
+  const expired2 = entry !== void 0 && entry.expires_at !== null && Date.parse(entry.expires_at) <= io2.clock().getTime();
+  if (entry === void 0 || expired2) {
+    io2.print(noComputerTokenSentence(origin.origin, entry === void 0 ? null : entry.expires_at));
+    const reached = authorizationOriginOf(io2.env, call.named[DEPLOY_OPTION.origin], NOTHING_SENT_OR_READ);
+    if ("refusal" in reached) {
+      io2.print(reached.refusal);
+      return COMMAND_STATUS.nothing_started;
+    }
+    io2.print(LOGIN_ROUTE_OPENER);
+    for (const line of loginLinesFor(io2, reached.origin)) io2.print(line);
+    io2.print(whoamiAfterLoginSentence(whoamiLineFor(io2, reached.origin)));
+    return COMMAND_STATUS.nothing_started;
+  }
+  const older = await planeWireRefusal(io2, origin.origin);
+  if (older !== null) {
+    io2.print(older);
+    return COMMAND_STATUS.nothing_started;
+  }
+  const answered = await readAccountUnder(io2, origin.origin, entry.token, agent.userAgent);
+  if ("account" in answered) {
+    for (const line of whoamiLinesOf(origin.origin, answered.account, entry)) io2.print(line);
+    return COMMAND_STATUS.done;
+  }
+  for (const line of answered.lines) io2.print(line);
+  if (answered.refused) {
+    io2.print(fileReadSentence(origin.origin));
+    return COMMAND_STATUS.failed;
+  }
+  io2.print(`Which account this computer's token acts as is unknown: run ${whoamiLineFor(io2, origin.origin)} again.`);
+  return COMMAND_STATUS.unknown;
+}
+var WHOAMI_ROW = Object.freeze({
+  name: WHOAMI_SUBCOMMAND,
+  summary: `Names the account this computer's token acts as at the platform's address: it reads the token the credential file keeps for the address and makes one ${READ_ACCOUNT_ACTION} call under it. It prints the address, the account's sign-in address and id, and the token's label and expiry. With no token for the address, it sends nothing and prints the login route. It prints no token.`,
+  options: WHOAMI_OPTIONS,
+  credential: null,
+  reads: "this computer's token for the origin from its credential file, never a minted token from TURNZERO_CLOUD_MINTED_TOKEN, and sends it only to that origin",
+  statuses: {
+    done: "the account was read",
+    failed: "the platform refused the read, where it no longer accepts the token among other causes: the printed lines name login",
+    unknown: "the read drew no answer, or an answer that is not a refusal",
+    nothing_started: "nothing was read: an option or the credential file was refused, the platform was too old, or no live token stands for the address, and the printed lines give the login route"
+  },
+  variables: [[ORIGIN_VARIABLE, `the platform's address whose token is read where the line names no ${DEPLOY_OPTION.origin}.`]],
+  note: [`${WHOAMI_SUBCOMMAND} reads which account a login or an authorize on this computer kept a token for, so you can tell it from your tool's own connection. The credential file is ${CREDENTIAL_FILE_WORDS}.`],
+  afterOwnError: "nothing was changed, since whoami only reads; run it again",
+  run: whoami
+});
+
 // src/turnzero_cloud_command/upgrade_check.ts
 import { posix as posix3, win32 as win324 } from "node:path";
 var UPGRADE_CHECK_SUBCOMMANDS = Object.freeze([DEPLOY_SUBCOMMAND, CHECK_SUBCOMMAND, LOGIN_SUBCOMMAND]);
@@ -5951,6 +6090,7 @@ async function remintAndWrite(io2, { application, envFile, origin }, userAgent,
   if (facts !== null && url !== null) lines = withSetting(lines, facts.setting, url);
   if (url !== null && limit !== null) lines = withSetting(lines, LOCAL_RUN_SETTING.databaseConnectionLimit, String(limit));
   if (url !== null && limit === null) lines = withoutSetting(lines, LOCAL_RUN_SETTING.databaseConnectionLimit);
+  lines = withoutReadSetting(lines, RETIRED_PLATFORM_CREDENTIAL_SETTING);
   lines = withSetting(lines, LOCAL_RUN_SETTING.platformCredential, credential);
   lines = withSetting(lines, LOCAL_RUN_SETTING.environment, LOCAL_RUN_ENVIRONMENT);
   lines = withSetting(lines, LOCAL_RUN_SETTING.api, origin);
@@ -5988,7 +6128,7 @@ var PROVISION_ROW = Object.freeze({
     LOCAL_RUN_SETTING.environment,
     LOCAL_RUN_SETTING.api,
     LOCAL_RUN_SETTING.gatewayUrl
-  ].join(", ")}, and ${LOCAL_RUN_SETTING.application}, the first two only where the application has a development database. It prints no credential value.`,
+  ].join(", ")}, and ${LOCAL_RUN_SETTING.application}, the first two only where the application has a development database. It removes a ${RETIRED_PLATFORM_CREDENTIAL_SETTING} line, the platform credential's earlier name. It prints no credential value.`,
   options: PROVISION_OPTIONS,
   credential: PROVISION_CREDENTIAL,
   statuses: {
@@ -6884,10 +7024,14 @@ var SCAFFOLD_TEMPLATE_FILES = Object.freeze({
       "// The live transport, which only the process entry opens: the platform's",
       "// origin and this copy's credential, from the settings it receives. A local",
       "// run receives the development credential, so the same transport works there.",
+      "// Where the credential is not set, it sends nothing and says which line writes it.",
       "export function liveTransport() {",
       "  const origin = process.env.TURNZERO_CLOUD_GATEWAY_URL ?? process.env.TURNZERO_CLOUD_API;",
-      "  return (path, init = {}) =>",
-      "    fetch(origin + path, { ...init, headers: { ...init.headers, authorization: `Bearer ${process.env.TURNZERO_CLOUD_TOKEN}` } });",
+      "  return (path, init = {}) => {",
+      "    const credential = process.env.TURNZERO_CLOUD_APP_TOKEN;",
+      "    if (!credential) throw new Error('TURNZERO_CLOUD_APP_TOKEN is not set, so no request was sent. Run the provision line again, then start the app again.');",
+      "    return fetch(origin + path, { ...init, headers: { ...init.headers, authorization: `Bearer ${credential}` } });",
+      "  };",
       "}",
       "",
       "// The asker over any transport: the live one, or a test double's. It answers",
@@ -7098,12 +7242,14 @@ var SCAFFOLD_TEMPLATE_FILES = Object.freeze({
       "// The live client, which only the process entry opens. A deployed copy",
       "// receives all three settings. A local run has no TURNZERO_CLOUD_REALM_KEYS,",
       "// so the client is built without keys there and verifies through the",
-      "// platform's route.",
+      "// platform's route. Where the credential is not set, the start stops and",
+      "// says which line writes it.",
       "export function openLiveAccounts() {",
       "  const keys = process.env.TURNZERO_CLOUD_REALM_KEYS;",
+      "  if (!process.env.TURNZERO_CLOUD_APP_TOKEN) throw new Error('TURNZERO_CLOUD_APP_TOKEN is not set, so no session can be verified. Run the provision line again, then start the app again.');",
       "  return makeVerifyClient({",
       "    baseUrl: process.env.TURNZERO_CLOUD_API,",
-      "    credential: process.env.TURNZERO_CLOUD_TOKEN,",
+      "    credential: process.env.TURNZERO_CLOUD_APP_TOKEN,",
       "    ...(keys ? { realmKeys: keys } : {}),",
       "  });",
       "}",
@@ -8648,7 +8794,8 @@ var SUBCOMMANDS = Object.freeze([
   AUTHORIZE_ROW,
   LOGOUT_ROW,
   TOKEN_ROW,
-  LOGIN_ROW
+  LOGIN_ROW,
+  WHOAMI_ROW
 ]);
 var SERVED = LINE_RUNNER;
 var NPX_FORM_SENTENCE = `Where the command is not installed, install it with ${installLineOf(DEFAULT_COMMAND_ORIGIN)}, or run the same line through npx: write ${commandRunnerOf("latest")} for ${LINE_RUNNER}, with next in place of latest on Turn Zero's development platform.`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "turnzero",
-  "version": "0.17.0",
+  "version": "0.18.1-next.1",
   "type": "module",
   "description": "The Turn Zero Cloud command, which an AI coding tool runs on your machine to deploy an application, store a secret, upload a file, download an export, take a library entry, write a local run's settings, start the application locally, and scaffold a new service from a template.",
   "license": "Apache-2.0",