turnzero 0.18.3 → 0.20.0-next.1

package/README.md

@@ -2,7 +2,7 @@
 
 Turn Zero Cloud connects to your AI coding tool through a Model Context Protocol (MCP) server. Once connected, your AI can code, build, and test backends, connect them to your app, and host your code in the cloud.
 
-Turn Zero Cloud is for developers who build with an AI coding tool and do not want to run servers. Your tool writes, builds, and tests the application on your computer. The platform builds it, runs it in production at the application's address, and records its logs, counters, and usage. To start, connect your AI coding tool: https://turnzero.ai/cloud/getting-started/connect-your-tool/
+Your AI coding tool writes the app; Turn Zero Cloud runs it, with hosting, database, sign-in and scaling included. Your tool writes, builds, and tests the application on your computer. The platform builds it, runs it in production at the application's address, and records its logs, counters, and usage. To start, connect your AI coding tool: https://turnzero.ai/cloud/getting-started/connect-your-tool/
 
 ## What this package is
 
@@ -23,7 +23,7 @@ Install it once with `npm install -g turnzero`, then run `turnzero login` once i
 - `run` starts your application on your computer with that file's settings.
 - `scaffold` writes a new service into your project from a template, installs it, and runs its tests.
 - `login` logs this computer in through your browser, `whoami` names the account its token acts as, and `logout` revokes its token.
-- `authorize` gives this computer a token through your tool, where you ask your tool to.
+- `authorize` gives this computer a token through your signed-in tool, which then tells you it did.
 - `token request` and `token claim` get a token for another computer or for an unattended run.
 
 Every subcommand's options, statuses, and output are on the reference page: https://turnzero.ai/cloud/reference/turnzero-command/

package/dist/turnzero-cloud.mjs

@@ -222,7 +222,8 @@ var SCAFFOLD_OPTION = Object.freeze({
   singular: "--singular",
   fields: "--fields",
   path: DEPLOY_OPTION.path,
-  origin: DEPLOY_OPTION.origin
+  origin: DEPLOY_OPTION.origin,
+  application: DEPLOY_OPTION.application
 });
 var SCAFFOLD_NAME_FORM = /^[a-z][a-z0-9]{0,29}$/;
 var SCAFFOLD_FIELD_NAME_FORM = /^[a-z][a-z0-9_]{0,29}$/;
@@ -419,6 +420,10 @@ var originOf = (text) => {
   if (url.protocol === "http:" && LOOPBACK_HOSTNAMES.includes(url.hostname)) return url.origin;
   return null;
 };
+var originReadOf = (value) => {
+  const held = (value ?? "").trim();
+  return held === "" ? DEFAULT_COMMAND_ORIGIN : originOf(held) ?? held;
+};
 var commandOriginOf = (text) => {
   const origin = originOf(text);
   if (origin !== null) return { origin };
@@ -905,10 +910,14 @@ var variableReadSentence = (origin, standing) => {
 };
 var fileReadSentence = (origin) => `The credential this run read was this computer's token for ${origin}, from its credential file: where the platform no longer accepts it, run ${LOGIN_SUBCOMMAND}${originWordsOf(origin)} to authorize this computer again.`;
 var noTokenSentence = (origin, expiredAt) => expiredAt === null ? `No credential was read, so nothing was sent: ${MINTED_TOKEN_VARIABLE} is not set, and this computer's credential file holds no token for ${origin}.` : `No credential was read, so nothing was sent: ${MINTED_TOKEN_VARIABLE} is not set, and this computer's token for ${origin} in its credential file expired at ${expiredAt}.`;
-var VARIABLE_ROUTE_SENTENCES = `A tool connected by a minted token, or a job, sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, never by writing the value in a line, and ${ORIGIN_VARIABLE} to the address that minted the token where that is not ${DEFAULT_COMMAND_ORIGIN}, then runs the line again. Such a tool cannot use ${MINT_TOKEN_ACTION}, which takes a sign-in alone. A tool sets ${MINTED_TOKEN_VARIABLE} for the deploy or check line alone and unsets it once that line ends.`;
+var VARIABLE_ROUTE_SENTENCES = `A tool connected by a minted token, or a job, sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, never by writing the value in a line, and ${ORIGIN_VARIABLE} to the address that minted the token where that is not ${DEFAULT_COMMAND_ORIGIN}, then runs the line again. Such a tool cannot use ${MINT_TOKEN_ACTION}, which takes a sign-in alone. A tool sets ${MINTED_TOKEN_VARIABLE} for the deploy, check, take, or scaffold line alone and unsets it once that line ends.`;
 var LOGIN_ROUTE_OPENER = "A person logs this computer in once, in a terminal of their own, and its token then stays on this computer for 30 days:";
 var DEPLOY_FILES_ROUTE_SENTENCE = "A folder within the caps of your tool's deploy_files call deploys now through deploy_files, with no login.";
-var loginRouteLines = (io2, origin) => [LOGIN_ROUTE_OPENER, ...loginLinesFor(io2, origin), DEPLOY_FILES_ROUTE_SENTENCE];
+var loginRouteLines = (io2, origin, deployFiles = true) => [
+  LOGIN_ROUTE_OPENER,
+  ...loginLinesFor(io2, origin),
+  ...deployFiles ? [DEPLOY_FILES_ROUTE_SENTENCE] : []
+];
 var loginRouteRefusalOf = (io2, closing) => {
   const place = credentialFileOf(io2);
   const tag = runTagOf();
@@ -1364,7 +1373,7 @@ var AUTHORIZE_ROW = Object.freeze({
   },
   variables: [[ORIGIN_VARIABLE, AUTHORIZATION_ORIGIN_VARIABLE_LINE]],
   note: [
-    `Authorizing this computer takes three acts once for each platform address, where you ask your tool to authorize it; login, run in a terminal of your own, is your own way. ${AUTHORIZE_SUBCOMMAND} run with nothing piped prints a challenge and the ${MINT_TOKEN_ACTION} call to make; your tool makes that call through the connection you signed in with, and runs the line it answers once, as given, on this computer, which keeps the token.`,
+    `Authorizing this computer takes three acts once for each platform address, which your signed-in tool makes itself and then reports to you; login, run in a terminal of your own, is your own way. ${AUTHORIZE_SUBCOMMAND} run with nothing piped prints a challenge and the ${MINT_TOKEN_ACTION} call to make; your tool makes that call through the connection you signed in with, and runs the line it answers once, as given, on this computer, which keeps the token.`,
     `The token is account-scoped and works from any computer until it expires or revoke_token ends it: keep it as you would a password, list_tokens shows it by this computer's host name, and logout ends it. The credential file is ${CREDENTIAL_FILE_WORDS}.`
   ],
   afterOwnError: AUTHORIZE_AFTER_OWN_ERROR,
@@ -2922,6 +2931,76 @@ function healthPathReadingOf(bytes, reading, recorded) {
   };
 }
 
+// src/turnzero_cloud_command/application_manifest.ts
+import { join as join3, relative as relative3 } from "node:path";
+var FOLDER_MANIFEST = "manifest.json";
+var APPLICATION_MEMBER = "application";
+var BYTE_ORDER_MARK3 = "\uFEFF";
+var jsonTextOf = (bytes) => {
+  const text = bytes.toString("utf8");
+  return text.startsWith(BYTE_ORDER_MARK3) ? text.slice(BYTE_ORDER_MARK3.length) : text;
+};
+var applicationManifestPartialOf = (at) => `${at}.partial`;
+var NOT_BOUND = Object.freeze({ kind: "unbound", manifest: null });
+var folderBindingOf = (io2, path) => {
+  let text;
+  let at;
+  try {
+    const folder = io2.realPath(path);
+    if (folder === null) return NOT_BOUND;
+    at = join3(folder, FOLDER_MANIFEST);
+    const real = io2.realPath(at);
+    if (real === null || relative3(at, real) !== "") return NOT_BOUND;
+    const standing = io2.stat(at);
+    if (standing === null || standing.folder) return NOT_BOUND;
+    text = jsonTextOf(io2.readFile(at));
+  } catch {
+    return NOT_BOUND;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return NOT_BOUND;
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) return NOT_BOUND;
+  const members = parsed;
+  if (!Object.prototype.hasOwnProperty.call(members, APPLICATION_MEMBER)) return { kind: "unbound", manifest: { at, parsed: members } };
+  const application = members[APPLICATION_MEMBER];
+  return typeof application === "string" && UPLOAD_ID.test(application) ? { kind: "bound", application } : { kind: "off_form" };
+};
+var BOUND_LINE_HEAD = "bound: ";
+var boundLineOf = (application) => `${BOUND_LINE_HEAD}${FOLDER_MANIFEST} now names application ${application}; a deploy or check line naming another application is refused`;
+var BIND_WRITE_FAILED_LINE = `${FOLDER_MANIFEST} could not be written to bind this folder to its application, so the deploy goes on unbound, and the next deploy writes it again.`;
+var boundElsewhereSentence = (bound) => `${FOLDER_MANIFEST} binds this folder to application ${bound}, and this line names another.`;
+var OFF_FORM_SENTENCE = `${FOLDER_MANIFEST}'s ${APPLICATION_MEMBER} member is not an application id, a lowercase UUID, so it binds this folder to no application a line can name.`;
+var BINDING_OWNER_ASK = `Ask the account's owner; where they mean this folder for that application, change or remove the manifest's ${APPLICATION_MEMBER} member, then run the line again.`;
+var HASH_BINDING_OWNER_ASK = `Ask the account's owner which application this folder deploys to; change or remove the manifest's ${APPLICATION_MEMBER} member to match, then run the line again.`;
+var bindingRefusalOf = (binding, application, closing) => {
+  if (binding.kind === "unbound" || binding.kind === "bound" && binding.application === application) return null;
+  const first = binding.kind === "bound" ? boundElsewhereSentence(binding.application) : OFF_FORM_SENTENCE;
+  return `${first} ${closing} ${BINDING_OWNER_ASK}`;
+};
+var manifestTextWithMember = (parsed, member, value) => `${JSON.stringify({ ...parsed, [member]: value }, null, 2)}
+`;
+var writeManifestMember = (io2, manifest, member, value) => {
+  const partial = applicationManifestPartialOf(manifest.at);
+  let made = false;
+  try {
+    if (io2.stat(partial)?.folder === false) io2.remove(partial);
+    made = io2.stat(partial) === null;
+    io2.writeNewFile(partial, manifestTextWithMember(manifest.parsed, member, value));
+    io2.rename(partial, manifest.at);
+  } catch {
+    try {
+      if (made) io2.remove(partial);
+    } catch {
+    }
+    return false;
+  }
+  return true;
+};
+
 // src/turnzero_cloud_command/deploy.ts
 import { createHash as createHash2 } from "node:crypto";
 import { readFileSync as readFileSync4, realpathSync, statSync as statSync3 } from "node:fs";
@@ -2929,7 +3008,7 @@ import { resolve as resolve4 } from "node:path";
 
 // src/turnzero_cloud_command/commit.ts
 import { readFileSync as readFileSync2, statSync } from "node:fs";
-import { dirname as dirname3, join as join3, resolve as resolve3 } from "node:path";
+import { dirname as dirname3, join as join4, resolve as resolve3 } from "node:path";
 var START_COMMIT_FORM = /^[0-9a-f]{7,64}$/;
 var GIT_ENTRY = ".git";
 var SYMBOLIC_DEPTH_MAX = 5;
@@ -2959,7 +3038,7 @@ var firstLineOf = (text) => (text.split(/\r?\n/, 1)[0] ?? "").trim();
 var gitFolderOf = (folder, reads = FILE_SYSTEM_READS) => {
   let dir = resolve3(folder);
   for (; ; ) {
-    const entry = join3(dir, GIT_ENTRY);
+    const entry = join4(dir, GIT_ENTRY);
     const kind = reads.kind(entry);
     if (kind === "folder") return entry;
     if (kind === "file") {
@@ -2977,7 +3056,7 @@ var gitFolderOf = (folder, reads = FILE_SYSTEM_READS) => {
   }
 };
 var sharedGitFolderOf = (gitFolder, reads = FILE_SYSTEM_READS) => {
-  const text = reads.text(join3(gitFolder, "commondir"));
+  const text = reads.text(join4(gitFolder, "commondir"));
   const named = text === null ? "" : firstLineOf(text);
   if (named === "") return gitFolder;
   const shared = resolve3(gitFolder, named);
@@ -2987,9 +3066,9 @@ var followable = (ref) => ref.startsWith("refs/") && ref.split("/").every((segme
 var refValueOf = (reads, gitFolder, sharedFolder, ref, depth) => {
   if (depth > SYMBOLIC_DEPTH_MAX || !followable(ref)) return null;
   const home = PER_WORKTREE_REFS.some((prefix) => ref.startsWith(prefix)) ? gitFolder : sharedFolder;
-  const loose = reads.text(join3(home, ...ref.split("/")));
+  const loose = reads.text(join4(home, ...ref.split("/")));
   if (loose !== null) return valueOf(reads, gitFolder, sharedFolder, firstLineOf(loose), depth + 1);
-  const packed = reads.text(join3(sharedFolder, "packed-refs"));
+  const packed = reads.text(join4(sharedFolder, "packed-refs"));
   if (packed === null) return null;
   for (const line of packed.split(/\r?\n/)) {
     if (line.startsWith("#") || line.startsWith("^")) continue;
@@ -3006,7 +3085,7 @@ var headCommitOf = (folder, reads = FILE_SYSTEM_READS) => {
   try {
     const gitFolder = gitFolderOf(folder, reads);
     if (gitFolder === null) return null;
-    const head = reads.text(join3(gitFolder, "HEAD"));
+    const head = reads.text(join4(gitFolder, "HEAD"));
     if (head === null) return null;
     const sharedFolder = sharedGitFolderOf(gitFolder, reads);
     if (sharedFolder === null) return null;
@@ -3105,7 +3184,7 @@ async function writeAgain(io2, what, write) {
 
 // src/turnzero_cloud_command/zip.ts
 import { readdirSync, readFileSync as readFileSync3, statSync as statSync2 } from "node:fs";
-import { join as join4 } from "node:path";
+import { join as join5 } from "node:path";
 import * as zlib from "node:zlib";
 import { deflateRawSync, inflateRawSync as inflateRawSync2 } from "node:zlib";
 var AI_TOOL_NAMES = Object.freeze([
@@ -3144,7 +3223,7 @@ var walkFolder = (root, limit, leftOut) => {
         leftOut?.push(entry.isDirectory() ? `${name}/` : name);
         continue;
       }
-      const path = join4(folder.path, entry.name);
+      const path = join5(folder.path, entry.name);
       if (entry.isSymbolicLink()) throw new ZipRefusal(linkRefusalSentence(name));
       if (entry.isDirectory()) {
         pending.push({ path, name });
@@ -3234,7 +3313,7 @@ var NO_PACKAGE_SENTENCE = "The folder holds no package.json at its root, so it i
 function zipFolder(root, seams = {}) {
   let rootFile = false;
   try {
-    rootFile = statSync2(join4(root, "package.json")).isFile();
+    rootFile = statSync2(join5(root, "package.json")).isFile();
   } catch {
     rootFile = false;
   }
@@ -3440,6 +3519,7 @@ async function prepareDeploy(io2, options, zipSha256Value, bearer, userAgent, re
   return prepared;
 }
 var NOTHING_STARTED = "Nothing was started.";
+var BINDING_NOTHING_SENT = "Nothing further was read and nothing was sent.";
 var NOTHING_UPLOADED_OR_STARTED = "Nothing was uploaded and nothing was started.";
 var healthPathRefusalOf = (prepared, zip, places) => {
   if (prepared.healthPathToRead === void 0 || places === null) return null;
@@ -3536,6 +3616,12 @@ async function deploy(named, io2, flags = /* @__PURE__ */ new Set()) {
   }
   const origin = sent.origin;
   const refused = () => credential.source === "credential_file" ? fileReadSentence(origin) : variableReadSentence(origin, fileStandingOf(io2, origin, io2.print));
+  const binding = pathKindOf(options.path) === "folder" ? folderBindingOf(io2, options.path) : null;
+  const unbound = binding === null ? null : bindingRefusalOf(binding, options.application, BINDING_NOTHING_SENT);
+  if (unbound !== null) {
+    io2.print(unbound);
+    return PROGRESS_EXIT_STATUS.nothing_started;
+  }
   const zipped = zipOf(options.path, io2, NOTHING_STARTED, named[DEPLOY_OPTION.path] !== void 0);
   if ("refusal" in zipped) {
     io2.print(zipped.refusal);
@@ -3557,6 +3643,9 @@ async function deploy(named, io2, flags = /* @__PURE__ */ new Set()) {
     return PROGRESS_EXIT_STATUS.nothing_started;
   }
   io2.print(preparedLineOf(prepared));
+  if (binding?.kind === "unbound" && binding.manifest !== null) {
+    io2.print(writeManifestMember(io2, binding.manifest, APPLICATION_MEMBER, options.application) ? boundLineOf(options.application) : BIND_WRITE_FAILED_LINE);
+  }
   const { upload, grant, environment } = prepared;
   const headers = { authorization: `Bearer ${grant}`, "user-agent": agent.userAgent };
   const stop = commandStopSentence(options.application, environment);
@@ -3667,7 +3756,7 @@ async function deploy(named, io2, flags = /* @__PURE__ */ new Set()) {
     }
     if (read2.status !== 200 || !read2.type.startsWith("text/plain")) {
       const refusal = markedRefusalOf(read2.status, read2.text);
-      const said = refusal !== null ? refusalLines(PROGRESS_READ_ACT, read2.status, refusal) : [notThePlatformLine(PROGRESS_READ_ACT, read2.status)];
+      const said = refusal === null ? [notThePlatformLine(PROGRESS_READ_ACT, read2.status)] : read2.status >= PLATFORM_FAILURE_STATUS ? failureLines(PROGRESS_READ_ACT, read2.status, refusal) : refusalLines(PROGRESS_READ_ACT, read2.status, refusal);
       for (const line of said) io2.print(line);
       io2.print(stop);
       return PROGRESS_EXIT_STATUS.refused;
@@ -3702,19 +3791,21 @@ var DEPLOY_ROW = Object.freeze({
     done: `the version deployed, or the deploy started where ${DEPLOY_NO_WAIT_VARIABLE} is set`,
     failed: "the deploy failed",
     unknown: "the wait stopped, or the start drew no answer: the deploy may go on, and read_status reads it",
-    nothing_started: "an option, the credential, or the folder was refused, no credential was read, the platform was too old, no usable upload was answered, no zipped file names the health path, the upload or start was refused, or the upload drew no answer"
+    nothing_started: "an option, credential, folder, or the folder's binding was refused, no credential was read, the platform was too old, no usable upload was answered, no zipped file names the health path, the upload or start was refused, or the upload drew no answer"
   },
   variables: [[DEPLOY_NO_WAIT_VARIABLE, "any value returns the command once the deploy has started, without waiting for it."]],
   note: [
     `A deploy is one line, which carries no credential: run the line your tool's deploy call answers, or ${DEPLOY_SUBCOMMAND} ${DEPLOY_OPTION.application} <application id>, from the application's folder. It reads no standard input. On an authorized computer it runs under this computer's token, which ${LOGIN_SUBCOMMAND} or ${AUTHORIZE_SUBCOMMAND} keeps in the credential file for each platform address, and sends it only to the address it is kept under: ${DEPLOY_OPTION.origin} where the line names one, else the address ${ORIGIN_VARIABLE} holds, else ${DEFAULT_COMMAND_ORIGIN}.`,
     `On a computer with no token for that address, or one that has expired, it sends nothing, ends 3, and prints two routes, in this order. A tool connected by a minted token, or a job with no tool, such as a CI job's, sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, such as the job's secret store, never by writing the value in a line. It sets ${ORIGIN_VARIABLE} to the address that minted the token where that is not ${DEFAULT_COMMAND_ORIGIN}, then runs the deploy line again. Such a tool cannot use ${MINT_TOKEN_ACTION}, which takes a sign-in alone.`,
     `Otherwise a person logs this computer in once with ${LOGIN_SUBCOMMAND}, in a terminal of their own, then runs the deploy line again; a folder within the caps of the tool's deploy_files call deploys now through deploy_files, with no login. The credential file is ${CREDENTIAL_FILE_WORDS}.`,
-    `A tool sets ${MINTED_TOKEN_VARIABLE} for the deploy or check line alone and unsets it once that line ends, since the command cannot unset a variable of the shell that started it. A value a job's environment already supplies stays as it stands. A job's token is minted for the application, with an expiry. The variable's token wins over the credential file: the command makes the preparing call under that token, and sends the token in no other request.`,
+    `A tool sets ${MINTED_TOKEN_VARIABLE} for the deploy, check, take, or scaffold line alone and unsets it once that line ends, since the command cannot unset a variable of the shell that started it. A value a job's environment already supplies stays as it stands. A job's token is minted for the application, with an expiry. The variable's token wins over the credential file: the command makes the preparing call under that token, and sends the token in no other request.`,
     `Under the variable, the command sends its token only to the address ${ORIGIN_VARIABLE} holds, or to ${DEFAULT_COMMAND_ORIGIN} where that variable is unset: under the token, ${DEPLOY_OPTION.origin} may name that address alone, and where the line names none the command addresses it. ${DEPLOY_OPTION.env} names the environment where a line names one, ${COMMAND_ENVIRONMENTS.join(" or ")}; where none is named, the platform chooses, and the command deploys to the environment the platform answers.`,
     `A progress read answered 502, 503, or 504, which is often temporary, is made again, at most three more times, and an upload answered 503 credential_lookup_busy, which wrote nothing, is made again after the wait it names, at most twice.`,
     `After its zip line, ${DEPLOY_SUBCOMMAND} prints the folder's top-level entries the zip holds on one line, at most ten and then the count of the rest, and ${HASH_SUBCOMMAND} ${HASH_OPTION.list} names every file; no such line prints for a .zip file.`,
     `Then it prints the paths the zip left out, a warning for a .zip file at the folder's root, a warning for a file that looks like a key or a credential, and a warning for a health path that no file names, package files and documentation set aside, each on a line of its own and only where there is something to name. The health warning refuses nothing.`,
-    `After the preparing call, where the platform's answer names the recorded manifest's health path and says the environment serves no version, and no file of the folder's zip names that path, ${DEPLOY_SUBCOMMAND} prints the platform's own refusal, then that nothing was uploaded and nothing was started, and ends 3 with no ${PREPARED_LINE_HEAD.trimEnd()} line, as the start would refuse it. A .zip file the line names is not read for it, and the start's own refusal stands.`
+    `After the preparing call, where the platform's answer names the recorded manifest's health path and says the environment serves no version, and no file of the folder's zip names that path, ${DEPLOY_SUBCOMMAND} prints the platform's own refusal, then that nothing was uploaded and nothing was started, and ends 3 with no ${PREPARED_LINE_HEAD.trimEnd()} line, as the start would refuse it. A .zip file the line names is not read for it, and the start's own refusal stands.`,
+    `Before its zip, ${DEPLOY_SUBCOMMAND} reads the folder's manifest.json. Where its application member names another application than ${DEPLOY_OPTION.application}, or is not an application id, the deploy ends 3 before anything is zipped or sent. To deploy the folder to another application on purpose, the account's owner changes or removes that member.`,
+    `Where the manifest holds no application member, ${DEPLOY_SUBCOMMAND} writes ${DEPLOY_OPTION.application}'s id into it after the ${PREPARED_LINE_HEAD.trimEnd()} line and prints a ${BOUND_LINE_HEAD.trimEnd()} line, so later deploy and check lines naming another application are refused. A write that fails prints one line and stops nothing. A .zip file the line names is not read for it.`
   ],
   afterOwnError: DEPLOY_AFTER_OWN_ERROR,
   run: (call, io2) => deploy(call.named, io2, call.flags)
@@ -3723,6 +3814,7 @@ var DEPLOY_ROW = Object.freeze({
 // src/turnzero_cloud_command/check.ts
 var NOTHING_SENT_OR_CHECKED = "Nothing was sent and nothing was checked.";
 var NOTHING_CHECKED = "Nothing was checked.";
+var BINDING_NOTHING_CHECKED = "Nothing further was read, and nothing was sent or checked.";
 var REFUSED_LINE_HEAD = "refused: ";
 var MANIFEST_LINE_HEAD = "manifest: ";
 var CHECKED_LINE_HEAD = "checked: ";
@@ -3914,6 +4006,12 @@ async function check(named, io2) {
   }
   const origin = sent.origin;
   const refused = () => credential.source === "credential_file" ? fileReadSentence(origin) : variableReadSentence(origin, fileStandingOf(io2, origin, io2.print));
+  const binding = pathKindOf(options.path) === "folder" ? folderBindingOf(io2, options.path) : null;
+  const unbound = binding === null ? null : bindingRefusalOf(binding, options.application, BINDING_NOTHING_CHECKED);
+  if (unbound !== null) {
+    io2.print(unbound);
+    return COMMAND_STATUS.nothing_started;
+  }
   const zipped = zipOf(options.path, io2, NOTHING_CHECKED, named[CHECK_OPTION.path] !== void 0, null, "checked");
   if ("refusal" in zipped) {
     io2.print(zipped.refusal);
@@ -3946,11 +4044,12 @@ var CHECK_ROW = Object.freeze({
   statuses: {
     done: "none of the checks would refuse a deploy now",
     failed: "a deploy would be refused now, the refused: lines naming each refusal",
-    nothing_started: "nothing was checked: an option, the credential, or the folder was refused, no credential was read and the two routes to one were printed, the platform was too old, or the check call was refused, drew no answer, was redirected, or failed"
+    nothing_started: "nothing was checked: an option, credential, folder, or the folder's binding was refused, no credential was read and the two routes to one were printed, the platform was too old, or the check call was refused, drew no answer, was redirected, or failed"
   },
   note: [
     `A check is one line, which carries no credential: run the line your tool's ${CHECK_ACTION} call answers, or ${CHECK_SUBCOMMAND} ${CHECK_OPTION.application} <application id>, from the application's folder, before a first deploy and after each fix. It reads its credential and the platform's address as ${DEPLOY_SUBCOMMAND} does, builds the zip ${DEPLOY_SUBCOMMAND} builds, and sends the platform the application alone, no byte of the zip and no hash. It uploads nothing and starts nothing.`,
     `After its zip line, ${CHECK_SUBCOMMAND} prints the further lines ${DEPLOY_SUBCOMMAND} prints, leaving out the health warning where the platform says the deploy would be a first one, since a refused: line then reads the recorded health path. Then it prints one refused: line for each refusal the platform answered for the application's state, then one for each refusal of the zip by the deploy's own checks, a line naming submit_manifest where the zip's manifest.json names another health path, and a last checked: line counting the refusals.`,
+    `Before its zip, ${CHECK_SUBCOMMAND} reads the folder's manifest.json as ${DEPLOY_SUBCOMMAND} reads it. Where its application member names another application than ${CHECK_OPTION.application}, or is not an application id, the check ends 3 before anything is zipped or sent. A check writes no member where none stands.`,
     `A passing check does not guarantee the deploy is accepted: a deploy in flight, the day's deploys, and the hosting cell's room can change before the deploy, which makes every check again.`
   ],
   afterOwnError: CHECK_AFTER_OWN_ERROR,
@@ -3978,6 +4077,10 @@ async function hash(named, io2, flags = /* @__PURE__ */ new Set()) {
     io2.print(LIST_ZIP_FILE_SENTENCE);
     return PROGRESS_EXIT_STATUS.nothing_started;
   }
+  if (pathKindOf(folder) === "folder" && folderBindingOf(io2, folder).kind === "off_form") {
+    io2.print(`${OFF_FORM_SENTENCE} ${NO_HASH_PRINTED} ${HASH_BINDING_OWNER_ASK}`);
+    return PROGRESS_EXIT_STATUS.nothing_started;
+  }
   const zipped = zipOf(folder, io2, NO_HASH_PRINTED, path !== void 0);
   if ("refusal" in zipped) {
     io2.print(zipped.refusal);
@@ -3999,7 +4102,7 @@ var HASH_ROW = Object.freeze({
 });
 
 // src/turnzero_cloud_command/secret.ts
-import { isAbsolute as isAbsolute3, join as join5, relative as relative3, resolve as resolve7, sep as sep2 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join6, relative as relative4, resolve as resolve7, sep as sep2 } from "node:path";
 
 // src/turnzero_cloud_command/value.ts
 var NOTHING_SENT2 = "Nothing was sent.";
@@ -4204,15 +4307,15 @@ var secretUnknownSentence = (act) => `Whether the value was written is unknown:
 var PACKAGE_FILE = "package.json";
 var VALUE_FILE_WARNING = `warning: the file ${SECRET_OPTION.valueFile} names stands inside an application folder, and a deploy from that folder would include it. Keep the file outside the application's folder, or delete it once this line ends 0.`;
 var valueFileWouldDeploy = (io2, cwd, file) => {
-  const between = relative3(cwd, file);
+  const between = relative4(cwd, file);
   if (between === "" || between === ".." || between.startsWith(`..${sep2}`) || isAbsolute3(between)) return false;
   const segments = between.split(sep2);
   if (segments.some(leftOutName)) return false;
   let folder = cwd;
   for (let depth = 0; depth < segments.length; depth += 1) {
-    if (depth > 0) folder = join5(folder, segments[depth - 1]);
+    if (depth > 0) folder = join6(folder, segments[depth - 1]);
     try {
-      if (io2.stat(join5(folder, PACKAGE_FILE))?.folder === false) return true;
+      if (io2.stat(join6(folder, PACKAGE_FILE))?.folder === false) return true;
     } catch {
     }
   }
@@ -4486,11 +4589,11 @@ var PUT_ROW = Object.freeze({
 
 // src/turnzero_cloud_command/library_take.ts
 import { createHash as createHash3 } from "node:crypto";
-import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute4, join as join7, relative as relative4, resolve as resolve10, sep as sep3 } from "node:path";
+import { basename as basename2, dirname as dirname4, isAbsolute as isAbsolute4, join as join8, relative as relative5, resolve as resolve10, sep as sep3 } from "node:path";
 
 // src/turnzero_cloud_command/run.ts
 import { constants } from "node:os";
-import { join as join6, resolve as resolve9, win32 as win323 } from "node:path";
+import { join as join7, resolve as resolve9, win32 as win323 } from "node:path";
 var RUN_OPTIONS = Object.freeze([
   {
     name: RUN_OPTION.path,
@@ -4674,7 +4777,7 @@ async function localRun(call, io2) {
     return COMMAND_STATUS.nothing_started;
   }
   try {
-    io2.readFile(join6(options.folder, PACKAGE_FILE2));
+    io2.readFile(join7(options.folder, PACKAGE_FILE2));
   } catch (error) {
     io2.print(
       `The application's folder holds no ${PACKAGE_FILE2} the command could read (${fileErrorCodeOf(error, "unreadable")}), so npm start has nothing to start there: ${RUN_OPTION.path} names the folder, and it is the folder the command runs in where the option is absent. ${NO_APPLICATION_STARTED}`
@@ -4746,10 +4849,38 @@ var LIBRARY_TAKE_OPTIONS = Object.freeze([
     name: LIBRARY_OPTION.origin,
     value: "<origin>",
     required: false,
-    description: `The platform's address. Where absent, ${DEFAULT_COMMAND_ORIGIN}.`
+    description: `The platform's address. Where absent, the address ${ORIGIN_VARIABLE} holds, or ${DEFAULT_COMMAND_ORIGIN} where it is unset. Under ${MINTED_TOKEN_VARIABLE} the token is sent only to the address ${ORIGIN_VARIABLE} holds, or to ${DEFAULT_COMMAND_ORIGIN} where it is unset. Otherwise it names the address whose token the command reads from this computer's credential file, and that token is sent to that address alone.`
   }
 ]);
 var NOTHING_WRITTEN2 = "Nothing was written.";
+var LIBRARY_CREDENTIAL = Object.freeze({
+  grant: "minted token",
+  aGrant: "a minted token",
+  call: `the ${LIBRARY_READ_ACTION} call`,
+  mintedToken: true,
+  piped: false,
+  places: `the command reads no standard input: it reads a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, as a tool connected by a minted token sets it from where its token is kept, or a job with no tool from its secret store, and otherwise this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write.`
+});
+var LIBRARY_READS = `no standard input: a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, and otherwise this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write, sent only to that address; with neither, it prints the variable route first and then, where the address is admitted, the login route`;
+var TAKE_AFTER_LOGIN = `Once ${LOGIN_SUBCOMMAND} has printed authorized:, run this take line again. ${NOTHING_WRITTEN2}`;
+var takeRedirectedLine = (status) => `${LIBRARY_READ_ACTION} was answered ${status >= 100 ? `${answeredHow(status)}, a redirect` : answeredHow(status)}, which the command never follows, so the credential was sent to no second address. ${NOTHING_WRITTEN2}`;
+async function readTakeCredential(io2, named, afterLogin) {
+  const line = { named, closing: NOTHING_WRITTEN2 };
+  const read2 = await readCredential(io2, LIBRARY_CREDENTIAL, "", line);
+  if ("unauthorized" in read2) {
+    const lines = [noTokenSentence(read2.unauthorized.origin, read2.unauthorized.expiredAt), VARIABLE_ROUTE_SENTENCES];
+    const origin = authorizationOriginOf(io2.env, named, NOTHING_WRITTEN2);
+    if ("refusal" in origin) return { lines: [...lines, origin.refusal] };
+    const unwritable = loginRouteRefusalOf(io2, NOTHING_WRITTEN2);
+    if (unwritable !== null) return { lines: [...lines, unwritable] };
+    return { lines: [...lines, ...loginRouteLines(io2, origin.origin, false), afterLogin] };
+  }
+  if ("refusal" in read2) return { lines: [read2.refusal] };
+  io2.hide(read2.credential, REDACTED_TOKEN);
+  const sent = credentialOriginOf(io2.env, read2, line);
+  if ("refusal" in sent) return { lines: [sent.refusal] };
+  return { bearer: read2.credential, origin: sent.origin };
+}
 var LINES_IN_WINDOWS_FORM = process.platform === "win32";
 var machineLineOf = (line, form = LINES_IN_WINDOWS_FORM, origin = DEFAULT_COMMAND_ORIGIN) => {
   const windows = typeof form === "boolean" ? form : form.windows;
@@ -4788,13 +4919,13 @@ var libraryTakeOptionsOf = (call, cwd) => {
   return { entry, root: resolve10(cwd, path ?? "."), named: path !== void 0, origin: origin.origin };
 };
 var inside = (parent, child) => {
-  const between = relative4(parent, child);
+  const between = relative5(parent, child);
   return between !== "" && !between.startsWith("..") && !isAbsolute4(between);
 };
-var shownFrom = (root) => (path) => shownName(relative4(root, path).split(sep3).join("/") || ".");
+var shownFrom = (root) => (path) => shownName(relative5(root, path).split(sep3).join("/") || ".");
 var repositoryRootOf = (io2, root) => {
   for (let at = root; ; at = dirname4(at)) {
-    if (io2.stat(join7(at, ".git")) !== null) return at;
+    if (io2.stat(join8(at, ".git")) !== null) return at;
     if (dirname4(at) === at) return root;
   }
 };
@@ -4814,14 +4945,14 @@ var TAKE_FOLDER_WORDS = Object.freeze({
   manifestCannot: "so the take cannot add its row to it"
 });
 var libraryFolderOf = (io2, root, words = TAKE_FOLDER_WORDS) => {
-  const own = join7(root, LIBRARY_FOLDER);
+  const own = join8(root, LIBRARY_FOLDER);
   const inRoot = { folder: root, called: ROOT_CALLED };
   const standing = io2.stat(own);
   if (standing !== null) {
     if (!standing.folder) return { refusal: `The project's ${LIBRARY_FOLDER} is a file, where the library folder stands. ${NOTHING_WRITTEN2}` };
     return { folder: own, fresh: false, within: inRoot };
   }
-  const pointerAt = join7(root, POINTER_FILE);
+  const pointerAt = join8(root, POINTER_FILE);
   if (io2.stat(pointerAt) === null) return { folder: own, fresh: true, within: inRoot };
   let named;
   try {
@@ -4845,22 +4976,22 @@ var libraryFolderOf = (io2, root, words = TAKE_FOLDER_WORDS) => {
   return { folder: at, fresh: false, within: { folder: repository, called: REPOSITORY_CALLED } };
 };
 var applicationFolderRefusalOf = (io2, options) => {
-  const holds = (folder) => io2.stat(join7(folder, LIBRARY_FOLDER)) !== null || io2.stat(join7(folder, POINTER_FILE)) !== null;
+  const holds = (folder) => io2.stat(join8(folder, LIBRARY_FOLDER)) !== null || io2.stat(join8(folder, POINTER_FILE)) !== null;
   const parent = dirname4(options.root);
   if (parent === options.root || holds(options.root) || !holds(parent)) return null;
   return options.named ? `The folder ${LIBRARY_OPTION.path} names holds neither ${LIBRARY_FOLDER}/ nor ${POINTER_FILE}, and the folder above it holds one, so it may be an application's folder inside that project. Take the entry at the project's root: name the folder above it with ${LIBRARY_OPTION.path}. Or, where the folder is a project of its own, make an empty ${LIBRARY_FOLDER}/ folder in it and run the line again. ${NOTHING_WRITTEN2}` : `This folder holds neither ${LIBRARY_FOLDER}/ nor ${POINTER_FILE}, and the folder above it holds one, so this may be an application's folder inside that project. Take the entry at the project's root: run the line in the folder above. Or, where this folder is a project of its own, make an empty ${LIBRARY_FOLDER}/ folder here and run the line again. ${NOTHING_WRITTEN2}`;
 };
 var entryFoldersIn = (io2, library) => {
-  const folders = (at) => (io2.listFolder(join7(library, ...at.split("/"))) ?? []).filter((name) => !NEVER_PUBLISHED.has(name) && io2.stat(join7(library, ...at.split("/"), name))?.folder === true).sort();
+  const folders = (at) => (io2.listFolder(join8(library, ...at.split("/"))) ?? []).filter((name) => !NEVER_PUBLISHED.has(name) && io2.stat(join8(library, ...at.split("/"), name))?.folder === true).sort();
   return [
     ...folders("features"),
     ...folders("ui").filter((name) => name !== "assets").map((name) => `ui/${name}`),
     ...folders("ui/assets/fonts").map((name) => `fonts/${name}`),
-    ...io2.stat(join7(library, "prd"))?.folder === true ? ["library/prd"] : []
+    ...io2.stat(join8(library, "prd"))?.folder === true ? ["library/prd"] : []
   ];
 };
 var manifestRowsOf = (io2, library, words = TAKE_FOLDER_WORDS) => {
-  const at = join7(library, MANIFEST_FILE2);
+  const at = join8(library, MANIFEST_FILE2);
   if (io2.stat(at) === null) return { rows: null, stood: null };
   try {
     const stood = io2.readFile(at);
@@ -4902,7 +5033,7 @@ var listedEntryOf = (answer, name) => {
   return { name, path, version, closure_hash: closure, files: listed2, source_commit: commit };
 };
 var LIST_READ = "The read of the entry's file list";
-var readOf = async (io2, origin, userAgent, body, what) => {
+var readOf = async (io2, origin, bearer, userAgent, body, what) => {
   let status;
   let text;
   try {
@@ -4911,10 +5042,15 @@ var readOf = async (io2, origin, userAgent, body, what) => {
       what,
       () => io2.fetch(`${origin}${LIBRARY_READ_PATH}`, {
         method: "POST",
-        headers: { "user-agent": userAgent, "content-type": "application/json" },
-        body: JSON.stringify(body)
+        headers: { authorization: `Bearer ${bearer}`, "user-agent": userAgent, "content-type": "application/json" },
+        body: JSON.stringify(body),
+        redirect: "manual"
       })
     );
+    if (redirected(response)) {
+      await response.body?.cancel().catch(() => void 0);
+      return { lines: [takeRedirectedLine(response.status)] };
+    }
     status = response.status;
     text = await response.text();
   } catch {
@@ -4924,16 +5060,17 @@ var readOf = async (io2, origin, userAgent, body, what) => {
   if (status >= 200 && status <= 299 && answer !== null) return { answer };
   const refusal = markedRefusalOf(status, text);
   if (refusal === null) return { lines: [`${LIBRARY_READ_ACTION} was answered HTTP ${status}, not by the platform. ${NOTHING_WRITTEN2}`] };
+  if (status >= PLATFORM_FAILURE_STATUS) return { lines: [...failureLines(LIBRARY_READ_ACTION, status, refusal), NOTHING_WRITTEN2] };
   return { lines: [...refusalLines(LIBRARY_READ_ACTION, status, refusal), NOTHING_WRITTEN2] };
 };
-var fileBytesOf = async (io2, origin, userAgent, name, file) => {
+var fileBytesOf = async (io2, origin, bearer, userAgent, name, file) => {
   const shown2 = `${LIBRARY_FOLDER}/${shownName(file.path)}`;
   let text = "";
   let encoding = null;
   let offset = 0;
   let stamp = null;
   for (; ; ) {
-    const read2 = await readOf(io2, origin, userAgent, { name, file: file.path, limit: LIBRARY_READ_CHUNK, ...stamp !== null ? { offset, stamp } : {} }, `The read of ${shown2}`);
+    const read2 = await readOf(io2, origin, bearer, userAgent, { name, file: file.path, limit: LIBRARY_READ_CHUNK, ...stamp !== null ? { offset, stamp } : {} }, `The read of ${shown2}`);
     if ("lines" in read2) return { lines: [`${shown2}: the read stopped.`, ...read2.lines] };
     const chunk = read2.answer.file;
     const next = chunk?.next_offset;
@@ -4979,11 +5116,6 @@ var ofModuleType = (plan, name) => {
 };
 var MADE_LINE_HEAD = "made: ";
 var madeLineOf = (made) => `${MADE_LINE_HEAD}${MADE_FOLDER}/package.json, since neither app/package.json nor the project root's package.json stood: private, named ${made.name}${made.module ? ", of type module" : ""}, with no scripts.`;
-var BYTE_ORDER_MARK3 = "\uFEFF";
-var jsonTextOf = (bytes) => {
-  const text = bytes.toString("utf8");
-  return text.startsWith(BYTE_ORDER_MARK3) ? text.slice(BYTE_ORDER_MARK3.length) : text;
-};
 var openingCharacterClauseOf = (text) => {
   const first = text.codePointAt(0);
   if (first === void 0) return "";
@@ -4993,19 +5125,19 @@ var openingCharacterClauseOf = (text) => {
   const control = first < 32 && first !== 9 && first !== 10 && first !== 13 || first >= 127 && first <= 159;
   return control ? `: the file opens with ${point}, a control character` : "";
 };
-var applicationFolderOf = (io2, root) => [join7(root, "app"), root].find((folder) => io2.stat(join7(folder, "package.json"))?.folder === false) ?? null;
+var applicationFolderOf = (io2, root) => [join8(root, "app"), root].find((folder) => io2.stat(join8(folder, "package.json"))?.folder === false) ?? null;
 var copyPlanOf = (io2, root, library, name) => {
   const shown2 = shownFrom(root);
   if (name.includes("/")) return { refusal: `The entry ${LIBRARY_OPTION.entry} names carries compiled modules under a name that holds a slash, which an npm package cannot take. ${NOTHING_WRITTEN2}` };
   const application = applicationFolderOf(io2, root);
   if (application === null) {
-    const app = join7(root, MADE_FOLDER);
+    const app = join8(root, MADE_FOLDER);
     const standing = io2.stat(app);
     if (standing !== null && !standing.folder || danglingLinkAt(io2, root, MADE_FOLDER)) {
       return { refusal: `Something that is no folder stands at ${MADE_FOLDER}, where the take would make the application's package.json. ${NOTHING_WRITTEN2}` };
     }
-    const copy2 = join7(app, "lib", name);
-    const madeFile = join7(app, "package.json");
+    const copy2 = join8(app, "lib", name);
+    const madeFile = join8(app, "package.json");
     if (io2.stat(madeFile) !== null || standing !== null && danglingLinkAt(io2, app, "package.json")) {
       return { refusal: `Something that is no package file stands at ${MADE_FOLDER}/package.json, where the take would make it. ${NOTHING_WRITTEN2}` };
     }
@@ -5018,7 +5150,7 @@ var copyPlanOf = (io2, root, library, name) => {
     const declaredAt2 = `file:lib/${name}`;
     return { application: app, copy: copy2, declared: madePackageFileOf(made, `${PACKAGE_SCOPE}${name}`, declaredAt2), declaredAt: declaredAt2, made };
   }
-  const packageFile = join7(application, "package.json");
+  const packageFile = join8(application, "package.json");
   const read2 = io2.readFile(packageFile);
   const text = jsonTextOf(read2);
   let parsed;
@@ -5030,12 +5162,12 @@ var copyPlanOf = (io2, root, library, name) => {
   }
   const packageName = `${PACKAGE_SCOPE}${name}`;
   const specs = DEPENDENCY_SECTIONS.map((section) => parsed[section]?.[packageName]).filter((spec) => spec !== void 0);
-  const place = application === root && io2.stat(join7(root, "app"))?.folder === true ? `app/lib/${name}` : `lib/${name}`;
+  const place = application === root && io2.stat(join8(root, "app"))?.folder === true ? `app/lib/${name}` : `lib/${name}`;
   let copy;
   let declared = null;
   let declaredAt = null;
   if (specs.length === 0) {
-    copy = join7(application, ...place.split("/"));
+    copy = join8(application, ...place.split("/"));
     declaredAt = `file:${place}`;
     declared = withDependency(text, parsed, packageName, declaredAt);
   } else {
@@ -5061,11 +5193,11 @@ var stageRefusalOf = (io2, stage, beside) => {
   return own ? null : `Something that is not the take's own stands at ${STAGE} beside ${beside}, the name the take writes under: move it, then run the line again. ${NOTHING_WRITTEN2}`;
 };
 var moveFolderIn = (io2, stage, target, files) => {
-  const fresh = join7(stage, "new");
-  const old = join7(stage, "old");
+  const fresh = join8(stage, "new");
+  const old = join8(stage, "old");
   io2.remove(stage);
   for (const [path, bytes] of files) {
-    const at = join7(fresh, ...path.split("/"));
+    const at = join8(fresh, ...path.split("/"));
     io2.makeFolder(dirname4(at));
     io2.writeFile(at, bytes);
   }
@@ -5105,15 +5237,14 @@ var PACKAGES_LINE_HEAD = "packages: ";
 var jsonEscapeOf = (character) => Array.from({ length: character.length }, (_, index) => `\\u${character.charCodeAt(index).toString(16).padStart(4, "0")}`).join("");
 var shownJson = (text) => [...text].map((character) => shownWhole(character) === character ? character : jsonEscapeOf(character)).join("");
 var packagesLineOf = (rows) => `${PACKAGES_LINE_HEAD}${shownJson(JSON.stringify(rows))}`;
-var applicationManifestPartialOf = (at) => `${at}.partial`;
 var PARTIAL_LINK_SENTENCE = writtenLinkSentence(`The file the application manifest is written to first, ${MANIFEST_FILE2}.partial beside it,`);
-var danglingLinkAt = (io2, folder, name) => io2.stat(join7(folder, name)) === null && (io2.listFolder(folder) ?? []).some((held) => held.toLowerCase() === name.toLowerCase() && io2.stat(join7(folder, held)) === null);
+var danglingLinkAt = (io2, folder, name) => io2.stat(join8(folder, name)) === null && (io2.listFolder(folder) ?? []).some((held) => held.toLowerCase() === name.toLowerCase() && io2.stat(join8(folder, held)) === null);
 var linkStandsAt = (io2, path) => {
   const name = basename2(path);
   if (!(io2.listFolder(dirname4(path)) ?? []).includes(name)) return false;
   const real = io2.realPath(path);
   const folder = io2.realPath(dirname4(path));
-  return real === null || folder === null || relative4(join7(folder, name), real) !== "";
+  return real === null || folder === null || relative5(join8(folder, name), real) !== "";
 };
 var writesThroughLink = (io2, holder, path) => linkStandsAt(io2, path) || !heldInside(io2, holder, path);
 var writtenNameRefusalOf = (io2, holder, names) => {
@@ -5122,11 +5253,11 @@ var writtenNameRefusalOf = (io2, holder, names) => {
 };
 var applicationManifestOf = (io2, root, library, folder = applicationFolderOf(io2, root)) => {
   if (folder === null) return { at: null, unwritten: "no_folder" };
-  const at = join7(folder, MANIFEST_FILE2);
+  const at = join8(folder, MANIFEST_FILE2);
   const standing = io2.stat(at);
   if (standing === null) return { at, unwritten: "not_standing" };
   if (!heldInside(io2, root, at)) return { refusal: linkSentence("The application manifest", ROOT_CALLED) };
-  const libraryManifest = join7(library, MANIFEST_FILE2);
+  const libraryManifest = join8(library, MANIFEST_FILE2);
   if (resolve10(at) === resolve10(libraryManifest) || realPlaceOf(io2, at) === realPlaceOf(io2, libraryManifest)) return { at, unwritten: "library_manifest" };
   if (standing.folder) return { at, unwritten: "no_object" };
   const partial = applicationManifestPartialOf(at);
@@ -5138,25 +5269,9 @@ var applicationManifestOf = (io2, root, library, folder = applicationFolderOf(io
   }
   return { at, unwritten: "no_object" };
 };
-var applicationManifestTextOf = (parsed, packages) => `${JSON.stringify({ ...parsed, packages }, null, 2)}
-`;
 var writeApplicationManifest = (io2, manifest, packages) => {
   if (!("parsed" in manifest)) return manifest;
-  const partial = applicationManifestPartialOf(manifest.at);
-  let made = false;
-  try {
-    if (io2.stat(partial)?.folder === false) io2.remove(partial);
-    made = io2.stat(partial) === null;
-    io2.writeNewFile(partial, applicationManifestTextOf(manifest.parsed, packages));
-    io2.rename(partial, manifest.at);
-  } catch {
-    try {
-      if (made) io2.remove(partial);
-    } catch {
-    }
-    return { at: manifest.at, unwritten: "write_failed" };
-  }
-  return { written: manifest.at };
+  return writeManifestMember(io2, manifest, "packages", packages) ? { written: manifest.at } : { at: manifest.at, unwritten: "write_failed" };
 };
 var packagesWhereOf = (root, outcome) => {
   const shown2 = shownFrom(root);
@@ -5180,17 +5295,17 @@ var COPY_PACKAGES_CLAUSE = "copy the packages line into the application manifest
 var KEEP_PACKAGES_CLAUSE = "the application manifest was written whole, so read it again before patching it, and carry its packages member over in any later rewrite; ";
 var installFailedSentence = (folder) => `npm install in ${folder} did not finish: the entry, its row, and the copy are written. Run npm install there again; running this line again takes the entry again whole.`;
 var LIBRARY_AFTER_OWN_ERROR = "the entry's folder, its manifest row, or the application's copy may stand in part, and running the line again replaces each whole";
-async function readTake(io2, options, userAgent, planOf, planeChecked = false) {
+async function readTake(io2, options, userAgent, bearer, planOf, planeChecked = false) {
   const refuse = (...lines) => ({ lines });
   const found = libraryFolderOf(io2, options.root);
   if ("refusal" in found) return refuse(found.refusal);
   const library = found.folder;
   if (!heldInside(io2, found.within.folder, library)) return refuse(linkSentence("The project's library folder", found.within.called));
-  const manifestAt = join7(library, MANIFEST_FILE2);
+  const manifestAt = join8(library, MANIFEST_FILE2);
   const inLibrary = writtenNameRefusalOf(io2, found.within.folder, [
     [WRITTEN_NAMES.manifest, manifestAt],
     [WRITTEN_NAMES.manifestPartial, `${manifestAt}.partial`],
-    [WRITTEN_NAMES.libraryStage, join7(library, STAGE)]
+    [WRITTEN_NAMES.libraryStage, join8(library, STAGE)]
   ]);
   if (inLibrary !== null) return refuse(inLibrary);
   const manifest = found.fresh ? { rows: null, stood: null } : manifestRowsOf(io2, library);
@@ -5200,11 +5315,11 @@ async function readTake(io2, options, userAgent, planOf, planeChecked = false) {
     const older = await planeWireRefusal(io2, options.origin);
     if (older !== null) return refuse(older);
   }
-  const list = await readOf(io2, options.origin, userAgent, { name: options.entry }, LIST_READ);
+  const list = await readOf(io2, options.origin, bearer, userAgent, { name: options.entry }, LIST_READ);
   if ("lines" in list) return refuse(...list.lines);
   const entry = listedEntryOf(list.answer, options.entry);
   if ("refusal" in entry) return refuse(entry.refusal);
-  const entryFolder = join7(library, ...entry.path.split("/"));
+  const entryFolder = join8(library, ...entry.path.split("/"));
   if (!heldInside(io2, found.within.folder, entryFolder)) return refuse(linkSentence("The entry's folder", found.within.called));
   if (io2.stat(entryFolder) !== null && !(manifest.rows ?? []).some((row) => rowName(row) === entry.name)) {
     return refuse(sourceSentence(`holds ${entry.name}'s folder and no row for it in its ${MANIFEST_FILE2}`));
@@ -5214,15 +5329,15 @@ async function readTake(io2, options, userAgent, planOf, planeChecked = false) {
   if (plan !== null && "refusal" in plan) return refuse(plan.refusal, ...plan.after ?? []);
   if (plan !== null && !heldInside(io2, options.root, plan.copy)) return refuse(linkSentence("The application's copy", ROOT_CALLED));
   const besideCopy = plan === null ? null : writtenNameRefusalOf(io2, options.root, [
-    ...plan.declared !== null ? [[WRITTEN_NAMES.packageFile, join7(plan.application, "package.json")]] : [],
+    ...plan.declared !== null ? [[WRITTEN_NAMES.packageFile, join8(plan.application, "package.json")]] : [],
     [WRITTEN_NAMES.copyStage, `${plan.copy}${STAGE}`]
   ]);
   if (besideCopy !== null) return refuse(besideCopy);
-  const staged = stageRefusalOf(io2, join7(library, STAGE), "the library folder") ?? (plan !== null ? stageRefusalOf(io2, `${plan.copy}${STAGE}`, "the application's copy") : null);
+  const staged = stageRefusalOf(io2, join8(library, STAGE), "the library folder") ?? (plan !== null ? stageRefusalOf(io2, `${plan.copy}${STAGE}`, "the application's copy") : null);
   if (staged !== null) return refuse(staged);
   const bytes = /* @__PURE__ */ new Map();
   for (const file of entry.files) {
-    const read2 = await fileBytesOf(io2, options.origin, userAgent, entry.name, file);
+    const read2 = await fileBytesOf(io2, options.origin, bearer, userAgent, entry.name, file);
     if ("lines" in read2) return refuse(...read2.lines);
     const actual = sha256(read2.bytes);
     if (actual !== file.sha256) return refuse(`${LIBRARY_FOLDER}/${shownName(file.path)}: SHA-256 ${actual} is not the listed value ${file.sha256}. ${NOTHING_WRITTEN2}`);
@@ -5242,11 +5357,11 @@ function writeTake(io2, root, { entry, library, entryFolder, rows, manifestStood
     source_commit: entry.source_commit,
     fetched_at: (/* @__PURE__ */ new Date()).toISOString()
   });
-  const manifestAt = join7(library, MANIFEST_FILE2);
+  const manifestAt = join8(library, MANIFEST_FILE2);
   const manifestPartial = `${manifestAt}.partial`;
   io2.writeFile(manifestPartial, manifestText);
   io2.rename(manifestPartial, manifestAt);
-  const entryStage = join7(library, STAGE);
+  const entryStage = join8(library, STAGE);
   try {
     moveFolderIn(
       io2,
@@ -5276,7 +5391,7 @@ function writeTake(io2, root, { entry, library, entryFolder, rows, manifestStood
       plan.copy,
       compiled.map((file) => [file.path.slice(entry.path.length + 1), bytes.get(file.path)])
     );
-    const packageFile = join7(plan.application, "package.json");
+    const packageFile = join8(plan.application, "package.json");
     if (plan.declared !== null) io2.writeFile(packageFile, plan.declared);
     if (plan.made !== void 0) io2.print(madeLineOf(plan.made));
     io2.print(
@@ -5330,7 +5445,9 @@ async function libraryTake(call, io2) {
   }
   const fromApplication = applicationFolderRefusalOf(io2, options);
   if (fromApplication !== null) return refuse(fromApplication);
-  const checked = await readTake(io2, options, agent.userAgent, (library, name) => copyPlanOf(io2, options.root, library, name));
+  const held = await readTakeCredential(io2, call.named[LIBRARY_OPTION.origin], TAKE_AFTER_LOGIN);
+  if ("lines" in held) return refuse(...held.lines);
+  const checked = await readTake(io2, { ...options, origin: held.origin }, agent.userAgent, held.bearer, (library, name) => copyPlanOf(io2, options.root, library, name));
   if ("lines" in checked) return refuse(...checked.lines);
   const application = applicationManifestOf(io2, options.root, checked.library, checked.plan?.application ?? applicationFolderOf(io2, options.root));
   if ("refusal" in application) return refuse(application.refusal);
@@ -5341,9 +5458,10 @@ async function libraryTake(call, io2) {
 var LIBRARY_ROW = Object.freeze({
   name: LIBRARY_SUBCOMMAND,
   acts: LIBRARY_ACTS,
-  summary: "Takes a library entry into the project: reads its files from the library, checks each file's SHA-256 and the entry's closure hash, then writes its row in the library folder's manifest.json and replaces the entry's folder under that folder whole. For an entry with compiled modules it copies its package.json and lib/ into the application's folder, declares the copy where it is not declared, and runs npm install there. It reads no credential.",
+  summary: "Takes a library entry into the project: reads its files from the library, checks each file's SHA-256 and the entry's closure hash, then writes its row in the library folder's manifest.json and replaces the entry's folder under that folder whole. For an entry with compiled modules it copies its package.json and lib/ into the application's folder, declares the copy where it is not declared, and runs npm install there. It reads under the credential check reads. With no credential, it sends nothing and prints the two routes to one, as check does.",
   options: LIBRARY_TAKE_OPTIONS,
-  credential: null,
+  credential: LIBRARY_CREDENTIAL,
+  reads: LIBRARY_READS,
   statuses: {
     done: "the entry taken, and installed where it carries compiled modules",
     failed: "the entry, its row, and the copy written, and npm install failed or the application manifest's packages was not written",
@@ -5730,6 +5848,7 @@ var whoamiLinesOf = (origin, account, entry) => [
   `${WHOAMI_LINE_HEADS.token}label ${entry.label !== null ? JSON.stringify(entry.label) : "none"}, expiring ${entry.expires_at !== null ? `at ${entry.expires_at}` : "never"}`
 ];
 var noComputerTokenSentence = (origin, expiredAt) => expiredAt === null ? `This computer's credential file holds no token for ${origin}, so nothing was sent.` : `This computer's token for ${origin} in its credential file expired at ${expiredAt}, so nothing was sent.`;
+var noLoginRoutesSentence = (origin) => `Your AI coding tool's own sign-in is not this computer's credential. With no login, deploy_files deploys a folder within its caps, ${AUTHORIZE_SUBCOMMAND}${originWordsOf(origin)} run with nothing piped prints the ${MINT_TOKEN_ACTION} call a signed-in tool makes to authorize this computer, and ${PROVISION_SUBCOMMAND}${originWordsOf(origin)} run so prints the call that answers its line.`;
 var whoamiAfterLoginSentence = (whoami2) => `Once login has printed authorized:, run ${whoami2} again.`;
 async function whoami(call, io2) {
   const origin = entryOriginOf(io2.env, call.named[DEPLOY_OPTION.origin], NOTHING_SENT_OR_READ);
@@ -5753,6 +5872,7 @@ async function whoami(call, io2) {
   const expired2 = entry !== void 0 && entry.expires_at !== null && Date.parse(entry.expires_at) <= io2.clock().getTime();
   if (entry === void 0 || expired2) {
     io2.print(noComputerTokenSentence(origin.origin, entry === void 0 ? null : entry.expires_at));
+    io2.print(noLoginRoutesSentence(origin.origin));
     const reached = authorizationOriginOf(io2.env, call.named[DEPLOY_OPTION.origin], NOTHING_SENT_OR_READ);
     if ("refusal" in reached) {
       io2.print(reached.refusal);
@@ -5783,7 +5903,7 @@ async function whoami(call, io2) {
 }
 var WHOAMI_ROW = Object.freeze({
   name: WHOAMI_SUBCOMMAND,
-  summary: `Names the account this computer's token acts as at the platform's address: it reads the token the credential file keeps for the address and makes one ${READ_ACCOUNT_ACTION} call under it. It prints the address, the account's sign-in address and id, and the token's label and expiry. With no token for the address, it sends nothing and prints the login route. It prints no token.`,
+  summary: `Names the account this computer's token acts as at the platform's address: it reads the token the credential file keeps for the address and makes one ${READ_ACCOUNT_ACTION} call under it. It prints the address, the account's sign-in address and id, and the token's label and expiry. With no token for the address, it sends nothing, names the ways on with no login (deploy_files, ${AUTHORIZE_SUBCOMMAND}, and ${PROVISION_SUBCOMMAND}), and then prints the login route. It prints no token.`,
   options: WHOAMI_OPTIONS,
   credential: null,
   reads: "this computer's token for the origin from its credential file, never a minted token from TURNZERO_CLOUD_MINTED_TOKEN, and sends it only to that origin",
@@ -5791,7 +5911,7 @@ var WHOAMI_ROW = Object.freeze({
     done: "the account was read",
     failed: "the platform refused the read, where it no longer accepts the token among other causes: the printed lines name login",
     unknown: "the read drew no answer, or an answer that is not a refusal",
-    nothing_started: "nothing was read: an option or the credential file was refused, the platform was too old, or no live token stands for the address, and the printed lines give the login route"
+    nothing_started: "nothing was read: an option or the credential file was refused, the platform was too old, or no live token stands for the address, and the printed lines name the ways on with no login, then the login route"
   },
   variables: [[ORIGIN_VARIABLE, `the platform's address whose token is read where the line names no ${DEPLOY_OPTION.origin}.`]],
   note: [`${WHOAMI_SUBCOMMAND} reads which account a login or an authorize on this computer kept a token for, so you can tell it from your tool's own connection. The credential file is ${CREDENTIAL_FILE_WORDS}.`],
@@ -5856,7 +5976,7 @@ var startUpgradeCheck = (io2, subcommand, named, running) => {
   const read2 = io2.registryFetch;
   if (read2 === void 0 || !UPGRADE_CHECK_SUBCOMMANDS.includes(subcommand)) return NO_CHECK;
   if (UPGRADE_CHECK_SKIP_VARIABLES.some((name) => io2.env[name] !== void 0)) return NO_CHECK;
-  const origin = named[DEPLOY_OPTION.origin] ?? io2.env[ORIGIN_VARIABLE] ?? DEFAULT_COMMAND_ORIGIN;
+  const origin = originReadOf(named[DEPLOY_OPTION.origin] ?? io2.env[ORIGIN_VARIABLE]);
   const tag = commandTagOf(origin);
   const place = credentialFileOf(io2);
   const path = (onWindows(io2) ? win324 : posix3).join(place.folder, UPGRADE_CHECK_FILE_NAME);
@@ -5900,7 +6020,7 @@ var startUpgradeCheck = (io2, subcommand, named, running) => {
 };
 
 // src/turnzero_cloud_command/provision.ts
-import { basename as basename3, dirname as dirname5, join as join8 } from "node:path";
+import { basename as basename3, dirname as dirname5, join as join9 } from "node:path";
 var PROVISION_OPTIONS = Object.freeze([
   {
     name: PROVISION_OPTION.application,
@@ -5957,7 +6077,7 @@ var APPLICATION_FOLDER_MARKS = Object.freeze(["package.json", "manifest.json"]);
 var outsideApplicationWarningOf = (folder) => `warning: ${folder} holds neither ${APPLICATION_FOLDER_MARKS[0]} nor ${APPLICATION_FOLDER_MARKS[1]}, so it may not be the application's folder, and the environment file was written there all the same. Where the application stands in another folder, move the file into that folder: a local run reads the environment file from the folder it runs in.`;
 var outsideApplicationFolder = (io2, envFile) => APPLICATION_FOLDER_MARKS.every((mark) => {
   try {
-    return io2.stat(join8(dirname5(envFile), mark))?.folder !== false;
+    return io2.stat(join9(dirname5(envFile), mark))?.folder !== false;
   } catch {
     return false;
   }
@@ -6299,7 +6419,7 @@ var PROVISION_ROW = Object.freeze({
 });
 
 // src/turnzero_cloud_command/scaffold.ts
-import { basename as basename4, dirname as dirname6, isAbsolute as isAbsolute5, join as join9, relative as relative5, resolve as resolve11 } from "node:path";
+import { basename as basename4, dirname as dirname6, isAbsolute as isAbsolute5, join as join10, relative as relative6, resolve as resolve11 } from "node:path";
 
 // src/turnzero_cloud_command/scaffold_template.ts
 var SCAFFOLD_TEMPLATE_FILES = Object.freeze({
@@ -7750,7 +7870,13 @@ var SCAFFOLD_OPTIONS = Object.freeze([
     name: SCAFFOLD_OPTION.origin,
     value: "<origin>",
     required: false,
-    description: `The platform's address. Where absent, ${DEFAULT_COMMAND_ORIGIN}.`
+    description: `The platform's address. Under a template that takes library entries, where absent, the address ${ORIGIN_VARIABLE} holds, or ${DEFAULT_COMMAND_ORIGIN} where it is unset. There, under ${MINTED_TOKEN_VARIABLE} the token is sent only to the address ${ORIGIN_VARIABLE} holds, or to ${DEFAULT_COMMAND_ORIGIN} where it is unset. Otherwise it names the address whose token the command reads from this computer's credential file, and that token is sent to that address alone. Under a template that takes none, where absent, ${DEFAULT_COMMAND_ORIGIN}.`
+  },
+  {
+    name: SCAFFOLD_OPTION.application,
+    value: "<application id>",
+    required: false,
+    description: `Under every template, the application the service deploys to, by its id, a lowercase UUID, as create_application answers it. The written ${APPLICATION_MANIFEST} names it in its application member, which binds the folder to that application, so a deploy or check line naming another is refused. Where absent, the first deploy writes the member.`
   }
 ]);
 var EMPTY_PACKAGES = '"packages": []';
@@ -7777,6 +7903,7 @@ var NEITHER_LEFT = Object.freeze({ tools: "written", claude: false });
 var ROOT_TOOLS_STEP = `Add this sentence to ${TOOLS_FILE} at the project's root, which the scaffold did not change, so a coding tool started at the root reads ${APPLICATION_FOLDER}/${TOOLS_FILE}: ${ROOT_SENTENCE}`;
 var ROOT_TOOLS_FAILED_STEP = `Add this sentence to ${TOOLS_FILE} at the project's root, which the scaffold could not write, so a coding tool started at the root reads ${APPLICATION_FOLDER}/${TOOLS_FILE}: ${ROOT_SENTENCE}`;
 var ROOT_CLAUDE_STEP = `Add this sentence to ${CLAUDE_FILE} at the project's root, since Claude Code reads that file and then reads no ${TOOLS_FILE} by itself: ${ROOT_SENTENCE}`;
+var APPLICATION_FORM_REFUSAL = `${SCAFFOLD_OPTION.application} names the application the service deploys to, by its id, a lowercase UUID, as create_application answers it. ${NOTHING_WRITTEN2}`;
 var RESOURCE_REFUSAL = Object.freeze({
   /** A plural outside SCAFFOLD_NAME_FORM. */
   resourceForm: `${SCAFFOLD_OPTION.resource} takes the plural of the resource the service keeps, the word of its table and its route: an ASCII lower-case letter, then ASCII lower-case letters and digits, at most 30 characters, such as orders. ${NOTHING_WRITTEN2}`,
@@ -7787,11 +7914,17 @@ var RESOURCE_REFUSAL = Object.freeze({
   /** A plural that does not end in s, with no `--singular`. */
   noClosingS: `${SCAFFOLD_OPTION.resource} takes a plural that ends in s where the line names no ${SCAFFOLD_OPTION.singular}, since the singular is then the plural without its closing s: name the singular with ${SCAFFOLD_OPTION.singular}, such as ${SCAFFOLD_OPTION.resource} people ${SCAFFOLD_OPTION.singular} person. ${NOTHING_WRITTEN2}`,
   /** The plural `s` alone, with no `--singular`: its singular would be empty. */
-  emptySingular: `${SCAFFOLD_OPTION.resource} takes a plural longer than s alone where the line names no ${SCAFFOLD_OPTION.singular}, since the singular, the plural without its closing s, is never empty: name the singular with ${SCAFFOLD_OPTION.singular}, or a longer plural. ${NOTHING_WRITTEN2}`
+  emptySingular: `${SCAFFOLD_OPTION.resource} takes a plural longer than s alone where the line names no ${SCAFFOLD_OPTION.singular}, since the singular, the plural without its closing s, is never empty: name the singular with ${SCAFFOLD_OPTION.singular}, or a longer plural. ${NOTHING_WRITTEN2}`,
+  /** A singular, given or derived, of `json` (#5225): the resource's
+   *  invalid error, invalid_<singular>, would then be invalid_json, the
+   *  error of a body that does not parse, and a caller could no longer
+   *  tell the two apart (PLD-L0-106). */
+  jsonSingular: `${SCAFFOLD_OPTION.singular} takes a singular other than json, since the service answers invalid_json for a body that does not parse and invalid_ with the singular for a row it refuses: name another singular with ${SCAFFOLD_OPTION.singular}, such as ${SCAFFOLD_OPTION.resource} jsons ${SCAFFOLD_OPTION.singular} document. ${NOTHING_WRITTEN2}`
 });
 var RESOURCE_NONE_KEPT = `${SCAFFOLD_OPTION.resource} and ${SCAFFOLD_OPTION.singular} name the resource ${RESOURCE_TEMPLATES_NAMED} keep, and the template this line writes keeps none: leave them out, or name ${RESOURCE_TEMPLATE_CHOICES}. ${NOTHING_WRITTEN2}`;
 var UNKNOWN_TEMPLATE = `${SCAFFOLD_OPTION.template} names the template to write, and the command has no template of that name: it has ${listedAnd(SCAFFOLD_TEMPLATES)}, and it writes ${SCAFFOLD_DEFAULT_TEMPLATE} where the line names none. ${NOTHING_WRITTEN2}`;
 var ownRouteRefusal = (word) => `${SCAFFOLD_OPTION.resource} takes a plural other than ${word}, the word of a route the template serves itself: name another plural. ${NOTHING_WRITTEN2}`;
+var JSON_SINGULAR = "json";
 var resourceNamesOf = (call, template) => {
   const plural = call.named[SCAFFOLD_OPTION.resource];
   const singular = call.named[SCAFFOLD_OPTION.singular];
@@ -7802,10 +7935,11 @@ var resourceNamesOf = (call, template) => {
   if (singular !== void 0 && !SCAFFOLD_NAME_FORM.test(singular)) return { refusal: RESOURCE_REFUSAL.singularForm };
   const own = kept2.routes.find((word) => word === plural);
   if (own !== void 0) return { refusal: ownRouteRefusal(own) };
-  if (singular !== void 0) return { plural, singular };
+  if (singular !== void 0) return singular === JSON_SINGULAR ? { refusal: RESOURCE_REFUSAL.jsonSingular } : { plural, singular };
   if (!plural.endsWith("s")) return { refusal: RESOURCE_REFUSAL.noClosingS };
   if (plural.length === 1) return { refusal: RESOURCE_REFUSAL.emptySingular };
-  return { plural, singular: plural.slice(0, -1) };
+  const derived = plural.slice(0, -1);
+  return derived === JSON_SINGULAR ? { refusal: RESOURCE_REFUSAL.jsonSingular } : { plural, singular: derived };
 };
 var CARRIED_FIELDS = Object.freeze([Object.freeze({ name: "title", kind: "text" })]);
 var FIELD_KINDS_CLAUSE = `the kind ${orListed(SCAFFOLD_FIELD_KINDS)}`;
@@ -7857,10 +7991,12 @@ var scaffoldOptionsOf = (call, cwd) => {
   if (names !== null && "refusal" in names) return names;
   const fields = fieldsOf(call, template);
   if (fields !== null && "refusal" in fields) return fields;
+  const application = call.named[SCAFFOLD_OPTION.application];
+  if (application !== void 0 && !UPLOAD_ID.test(application)) return { refusal: APPLICATION_FORM_REFUSAL };
   const path = call.named[SCAFFOLD_OPTION.path];
   const origin = commandOriginOf(call.named[SCAFFOLD_OPTION.origin] ?? DEFAULT_COMMAND_ORIGIN);
   if ("refusal" in origin) return origin;
-  return { template, names, fields, root: resolve11(cwd, path ?? "."), named: path !== void 0, origin: origin.origin };
+  return { template, names, fields, root: resolve11(cwd, path ?? "."), named: path !== void 0, origin: origin.origin, application: application ?? null };
 };
 var capitalised = (name) => `${name.charAt(0).toUpperCase()}${name.slice(1)}`;
 var resourceFormsOf = (names) => [
@@ -8179,9 +8315,36 @@ var manifestWithMinute = (text, minute) => {
   if (!WRITTEN_MINUTE.test(String(minute))) throw new Error("a minute a run writes is a whole number from 0 to 59");
   return `${around[0]}${CRON_HEAD}${minute} ${around[1]}`;
 };
-var composedFilesOf = (files, rows, minute) => files.map(([path, text]) => [path, path === APPLICATION_MANIFEST ? manifestWithMinute(manifestWithPackages(text, rows), minute) : text]);
+var MANIFEST_VERSION_LINE = '  "manifest_version": 1,\n';
+var APPLICATION_LINE_OPEN = '  "application": "';
+var applicationLineOf = (application) => `${APPLICATION_LINE_OPEN}${application}",
+`;
+var manifestWithApplication = (text, application) => {
+  if (application === null) return text;
+  const around = text.split(MANIFEST_VERSION_LINE);
+  if (around.length !== 2) throw new Error("the template's manifest does not hold one manifest_version line");
+  return `${around[0]}${MANIFEST_VERSION_LINE}${applicationLineOf(application)}${around[1]}`;
+};
+var composedFilesOf = (files, rows, minute, application = null) => files.map(([path, text]) => [path, path === APPLICATION_MANIFEST ? manifestWithApplication(manifestWithMinute(manifestWithPackages(text, rows), minute), application) : text]);
+var APPLICATION_LINE_REST = 'hhhhhhhh-hhhh-hhhh-hhhh-hhhhhhhhhhhh",';
+var applicationLineRestPart = (text) => text.length <= APPLICATION_LINE_REST.length && [...text].every((character, index) => APPLICATION_LINE_REST[index] === "h" ? /^[0-9a-f]$/.test(character) : character === APPLICATION_LINE_REST[index]);
+var withoutApplicationLine = (staged, text) => {
+  const at = text.indexOf(MANIFEST_VERSION_LINE);
+  if (at < 0) return staged;
+  const head = text.slice(0, at + MANIFEST_VERSION_LINE.length);
+  if (staged.length <= head.length || !staged.startsWith(head)) return staged;
+  const rest = staged.slice(head.length);
+  if (APPLICATION_LINE_OPEN.startsWith(rest)) return true;
+  if (!rest.startsWith(APPLICATION_LINE_OPEN)) return staged;
+  const after = rest.slice(APPLICATION_LINE_OPEN.length);
+  const lineEnd = after.indexOf("\n");
+  if (lineEnd < 0) return applicationLineRestPart(after);
+  const line = after.slice(0, lineEnd);
+  if (line.length !== APPLICATION_LINE_REST.length || !applicationLineRestPart(line)) return false;
+  return `${head}${after.slice(lineEnd + 1)}`;
+};
 var inside2 = (parent, child) => {
-  const between = relative5(parent, child);
+  const between = relative6(parent, child);
   return between !== "" && !between.startsWith("..") && !isAbsolute5(between);
 };
 var ownManifestText = (staged, text) => {
@@ -8189,7 +8352,9 @@ var ownManifestText = (staged, text) => {
   if (around.length !== 2) return false;
   const carried = text.split(CARRIED_CRON);
   if (carried.length > 2) return false;
-  let read2 = staged;
+  const unbound = withoutApplicationLine(staged, text);
+  if (typeof unbound === "boolean") return unbound;
+  let read2 = unbound;
   if (carried.length === 2) {
     const head = `${carried[0]}${CRON_HEAD}`;
     if (read2.length > head.length) {
@@ -8223,18 +8388,18 @@ var ownStage = (io2, stage, files) => {
   const folders = new Set([...texts.keys()].flatMap((path) => path.split("/").slice(0, -1).map((_, index, segments) => segments.slice(0, index + 1).join("/"))));
   const own = (at, prefix) => (io2.listFolder(at) ?? []).every((name) => {
     const path = prefix === "" ? name : `${prefix}/${name}`;
-    const standing = io2.stat(join9(at, name));
+    const standing = io2.stat(join10(at, name));
     if (standing === null) return false;
-    if (standing.folder) return folders.has(path) && own(join9(at, name), path);
+    if (standing.folder) return folders.has(path) && own(join10(at, name), path);
     const text = texts.get(path);
-    return text !== void 0 && ownFile(io2, join9(at, name), standing.size, path, text);
+    return text !== void 0 && ownFile(io2, join10(at, name), standing.size, path, text);
   });
   return own(stage, "");
 };
-var danglingAt = (io2, folder, name) => io2.stat(join9(folder, name)) === null && (io2.listFolder(folder) ?? []).some((held) => held.toLowerCase() === name.toLowerCase() && io2.stat(join9(folder, held)) === null);
+var danglingAt = (io2, folder, name) => io2.stat(join10(folder, name)) === null && (io2.listFolder(folder) ?? []).some((held) => held.toLowerCase() === name.toLowerCase() && io2.stat(join10(folder, held)) === null);
 var standsAt = (io2, folder, name) => {
   try {
-    return io2.stat(join9(folder, name)) !== null || danglingAt(io2, folder, name);
+    return io2.stat(join10(folder, name)) !== null || danglingAt(io2, folder, name);
   } catch {
     return true;
   }
@@ -8269,8 +8434,8 @@ var folderRefusalOf = (io2, options, files, takeLines) => {
     }
     if (standing2 !== null || dirname6(at) === at) break;
   }
-  const app = join9(root, APPLICATION_FOLDER);
-  const stage = join9(root, STAGE_FOLDER);
+  const app = join10(root, APPLICATION_FOLDER);
+  const stage = join10(root, STAGE_FOLDER);
   const notOwn = STAGE_NOT_OWN;
   const standing = io2.stat(app);
   if (standing === null ? danglingAt(io2, root, APPLICATION_FOLDER) : !standing.folder) return [noFolderSentence(APPLICATION_FOLDER, "the scaffold writes the application")];
@@ -8379,7 +8544,7 @@ var nextStepLines = (origin, windows = LINES_IN_WINDOWS_FORM, left = NEITHER_LEF
 var writeTemplate = (io2, stage, app, files) => {
   io2.remove(stage);
   for (const [path, text] of files) {
-    const at = join9(stage, ...path.split("/"));
+    const at = join10(stage, ...path.split("/"));
     io2.makeFolder(dirname6(at));
     io2.writeFile(at, text);
   }
@@ -8392,7 +8557,7 @@ var writeTemplate = (io2, stage, app, files) => {
 };
 var writeRootSentence = (io2, root) => {
   try {
-    io2.writeNewFile(join9(root, TOOLS_FILE), `${ROOT_SENTENCE}
+    io2.writeNewFile(join10(root, TOOLS_FILE), `${ROOT_SENTENCE}
 `);
     return "written";
   } catch (error) {
@@ -8449,9 +8614,11 @@ async function scaffold(call, io2) {
   const { takes } = TEMPLATE_FACTS[template];
   const defaulted = call.named[SCAFFOLD_OPTION.template] === void 0;
   const files = writtenFilesOf(template, options.names, options.fields);
-  const app = join9(root, APPLICATION_FOLDER);
-  const stage = join9(root, STAGE_FOLDER);
-  const takeLines = takes.map((take) => machineLineOf(libraryTakeLineOf({ origin, entry: take.entry }), { windows: io2.windows ?? LINES_IN_WINDOWS_FORM, npx: ranThroughNpx(io2) }, origin));
+  const app = join10(root, APPLICATION_FOLDER);
+  const stage = join10(root, STAGE_FOLDER);
+  const takeLinesFor = (at) => takes.map((take) => machineLineOf(libraryTakeLineOf({ origin: at, entry: take.entry }), { windows: io2.windows ?? LINES_IN_WINDOWS_FORM, npx: ranThroughNpx(io2) }, at));
+  let lineOrigin = origin;
+  let takeLines = takeLinesFor(lineOrigin);
   let reached = "checks";
   const stateNow = () => {
     if (reached === "template") return "template";
@@ -8478,10 +8645,14 @@ async function scaffold(call, io2) {
       if ("lines" in found) return refuse(...found.lines);
       held = found;
     } else {
+      const credential = await readTakeCredential(io2, call.named[SCAFFOLD_OPTION.origin], SCAFFOLD_AFTER_LOGIN);
+      if ("lines" in credential) return refuse(...credential.lines);
+      lineOrigin = credential.origin;
+      takeLines = takeLinesFor(lineOrigin);
       for (const take of takes) {
-        const copy = join9(app, "lib", take.entry);
+        const copy = join10(app, "lib", take.entry);
         const planOf = (library) => writesOver(library, copy) ? { refusal: LIBRARY_OVER_APPLICATION } : { application: app, copy, declared: null, declaredAt: null };
-        const read2 = await readTake(io2, { entry: take.entry, root, named: options.named, origin }, agent.userAgent, planOf, checks.length > 0);
+        const read2 = await readTake(io2, { entry: take.entry, root, named: options.named, origin: credential.origin }, agent.userAgent, credential.bearer, planOf, checks.length > 0);
         if ("lines" in read2) return refuse(...read2.lines);
         if (read2.plan === null) {
           return refuse(`The ${take.entry} entry the library served carries no compiled modules, which the service's package file declares and installs. That is the platform's to fix: report it. ${NOTHING_WRITTEN2}`);
@@ -8502,7 +8673,7 @@ async function scaffold(call, io2) {
     reached = "writes";
     if (io2.stat(root) === null) io2.makeFolder(root);
     if (held.fresh) io2.makeFolder(held.library);
-    writeTemplate(io2, stage, app, composedFilesOf(files, held.packages, minute));
+    writeTemplate(io2, stage, app, composedFilesOf(files, held.packages, minute, options.application));
     reached = "template";
     const tools = toolsStands ? "stands" : writeRootSentence(io2, root);
     if (defaulted) io2.print(DEFAULT_TEMPLATE_LINE);
@@ -8514,7 +8685,7 @@ async function scaffold(call, io2) {
     release();
     if (ended) return COMMAND_STATUS.unknown;
     const taken = checks.map((check2, index) => ({ entry: takes[index].entry, version: check2.entry.version, line: takeLines[index] }));
-    return await installAndTest(io2, app, template, taken, origin, { tools, claude: claudeStands });
+    return await installAndTest(io2, app, template, taken, lineOrigin, { tools, claude: claudeStands });
   } catch (error) {
     const state = stateNow();
     const arrivedAs = error instanceof ApplicationArrived ? state : null;
@@ -8564,11 +8735,15 @@ async function installAndTest(io2, app, template, taken, origin, left) {
   for (const line of nextStepLines(origin, { windows: io2.windows ?? LINES_IN_WINDOWS_FORM, npx: ranThroughNpx(io2) }, left, template)) io2.print(line);
   return COMMAND_STATUS.done;
 }
+var SCAFFOLD_CREDENTIAL = LIBRARY_CREDENTIAL;
+var SCAFFOLD_READS = `under a template that takes library entries what library take reads, ${LIBRARY_READS}; and under a template that takes none, no credential`;
+var SCAFFOLD_AFTER_LOGIN = `Once ${LOGIN_SUBCOMMAND} has printed authorized:, run this scaffold line again. ${NOTHING_WRITTEN2}`;
 var SCAFFOLD_ROW = Object.freeze({
   name: SCAFFOLD_SUBCOMMAND,
-  summary: `Writes a new service from a template into a project, ${SCAFFOLD_DEFAULT_TEMPLATE} where the line names no ${SCAFFOLD_OPTION.template}. A template that takes library entries, as database-service takes the Database entry and web-app takes three, takes each as library take does, checking each file's SHA-256 and each entry's closure hash before it writes anything. It then writes the template's files under app/, the manifest's packages member filled from the library folder's rows, runs npm install and npm test there, and prints the next steps. It starts a new application and writes over none. It reads no credential.`,
+  summary: `Writes a new service from a template into a project, ${SCAFFOLD_DEFAULT_TEMPLATE} where the line names no ${SCAFFOLD_OPTION.template}. A template that takes library entries, as database-service takes the Database entry and web-app takes three, takes each as library take does, under the credential library take reads, checking each file's SHA-256 and each entry's closure hash before it writes anything. It then writes the template's files under app/, the manifest's packages member filled from the library folder's rows, runs npm install and npm test there, and prints the next steps. It starts a new application and writes over none. A template that takes no entry reads no credential.`,
   options: SCAFFOLD_OPTIONS,
-  credential: null,
+  credential: SCAFFOLD_CREDENTIAL,
+  reads: SCAFFOLD_READS,
   statuses: {
     done: "the files written and installed, the entries taken where the template takes any, and the tests passed",
     failed: "the files written, and npm install or the tests failed",
@@ -8577,6 +8752,7 @@ var SCAFFOLD_ROW = Object.freeze({
   },
   note: [
     `Run the ${SCAFFOLD_SUBCOMMAND} line at the root of a new project, or name the root with ${SCAFFOLD_OPTION.path}, which the command makes where it does not stand. A line that names no ${SCAFFOLD_OPTION.template} writes ${SCAFFOLD_DEFAULT_TEMPLATE}, which takes no library entry and makes no request, and says so in a line before the files it wrote. Under scheduled-job, the minute of the schedule's cron in the manifest is the minute of the hour, in UTC, at which the run started.`,
+    `With ${SCAFFOLD_OPTION.application}, the manifest names that application in its application member, on the line after manifest_version, which binds the folder to it before any deploy: a deploy or check line naming another application is refused. Where absent, the first deploy writes the member.`,
     `Under ${listedAnd(RESOURCE_TEMPLATES)}, with ${SCAFFOLD_OPTION.resource}, and ${SCAFFOLD_OPTION.singular} where the singular is not the plural without its closing s, it writes the same service under the resource's names, its table, its route, its functions, and its file names among them, and runs the tests on the files as written. It refuses, writing nothing, where the root's ${APPLICATION_FOLDER}/ holds any file or folder, and it takes no option that overwrites: where the template takes entries, its sentence names the ${LIBRARY_SUBCOMMAND} take line for each, which adds the package to an application that stands.`,
     `A root that holds neither ${LIBRARY_FOLDER}/ nor ${POINTER_FILE} takes a ${LIBRARY_FOLDER}/ of its own. Where the root holds no ${TOOLS_FILE}, it writes one of one sentence, which sends a coding tool to ${APPLICATION_FOLDER}/${TOOLS_FILE}; it changes no file that stands at the root, and where an ${TOOLS_FILE} or a ${CLAUDE_FILE} stands there it prints the sentence to add.`,
     `${SCAFFOLD_SUBCOMMAND} leaves ${COMMAND_CREDENTIAL_VARIABLES.join(" and ")} out of what npm install and npm test receive. An interrupt reaches npm, the command ends after it, and after an interrupted install the tests are not started. A signal that arrives after the command's first write and before npm starts is acted on once the writes are made: the command prints the way on, starts no npm, and ends with 128 and the signal's number.`,
@@ -8759,6 +8935,7 @@ var startErrorOf = (error) => {
 var HELD_SIGNALS = Object.freeze(["SIGINT", "SIGTERM", "SIGHUP"]);
 var endedStatusOf = (signal) => 128 + (constants2.signals[signal] ?? 0);
 var SIGNALS_PASS_ON = process.platform !== "win32";
+var CHILD_GROUPS = process.platform !== "win32";
 var passedOnSignalOf = (signal, interrupts, inputIsTerminal, passesOn = SIGNALS_PASS_ON) => {
   if (!passesOn) return null;
   if (signal !== "SIGINT") return signal;
@@ -8783,16 +8960,18 @@ var holdSignals = (signals, inputIsTerminal, passesOn, passOn, onInterrupt) => {
     for (const [signal, handler] of held) signals.off(signal, handler);
   };
 };
-var childRunnerOf = (signals, inputIsTerminal, passesOn = SIGNALS_PASS_ON) => (run) => new Promise((resolve12) => {
+var childRunnerOf = (signals, inputIsTerminal, passesOn = SIGNALS_PASS_ON, groups = CHILD_GROUPS) => (run) => new Promise((resolve12) => {
   const output = run.output;
   let interrupted = false;
+  const group = run.foreground === true && passesOn && groups;
   try {
     const child = spawn(run.command, [...run.args], {
       cwd: run.cwd,
       env: run.env,
       shell: run.shell ?? false,
       stdio: ["ignore", output ? "pipe" : "inherit", output ? "pipe" : "inherit"],
-      windowsHide: false
+      windowsHide: false,
+      detached: group
     });
     if (output) {
       child.stdout?.setEncoding("utf8").on("data", (chunk) => output(chunk, "stdout"));
@@ -8803,9 +8982,17 @@ var childRunnerOf = (signals, inputIsTerminal, passesOn = SIGNALS_PASS_ON) => (r
     if (run.foreground) {
       const release = holdSignals(
         signals,
-        inputIsTerminal(),
+        // A group of its own hears no terminal's interrupt, so the command hands on the first one too.
+        group ? false : inputIsTerminal(),
         passesOn,
         (signal) => {
+          if (group && child.pid !== void 0) {
+            try {
+              process.kill(-child.pid, signal);
+              return;
+            } catch {
+            }
+          }
           child.kill(signal);
         },
         () => {
@@ -9182,7 +9369,7 @@ async function runGuarded(argv2, io2) {
   if (parsed.kind === "refused") {
     say(carriesTokenCode(argv2) ? `${parsed.sentence} ${TOKEN_CODE_UNREAD}` : parsed.sentence);
     const npx = "ranThroughNpx" in io2 && io2.ranThroughNpx === true;
-    const help = npx ? npxFormOf(`${SERVED} --help`, io2.env[ORIGIN_VARIABLE] ?? DEFAULT_COMMAND_ORIGIN) : `${SERVED} --help`;
+    const help = npx ? npxFormOf(`${SERVED} --help`, originReadOf(io2.env[ORIGIN_VARIABLE])) : `${SERVED} --help`;
     say(`${io2.windows ?? ON_WINDOWS ? windowsLineOf(help) : help} prints the usage.`);
     return COMMAND_STATUS.nothing_started;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "turnzero",
-  "version": "0.18.3",
+  "version": "0.20.0-next.1",
   "type": "module",
   "description": "The Turn Zero Cloud command, which an AI coding tool runs on your machine to deploy an application, store a secret, upload a file, download an export, take a library entry, write a local run's settings, start the application locally, and scaffold a new service from a template.",
   "license": "Apache-2.0",