turnzero 0.19.0-next.1 → 0.20.0

package/README.md

@@ -23,7 +23,7 @@ Install it once with `npm install -g turnzero`, then run `turnzero login` once i
 - `run` starts your application on your computer with that file's settings.
 - `scaffold` writes a new service into your project from a template, installs it, and runs its tests.
 - `login` logs this computer in through your browser, `whoami` names the account its token acts as, and `logout` revokes its token.
-- `authorize` gives this computer a token through your tool, where you ask your tool to.
+- `authorize` gives this computer a token through your signed-in tool, which then tells you it did.
 - `token request` and `token claim` get a token for another computer or for an unattended run.
 
 Every subcommand's options, statuses, and output are on the reference page: https://turnzero.ai/cloud/reference/turnzero-command/

package/dist/turnzero-cloud.mjs

@@ -910,10 +910,14 @@ var variableReadSentence = (origin, standing) => {
 };
 var fileReadSentence = (origin) => `The credential this run read was this computer's token for ${origin}, from its credential file: where the platform no longer accepts it, run ${LOGIN_SUBCOMMAND}${originWordsOf(origin)} to authorize this computer again.`;
 var noTokenSentence = (origin, expiredAt) => expiredAt === null ? `No credential was read, so nothing was sent: ${MINTED_TOKEN_VARIABLE} is not set, and this computer's credential file holds no token for ${origin}.` : `No credential was read, so nothing was sent: ${MINTED_TOKEN_VARIABLE} is not set, and this computer's token for ${origin} in its credential file expired at ${expiredAt}.`;
-var VARIABLE_ROUTE_SENTENCES = `A tool connected by a minted token, or a job, sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, never by writing the value in a line, and ${ORIGIN_VARIABLE} to the address that minted the token where that is not ${DEFAULT_COMMAND_ORIGIN}, then runs the line again. Such a tool cannot use ${MINT_TOKEN_ACTION}, which takes a sign-in alone. A tool sets ${MINTED_TOKEN_VARIABLE} for the deploy or check line alone and unsets it once that line ends.`;
+var VARIABLE_ROUTE_SENTENCES = `A tool connected by a minted token, or a job, sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, never by writing the value in a line, and ${ORIGIN_VARIABLE} to the address that minted the token where that is not ${DEFAULT_COMMAND_ORIGIN}, then runs the line again. Such a tool cannot use ${MINT_TOKEN_ACTION}, which takes a sign-in alone. A tool sets ${MINTED_TOKEN_VARIABLE} for the deploy, check, take, or scaffold line alone and unsets it once that line ends.`;
 var LOGIN_ROUTE_OPENER = "A person logs this computer in once, in a terminal of their own, and its token then stays on this computer for 30 days:";
 var DEPLOY_FILES_ROUTE_SENTENCE = "A folder within the caps of your tool's deploy_files call deploys now through deploy_files, with no login.";
-var loginRouteLines = (io2, origin) => [LOGIN_ROUTE_OPENER, ...loginLinesFor(io2, origin), DEPLOY_FILES_ROUTE_SENTENCE];
+var loginRouteLines = (io2, origin, deployFiles = true) => [
+  LOGIN_ROUTE_OPENER,
+  ...loginLinesFor(io2, origin),
+  ...deployFiles ? [DEPLOY_FILES_ROUTE_SENTENCE] : []
+];
 var loginRouteRefusalOf = (io2, closing) => {
   const place = credentialFileOf(io2);
   const tag = runTagOf();
@@ -1369,7 +1373,7 @@ var AUTHORIZE_ROW = Object.freeze({
   },
   variables: [[ORIGIN_VARIABLE, AUTHORIZATION_ORIGIN_VARIABLE_LINE]],
   note: [
-    `Authorizing this computer takes three acts once for each platform address, where you ask your tool to authorize it; login, run in a terminal of your own, is your own way. ${AUTHORIZE_SUBCOMMAND} run with nothing piped prints a challenge and the ${MINT_TOKEN_ACTION} call to make; your tool makes that call through the connection you signed in with, and runs the line it answers once, as given, on this computer, which keeps the token.`,
+    `Authorizing this computer takes three acts once for each platform address, which your signed-in tool makes itself and then reports to you; login, run in a terminal of your own, is your own way. ${AUTHORIZE_SUBCOMMAND} run with nothing piped prints a challenge and the ${MINT_TOKEN_ACTION} call to make; your tool makes that call through the connection you signed in with, and runs the line it answers once, as given, on this computer, which keeps the token.`,
     `The token is account-scoped and works from any computer until it expires or revoke_token ends it: keep it as you would a password, list_tokens shows it by this computer's host name, and logout ends it. The credential file is ${CREDENTIAL_FILE_WORDS}.`
   ],
   afterOwnError: AUTHORIZE_AFTER_OWN_ERROR,
@@ -3794,7 +3798,7 @@ var DEPLOY_ROW = Object.freeze({
     `A deploy is one line, which carries no credential: run the line your tool's deploy call answers, or ${DEPLOY_SUBCOMMAND} ${DEPLOY_OPTION.application} <application id>, from the application's folder. It reads no standard input. On an authorized computer it runs under this computer's token, which ${LOGIN_SUBCOMMAND} or ${AUTHORIZE_SUBCOMMAND} keeps in the credential file for each platform address, and sends it only to the address it is kept under: ${DEPLOY_OPTION.origin} where the line names one, else the address ${ORIGIN_VARIABLE} holds, else ${DEFAULT_COMMAND_ORIGIN}.`,
     `On a computer with no token for that address, or one that has expired, it sends nothing, ends 3, and prints two routes, in this order. A tool connected by a minted token, or a job with no tool, such as a CI job's, sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, such as the job's secret store, never by writing the value in a line. It sets ${ORIGIN_VARIABLE} to the address that minted the token where that is not ${DEFAULT_COMMAND_ORIGIN}, then runs the deploy line again. Such a tool cannot use ${MINT_TOKEN_ACTION}, which takes a sign-in alone.`,
     `Otherwise a person logs this computer in once with ${LOGIN_SUBCOMMAND}, in a terminal of their own, then runs the deploy line again; a folder within the caps of the tool's deploy_files call deploys now through deploy_files, with no login. The credential file is ${CREDENTIAL_FILE_WORDS}.`,
-    `A tool sets ${MINTED_TOKEN_VARIABLE} for the deploy or check line alone and unsets it once that line ends, since the command cannot unset a variable of the shell that started it. A value a job's environment already supplies stays as it stands. A job's token is minted for the application, with an expiry. The variable's token wins over the credential file: the command makes the preparing call under that token, and sends the token in no other request.`,
+    `A tool sets ${MINTED_TOKEN_VARIABLE} for the deploy, check, take, or scaffold line alone and unsets it once that line ends, since the command cannot unset a variable of the shell that started it. A value a job's environment already supplies stays as it stands. A job's token is minted for the application, with an expiry. The variable's token wins over the credential file: the command makes the preparing call under that token, and sends the token in no other request.`,
     `Under the variable, the command sends its token only to the address ${ORIGIN_VARIABLE} holds, or to ${DEFAULT_COMMAND_ORIGIN} where that variable is unset: under the token, ${DEPLOY_OPTION.origin} may name that address alone, and where the line names none the command addresses it. ${DEPLOY_OPTION.env} names the environment where a line names one, ${COMMAND_ENVIRONMENTS.join(" or ")}; where none is named, the platform chooses, and the command deploys to the environment the platform answers.`,
     `A progress read answered 502, 503, or 504, which is often temporary, is made again, at most three more times, and an upload answered 503 credential_lookup_busy, which wrote nothing, is made again after the wait it names, at most twice.`,
     `After its zip line, ${DEPLOY_SUBCOMMAND} prints the folder's top-level entries the zip holds on one line, at most ten and then the count of the rest, and ${HASH_SUBCOMMAND} ${HASH_OPTION.list} names every file; no such line prints for a .zip file.`,
@@ -4845,10 +4849,38 @@ var LIBRARY_TAKE_OPTIONS = Object.freeze([
     name: LIBRARY_OPTION.origin,
     value: "<origin>",
     required: false,
-    description: `The platform's address. Where absent, ${DEFAULT_COMMAND_ORIGIN}.`
+    description: `The platform's address. Where absent, the address ${ORIGIN_VARIABLE} holds, or ${DEFAULT_COMMAND_ORIGIN} where it is unset. Under ${MINTED_TOKEN_VARIABLE} the token is sent only to the address ${ORIGIN_VARIABLE} holds, or to ${DEFAULT_COMMAND_ORIGIN} where it is unset. Otherwise it names the address whose token the command reads from this computer's credential file, and that token is sent to that address alone.`
   }
 ]);
 var NOTHING_WRITTEN2 = "Nothing was written.";
+var LIBRARY_CREDENTIAL = Object.freeze({
+  grant: "minted token",
+  aGrant: "a minted token",
+  call: `the ${LIBRARY_READ_ACTION} call`,
+  mintedToken: true,
+  piped: false,
+  places: `the command reads no standard input: it reads a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, as a tool connected by a minted token sets it from where its token is kept, or a job with no tool from its secret store, and otherwise this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write.`
+});
+var LIBRARY_READS = `no standard input: a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, and otherwise this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write, sent only to that address; with neither, it prints the variable route first and then, where the address is admitted, the login route`;
+var TAKE_AFTER_LOGIN = `Once ${LOGIN_SUBCOMMAND} has printed authorized:, run this take line again. ${NOTHING_WRITTEN2}`;
+var takeRedirectedLine = (status) => `${LIBRARY_READ_ACTION} was answered ${status >= 100 ? `${answeredHow(status)}, a redirect` : answeredHow(status)}, which the command never follows, so the credential was sent to no second address. ${NOTHING_WRITTEN2}`;
+async function readTakeCredential(io2, named, afterLogin) {
+  const line = { named, closing: NOTHING_WRITTEN2 };
+  const read2 = await readCredential(io2, LIBRARY_CREDENTIAL, "", line);
+  if ("unauthorized" in read2) {
+    const lines = [noTokenSentence(read2.unauthorized.origin, read2.unauthorized.expiredAt), VARIABLE_ROUTE_SENTENCES];
+    const origin = authorizationOriginOf(io2.env, named, NOTHING_WRITTEN2);
+    if ("refusal" in origin) return { lines: [...lines, origin.refusal] };
+    const unwritable = loginRouteRefusalOf(io2, NOTHING_WRITTEN2);
+    if (unwritable !== null) return { lines: [...lines, unwritable] };
+    return { lines: [...lines, ...loginRouteLines(io2, origin.origin, false), afterLogin] };
+  }
+  if ("refusal" in read2) return { lines: [read2.refusal] };
+  io2.hide(read2.credential, REDACTED_TOKEN);
+  const sent = credentialOriginOf(io2.env, read2, line);
+  if ("refusal" in sent) return { lines: [sent.refusal] };
+  return { bearer: read2.credential, origin: sent.origin };
+}
 var LINES_IN_WINDOWS_FORM = process.platform === "win32";
 var machineLineOf = (line, form = LINES_IN_WINDOWS_FORM, origin = DEFAULT_COMMAND_ORIGIN) => {
   const windows = typeof form === "boolean" ? form : form.windows;
@@ -5001,7 +5033,7 @@ var listedEntryOf = (answer, name) => {
   return { name, path, version, closure_hash: closure, files: listed2, source_commit: commit };
 };
 var LIST_READ = "The read of the entry's file list";
-var readOf = async (io2, origin, userAgent, body, what) => {
+var readOf = async (io2, origin, bearer, userAgent, body, what) => {
   let status;
   let text;
   try {
@@ -5010,10 +5042,15 @@ var readOf = async (io2, origin, userAgent, body, what) => {
       what,
       () => io2.fetch(`${origin}${LIBRARY_READ_PATH}`, {
         method: "POST",
-        headers: { "user-agent": userAgent, "content-type": "application/json" },
-        body: JSON.stringify(body)
+        headers: { authorization: `Bearer ${bearer}`, "user-agent": userAgent, "content-type": "application/json" },
+        body: JSON.stringify(body),
+        redirect: "manual"
       })
     );
+    if (redirected(response)) {
+      await response.body?.cancel().catch(() => void 0);
+      return { lines: [takeRedirectedLine(response.status)] };
+    }
     status = response.status;
     text = await response.text();
   } catch {
@@ -5026,14 +5063,14 @@ var readOf = async (io2, origin, userAgent, body, what) => {
   if (status >= PLATFORM_FAILURE_STATUS) return { lines: [...failureLines(LIBRARY_READ_ACTION, status, refusal), NOTHING_WRITTEN2] };
   return { lines: [...refusalLines(LIBRARY_READ_ACTION, status, refusal), NOTHING_WRITTEN2] };
 };
-var fileBytesOf = async (io2, origin, userAgent, name, file) => {
+var fileBytesOf = async (io2, origin, bearer, userAgent, name, file) => {
   const shown2 = `${LIBRARY_FOLDER}/${shownName(file.path)}`;
   let text = "";
   let encoding = null;
   let offset = 0;
   let stamp = null;
   for (; ; ) {
-    const read2 = await readOf(io2, origin, userAgent, { name, file: file.path, limit: LIBRARY_READ_CHUNK, ...stamp !== null ? { offset, stamp } : {} }, `The read of ${shown2}`);
+    const read2 = await readOf(io2, origin, bearer, userAgent, { name, file: file.path, limit: LIBRARY_READ_CHUNK, ...stamp !== null ? { offset, stamp } : {} }, `The read of ${shown2}`);
     if ("lines" in read2) return { lines: [`${shown2}: the read stopped.`, ...read2.lines] };
     const chunk = read2.answer.file;
     const next = chunk?.next_offset;
@@ -5258,7 +5295,7 @@ var COPY_PACKAGES_CLAUSE = "copy the packages line into the application manifest
 var KEEP_PACKAGES_CLAUSE = "the application manifest was written whole, so read it again before patching it, and carry its packages member over in any later rewrite; ";
 var installFailedSentence = (folder) => `npm install in ${folder} did not finish: the entry, its row, and the copy are written. Run npm install there again; running this line again takes the entry again whole.`;
 var LIBRARY_AFTER_OWN_ERROR = "the entry's folder, its manifest row, or the application's copy may stand in part, and running the line again replaces each whole";
-async function readTake(io2, options, userAgent, planOf, planeChecked = false) {
+async function readTake(io2, options, userAgent, bearer, planOf, planeChecked = false) {
   const refuse = (...lines) => ({ lines });
   const found = libraryFolderOf(io2, options.root);
   if ("refusal" in found) return refuse(found.refusal);
@@ -5278,7 +5315,7 @@ async function readTake(io2, options, userAgent, planOf, planeChecked = false) {
     const older = await planeWireRefusal(io2, options.origin);
     if (older !== null) return refuse(older);
   }
-  const list = await readOf(io2, options.origin, userAgent, { name: options.entry }, LIST_READ);
+  const list = await readOf(io2, options.origin, bearer, userAgent, { name: options.entry }, LIST_READ);
   if ("lines" in list) return refuse(...list.lines);
   const entry = listedEntryOf(list.answer, options.entry);
   if ("refusal" in entry) return refuse(entry.refusal);
@@ -5300,7 +5337,7 @@ async function readTake(io2, options, userAgent, planOf, planeChecked = false) {
   if (staged !== null) return refuse(staged);
   const bytes = /* @__PURE__ */ new Map();
   for (const file of entry.files) {
-    const read2 = await fileBytesOf(io2, options.origin, userAgent, entry.name, file);
+    const read2 = await fileBytesOf(io2, options.origin, bearer, userAgent, entry.name, file);
     if ("lines" in read2) return refuse(...read2.lines);
     const actual = sha256(read2.bytes);
     if (actual !== file.sha256) return refuse(`${LIBRARY_FOLDER}/${shownName(file.path)}: SHA-256 ${actual} is not the listed value ${file.sha256}. ${NOTHING_WRITTEN2}`);
@@ -5408,7 +5445,9 @@ async function libraryTake(call, io2) {
   }
   const fromApplication = applicationFolderRefusalOf(io2, options);
   if (fromApplication !== null) return refuse(fromApplication);
-  const checked = await readTake(io2, options, agent.userAgent, (library, name) => copyPlanOf(io2, options.root, library, name));
+  const held = await readTakeCredential(io2, call.named[LIBRARY_OPTION.origin], TAKE_AFTER_LOGIN);
+  if ("lines" in held) return refuse(...held.lines);
+  const checked = await readTake(io2, { ...options, origin: held.origin }, agent.userAgent, held.bearer, (library, name) => copyPlanOf(io2, options.root, library, name));
   if ("lines" in checked) return refuse(...checked.lines);
   const application = applicationManifestOf(io2, options.root, checked.library, checked.plan?.application ?? applicationFolderOf(io2, options.root));
   if ("refusal" in application) return refuse(application.refusal);
@@ -5419,9 +5458,10 @@ async function libraryTake(call, io2) {
 var LIBRARY_ROW = Object.freeze({
   name: LIBRARY_SUBCOMMAND,
   acts: LIBRARY_ACTS,
-  summary: "Takes a library entry into the project: reads its files from the library, checks each file's SHA-256 and the entry's closure hash, then writes its row in the library folder's manifest.json and replaces the entry's folder under that folder whole. For an entry with compiled modules it copies its package.json and lib/ into the application's folder, declares the copy where it is not declared, and runs npm install there. It reads no credential.",
+  summary: "Takes a library entry into the project: reads its files from the library, checks each file's SHA-256 and the entry's closure hash, then writes its row in the library folder's manifest.json and replaces the entry's folder under that folder whole. For an entry with compiled modules it copies its package.json and lib/ into the application's folder, declares the copy where it is not declared, and runs npm install there. It reads under the credential check reads. With no credential, it sends nothing and prints the two routes to one, as check does.",
   options: LIBRARY_TAKE_OPTIONS,
-  credential: null,
+  credential: LIBRARY_CREDENTIAL,
+  reads: LIBRARY_READS,
   statuses: {
     done: "the entry taken, and installed where it carries compiled modules",
     failed: "the entry, its row, and the copy written, and npm install failed or the application manifest's packages was not written",
@@ -5808,6 +5848,7 @@ var whoamiLinesOf = (origin, account, entry) => [
   `${WHOAMI_LINE_HEADS.token}label ${entry.label !== null ? JSON.stringify(entry.label) : "none"}, expiring ${entry.expires_at !== null ? `at ${entry.expires_at}` : "never"}`
 ];
 var noComputerTokenSentence = (origin, expiredAt) => expiredAt === null ? `This computer's credential file holds no token for ${origin}, so nothing was sent.` : `This computer's token for ${origin} in its credential file expired at ${expiredAt}, so nothing was sent.`;
+var noLoginRoutesSentence = (origin) => `Your AI coding tool's own sign-in is not this computer's credential. With no login, deploy_files deploys a folder within its caps, ${AUTHORIZE_SUBCOMMAND}${originWordsOf(origin)} run with nothing piped prints the ${MINT_TOKEN_ACTION} call a signed-in tool makes to authorize this computer, and ${PROVISION_SUBCOMMAND}${originWordsOf(origin)} run so prints the call that answers its line.`;
 var whoamiAfterLoginSentence = (whoami2) => `Once login has printed authorized:, run ${whoami2} again.`;
 async function whoami(call, io2) {
   const origin = entryOriginOf(io2.env, call.named[DEPLOY_OPTION.origin], NOTHING_SENT_OR_READ);
@@ -5831,6 +5872,7 @@ async function whoami(call, io2) {
   const expired2 = entry !== void 0 && entry.expires_at !== null && Date.parse(entry.expires_at) <= io2.clock().getTime();
   if (entry === void 0 || expired2) {
     io2.print(noComputerTokenSentence(origin.origin, entry === void 0 ? null : entry.expires_at));
+    io2.print(noLoginRoutesSentence(origin.origin));
     const reached = authorizationOriginOf(io2.env, call.named[DEPLOY_OPTION.origin], NOTHING_SENT_OR_READ);
     if ("refusal" in reached) {
       io2.print(reached.refusal);
@@ -5861,7 +5903,7 @@ async function whoami(call, io2) {
 }
 var WHOAMI_ROW = Object.freeze({
   name: WHOAMI_SUBCOMMAND,
-  summary: `Names the account this computer's token acts as at the platform's address: it reads the token the credential file keeps for the address and makes one ${READ_ACCOUNT_ACTION} call under it. It prints the address, the account's sign-in address and id, and the token's label and expiry. With no token for the address, it sends nothing and prints the login route. It prints no token.`,
+  summary: `Names the account this computer's token acts as at the platform's address: it reads the token the credential file keeps for the address and makes one ${READ_ACCOUNT_ACTION} call under it. It prints the address, the account's sign-in address and id, and the token's label and expiry. With no token for the address, it sends nothing, names the ways on with no login (deploy_files, ${AUTHORIZE_SUBCOMMAND}, and ${PROVISION_SUBCOMMAND}), and then prints the login route. It prints no token.`,
   options: WHOAMI_OPTIONS,
   credential: null,
   reads: "this computer's token for the origin from its credential file, never a minted token from TURNZERO_CLOUD_MINTED_TOKEN, and sends it only to that origin",
@@ -5869,7 +5911,7 @@ var WHOAMI_ROW = Object.freeze({
     done: "the account was read",
     failed: "the platform refused the read, where it no longer accepts the token among other causes: the printed lines name login",
     unknown: "the read drew no answer, or an answer that is not a refusal",
-    nothing_started: "nothing was read: an option or the credential file was refused, the platform was too old, or no live token stands for the address, and the printed lines give the login route"
+    nothing_started: "nothing was read: an option or the credential file was refused, the platform was too old, or no live token stands for the address, and the printed lines name the ways on with no login, then the login route"
   },
   variables: [[ORIGIN_VARIABLE, `the platform's address whose token is read where the line names no ${DEPLOY_OPTION.origin}.`]],
   note: [`${WHOAMI_SUBCOMMAND} reads which account a login or an authorize on this computer kept a token for, so you can tell it from your tool's own connection. The credential file is ${CREDENTIAL_FILE_WORDS}.`],
@@ -7828,7 +7870,7 @@ var SCAFFOLD_OPTIONS = Object.freeze([
     name: SCAFFOLD_OPTION.origin,
     value: "<origin>",
     required: false,
-    description: `The platform's address. Where absent, ${DEFAULT_COMMAND_ORIGIN}.`
+    description: `The platform's address. Under a template that takes library entries, where absent, the address ${ORIGIN_VARIABLE} holds, or ${DEFAULT_COMMAND_ORIGIN} where it is unset. There, under ${MINTED_TOKEN_VARIABLE} the token is sent only to the address ${ORIGIN_VARIABLE} holds, or to ${DEFAULT_COMMAND_ORIGIN} where it is unset. Otherwise it names the address whose token the command reads from this computer's credential file, and that token is sent to that address alone. Under a template that takes none, where absent, ${DEFAULT_COMMAND_ORIGIN}.`
   },
   {
     name: SCAFFOLD_OPTION.application,
@@ -8574,7 +8616,9 @@ async function scaffold(call, io2) {
   const files = writtenFilesOf(template, options.names, options.fields);
   const app = join10(root, APPLICATION_FOLDER);
   const stage = join10(root, STAGE_FOLDER);
-  const takeLines = takes.map((take) => machineLineOf(libraryTakeLineOf({ origin, entry: take.entry }), { windows: io2.windows ?? LINES_IN_WINDOWS_FORM, npx: ranThroughNpx(io2) }, origin));
+  const takeLinesFor = (at) => takes.map((take) => machineLineOf(libraryTakeLineOf({ origin: at, entry: take.entry }), { windows: io2.windows ?? LINES_IN_WINDOWS_FORM, npx: ranThroughNpx(io2) }, at));
+  let lineOrigin = origin;
+  let takeLines = takeLinesFor(lineOrigin);
   let reached = "checks";
   const stateNow = () => {
     if (reached === "template") return "template";
@@ -8601,10 +8645,14 @@ async function scaffold(call, io2) {
       if ("lines" in found) return refuse(...found.lines);
       held = found;
     } else {
+      const credential = await readTakeCredential(io2, call.named[SCAFFOLD_OPTION.origin], SCAFFOLD_AFTER_LOGIN);
+      if ("lines" in credential) return refuse(...credential.lines);
+      lineOrigin = credential.origin;
+      takeLines = takeLinesFor(lineOrigin);
       for (const take of takes) {
         const copy = join10(app, "lib", take.entry);
         const planOf = (library) => writesOver(library, copy) ? { refusal: LIBRARY_OVER_APPLICATION } : { application: app, copy, declared: null, declaredAt: null };
-        const read2 = await readTake(io2, { entry: take.entry, root, named: options.named, origin }, agent.userAgent, planOf, checks.length > 0);
+        const read2 = await readTake(io2, { entry: take.entry, root, named: options.named, origin: credential.origin }, agent.userAgent, credential.bearer, planOf, checks.length > 0);
         if ("lines" in read2) return refuse(...read2.lines);
         if (read2.plan === null) {
           return refuse(`The ${take.entry} entry the library served carries no compiled modules, which the service's package file declares and installs. That is the platform's to fix: report it. ${NOTHING_WRITTEN2}`);
@@ -8637,7 +8685,7 @@ async function scaffold(call, io2) {
     release();
     if (ended) return COMMAND_STATUS.unknown;
     const taken = checks.map((check2, index) => ({ entry: takes[index].entry, version: check2.entry.version, line: takeLines[index] }));
-    return await installAndTest(io2, app, template, taken, origin, { tools, claude: claudeStands });
+    return await installAndTest(io2, app, template, taken, lineOrigin, { tools, claude: claudeStands });
   } catch (error) {
     const state = stateNow();
     const arrivedAs = error instanceof ApplicationArrived ? state : null;
@@ -8687,11 +8735,15 @@ async function installAndTest(io2, app, template, taken, origin, left) {
   for (const line of nextStepLines(origin, { windows: io2.windows ?? LINES_IN_WINDOWS_FORM, npx: ranThroughNpx(io2) }, left, template)) io2.print(line);
   return COMMAND_STATUS.done;
 }
+var SCAFFOLD_CREDENTIAL = LIBRARY_CREDENTIAL;
+var SCAFFOLD_READS = `under a template that takes library entries what library take reads, ${LIBRARY_READS}; and under a template that takes none, no credential`;
+var SCAFFOLD_AFTER_LOGIN = `Once ${LOGIN_SUBCOMMAND} has printed authorized:, run this scaffold line again. ${NOTHING_WRITTEN2}`;
 var SCAFFOLD_ROW = Object.freeze({
   name: SCAFFOLD_SUBCOMMAND,
-  summary: `Writes a new service from a template into a project, ${SCAFFOLD_DEFAULT_TEMPLATE} where the line names no ${SCAFFOLD_OPTION.template}. A template that takes library entries, as database-service takes the Database entry and web-app takes three, takes each as library take does, checking each file's SHA-256 and each entry's closure hash before it writes anything. It then writes the template's files under app/, the manifest's packages member filled from the library folder's rows, runs npm install and npm test there, and prints the next steps. It starts a new application and writes over none. It reads no credential.`,
+  summary: `Writes a new service from a template into a project, ${SCAFFOLD_DEFAULT_TEMPLATE} where the line names no ${SCAFFOLD_OPTION.template}. A template that takes library entries, as database-service takes the Database entry and web-app takes three, takes each as library take does, under the credential library take reads, checking each file's SHA-256 and each entry's closure hash before it writes anything. It then writes the template's files under app/, the manifest's packages member filled from the library folder's rows, runs npm install and npm test there, and prints the next steps. It starts a new application and writes over none. A template that takes no entry reads no credential.`,
   options: SCAFFOLD_OPTIONS,
-  credential: null,
+  credential: SCAFFOLD_CREDENTIAL,
+  reads: SCAFFOLD_READS,
   statuses: {
     done: "the files written and installed, the entries taken where the template takes any, and the tests passed",
     failed: "the files written, and npm install or the tests failed",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "turnzero",
-  "version": "0.19.0-next.1",
+  "version": "0.20.0",
   "type": "module",
   "description": "The Turn Zero Cloud command, which an AI coding tool runs on your machine to deploy an application, store a secret, upload a file, download an export, take a library entry, write a local run's settings, start the application locally, and scaffold a new service from a template.",
   "license": "Apache-2.0",