turnzero 0.20.0 → 0.21.0

package/dist/turnzero-cloud.mjs

@@ -185,6 +185,7 @@ var libraryTakeLineOf = (call) => commandLineOf(call.origin, LIBRARY_SUBCOMMAND,
 });
 var PROVISION_SUBCOMMAND = "provision";
 var PROVISION_OPTION = Object.freeze({ application: SECRET_OPTION.application, envFile: "--env-file", origin: DEPLOY_OPTION.origin });
+var PROVISION_CLAIM_FLAG = "--claim";
 var PROVISION_ACTION = SECRET_ACTION.rotate;
 var PROVISION_ENVIRONMENT = "development";
 var platformCredentialNameOf = (application) => `credential-${application}`;
@@ -1014,7 +1015,6 @@ var mintCallMembers = (kind, challenge, label) => kind === "authorized computer"
   [AUTHORIZED_COMPUTER_MEMBER, true],
   ["label", label]
 ] : [[CODE_CHALLENGE_MEMBER, challenge]];
-var firstActWayOn = (kind) => kind === "authorized computer" ? `Where the platform refuses ${CODE_CHALLENGE_MEMBER}, it does not yet serve this authorization: deploy by the line your tool's deploy call answers until the platform's next release.` : `Where the platform refuses ${CODE_CHALLENGE_MEMBER}, it does not yet serve this mint: until the platform's next release, ${MINT_TOKEN_ACTION} without it answers the token's value as it does today.`;
 var firstActNamed = (kind, origin = DEFAULT_COMMAND_ORIGIN) => `${kind === "authorized computer" ? AUTHORIZE_SUBCOMMAND : `${TOKEN_SUBCOMMAND} ${TOKEN_REQUEST_ACT}`}${originWordsOf(origin)}`;
 var noConnectionLine = (origin) => `Where your tool holds no connection signed in to ${origin}, ${MINT_TOKEN_ACTION} is not among its tools: a person connects the tool and signs in, in a browser, before the call.`;
 var loginWaySentence = (loginLines) => `A person can instead log this computer in themselves, in a terminal of their own, by running ${loginLines.join(", then ")}, and approving the login in the browser.`;
@@ -1027,8 +1027,7 @@ var firstActLines = (origin, kind, pending, label, loginLines = []) => [
   CALL_LINE_HEAD,
   ...mintCallMembers(kind, pending.challenge, label).map(([name, value]) => `  ${name}: ${JSON.stringify(value)}`),
   kind === "authorized computer" ? `The line keeps the token it mints in this computer's credential file and revokes the one this computer held there before. The token is account-scoped and works from any computer until it expires or revoke_token ends it, and list_tokens shows it by its label. The request is pending until ${pending.expires_at}: ${firstActNamed(kind, origin)} run again before then prints this challenge again.` : `It answers a ${TOKEN_SUBCOMMAND} ${TOKEN_CLAIM_ACT} line, which is yours to run in a terminal outside the AI coding tool, on this computer as this user, and never through the tool: it prints the token's value once to standard output, so pipe it into your secret store's command where the token is a job's. The request is pending until ${pending.expires_at}: ${firstActNamed(kind, origin)} run again before then prints this challenge again.`,
-  ...kind === "authorized computer" && loginLines.length > 0 ? [loginWaySentence(loginLines)] : [],
-  firstActWayOn(kind)
+  ...kind === "authorized computer" && loginLines.length > 0 ? [loginWaySentence(loginLines)] : []
 ];
 var reusedRequestSentence = (origin, pending) => `A request for ${origin} is pending until ${pending.expires_at}, so its challenge is printed again and no new verifier was made.`;
 var replacedRequestSentence = (origin, expired2) => `The request pending for ${origin} expired at ${expired2.expires_at}, so a new one replaces it: a line minted against the old challenge is refused at its exchange, and a ${MINT_TOKEN_ACTION} call naming the new challenge below answers a fresh one.`;
@@ -2679,7 +2678,6 @@ var isRecord = (value) => typeof value === "object" && value !== null && !Array.
 var ROOT_FILE_MAX_BYTES = 1024 * 1024;
 var MEMBER_FILE_MAX_BYTES = 64 * 1024;
 var MEMBER_FILES_READ_MAX = 50;
-var WINDOWS_ZIP_COMMAND = "tar.exe -a -c -f app.zip --exclude node_modules --exclude .env --exclude '.env.*' --exclude .git --exclude .claude --exclude .mcp.json --exclude .codex --exclude .cursor --exclude .gemini --exclude .continue --exclude .roo --exclude .kiro --exclude .amazonq --exclude .aider.conf.yml -C app .";
 function readArtifact(bytes) {
   const stored = [];
   const names = [];
@@ -2756,6 +2754,7 @@ function readArtifact(bytes) {
     records
   };
 }
+var WINDOWS_ZIP_STEP_ROUTE = "/cloud/getting-started/deploy-an-application/#3-build-and-upload-the-artifact";
 function entryRefusalDetail(refused) {
   const named = `The zip's entry ${shownEntry(refused.entry)} ${refused.reason}`;
   if (refused.cause === "file_and_folder") return `${named}, and the image build cannot write one path as both a file and a folder: remove one of the two entries, and deploy again`;
@@ -2763,7 +2762,7 @@ function entryRefusalDetail(refused) {
   if (refused.cause === "too_many_segments") return `${named}: deploy the application's own files alone, without node_modules or build caches, and deploy again`;
   const rule = "the image build takes an entry only as a relative path inside the zip's root, with / between its segments";
   if (refused.cause === "backslash") {
-    return `${named}, and ${rule}. Windows PowerShell's Compress-Archive writes a backslash there: build the zip with tar.exe from the folder that holds the application's folder, as in \`${WINDOWS_ZIP_COMMAND}\` where that folder is app, and deploy again`;
+    return `${named}, and the image build takes / alone between a name's segments. Windows PowerShell's Compress-Archive writes one: use the tar.exe command read_documentation page ${WINDOWS_ZIP_STEP_ROUTE} gives, and deploy again`;
   }
   return `${named}, and ${rule}: zip the contents of the folder that holds package.json with a tool that writes relative names, and deploy again`;
 }
@@ -6039,6 +6038,13 @@ var PROVISION_OPTIONS = Object.freeze([
     value: "<origin>",
     required: false,
     description: `The platform's address, which is also written as ${LOCAL_RUN_SETTING.api} and ${LOCAL_RUN_SETTING.gatewayUrl}. Where absent, ${DEFAULT_COMMAND_ORIGIN}; with no grant piped, the address ${ORIGIN_VARIABLE} holds where it is set. Under ${MINTED_TOKEN_VARIABLE} the token is sent only to the address ${ORIGIN_VARIABLE} holds, or to ${DEFAULT_COMMAND_ORIGIN} where it is unset. Otherwise, with no grant piped, it names the address whose token the command reads from this computer's credential file, and that token is sent to that address alone.`
+  },
+  {
+    name: PROVISION_CLAIM_FLAG,
+    value: "",
+    required: false,
+    flag: true,
+    description: `With no token for the address, presents this computer's pending verifier, the one the first act kept, as the credential of the provision grant the submit_manifest call recorded, so the line pipes nothing. Where the platform holds no such grant, the run prints the first act. Under a token it runs as the line without it does, and a grant piped beside it is refused.`
   }
 ]);
 var PROVISION_CREDENTIAL = Object.freeze({
@@ -6050,6 +6056,9 @@ var PROVISION_CREDENTIAL = Object.freeze({
   bare: `with nothing piped and neither token, it keeps a verifier and prints the challenge and the submit_manifest call naming local_run and ${CODE_CHALLENGE_MEMBER}, and a grant piped is presented with that verifier`
 });
 var NOTHING_REMINTED = "Nothing was re-minted, and the environment file is as it stood.";
+var CLAIM_FALLBACK_ERRORS = Object.freeze(["authentication_required", "secret_grant_not_admitted", "secret_grant_expired", "secret_grant_spent"]);
+var claimRefusedSentence = (origin, error) => `This computer's pending verifier was presented to ${origin}, which holds no provision grant it claims (${error}), so nothing was re-minted, and the first act follows.`;
+var CLAIM_BESIDE_GRANT_REFUSAL = `${PROVISION_CLAIM_FLAG} presents this computer's pending verifier in place of a grant, so a grant piped beside it is refused: run the line the submit_manifest call answered as given. ${NOTHING_REMINTED}`;
 var PROVISION_BARE_LINE_WORDS = commandLineOf(DEFAULT_COMMAND_ORIGIN, PROVISION_SUBCOMMAND, { options: [[PROVISION_OPTION.application, "<application id>"]] });
 var freshLineOf = (io2, application, origin, envFile) => provisionLineFor(io2, { origin, application, ...envFile !== void 0 ? { envFile } : {} });
 var freshLineSteps2 = (line) => `${line} with nothing piped, and where it prints a submit_manifest call, make that call from your tool and run the line it answers as given`;
@@ -6071,7 +6080,7 @@ var provisionOptionsOf = (call, cwd, stands = () => false) => {
   if ("refusal" in origin) return origin;
   const envFile = environmentFileOf(cwd, call.named[PROVISION_OPTION.envFile]);
   if (!environmentFileName(basename3(envFile))) return { refusal: envFileNameRefusalOf(stands(envFile)) };
-  return { application, envFile, origin: origin.origin };
+  return { application, envFile, origin: origin.origin, claim: call.flags.has(PROVISION_CLAIM_FLAG) };
 };
 var APPLICATION_FOLDER_MARKS = Object.freeze(["package.json", "manifest.json"]);
 var outsideApplicationWarningOf = (folder) => `warning: ${folder} holds neither ${APPLICATION_FOLDER_MARKS[0]} nor ${APPLICATION_FOLDER_MARKS[1]}, so it may not be the application's folder, and the environment file was written there all the same. Where the application stands in another folder, move the file into that folder: a local run reads the environment file from the folder it runs in.`;
@@ -6229,12 +6238,20 @@ async function provision(call, io2) {
       io2.print(noCredentialRefusal(PROVISION_CREDENTIAL, read2.unauthorized.origin, read2.unauthorized.expiredAt, ""));
       return COMMAND_STATUS.nothing_started;
     }
+    if (options.claim) {
+      const claimed2 = await claimRun(io2, call, options, agent.userAgent, standing.text, namedEnvFile, read2.unauthorized);
+      if (claimed2 !== null) return claimed2;
+    }
     return firstProvisionAct(io2, call, options.application, namedEnvFile, read2.unauthorized);
   }
   if ("refusal" in read2) {
     io2.print(read2.refusal);
     return COMMAND_STATUS.nothing_started;
   }
+  if (options.claim && read2.kind === "grant") {
+    io2.print(CLAIM_BESIDE_GRANT_REFUSAL);
+    return COMMAND_STATUS.nothing_started;
+  }
   if (read2.kind === "token") io2.hide(read2.credential, REDACTED_TOKEN);
   const where = credentialOriginOf(io2.env, read2, { named: call.named[PROVISION_OPTION.origin], closing: NOTHING_REMINTED });
   if ("refusal" in where) {
@@ -6242,9 +6259,31 @@ async function provision(call, io2) {
     return COMMAND_STATUS.nothing_started;
   }
   const sent = { ...options, origin: where.origin };
-  const again = freshLineOf(io2, options.application, sent.origin, namedEnvFile);
   const verifier = read2.kind === "grant" ? pendingVerifierOf(io2, sent.origin) : null;
-  const tried = tryEnvironmentFile(io2, options.envFile);
+  return remintRun(io2, sent, agent.userAgent, { credential: read2.credential, kind: read2.kind, verifier }, standing.text, namedEnvFile);
+}
+async function claimRun(io2, call, options, userAgent, standing, namedEnvFile, unauthorized) {
+  const origin = authorizationOriginOf(io2.env, call.named[PROVISION_OPTION.origin], NOTHING_REMINTED);
+  if ("refusal" in origin) {
+    io2.print(origin.refusal);
+    return COMMAND_STATUS.nothing_started;
+  }
+  const verifier = pendingVerifierOf(io2, origin.origin);
+  if (verifier === null) return null;
+  const sent = { ...options, origin: origin.origin };
+  return remintRun(
+    io2,
+    sent,
+    userAgent,
+    { credential: verifier, kind: "grant", verifier },
+    standing,
+    namedEnvFile,
+    () => firstProvisionAct(io2, call, options.application, namedEnvFile, unauthorized, true)
+  );
+}
+async function remintRun(io2, sent, userAgent, read2, standing, namedEnvFile, claimFallback) {
+  const again = freshLineOf(io2, sent.application, sent.origin, namedEnvFile);
+  const tried = tryEnvironmentFile(io2, sent.envFile);
   if ("unwritten" in tried) {
     io2.print(
       `The environment file could not be written (${tried.unwritten}): ${PROVISION_OPTION.envFile} names it, and it is ${ENVIRONMENT_FILE_NAME} in the folder the command runs in where the option is absent; its folder must stand. ${NOTHING_REMINTED}`
@@ -6254,7 +6293,7 @@ async function provision(call, io2) {
   const reminted = { database: "no", platform: "no" };
   const release = io2.whenEnded(() => {
     for (const line of signalEndedLines(reminted, read2.kind, again)) io2.print(line);
-    dropWritingFile(io2, options.envFile);
+    dropWritingFile(io2, sent.envFile);
   });
   try {
     const older = await planeWireRefusal(io2, sent.origin);
@@ -6262,10 +6301,10 @@ async function provision(call, io2) {
       io2.print(older);
       return COMMAND_STATUS.nothing_started;
     }
-    return await remintAndWrite(io2, sent, agent.userAgent, { ...read2, verifier, again, next: nextRunLineOf(io2, sent.origin, namedEnvFile) }, standing.text, reminted);
+    return await remintAndWrite(io2, sent, userAgent, { ...read2, again, next: nextRunLineOf(io2, sent.origin, namedEnvFile) }, standing, reminted, claimFallback);
   } finally {
     release();
-    dropWritingFile(io2, options.envFile);
+    dropWritingFile(io2, sent.envFile);
   }
 }
 var signalEndedLines = (reminted, kind, line) => {
@@ -6298,8 +6337,8 @@ var provisionFirstActLines = (origin, application, challenge, expiresAt, line) =
   `  ${CODE_CHALLENGE_MEMBER}: ${JSON.stringify(challenge)}`,
   `That line presents its grant with this computer's verifier, so a copy of it re-mints nothing elsewhere; it re-mints the development credentials and writes them into the environment file. The request is pending until ${expiresAt}: ${line} run again before then prints this challenge again.`
 ];
-async function firstProvisionAct(io2, call, application, envFile, unauthorized) {
-  io2.print(noTokenSentence(unauthorized.origin, unauthorized.expiredAt));
+async function firstProvisionAct(io2, call, application, envFile, unauthorized, afterClaim = false) {
+  if (!afterClaim) io2.print(noTokenSentence(unauthorized.origin, unauthorized.expiredAt));
   const origin = authorizationOriginOf(io2.env, call.named[PROVISION_OPTION.origin], NOTHING_REMINTED);
   if ("refusal" in origin) {
     io2.print(origin.refusal);
@@ -6318,7 +6357,7 @@ async function firstProvisionAct(io2, call, application, envFile, unauthorized)
   }
   return COMMAND_STATUS.done;
 }
-async function remintAndWrite(io2, { application, envFile, origin }, userAgent, read2, standing, reminted = { database: "no", platform: "no" }) {
+async function remintAndWrite(io2, { application, envFile, origin }, userAgent, read2, standing, reminted = { database: "no", platform: "no" }, claimFallback) {
   const untouched = (lines2) => {
     for (const line of [...lines2, NOTHING_REMINTED]) io2.print(line);
     return COMMAND_STATUS.nothing_started;
@@ -6329,6 +6368,10 @@ async function remintAndWrite(io2, { application, envFile, origin }, userAgent,
   };
   const database = await remint(io2, origin, read2.credential, userAgent, application, databaseCredentialNameOf(application), read2.verifier);
   reminted.database = database.kind === "answered" || database.kind === "unknown" ? database.kind : "no";
+  if (claimFallback !== void 0 && database.kind === "refused" && CLAIM_FALLBACK_ERRORS.includes(database.error)) {
+    io2.print(claimRefusedSentence(origin, database.error));
+    return claimFallback();
+  }
   if (database.kind === "unsent") return untouched(database.lines);
   if (database.kind === "unknown") return lost([...database.lines, remintUnknownSentence("database")]);
   const noDatabase = database.kind === "refused" && database.error === NO_DATABASE_ERROR && database.action === PROVISION_ACTION;
@@ -9166,7 +9209,7 @@ var SUBCOMMANDS = Object.freeze([
   WHOAMI_ROW
 ]);
 var SERVED = LINE_RUNNER;
-var NPX_FORM_SENTENCE = `Where the command is not installed, install it with ${installLineOf(DEFAULT_COMMAND_ORIGIN)}, or run the same line through npx: write ${commandRunnerOf("latest")} for ${LINE_RUNNER}, with next in place of latest on Turn Zero's development platform.`;
+var NPX_FORM_SENTENCE = `Where the command is not installed, install it with ${installLineOf(DEFAULT_COMMAND_ORIGIN)}, or run the same line through npx: write ${commandRunnerOf("latest")} for ${LINE_RUNNER}.`;
 var namedWithActs = (subcommand) => subcommand.acts ? `${subcommand.name} ${subcommand.acts.join("|")}` : subcommand.name;
 var shown = (option) => option.flag ? option.name : `${option.name} ${option.value}`;
 var listed = (names) => names.length < 3 ? names.join(" and ") : `${names.slice(0, -1).join(", ")}, and ${names[names.length - 1]}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "turnzero",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "type": "module",
   "description": "The Turn Zero Cloud command, which an AI coding tool runs on your machine to deploy an application, store a secret, upload a file, download an export, take a library entry, write a local run's settings, start the application locally, and scaffold a new service from a template.",
   "license": "Apache-2.0",