turnzero 0.24.0 → 0.25.0

package/dist/turnzero-cloud.mjs

@@ -928,7 +928,7 @@ var fileReadSentence = (origin) => `The credential this run read was this comput
 var noTokenSentence = (origin, expiredAt) => expiredAt === null ? `No credential was read, so nothing was sent: ${MINTED_TOKEN_VARIABLE} is not set, and this computer's credential file holds no token for ${origin}.` : `No credential was read, so nothing was sent: ${MINTED_TOKEN_VARIABLE} is not set, and this computer's token for ${origin} in its credential file expired at ${expiredAt}.`;
 var VARIABLE_ROUTE_SENTENCES = variableRouteSentencesOf("runs the line again");
 function variableRouteSentencesOf(then) {
-  return `A tool connected by a minted token, or a job, sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, never by writing the value in a line, and ${ORIGIN_VARIABLE} to the address that minted the token where that is not ${DEFAULT_COMMAND_ORIGIN}, then ${then}. Such a tool cannot use ${MINT_TOKEN_ACTION}, which takes a sign-in alone. A tool sets ${MINTED_TOKEN_VARIABLE} for the deploy, check, take, or scaffold line alone and unsets it once that line ends.`;
+  return `A tool connected by a minted token, or a job, sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, never by writing the value in a line, and ${ORIGIN_VARIABLE} to the address that minted the token where that is not ${DEFAULT_COMMAND_ORIGIN}, then ${then}. Such a tool cannot use ${MINT_TOKEN_ACTION}, which takes a sign-in alone. A tool sets ${MINTED_TOKEN_VARIABLE} for one line at a time and unsets it once that line ends.`;
 }
 var LOGIN_ROUTE_OPENER = "A person logs this computer in once, in a terminal of their own, and its token then stays on this computer for 30 days:";
 var DEPLOY_FILES_ROUTE_SENTENCE = "A folder within the caps of your tool's deploy_files call deploys now through deploy_files, with no login.";
@@ -3947,7 +3947,7 @@ var DEPLOY_ROW = Object.freeze({
     `A deploy is one line, which carries no credential: run the line your tool's deploy call answers, or ${DEPLOY_SUBCOMMAND} ${DEPLOY_OPTION.application} <application id>, from the application's folder. It reads no standard input. On an authorized computer it runs under this computer's token, which ${LOGIN_SUBCOMMAND} or ${AUTHORIZE_SUBCOMMAND} keeps in the credential file for each platform address, and sends it only to the address it is kept under: ${DEPLOY_OPTION.origin} where the line names one, else the address ${ORIGIN_VARIABLE} holds, else ${DEFAULT_COMMAND_ORIGIN}.`,
     `On a computer with no token for that address, or one that has expired, it sends nothing, ends 3, and prints two routes, in this order. A tool connected by a minted token, or a job with no tool, such as a CI job's, sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, such as the job's secret store, never by writing the value in a line. It sets ${ORIGIN_VARIABLE} to the address that minted the token where that is not ${DEFAULT_COMMAND_ORIGIN}, then runs the deploy line again. Such a tool cannot use ${MINT_TOKEN_ACTION}, which takes a sign-in alone.`,
     `Otherwise a person logs this computer in once with ${LOGIN_SUBCOMMAND}, in a terminal of their own, then runs the deploy line again; a folder within the caps of the tool's deploy_files call deploys now through deploy_files, with no login. The credential file is ${CREDENTIAL_FILE_WORDS}.`,
-    `A tool sets ${MINTED_TOKEN_VARIABLE} for the deploy, check, take, or scaffold line alone and unsets it once that line ends, since the command cannot unset a variable of the shell that started it. A value a job's environment already supplies stays as it stands. A job's token is minted for the application, with an expiry. The variable's token wins over the credential file: the command makes the preparing call under that token, and sends the token in no other request.`,
+    `A tool sets ${MINTED_TOKEN_VARIABLE} for one line at a time and unsets it once that line ends, since the command cannot unset a variable of the shell that started it. A value a job's environment already supplies stays as it stands. A job's token is minted for the application, with an expiry. The variable's token wins over the credential file: the command makes the preparing call under that token, and sends the token in no other request.`,
     `Under the variable, the command sends its token only to the address ${ORIGIN_VARIABLE} holds, or to ${DEFAULT_COMMAND_ORIGIN} where that variable is unset: under the token, ${DEPLOY_OPTION.origin} may name that address alone, and where the line names none the command addresses it. ${DEPLOY_OPTION.env} names the environment where a line names one, ${COMMAND_ENVIRONMENTS.join(" or ")}; where none is named, the platform chooses, and the command deploys to the environment the platform answers.`,
     `A progress read answered 502, 503, or 504, which is often temporary, is made again, at most three more times, and an upload answered 503 credential_lookup_busy, which wrote nothing, is made again after the wait it names, at most twice.`,
     `After its zip line, ${DEPLOY_SUBCOMMAND} prints the folder's top-level entries the zip holds on one line, at most ten and then the count of the rest, and ${HASH_SUBCOMMAND} ${HASH_OPTION.list} names every file; no such line prints for a .zip file.`,
@@ -3979,6 +3979,7 @@ var checkAnswerUnusable = (status) => `The check call was answered HTTP ${status
 var CHECK_AGAIN = `${NOTHING_CHECKED} Run the line again.`;
 var CHECK_RATE_CAPPED = `${NOTHING_CHECKED} Run the line again after the wait the answer names.`;
 var CHECK_AFTER_LOGIN = `Once login has printed authorized:, run this check line again. ${NOTHING_SENT_OR_CHECKED}`;
+var checkHashSentenceOf = (io2, path, origin) => `Before any sign-in, ${printedLineOf(io2, commandLineOf(origin, HASH_SUBCOMMAND, path === void 0 ? {} : { path }), origin)} builds the same zip and prints the same warnings: it needs no credential and sends nothing, though only check runs the deploy's checks of the zip.`;
 var NO_APPLICATION_YET = "Where no application exists yet, call create_application from your tool first: the check reads that application's state on the platform beside the folder.";
 var checkOptionsOf = (named, cwd) => {
   const application = named[CHECK_OPTION.application];
@@ -4141,6 +4142,7 @@ async function check(named, io2) {
       return COMMAND_STATUS.nothing_started;
     }
     for (const line of loginRouteLines(io2, origin2.origin)) io2.print(line);
+    io2.print(checkHashSentenceOf(io2, named[CHECK_OPTION.path], origin2.origin));
     io2.print(CHECK_AFTER_LOGIN);
     return COMMAND_STATUS.nothing_started;
   }
@@ -6186,7 +6188,7 @@ var PROVISION_OPTIONS = Object.freeze([
     name: PROVISION_OPTION.envFile,
     value: "<file>",
     required: false,
-    description: `The environment file to write, named ${ENVIRONMENT_FILE_NAME} or ${ENVIRONMENT_FILE_NAME}.<name>, the names every zip the command builds leaves out. Where absent, ${ENVIRONMENT_FILE_NAME} in the folder the command runs in. An existing file keeps every line the command does not set.`
+    description: `The environment file to write, named ${ENVIRONMENT_FILE_NAME} or ${ENVIRONMENT_FILE_NAME}.<name>, the names every zip the command builds leaves out. Where absent, ${ENVIRONMENT_FILE_NAME} in the folder the command runs in. A path outside that folder, such as ../${ENVIRONMENT_FILE_NAME}.turnzero, is admitted, so the credentials can stay out of the project. An existing file keeps every line the command does not set.`
   },
   {
     name: PROVISION_OPTION.origin,
@@ -6239,7 +6241,7 @@ var provisionOptionsOf = (call, cwd, stands = () => false) => {
   return { application, envFile, origin: origin.origin, claim: call.flags.has(PROVISION_CLAIM_FLAG) };
 };
 var APPLICATION_FOLDER_MARKS = Object.freeze(["package.json", "manifest.json"]);
-var outsideApplicationWarningOf = (folder) => `warning: ${folder} holds neither ${APPLICATION_FOLDER_MARKS[0]} nor ${APPLICATION_FOLDER_MARKS[1]}, so it may not be the application's folder, and the environment file was written there all the same. Where the application stands in another folder, move the file into that folder: a local run reads the environment file from the folder it runs in.`;
+var outsideApplicationWarningOf = (folder) => `warning: ${folder} holds neither ${APPLICATION_FOLDER_MARKS[0]} nor ${APPLICATION_FOLDER_MARKS[1]}, so it may not be the application's folder, and the environment file was written there all the same. A local run reads the environment file from the folder it runs in unless its line names one with ${PROVISION_OPTION.envFile}: move the file into the application's folder, or name it on the line that starts the run.`;
 var outsideApplicationFolder = (io2, envFile) => APPLICATION_FOLDER_MARKS.every((mark) => {
   try {
     return io2.stat(join9(dirname5(envFile), mark))?.folder !== false;
@@ -6632,7 +6634,7 @@ var SCAFFOLD_TEMPLATE_FILES = Object.freeze({
     ["AGENTS.md", [
       "# This service runs on Turn Zero Cloud",
       "",
-      "The service in this folder is hosted on Turn Zero Cloud. It started from the platform's `database-service` template: a Node.js service that keeps its data in the platform's database.",
+      "The service in this folder is hosted on Turn Zero Cloud. It started from the platform's `database-service` template: a Node.js service that keeps its data in the platform's database. This file describes the template the service started from: keep it current as the service changes.",
       "",
       "## Where the rules are",
       "",
@@ -6904,9 +6906,9 @@ var SCAFFOLD_TEMPLATE_FILES = Object.freeze({
     ["AGENTS.md", [
       "# This service runs on Turn Zero Cloud",
       "",
-      "The service in this folder is hosted on Turn Zero Cloud. It started from the platform's `hello-world` template: the smallest Node.js service that deploys, with a health route and one API route.",
+      "The service in this folder is hosted on Turn Zero Cloud. It started from the platform's `hello-world` template: the smallest Node.js service that deploys, with a health route and one API route. This file describes the template the service started from: keep it current as the service changes.",
       "",
-      "Its one API route, `GET /api/hello`, answers hello world.",
+      "It started with one API route, `GET /api/hello`, which answers hello world.",
       "",
       "## Where the rules are",
       "",
@@ -7023,9 +7025,9 @@ var SCAFFOLD_TEMPLATE_FILES = Object.freeze({
     ["AGENTS.md", [
       "# This service runs on Turn Zero Cloud",
       "",
-      "The service in this folder is hosted on Turn Zero Cloud. It started from the platform's `scheduled-job` template: the smallest Node.js service that deploys, with one handler the platform runs on a schedule.",
+      "The service in this folder is hosted on Turn Zero Cloud. It started from the platform's `scheduled-job` template: the smallest Node.js service that deploys, with one handler the platform runs on a schedule. This file describes the template the service started from: keep it current as the service changes.",
       "",
-      "Its schedule, `heartbeat`, runs the handler in `src/jobs.mjs` once an hour through the Schedule package, and the handler prints one line.",
+      "It started with one schedule, `heartbeat`, which runs the handler in `src/jobs.mjs` once an hour through the Schedule package, and the handler prints one line.",
       "",
       "## Where the rules are",
       "",
@@ -7224,12 +7226,12 @@ var SCAFFOLD_TEMPLATE_FILES = Object.freeze({
     ["AGENTS.md", [
       "# This service runs on Turn Zero Cloud",
       "",
-      "The service in this folder is hosted on Turn Zero Cloud. It started from the platform's `web-app` template: a Node.js service with a web page, sign-in for its users, each user's own rows in the platform's database, and an AI model under the plan's allowance.",
+      "The service in this folder is hosted on Turn Zero Cloud. It started from the platform's `web-app` template: a Node.js service with a web page, sign-in for its users, each user's own rows in the platform's database, and an AI model under the plan's allowance. This file describes the template the service started from: keep it current as the service changes.",
       "",
       "## Where you build",
       "",
       "- The page: `client/`, plain HTML, CSS, and script, which the platform serves at the application's address.",
-      "- The routes: `src/server.mjs`. Each route under `/api/` reads the signed-in user, and keeps and lists that user's own rows.",
+      "- The routes: `src/server.mjs`. The service started with routes under `/api/` that each read the signed-in user, and keep and list that user's own rows.",
       "- The AI model: `src/ai.mjs`, which calls it under the plan's allowance, with no key of your own.",
       "- The tables: `migrations/`, one file for each change, applied in order at each start.",
       "",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "turnzero",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "type": "module",
   "description": "The Turn Zero Cloud command, which an AI coding tool runs on your machine to deploy an application, store a secret, upload a file, download an export, take a library entry, write a local run's settings, start the application locally, and scaffold a new service from a template.",
   "license": "Apache-2.0",