turnzero 0.25.1 → 0.25.5-next.1

package/dist/turnzero-cloud.mjs

@@ -552,7 +552,8 @@ var WIRE_FILE_NOUNS = Object.freeze({
 var PLANE_OLDER_WAY_ON = "Nothing was started: run this command again once the origin serves a newer release.";
 var PLANE_OLDER_FIRST_ACT_WAY_ON = "Nothing was started: once the origin serves a newer release, start again with the first act.";
 var planeOlderSentence = (version, origin, key, needs, served, tokenCodeUnread) => `${TURNZERO_CLOUD_PACKAGE} ${version} needs ${WIRE_FILE_NOUNS[key]} of ${needs} or later, and ${origin} serves ${served}, an older Turn Zero Cloud. ${tokenCodeUnread === void 0 ? PLANE_OLDER_WAY_ON : `${PLANE_OLDER_FIRST_ACT_WAY_ON} ${tokenCodeUnread}`}`;
-var servedWireOf = async (io2, origin) => {
+var COMMAND_LATEST_FORM = /^(?:0|[1-9]\d{0,8})\.(?:0|[1-9]\d{0,8})\.(?:0|[1-9]\d{0,8})$/;
+var servedHealthOf = async (io2, origin) => {
   const controller = new AbortController();
   const cancel = io2.schedule(PLANE_CHECK_BOUND_SECONDS * 1e3, () => controller.abort());
   try {
@@ -561,9 +562,13 @@ var servedWireOf = async (io2, origin) => {
       await response.body?.cancel().catch(() => void 0);
       return null;
     }
-    const wire = planeObjectOf(await response.text())?.wire;
-    if (wire === null || typeof wire !== "object" || Array.isArray(wire)) return null;
-    return Object.fromEntries(Object.entries(wire).filter((entry) => typeof entry[1] === "string"));
+    const body = planeObjectOf(await response.text());
+    if (body === null) return null;
+    const { wire, command_latest: latest } = body;
+    return {
+      wire: wire === null || typeof wire !== "object" || Array.isArray(wire) ? null : Object.fromEntries(Object.entries(wire).filter((entry) => typeof entry[1] === "string")),
+      commandLatest: typeof latest === "string" && COMMAND_LATEST_FORM.test(latest) ? latest : null
+    };
   } catch {
     return null;
   } finally {
@@ -580,7 +585,9 @@ var olderMemberOf = (served, needed = PLANE_WIRE_NEEDED) => {
   return null;
 };
 var planeWireRefusal = async (io2, origin, tokenCodeUnread) => {
-  const served = await servedWireOf(io2, origin);
+  const health = await servedHealthOf(io2, origin);
+  io2.noteCommandLatest?.(origin, health?.commandLatest ?? null);
+  const served = health?.wire ?? null;
   if (served === null) return null;
   const older = olderMemberOf(served);
   return older === null ? null : planeOlderSentence(commandVersion(), origin, older.key, older.needs, older.served, tokenCodeUnread);
@@ -828,6 +835,7 @@ var loginLineFor = (io2, origin) => {
   const line = loginLineOf(origin);
   return onWindows(io2) ? windowsLineOf(line) : line;
 };
+var authorizeLineFor = (io2, origin) => printedLineOf(io2, commandLineOf(origin, AUTHORIZE_SUBCOMMAND, origin !== DEFAULT_COMMAND_ORIGIN ? { origin } : {}), origin);
 var loginLinesFor = (io2, origin) => [
   ...ranThroughNpx(io2) ? [installLineOf(origin)] : [],
   loginLineFor(io2, origin)
@@ -840,13 +848,12 @@ var CREDENTIAL_SOURCES = Object.freeze(["standard_input", "minted_token_variable
 var credentialPlaces = (declared) => declared.places ?? `the command reads the grant from its standard input, as the line ${declared.call} answers pipes it in${declared.mintedToken ? `, and otherwise a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, or this computer's token for the platform's address from its credential file, which login and authorize write` : declared.computerToken === true ? `, and otherwise this computer's token for the platform's address from its credential file, which login and authorize write, and never a minted token from ${MINTED_TOKEN_VARIABLE}` : ""}.`;
 var unsetVariableWayOn = (declared) => `To run a line you wrote yourself under this computer's token, unset ${MINTED_TOKEN_VARIABLE} and run it again; or pipe ${declared.aGrant}.`;
 var grantWaysOn = (declared) => `Pipe ${declared.aGrant}, as the line ${declared.call} answers pipes it, or, where you wrote the line yourself, pipe nothing to run it under this computer's token.`;
-var emptyGrantRefusal = (declared) => emptyPipeRefusal(declared, grantWaysOn(declared));
-var emptyPipeRefusal = (declared, wayOn) => `The ${declared.grant} piped to the command was empty, so nothing was sent and nothing was started. ${wayOn}`;
-var unendedReadRefusal = (declared, reading, nothingArrived = false) => unendedReadSentence(
+var emptyGrantRefusal = (declared) => `The ${declared.grant} piped to the command was empty, so nothing was sent and nothing was started. ${grantWaysOn(declared)}`;
+var unendedReadRefusal = (declared, reading) => unendedReadSentence(
   declared.grant,
   reading,
   "nothing was sent and nothing was started.",
-  declared.computerToken === true ? grantWaysOn(declared) : pipeWholeWayOn(declared.aGrant, declared.call, declared.mintedToken && nothingArrived)
+  declared.computerToken === true ? grantWaysOn(declared) : pipeWholeWayOn(declared.aGrant, declared.call)
 );
 var emptyTokenVariableRefusal = () => `${MINTED_TOKEN_VARIABLE} is set but empty, so nothing was sent and nothing was started: the read that set it for this line found no token. Set it to your minted token from where your tool keeps it, or unset it to use this computer's token.`;
 var noCredentialRefusal = (declared, origin, expiredAt, again) => `No ${declared.grant} was read, so nothing was started: ${credentialPlaces(declared)} ${expiredAt === null ? `This computer's credential file holds no token for ${origin}.` : `This computer's token for ${origin} in its credential file expired at ${expiredAt}.`} ${again}`.trimEnd();
@@ -855,10 +862,10 @@ async function readCredential(io2, declared, again, line = { named: void 0, clos
   if (declared.piped !== false) {
     const read3 = await readStandardInputEnded(io2.input, io2.grantBoundMs);
     const unended = unendedReadingOf(read3);
-    if (unended !== null) return { refusal: unendedReadRefusal(declared, unended, read3.bytes === 0) };
+    if (unended !== null) return { refusal: unendedReadRefusal(declared, unended) };
     const grant = read3.text.trim();
     if (declared.emptyPipeRefused === true && grant === "" && read3.bytes > 0) {
-      return { refusal: declared.computerToken === true ? emptyGrantRefusal(declared) : emptyPipeRefusal(declared, again) };
+      return { refusal: emptyGrantRefusal(declared) };
     }
     if (grant !== "") {
       if (!UPLOAD_GRANT_FORM.test(grant)) {
@@ -926,10 +933,7 @@ var variableReadSentence = (origin, standing) => {
 };
 var fileReadSentence = (origin) => `The credential this run read was this computer's token for ${origin}, from its credential file: where the platform no longer accepts it, run ${LOGIN_SUBCOMMAND}${originWordsOf(origin)} to authorize this computer again.`;
 var noTokenSentence = (origin, expiredAt) => expiredAt === null ? `No credential was read, so nothing was sent: ${MINTED_TOKEN_VARIABLE} is not set, and this computer's credential file holds no token for ${origin}.` : `No credential was read, so nothing was sent: ${MINTED_TOKEN_VARIABLE} is not set, and this computer's token for ${origin} in its credential file expired at ${expiredAt}.`;
-var VARIABLE_ROUTE_SENTENCES = variableRouteSentencesOf("runs the line again");
-function variableRouteSentencesOf(then) {
-  return `A tool connected by a minted token, or a job, sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, never by writing the value in a line, and ${ORIGIN_VARIABLE} to the address that minted the token where that is not ${DEFAULT_COMMAND_ORIGIN}, then ${then}. Such a tool cannot use ${MINT_TOKEN_ACTION}, which takes a sign-in alone. A tool sets ${MINTED_TOKEN_VARIABLE} for one line at a time and unsets it once that line ends.`;
-}
+var VARIABLE_ROUTE_SENTENCES = `A tool connected by a minted token, or a job, sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, never by writing the value in a line, and ${ORIGIN_VARIABLE} to the address that minted the token where that is not ${DEFAULT_COMMAND_ORIGIN}, then runs the line again. Such a tool cannot use ${MINT_TOKEN_ACTION}, which takes a sign-in alone. A tool sets ${MINTED_TOKEN_VARIABLE} for one line at a time and unsets it once that line ends.`;
 var LOGIN_ROUTE_OPENER = "A person logs this computer in once, in a terminal of their own, and its token then stays on this computer for 30 days:";
 var DEPLOY_FILES_ROUTE_SENTENCE = "A folder within the caps of your tool's deploy_files call deploys now through deploy_files, with no login.";
 var loginRouteLines = (io2, origin, deployFiles = true) => [
@@ -2313,7 +2317,14 @@ var scanForSegment = (data, segment, count) => {
 var readHealthPath = (path, entries) => {
   const count = { scanned: 0, candidates: 0 };
   let decoded = 0;
-  const answer = (found) => ({ answer: found, decodedBytes: decoded, scannedBytes: count.scanned, candidates: count.candidates });
+  const healthLike = /* @__PURE__ */ new Set();
+  const answer = (found) => ({
+    answer: found,
+    decodedBytes: decoded,
+    scannedBytes: count.scanned,
+    candidates: count.candidates,
+    nearest: found === "absent" ? nearestHealthPathOf(healthLike, path) : null
+  });
   const segmentText = healthSegmentOf(path);
   if (segmentText === null) return answer("unread");
   const segment = Buffer.from(segmentText, "utf8");
@@ -2331,11 +2342,35 @@ var readHealthPath = (path, entries) => {
     decoded += data.length;
     const found = scanForSegment(data, segment, count);
     if (found !== "absent") return answer(found === "held" ? "held" : "unread");
+    collectHealthLikePaths(data, healthLike);
   }
   return answer("absent");
 };
+var HEALTH_LIKE_PATHS_MAX = 32;
+var HEALTH_LIKE_SEGMENT_MAX = 64;
+var QUOTED_PATH = /(["'`])(\/[A-Za-z0-9._~\/-]{1,200})\1/g;
+var collectHealthLikePaths = (data, found) => {
+  if (found.size >= HEALTH_LIKE_PATHS_MAX) return;
+  for (const match of data.toString("utf8").matchAll(QUOTED_PATH)) {
+    const path = match[2];
+    if (!/health/i.test(path) || path.includes("//") || path.length > 1 && path.endsWith("/")) continue;
+    if (path.split("/").some((segment) => segment.length > HEALTH_LIKE_SEGMENT_MAX)) continue;
+    found.add(path);
+    if (found.size >= HEALTH_LIKE_PATHS_MAX) return;
+  }
+};
+var nearestHealthPathOf = (found, path) => {
+  const bare = bareHealthPath(path);
+  let best = null;
+  for (const candidate of found) {
+    if (candidate === bare) continue;
+    if (best === null || candidate.length < best.length || candidate.length === best.length && candidate < best) best = candidate;
+  }
+  return best;
+};
 var shownHealthPath = (path) => shownNoteName(bareHealthPath(path));
 var healthLineOf = (path) => `${WARNING_LINE_HEAD}${MANIFEST_FILE} names the health path ${shownHealthPath(path)}, and no other file of the zip holds its last segment, package files and documentation set aside. A deploy waits for that path to answer 200 three times in a row, so check that the application serves it. A route built in another form is not seen here.`;
+var nearestHealthLineOf = (nearest) => `The zip's source names the path ${shownHealthPath(nearest)}: where that is the health path meant, set the manifest's health to it and call submit_manifest.`;
 var CREDENTIAL_FILE_NAMES = Object.freeze(["id_rsa", "id_dsa", "id_ecdsa", "id_ed25519", ".netrc", ".pgpass", ".htpasswd", "credentials.json"]);
 var CLIENT_SECRET_OPENING = "client_secret";
 var CLIENT_SECRET_ENDING = ".json";
@@ -2457,7 +2492,7 @@ var localWriteLineIn = (data) => {
 var localWriteLineOf = (found) => found === null ? null : `${WARNING_LINE_HEAD}${shownNoteName(found.name)}, line ${found.line}, writes to a local file inside the application's folder. A running copy's disk is lost whenever the copy is replaced or stops: keep files in a storage area and records in a database, as read_documentation's pages /cloud/guides/store-files/ and /cloud/guides/add-a-database/ describe.`;
 var LIST_LINE_HEAD = "file: ";
 var listLineOf = (file) => `${LIST_LINE_HEAD}${file.size} ${shownWhole(file.name)}`;
-var NO_NOTES = Object.freeze({ leftOut: Object.freeze([]), rootZips: Object.freeze([]), rootRunOutput: Object.freeze([]), credentialFiles: Object.freeze([]), localWrite: null, unservedHealthPath: null });
+var NO_NOTES = Object.freeze({ leftOut: Object.freeze([]), rootZips: Object.freeze([]), rootRunOutput: Object.freeze([]), credentialFiles: Object.freeze([]), localWrite: null, unservedHealthPath: null, nearestHealthPath: null });
 var noteLinesOf = (notes, health, zipped = null) => {
   const lines = [];
   const files = zipped === null ? null : filesLineOf(zipped.map((file) => file.name));
@@ -2472,7 +2507,10 @@ var noteLinesOf = (notes, health, zipped = null) => {
   if (credential !== null) lines.push(credential);
   const localWrite = localWriteLineOf(notes.localWrite);
   if (localWrite !== null) lines.push(localWrite);
-  if (health && notes.unservedHealthPath !== null) lines.push(healthLineOf(notes.unservedHealthPath));
+  if (health && notes.unservedHealthPath !== null) {
+    lines.push(healthLineOf(notes.unservedHealthPath));
+    if (notes.nearestHealthPath !== null) lines.push(nearestHealthLineOf(notes.nearestHealthPath));
+  }
   return lines;
 };
 
@@ -3479,6 +3517,7 @@ function zipFolder(root, seams = {}) {
   const credentialFiles = [];
   let localWrite = null;
   const places = [];
+  const healthLike = /* @__PURE__ */ new Set();
   const zip = zipFiles(
     files,
     seams.read,
@@ -3489,7 +3528,10 @@ function zipFolder(root, seams = {}) {
         const line = localWriteLineIn(data);
         if (line !== null) localWrite = { name: file.name, line };
       }
-      if (segment !== null && !held && readForHealth(file.name) && holdsSegment(data, segment)) held = true;
+      if (segment !== null && !held && readForHealth(file.name)) {
+        if (holdsSegment(data, segment)) held = true;
+        else collectHealthLikePaths(data, healthLike);
+      }
     },
     (place) => places.push(place)
   );
@@ -3504,7 +3546,8 @@ function zipFolder(root, seams = {}) {
       rootRunOutput: files.filter((file) => rootRunOutputName(file.name)).map((file) => file.name),
       credentialFiles,
       localWrite,
-      unservedHealthPath: segment !== null && !held ? healthPath : null
+      unservedHealthPath: segment !== null && !held ? healthPath : null,
+      nearestHealthPath: segment !== null && !held && healthPath !== null ? nearestHealthPathOf(healthLike, healthPath) : null
     }
   };
 }
@@ -3672,8 +3715,9 @@ var BINDING_NOTHING_SENT = "Nothing further was read and nothing was sent.";
 var NOTHING_UPLOADED_OR_STARTED = "Nothing was uploaded and nothing was started.";
 var healthPathRefusalOf = (prepared, zip, places) => {
   if (prepared.healthPathToRead === void 0 || places === null) return null;
-  if (readHealthPath(prepared.healthPathToRead, healthEntriesOf(zip, places)).answer !== "absent") return null;
-  return [healthPathUnservedDetail(prepared.healthPathToRead), NOTHING_UPLOADED_OR_STARTED];
+  const read2 = readHealthPath(prepared.healthPathToRead, healthEntriesOf(zip, places));
+  if (read2.answer !== "absent") return null;
+  return [healthPathUnservedDetail(prepared.healthPathToRead), ...read2.nearest === null ? [] : [nearestHealthLineOf(read2.nearest)], NOTHING_UPLOADED_OR_STARTED];
 };
 var zipSha256 = (zip) => createHash2("sha256").update(zip).digest("hex");
 var pathKindOf = (path) => {
@@ -5026,9 +5070,7 @@ async function readTakeCredential(io2, named, afterLogin, why) {
     const unwritable = loginRouteRefusalOf(io2, NOTHING_WRITTEN2);
     if (unwritable !== null) return { lines: [...head, VARIABLE_ROUTE_SENTENCES, unwritable] };
     const route = loginRouteLines(io2, origin.origin, false);
-    if (typeof afterLogin === "string") return { lines: [...head, VARIABLE_ROUTE_SENTENCES, ...route, afterLogin] };
-    const close = afterLogin(origin.origin);
-    return { lines: [...head, close.variableRoute, ...route, close.afterLogin], signIn: origin.origin };
+    return { lines: [...head, VARIABLE_ROUTE_SENTENCES, ...route, afterLogin] };
   }
   if ("refusal" in read2) return { lines: [read2.refusal] };
   io2.hide(read2.credential, REDACTED_TOKEN);
@@ -5677,6 +5719,7 @@ var unboundSentence = "No port on this computer could be bound for the browser t
 var unopenedSentence = "The browser could not be opened here: open the address yourself, approve the login, and paste here the code the page shows if it shows one.";
 var noSendSentence = (seconds) => `No answer has come from the browser in ${seconds} seconds. Where the page shows a code, paste it here; the browser's answer still completes the login.`;
 var noTerminalSentence2 = "This run has no terminal to paste a code into, so it waits for the browser's answer alone.";
+var toolRouteSentence = (authorizeLine) => `This line waits for a person to approve the login in a browser. A tool signed in to Turn Zero needs no browser: stop this line, run ${authorizeLine}, and make the mint_token call it prints.`;
 var noWayInSentence = (line, minutes = PENDING_REQUEST_MS / 6e4) => `This run has no terminal to paste a code into and no port for the browser to answer, so nothing was minted and the request stays pending for ${minutesWords(minutes)}. Run ${line} in a terminal of your own.`;
 var endedSentence = (minutes, line) => `No approval arrived within ${minutesWords(minutes)}, so nothing was minted and nothing was changed. Run ${line} again to log this computer in.`;
 var stoppedSentence = (line) => `The code prompt was stopped, so nothing was minted. Run ${line} again to log this computer in.`;
@@ -5831,6 +5874,7 @@ async function login(call, io2) {
       })
     );
   }
+  if (io2.errorIsTerminal !== true) io2.print(toolRouteSentence(authorizeLineFor(io2, origin.origin)));
   const arrival = await arrived;
   for (const cancel of cancels) cancel();
   prompt?.close();
@@ -6128,6 +6172,60 @@ var cacheOf = (text) => {
   }
 };
 var NO_CHECK = Object.freeze({ finish: () => null });
+var releaseOf = (version) => version.replace(/-.*$/, "");
+var updateRunOf = (io2, tag) => {
+  if (!ranThroughNpx(io2)) return { line: `npm install -g ${TURNZERO_CLOUD_PACKAGE}@${tag}`, npx: false };
+  const head = commandRunnerOf(tag);
+  return { line: onWindows(io2) ? windowsLineOf(head) : head, npx: true };
+};
+var updateNoticeOf = (io2, tag, version, running) => {
+  const run = updateRunOf(io2, tag);
+  return run.npx ? `A newer turnzero, ${version}, is published under ${tag} (this is ${running}): ${run.line} runs it.` : upgradeLineOf(tag, version, running);
+};
+var COMMAND_TOO_OLD_ERROR = "command_too_old";
+var commandTooOldLineOf = (io2, tag, running, latest) => {
+  if (latest !== null && newerVersion(latest, releaseOf(running))) return updateNoticeOf(io2, tag, latest, running);
+  const run = updateRunOf(io2, tag);
+  return `This turnzero, ${running}, is older than the platform answers: ${run.line} ${run.npx ? "runs" : "installs"} the version published under ${tag}.`;
+};
+var startUpdateNotices = (io2, say, running, named) => {
+  let origin = null;
+  let latest = null;
+  let notified = null;
+  let tooOld = false;
+  const tooOldTail = answerLineOf("", "refused", 426, COMMAND_TOO_OLD_ERROR);
+  const watched = (print) => (line) => {
+    if (line.endsWith(tooOldTail)) tooOld = true;
+    print(line);
+  };
+  const printError = io2.printError;
+  const runIo = {
+    ...io2,
+    print: watched(io2.print),
+    ...printError !== void 0 ? { printError: watched(printError) } : {},
+    noteCommandLatest: (at, served) => {
+      origin ??= at;
+      if (served === null || latest !== null) return;
+      latest = served;
+      if (!newerVersion(served, releaseOf(running))) return;
+      notified = served;
+      say(updateNoticeOf(io2, commandTagOf(at), served, running));
+    }
+  };
+  return {
+    io: runIo,
+    finish: (daily) => {
+      const lines = [];
+      if (tooOld) {
+        const at = origin ?? originReadOf(named[DEPLOY_OPTION.origin] ?? io2.env[ORIGIN_VARIABLE]);
+        lines.push(commandTooOldLineOf(io2, commandTagOf(at), running, latest));
+      }
+      const line = daily.finish(notified);
+      if (line !== null) lines.push(line);
+      return lines;
+    }
+  };
+};
 var startUpgradeCheck = (io2, subcommand, named, running) => {
   const read2 = io2.registryFetch;
   if (read2 === void 0 || !UPGRADE_CHECK_SUBCOMMANDS.includes(subcommand)) return NO_CHECK;
@@ -6168,9 +6266,10 @@ var startUpgradeCheck = (io2, subcommand, named, running) => {
     }
   })();
   return {
-    finish: () => {
+    finish: (named2) => {
       controller.abort();
-      return arrived !== null && newerVersion(arrived, running) ? upgradeLineOf(tag, arrived, running) : null;
+      if (arrived === null || !newerVersion(arrived, running)) return null;
+      return typeof named2 === "string" && !newerVersion(arrived, named2) ? null : upgradeLineOf(tag, arrived, running);
     }
   };
 };
@@ -6194,29 +6293,29 @@ var PROVISION_OPTIONS = Object.freeze([
     name: PROVISION_OPTION.origin,
     value: "<origin>",
     required: false,
-    description: `The platform's address, which is also written as ${LOCAL_RUN_SETTING.api} and ${LOCAL_RUN_SETTING.gatewayUrl}. Where absent, ${DEFAULT_COMMAND_ORIGIN}; with no grant piped, the address ${ORIGIN_VARIABLE} holds where it is set. Under ${MINTED_TOKEN_VARIABLE} the token is sent only to the address ${ORIGIN_VARIABLE} holds, or to ${DEFAULT_COMMAND_ORIGIN} where it is unset. Otherwise, with no grant piped, it names the address whose token the command reads from this computer's credential file, and that token is sent to that address alone.`
+    description: `The platform's address, which is also written as ${LOCAL_RUN_SETTING.api} and ${LOCAL_RUN_SETTING.gatewayUrl}. Where absent, the address ${ORIGIN_VARIABLE} holds, or ${DEFAULT_COMMAND_ORIGIN} where it is unset. Under ${MINTED_TOKEN_VARIABLE} the token is sent only to the address ${ORIGIN_VARIABLE} holds, or to ${DEFAULT_COMMAND_ORIGIN} where it is unset. Otherwise it names the address whose token the command reads from this computer's credential file, and that token is sent to that address alone.`
   },
   {
     name: PROVISION_CLAIM_FLAG,
     value: "",
     required: false,
     flag: true,
-    description: `With no token for the address, presents this computer's pending verifier, the one the first act kept, as the credential of the provision grant the submit_manifest call recorded, so the line pipes nothing. Where the platform holds no such grant, the run prints the first act. Under a token it runs as the line without it does, and a grant piped beside it is refused.`
+    description: `With no token for the address, presents this computer's pending verifier, the one the first act kept, as the credential of the provision grant the submit_manifest call recorded. Where the platform holds no such grant, the run prints the first act. Under a token it runs as the line without it does.`
   }
 ]);
 var PROVISION_CREDENTIAL = Object.freeze({
-  grant: "secret grant",
-  aGrant: "a secret grant",
+  grant: "minted token",
+  aGrant: "a minted token",
   call: "the submit_manifest call naming local_run",
   mintedToken: true,
-  emptyPipeRefused: true,
-  bare: `with nothing piped and neither token, it keeps a verifier and prints the challenge and the submit_manifest call naming local_run and ${CODE_CHALLENGE_MEMBER}, and a grant piped is presented with that verifier`,
+  piped: false,
+  places: `the command reads no standard input: it reads a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, as a tool connected by a minted token sets it from where its token is kept, or a job with no tool from its secret store, and otherwise this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write.`,
   claim: `this computer's pending verifier, under ${PROVISION_CLAIM_FLAG}`
 });
+var PROVISION_READS = `no standard input: a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, and otherwise this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write, sent only to that address; else ${PROVISION_CREDENTIAL.claim}; with none, it keeps a verifier and prints the challenge and the submit_manifest call naming local_run and ${CODE_CHALLENGE_MEMBER}`;
 var NOTHING_REMINTED = "Nothing was re-minted, and the environment file is as it stood.";
 var CLAIM_FALLBACK_ERRORS = Object.freeze(["authentication_required", "secret_grant_not_admitted", "secret_grant_expired", "secret_grant_spent"]);
 var claimRefusedSentence = (origin, error) => `This computer's pending verifier was presented to ${origin}, which holds no provision grant it claims (${error}), so nothing was re-minted, and the first act follows.`;
-var CLAIM_BESIDE_GRANT_REFUSAL = `${PROVISION_CLAIM_FLAG} presents this computer's pending verifier in place of a grant, so a grant piped beside it is refused: run the line the submit_manifest call answered as given. ${NOTHING_REMINTED}`;
 var PROVISION_BARE_LINE_WORDS = commandLineOf(DEFAULT_COMMAND_ORIGIN, PROVISION_SUBCOMMAND, { options: [[PROVISION_OPTION.application, "<application id>"]] });
 var freshLineOf = (io2, application, origin, envFile) => provisionLineFor(io2, { origin, application, ...envFile !== void 0 ? { envFile } : {} });
 var freshLineSteps2 = (line) => `${line} with nothing piped, and where it prints a submit_manifest call, make that call from your tool and run the line it answers as given`;
@@ -6406,19 +6505,14 @@ async function provision(call, io2) {
     io2.print(read2.refusal);
     return COMMAND_STATUS.nothing_started;
   }
-  if (options.claim && read2.kind === "grant") {
-    io2.print(CLAIM_BESIDE_GRANT_REFUSAL);
-    return COMMAND_STATUS.nothing_started;
-  }
-  if (read2.kind === "token") io2.hide(read2.credential, REDACTED_TOKEN);
+  io2.hide(read2.credential, REDACTED_TOKEN);
   const where = credentialOriginOf(io2.env, read2, { named: call.named[PROVISION_OPTION.origin], closing: NOTHING_REMINTED });
   if ("refusal" in where) {
     io2.print(where.refusal);
     return COMMAND_STATUS.nothing_started;
   }
   const sent = { ...options, origin: where.origin };
-  const verifier = read2.kind === "grant" ? pendingVerifierOf(io2, sent.origin) : null;
-  return remintRun(io2, sent, agent.userAgent, { credential: read2.credential, kind: read2.kind, verifier }, standing.text, namedEnvFile);
+  return remintRun(io2, sent, agent.userAgent, { credential: read2.credential, kind: "token", verifier: null }, standing.text, namedEnvFile);
 }
 async function claimRun(io2, call, options, userAgent, standing, namedEnvFile, unauthorized) {
   const origin = authorizationOriginOf(io2.env, call.named[PROVISION_OPTION.origin], NOTHING_REMINTED);
@@ -6605,6 +6699,7 @@ var PROVISION_ROW = Object.freeze({
   ].join(", ")}, and ${LOCAL_RUN_SETTING.application}, the first two only where the application has a development database. It removes a ${RETIRED_PLATFORM_CREDENTIAL_SETTING} line, the platform credential's earlier name. It prints no credential value.`,
   options: PROVISION_OPTIONS,
   credential: PROVISION_CREDENTIAL,
+  reads: PROVISION_READS,
   statuses: {
     done: "the settings written, or the first act printed its challenge and call",
     failed: "the settings written without a connection limit, which the platform's answer did not carry",
@@ -6612,7 +6707,7 @@ var PROVISION_ROW = Object.freeze({
     nothing_started: "nothing was re-minted"
   },
   note: [
-    `Run ${PROVISION_BARE_LINE_WORDS} from the folder the application runs in. With nothing piped and no token for the address, it prints a challenge and the submit_manifest call naming local_run and ${CODE_CHALLENGE_MEMBER}; your tool makes that call and runs the line it answers once, as given, before its grant expires, which presents the grant with this computer's verifier. On a computer logged in, the bare line re-mints at once.`,
+    `Run ${PROVISION_BARE_LINE_WORDS} from the folder the application runs in. With no token for the address, it prints a challenge and the submit_manifest call naming local_run and ${CODE_CHALLENGE_MEMBER}; your tool makes that call and runs the line it answers once, as given, before its grant expires, which presents the grant with this computer's verifier. On a computer logged in, the bare line re-mints at once.`,
     `Each run revokes the development credentials the application had before it. A deployed development environment holds the revoked values until it restarts, so the line's last re-mint restarts it where development serves a version. Its redeploy takes both re-minted credentials from custody, the connection string and the platform credential, and does not count toward the day's deploys. Where a deploy of development is still in flight, the re-mint's answer names restart_application on development, and your tool calls it once that deploy ends. ${PROVISION_SUBCOMMAND} writes no ${PORT_SETTING}: ${RUN_SUBCOMMAND} sets it from ${RUN_OPTION.port}.`
   ],
   afterOwnError: provisionAfterOwnError,
@@ -8705,21 +8800,18 @@ var folderRefusalOf = (io2, options, files, takeLines, lineOf) => {
   return null;
 };
 var RUN_AGAIN = "Run the same line again.";
-var FINISH_WORDS = Object.freeze({ opening: "To finish,", again: " again whole" });
-var AFTER_LOGIN_FINISH_WORDS = Object.freeze({ opening: `Once ${LOGIN_SUBCOMMAND} has printed authorized:,`, again: "" });
-var finishSentence = (entry, takeLine, words = FINISH_WORDS) => `${words.opening} run this line at the project's root, which takes the ${entry} entry${words.again} and installs, then run npm test in ${APPLICATION_FOLDER}/: ${takeLine}`;
+var finishSentence = (entry, takeLine) => `To finish, run this line at the project's root, which takes the ${entry} entry again whole and installs, then run npm test in ${APPLICATION_FOLDER}/: ${takeLine}`;
 var LINE_COUNT_WORDS = Object.freeze({ 2: "two", 3: "three", 4: "four" });
-var finishEachSentence = (entries, takeLines, words = FINISH_WORDS) => [
-  `${words.opening} run each of these ${LINE_COUNT_WORDS[takeLines.length] ?? takeLines.length} lines at the project's root, in order, which take the ${listedAnd(entries)} entries${words.again} and install, then run npm test in ${APPLICATION_FOLDER}/:`,
+var finishEachSentence = (entries, takeLines) => [
+  `To finish, run each of these ${LINE_COUNT_WORDS[takeLines.length] ?? takeLines.length} lines at the project's root, in order, which take the ${listedAnd(entries)} entries again whole and install, then run npm test in ${APPLICATION_FOLDER}/:`,
   ...takeLines
 ].join("\n");
 var FINISH_UNTAKEN = `To finish, run npm install and then npm test in ${APPLICATION_FOLDER}/.`;
-var finishOf = (entry, takeLine, words = FINISH_WORDS) => {
+var finishOf = (entry, takeLine) => {
   const [entries, lines] = [listOf(entry), listOf(takeLine)];
   if (entries.length === 0 || lines.length !== entries.length) return FINISH_UNTAKEN;
-  return entries.length === 1 ? finishSentence(entries[0], lines[0], words) : finishEachSentence(entries, lines, words);
+  return entries.length === 1 ? finishSentence(entries[0], lines[0]) : finishEachSentence(entries, lines);
 };
-var afterLoginFinishOf = (entries, takeLines) => finishOf(entries, takeLines, AFTER_LOGIN_FINISH_WORDS);
 var writtenClause = (entry) => {
   const entries = listOf(entry);
   if (entries.length === 0) return "the service's files are written";
@@ -8764,11 +8856,11 @@ var standsWayOn = (template, takeLines) => {
   return `${takes.length > 0 ? `. ${takes.join("\n")}` : `: ${SCAFFOLD_SUBCOMMAND} starts a new application and writes over none.`}
 ${STANDS_DEPLOY_LINE}`;
 };
-var stoppedCloseOf = (state, template, takeLines, words = FINISH_WORDS) => {
+var stoppedCloseOf = (state, template, takeLines) => {
   const before = `before ${APPLICATION_FOLDER}/ was written`;
   switch (state) {
     case "template":
-      return `after ${APPLICATION_FOLDER}/ was written. ${finishOf(TEMPLATE_FACTS[template].takes.map((take) => take.entry), takeLines, words)}`;
+      return `after ${APPLICATION_FOLDER}/ was written. ${finishOf(TEMPLATE_FACTS[template].takes.map((take) => take.entry), takeLines)}`;
     case "absent":
       return `${before}, and no ${APPLICATION_FOLDER}/ stands. ${RUN_AGAIN}`;
     case "empty":
@@ -8781,8 +8873,8 @@ var stoppedCloseOf = (state, template, takeLines, words = FINISH_WORDS) => {
       return `${before}, and what stands at ${APPLICATION_FOLDER} could not be read: make it readable or move it, then run the same line again.`;
   }
 };
-var ownErrorLine = (error, state, template, takeLines, words = FINISH_WORDS) => `The command stopped on an error of its own (${errorWordOf(error)}) ${stoppedCloseOf(state, template, takeLines, words)}`;
-var signalEndedLine = (state, template, takeLines, words = FINISH_WORDS) => `A signal ended the command ${stoppedCloseOf(state, template, takeLines, words)}`;
+var ownErrorLine = (error, state, template, takeLines) => `The command stopped on an error of its own (${errorWordOf(error)}) ${stoppedCloseOf(state, template, takeLines)}`;
+var signalEndedLine = (state, template, takeLines) => `A signal ended the command ${stoppedCloseOf(state, template, takeLines)}`;
 var ApplicationArrived = class extends Error {
 };
 var arrivedLine = (template, takeLines) => `${APPLICATION_FOLDER}/ took a file or a folder while the scaffold ran, so an application stands there and the template was not written${standsWayOn(template, takeLines)}`;
@@ -8880,7 +8972,6 @@ async function scaffold(call, io2) {
   let lineOrigin = origin;
   const lineOf = (entry) => takeLineFor(entry, lineOrigin);
   let takeLines = takeLinesFor(lineOrigin);
-  let finishWords = FINISH_WORDS;
   let reached = "checks";
   const stateNow = () => {
     if (reached === "template") return "template";
@@ -8902,44 +8993,26 @@ async function scaffold(call, io2) {
     if (refused !== null) return refuse(...refused);
     const checks = [];
     let held;
-    let unsigned = null;
-    const untaken = () => untakenLibraryOf(io2, root, (library) => writesOver(library, app));
     if (takes.length === 0) {
-      const found = untaken();
+      const found = untakenLibraryOf(io2, root, (library) => writesOver(library, app));
       if ("lines" in found) return refuse(...found.lines);
       held = found;
     } else {
-      const entries = takes.map((take) => take.entry);
-      const credential = await readTakeCredential(
-        io2,
-        call.named[SCAFFOLD_OPTION.origin],
-        (at) => ({ variableRoute: scaffoldVariableRouteOf(entries.length), afterLogin: afterLoginFinishOf(entries, takeLinesFor(at)) }),
-        SCAFFOLD_SIGN_IN_WHY
-      );
-      if ("lines" in credential) {
-        if (credential.signIn === void 0) return refuse(...credential.lines);
-        lineOrigin = credential.signIn;
-        takeLines = takeLinesFor(lineOrigin);
-        const found = untaken();
-        if ("lines" in found) return refuse(...found.lines);
-        held = found;
-        unsigned = credential.lines;
-        finishWords = AFTER_LOGIN_FINISH_WORDS;
-      } else {
-        lineOrigin = credential.origin;
-        takeLines = takeLinesFor(lineOrigin);
-        for (const take of takes) {
-          const copy = join10(app, "lib", take.entry);
-          const planOf = (library) => writesOver(library, copy) ? { refusal: LIBRARY_OVER_APPLICATION } : { application: app, copy, declared: null, declaredAt: null };
-          const read2 = await readTake(io2, { entry: take.entry, root, named: options.named, origin: credential.origin }, agent.userAgent, credential.bearer, planOf, checks.length > 0);
-          if ("lines" in read2) return refuse(...read2.lines);
-          if (read2.plan === null) {
-            return refuse(`The ${take.entry} entry the library served carries no compiled modules, which the service's package file declares and installs. That is the platform's to fix: report it. ${NOTHING_WRITTEN2}`);
-          }
-          checks.push(read2);
+      const credential = await readTakeCredential(io2, call.named[SCAFFOLD_OPTION.origin], SCAFFOLD_AFTER_LOGIN, SCAFFOLD_SIGN_IN_WHY);
+      if ("lines" in credential) return refuse(...credential.lines);
+      lineOrigin = credential.origin;
+      takeLines = takeLinesFor(lineOrigin);
+      for (const take of takes) {
+        const copy = join10(app, "lib", take.entry);
+        const planOf = (library) => writesOver(library, copy) ? { refusal: LIBRARY_OVER_APPLICATION } : { application: app, copy, declared: null, declaredAt: null };
+        const read2 = await readTake(io2, { entry: take.entry, root, named: options.named, origin: credential.origin }, agent.userAgent, credential.bearer, planOf, checks.length > 0);
+        if ("lines" in read2) return refuse(...read2.lines);
+        if (read2.plan === null) {
+          return refuse(`The ${take.entry} entry the library served carries no compiled modules, which the service's package file declares and installs. That is the platform's to fix: report it. ${NOTHING_WRITTEN2}`);
         }
-        held = { library: checks[0].library, fresh: checks[0].fresh, packages: takenPackagesOf(checks) };
+        checks.push(read2);
       }
+      held = { library: checks[0].library, fresh: checks[0].fresh, packages: takenPackagesOf(checks) };
     }
     const arrived = folderRefusalOf(io2, options, files, takeLines, lineOf);
     if (arrived !== null) return refuse(...arrived);
@@ -8948,7 +9021,7 @@ async function scaffold(call, io2) {
     let ended = false;
     release = io2.whenEnded(() => {
       ended = true;
-      printEach(io2, signalEndedLine(stateNow(), template, takeLines, finishWords));
+      printEach(io2, signalEndedLine(stateNow(), template, takeLines));
     });
     reached = "writes";
     if (io2.stat(root) === null) io2.makeFolder(root);
@@ -8964,16 +9037,12 @@ async function scaffold(call, io2) {
     await io2.sleep(LOOP_TURN_MS);
     release();
     if (ended) return COMMAND_STATUS.unknown;
-    if (unsigned !== null) {
-      for (const line of unsigned) printEach(io2, line);
-      return COMMAND_STATUS.failed;
-    }
     const taken = checks.map((check2, index) => ({ entry: takes[index].entry, version: check2.entry.version, line: takeLines[index] }));
     return await installAndTest(io2, app, template, taken, lineOrigin, { tools, claude: claudeStands });
   } catch (error) {
     const state = stateNow();
     const arrivedAs = error instanceof ApplicationArrived ? state : null;
-    printEach(io2, arrivedAs === "held" ? arrivedLine(template, takeLines) : arrivedAs === "no folder" ? ARRIVED_NO_FOLDER_LINE : ownErrorLine(error, state, template, takeLines, finishWords));
+    printEach(io2, arrivedAs === "held" ? arrivedLine(template, takeLines) : arrivedAs === "no folder" ? ARRIVED_NO_FOLDER_LINE : ownErrorLine(error, state, template, takeLines));
     return COMMAND_STATUS.unknown;
   } finally {
     release();
@@ -9021,17 +9090,17 @@ async function installAndTest(io2, app, template, taken, origin, left) {
 }
 var SCAFFOLD_CREDENTIAL = LIBRARY_CREDENTIAL;
 var SCAFFOLD_READS = `under a template that takes library entries what library take reads, ${LIBRARY_READS}; and under a template that takes none, no credential`;
-var scaffoldVariableRouteOf = (count) => variableRouteSentencesOf(count === 1 ? "runs the take line below at the project's root, and not this line again" : "runs the take lines below at the project's root, in order, and not this line again");
+var SCAFFOLD_AFTER_LOGIN = `Once ${LOGIN_SUBCOMMAND} has printed authorized:, run this ${SCAFFOLD_SUBCOMMAND} line again. ${NOTHING_WRITTEN2}`;
 var SCAFFOLD_SIGN_IN_WHY = `A template that takes library entries needs a sign-in, since the library's reads are under a credential; ${SCAFFOLD_DEFAULT_TEMPLATE}, which takes none, runs without one.`;
 var SCAFFOLD_ROW = Object.freeze({
   name: SCAFFOLD_SUBCOMMAND,
-  summary: `Writes a new service from a template into a project, ${SCAFFOLD_DEFAULT_TEMPLATE} where the line names no ${SCAFFOLD_OPTION.template}. A template that takes library entries, as database-service takes the Database entry and web-app takes three, takes each as library take does, under the credential library take reads, checking each file's SHA-256 and each entry's closure hash before it writes anything. It then writes the template's files under app/, the manifest's packages member filled from the library folder's rows, runs npm install and npm test there, and prints the next steps. Where such a template reads no credential, it writes the template's files, takes no entry, runs no npm, and prints the login route and the take lines that finish the service. It starts a new application and writes over none. A template that takes no entry reads no credential.`,
+  summary: `Writes a new service from a template into a project, ${SCAFFOLD_DEFAULT_TEMPLATE} where the line names no ${SCAFFOLD_OPTION.template}. A template that takes library entries, as database-service takes the Database entry and web-app takes three, takes each as library take does, under the credential library take reads, checking each file's SHA-256 and each entry's closure hash before it writes anything. It then writes the template's files under app/, the manifest's packages member filled from the library folder's rows, runs npm install and npm test there, and prints the next steps. Where such a template reads no credential, it writes nothing and prints the login route, closed by this line to run again once signed in. It starts a new application and writes over none. A template that takes no entry reads no credential.`,
   options: SCAFFOLD_OPTIONS,
   credential: SCAFFOLD_CREDENTIAL,
   reads: SCAFFOLD_READS,
   statuses: {
     done: "the files written and installed, the entries taken where the template takes any, and the tests passed",
-    failed: "the files written, and npm install or the tests failed, or no credential was read, so no library entry was taken",
+    failed: "the files written, and npm install or the tests failed",
     unknown: "the run stopped before its end, by an interrupt or another signal that ended npm, by an error of the command's own, or by something that came to stand at app while it wrote: the printed sentence names the way on",
     nothing_started: "nothing was written"
   },
@@ -9982,9 +10051,9 @@ async function runGuarded(argv2, io2) {
     return COMMAND_STATUS.nothing_started;
   }
   const upgrade = startUpgradeCheck(io2, parsed.subcommand.name, parsed.call.named, version);
-  const status = await parsed.subcommand.run(parsed.call, io2);
-  const notice = upgrade.finish();
-  if (notice !== null) say(notice);
+  const notices = startUpdateNotices(io2, say, version, parsed.call.named);
+  const status = await parsed.subcommand.run(parsed.call, notices.io);
+  for (const line of notices.finish(upgrade)) say(line);
   return status;
 }
 var outputOf = (argv2, io2) => argv2[0] === TOKEN_SUBCOMMAND && argv2[1] === TOKEN_CLAIM_ACT ? io2.printError ?? io2.print : io2.print;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "turnzero",
-  "version": "0.25.1",
+  "version": "0.25.5-next.1",
   "type": "module",
   "description": "The Turn Zero Cloud command, which an AI coding tool runs on your machine to deploy an application, store a secret, upload a file, download an export, take a library entry, write a local run's settings, start the application locally, and scaffold a new service from a template.",
   "license": "Apache-2.0",