turnzero 0.27.0 → 0.30.0

package/dist/turnzero-cloud.mjs

@@ -37,7 +37,7 @@ var shownHealthPathOf = (path) => {
   }
   return JSON.stringify("\u2026");
 };
-var healthPathUnservedDetail = (path) => `No source text in the zip names the health path ${shownHealthPathOf(path)}. Serve it from your code, or set the manifest's health to a served path and call submit_manifest (PLD-L0-63).`;
+var healthPathUnservedDetail = (path) => `No source text in the zip names the health path ${shownHealthPathOf(path)}. Serve it from your code, or set the manifest's health to a served path and call submit_manifest.`;
 var deployAreaName = (application) => `${DEPLOY_AREA_PREFIX}${application}`;
 var UPLOAD_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 var uploadFileName = (id) => `${id}.zip`;
@@ -275,6 +275,11 @@ var MINT_TOKEN_ACTION = "mint_token";
 var REVOKE_TOKEN_ACTION = "revoke_token";
 var AUTHORIZED_LINE_HEAD = "authorized: ";
 var LOGGED_OUT_LINE_HEAD = "logged out: ";
+var COMPLETION_MEMBER = "completion";
+var COMPLETION_MINT = "mint";
+var MINT_MEMBER = "mint";
+var MINT_OPTION = "--mint";
+var MINT_ID_FORM = UPLOAD_ID;
 
 // src/turnzero_cloud_command/credential_file.ts
 import { randomBytes } from "node:crypto";
@@ -393,14 +398,14 @@ var isWireVersion = (value) => parseWireVersion(value) !== null;
 function compareWireVersions(a, b) {
   const x2 = parseWireVersion(a);
   const y = parseWireVersion(b);
-  if (!x2 || !y) throw new Error("a wire version is a date, a dot, and a counter (MAPI-02).");
+  if (!x2 || !y) throw new Error("a wire version is a date, a dot, and a counter.");
   if (x2.date !== y.date) return x2.date < y.date ? -1 : 1;
   return x2.counter === y.counter ? 0 : x2.counter < y.counter ? -1 : 1;
 }
 
 // src/turnzero_cloud_command/plane_wire.ts
 var PLANE_WIRE_NEEDED = Object.freeze({
-  action_payloads: "2026-10-14.2",
+  action_payloads: "2026-10-24.10",
   management_api: "2026-10-10.5",
   wire_errors: "2026-10-10.6"
 });
@@ -440,19 +445,20 @@ var originReadOf = (value) => {
   const held = (value ?? "").trim();
   return held === "" ? DEFAULT_COMMAND_ORIGIN : originOf(held) ?? held;
 };
+var ORIGIN_FORM_SENTENCES = `It is an https address with no path, ${ORIGIN_HOST_WORDS}. For a local platform, it may be an http address of this machine: 127.0.0.1, localhost, or [::1].`;
 var commandOriginOf = (text) => {
   const origin = originOf(text);
   if (origin !== null) return { origin };
   return {
-    refusal: `${DEPLOY_OPTION.origin} names the platform's address, such as ${DEFAULT_COMMAND_ORIGIN}: an https address with no path, ${ORIGIN_HOST_WORDS}, or an http address of this machine (127.0.0.1, localhost, or [::1]) for a local platform, since the command sends its credential to it. Nothing was started.`
+    refusal: `${DEPLOY_OPTION.origin} names the platform's address, such as ${DEFAULT_COMMAND_ORIGIN}, since the command sends its credential to it. ${ORIGIN_FORM_SENTENCES} Nothing was started.`
   };
 };
 var MINTED_TOKEN_OUTSIDE_OPENING = `${DEPLOY_OPTION.origin} names an address this run does not send its minted token to.`;
 var firstPartyOriginWayOn = (origin) => `Set ${ORIGIN_VARIABLE} to ${origin} beside ${MINTED_TOKEN_VARIABLE} and run the line again, since that variable, never the line, states where the minted token goes.`;
-var MINTED_TOKEN_HELD_ALONE = `${MINTED_TOKEN_OUTSIDE_OPENING} Where ${ORIGIN_VARIABLE} is set, a line run by a tool connected by a minted token, or by a job, sends the token in ${MINTED_TOKEN_VARIABLE} only to the address that variable holds, so ${DEPLOY_OPTION.origin} may name that address alone. Where the platform is at another address, set ${ORIGIN_VARIABLE} to it beside the token, or unset the variable for the command's default address, and run the line again.`;
+var MINTED_TOKEN_HELD_ALONE = `${MINTED_TOKEN_OUTSIDE_OPENING} Where ${ORIGIN_VARIABLE} is set, a line run by a tool connected by a minted token, or by a job, sends the token in ${MINTED_TOKEN_VARIABLE} only to the address that variable holds. The line's ${DEPLOY_OPTION.origin} may then name that address alone. Where the platform is at another address, set ${ORIGIN_VARIABLE} to it beside the token, or unset the variable for the command's default address, and run the line again.`;
 var mintedTokenOriginOf = (env, named, closing) => {
   const held = heldOriginOf(env, named, closing, {
-    variable: "a line run by a tool connected by a minted token, or by a job, sends the minted token to the address the variable names",
+    variable: "A line run by a tool connected by a minted token, or by a job, sends the minted token to the address the variable names",
     outside: `${MINTED_TOKEN_OUTSIDE_OPENING} A line run by a tool connected by a minted token, or by a job, sends the token in ${MINTED_TOKEN_VARIABLE} only to ${DEFAULT_COMMAND_ORIGIN} or to the address ${ORIGIN_VARIABLE} holds in the same environment. Where the platform is at another address, set ${ORIGIN_VARIABLE} to it beside the token, and run the line again.`,
     heldAlone: MINTED_TOKEN_HELD_ALONE
   });
@@ -466,7 +472,7 @@ var heldOriginOf = (env, named, closing, words) => {
   const fromEnvironment = held === "" ? null : originOf(held);
   if (held !== "" && fromEnvironment === null) {
     return {
-      refusal: `What ${ORIGIN_VARIABLE} holds is not the platform's address: ${words.variable}, such as ${DEFAULT_COMMAND_ORIGIN}, which is an https address with no path, ${ORIGIN_HOST_WORDS}, or an http address of this machine (127.0.0.1, localhost, or [::1]) for a local platform. Set the variable to that address, or unset it. ${closing}`
+      refusal: `What ${ORIGIN_VARIABLE} holds is not the platform's address. ${words.variable}, such as ${DEFAULT_COMMAND_ORIGIN}. ${ORIGIN_FORM_SENTENCES} Set the variable to that address, or unset it. ${closing}`
     };
   }
   if (named === void 0) return { origin: fromEnvironment ?? DEFAULT_COMMAND_ORIGIN };
@@ -481,7 +487,7 @@ var heldOriginOf = (env, named, closing, words) => {
 var AUTHORIZATION_ACTS_WORDS = `${AUTHORIZE_SUBCOMMAND}, ${TOKEN_SUBCOMMAND} ${TOKEN_REQUEST_ACT}, and ${TOKEN_SUBCOMMAND} ${TOKEN_CLAIM_ACT}`;
 var authorizationOriginOf = (env, named, closing) => heldOriginOf(env, named, closing, {
   variable: `${AUTHORIZATION_ACTS_WORDS} reach only the address the variable names`,
-  outside: `${DEPLOY_OPTION.origin} names an address this computer's authorization does not reach: ${AUTHORIZATION_ACTS_WORDS} reach only ${DEFAULT_COMMAND_ORIGIN}, ${DEVELOPMENT_COMMAND_ORIGIN}, or the address ${ORIGIN_VARIABLE} holds, so a line chooses only between the platform's own two addresses and the environment names any other. Where the platform is at another address, set ${ORIGIN_VARIABLE} to it, and run the line again.`,
+  outside: `${DEPLOY_OPTION.origin} names an address this computer's authorization does not reach. ${AUTHORIZATION_ACTS_WORDS} reach only ${DEFAULT_COMMAND_ORIGIN}, ${DEVELOPMENT_COMMAND_ORIGIN}, or the address ${ORIGIN_VARIABLE} holds. A line chooses only between the platform's own two addresses, and the environment names any other. Where the platform is at another address, set ${ORIGIN_VARIABLE} to it, and run the line again.`,
   admitted: FIRST_PARTY_COMMAND_ORIGINS
 });
 var entryOriginOf = (env, named, closing) => {
@@ -491,7 +497,7 @@ var entryOriginOf = (env, named, closing) => {
   const origin = originOf(held);
   if (origin !== null) return { origin };
   return {
-    refusal: `What ${ORIGIN_VARIABLE} holds is not the platform's address: where the line names no ${DEPLOY_OPTION.origin}, the command reads this computer's entry for the address the variable names, such as ${DEFAULT_COMMAND_ORIGIN}, which is an https address with no path, ${ORIGIN_HOST_WORDS}, or an http address of this machine (127.0.0.1, localhost, or [::1]) for a local platform. Set the variable to that address, or unset it. ${closing}`
+    refusal: `What ${ORIGIN_VARIABLE} holds is not the platform's address. Where the line names no ${DEPLOY_OPTION.origin}, the command reads this computer's entry for the address the variable names, such as ${DEFAULT_COMMAND_ORIGIN}. ${ORIGIN_FORM_SENTENCES} Set the variable to that address, or unset it. ${closing}`
   };
 };
 var HEADER_VALUE = /^[\x20-\x7e]*$/;
@@ -551,7 +557,7 @@ var WIRE_FILE_NOUNS = Object.freeze({
 });
 var PLANE_OLDER_WAY_ON = "Nothing was started: run this command again once the origin serves a newer release.";
 var PLANE_OLDER_FIRST_ACT_WAY_ON = "Nothing was started: once the origin serves a newer release, start again with the first act.";
-var planeOlderSentence = (version, origin, key, needs, served, tokenCodeUnread) => `${TURNZERO_CLOUD_PACKAGE} ${version} needs ${WIRE_FILE_NOUNS[key]} of ${needs} or later, and ${origin} serves ${served}, an older Turn Zero Cloud. ${tokenCodeUnread === void 0 ? PLANE_OLDER_WAY_ON : `${PLANE_OLDER_FIRST_ACT_WAY_ON} ${tokenCodeUnread}`}`;
+var planeOlderSentence = (version, origin, key, needs, served, tokenCodeUnread) => `${TURNZERO_CLOUD_PACKAGE} ${version} needs ${WIRE_FILE_NOUNS[key]} of ${needs} or later, and ${origin} serves ${served}, an older Turn Zero Cloud. ${tokenCodeUnread === void 0 ? PLANE_OLDER_WAY_ON : tokenCodeUnread === "" ? PLANE_OLDER_FIRST_ACT_WAY_ON : `${PLANE_OLDER_FIRST_ACT_WAY_ON} ${tokenCodeUnread}`}`;
 var COMMAND_LATEST_FORM = /^(?:0|[1-9]\d{0,8})\.(?:0|[1-9]\d{0,8})\.(?:0|[1-9]\d{0,8})$/;
 var servedHealthOf = async (io2, origin) => {
   const controller = new AbortController();
@@ -845,7 +851,8 @@ var loginLinesFor = (io2, origin) => [
 var REDACTED_TOKEN = "<minted token>";
 var MINTED_TOKEN_PREFIX_WORDS = `${MINTED_TOKEN_PREFIX.slice(0, -1)} and an underscore`;
 var CREDENTIAL_SOURCES = Object.freeze(["standard_input", "minted_token_variable", "credential_file"]);
-var credentialPlaces = (declared) => declared.places ?? `the command reads the grant from its standard input, as the line ${declared.call} answers pipes it in${declared.mintedToken ? `, and otherwise a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, or this computer's token for the platform's address from its credential file, which login and authorize write` : declared.computerToken === true ? `, and otherwise this computer's token for the platform's address from its credential file, which login and authorize write, and never a minted token from ${MINTED_TOKEN_VARIABLE}` : ""}.`;
+var NO_INPUT_PLACES = `The command reads no standard input. It reads a minted token from ${MINTED_TOKEN_VARIABLE} where it is set. A tool connected by a minted token sets it from where its token is kept, and a job with no tool from its secret store. Otherwise it reads this computer's token for the platform's address from its credential file, which login and authorize write.`;
+var credentialPlaces = (declared) => declared.places ?? `The command reads the grant from its standard input, as the line ${declared.call} answers pipes it in.${declared.mintedToken ? ` Otherwise it reads a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, or this computer's token for the platform's address from its credential file, which login and authorize write.` : declared.computerToken === true ? ` Otherwise it reads this computer's token for the platform's address from its credential file, which login and authorize write. It never reads a minted token from ${MINTED_TOKEN_VARIABLE}.` : ""}`;
 var unsetVariableWayOn = (declared) => `To run a line you wrote yourself under this computer's token, unset ${MINTED_TOKEN_VARIABLE} and run it again; or pipe ${declared.aGrant}.`;
 var grantWaysOn = (declared) => `Pipe ${declared.aGrant}, as the line ${declared.call} answers pipes it, or, where you wrote the line yourself, pipe nothing to run it under this computer's token.`;
 var emptyGrantRefusal = (declared) => `The ${declared.grant} piped to the command was empty, so nothing was sent and nothing was started. ${grantWaysOn(declared)}`;
@@ -856,7 +863,7 @@ var unendedReadRefusal = (declared, reading) => unendedReadSentence(
   declared.computerToken === true ? grantWaysOn(declared) : pipeWholeWayOn(declared.aGrant, declared.call)
 );
 var emptyTokenVariableRefusal = () => `${MINTED_TOKEN_VARIABLE} is set but empty, so nothing was sent and nothing was started: the read that set it for this line found no token. Set it to your minted token from where your tool keeps it, or unset it to use this computer's token.`;
-var noCredentialRefusal = (declared, origin, expiredAt, again) => `No ${declared.grant} was read, so nothing was started: ${credentialPlaces(declared)} ${expiredAt === null ? `This computer's credential file holds no token for ${origin}.` : `This computer's token for ${origin} in its credential file expired at ${expiredAt}.`} ${again}`.trimEnd();
+var noCredentialRefusal = (declared, origin, expiredAt, again) => `No ${declared.grant} was read, so nothing was started. ${credentialPlaces(declared)} ${expiredAt === null ? `This computer's credential file holds no token for ${origin}.` : `This computer's token for ${origin} in its credential file expired at ${expiredAt}.`} ${again}`.trimEnd();
 var expired = (expiresAt, now) => expiresAt !== null && Date.parse(expiresAt) <= now.getTime();
 async function readCredential(io2, declared, again, line = { named: void 0, closing: "" }) {
   if (declared.piped !== false) {
@@ -880,14 +887,14 @@ async function readCredential(io2, declared, again, line = { named: void 0, clos
   if (held !== void 0 && token2 === "" && declared.mintedToken) return { refusal: emptyTokenVariableRefusal() };
   if (token2 !== "" && !declared.mintedToken) {
     return {
-      refusal: `No ${declared.grant} was read, so nothing was started. ${MINTED_TOKEN_VARIABLE} is set, and this subcommand does not run under a minted token: ${credentialPlaces(declared)} ${computerToken ? `${unsetVariableWayOn(declared)} ` : ""}${again}`
+      refusal: `No ${declared.grant} was read, so nothing was started. ${MINTED_TOKEN_VARIABLE} is set, and this subcommand does not run under a minted token. ${credentialPlaces(declared)} ${computerToken ? `${unsetVariableWayOn(declared)} ` : ""}${again}`
     };
   }
-  if (!declared.mintedToken && !computerToken) return { refusal: `No ${declared.grant} was read, so nothing was started: ${credentialPlaces(declared)} ${again}` };
+  if (!declared.mintedToken && !computerToken) return { refusal: `No ${declared.grant} was read, so nothing was started. ${credentialPlaces(declared)} ${again}` };
   if (token2 !== "") {
     if (!MINTED_TOKEN_FORM.test(token2)) {
       return {
-        refusal: `What ${MINTED_TOKEN_VARIABLE} holds is not a minted token, so nothing was sent and nothing was started: a token mint_token answers opens with ${MINTED_TOKEN_PREFIX_WORDS}. Set the variable to that token, from where your tool keeps it or from your CI's secret store.`
+        refusal: `${MINTED_TOKEN_VARIABLE} does not hold a minted token, so nothing was sent and nothing was started. A token that mint_token answers opens with ${MINTED_TOKEN_PREFIX_WORDS}. Set the variable to that token, from where your tool keeps it or from your CI's secret store.`
       };
     }
     return { credential: token2, kind: "token", source: "minted_token_variable" };
@@ -922,18 +929,19 @@ var variableReadSentence = (origin, standing) => {
   const opening = `The credential this run read was the minted token in ${MINTED_TOKEN_VARIABLE}, which wins over this computer's credential file`;
   switch (standing) {
     case "live":
-      return `${opening}, and that file holds a token for ${origin}: where the variable is left from another run, unset it and run the line again to run under this computer's token.`;
+      return `${opening}. That file holds a token for ${origin}. Where the variable is left from another run, unset it and run the line again to run under this computer's token.`;
     case "expired":
-      return `${opening}; that file holds a token for ${origin} that has expired.`;
+      return `${opening}. That file holds a token for ${origin} that has expired.`;
     case "none":
-      return `${opening}; that file holds no token for ${origin}.`;
+      return `${opening}. That file holds no token for ${origin}.`;
     case "unread":
-      return `${opening}; that file could not be read.`;
+      return `${opening}. That file could not be read.`;
   }
 };
 var fileReadSentence = (origin) => `The credential this run read was this computer's token for ${origin}, from its credential file: where the platform no longer accepts it, run ${LOGIN_SUBCOMMAND}${originWordsOf(origin)} to authorize this computer again.`;
 var noTokenSentence = (origin, expiredAt) => expiredAt === null ? `No credential was read, so nothing was sent: ${MINTED_TOKEN_VARIABLE} is not set, and this computer's credential file holds no token for ${origin}.` : `No credential was read, so nothing was sent: ${MINTED_TOKEN_VARIABLE} is not set, and this computer's token for ${origin} in its credential file expired at ${expiredAt}.`;
-var VARIABLE_ROUTE_SENTENCES = `A tool connected by a minted token, or a job, sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, never by writing the value in a line, and ${ORIGIN_VARIABLE} to the address that minted the token where that is not ${DEFAULT_COMMAND_ORIGIN}, then runs the line again. Such a tool cannot use ${MINT_TOKEN_ACTION}, which takes a sign-in alone. A tool sets ${MINTED_TOKEN_VARIABLE} for one line at a time and unsets it once that line ends.`;
+var VARIABLE_ROUTE_SENTENCES = `A tool connected by a minted token, or a job, sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, never by writing the value in a line. It sets ${ORIGIN_VARIABLE} to the address that minted the token where that is not ${DEFAULT_COMMAND_ORIGIN}, then runs the line again. Such a tool cannot use ${MINT_TOKEN_ACTION}, which takes a sign-in alone. A tool sets ${MINTED_TOKEN_VARIABLE} for one line at a time and unsets it once that line ends.`;
+var authorizeRouteSentence = (origin) => `${AUTHORIZE_SUBCOMMAND}${originWordsOf(origin)} run with nothing piped prints the ${MINT_TOKEN_ACTION} call a signed-in tool makes to authorize this computer.`;
 var LOGIN_ROUTE_OPENER = "A person logs this computer in once, in a terminal of their own, and its token then stays on this computer for 30 days:";
 var DEPLOY_FILES_ROUTE_SENTENCE = "A folder within the caps of your tool's deploy_files call deploys now through deploy_files, with no login.";
 var loginRouteLines = (io2, origin, deployFiles = true) => [
@@ -1010,7 +1018,9 @@ var TOKEN_CODE_RUN_AGAIN = "Run the line again once the cause above is put right
 var TOKEN_CODE_UNREAD = `${TOKEN_CODE_UNREAD_FIRST} ${TOKEN_CODE_RUN_AGAIN}`;
 var tokenCodeFloorSentence = (version, found) => `${TURNZERO_CLOUD_PACKAGE} ${version} needs Node.js ${COMMAND_NODE_FLOOR} or later, and this machine runs Node.js ${found}, so nothing was read and nothing was started. A token code the line carried was not read: it is live until it expires, and it mints nothing without this computer's verifier. Install Node.js ${COMMAND_NODE_FLOOR} or later, then run the line again.`;
 var NOTHING_SENT = "Nothing was sent and nothing was started.";
-var carriesTokenCode = (argv2) => argv2[0] === AUTHORIZE_SUBCOMMAND || argv2[0] === TOKEN_SUBCOMMAND && argv2[1] === TOKEN_CLAIM_ACT;
+var MINT_UNPRESENTED = `Nothing was presented. ${TOKEN_CODE_RUN_AGAIN}`;
+var namesMint = (argv2) => argv2[0] === AUTHORIZE_SUBCOMMAND && argv2.slice(1).some((argument) => argument === MINT_OPTION || argument.startsWith(`${MINT_OPTION}=`));
+var carriesTokenCode = (argv2) => argv2[0] === AUTHORIZE_SUBCOMMAND && !namesMint(argv2) || argv2[0] === TOKEN_SUBCOMMAND && argv2[1] === TOKEN_CLAIM_ACT;
 var LABEL_FALLBACK = "authorized computer";
 var computerLabelOf = (host) => {
   let label = "";
@@ -1035,24 +1045,25 @@ var mintCallMembers = (kind, challenge, label) => kind === "authorized computer"
   [CODE_CHALLENGE_MEMBER, challenge],
   ["scope_kind", "account"],
   [AUTHORIZED_COMPUTER_MEMBER, true],
-  ["label", label]
+  ["label", label],
+  [COMPLETION_MEMBER, COMPLETION_MINT]
 ] : [[CODE_CHALLENGE_MEMBER, challenge]];
 var firstActNamed = (kind, origin = DEFAULT_COMMAND_ORIGIN) => `${kind === "authorized computer" ? AUTHORIZE_SUBCOMMAND : `${TOKEN_SUBCOMMAND} ${TOKEN_REQUEST_ACT}`}${originWordsOf(origin)}`;
 var noConnectionLine = (origin) => `Where your tool holds no connection signed in to ${origin}, ${MINT_TOKEN_ACTION} is not among its tools: a person connects the tool and signs in, in a browser, before the call.`;
 var loginWaySentence = (loginLines) => `A person can instead log this computer in themselves, in a terminal of their own, by running ${loginLines.join(", then ")}, and approving the login in the browser.`;
 var firstActLines = (origin, kind, pending, label, loginLines = []) => [
-  kind === "authorized computer" ? `To authorize this computer at ${origin}, call ${MINT_TOKEN_ACTION} from your tool, through the connection you signed in with, naming the members below and no others, then run the line it answers once, as given, on this computer.` : `To mint a token whose value never passes through the chat, call ${MINT_TOKEN_ACTION} at ${origin} from your tool, through the connection you signed in with, naming the member below beside the scope_kind, application, grants, label, and expires_in_days the task needs.`,
+  kind === "authorized computer" ? `To authorize this computer at ${origin}, call ${MINT_TOKEN_ACTION} from your tool, through the connection you signed in with, naming the members below and no others. Then run the line it answers once, as given, on this computer.` : `To mint a token whose value never passes through the chat, call ${MINT_TOKEN_ACTION} at ${origin} from your tool, through the connection you signed in with. Name the member below beside the scope_kind, application, grants, label, and expires_in_days the task needs.`,
   // The case this command cannot see (#4273): a tool with no signed-in
   // connection holds no mint_token, and only a person's sign-in mends it.
   noConnectionLine(origin),
   `${CHALLENGE_LINE_HEAD}${pending.challenge}`,
   CALL_LINE_HEAD,
   ...mintCallMembers(kind, pending.challenge, label).map(([name, value]) => `  ${name}: ${JSON.stringify(value)}`),
-  kind === "authorized computer" ? `The line keeps the token it mints in this computer's credential file and revokes the one this computer held there before. The token is account-scoped and works from any computer until it expires or revoke_token ends it, and list_tokens shows it by its label. The request is pending until ${pending.expires_at}: ${firstActNamed(kind, origin)} run again before then prints this challenge again.` : `It answers a ${TOKEN_SUBCOMMAND} ${TOKEN_CLAIM_ACT} line, which is yours to run in a terminal outside the AI coding tool, on this computer as this user, and never through the tool: it prints the token's value once to standard output, so pipe it into your secret store's command where the token is a job's. The request is pending until ${pending.expires_at}: ${firstActNamed(kind, origin)} run again before then prints this challenge again.`,
+  kind === "authorized computer" ? `The line it answers holds no code. It keeps the token it mints in this computer's credential file and revokes the one this computer held there before. The token is account-scoped and works from any computer until it expires or revoke_token ends it, and list_tokens shows it by its label. The request is pending until ${pending.expires_at}: ${firstActNamed(kind, origin)} run again before then prints this challenge again.` : `It answers a ${TOKEN_SUBCOMMAND} ${TOKEN_CLAIM_ACT} line, which is yours to run in a terminal outside the AI coding tool, on this computer as this user, and never through the tool. That line prints the token's value once to standard output, so pipe it into your secret store's command where the token is a job's. The request is pending until ${pending.expires_at}: ${firstActNamed(kind, origin)} run again before then prints this challenge again.`,
   ...kind === "authorized computer" && loginLines.length > 0 ? [loginWaySentence(loginLines)] : []
 ];
 var reusedRequestSentence = (origin, pending) => `A request for ${origin} is pending until ${pending.expires_at}, so its challenge is printed again and no new verifier was made.`;
-var replacedRequestSentence = (origin, expired2) => `The request pending for ${origin} expired at ${expired2.expires_at}, so a new one replaces it: a line minted against the old challenge is refused at its exchange, and a ${MINT_TOKEN_ACTION} call naming the new challenge below answers a fresh one.`;
+var replacedRequestSentence = (origin, expired2) => `The request pending for ${origin} expired at ${expired2.expires_at}, so a new one replaces it. A line minted against the old challenge is refused at its exchange, and a ${MINT_TOKEN_ACTION} call naming the new challenge below answers a fresh one.`;
 async function firstAct(io2, origin, kind, say, opener = null) {
   const kept2 = keepPendingRequest(io2, origin, say);
   if ("status" in kept2) return kept2.status;
@@ -1115,6 +1126,7 @@ function keepPendingRequest(io2, origin, say) {
 var TOKEN_CALL_BOUND_SECONDS = 60;
 var EXCHANGE_ACT = "exchange";
 var exchangeBodyOf = (verifier) => ({ [CODE_VERIFIER_MEMBER]: verifier });
+var heldExchangeBodyOf = (mint) => ({ [MINT_MEMBER]: mint });
 var revocationBodyOf = (id) => ({ id });
 var postAction = async (io2, origin, action, bearer, userAgent, body) => {
   const controller = new AbortController();
@@ -1171,7 +1183,7 @@ var mintedTokenOf = (answer) => {
 };
 var mintAgainSentence = (kind, origin = DEFAULT_COMMAND_ORIGIN, login2 = null) => login2 !== null ? `Run ${login2} again to log this computer in.` : `Call ${MINT_TOKEN_ACTION} from your tool again with the challenge ${firstActNamed(kind, origin)} prints, and run the line it answers.`;
 var exchangeUnknownSentence = (kind, origin = DEFAULT_COMMAND_ORIGIN, login2 = null) => `Whether a token was minted is unknown: list_tokens from your tool shows each token by its label, and revoke_token ends one nothing holds. ${mintAgainSentence(kind, origin, login2)}`;
-var noPendingSentence = (origin, kind) => `No request is pending for ${origin} on this computer, so the token code was not presented and nothing was sent: the verifier it needs is kept only on the computer whose ${firstActNamed(kind)} printed its challenge. Run ${firstActNamed(kind, origin)} on this computer, call ${MINT_TOKEN_ACTION} from your tool with the challenge it prints, and run the line it answers.`;
+var noPendingSentence = (origin, kind, presented = "code") => `No request is pending for ${origin} on this computer, so ${presented === "mint" ? "nothing was sent: the verifier the mint needs" : "the token code was not presented and nothing was sent: the verifier it needs"} is kept only on the computer whose ${firstActNamed(kind)} printed its challenge. Run ${firstActNamed(kind, origin)} on this computer, call ${MINT_TOKEN_ACTION} from your tool with the challenge it prints, and run the line it answers.`;
 var markerDisagreesSentence = (kind, origin = DEFAULT_COMMAND_ORIGIN) => kind === "authorized computer" ? `The exchange minted a token that is not an authorized computer's, and ${AUTHORIZE_SUBCOMMAND} keeps only an authorized computer's, so nothing of its value was printed or kept. Call ${MINT_TOKEN_ACTION} from your tool again naming ${AUTHORIZED_COMPUTER_MEMBER}: true, as ${AUTHORIZE_SUBCOMMAND} prints it, and run the line it answers.` : `The exchange minted an authorized computer's token, and ${TOKEN_SUBCOMMAND} ${TOKEN_CLAIM_ACT} prints only a token that is not one, so nothing of its value was printed or kept. Call ${MINT_TOKEN_ACTION} from your tool again without ${AUTHORIZED_COMPUTER_MEMBER}, as ${TOKEN_SUBCOMMAND} ${TOKEN_REQUEST_ACT} prints it, and run the line it answers; to authorize this computer, run ${AUTHORIZE_SUBCOMMAND}${originWordsOf(origin)}.`;
 var mintedRevocationLines = (revocation, minted) => "lines" in revocation ? [...revocation.lines, standsSentence(`The token it minted, ${minted.id},`, minted.id, minted.expiresAt)] : [`The token it minted, ${minted.id}, is revoked.`];
 var authorizedLineOf = (origin, entry, account = null) => `${AUTHORIZED_LINE_HEAD}${origin}${account !== null ? ` as ${accountWordsOf(account)}` : ""}, label ${entry.label !== null ? JSON.stringify(entry.label) : "none"}, its token expiring ${entry.expires_at !== null ? `at ${entry.expires_at}` : "never"}`;
@@ -1202,17 +1214,19 @@ async function readAccountUnder(io2, origin, token2, userAgent) {
 var whoamiLineFor = (io2, origin) => printedLineOf(io2, commandLineOf(origin, WHOAMI_SUBCOMMAND, origin !== DEFAULT_COMMAND_ORIGIN ? { origin } : {}), origin);
 var accountUnreadSentence = (whoami2) => `The account this computer's token acts as was not read, and the token is kept: run ${whoami2} to read it.`;
 var CLAIMED_LINE_HEAD = "claimed: ";
-async function completeAct(io2, origin, kind, code, userAgent, say, deliver = () => void 0, login2 = null) {
+async function completeAct(io2, origin, kind, presentation, userAgent, say, deliver = () => void 0, login2 = null) {
+  const held = "mint" in presentation;
+  const unread = held ? MINT_UNPRESENTED : TOKEN_CODE_UNREAD;
   const place = credentialFileOf(io2);
   const read2 = readMovingCredentialFile(io2, place, say);
   if (!("state" in read2)) {
-    say(`${readRefusalOf(read2, place.path)} ${TOKEN_CODE_UNREAD}`);
+    say(`${readRefusalOf(read2, place.path)} ${unread}`);
     return COMMAND_STATUS.nothing_started;
   }
   hideStandingTokens(io2, read2.state);
   const pending = read2.state.pending.get(origin);
   if (pending === void 0) {
-    say(noPendingSentence(origin, kind));
+    say(noPendingSentence(origin, kind, held ? "mint" : "code"));
     return COMMAND_STATUS.nothing_started;
   }
   io2.hide(pending.verifier, REDACTED_VERIFIER);
@@ -1222,25 +1236,25 @@ async function completeAct(io2, origin, kind, code, userAgent, say, deliver = ()
   const release = io2.whenEnded(() => {
     stage.ended = true;
     say(
-      stage.now === "unsent" ? `The run was ended before its exchange. ${TOKEN_CODE_UNREAD}` : stage.now === "sent" ? `The run was ended during its exchange. ${exchangeUnknownSentence(kind, origin, login2)}` : `The run was ended after its exchange minted a token, which may not have been ${kind === "authorized computer" ? "kept" : "printed"}: list_tokens from your tool shows it by its label, and revoke_token ends it.`
+      stage.now === "unsent" ? `The run was ended before its exchange. ${unread}` : stage.now === "sent" ? `The run was ended during its exchange. ${exchangeUnknownSentence(kind, origin, login2)}` : `The run was ended after its exchange minted a token, which may not have been ${kind === "authorized computer" ? "kept" : "printed"}: list_tokens from your tool shows it by its label, and revoke_token ends it.`
     );
     dropCredentialWriting(io2, place, tag);
   });
   try {
     const prepared = prepareCredentialFile(io2, place, tag);
     if ("unwritten" in prepared) {
-      say(`${unwritableFileSentence(place.path, prepared.unwritten)} Nothing was sent. ${TOKEN_CODE_UNREAD}`);
+      say(`${unwritableFileSentence(place.path, prepared.unwritten)} Nothing was sent. ${unread}`);
       return COMMAND_STATUS.nothing_started;
     }
     if (stage.ended) return COMMAND_STATUS.nothing_started;
-    const older = await planeWireRefusal(io2, origin, TOKEN_CODE_UNREAD_FIRST);
+    const older = await planeWireRefusal(io2, origin, held ? "" : TOKEN_CODE_UNREAD_FIRST);
     if (stage.ended) return COMMAND_STATUS.nothing_started;
     if (older !== null) {
       say(older);
       return COMMAND_STATUS.nothing_started;
     }
     stage.now = "sent";
-    const answered = await postAction(io2, origin, MINT_TOKEN_ACTION, code, userAgent, exchangeBodyOf(pending.verifier));
+    const answered = "mint" in presentation ? await postAction(io2, origin, MINT_TOKEN_ACTION, pending.verifier, userAgent, heldExchangeBodyOf(presentation.mint)) : await postAction(io2, origin, MINT_TOKEN_ACTION, presentation.code, userAgent, exchangeBodyOf(pending.verifier));
     if (stage.ended) {
       const late = answered === null ? null : planeObjectOf(answered.text);
       if (late !== null && typeof late.value === "string") io2.hide(late.value, REDACTED_TOKEN);
@@ -1253,7 +1267,7 @@ async function completeAct(io2, origin, kind, code, userAgent, say, deliver = ()
       return COMMAND_STATUS.unknown;
     }
     if (answered.redirected) {
-      say(`The exchange was answered ${answeredHow(answered.status)}, which the command never follows, so the code and the verifier were sent to no second address.`);
+      say(`The exchange was answered ${answeredHow(answered.status)}, which the command never follows, so ${held ? "the verifier was" : "the code and the verifier were"} sent to no second address.`);
       say(unknown);
       return COMMAND_STATUS.unknown;
     }
@@ -1272,7 +1286,9 @@ async function completeAct(io2, origin, kind, code, userAgent, say, deliver = ()
         return COMMAND_STATUS.unknown;
       }
       for (const line of refusalLines(EXCHANGE_ACT, answered.status, refusal)) say(line);
-      say(answered.status === 429 ? "Nothing was minted, and the token code was not spent: run the line again after the wait the answer names." : `Nothing was minted. ${mintAgainSentence(kind, origin, login2)}`);
+      say(
+        answered.status === 429 ? `Nothing was minted, and ${held ? "nothing was spent" : "the token code was not spent"}: run the line again after the wait the answer names.` : `Nothing was minted. ${mintAgainSentence(kind, origin, login2)}`
+      );
       return COMMAND_STATUS.nothing_started;
     }
     const minted = answer === null ? null : mintedTokenOf(answer);
@@ -1344,29 +1360,45 @@ var AUTHORIZE_OPTIONS = Object.freeze([
     value: "<origin>",
     required: false,
     description: `The platform's address this computer is authorized at. Where absent, the address ${ORIGIN_VARIABLE} holds, or ${DEFAULT_COMMAND_ORIGIN} where it is unset. A ${DEPLOY_OPTION.origin} the line names must be ${DEFAULT_COMMAND_ORIGIN}, ${DEVELOPMENT_COMMAND_ORIGIN}, or the address ${ORIGIN_VARIABLE} holds, an address of this machine only where ${ORIGIN_VARIABLE} names it.`
+  },
+  {
+    name: MINT_OPTION,
+    value: "<id>",
+    required: false,
+    description: `The mint the line names, by its id, a lowercase UUID, as the line a ${MINT_TOKEN_ACTION} call answers names it. The id is no credential. Under it, ${AUTHORIZE_SUBCOMMAND} reads nothing on standard input and presents this computer's verifier for that mint.`
   }
 ]);
+var MINT_ID_REFUSAL = `${MINT_OPTION} names the mint by its id, a lowercase UUID, as the line the ${MINT_TOKEN_ACTION} call answered names it: run that line as given. ${NOTHING_SENT}`;
 var AUTHORIZE_CREDENTIAL = Object.freeze({
   grant: "token code",
   aGrant: "a token code",
   call: `the ${MINT_TOKEN_ACTION} call`,
   mintedToken: false,
-  bare: `with nothing piped, it keeps a verifier and prints the challenge and the ${MINT_TOKEN_ACTION} call that authorize this computer`
+  pipes: `where the line pipes one in, as the line of a ${MINT_TOKEN_ACTION} call that sets no completion does`,
+  bare: `with nothing piped and no ${MINT_OPTION}, it keeps a verifier and prints the challenge and the ${MINT_TOKEN_ACTION} call that authorize this computer. That call answers ${AUTHORIZE_SUBCOMMAND} ${MINT_OPTION} <id>, a line that holds no code: under it, ${AUTHORIZE_SUBCOMMAND} reads nothing on standard input and presents the verifier for that mint`
 });
-var AUTHORIZATION_ORIGIN_VARIABLE_LINE = `the platform's address the authorization reaches where the line names no ${DEPLOY_OPTION.origin}, and the one address beside ${DEFAULT_COMMAND_ORIGIN} and ${DEVELOPMENT_COMMAND_ORIGIN} a ${DEPLOY_OPTION.origin} may name, an address of this machine only where it names it.`;
+var AUTHORIZATION_ORIGIN_VARIABLE_LINE = `the platform's address the authorization reaches where the line names no ${DEPLOY_OPTION.origin}. It is the one address beside ${DEFAULT_COMMAND_ORIGIN} and ${DEVELOPMENT_COMMAND_ORIGIN} a ${DEPLOY_OPTION.origin} may name, an address of this machine only where it names it.`;
 var CREDENTIAL_FILE_WORDS = `${CREDENTIAL_FILE_NAME} in a folder ${CREDENTIAL_FOLDER_NAME} under ${CONFIG_HOME_VARIABLE}, or under .config in your home folder where that is unset, readable by you alone. On Windows it is in a folder ${WINDOWS_CREDENTIAL_FOLDER_NAME} under your profile folder, ${PROFILE_VARIABLE}. A file under ${LOCAL_APP_DATA_VARIABLE} from an older version is moved there once`;
-var AUTHORIZE_AFTER_OWN_ERROR = "a token code the line carried may not have been presented, and it is live until it expires and mints nothing without this computer's verifier; where a token was minted, list_tokens from your tool shows it by its label, and revoke_token ends it";
+var AUTHORIZE_AFTER_OWN_ERROR = "a token code the line carried may not have been presented. That code is live until it expires, and mints nothing without this computer's verifier. Where a token was minted, list_tokens from your tool shows it by its label, and revoke_token ends it";
+var MINT_AFTER_OWN_ERROR = "the verifier may not have been presented. Where a token was minted, list_tokens from your tool shows it by its label, and revoke_token ends it";
 async function authorize(call, io2) {
+  const mint = call.named[MINT_OPTION];
+  if (mint !== void 0 && !MINT_ID_FORM.test(mint)) {
+    io2.print(MINT_ID_REFUSAL);
+    return COMMAND_STATUS.nothing_started;
+  }
+  const unread = mint !== void 0 ? MINT_UNPRESENTED : TOKEN_CODE_UNREAD;
   const origin = authorizationOriginOf(io2.env, call.named[DEPLOY_OPTION.origin], NOTHING_SENT);
   if ("refusal" in origin) {
-    io2.print(`${origin.refusal} ${TOKEN_CODE_UNREAD}`);
+    io2.print(`${origin.refusal} ${unread}`);
     return COMMAND_STATUS.nothing_started;
   }
   const agent = userAgentOf(io2.env);
   if ("refusal" in agent) {
-    io2.print(`${agent.refusal} ${TOKEN_CODE_UNREAD}`);
+    io2.print(`${agent.refusal} ${unread}`);
     return COMMAND_STATUS.nothing_started;
   }
+  if (mint !== void 0) return completeAct(io2, origin.origin, "authorized computer", { mint }, agent.userAgent, io2.print);
   const read2 = await readTokenCode(io2, "authorized computer", origin.origin);
   if ("refusal" in read2) {
     io2.print(read2.refusal);
@@ -1379,11 +1411,11 @@ async function authorize(call, io2) {
     return COMMAND_STATUS.nothing_started;
   }
   io2.hide(code, REDACTED_TOKEN_CODE);
-  return completeAct(io2, origin.origin, "authorized computer", code, agent.userAgent, io2.print);
+  return completeAct(io2, origin.origin, "authorized computer", { code }, agent.userAgent, io2.print);
 }
 var AUTHORIZE_ROW = Object.freeze({
   name: AUTHORIZE_SUBCOMMAND,
-  summary: `Authorizes this computer at the platform's address, in two acts around one ${MINT_TOKEN_ACTION} call your tool makes. Run with nothing piped, it keeps a verifier in this computer's credential file, and prints the challenge and the call. Run with the token code the call's line pipes in, it presents the code with the verifier. It then keeps the token the platform mints in the credential file, and prints authorized:. It prints no token, code, or verifier.`,
+  summary: `Authorizes this computer at the platform's address, in two acts around one ${MINT_TOKEN_ACTION} call your tool makes. Run with nothing piped, it keeps a verifier in this computer's credential file, and prints the challenge and the call. Run as the line the call answers, with ${MINT_OPTION} and no code, or with a piped token code, it presents the verifier. It then keeps the minted token in that file, and prints authorized:. It prints no token, code, or verifier.`,
   example: AUTHORIZE_SUBCOMMAND,
   options: AUTHORIZE_OPTIONS,
   credential: AUTHORIZE_CREDENTIAL,
@@ -1391,14 +1423,14 @@ var AUTHORIZE_ROW = Object.freeze({
     done: "the challenge printed, or this computer authorized",
     failed: "a token was minted and not kept, or the token this computer held before was not revoked: the printed lines name revoke_token",
     unknown: "the exchange drew no answer, or an answer that is not a refusal: list_tokens shows whether a token was minted",
-    nothing_started: "nothing was minted: an option, the credential file, or the token code was refused, no request was pending, the platform was too old, or the exchange was refused"
+    nothing_started: `nothing was minted. An option, the mint's id, the credential file, or the token code was refused. Or no request was pending, the platform was too old, or the exchange was refused`
   },
   variables: [[ORIGIN_VARIABLE, AUTHORIZATION_ORIGIN_VARIABLE_LINE]],
   note: [
-    `Authorizing this computer takes three acts once for each platform address, which your signed-in tool makes itself and then reports to you; login, run in a terminal of your own, is your own way. ${AUTHORIZE_SUBCOMMAND} run with nothing piped prints a challenge and the ${MINT_TOKEN_ACTION} call to make; your tool makes that call through the connection you signed in with, and runs the line it answers once, as given, on this computer, which keeps the token.`,
+    `Authorizing this computer takes three acts once for each platform address, which your signed-in tool makes itself and then reports to you; login, run in a terminal of your own, is your own way. ${AUTHORIZE_SUBCOMMAND} run with nothing piped prints a challenge and the ${MINT_TOKEN_ACTION} call to make. Your tool makes that call through the connection you signed in with, and runs the line it answers once, as given, on this computer. That line holds no code, and it keeps the token.`,
     `The token is account-scoped and works from any computer until it expires or revoke_token ends it: keep it as you would a password, list_tokens shows it by this computer's host name, and logout ends it. The credential file is ${CREDENTIAL_FILE_WORDS}.`
   ],
-  afterOwnError: AUTHORIZE_AFTER_OWN_ERROR,
+  afterOwnError: (call) => call.named[MINT_OPTION] !== void 0 ? MINT_AFTER_OWN_ERROR : AUTHORIZE_AFTER_OWN_ERROR,
   run: authorize
 });
 
@@ -1865,11 +1897,11 @@ var codeOf = (error) => {
   return typeof code === "string" && /^[A-Z0-9_]+$/.test(code) ? code : "unwritable";
 };
 var addressable = (entry) => ![entry.area, ...entry.name.split(/[\\/]/)].some((segment) => segment === "." || segment === "..");
-var applicationFolderSentence = () => `The folder the line runs in holds package.json, so it is an application's folder, and the line names no ${EXPORT_OPTION.path}: the export would be written inside it, where a deploy from that folder would carry every file of the export. Run the line again with ${EXPORT_OPTION.path} naming a folder outside this one, which the same grant serves until it expires. ${NOTHING_WRITTEN}`;
+var applicationFolderSentence = () => `The folder the line runs in holds package.json, so it is an application's folder, and the line names no ${EXPORT_OPTION.path}. The export would be written inside it, where a deploy from that folder would carry every file of the export. Run the line again with ${EXPORT_OPTION.path} naming a folder outside this one, which the same grant serves until it expires. ${NOTHING_WRITTEN}`;
 var ABSENT_FILE_STATUS = 404;
 var ABSENT_FILE_ERROR = "no_such_file";
 var freshExportLine = (absent) => `${absent === 1 ? "A file the manifest names was" : `${absent} files the manifest names were`} answered as an absent name and ${absent === 1 ? "was" : "were"} not read. A fresh export has the application's files as they now stand: call request_export from your tool, then ${DOWNLOAD_GRANT_ACTION} once read_export answers it completed.`;
-var runAgainLine = (again) => `Run the line again before its grant expires, or take a fresh one: ${again} It skips the files on disk and reads again each file whose read failed.`;
+var runAgainLine = (again) => `Run the line again before its grant expires, or take a fresh one. ${again} It skips the files on disk and reads again each file whose read failed.`;
 var MANIFEST_READ = "The manifest read";
 var fileReadOf = (natural) => `The read of ${shownWhole(natural)}`;
 var APPLICATION_MARK = "package.json";
@@ -1917,7 +1949,7 @@ async function exportDownload(call, io2) {
     }
     if (earlier === null) {
       io2.print(
-        `${called} holds files and no index of this export, so the command writes nothing into it: name a new or empty folder with ${EXPORT_OPTION.path}, or the folder an earlier run of this export's line wrote. ${NOTHING_WRITTEN}`
+        `${called} holds files and no index of this export, so the command writes nothing into it. Name a new or empty folder with ${EXPORT_OPTION.path}, or the folder an earlier run of this export's line wrote. ${NOTHING_WRITTEN}`
       );
       return COMMAND_STATUS.nothing_started;
     }
@@ -1986,7 +2018,7 @@ async function exportDownload(call, io2) {
   if (!(manifestRead instanceof Response)) {
     if (manifestRead.kind === "ended") for (const line of manifestRead.lines) io2.print(line);
     else io2.print(`The export's manifest could not be read: ${manifestRead.kind === "failed" ? manifestRead.reason : "the read was capped"}.`);
-    io2.print(`${manifestRead.kind === "ended" ? again : `Call read_export from your tool with application ${options.application} and export ${options.export} to see whether the export completed, then ${again.charAt(0).toLowerCase()}${again.slice(1)}`} ${NOTHING_WRITTEN}`);
+    io2.print(`${manifestRead.kind === "ended" ? again : `Call read_export from your tool with application ${options.application} and export ${options.export} to see whether the export completed. Then ${again.charAt(0).toLowerCase()}${again.slice(1)}`} ${NOTHING_WRITTEN}`);
     return COMMAND_STATUS.nothing_started;
   }
   let manifestBytes;
@@ -2866,9 +2898,9 @@ function* readArtifactSteps(bytes) {
   const unreadable = () => new DeployRefusal(
     400,
     "artifact_unreadable",
-    "The artifact's bytes do not read as a zip archive. The platform deploys a zip holding the application's package.json at its root: zip the project folder's contents and deploy again (PLD-L0-63)."
+    "The artifact's bytes do not read as a zip archive. The platform deploys a zip holding the application's package.json at its root: zip the project folder's contents and deploy again."
   );
-  const layoutRefusal = (detail) => new DeployRefusal(400, "artifact_layout_invalid", `${detail} (PLD-L0-63).`);
+  const layoutRefusal = (detail) => new DeployRefusal(400, "artifact_layout_invalid", `${detail}.`);
   let declaredBytes = 0;
   let listing;
   try {
@@ -2909,7 +2941,7 @@ function* readArtifactSteps(bytes) {
       texts.set(index, inflateZipRecord(bytes, records[index]).toString("utf8"));
     } catch (error) {
       if (!(error instanceof ZipUnreadable)) throw error;
-      throw new DeployRefusal(400, "artifact_unreadable", `The zip's ${error.message}: zip the application's folder again, and deploy again (PLD-L0-63).`);
+      throw new DeployRefusal(400, "artifact_unreadable", `The zip's ${error.message}: zip the application's folder again, and deploy again.`);
     }
     yield;
   }
@@ -2991,14 +3023,14 @@ function unbuiltBinding(reading) {
 }
 function artifactLayoutOf(reading) {
   const refuse = (detail) => {
-    throw new DeployRefusal(400, "artifact_layout_invalid", `${detail} (PLD-L0-63).`);
+    throw new DeployRefusal(400, "artifact_layout_invalid", `${detail}.`);
   };
   const unbuilt = unbuiltBinding(reading);
   if (unbuilt !== null) {
     const where = unbuilt.root ? "is the root binding.gyp, and the zip holds no .node file outside node_modules and every workspace member's folder" : "is a binding.gyp of the artifact's own, beside a workspace member's package.json, and that member's folder, less its nested members' folders, holds no .node file";
     const ship = unbuilt.root ? "ship its .node file in the zip" : "ship its .node file inside the member's folder";
     refuse(
-      `The zip's entry ${shownEntry(unbuilt.entry)} ${where}. A native module of the artifact's own must ship prebuilt, because the platform never builds the customer's code (PLD-L0-60): build it for Linux on your machine, ${ship}, and deploy again`
+      `The zip's entry ${shownEntry(unbuilt.entry)} ${where}. A native module of the artifact's own must ship prebuilt, because the platform never builds the customer's code: build it for Linux on your machine, ${ship}, and deploy again`
     );
   }
   if (reading.oversizedRoot !== null) {
@@ -3037,7 +3069,7 @@ var nestingDeeperThan = (value, max) => {
 function manifestCopyDepthRefusal(reading) {
   if (reading.manifestJson === null) return;
   if (nestingDeeperThan(parsePackageJson(reading.manifestJson), MANIFEST_COPY_DEPTH_MAX)) {
-    throw new DeployRefusal(400, "artifact_layout_invalid", `The zip's manifest.json nests deeper than the ${MANIFEST_COPY_DEPTH_MAX} levels the deploy reads: the platform reads the manifest submit_manifest recorded, so flatten the zip's copy or leave it out, and deploy again (PLD-L0-63).`);
+    throw new DeployRefusal(400, "artifact_layout_invalid", `The zip's manifest.json nests deeper than the ${MANIFEST_COPY_DEPTH_MAX} levels the deploy reads: the platform reads the manifest submit_manifest recorded, so flatten the zip's copy or leave it out, and deploy again.`);
   }
 }
 function clientReadingOf(records) {
@@ -3057,7 +3089,7 @@ function clientReadingOf(records) {
   return { admitted, skipped };
 }
 function clientBoundRefusal(reading) {
-  const cite = " (SVC-L0-26).";
+  const cite = ".";
   if (reading.admitted.size > CLIENT_FILES_MAX) {
     return `The zip's client/ folder holds ${reading.admitted.size} files the publish admits, more than the ${CLIENT_FILES_MAX} files one version publishes: ship fewer client files, and deploy again${cite}`;
   }
@@ -3160,6 +3192,8 @@ var folderBindingOf = (io2, path) => {
   const application = members[APPLICATION_MEMBER];
   return typeof application === "string" && UPLOAD_ID.test(application) ? { kind: "bound", application } : { kind: "off_form" };
 };
+var BINDING_LINE_HEAD = "binding: ";
+var bindingLineOf = (application) => `${BINDING_LINE_HEAD}${FOLDER_MANIFEST} gets application ${application}, so later deploy and check lines naming another application are refused`;
 var BOUND_LINE_HEAD = "bound: ";
 var boundLineOf = (application) => `${BOUND_LINE_HEAD}${FOLDER_MANIFEST} now names application ${application}; a deploy or check line naming another application is refused`;
 var BIND_WRITE_FAILED_LINE = `${FOLDER_MANIFEST} could not be written to bind this folder to its application, so the deploy goes on unbound, and the next deploy writes it again.`;
@@ -3566,6 +3600,7 @@ function zipFolder(root, seams = {}) {
 // src/turnzero_cloud_command/deploy.ts
 var ZIP_LINE_HEAD = "zip: ";
 var PREPARED_LINE_HEAD = DEPLOY_PREPARED_LINE_HEAD;
+var UPLOADING_LINE_HEAD = "uploading: ";
 var UPLOADED_LINE_HEAD = "uploaded: ";
 var STARTED_LINE_HEAD = "started: ";
 var WAITING_LINE_HEAD = "waiting: ";
@@ -3584,7 +3619,7 @@ var deployOptionsOf = (named, cwd, flags = /* @__PURE__ */ new Set()) => {
     const found = COMMAND_ENVIRONMENTS.find((name) => name === env);
     if (found === void 0) {
       return {
-        refusal: `${DEPLOY_OPTION.env} names the environment to deploy to, ${COMMAND_ENVIRONMENTS.join(" or ")}; a line that names none deploys to the environment the platform chooses. Nothing was started.`
+        refusal: `${DEPLOY_OPTION.env} names the environment to deploy to, ${COMMAND_ENVIRONMENTS.join(" or ")}. A line that names none deploys to the environment the platform chooses. Nothing was started.`
       };
     }
     environment = found;
@@ -3609,9 +3644,9 @@ var DEPLOY_CREDENTIAL = Object.freeze({
   call: "the deploy call",
   mintedToken: true,
   piped: false,
-  places: `the command reads no standard input: it reads a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, as a tool connected by a minted token sets it from where its token is kept, or a job with no tool from its secret store, and otherwise this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write.`
+  places: NO_INPUT_PLACES
 });
-var DEPLOY_READS = `no standard input: a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, and otherwise this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write, sent only to that address; with neither, it prints the variable route first and then, where the address is admitted, the login route`;
+var DEPLOY_READS = `no standard input. It reads a minted token from ${MINTED_TOKEN_VARIABLE} where that is set. Otherwise it reads this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write, and sends it only to that address. With neither, it prints the variable route first, then the login route where the address is admitted`;
 var DEPLOY_AFTER_LOGIN = `Once login has printed authorized:, run this deploy line again. ${NOTHING_SENT_OR_STARTED}`;
 var PREPARE_ACT = "prepare";
 var PREPARE_AGAIN = "Nothing was started. Run the line again: it prepares a fresh upload, which replaces any upload this run prepared.";
@@ -3848,6 +3883,7 @@ async function deploy(named, io2, flags = /* @__PURE__ */ new Set()) {
   }
   io2.print(preparedLineOf(prepared));
   if (binding?.kind === "unbound" && binding.manifest !== null) {
+    io2.print(bindingLineOf(options.application));
     io2.print(writeManifestMember(io2, binding.manifest, APPLICATION_MEMBER, options.application) ? boundLineOf(options.application) : BIND_WRITE_FAILED_LINE);
   }
   const { upload, grant, environment } = prepared;
@@ -3855,6 +3891,7 @@ async function deploy(named, io2, flags = /* @__PURE__ */ new Set()) {
   const stop = commandStopSentence(options.application, environment);
   const uploadNoAnswer = uploadNoAnswerSentence(options.application, environment);
   const address = storageFileAddress(origin, deployAreaName(options.application), uploadFileName(upload));
+  io2.print(`${UPLOADING_LINE_HEAD}${zipped.zip.length} bytes as upload ${upload}`);
   let uploaded;
   try {
     uploaded = await writeAgain(
@@ -3984,7 +4021,7 @@ async function deploy(named, io2, flags = /* @__PURE__ */ new Set()) {
   io2.print(stop);
   return PROGRESS_EXIT_STATUS.refused;
 }
-var DEPLOY_AFTER_OWN_ERROR = "the deploy may or may not have started: call read_status from your tool first, make the start-only retry a pending upload it answers carries, and run the line again only where it shows neither";
+var DEPLOY_AFTER_OWN_ERROR = "the deploy may or may not have started. Call read_status from your tool first, make the start-only retry a pending upload it answers carries, and run the line again only where it shows neither";
 var DEPLOY_ROW = Object.freeze({
   name: DEPLOY_SUBCOMMAND,
   summary: "Deploys the application folder, or a .zip file. It zips the folder, makes the preparing deploy call, uploads the zip under the upload grant that call answers, starts the deploy, and waits for it, printing each step and the outcome. It runs under this computer's token. A tool connected by a minted token, or a job with no tool, runs it under a minted token. With no credential, it sends nothing and prints the two routes to one: the minted token's variables first, then, where the address is admitted, the login route.",
@@ -3996,21 +4033,21 @@ var DEPLOY_ROW = Object.freeze({
     done: `the version deployed, or the deploy started where ${DEPLOY_NO_WAIT_VARIABLE} is set`,
     failed: "the deploy failed",
     unknown: "the wait stopped, or the start drew no answer: the deploy may go on, and read_status reads it",
-    nothing_started: "an option, credential, folder, or the folder's binding was refused, no credential was read, the platform was too old, no usable upload was answered, no zipped file names the health path, the upload or start was refused, or the upload drew no answer"
+    nothing_started: "an option, credential, folder, or the folder's binding was refused, or no credential was read. Or the platform was too old, or no usable upload was answered. Or no zipped file names the health path. Or the upload or start was refused, or the upload drew no answer"
   },
   variables: [[DEPLOY_NO_WAIT_VARIABLE, "any value returns the command once the deploy has started, without waiting for it."]],
   note: [
-    `A deploy is one line, which carries no credential: run the line your tool's deploy call answers, or ${DEPLOY_SUBCOMMAND} ${DEPLOY_OPTION.application} <application id>, from the application's folder. It reads no standard input. On an authorized computer it runs under this computer's token, which ${LOGIN_SUBCOMMAND} or ${AUTHORIZE_SUBCOMMAND} keeps in the credential file for each platform address, and sends it only to the address it is kept under: ${DEPLOY_OPTION.origin} where the line names one, else the address ${ORIGIN_VARIABLE} holds, else ${DEFAULT_COMMAND_ORIGIN}.`,
-    `On a computer with no token for that address, or one that has expired, it sends nothing, ends 3, and prints two routes, in this order. A tool connected by a minted token, or a job with no tool, such as a CI job's, sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, such as the job's secret store, never by writing the value in a line. It sets ${ORIGIN_VARIABLE} to the address that minted the token where that is not ${DEFAULT_COMMAND_ORIGIN}, then runs the deploy line again. Such a tool cannot use ${MINT_TOKEN_ACTION}, which takes a sign-in alone.`,
-    `Otherwise a person logs this computer in once with ${LOGIN_SUBCOMMAND}, in a terminal of their own, then runs the deploy line again; a folder within the caps of the tool's deploy_files call deploys now through deploy_files, with no login. The credential file is ${CREDENTIAL_FILE_WORDS}.`,
+    `A deploy is one line, which carries no credential: run the line your tool's deploy call answers, or ${DEPLOY_SUBCOMMAND} ${DEPLOY_OPTION.application} <application id>, from the application's folder. It reads no standard input. On an authorized computer it runs under this computer's token, which ${LOGIN_SUBCOMMAND} or ${AUTHORIZE_SUBCOMMAND} keeps in the credential file for each platform address. It sends that token only to the address it is kept under: ${DEPLOY_OPTION.origin} where the line names one, else the address ${ORIGIN_VARIABLE} holds, else ${DEFAULT_COMMAND_ORIGIN}.`,
+    `On a computer with no token for that address, or one that has expired, it sends nothing, ends 3, and prints two routes, in this order. A tool connected by a minted token, or a job with no tool, such as a CI job's, sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, never by writing the value in a line. It sets ${ORIGIN_VARIABLE} to the address that minted the token where that is not ${DEFAULT_COMMAND_ORIGIN}, then runs the deploy line again. Such a tool cannot use ${MINT_TOKEN_ACTION}, which takes a sign-in alone.`,
+    `Otherwise a person logs this computer in once with ${LOGIN_SUBCOMMAND}, in a terminal of their own, then runs the deploy line again. A folder within the caps of the tool's deploy_files call deploys now through deploy_files, with no login. The credential file is ${CREDENTIAL_FILE_WORDS}.`,
     `A tool sets ${MINTED_TOKEN_VARIABLE} for one line at a time and unsets it once that line ends, since the command cannot unset a variable of the shell that started it. A value a job's environment already supplies stays as it stands. A job's token is minted for the application, with an expiry. The variable's token wins over the credential file: the command makes the preparing call under that token, and sends the token in no other request.`,
-    `Under the variable, the command sends its token only to the address ${ORIGIN_VARIABLE} holds, or to ${DEFAULT_COMMAND_ORIGIN} where that variable is unset: under the token, ${DEPLOY_OPTION.origin} may name that address alone, and where the line names none the command addresses it. ${DEPLOY_OPTION.env} names the environment where a line names one, ${COMMAND_ENVIRONMENTS.join(" or ")}; where none is named, the platform chooses, and the command deploys to the environment the platform answers.`,
-    `A progress read answered 502, 503, or 504, which is often temporary, is made again, at most three more times, and an upload answered 503 credential_lookup_busy, which wrote nothing, is made again after the wait it names, at most twice.`,
-    `After its zip line, ${DEPLOY_SUBCOMMAND} prints the folder's top-level entries the zip holds on one line, at most ten and then the count of the rest, and ${HASH_SUBCOMMAND} ${HASH_OPTION.list} names every file; no such line prints for a .zip file.`,
-    `Then it prints the paths the zip left out, a warning for a .zip file at the folder's root, a warning for a file that looks like a key or a credential, and a warning for a health path that no file names, package files and documentation set aside, each on a line of its own and only where there is something to name. The health warning refuses nothing.`,
-    `After the preparing call, where the platform's answer names the recorded manifest's health path and says the environment serves no version, and no file of the folder's zip names that path, ${DEPLOY_SUBCOMMAND} prints the platform's own refusal, then that nothing was uploaded and nothing was started, and ends 3 with no ${PREPARED_LINE_HEAD.trimEnd()} line, as the start would refuse it. A .zip file the line names is not read for it, and the start's own refusal stands.`,
+    `Under the variable, the command sends its token only to the address ${ORIGIN_VARIABLE} holds, or to ${DEFAULT_COMMAND_ORIGIN} where that variable is unset. Under the token, ${DEPLOY_OPTION.origin} may name that address alone, and where the line names none the command addresses it. ${DEPLOY_OPTION.env} names the environment where a line names one, ${COMMAND_ENVIRONMENTS.join(" or ")}. Where none is named, the platform chooses, and the command deploys to the environment the platform answers.`,
+    `A progress read answered 502, 503, or 504, which is often temporary, is made again, at most three more times. An upload answered 503 credential_lookup_busy, which wrote nothing, is made again after the wait it names, at most twice.`,
+    `After its zip line, ${DEPLOY_SUBCOMMAND} prints the folder's top-level entries the zip holds on one line, at most ten and then the count of the rest. ${HASH_SUBCOMMAND} ${HASH_OPTION.list} names every file. No such line prints for a .zip file.`,
+    `Then it prints the paths the zip left out, a warning for a .zip file at the folder's root, and a warning for a file that looks like a key or a credential. It warns of a health path that no file names, package files and documentation set aside. Each prints on a line of its own, only where there is something to name. The health warning refuses nothing.`,
+    `After the preparing call, the platform's answer may name the recorded manifest's health path and say the environment serves no version. Where no file of the folder's zip names that path, ${DEPLOY_SUBCOMMAND} prints the platform's own refusal, then that nothing was uploaded and nothing was started. It ends 3 with no ${PREPARED_LINE_HEAD.trimEnd()} line, as the start would refuse it. A .zip file the line names is not read for it, and the start's own refusal stands.`,
     `Before its zip, ${DEPLOY_SUBCOMMAND} reads the folder's manifest.json. Where its application member names another application than ${DEPLOY_OPTION.application}, or is not an application id, the deploy ends 3 before anything is zipped or sent. To deploy the folder to another application on purpose, the account's owner changes or removes that member.`,
-    `Where the manifest holds no application member, ${DEPLOY_SUBCOMMAND} writes ${DEPLOY_OPTION.application}'s id into it after the ${PREPARED_LINE_HEAD.trimEnd()} line and prints a ${BOUND_LINE_HEAD.trimEnd()} line, so later deploy and check lines naming another application are refused. A write that fails prints one line and stops nothing. A .zip file the line names is not read for it.`
+    `Where the manifest holds no application member, ${DEPLOY_SUBCOMMAND} prints a ${BINDING_LINE_HEAD.trimEnd()} line after the ${PREPARED_LINE_HEAD.trimEnd()} line, then writes ${DEPLOY_OPTION.application}'s id into it and prints a ${BOUND_LINE_HEAD.trimEnd()} line. Later deploy and check lines naming another application are then refused. A write that fails prints one line and stops nothing. A .zip file the line names is not read for it.`
   ],
   afterOwnError: DEPLOY_AFTER_OWN_ERROR,
   run: (call, io2) => deploy(call.named, io2, call.flags)
@@ -4023,6 +4060,8 @@ var BINDING_NOTHING_CHECKED = "Nothing further was read, and nothing was sent or
 var REFUSED_LINE_HEAD = "refused: ";
 var MANIFEST_LINE_HEAD = "manifest: ";
 var CHECKED_LINE_HEAD = "checked: ";
+var CHECKING_LINE_HEAD = "checking: ";
+var checkingLineOf = (application) => `${CHECKING_LINE_HEAD}application ${application} on the platform, then the zip.`;
 var CHECK_ACT = "check";
 var CHECK_CALL_BOUND_SECONDS = 60;
 var CHECK_NO_ANSWER = "The check call drew no answer.";
@@ -4074,9 +4113,9 @@ var CHECK_CREDENTIAL = Object.freeze({
   call: `the ${CHECK_ACTION} call`,
   mintedToken: true,
   piped: false,
-  places: `the command reads no standard input: it reads a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, as a tool connected by a minted token sets it from where its token is kept, or a job with no tool from its secret store, and otherwise this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write.`
+  places: NO_INPUT_PLACES
 });
-var CHECK_READS = `no standard input: a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, and otherwise this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write, sent only to that address; with neither, it prints the variable route first and then, where the address is admitted, the login route`;
+var CHECK_READS = `no standard input. It reads a minted token from ${MINTED_TOKEN_VARIABLE} where that is set. Otherwise it reads this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write, and sends it only to that address. With neither, it prints the variable route first, then the login route where the address is admitted`;
 var checkAnswerOf = (answer) => {
   const { refusals, first_deploy: firstDeploy, recorded_health_path: recordedHealthPath } = answer;
   if (!Array.isArray(refusals) || typeof firstDeploy !== "boolean" || typeof recordedHealthPath !== "string") return null;
@@ -4226,6 +4265,7 @@ async function check(named, io2) {
     return COMMAND_STATUS.nothing_started;
   }
   io2.print(zipped.line);
+  io2.print(checkingLineOf(options.application));
   const older = await planeWireRefusal(io2, origin);
   if (older !== null) {
     io2.print(older);
@@ -4253,11 +4293,11 @@ var CHECK_ROW = Object.freeze({
   statuses: {
     done: "none of the checks would refuse a deploy now",
     failed: "a deploy would be refused now, the refused: lines naming each refusal",
-    nothing_started: "nothing was checked: an option, credential, folder, or the folder's binding was refused, no credential was read and the two routes to one were printed, the platform was too old, or the check call was refused, drew no answer, was redirected, or failed"
+    nothing_started: "nothing was checked. An option, credential, folder, or the folder's binding was refused, or no credential was read and the two routes to one were printed. Or the platform was too old. Or the check call was refused, drew no answer, was redirected, or failed"
   },
   note: [
     `A check is one line, which carries no credential: run the line your tool's ${CHECK_ACTION} call answers, or ${CHECK_SUBCOMMAND} ${CHECK_OPTION.application} <application id>, from the application's folder, before a first deploy and after each fix. It reads its credential and the platform's address as ${DEPLOY_SUBCOMMAND} does, builds the zip ${DEPLOY_SUBCOMMAND} builds, and sends the platform the application alone, no byte of the zip and no hash. It uploads nothing and starts nothing.`,
-    `After its zip line, ${CHECK_SUBCOMMAND} prints the further lines ${DEPLOY_SUBCOMMAND} prints, leaving out the health warning where the platform says the deploy would be a first one, since a refused: line then reads the recorded health path. Then it prints one refused: line for each refusal the platform answered for the application's state, then one for each refusal of the zip by the deploy's own checks, a line naming submit_manifest where the zip's manifest.json names another health path, and a last checked: line counting the refusals.`,
+    `After its zip line and a checking: line, ${CHECK_SUBCOMMAND} prints the further lines ${DEPLOY_SUBCOMMAND} prints. It leaves out the health warning where the platform says the deploy would be a first one, since a refused: line then reads the recorded health path. Then it prints one refused: line for each refusal the platform answered for the application's state, then one for each refusal of the zip by the deploy's own checks. A line names submit_manifest where the zip's manifest.json names another health path, and a last checked: line counts the refusals.`,
     `Before its zip, ${CHECK_SUBCOMMAND} reads the folder's manifest.json as ${DEPLOY_SUBCOMMAND} reads it. Where its application member names another application than ${CHECK_OPTION.application}, or is not an application id, the check ends 3 before anything is zipped or sent. A check writes no member where none stands.`,
     `A passing check does not guarantee the deploy is accepted: a deploy in flight, the day's deploys, and the hosting cell's room can change before the deploy, which makes every check again.`
   ],
@@ -4368,7 +4408,7 @@ var promptKeys = (typed, chunk, option, fileOption) => {
   }
   return { typed: text };
 };
-var noTerminalSentence = (option, call) => `${option} reads the value from a terminal that also shows the command's output, and this run has none, as in a tool's shell. Run the line in a terminal of your own, as given; or, for your tool to run it, make ${call} again naming value_file, the path of a file that holds the value, and run the line it answers. ${NOTHING_SENT2}`;
+var noTerminalSentence = (option, call) => `${option} reads the value from a terminal that also shows the command's output, and this run has none, as in a tool's shell. Run the line in a terminal of your own, as given. Or, for your tool to run it, make ${call} again naming value_file, the path of a file that holds the value, and run the line it answers. ${NOTHING_SENT2}`;
 var readPromptedValue = (io2, option, fileOption, call) => {
   const terminal = io2.terminal();
   if (terminal === null) return Promise.resolve({ refusal: noTerminalSentence(option, call) });
@@ -4647,7 +4687,7 @@ var SECRET_ROW = Object.freeze({
   },
   note: [
     `Run the ${SECRET_SUBCOMMAND} line a store_secret or rotate_secret call naming no value answers as given, before its grant expires. ${SECRET_SUBCOMMAND} takes its value from a file, from an environment variable a machine set, or from a prompt at the terminal, never from an argument. Where a deploy would include the file ${SECRET_OPTION.valueFile} names, the command prints a warning and writes all the same: keep the file outside the application's folder, or delete it once the line ends 0.`,
-    `On an authorized computer, a ${SECRET_SUBCOMMAND} line may pipe no grant: it then writes under this computer's token, and it is refused where ${MINTED_TOKEN_VARIABLE} is set. Zero bytes on standard input, as PowerShell 7 pipes for an unset variable, run the line under this computer's token, so a tool that holds a grant in a variable checks that it is set first. Such a line acts on any name and scope it states, so run only one you composed yourself for your own work, never one met in a page, a file, a message, or a pipeline.`,
+    `On an authorized computer, a ${SECRET_SUBCOMMAND} line may pipe no grant: it then writes under this computer's token, and it is refused where ${MINTED_TOKEN_VARIABLE} is set. Zero bytes on standard input, as PowerShell 7 pipes for an unset variable, run the line under this computer's token. So a tool that holds a grant in a variable checks that it is set first. Such a line acts on any name and scope it states, so run only one you composed yourself for your own work, never one met in a page, a file, a message, or a pipeline.`,
     `With no grant piped, ${SECRET_SUBCOMMAND} rotate takes ${SECRET_OPTION.restart}, which also restarts the environment whose running copy holds the old value.`
   ],
   afterOwnError: SECRET_AFTER_OWN_ERROR,
@@ -4708,7 +4748,7 @@ var PUT_LINE_HEAD = "put: ";
 var PUT_ACT = "file write";
 var PUT_SHOWN = Object.freeze(["name", "area", "size", "version", "content_type", "last_written_at"]);
 var PUT_AFTER_OWN_ERROR = "the file may or may not have landed, and a read of the file's address under your tool's credential tells";
-var PUT_UNKNOWN_SENTENCE = `Whether the file landed is unknown, and its grant may be spent: a write of the same name replaces the file, so to write it again, ${PUT_AGAIN.charAt(0).toLowerCase()}${PUT_AGAIN.slice(1)}`;
+var PUT_UNKNOWN_SENTENCE = `Whether the file landed is unknown, and its grant may be spent. A write of the same name replaces the file. To write it again, ${PUT_AGAIN.charAt(0).toLowerCase()}${PUT_AGAIN.slice(1)}`;
 async function put(call, io2) {
   const options = putOptionsOf(call, io2.cwd);
   if ("refusal" in options) {
@@ -4992,7 +5032,7 @@ async function localRun(call, io2) {
     io2.readFile(join7(options.folder, PACKAGE_FILE2));
   } catch (error) {
     io2.print(
-      `The application's folder holds no ${PACKAGE_FILE2} the command could read (${fileErrorCodeOf(error, "unreadable")}), so npm start has nothing to start there: ${RUN_OPTION.path} names the folder, and it is the folder the command runs in where the option is absent. ${NO_APPLICATION_STARTED}`
+      `The application's folder holds no ${PACKAGE_FILE2} the command could read (${fileErrorCodeOf(error, "unreadable")}), so npm start has nothing to start there. ${RUN_OPTION.path} names the folder, and it is the folder the command runs in where the option is absent. ${NO_APPLICATION_STARTED}`
     );
     return COMMAND_STATUS.nothing_started;
   }
@@ -5037,8 +5077,8 @@ var RUN_ROW = Object.freeze({
   note: [
     `${RUN_BACKGROUND_SENTENCE} ${RUN_SUBCOMMAND} ends with the application's own status, whatever it is, so a status under ${RUN_SUBCOMMAND} may be the application's and not the command's. Where no application was started, the command's own lines say so, so a 3 with no such line is the application's own.`,
     `While the application runs, an interrupt does not end the command before the application. On macOS and Linux it is passed on where standard input is no terminal, and on Windows the application runs on the command's console, which hands it the interrupt itself.`,
-    `Where the line was started with npx.cmd, cmd asks Terminate batch job (Y/N)? once after the command ends, and either answer returns the prompt, N keeping the command's status and Y ending with cmd's own; the command's last line after an interrupted run on Windows says so, on a line of its own. A shell whose npx is no batch file, Git Bash or a PowerShell that runs scripts, asks nothing. After an interrupt on Windows, the status is npm's, or cmd's where the command had to start npm through cmd, and may not be the application's.`,
-    `${RUN_SUBCOMMAND} leaves ${COMMAND_CREDENTIAL_VARIABLES.join(" and ")} out of what the application receives. It replaces a value in the output only where the application prints it as it received it, or a connection string's password with its percent escapes read, and it leaves a value under eight characters as it is.`
+    `Where the line was started with npx.cmd, cmd asks Terminate batch job (Y/N)? once after the command ends. Either answer returns the prompt, N keeping the command's status and Y ending with cmd's own. The command's last line after an interrupted run on Windows says so, on a line of its own. A shell whose npx is no batch file, Git Bash or a PowerShell that runs scripts, asks nothing. After an interrupt on Windows, the status is npm's, or cmd's where the command had to start npm through cmd, and may not be the application's.`,
+    `${RUN_SUBCOMMAND} leaves ${COMMAND_CREDENTIAL_VARIABLES.join(" and ")} out of what the application receives. It replaces a value in the output only where the application prints it as it received it, or a connection string's password with its percent escapes read. It leaves a value under eight characters as it is.`
   ],
   afterOwnError: "the application may or may not have been started",
   run: localRun
@@ -5072,9 +5112,9 @@ var LIBRARY_CREDENTIAL = Object.freeze({
   call: `the ${LIBRARY_READ_ACTION} call`,
   mintedToken: true,
   piped: false,
-  places: `the command reads no standard input: it reads a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, as a tool connected by a minted token sets it from where its token is kept, or a job with no tool from its secret store, and otherwise this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write.`
+  places: NO_INPUT_PLACES
 });
-var LIBRARY_READS = `no standard input: a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, and otherwise this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write, sent only to that address; with neither, it prints the variable route first and then, where the address is admitted, the login route`;
+var LIBRARY_READS = `no standard input. It reads a minted token from ${MINTED_TOKEN_VARIABLE} where that is set. Otherwise it reads this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write, and sends it only to that address. With neither, it prints the variable route first, then the login route where the address is admitted`;
 var TAKE_AFTER_LOGIN = `Once ${LOGIN_SUBCOMMAND} has printed authorized:, run this take line again. ${NOTHING_WRITTEN2}`;
 var takeRedirectedLine = (status) => `${LIBRARY_READ_ACTION} was answered ${status >= 100 ? `${answeredHow(status)}, a redirect` : answeredHow(status)}, which the command never follows, so the credential was sent to no second address. ${NOTHING_WRITTEN2}`;
 async function readTakeCredential(io2, named, afterLogin, why) {
@@ -5087,7 +5127,7 @@ async function readTakeCredential(io2, named, afterLogin, why) {
     const unwritable = loginRouteRefusalOf(io2, NOTHING_WRITTEN2);
     if (unwritable !== null) return { lines: [...head, VARIABLE_ROUTE_SENTENCES, unwritable] };
     const route = loginRouteLines(io2, origin.origin, false);
-    return { lines: [...head, VARIABLE_ROUTE_SENTENCES, ...route, afterLogin] };
+    return { lines: [...head, VARIABLE_ROUTE_SENTENCES, authorizeRouteSentence(origin.origin), ...route, afterLogin] };
   }
   if ("refusal" in read2) return { lines: [read2.refusal] };
   io2.hide(read2.credential, REDACTED_TOKEN);
@@ -5339,12 +5379,28 @@ var openingCharacterClauseOf = (text) => {
   const control = first < 32 && first !== 9 && first !== 10 && first !== 13 || first >= 127 && first <= 159;
   return control ? `: the file opens with ${point}, a control character` : "";
 };
+var APPLICATION_IN_APP_LINE = "No package.json stands at the project's root or in app/, so the application goes in app/.";
+var ROOT_SOURCE_FILE = /\.(?:[cm]?[jt]s|[jt]sx)$/;
+var startedAtRootOf = (io2, root) => (io2.listFolder(root) ?? []).flatMap((name) => {
+  const standing = io2.stat(join8(root, name));
+  if (standing === null) return [];
+  if (name === "package.json") return standing.folder ? [] : [name];
+  if (name === "src") return standing.folder ? ["src/"] : [];
+  return !standing.folder && ROOT_SOURCE_FILE.test(name) ? [name] : [];
+}).sort();
+var startedWordsOf = (names) => {
+  const shown2 = names.length > 3 ? [...names.slice(0, 3).map(shownName), `${names.length - 3} more`] : names.map(shownName);
+  return shown2.length < 3 ? shown2.join(" and ") : `${shown2.slice(0, -1).join(", ")}, and ${shown2[shown2.length - 1]}`;
+};
+var startedRootTakeRefusal = (names) => `The project's root holds ${startedWordsOf(names)} and no package.json, so the take would start the application in app/ beside them. To keep the application at the root, add its package.json there. To start it in app/, move those files into app/. Then run this line again. ${NOTHING_WRITTEN2}`;
 var applicationFolderOf = (io2, root) => [join8(root, "app"), root].find((folder) => io2.stat(join8(folder, "package.json"))?.folder === false) ?? null;
 var copyPlanOf = (io2, root, library, name) => {
   const shown2 = shownFrom(root);
   if (name.includes("/")) return { refusal: `The entry ${LIBRARY_OPTION.entry} names carries compiled modules under a name that holds a slash, which an npm package cannot take. ${NOTHING_WRITTEN2}` };
   const application = applicationFolderOf(io2, root);
   if (application === null) {
+    const started = startedAtRootOf(io2, root);
+    if (started.length > 0) return { refusal: startedRootTakeRefusal(started) };
     const app = join8(root, MADE_FOLDER);
     const standing = io2.stat(app);
     if (standing !== null && !standing.folder || danglingLinkAt(io2, root, MADE_FOLDER)) {
@@ -5508,12 +5564,12 @@ var committedFilesOf = (copied, written) => {
   if (files.length === 1) return files[0];
   return `${files.slice(0, -1).join(", ")}${files.length > 2 ? "," : ""} and ${files[files.length - 1]}`;
 };
-var COPY_PACKAGES_CLAUSE = "copy the packages line into the application manifest's packages member at each submission; ";
-var KEEP_PACKAGES_CLAUSE = "the application manifest was written whole, so read it again before patching it, carry its packages member over in any later rewrite, and call submit_manifest with it before the next deploy; ";
-var MADE_MANIFEST_CLAUSE = "the application manifest was made with no services and a public audience, so declare the services and the audience the application uses in it before submit_manifest; ";
+var COPY_PACKAGES_CLAUSE = "Copy the packages line into the application manifest's packages member at each submission. ";
+var KEEP_PACKAGES_CLAUSE = "The application manifest was written whole, so read it again before patching it, and carry its packages member over in any later rewrite. Call submit_manifest with it before the next deploy. ";
+var MADE_MANIFEST_CLAUSE = "The application manifest was made with no services and a public audience. Declare the services and the audience the application uses in it before submit_manifest. ";
 var installFailedSentence = (folder) => `npm install in ${folder} did not finish: the entry, its row, and the copy are written. Run npm install there again; running this line again takes the entry again whole.`;
 var LIBRARY_AFTER_OWN_ERROR = "the entry's folder, its manifest row, or the application's copy may stand in part, and running the line again replaces each whole";
-async function readTake(io2, options, userAgent, bearer, planOf, planeChecked = false) {
+async function readTake(io2, options, userAgent, bearer, planOf, planeChecked = false, say = () => void 0) {
   const refuse = (...lines) => ({ lines });
   const found = libraryFolderOf(io2, options.root);
   if ("refusal" in found) return refuse(found.refusal);
@@ -5553,6 +5609,7 @@ async function readTake(io2, options, userAgent, bearer, planOf, planeChecked =
   if (besideCopy !== null) return refuse(besideCopy);
   const staged = stageRefusalOf(io2, join8(library, STAGE), "the library folder") ?? (plan !== null ? stageRefusalOf(io2, `${plan.copy}${STAGE}`, "the application's copy") : null);
   if (staged !== null) return refuse(staged);
+  say(readingLineOf(entry.name, entry.version, entry.files.length));
   const bytes = /* @__PURE__ */ new Map();
   for (const file of entry.files) {
     const read2 = await fileBytesOf(io2, options.origin, bearer, userAgent, entry.name, file);
@@ -5565,6 +5622,8 @@ async function readTake(io2, options, userAgent, bearer, planOf, planeChecked =
   const packages = packagesOf(manifestTextOf(manifest.rows, { name: entry.name, version: entry.version, closure_hash: entry.closure_hash, source_commit: entry.source_commit, fetched_at: "" }));
   return { entry, library, fresh: found.fresh, entryFolder, rows: manifest.rows, manifestStood: manifest.stood, compiled, plan: planned, bytes, packages };
 }
+var READING_LINE_HEAD = "reading: ";
+var readingLineOf = (name, version, files) => `${READING_LINE_HEAD}${name} ${version === null ? "with no version" : shownWhole(version)}, ${files} ${files === 1 ? "file" : "files"} from the library to check.`;
 function writeTake(io2, root, { entry, library, entryFolder, rows, manifestStood, compiled, plan, bytes }) {
   const shown2 = shownFrom(root);
   io2.makeFolder(library);
@@ -5644,7 +5703,7 @@ async function installTake(io2, root, plan, manifestText, application) {
   io2.print(`${packagesLineOf(packagesOf(manifestText))} ${packagesWhereOf(root, application)}`);
   if (!("written" in application) && application.unwritten === "write_failed") status = COMMAND_STATUS.failed;
   io2.print(
-    `next: commit ${committedFilesOf(plan !== null, "written" in application)}; ${"written" in application ? `${application.made === true ? MADE_MANIFEST_CLAUSE : ""}${KEEP_PACKAGES_CLAUSE}` : COPY_PACKAGES_CLAUSE}and, where the project holds the registrar, pin the version in its instance file and run validate with kind library.`
+    `next: commit ${committedFilesOf(plan !== null, "written" in application)}. ${"written" in application ? `${application.made === true ? MADE_MANIFEST_CLAUSE : ""}${KEEP_PACKAGES_CLAUSE}` : COPY_PACKAGES_CLAUSE}Where the project holds the registrar, pin the version in its instance file and run validate with kind library.`
   );
   printAfterInterrupt(io2, afterInterrupt);
   return status;
@@ -5665,10 +5724,11 @@ async function libraryTake(call, io2) {
   if (fromApplication !== null) return refuse(fromApplication);
   const held = await readTakeCredential(io2, call.named[LIBRARY_OPTION.origin], TAKE_AFTER_LOGIN);
   if ("lines" in held) return refuse(...held.lines);
-  const checked = await readTake(io2, { ...options, origin: held.origin }, agent.userAgent, held.bearer, (library, name) => copyPlanOf(io2, options.root, library, name));
+  const checked = await readTake(io2, { ...options, origin: held.origin }, agent.userAgent, held.bearer, (library, name) => copyPlanOf(io2, options.root, library, name), false, (line) => io2.print(line));
   if ("lines" in checked) return refuse(...checked.lines);
   const application = applicationManifestOf(io2, options.root, checked.library, checked.plan?.application ?? applicationFolderOf(io2, options.root));
   if ("refusal" in application) return refuse(application.refusal);
+  if (checked.plan?.made !== void 0) io2.print(APPLICATION_IN_APP_LINE);
   const manifestText = writeTake(io2, options.root, checked);
   const written = writeApplicationManifest(io2, application, packagesOf(manifestText));
   return installTake(io2, options.root, checked.plan, manifestText, written);
@@ -5686,7 +5746,10 @@ var LIBRARY_ROW = Object.freeze({
     failed: "the entry, its row, and the copy written, and npm install failed or the application manifest's packages was not written",
     nothing_started: "nothing was written"
   },
-  note: [`Run the ${LIBRARY_SUBCOMMAND} line at the project's root: the folder that holds system/ or system.json beside app/, or, on a first take, the folder a new system/ is made in. Where that folder holds neither and the folder above it holds one, the take is refused, and its sentence names both ways on. It writes nothing until every file is checked.`],
+  note: [
+    `Run the ${LIBRARY_SUBCOMMAND} line at the project's root: the folder that holds system/ or system.json beside app/, or, on a first take, the folder a new system/ is made in. Where that folder holds neither and the folder above it holds one, the take is refused, and its sentence names both ways on. It writes nothing until every file is checked.`,
+    `For an entry with compiled modules, the application's folder is app/ where it holds package.json, else the project's root where it does. Where neither stands, the take says so first, then makes app/package.json and places the copy in app/. It refuses, writing nothing, where the root holds no package.json but src/ or a source file such as server.mjs, since app/ would then stand beside that code.`
+  ],
   afterOwnError: LIBRARY_AFTER_OWN_ERROR,
   run: libraryTake
 });
@@ -5759,7 +5822,7 @@ var stateOnlyAnswer = (origin) => ({ status: 204, headers: answerHeaders(origin,
 var outcomeAnswer = (origin, authorized) => ({
   status: 200,
   headers: answerHeaders(origin, true),
-  body: authorized ? browserPageOf("This computer is logged in", `The turnzero command on this computer is logged in at ${origin}. You can close this tab.`) : browserPageOf("The login did not complete", "The turnzero command on this computer did not complete the login; its terminal says why and what to run next. You can close this tab.")
+  body: authorized ? browserPageOf("This computer is logged in", `The turnzero command on this computer is logged in at ${origin}. Return to your AI tool and continue the setup or deployment you started. You can close this tab.`) : browserPageOf("The login did not complete", "The turnzero command on this computer did not complete the login; its terminal says why and what to run next. You can close this tab.")
 });
 var wrongStateAnswer = (origin) => ({
   status: 400,
@@ -5912,7 +5975,7 @@ async function login(call, io2) {
       io2.print(notCodeSentence(again));
       return COMMAND_STATUS.nothing_started;
     }
-    const status = await completeAct(io2, origin.origin, "authorized computer", arrival.code, agent.userAgent, io2.print, () => void 0, again);
+    const status = await completeAct(io2, origin.origin, "authorized computer", { code: arrival.code }, agent.userAgent, io2.print, () => void 0, again);
     outcome(status === COMMAND_STATUS.done);
     return status;
   } finally {
@@ -5937,19 +6000,19 @@ var LOGIN_OPTIONS = Object.freeze([
     description: "Opens no browser and binds no port: open the printed address in a browser on any computer, approve, and paste the code the page shows."
   }
 ]);
-var LOGIN_AFTER_OWN_ERROR = "the login may not have completed; where a token was minted, list_tokens from your tool shows it by its label, and revoke_token ends it; run login again to log this computer in";
+var LOGIN_AFTER_OWN_ERROR = "the login may not have completed. Where a token was minted, list_tokens from your tool shows it by its label, and revoke_token ends it. Run login again to log this computer in";
 var LOGIN_ROW = Object.freeze({
   name: LOGIN_SUBCOMMAND,
   summary: `Logs this computer in at the platform's address. It opens the platform's computer login page (${COMPUTER_LOGIN_PATH}) in your default browser, where you approve the login under your sign-in. It keeps the token the platform mints in this computer's credential file. It then reads the account the token acts as, and prints authorized: with the address, the account's sign-in address (or its id where it has none), the token's label, and its expiry. Where the browser cannot answer, it asks for the code the page shows. It prints no token, code, or verifier.`,
   example: LOGIN_SUBCOMMAND,
   options: LOGIN_OPTIONS,
   credential: null,
-  reads: "nothing from standard input; with the browser it waits for the page to answer on a port of this computer, and with --no-browser it reads the code the page shows from the terminal, hidden; once the token is kept, it reads the account through read_account under it",
+  reads: "nothing from standard input. With the browser, it waits for the page to answer on a port of this computer. With --no-browser, it reads the code the page shows from the terminal, hidden. Once the token is kept, it reads the account through read_account under it",
   statuses: {
     done: "this computer logged in",
     failed: "a token was minted and not kept, or the token this computer held before was not revoked: the printed lines name revoke_token",
     unknown: "the exchange drew no answer, or an answer that is not a refusal: list_tokens shows whether a token was minted",
-    nothing_started: "nothing was minted: an option or the credential file was refused, no code arrived in time or could arrive, the prompt was stopped or given what is not a token code, the platform was too old, or the exchange was refused"
+    nothing_started: "nothing was minted. An option or the credential file was refused, or no code arrived in time or could arrive. Or the prompt was stopped, or given what is not a token code. Or the platform was too old, or the exchange was refused"
   },
   variables: [[ORIGIN_VARIABLE, AUTHORIZATION_ORIGIN_VARIABLE_LINE]],
   note: [
@@ -5970,7 +6033,7 @@ var LOGOUT_OPTIONS = Object.freeze([
   }
 ]);
 var NOTHING_REMOVED = "Nothing was sent and nothing was removed.";
-var LOGOUT_AFTER_OWN_ERROR = "the token may or may not have been revoked, and this computer's entries for the origin may stand in the credential file: list_tokens from your tool shows whether the token stands, and revoke_token ends it";
+var LOGOUT_AFTER_OWN_ERROR = "the token may or may not have been revoked, and this computer's entries for the origin may stand in the credential file. list_tokens from your tool shows whether the token stands, and revoke_token ends it";
 var loggedOutLineOf = (origin, ended) => `${LOGGED_OUT_LINE_HEAD}${origin}, ${ended === null ? "the request pending there removed; no token was kept for it" : ended.how === "revoked" ? `token ${ended.id} revoked and removed from this computer` : ended.how === "ended" ? `token ${ended.id} removed from this computer, which had already ended` : `token ${ended.id} removed from this computer and not revoked`}`;
 async function logout(call, io2) {
   const origin = entryOriginOf(io2.env, call.named[DEPLOY_OPTION.origin], NOTHING_REMOVED);
@@ -6071,7 +6134,7 @@ var whoamiLinesOf = (origin, account, entry) => [
   `${WHOAMI_LINE_HEADS.token}label ${entry.label !== null ? JSON.stringify(entry.label) : "none"}, expiring ${entry.expires_at !== null ? `at ${entry.expires_at}` : "never"}`
 ];
 var noComputerTokenSentence = (origin, expiredAt) => expiredAt === null ? `This computer's credential file holds no token for ${origin}, so nothing was sent.` : `This computer's token for ${origin} in its credential file expired at ${expiredAt}, so nothing was sent.`;
-var noLoginRoutesSentence = (origin) => `Your AI coding tool's own sign-in is not this computer's credential. With no login, deploy_files deploys a folder within its caps, ${AUTHORIZE_SUBCOMMAND}${originWordsOf(origin)} run with nothing piped prints the ${MINT_TOKEN_ACTION} call a signed-in tool makes to authorize this computer, and ${PROVISION_SUBCOMMAND}${originWordsOf(origin)} run so prints the call that answers its line.`;
+var noLoginRoutesSentence = (origin) => `Your AI coding tool's own sign-in is not this computer's credential. With no login, deploy_files deploys a folder within its caps. ${authorizeRouteSentence(origin)} ${PROVISION_SUBCOMMAND}${originWordsOf(origin)} run so prints the call that answers its line.`;
 var whoamiAfterLoginSentence = (whoami2) => `Once login has printed authorized:, run ${whoami2} again.`;
 async function whoami(call, io2) {
   const origin = entryOriginOf(io2.env, call.named[DEPLOY_OPTION.origin], NOTHING_SENT_OR_READ);
@@ -6135,7 +6198,7 @@ var WHOAMI_ROW = Object.freeze({
     done: "the account was read",
     failed: "the platform refused the read, where it no longer accepts the token among other causes: the printed lines name login",
     unknown: "the read drew no answer, or an answer that is not a refusal",
-    nothing_started: "nothing was read: an option or the credential file was refused, the platform was too old, or no live token stands for the address, and the printed lines name the ways on with no login, then the login route"
+    nothing_started: "nothing was read. An option or the credential file was refused, or the platform was too old. Or no live token stands for the address, and the printed lines name the ways on with no login, then the login route"
   },
   variables: [[ORIGIN_VARIABLE, `the platform's address whose token is read where the line names no ${DEPLOY_OPTION.origin}.`]],
   note: [`${WHOAMI_SUBCOMMAND} reads which account a login or an authorize on this computer kept a token for, so you can tell it from your tool's own connection. The credential file is ${CREDENTIAL_FILE_WORDS}.`],
@@ -6333,21 +6396,21 @@ var PROVISION_CREDENTIAL = Object.freeze({
   call: "the submit_manifest call naming local_run",
   mintedToken: true,
   piped: false,
-  places: `the command reads no standard input: it reads a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, as a tool connected by a minted token sets it from where its token is kept, or a job with no tool from its secret store, and otherwise this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write.`,
+  places: NO_INPUT_PLACES,
   claim: `this computer's pending verifier, under ${PROVISION_CLAIM_FLAG}`
 });
-var PROVISION_READS = `no standard input: a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, and otherwise this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write, sent only to that address; else ${PROVISION_CREDENTIAL.claim}; with none, it keeps a verifier and prints the challenge and the submit_manifest call naming local_run and ${CODE_CHALLENGE_MEMBER}`;
+var PROVISION_READS = `no standard input. It reads a minted token from ${MINTED_TOKEN_VARIABLE} where that is set. Otherwise it reads this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write, and sends it only to that address. Else it reads ${PROVISION_CREDENTIAL.claim}. With none, it keeps a verifier, and prints the challenge and the submit_manifest call naming local_run and ${CODE_CHALLENGE_MEMBER}`;
 var NOTHING_REMINTED = "Nothing was re-minted, and the environment file is as it stood.";
 var CLAIM_FALLBACK_ERRORS = Object.freeze(["authentication_required", "secret_grant_not_admitted", "secret_grant_expired", "secret_grant_spent"]);
 var claimRefusedSentence = (origin, error) => `This computer's pending verifier was presented to ${origin}, which holds no provision grant it claims (${error}), so nothing was re-minted, and the first act follows.`;
 var PROVISION_BARE_LINE_WORDS = commandLineOf(DEFAULT_COMMAND_ORIGIN, PROVISION_SUBCOMMAND, { options: [[PROVISION_OPTION.application, "<application id>"]] });
 var freshLineOf = (io2, application, origin, envFile) => provisionLineFor(io2, { origin, application, ...envFile !== void 0 ? { envFile } : {} });
-var freshLineSteps2 = (line) => `${line} with nothing piped, and where it prints a submit_manifest call, make that call from your tool and run the line it answers as given`;
+var freshLineSteps2 = (line) => `${line} with nothing piped. Where it prints a submit_manifest call, make that call from your tool and run the line it answers as given`;
 var provisionAgainOf = (line) => `Run ${freshLineSteps2(line)}.`;
 var againSteps = (kind, line) => kind === "grant" ? `run ${freshLineSteps2(line)}` : "run the line again";
 var remintAgainSentence = (kind, line) => {
   const steps = againSteps(kind, line);
-  return `${steps[0].toUpperCase()}${steps.slice(1)}: it re-mints both credentials and writes the file.`;
+  return `${steps[0].toUpperCase()}${steps.slice(1)}. It re-mints both credentials and writes the file.`;
 };
 var envFileNameRefusalOf = (standing) => `${PROVISION_OPTION.envFile} names the environment file ${ENVIRONMENT_FILE_NAME} or ${ENVIRONMENT_FILE_NAME}.<name>, the names every zip the command or deploy_files builds leaves out, so the credentials it holds never ride one.${standing ? ` A file stands at the name given, and an earlier run may have written credentials into it: move its lines into ${ENVIRONMENT_FILE_NAME} and delete it.` : ""} ${NOTHING_REMINTED}`;
 var provisionOptionsOf = (call, cwd, stands = () => false) => {
@@ -6364,7 +6427,7 @@ var provisionOptionsOf = (call, cwd, stands = () => false) => {
   return { application, envFile, origin: origin.origin, claim: call.flags.has(PROVISION_CLAIM_FLAG) };
 };
 var APPLICATION_FOLDER_MARKS = Object.freeze(["package.json", "manifest.json"]);
-var outsideApplicationWarningOf = (folder) => `warning: ${folder} holds neither ${APPLICATION_FOLDER_MARKS[0]} nor ${APPLICATION_FOLDER_MARKS[1]}, so it may not be the application's folder, and the environment file was written there all the same. A local run reads the environment file from the folder it runs in unless its line names one with ${PROVISION_OPTION.envFile}: move the file into the application's folder, or name it on the line that starts the run.`;
+var outsideApplicationWarningOf = (folder) => `warning: ${folder} holds neither ${APPLICATION_FOLDER_MARKS[0]} nor ${APPLICATION_FOLDER_MARKS[1]}, so it may not be the application's folder, and the environment file was written there all the same. A local run reads the environment file from the folder it runs in unless its line names one with ${PROVISION_OPTION.envFile}. Move the file into the application's folder, or name it on the line that starts the run.`;
 var outsideApplicationFolder = (io2, envFile) => APPLICATION_FOLDER_MARKS.every((mark) => {
   try {
     return io2.stat(join9(dirname5(envFile), mark))?.folder !== false;
@@ -6469,7 +6532,7 @@ var factsOf = (member) => {
 var connectionSettingOf = (facts, password) => `postgresql://${encodeURIComponent(facts.roleName)}:${encodeURIComponent(password)}@${facts.host}:5432/${encodeURIComponent(facts.dbName)}?sslmode=verify-full`;
 var LIMIT_SHOWN_MAX = 80;
 var UNATTENDED_JOB_VARIABLE = "CI";
-var afterOwnErrorBy = (line) => `a credential may or may not have been re-minted, and the environment file may not hold its value: ${line} run again with nothing piped re-mints both and writes the file, or prints the submit_manifest call whose line does`;
+var afterOwnErrorBy = (line) => `a credential may or may not have been re-minted, and the environment file may not hold its value. ${line} run again with nothing piped re-mints both and writes the file, or prints the submit_manifest call whose line does`;
 var PROVISION_AFTER_OWN_ERROR = afterOwnErrorBy(`${PROVISION_BARE_LINE_WORDS}, with the ${PROVISION_OPTION.origin} and ${PROVISION_OPTION.envFile} the line named,`);
 var provisionAfterOwnError = (call, io2) => {
   try {
@@ -6602,7 +6665,7 @@ var pendingVerifierOf = (io2, origin) => {
 var PROVISION_CHALLENGE_HEAD = "challenge: ";
 var PROVISION_CALL_HEAD = "call submit_manifest with:";
 var MANIFEST_MEMBER_WORDS = "the application's manifest, as your tool submits it";
-var replacedProvisionRequestSentence = (origin, expiredAt) => `The request pending for ${origin} expired at ${expiredAt}, so a new one replaces it: a line answered against the old challenge is refused using nothing, and the submit_manifest call naming the new challenge below answers a fresh one.`;
+var replacedProvisionRequestSentence = (origin, expiredAt) => `The request pending for ${origin} expired at ${expiredAt}, so a new one replaces it. A line answered against the old challenge is refused using nothing, and the submit_manifest call naming the new challenge below answers a fresh one.`;
 var provisionFirstActLines = (origin, application, challenge, expiresAt, line) => [
   `To write this application's development settings from ${origin}, call submit_manifest from your tool naming the members below, then run the line it answers once, as given, in this folder, before its grant expires.`,
   `${PROVISION_CHALLENGE_HEAD}${challenge}`,
@@ -6703,7 +6766,7 @@ async function remintAndWrite(io2, { application, envFile, origin }, userAgent,
   if (facts !== null && limitCarried !== null) {
     const cause = limitMember ? "the plan's database-connection-limit holds no usable quantity, which platform staff set with set_plan_quota" : "the platform that answered serves no such member yet";
     io2.print(
-      `${envFile} holds ${facts.setting} and the platform settings this run re-minted, and no ${LOCAL_RUN_SETTING.databaseConnectionLimit}: ${PROVISION_ACTION}'s development_database answer carried ${limitCarried}, where the pool's maximum is a positive integer, so ${cause}. Until that changes the application's pool holds one connection; once it has, ${againSteps(read2.kind, read2.again)}.`
+      `${envFile} holds ${facts.setting} and the platform settings this run re-minted, and no ${LOCAL_RUN_SETTING.databaseConnectionLimit}. ${PROVISION_ACTION}'s development_database answer carried ${limitCarried}. The pool's maximum is a positive integer, so ${cause}. Until that changes, the application's pool holds one connection. Once it has, ${againSteps(read2.kind, read2.again)}.`
     );
     io2.print(provisionNextLineOf(read2.next));
     return COMMAND_STATUS.failed;
@@ -6732,7 +6795,7 @@ var PROVISION_ROW = Object.freeze({
     nothing_started: "nothing was re-minted"
   },
   note: [
-    `Run ${PROVISION_BARE_LINE_WORDS} from the folder the application runs in. With no token for the address, it prints a challenge and the submit_manifest call naming local_run and ${CODE_CHALLENGE_MEMBER}; your tool makes that call and runs the line it answers once, as given, before its grant expires, which presents the grant with this computer's verifier. On a computer logged in, the bare line re-mints at once.`,
+    `Run ${PROVISION_BARE_LINE_WORDS} from the folder the application runs in. With no token for the address, it prints a challenge and the submit_manifest call naming local_run and ${CODE_CHALLENGE_MEMBER}. Your tool makes that call and runs the line it answers once, as given, before its grant expires, which presents the grant with this computer's verifier. On a computer logged in, the bare line re-mints at once.`,
     `Each run revokes the development credentials the application had before it. A deployed development environment holds the revoked values until it restarts, so the line's last re-mint restarts it where development serves a version. Its redeploy takes both re-minted credentials from custody, the connection string and the platform credential, and does not count toward the day's deploys. Where a deploy of development is still in flight, the re-mint's answer names restart_application on development, and your tool calls it once that deploy ends. ${PROVISION_SUBCOMMAND} writes no ${PORT_SETTING}: ${RUN_SUBCOMMAND} sets it from ${RUN_OPTION.port}.`
   ],
   afterOwnError: provisionAfterOwnError,
@@ -6758,9 +6821,9 @@ var SCAFFOLD_TEMPLATE_FILES = Object.freeze({
       "",
       "## Where the rules are",
       "",
-      "Turn Zero Cloud serves its rules to a coding tool through its MCP server, `turnzero-cloud`, and they change with the platform, so none is repeated here.",
+      "Turn Zero Cloud serves its rules to a coding tool through the MCP server `turnzero`, one connection to the products your account holds. The rules change with the platform, so none is repeated here.",
       "",
-      `- Where the server is not connected, connect it first. The platform's page "Connect your AI tool" says how.`,
+      "- Where the server is not connected, set up Turn Zero Cloud first: https://turnzero.ai/cloud/getting-started/set-up/",
       "- Before you change or deploy this service, read the server's `deploy` skill.",
       "",
       "## What you run here",
@@ -7032,9 +7095,9 @@ var SCAFFOLD_TEMPLATE_FILES = Object.freeze({
       "",
       "## Where the rules are",
       "",
-      "Turn Zero Cloud serves its rules to a coding tool through its MCP server, `turnzero-cloud`, and they change with the platform, so none is repeated here.",
+      "Turn Zero Cloud serves its rules to a coding tool through the MCP server `turnzero`, one connection to the products your account holds. The rules change with the platform, so none is repeated here.",
       "",
-      `- Where the server is not connected, connect it first. The platform's page "Connect your AI tool" says how.`,
+      "- Where the server is not connected, set up Turn Zero Cloud first: https://turnzero.ai/cloud/getting-started/set-up/",
       "- Before you change or deploy this service, read the server's `deploy` skill.",
       "",
       "## What you run here",
@@ -7151,9 +7214,9 @@ var SCAFFOLD_TEMPLATE_FILES = Object.freeze({
       "",
       "## Where the rules are",
       "",
-      "Turn Zero Cloud serves its rules to a coding tool through its MCP server, `turnzero-cloud`, and they change with the platform, so none is repeated here.",
+      "Turn Zero Cloud serves its rules to a coding tool through the MCP server `turnzero`, one connection to the products your account holds. The rules change with the platform, so none is repeated here.",
       "",
-      `- Where the server is not connected, connect it first. The platform's page "Connect your AI tool" says how.`,
+      "- Where the server is not connected, set up Turn Zero Cloud first: https://turnzero.ai/cloud/getting-started/set-up/",
       "- Before you change or deploy this service, read the server's `deploy` skill, and before you change its schedule, the server's `schedule` skill.",
       "",
       "## What you run here",
@@ -7357,9 +7420,9 @@ var SCAFFOLD_TEMPLATE_FILES = Object.freeze({
       "",
       "## Where the rules are",
       "",
-      "Turn Zero Cloud serves its rules to a coding tool through its MCP server, `turnzero-cloud`, and they change with the platform, so none is repeated here.",
+      "Turn Zero Cloud serves its rules to a coding tool through the MCP server `turnzero`, one connection to the products your account holds. The rules change with the platform, so none is repeated here.",
       "",
-      `- Where the server is not connected, connect it first. The platform's page "Connect your AI tool" says how.`,
+      "- Where the server is not connected, set up Turn Zero Cloud first: https://turnzero.ai/cloud/getting-started/set-up/",
       "- Before you change or deploy this service, read the server's `deploy` skill, and before you change its sign-in or its AI call, the server's `add-sign-in` or `use-ai-allowance` skill.",
       "",
       "## What you run here",
@@ -8161,7 +8224,7 @@ var SCAFFOLD_OPTIONS = Object.freeze([
     name: SCAFFOLD_OPTION.resource,
     value: "<plural>",
     required: false,
-    description: `Under ${RESOURCE_TEMPLATES_NAMED}, the resource the service keeps, by its plural, the word of its table and its route: an ASCII lower-case letter, then ASCII lower-case letters and digits, at most 30 characters. It is never the word of the template's own route: ${perResourceTemplate((kept2) => kept2.routes)}. The files are written under its names where the template names notes, note, Notes, and Note, file names among them. Where absent, the service keeps notes. A template that keeps no resource refuses it.`
+    description: `Under ${RESOURCE_TEMPLATES_NAMED}, the resource the service keeps, by its plural, the word of its table and its route. It is an ASCII lower-case letter, then ASCII lower-case letters and digits, at most 30 characters. It is never the word of the template's own route: ${perResourceTemplate((kept2) => kept2.routes)}. The files are written under its names where the template names notes, note, Notes, and Note, file names among them. Where absent, the service keeps notes. A template that keeps no resource refuses it.`
   },
   {
     name: SCAFFOLD_OPTION.singular,
@@ -8215,30 +8278,30 @@ var ROOT_TOOLS_UNCHANGED = `${SCAFFOLD_LINE_HEAD.unchanged}${TOOLS_FILE} at the
 var ROOT_TOOLS_FAILED = `${SCAFFOLD_LINE_HEAD.failed}${TOOLS_FILE} at the project's root, where a part of the file may stand. Add this sentence to that file, so a coding tool started at the root reads ${APPLICATION_FOLDER}/${TOOLS_FILE}: ${ROOT_SENTENCE}`;
 var ROOT_CLAUDE_UNCHANGED = `${SCAFFOLD_LINE_HEAD.unchanged}${CLAUDE_FILE} at the project's root. Claude Code reads that file and then reads no ${TOOLS_FILE} by itself, so add this sentence to it: ${ROOT_SENTENCE}`;
 var NEITHER_LEFT = Object.freeze({ tools: "written", claude: false });
-var ROOT_TOOLS_STEP = `Add this sentence to ${TOOLS_FILE} at the project's root, which the scaffold did not change, so a coding tool started at the root reads ${APPLICATION_FOLDER}/${TOOLS_FILE}: ${ROOT_SENTENCE}`;
-var ROOT_TOOLS_FAILED_STEP = `Add this sentence to ${TOOLS_FILE} at the project's root, which the scaffold could not write, so a coding tool started at the root reads ${APPLICATION_FOLDER}/${TOOLS_FILE}: ${ROOT_SENTENCE}`;
-var ROOT_CLAUDE_STEP = `Add this sentence to ${CLAUDE_FILE} at the project's root, since Claude Code reads that file and then reads no ${TOOLS_FILE} by itself: ${ROOT_SENTENCE}`;
+var ROOT_TOOLS_STEP = `Add a sentence to ${TOOLS_FILE} at the project's root, which the scaffold did not change, so a coding tool started at the root reads ${APPLICATION_FOLDER}/${TOOLS_FILE}. The sentence to add: ${ROOT_SENTENCE}`;
+var ROOT_TOOLS_FAILED_STEP = `Add a sentence to ${TOOLS_FILE} at the project's root, which the scaffold could not write, so a coding tool started at the root reads ${APPLICATION_FOLDER}/${TOOLS_FILE}. The sentence to add: ${ROOT_SENTENCE}`;
+var ROOT_CLAUDE_STEP = `Add a sentence to ${CLAUDE_FILE} at the project's root, since Claude Code reads that file and then reads no ${TOOLS_FILE} by itself. The sentence to add: ${ROOT_SENTENCE}`;
 var APPLICATION_FORM_REFUSAL = `${SCAFFOLD_OPTION.application} names the application the service deploys to, by its id, a lowercase UUID, as create_application answers it. ${NOTHING_WRITTEN2}`;
 var RESOURCE_REFUSAL = Object.freeze({
   /** A plural outside SCAFFOLD_NAME_FORM. */
   resourceForm: `${SCAFFOLD_OPTION.resource} takes the plural of the resource the service keeps, the word of its table and its route: an ASCII lower-case letter, then ASCII lower-case letters and digits, at most 30 characters, such as orders. ${NOTHING_WRITTEN2}`,
   /** A singular outside SCAFFOLD_NAME_FORM. */
-  singularForm: `${SCAFFOLD_OPTION.singular} takes the singular of that resource, the word for one of its rows, in the form ${SCAFFOLD_OPTION.resource} takes: an ASCII lower-case letter, then ASCII lower-case letters and digits, at most 30 characters, such as order. ${NOTHING_WRITTEN2}`,
+  singularForm: `${SCAFFOLD_OPTION.singular} takes the singular of that resource, the word for one of its rows, in the form ${SCAFFOLD_OPTION.resource} takes. That is an ASCII lower-case letter, then ASCII lower-case letters and digits, at most 30 characters, such as order. ${NOTHING_WRITTEN2}`,
   /** `--singular` with no `--resource`. */
-  noResource: `${SCAFFOLD_OPTION.singular} takes the singular of the resource ${SCAFFOLD_OPTION.resource} names, and the line names no ${SCAFFOLD_OPTION.resource}: name the plural with ${SCAFFOLD_OPTION.resource}, or leave ${SCAFFOLD_OPTION.singular} out. ${NOTHING_WRITTEN2}`,
+  noResource: `${SCAFFOLD_OPTION.singular} takes the singular of the resource ${SCAFFOLD_OPTION.resource} names, and the line names no ${SCAFFOLD_OPTION.resource}. Name the plural with ${SCAFFOLD_OPTION.resource}, or leave ${SCAFFOLD_OPTION.singular} out. ${NOTHING_WRITTEN2}`,
   /** A plural that does not end in s, with no `--singular`. */
-  noClosingS: `${SCAFFOLD_OPTION.resource} takes a plural that ends in s where the line names no ${SCAFFOLD_OPTION.singular}, since the singular is then the plural without its closing s: name the singular with ${SCAFFOLD_OPTION.singular}, such as ${SCAFFOLD_OPTION.resource} people ${SCAFFOLD_OPTION.singular} person. ${NOTHING_WRITTEN2}`,
+  noClosingS: `${SCAFFOLD_OPTION.resource} takes a plural that ends in s where the line names no ${SCAFFOLD_OPTION.singular}, since the singular is then the plural without its closing s. Name the singular with ${SCAFFOLD_OPTION.singular}, such as ${SCAFFOLD_OPTION.resource} people ${SCAFFOLD_OPTION.singular} person. ${NOTHING_WRITTEN2}`,
   /** The plural `s` alone, with no `--singular`: its singular would be empty. */
-  emptySingular: `${SCAFFOLD_OPTION.resource} takes a plural longer than s alone where the line names no ${SCAFFOLD_OPTION.singular}, since the singular, the plural without its closing s, is never empty: name the singular with ${SCAFFOLD_OPTION.singular}, or a longer plural. ${NOTHING_WRITTEN2}`,
+  emptySingular: `${SCAFFOLD_OPTION.resource} takes a plural longer than s alone where the line names no ${SCAFFOLD_OPTION.singular}, since the singular, the plural without its closing s, is never empty. Name the singular with ${SCAFFOLD_OPTION.singular}, or a longer plural. ${NOTHING_WRITTEN2}`,
   /** A singular, given or derived, of `json` (#5225): the resource's
    *  invalid error, invalid_<singular>, would then be invalid_json, the
    *  error of a body that does not parse, and a caller could no longer
    *  tell the two apart (PLD-L0-106). */
-  jsonSingular: `${SCAFFOLD_OPTION.singular} takes a singular other than json, since the service answers invalid_json for a body that does not parse and invalid_ with the singular for a row it refuses: name another singular with ${SCAFFOLD_OPTION.singular}, such as ${SCAFFOLD_OPTION.resource} jsons ${SCAFFOLD_OPTION.singular} document. ${NOTHING_WRITTEN2}`
+  jsonSingular: `${SCAFFOLD_OPTION.singular} takes a singular other than json, since the service answers invalid_json for a body that does not parse and invalid_ with the singular for a row it refuses. Name another singular with ${SCAFFOLD_OPTION.singular}, such as ${SCAFFOLD_OPTION.resource} jsons ${SCAFFOLD_OPTION.singular} document. ${NOTHING_WRITTEN2}`
 });
 var RESOURCE_NONE_KEPT = `${SCAFFOLD_OPTION.resource} and ${SCAFFOLD_OPTION.singular} name the resource ${RESOURCE_TEMPLATES_NAMED} keep, and the template this line writes keeps none: leave them out, or name ${RESOURCE_TEMPLATE_CHOICES}. ${NOTHING_WRITTEN2}`;
 var UNKNOWN_TEMPLATE = `${SCAFFOLD_OPTION.template} names the template to write, and the command has no template of that name: it has ${listedAnd(SCAFFOLD_TEMPLATES)}, and it writes ${SCAFFOLD_DEFAULT_TEMPLATE} where the line names none. ${NOTHING_WRITTEN2}`;
-var ownRouteRefusal = (word) => `${SCAFFOLD_OPTION.resource} takes a plural other than ${word}, the word of a route the template serves itself: name another plural. ${NOTHING_WRITTEN2}`;
+var ownRouteRefusal = (word) => `${SCAFFOLD_OPTION.resource} takes a plural other than ${word}, the word of a route the template serves itself. Name another plural. ${NOTHING_WRITTEN2}`;
 var JSON_SINGULAR = "json";
 var resourceNamesOf = (call, template) => {
   const plural = call.named[SCAFFOLD_OPTION.resource];
@@ -8259,7 +8322,7 @@ var resourceNamesOf = (call, template) => {
 var CARRIED_FIELDS = Object.freeze([Object.freeze({ name: "title", kind: "text" })]);
 var FIELD_KINDS_CLAUSE = `the kind ${orListed(SCAFFOLD_FIELD_KINDS)}`;
 var COLUMN_MEANING = Object.freeze({ id: "the key column", owner: "the column of the row's owner" });
-var reservedFieldRefusal = (columns) => `${SCAFFOLD_OPTION.fields} takes a field name other than ${columns.join(" or ")}, ${listedAnd(columns.map((column) => COLUMN_MEANING[column] ?? `the column ${column}`))} the migration writes itself, and ${FIELD_KINDS_CLAUSE}: name the field another way. ${NOTHING_WRITTEN2}`;
+var reservedFieldRefusal = (columns) => `${SCAFFOLD_OPTION.fields} takes a field name other than ${columns.join(" or ")}, ${listedAnd(columns.map((column) => COLUMN_MEANING[column] ?? `the column ${column}`))} the migration writes itself, and ${FIELD_KINDS_CLAUSE}. Name the field another way. ${NOTHING_WRITTEN2}`;
 var FIELD_REFUSAL = Object.freeze({
   /** A field with no colon or more than one, an empty field among them. */
   listForm: `${SCAFFOLD_OPTION.fields} takes fields separated by commas, each a name, a colon, and a kind, such as name:text,message:text, ${FIELD_KINDS_CLAUSE}. ${NOTHING_WRITTEN2}`,
@@ -8733,7 +8796,7 @@ var applicationStandsLines = (template, takeLines) => {
   return [
     first,
     ...takes.map(
-      (take, index) => `To add the ${take.entry} package to the application that stands, run this line at the project's root, then follow ${take.follow}, read_documentation's page ${take.page}: ${lines[index]}`
+      (take, index) => `To add the ${take.entry} package to the application that stands, follow ${take.follow}, read_documentation's page ${take.page}. Run this line at the project's root first: ${lines[index]}`
     ),
     STANDS_DEPLOY_LINE
   ];
@@ -8801,14 +8864,16 @@ var takeMadeLines = (template, entries, lineOf) => {
     return [first, `${opening}, which takes ${taken} itself.`];
   }
   const lines = again.map(lineOf);
-  if (again.length === 1) return [first, `${opening}, then run this line at the project's root, which takes the ${again[0]} entry again into the new ${APPLICATION_FOLDER}/: ${lines[0]}`];
+  if (again.length === 1) return [first, `${opening}. Then run this line at the project's root, which takes the ${again[0]} entry again into the new ${APPLICATION_FOLDER}/: ${lines[0]}`];
   return [
     first,
-    `${opening}, then run each of these ${LINE_COUNT_WORDS[lines.length] ?? lines.length} lines at the project's root, in order, which take the ${listedAnd(again)} entries again into the new ${APPLICATION_FOLDER}/:`,
+    `${opening}. Then run each of these ${LINE_COUNT_WORDS[lines.length] ?? lines.length} lines at the project's root, in order, which take the ${listedAnd(again)} entries again into the new ${APPLICATION_FOLDER}/:`,
     ...lines
   ];
 };
-var STAGE_NOT_OWN = `Something that is not this run's own stands at ${STAGE_FOLDER} in the project's root, the name the scaffold writes under, an earlier run's files under another template or another resource name among it: move or remove ${STAGE_FOLDER}, then run the line again. ${NOTHING_WRITTEN2}`;
+var STAGE_NOT_OWN = `Something that is not this run's own stands at ${STAGE_FOLDER} in the project's root, the name the scaffold writes under. An earlier run's files under another template or another resource name may be among it. Move or remove ${STAGE_FOLDER}, then run the line again. ${NOTHING_WRITTEN2}`;
+var startedRootScaffoldRefusal = (names) => `The project's root holds ${startedWordsOf(names)} and no package.json, so an application may be started there, and the scaffold would write app/ beside it. To add a library package to that application, add its package.json at the root, then run ${LIBRARY_SUBCOMMAND} take there. To start a new service, run this line in a new folder, or name one with ${SCAFFOLD_OPTION.path}. ${NOTHING_WRITTEN2}`;
+var ROOT_PACKAGE_LINE = "A package.json stands at the project's root, so the new application goes in app/ beside it.";
 var folderRefusalOf = (io2, options, files, takeLines, lineOf) => {
   const { root } = options;
   for (let at = root; ; at = dirname6(at)) {
@@ -8828,6 +8893,8 @@ var folderRefusalOf = (io2, options, files, takeLines, lineOf) => {
     const taken = takeMadeEntriesOf(io2, app);
     return taken !== null ? takeMadeLines(options.template, taken, lineOf) : applicationStandsLines(options.template, takeLines);
   }
+  const started = startedAtRootOf(io2, root);
+  if (started.length > 0 && !started.includes("package.json")) return [startedRootScaffoldRefusal(started)];
   if (!heldInside(io2, root, app)) return [scaffoldLinkSentence(`The application's folder, ${APPLICATION_FOLDER}/,`)];
   const staged = io2.stat(stage);
   if (staged === null && danglingAt(io2, root, STAGE_FOLDER)) return [notOwn];
@@ -8916,7 +8983,7 @@ var ApplicationArrived = class extends Error {
 };
 var arrivedLine = (template, takeLines) => `${APPLICATION_FOLDER}/ took a file or a folder while the scaffold ran, so an application stands there and the template was not written${standsWayOn(template, takeLines)}`;
 var ARRIVED_NO_FOLDER_LINE = `Something that is no folder came to stand at ${APPLICATION_FOLDER} while the scaffold ran, and the template was not written: move it, then run the same line again.`;
-var SCAFFOLD_AFTER_OWN_ERROR = `where the project's root holds no ${APPLICATION_FOLDER}/, or an empty one, the application was not written, and the same line run again writes it; where ${APPLICATION_FOLDER}/ holds the service's files, the ${LIBRARY_SUBCOMMAND} take line for each entry the template takes, run at the project's root, then npm test in ${APPLICATION_FOLDER}/, finish it where the template takes entries, and npm install and then npm test in ${APPLICATION_FOLDER}/ finish it where it takes none`;
+var SCAFFOLD_AFTER_OWN_ERROR = `where the project's root holds no ${APPLICATION_FOLDER}/, or an empty one, the application was not written, and the same line run again writes it. Where ${APPLICATION_FOLDER}/ holds the service's files, the ${LIBRARY_SUBCOMMAND} take line for each entry the template takes, run at the project's root, then npm test in ${APPLICATION_FOLDER}/, finish it where the template takes entries. Where it takes none, npm install and then npm test in ${APPLICATION_FOLDER}/ finish it`;
 var printEach = (io2, text) => {
   for (const line of text.split("\n")) io2.print(line);
 };
@@ -9055,12 +9122,14 @@ async function scaffold(call, io2) {
     if (arrived !== null) return refuse(...arrived);
     const toolsStands = standsAt(io2, root, TOOLS_FILE);
     const claudeStands = standsAt(io2, root, CLAUDE_FILE);
+    const rootPackage = startedAtRootOf(io2, root).includes("package.json");
     let ended = false;
     release = io2.whenEnded(() => {
       ended = true;
       printEach(io2, signalEndedLine(stateNow(), template, takeLines));
     });
     reached = "writes";
+    io2.print(rootPackage ? ROOT_PACKAGE_LINE : APPLICATION_IN_APP_LINE);
     if (io2.stat(root) === null) io2.makeFolder(root);
     if (held.fresh) io2.makeFolder(held.library);
     writeTemplate(io2, stage, app, composedFilesOf(files, held.packages, minute, options.application));
@@ -9126,9 +9195,9 @@ async function installAndTest(io2, app, template, taken, origin, left) {
   return COMMAND_STATUS.done;
 }
 var SCAFFOLD_CREDENTIAL = LIBRARY_CREDENTIAL;
-var SCAFFOLD_READS = `under a template that takes library entries what library take reads, ${LIBRARY_READS}; and under a template that takes none, no credential`;
+var SCAFFOLD_READS = `what library take reads under a template that takes library entries: ${LIBRARY_READS}. Under a template that takes none, it reads no credential`;
 var SCAFFOLD_AFTER_LOGIN = `Once ${LOGIN_SUBCOMMAND} has printed authorized:, run this ${SCAFFOLD_SUBCOMMAND} line again. ${NOTHING_WRITTEN2}`;
-var SCAFFOLD_SIGN_IN_WHY = `A template that takes library entries needs a sign-in, since the library's reads are under a credential; ${SCAFFOLD_DEFAULT_TEMPLATE}, which takes none, runs without one.`;
+var SCAFFOLD_SIGN_IN_WHY = `A template that takes library entries needs a sign-in, since the library's reads are under a credential. The ${SCAFFOLD_DEFAULT_TEMPLATE} template, which takes none, runs without one.`;
 var SCAFFOLD_ROW = Object.freeze({
   name: SCAFFOLD_SUBCOMMAND,
   summary: `Writes a new service from a template into a project, ${SCAFFOLD_DEFAULT_TEMPLATE} where the line names no ${SCAFFOLD_OPTION.template}. It writes the template's files under app/, runs npm install and npm test there, and prints the next steps. It starts a new application, and writes over no file. Some templates take library entries: database-service takes the Database entry, and web-app takes three. Such a template takes each entry as library take does, under the same credential and with the same checks, before it writes anything. It fills the manifest's packages member from the library folder's rows. With no credential, it writes nothing, and prints the login route and this line to run again once you are signed in. A template that takes no entry reads no credential.`,
@@ -9139,16 +9208,17 @@ var SCAFFOLD_ROW = Object.freeze({
   statuses: {
     done: "the files written and installed, the entries taken where the template takes any, and the tests passed",
     failed: "the files written, and npm install or the tests failed",
-    unknown: "the run stopped before its end, by an interrupt or another signal that ended npm, by an error of the command's own, or by something that came to stand at app while it wrote: the printed sentence names the way on",
+    unknown: "the run stopped before its end. An interrupt or another signal ended npm, or the command met an error of its own, or something came to stand at app while it wrote. The printed sentence names the way on",
     nothing_started: "nothing was written"
   },
   note: [
     `Run the ${SCAFFOLD_SUBCOMMAND} line at the root of a new project, or name the root with ${SCAFFOLD_OPTION.path}, which the command makes where it does not stand. A line that names no ${SCAFFOLD_OPTION.template} writes ${SCAFFOLD_DEFAULT_TEMPLATE}, which takes no library entry and makes no request, and says so in a line before the files it wrote. Under scheduled-job, the minute of the schedule's cron in the manifest is the minute of the hour, in UTC, at which the run started.`,
+    `${SCAFFOLD_SUBCOMMAND} writes the service in ${APPLICATION_FOLDER}/, and before the files it lists, says so and why. Where a package.json stands at the root, it writes ${APPLICATION_FOLDER}/ beside it all the same. It refuses, writing nothing, where the root holds src/ or a source file such as server.mjs and no package.json.`,
     `With ${SCAFFOLD_OPTION.application}, the manifest names that application in its application member, on the line after manifest_version, which binds the folder to it before any deploy: a deploy or check line naming another application is refused. Where absent, the first deploy writes the member.`,
-    `Under ${listedAnd(RESOURCE_TEMPLATES)}, with ${SCAFFOLD_OPTION.resource}, and ${SCAFFOLD_OPTION.singular} where the singular is not the plural without its closing s, it writes the same service under the resource's names, its table, its route, its functions, and its file names among them, and runs the tests on the files as written. It refuses, writing nothing, where the root's ${APPLICATION_FOLDER}/ holds any file or folder, and it takes no option that overwrites: where the template takes entries, its sentence names the ${LIBRARY_SUBCOMMAND} take line for each, which adds the package to an application that stands.`,
-    `A root that holds neither ${LIBRARY_FOLDER}/ nor ${POINTER_FILE} takes a ${LIBRARY_FOLDER}/ of its own. Where the root holds no ${TOOLS_FILE}, it writes one of one sentence, which sends a coding tool to ${APPLICATION_FOLDER}/${TOOLS_FILE}; it changes no file that stands at the root, and where an ${TOOLS_FILE} or a ${CLAUDE_FILE} stands there it prints the sentence to add.`,
-    `${SCAFFOLD_SUBCOMMAND} leaves ${COMMAND_CREDENTIAL_VARIABLES.join(" and ")} out of what npm install and npm test receive. An interrupt reaches npm, the command ends after it, and after an interrupted install the tests are not started. A signal that arrives after the command's first write and before npm starts is acted on once the writes are made: the command prints the way on, starts no npm, and ends with 128 and the signal's number.`,
-    `Where the tests fail, they failed on the files as written, and the printed line says to report it, naming the versions the library served where the template takes entries, and the template and the command's version where it takes none.`
+    `Under ${listedAnd(RESOURCE_TEMPLATES)}, with ${SCAFFOLD_OPTION.resource}, it writes the same service under the resource's names, its table, its route, its functions, and its file names among them. Name ${SCAFFOLD_OPTION.singular} too where the singular is not the plural without its closing s. It runs the tests on the files as written. It refuses, writing nothing, where the root's ${APPLICATION_FOLDER}/ holds any file or folder, and it takes no option that overwrites. Where the template takes entries, its sentence names the ${LIBRARY_SUBCOMMAND} take line for each, which adds the package to an application that stands.`,
+    `A root that holds neither ${LIBRARY_FOLDER}/ nor ${POINTER_FILE} takes a ${LIBRARY_FOLDER}/ of its own. Where the root holds no ${TOOLS_FILE}, it writes one of one sentence, which sends a coding tool to ${APPLICATION_FOLDER}/${TOOLS_FILE}. It changes no file that stands at the root, and where an ${TOOLS_FILE} or a ${CLAUDE_FILE} stands there it prints the sentence to add.`,
+    `${SCAFFOLD_SUBCOMMAND} leaves ${COMMAND_CREDENTIAL_VARIABLES.join(" and ")} out of what npm install and npm test receive. An interrupt reaches npm, the command ends after it, and after an interrupted install the tests are not started. A signal that arrives after the command's first write and before npm starts is acted on once the writes are made. The command then prints the way on, starts no npm, and ends with 128 and the signal's number.`,
+    `Where the tests fail, they failed on the files as written, and the printed line says to report it. It names the versions the library served where the template takes entries, and the template and the command's version where it takes none.`
   ],
   afterOwnError: SCAFFOLD_AFTER_OWN_ERROR,
   run: scaffold
@@ -9187,13 +9257,13 @@ var SESSION_OPTIONS = Object.freeze([
     name: SESSION_OPTION.endUser,
     value: "<end user id or label>",
     required: true,
-    description: "The test end user, by the id or the label create_test_end_users answered."
+    description: "The test end user, by the id or the label test_end_users answered with act create."
   },
   {
     name: SESSION_OPTION.out,
     value: "<path>",
     required: true,
-    description: `The cookie jar file the session's cookie is written into, which curl -b reads. Its folder must stand. A file that stands there is refused unless the line names ${SESSION_OPTION.force}, and a path inside the folder the command runs in is refused where that folder holds package.json, since a deploy from it would upload the jar.`
+    description: `The cookie jar file the session's cookie is written into, which curl -b reads. Its folder must stand. A file that stands there is refused unless the line names ${SESSION_OPTION.force}. A path inside the folder the command runs in is refused where that folder holds package.json, since a deploy from it would upload the jar.`
   },
   {
     name: SESSION_OPTION.origin,
@@ -9215,9 +9285,9 @@ var SESSION_CREDENTIAL = Object.freeze({
   call: `the ${SIGN_IN_TEST_END_USER_ACTION} call`,
   mintedToken: true,
   piped: false,
-  places: `the command reads no standard input: it reads a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, as a tool connected by a minted token sets it from where its token is kept, or a job with no tool from its secret store, and otherwise this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write.`
+  places: NO_INPUT_PLACES
 });
-var SESSION_READS = `no standard input: a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, and otherwise this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write, sent only to that address; with neither, it prints the variable route first and then, where the address is admitted, the login route`;
+var SESSION_READS = `no standard input. It reads a minted token from ${MINTED_TOKEN_VARIABLE} where that is set. Otherwise it reads this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write, and sends it only to that address. With neither, it prints the variable route first, then the login route where the address is admitted`;
 var missingOptionSentence = (option) => `${SESSION_SUBCOMMAND} needs ${option.name} ${option.value}, as the line a ${SIGN_IN_TEST_END_USER_ACTION} call answers names it. ${NOTHING_SENT_OR_WRITTEN}`;
 var ENVIRONMENT_REFUSAL = `${SESSION_OPTION.environment} names the environment the end user signs in to, ${COMMAND_ENVIRONMENTS.join(" or ")}. ${NOTHING_SENT_OR_WRITTEN}`;
 var OUT_STANDS_REFUSAL = `A file stands where ${SESSION_OPTION.out} names the cookie jar, and ${SESSION_SUBCOMMAND} replaces one only where the line names ${SESSION_OPTION.force}. Name a new file, or add ${SESSION_OPTION.force} to replace it. ${NOTHING_SENT_OR_WRITTEN}`;
@@ -9463,12 +9533,12 @@ var SESSION_ROW = Object.freeze({
   reads: SESSION_READS,
   statuses: {
     done: `the end user was signed in and the session's cookie written to the file ${SESSION_OPTION.out} names`,
-    failed: "the platform refused the sign-in, the printed lines naming the platform's error and detail, or the end user was signed in and the cookie jar could not be written, so the session's cookie was not kept",
+    failed: "the platform refused the sign-in, and the printed lines name the platform's error and detail. Or the end user was signed in, and the cookie jar could not be written, so the session's cookie was not kept",
     unknown: "the sign-in call drew no answer, was redirected, failed, or drew an answer that is neither a refusal nor a session, and nothing was written",
-    nothing_started: `nothing was sent, or nothing was written: an option, the file ${SESSION_OPTION.out} names, or the credential was refused, no credential was read and the two routes to one were printed, the platform was too old, or the jar's folder admitted no write`
+    nothing_started: `nothing was sent, or nothing was written. An option, the file ${SESSION_OPTION.out} names, or the credential was refused. Or no credential was read, and the two routes to one were printed. Or the platform was too old, or the jar's folder admitted no write`
   },
   note: [
-    `A session line is the one your tool's ${SIGN_IN_TEST_END_USER_ACTION} call answers where the platform serves that action, and it carries no credential. Run it once: it signs the test end user in and writes the session's cookie into the file ${SESSION_OPTION.out} names, in the cookie file form curl -b reads, so the session's value never passes through your tool. Requests then carry the cookie with curl -b and that path.`,
+    `A session line is the one your tool's ${SIGN_IN_TEST_END_USER_ACTION} call answers where the platform serves that action, and it carries no credential. Run it once: it signs the test end user in and writes the session's cookie into the file ${SESSION_OPTION.out} names. The file is in the cookie file form curl -b reads, so the session's value never passes through your tool. Requests then carry the cookie with curl -b and that path.`,
     `${SESSION_SUBCOMMAND} writes the cookie jar under another name beside it, owner-only, and renames it into place, and it removes that file where the run ends before the rename. It writes over a file that stands only where the line names ${SESSION_OPTION.force}. It refuses a path inside the folder the command runs in where that folder holds package.json, since a deploy from it would upload the jar.`
   ],
   afterOwnError: `whether the end user was signed in is unknown, and a file ${SESSION_OPTION.out} names may now stand, so run the line again, adding ${SESSION_OPTION.force} where it does`,
@@ -9491,7 +9561,7 @@ var TOKEN_CREDENTIAL = Object.freeze({
   mintedToken: false,
   bare: `under ${TOKEN_ACTS[0]}, it reads none, and prints the challenge for a ${MINT_TOKEN_ACTION} call`
 });
-var TERMINAL_RULE_SENTENCE = `${TOKEN_SUBCOMMAND} ${TOKEN_CLAIM_ACT} prints a token's value, so it runs only where its standard error is a terminal, as in a terminal of your own outside the AI coding tool, its standard output piped or not; here it is not, as under an AI coding tool's shell, so nothing was read and nothing was sent. Run the line yourself in a terminal outside the AI coding tool, piping it into your secret store's command where the token is a job's.`;
+var TERMINAL_RULE_SENTENCE = `${TOKEN_SUBCOMMAND} ${TOKEN_CLAIM_ACT} prints a token's value, so it runs only where its standard error is a terminal, as in a terminal of your own outside the AI coding tool, its standard output piped or not. Here it is not, as under an AI coding tool's shell, so nothing was read and nothing was sent. Run the line yourself in a terminal outside the AI coding tool, piping it into your secret store's command where the token is a job's.`;
 async function token(call, io2) {
   const claim = call.act === TOKEN_CLAIM_ACT;
   const say = claim ? io2.printError ?? io2.print : io2.print;
@@ -9526,7 +9596,7 @@ async function token(call, io2) {
     return COMMAND_STATUS.nothing_started;
   }
   io2.hide(code, REDACTED_TOKEN_CODE);
-  return completeAct(io2, origin.origin, "general", code, agent.userAgent, say, (minted) => io2.printValue(minted.value));
+  return completeAct(io2, origin.origin, "general", { code }, agent.userAgent, say, (minted) => io2.printValue(minted.value));
 }
 var TOKEN_ROW = Object.freeze({
   name: TOKEN_SUBCOMMAND,
@@ -9539,10 +9609,10 @@ var TOKEN_ROW = Object.freeze({
     done: "the challenge printed, or the value printed once",
     failed: "the token minted was an authorized computer's, and is revoked where it could be: the printed lines name revoke_token",
     unknown: "the exchange drew no answer, or an answer that is not a refusal: list_tokens shows whether a token was minted",
-    nothing_started: "nothing was minted: an option, the credential file, the token code, or a standard error that is no terminal was refused, no request was pending, the platform was too old, or the exchange was refused"
+    nothing_started: "nothing was minted. An option, the credential file, the token code, or a standard error that is no terminal was refused. Or no request was pending, the platform was too old, or the exchange was refused"
   },
   variables: [[ORIGIN_VARIABLE, AUTHORIZATION_ORIGIN_VARIABLE_LINE]],
-  note: [`${TOKEN_SUBCOMMAND} ${TOKEN_ACTS[0]} may run in a tool, since it prints nothing secret. ${TOKEN_SUBCOMMAND} ${TOKEN_ACTS[1]} is yours, run in a terminal outside the AI coding tool on the same computer as the same user, and never by a tool: it runs only where its standard error is a terminal, which yours stays when you pipe its standard output into your secret store's command, such as gh secret set ${MINTED_TOKEN_VARIABLE}. Read the line's origin before you run it.`],
+  note: [`${TOKEN_SUBCOMMAND} ${TOKEN_ACTS[0]} may run in a tool, since it prints nothing secret. ${TOKEN_SUBCOMMAND} ${TOKEN_ACTS[1]} is yours, run in a terminal outside the AI coding tool on the same computer as the same user, and never by a tool. It runs only where its standard error is a terminal, which yours stays when you pipe its standard output into your secret store's command, such as gh secret set ${MINTED_TOKEN_VARIABLE}. Read the line's origin before you run it.`],
   afterOwnError: AUTHORIZE_AFTER_OWN_ERROR,
   run: token
 });
@@ -9787,6 +9857,7 @@ var processIo = () => ({
 `);
   },
   errorIsTerminal: process.stderr.isTTY === true,
+  outputIsTerminal: process.stdout.isTTY === true,
   // The one value line (PLD-L0-94): a minted token's value alone, whole, on
   // standard output; any other text is written as print writes it.
   printValue: (value) => {
@@ -9896,7 +9967,7 @@ var STATUS_MEANINGS = Object.freeze([
   ["nothing_started", "nothing was started"]
 ]);
 var WINDOWS_SENTENCE = `On Windows, write ${WINDOWS_LINE_PROGRAM} for ${LINE_PROGRAM}, because Windows PowerShell refuses ${LINE_PROGRAM} where running scripts is disabled.`;
-var QUOTED_PATH_SENTENCE = "On Windows, a path written between double quotes ends in no backslash: cmd and Windows PowerShell 5.1 read a backslash before the closing quote as keeping the quote, and the command there refuses a path that holds a double quote.";
+var QUOTED_PATH_SENTENCE = "On Windows, end a path written between double quotes with no backslash. cmd and Windows PowerShell 5.1 read a backslash before the closing quote as keeping the quote. The command there refuses a path that holds a double quote.";
 var ON_WINDOWS = process.platform === "win32";
 var pipedHead = (subcommand) => subcommand.credential === null || subcommand.credential.piped === false ? "" : subcommand.credential.bare !== void 0 || subcommand.credential.computerToken === true ? `[echo <${subcommand.credential.grant}> |] ` : `echo <${subcommand.credential.grant}> | `;
 var usageLineOf = (subcommand) => {
@@ -9927,7 +9998,7 @@ var pipedLinesOf = (subcommand) => {
   const credential = subcommand.credential;
   if (credential === null || credential.piped === false) return [];
   return [
-    `  ${subcommand.name} reads ${credential.aGrant} from standard input, as the line ${credential.call} answers pipes it in${credential.mintedToken ? `; and otherwise a minted token from ${MINTED_TOKEN_VARIABLE} where it is set, or this computer's token from its credential file${credential.claim !== void 0 ? `, else ${credential.claim}` : ""}` : credential.computerToken === true ? `; and otherwise this computer's token from its credential file, never a minted token from ${MINTED_TOKEN_VARIABLE}, whose being set refuses the run` : ""}${credential.bare !== void 0 ? `; ${credential.bare}` : ""}.`
+    `  ${subcommand.name} reads ${credential.aGrant} from standard input${credential.pipes !== void 0 ? ` ${credential.pipes}` : `, as the line ${credential.call} answers pipes it in`}.${credential.mintedToken ? ` Otherwise it reads a minted token from ${MINTED_TOKEN_VARIABLE} where that is set, or this computer's token from its credential file${credential.claim !== void 0 ? `, else ${credential.claim}` : ""}.` : credential.computerToken === true ? ` Otherwise it reads this computer's token from its credential file. It never reads a minted token from ${MINTED_TOKEN_VARIABLE}, and refuses the run where that variable is set.` : ""}${credential.bare !== void 0 ? ` ${credential.bare.charAt(0).toUpperCase()}${credential.bare.slice(1)}.` : ""}`
   ];
 };
 var readsLinesOf = (subcommand) => subcommand.reads !== void 0 ? [`  ${subcommand.name} reads ${subcommand.reads}.`] : [];
@@ -9942,7 +10013,8 @@ var originVariableLine = () => {
 };
 var USER_AGENT_LINE = `  ${USER_AGENT_VARIABLE}  text appended to the command's user agent on each request.`;
 var ownVariableLinesOf = (subcommand) => (subcommand.variables ?? []).map(([name, does]) => `  ${name}  under ${subcommand.name}, ${does}`);
-var statusLineOf = (status, meaning, clauses, also) => `  ${COMMAND_STATUS[status]}  ${meaning}${clauses.length > 0 ? `: ${clauses.join("; ")}` : ""}.${also !== void 0 ? ` ${also}` : ""}`;
+var statusLineOf = (status, meaning, clauses, also) => `  ${COMMAND_STATUS[status]}  ${meaning}.${clauses.map((clause) => ` ${clause}.`).join("")}${also !== void 0 ? ` ${also}` : ""}`;
+var statusClauseOf = (name, clause) => `Under ${name}, ${clause}`;
 var noteLinesOf2 = (subcommand) => (subcommand.note ?? []).flatMap((paragraph) => ["", paragraph]);
 var usageBlockOf = (subcommandHelp) => [
   "Usage:",
@@ -9977,7 +10049,7 @@ var subcommandHelpOf = (subcommand, version = commandVersion()) => {
   lines.push(USER_AGENT_LINE, "", "Statuses:");
   for (const [status, meaning, also] of STATUS_MEANINGS) {
     const clause = subcommand.statuses[status];
-    if (clause !== void 0 || also !== void 0) lines.push(statusLineOf(status, meaning, clause !== void 0 ? [`under ${subcommand.name}, ${clause}`] : [], also));
+    if (clause !== void 0 || also !== void 0) lines.push(statusLineOf(status, meaning, clause !== void 0 ? [statusClauseOf(subcommand.name, clause)] : [], also));
   }
   lines.push(...noteLinesOf2(subcommand), "", SHARED_HELP_SENTENCE);
   return lines.join("\n");
@@ -9990,7 +10062,7 @@ var grantArgumentSentence = () => "An argument holds a grant. The command never
 var tokenArgumentSentence = () => `An argument holds a minted token. The command never takes a credential from its arguments: it reads a minted token from ${MINTED_TOKEN_VARIABLE} alone. A tool connected by a minted token, or an unattended run, sets that variable for the one line, from where the tool keeps the token or from your CI's secret store. Nothing was sent and nothing was started.`;
 var NOTHING_STARTED2 = "Nothing was started.";
 var unquoted = (value) => value.length >= 2 && value.startsWith('"') && value.endsWith('"') ? value.slice(1, -1) : value;
-var quoteInPathSentence = (name) => `${name} names a path, and its value holds a double quote, which no path on Windows holds. The usual cause is a path written with a backslash before its closing quote, which cmd and Windows PowerShell 5.1 read as keeping the quote, joining the arguments after it into the value. Write the path with no backslash at its end. ${NOTHING_STARTED2}`;
+var quoteInPathSentence = (name) => `${name} names a path, and its value holds a double quote, which no path on Windows holds. The usual cause is a backslash before the path's closing quote. cmd and Windows PowerShell 5.1 read it as keeping the quote, and join the arguments that follow into the value. Write the path with no backslash at its end. ${NOTHING_STARTED2}`;
 var emptyValueSentence = (name) => `${name} was given an empty value, as an unset shell variable gives. Name its value, or leave ${name} out where the line means its default. ${NOTHING_STARTED2}`;
 var valuePlacesOf = (argv2) => {
   const places = /* @__PURE__ */ new Set();
@@ -10072,6 +10144,9 @@ var nodeFloorRefusal = (found, version = commandVersion()) => {
   return major !== null && major < COMMAND_NODE_FLOOR ? nodeFloorSentence(version, found) : null;
 };
 var versionLineOf = (version, found) => `${TURNZERO_CLOUD_PACKAGE} ${version} (Node.js ${found})`;
+var SETUP_GUIDE = "https://turnzero.ai/cloud/getting-started/set-up/";
+var SETUP_PROMPT = "Set me up with Turn Zero Cloud and a small demo app. Read https://turnzero.ai/cloud/getting-started/set-up/index.md in full and follow the steps.";
+var showOnboarding = (io2) => io2.outputIsTerminal === true && !io2.env.CI;
 async function runGuarded(argv2, io2) {
   const found = io2.nodeVersion ?? process.versions.node;
   const version = commandVersion();
@@ -10083,6 +10158,8 @@ async function runGuarded(argv2, io2) {
   const parsed = parseArguments(argv2, io2.windows ?? ON_WINDOWS);
   if (parsed.kind === "help") {
     io2.print((parsed.subcommand === void 0 ? null : subcommandHelpText(parsed.subcommand.name, version)) ?? shortUsageText(version));
+    if (parsed.subcommand === void 0 && showOnboarding(io2)) io2.print(`
+New to Turn Zero Cloud? Start here: ${SETUP_GUIDE}`);
     return COMMAND_STATUS.done;
   }
   if (parsed.kind === "version") {
@@ -10096,6 +10173,12 @@ async function runGuarded(argv2, io2) {
     const npx = "ranThroughNpx" in io2 && io2.ranThroughNpx === true;
     const help = npx ? npxFormOf(`${SERVED} --help`, originReadOf(io2.env[ORIGIN_VARIABLE])) : `${SERVED} --help`;
     say(`${io2.windows ?? ON_WINDOWS ? windowsLineOf(help) : help} prints the usage.`);
+    if (argv2.length === 0 && showOnboarding(io2)) {
+      say(`
+Get started: ${SETUP_GUIDE}`);
+      say(`Paste this into Claude, ChatGPT, or Codex:
+${SETUP_PROMPT}`);
+    }
     return COMMAND_STATUS.nothing_started;
   }
   const upgrade = startUpgradeCheck(io2, parsed.subcommand.name, parsed.call.named, version);
@@ -10106,7 +10189,7 @@ async function runGuarded(argv2, io2) {
 }
 var outputOf = (argv2, io2) => argv2[0] === TOKEN_SUBCOMMAND && argv2[1] === TOKEN_CLAIM_ACT ? io2.printError ?? io2.print : io2.print;
 var NOTHING_REACHED = "no subcommand was reached, so nothing was started";
-var ownErrorSentence = (error, afterOwnError = NOTHING_REACHED) => `The command stopped on an error of its own (${error instanceof Error ? error.message : String(error)}); ${afterOwnError}.`;
+var ownErrorSentence = (error, afterOwnError = NOTHING_REACHED) => `The command stopped on an error of its own (${error instanceof Error ? error.message : String(error)}). ${afterOwnError.charAt(0).toUpperCase()}${afterOwnError.slice(1)}.`;
 var ownErrorLineOf = (argv2, io2, error) => {
   const parsed = parseArguments(argv2, io2.windows ?? ON_WINDOWS);
   return ownErrorSentence(error, parsed.kind === "run" ? afterOwnErrorOf(parsed.subcommand, parsed.call, io2) : NOTHING_REACHED);