turnzero 0.30.1 → 0.31.1-next.1

package/README.md

@@ -10,13 +10,13 @@ Paste this into Claude, ChatGPT, or Codex:
 Set me up with Turn Zero Cloud and a small demo app. Read https://turnzero.ai/cloud/getting-started/set-up/index.md in full and follow the steps.
 ```
 
-Your AI guides you through connecting Turn Zero Cloud, signing in or creating a free account, and building a demo you can open in your browser.
+Your AI connects Turn Zero Cloud and signs you in, or creates a free account. Then it gives you a build prompt to paste, which builds a demo you can open in your browser.
 
 [Read the setup guide](https://turnzero.ai/cloud/getting-started/set-up/) · [Explore Turn Zero Cloud](https://turnzero.ai/cloud/)
 
 ## What this package does
 
-The `turnzero` CLI lets your AI tool deploy files, run and test your app locally, and create a project from a template. The setup guide handles installation and authorization when needed.
+The `turnzero` CLI lets your AI coding tool deploy files, run and test your app locally, and create a project from a template. The setup guide handles installation and authorization when needed.
 
 To install it yourself, run `npm install -g turnzero`. It needs Node.js 24 or later. For commands and examples, run `turnzero --help`, or `turnzero.cmd --help` on Windows. Use `turnzero <subcommand> --help` for a specific command.
 

package/dist/turnzero-cloud.mjs

@@ -64,6 +64,7 @@ var TURNZERO_CLOUD_PACKAGE = "turnzero";
 var LOGIN_SUBCOMMAND = "login";
 var LOGIN_OPTION = Object.freeze({ origin: "--origin", noBrowser: "--no-browser" });
 var loginLineOf = (origin) => commandLineOf(origin, LOGIN_SUBCOMMAND, origin !== DEFAULT_COMMAND_ORIGIN ? { origin } : {});
+var HAND_OVER_SENTENCE = "If your tool's own safety check refuses a line, give the person that exact line to run once in their own terminal, never a rewritten one.";
 var COMPUTER_LOGIN_PATH = "/approve/computer";
 var COMPUTER_LOGIN_QUERY = Object.freeze({ challenge: "challenge", state: "state", port: "port", label: "label" });
 var LOGIN_STATE_FORM = /^[A-Za-z0-9_-]{43}$/;
@@ -280,6 +281,57 @@ var COMPLETION_MINT = "mint";
 var MINT_MEMBER = "mint";
 var MINT_OPTION = "--mint";
 var MINT_ID_FORM = UPLOAD_ID;
+var TZMESH_SUBCOMMAND = "tzmesh";
+var TZMESH_REGISTER_ACT = "register";
+var TZMESH_OPTION = {
+  name: "--name",
+  secret: "--secret",
+  toFile: "--to-file",
+  application: "--application",
+  environment: "--environment",
+  force: "--force",
+  origin: "--origin",
+  tzmeshEstate: "--tzmesh-estate",
+  mint: "--mint"
+};
+var TZMESH_ESTATES = Object.freeze(["production", "development"]);
+var TZMESH_ESTATE_ORIGINS = Object.freeze({
+  production: Object.freeze({ plane: DEFAULT_COMMAND_ORIGIN, wire: "https://tzmesh.turnzero.ai" }),
+  development: Object.freeze({ plane: DEVELOPMENT_COMMAND_ORIGIN, wire: "https://tzmesh.dev.turnzero.ai" })
+});
+var tzmeshEstateOfPlane = (origin) => TZMESH_ESTATES.find((estate) => TZMESH_ESTATE_ORIGINS[estate].plane === origin) ?? null;
+var TZMESH_MINT_GRANT = "tzmesh";
+var TZMESH_COMMAND_LABEL = "turnzero command";
+var TZMESH_MINT_DAYS = 1;
+var TZMESH_SIGNED_TOKEN_PREFIX = `${MINTED_TOKEN_PREFIX}${TZMESH_MINT_GRANT}1.`;
+var TZMESH_SIGNED_TOKEN_MAX = 4096;
+var TZMESH_SIGNED_TOKEN_FORM = new RegExp(`^${TZMESH_SIGNED_TOKEN_PREFIX.replace(/\./g, "\\.")}[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]{86}$`);
+var isTzmeshSignedToken = (value) => typeof value === "string" && value.length <= TZMESH_SIGNED_TOKEN_MAX && TZMESH_SIGNED_TOKEN_FORM.test(value);
+var SIGNED_TOKEN_PRODUCTS = ["tzmesh", "tztrack"];
+var PRODUCT_SIGNED_TOKEN_FORM = new RegExp(`^${MINTED_TOKEN_PREFIX}(?:${SIGNED_TOKEN_PRODUCTS.join("|")})1\\.[A-Za-z0-9_-]+\\.[A-Za-z0-9_-]{86}$`);
+var isClaimableToken = (value) => MINTED_TOKEN_FORM.test(value) || value.length <= TZMESH_SIGNED_TOKEN_MAX && PRODUCT_SIGNED_TOKEN_FORM.test(value);
+var TZMESH_SECRET_PREFIX = "turnzero_tzmesh_sec_";
+var TZMESH_SECRET_FORM = new RegExp(`^${TZMESH_SECRET_PREFIX}[A-Za-z0-9_-]{16,256}$`);
+var TZMESH_NAME_FORM = /^[A-Za-z0-9_-]{1,32}$/;
+var TZMESH_REGISTER_PATH = "/v1/register";
+var TZMESH_END_PATH = "/v1/end";
+var tzmeshMintMembers = (challenge) => [
+  [CODE_CHALLENGE_MEMBER, challenge],
+  ["scope_kind", "account"],
+  ["grants", [TZMESH_MINT_GRANT]],
+  ["label", TZMESH_COMMAND_LABEL],
+  ["expires_in_days", TZMESH_MINT_DAYS],
+  [COMPLETION_MEMBER, COMPLETION_MINT]
+];
+var tzmeshRegisterOptionsOf = (call) => [
+  `${TZMESH_OPTION.name} ${call.name}`,
+  call.secret !== void 0 ? `${TZMESH_OPTION.secret} ${call.secret}` : `${TZMESH_OPTION.toFile} "${call.toFile ?? ""}"`,
+  ...call.application !== void 0 ? [`${TZMESH_OPTION.application} ${call.application}`] : [],
+  ...call.environment !== void 0 ? [`${TZMESH_OPTION.environment} ${call.environment}`] : [],
+  ...call.force === true ? [TZMESH_OPTION.force] : [],
+  `${TZMESH_OPTION.origin} ${originWord(call.origin)}`,
+  `${TZMESH_OPTION.tzmeshEstate} ${call.tzmeshEstate}`
+].join(" ");
 
 // src/turnzero_cloud_command/credential_file.ts
 import { randomBytes } from "node:crypto";
@@ -789,9 +841,9 @@ var readMovingCredentialFile = (io2, place, say) => {
 // src/turnzero_cloud_command/grant.ts
 var GRANT_READ_BOUND_MS = 1e4;
 var GRANT_INPUT_BYTES_MAX = 4096;
-var readStandardInputEnded = (input, boundMs = GRANT_READ_BOUND_MS) => new Promise((resolve13) => {
+var readStandardInputEnded = (input, boundMs = GRANT_READ_BOUND_MS) => new Promise((resolve14) => {
   if (input.isTTY) {
-    resolve13({ text: "", bytes: 0, ending: "terminal" });
+    resolve14({ text: "", bytes: 0, ending: "terminal" });
     return;
   }
   const chunks = [];
@@ -813,7 +865,7 @@ var readStandardInputEnded = (input, boundMs = GRANT_READ_BOUND_MS) => new Promi
     input.removeListener("close", onEnd);
     input.pause();
     input.destroy?.();
-    resolve13({ text: Buffer.concat(chunks).toString("utf8"), bytes, ending });
+    resolve14({ text: Buffer.concat(chunks).toString("utf8"), bytes, ending });
   };
   const onEnd = () => finish("end");
   const onError = () => finish("error");
@@ -943,11 +995,12 @@ var noTokenSentence = (origin, expiredAt) => expiredAt === null ? `No credential
 var VARIABLE_ROUTE_SENTENCES = `A tool connected by a minted token, or a job, sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, never by writing the value in a line. It sets ${ORIGIN_VARIABLE} to the address that minted the token where that is not ${DEFAULT_COMMAND_ORIGIN}, then runs the line again. Such a tool cannot use ${MINT_TOKEN_ACTION}, which takes a sign-in alone. A tool sets ${MINTED_TOKEN_VARIABLE} for one line at a time and unsets it once that line ends.`;
 var authorizeRouteSentence = (origin) => `${AUTHORIZE_SUBCOMMAND}${originWordsOf(origin)} run with nothing piped prints the ${MINT_TOKEN_ACTION} call a signed-in tool makes to authorize this computer.`;
 var LOGIN_ROUTE_OPENER = "A person logs this computer in once, in a terminal of their own, and its token then stays on this computer for 30 days:";
-var DEPLOY_FILES_ROUTE_SENTENCE = "A folder within the caps of your tool's deploy_files call deploys now through deploy_files, with no login.";
+var DEPLOY_FILES_ROUTE_SENTENCE = "A folder within the caps of your tool's deploy_files call deploys now through deploy_files, with no login; past them, through mint_upload_grant and deploy's artifact.";
 var loginRouteLines = (io2, origin, deployFiles = true) => [
   LOGIN_ROUTE_OPENER,
   ...loginLinesFor(io2, origin),
-  ...deployFiles ? [DEPLOY_FILES_ROUTE_SENTENCE] : []
+  ...deployFiles ? [DEPLOY_FILES_ROUTE_SENTENCE] : [],
+  HAND_OVER_SENTENCE
 ];
 var loginRouteRefusalOf = (io2, closing) => {
   const place = credentialFileOf(io2);
@@ -963,6 +1016,8 @@ var loginRouteRefusalOf = (io2, closing) => {
 // src/turnzero_cloud_command/guard.ts
 var GRANT_TEXT = new RegExp(`${UPLOAD_GRANT_PREFIX}[A-Za-z0-9_-]*(?:\\.[A-Za-z0-9_-]+)*`, "g");
 var TOKEN_TEXT = new RegExp(`${MINTED_TOKEN_PREFIX}[A-Za-z0-9_-]*(?:\\.[A-Za-z0-9_-]+)*`, "g");
+var PROGRAM_SECRET_TEXT = new RegExp(`${TZMESH_SECRET_PREFIX}[A-Za-z0-9_-]*`, "g");
+var REDACTED_PROGRAM_SECRET = "<program secret>";
 var REDACTED_GRANT = "<grant>";
 var REDACTED_VALUE = "<value>";
 var REDACTED_TOKEN_CODE = "<token code>";
@@ -970,10 +1025,10 @@ var REDACTED_VERIFIER = "<verifier>";
 var REDACTED_CHALLENGE = "<challenge>";
 var HIDDEN_TEXT_MIN = 8;
 var redactGrants = (line) => line.replace(GRANT_TEXT, REDACTED_GRANT);
-var redactCredentials = (line) => redactGrants(line).replace(TOKEN_TEXT, REDACTED_TOKEN);
+var redactCredentials = (line) => redactGrants(line).replace(TOKEN_TEXT, REDACTED_TOKEN).replace(PROGRAM_SECRET_TEXT, REDACTED_PROGRAM_SECRET);
 var VALUE_LINE_REFUSED = Object.freeze({
   twice: "the value line is printed once in a run",
-  form: "only a minted token's value is printed whole",
+  form: "only a value of a form token claim prints is printed whole",
   terminal: "the value line is printed only where the command's standard error is a terminal",
   seam: "this io prints no value line"
 });
@@ -1001,7 +1056,7 @@ var guarded = (io2) => {
     },
     printValue: (value) => {
       if (valuePrinted) throw new Error(VALUE_LINE_REFUSED.twice);
-      if (!MINTED_TOKEN_FORM.test(value)) throw new Error(VALUE_LINE_REFUSED.form);
+      if (!isClaimableToken(value)) throw new Error(VALUE_LINE_REFUSED.form);
       if (io2.errorIsTerminal !== true) throw new Error(VALUE_LINE_REFUSED.terminal);
       if (io2.printValue === void 0) throw new Error(VALUE_LINE_REFUSED.seam);
       valuePrinted = true;
@@ -1041,17 +1096,33 @@ var hideStandingTokens = (io2, state) => {
 };
 var CHALLENGE_LINE_HEAD = "challenge: ";
 var CALL_LINE_HEAD = `call ${MINT_TOKEN_ACTION} with:`;
-var mintCallMembers = (kind, challenge, label) => kind === "authorized computer" ? [
+var mintCallMembers = (kind, challenge, label) => kind === "tzmesh" ? tzmeshMintMembers(challenge) : kind === "authorized computer" ? [
   [CODE_CHALLENGE_MEMBER, challenge],
   ["scope_kind", "account"],
   [AUTHORIZED_COMPUTER_MEMBER, true],
   ["label", label],
   [COMPLETION_MEMBER, COMPLETION_MINT]
 ] : [[CODE_CHALLENGE_MEMBER, challenge]];
-var firstActNamed = (kind, origin = DEFAULT_COMMAND_ORIGIN) => `${kind === "authorized computer" ? AUTHORIZE_SUBCOMMAND : `${TOKEN_SUBCOMMAND} ${TOKEN_REQUEST_ACT}`}${originWordsOf(origin)}`;
+var firstActNamed = (kind, origin = DEFAULT_COMMAND_ORIGIN) => kind === "tzmesh" ? (
+  // The tzmesh first act takes its options, which its own lines name, so
+  // the act is named by its words alone (PLD-L0-112).
+  `${TZMESH_SUBCOMMAND} ${TZMESH_REGISTER_ACT}`
+) : `${kind === "authorized computer" ? AUTHORIZE_SUBCOMMAND : `${TOKEN_SUBCOMMAND} ${TOKEN_REQUEST_ACT}`}${originWordsOf(origin)}`;
 var noConnectionLine = (origin) => `Where your tool holds no connection signed in to ${origin}, ${MINT_TOKEN_ACTION} is not among its tools: a person connects the tool and signs in, in a browser, before the call.`;
 var loginWaySentence = (loginLines) => `A person can instead log this computer in themselves, in a terminal of their own, by running ${loginLines.join(", then ")}, and approving the login in the browser.`;
-var firstActLines = (origin, kind, pending, label, loginLines = []) => [
+var OPTIONS_LINE_HEAD = "options: ";
+var tzmeshFirstActLines = (origin, pending, completing2) => [
+  `To register a tzMesh agent, call ${MINT_TOKEN_ACTION} at ${origin} from your tool, through the connection you signed in with, naming the members below and no others. Then run the line it answers once, on this computer, with the options below after it.`,
+  noConnectionLine(origin),
+  `${CHALLENGE_LINE_HEAD}${pending.challenge}`,
+  CALL_LINE_HEAD,
+  ...mintCallMembers("tzmesh", pending.challenge, TZMESH_COMMAND_LABEL).map(([name, value]) => `  ${name}: ${JSON.stringify(value)}`),
+  `${OPTIONS_LINE_HEAD}${completing2}`,
+  `The line it answers holds no code. The run presents this computer's verifier, registers the agent with the token it mints, keeps the agent's secret where the options say, and revokes the token. No line prints the secret.`,
+  `The request is pending until ${pending.expires_at}: ${firstActNamed("tzmesh", origin)} run again with the same options before then prints this challenge again.`,
+  HAND_OVER_SENTENCE
+];
+var firstActLines = (origin, kind, pending, label, loginLines = [], completing2 = "") => kind === "tzmesh" ? tzmeshFirstActLines(origin, pending, completing2) : [
   kind === "authorized computer" ? `To authorize this computer at ${origin}, call ${MINT_TOKEN_ACTION} from your tool, through the connection you signed in with, naming the members below and no others. Then run the line it answers once, as given, on this computer.` : `To mint a token whose value never passes through the chat, call ${MINT_TOKEN_ACTION} at ${origin} from your tool, through the connection you signed in with. Name the member below beside the scope_kind, application, grants, label, and expires_in_days the task needs.`,
   // The case this command cannot see (#4273): a tool with no signed-in
   // connection holds no mint_token, and only a person's sign-in mends it.
@@ -1060,11 +1131,12 @@ var firstActLines = (origin, kind, pending, label, loginLines = []) => [
   CALL_LINE_HEAD,
   ...mintCallMembers(kind, pending.challenge, label).map(([name, value]) => `  ${name}: ${JSON.stringify(value)}`),
   kind === "authorized computer" ? `The line it answers holds no code. It keeps the token it mints in this computer's credential file and revokes the one this computer held there before. The token is account-scoped and works from any computer until it expires or revoke_token ends it, and list_tokens shows it by its label. The request is pending until ${pending.expires_at}: ${firstActNamed(kind, origin)} run again before then prints this challenge again.` : `It answers a ${TOKEN_SUBCOMMAND} ${TOKEN_CLAIM_ACT} line, which is yours to run in a terminal outside the AI coding tool, on this computer as this user, and never through the tool. That line prints the token's value once to standard output, so pipe it into your secret store's command where the token is a job's. The request is pending until ${pending.expires_at}: ${firstActNamed(kind, origin)} run again before then prints this challenge again.`,
-  ...kind === "authorized computer" && loginLines.length > 0 ? [loginWaySentence(loginLines)] : []
+  ...kind === "authorized computer" && loginLines.length > 0 ? [loginWaySentence(loginLines)] : [],
+  ...kind === "authorized computer" ? [HAND_OVER_SENTENCE] : []
 ];
 var reusedRequestSentence = (origin, pending) => `A request for ${origin} is pending until ${pending.expires_at}, so its challenge is printed again and no new verifier was made.`;
 var replacedRequestSentence = (origin, expired2) => `The request pending for ${origin} expired at ${expired2.expires_at}, so a new one replaces it. A line minted against the old challenge is refused at its exchange, and a ${MINT_TOKEN_ACTION} call naming the new challenge below answers a fresh one.`;
-async function firstAct(io2, origin, kind, say, opener = null) {
+async function firstAct(io2, origin, kind, say, opener = null, completing2 = "") {
   const kept2 = keepPendingRequest(io2, origin, say);
   if ("status" in kept2) return kept2.status;
   const { pending, opening } = kept2;
@@ -1072,7 +1144,7 @@ async function firstAct(io2, origin, kind, say, opener = null) {
   const lines = [
     ...opener !== null ? [opener] : [],
     ...opening !== "" ? [opening] : [],
-    ...firstActLines(origin, kind, pending, label, kind === "authorized computer" ? loginLinesFor(io2, origin) : [])
+    ...firstActLines(origin, kind, pending, label, kind === "authorized computer" ? loginLinesFor(io2, origin) : [], completing2)
   ];
   let last = -1;
   for (const [index, line] of lines.entries()) if (line.includes(pending.challenge)) last = index;
@@ -1167,9 +1239,10 @@ async function revokeUnder(io2, origin, token2, id, userAgent) {
 var standsSentence = (what, id, expiresAt) => `${what} was not revoked, so it works until it expires${expiresAt !== null ? ` at ${expiresAt}` : ""}: revoke_token from your tool with id ${id} ends it, and list_tokens shows whether it stands.`;
 var INSTANT_FORM2 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/;
 var KEPT_LABEL_FORM = /^[^\u0000-\u001f\u007f-\u009f]{1,512}$/;
-var mintedTokenOf = (answer) => {
+var mintedTokenOf = (answer, kind = "authorized computer") => {
   const { value, token: token2 } = answer;
-  if (typeof value !== "string" || !MINTED_TOKEN_FORM.test(value)) return null;
+  if (typeof value !== "string") return null;
+  if (kind === "tzmesh" || kind === "general" ? value === "" || value.length > TZMESH_SIGNED_TOKEN_MAX : !MINTED_TOKEN_FORM.test(value)) return null;
   if (token2 === null || typeof token2 !== "object" || Array.isArray(token2)) return null;
   const view = token2;
   if (typeof view.id !== "string" || !UPLOAD_ID.test(view.id)) return null;
@@ -1185,6 +1258,7 @@ var mintAgainSentence = (kind, origin = DEFAULT_COMMAND_ORIGIN, login2 = null) =
 var exchangeUnknownSentence = (kind, origin = DEFAULT_COMMAND_ORIGIN, login2 = null) => `Whether a token was minted is unknown: list_tokens from your tool shows each token by its label, and revoke_token ends one nothing holds. ${mintAgainSentence(kind, origin, login2)}`;
 var noPendingSentence = (origin, kind, presented = "code") => `No request is pending for ${origin} on this computer, so ${presented === "mint" ? "nothing was sent: the verifier the mint needs" : "the token code was not presented and nothing was sent: the verifier it needs"} is kept only on the computer whose ${firstActNamed(kind)} printed its challenge. Run ${firstActNamed(kind, origin)} on this computer, call ${MINT_TOKEN_ACTION} from your tool with the challenge it prints, and run the line it answers.`;
 var markerDisagreesSentence = (kind, origin = DEFAULT_COMMAND_ORIGIN) => kind === "authorized computer" ? `The exchange minted a token that is not an authorized computer's, and ${AUTHORIZE_SUBCOMMAND} keeps only an authorized computer's, so nothing of its value was printed or kept. Call ${MINT_TOKEN_ACTION} from your tool again naming ${AUTHORIZED_COMPUTER_MEMBER}: true, as ${AUTHORIZE_SUBCOMMAND} prints it, and run the line it answers.` : `The exchange minted an authorized computer's token, and ${TOKEN_SUBCOMMAND} ${TOKEN_CLAIM_ACT} prints only a token that is not one, so nothing of its value was printed or kept. Call ${MINT_TOKEN_ACTION} from your tool again without ${AUTHORIZED_COMPUTER_MEMBER}, as ${TOKEN_SUBCOMMAND} ${TOKEN_REQUEST_ACT} prints it, and run the line it answers; to authorize this computer, run ${AUTHORIZE_SUBCOMMAND}${originWordsOf(origin)}.`;
+var unclaimableFormSentence = (origin = DEFAULT_COMMAND_ORIGIN) => `The exchange minted a token whose value is of no form ${TOKEN_SUBCOMMAND} ${TOKEN_CLAIM_ACT} prints, so nothing of its value was printed or kept. ${mintAgainSentence("general", origin)}`;
 var mintedRevocationLines = (revocation, minted) => "lines" in revocation ? [...revocation.lines, standsSentence(`The token it minted, ${minted.id},`, minted.id, minted.expiresAt)] : [`The token it minted, ${minted.id}, is revoked.`];
 var authorizedLineOf = (origin, entry, account = null) => `${AUTHORIZED_LINE_HEAD}${origin}${account !== null ? ` as ${accountWordsOf(account)}` : ""}, label ${entry.label !== null ? JSON.stringify(entry.label) : "none"}, its token expiring ${entry.expires_at !== null ? `at ${entry.expires_at}` : "never"}`;
 var READ_ACCOUNT_ACTION = "read_account";
@@ -1214,7 +1288,7 @@ async function readAccountUnder(io2, origin, token2, userAgent) {
 var whoamiLineFor = (io2, origin) => printedLineOf(io2, commandLineOf(origin, WHOAMI_SUBCOMMAND, origin !== DEFAULT_COMMAND_ORIGIN ? { origin } : {}), origin);
 var accountUnreadSentence = (whoami2) => `The account this computer's token acts as was not read, and the token is kept: run ${whoami2} to read it.`;
 var CLAIMED_LINE_HEAD = "claimed: ";
-async function completeAct(io2, origin, kind, presentation, userAgent, say, deliver = () => void 0, login2 = null) {
+async function completeAct(io2, origin, kind, presentation, userAgent, say, deliver = () => void 0, login2 = null, carried = null) {
   const held = "mint" in presentation;
   const unread = held ? MINT_UNPRESENTED : TOKEN_CODE_UNREAD;
   const place = credentialFileOf(io2);
@@ -1232,13 +1306,14 @@ async function completeAct(io2, origin, kind, presentation, userAgent, say, deli
   io2.hide(pending.verifier, REDACTED_VERIFIER);
   io2.hide(pending.challenge, REDACTED_CHALLENGE);
   const tag = runTagOf();
-  const stage = { now: "unsent", ended: false };
+  const stage = carried?.stage ?? { now: "unsent", ended: false };
   const release = io2.whenEnded(() => {
     stage.ended = true;
     say(
-      stage.now === "unsent" ? `The run was ended before its exchange. ${unread}` : stage.now === "sent" ? `The run was ended during its exchange. ${exchangeUnknownSentence(kind, origin, login2)}` : `The run was ended after its exchange minted a token, which may not have been ${kind === "authorized computer" ? "kept" : "printed"}: list_tokens from your tool shows it by its label, and revoke_token ends it.`
+      carried !== null ? carried.endedLine(stage.now) : stage.now === "unsent" ? `The run was ended before its exchange. ${unread}` : stage.now === "sent" ? `The run was ended during its exchange. ${exchangeUnknownSentence(kind, origin, login2)}` : `The run was ended after its exchange minted a token, which may not have been ${kind === "authorized computer" ? "kept" : "printed"}: list_tokens from your tool shows it by its label, and revoke_token ends it.`
     );
     dropCredentialWriting(io2, place, tag);
+    carried?.drop();
   });
   try {
     const prepared = prepareCredentialFile(io2, place, tag);
@@ -1246,6 +1321,11 @@ async function completeAct(io2, origin, kind, presentation, userAgent, say, deli
       say(`${unwritableFileSentence(place.path, prepared.unwritten)} Nothing was sent. ${unread}`);
       return COMMAND_STATUS.nothing_started;
     }
+    const untried = carried?.prepare() ?? null;
+    if (untried !== null) {
+      say(untried);
+      return COMMAND_STATUS.nothing_started;
+    }
     if (stage.ended) return COMMAND_STATUS.nothing_started;
     const older = await planeWireRefusal(io2, origin, held ? "" : TOKEN_CODE_UNREAD_FIRST);
     if (stage.ended) return COMMAND_STATUS.nothing_started;
@@ -1253,6 +1333,14 @@ async function completeAct(io2, origin, kind, presentation, userAgent, say, deli
       say(older);
       return COMMAND_STATUS.nothing_started;
     }
+    if (carried !== null) {
+      const further = await carried.checks();
+      if (stage.ended) return COMMAND_STATUS.nothing_started;
+      if (further !== null) {
+        say(further);
+        return COMMAND_STATUS.nothing_started;
+      }
+    }
     stage.now = "sent";
     const answered = "mint" in presentation ? await postAction(io2, origin, MINT_TOKEN_ACTION, pending.verifier, userAgent, heldExchangeBodyOf(presentation.mint)) : await postAction(io2, origin, MINT_TOKEN_ACTION, presentation.code, userAgent, exchangeBodyOf(pending.verifier));
     if (stage.ended) {
@@ -1291,7 +1379,7 @@ async function completeAct(io2, origin, kind, presentation, userAgent, say, deli
       );
       return COMMAND_STATUS.nothing_started;
     }
-    const minted = answer === null ? null : mintedTokenOf(answer);
+    const minted = answer === null ? null : mintedTokenOf(answer, kind);
     if (minted === null) {
       say(`The exchange was answered HTTP ${answered.status} with no token the command can use: a value and an id, each in its form. Nothing of the answer was printed or kept.`);
       say(unknown);
@@ -1299,6 +1387,17 @@ async function completeAct(io2, origin, kind, presentation, userAgent, say, deli
     }
     stage.now = "minted";
     io2.hide(minted.value, REDACTED_TOKEN);
+    if (kind === "tzmesh" && carried !== null) {
+      const ended = updateCredentialFile(io2, place, tag, withoutPending(origin));
+      if (stage.ended) return COMMAND_STATUS.unknown;
+      if (!("written" in ended)) say(`The request pending for ${origin} stands in the credential file, which could not be written now: it ends at its expiry, or when ${firstActNamed(kind, origin)} replaces it.`);
+      return isTzmeshSignedToken(minted.value) && !minted.authorizedComputer ? await carried.deliver(minted) : await carried.refuse(minted);
+    }
+    if (kind === "general" && !isClaimableToken(minted.value)) {
+      say(unclaimableFormSentence(origin));
+      for (const line of mintedRevocationLines(await revokeUnder(io2, origin, minted.value, minted.id, userAgent), minted)) say(line);
+      return COMMAND_STATUS.failed;
+    }
     if (minted.authorizedComputer !== (kind === "authorized computer")) {
       say(markerDisagreesSentence(kind, origin));
       for (const line of mintedRevocationLines(await revokeUnder(io2, origin, minted.value, minted.id, userAgent), minted)) say(line);
@@ -1309,6 +1408,7 @@ async function completeAct(io2, origin, kind, presentation, userAgent, say, deli
   } finally {
     release();
     dropCredentialWriting(io2, place, tag);
+    carried?.drop();
   }
 }
 function claimed(io2, place, tag, origin, minted, say, deliver) {
@@ -3325,7 +3425,7 @@ var headCommitOf = (folder, reads = FILE_SYSTEM_READS) => {
 
 // src/turnzero_cloud_command/options.ts
 var afterOwnErrorOf = (row, call, io2) => typeof row.afterOwnError === "function" ? row.afterOwnError(call, io2) : row.afterOwnError;
-var PATH_OPTION_NAMES = Object.freeze([DEPLOY_OPTION.path, SECRET_OPTION.valueFile, PROVISION_OPTION.envFile, SESSION_OPTION.out]);
+var PATH_OPTION_NAMES = Object.freeze([DEPLOY_OPTION.path, SECRET_OPTION.valueFile, PROVISION_OPTION.envFile, SESSION_OPTION.out, TZMESH_OPTION.toFile]);
 var DEPLOY_OPTIONS = Object.freeze([
   {
     name: DEPLOY_OPTION.application,
@@ -4039,7 +4139,8 @@ var DEPLOY_ROW = Object.freeze({
   note: [
     `A deploy is one line, which carries no credential: run the line your tool's deploy call answers, or ${DEPLOY_SUBCOMMAND} ${DEPLOY_OPTION.application} <application id>, from the application's folder. It reads no standard input. On an authorized computer it runs under this computer's token, which ${LOGIN_SUBCOMMAND} or ${AUTHORIZE_SUBCOMMAND} keeps in the credential file for each platform address. It sends that token only to the address it is kept under: ${DEPLOY_OPTION.origin} where the line names one, else the address ${ORIGIN_VARIABLE} holds, else ${DEFAULT_COMMAND_ORIGIN}.`,
     `On a computer with no token for that address, or one that has expired, it sends nothing, ends 3, and prints two routes, in this order. A tool connected by a minted token, or a job with no tool, such as a CI job's, sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, never by writing the value in a line. It sets ${ORIGIN_VARIABLE} to the address that minted the token where that is not ${DEFAULT_COMMAND_ORIGIN}, then runs the deploy line again. Such a tool cannot use ${MINT_TOKEN_ACTION}, which takes a sign-in alone.`,
-    `Otherwise a person logs this computer in once with ${LOGIN_SUBCOMMAND}, in a terminal of their own, then runs the deploy line again. A folder within the caps of the tool's deploy_files call deploys now through deploy_files, with no login. The credential file is ${CREDENTIAL_FILE_WORDS}.`,
+    `Otherwise a person logs this computer in once with ${LOGIN_SUBCOMMAND}, in a terminal of their own, then runs the deploy line again. The credential file is ${CREDENTIAL_FILE_WORDS}.`,
+    `${DEPLOY_FILES_ROUTE_SENTENCE} ${HAND_OVER_SENTENCE}`,
     `A tool sets ${MINTED_TOKEN_VARIABLE} for one line at a time and unsets it once that line ends, since the command cannot unset a variable of the shell that started it. A value a job's environment already supplies stays as it stands. A job's token is minted for the application, with an expiry. The variable's token wins over the credential file: the command makes the preparing call under that token, and sends the token in no other request.`,
     `Under the variable, the command sends its token only to the address ${ORIGIN_VARIABLE} holds, or to ${DEFAULT_COMMAND_ORIGIN} where that variable is unset. Under the token, ${DEPLOY_OPTION.origin} may name that address alone, and where the line names none the command addresses it. ${DEPLOY_OPTION.env} names the environment where a line names one, ${COMMAND_ENVIRONMENTS.join(" or ")}. Where none is named, the platform chooses, and the command deploys to the environment the platform answers.`,
     `A progress read answered 502, 503, or 504, which is often temporary, is made again, at most three more times. An upload answered 503 credential_lookup_busy, which wrote nothing, is made again after the wait it names, at most twice.`,
@@ -4412,7 +4513,7 @@ var noTerminalSentence = (option, call) => `${option} reads the value from a ter
 var readPromptedValue = (io2, option, fileOption, call) => {
   const terminal = io2.terminal();
   if (terminal === null) return Promise.resolve({ refusal: noTerminalSentence(option, call) });
-  return new Promise((resolve13) => {
+  return new Promise((resolve14) => {
     let typed = "";
     let done = false;
     let cancel = () => void 0;
@@ -4422,7 +4523,7 @@ var readPromptedValue = (io2, option, fileOption, call) => {
       cancel();
       terminal.write("\n");
       terminal.close();
-      resolve13(read2);
+      resolve14(read2);
     };
     cancel = io2.schedule(
       PROMPT_BOUND_SECONDS * 1e3,
@@ -5794,8 +5895,8 @@ var openerRunOf = (io2, address) => {
 };
 var openBrowser = async (io2, address) => {
   let cancel = () => void 0;
-  const waited = new Promise((resolve13) => {
-    cancel = io2.schedule(OPENER_WAIT_MS, () => resolve13("waiting"));
+  const waited = new Promise((resolve14) => {
+    cancel = io2.schedule(OPENER_WAIT_MS, () => resolve14("waiting"));
   });
   const ended = await Promise.race([io2.child(openerRunOf(io2, address)), waited]);
   cancel();
@@ -5876,13 +5977,13 @@ async function login(call, io2) {
   const endMs = Math.max(1e3, Date.parse(pending.expires_at) - io2.clock().getTime());
   const minutes = minutesLeftOf(pending.expires_at, io2.clock());
   let settle = () => void 0;
-  const arrived = new Promise((resolve13) => {
-    settle = resolve13;
+  const arrived = new Promise((resolve14) => {
+    settle = resolve14;
   });
   let taken = false;
   let outcome = () => void 0;
-  const outcomeKnown = new Promise((resolve13) => {
-    outcome = resolve13;
+  const outcomeKnown = new Promise((resolve14) => {
+    outcome = resolve14;
   });
   const take = (arrival2) => {
     if (taken) return false;
@@ -6141,7 +6242,7 @@ var whoamiLinesOf = (origin, account, entry) => [
   `${WHOAMI_LINE_HEADS.token}label ${entry.label !== null ? JSON.stringify(entry.label) : "none"}, expiring ${entry.expires_at !== null ? `at ${entry.expires_at}` : "never"}`
 ];
 var noComputerTokenSentence = (origin, expiredAt) => expiredAt === null ? `This computer's credential file holds no token for ${origin}, so nothing was sent.` : `This computer's token for ${origin} in its credential file expired at ${expiredAt}, so nothing was sent.`;
-var noLoginRoutesSentence = (origin) => `Your AI coding tool's own sign-in is not this computer's credential. With no login, deploy_files deploys a folder within its caps. ${authorizeRouteSentence(origin)} ${PROVISION_SUBCOMMAND}${originWordsOf(origin)} run so prints the call that answers its line.`;
+var noLoginRoutesSentence = (origin) => `Your AI coding tool's own sign-in is not this computer's credential. With no login, deploy_files deploys a folder within its caps; past them, upload a zip with mint_upload_grant, then name it as deploy's artifact. ${PROVISION_SUBCOMMAND}${originWordsOf(origin)} run with nothing piped prints the call that answers its line.`;
 var whoamiAfterLoginSentence = (whoami2) => `Once login has printed authorized:, run ${whoami2} again.`;
 async function whoami(call, io2) {
   const origin = entryOriginOf(io2.env, call.named[DEPLOY_OPTION.origin], NOTHING_SENT_OR_READ);
@@ -6173,6 +6274,7 @@ async function whoami(call, io2) {
     }
     io2.print(LOGIN_ROUTE_OPENER);
     for (const line of loginLinesFor(io2, reached.origin)) io2.print(line);
+    io2.print(HAND_OVER_SENTENCE);
     io2.print(whoamiAfterLoginSentence(whoamiLineFor(io2, reached.origin)));
     return COMMAND_STATUS.nothing_started;
   }
@@ -6196,7 +6298,7 @@ async function whoami(call, io2) {
 }
 var WHOAMI_ROW = Object.freeze({
   name: WHOAMI_SUBCOMMAND,
-  summary: `Names the account this computer's token acts as at the platform's address. It reads the token the credential file keeps for the address, and makes one ${READ_ACCOUNT_ACTION} call under it. It prints the address, the account's sign-in address and id, and the token's label and expiry. With no token for the address, it sends nothing. It names the ways on with no login (deploy_files, ${AUTHORIZE_SUBCOMMAND}, and ${PROVISION_SUBCOMMAND}), then prints the login route. It prints no token.`,
+  summary: `Names the account this computer's token acts as at the platform's address. It reads the token the credential file keeps for the address, and makes one ${READ_ACCOUNT_ACTION} call under it. It prints the address, the account's sign-in address and id, and the token's label and expiry. With no token for the address, it sends nothing. It names the ways on with no login (deploy_files, the upload route, and ${PROVISION_SUBCOMMAND}), then prints the login route. It prints no token.`,
   example: WHOAMI_SUBCOMMAND,
   options: WHOAMI_OPTIONS,
   credential: null,
@@ -9624,6 +9726,460 @@ var TOKEN_ROW = Object.freeze({
   run: token
 });
 
+// src/turnzero_cloud_command/tzmesh_register.ts
+import { dirname as dirname8, resolve as resolve13 } from "node:path";
+var TZMESH_LISTED = false;
+var TZMESH_ACT_WORDS = `${TZMESH_SUBCOMMAND} ${TZMESH_REGISTER_ACT}`;
+var TZMESH_OPTIONS = Object.freeze([
+  {
+    name: TZMESH_OPTION.name,
+    value: "<name>",
+    required: true,
+    description: "The agent's name, 1 to 32 letters, digits, hyphens, and underscores. Its handle is this name under your account's handle."
+  },
+  {
+    name: TZMESH_OPTION.secret,
+    value: "<secret name>",
+    required: false,
+    description: `The name the agent's secret is stored under in your account's secret store. Give exactly one of this and ${TZMESH_OPTION.toFile}. Under it, the secret never reaches your tool.`
+  },
+  {
+    name: TZMESH_OPTION.toFile,
+    value: "<file>",
+    required: false,
+    description: "A file the agent's secret is written into, alone on one line and readable by you alone, for a program on this computer. Anything that runs as you can read it, your tool among them."
+  },
+  {
+    name: TZMESH_OPTION.application,
+    value: "<application id>",
+    required: false,
+    description: `Under ${TZMESH_OPTION.secret}, the application whose scope holds the secret. Where absent, the account's scope.`
+  },
+  {
+    name: TZMESH_OPTION.environment,
+    value: "<environment>",
+    required: false,
+    description: `Under ${TZMESH_OPTION.secret}, the environment of that application whose scope holds the secret, ${COMMAND_ENVIRONMENTS.join(" or ")}. It goes with ${TZMESH_OPTION.application}.`
+  },
+  {
+    name: TZMESH_OPTION.force,
+    value: "",
+    required: false,
+    flag: true,
+    description: `Under ${TZMESH_OPTION.toFile}, replaces the file that stands there.`
+  },
+  {
+    name: TZMESH_OPTION.origin,
+    value: "<origin>",
+    required: false,
+    description: `The platform's address the secret is stored at, ${DEFAULT_COMMAND_ORIGIN} or ${DEVELOPMENT_COMMAND_ORIGIN}. Where absent, the address ${ORIGIN_VARIABLE} holds, or ${DEFAULT_COMMAND_ORIGIN} where it is unset.`
+  },
+  {
+    name: TZMESH_OPTION.tzmeshEstate,
+    value: "<estate>",
+    required: false,
+    description: `The estate the agent is registered at, ${TZMESH_ESTATES.join(" or ")}: its platform mints the run's token, and its tzMesh service registers the agent. Where absent, the estate of ${TZMESH_OPTION.origin}.`
+  },
+  {
+    name: TZMESH_OPTION.mint,
+    value: "<id>",
+    required: false,
+    description: `The mint the line names, by its id, as the line a ${MINT_TOKEN_ACTION} call answers names it. The id is no credential. Under it, the command presents this computer's verifier for that mint.`
+  }
+]);
+var UNPRINTABLE_PATH = /["$`%\u0000-\u001f\u007f]/;
+var closingOf = (call) => call.named[TZMESH_OPTION.mint] !== void 0 ? MINT_UNPRESENTED : NOTHING_SENT;
+var TZMESH_MINT_ID_REFUSAL = `${TZMESH_OPTION.mint} names the mint by its id, a lowercase UUID, as the line the ${MINT_TOKEN_ACTION} call answered names it: run that line as given, with the options the first act printed after it. ${NOTHING_SENT}`;
+var tzmeshOriginRefusal = (closing) => `${TZMESH_OPTION.origin} names the platform's address the secret is stored at, and ${TZMESH_ACT_WORDS} reaches only ${DEFAULT_COMMAND_ORIGIN} or ${DEVELOPMENT_COMMAND_ORIGIN}. Where the line names none, ${ORIGIN_VARIABLE} must hold one of those two, or be unset. ${closing}`;
+var tzmeshOptionsOf = (call, io2) => {
+  const mint = call.named[TZMESH_OPTION.mint] ?? null;
+  if (mint !== null && !MINT_ID_FORM.test(mint)) return { refusal: TZMESH_MINT_ID_REFUSAL };
+  const closing = closingOf(call);
+  const name = call.named[TZMESH_OPTION.name];
+  if (name === void 0 || !TZMESH_NAME_FORM.test(name)) return { refusal: `${TZMESH_OPTION.name} names the agent: 1 to 32 letters, digits, hyphens, and underscores. ${closing}` };
+  const secret2 = call.named[TZMESH_OPTION.secret];
+  const toFile = call.named[TZMESH_OPTION.toFile];
+  if (secret2 === void 0 === (toFile === void 0)) {
+    return { refusal: `Give one of ${TZMESH_OPTION.secret} and ${TZMESH_OPTION.toFile}: the name the agent's secret is stored under, or the file it is written into. ${closing}` };
+  }
+  if (secret2 !== void 0 && !SECRET_NAME_FORM.test(secret2)) {
+    return { refusal: `${TZMESH_OPTION.secret} names the secret the agent's secret is stored under: a letter or digit first, then letters, digits, _ or -, up to 64 characters. ${closing}` };
+  }
+  const application = call.named[TZMESH_OPTION.application] ?? null;
+  if (application !== null && toFile !== void 0) return { refusal: `${TZMESH_OPTION.application} goes with ${TZMESH_OPTION.secret} alone: a file has no scope. ${closing}` };
+  if (application !== null && !UPLOAD_ID.test(application)) {
+    return { refusal: `${TZMESH_OPTION.application} names the application whose scope holds the secret, by its id, a lowercase UUID. ${closing}` };
+  }
+  const named = call.named[TZMESH_OPTION.environment];
+  const environment = COMMAND_ENVIRONMENTS.find((entry) => entry === named) ?? null;
+  if (named !== void 0 && (environment === null || application === null)) {
+    return {
+      refusal: `${TZMESH_OPTION.environment} names the environment of an application whose scope holds the secret, ${COMMAND_ENVIRONMENTS.join(" or ")}, and goes with ${TZMESH_OPTION.application}: the account's scope has no environment. ${closing}`
+    };
+  }
+  const force = call.flags.has(TZMESH_OPTION.force);
+  if (force && toFile === void 0) return { refusal: `${TZMESH_OPTION.force} goes with ${TZMESH_OPTION.toFile} alone: it replaces a file that stands there. ${closing}` };
+  const path = toFile !== void 0 ? resolve13(io2.cwd, toFile) : null;
+  if (path !== null && UNPRINTABLE_PATH.test(path)) {
+    return { refusal: `${TZMESH_OPTION.toFile} names a path holding a character a line cannot carry between double quotes: a double quote, $, a backtick, %, or a control character. Name a path without one. ${closing}` };
+  }
+  const origin = entryOriginOf(io2.env, call.named[TZMESH_OPTION.origin], closing);
+  if ("refusal" in origin) return origin;
+  if (!FIRST_PARTY_COMMAND_ORIGINS.includes(origin.origin)) return { refusal: tzmeshOriginRefusal(closing) };
+  const namedEstate = call.named[TZMESH_OPTION.tzmeshEstate];
+  const estate = namedEstate === void 0 ? tzmeshEstateOfPlane(origin.origin) : TZMESH_ESTATES.find((entry) => entry === namedEstate) ?? null;
+  if (estate === null) return { refusal: `${TZMESH_OPTION.tzmeshEstate} names the estate the agent is registered at, ${TZMESH_ESTATES.join(" or ")}. ${closing}` };
+  return {
+    name,
+    route: secret2 !== void 0 ? { secret: secret2 } : { toFile: path },
+    application,
+    environment,
+    force,
+    origin: origin.origin,
+    estate,
+    mint
+  };
+};
+var completingOptionsOf = (options) => {
+  const call = {
+    name: options.name,
+    ..."secret" in options.route ? { secret: options.route.secret } : { toFile: options.route.toFile },
+    ...options.application !== null ? { application: options.application } : {},
+    ...options.environment !== null ? { environment: options.environment } : {},
+    ...options.force ? { force: true } : {},
+    origin: options.origin,
+    tzmeshEstate: options.estate
+  };
+  return tzmeshRegisterOptionsOf(call);
+};
+var tzmeshMintedTokenRefusal = (closing) => `${MINTED_TOKEN_VARIABLE} is set, and ${TZMESH_ACT_WORDS} never runs under a minted token: it runs under this computer's token for each address it sends to. Unset the variable for this line and run it again. ${closing}`;
+var NEEDED_FOR = Object.freeze({
+  revoke: "to revoke the token the run mints there",
+  store: "to store the secret there",
+  both: "to revoke the token the run mints there and to store the secret there"
+});
+var tzmeshNoTokenSentence = (origin, expiredAt, need) => expiredAt === null ? `This computer's credential file holds no token for ${origin}, which ${TZMESH_ACT_WORDS} needs ${NEEDED_FOR[need]}, so nothing was sent.` : `This computer's token for ${origin} in its credential file expired at ${expiredAt}, and ${TZMESH_ACT_WORDS} needs one ${NEEDED_FOR[need]}, so nothing was sent.`;
+var readComputerTokens = (io2, mintPlane, storeOrigin, closing) => {
+  const place = credentialFileOf(io2);
+  const read2 = readMovingCredentialFile(io2, place, io2.print);
+  if (!("state" in read2)) {
+    io2.print(`${readRefusalOf(read2, place.path)} ${closing}`);
+    return { status: COMMAND_STATUS.nothing_started };
+  }
+  hideStandingTokens(io2, read2.state);
+  const now = io2.clock().getTime();
+  const needs = storeOrigin === null ? [[mintPlane, "revoke"]] : storeOrigin === mintPlane ? [[mintPlane, "both"]] : [[mintPlane, "revoke"], [storeOrigin, "store"]];
+  for (const [origin, need] of needs) {
+    const entry = read2.state.origins.get(origin);
+    const expiredAt = entry !== void 0 && entry.expires_at !== null && Date.parse(entry.expires_at) <= now ? entry.expires_at : null;
+    if (entry !== void 0 && expiredAt === null) continue;
+    io2.print(tzmeshNoTokenSentence(origin, expiredAt, need));
+    io2.print(authorizeRouteSentence(origin));
+    const unwritable = loginRouteRefusalOf(io2, closing);
+    if (unwritable !== null) io2.print(unwritable);
+    else for (const line of loginRouteLines(io2, origin, false)) io2.print(line);
+    return { status: COMMAND_STATUS.nothing_started };
+  }
+  const mint = read2.state.origins.get(mintPlane);
+  return { mint, store: storeOrigin === null ? null : read2.state.origins.get(storeOrigin) };
+};
+var toFileFolderRefusal = (closing) => `${TZMESH_OPTION.toFile} names a folder: name a file for the secret, in that folder or another. ${closing}`;
+var toFileStandsRefusal = (closing) => `A file stands where ${TZMESH_OPTION.toFile} names, and ${TZMESH_ACT_WORDS} writes over one only where the line names ${TZMESH_OPTION.force}. Name a new file, or add ${TZMESH_OPTION.force} to replace it. ${closing}`;
+var toFileDeployedRefusal = (closing) => `${TZMESH_OPTION.toFile} names a file a deploy from the folder this line runs in would include, so the secret would be uploaded with the application. Name a file outside the application's folder. ${closing}`;
+var toFileParentRefusal = (closing) => `The folder ${TZMESH_OPTION.toFile} names a file in does not stand: make it, or name a file in a folder that stands. ${closing}`;
+var toFileUntriedRefusal = (code, closing) => `The file ${TZMESH_OPTION.toFile} names could not be written (${code}): its folder must admit a write. ${closing}`;
+var toFileRefusalOf = (io2, path, force, closing) => {
+  const standing = io2.stat(path);
+  if (standing !== null && standing.folder) return toFileFolderRefusal(closing);
+  if (standing !== null && !force) return toFileStandsRefusal(closing);
+  if (valueFileWouldDeploy(io2, resolve13(io2.cwd), path)) return toFileDeployedRefusal(closing);
+  const folder = io2.stat(dirname8(path));
+  if (folder === null || !folder.folder) return toFileParentRefusal(closing);
+  return null;
+};
+var REGISTERED_LINE_HEAD = "registered: ";
+var WRITTEN_LINE_HEAD = "written: ";
+var REGISTER_ACT = "register";
+var END_ACT = "deletion";
+var PRINTED_NAME_FORM = /^[A-Za-z0-9_.:/@-]{1,160}$/;
+var agentWords = (agent) => agent.handle !== null ? agent.handle : `with id ${agent.id}`;
+var registeredLineOf = (agent, wire) => `${REGISTERED_LINE_HEAD}agent ${agent.handle ?? "with no handle"}, id ${agent.id}, at ${wire}, its secret printed nowhere`;
+var WRITTEN_LINE = `${WRITTEN_LINE_HEAD}the agent's secret, alone on one line, into the file ${TZMESH_OPTION.toFile} names, readable by its owner alone`;
+var REGISTER_UNKNOWN = "Whether the agent was registered is unknown: tzmesh_participants from your tool shows it, and end from your tool, naming its participant and delete true, deletes it.";
+var agentStandsSentence = (agent) => `The agent ${agentWords(agent)} stands with no secret kept: end from your tool, naming participant ${agent.id} and delete true, deletes it and frees its name.`;
+var storeUnknownSentence = (secretName, agent) => `Whether the secret was stored is unknown: list_secrets from your tool shows when ${secretName} was last written. Where it was not written, end from your tool, naming participant ${agent.id} and delete true, deletes the agent ${agentWords(agent)}.`;
+var TOKEN_LEFT = `list_tokens from your tool shows the run's token by its label, ${TZMESH_COMMAND_LABEL}, and revoke_token ends it; it expires within a day either way.`;
+var tokenStandsSentence = (id) => `The run's token, ${id}, was not revoked, so it works until it expires within a day: revoke_token from your tool with id ${id} ends it, and list_tokens shows whether it stands.`;
+var revocationBearerRefused = (origin) => `This computer's token for ${origin} was refused as the bearer of the revocation.`;
+var revocationNotFound = (origin) => `The account this computer's token for ${origin} acts as holds no such token: that token likely belongs to another account than the one your tool signed in with.`;
+var postWire = async (io2, wire, path, bearer, userAgent, body) => {
+  const controller = new AbortController();
+  const cancel = io2.schedule(TOKEN_CALL_BOUND_SECONDS * 1e3, () => controller.abort());
+  try {
+    const response = await io2.fetch(`${wire}${path}`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${bearer}`, "user-agent": userAgent, "content-type": "application/json" },
+      body: JSON.stringify(body),
+      redirect: "manual",
+      signal: controller.signal
+    });
+    return { status: response.status, redirected: redirected(response), text: await response.text() };
+  } catch {
+    return null;
+  } finally {
+    cancel();
+  }
+};
+var register = async (io2, wire, token2, userAgent, name) => {
+  const answered = await postWire(io2, wire, TZMESH_REGISTER_PATH, token2, userAgent, { kind: "standing", name, label: TZMESH_COMMAND_LABEL });
+  if (answered === null) return { unknown: [`The ${REGISTER_ACT} drew no answer.`] };
+  if (answered.redirected) return { unknown: [`The ${REGISTER_ACT} was answered ${answeredHow(answered.status)}, which the command never follows, so the token was sent to no second address.`] };
+  if (answered.status >= PLATFORM_FAILURE_STATUS) return { unknown: failureLines(REGISTER_ACT, answered.status, planeRefusalOf(answered.text)) };
+  const answer = planeObjectOf(answered.text);
+  if (answer !== null && typeof answer.secret === "string") io2.hide(answer.secret, REDACTED_PROGRAM_SECRET);
+  if (answered.status < 200 || answered.status > 299) {
+    const refusal = planeRefusalOf(answered.text);
+    if (refusal === null) return { unknown: [`The ${REGISTER_ACT} was answered HTTP ${answered.status}, not by the tzMesh service.`] };
+    return { refused: [...refusalLines(REGISTER_ACT, answered.status, refusal), "Nothing was registered."] };
+  }
+  const participant = answer?.participant;
+  const record = participant !== null && typeof participant === "object" && !Array.isArray(participant) ? participant : null;
+  const id = typeof record?.id === "string" && PRINTED_NAME_FORM.test(record.id) ? record.id : null;
+  if (id === null) return { unknown: [`The ${REGISTER_ACT} was answered HTTP ${answered.status} with no participant the command can read.`] };
+  const agent = { id, handle: typeof record?.handle === "string" && PRINTED_NAME_FORM.test(record.handle) ? record.handle : null };
+  const secret2 = answer?.secret;
+  if (typeof secret2 !== "string" || !TZMESH_SECRET_FORM.test(secret2)) {
+    return { standing: agent, lines: [`The ${REGISTER_ACT} answered no secret the command can keep, so the agent stands with none kept.`] };
+  }
+  return { agent, secret: secret2 };
+};
+var deleteAgent = async (io2, wire, token2, userAgent, agent) => {
+  const answered = await postWire(io2, wire, TZMESH_END_PATH, token2, userAgent, { participant: agent.id, delete: true });
+  const deleted = answered !== null && !answered.redirected && answered.status >= 200 && answered.status <= 299 && planeObjectOf(answered.text) !== null;
+  if (deleted) return [`The agent ${agentWords(agent)} was deleted, and its name is free again.`];
+  const why = answered === null ? [`The ${END_ACT} drew no answer.`] : answered.redirected ? [`The ${END_ACT} was answered ${answeredHow(answered.status)}, which the command never follows.`] : answered.status >= PLATFORM_FAILURE_STATUS ? failureLines(END_ACT, answered.status, planeRefusalOf(answered.text)) : planeRefusalOf(answered.text) !== null ? refusalLines(END_ACT, answered.status, planeRefusalOf(answered.text)) : [`The ${END_ACT} was answered HTTP ${answered.status}, not by the tzMesh service.`];
+  return [...why, agentStandsSentence(agent)];
+};
+var revokeRunToken = async (io2, plane, bearer, id, userAgent) => {
+  const answered = await postAction(io2, plane, REVOKE_TOKEN_ACTION, bearer, userAgent, revocationBodyOf(id));
+  let lines;
+  if (answered === null) lines = [`${REVOKE_TOKEN_ACTION} drew no answer.`];
+  else if (answered.redirected) lines = [`${REVOKE_TOKEN_ACTION} was answered ${answeredHow(answered.status)}, which the command never follows.`];
+  else if (answered.status >= PLATFORM_FAILURE_STATUS) lines = failureLines(REVOKE_TOKEN_ACTION, answered.status, planeRefusalOf(answered.text));
+  else if (answered.status >= 200 && answered.status <= 299) {
+    const row = planeObjectOf(answered.text)?.token;
+    if (row !== null && typeof row === "object" && !Array.isArray(row) && row.id === id) return null;
+    lines = [`${REVOKE_TOKEN_ACTION} was answered HTTP ${answered.status} with no revocation of token ${id} the command can read.`];
+  } else {
+    const refusal = markedRefusalOf(answered.status, answered.text);
+    lines = refusal === null ? [notThePlatformLine("revocation", answered.status)] : [
+      ...refusalLines(REVOKE_TOKEN_ACTION, answered.status, refusal),
+      ...answered.status === 401 ? [revocationBearerRefused(plane)] : answered.status === 404 ? [revocationNotFound(plane)] : []
+    ];
+  }
+  return [...lines, tokenStandsSentence(id)];
+};
+var endedLineOf = (stage, plane, agent, route) => {
+  switch (stage) {
+    case "unsent":
+      return `The run was ended before its exchange. ${MINT_UNPRESENTED}`;
+    case "sent":
+      return `The run was ended during its exchange. ${exchangeUnknownSentence("tzmesh", plane)}`;
+    case "minted":
+      return `The run was ended after its exchange minted the run's token, before the register. ${TOKEN_LEFT}`;
+    case "registering":
+      return `The run was ended during the register. ${REGISTER_UNKNOWN} ${TOKEN_LEFT}`;
+    case "registered":
+      return agent === null ? `The run was ended after the register. ${REGISTER_UNKNOWN} ${TOKEN_LEFT}` : "secret" in route ? `The run was ended after the register, while its secret was being stored. ${storeUnknownSentence(route.secret, agent)} ${TOKEN_LEFT}` : `The run was ended after the register, before its secret was written. ${agentStandsSentence(agent)} ${TOKEN_LEFT}`;
+    case "stored":
+      return `The run was ended after the agent's secret was kept, before the run's token was revoked. ${TOKEN_LEFT}`;
+  }
+};
+var completing = async (io2, options, mint, tokens, userAgent) => {
+  const { plane, wire } = TZMESH_ESTATE_ORIGINS[options.estate];
+  const route = options.route;
+  const tag = runTagOf();
+  const stage = { now: "unsent", ended: false };
+  let agent = null;
+  const revokedThen = async (minted, status) => {
+    const lines = await revokeRunToken(io2, plane, tokens.mint.token, minted.id, userAgent);
+    if (stage.ended) return COMMAND_STATUS.unknown;
+    if (lines === null) {
+      io2.print(`The run's token, ${minted.id}, is revoked.`);
+      return status;
+    }
+    for (const line of lines) io2.print(line);
+    return Math.max(status, COMMAND_STATUS.failed);
+  };
+  const deletedThen = async (minted, standing) => {
+    const lines = await deleteAgent(io2, wire, minted.value, userAgent, standing);
+    if (stage.ended) return COMMAND_STATUS.unknown;
+    for (const line of lines) io2.print(line);
+    return revokedThen(minted, COMMAND_STATUS.failed);
+  };
+  const carried = {
+    stage,
+    endedLine: (now) => endedLineOf(now, plane, agent, route),
+    // The file's try, by an empty file beside it under the run's tag,
+    // owner-only, before any request (decision 6).
+    prepare: () => {
+      if (!("toFile" in route)) return null;
+      const tried = tryWritingFile(io2, route.toFile, "owner only", tag);
+      return "unwritten" in tried ? toFileUntriedRefusal(tried.unwritten, MINT_UNPRESENTED) : null;
+    },
+    // The store estate's plane check, where the run sends there and it is
+    // not the mint estate's plane, which the act checked first (PLD-L0-110).
+    checks: async () => "secret" in route && options.origin !== plane ? planeWireRefusal(io2, options.origin, "") : null,
+    drop: () => {
+      if ("toFile" in route) dropWritingFile(io2, route.toFile, tag);
+    },
+    refuse: async (minted) => {
+      io2.print(`The exchange minted a token that is not an unmarked tzMesh token of the signed form, so nothing of its value was used or kept. Call ${MINT_TOKEN_ACTION} from your tool again with the members ${TZMESH_ACT_WORDS} prints, and run the line it answers.`);
+      return revokedThen(minted, COMMAND_STATUS.failed);
+    },
+    deliver: async (minted) => {
+      stage.now = "registering";
+      const registered = await register(io2, wire, minted.value, userAgent, options.name);
+      if (stage.ended) return COMMAND_STATUS.unknown;
+      if ("refused" in registered) {
+        for (const line of registered.refused) io2.print(line);
+        return revokedThen(minted, COMMAND_STATUS.failed);
+      }
+      if ("unknown" in registered) {
+        for (const line of registered.unknown) io2.print(line);
+        io2.print(REGISTER_UNKNOWN);
+        return revokedThen(minted, COMMAND_STATUS.unknown);
+      }
+      if ("standing" in registered) {
+        agent = registered.standing;
+        stage.now = "registered";
+        for (const line of registered.lines) io2.print(line);
+        return deletedThen(minted, registered.standing);
+      }
+      agent = registered.agent;
+      const secret2 = registered.secret;
+      stage.now = "registered";
+      io2.print(registeredLineOf(agent, wire));
+      if ("toFile" in route) {
+        const written = writeThenRename(io2, route.toFile, `${secret2}
+`, "owner only", tag);
+        if (stage.ended) return COMMAND_STATUS.unknown;
+        if ("unwritten" in written) {
+          io2.print(`The file ${TZMESH_OPTION.toFile} names could not be written (${written.unwritten}), so the agent's secret was not kept.`);
+          return deletedThen(minted, agent);
+        }
+        stage.now = "stored";
+        io2.print(WRITTEN_LINE);
+        return revokedThen(minted, COMMAND_STATUS.done);
+      }
+      const action = SECRET_ACTION.store;
+      const answered = await postAction(io2, options.origin, action, (tokens.store ?? tokens.mint).token, userAgent, {
+        name: route.secret,
+        value: secret2,
+        ...options.application !== null ? { application: options.application } : {},
+        ...options.environment !== null ? { environment: options.environment } : {}
+      });
+      if (stage.ended) return COMMAND_STATUS.unknown;
+      const unknownStore = async (lines) => {
+        for (const line of lines) io2.print(line);
+        io2.print(storeUnknownSentence(route.secret, agent));
+        return revokedThen(minted, COMMAND_STATUS.unknown);
+      };
+      if (answered === null) return unknownStore([`${action} drew no answer.`]);
+      if (answered.redirected) return unknownStore([`${action} was answered ${answeredHow(answered.status)}, which the command never follows, so the value was sent to no second address.`]);
+      if (answered.status >= PLATFORM_FAILURE_STATUS) return unknownStore(failureLines(action, answered.status, planeRefusalOf(answered.text)));
+      const answer = planeObjectOf(answered.text);
+      if (answered.status < 200 || answered.status > 299) {
+        const refusal = markedRefusalOf(answered.status, answered.text);
+        if (refusal === null) return unknownStore([`${action} was answered HTTP ${answered.status}, not by the platform.`]);
+        for (const line of refusalLines(action, answered.status, refusal)) io2.print(line);
+        return deletedThen(minted, agent);
+      }
+      if (answer === null) return unknownStore([`${action} was answered HTTP ${answered.status}, not by the platform.`]);
+      stage.now = "stored";
+      io2.print(`${SECRET_LINE_HEAD.store}${JSON.stringify(Object.fromEntries(SECRET_SHOWN.filter((member) => member in answer).map((member) => [member, answer[member]])))}`);
+      if (typeof answer.detail === "string") io2.print(oneLine(answer.detail));
+      if ("value" in answer) io2.print("The answer carried a value, which the command never prints.");
+      return revokedThen(minted, COMMAND_STATUS.done);
+    }
+  };
+  return completeAct(io2, plane, "tzmesh", { mint }, userAgent, io2.print, void 0, null, carried);
+};
+async function tzmeshRegister(call, io2) {
+  const options = tzmeshOptionsOf(call, io2);
+  if ("refusal" in options) {
+    io2.print(options.refusal);
+    return COMMAND_STATUS.nothing_started;
+  }
+  const closing = options.mint !== null ? MINT_UNPRESENTED : NOTHING_SENT;
+  const agent = userAgentOf(io2.env);
+  if ("refusal" in agent) {
+    io2.print(`${agent.refusal} ${options.mint !== null ? MINT_UNPRESENTED : ""}`.trimEnd());
+    return COMMAND_STATUS.nothing_started;
+  }
+  if ((io2.env[MINTED_TOKEN_VARIABLE] ?? "").trim() !== "") {
+    io2.print(tzmeshMintedTokenRefusal(closing));
+    return COMMAND_STATUS.nothing_started;
+  }
+  const { plane } = TZMESH_ESTATE_ORIGINS[options.estate];
+  const tokens = readComputerTokens(io2, plane, "secret" in options.route ? options.origin : null, closing);
+  if ("status" in tokens) return tokens.status;
+  io2.hide(tokens.mint.token, REDACTED_TOKEN);
+  if (tokens.store !== null) io2.hide(tokens.store.token, REDACTED_TOKEN);
+  if ("toFile" in options.route) {
+    const refused = toFileRefusalOf(io2, options.route.toFile, options.force, closing);
+    if (refused !== null) {
+      io2.print(refused);
+      return COMMAND_STATUS.nothing_started;
+    }
+  }
+  if (options.mint !== null) return completing(io2, options, options.mint, tokens, agent.userAgent);
+  if ("toFile" in options.route) {
+    const path = options.route.toFile;
+    const tag = runTagOf();
+    const release = io2.whenEnded(() => dropWritingFile(io2, path, tag));
+    try {
+      const tried = tryWritingFile(io2, path, "owner only", tag);
+      if ("unwritten" in tried) {
+        io2.print(toFileUntriedRefusal(tried.unwritten, closing));
+        return COMMAND_STATUS.nothing_started;
+      }
+    } finally {
+      dropWritingFile(io2, path, tag);
+      release();
+    }
+  }
+  return firstAct(io2, plane, "tzmesh", io2.print, null, completingOptionsOf(options));
+}
+var TZMESH_READS = `this computer's token for each address it sends to, and the verifier its first act keeps, from its credential file. It never reads a minted token from ${MINTED_TOKEN_VARIABLE}, and refuses the run where that variable is set`;
+var TZMESH_AFTER_OWN_ERROR = "whether the run's token was minted, the agent registered, or its secret kept is unknown. list_tokens from your tool shows the token by its label, turnzero command, and revoke_token ends it. tzmesh_participants shows the agent, and end with delete true deletes it";
+var TZMESH_FIRST_ACT_AFTER_OWN_ERROR = "a request may now be pending in this computer's credential file, and nothing was sent";
+var TZMESH_ROW = Object.freeze({
+  name: TZMESH_SUBCOMMAND,
+  acts: Object.freeze([TZMESH_REGISTER_ACT]),
+  summary: `Registers a tzMesh standing agent, and keeps its program secret where a program reads it, never printing it. It keeps the secret in your account's secret store by name, or in a file. It runs in two acts around one ${MINT_TOKEN_ACTION} call your tool makes.`,
+  example: `${TZMESH_ACT_WORDS} ${TZMESH_OPTION.name} <name> ${TZMESH_OPTION.secret} <secret name> ${TZMESH_OPTION.application} <application id> ${TZMESH_OPTION.environment} production`,
+  options: TZMESH_OPTIONS,
+  credential: null,
+  reads: TZMESH_READS,
+  statuses: {
+    done: "the challenge printed, or the agent registered, its secret kept, and the run's token revoked",
+    failed: "a part failed: the agent was not registered, its secret was not kept, or the run's token was not revoked. The printed lines name what stands and the call that ends it",
+    unknown: "an outcome is unknown: the printed lines name list_tokens, tzmesh_participants, or list_secrets",
+    nothing_started: `nothing was minted. An option, the credential file, the file ${TZMESH_OPTION.toFile} names, or this computer's token was refused. Or no request was pending, the platform was too old, or the exchange was refused`
+  },
+  variables: [[ORIGIN_VARIABLE, `the platform's address the secret is stored at where the line names no ${TZMESH_OPTION.origin}. It must be ${DEFAULT_COMMAND_ORIGIN} or ${DEVELOPMENT_COMMAND_ORIGIN}.`]],
+  note: [
+    `Registering an agent takes two acts around one ${MINT_TOKEN_ACTION} call, which your signed-in tool makes itself. ${TZMESH_ACT_WORDS} run without ${TZMESH_OPTION.mint} prints a challenge, the call to make, and the options its completing line takes. Your tool makes that call, and runs the line it answers once, on this computer, with those options after it. That line holds no code.`,
+    `The completing line presents this computer's verifier and receives a tzMesh token minted for this run alone. It registers the agent with that token, keeps the agent's secret, and revokes the token. Where the secret could not be kept, it deletes the agent.`,
+    `With ${TZMESH_OPTION.secret}, the secret goes from the register's answer to your account's secret store, and never reaches your tool. With ${TZMESH_OPTION.toFile}, it goes into that file, which anything that runs as you can read, your tool among them. Keep that file outside any application's folder.`,
+    `The run reads this computer's token for each address it sends to: the ${TZMESH_OPTION.tzmeshEstate} platform's, to revoke the run's token, and under ${TZMESH_OPTION.secret} the ${TZMESH_OPTION.origin} platform's, to store the secret. Authorize this computer at each first.`
+  ],
+  afterOwnError: (call) => call.named[TZMESH_OPTION.mint] !== void 0 ? TZMESH_AFTER_OWN_ERROR : TZMESH_FIRST_ACT_AFTER_OWN_ERROR,
+  listed: TZMESH_LISTED,
+  run: tzmeshRegister
+});
+
 // src/turnzero_cloud_command/process_io.ts
 import { spawn } from "node:child_process";
 import { chmodSync, closeSync, openSync, readFileSync as readFileSync5, realpathSync as realpathSync2, writeFileSync, writeSync } from "node:fs";
@@ -9632,7 +10188,7 @@ import { createServer } from "node:http";
 import { constants as constants2 } from "node:os";
 import { sep as sep5 } from "node:path";
 import { ReadStream, isatty } from "node:tty";
-var listenLoopback = (answer) => new Promise((resolve13) => {
+var listenLoopback = (answer) => new Promise((resolve14) => {
   const server = createServer((request, response) => {
     const url = new URL(request.url ?? "/", "http://127.0.0.1");
     const query = {};
@@ -9649,16 +10205,16 @@ var listenLoopback = (answer) => new Promise((resolve13) => {
       }
     );
   });
-  server.once("error", () => resolve13(null));
+  server.once("error", () => resolve14(null));
   server.listen(0, "127.0.0.1", () => {
     const address = server.address();
     if (address === null || typeof address === "string") {
       server.close();
-      resolve13(null);
+      resolve14(null);
       return;
     }
     let closed = false;
-    resolve13({
+    resolve14({
       port: address.port,
       close: () => {
         if (closed) return;
@@ -9751,7 +10307,7 @@ var holdSignals = (signals, inputIsTerminal, passesOn, passOn, onInterrupt) => {
     for (const [signal, handler] of held) signals.off(signal, handler);
   };
 };
-var childRunnerOf = (signals, inputIsTerminal, passesOn = SIGNALS_PASS_ON, groups = CHILD_GROUPS) => (run) => new Promise((resolve13) => {
+var childRunnerOf = (signals, inputIsTerminal, passesOn = SIGNALS_PASS_ON, groups = CHILD_GROUPS) => (run) => new Promise((resolve14) => {
   const output = run.output;
   let interrupted = false;
   const group = run.foreground === true && passesOn && groups;
@@ -9768,8 +10324,8 @@ var childRunnerOf = (signals, inputIsTerminal, passesOn = SIGNALS_PASS_ON, group
       child.stdout?.setEncoding("utf8").on("data", (chunk) => output(chunk, "stdout"));
       child.stderr?.setEncoding("utf8").on("data", (chunk) => output(chunk, "stderr"));
     }
-    child.once("error", (error) => resolve13({ status: null, signal: null, error: startErrorOf(error) }));
-    child.once("close", (status, signal) => resolve13({ status, signal, error: null, ...interrupted ? { interrupted: true } : {} }));
+    child.once("error", (error) => resolve14({ status: null, signal: null, error: startErrorOf(error) }));
+    child.once("close", (status, signal) => resolve14({ status, signal, error: null, ...interrupted ? { interrupted: true } : {} }));
     if (run.foreground) {
       const release = holdSignals(
         signals,
@@ -9794,7 +10350,7 @@ var childRunnerOf = (signals, inputIsTerminal, passesOn = SIGNALS_PASS_ON, group
       child.once("close", release);
     }
   } catch (error) {
-    resolve13({ status: null, signal: null, error: startErrorOf(error) });
+    resolve14({ status: null, signal: null, error: startErrorOf(error) });
   }
 });
 var runChild = childRunnerOf(process, () => isatty(0));
@@ -9839,7 +10395,7 @@ var processIo = () => ({
   // hold a subcommand lets go after a pause has seen it (scaffold.ts;
   // PLD-L0-103). A bare timer of no length ends before the loop polls, and
   // the signal would be dropped with the hold.
-  sleep: (ms) => new Promise((resolve13) => setTimeout(() => setImmediate(resolve13), ms)),
+  sleep: (ms) => new Promise((resolve14) => setTimeout(() => setImmediate(resolve14), ms)),
   schedule: (ms, fire) => {
     const timer = setTimeout(fire, ms);
     return () => clearTimeout(timer);
@@ -9865,17 +10421,19 @@ var processIo = () => ({
   },
   errorIsTerminal: process.stderr.isTTY === true,
   outputIsTerminal: process.stdout.isTTY === true,
-  // The one value line (PLD-L0-94): a minted token's value alone, whole, on
-  // standard output; any other text is written as print writes it.
+  // The one value line (PLD-L0-94; PLD-L0-104): a value of a form `token
+  // claim` prints, the minted token's or a product's signed form since
+  // #7168, alone and whole on standard output; any other text is written as
+  // print writes it.
   printValue: (value) => {
-    process.stdout.write(`${MINTED_TOKEN_FORM.test(value) ? value : redactCredentials(value)}
+    process.stdout.write(`${isClaimableToken(value) ? value : redactCredentials(value)}
 `);
   }
 });
-var writeWhole = (fd2, chunk) => new Promise((resolve13, reject) => {
+var writeWhole = (fd2, chunk) => new Promise((resolve14, reject) => {
   const from = (offset) => {
     if (offset >= chunk.length) {
-      resolve13();
+      resolve14();
       return;
     }
     writeAt(fd2, chunk, offset, chunk.length - offset, null, (error, written) => error ? reject(error) : from(offset + written));
@@ -9956,10 +10514,12 @@ var SUBCOMMANDS = Object.freeze([
   TOKEN_ROW,
   LOGIN_ROW,
   WHOAMI_ROW,
-  SESSION_ROW
+  SESSION_ROW,
+  TZMESH_ROW
 ]);
+var listedSubcommands = () => SUBCOMMANDS.filter((subcommand) => subcommand.listed !== false);
 var SERVED = LINE_RUNNER;
-var NPX_FORM_SENTENCE = `Where the command is not installed, install it with ${installLineOf(DEFAULT_COMMAND_ORIGIN)}. A person or a job may instead run the same line through npx: write ${commandRunnerOf("latest")} for ${LINE_RUNNER}. A tool where the command is not installed uses deploy_files within its caps, or the deploy skill's setup steps, never the npx line.`;
+var NPX_FORM_SENTENCE = `Where the command is not installed, install it with ${installLineOf(DEFAULT_COMMAND_ORIGIN)}. A person or a job may instead run the same line through npx: write ${commandRunnerOf("latest")} for ${LINE_RUNNER}. A tool where the command is not installed deploys through deploy_files within its caps and the upload route past them. For any other line it takes the deploy skill's setup steps, never the npx line.`;
 var namedWithActs = (subcommand) => subcommand.acts ? `${subcommand.name} ${subcommand.acts.join("|")}` : subcommand.name;
 var shown = (option) => option.flag ? option.name : `${option.name} ${option.value}`;
 var listed = (names) => names.length < 3 ? names.join(" and ") : `${names.slice(0, -1).join(", ")}, and ${names[names.length - 1]}`;
@@ -9983,9 +10543,9 @@ var usageLineOf = (subcommand) => {
   return `${pipedHead(subcommand)}${SERVED} ${[namedWithActs(subcommand), ...required, ...optional].join(" ")}`;
 };
 var usageHeadOf = (version) => `${TURNZERO_CLOUD_PACKAGE} ${version}: the Turn Zero Cloud command, installed from the public npm registry by your platform's tag, latest on production and next on development.`;
-var unreadNames = () => SUBCOMMANDS.filter((subcommand) => subcommand.credential === null && subcommand.reads === void 0).map((subcommand) => subcommand.name);
-var unattendedNames = () => SUBCOMMANDS.filter((subcommand) => subcommand.credential?.mintedToken === true).map((subcommand) => subcommand.name);
-var computerOnlyNames = () => SUBCOMMANDS.filter((subcommand) => subcommand.credential?.computerToken === true).map((subcommand) => subcommand.name);
+var unreadNames = () => listedSubcommands().filter((subcommand) => subcommand.credential === null && subcommand.reads === void 0).map((subcommand) => subcommand.name);
+var unattendedNames = () => listedSubcommands().filter((subcommand) => subcommand.credential?.mintedToken === true).map((subcommand) => subcommand.name);
+var computerOnlyNames = () => listedSubcommands().filter((subcommand) => subcommand.credential?.computerToken === true).map((subcommand) => subcommand.name);
 var exampleLineOf = (subcommand) => {
   const credential = subcommand.credential;
   const mustPipe = credential !== null && credential.piped !== false && credential.bare === void 0 && credential.computerToken !== true;
@@ -10025,7 +10585,7 @@ var statusClauseOf = (name, clause) => `Under ${name}, ${clause}`;
 var noteLinesOf2 = (subcommand) => (subcommand.note ?? []).flatMap((paragraph) => ["", paragraph]);
 var usageBlockOf = (subcommandHelp) => [
   "Usage:",
-  ...SUBCOMMANDS.map((subcommand) => `  ${usageLineOf(subcommand)}`),
+  ...listedSubcommands().map((subcommand) => `  ${usageLineOf(subcommand)}`),
   `  ${SERVED} --version`,
   `  ${SERVED} --help`,
   ...subcommandHelp ? [`  ${SERVED} <subcommand> --help`] : []
@@ -10044,7 +10604,7 @@ var shortUsageText = (version = commandVersion()) => [
   ...STATUS_MEANINGS.map(([status, meaning, also]) => statusLineOf(status, meaning, [], also)),
   "",
   "Subcommands:",
-  ...SUBCOMMANDS.map((subcommand) => `  ${namedWithActs(subcommand)}: ${subcommand.summary}`),
+  ...listedSubcommands().map((subcommand) => `  ${namedWithActs(subcommand)}: ${subcommand.summary}`),
   "",
   SUBCOMMAND_HELP_SENTENCE
 ].join("\n");
@@ -10086,7 +10646,7 @@ var valuePlacesOf = (argv2) => {
   }
   return places;
 };
-var noSubcommandSentence = (first) => `${first === void 0 ? "No subcommand was named" : `The first argument is not a subcommand of ${TURNZERO_CLOUD_PACKAGE}`}: the subcommands are ${SUBCOMMANDS.map((entry) => entry.name).join(", ")}. ${NOTHING_STARTED2}`;
+var noSubcommandSentence = (first) => `${first === void 0 ? "No subcommand was named" : `The first argument is not a subcommand of ${TURNZERO_CLOUD_PACKAGE}`}: the subcommands are ${listedSubcommands().map((entry) => entry.name).join(", ")}. ${NOTHING_STARTED2}`;
 var parseArguments = (argv2, onWindows2 = ON_WINDOWS) => {
   if (argv2.some((argument) => argument.includes(UPLOAD_GRANT_PREFIX))) return { kind: "refused", sentence: grantArgumentSentence() };
   if (argv2.some((argument) => argument.includes(MINTED_TOKEN_PREFIX))) return { kind: "refused", sentence: tokenArgumentSentence() };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "turnzero",
-  "version": "0.30.1",
+  "version": "0.31.1-next.1",
   "type": "module",
   "description": "Deploy and run AI-built apps with Turn Zero Cloud hosting and backend services.",
   "license": "Apache-2.0",