turnzero 0.36.0 → 0.37.0-next.1

package/dist/turnzero-cloud.mjs

@@ -37,7 +37,7 @@ var shownHealthPathOf = (path) => {
   }
   return JSON.stringify("\u2026");
 };
-var healthPathUnservedDetail = (path) => `No source text in the zip names the health path ${shownHealthPathOf(path)}. Serve it from your code, or set the manifest's health to a served path and call submit_manifest.`;
+var healthPathUnservedDetail = (path) => `No source text in the zip names the health path ${shownHealthPathOf(path)}. Serve it from your code, or set the manifest's health to a served path and call tzcloud_submit_manifest.`;
 var deployAreaName = (application) => `${DEPLOY_AREA_PREFIX}${application}`;
 var UPLOAD_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 var uploadFileName = (id) => `${id}.zip`;
@@ -46,6 +46,36 @@ var COMMAND_ENVIRONMENTS = Object.freeze(["development", "production"]);
 var DEPLOY_ACTION_PATH = "/api/v1/actions/deploy";
 var ACTIONS_ROUTE_PREFIX = "/api/v1/actions/";
 var actionPathOf = (action) => `${ACTIONS_ROUTE_PREFIX}${action}`;
+var COMMAND_ACTION_SURFACE = Object.freeze({
+  add_test_end_users: "tzcloud",
+  check_deploy: "tzcloud",
+  create_application: "tzcloud",
+  create_environment: "tzcloud",
+  deploy: "tzcloud",
+  deploy_files: "tzcloud",
+  list_secrets: "tzcloud",
+  mint_upload_grant: "tzcloud",
+  promote: "tzcloud",
+  read_export: "tzcloud",
+  read_library: "tzcloud",
+  read_logs: "tzcloud",
+  read_schedules: "tzcloud",
+  read_status: "tzcloud",
+  request_export: "tzcloud",
+  restart_application: "tzcloud",
+  run_schedule: "tzcloud",
+  sign_in_test_end_user: "tzcloud",
+  store_secret: "tzcloud",
+  submit_manifest: "tzcloud",
+  list_tokens: "account",
+  mint_token: "account",
+  read_account: "account",
+  read_documentation: "account",
+  revoke_token: "account",
+  set_plan_quota: "account",
+  start: "account"
+});
+var toolNameOf = (action) => COMMAND_ACTION_SURFACE[action] === "account" ? action : `${COMMAND_ACTION_SURFACE[action]}_${action}`;
 var progressPathOf = (upload) => `${DEPLOY_PROGRESS_PREFIX}${upload}/progress`;
 var PROGRESS_PAUSE_SECONDS = 2;
 var PROGRESS_READ_BOUND_SECONDS = 60;
@@ -54,7 +84,7 @@ var DEPLOY_NO_WAIT_VARIABLE = "TURNZERO_DEPLOY_NO_WAIT";
 var PROGRESS_EXIT_STATUS = Object.freeze({ deployed: 0, failed: 1, refused: 2, nothing_started: 3 });
 var PROGRESS_SETTLED_DEPLOYED = "settled: deployed version ";
 var PROGRESS_SETTLED_FAILED = "settled: failed";
-var commandStopSentence = (application, environment = UPLOAD_ENVIRONMENT) => `The command stopped waiting, and the deploy may go on: call read_status from your tool with application ${application} and environment ${environment}, giving it wait_seconds so the call waits for the deploy to settle.`;
+var commandStopSentence = (application, environment = UPLOAD_ENVIRONMENT) => `The command stopped waiting, and the deploy may go on: call tzcloud_read_status from your tool with application ${application} and environment ${environment}, giving it wait_seconds so the call waits for the deploy to settle.`;
 var startBodyOf = (application, upload, environment = UPLOAD_ENVIRONMENT) => ({
   application,
   environment,
@@ -62,18 +92,21 @@ var startBodyOf = (application, upload, environment = UPLOAD_ENVIRONMENT) => ({
 });
 var TURNZERO_CLOUD_PACKAGE = "turnzero";
 var LOGIN_SUBCOMMAND = "login";
-var LOGIN_OPTION = Object.freeze({ origin: "--origin", noBrowser: "--no-browser" });
+var LOGIN_OPTION = Object.freeze({ origin: "--origin", noBrowser: "--no-browser", device: "--device" });
 var loginLineOf = (origin) => commandLineOf(origin, LOGIN_SUBCOMMAND, origin !== DEFAULT_COMMAND_ORIGIN ? { origin } : {});
 var HAND_OVER_SENTENCE = "If your tool's own safety check refuses a command, first take any route named above that your tool can still use, telling the person which and why. Only if none works, give the person that exact command to run once in their own terminal, never a rewritten one.";
 var COMPUTER_LOGIN_PATH = "/approve/computer";
 var COMPUTER_LOGIN_QUERY = Object.freeze({ challenge: "challenge", state: "state", port: "port", label: "label" });
+var COMPUTER_LOGIN_MODE_MEMBER = "mode";
+var COMPUTER_LOGIN_DEVICE_MODE = "device";
 var LOGIN_STATE_FORM = /^[A-Za-z0-9_-]{43}$/;
 var computerLoginAddressOf = (origin, login2) => {
   const query = new URLSearchParams();
   query.set(COMPUTER_LOGIN_QUERY.challenge, login2.challenge);
   query.set(COMPUTER_LOGIN_QUERY.state, login2.state);
-  if (login2.port !== null) query.set(COMPUTER_LOGIN_QUERY.port, String(login2.port));
+  if (login2.port !== null && login2.device !== true) query.set(COMPUTER_LOGIN_QUERY.port, String(login2.port));
   query.set(COMPUTER_LOGIN_QUERY.label, login2.label);
+  if (login2.device === true) query.set(COMPUTER_LOGIN_MODE_MEMBER, COMPUTER_LOGIN_DEVICE_MODE);
   return `${origin}${COMPUTER_LOGIN_PATH}?${query.toString()}`;
 };
 var DEPLOY_SUBCOMMAND = "deploy";
@@ -154,7 +187,12 @@ var MINTED_TOKEN_PREFIX = TOKEN_PREFIX;
 var MINTED_TOKEN_FORM = new RegExp(`^${MINTED_TOKEN_PREFIX}[A-Za-z0-9_-]{43}$`);
 var SECRET_SUBCOMMAND = "secret";
 var SECRET_ACTS = Object.freeze(["store", "rotate"]);
-var SECRET_ACTION = Object.freeze({ store: "store_secret", rotate: "rotate_secret" });
+var SECRET_ACTION = Object.freeze({ store: "store_secret", rotate: "store_secret" });
+var SECRET_REPLACE_MEMBER = Object.freeze({ replace: true });
+var SECRET_CALL = Object.freeze({
+  store: toolNameOf("store_secret"),
+  rotate: `${toolNameOf("store_secret")} with replace: true`
+});
 var SECRET_OPTION = Object.freeze({
   name: "--name",
   application: "--application",
@@ -178,12 +216,13 @@ var EXPORT_MANIFEST_FILE = "manifest.json";
 var exportFileName = (exportId, path) => `${exportId}/${path}`;
 var EXPORT_SUBCOMMAND = "export";
 var EXPORT_ACTS = Object.freeze(["download"]);
-var DOWNLOAD_GRANT_ACTION = "mint_download_grant";
+var DOWNLOAD_GRANT_ACTION = "request_export";
+var DOWNLOAD_GRANT_CALL = `the ${toolNameOf(DOWNLOAD_GRANT_ACTION)} call with download: true`;
 var EXPORT_OPTION = Object.freeze({ export: "--export", path: DEPLOY_OPTION.path, origin: DEPLOY_OPTION.origin });
 var LIBRARY_SUBCOMMAND = "library";
 var LIBRARY_ACTS = Object.freeze(["take"]);
 var LIBRARY_OPTION = Object.freeze({ entry: "--entry", path: DEPLOY_OPTION.path, origin: DEPLOY_OPTION.origin });
-var LIBRARY_READ_ACTION = "read_library_entry";
+var LIBRARY_READ_ACTION = "read_library";
 var LIBRARY_READ_PATH = actionPathOf(LIBRARY_READ_ACTION);
 var LIBRARY_READ_CHUNK = 16e3;
 var LIBRARY_ENTRY_NAME_FORM = /^[a-z0-9][a-z0-9_-]*(\/[a-z0-9][a-z0-9_-]*)?$/;
@@ -287,6 +326,10 @@ var COMPLETION_MINT = "mint";
 var MINT_MEMBER = "mint";
 var MINT_OPTION = "--mint";
 var MINT_ID_FORM = UPLOAD_ID;
+var MINT_DEVICE = "device";
+var DEVICE_POLL_PENDING = "authorization_pending";
+var DEVICE_POLL_SECONDS = 5;
+var DEVICE_ROW_SECONDS = 3600;
 var TZMESH_SUBCOMMAND = "tzmesh";
 var TZMESH_REGISTER_ACT = "register";
 var TZMESH_OPTION = {
@@ -483,9 +526,9 @@ function compareWireVersions(a, b) {
 
 // src/turnzero_cloud_command/plane_wire.ts
 var PLANE_WIRE_NEEDED = Object.freeze({
-  action_payloads: "2026-10-24.10",
-  management_api: "2026-10-10.5",
-  wire_errors: "2026-10-10.6"
+  action_payloads: "2026-11-04.8",
+  management_api: "2026-11-04.7",
+  wire_errors: "2026-11-04.2"
 });
 
 // src/turnzero_cloud_command/version.ts
@@ -919,6 +962,7 @@ var loginLineFor = (io2, origin) => {
   return onWindows(io2) ? windowsLineOf(line) : line;
 };
 var authorizeLineFor = (io2, origin) => printedLineOf(io2, commandLineOf(origin, AUTHORIZE_SUBCOMMAND, origin !== DEFAULT_COMMAND_ORIGIN ? { origin } : {}), origin);
+var deviceLoginLineFor = (io2, origin) => printedLineOf(io2, commandLineOf(origin, LOGIN_SUBCOMMAND, { ...origin !== DEFAULT_COMMAND_ORIGIN ? { origin } : {}, flags: [LOGIN_OPTION.device] }), origin);
 var loginLinesFor = (io2, origin) => [
   ...ranThroughNpx(io2) ? [installLineOf(origin)] : [],
   loginLineFor(io2, origin)
@@ -1020,10 +1064,12 @@ var noTokenSentence = (origin, expiredAt) => expiredAt === null ? `No credential
 var VARIABLE_ROUTE_SENTENCES = `A tool connected by a minted token, or a job, sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, never by writing the value in a command. It sets ${ORIGIN_VARIABLE} to the address that minted the token if that is not ${DEFAULT_COMMAND_ORIGIN}, then runs the command again. Such a tool cannot use ${MINT_TOKEN_ACTION}, which works only under a sign-in. A tool sets ${MINTED_TOKEN_VARIABLE} for one command at a time and unsets it once that command ends.`;
 var authorizeRouteSentence = (origin) => `${AUTHORIZE_SUBCOMMAND}${originWordsOf(origin)} run with nothing piped prints the ${MINT_TOKEN_ACTION} call a signed-in tool makes to authorize this computer.`;
 var LOGIN_ROUTE_OPENER = "A person logs this computer in once, in a terminal of their own, and its token then stays on this computer for 30 days:";
-var DEPLOY_ROUTES_SENTENCE = "For regular use, prefer this command wherever your tool can install and run it and reach the platform. A first simple test within the caps of your tool's deploy_files call may deploy through deploy_files, as may any folder within them where this command cannot work. Past the caps, where your tool may not install or run this command, upload a zip with mint_upload_grant, then name it as deploy's artifact.";
+var DEPLOY_ROUTES_SENTENCE = "For regular use, prefer this command wherever your tool can install and run it and reach the platform. A first simple test within the caps of your tool's tzcloud_deploy_files call may deploy through tzcloud_deploy_files, as may any folder within them where this command cannot work. Past the caps, where your tool may not install or run this command, upload a zip with tzcloud_mint_upload_grant, then name it as tzcloud_deploy's artifact.";
+var deviceRouteSentence = (deviceLine) => `An AI tool that cannot authorize this computer through a signed-in Turn Zero connection, with no terminal for a person, runs ${deviceLine} and sends the person its link.`;
 var loginRouteLines = (io2, origin, deployFiles = true) => [
   LOGIN_ROUTE_OPENER,
   ...loginLinesFor(io2, origin),
+  deviceRouteSentence(deviceLoginLineFor(io2, origin)),
   ...deployFiles ? [DEPLOY_ROUTES_SENTENCE] : [],
   HAND_OVER_SENTENCE
 ];
@@ -1114,9 +1160,9 @@ var computerLabelOf = (host) => {
   return label === "" ? LABEL_FALLBACK : label;
 };
 var newVerifier = () => randomBytes2(32).toString("base64url");
-var newPendingEntry = (now) => {
+var newPendingEntry = (now, lifeMs = PENDING_REQUEST_MS) => {
   const verifier = newVerifier();
-  return { verifier, challenge: codeChallengeOf(verifier), expires_at: new Date(now.getTime() + PENDING_REQUEST_MS).toISOString() };
+  return { verifier, challenge: codeChallengeOf(verifier), expires_at: new Date(now.getTime() + lifeMs).toISOString() };
 };
 var hideStandingTokens = (io2, state) => {
   for (const entry of state.origins.values()) io2.hide(entry.token, REDACTED_TOKEN);
@@ -1137,7 +1183,7 @@ var firstActNamed = (kind, origin = DEFAULT_COMMAND_ORIGIN) => kind === "tzmesh"
 ) : `${kind === "authorized computer" ? AUTHORIZE_SUBCOMMAND : `${TOKEN_SUBCOMMAND} ${TOKEN_REQUEST_ACT}`}${originWordsOf(origin)}`;
 var noConnectionLine = (origin) => `Where your tool holds no connection signed in to ${origin}, ${MINT_TOKEN_ACTION} is not among its tools: a person connects the tool and signs in, in a browser, before the call.`;
 var loginWaySentence = (loginLines) => `A person can instead log this computer in themselves, in a terminal of their own, by running ${loginLines.join(", then ")}, and approving the login in the browser.`;
-var AUTHORIZE_HAND_OVER_SENTENCE = "If your tool's own safety check refuses the answered line, a deploy can still go through a route that does not require the turnzero command. That is deploy_files within its caps or, past them where your tool can zip and upload the folder, mint_upload_grant followed by deploy naming the uploaded zip as artifact. Tell the person which route you take and why. Only where no such route serves, give the person that exact line to run once in their own terminal, never a rewritten one.";
+var AUTHORIZE_HAND_OVER_SENTENCE = "If your tool's own safety check refuses the answered line, a deploy can still go through a route that does not require the turnzero command. That is tzcloud_deploy_files within its caps or, past them where your tool can zip and upload the folder, tzcloud_mint_upload_grant followed by tzcloud_deploy naming the uploaded zip as artifact. Tell the person which route you take and why. Only where no such route serves, give the person that exact line to run once in their own terminal, never a rewritten one.";
 var TZMESH_HAND_OVER_SENTENCE = "If your tool's own safety check refuses the answered line, give the person that exact line to run once in their own terminal, never a rewritten one.";
 var OPTIONS_LINE_HEAD = "options: ";
 var tzmeshFirstActLines = (origin, pending, completing2) => [
@@ -1165,6 +1211,7 @@ var firstActLines = (origin, kind, pending, label, loginLines = [], completing2
 ];
 var reusedRequestSentence = (origin, pending) => `A request for ${origin} is pending until ${pending.expires_at}, so its challenge is printed again and no new verifier was made.`;
 var replacedRequestSentence = (origin, expired2) => `The request pending for ${origin} expired at ${expired2.expires_at}, so a new one replaces it. A line minted against the old challenge is refused at its exchange, and a ${MINT_TOKEN_ACTION} call naming the new challenge below answers a fresh one.`;
+var unchangedRequestSentence = (origin, expiresAt) => `Nothing was sent, and the request pending for ${origin} stands unchanged until ${expiresAt}.`;
 async function firstAct(io2, origin, kind, say, opener = null, completing2 = "") {
   const kept2 = keepPendingRequest(io2, origin, say);
   if ("status" in kept2) return kept2.status;
@@ -1183,7 +1230,7 @@ async function firstAct(io2, origin, kind, say, opener = null, completing2 = "")
   }
   return COMMAND_STATUS.done;
 }
-function keepPendingRequest(io2, origin, say) {
+function keepPendingRequest(io2, origin, say, lifeMs) {
   const place = credentialFileOf(io2);
   const read2 = readMovingCredentialFile(io2, place, say);
   if (!("state" in read2)) {
@@ -1193,36 +1240,43 @@ function keepPendingRequest(io2, origin, say) {
   hideStandingTokens(io2, read2.state);
   const now = io2.clock();
   const standing = read2.state.pending.get(origin);
-  let pending;
-  let opening;
-  if (standing !== void 0 && pendingLives(standing, now)) {
-    pending = standing;
-    io2.hide(pending.verifier, REDACTED_VERIFIER);
-    opening = reusedRequestSentence(origin, pending);
-  } else {
-    pending = newPendingEntry(now);
-    io2.hide(pending.verifier, REDACTED_VERIFIER);
+  const write = (entry, unchanged = null) => {
     const tag = runTagOf();
+    const after = unchanged === null ? "Nothing was sent, and no request is pending." : unchangedRequestSentence(origin, unchanged);
     const release = io2.whenEnded(() => dropCredentialWriting(io2, place, tag));
     try {
       const prepared = prepareCredentialFile(io2, place, tag);
       if ("unwritten" in prepared) {
-        say(`${unwritableFileSentence(place.path, prepared.unwritten)} Nothing was sent, and no request is pending.`);
-        return { status: COMMAND_STATUS.nothing_started };
+        say(`${unwritableFileSentence(place.path, prepared.unwritten)} ${after}`);
+        return COMMAND_STATUS.nothing_started;
       }
-      const written = updateCredentialFile(io2, place, tag, withPending(origin, pending));
+      const written = updateCredentialFile(io2, place, tag, withPending(origin, entry));
       if (!("written" in written)) {
-        say("unwritten" in written ? `${unwritableFileSentence(place.path, written.unwritten)} Nothing was sent, and no request is pending.` : readRefusalOf(written, place.path));
-        return { status: COMMAND_STATUS.nothing_started };
+        say("unwritten" in written ? `${unwritableFileSentence(place.path, written.unwritten)} ${after}` : readRefusalOf(written, place.path));
+        return COMMAND_STATUS.nothing_started;
       }
+      return null;
     } finally {
       release();
       dropCredentialWriting(io2, place, tag);
     }
-    opening = standing !== void 0 ? replacedRequestSentence(origin, standing) : "";
-    return { pending, opening, standing: standing !== void 0 ? { kind: "replaced", expired: standing } : { kind: "new" } };
+  };
+  if (standing !== void 0 && pendingLives(standing, now)) {
+    io2.hide(standing.verifier, REDACTED_VERIFIER);
+    let pending2 = standing;
+    if (lifeMs !== void 0) {
+      pending2 = { ...standing, expires_at: new Date(now.getTime() + lifeMs).toISOString() };
+      const refused2 = write(pending2, standing.expires_at);
+      if (refused2 !== null) return { status: refused2 };
+    }
+    return { pending: pending2, opening: reusedRequestSentence(origin, pending2), standing: { kind: "reused" } };
   }
-  return { pending, opening, standing: { kind: "reused" } };
+  const pending = newPendingEntry(now, lifeMs);
+  io2.hide(pending.verifier, REDACTED_VERIFIER);
+  const refused = write(pending);
+  if (refused !== null) return { status: refused };
+  const opening = standing !== void 0 ? replacedRequestSentence(origin, standing) : "";
+  return { pending, opening, standing: standing !== void 0 ? { kind: "replaced", expired: standing } : { kind: "new" } };
 }
 var TOKEN_CALL_BOUND_SECONDS = 60;
 var EXCHANGE_ACT = "exchange";
@@ -1240,13 +1294,22 @@ var postAction = async (io2, origin, action, bearer, userAgent, body) => {
       redirect: "manual",
       signal: controller.signal
     });
-    return { status: response.status, redirected: redirected(response), text: await response.text() };
+    return { status: response.status, redirected: redirected(response), text: await response.text(), retryAfter: response.headers.get("retry-after") };
   } catch {
     return null;
   } finally {
     cancel();
   }
 };
+var WHOLE_SECONDS = /^[0-9]{1,9}$/;
+var devicePollWaitMsOf = (answered) => {
+  if (answered === null || answered.redirected) return null;
+  if (answered.status === 429) {
+    const named = (answered.retryAfter ?? "").trim();
+    return (WHOLE_SECONDS.test(named) ? Number(named) : DEVICE_POLL_SECONDS) * 1e3;
+  }
+  return answered.status === 400 && markedRefusalOf(answered.status, answered.text)?.error === DEVICE_POLL_PENDING ? DEVICE_POLL_SECONDS * 1e3 : null;
+};
 var NO_LONGER_SERVES = Object.freeze([401, 404]);
 var revokedRowOf = (answer, id) => {
   const row = answer?.token;
@@ -1328,7 +1391,8 @@ var whoamiLineFor = (io2, origin) => printedLineOf(io2, commandLineOf(origin, WH
 var accountUnreadSentence = (whoami2) => `The account this computer's token acts as was not read, and the token is kept: run ${whoami2} to read it.`;
 var CLAIMED_LINE_HEAD = "claimed: ";
 async function completeAct(io2, origin, kind, presentation, userAgent, say, deliver = () => void 0, login2 = null, carried = null) {
-  const held = "mint" in presentation;
+  const held = !("code" in presentation);
+  const device = "device" in presentation ? presentation.device : null;
   const unread = held ? MINT_UNPRESENTED : TOKEN_CODE_UNREAD;
   const place = credentialFileOf(io2);
   const read2 = readMovingCredentialFile(io2, place, say);
@@ -1348,10 +1412,11 @@ async function completeAct(io2, origin, kind, presentation, userAgent, say, deli
   io2.hide(pending.challenge, REDACTED_CHALLENGE);
   const tag = runTagOf();
   const stage = carried?.stage ?? { now: "unsent", ended: false };
+  let waiting = false;
   const release = io2.whenEnded(() => {
     stage.ended = true;
     say(
-      carried !== null ? carried.endedLine(stage.now) : stage.now === "unsent" ? `The run was ended before its exchange. ${unread}` : stage.now === "sent" ? `The run was ended during its exchange. ${exchangeUnknownSentence(kind, origin, login2)}` : `The run was ended after its exchange minted a token, which may not have been ${kind === "authorized computer" ? "kept" : "printed"}: list_tokens from your tool shows it by its label, and revoke_token ends it.`
+      carried !== null ? carried.endedLine(stage.now) : device !== null && waiting ? device.stoppedLine : stage.now === "unsent" ? `The run was ended before its exchange. ${unread}` : stage.now === "sent" ? `The run was ended during its exchange. ${exchangeUnknownSentence(kind, origin, login2)}` : `The run was ended after its exchange minted a token, which may not have been ${kind === "authorized computer" ? "kept" : "printed"}: list_tokens from your tool shows it by its label, and revoke_token ends it.`
     );
     dropCredentialWriting(io2, place, tag);
     carried?.drop();
@@ -1368,7 +1433,7 @@ async function completeAct(io2, origin, kind, presentation, userAgent, say, deli
       return COMMAND_STATUS.nothing_started;
     }
     if (stage.ended) return COMMAND_STATUS.nothing_started;
-    const older = await planeWireRefusal(io2, origin, held ? "" : TOKEN_CODE_UNREAD_FIRST);
+    const older = await planeWireRefusal(io2, origin, device !== null ? void 0 : held ? "" : TOKEN_CODE_UNREAD_FIRST);
     if (stage.ended) return COMMAND_STATUS.nothing_started;
     if (older !== null) {
       say(older);
@@ -1383,7 +1448,28 @@ async function completeAct(io2, origin, kind, presentation, userAgent, say, deli
       }
     }
     stage.now = "sent";
-    const answered = "mint" in presentation ? await postAction(io2, origin, MINT_TOKEN_ACTION, pending.verifier, userAgent, heldExchangeBodyOf(presentation.mint)) : await postAction(io2, origin, MINT_TOKEN_ACTION, presentation.code, userAgent, exchangeBodyOf(pending.verifier));
+    let answered;
+    if (device !== null) {
+      for (; ; ) {
+        answered = await postAction(io2, origin, MINT_TOKEN_ACTION, pending.verifier, userAgent, heldExchangeBodyOf(MINT_DEVICE));
+        if (stage.ended) break;
+        const wait = devicePollWaitMsOf(answered);
+        if (wait === null) break;
+        const left = device.until - io2.clock().getTime();
+        if (left > 0) {
+          waiting = true;
+          await io2.sleep(Math.min(wait, left));
+          waiting = false;
+          if (stage.ended) return COMMAND_STATUS.nothing_started;
+        }
+        if (io2.clock().getTime() >= device.until) {
+          say(device.endedLine);
+          return COMMAND_STATUS.nothing_started;
+        }
+      }
+    } else {
+      answered = "code" in presentation ? await postAction(io2, origin, MINT_TOKEN_ACTION, presentation.code, userAgent, exchangeBodyOf(pending.verifier)) : await postAction(io2, origin, MINT_TOKEN_ACTION, pending.verifier, userAgent, heldExchangeBodyOf("mint" in presentation ? presentation.mint : MINT_DEVICE));
+    }
     if (stage.ended) {
       const late = answered === null ? null : planeObjectOf(answered.text);
       if (late !== null && typeof late.value === "string") io2.hide(late.value, REDACTED_TOKEN);
@@ -1416,7 +1502,7 @@ async function completeAct(io2, origin, kind, presentation, userAgent, say, deli
       }
       for (const line of refusalLines(EXCHANGE_ACT, answered.status, refusal)) say(line);
       say(
-        answered.status === 429 ? `Nothing was minted, and ${held ? "nothing was spent" : "the token code was not spent"}: run the line again after the wait the answer names.` : `Nothing was minted. ${mintAgainSentence(kind, origin, login2)}`
+        answered.status === 429 ? `Nothing was minted, and ${held ? "nothing was spent" : "the token code was not spent"}: run the line again after the wait the answer names.` : `Nothing was minted. ${device !== null ? device.refusedLine : mintAgainSentence(kind, origin, login2)}`
       );
       return COMMAND_STATUS.nothing_started;
     }
@@ -1911,7 +1997,7 @@ var EXPORT_DOWNLOAD_OPTIONS = Object.freeze([
     name: EXPORT_OPTION.export,
     value: "<application id>/<export id>",
     required: true,
-    description: `The application and its completed export, as the ${DOWNLOAD_GRANT_ACTION} call returned them, joined by a slash.`
+    description: `The application and its completed export, as ${DOWNLOAD_GRANT_CALL} returned them, joined by a slash.`
   },
   {
     name: EXPORT_OPTION.path,
@@ -1929,7 +2015,7 @@ var EXPORT_DOWNLOAD_OPTIONS = Object.freeze([
 var EXPORT_DOWNLOAD_CREDENTIAL = Object.freeze({
   grant: "download grant",
   aGrant: "a download grant",
-  call: `the ${DOWNLOAD_GRANT_ACTION} call`,
+  call: DOWNLOAD_GRANT_CALL,
   mintedToken: false
 });
 var EXPORT_READS_AT_ONCE = 4;
@@ -1950,14 +2036,14 @@ var EXPORT_LINE_HEAD = Object.freeze({
 });
 var defaultExportFolderOf = (exportId) => `export-${exportId}`;
 var NOTHING_WRITTEN = "Nothing was written.";
-var exportAgain = (application, exportId) => `Call ${DOWNLOAD_GRANT_ACTION} from your tool with application ${application} and export ${exportId}, naming the same folder as local_path where this line named one, and run the line it answers as given.`;
+var exportAgain = (application, exportId) => `Call ${toolNameOf(DOWNLOAD_GRANT_ACTION)} with download: true from your tool with application ${application} and export ${exportId}, naming the same folder as local_path where this line named one, and run the line it answers as given.`;
 var exportDownloadOptionsOf = (call, cwd) => {
   if (!EXPORT_ACTS.some((act) => act === call.act)) return { refusal: `${EXPORT_SUBCOMMAND} takes ${EXPORT_ACTS.join(" or ")} as its first argument. ${NOTHING_WRITTEN}` };
   const named = call.named[EXPORT_OPTION.export];
   const [application, exportId, ...rest] = (named ?? "").split("/");
   if (named === void 0 || rest.length > 0 || application === void 0 || exportId === void 0 || !UPLOAD_ID.test(application) || !UPLOAD_ID.test(exportId)) {
     return {
-      refusal: `${EXPORT_OPTION.export} names the application and its export as the ${DOWNLOAD_GRANT_ACTION} call answered them, <application id>/<export id>, each a lowercase UUID. Run the line the ${DOWNLOAD_GRANT_ACTION} call answered as given. ${NOTHING_WRITTEN}`
+      refusal: `${EXPORT_OPTION.export} names the application and its export as ${DOWNLOAD_GRANT_CALL} answered them, <application id>/<export id>, each a lowercase UUID. Run the line ${DOWNLOAD_GRANT_CALL} answered as given. ${NOTHING_WRITTEN}`
     };
   }
   const origin = commandOriginOf(call.named[EXPORT_OPTION.origin] ?? DEFAULT_COMMAND_ORIGIN);
@@ -1966,7 +2052,7 @@ var exportDownloadOptionsOf = (call, cwd) => {
   return { application, export: exportId, folder: resolve2(cwd, path ?? defaultExportFolderOf(exportId)), named: path !== void 0, origin: origin.origin };
 };
 var exportEntriesOf = (text, application, exportId) => {
-  const unread = { refusal: `The export's manifest is not one the command reads: call read_export from your tool with application ${application} and export ${exportId} to see the export. ${NOTHING_WRITTEN}` };
+  const unread = { refusal: `The export's manifest is not one the command reads: call tzcloud_read_export from your tool with application ${application} and export ${exportId} to see the export. ${NOTHING_WRITTEN}` };
   let manifest;
   try {
     manifest = JSON.parse(text);
@@ -1978,7 +2064,7 @@ var exportEntriesOf = (text, application, exportId) => {
   if (read2.export !== exportId || read2.application !== application) return unread;
   if (read2.state !== "completed") {
     return {
-      refusal: `The export did not complete${typeof read2.outcome === "string" ? ` (${read2.outcome})` : ""}, so its files are not read: call request_export from your tool for a fresh export, then ${DOWNLOAD_GRANT_ACTION} once read_export answers it completed. ${NOTHING_WRITTEN}`
+      refusal: `The export did not complete${typeof read2.outcome === "string" ? ` (${read2.outcome})` : ""}, so its files are not read: call tzcloud_request_export from your tool for a fresh export, then ${toolNameOf(DOWNLOAD_GRANT_ACTION)} with download: true once tzcloud_read_export answers it completed. ${NOTHING_WRITTEN}`
     };
   }
   const tables = read2.database?.tables ?? [];
@@ -2047,7 +2133,7 @@ var addressable = (entry) => ![entry.area, ...entry.name.split(/[\\/]/)].some((s
 var applicationFolderSentence = () => `The folder the line runs in holds package.json, so it is an application's folder, and the line names no ${EXPORT_OPTION.path}. The export would be written inside it, where a deploy from that folder would carry every file of the export. Run the line again with ${EXPORT_OPTION.path} naming a folder outside this one, which the same grant serves until it expires. ${NOTHING_WRITTEN}`;
 var ABSENT_FILE_STATUS = 404;
 var ABSENT_FILE_ERROR = "no_such_file";
-var freshExportLine = (absent) => `${absent === 1 ? "A file the manifest names was" : `${absent} files the manifest names were`} answered as an absent name and ${absent === 1 ? "was" : "were"} not read. A fresh export has the application's files as they now stand: call request_export from your tool, then ${DOWNLOAD_GRANT_ACTION} once read_export answers it completed.`;
+var freshExportLine = (absent) => `${absent === 1 ? "A file the manifest names was" : `${absent} files the manifest names were`} answered as an absent name and ${absent === 1 ? "was" : "were"} not read. A fresh export has the application's files as they now stand: call tzcloud_request_export from your tool, then ${toolNameOf(DOWNLOAD_GRANT_ACTION)} with download: true once tzcloud_read_export answers it completed.`;
 var runAgainLine = (again) => `Run the line again before its grant expires, or take a fresh one. ${again} It skips the files on disk and reads again each file whose read failed.`;
 var MANIFEST_READ = "The manifest read";
 var fileReadOf = (natural) => `The read of ${shownWhole(natural)}`;
@@ -2165,7 +2251,7 @@ async function exportDownload(call, io2) {
   if (!(manifestRead instanceof Response)) {
     if (manifestRead.kind === "ended") for (const line of manifestRead.lines) io2.print(line);
     else io2.print(`The export's manifest could not be read: ${manifestRead.kind === "failed" ? manifestRead.reason : "the read was capped"}.`);
-    io2.print(`${manifestRead.kind === "ended" ? again : `Call read_export from your tool with application ${options.application} and export ${options.export} to see whether the export completed. Then ${again.charAt(0).toLowerCase()}${again.slice(1)}`} ${NOTHING_WRITTEN}`);
+    io2.print(`${manifestRead.kind === "ended" ? again : `Call tzcloud_read_export from your tool with application ${options.application} and export ${options.export} to see whether the export completed. Then ${again.charAt(0).toLowerCase()}${again.slice(1)}`} ${NOTHING_WRITTEN}`);
     return COMMAND_STATUS.nothing_started;
   }
   let manifestBytes;
@@ -2366,21 +2452,21 @@ async function exportDownload(call, io2) {
   }
   return COMMAND_STATUS.done;
 }
-var EXPORT_AFTER_OWN_ERROR = `the files written so far stand under the folder, and a fresh line from ${DOWNLOAD_GRANT_ACTION} with the same folder skips them`;
+var EXPORT_AFTER_OWN_ERROR = `the files written so far stand under the folder, and a fresh line from ${DOWNLOAD_GRANT_CALL} with the same folder skips them`;
 var EXPORT_DOWNLOAD_ROW = Object.freeze({
   name: EXPORT_SUBCOMMAND,
   acts: EXPORT_ACTS,
-  summary: `Downloads every file of a completed export: its manifest, each table's CSV, and each stored file. It runs under the download grant the ${DOWNLOAD_GRANT_ACTION} call returned. It checks each file against the length that response states and the version the manifest gives.`,
+  summary: `Downloads every file of a completed export: its manifest, each table's CSV, and each stored file. It runs under the download grant ${DOWNLOAD_GRANT_CALL} returned. It checks each file against the length that response states and the version the manifest gives.`,
   example: `${EXPORT_SUBCOMMAND} ${EXPORT_ACTS[0]} ${EXPORT_OPTION.export} <application id>/<export id> ${EXPORT_OPTION.path} <folder>`,
   options: EXPORT_DOWNLOAD_OPTIONS,
   credential: EXPORT_DOWNLOAD_CREDENTIAL,
   statuses: {
     done: "every file the manifest lists on disk, moved ones reported",
     failed: "a file failed, was cut short, or was refused: the closing lines give the command to run again, or a fresh export if a file was reported as an absent name",
-    unknown: `the run stopped before the end: a fresh command from ${DOWNLOAD_GRANT_ACTION} resumes it`,
+    unknown: `the run stopped before the end: a fresh command from ${DOWNLOAD_GRANT_CALL} resumes it`,
     nothing_started: "an option, the grant, the folder, or the manifest was refused, or the platform was too old, and nothing was written"
   },
-  note: [`Run the ${EXPORT_SUBCOMMAND} download command a ${DOWNLOAD_GRANT_ACTION} call returns, as given, before its grant expires. Run it from a folder that is not an application's, or with ${EXPORT_OPTION.path} giving one outside it. It writes into a new or empty folder, or one an earlier run of the same export wrote, skipping the files already on disk.`],
+  note: [`Run the ${EXPORT_SUBCOMMAND} download command ${DOWNLOAD_GRANT_CALL} returns, as given, before its grant expires. Run it from a folder that is not an application's, or with ${EXPORT_OPTION.path} giving one outside it. It writes into a new or empty folder, or one an earlier run of the same export wrote, skipping the files already on disk.`],
   afterOwnError: EXPORT_AFTER_OWN_ERROR,
   run: exportDownload
 });
@@ -2551,7 +2637,7 @@ var nearestHealthPathOf = (found, path) => {
 };
 var shownHealthPath = (path) => shownNoteName(bareHealthPath(path));
 var healthLineOf = (path) => `${WARNING_LINE_HEAD}${MANIFEST_FILE} names the health path ${shownHealthPath(path)}, and no other file of the zip holds its last segment, package files and documentation set aside. A deploy waits for that path to answer 200 three times in a row, so check that the application serves it. A route built in another form is not seen here.`;
-var nearestHealthLineOf = (nearest) => `The zip's source names the path ${shownHealthPath(nearest)}: where that is the health path meant, set the manifest's health to it and call submit_manifest.`;
+var nearestHealthLineOf = (nearest) => `The zip's source names the path ${shownHealthPath(nearest)}: where that is the health path meant, set the manifest's health to it and call tzcloud_submit_manifest.`;
 var CREDENTIAL_FILE_NAMES = Object.freeze(["id_rsa", "id_dsa", "id_ecdsa", "id_ed25519", ".netrc", ".pgpass", ".htpasswd", "credentials.json"]);
 var CLIENT_SECRET_OPENING = "client_secret";
 var CLIENT_SECRET_ENDING = ".json";
@@ -2589,7 +2675,7 @@ var credentialFileName = (name) => {
   return CREDENTIAL_FILE_NAMES.includes(last) || last.startsWith(CLIENT_SECRET_OPENING) && last.endsWith(CLIENT_SECRET_ENDING) || CREDENTIAL_FILE_ENDINGS.some((ending) => last.endsWith(ending));
 };
 var looksLikeCredential = (name, data) => credentialFileName(name) || holdsPrivateKey(data);
-var credentialAdvice = (subject) => `Where ${subject} holds a secret, move it out of the application's folder before the next deploy, and store a secret value the application needs with ${SECRET_ACTION.store}. The ${HASH_SUBCOMMAND} subcommand with ${HASH_OPTION.list} prints every file the zip holds.`;
+var credentialAdvice = (subject) => `Where ${subject} holds a secret, move it out of the application's folder before the next deploy, and store a secret value the application needs with ${toolNameOf(SECRET_ACTION.store)}. The ${HASH_SUBCOMMAND} subcommand with ${HASH_OPTION.list} prints every file the zip holds.`;
 var credentialLineOf = (names) => names.length === 0 ? null : names.length === 1 ? `${WARNING_LINE_HEAD}the zip holds a file that looks like a key or a credential, and the upload includes it: ${listedNames(names)}. ${credentialAdvice("it")}` : `${WARNING_LINE_HEAD}the zip holds ${names.length} files that look like keys or credentials, and the upload includes them: ${listedNames(names)}. ${credentialAdvice("one")}`;
 var LOCAL_WRITE_EXTENSIONS = Object.freeze([".js", ".mjs", ".cjs", ".ts"]);
 var LOCAL_WRITE_UNREAD_FOLDERS = Object.freeze(["client/", "lib/"]);
@@ -3198,7 +3284,7 @@ function artifactLayoutOf(reading) {
     if (nested.length === 1) {
       refuse(`The zip holds no package.json at its root, and its top-level folder ${shownEntry(`${nested[0]}/`)} holds one: zip that folder's contents rather than the folder, so package.json sits at the zip's root, and deploy again`);
     }
-    refuse("The zip holds no package.json at its root. The image runs npm start at the zip's root: zip the project folder's contents with package.json at the top, and deploy again");
+    refuse("The zip has no root package.json. The image runs npm start there: zip the folder's contents with package.json at the top, then deploy again. For a static site, add the server in read_documentation's /cloud/guides/publish-a-static-site/");
   }
   const manifest = parsePackageJson(reading.packageJson);
   if (!isRecord(manifest)) {
@@ -3225,7 +3311,7 @@ var nestingDeeperThan = (value, max) => {
 function manifestCopyDepthRefusal(reading) {
   if (reading.manifestJson === null) return;
   if (nestingDeeperThan(parsePackageJson(reading.manifestJson), MANIFEST_COPY_DEPTH_MAX)) {
-    throw new DeployRefusal(400, "artifact_layout_invalid", `The zip's manifest.json nests deeper than the ${MANIFEST_COPY_DEPTH_MAX} levels the deploy reads: the platform reads the manifest submit_manifest recorded, so flatten the zip's copy or leave it out, and deploy again.`);
+    throw new DeployRefusal(400, "artifact_layout_invalid", `The zip's manifest.json nests deeper than the ${MANIFEST_COPY_DEPTH_MAX} levels the deploy reads: the platform reads the manifest tzcloud_submit_manifest recorded, so flatten the zip's copy or leave it out, and deploy again.`);
   }
 }
 function clientReadingOf(records) {
@@ -3487,7 +3573,7 @@ var DEPLOY_OPTIONS = Object.freeze([
     name: DEPLOY_OPTION.application,
     value: "<application id>",
     required: true,
-    description: "The application to deploy, by its id, a lowercase UUID, as given in the command your tool's deploy call returns."
+    description: "The application to deploy, by its id, a lowercase UUID, as given in the command your tool's tzcloud_deploy call returns."
   },
   {
     name: DEPLOY_OPTION.origin,
@@ -3506,7 +3592,7 @@ var DEPLOY_OPTIONS = Object.freeze([
     value: "",
     required: false,
     flag: true,
-    description: "Rotates production's database credential with this deploy, as given in the command a deploy call with rotate_database_credential returns."
+    description: "Rotates production's database credential with this deploy, as given in the command a tzcloud_deploy call with rotate_database_credential returns."
   },
   {
     name: DEPLOY_JSON_FLAG,
@@ -3519,7 +3605,7 @@ var DEPLOY_OPTIONS = Object.freeze([
     name: DEPLOY_OPTION.env,
     value: "<environment>",
     required: false,
-    description: `The environment to deploy to, ${COMMAND_ENVIRONMENTS.join(" or ")}. If omitted, the platform chooses, and the command deploys to the environment given in the platform's response. The command a deploy call returns does not include it.`
+    description: `The environment to deploy to, ${COMMAND_ENVIRONMENTS.join(" or ")}. If omitted, the platform chooses, and the command deploys to the environment given in the platform's response. The command a tzcloud_deploy call returns does not include it.`
   }
 ]);
 var HASH_OPTIONS = Object.freeze([
@@ -3796,7 +3882,7 @@ function zipFiles(files, read2 = (path) => readFileSync3(path), seen, placed) {
   end.writeUInt32LE(offset, 16);
   return Buffer.concat([...parts, centralBytes, end]);
 }
-var NO_PACKAGE_SENTENCE = "The folder holds no package.json at its root, so it is not an application folder: run the line from the application's folder, or name it with --path.";
+var NO_PACKAGE_SENTENCE = "The folder has no root package.json. Run from the application's folder or use --path; for a static site without a server, read_documentation's page /cloud/guides/publish-a-static-site/ shows the server to add.";
 function zipFolder(root, seams = {}) {
   let rootFile = false;
   try {
@@ -3881,7 +3967,7 @@ var deployOptionsOf = (named, cwd, flags = /* @__PURE__ */ new Set()) => {
   const application = named[DEPLOY_OPTION.application];
   if (application === void 0 || !UPLOAD_ID.test(application)) {
     return {
-      refusal: `${DEPLOY_OPTION.application} names the application to deploy, by its id, a lowercase UUID, as the line a deploy call from your tool answers names it. Nothing was started.`
+      refusal: `${DEPLOY_OPTION.application} names the application to deploy, by its id, a lowercase UUID, as the line a tzcloud_deploy call from your tool answers names it. Nothing was started.`
     };
   }
   const env = named[DEPLOY_OPTION.env];
@@ -3908,11 +3994,11 @@ var deployOptionsOf = (named, cwd, flags = /* @__PURE__ */ new Set()) => {
 var COMMAND_ACTS = Object.freeze(["upload", "start", "progress read"]);
 var PROGRESS_READ_ACT = COMMAND_ACTS[2];
 var NOTHING_SENT_OR_STARTED = "Nothing was sent and nothing was started.";
-var uploadNoAnswerSentence = (application, environment) => `The upload drew no answer, so nothing was started, though the file may have landed. Call read_status from your tool with application ${application} and environment ${environment}: where it answers a pending upload, make the start-only retry that upload carries; otherwise run this line again.`;
+var uploadNoAnswerSentence = (application, environment) => `The upload drew no answer, so nothing was started, though the file may have landed. Call tzcloud_read_status from your tool with application ${application} and environment ${environment}: where it answers a pending upload, make the start-only retry that upload carries; otherwise run this line again.`;
 var DEPLOY_CREDENTIAL = Object.freeze({
   grant: "minted token",
   aGrant: "a minted token",
-  call: "the deploy call",
+  call: "the tzcloud_deploy call",
   mintedToken: true,
   piped: false,
   places: NO_INPUT_PLACES
@@ -4046,8 +4132,7 @@ var pathKindOf = (path) => {
     return "absent";
   }
 };
-var zipOf = (path, io2, closing = NOTHING_STARTED, named = false, wayOn = null, asItIs = "uploaded") => {
-  const placeClosing = wayOn ?? closing;
+var zipOf = (path, io2, closing = NOTHING_STARTED, named = false, asItIs = "uploaded") => {
   const place = named ? `What ${DEPLOY_OPTION.path} names` : "The folder the line runs in";
   const kind = pathKindOf(path);
   if (kind === "zip") {
@@ -4061,14 +4146,14 @@ var zipOf = (path, io2, closing = NOTHING_STARTED, named = false, wayOn = null,
     return { zip, sha256: sha2562, line: `${ZIP_LINE_HEAD}${path}, ${zip.length} bytes, ${asItIs} as it is, ${HASH_LINE_HEAD}${sha2562}`, source: "file", notes: NO_NOTES, files: null, places: null };
   }
   if (kind !== "folder") {
-    return { refusal: `${place} is neither an application folder nor a .zip file. Run the line from the application's folder, or name the folder or the .zip file with ${DEPLOY_OPTION.path}. ${placeClosing}` };
+    return { refusal: `${place} is neither an application folder nor a .zip file. Run the line from the application's folder, or name the folder or the .zip file with ${DEPLOY_OPTION.path}. ${closing}` };
   }
   try {
     const { zip, entries, files, places, notes } = zipFolder(path, io2.walk ? { walk: io2.walk } : {});
     const sha2562 = zipSha256(zip);
     return { zip, sha256: sha2562, line: `${ZIP_LINE_HEAD}${entries} files from ${path}, ${zip.length} bytes, ${HASH_LINE_HEAD}${sha2562}`, source: "folder", notes, files, places };
   } catch (error) {
-    if (error instanceof ZipRefusal) return { refusal: `${error.message} ${error.message === NO_PACKAGE_SENTENCE ? placeClosing : closing}` };
+    if (error instanceof ZipRefusal) return { refusal: `${error.message} ${closing}` };
     return { refusal: `${named ? `The folder ${DEPLOY_OPTION.path} names` : "The folder the line runs in"} could not be read (${errorCodeOf(error)}). ${closing}` };
   }
 };
@@ -4367,7 +4452,7 @@ async function deployRun(named, io2, flags) {
   io2.print(stop);
   return PROGRESS_EXIT_STATUS.refused;
 }
-var DEPLOY_AFTER_OWN_ERROR = "the deploy may or may not have started. Call read_status from your tool first, make the start-only retry a pending upload it answers carries, and run the line again only where it shows neither";
+var DEPLOY_AFTER_OWN_ERROR = "the deploy may or may not have started. Call tzcloud_read_status from your tool first, make the start-only retry a pending upload it answers carries, and run the line again only where it shows neither";
 var DEPLOY_ROW = Object.freeze({
   name: DEPLOY_SUBCOMMAND,
   summary: "Deploys the application folder, or a .zip file. It zips the folder, makes the preparing deploy call, uploads the zip under the upload grant that call returns, starts the deploy, and waits for it, printing each step and the outcome. It runs under this computer's token. A tool connected by a minted token, or a job with no tool, runs it under a minted token. With no credential, it sends nothing and prints the two routes to get one: the minted token's variables first, then the login route if the address is admitted.",
@@ -4378,12 +4463,12 @@ var DEPLOY_ROW = Object.freeze({
   statuses: {
     done: `the version deployed, or the deploy started if ${DEPLOY_NO_WAIT_VARIABLE} is set`,
     failed: "the deploy failed",
-    unknown: "the wait stopped, or the start got no response: the deploy may go on, and read_status reads it",
+    unknown: "the wait stopped, or the start got no response: the deploy may go on, and tzcloud_read_status reads it",
     nothing_started: "an option, credential, folder, or the folder's binding was refused, or no credential was read. Or the platform was too old, or no usable upload was returned. Or no zipped file refers to the health path. Or the upload or start was refused, or the upload got no response"
   },
   variables: [[DEPLOY_NO_WAIT_VARIABLE, "any value makes the command return once the deploy has started, without waiting for it."]],
   note: [
-    `A deploy is one command, which contains no credential: run the command your tool's deploy call returns, or ${DEPLOY_SUBCOMMAND} ${DEPLOY_OPTION.application} <application id>, from the application's folder. It reads no standard input. On an authorized computer it runs under this computer's token, which ${LOGIN_SUBCOMMAND} or ${AUTHORIZE_SUBCOMMAND} keeps in the credential file for each platform address. It sends that token only to the address it is kept under: ${DEPLOY_OPTION.origin} if the command has one, else the address in ${ORIGIN_VARIABLE}, else ${DEFAULT_COMMAND_ORIGIN}.`,
+    `A deploy is one command, which contains no credential: run the command your tool's tzcloud_deploy call returns, or ${DEPLOY_SUBCOMMAND} ${DEPLOY_OPTION.application} <application id>, from the application's folder. It reads no standard input. On an authorized computer it runs under this computer's token, which ${LOGIN_SUBCOMMAND} or ${AUTHORIZE_SUBCOMMAND} keeps in the credential file for each platform address. It sends that token only to the address it is kept under: ${DEPLOY_OPTION.origin} if the command has one, else the address in ${ORIGIN_VARIABLE}, else ${DEFAULT_COMMAND_ORIGIN}.`,
     `On a computer with no token for that address, or one that has expired, it sends nothing, ends 3, and prints two routes, in this order. A tool connected by a minted token, or a job with no tool, such as a CI job's, sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, never by writing the value in a command. It sets ${ORIGIN_VARIABLE} to the address that minted the token if that is not ${DEFAULT_COMMAND_ORIGIN}, then runs the deploy command again. Such a tool cannot use ${MINT_TOKEN_ACTION}, which works only under a sign-in.`,
     `The second route authorizes this computer, and then the deploy command runs again. A tool signed in to the platform may do this itself with ${AUTHORIZE_SUBCOMMAND}. The run also prints the person's way: ${LOGIN_SUBCOMMAND}, run once in a terminal of their own. The credential file is ${CREDENTIAL_FILE_WORDS}.`,
     DEPLOY_ROUTES_SENTENCE,
@@ -4423,12 +4508,12 @@ var CHECK_AGAIN = `${NOTHING_CHECKED} Run the line again.`;
 var CHECK_RATE_CAPPED = `${NOTHING_CHECKED} Run the line again after the wait the answer names.`;
 var CHECK_AFTER_LOGIN = `Once login has printed authorized:, run this check line again. ${NOTHING_SENT_OR_CHECKED}`;
 var checkHashSentenceOf = (io2, path, origin) => `Before any sign-in, ${printedLineOf(io2, commandLineOf(origin, HASH_SUBCOMMAND, path === void 0 ? {} : { path }), origin)} builds the same zip and prints the same warnings: it needs no credential and sends nothing, though only check runs the deploy's checks of the zip.`;
-var NO_APPLICATION_YET = "Where no application exists yet, call create_application from your tool first: the check reads that application's state on the platform beside the folder.";
+var NO_APPLICATION_YET = "Where no application exists yet, call tzcloud_create_application from your tool first: the check reads that application's state on the platform beside the folder.";
 var checkOptionsOf = (named, cwd) => {
   const application = named[CHECK_OPTION.application];
   if (application === void 0 || !UPLOAD_ID.test(application)) {
     return {
-      refusal: `${CHECK_OPTION.application} names the application whose deploy to check, by its id, a lowercase UUID, as the line a ${CHECK_ACTION} call from your tool answers names it. ${NO_APPLICATION_YET} ${NOTHING_CHECKED}`
+      refusal: `${CHECK_OPTION.application} names the application whose deploy to check, by its id, a lowercase UUID, as the line a ${toolNameOf(CHECK_ACTION)} call from your tool answers names it. ${NO_APPLICATION_YET} ${NOTHING_CHECKED}`
     };
   }
   const origin = commandOriginOf(named[CHECK_OPTION.origin] ?? DEFAULT_COMMAND_ORIGIN);
@@ -4440,7 +4525,7 @@ var CHECK_OPTIONS = Object.freeze([
     name: CHECK_OPTION.application,
     value: "<application id>",
     required: true,
-    description: `The application whose deploy to check, by its id, a lowercase UUID, as given in the command your tool's ${CHECK_ACTION} call returns.`
+    description: `The application whose deploy to check, by its id, a lowercase UUID, as given in the command your tool's ${toolNameOf(CHECK_ACTION)} call returns.`
   },
   {
     name: CHECK_OPTION.origin,
@@ -4458,7 +4543,7 @@ var CHECK_OPTIONS = Object.freeze([
 var CHECK_CREDENTIAL = Object.freeze({
   grant: "minted token",
   aGrant: "a minted token",
-  call: `the ${CHECK_ACTION} call`,
+  call: `the ${toolNameOf(CHECK_ACTION)} call`,
   mintedToken: true,
   piped: false,
   places: NO_INPUT_PLACES
@@ -4479,7 +4564,7 @@ var checkAnswerOf = (answer) => {
   return { refusals: read2, firstDeploy, recordedHealthPath };
 };
 var refusedLineOf = (error, detail) => `${REFUSED_LINE_HEAD}${error}${detail !== null && detail !== "" ? `: ${oneLine(detail)}` : ""}`;
-var manifestLineOf = (zipPath, recordedPath) => `${MANIFEST_LINE_HEAD}the zip's manifest.json names the health path ${shownNoteName(zipPath)}, and the recorded manifest names ${shownNoteName(recordedPath)}. A deploy reads the recorded manifest: to deploy under the zip's copy, call submit_manifest with it first, then check again.`;
+var manifestLineOf = (zipPath, recordedPath) => `${MANIFEST_LINE_HEAD}the zip's manifest.json names the health path ${shownNoteName(zipPath)}, and the recorded manifest names ${shownNoteName(recordedPath)}. A deploy reads the recorded manifest: to deploy under the zip's copy, call tzcloud_submit_manifest with it first, then check again.`;
 var checkedLineOf = (answered, zip) => {
   const total = answered + zip;
   if (total === 0) return `${CHECKED_LINE_HEAD}no refusal: none of the checks would refuse a deploy now, and a later deploy reads every check again.`;
@@ -4607,7 +4692,7 @@ async function check(named, io2) {
     io2.print(unbound);
     return COMMAND_STATUS.nothing_started;
   }
-  const zipped = zipOf(options.path, io2, NOTHING_CHECKED, named[CHECK_OPTION.path] !== void 0, null, "checked");
+  const zipped = zipOf(options.path, io2, NOTHING_CHECKED, named[CHECK_OPTION.path] !== void 0, "checked");
   if ("refusal" in zipped) {
     io2.print(zipped.refusal);
     return COMMAND_STATUS.nothing_started;
@@ -4644,8 +4729,8 @@ var CHECK_ROW = Object.freeze({
     nothing_started: "nothing was checked. An option, credential, folder, or the folder's binding was refused, or no credential was read and the two routes to get one were printed. Or the platform was too old. Or the check call was refused, got no response, was redirected, or failed"
   },
   note: [
-    `A check is one command, which contains no credential: run the command your tool's ${CHECK_ACTION} call returns, or ${CHECK_SUBCOMMAND} ${CHECK_OPTION.application} <application id>, from the application's folder, before a first deploy and after each fix. It reads its credential and the platform's address as ${DEPLOY_SUBCOMMAND} does, and builds the same zip ${DEPLOY_SUBCOMMAND} builds. It sends the platform only the application, no byte of the zip and no hash. It uploads nothing and starts nothing.`,
-    `After its zip line and a checking: line, ${CHECK_SUBCOMMAND} prints the further lines ${DEPLOY_SUBCOMMAND} prints. It leaves out the health warning if the platform says the deploy would be a first one, since a refused: line then states the recorded health path. Then it prints one refused: line for each refusal the platform returned for the application's state, then one for each refusal of the zip by the deploy's own checks. A line mentions submit_manifest if the zip's manifest.json gives another health path, and a last checked: line counts the refusals.`,
+    `A check is one command, which contains no credential: run the command your tool's ${toolNameOf(CHECK_ACTION)} call returns, or ${CHECK_SUBCOMMAND} ${CHECK_OPTION.application} <application id>, from the application's folder, before a first deploy and after each fix. It reads its credential and the platform's address as ${DEPLOY_SUBCOMMAND} does, and builds the same zip ${DEPLOY_SUBCOMMAND} builds. It sends the platform only the application, no byte of the zip and no hash. It uploads nothing and starts nothing.`,
+    `After its zip line and a checking: line, ${CHECK_SUBCOMMAND} prints the further lines ${DEPLOY_SUBCOMMAND} prints. It leaves out the health warning if the platform says the deploy would be a first one, since a refused: line then states the recorded health path. Then it prints one refused: line for each refusal the platform returned for the application's state, then one for each refusal of the zip by the deploy's own checks. A line mentions tzcloud_submit_manifest if the zip's manifest.json gives another health path, and a last checked: line counts the refusals.`,
     `Before its zip, ${CHECK_SUBCOMMAND} reads the folder's manifest.json as ${DEPLOY_SUBCOMMAND} reads it. If its application member gives an application other than ${CHECK_OPTION.application}, or is not an application id, the check ends 3 before anything is zipped or sent. A check writes no member if none exists.`,
     `A passing check does not guarantee the deploy is accepted: a deploy in flight, the day's deploys, and the hosting cell's room can change before the deploy, which makes every check again.`
   ],
@@ -4796,7 +4881,7 @@ var SECRET_OPTIONS = Object.freeze([
     name: SECRET_OPTION.name,
     value: "<name>",
     required: true,
-    description: "The name the value is stored under, as given in the command the store_secret or rotate_secret call returns."
+    description: "The name the value is stored under, as given in the command the tzcloud_store_secret call returns."
   },
   {
     name: SECRET_OPTION.application,
@@ -4848,22 +4933,22 @@ var SECRET_OPTIONS = Object.freeze([
 var SECRET_CREDENTIAL = Object.freeze({
   grant: "secret grant",
   aGrant: "a secret grant",
-  call: "the store_secret or rotate_secret call",
+  call: "the tzcloud_store_secret call",
   mintedToken: false,
   computerToken: true,
   emptyPipeRefused: true
 });
-var freshLineSteps = (act) => `${SECRET_ACTION[act]} from your tool with the name and its scope, naming no value, and run the line it answers as given.`;
+var freshLineSteps = (act) => `${SECRET_CALL[act]} from your tool with the name and its scope, naming no value, and run the line it answers as given.`;
 var secretAgain = (act) => `Call ${freshLineSteps(act)}`;
 var RESTART_UNDER_STORE = `${SECRET_OPTION.restart} goes with ${SECRET_SUBCOMMAND} rotate alone: a store restarts nothing. ${NOTHING_SENT2}`;
-var RESTART_UNDER_GRANT = `${SECRET_OPTION.restart} asks for a restart, and a write under a secret grant writes the value alone. Run the line without ${SECRET_OPTION.restart} and then make the restart_application call the answer's next names, or, where you wrote the line yourself, run it with no grant piped, under this computer's token. ${NOTHING_SENT2}`;
+var RESTART_UNDER_GRANT = `${SECRET_OPTION.restart} asks for a restart, and a write under a secret grant writes the value alone. Run the line without ${SECRET_OPTION.restart} and then make the tzcloud_restart_application call the answer's next names, or, where you wrote the line yourself, run it with no grant piped, under this computer's token. ${NOTHING_SENT2}`;
 var platformMintedUnderToken = (line) => `${SECRET_OPTION.name} names a credential the platform minted for that application, which a rotation under this computer's token would re-mint and answer a value the command never prints. ${line}, run in the folder the application runs in, re-mints it and writes it into the environment file. ${NOTHING_SENT2}`;
 var underTokenLine = (origin) => `No secret grant was piped, so this line runs under this computer's token for ${origin}.`;
-var sentLine = (act, underGrant) => `The ${SECRET_ACTION[act]} write is being sent; wait for its answer. Before any second run, call list_secrets from your tool, whose row for the name shows when it was last written, so whether this write landed.${underGrant ? " The secret grant serves once: where this write landed, a second run of this line is normally refused secret_grant_spent." : ""}`;
+var sentLine = (act, underGrant) => `The ${SECRET_ACTION[act]} write is being sent; wait for its answer. Before any second run, call tzcloud_list_secrets from your tool, whose row for the name shows when it was last written, so whether this write landed.${underGrant ? " The secret grant serves once: where this write landed, a second run of this line is normally refused secret_grant_spent." : ""}`;
 var secretOptionsOf = (call, cwd) => {
   const act = SECRET_ACTS.find((entry) => entry === call.act);
   if (act === void 0) return { refusal: `${SECRET_SUBCOMMAND} takes ${SECRET_ACTS.join(" or ")} as its first argument. ${NOTHING_SENT2}` };
-  const asAnswered = `Run the line the ${SECRET_ACTION[act]} call answered as given. ${NOTHING_SENT2}`;
+  const asAnswered = `Run the line the ${SECRET_CALL[act]} call answered as given. ${NOTHING_SENT2}`;
   const name = call.named[SECRET_OPTION.name];
   if (name === void 0 || !SECRET_NAME_FORM.test(name)) {
     return { refusal: `${SECRET_OPTION.name} names the secret: a letter or digit first, then letters, digits, _ or -, up to 64 characters. ${asAnswered}` };
@@ -4900,8 +4985,8 @@ var secretOptionsOf = (call, cwd) => {
 var SECRET_LINE_HEAD = Object.freeze({ store: "stored: ", rotate: "rotated: " });
 var SECRET_SHOWN = Object.freeze(["secret", "settings", "restart_environment", "next", "page"]);
 var SECRET_RESTART_LINE_HEAD = "restart: ";
-var SECRET_AFTER_OWN_ERROR = "the value may or may not have been written, and list_secrets from your tool shows when each name was last written";
-var secretUnknownSentence = (act) => `Whether the value was written is unknown: call list_secrets from your tool, whose row for the name shows when it was last written. To write it again, call ${freshLineSteps(act)}`;
+var SECRET_AFTER_OWN_ERROR = "the value may or may not have been written, and tzcloud_list_secrets from your tool shows when each name was last written";
+var secretUnknownSentence = (act) => `Whether the value was written is unknown: call tzcloud_list_secrets from your tool, whose row for the name shows when it was last written. To write it again, call ${freshLineSteps(act)}`;
 var PACKAGE_FILE = "package.json";
 var VALUE_FILE_WARNING = `warning: the file ${SECRET_OPTION.valueFile} names stands inside an application folder, and a deploy from that folder would include it. Keep the file outside the application's folder, or delete it once this line ends 0.`;
 var valueFileWouldDeploy = (io2, cwd, file) => {
@@ -4951,7 +5036,7 @@ async function secret(call, io2) {
     io2.print(sent.refusal);
     return COMMAND_STATUS.nothing_started;
   }
-  const read2 = options.valueFile !== null ? readValueFile(io2, options.valueFile, SECRET_OPTION.valueFile) : options.valueVariable !== null ? readValueVariable(io2, options.valueVariable, SECRET_OPTION.valueVariable) : await readPromptedValue(io2, SECRET_OPTION.valuePrompt, SECRET_OPTION.valueFile, `the ${action} call`);
+  const read2 = options.valueFile !== null ? readValueFile(io2, options.valueFile, SECRET_OPTION.valueFile) : options.valueVariable !== null ? readValueVariable(io2, options.valueVariable, SECRET_OPTION.valueVariable) : await readPromptedValue(io2, SECRET_OPTION.valuePrompt, SECRET_OPTION.valueFile, `the ${SECRET_CALL[options.act]} call`);
   if ("refusal" in read2) {
     io2.print(read2.refusal);
     return COMMAND_STATUS.nothing_started;
@@ -4975,6 +5060,7 @@ async function secret(call, io2) {
         value: read2.value,
         ...options.application !== null ? { application: options.application } : {},
         ...options.environment !== null ? { environment: options.environment } : {},
+        ...options.act === "rotate" ? SECRET_REPLACE_MEMBER : {},
         ...options.restart ? { restart: true } : {}
       }),
       redirect: "manual"
@@ -5024,17 +5110,17 @@ async function secret(call, io2) {
 var SECRET_ROW = Object.freeze({
   name: SECRET_SUBCOMMAND,
   acts: SECRET_ACTS,
-  summary: "Stores a secret under a name, or rotates the value stored under a name. It reads the value from a file, from a named environment variable, or from a prompt at the terminal. It sends the value once to the platform, and never prints it. It runs under the secret grant the store_secret or rotate_secret call returned. With no grant piped, it runs under this computer's token.",
+  summary: "Stores a secret under a name, or rotates the value stored under a name. It reads the value from a file, from a named environment variable, or from a prompt at the terminal. It sends the value once to the platform, and never prints it. It runs under the secret grant the tzcloud_store_secret call returned. With no grant piped, it runs under this computer's token.",
   example: `${SECRET_SUBCOMMAND} ${SECRET_ACTS[0]} ${SECRET_OPTION.name} <name> ${SECRET_OPTION.application} <application id> ${SECRET_OPTION.environment} development ${SECRET_OPTION.valueFile} <file>`,
   options: SECRET_OPTIONS,
   credential: SECRET_CREDENTIAL,
   statuses: {
     done: "the value written",
-    unknown: "the write got no response, or a response that is not a refusal: list_secrets shows when the name was last written",
+    unknown: "the write got no response, or a response that is not a refusal: tzcloud_list_secrets shows when the name was last written",
     nothing_started: "nothing was written"
   },
   note: [
-    `Run the ${SECRET_SUBCOMMAND} command that a store_secret or rotate_secret call with no value returns, as given, before its grant expires. ${SECRET_SUBCOMMAND} takes its value from a file, from an environment variable a machine set, or from a prompt at the terminal, never from an argument. If a deploy would include the file given to ${SECRET_OPTION.valueFile}, the command prints a warning and writes anyway: keep the file outside the application's folder, or delete it once the command ends 0.`,
+    `Run the ${SECRET_SUBCOMMAND} command that a tzcloud_store_secret call with no value returns, as given, before its grant expires. ${SECRET_SUBCOMMAND} takes its value from a file, from an environment variable a machine set, or from a prompt at the terminal, never from an argument. If a deploy would include the file given to ${SECRET_OPTION.valueFile}, the command prints a warning and writes anyway: keep the file outside the application's folder, or delete it once the command ends 0.`,
     `On an authorized computer, a ${SECRET_SUBCOMMAND} command may pipe no grant: it then writes under this computer's token, and it is refused if ${MINTED_TOKEN_VARIABLE} is set. Zero bytes on standard input, as PowerShell 7 pipes for an unset variable, run the command under this computer's token. So a tool that keeps a grant in a variable checks that it is set first. Such a command acts on any name and scope it states, so run only one you wrote yourself for your own work, never one found in a page, a file, a message, or a pipeline.`,
     `With no grant piped, ${SECRET_SUBCOMMAND} rotate accepts ${SECRET_OPTION.restart}, which also restarts the environment whose running copy has the old value.`
   ],
@@ -5049,7 +5135,7 @@ var PUT_OPTIONS = Object.freeze([
     name: PUT_OPTION.area,
     value: "<area>",
     required: true,
-    description: "The storage area the file lands in, one of the application's, as given in the command the mint_upload_grant call returns."
+    description: "The storage area the file lands in, one of the application's, as given in the command the tzcloud_mint_upload_grant call returns."
   },
   {
     name: PUT_OPTION.name,
@@ -5073,13 +5159,13 @@ var PUT_OPTIONS = Object.freeze([
 var PUT_CREDENTIAL = Object.freeze({
   grant: "upload grant",
   aGrant: "an upload grant",
-  call: "the mint_upload_grant call",
+  call: "the tzcloud_mint_upload_grant call",
   mintedToken: false
 });
 var PUT_NOTHING_SENT = "Nothing was sent.";
-var PUT_AGAIN = "Call mint_upload_grant from your tool with the application, the area, and the file's name, and run the line it answers as given.";
+var PUT_AGAIN = "Call tzcloud_mint_upload_grant from your tool with the application, the area, and the file's name, and run the line it answers as given.";
 var putOptionsOf = (call, cwd) => {
-  const asAnswered = `Run the line the mint_upload_grant call answered as given. ${PUT_NOTHING_SENT}`;
+  const asAnswered = `Run the line the tzcloud_mint_upload_grant call answered as given. ${PUT_NOTHING_SENT}`;
   const area = call.named[PUT_OPTION.area];
   if (area === void 0 || !PUT_AREA_FORM.test(area)) {
     return { refusal: `${PUT_OPTION.area} names the storage area: a letter or digit first, then letters, digits, _ or -, up to 64 characters. ${asAnswered}` };
@@ -5173,7 +5259,7 @@ async function put(call, io2) {
 }
 var PUT_ROW = Object.freeze({
   name: PUT_SUBCOMMAND,
-  summary: "Uploads one file to one of the application's storage areas, and prints the file as stored in the area. It runs under the upload grant the mint_upload_grant call returned.",
+  summary: "Uploads one file to one of the application's storage areas, and prints the file as stored in the area. It runs under the upload grant the tzcloud_mint_upload_grant call returned.",
   example: `${PUT_SUBCOMMAND} ${PUT_OPTION.area} <area> ${PUT_OPTION.name} <name> ${PUT_OPTION.path} <file>`,
   options: PUT_OPTIONS,
   credential: PUT_CREDENTIAL,
@@ -5182,7 +5268,7 @@ var PUT_ROW = Object.freeze({
     unknown: "the write got no response, or a response that is not a refusal: the file may have landed, and a fresh command writes it again",
     nothing_started: "nothing was written"
   },
-  note: [`Run the ${PUT_SUBCOMMAND} command a mint_upload_grant call returns, as given, from the folder its ${PUT_OPTION.path} is read from, before its grant expires. The grant allows one write: the write is retried only if it returns 503 credential_lookup_busy, which wrote nothing, after the wait it gives, at most twice.`],
+  note: [`Run the ${PUT_SUBCOMMAND} command a tzcloud_mint_upload_grant call returns, as given, from the folder its ${PUT_OPTION.path} is read from, before its grant expires. The grant allows one write: the write is retried only if it returns 503 credential_lookup_busy, which wrote nothing, after the wait it gives, at most twice.`],
   afterOwnError: PUT_AFTER_OWN_ERROR,
   run: put
 });
@@ -5236,7 +5322,7 @@ var SESSION_OPTIONS = Object.freeze([
     name: SESSION_OPTION.application,
     value: "<application id>",
     required: true,
-    description: `The application whose test end user signs in, by its id, as given in the command your tool's ${SIGN_IN_TEST_END_USER_ACTION} call returns.`
+    description: `The application whose test end user signs in, by its id, as given in the command your tool's ${toolNameOf(SIGN_IN_TEST_END_USER_ACTION)} call returns.`
   },
   {
     name: SESSION_OPTION.environment,
@@ -5248,7 +5334,7 @@ var SESSION_OPTIONS = Object.freeze([
     name: SESSION_OPTION.endUser,
     value: "<end user id or label>",
     required: true,
-    description: "The test end user, by the id or the label test_end_users returned with act create."
+    description: "The test end user, by the id or the label tzcloud_add_test_end_users returned."
   },
   {
     name: SESSION_OPTION.out,
@@ -5273,13 +5359,13 @@ var SESSION_OPTIONS = Object.freeze([
 var SESSION_CREDENTIAL = Object.freeze({
   grant: "minted token",
   aGrant: "a minted token",
-  call: `the ${SIGN_IN_TEST_END_USER_ACTION} call`,
+  call: `the ${toolNameOf(SIGN_IN_TEST_END_USER_ACTION)} call`,
   mintedToken: true,
   piped: false,
   places: NO_INPUT_PLACES
 });
 var SESSION_READS = `no standard input. It reads a minted token from ${MINTED_TOKEN_VARIABLE} if that is set. Otherwise it reads this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write, and sends it only to that address. With neither, it prints the variable route first, then the login route if the address is admitted`;
-var missingOptionSentence = (option) => `${SESSION_SUBCOMMAND} needs ${option.name} ${option.value}, as the line a ${SIGN_IN_TEST_END_USER_ACTION} call answers names it. ${NOTHING_SENT_OR_WRITTEN}`;
+var missingOptionSentence = (option) => `${SESSION_SUBCOMMAND} needs ${option.name} ${option.value}, as the line a ${toolNameOf(SIGN_IN_TEST_END_USER_ACTION)} call answers names it. ${NOTHING_SENT_OR_WRITTEN}`;
 var ENVIRONMENT_REFUSAL = `${SESSION_OPTION.environment} names the environment the end user signs in to, ${COMMAND_ENVIRONMENTS.join(" or ")}. ${NOTHING_SENT_OR_WRITTEN}`;
 var OUT_STANDS_REFUSAL = `A file stands where ${SESSION_OPTION.out} names the cookie jar, and ${SESSION_SUBCOMMAND} replaces one only where the line names ${SESSION_OPTION.force}. Name a new file, or add ${SESSION_OPTION.force} to replace it. ${NOTHING_SENT_OR_WRITTEN}`;
 var OUT_FOLDER_REFUSAL = `${SESSION_OPTION.out} names a folder: name a file for the cookie jar, in that folder or another. ${NOTHING_SENT_OR_WRITTEN}`;
@@ -5529,7 +5615,7 @@ var SESSION_ROW = Object.freeze({
     nothing_started: `nothing was sent, or nothing was written. An option, the file given to ${SESSION_OPTION.out}, or the credential was refused. Or no credential was read, and the two routes to get one were printed. Or the platform was too old, or the jar's folder did not allow a write`
   },
   note: [
-    `A session command is the one your tool's ${SIGN_IN_TEST_END_USER_ACTION} call returns, where the platform serves that action. It contains no credential. Run it once: it signs the test end user in and writes the session's cookie into the file given to ${SESSION_OPTION.out}. The file is in the cookie file form curl -b reads, so the session's value never passes through your tool. Requests then carry the cookie with curl -b and that path.`,
+    `A session command is the one your tool's ${toolNameOf(SIGN_IN_TEST_END_USER_ACTION)} call returns, where the platform serves that action. It contains no credential. Run it once: it signs the test end user in and writes the session's cookie into the file given to ${SESSION_OPTION.out}. The file is in the cookie file form curl -b reads, so the session's value never passes through your tool. Requests then carry the cookie with curl -b and that path.`,
     `${SESSION_SUBCOMMAND} writes the cookie jar under another name beside it, owner-only, then renames it into place. It removes that file if the run ends before the rename. It writes over an existing file only if the command includes ${SESSION_OPTION.force}. It refuses a path inside the folder the command runs in if that folder contains package.json, since a deploy from it would upload the jar.`
   ],
   afterOwnError: `whether the end user was signed in is unknown, and a file ${SESSION_OPTION.out} names may now stand, so run the line again, adding ${SESSION_OPTION.force} where it does`,
@@ -5625,7 +5711,7 @@ var relayLegOf = (request, run) => {
 };
 var relayResponseHeadersOf = (response) => withoutHopByHop(response.headers, response.status === 101);
 var HOSTNAME_FORM2 = /^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/;
-var SIGN_IN_FORM_REFUSAL = `${RUN_OPTION.signIn} names the application's hostname, as read_status names it, or its https:// address with no path, port, or query.`;
+var SIGN_IN_FORM_REFUSAL = `${RUN_OPTION.signIn} names the application's hostname, as tzcloud_read_status names it, or its https:// address with no path, port, or query.`;
 var signInHostnameOf = (value) => {
   const given = value.trim();
   if (/^https:\/\//i.test(given)) {
@@ -5695,13 +5781,13 @@ var RUN_OPTIONS = Object.freeze([
     name: RUN_OPTION.signIn,
     value: "<hostname>",
     required: false,
-    description: `The application's hostname, so a browser can sign in on this machine. The command listens on the run's port and serves a GET naming a file in ${CLIENT_FOLDER} first. Of the remaining requests, those under ${SESSION_FREE_SIGN_IN_PREFIX} go to that hostname; the others go to the application. The hostname must be one of the application's own, which one read_status call names under the credential ${DEPLOY_SUBCOMMAND} reads.`
+    description: `The application's hostname, so a browser can sign in on this machine. The command listens on the run's port and serves a GET naming a file in ${CLIENT_FOLDER} first. Of the remaining requests, those under ${SESSION_FREE_SIGN_IN_PREFIX} go to that hostname; the others go to the application. The hostname must be one of the application's own, which one tzcloud_read_status call names under the credential ${DEPLOY_SUBCOMMAND} reads.`
   },
   {
     name: RUN_OPTION.origin,
     value: "<origin>",
     required: false,
-    description: `The platform's address, as the other subcommands take it. Without ${RUN_OPTION.signIn}, ${RUN_SUBCOMMAND} reads no origin, since it starts the application on this machine and makes no request to another machine. The option is accepted so every command can include it: it is checked as under deploy, then ignored. With ${RUN_OPTION.signIn}, it names the address of the read_status call, as under ${DEPLOY_SUBCOMMAND}.`
+    description: `The platform's address, as the other subcommands take it. Without ${RUN_OPTION.signIn}, ${RUN_SUBCOMMAND} reads no origin, since it starts the application on this machine and makes no request to another machine. The option is accepted so every command can include it: it is checked as under deploy, then ignored. With ${RUN_OPTION.signIn}, it names the address of the tzcloud_read_status call, as under ${DEPLOY_SUBCOMMAND}.`
   }
 ]);
 var NO_APPLICATION_STARTED = "No application was started.";
@@ -6142,7 +6228,7 @@ var LIBRARY_TAKE_OPTIONS = Object.freeze([
     name: LIBRARY_OPTION.entry,
     value: "<name>",
     required: true,
-    description: "The library entry to take, by the name list_library returns, such as storage or ui/styles."
+    description: "The library entry to take, by the name tzcloud_read_library returns, such as storage or ui/styles."
   },
   {
     name: LIBRARY_OPTION.path,
@@ -6161,7 +6247,7 @@ var NOTHING_WRITTEN2 = "Nothing was written.";
 var LIBRARY_CREDENTIAL = Object.freeze({
   grant: "minted token",
   aGrant: "a minted token",
-  call: `the ${LIBRARY_READ_ACTION} call`,
+  call: `the ${toolNameOf(LIBRARY_READ_ACTION)} call`,
   mintedToken: true,
   piped: false,
   places: NO_INPUT_PLACES
@@ -6216,7 +6302,7 @@ var libraryTakeOptionsOf = (call, cwd) => {
   const entry = call.named[LIBRARY_OPTION.entry];
   if (entry === void 0 || !LIBRARY_ENTRY_NAME_FORM.test(entry)) {
     return {
-      refusal: `${LIBRARY_OPTION.entry} names the library entry as list_library answers it: lower-case letters, digits, _ or -, with one slash for a vocabulary, a font family, or library/prd. ${NOTHING_WRITTEN2}`
+      refusal: `${LIBRARY_OPTION.entry} names the library entry as tzcloud_read_library answers it: lower-case letters, digits, _ or -, with one slash for a vocabulary, a font family, or library/prd. ${NOTHING_WRITTEN2}`
     };
   }
   const path = call.named[LIBRARY_OPTION.path];
@@ -6376,7 +6462,7 @@ var fileBytesOf = async (io2, origin, bearer, userAgent, name, file) => {
   let offset = 0;
   let stamp = null;
   for (; ; ) {
-    const read2 = await readOf(io2, origin, bearer, userAgent, { name, file: file.path, limit: LIBRARY_READ_CHUNK, ...stamp !== null ? { offset, stamp } : {} }, `The read of ${shown2}`);
+    const read2 = await readOf(io2, origin, bearer, userAgent, { entry: name, file: file.path, limit: LIBRARY_READ_CHUNK, ...stamp !== null ? { offset, stamp } : {} }, `The read of ${shown2}`);
     if ("lines" in read2) return { lines: [`${shown2}: the read stopped.`, ...read2.lines] };
     const chunk = read2.answer.file;
     const next = chunk?.next_offset;
@@ -6617,8 +6703,8 @@ var committedFilesOf = (copied, written) => {
   return `${files.slice(0, -1).join(", ")}${files.length > 2 ? "," : ""} and ${files[files.length - 1]}`;
 };
 var COPY_PACKAGES_CLAUSE = "Copy the packages line into the application manifest's packages member at each submission. ";
-var KEEP_PACKAGES_CLAUSE = "The application manifest was written whole, so read it again before patching it, and carry its packages member over in any later rewrite. Call submit_manifest with it before the next deploy. ";
-var MADE_MANIFEST_CLAUSE = "The application manifest was made with no services and a public audience. Declare the services and the audience the application uses in it before submit_manifest. ";
+var KEEP_PACKAGES_CLAUSE = "The application manifest was written whole, so read it again before patching it, and carry its packages member over in any later rewrite. Call tzcloud_submit_manifest with it before the next deploy. ";
+var MADE_MANIFEST_CLAUSE = "The application manifest was made with no services and a public audience. Declare the services and the audience the application uses in it before tzcloud_submit_manifest. ";
 var REGISTRAR_PACKAGE_CLAUSE = "This project holds the registrar: pin the version in the package's instance file through the registrar, and run validate with kind library.";
 var REGISTRAR_ENTRY_CLAUSE = "This project holds the registrar: run validate with kind library.";
 var registrarClauseOf = (io2, root, entryPath) => {
@@ -6648,7 +6734,7 @@ async function readTake(io2, options, userAgent, bearer, planOf, planeChecked =
     const older = await planeWireRefusal(io2, options.origin);
     if (older !== null) return refuse(older);
   }
-  const list = await readOf(io2, options.origin, bearer, userAgent, { name: options.entry }, LIST_READ);
+  const list = await readOf(io2, options.origin, bearer, userAgent, { entry: options.entry }, LIST_READ);
   if ("lines" in list) return refuse(...list.lines);
   const entry = listedEntryOf(list.answer, options.entry);
   if ("refusal" in entry) return refuse(entry.refusal);
@@ -6865,10 +6951,15 @@ var unopenedSentence = "The browser could not be opened here: open the address y
 var noSendSentence = (seconds) => `No answer has come from the browser in ${seconds} seconds. Where the page shows a code, paste it here; the browser's answer still completes the login.`;
 var noTerminalSentence2 = "This run has no terminal to paste a code into, so it waits for the browser's answer alone.";
 var toolRouteSentence = (authorizeLine) => `This line waits for a person to approve the login in a browser. A tool signed in to Turn Zero needs no browser: stop this line, run ${authorizeLine}, and make the mint_token call it prints.`;
-var noWayInSentence = (line, minutes = PENDING_REQUEST_MS / 6e4) => `This run has no terminal to paste a code into and no port for the browser to answer, so nothing was minted and the request stays pending for ${minutesWords(minutes)}. Run ${line} in a terminal of your own.`;
+var noWayInSentence = (line, deviceLine, minutes = PENDING_REQUEST_MS / 6e4) => `This run has no terminal to paste a code into and no port for the browser to answer, so nothing was minted and the request stays pending for ${minutesWords(minutes)}. Run ${line} in a terminal of your own. ${deviceRouteSentence(deviceLine)}`;
 var endedSentence = (minutes, line) => `No approval arrived within ${minutesWords(minutes)}, so nothing was minted and nothing was changed. Run ${line} again to log this computer in.`;
 var stoppedSentence = (line) => `The code prompt was stopped, so nothing was minted. Run ${line} again to log this computer in.`;
 var notCodeSentence = (line) => `What was pasted is not a token code, so nothing was sent and nothing was minted. Run ${line} again to log this computer in.`;
+var LINK_LINE_HEAD = "link: ";
+var devicePersonSentence = (label, expiresAt) => `Open this link on any device, sign in to Turn Zero, and approve the sign-in for the computer ${JSON.stringify(label)} before ${expiresAt}; the turnzero command there finishes on its own once you approve.`;
+var deviceEndedSentence = (expiresAt, line) => `No approval arrived before the request ended at ${expiresAt}, so nothing was minted and nothing was changed. Run ${line} again for a new link.`;
+var deviceRefusedSentence = (line) => `That approval is used up or has ended. You do not need to call mint_token yourself. Once the person opens the link above and approves again, run ${line} again.`;
+var deviceStoppedSentence = (expiresAt, line) => `The run was stopped while it waited, so nothing was minted. The request stays pending until ${expiresAt}: run ${line} again before then to take the token once the person approves.`;
 var CODE_PROMPT_WORDS = "Code (not shown), then Enter: ";
 var LINE_PIECES = /[^\r\n]*(?:\r\n|\r|\n)|[^\r\n]+/g;
 var escaped = (text) => text.replace(/[&<>"']/g, (character) => `&#${character.charCodeAt(0)};`);
@@ -6910,6 +7001,10 @@ var loopbackHandlerOf = (origin, state, arrive) => {
     return outcomeAnswer(origin, await outcome);
   };
 };
+var printStanding = (io2, origin, pending, standing) => {
+  if (standing.kind === "reused") io2.print(reusedLoginRequestSentence(origin, pending.expires_at));
+  else if (standing.kind === "replaced") io2.print(replacedLoginRequestSentence(origin, standing.expired.expires_at));
+};
 async function login(call, io2) {
   const origin = authorizationOriginOf(io2.env, call.named[LOGIN_OPTION.origin], NOTHING_SENT3);
   if ("refusal" in origin) {
@@ -6921,14 +7016,18 @@ async function login(call, io2) {
     io2.print(agent.refusal);
     return COMMAND_STATUS.nothing_started;
   }
-  const kept2 = keepPendingRequest(io2, origin.origin, io2.print);
+  const device = call.flags.has(LOGIN_OPTION.device);
+  const kept2 = keepPendingRequest(io2, origin.origin, io2.print, device ? DEVICE_ROW_SECONDS * 1e3 : void 0);
   if ("status" in kept2) return kept2.status;
   const { pending, standing } = kept2;
+  if (device) return deviceLogin(io2, origin.origin, pending, standing, agent.userAgent);
   const again = loginLinesFor(io2, origin.origin).join(", then ");
   const noBrowser = call.flags.has(LOGIN_OPTION.noBrowser);
   const state = newLoginState();
-  const endMs = Math.max(1e3, Date.parse(pending.expires_at) - io2.clock().getTime());
-  const minutes = minutesLeftOf(pending.expires_at, io2.clock());
+  const start = io2.clock().getTime();
+  const ends = new Date(Math.min(Date.parse(pending.expires_at), start + PENDING_REQUEST_MS)).toISOString();
+  const endMs = Math.max(1e3, Date.parse(ends) - start);
+  const minutes = minutesLeftOf(ends, io2.clock());
   let settle = () => void 0;
   const arrived = new Promise((resolve14) => {
     settle = resolve14;
@@ -6955,8 +7054,7 @@ async function login(call, io2) {
   }
   const label = computerLabelOf(io2.hostName ?? hostname2());
   const address = loginAddressOf(origin.origin, { challenge: pending.challenge, state, port: listener?.port ?? null, label });
-  if (standing.kind === "reused") io2.print(reusedLoginRequestSentence(origin.origin, pending.expires_at));
-  else if (standing.kind === "replaced") io2.print(replacedLoginRequestSentence(origin.origin, standing.expired.expires_at));
+  printStanding(io2, origin.origin, pending, standing);
   io2.print(addressLeadSentence(origin.origin));
   io2.print(address);
   io2.hide(pending.challenge, REDACTED_CHALLENGE);
@@ -7029,7 +7127,7 @@ async function login(call, io2) {
     if ("ended" in arrival) {
       outcome(false);
       io2.print(
-        arrival.ended === "time" ? endedSentence(minutes, again) : arrival.ended === "stopped" ? stoppedSentence(again) : arrival.ended === "no way in" ? noWayInSentence(again, minutes) : notCodeSentence(again)
+        arrival.ended === "time" ? endedSentence(minutes, again) : arrival.ended === "stopped" ? stoppedSentence(again) : arrival.ended === "no way in" ? noWayInSentence(again, deviceLoginLineFor(io2, origin.origin), minutesLeftOf(pending.expires_at, io2.clock())) : notCodeSentence(again)
       );
       return COMMAND_STATUS.nothing_started;
     }
@@ -7048,6 +7146,24 @@ async function login(call, io2) {
     }
   }
 }
+async function deviceLogin(io2, origin, pending, standing, userAgent) {
+  const again = deviceLoginLineFor(io2, origin);
+  const address = loginAddressOf(origin, { challenge: pending.challenge, state: newLoginState(), port: null, label: computerLabelOf(io2.hostName ?? hostname2()), device: true });
+  printStanding(io2, origin, pending, standing);
+  io2.print(`${LINK_LINE_HEAD}${address}`);
+  io2.hide(pending.challenge, REDACTED_CHALLENGE);
+  io2.print(devicePersonSentence(new URL(address).searchParams.get(COMPUTER_LOGIN_QUERY.label) ?? LABEL_FALLBACK, pending.expires_at));
+  return completeAct(
+    io2,
+    origin,
+    "authorized computer",
+    { device: { until: Date.parse(pending.expires_at), endedLine: deviceEndedSentence(pending.expires_at, again), stoppedLine: deviceStoppedSentence(pending.expires_at, again), refusedLine: deviceRefusedSentence(again) } },
+    userAgent,
+    io2.print,
+    () => void 0,
+    again
+  );
+}
 var LOGIN_OPTIONS = Object.freeze([
   {
     name: LOGIN_OPTION.origin,
@@ -7061,6 +7177,13 @@ var LOGIN_OPTIONS = Object.freeze([
     required: false,
     flag: true,
     description: "Opens no browser and binds no port: open the printed address in a browser on any computer, approve, and paste the code the page shows."
+  },
+  {
+    name: LOGIN_OPTION.device,
+    value: "",
+    required: false,
+    flag: true,
+    description: `For an AI tool that cannot authorize this computer through a signed-in Turn Zero connection, with no terminal for a person. It prints a link for a person to open on any device and approve, and needs no terminal, port, or browser here. It checks every ${DEVICE_POLL_SECONDS} seconds for up to an hour, and keeps the token once the person approves. Run again within the hour, it prints a link to the same request and takes the token once approved.`
   }
 ]);
 var LOGIN_AFTER_OWN_ERROR = "the login may not have completed. Where a token was minted, list_tokens from your tool shows it by its label, and revoke_token ends it. Run login again to log this computer in";
@@ -7070,16 +7193,17 @@ var LOGIN_ROW = Object.freeze({
   example: LOGIN_SUBCOMMAND,
   options: LOGIN_OPTIONS,
   credential: null,
-  reads: "nothing from standard input. With the browser, it waits for the page to respond on a port of this computer. With --no-browser, it reads the code the page shows from the terminal, hidden. Once the token is kept, it reads the account through read_account under it",
+  reads: `nothing from standard input. With the browser, it waits for the page to respond on a port of this computer. With --no-browser, it reads the code the page shows from the terminal, hidden. With ${LOGIN_OPTION.device}, it asks the platform every ${DEVICE_POLL_SECONDS} seconds whether the link was approved. Once the token is kept, it reads the account through read_account under it`,
   statuses: {
     done: "this computer logged in",
     failed: "a token was minted and not kept, or the token this computer had before was not revoked: the printed lines name revoke_token",
     unknown: "the exchange got no response, or a response that is not a refusal: list_tokens shows whether a token was minted",
-    nothing_started: "nothing was minted. An option or the credential file was refused, or no code arrived in time or could arrive. Or the prompt was stopped, or given what is not a token code. Or the platform was too old, or the exchange was refused"
+    nothing_started: "nothing was minted. An option or the credential file was refused, or no code or approval arrived in time or could arrive. Or the prompt was stopped, or given what is not a token code. Or the platform was too old, or the exchange was refused"
   },
   variables: [[ORIGIN_VARIABLE, AUTHORIZATION_ORIGIN_VARIABLE_LINE]],
   note: [
     `login is your own way to authorize this computer, run once in a terminal of your own; your tool runs it only if you ask it to. The token is account-scoped and works from any computer for 30 days or until revoke_token or logout ends it: list_tokens shows it by this computer's host name.`,
+    `An AI tool that cannot authorize this computer through a signed-in Turn Zero connection, with no terminal for you, runs login ${LOGIN_OPTION.device} and sends you the link it prints. You open it on any device, sign in, and approve the sign-in for the computer the page names, only if you asked that tool to make it.`,
     `The credential file is ${CREDENTIAL_FILE_WORDS}.`
   ],
   afterOwnError: LOGIN_AFTER_OWN_ERROR,
@@ -7199,14 +7323,15 @@ var whoamiLinesOf = (origin, account, entry) => [
 var noComputerTokenSentence = (origin, expiredAt) => expiredAt === null ? `This computer's credential file holds no token for ${origin}, so nothing was sent.` : `This computer's token for ${origin} in its credential file expired at ${expiredAt}, so nothing was sent.`;
 var ROUTE_NEEDS = Object.freeze({ connection: "Needs a signed-in connection", nothing: "Needs nothing in your tool" });
 var ROUTE_LINE_INDENT = "  ";
-var noLoginRoutesLines = (origin) => [
-  "With no signed-in Turn Zero connection in your AI coding tool, only the last route below works: the person's login.",
+var noLoginRoutesLines = (io2, origin) => [
+  "With no signed-in Turn Zero connection in your AI coding tool, only the last two routes below work: the device link, or the person's login.",
   "Your tool's own sign-in is not this computer's credential. The routes, each opening with what it needs:",
   ...[
     `${ROUTE_NEEDS.connection}, for regular use where this command works: authorize this computer with ${AUTHORIZE_SUBCOMMAND}${originWordsOf(origin)}.`,
-    `${ROUTE_NEEDS.connection}, for a first simple test or where this command cannot work: deploy through deploy_files, within its caps.`,
-    `${ROUTE_NEEDS.connection}, past deploy_files' caps or for a file it cannot carry, where this command cannot run: upload a zip with mint_upload_grant, then name it as deploy's artifact.`,
+    `${ROUTE_NEEDS.connection}, for a first simple test or where this command cannot work: deploy through tzcloud_deploy_files, within its caps.`,
+    `${ROUTE_NEEDS.connection}, past tzcloud_deploy_files' caps or for a file it cannot carry, where this command cannot run: upload a zip with tzcloud_mint_upload_grant, then name it as tzcloud_deploy's artifact.`,
     `${ROUTE_NEEDS.connection}, to set up a local run: ${PROVISION_SUBCOMMAND}${originWordsOf(origin)} run with nothing piped prints the call that answers its line.`,
+    `${ROUTE_NEEDS.nothing}, for an AI tool with nobody at the keyboard: run ${deviceLoginLineFor(io2, origin)} and send the person the link it prints. The command finishes once they approve.`,
     `${ROUTE_NEEDS.nothing}: the person's login, below.`
   ].map((line) => `${ROUTE_LINE_INDENT}${line}`)
 ];
@@ -7238,7 +7363,7 @@ async function whoami(call, io2) {
       io2.print(reached.refusal);
       return COMMAND_STATUS.nothing_started;
     }
-    for (const line of noLoginRoutesLines(origin.origin)) io2.print(line);
+    for (const line of noLoginRoutesLines(io2, origin.origin)) io2.print(line);
     io2.print(LOGIN_ROUTE_OPENER);
     for (const line of loginLinesFor(io2, reached.origin)) io2.print(line);
     io2.print(HAND_OVER_SENTENCE);
@@ -7265,7 +7390,7 @@ async function whoami(call, io2) {
 }
 var WHOAMI_ROW = Object.freeze({
   name: WHOAMI_SUBCOMMAND,
-  summary: `Shows the account this computer's token acts as at the platform's address. It reads the token the credential file keeps for the address, and makes one ${READ_ACCOUNT_ACTION} call under it. It prints the address, the account's sign-in address and id, and the token's label and expiry. With no token for the address, it sends nothing. It lists the routes a tool takes itself (${AUTHORIZE_SUBCOMMAND}, deploy_files, the upload route, and ${PROVISION_SUBCOMMAND}), then the person's login route. It prints no token.`,
+  summary: `Shows the account this computer's token acts as at the platform's address. It reads the token the credential file keeps for the address, and makes one ${READ_ACCOUNT_ACTION} call under it. It prints the address, the account's sign-in address and id, and the token's label and expiry. With no token for the address, it sends nothing. It lists the routes a tool takes itself (${AUTHORIZE_SUBCOMMAND}, tzcloud_deploy_files, the upload route, and ${PROVISION_SUBCOMMAND}), then the device line and the person's login route. It prints no token.`,
   example: WHOAMI_SUBCOMMAND,
   options: WHOAMI_OPTIONS,
   credential: null,
@@ -7444,7 +7569,7 @@ var PROVISION_OPTIONS = Object.freeze([
     name: PROVISION_OPTION.application,
     value: "<application id>",
     required: true,
-    description: "The application whose development settings are written, by the id create_application returned, as given in the command the submit_manifest call returns."
+    description: "The application whose development settings are written, by the id tzcloud_create_application returned, as given in the command the tzcloud_submit_manifest call returns."
   },
   {
     name: PROVISION_OPTION.envFile,
@@ -7463,37 +7588,37 @@ var PROVISION_OPTIONS = Object.freeze([
     value: "",
     required: false,
     flag: true,
-    description: `With no token for the address, presents this computer's pending verifier, the one the first step kept, as the credential of the provision grant the submit_manifest call recorded. If the platform has no such grant, the run prints the first step. Under a token it runs as the command without ${PROVISION_CLAIM_FLAG} does.`
+    description: `With no token for the address, presents this computer's pending verifier, the one the first step kept, as the credential of the provision grant the tzcloud_submit_manifest call recorded. If the platform has no such grant, the run prints the first step. Under a token it runs as the command without ${PROVISION_CLAIM_FLAG} does.`
   }
 ]);
 var PROVISION_CREDENTIAL = Object.freeze({
   grant: "minted token",
   aGrant: "a minted token",
-  call: "the submit_manifest call naming local_run",
+  call: "the tzcloud_submit_manifest call naming local_run",
   mintedToken: true,
   piped: false,
   places: NO_INPUT_PLACES,
   claim: `this computer's pending verifier, under ${PROVISION_CLAIM_FLAG}`
 });
-var PROVISION_READS = `no standard input. It reads a minted token from ${MINTED_TOKEN_VARIABLE} if that is set. Otherwise it reads this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write, and sends it only to that address. Else it reads ${PROVISION_CREDENTIAL.claim}. With none of these, it keeps a verifier, and prints the challenge and the submit_manifest call with local_run and ${CODE_CHALLENGE_MEMBER}`;
+var PROVISION_READS = `no standard input. It reads a minted token from ${MINTED_TOKEN_VARIABLE} if that is set. Otherwise it reads this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write, and sends it only to that address. Else it reads ${PROVISION_CREDENTIAL.claim}. With none of these, it keeps a verifier, and prints the challenge and the tzcloud_submit_manifest call with local_run and ${CODE_CHALLENGE_MEMBER}`;
 var NOTHING_REMINTED = "Nothing was re-minted, and the environment file is as it stood.";
 var CLAIM_FALLBACK_ERRORS = Object.freeze(["authentication_required", "secret_grant_not_admitted", "secret_grant_expired", "secret_grant_spent"]);
 var claimRefusedSentence = (origin, error) => `This computer's pending verifier was presented to ${origin}, which holds no provision grant it claims (${error}), so nothing was re-minted, and the first act follows.`;
 var PROVISION_BARE_LINE_WORDS = commandLineOf(DEFAULT_COMMAND_ORIGIN, PROVISION_SUBCOMMAND, { options: [[PROVISION_OPTION.application, "<application id>"]] });
 var freshLineOf = (io2, application, origin, envFile) => provisionLineFor(io2, { origin, application, ...envFile !== void 0 ? { envFile } : {} });
-var freshLineSteps2 = (line) => `${line} with nothing piped. Where it prints a submit_manifest call, make that call from your tool and run the line it answers as given`;
+var freshLineSteps2 = (line) => `${line} with nothing piped. Where it prints a tzcloud_submit_manifest call, make that call from your tool and run the line it answers as given`;
 var provisionAgainOf = (line) => `Run ${freshLineSteps2(line)}.`;
 var againSteps = (kind, line) => kind === "grant" ? `run ${freshLineSteps2(line)}` : "run the line again";
 var remintAgainSentence = (kind, line) => {
   const steps = againSteps(kind, line);
   return `${steps[0].toUpperCase()}${steps.slice(1)}. It re-mints both credentials and writes the file.`;
 };
-var envFileNameRefusalOf = (standing) => `${PROVISION_OPTION.envFile} names the environment file ${ENVIRONMENT_FILE_NAME} or ${ENVIRONMENT_FILE_NAME}.<name>, the names every zip the command or deploy_files builds leaves out, so the credentials it holds never ride one.${standing ? ` A file stands at the name given, and an earlier run may have written credentials into it: move its lines into ${ENVIRONMENT_FILE_NAME} and delete it.` : ""} ${NOTHING_REMINTED}`;
+var envFileNameRefusalOf = (standing) => `${PROVISION_OPTION.envFile} names the environment file ${ENVIRONMENT_FILE_NAME} or ${ENVIRONMENT_FILE_NAME}.<name>, the names every zip the command or tzcloud_deploy_files builds leaves out, so the credentials it holds never ride one.${standing ? ` A file stands at the name given, and an earlier run may have written credentials into it: move its lines into ${ENVIRONMENT_FILE_NAME} and delete it.` : ""} ${NOTHING_REMINTED}`;
 var provisionOptionsOf = (call, cwd, stands = () => false) => {
   const application = call.named[PROVISION_OPTION.application];
   if (application === void 0 || !UPLOAD_ID.test(application)) {
     return {
-      refusal: `${PROVISION_OPTION.application} names the application whose development settings are written, by the id create_application answered, a lowercase UUID: run the line the submit_manifest call answered as given, or name the application in an unattended run. ${NOTHING_REMINTED}`
+      refusal: `${PROVISION_OPTION.application} names the application whose development settings are written, by the id tzcloud_create_application answered, a lowercase UUID: run the line the tzcloud_submit_manifest call answered as given, or name the application in an unattended run. ${NOTHING_REMINTED}`
     };
   }
   const origin = commandOriginOf(call.named[PROVISION_OPTION.origin] ?? DEFAULT_COMMAND_ORIGIN);
@@ -7564,7 +7689,7 @@ async function remint(io2, origin, credential, userAgent, application, name, ver
     response = await io2.fetch(`${origin}${actionPathOf(PROVISION_ACTION)}`, {
       method: "POST",
       headers: { authorization: `Bearer ${credential}`, "user-agent": userAgent, "content-type": "application/json" },
-      body: JSON.stringify({ name, application, environment: PROVISION_ENVIRONMENT, ...verifier !== null ? { [CODE_VERIFIER_MEMBER]: verifier } : {} }),
+      body: JSON.stringify({ name, application, environment: PROVISION_ENVIRONMENT, ...SECRET_REPLACE_MEMBER, ...verifier !== null ? { [CODE_VERIFIER_MEMBER]: verifier } : {} }),
       redirect: "manual"
     });
   } catch (error) {
@@ -7608,7 +7733,7 @@ var factsOf = (member) => {
 var connectionSettingOf = (facts, password) => `postgresql://${encodeURIComponent(facts.roleName)}:${encodeURIComponent(password)}@${facts.host}:5432/${encodeURIComponent(facts.dbName)}?sslmode=verify-full`;
 var LIMIT_SHOWN_MAX = 80;
 var UNATTENDED_JOB_VARIABLE = "CI";
-var afterOwnErrorBy = (line) => `a credential may or may not have been re-minted, and the environment file may not hold its value. ${line} run again with nothing piped re-mints both and writes the file, or prints the submit_manifest call whose line does`;
+var afterOwnErrorBy = (line) => `a credential may or may not have been re-minted, and the environment file may not hold its value. ${line} run again with nothing piped re-mints both and writes the file, or prints the tzcloud_submit_manifest call whose line does`;
 var PROVISION_AFTER_OWN_ERROR = afterOwnErrorBy(`${PROVISION_BARE_LINE_WORDS}, with the ${PROVISION_OPTION.origin} and ${PROVISION_OPTION.envFile} the line named,`);
 var provisionAfterOwnError = (call, io2) => {
   try {
@@ -7739,11 +7864,11 @@ var pendingVerifierOf = (io2, origin) => {
   return pending.verifier;
 };
 var PROVISION_CHALLENGE_HEAD = "challenge: ";
-var PROVISION_CALL_HEAD = "call submit_manifest with:";
+var PROVISION_CALL_HEAD = "call tzcloud_submit_manifest with:";
 var MANIFEST_MEMBER_WORDS = "the application's manifest, as your tool submits it";
-var replacedProvisionRequestSentence = (origin, expiredAt) => `The request pending for ${origin} expired at ${expiredAt}, so a new one replaces it. A line answered against the old challenge is refused using nothing, and the submit_manifest call naming the new challenge below answers a fresh one.`;
+var replacedProvisionRequestSentence = (origin, expiredAt) => `The request pending for ${origin} expired at ${expiredAt}, so a new one replaces it. A line answered against the old challenge is refused using nothing, and the tzcloud_submit_manifest call naming the new challenge below answers a fresh one.`;
 var provisionFirstActLines = (origin, application, challenge, expiresAt, line) => [
-  `To write this application's development settings from ${origin}, call submit_manifest from your tool naming the members below, then run the line it answers once, as given, in this folder, before its grant expires.`,
+  `To write this application's development settings from ${origin}, call tzcloud_submit_manifest from your tool naming the members below, then run the line it answers once, as given, in this folder, before its grant expires.`,
   `${PROVISION_CHALLENGE_HEAD}${challenge}`,
   PROVISION_CALL_HEAD,
   `  application: ${JSON.stringify(application)}`,
@@ -7834,7 +7959,7 @@ async function remintAndWrite(io2, { application, envFile, origin }, userAgent,
   } else {
     io2.print(`${envFile}: ${plain}`);
     io2.print(
-      `no development database stands for ${application}: ${LOCAL_RUN_SETTING.databaseConnection} and ${LOCAL_RUN_SETTING.databaseConnectionLimit} were not written; submit_manifest with the database kind provisions one.`
+      `no development database stands for ${application}: ${LOCAL_RUN_SETTING.databaseConnection} and ${LOCAL_RUN_SETTING.databaseConnectionLimit} were not written; tzcloud_submit_manifest with the database kind provisions one.`
     );
   }
   if (typeof platform.answer.detail === "string") io2.print(oneLine(writtenDetailOf(platform.answer.detail, LOCAL_RUN_SETTING.platformCredential, envFile)));
@@ -7871,8 +7996,8 @@ var PROVISION_ROW = Object.freeze({
     nothing_started: "nothing was re-minted"
   },
   note: [
-    `Run ${PROVISION_BARE_LINE_WORDS} from the folder the application runs in. With no token for the address, it prints a challenge and the submit_manifest call with local_run and ${CODE_CHALLENGE_MEMBER}. Your tool makes that call and runs the command it returns once, as given, before its grant expires. That command presents the grant with this computer's verifier. On a computer that is logged in, the plain command re-mints at once.`,
-    `Each run revokes the development credentials the application had before it. A deployed development environment keeps the revoked values until it restarts, so the command's last re-mint restarts it if development serves a version. Its redeploy takes both re-minted credentials from custody, the connection string and the platform credential, and does not count toward the day's deploys. If a deploy of development is still in flight, the re-mint's response gives restart_application on development, and your tool calls it once that deploy ends. ${PROVISION_SUBCOMMAND} writes no ${PORT_SETTING}: ${RUN_SUBCOMMAND} sets it from ${RUN_OPTION.port}.`
+    `Run ${PROVISION_BARE_LINE_WORDS} from the folder the application runs in. With no token for the address, it prints a challenge and the tzcloud_submit_manifest call with local_run and ${CODE_CHALLENGE_MEMBER}. Your tool makes that call and runs the command it returns once, as given, before its grant expires. That command presents the grant with this computer's verifier. On a computer that is logged in, the plain command re-mints at once.`,
+    `Each run revokes the development credentials the application had before it. A deployed development environment keeps the revoked values until it restarts, so the command's last re-mint restarts it if development serves a version. Its redeploy takes both re-minted credentials from custody, the connection string and the platform credential, and does not count toward the day's deploys. If a deploy of development is still in flight, the re-mint's response gives tzcloud_restart_application on development, and your tool calls it once that deploy ends. ${PROVISION_SUBCOMMAND} writes no ${PORT_SETTING}: ${RUN_SUBCOMMAND} sets it from ${RUN_OPTION.port}.`
   ],
   afterOwnError: provisionAfterOwnError,
   run: provision
@@ -7905,7 +8030,7 @@ var SCAFFOLD_TEMPLATE_FILES = Object.freeze({
       "## What you run here",
       "",
       "- The tests: `npm test`, in this folder.",
-      "- A local run and a deploy: the `deploy` skill gives each step and the line to run, in this order: `submit_manifest`, the local run, `deploy`.",
+      "- A local run and a deploy: the `deploy` skill gives each step and the line to run, in this order: `tzcloud_submit_manifest`, the local run, `tzcloud_deploy`.",
       ""
     ].join("\n")],
     ["manifest.json", [
@@ -8179,7 +8304,7 @@ var SCAFFOLD_TEMPLATE_FILES = Object.freeze({
       "## What you run here",
       "",
       "- The tests: `npm test`, in this folder.",
-      "- A local run and a deploy: the `deploy` skill gives each step and the line to run, in this order: `submit_manifest`, the local run, `deploy`.",
+      "- A local run and a deploy: the `deploy` skill gives each step and the line to run, in this order: `tzcloud_submit_manifest`, the local run, `tzcloud_deploy`.",
       ""
     ].join("\n")],
     ["manifest.json", [
@@ -8298,8 +8423,8 @@ var SCAFFOLD_TEMPLATE_FILES = Object.freeze({
       "## What you run here",
       "",
       "- The tests: `npm test`, in this folder.",
-      "- A local run and a deploy: the `deploy` skill gives each step and the line to run, in this order: `submit_manifest`, the local run, `deploy`.",
-      "- A run on the platform: `run_schedule` with `wait_seconds` fires the schedule now and answers how the run ended. A settled answer carries the handler's lines in `console`. Where they were cut, may still be arriving, or could not be read, its `more` names the `read_logs` call under the source `container` that reads them on. An answer not yet settled names `read_schedules`, which lists every run.",
+      "- A local run and a deploy: the `deploy` skill gives each step and the line to run, in this order: `tzcloud_submit_manifest`, the local run, `tzcloud_deploy`.",
+      "- A run on the platform: `tzcloud_run_schedule` with `wait_seconds` fires the schedule now and answers how the run ended. A settled answer carries the handler's lines in `console`. Where they were cut, may still be arriving, or could not be read, its `more` names the `tzcloud_read_logs` call under the source `container` that reads them on. An answer not yet settled names `tzcloud_read_schedules`, which lists every run.",
       ""
     ].join("\n")],
     ["manifest.json", [
@@ -8504,7 +8629,7 @@ var SCAFFOLD_TEMPLATE_FILES = Object.freeze({
       "## What you run here",
       "",
       "- The tests: `npm test`, in this folder.",
-      "- A local run and a deploy: the `deploy` skill gives each step and the line to run, in this order: `submit_manifest`, the local run, `deploy`.",
+      "- A local run and a deploy: the `deploy` skill gives each step and the line to run, in this order: `tzcloud_submit_manifest`, the local run, `tzcloud_deploy`.",
       "- Sign-in on a local run: start it with `--sign-in` and the application's own hostname, then open the address its port line names; the command sends the sign-in routes to that hostname. Without `--sign-in`, the page a local run serves has no sign-in routes, sign-in is on the deployed application's own address, and a local run's API routes take a session as a Bearer.",
       ""
     ].join("\n")],
@@ -9174,16 +9299,16 @@ var SCAFFOLD_TEMPLATE_FILES = Object.freeze({
 var APPLICATION_FOLDER = "app";
 var STAGE_FOLDER = "app.scaffold";
 var APPLICATION_MANIFEST = "manifest.json";
-var CREATE_STEP = "Call create_application from your tool for this new service, and skip this step where you already created its application.";
-var DEPLOY_TARGET_SENTENCE = "The deploy goes to the application's deploy target: production on an application with one environment, as a new one has, and development on one with two, where production receives a version through promote. To try versions on development, call create_environment first and follow its answer.";
+var CREATE_STEP = "Call tzcloud_create_application from your tool for this new service, and skip this step where you already created its application.";
+var DEPLOY_TARGET_SENTENCE = "The deploy goes to the application's deploy target: production on an application with one environment, as a new one has, and development on one with two, where production receives a version through tzcloud_promote. To try versions on development, call tzcloud_create_environment first and follow its answer.";
 var runLineOf = (origin, windows) => machineLineOf(commandLineOf(origin, RUN_SUBCOMMAND, origin !== DEFAULT_COMMAND_ORIGIN ? { origin } : {}), windows, origin);
-var DEPLOY_STEP = `Call deploy from your tool with the application, naming no environment and neither artifact nor upload, and run the line it answers in ${APPLICATION_FOLDER}/. ${DEPLOY_TARGET_SENTENCE}`;
+var DEPLOY_STEP = `Call tzcloud_deploy from your tool with the application, naming no environment and neither artifact nor upload, and run the line it answers in ${APPLICATION_FOLDER}/. ${DEPLOY_TARGET_SENTENCE}`;
 var SHAPE_STEP = `Shape the service to your own before the first deploy: the table and its migration in ${APPLICATION_FOLDER}/migrations, the routes in ${APPLICATION_FOLDER}/src, and the tests, which cover those routes as written.`;
 var WEB_SHAPE_STEP = `Shape the app to your own before the first deploy: the page in ${APPLICATION_FOLDER}/client, the table and its migration in ${APPLICATION_FOLDER}/migrations, the routes in ${APPLICATION_FOLDER}/src, and the tests, which cover those routes as written.`;
 var WEB_OPEN_STEP = "Open the address the deploy answers in a browser and sign in there: the page lists the signed-in user's own rows, adds one, and answers a question under the plan's AI allowance.";
-var SUBMIT_NO_SETTING_STEP = `Call submit_manifest from your tool with the application and its manifest, ${APPLICATION_FOLDER}/${APPLICATION_MANIFEST}, naming no local_run, since the service reads no setting.`;
+var SUBMIT_NO_SETTING_STEP = `Call tzcloud_submit_manifest from your tool with the application and its manifest, ${APPLICATION_FOLDER}/${APPLICATION_MANIFEST}, naming no local_run, since the service reads no setting.`;
 var provisionStepLineOf = (origin, windows) => machineLineOf(provisionBareLineOf({ origin, application: "<application id>" }), windows, origin);
-var provisionStepOf = (origin, windows) => `Call submit_manifest from your tool with the application and its manifest, ${APPLICATION_FOLDER}/${APPLICATION_MANIFEST}, naming no local_run. Then run ${freshLineSteps2("the provision line below")}, all in ${APPLICATION_FOLDER}/. The provision line: ${provisionStepLineOf(origin, windows)}`;
+var provisionStepOf = (origin, windows) => `Call tzcloud_submit_manifest from your tool with the application and its manifest, ${APPLICATION_FOLDER}/${APPLICATION_MANIFEST}, naming no local_run. Then run ${freshLineSteps2("the provision line below")}, all in ${APPLICATION_FOLDER}/. The provision line: ${provisionStepLineOf(origin, windows)}`;
 var SCHEDULED_JOB_SCHEDULE = "heartbeat";
 var ENTRY_PAGES = Object.freeze({
   database: Object.freeze({ follow: "the guide Add a database", page: "/cloud/guides/add-a-database/" }),
@@ -9247,7 +9372,7 @@ var TEMPLATE_FACTS = Object.freeze({
       SUBMIT_NO_SETTING_STEP,
       `In ${APPLICATION_FOLDER}/, start the application on this machine, where GET /api/hello then answers hello world; no schedule fires on this machine, and the tests fire the handler. ${RUN_STEP_BACKGROUND}: ${runLineOf(origin, windows)}`,
       DEPLOY_STEP,
-      `Call run_schedule from your tool with the application, the schedule ${SCHEDULED_JOB_SCHEDULE}, and wait_seconds, which fires the handler now and answers how the run ended. A settled answer carries the handler's lines in console, and its more names the read_logs call where the lines were cut, may still be arriving, or could not be read. An answer not yet settled carries no console and names read_schedules, which lists every run.`
+      `Call tzcloud_run_schedule from your tool with the application, the schedule ${SCHEDULED_JOB_SCHEDULE}, and wait_seconds, which fires the handler now and answers how the run ended. A settled answer carries the handler's lines in console, and its more names the tzcloud_read_logs call where the lines were cut, may still be arriving, or could not be read. An answer not yet settled carries no console and names tzcloud_read_schedules, which lists every run.`
     ]
   }),
   "web-app": Object.freeze({
@@ -9331,7 +9456,7 @@ var SCAFFOLD_OPTIONS = Object.freeze([
     name: SCAFFOLD_OPTION.application,
     value: "<application id>",
     required: false,
-    description: `Under every template, the application the service deploys to, by its id, a lowercase UUID, as create_application returns it. The written ${APPLICATION_MANIFEST} gives it in its application member, which binds the folder to that application, so a deploy or check command that gives another is refused. If omitted, the first deploy writes the member.`
+    description: `Under every template, the application the service deploys to, by its id, a lowercase UUID, as tzcloud_create_application returns it. The written ${APPLICATION_MANIFEST} gives it in its application member, which binds the folder to that application, so a deploy or check command that gives another is refused. If omitted, the first deploy writes the member.`
   }
 ]);
 var EMPTY_PACKAGES = '"packages": []';
@@ -9358,7 +9483,7 @@ var NEITHER_LEFT = Object.freeze({ tools: "written", claude: false });
 var ROOT_TOOLS_STEP = `Add a sentence to ${TOOLS_FILE} at the project's root, which the scaffold did not change, so a coding tool started at the root reads ${APPLICATION_FOLDER}/${TOOLS_FILE}. The sentence to add: ${ROOT_SENTENCE}`;
 var ROOT_TOOLS_FAILED_STEP = `Add a sentence to ${TOOLS_FILE} at the project's root, which the scaffold could not write, so a coding tool started at the root reads ${APPLICATION_FOLDER}/${TOOLS_FILE}. The sentence to add: ${ROOT_SENTENCE}`;
 var ROOT_CLAUDE_STEP = `Add a sentence to ${CLAUDE_FILE} at the project's root, since Claude Code reads that file and then reads no ${TOOLS_FILE} by itself. The sentence to add: ${ROOT_SENTENCE}`;
-var APPLICATION_FORM_REFUSAL = `${SCAFFOLD_OPTION.application} names the application the service deploys to, by its id, a lowercase UUID, as create_application answers it. ${NOTHING_WRITTEN2}`;
+var APPLICATION_FORM_REFUSAL = `${SCAFFOLD_OPTION.application} names the application the service deploys to, by its id, a lowercase UUID, as tzcloud_create_application answers it. ${NOTHING_WRITTEN2}`;
 var RESOURCE_REFUSAL = Object.freeze({
   /** A plural outside SCAFFOLD_NAME_FORM. */
   resourceForm: `${SCAFFOLD_OPTION.resource} takes the plural of the resource the service keeps, the word of its table and its route: an ASCII lower-case letter, then ASCII lower-case letters and digits, at most 30 characters, such as orders. ${NOTHING_WRITTEN2}`,
@@ -9864,7 +9989,7 @@ var scaffoldLinkSentence = (what) => `${what} stands on a link that leads outsid
 var listOf = (value) => value === null ? [] : Array.isArray(value) ? value : [value];
 var BRING_PAGE = "/cloud/guides/bring-an-existing-application/";
 var BRING_FOLLOW = "the guide Bring an existing application";
-var STANDS_DEPLOY_LINE = `Where ${APPLICATION_FOLDER}/ holds an application, deploy it: call deploy from your tool and run the line it answers in ${APPLICATION_FOLDER}/, as ${BRING_FOLLOW}, read_documentation's page ${BRING_PAGE}, says.`;
+var STANDS_DEPLOY_LINE = `Where ${APPLICATION_FOLDER}/ holds an application, deploy it: call tzcloud_deploy from your tool and run the line it answers in ${APPLICATION_FOLDER}/, as ${BRING_FOLLOW}, read_documentation's page ${BRING_PAGE}, says.`;
 var applicationStandsLines = (template, takeLines) => {
   const { takes } = TEMPLATE_FACTS[template];
   const lines = listOf(takeLines);
@@ -10375,7 +10500,6 @@ var TOKEN_ROW = Object.freeze({
 
 // src/turnzero_cloud_command/tzmesh_register.ts
 import { dirname as dirname8, resolve as resolve13 } from "node:path";
-var TZMESH_LISTED = true;
 var TZMESH_ACT_WORDS = `${TZMESH_SUBCOMMAND} ${TZMESH_REGISTER_ACT}`;
 var TZMESH_OPTIONS = Object.freeze([
   {
@@ -10661,7 +10785,7 @@ var registeredLineOf = (agent, wire) => `${REGISTERED_LINE_HEAD}agent ${agent.ha
 var WRITTEN_LINE = `${WRITTEN_LINE_HEAD}the agent's secret, alone on one line, into the file ${TZMESH_OPTION.toFile} names, readable by its owner alone`;
 var REGISTER_UNKNOWN = "Whether the agent was registered is unknown: tzmesh_list_participants from your tool shows it, and delete_agent from your tool, naming its participant, deletes it.";
 var agentStandsSentence = (agent) => `The agent ${agentWords(agent)} stands with no secret kept: delete_agent from your tool, naming participant ${agent.id}, deletes it and frees its name.`;
-var storeUnknownSentence = (secretName, agent) => `Whether the secret was stored is unknown: list_secrets from your tool shows when ${secretName} was last written. Where it was not written, delete_agent from your tool, naming participant ${agent.id}, deletes the agent ${agentWords(agent)}.`;
+var storeUnknownSentence = (secretName, agent) => `Whether the secret was stored is unknown: tzcloud_list_secrets from your tool shows when ${secretName} was last written. Where it was not written, delete_agent from your tool, naming participant ${agent.id}, deletes the agent ${agentWords(agent)}.`;
 var TOKEN_LEFT = `list_tokens from your tool shows the run's token by its label, ${TZMESH_COMMAND_LABEL}, and revoke_token ends it; it expires within a day either way.`;
 var tokenStandsSentence = (id) => `The run's token, ${id}, was not revoked, so it works until it expires within a day: revoke_token from your tool with id ${id} ends it, and list_tokens shows whether it stands.`;
 var revocationBearerRefused = (origin) => `This computer's token for ${origin} was refused as the bearer of the revocation.`;
@@ -10767,10 +10891,10 @@ var setUpAgent = async (io2, wire, secret2, userAgent, options, ended) => {
   return { signing };
 };
 var firstStoreStandsSentence = (secretName) => `${secretName} now holds the deleted agent's secret, which works nowhere, until the line runs again.`;
-var signingUnknownSentence = (signingName, agent) => `Whether the webhook's signing secret was stored is unknown: list_secrets from your tool shows when ${signingName} was last written. Where it was not written, delete_agent from your tool, naming participant ${agent.id}, deletes the agent ${agentWords(agent)}, and the line runs again.`;
+var signingUnknownSentence = (signingName, agent) => `Whether the webhook's signing secret was stored is unknown: tzcloud_list_secrets from your tool shows when ${signingName} was last written. Where it was not written, delete_agent from your tool, naming participant ${agent.id}, deletes the agent ${agentWords(agent)}, and the line runs again.`;
 var unfinishableSentence = (agent) => `The agent ${agentWords(agent)} cannot be finished, since its webhook's signing secret ended with the run: delete_agent from your tool, naming participant ${agent.id}, deletes it, and the line runs again.`;
-var firstStoreUnknownSentence = (secretName) => `Whether ${secretName} was written is unknown: list_secrets from your tool shows when it was last written. Where it was, it holds the deleted agent's secret, which works nowhere, until the line runs again.`;
-var unfinishedStandsSentence = (agent, kept2) => `${kept2.known ? `${kept2.name} holds the secret of the agent ${agentWords(agent)}.` : `Whether ${kept2.name} holds the secret of the agent ${agentWords(agent)} is unknown: list_secrets from your tool shows when it was last written.`} ${unfinishableSentence(agent)}`;
+var firstStoreUnknownSentence = (secretName) => `Whether ${secretName} was written is unknown: tzcloud_list_secrets from your tool shows when it was last written. Where it was, it holds the deleted agent's secret, which works nowhere, until the line runs again.`;
+var unfinishedStandsSentence = (agent, kept2) => `${kept2.known ? `${kept2.name} holds the secret of the agent ${agentWords(agent)}.` : `Whether ${kept2.name} holds the secret of the agent ${agentWords(agent)} is unknown: tzcloud_list_secrets from your tool shows when it was last written.`} ${unfinishableSentence(agent)}`;
 var revokeRunToken = async (io2, plane, bearer, id, userAgent) => {
   const answered = await postAction(io2, plane, REVOKE_TOKEN_ACTION, bearer, userAgent, revocationBodyOf(id));
   let lines;
@@ -11018,7 +11142,7 @@ var TZMESH_ROW = Object.freeze({
   statuses: {
     done: "the challenge printed, or the agent registered, its secret kept, and the run's token revoked",
     failed: "a part failed: the agent was not registered, its secret was not kept, or the run's token was not revoked. The printed lines name what stands and the call that ends it",
-    unknown: "an outcome is unknown: the printed lines name list_tokens, tzmesh_list_participants, or list_secrets",
+    unknown: "an outcome is unknown: the printed lines name list_tokens, tzmesh_list_participants, or tzcloud_list_secrets",
     nothing_started: `nothing was minted. An option, the credential file, the file ${TZMESH_OPTION.toFile} names, or this computer's token was refused. Or no request was pending, the platform was too old, or the exchange was refused`
   },
   variables: [[ORIGIN_VARIABLE, `the platform's address the secret is stored at where the line names no ${TZMESH_OPTION.origin}. It must be ${DEFAULT_COMMAND_ORIGIN} or ${DEVELOPMENT_COMMAND_ORIGIN}.`]],
@@ -11030,7 +11154,6 @@ var TZMESH_ROW = Object.freeze({
     `The run reads this computer's token for each address it sends to: the ${TZMESH_OPTION.tzmeshEstate} platform's, to revoke the run's token, and under ${TZMESH_OPTION.secret} the ${TZMESH_OPTION.origin} platform's, to store the secret. Authorize this computer at each first.`
   ],
   afterOwnError: (call) => call.named[TZMESH_OPTION.mint] !== void 0 ? TZMESH_AFTER_OWN_ERROR : TZMESH_FIRST_ACT_AFTER_OWN_ERROR,
-  listed: TZMESH_LISTED,
   run: tzmeshRegister
 });
 
@@ -11618,9 +11741,8 @@ var SUBCOMMANDS = Object.freeze([
   SESSION_ROW,
   TZMESH_ROW
 ]);
-var listedSubcommands = () => SUBCOMMANDS.filter((subcommand) => subcommand.listed !== false);
 var SERVED = LINE_RUNNER;
-var NPX_FORM_SENTENCE = `A tool runs the command through npx first: write ${commandRunnerOf("latest")} for ${LINE_RUNNER}, since that form runs whether or not the command is installed. Where the tool's safety check refuses it, the tool runs ${LINE_RUNNER} where ${LINE_RUNNER} --version responds, and otherwise takes deploy_files for a deploy or installs the command with ${installLineOf(DEFAULT_COMMAND_ORIGIN)}. Past deploy_files' caps, where it may not install or run the command, it uploads a zip with mint_upload_grant and names it as deploy's artifact. A person or a job may run either form.`;
+var NPX_FORM_SENTENCE = `A tool runs the command through npx first: write ${commandRunnerOf("latest")} for ${LINE_RUNNER}, since that form runs whether or not the command is installed. Where the tool's safety check refuses it, the tool runs ${LINE_RUNNER} where ${LINE_RUNNER} --version responds, and otherwise takes tzcloud_deploy_files for a deploy or installs the command with ${installLineOf(DEFAULT_COMMAND_ORIGIN)}. Past tzcloud_deploy_files' caps, where it may not install or run the command, it uploads a zip with tzcloud_mint_upload_grant and names it as tzcloud_deploy's artifact. A person or a job may run either form.`;
 var namedWithActs = (subcommand) => subcommand.acts ? `${subcommand.name} ${subcommand.acts.join("|")}` : subcommand.name;
 var shown = (option) => option.flag ? option.name : `${option.name} ${option.value}`;
 var listed = (names) => names.length < 3 ? names.join(" and ") : `${names.slice(0, -1).join(", ")}, and ${names[names.length - 1]}`;
@@ -11644,9 +11766,9 @@ var usageLineOf = (subcommand) => {
   return `${pipedHead(subcommand)}${SERVED} ${[namedWithActs(subcommand), ...required, ...optional].join(" ")}`;
 };
 var usageHeadOf = (version) => `${TURNZERO_CLOUD_PACKAGE} ${version}: the Turn Zero Cloud command, installed from the public npm registry by your platform's tag, latest on production and next on development.`;
-var unreadNames = () => listedSubcommands().filter((subcommand) => subcommand.credential === null && subcommand.reads === void 0).map((subcommand) => subcommand.name);
-var unattendedNames = () => listedSubcommands().filter((subcommand) => subcommand.credential?.mintedToken === true).map((subcommand) => subcommand.name);
-var computerOnlyNames = () => listedSubcommands().filter((subcommand) => subcommand.credential?.computerToken === true).map((subcommand) => subcommand.name);
+var unreadNames = () => SUBCOMMANDS.filter((subcommand) => subcommand.credential === null && subcommand.reads === void 0).map((subcommand) => subcommand.name);
+var unattendedNames = () => SUBCOMMANDS.filter((subcommand) => subcommand.credential?.mintedToken === true).map((subcommand) => subcommand.name);
+var computerOnlyNames = () => SUBCOMMANDS.filter((subcommand) => subcommand.credential?.computerToken === true).map((subcommand) => subcommand.name);
 var exampleLineOf = (subcommand) => {
   const credential = subcommand.credential;
   const mustPipe = credential !== null && credential.piped !== false && credential.bare === void 0 && credential.computerToken !== true;
@@ -11672,7 +11794,7 @@ var pipedLinesOf = (subcommand) => {
 var readsLinesOf = (subcommand) => subcommand.reads !== void 0 ? [`  ${subcommand.name} reads ${subcommand.reads}.`] : [];
 var noCredentialLine = () => {
   const unread = unreadNames();
-  const unlessFlagged = listedSubcommands().filter((subcommand) => subcommand.credential === null && subcommand.readsOnlyWith !== void 0).map((subcommand) => `${subcommand.name} without ${subcommand.readsOnlyWith}`);
+  const unlessFlagged = SUBCOMMANDS.filter((subcommand) => subcommand.credential === null && subcommand.readsOnlyWith !== void 0).map((subcommand) => `${subcommand.name} without ${subcommand.readsOnlyWith}`);
   const subject = unlessFlagged.length === 0 ? listed(unread) : unread.length === 0 ? listed(unlessFlagged) : `${listed(unread)}, and ${listed(unlessFlagged)},`;
   return `  The command takes no credential in its arguments, and ${subject} ${unread.length + unlessFlagged.length === 1 ? "reads" : "read"} none.`;
 };
@@ -11688,7 +11810,7 @@ var statusClauseOf = (name, clause) => `Under ${name}, ${clause}`;
 var noteLinesOf2 = (subcommand) => (subcommand.note ?? []).flatMap((paragraph) => ["", paragraph]);
 var usageBlockOf = (subcommandHelp) => [
   "Usage:",
-  ...listedSubcommands().map((subcommand) => `  ${usageLineOf(subcommand)}`),
+  ...SUBCOMMANDS.map((subcommand) => `  ${usageLineOf(subcommand)}`),
   `  ${SERVED} --version`,
   `  ${SERVED} --help`,
   ...subcommandHelp ? [`  ${SERVED} <subcommand> --help`] : []
@@ -11707,7 +11829,7 @@ var shortUsageText = (version = commandVersion()) => [
   ...STATUS_MEANINGS.map(([status, meaning, also]) => statusLineOf(status, meaning, [], also)),
   "",
   "Subcommands:",
-  ...listedSubcommands().map((subcommand) => `  ${namedWithActs(subcommand)}: ${subcommand.summary}`),
+  ...SUBCOMMANDS.map((subcommand) => `  ${namedWithActs(subcommand)}: ${subcommand.summary}`),
   "",
   SUBCOMMAND_HELP_SENTENCE
 ].join("\n");
@@ -11756,7 +11878,7 @@ var valuePlacesOf = (argv2) => {
   }
   return places;
 };
-var noSubcommandSentence = (first) => `${first === void 0 ? "No subcommand was named" : `The first argument is not a subcommand of ${TURNZERO_CLOUD_PACKAGE}`}: the subcommands are ${listedSubcommands().map((entry) => entry.name).join(", ")}. ${NOTHING_STARTED2}`;
+var noSubcommandSentence = (first) => `${first === void 0 ? "No subcommand was named" : `The first argument is not a subcommand of ${TURNZERO_CLOUD_PACKAGE}`}: the subcommands are ${SUBCOMMANDS.map((entry) => entry.name).join(", ")}. ${NOTHING_STARTED2}`;
 var parseArguments = (given, onWindows2 = ON_WINDOWS) => {
   const argv2 = withCurrentOptionNames(given);
   if (argv2.some((argument) => argument.includes(UPLOAD_GRANT_PREFIX))) return { kind: "refused", sentence: grantArgumentSentence() };