turnzero 0.38.0 → 0.39.0

package/README.md

@@ -33,7 +33,7 @@ To install it yourself, run `npm install -g turnzero`. It needs Node.js 24 or la
 - `tzmesh register` registers a tzMesh standing agent and stores its program secret in your account's secret store or a local file, without printing it.
 - `run` starts your application on your computer with that file's settings. With `client/` and a numeric port it also serves the client files. Add `--sign-in <hostname>` to use browser sign-in locally.
 - `scaffold` writes a new service into your project from a template, installs it, and runs its tests.
-- `login` logs this computer in through your browser, `whoami` names the account its token acts as, and `logout` revokes its token.
+- `login` signs in the Turn Zero CLI on this computer through your browser, `whoami` names the account its token acts as, and `logout` revokes its token.
 - `authorize` gives this computer a token through your signed-in tool, which then tells you it did.
 - `token request` and `token claim` get a token for another computer or for an unattended run.
 - `session` signs a test end user of your application in and writes the session's cookie into a file that curl reads.

package/dist/turnzero-cloud.mjs

@@ -1067,7 +1067,7 @@ var fileReadSentence = (origin) => `The credential this run read was this comput
 var noTokenSentence = (origin, expiredAt) => expiredAt === null ? `No credential was read, so nothing was sent: ${MINTED_TOKEN_VARIABLE} is not set, and this computer's credential file holds no token for ${origin}.` : `No credential was read, so nothing was sent: ${MINTED_TOKEN_VARIABLE} is not set, and this computer's token for ${origin} in its credential file expired at ${expiredAt}.`;
 var VARIABLE_ROUTE_SENTENCES = `A tool connected by a minted token, or a job, sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, never by writing the value in a command. It sets ${ORIGIN_VARIABLE} to the address that minted the token if that is not ${DEFAULT_COMMAND_ORIGIN}, then runs the command again. Such a tool cannot use ${MINT_TOKEN_ACTION}, which works only under a sign-in. A tool sets ${MINTED_TOKEN_VARIABLE} for one command at a time and unsets it once that command ends.`;
 var authorizeRouteSentence = (origin) => `${AUTHORIZE_SUBCOMMAND}${originWordsOf(origin)} run with nothing piped prints the ${MINT_TOKEN_ACTION} call a signed-in tool makes to authorize this computer.`;
-var LOGIN_ROUTE_OPENER = "A person logs this computer in once, in a terminal of their own, and its token then stays on this computer for 30 days:";
+var LOGIN_ROUTE_OPENER = "A person signs in on this computer once, in a terminal of their own, and its token then stays on this computer for 30 days:";
 var DEPLOY_ROUTES_SENTENCE = "For regular use, prefer this command wherever your tool can install and run it and reach the platform. A first simple test within the caps of your tool's tzcloud_deploy_files call may deploy through tzcloud_deploy_files, as may any folder within them where this command cannot work. Past the caps, where your tool may not install or run this command, upload a zip with tzcloud_mint_upload_grant, then name it as tzcloud_deploy's artifact.";
 var deviceRouteSentence = (deviceLine) => `An AI tool that cannot authorize this computer through a signed-in Turn Zero connection, with no terminal for a person, runs ${deviceLine} and sends the person its link.`;
 var loginRouteLines = (io2, origin, deployFiles = true) => [
@@ -1186,7 +1186,7 @@ var firstActNamed = (kind, origin = DEFAULT_COMMAND_ORIGIN) => kind === "tzmesh"
   `${TZMESH_SUBCOMMAND} ${TZMESH_REGISTER_ACT}`
 ) : `${kind === "authorized computer" ? AUTHORIZE_SUBCOMMAND : `${TOKEN_SUBCOMMAND} ${TOKEN_REQUEST_ACT}`}${originWordsOf(origin)}`;
 var noConnectionLine = (origin) => `Where your tool holds no connection signed in to ${origin}, ${MINT_TOKEN_ACTION} is not among its tools: a person connects the tool and signs in, in a browser, before the call.`;
-var loginWaySentence = (loginLines) => `A person can instead log this computer in themselves, in a terminal of their own, by running ${loginLines.join(", then ")}, and approving the login in the browser.`;
+var loginWaySentence = (loginLines) => `A person can instead sign in on this computer themselves, in a terminal of their own, by running ${loginLines.join(", then ")}, and approving the sign-in in the browser.`;
 var AUTHORIZE_HAND_OVER_SENTENCE = "If your tool's own safety check refuses the answered line, a deploy can still go through a route that does not require the turnzero command. That is tzcloud_deploy_files within its caps or, past them where your tool can zip and upload the folder, tzcloud_mint_upload_grant followed by tzcloud_deploy naming the uploaded zip as artifact. Tell the person which route you take and why. Only where no such route serves, give the person that exact line to run once in their own terminal, never a rewritten one.";
 var TZMESH_HAND_OVER_SENTENCE = "If your tool's own safety check refuses the answered line, give the person that exact line to run once in their own terminal, never a rewritten one.";
 var OPTIONS_LINE_HEAD = "options: ";
@@ -1350,7 +1350,7 @@ var mintedTokenOf = (answer, kind = "authorized computer") => {
     authorizedComputer: view[AUTHORIZED_COMPUTER_MEMBER] === true
   };
 };
-var mintAgainSentence = (kind, origin = DEFAULT_COMMAND_ORIGIN, login2 = null) => login2 !== null ? `Run ${login2} again to log this computer in.` : `Call ${MINT_TOKEN_ACTION} from your tool again with the challenge ${firstActNamed(kind, origin)} prints, and run the line it answers.`;
+var mintAgainSentence = (kind, origin = DEFAULT_COMMAND_ORIGIN, login2 = null) => login2 !== null ? `Run ${login2} again to sign in on this computer.` : `Call ${MINT_TOKEN_ACTION} from your tool again with the challenge ${firstActNamed(kind, origin)} prints, and run the line it answers.`;
 var exchangeUnknownSentence = (kind, origin = DEFAULT_COMMAND_ORIGIN, login2 = null) => `Whether a token was minted is unknown: list_tokens from your tool shows each token by its label, and revoke_token ends one nothing holds. ${mintAgainSentence(kind, origin, login2)}`;
 var noPendingSentence = (origin, kind, presented = "code") => `No request is pending for ${origin} on this computer, so ${presented === "mint" ? "nothing was sent: the verifier the mint needs" : "the token code was not presented and nothing was sent: the verifier it needs"} is kept only on the computer whose ${firstActNamed(kind)} printed its challenge. Run ${firstActNamed(kind, origin)} on this computer, call ${MINT_TOKEN_ACTION} from your tool with the challenge it prints, and run the line it answers.`;
 var otherLivingRequestOf = (pending, origin, now) => {
@@ -2140,6 +2140,8 @@ var ABSENT_FILE_ERROR = "no_such_file";
 var freshExportLine = (absent) => `${absent === 1 ? "A file the manifest names was" : `${absent} files the manifest names were`} answered as an absent name and ${absent === 1 ? "was" : "were"} not read. A fresh export has the application's files as they now stand: call tzcloud_request_export from your tool, then ${toolNameOf(DOWNLOAD_GRANT_ACTION)} with download: true once tzcloud_read_export answers it completed.`;
 var runAgainLine = (again) => `Run the line again before its grant expires, or take a fresh one. ${again} It skips the files on disk and reads again each file whose read failed.`;
 var MANIFEST_READ = "The manifest read";
+var MANIFEST_READ_ACT = "manifest read";
+var FILE_READ_ACT = "file read";
 var fileReadOf = (natural) => `The read of ${shownWhole(natural)}`;
 var APPLICATION_MARK = "package.json";
 async function exportDownload(call, io2) {
@@ -2245,7 +2247,7 @@ async function exportDownload(call, io2) {
   let manifestRead;
   for (; ; ) {
     if (pause !== null) await pause;
-    manifestRead = await get("manifest read", exportArea, exportFileName(options.export, EXPORT_MANIFEST_FILE), MANIFEST_READ);
+    manifestRead = await get(MANIFEST_READ_ACT, exportArea, exportFileName(options.export, EXPORT_MANIFEST_FILE), MANIFEST_READ);
     if (manifestRead instanceof Response || manifestRead.kind !== "capped") break;
     if (!waitOutCap()) {
       manifestRead = { kind: "ended", lines: cappedEnd };
@@ -2330,7 +2332,7 @@ async function exportDownload(call, io2) {
     const entry = entries[ordinal];
     const target = targetOf(locals[ordinal]);
     if (target === null || !addressable(entry)) return { kind: "failed", reason: "its name holds a . or .. segment, which no address carries", unread: true };
-    const answered = await get("file read", entry.area, entry.name, fileReadOf(entry.natural));
+    const answered = await get(FILE_READ_ACT, entry.area, entry.name, fileReadOf(entry.natural));
     if (!(answered instanceof Response)) return answered;
     const length = lengthOf(answered);
     if (length === null) {
@@ -6943,22 +6945,22 @@ var openBrowser = async (io2, address) => {
   cancel();
   return ended === "waiting" || ended.error === null && ended.status === 0;
 };
-var addressLeadSentence = (origin) => `To log this computer in at ${origin}, approve the login on this page:`;
-var reusedLoginRequestSentence = (origin, expiresAt) => `A login request for ${origin} is pending until ${expiresAt}, so this login uses it again and makes no new verifier.`;
-var replacedLoginRequestSentence = (origin, expiredAt) => `The login request pending for ${origin} expired at ${expiredAt}, so a new one replaces it, and the address below carries its challenge. An approval or a line made against the old challenge is refused at its exchange.`;
+var addressLeadSentence = (origin) => `To sign in to the Turn Zero CLI on this computer at ${origin}, approve the sign-in on this page:`;
+var reusedLoginRequestSentence = (origin, expiresAt) => `A sign-in request for ${origin} is pending until ${expiresAt}, so this sign-in uses it again and makes no new verifier.`;
+var replacedLoginRequestSentence = (origin, expiredAt) => `The sign-in request pending for ${origin} expired at ${expiredAt}, so a new one replaces it, and the address below carries its challenge. An approval or a line made against the old challenge is refused at its exchange.`;
 var minutesWords = (minutes) => `${minutes} minute${minutes === 1 ? "" : "s"}`;
 var minutesLeftOf = (expiresAt, now) => Math.max(1, Math.ceil((Date.parse(expiresAt) - now.getTime()) / 6e4));
 var openingSentence = (minutes) => `Opening it in your default browser. If you use another one, copy the address above into it. This command waits up to ${minutesWords(minutes)} for the approval.`;
-var noBrowserSentence = "Open the address in a browser on any computer, approve the login, and paste here the code the page shows.";
+var noBrowserSentence = "Open the address in a browser on any computer, approve the sign-in, and paste here the code the page shows.";
 var unboundSentence = "No port on this computer could be bound for the browser to answer, so paste here the code the page shows once you approve.";
-var unopenedSentence = "The browser could not be opened here: open the address yourself, approve the login, and paste here the code the page shows if it shows one.";
-var noSendSentence = (seconds) => `No answer has come from the browser in ${seconds} seconds. Where the page shows a code, paste it here; the browser's answer still completes the login.`;
+var unopenedSentence = "The browser could not be opened here: open the address yourself, approve the sign-in, and paste here the code the page shows if it shows one.";
+var noSendSentence = (seconds) => `No answer has come from the browser in ${seconds} seconds. Where the page shows a code, paste it here; the browser's answer still completes the sign-in.`;
 var noTerminalSentence2 = "This run has no terminal to paste a code into, so it waits for the browser's answer alone.";
-var toolRouteSentence = (authorizeLine) => `This line waits for a person to approve the login in a browser. A tool signed in to Turn Zero needs no browser: stop this line, run ${authorizeLine}, and make the mint_token call it prints.`;
+var toolRouteSentence = (authorizeLine) => `This line waits for a person to approve the sign-in in a browser. A tool signed in to Turn Zero needs no browser: stop this line, run ${authorizeLine}, and make the mint_token call it prints.`;
 var noWayInSentence = (line, deviceLine, minutes = PENDING_REQUEST_MS / 6e4) => `This run has no terminal to paste a code into and no port for the browser to answer, so nothing was minted and the request stays pending for ${minutesWords(minutes)}. Run ${line} in a terminal of your own. ${deviceRouteSentence(deviceLine)}`;
-var endedSentence = (minutes, line) => `No approval arrived within ${minutesWords(minutes)}, so nothing was minted and nothing was changed. Run ${line} again to log this computer in.`;
-var stoppedSentence = (line) => `The code prompt was stopped, so nothing was minted. Run ${line} again to log this computer in.`;
-var notCodeSentence = (line) => `What was pasted is not a token code, so nothing was sent and nothing was minted. Run ${line} again to log this computer in.`;
+var endedSentence = (minutes, line) => `No approval arrived within ${minutesWords(minutes)}, so nothing was minted and nothing was changed. Run ${line} again to sign in on this computer.`;
+var stoppedSentence = (line) => `The code prompt was stopped, so nothing was minted. Run ${line} again to sign in on this computer.`;
+var notCodeSentence = (line) => `What was pasted is not a token code, so nothing was sent and nothing was minted. Run ${line} again to sign in on this computer.`;
 var LINK_LINE_HEAD = "link: ";
 var devicePersonSentence = (label, expiresAt) => `Open this link on any device, sign in to Turn Zero, and approve the sign-in for the computer ${JSON.stringify(label)} before ${expiresAt}; the turnzero command there finishes on its own once you approve.`;
 var deviceEndedSentence = (expiresAt, line) => `No approval arrived before the request ended at ${expiresAt}, so nothing was minted and nothing was changed. Run ${line} again for a new link.`;
@@ -6967,7 +6969,9 @@ var deviceStoppedSentence = (expiresAt, line) => `The run was stopped while it w
 var CODE_PROMPT_WORDS = "Code (not shown), then Enter: ";
 var LINE_PIECES = /[^\r\n]*(?:\r\n|\r|\n)|[^\r\n]+/g;
 var escaped = (text) => text.replace(/[&<>"']/g, (character) => `&#${character.charCodeAt(0)};`);
-var browserPageOf = (title, sentence) => `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escaped(title)}</title></head><body style="font-family: system-ui, sans-serif; max-width: 36rem; margin: 3rem auto; padding: 0 1rem; line-height: 1.5"><h1>${escaped(title)}</h1><p>${escaped(sentence)}</p></body></html>`;
+var BROWSER_PAGE_STYLE = 'body{margin:0;min-height:100vh;display:grid;place-items:center;background:#fafbf7;color:#102b23;font-family:Inter,ui-sans-serif,system-ui,-apple-system,"Segoe UI",sans-serif}main{box-sizing:border-box;width:calc(100% - 1.5rem);max-width:536px;padding:32px;border:1px solid #d7e1d7;border-radius:20px;background:#fff;box-shadow:0 12px 36px #102b230c}.brand{display:flex;align-items:center;gap:10px;margin:0 0 30px;color:#205942;font-weight:600}.brand img{width:33px;height:33px;object-fit:contain}.brand span{font-size:19px;letter-spacing:-0.35px}h1{margin:0 0 10px;font-size:28px;line-height:1.2;font-weight:650;letter-spacing:-0.8px}p{margin:0;font-size:15px;line-height:1.55;color:#4a5b53;overflow-wrap:anywhere}';
+var browserPageMarkOf = (origin) => `${origin}/assets/favicon.svg`;
+var browserPageOf = (title, sentence, origin) => `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${escaped(title)}</title><style>${BROWSER_PAGE_STYLE}</style></head><body><main><div class="brand"><img alt="" width="33" height="33" referrerpolicy="no-referrer" onerror="this.remove()" src="${escaped(browserPageMarkOf(origin))}"><span>Turn Zero</span></div><h1>${escaped(title)}</h1><p>${escaped(sentence)}</p></main></body></html>`;
 var answerHeaders = (origin, html) => ({
   "access-control-allow-origin": origin,
   "access-control-allow-private-network": "true",
@@ -6978,17 +6982,17 @@ var stateOnlyAnswer = (origin) => ({ status: 204, headers: answerHeaders(origin,
 var outcomeAnswer = (origin, authorized) => ({
   status: 200,
   headers: answerHeaders(origin, true),
-  body: authorized ? browserPageOf("This computer is logged in", `The turnzero command on this computer is logged in at ${origin}. Return to your AI tool and continue the setup or deployment you started. You can close this tab.`) : browserPageOf("The login did not complete", "The turnzero command on this computer did not complete the login; its terminal says why and what to run next. You can close this tab.")
+  body: authorized ? browserPageOf("Signed in", `The Turn Zero CLI on this computer is signed in at ${origin}. Return to your AI tool and continue the setup or deployment you started. You can close this tab.`, origin) : browserPageOf("The sign-in did not complete", "The Turn Zero CLI on this computer did not complete the sign-in; its terminal says why and what to run next. You can close this tab.", origin)
 });
 var wrongStateAnswer = (origin) => ({
   status: 400,
   headers: answerHeaders(origin, true),
-  body: browserPageOf("Not this login", "This address is not the login the turnzero command on this computer is waiting for. Nothing was changed.")
+  body: browserPageOf("Not this sign-in", "This address is not the sign-in the Turn Zero CLI on this computer is waiting for. Nothing was changed.", origin)
 });
 var endedAnswer = (origin) => ({
   status: 410,
   headers: answerHeaders(origin, true),
-  body: browserPageOf("This login has ended", "The turnzero command on this computer is no longer waiting for this login. Run turnzero login again.")
+  body: browserPageOf("This sign-in has ended", "The Turn Zero CLI on this computer is no longer waiting for this sign-in. Run turnzero login again.", origin)
 });
 var notFoundAnswer = (origin) => ({ status: 404, headers: answerHeaders(origin, false), body: "" });
 var loopbackHandlerOf = (origin, state, arrive) => {
@@ -7173,7 +7177,7 @@ var LOGIN_OPTIONS = Object.freeze([
     name: LOGIN_OPTION.origin,
     value: "<origin>",
     required: false,
-    description: `The platform's address this computer logs in at. If omitted, the address in ${ORIGIN_VARIABLE}, or ${DEFAULT_COMMAND_ORIGIN} if that is unset. A ${LOGIN_OPTION.origin} given in the command must be ${DEFAULT_COMMAND_ORIGIN}, ${DEVELOPMENT_COMMAND_ORIGIN}, or the address in ${ORIGIN_VARIABLE}.`
+    description: `The platform's address this computer signs in at. If omitted, the address in ${ORIGIN_VARIABLE}, or ${DEFAULT_COMMAND_ORIGIN} if that is unset. A ${LOGIN_OPTION.origin} given in the command must be ${DEFAULT_COMMAND_ORIGIN}, ${DEVELOPMENT_COMMAND_ORIGIN}, or the address in ${ORIGIN_VARIABLE}.`
   },
   {
     name: LOGIN_OPTION.noBrowser,
@@ -7190,16 +7194,16 @@ var LOGIN_OPTIONS = Object.freeze([
     description: `For an AI tool that cannot authorize this computer through a signed-in Turn Zero connection, with no terminal for a person. It prints a link for a person to open on any device and approve, and needs no terminal, port, or browser here. It checks every ${DEVICE_POLL_SECONDS} seconds for up to an hour, and keeps the token once the person approves. Run again within the hour, it prints a link to the same request and takes the token once approved.`
   }
 ]);
-var LOGIN_AFTER_OWN_ERROR = "the login may not have completed. Where a token was minted, list_tokens from your tool shows it by its label, and revoke_token ends it. Run login again to log this computer in";
+var LOGIN_AFTER_OWN_ERROR = "the sign-in may not have completed. Where a token was minted, list_tokens from your tool shows it by its label, and revoke_token ends it. Run login again to sign in on this computer";
 var LOGIN_ROW = Object.freeze({
   name: LOGIN_SUBCOMMAND,
-  summary: `Logs this computer in at the platform's address. It opens the platform's computer login page (${COMPUTER_LOGIN_PATH}) in your default browser, where you approve the login under your sign-in. It keeps the token the platform mints in this computer's credential file. It then reads the account the token acts as, and prints authorized: with the address, the account's sign-in address (or its id if it has none), the token's label, and its expiry. If the browser cannot respond, it asks for the code the page shows. It prints no token, code, or verifier.`,
+  summary: `Signs the Turn Zero CLI in on this computer at the platform's address. It opens the platform's sign-in page for the CLI (${COMPUTER_LOGIN_PATH}) in your default browser, where you approve the sign-in. It keeps the token the platform mints in this computer's credential file. It then reads the account the token acts as, and prints authorized: with the address, the account's sign-in address (or its id if it has none), the token's label, and its expiry. If the browser cannot respond, it asks for the code the page shows. It prints no token, code, or verifier.`,
   example: LOGIN_SUBCOMMAND,
   options: LOGIN_OPTIONS,
   credential: null,
   reads: `nothing from standard input. With the browser, it waits for the page to respond on a port of this computer. With --no-browser, it reads the code the page shows from the terminal, hidden. With ${LOGIN_OPTION.device}, it asks the platform every ${DEVICE_POLL_SECONDS} seconds whether the link was approved. Once the token is kept, it reads the account through read_account under it`,
   statuses: {
-    done: "this computer logged in",
+    done: "this computer signed in",
     failed: "a token was minted and not kept, or the token this computer had before was not revoked: the printed lines name revoke_token",
     unknown: "the exchange got no response, or a response that is not a refusal: list_tokens shows whether a token was minted",
     nothing_started: "nothing was minted. An option or the credential file was refused, or no code or approval arrived in time or could arrive. Or the prompt was stopped, or given what is not a token code. Or the platform was too old, or the exchange was refused"
@@ -8000,7 +8004,7 @@ var PROVISION_ROW = Object.freeze({
     nothing_started: "nothing was re-minted"
   },
   note: [
-    `Run ${PROVISION_BARE_LINE_WORDS} from the folder the application runs in. With no token for the address, it prints a challenge and the tzcloud_submit_manifest call with local_run and ${CODE_CHALLENGE_MEMBER}. Your tool makes that call and runs the command it returns once, as given, before its grant expires. That command presents the grant with this computer's verifier. On a computer that is logged in, the plain command re-mints at once.`,
+    `Run ${PROVISION_BARE_LINE_WORDS} from the folder the application runs in. With no token for the address, it prints a challenge and the tzcloud_submit_manifest call with local_run and ${CODE_CHALLENGE_MEMBER}. Your tool makes that call and runs the command it returns once, as given, before its grant expires. That command presents the grant with this computer's verifier. On a computer that is signed in, the plain command re-mints at once.`,
     `Each run revokes the development credentials the application had before it. A deployed development environment keeps the revoked values until it restarts, so the command's last re-mint restarts it if development serves a version. Its redeploy takes both re-minted credentials from custody, the connection string and the platform credential, and does not count toward the day's deploys. If a deploy of development is still in flight, the re-mint's response gives tzcloud_restart_application on development, and your tool calls it once that deploy ends. ${PROVISION_SUBCOMMAND} writes no ${PORT_SETTING}: ${RUN_SUBCOMMAND} sets it from ${RUN_OPTION.port}.`
   ],
   afterOwnError: provisionAfterOwnError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "turnzero",
-  "version": "0.38.0",
+  "version": "0.39.0",
   "type": "module",
   "description": "Deploy and run AI-built apps with Turn Zero Cloud hosting and backend services.",
   "license": "Apache-2.0",