turnzero 0.43.0 → 0.45.0-next.1

package/README.md

@@ -4,13 +4,13 @@ Build with AI. Turn Zero Cloud runs your backend—with hosting, PostgreSQL, fil
 
 ## Get started
 
-Paste this into Claude, ChatGPT, or Codex:
+Paste the setup prompt into your AI coding tool.
 
 ```text
 Set me up with Turn Zero Cloud and a small demo app. Read https://turnzero.ai/cloud/getting-started/set-up/index.md in full and follow the steps.
 ```
 
-Your AI connects Turn Zero Cloud and signs you in, or creates a free account. Then it gives you a build prompt to paste, which builds a demo you can open in your browser.
+Follow the setup steps for your AI coding tool to connect it to Turn Zero, sign in when asked, and paste the build prompt to build and deploy a small demo app.
 
 [Read the setup guide](https://turnzero.ai/cloud/getting-started/set-up/) · [Explore Turn Zero Cloud](https://turnzero.ai/cloud/)
 
@@ -24,6 +24,7 @@ To install it yourself, run `npm install -g turnzero`. It needs Node.js 24 or la
 
 - `deploy` zips your application, uploads it, deploys it, and waits for the result.
 - `check` tells you whether a deploy would be refused, without uploading anything.
+- `promote` promotes the version development serves, or a deployed version you name, to production, and prints the result.
 - `hash` prints the hash of the zip a deploy would upload.
 - `secret store` and `secret rotate` store a secret under a name, or replace its value.
 - `put` uploads one file to a storage area.

package/dist/turnzero-cloud.mjs

@@ -53,7 +53,9 @@ var COMMAND_ACTION_SURFACE = Object.freeze({
   create_environment: "tzcloud",
   deploy: "tzcloud",
   deploy_files: "tzcloud",
+  list_applications: "tzcloud",
   list_secrets: "tzcloud",
+  list_versions: "tzcloud",
   mint_upload_grant: "tzcloud",
   promote: "tzcloud",
   read_export: "tzcloud",
@@ -121,6 +123,12 @@ var CHECK_ACTION = "check_deploy";
 var HASH_SUBCOMMAND = "hash";
 var DEPLOY_OPTION = Object.freeze({ env: "--env", upload: "--upload", path: "--path", origin: "--origin", application: "--application" });
 var CHECK_OPTION = { application: "--application", path: "--path", origin: "--origin" };
+var PROMOTE_SUBCOMMAND = "promote";
+var PROMOTE_OPTION = {
+  application: "--application",
+  version: "--version-number",
+  origin: "--origin"
+};
 var HASH_OPTION = Object.freeze({ path: DEPLOY_OPTION.path, list: "--list", origin: DEPLOY_OPTION.origin });
 var HASH_LINE_HEAD = "sha256: ";
 var LINE_PROGRAM = TURNZERO_CLOUD_PACKAGE;
@@ -352,7 +360,9 @@ var TZMESH_OPTION = {
   description: "--description",
   title: "--title",
   join: "--join",
-  public: "--public"
+  public: "--public",
+  // A standing agent's key rotation (the tzmesh rotate plan's decision 1).
+  rotate: "--rotate"
 };
 var TZMESH_ESTATES = Object.freeze(["production", "development"]);
 var ESTATE_ORIGINS = Object.freeze({
@@ -377,6 +387,13 @@ var TZMESH_REGISTER_PATH = "/v1/register";
 var TZMESH_DELETE_AGENT_PATH = "/v1/delete_agent";
 var TZMESH_WEBHOOK_SET_PATH = "/v1/set_webhook";
 var TZMESH_JOIN_PATH = "/v1/join_channel";
+var TZMESH_LIST_PARTICIPANTS_PATH = "/v1/list_participants";
+var TZMESH_REMOVE_LISTENERS_PATH = "/v1/remove_listeners";
+var TZMESH_LABEL_MAX = 80;
+var tzmeshListenerLabelOf = (destination) => {
+  const where = "secret" in destination ? `secret ${destination.secret} ${destination.application === null ? "at the account" : `at ${destination.application} ${destination.environment ?? "production"}`}` : `file ${destination.toFile.split(/[\\/]/).pop() ?? destination.toFile}`;
+  return [...`${TZMESH_COMMAND_LABEL}: ${where}`].slice(0, TZMESH_LABEL_MAX).join("");
+};
 var TZMESH_WEBHOOK_ROUTE = "/tzmesh/webhook";
 var TZMESH_WEBHOOK_SECRET_PREFIX = "turnzero_tzmesh_whk_";
 var TZMESH_WEBHOOK_SECRET_FORM = new RegExp(`^${TZMESH_WEBHOOK_SECRET_PREFIX}[A-Za-z0-9_-]{43}$`);
@@ -392,6 +409,7 @@ var tzmeshMintMembers = (challenge) => [
 ];
 var tzmeshRegisterOptionsOf = (call) => [
   `${TZMESH_OPTION.name} ${call.name}`,
+  ...call.rotate === true ? [TZMESH_OPTION.rotate] : [],
   call.secret !== void 0 ? `${TZMESH_OPTION.secret} ${call.secret}` : `${TZMESH_OPTION.toFile} "${call.toFile ?? ""}"`,
   ...call.application !== void 0 ? [`${TZMESH_OPTION.application} ${call.application}`] : [],
   ...call.environment !== void 0 ? [`${TZMESH_OPTION.environment} ${call.environment}`] : [],
@@ -1064,7 +1082,8 @@ var variableReadSentence = (origin, standing) => {
   }
 };
 var fileReadSentence = (origin) => `The credential this run read was this computer's token for ${origin}, from its credential file: where the platform no longer accepts it, run ${LOGIN_SUBCOMMAND}${originWordsOf(origin)} to authorize this computer again.`;
-var noTokenSentence = (origin, expiredAt) => expiredAt === null ? `No credential was read, so nothing was sent: ${MINTED_TOKEN_VARIABLE} is not set, and this computer's credential file holds no token for ${origin}.` : `No credential was read, so nothing was sent: ${MINTED_TOKEN_VARIABLE} is not set, and this computer's token for ${origin} in its credential file expired at ${expiredAt}.`;
+var NO_COMPUTER_SIGN_IN_SENTENCE = "Signing in to a Turn Zero connection authorizes no computer.";
+var noTokenSentence = (origin, expiredAt) => expiredAt === null ? `No credential was read, so nothing was sent: ${MINTED_TOKEN_VARIABLE} is not set, and this computer's credential file holds no token for ${origin}. ${NO_COMPUTER_SIGN_IN_SENTENCE}` : `No credential was read, so nothing was sent: ${MINTED_TOKEN_VARIABLE} is not set, and this computer's token for ${origin} in its credential file expired at ${expiredAt}. ${NO_COMPUTER_SIGN_IN_SENTENCE}`;
 var VARIABLE_ROUTE_SENTENCES = `A tool connected by a minted token, or a job, sets ${MINTED_TOKEN_VARIABLE} from where its token is kept, never by writing the value in a command. It sets ${ORIGIN_VARIABLE} to the address that minted the token if that is not ${DEFAULT_COMMAND_ORIGIN}, then runs the command again. Such a tool cannot use ${MINT_TOKEN_ACTION}, which works only under a sign-in. A tool sets ${MINTED_TOKEN_VARIABLE} for one command at a time and unsets it once that command ends.`;
 var authorizeRouteSentence = (origin) => `${AUTHORIZE_SUBCOMMAND}${originWordsOf(origin)} run with nothing piped prints the ${MINT_TOKEN_ACTION} call a signed-in tool makes to authorize this computer.`;
 var LOGIN_ROUTE_OPENER = "A person signs in on this computer once, in a terminal of their own, and its token then stays on this computer for 30 days:";
@@ -1187,20 +1206,23 @@ var firstActNamed = (kind, origin = DEFAULT_COMMAND_ORIGIN) => kind === "tzmesh"
 ) : `${kind === "authorized computer" ? AUTHORIZE_SUBCOMMAND : `${TOKEN_SUBCOMMAND} ${TOKEN_REQUEST_ACT}`}${originWordsOf(origin)}`;
 var noConnectionLine = (origin) => `Where your tool holds no connection signed in to ${origin}, ${MINT_TOKEN_ACTION} is not among its tools: a person connects the tool and signs in, in a browser, before the call.`;
 var loginWaySentence = (loginLines) => `A person can instead sign in on this computer themselves, in a terminal of their own, by running ${loginLines.join(", then ")}, and approving the sign-in in the browser.`;
-var AUTHORIZE_HAND_OVER_SENTENCE = "If the answered line can't run here, a deploy can still go through a route that does not require the turnzero command. That is tzcloud_deploy_files within its caps or, past them where your tool can zip and upload the folder, tzcloud_mint_upload_grant followed by tzcloud_deploy naming the uploaded zip as artifact. Tell the person which route you take and why. Only where no such route serves, give the person that exact line to run once in their own terminal, never a rewritten one.";
+var AUTHORIZE_HAND_OVER_SENTENCE = `If the host refuses ${MINT_TOKEN_ACTION} or won't run its returned line, use a deploy route that needs no turnzero command. Use tzcloud_deploy_files within its caps or, past them where your tool can zip and upload the folder, use tzcloud_mint_upload_grant followed by tzcloud_deploy naming the uploaded zip as artifact. Tell the person which route you take and why. If neither route fits, ask the person to run the login command above in their own terminal.`;
 var TZMESH_HAND_OVER_SENTENCE = "If the answered line can't run here, give the person that exact line to run once in their own terminal, never a rewritten one.";
 var OPTIONS_LINE_HEAD = "options: ";
-var tzmeshFirstActLines = (origin, pending, completing2) => [
-  `To register a tzMesh agent, call ${MINT_TOKEN_ACTION} at ${origin} from your tool, through the connection you signed in with, naming the members below and no others. Then run the line it answers once, on this computer, with the options below after it.`,
-  noConnectionLine(origin),
-  `${CHALLENGE_LINE_HEAD}${pending.challenge}`,
-  CALL_LINE_HEAD,
-  ...mintCallMembers("tzmesh", pending.challenge, TZMESH_COMMAND_LABEL).map(([name, value]) => `  ${name}: ${JSON.stringify(value)}`),
-  `${OPTIONS_LINE_HEAD}${completing2}`,
-  `The line it answers holds no code. The run presents this computer's verifier, registers the agent with the token it mints, keeps the agent's secret where the options say, and revokes the token. No line prints the secret.`,
-  `The request is pending until ${pending.expires_at}: ${firstActNamed("tzmesh", origin)} run again with the same options before then prints this challenge again.`,
-  TZMESH_HAND_OVER_SENTENCE
-];
+var tzmeshFirstActLines = (origin, pending, completing2) => {
+  const rotating = completing2.split(" ").includes(TZMESH_OPTION.rotate);
+  return [
+    `${rotating ? "To add a new key to this tzMesh agent" : "To register a tzMesh agent"}, call ${MINT_TOKEN_ACTION} at ${origin} from your tool, through the connection you signed in with, naming the members below and no others. Then run the line it answers once, on this computer, with the options below after it.`,
+    noConnectionLine(origin),
+    `${CHALLENGE_LINE_HEAD}${pending.challenge}`,
+    CALL_LINE_HEAD,
+    ...mintCallMembers("tzmesh", pending.challenge, TZMESH_COMMAND_LABEL).map(([name, value]) => `  ${name}: ${JSON.stringify(value)}`),
+    `${OPTIONS_LINE_HEAD}${completing2}`,
+    rotating ? `The line it answers holds no code. The run presents this computer's verifier, uses the minted token to add the new key, saves the new key's secret where the options say, and revokes the minted token. No line prints the secret.` : `The line it answers holds no code. The run presents this computer's verifier, registers the agent with the token it mints, keeps the agent's secret where the options say, and revokes the token. No line prints the secret.`,
+    `The request is pending until ${pending.expires_at}: ${firstActNamed("tzmesh", origin)} run again with the same options before then prints this challenge again.`,
+    TZMESH_HAND_OVER_SENTENCE
+  ];
+};
 var firstActLines = (origin, kind, pending, label, loginLines = [], completing2 = "") => kind === "tzmesh" ? tzmeshFirstActLines(origin, pending, completing2) : [
   kind === "authorized computer" ? `To authorize this computer at ${origin}, call ${MINT_TOKEN_ACTION} from your tool, through the connection you signed in with, naming the members below and no others. Then run the line it answers once, as given, on this computer.` : `To mint a token whose value never passes through the chat, call ${MINT_TOKEN_ACTION} at ${origin} from your tool, through the connection you signed in with. Name the member below beside the scope_kind, application, grants, label, and expires_in_days the task needs.`,
   // The case this command cannot see (#4273): a tool with no signed-in
@@ -1423,6 +1445,14 @@ async function completeAct(io2, origin, kind, presentation, userAgent, say, deli
   let waiting = false;
   const release = io2.whenEnded(() => {
     stage.ended = true;
+    const settling = carried?.settle?.(stage.now) ?? null;
+    if (settling !== null) {
+      return settling.then((line) => {
+        say(line);
+        dropCredentialWriting(io2, place, tag);
+        carried?.drop();
+      });
+    }
     say(
       carried !== null ? carried.endedLine(stage.now) : device !== null && waiting ? device.stoppedLine : stage.now === "unsent" ? `The run was ended before its exchange. ${unread}` : stage.now === "sent" ? `The run was ended during its exchange. ${exchangeUnknownSentence(kind, origin, login2)}` : `The run was ended after its exchange minted a token, which may not have been ${kind === "authorized computer" ? "kept" : "printed"}: list_tokens from your tool shows it by its label, and revoke_token ends it.`
     );
@@ -6256,7 +6286,7 @@ var LIBRARY_CREDENTIAL = Object.freeze({
 var LIBRARY_READS = `no standard input. It reads a minted token from ${MINTED_TOKEN_VARIABLE} if that is set. Otherwise it reads this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write, and sends it only to that address. With neither, it prints the variable route first, then the sign-in route if the address is admitted`;
 var TAKE_AFTER_LOGIN = `Once ${LOGIN_SUBCOMMAND} has printed authorized:, run this take line again. ${NOTHING_WRITTEN2}`;
 var takeRedirectedLine = (status) => `${LIBRARY_READ_ACTION} was answered ${status >= 100 ? `${answeredHow(status)}, a redirect` : answeredHow(status)}, which the command never follows, so the credential was sent to no second address. ${NOTHING_WRITTEN2}`;
-async function readTakeCredential(io2, named, afterLogin, why) {
+async function readTakeCredential(io2, named, afterLogin, why, refused) {
   const line = { named, closing: NOTHING_WRITTEN2 };
   const read2 = await readCredential(io2, LIBRARY_CREDENTIAL, "", line);
   if ("unauthorized" in read2) {
@@ -6266,7 +6296,7 @@ async function readTakeCredential(io2, named, afterLogin, why) {
     const unwritable = loginRouteRefusalOf(io2, NOTHING_WRITTEN2);
     if (unwritable !== null) return { lines: [...head, VARIABLE_ROUTE_SENTENCES, unwritable] };
     const route = loginRouteLines(io2, origin.origin, false);
-    return { lines: [...head, VARIABLE_ROUTE_SENTENCES, authorizeRouteSentence(origin.origin), ...route, afterLogin] };
+    return { lines: [...head, VARIABLE_ROUTE_SENTENCES, authorizeRouteSentence(origin.origin), ...refused !== void 0 ? [refused] : [], ...route, afterLogin] };
   }
   if ("refusal" in read2) return { lines: [read2.refusal] };
   io2.hide(read2.credential, REDACTED_TOKEN);
@@ -7565,6 +7595,164 @@ var startUpgradeCheck = (io2, subcommand, named, running) => {
   };
 };
 
+// src/turnzero_cloud_command/promote.ts
+var NOTHING_SENT_OR_PROMOTED = "Nothing was sent and nothing was promoted.";
+var PROMOTE_ACT = "promote";
+var PROMOTE_WAIT_SECONDS = 45;
+var VERSION_FORM3 = /^[1-9][0-9]{0,8}$/;
+var promoteOptionsOf = (named) => {
+  const application = named[PROMOTE_OPTION.application];
+  if (application === void 0 || !UPLOAD_ID.test(application)) {
+    return { refusal: `${PROMOTE_OPTION.application} gives the application to promote, by its id, a lowercase UUID, as ${toolNameOf("list_applications")} returns it. ${NOTHING_SENT_OR_PROMOTED}` };
+  }
+  const version = named[PROMOTE_OPTION.version];
+  if (version !== void 0 && !VERSION_FORM3.test(version)) {
+    return { refusal: `${PROMOTE_OPTION.version} gives a version of the application's history by its number, as ${toolNameOf("list_versions")} returns it: a whole number from 1, at most nine digits, with no leading zero. ${NOTHING_SENT_OR_PROMOTED}` };
+  }
+  const origin = commandOriginOf(named[PROMOTE_OPTION.origin] ?? DEFAULT_COMMAND_ORIGIN);
+  if ("refusal" in origin) return origin;
+  return version === void 0 ? { application } : { application, version: Number(version) };
+};
+var PROMOTE_OPTIONS = Object.freeze([
+  {
+    name: PROMOTE_OPTION.application,
+    value: "<application id>",
+    required: true,
+    description: `The application to promote, by its id, a lowercase UUID, as ${toolNameOf("list_applications")} returns it.`
+  },
+  {
+    name: PROMOTE_OPTION.version,
+    value: "<number>",
+    required: false,
+    description: `The number of a version in the application's history to promote, as ${toolNameOf("list_versions")} returns it: a whole number from 1, at most nine digits, with no leading zero. If omitted, the version the development environment serves.`
+  },
+  {
+    name: PROMOTE_OPTION.origin,
+    value: "<origin>",
+    required: false,
+    description: `The platform's address. If omitted, the address in ${ORIGIN_VARIABLE}, or ${DEFAULT_COMMAND_ORIGIN} if that is unset. Under ${MINTED_TOKEN_VARIABLE} the token is sent only to the address in ${ORIGIN_VARIABLE}, or to ${DEFAULT_COMMAND_ORIGIN} if that is unset. Otherwise it gives the address whose token the command reads from this computer's credential file, and that token is sent only to that address.`
+  }
+]);
+var PROMOTE_CREDENTIAL = Object.freeze({
+  grant: "minted token",
+  aGrant: "a minted token",
+  call: `the ${toolNameOf("promote")} call`,
+  mintedToken: true,
+  piped: false,
+  places: NO_INPUT_PLACES
+});
+var PROMOTE_READS = `no standard input. It reads a minted token from ${MINTED_TOKEN_VARIABLE} if that is set. Otherwise it reads this computer's token for the platform's address from its credential file, which ${LOGIN_SUBCOMMAND} and ${AUTHORIZE_SUBCOMMAND} write, and sends it only to that address. With neither, it prints the variable route first, then the sign-in route if the address is admitted`;
+var PROMOTE_AFTER_LOGIN = `Once login has printed authorized:, run this promote line again. ${NOTHING_SENT_OR_PROMOTED}`;
+var NEXT_LINE_HEAD = "next: ";
+var nextLineOf = (application, waitSeconds) => `${NEXT_LINE_HEAD}call ${toolNameOf("read_status")} with application ${application}, environment production, and wait_seconds ${waitSeconds}, to read the promote's end.`;
+var unknownStartLineOf = (application) => `Whether the promote started is unknown: call ${toolNameOf("read_status")} with application ${application} and environment production, and run this line again only if that read shows no promote started after this call.`;
+var ANSWER_STATES = Object.freeze(["deployed", "failed", "deploying"]);
+var promoteAnswerOf = (answer) => {
+  const { state, summary, detail, next } = answer;
+  if (typeof state !== "string" || !ANSWER_STATES.includes(state)) return null;
+  let nextWait = null;
+  if (next !== null && typeof next === "object" && !Array.isArray(next)) {
+    const { action, arguments: args } = next;
+    const wait = args !== null && typeof args === "object" ? args.wait_seconds : void 0;
+    if (action === "read_status" && typeof wait === "number" && Number.isInteger(wait) && wait > 0) nextWait = wait;
+  }
+  return { state, summary: typeof summary === "string" ? summary : null, detail: typeof detail === "string" ? detail : null, nextWait };
+};
+async function promote(named, io2) {
+  const options = promoteOptionsOf(named);
+  if ("refusal" in options) {
+    io2.print(options.refusal);
+    return COMMAND_STATUS.nothing_started;
+  }
+  const agent = userAgentOf(io2.env);
+  if ("refusal" in agent) {
+    io2.print(agent.refusal);
+    return COMMAND_STATUS.nothing_started;
+  }
+  const line = { named: named[PROMOTE_OPTION.origin], closing: NOTHING_SENT_OR_PROMOTED };
+  const credential = await readCredential(io2, PROMOTE_CREDENTIAL, "", line);
+  if ("unauthorized" in credential) {
+    io2.print(noTokenSentence(credential.unauthorized.origin, credential.unauthorized.expiredAt));
+    io2.print(VARIABLE_ROUTE_SENTENCES);
+    const reached = authorizationOriginOf(io2.env, named[PROMOTE_OPTION.origin], NOTHING_SENT_OR_PROMOTED);
+    if ("refusal" in reached) {
+      io2.print(reached.refusal);
+      return COMMAND_STATUS.nothing_started;
+    }
+    const unwritable = loginRouteRefusalOf(io2, NOTHING_SENT_OR_PROMOTED);
+    if (unwritable !== null) {
+      io2.print(unwritable);
+      return COMMAND_STATUS.nothing_started;
+    }
+    for (const routeLine of loginRouteLines(io2, reached.origin)) io2.print(routeLine);
+    io2.print(PROMOTE_AFTER_LOGIN);
+    return COMMAND_STATUS.nothing_started;
+  }
+  if ("refusal" in credential) {
+    io2.print(credential.refusal);
+    return COMMAND_STATUS.nothing_started;
+  }
+  io2.hide(credential.credential, REDACTED_TOKEN);
+  const sent = credentialOriginOf(io2.env, credential, line);
+  if ("refusal" in sent) {
+    io2.print(sent.refusal);
+    return COMMAND_STATUS.nothing_started;
+  }
+  const origin = sent.origin;
+  const older = await planeWireRefusal(io2, origin);
+  if (older !== null) {
+    io2.print(older);
+    return COMMAND_STATUS.nothing_started;
+  }
+  const unknown = (lines) => {
+    for (const printed of lines) io2.print(printed);
+    io2.print(unknownStartLineOf(options.application));
+    return COMMAND_STATUS.unknown;
+  };
+  const body = { application: options.application, ...options.version !== void 0 ? { version: options.version } : {}, wait_seconds: PROMOTE_WAIT_SECONDS };
+  const answered = await postAction(io2, origin, "promote", credential.credential, agent.userAgent, body);
+  if (answered === null) return unknown([`The ${PROMOTE_ACT} call drew no answer.`]);
+  if (answered.redirected) return unknown([`The ${PROMOTE_ACT} call was answered ${answeredHow(answered.status)}, which the command never follows, so the credential was sent to no second address.`]);
+  if (answered.status >= PLATFORM_FAILURE_STATUS) return unknown(failureLines(PROMOTE_ACT, answered.status, planeRefusalOf(answered.text)));
+  if (answered.status < 200 || answered.status > 299) {
+    const refusal = markedRefusalOf(answered.status, answered.text);
+    if (refusal === null) return unknown([notThePlatformLine(PROMOTE_ACT, answered.status)]);
+    for (const printed of refusalLines(PROMOTE_ACT, answered.status, refusal)) io2.print(printed);
+    io2.print(credential.source === "credential_file" ? fileReadSentence(origin) : variableReadSentence(origin, fileStandingOf(io2, origin, io2.print)));
+    return COMMAND_STATUS.nothing_started;
+  }
+  const object = planeObjectOf(answered.text);
+  const answer = object === null ? null : promoteAnswerOf(object);
+  if (answer === null) return unknown([`The ${PROMOTE_ACT} call was answered HTTP ${answered.status} with no answer the command can read.`]);
+  if (answer.summary !== null) io2.print(oneLine(answer.summary));
+  if (answer.detail !== null) io2.print(oneLine(answer.detail));
+  if (answer.state === "deployed") return COMMAND_STATUS.done;
+  if (answer.state === "failed") return COMMAND_STATUS.failed;
+  io2.print(nextLineOf(options.application, answer.nextWait ?? PROMOTE_WAIT_SECONDS));
+  return COMMAND_STATUS.unknown;
+}
+var PROMOTE_AFTER_OWN_ERROR = `the promote may have started, so call ${toolNameOf("read_status")} for the application's production environment, and run the line again only if that read shows no promote started after this call`;
+var PROMOTE_ROW = Object.freeze({
+  name: PROMOTE_SUBCOMMAND,
+  summary: `Promotes a version to production through the platform's ${toolNameOf("promote")} action: the version the development environment serves, or the one ${PROMOTE_OPTION.version} gives. It makes one ${toolNameOf("promote")} call under the same credential as check and waits up to ${PROMOTE_WAIT_SECONDS} seconds for its end. It prints the platform's own summary and detail. With no credential, it sends nothing and prints the two routes to get one.`,
+  example: `${PROMOTE_SUBCOMMAND} ${PROMOTE_OPTION.application} <application id>`,
+  options: PROMOTE_OPTIONS,
+  credential: PROMOTE_CREDENTIAL,
+  reads: PROMOTE_READS,
+  statuses: {
+    done: "the promoted version serves production",
+    failed: "the promote ended failed, as the printed detail says",
+    unknown: `the promote is still running, or its start is unknown: the printed line gives the ${toolNameOf("read_status")} call that reads it`,
+    nothing_started: "nothing was promoted. An option or the credential was refused, or no credential was read and the two routes to get one were printed. Or the platform was too old, or it refused the call"
+  },
+  note: [
+    `A promote reuses the image built at deploy and gives the version production's own settings and credentials, as the ${toolNameOf("promote")} call does. If you omit ${PROMOTE_OPTION.version}, check that development serves the version you want in production. To promote a specific version, use ${PROMOTE_OPTION.version} with the number of a deployed version that has not been retired. It never re-mints the production database's password, which stays the tool's own ${toolNameOf("promote")} call with rotate_database_credential.`,
+    `Where the call drew no answer, or the answer was not the platform's or could not be read, the promote may have started. Call ${toolNameOf("read_status")} for the application's production environment, and run the line again only if that read shows no promote started after the call.`
+  ],
+  afterOwnError: PROMOTE_AFTER_OWN_ERROR,
+  run: (call, io2) => promote(call.named, io2)
+});
+
 // src/turnzero_cloud_command/provision.ts
 import { basename as basename3, dirname as dirname6, join as join10 } from "node:path";
 var PROVISION_OPTIONS = Object.freeze([
@@ -9413,9 +9601,11 @@ var RESOURCE_TEMPLATE_CHOICES = RESOURCE_TEMPLATES.map((template) => `${SCAFFOLD
 var perResourceTemplate = (of) => listedAnd(RESOURCE_TEMPLATES.map((template) => `${orListed(of(keptOf(template)))} under ${template}`));
 var orListed = (names) => names.length < 3 ? names.join(" or ") : `${names.slice(0, -1).join(", ")}, or ${names[names.length - 1]}`;
 var andListed = (names) => names.length < 3 ? names.join(" and ") : `${names.slice(0, -1).join(", ")}, and ${names[names.length - 1]}`;
+var PUBLIC_GALLERY_STARTER_SENTENCE = "For a public gallery with no sign-in, follow the complete starter in Store files, under A public upload service with no sign-in (read_documentation, page /cloud/guides/store-files/).";
 var templatesDescribed = () => [
   `The template to write, one of ${andListed(SCAFFOLD_TEMPLATES)}, ${SCAFFOLD_DEFAULT_TEMPLATE} if omitted.`,
-  ...SCAFFOLD_TEMPLATES.map((template) => `The ${template} template is ${TEMPLATE_FACTS[template].is}.`)
+  ...SCAFFOLD_TEMPLATES.map((template) => `The ${template} template is ${TEMPLATE_FACTS[template].is}.`),
+  PUBLIC_GALLERY_STARTER_SENTENCE
 ].join(" ");
 var OTHER_TYPE_WAY_ON = "For a type outside these, name the nearest kind, then change the written migration and routes: the files are your service's own.";
 var SCAFFOLD_OPTIONS = Object.freeze([
@@ -10307,7 +10497,7 @@ async function scaffold(call, io2) {
       if ("lines" in found) return refuse(...found.lines);
       held = found;
     } else {
-      const credential = await readTakeCredential(io2, call.named[SCAFFOLD_OPTION.origin], SCAFFOLD_AFTER_LOGIN, SCAFFOLD_SIGN_IN_WHY);
+      const credential = await readTakeCredential(io2, call.named[SCAFFOLD_OPTION.origin], SCAFFOLD_AFTER_LOGIN, SCAFFOLD_SIGN_IN_WHY, SCAFFOLD_REFUSED_MINT_SENTENCE);
       if ("lines" in credential) return refuse(...credential.lines);
       lineOrigin = credential.origin;
       takeLines = takeLinesFor(lineOrigin);
@@ -10403,6 +10593,7 @@ var SCAFFOLD_CREDENTIAL = LIBRARY_CREDENTIAL;
 var SCAFFOLD_READS = `what library take reads under a template that takes library entries: ${LIBRARY_READS}. Under a template that takes none, it reads no credential`;
 var SCAFFOLD_AFTER_LOGIN = `Once ${LOGIN_SUBCOMMAND} has printed authorized:, run this ${SCAFFOLD_SUBCOMMAND} line again. ${NOTHING_WRITTEN2}`;
 var SCAFFOLD_SIGN_IN_WHY = `A template that takes library entries needs a sign-in, since the library's reads are under a credential. The ${SCAFFOLD_DEFAULT_TEMPLATE} template, which takes none, runs without one.`;
+var SCAFFOLD_REFUSED_MINT_SENTENCE = `If the host refuses ${MINT_TOKEN_ACTION} or its returned line, ask the person to run the login line below in their own terminal, or build without ${SCAFFOLD_SUBCOMMAND} using signed-in tzcloud_read_library and tzcloud_deploy_files within its caps.`;
 var SCAFFOLD_ROW = Object.freeze({
   name: SCAFFOLD_SUBCOMMAND,
   summary: `Writes a new service from a template into a project, ${SCAFFOLD_DEFAULT_TEMPLATE} if the command has no ${SCAFFOLD_OPTION.template}. It writes the template's files under app/, runs npm install and npm test there, and prints the next steps. It starts a new application, and writes over no file. Some templates take library entries: database-service takes the Database entry, and web-app takes three. Such a template takes each entry as library take does, under the same credential and with the same checks, before it writes anything. It fills the manifest's packages member from the library folder's rows. With no credential, it writes nothing, and prints the sign-in route and this command to run again once you are signed in. A template that takes no entry reads no credential.`,
@@ -10511,6 +10702,13 @@ var TZMESH_OPTIONS = Object.freeze([
     required: true,
     description: "The agent's name, 1 to 32 letters, digits, hyphens, and underscores. Its handle is this name under your account's handle."
   },
+  {
+    name: TZMESH_OPTION.rotate,
+    value: "",
+    required: false,
+    flag: true,
+    description: `Adds a program key to the standing agent named by ${TZMESH_OPTION.name} and saves it to the chosen destination. For webhook rotations, it sets the webhook on the new key. After the command succeeds, restart your program, then end the old key.`
+  },
   {
     name: TZMESH_OPTION.secret,
     value: "<secret name>",
@@ -10545,7 +10743,7 @@ var TZMESH_OPTIONS = Object.freeze([
     name: TZMESH_OPTION.webhookSecret,
     value: "<secret name>",
     required: false,
-    description: `With ${TZMESH_OPTION.webhookOrigin}, the name the webhook's signing secret is stored under, in the scope ${TZMESH_OPTION.secret} is stored in. It names the secret and never holds it.`
+    description: `With ${TZMESH_OPTION.webhookOrigin}, or alone under ${TZMESH_OPTION.rotate}, the name the webhook's signing secret is stored under, in the scope ${TZMESH_OPTION.secret} is stored in. It names the secret and never holds it.`
   },
   {
     name: TZMESH_OPTION.description,
@@ -10598,6 +10796,35 @@ var TZMESH_OPTIONS = Object.freeze([
     description: `The mint the line names, by its id, as the line a ${MINT_TOKEN_ACTION} call answers names it. The id is no credential. Under it, the command presents this computer's verifier for that mint.`
   }
 ]);
+var ROTATE_REFUSED = [TZMESH_OPTION.description, TZMESH_OPTION.title, TZMESH_OPTION.join];
+var rotateOptionsOf = (call, toFile, closing) => {
+  const named = (option) => call.named[option] ?? null;
+  const refused = [...ROTATE_REFUSED.filter((option) => named(option) !== null), ...call.flags.has(TZMESH_OPTION.public) ? [TZMESH_OPTION.public] : []];
+  if (refused.length > 0) {
+    return { refusal: `${refused[0]} sets up a new agent, and ${TZMESH_OPTION.rotate} keeps the agent as it stands: leave ${refused[0]} out. ${closing}` };
+  }
+  const webhookOrigin = named(TZMESH_OPTION.webhookOrigin);
+  const webhookSecret = named(TZMESH_OPTION.webhookSecret);
+  if (toFile && (webhookOrigin !== null || webhookSecret !== null)) {
+    return { refusal: `${webhookOrigin !== null ? TZMESH_OPTION.webhookOrigin : TZMESH_OPTION.webhookSecret} goes with ${TZMESH_OPTION.secret} alone: a file holds one value, and a webhook needs two. ${closing}` };
+  }
+  if (webhookOrigin !== null && webhookSecret === null) {
+    return { refusal: `${TZMESH_OPTION.webhookOrigin} moves the webhook, and its signing secret goes under the name ${TZMESH_OPTION.webhookSecret} gives: name it too. ${closing}` };
+  }
+  if (webhookOrigin !== null && !isHttpsOrigin(webhookOrigin)) {
+    return {
+      refusal: `${TZMESH_OPTION.webhookOrigin} names the https origin of the application that hosts the agent, such as https://<name>.ai.host: its host in lowercase letters, digits, hyphens, and dots, with no path. ${closing}`
+    };
+  }
+  if (webhookSecret !== null && !SECRET_NAME_FORM.test(webhookSecret)) {
+    return { refusal: `${TZMESH_OPTION.webhookSecret} names the secret the webhook's signing secret is stored under: a letter or digit first, then letters, digits, _ or -, up to 64 characters. ${closing}` };
+  }
+  const secret2 = named(TZMESH_OPTION.secret);
+  if (webhookSecret !== null && secret2 !== null && webhookSecret.toLowerCase() === secret2.toLowerCase()) {
+    return { refusal: `${TZMESH_OPTION.webhookSecret} names a secret other than the one ${TZMESH_OPTION.secret} names: the agent's secret and the webhook's signing secret are stored under two names. ${closing}` };
+  }
+  return { rotateWebhook: webhookSecret === null ? null : { origin: webhookOrigin, secretName: webhookSecret } };
+};
 var SETUP_OPTIONS = [TZMESH_OPTION.webhookOrigin, TZMESH_OPTION.webhookSecret, TZMESH_OPTION.description, TZMESH_OPTION.title, TZMESH_OPTION.join];
 var UNCARRIED_WORDS = "a double quote, $, a backtick, %, !, &, |, <, >, ^, a curly double quote, a doubled or trailing backslash, or a control character";
 var JOIN_CHANNEL_FORM = /^[^\s,]{1,200}$/;
@@ -10696,7 +10923,10 @@ var tzmeshOptionsOf = (call, io2) => {
   if (path !== null && !lineValueCarries(path)) {
     return { refusal: `${TZMESH_OPTION.toFile} names a path holding a character a line cannot carry alike in every shell between double quotes: ${UNCARRIED_WORDS}. Name a path without one. ${closing}` };
   }
-  const setup = setupOptionsOf(call, toFile !== void 0, closing);
+  const rotate = call.flags.has(TZMESH_OPTION.rotate);
+  const rotation = rotate ? rotateOptionsOf(call, toFile !== void 0, closing) : { rotateWebhook: null };
+  if ("refusal" in rotation) return rotation;
+  const setup = rotate ? { webhook: null, description: null, title: null, join: [], public: false } : setupOptionsOf(call, toFile !== void 0, closing);
   if ("refusal" in setup) return setup;
   const origin = entryOriginOf(io2.env, call.named[TZMESH_OPTION.origin], closing);
   if ("refusal" in origin) return origin;
@@ -10713,16 +10943,21 @@ var tzmeshOptionsOf = (call, io2) => {
     origin: origin.origin,
     estate,
     mint,
-    ...setup
+    ...setup,
+    rotate,
+    rotateWebhook: rotation.rotateWebhook
   };
 };
+var destinationOf = (options) => "secret" in options.route ? { secret: options.route.secret, application: options.application, environment: options.environment } : { toFile: options.route.toFile };
 var completingOptionsOf = (options) => {
   const call = {
     name: options.name,
+    ...options.rotate ? { rotate: true } : {},
     ..."secret" in options.route ? { secret: options.route.secret } : { toFile: options.route.toFile },
     ...options.application !== null ? { application: options.application } : {},
     ...options.environment !== null ? { environment: options.environment } : {},
     ...options.webhook !== null ? { webhookOrigin: options.webhook.origin, webhookSecret: options.webhook.secretName } : {},
+    ...options.rotateWebhook !== null ? { ...options.rotateWebhook.origin !== null ? { webhookOrigin: options.rotateWebhook.origin } : {}, webhookSecret: options.rotateWebhook.secretName } : {},
     ...options.description !== null ? { description: options.description } : {},
     ...options.title !== null ? { title: options.title } : {},
     ...options.join.length > 0 ? { join: options.join } : {},
@@ -10816,7 +11051,9 @@ var register = async (io2, wire, token2, userAgent, options) => {
   const answered = await postWire(io2, wire, TZMESH_REGISTER_PATH, token2, userAgent, {
     kind: "standing",
     name: options.name,
-    label: TZMESH_COMMAND_LABEL,
+    // The listener's label names where its secret went (the tzmesh rotate
+    // plan's decision 2), so a rotation for the same place finds it.
+    label: tzmeshListenerLabelOf(destinationOf(options)),
     ...options.title !== null ? { title: options.title } : {},
     ...options.description !== null ? { description: options.description } : {},
     ...options.public ? { visibility: "public" } : {}
@@ -10918,6 +11155,105 @@ var revokeRunToken = async (io2, plane, bearer, id, userAgent) => {
   }
   return [...lines, tokenStandsSentence(id)];
 };
+var READ_ACT = "list_participants";
+var ATTACH_ACT = "attach";
+var REMOVE_ACT = "remove_listeners";
+var LIST_SECRETS_ACTION = "list_secrets";
+var ATTACHED_LINE_HEAD = "attached: ";
+var PRINTED_INSTANT_FORM = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/;
+var recordOf = (value) => value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+var isWebhookUrl = (value) => {
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && url.hostname !== "" && url.username === "" && url.password === "" && url.hash === "";
+  } catch {
+    return false;
+  }
+};
+var rotatedAgentOf = (answer, name) => {
+  const participants = Array.isArray(answer.participants) ? answer.participants : [];
+  for (const entry of participants) {
+    const record = recordOf(entry);
+    if (record === null || record.kind !== "standing") continue;
+    const handle = typeof record.handle === "string" ? record.handle : null;
+    const named = record.name === name || handle !== null && handle.includes("/") && handle.slice(handle.lastIndexOf("/") + 1) === name;
+    if (!named) continue;
+    if (typeof record.id !== "string" || !PRINTED_NAME_FORM.test(record.id)) return null;
+    const webhook = recordOf(record.webhook);
+    const webhookUrl = typeof webhook?.url === "string" && isWebhookUrl(webhook.url) ? webhook.url : null;
+    const rows = Array.isArray(record.served_by) ? record.served_by : [];
+    const programListeners = rows.map(recordOf).filter((row) => row !== null && row.kind === "program" && typeof row.id === "string" && PRINTED_NAME_FORM.test(row.id)).map((row) => ({
+      id: row.id,
+      label: typeof row.label === "string" ? row.label : null,
+      madeAt: typeof row.created_at === "string" && PRINTED_INSTANT_FORM.test(row.created_at) ? row.created_at : null
+    }));
+    return { id: record.id, handle: handle !== null && PRINTED_NAME_FORM.test(handle) ? handle : null, webhookUrl, programListeners };
+  }
+  return null;
+};
+var storedAtScope = (answer, name, application, environment) => {
+  const secrets = Array.isArray(answer.secrets) ? answer.secrets : [];
+  return secrets.some((entry) => {
+    const row = recordOf(entry);
+    if (row === null || row.name !== name) return false;
+    if (application === null) return (row.application ?? null) === null;
+    return row.application === application && row.environment === (environment ?? "production");
+  });
+};
+var attachListener = async (io2, wire, token2, userAgent, agent, label) => {
+  const answered = await postWire(io2, wire, TZMESH_REGISTER_PATH, token2, userAgent, { attach: agent.id, kind: "standing", session_secret: false, label });
+  if (answered === null) return { unknown: [`The ${ATTACH_ACT} drew no answer.`] };
+  if (answered.redirected) return { unknown: [`The ${ATTACH_ACT} was answered ${answeredHow(answered.status)}, which the command never follows, so the token was sent to no second address.`] };
+  const answer = planeObjectOf(answered.text);
+  if (answer !== null && typeof answer.secret === "string") io2.hide(answer.secret, REDACTED_PROGRAM_SECRET);
+  if (answered.status >= PLATFORM_FAILURE_STATUS) return { unknown: failureLines(ATTACH_ACT, answered.status, planeRefusalOf(answered.text)) };
+  if (answered.status < 200 || answered.status > 299) {
+    const refusal = planeRefusalOf(answered.text);
+    if (refusal === null) return { unknown: [`The ${ATTACH_ACT} was answered HTTP ${answered.status}, not by the tzMesh service.`] };
+    return { refused: [...refusalLines(ATTACH_ACT, answered.status, refusal), "No key was added."] };
+  }
+  const listener = typeof answer?.listener === "string" && PRINTED_NAME_FORM.test(answer.listener) ? answer.listener : null;
+  const secret2 = answer?.secret;
+  if (listener === null || typeof secret2 !== "string" || !TZMESH_SECRET_FORM.test(secret2)) {
+    return { unknown: [`The ${ATTACH_ACT} was answered HTTP ${answered.status} with no new key the command can read.`] };
+  }
+  return { secret: secret2, listener };
+};
+var removeListener = async (io2, wire, token2, userAgent, agent, listener) => {
+  const answered = await postWire(io2, wire, TZMESH_REMOVE_LISTENERS_PATH, token2, userAgent, { participant: agent.id, listener });
+  const removed = answered !== null && !answered.redirected && answered.status >= 200 && answered.status <= 299 && planeObjectOf(answered.text) !== null;
+  if (removed) return { removed: true, lines: [`The new key ${listener} was removed, so the stored names still hold the old key, which stays live.`], unknown: false };
+  const refusal = answered === null || answered.redirected || answered.status >= PLATFORM_FAILURE_STATUS ? null : planeRefusalOf(answered.text);
+  const why = answered === null ? [`The ${REMOVE_ACT} drew no answer.`] : answered.redirected ? [`The ${REMOVE_ACT} was answered ${answeredHow(answered.status)}, which the command never follows.`] : answered.status >= PLATFORM_FAILURE_STATUS ? failureLines(REMOVE_ACT, answered.status, planeRefusalOf(answered.text)) : refusal !== null ? refusalLines(REMOVE_ACT, answered.status, refusal) : [`The ${REMOVE_ACT} was answered HTTP ${answered.status}, not by the tzMesh service.`];
+  return { removed: false, lines: why, unknown: refusal === null };
+};
+var personEndsKeyAt = (estate) => `${ESTATE_ORIGINS[estate].site}/me under Hosted agents, open the agent's Manage keys, and choose End key`;
+var noStandingAgentSentence = (name) => `The account holds no standing agent named ${name}, so ${TZMESH_OPTION.rotate} has no key to replace.`;
+var webhookNameOwedSentence = () => `The agent answers a webhook, so its new key needs a new signing secret too: name the signing secret's stored name with ${TZMESH_OPTION.webhookSecret}, beside ${TZMESH_OPTION.secret}.`;
+var webhookNotAnsweredSentence = () => `The agent answers no webhook, so ${TZMESH_OPTION.webhookSecret} names nothing to replace: leave it out, or add ${TZMESH_OPTION.webhookOrigin} to set one.`;
+var notStoredSentence = (option, name) => `${option} names ${name}, which is not stored at that scope, and ${TZMESH_OPTION.rotate} replaces only a name its setup stored: name the stored name, or set the agent up again.`;
+var NOTHING_CHANGED = "Nothing changed.";
+var attachedLineOf = (agent, listener, label) => `${ATTACHED_LINE_HEAD}a new key ${listener} for agent ${agent.handle ?? `with id ${agent.id}`}, labelled "${label}", its secret printed nowhere`;
+var attachUnknownSentence = (label, estate) => `The command could not tell whether it added a key, so it removed none. Use tzmesh_list_participants to look for the destination label "${label}". More than one key can have that label. End a key at ${personEndsKeyAt(estate)} only if you can identify it as the new key and verify it is unused.`;
+var crossingSentence = () => `Another run added a key to the agent while this one ran, so this run stops: run ${TZMESH_OPTION.rotate} once more, alone.`;
+var unremovedSentence = (listener, estate) => `The new key ${listener} stands, and no stored name holds its secret, so it serves nothing: your person can end it at ${personEndsKeyAt(estate)}.`;
+var storeUnknownRotateSentence = (name, listener) => `Whether ${name} now holds the new key ${listener} is unknown: tzcloud_list_secrets from your tool shows when it was last written. Either way the key it holds stays live. Run ${TZMESH_OPTION.rotate} again before restarting your program.`;
+var WEBHOOK_UNSET_SENTENCE = `The new key has no webhook. Run ${TZMESH_OPTION.rotate} again before restarting your program.`;
+var webhookClearedSentence = (programName, signingName) => `The program secret ${programName} holds the new key. The signing secret ${signingName} was not updated, and the new key's webhook was cleared. Run ${TZMESH_OPTION.rotate} again before restarting.`;
+var signingUnknownRotateSentence = (signingName) => `The command could not confirm whether ${signingName} was updated. Use tzcloud_list_secrets to see when it was last written. The new key's webhook was cleared. Run ${TZMESH_OPTION.rotate} again before restarting.`;
+var webhookUnclearedSentence = (listener, estate) => `The command could not confirm that the webhook was cleared on the new key ${listener}. Run ${TZMESH_OPTION.rotate} again and restart your program before ending key ${listener} at ${personEndsKeyAt(estate)}.`;
+var crossingAfterSentence = () => `Another run added a key to the agent while this one ran, so the stored names may hold a mixed pair: run ${TZMESH_OPTION.rotate} once more, alone, before restarting your program.`;
+var crossingUnreadSentence = () => `Whether another run added a key meanwhile is unknown: tzmesh_list_participants from your tool shows the agent's keys. Where only this run's new key is new, restart your program as below.`;
+var keyMadeWordsOf = (instant) => `${new Date(instant).toLocaleString("en-GB", { day: "numeric", month: "short", year: "numeric", hour: "2-digit", minute: "2-digit", timeZone: "UTC" })} UTC`;
+var rotateNextLines = (options, others, label, newMadeAt) => {
+  const restart = "secret" in options.route && options.application !== null ? `1. Restart the application so it reads the new key: tzcloud_restart_application from your tool for ${options.application} in ${options.environment ?? "production"}.` : `1. Restart your program so it reads the new key from ${"secret" in options.route ? options.route.secret : "the file"}.`;
+  const unlabelled = (entry) => entry.label === null || entry.label === "" || entry.label === TZMESH_COMMAND_LABEL;
+  const matching = others.filter((entry) => entry.label === label);
+  const old = others.length === 1 && (unlabelled(others[0]) || others[0].label === label) ? others[0] : matching.length === 1 ? matching[0] : null;
+  const made = old !== null && old.madeAt !== null ? keyMadeWordsOf(old.madeAt) : null;
+  const end = old !== null && made !== null && newMadeAt !== null && made !== keyMadeWordsOf(newMadeAt) ? `2. At ${ESTATE_ORIGINS[options.estate].site}/me, under Hosted agents, open the agent's Manage keys. Find the old key${old.label !== null && old.label !== "" ? ` labelled "${old.label}" and` : ""} created at ${made} (its id is ${old.id}), then choose End key for that entry. Until then, conversations the old key holds wait for it.` : `2. Then end the old key of the copy the restart replaced, and no other, at ${personEndsKeyAt(options.estate)}. Until then, conversations the old key holds wait for it.`;
+  return [restart, end];
+};
 var endedLineOf = (stage, plane, agent, options) => {
   const route = options.route;
   switch (stage) {
@@ -10937,6 +11273,14 @@ var endedLineOf = (stage, plane, agent, options) => {
       return agent === null || options.webhook === null ? `The run was ended after the register. ${registerUnknownSentence(options.estate)} ${TOKEN_LEFT}` : `The run was ended while the webhook's signing secret was being stored. ${signingUnknownSentence(options.webhook.secretName, agent, options.estate)} ${TOKEN_LEFT}`;
     case "stored":
       return `The run was ended after the agent's secret was kept, before the run's token was revoked. ${TOKEN_LEFT}`;
+    // The rotation's stages, whose lines its run names with what it holds
+    // (rotateEndedLineOf); this one stands where no run supplies them.
+    case "rotate reading":
+    case "rotate attached":
+    case "rotate storing":
+    case "rotate signing":
+    case "rotate stored":
+      return `The run was ended during its rotation. tzmesh_list_participants from your tool shows the agent's keys. ${TOKEN_LEFT}`;
   }
 };
 var completing = async (io2, options, mint, tokens, userAgent) => {
@@ -10964,15 +11308,18 @@ var completing = async (io2, options, mint, tokens, userAgent) => {
     } else io2.print(kept2 === null ? agentStandsSentence(standing, options.estate) : unfinishedStandsSentence(standing, kept2, options.estate));
     return revokedThen(minted, deleted.unknown ? whenUnknown : COMMAND_STATUS.failed);
   };
-  const storeNamed = async (name, value) => {
+  const storeNamed = async (name, value, replace = false, heedEnd = true) => {
     const action = SECRET_ACTION.store;
     const answered = await postAction(io2, options.origin, action, (tokens.store ?? tokens.mint).token, userAgent, {
       name,
       value,
       ...options.application !== null ? { application: options.application } : {},
-      ...options.environment !== null ? { environment: options.environment } : {}
+      ...options.environment !== null ? { environment: options.environment } : {},
+      // A rotation replaces a name its setup stored (the tzmesh rotate
+      // plan's decision 3; store_secret's `replace`).
+      ...replace ? { replace: true } : {}
     });
-    if (stage.ended) return "ended";
+    if (heedEnd && stage.ended) return "ended";
     if (answered === null) return { unknown: [`${action} drew no answer.`] };
     if (answered.redirected) return { unknown: [`${action} was answered ${answeredHow(answered.status)}, which the command never follows, so the value was sent to no second address.`] };
     if (answered.status >= PLATFORM_FAILURE_STATUS) return { unknown: failureLines(action, answered.status, planeRefusalOf(answered.text)) };
@@ -10980,6 +11327,7 @@ var completing = async (io2, options, mint, tokens, userAgent) => {
     if (answered.status < 200 || answered.status > 299) {
       const refusal = markedRefusalOf(answered.status, answered.text);
       if (refusal === null) return { unknown: [`${action} was answered HTTP ${answered.status}, not by the platform.`] };
+      if (replace && answered.status === 404 && refusal.error === "not_found") return "gone";
       for (const line of refusalLines(action, answered.status, refusal)) io2.print(line);
       return "refused";
     }
@@ -10989,9 +11337,231 @@ var completing = async (io2, options, mint, tokens, userAgent) => {
     if ("value" in answer) io2.print("The answer carried a value, which the command never prints.");
     return "stored";
   };
+  const rotationLabel = tzmeshListenerLabelOf(destinationOf(options));
+  let rotated = null;
+  let newKey = null;
+  let others = [];
+  let answerWindow = null;
+  const windowDone = new Promise((resolve14) => {
+    answerWindow = resolve14;
+  });
+  const closeWindow = async (minted, status) => {
+    if (stage.ended) {
+      answerWindow?.(`The run was ended during its stores, and its calls answered first: the lines above say what stands. ${TOKEN_LEFT}`);
+      return COMMAND_STATUS.unknown;
+    }
+    return revokedThen(minted, status);
+  };
+  const unchanged = async (minted, lines) => {
+    for (const line of lines) io2.print(line);
+    io2.print(NOTHING_CHANGED);
+    const revoked = await revokeRunToken(io2, plane, tokens.mint.token, minted.id, userAgent);
+    if (stage.ended) return COMMAND_STATUS.unknown;
+    if (revoked === null) {
+      io2.print(`The run's token, ${minted.id}, is revoked.`);
+      return COMMAND_STATUS.nothing_started;
+    }
+    for (const line of revoked) io2.print(line);
+    return COMMAND_STATUS.failed;
+  };
+  let removing = null;
+  const removeOnce = (token2) => removing ??= Promise.resolve().then(() => removeListener(io2, wire, token2, userAgent, rotated, newKey));
+  const removeNewKey = async (minted) => {
+    const removal = await removeOnce(minted.value);
+    for (const line of removal.lines) io2.print(line);
+    if (!removal.removed) io2.print(unremovedSentence(newKey, options.estate));
+    return removal;
+  };
+  const removedThen = async (minted, status) => {
+    const removal = await removeNewKey(minted);
+    if (stage.ended) return COMMAND_STATUS.unknown;
+    return revokedThen(minted, removal.unknown ? COMMAND_STATUS.unknown : removal.removed ? status : Math.max(status, COMMAND_STATUS.failed));
+  };
+  const storeRotated = async (name, value) => {
+    let answered = await storeNamed(name, value, true, false);
+    let uncertain = false;
+    if (typeof answered === "object" && !stage.ended) {
+      for (const line of answered.unknown) io2.print(line);
+      uncertain = true;
+      answered = await storeNamed(name, value, true, false);
+    }
+    if (answered === "gone") answered = await storeNamed(name, value, false, false);
+    const settled = answered === "ended" || answered === "gone" ? "refused" : answered;
+    if (settled === "refused" && uncertain) return { unknown: [`${SECRET_ACTION.store} was refused when sent once more, which does not show whether its first send wrote ${name}.`] };
+    return settled;
+  };
+  const setWebhook = (secret2, url) => setupCall(io2, wire, TZMESH_WEBHOOK_SET_PATH, secret2, userAgent, WEBHOOK_ACT, { url }, (answer) => {
+    if (typeof answer?.signing_secret === "string") io2.hide(answer.signing_secret, REDACTED_WEBHOOK_SECRET);
+  });
+  let tokensRun = null;
+  const readAgents = () => setupCall(io2, wire, TZMESH_LIST_PARTICIPANTS_PATH, tokensRun, userAgent, READ_ACT, {}, () => void 0);
+  const rotating = async (minted) => {
+    tokensRun = minted.value;
+    stage.now = "rotate reading";
+    const first = await readAgents();
+    if (stage.ended) return COMMAND_STATUS.unknown;
+    if (!("answer" in first)) return unchanged(minted, "refused" in first ? first.refused : first.unknown);
+    const read2 = rotatedAgentOf(first.answer, options.name);
+    if (read2 === null) return unchanged(minted, [noStandingAgentSentence(options.name)]);
+    rotated = read2;
+    others = read2.programListeners;
+    const movedTo = options.rotateWebhook?.origin ?? null;
+    const webhookUrl = movedTo !== null ? `${movedTo}${TZMESH_WEBHOOK_ROUTE}` : read2.webhookUrl;
+    if (webhookUrl !== null && options.rotateWebhook === null) return unchanged(minted, [webhookNameOwedSentence()]);
+    if (webhookUrl === null && options.rotateWebhook !== null) return unchanged(minted, [webhookNotAnsweredSentence()]);
+    if ("secret" in route) {
+      const named = [[TZMESH_OPTION.secret, route.secret], ...options.rotateWebhook !== null ? [[TZMESH_OPTION.webhookSecret, options.rotateWebhook.secretName]] : []];
+      const listed2 = await postAction(io2, options.origin, LIST_SECRETS_ACTION, (tokens.store ?? tokens.mint).token, userAgent, {
+        ...options.application !== null ? { application: options.application } : {},
+        ...options.application !== null && options.environment !== null ? { environment: options.environment } : {}
+      });
+      if (stage.ended) return COMMAND_STATUS.unknown;
+      const answer = listed2 !== null && !listed2.redirected && listed2.status >= 200 && listed2.status <= 299 ? planeObjectOf(listed2.text) : null;
+      if (answer === null) {
+        const refusal = listed2 === null || listed2.redirected ? null : markedRefusalOf(listed2.status, listed2.text);
+        return unchanged(minted, [
+          listed2 === null ? `${LIST_SECRETS_ACTION} drew no answer.` : listed2.redirected ? `${LIST_SECRETS_ACTION} was answered ${answeredHow(listed2.status)}, which the command never follows.` : refusal !== null ? refusalLines(LIST_SECRETS_ACTION, listed2.status, refusal).join(" ") : `${LIST_SECRETS_ACTION} was answered HTTP ${listed2.status}, not by the platform.`
+        ]);
+      }
+      const missing = named.find(([, name]) => !storedAtScope(answer, name, options.application, options.environment));
+      if (missing !== void 0) return unchanged(minted, [notStoredSentence(missing[0], missing[1])]);
+    }
+    const attached = await attachListener(io2, wire, minted.value, userAgent, read2, rotationLabel);
+    if (stage.ended) return COMMAND_STATUS.unknown;
+    if ("refused" in attached) {
+      for (const line of attached.refused) io2.print(line);
+      return revokedThen(minted, COMMAND_STATUS.failed);
+    }
+    if ("unknown" in attached) {
+      for (const line of attached.unknown) io2.print(line);
+      io2.print(attachUnknownSentence(rotationLabel, options.estate));
+      return revokedThen(minted, COMMAND_STATUS.unknown);
+    }
+    newKey = attached.listener;
+    const secret2 = attached.secret;
+    stage.now = "rotate attached";
+    io2.print(attachedLineOf(read2, newKey, rotationLabel));
+    const known = new Set(read2.programListeners.map((entry) => entry.id));
+    const strangerIn = (answer) => {
+      const now = rotatedAgentOf(answer, options.name);
+      return now === null || now.programListeners.some((entry) => !known.has(entry.id) && entry.id !== newKey);
+    };
+    const second = await readAgents();
+    if (stage.ended) return COMMAND_STATUS.unknown;
+    if (!("answer" in second)) {
+      for (const line of "refused" in second ? second.refused : second.unknown) io2.print(line);
+      return removedThen(minted, "refused" in second ? COMMAND_STATUS.failed : COMMAND_STATUS.unknown);
+    }
+    if (strangerIn(second.answer)) {
+      io2.print(crossingSentence());
+      return removedThen(minted, COMMAND_STATUS.failed);
+    }
+    stage.now = "rotate storing";
+    if ("toFile" in route) {
+      const written = writeThenRename(io2, route.toFile, `${secret2}
+`, "owner only", tag);
+      if ("unwritten" in written) {
+        io2.print(`The file ${TZMESH_OPTION.toFile} names could not be written (${written.unwritten}), so it still holds the old key.`);
+        await removeNewKey(minted);
+        return closeWindow(minted, COMMAND_STATUS.failed);
+      }
+      io2.print(WRITTEN_LINE);
+    } else {
+      const stored = await storeRotated(route.secret, secret2);
+      if (stored === "refused") {
+        await removeNewKey(minted);
+        return closeWindow(minted, COMMAND_STATUS.failed);
+      }
+      if (stored !== "stored") {
+        for (const line of stored.unknown) io2.print(line);
+        io2.print(storeUnknownRotateSentence(route.secret, newKey));
+        return closeWindow(minted, COMMAND_STATUS.unknown);
+      }
+    }
+    if (webhookUrl !== null && options.rotateWebhook !== null && "secret" in route) {
+      let set = await setWebhook(secret2, webhookUrl);
+      if ("unknown" in set && !stage.ended) {
+        for (const line of set.unknown) io2.print(line);
+        set = await setWebhook(secret2, webhookUrl);
+        if ("refused" in set) set = { unknown: [...set.refused, `The ${WEBHOOK_ACT} was refused when sent once more, which does not show whether its first send set the webhook.`] };
+      }
+      stage.now = "rotate signing";
+      const signing = "answer" in set ? set.answer.signing_secret : null;
+      if (!("answer" in set) || typeof signing !== "string" || !TZMESH_WEBHOOK_SECRET_FORM.test(signing)) {
+        if ("refused" in set) {
+          for (const line of set.refused) io2.print(line);
+          io2.print(WEBHOOK_UNSET_SENTENCE);
+          return closeWindow(minted, COMMAND_STATUS.failed);
+        }
+        for (const line of "unknown" in set ? set.unknown : [`The ${WEBHOOK_ACT} answered no signing secret of its form, so the command keeps none.`]) io2.print(line);
+        const cleared = await setWebhook(secret2, null);
+        if (!("answer" in cleared)) {
+          for (const line of "refused" in cleared ? cleared.refused : cleared.unknown) io2.print(line);
+          io2.print(webhookUnclearedSentence(newKey, options.estate));
+          return closeWindow(minted, COMMAND_STATUS.unknown);
+        }
+        io2.print(WEBHOOK_UNSET_SENTENCE);
+        return closeWindow(minted, "unknown" in set ? COMMAND_STATUS.unknown : COMMAND_STATUS.failed);
+      }
+      io2.print(webhookLineOf(webhookUrl));
+      const kept2 = await storeRotated(options.rotateWebhook.secretName, signing);
+      if (kept2 !== "stored") {
+        if (typeof kept2 === "object") for (const line of kept2.unknown) io2.print(line);
+        const cleared = await setWebhook(secret2, null);
+        if (!("answer" in cleared)) {
+          for (const line of "refused" in cleared ? cleared.refused : cleared.unknown) io2.print(line);
+          io2.print(webhookUnclearedSentence(newKey, options.estate));
+          return closeWindow(minted, COMMAND_STATUS.unknown);
+        }
+        io2.print(kept2 === "refused" ? webhookClearedSentence(route.secret, options.rotateWebhook.secretName) : signingUnknownRotateSentence(options.rotateWebhook.secretName));
+        return closeWindow(minted, kept2 === "refused" ? COMMAND_STATUS.failed : COMMAND_STATUS.unknown);
+      }
+    }
+    stage.now = "rotate stored";
+    if (stage.ended) {
+      for (const line of rotateNextLines(options, others, rotationLabel, null)) io2.print(line);
+      return closeWindow(minted, COMMAND_STATUS.unknown);
+    }
+    const third = await readAgents();
+    if (stage.ended) return COMMAND_STATUS.unknown;
+    if (!("answer" in third)) {
+      for (const line of "refused" in third ? third.refused : third.unknown) io2.print(line);
+      io2.print(crossingUnreadSentence());
+      for (const line of rotateNextLines(options, others, rotationLabel, null)) io2.print(line);
+      return revokedThen(minted, COMMAND_STATUS.unknown);
+    }
+    if (strangerIn(third.answer)) {
+      io2.print(crossingAfterSentence());
+      return revokedThen(minted, COMMAND_STATUS.failed);
+    }
+    const newMadeAt = rotatedAgentOf(third.answer, options.name)?.programListeners.find((entry) => entry.id === newKey)?.madeAt ?? null;
+    for (const line of rotateNextLines(options, others, rotationLabel, newMadeAt)) io2.print(line);
+    return revokedThen(minted, COMMAND_STATUS.done);
+  };
+  const rotateEndedLineOf = (now) => {
+    switch (now) {
+      case "rotate reading":
+        return `The run was ended before its new key was known, so no stored name holds a key this run made: tzmesh_list_participants from your tool shows the agent's keys, and one labelled "${rotationLabel}" that no name holds can be ended at ${personEndsKeyAt(options.estate)}. ${TOKEN_LEFT}`;
+      case "rotate stored":
+        return `The run was ended after the new secret values were saved. ${rotateNextLines(options, others, rotationLabel, null).join(" ")} ${TOKEN_LEFT}`;
+      default:
+        return endedLineOf(now, plane, agent, options);
+    }
+  };
+  const rotateSettle = (now) => {
+    if (now === "rotate attached" && rotated !== null && newKey !== null && tokensRun !== null) {
+      const key = newKey;
+      return removeOnce(tokensRun).then(
+        (removal) => removal.removed ? `The run was ended before its first store, so the new key ${key} was removed, and the stored names still hold the old key. ${TOKEN_LEFT}` : `The run was ended before its first store. ${unremovedSentence(key, options.estate)} ${TOKEN_LEFT}`
+      );
+    }
+    if (now === "rotate storing" || now === "rotate signing") return windowDone;
+    return null;
+  };
   const carried = {
     stage,
-    endedLine: (now) => endedLineOf(now, plane, agent, options),
+    endedLine: (now) => options.rotate ? rotateEndedLineOf(now) : endedLineOf(now, plane, agent, options),
+    ...options.rotate ? { settle: rotateSettle } : {},
     // The file's try, by an empty file beside it under the run's tag,
     // owner-only, before any request (decision 6).
     prepare: () => {
@@ -11010,6 +11580,7 @@ var completing = async (io2, options, mint, tokens, userAgent) => {
       return revokedThen(minted, COMMAND_STATUS.failed);
     },
     deliver: async (minted) => {
+      if (options.rotate) return rotating(minted);
       stage.now = "registering";
       const registered = await register(io2, wire, minted.value, userAgent, options);
       if (stage.ended) return COMMAND_STATUS.unknown;
@@ -11062,7 +11633,7 @@ var completing = async (io2, options, mint, tokens, userAgent) => {
       }
       const stored = await storeNamed(route.secret, secret2);
       if (stored === "ended" || stage.ended) return COMMAND_STATUS.unknown;
-      if (stored === "refused") return deletedThen(minted, agent);
+      if (stored === "refused" || stored === "gone") return deletedThen(minted, agent);
       if (stored !== "stored") {
         for (const line of stored.unknown) io2.print(line);
         if (options.webhook !== null) return deletedThen(minted, agent, COMMAND_STATUS.unknown, { name: route.secret, known: false });
@@ -11073,7 +11644,7 @@ var completing = async (io2, options, mint, tokens, userAgent) => {
         stage.now = "storing signing";
         const kept2 = await storeNamed(options.webhook.secretName, signing);
         if (kept2 === "ended" || stage.ended) return COMMAND_STATUS.unknown;
-        if (kept2 === "refused") return deletedThen(minted, agent, COMMAND_STATUS.failed, { name: route.secret, known: true });
+        if (kept2 === "refused" || kept2 === "gone") return deletedThen(minted, agent, COMMAND_STATUS.failed, { name: route.secret, known: true });
         if (kept2 !== "stored") {
           for (const line of kept2.unknown) io2.print(line);
           io2.print(signingUnknownSentence(options.webhook.secretName, agent, options.estate));
@@ -11145,23 +11716,24 @@ var TZMESH_FIRST_ACT_AFTER_OWN_ERROR = "a request may now be pending in this com
 var TZMESH_ROW = Object.freeze({
   name: TZMESH_SUBCOMMAND,
   acts: Object.freeze([TZMESH_REGISTER_ACT]),
-  summary: `Registers a tzMesh standing agent, and keeps its program secret where a program reads it, never printing it. It keeps the secret in your account's secret store by name, or in a file. It runs in two acts around one ${MINT_TOKEN_ACTION} call your tool makes.`,
+  summary: `Registers a tzMesh standing agent, or rotates its program key with ${TZMESH_OPTION.rotate}. It saves the secret in your account's secret store or in a file, and prints no secret value. It runs in two acts around one ${MINT_TOKEN_ACTION} call your tool makes.`,
   example: `${TZMESH_ACT_WORDS} ${TZMESH_OPTION.name} <name> ${TZMESH_OPTION.secret} <secret name> ${TZMESH_OPTION.application} <application id> ${TZMESH_OPTION.environment} production`,
   options: TZMESH_OPTIONS,
   credential: null,
   reads: TZMESH_READS,
   statuses: {
-    done: "the challenge printed, or the agent registered, its secret kept, and the run's token revoked",
-    failed: "a part failed: the agent was not registered, its secret was not kept, or the run's token was not revoked. The printed lines name what stands and the call that ends it",
-    unknown: "an outcome is unknown: the printed lines name list_tokens, tzmesh_list_participants, or tzcloud_list_secrets",
-    nothing_started: `nothing was minted. An option, the credential file, the file ${TZMESH_OPTION.toFile} names, or this computer's token was refused. Or no request was pending, the platform was too old, or the exchange was refused`
+    done: "the challenge printed. On completion, setup registered the agent and saved its secret, or rotation added a key and saved the required values. The run token was revoked",
+    failed: "a step failed, or the run token could not be revoked. Read the printed lines to see what changed and how to recover",
+    unknown: "an outcome is unknown: the printed lines name list_tokens, tzmesh_list_participants, or tzcloud_list_secrets. Follow the printed recovery before restarting or ending a key",
+    nothing_started: `the command stopped before changing the agent or destination. If the command minted a run token, it revoked it. An option, the credential file, the file ${TZMESH_OPTION.toFile} names, or this computer's token was refused. Or no request was pending, the platform was too old, or the exchange was refused. Or, under ${TZMESH_OPTION.rotate}, the agent, a stored name, or the signing secret's name was missing`
   },
   variables: [[ORIGIN_VARIABLE, `the platform's address the secret is stored at where the line names no ${TZMESH_OPTION.origin}. It must be ${DEFAULT_COMMAND_ORIGIN} or ${DEVELOPMENT_COMMAND_ORIGIN}.`]],
   note: [
-    `Registering an agent takes two acts around one ${MINT_TOKEN_ACTION} call, which your signed-in tool makes itself. ${TZMESH_ACT_WORDS} run without ${TZMESH_OPTION.mint} prints a challenge, the call to make, and the options its completing line takes. Your tool makes that call, and runs the line it answers once, on this computer, with those options after it. That line holds no code.`,
-    `The completing line presents this computer's verifier and receives a tzMesh token minted for this run alone. It registers the agent with that token, keeps the agent's secret, and revokes the token. Where the secret could not be kept, it deletes the agent.`,
+    `Setup and rotation take two acts around one ${MINT_TOKEN_ACTION} call, which your signed-in tool makes itself. ${TZMESH_ACT_WORDS} run without ${TZMESH_OPTION.mint} prints a challenge, the call to make, and the options its completing line takes. Your tool makes that call, and runs the line it answers once, on this computer, with those options after it. That line holds no code.`,
+    `The completing line presents this computer's verifier and receives a tzMesh token minted for this run alone. In setup, it registers the agent with that token, keeps the agent's secret, and revokes the token. Where the secret could not be kept, it deletes the agent.`,
     `With ${TZMESH_OPTION.secret}, the secret goes from the register's answer to your account's secret store, and never reaches your tool. With ${TZMESH_OPTION.toFile}, it goes into that file, which anything that runs as you can read, your tool among them. Keep that file outside any application's folder.`,
-    `For an agent a Turn Zero Cloud application hosts, the same run sets it up. ${TZMESH_OPTION.webhookOrigin} sets its webhook at that application's origin, and ${TZMESH_OPTION.webhookSecret} names where the webhook's signing secret is stored. ${TZMESH_OPTION.join} joins its channels. Its description, title, and ${TZMESH_OPTION.public} go into the register. Where a step fails, follow the recovery the run prints before running the line again.`,
+    `In setup, for an agent a Turn Zero Cloud application hosts, the same run sets it up. ${TZMESH_OPTION.webhookOrigin} sets its webhook at that application's origin, and ${TZMESH_OPTION.webhookSecret} names where the webhook's signing secret is stored. ${TZMESH_OPTION.join} joins its channels. Its description, title, and ${TZMESH_OPTION.public} go into the register. Where a step fails, follow the recovery the run prints before running the line again.`,
+    `With ${TZMESH_OPTION.rotate}, the completing line adds a key to the named standing agent and saves the program secret in the chosen store or file. For a webhook rotation it also sets the webhook on the new key and stores its signing secret. After success, restart your program and check the new key before ending the old one. If a step fails, follow the printed recovery before restarting or ending a key.`,
     `The run reads this computer's token for each address it sends to: the ${TZMESH_OPTION.tzmeshEstate} platform's, to revoke the run's token, and under ${TZMESH_OPTION.secret} the ${TZMESH_OPTION.origin} platform's, to store the secret. Authorize this computer at each first.`
   ],
   afterOwnError: (call) => call.named[TZMESH_OPTION.mint] !== void 0 ? tzmeshAfterOwnError(call) : TZMESH_FIRST_ACT_AFTER_OWN_ERROR,
@@ -11587,7 +12159,8 @@ var childRunnerOf = (signals, inputIsTerminal, passesOn = SIGNALS_PASS_ON, group
   }
 });
 var runChild = childRunnerOf(process, () => isatty(0));
-var endHoldOf = (signals, end) => (act) => {
+var END_WAIT_BOUND_MS = 25e4;
+var endHoldOf = (signals, end, schedule = scheduleUnref) => (act) => {
   let held = [];
   const release = () => {
     for (const [signal, handler] of held) signals.off(signal, handler);
@@ -11596,17 +12169,41 @@ var endHoldOf = (signals, end) => (act) => {
   held = HELD_SIGNALS.map((signal) => {
     const handler = () => {
       release();
+      let answered = void 0;
       try {
-        act();
+        answered = act();
       } catch {
       }
-      end(endedStatusOf(signal));
+      if (answered === void 0 || typeof answered.then !== "function") {
+        end(endedStatusOf(signal));
+        return;
+      }
+      let ended = false;
+      const again = [];
+      const finish = () => {
+        if (ended) return;
+        ended = true;
+        for (const [other, onAgain] of again) signals.off(other, onAgain);
+        cancel();
+        end(endedStatusOf(signal));
+      };
+      for (const other of HELD_SIGNALS) {
+        signals.on(other, finish);
+        again.push([other, finish]);
+      }
+      const cancel = schedule(END_WAIT_BOUND_MS, finish);
+      answered.then(finish, finish);
     };
     signals.on(signal, handler);
     return [signal, handler];
   });
   return release;
 };
+var scheduleUnref = (ms, act) => {
+  const timer = setTimeout(act, ms);
+  timer.unref?.();
+  return () => clearTimeout(timer);
+};
 var OUTPUT_LEAVE_BOUND_MS = 2e3;
 var endAfterOutput = (status) => {
   process.exitCode = status;
@@ -11737,6 +12334,7 @@ var SUBCOMMANDS = Object.freeze([
   HASH_ROW,
   DEPLOY_ROW,
   CHECK_ROW,
+  PROMOTE_ROW,
   SECRET_ROW,
   PUT_ROW,
   EXPORT_DOWNLOAD_ROW,
@@ -11988,7 +12586,7 @@ New to Turn Zero Cloud? Start here: ${SETUP_GUIDE}`);
     if (argv2.length === 0 && showOnboarding(io2)) {
       say(`
 Get started: ${SETUP_GUIDE}`);
-      say(`Paste this into Claude, ChatGPT, or Codex:
+      say(`Paste the setup prompt into your AI coding tool.
 ${SETUP_PROMPT}`);
     }
     if (jsonDeployOf(argv2)) printDeployResultOnce(io2, jsonResultHoldOf(io2), deployResultOf(COMMAND_STATUS.nothing_started, deployApplicationOf(argv2), []));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "turnzero",
-  "version": "0.43.0",
+  "version": "0.45.0-next.1",
   "type": "module",
   "description": "Deploy and run AI-built apps with Turn Zero Cloud hosting and backend services.",
   "license": "Apache-2.0",