wawesome 0.10.0 → 0.12.0

package/README.md

@@ -1,23 +1,23 @@
-# 🚀 wawesome
+# wawesome
 
-> Official CLI for building, bundling, and deploying serverless WebAssembly functions on the
-> **[wawesome.io](https://wawesome.io)** platform.
+> Official CLI for bundling and deploying serverless WebAssembly functions on the
+> [wawesome.io](https://wawesome.io) platform.
 
 [![npm version](https://img.shields.io/npm/v/wawesome.svg?color=cyan)](https://www.npmjs.com/package/wawesome)
 
-Deploy ultra-fast, lightweight serverless WebAssembly functions directly from your terminal in under 60 seconds.
+Write a TypeScript function, deploy it from your terminal, and get back the address it answers on.
 
 ---
 
-## ⚡ Quick Start
+## Quick start
 
 ### 1. Create an account
 
 Sign up for free at **[https://wawesome.io](https://wawesome.io)** to set up your workspace.
 
-### 2. Authenticate CLI
+### 2. Authenticate the CLI
 
-Login via browser OAuth:
+Log in through your browser:
 
 ```bash
 npx wawesome login
@@ -32,14 +32,14 @@ mkdir my-wasm-app && cd my-wasm-app
 npx wawesome init
 ```
 
-`init` asks for the function name and for the **App slug** — the App groups the Functions of one
+`init` asks for the function name and for the **App slug**. An App groups the Functions of one
 project, and its slug is part of the public URL your client sees. Both default to the directory
 name, so naming is usually a matter of pressing enter.
 
 An App slug must be a legal hostname label: lowercase letters, numbers, and single hyphens between
-them (no leading or trailing hyphen, 63 characters at most). Type something else — `My Client` —
-and the CLI shows you the slug it would become (`my-client`) and asks again, rather than rewriting
-your answer behind your back.
+them (no leading or trailing hyphen, 63 characters at most). Type something else, such as
+`My Client`, and the CLI shows you the slug it would become (`my-client`) and asks again, rather
+than rewriting your answer behind your back.
 
 #### Starting from a template
 
@@ -51,39 +51,40 @@ npx wawesome init --template stripe-webhook
 ```
 
 This goes from nothing to a deployed Function in one command. The template is downloaded over
-plain HTTP and unpacked — **git is not required**, on any platform — and its files land exactly as
-they are published. Only the `name` in `package.json`, the App and Function names in
-`wawesome-function.json`, and the `wawesome` dependency are touched — the last so the project you
-get depends on the CLI that scaffolded it rather than the one the template was released against.
-
-Templates declare what they need rather than shipping placeholders, so the CLI then asks for each
-environment variable the template requires — showing where in the provider's own dashboard to find
-the value — stores them (secrets write-only), enables any outbound providers the template calls,
+plain HTTP and unpacked, so **git is not required** on any platform, and its files land exactly as
+they are published. Only three things are touched: the `name` in `package.json`, the App and
+Function names in `wawesome-function.json`, and the `wawesome` dependency. That last one is so the
+project you get depends on the CLI that scaffolded it rather than the one the template was released
+against.
+
+Templates declare what they need rather than shipping placeholders. The CLI asks for each
+environment variable the template requires, showing where in the provider's own dashboard to find
+the value. It stores them (secrets write-only), enables any outbound providers the template calls,
 and deploys. If a value does not exist yet, leave it blank; the CLI tells you the `env set` command
 to run once it does.
 
-Dependencies are installed for you (with whatever package manager launched the CLI — `npx`, `pnpm
-dlx`, `bun x`), so the types are there when you open the project and the bundler can resolve the
-template's imports. Pass `--no-install` to do it yourself. A failed install never stops the flow;
-the command to re-run is printed.
+The CLI installs your dependencies with whatever package manager launched it (`npx`, `pnpm dlx`,
+`bun x`), so the types are there when you open the project and the bundler can resolve the
+template's imports. Pass `--no-install` to do it yourself. A failed install never stops the flow,
+and the CLI prints the command to re-run.
 
 Before any of that is sent anywhere, the CLI shows you the **public URL your Function will have**
-and offers to change your workspace address — the part of that URL that is yours rather than this
-project's, and the same one `wawesome workspace show` prints. It is randomly minted at signup and
-stays changeable until your first deploy, at which point it locks for good, because live URLs carry
-it. Press enter to keep it. If it is already locked, the offer is not made and the reason is said
-plainly.
+and offers to change your workspace address. That is the part of the URL which is yours rather
+than this project's, and it is the same one `wawesome workspace show` prints. Signup mints it at
+random and it stays changeable until your first deploy, at which point it locks for good, because
+live URLs carry it. Press enter to keep it. If it is already locked, the CLI does not make the
+offer and says why.
 
-Being logged in is checked **before** the first question, not at the deploy: an expired session
-offers you a login there and then, and declining still leaves you the project plus the two commands
-that finish it.
+The CLI checks you are logged in **before** the first question rather than at the deploy. An
+expired session offers you a login there and then, and declining still leaves you the project plus
+the two commands that finish it.
 
-Run it in an empty directory: if any file would be overwritten, nothing is written at all and the
-collision is named.
+Run it in an empty directory. If any file would be overwritten, nothing is written at all and the
+CLI names the collision.
 
-### 4. Build & Deploy
+### 4. Build and deploy
 
-Deploy your serverless function to Wawesome Cloud instantly:
+Deploy your serverless function to the platform:
 
 ```bash
 npx wawesome deploy
@@ -91,7 +92,7 @@ npx wawesome deploy
 
 ---
 
-## 📖 Command Reference
+## Command reference
 
 | Command                                 | Description                                                         |
 |:----------------------------------------|:--------------------------------------------------------------------|
@@ -116,37 +117,37 @@ npx wawesome deploy
 | `npx wawesome env list`                 | View environment variables for the current app                      |
 | `npx wawesome env set <key> <val>`      | Set an environment variable (add `--secret` for write-only)         |
 | `npx wawesome env rm <key>`             | Delete an environment variable                                      |
-| `npx wawesome credentials`              | List deploy credentials — name, prefix, capabilities, Apps, last use |
+| `npx wawesome credentials`              | List deploy credentials: name, prefix, capabilities, Apps, last use |
 | `npx wawesome credentials mint <name>`  | Mint a deploy credential and print its secret, once                 |
 | `npx wawesome credentials revoke <name>`| Revoke a deploy credential by name or prefix                        |
 
 ---
 
-## 🧭 Unsupported Globals
+## Unsupported globals
 
 Every build scans the bundle it just produced against the platform's declared guest surface, and says
 nothing unless it finds something.
 
-- **`Intl` is not provided.** Where the bundle reaches it as it loads — your own module scope, or a
-  dependency's — the build is refused before a deploy uploads anything: that bundle would not
-  evaluate on the platform. Where the reference sits inside a function that may never be called,
+- **`Intl` is not provided.** Where the bundle reaches it as it loads, in your own module scope or
+  a dependency's, the build is refused before a deploy uploads anything, because that bundle would
+  not evaluate on the platform. Where the reference sits inside a function that may never be called,
   behind a `typeof` check, or inside a `try`, you get a warning and the deploy proceeds.
 - **`toLocaleString`, `toLocaleDateString`, `toLocaleTimeString`, `toLocaleLowerCase` and
   `toLocaleUpperCase` ignore their locale argument.** They run and return an unlocalised answer, so
   these warn.
 
 Each message names the global, the file and line in *your* source, and what to do about it. Declaring
-an `Intl` polyfill in your `package.json` — the same declaration [local parity
-reads](#testing-against-the-guests-javascript-surface) — silences the report, as does installing one
+an `Intl` polyfill in your `package.json`, the same declaration [local parity
+reads](#testing-against-the-guests-javascript-surface), silences the report, as does installing one
 on `globalThis` in the bundle itself. The scan reads static references only: a global reached through
 `globalThis['Intl']` is invisible to it, so it never refuses a deploy on a guess. `deploy
 --skip-build` scans the bundle it found on disk before uploading it.
 
-## 📜 Invocation Logs
+## Invocation logs
 
 Inspect past function runs or view raw `stdout` / `stderr` log outputs directly in your terminal.
 
-### 1. List Recent Invocations
+### 1. List recent invocations
 
 List past executions (including status, trigger type, timestamp, and duration) for the function in the
 current directory:
@@ -161,7 +162,7 @@ Or list invocations for a specific function by name:
 npx wawesome logs my-function
 ```
 
-Filter by invocation status — only show errors, timeouts, etc.:
+Filter by invocation status, to show only errors or timeouts:
 
 ```bash
 npx wawesome logs my-function --error
@@ -169,7 +170,7 @@ npx wawesome logs my-function --status timeout
 npx wawesome logs my-function --running
 ```
 
-### 2. View Invocation Log Body (`stdout`/`stderr`)
+### 2. View the invocation log body (`stdout`/`stderr`)
 
 Fetch and print the captured `console.log` / `console.error` text for a specific invocation:
 
@@ -183,9 +184,9 @@ Or pass the UUID directly as the target:
 npx wawesome logs 019fb344-ea0c-78f2-8a9b-d04e188b9823
 ```
 
-### 3. Follow Live Output (`--follow`)
+### 3. Follow live output (`--follow`)
 
-Stream an invocation's output as it runs — like `tail -f` for your serverless function.
+Stream an invocation's output as it runs, like `tail -f` for your serverless function.
 
 #### Follow by function name (recommended)
 
@@ -205,13 +206,13 @@ npx wawesome logs 019fb344-ea0c-78f2-8a9b-d04e188b9823 --follow
 
 #### Reconnection
 
-On transient network errors or server issues (5xx), the CLI automatically reconnects with
-exponential back-off (up to 3 retries). Non-recoverable errors like authentication failures
-(401) or unknown invocations (404) exit immediately with a clear message.
+On a transient network error or a 5xx, the CLI reconnects with exponential back-off, up to three
+retries. It does not retry an authentication failure (401) or an unknown invocation (404). Those
+exit at once, naming what happened.
 
 ---
 
-## ⚡ Manual Invocation
+## Manual invocation
 
 Fire a background run of a Function immediately without waiting for a schedule tick or deploying code:
 
@@ -231,11 +232,11 @@ npx wawesome invoke --no-follow
 
 ---
 
-## ⏰ Schedules & Cron Management
+## Schedules and cron management
 
 Manage recurring Schedules and inspect background run history directly from your terminal.
 
-### 1. List Schedules
+### 1. List schedules
 
 List a Function's Schedules with expression, state, and next run in UTC:
 
@@ -250,12 +251,12 @@ npx wawesome cron list my-function
 npx wawesome cron list --app my-app
 ```
 
-The output clearly distinguishes the three off-states:
+The output tells the three off-states apart:
 - `paused`: stopped by a user, resumable with `wawesome cron resume <name>`
 - `not in this config file`: disabled because it was removed from configuration, resumable only by declaring it again in code
 - `suspended`: suspended by the non-payment ladder, resumable only after settling workspace balance
 
-### 2. Pause and Resume Schedules
+### 2. Pause and resume schedules
 
 ```bash
 # Pause a schedule by name (stops queued ticks and survives future deploys)
@@ -268,7 +269,7 @@ npx wawesome cron pause nightly-reconcile --reason "database maintenance"
 npx wawesome cron resume nightly-reconcile
 ```
 
-### 3. Read Run History
+### 3. Read run history
 
 Inspect past scheduled and manual runs, showing when each run was due, when it started, pool delay, and how it ended:
 
@@ -282,15 +283,15 @@ npx wawesome cron history my-function --state failed
 
 ---
 
-## 🔑 Deploy Credentials
+## Deploy credentials
 
 A deploy credential is what a CI pipeline or an agent authenticates with, where there is nobody at a
 keyboard to log in. It belongs to the workspace rather than to you: it keeps working after you leave,
-and revoking it does not end your own session. Once you have one, [Deploying from CI](#-deploying-from-ci)
+and revoking it does not end your own session. Once you have one, [Deploying from CI](#deploying-from-ci)
 is what to do with it.
 
-Minting, listing and revoking are the workspace owner's, and are closed to deploy credentials
-themselves whatever they carry — a leaked credential cannot mint another. So these three run on your
+Minting, listing and revoking belong to the workspace owner. They are closed to deploy credentials
+themselves, whatever those carry, so a leaked credential cannot mint another. All three run on your
 ordinary `npx wawesome login` session.
 
 ### Mint one
@@ -299,8 +300,8 @@ ordinary `npx wawesome login` session.
 npx wawesome credentials mint ci-pipeline
 ```
 
-The secret is printed once and never again — the platform stores a digest of it, so no later read can
-rebuild it. It goes to stdout on a line of its own and everything else the command prints goes to
+The secret is printed once and never again. The platform stores a digest of it, so no later read
+can rebuild it. It goes to stdout on a line of its own and everything else the command prints goes to
 stderr, so a redirect catches the secret and not one character besides:
 
 ```bash
@@ -313,17 +314,20 @@ you say otherwise:
 ```bash
 # reads logs and cannot deploy, restricted to one App, never expires
 npx wawesome credentials mint agent -c logs:read -a prod --expires never
+
+# ships code and attaches the domain the project declares
+npx wawesome credentials mint ci -c deploy,domains:attach -a prod
 ```
 
 | Flag                 | Meaning                                                                       |
 |:---------------------|:------------------------------------------------------------------------------|
-| `-c, --capability`   | `deploy`, `logs:read`, or both. Repeatable or comma-separated. Default `deploy` |
+| `-c, --capability`   | `deploy`, `logs:read`, `domains:attach`, or any mix. Repeatable or comma-separated. Default `deploy` |
 | `-a, --app`          | Restrict to these Apps, by slug. Repeatable. Default: every App in the workspace |
 | `--expires`          | Days, or `never`. Default: 90                                                   |
 
-An App named in a restriction does not have to exist yet — a pipeline whose first deploy creates the
+An App named in a restriction does not have to exist yet. A pipeline whose first deploy creates the
 App it was minted for is the ordinary case. A restriction bounds what a credential can disturb, not
-what it can read: a Function deployed into one App still reads the whole workspace's environment at
+what it can read. A Function deployed into one App still reads the whole workspace's environment at
 runtime.
 
 ### List them
@@ -332,7 +336,7 @@ runtime.
 npx wawesome credentials
 ```
 
-Name, displayable prefix, capabilities, Apps, last use and expiry — never the secret, which the
+Name, displayable prefix, capabilities, Apps, last use and expiry. Never the secret, which the
 platform no longer holds. `LAST USED` lags by a few minutes and reads `never` for a credential
 nothing has ever presented, which is a better reason to revoke one than any calendar date.
 
@@ -350,7 +354,7 @@ it.
 
 ---
 
-## ⚙️ Configuration & Custom Gateway
+## Configuration and a custom gateway
 
 ### `wawesome-function.json`
 
@@ -364,7 +368,7 @@ Every project directory includes a `wawesome-function.json` file generated durin
 }
 ```
 
-`app` is the App this Function is deployed into, and it is client-facing — every deploy from this
+`app` is the App this Function is deployed into, and it is client-facing. Every deploy from this
 directory is scoped to it.
 
 `function` is the address. Changing it does not rename anything: your Function's URL is built from
@@ -385,40 +389,40 @@ Add `"assets"` to deploy static files beside your code:
 ```
 
 Everything under that directory is deployed with the version and served at its path beneath your
-Function's URL — `dist/client/assets/index-a1.js` answers at `https://<app-host>/<function>/assets/index-a1.js`.
+Function's URL, so `dist/client/assets/index-a1.js` answers at `https://<app-host>/<function>/assets/index-a1.js`.
 The CLI hashes each file and asks the platform which of them it does not already hold, so a redeploy
-that changed one chunk uploads one chunk — and a deploy that changed nothing at all is refused
-before a byte moves.
+that changed one chunk uploads one chunk. A deploy that changed nothing at all is refused before a
+byte moves.
 
 Files are served straight from object storage; your Function is never invoked for one, and no
-invocation is recorded. They answer on your App's own hostname and nowhere else — on the
+invocation is recorded. They answer on your App's own hostname and nowhere else. On the
 development path form (`/x/<tenant>/<app>/<function>/...`) the same address reaches your handler
 as it always has, because a file on an origin every workspace shares would be same-origin with
 all of them. Each carries `Cache-Control: public, max-age=31536000, immutable` and an
-`ETag`, so name your build output by content hash — a file's bytes must never change under a name a
+`ETag`, so name your build output by content hash. A file's bytes must never change under a name a
 browser has already cached for a year. The content type comes from the extension against a fixed
 allowlist and is never sniffed; anything off it is served as a download.
 
 Two rules to know about:
 
 - **Everything beneath `assets/` is static**, whatever the deploy carries. A request there never
-  reaches your handler — an unknown path under it is a 404, not a route for you to answer.
+  reaches your handler, and an unknown path under it is a 404 rather than a route for you to answer.
 - **At most 100 files may sit outside `assets/`.** Those paths travel on the version record so a
   request can be routed without a lookup per file. Put bulk output under `assets/`, where a file
   costs nothing; `favicon.ico`, `robots.txt` and a `.well-known/` directory are what the rest is
   for.
 
 **HTML is refused at deploy time.** Your Function renders its own markup, and a document served from
-your App's own origin is the sharpest same-origin vector a static file has.
+your App's own origin is the sharpest same-origin risk a static file carries.
 
 **An SVG is served inert.** The rule behind the refusal above is that nothing you deploy as a file
-becomes a page on your App's own origin, and an SVG opened directly in a browser would — it runs
-script, and it renders whatever HTML a `<foreignObject>` holds. It is served rather than refused
-because making it inert costs the file nothing: an `<img src="logo.svg">` never ran that script and
-is never checked against the policy, so your drawings render as they always did. Every SVG and XML
-file carries `Content-Security-Policy: script-src 'none'; sandbox`, and only navigating straight to
-one loses anything — such a file is sandboxed onto an origin of its own, so its links no longer
-navigate and a page embedding it through `<object>` or `<iframe>` cannot reach into its DOM.
+becomes a page on your App's own origin, and an SVG opened directly in a browser would become one.
+It runs script, and it renders whatever HTML a `<foreignObject>` holds. It is served rather than
+refused because making it inert costs the file nothing. An `<img src="logo.svg">` never ran that
+script and is never checked against the policy, so your drawings render as they always did. Every
+SVG and XML file carries `Content-Security-Policy: script-src 'none'; sandbox`, and only navigating
+straight to one loses anything. Such a file is sandboxed onto an origin of its own, so its links no
+longer navigate and a page embedding it through `<object>` or `<iframe>` cannot reach into its DOM.
 
 ### Schedules
 
@@ -433,12 +437,12 @@ Add `"schedules"` to run a Function on a recurring timer, with no caller:
 }
 ```
 
-An expression is **five fields, read in UTC** — minute, hour, day of month, month, day of week. There
-is no seconds field, and no timezone: a local zone would make one night a year fire a job twice and
+An expression is **five fields, read in UTC**: minute, hour, day of month, month, day of week. There
+is no seconds field and no timezone. A local zone would make one night a year fire a job twice and
 another night not at all.
 
 The name is yours to choose and is what the platform keys the schedule by, so editing an expression
-is a change to the same schedule rather than the deletion of one and the creation of another — its
+is a change to the same schedule rather than the deletion of one and the creation of another. Its
 history and its paused state stay attached to it.
 
 Your deploy applies them and prints each one with the time it will next run. It is refused, before
@@ -448,7 +452,7 @@ five minutes, or if one Function declares more than five schedules.
 Two rules worth knowing before you edit the file:
 
 - **A schedule you delete from the file is disabled, not deleted.** Its history stays, and declaring
-  it again is what turns it back on — so a typo costs you a deploy rather than a job's record.
+  it again is what turns it back on, so a typo costs you a deploy rather than a job's record.
 - **A deploy never resumes a schedule a person paused.** When it runs is code; whether it is running
   is not, and an unrelated commit the next morning must not restart what you stopped at 3am.
 
@@ -469,7 +473,7 @@ A job on a timer should not also be sitting at a guessable URL where a stranger
 }
 ```
 
-A private Function has **no public address at all** in production — not a hidden one, not one
+A private Function has **no public address at all** in production, not a hidden one and not one
 behind a credential. A request for it against your App's own hostname is answered with the same 404
 as a Function that was never deployed. This is how you deploy a job with side effects without leaving
 it where a stranger who guesses the slug can fire it.
@@ -497,7 +501,7 @@ the line is refused, and the deploy tells you so having written nothing.
 npx wawesome deploy --publish
 ```
 
-That is deliberate — the line that keeps a job off the internet is one line, and a deploy that
+That is deliberate. The line that keeps a job off the internet is one line, and a deploy that
 quietly honoured its deletion would put the job back on the open internet with nothing said. Every
 deploy prints the visibility it landed, beside the URL or in place of it.
 
@@ -529,19 +533,30 @@ deploy prints the refusal and lands everything else it was doing.
 The address derived from your workspace slug keeps serving after you attach a domain. Both names
 answer, so webhooks and integrations already pointed at the old one keep working.
 
-An apex domain — `client.com` with no `www` — attaches like any other name. Whether a CNAME may sit at
+An apex domain, `client.com` with no `www`, attaches like any other name. Whether a CNAME may sit at
 your zone root is your DNS provider's rule, and where it cannot, attach `www.client.com` and configure
 the redirect at the provider.
 
-Deleting the line detaches nothing. Detaching takes a live site dark, which is not something a deploy
-should infer from a deleted line.
+Deleting the line detaches nothing. Detaching takes a live site dark, which is not something a
+deploy should infer from a deleted line. So the deploy reports the domain it found and left serving,
+and names the one command that takes it off:
+
+```bash
+npx wawesome domains detach shop.client.com
+```
+
+The hostname is typed because an App carries exactly one domain, and the command that removes it
+should not be one you can run by reflex. It says what it is about to do first: the domain stops
+resolving here, this App's own address keeps serving, and the certificate is given back. Afterwards
+the name is free to attach again by declaring it and deploying, which is also what the next deploy
+does if you leave the line in the file.
 
 ### Reserved headers
 
 `x-wawesome-*` belongs to the platform in both directions. It is stripped off the request before your
-handler sees it, and off your response before the caller does — so **do not name a header of your own
-on that prefix**: it is dropped silently rather than rejected, and you will not get an error telling
-you why it vanished.
+handler sees it, and off your response before the caller does. So **do not name a header of your
+own on that prefix**. It is dropped silently rather than rejected, and you will not get an error
+telling you why it vanished.
 
 Four headers arrive or leave on it, and the stripping is what makes them worth trusting:
 
@@ -549,13 +564,13 @@ Four headers arrive or leave on it, and the stripping is what makes them worth t
 | --- | --- | --- |
 | `x-wawesome-forwarded-prefix` | inbound | The mount that was stripped from the path. Join it to the path you observe to rebuild the caller's URL. |
 | `x-wawesome-trigger` | inbound | How this run started: `caller` when someone called your address, `schedule` when fired by a Schedule. A caller cannot forge it in production (stripped inbound). On the local development surface, pass `x-wawesome-trigger: schedule` to exercise a background run by hand with the collapsed budget. |
-| `x-wawesome-invocation-id` | outbound | The id of this run — the key to fetch its logs with `npx wawesome logs --invocation <id>`. |
-| `x-wawesome-error` | outbound | Present only when the platform failed, never when your Function did. Its *absence* means the status on the wire is yours — up to the moment your response is committed, and no further. |
+| `x-wawesome-invocation-id` | outbound | The id of this run, the key to fetch its logs with `npx wawesome logs --invocation <id>`. |
+| `x-wawesome-error` | outbound | Present only when the platform failed, never when your Function did. Its *absence* means the status on the wire is yours, up to the moment your response is committed and no further. |
 
 ### Testing against the guest's JavaScript surface
 
 Your Function does not run on Node. The engine has no `Intl`, and its `toLocaleString` ignores the
-locale you pass — `(1234.5).toLocaleString('en-US')` comes back as `"1234.5"`, not `"1,234.50"`. On
+locale you pass. `(1234.5).toLocaleString('en-US')` comes back as `"1234.5"`, not `"1,234.50"`. On
 Node both work, which is how a green suite ships a Function that throws in production, or renders
 markup the browser then refuses to hydrate.
 
@@ -572,19 +587,19 @@ export default defineConfig({
 
 Templates scaffolded with `wawesome init --template` ship this already. With it in place `Intl` is
 gone, `MessageChannel` is the platform's own implementation rather than Node's, and the
-locale-sensitive methods throw with a message naming the remedy — they throw rather than return the
+locale-sensitive methods throw with a message naming the remedy. They throw rather than return the
 engine's unlocalised answer because the platform declares them unsupported, and a wrong string that
 fails nowhere is the thing this is here to stop you shipping.
 
-If you bundle an `Intl` polyfill, declare it in your `package.json` as you normally would — a
+If you bundle an `Intl` polyfill, declare it in your `package.json` as you normally would. A
 dependency that provides `Intl` is left in place rather than stripped out from under you.
 
-### Local Development / Gateway Overrides
+### Local development and gateway overrides
 
 If you are running a local gateway or self-hosted instance, you can configure your CLI Gateway URL using any of the
 following:
 
-#### 1. Custom Settings (`~/.wawesome/settings.json`)
+#### 1. Custom settings (`~/.wawesome/settings.json`)
 
 Create `~/.wawesome/settings.json`:
 
@@ -594,13 +609,13 @@ Create `~/.wawesome/settings.json`:
 }
 ```
 
-#### 2. Environment Variables
+#### 2. Environment variables
 
 ```bash
 export WAWESOME_GATEWAY_URL="http://localhost:3000"
 ```
 
-#### 3. CLI Flag
+#### 3. CLI flag
 
 ```bash
 npx wawesome login --gateway http://localhost:3000
@@ -613,10 +628,10 @@ gateway along with the credentials.
 
 ---
 
-## 🤖 Deploying from CI
+## Deploying from CI
 
 A **deploy credential** is what deploys without a person at a keyboard. Your workspace mints one, and the CLI reads it
-from a single environment variable — there is no login, and no credentials file is involved at any point:
+from a single environment variable. There is no login, and no credentials file is involved at any point:
 
 ```bash
 export WAWESOME_DEPLOY_CREDENTIAL="wawe_..."
@@ -633,8 +648,8 @@ While it is set:
 - it wins over any `~/.wawesome/credentials.json` on the machine, so a runner with a stale cached home directory still
   deploys as the credential rather than as whoever last logged in there;
 - nothing is written to disk, and the secret stays in the environment where you put it;
-- a refusal says which of four things happened — the credential is unknown, revoked, expired, or does not carry what the
-  command needs — instead of asking you to sign in again, which a pipeline cannot do;
+- a refusal names which of four things happened: the credential is unknown, revoked, expired, or does not carry what
+  the command needs. It does not ask you to sign in again, which a pipeline cannot do;
 - `login` and `logout` refuse, because neither would change what the next command authenticates as;
 - `credentials` is refused by the platform, because minting, listing and revoking are closed to
   credentials whatever they carry;
@@ -642,7 +657,7 @@ While it is set:
 
 ---
 
-## 🔒 Security & Secrets
+## Security and secrets
 
 Wawesome encrypts environment variables at rest using two-tier envelope encryption (AES-256-GCM with per-app data keys
 and AAD context binding). Use `--secret` when setting sensitive keys:
@@ -653,7 +668,7 @@ npx wawesome env set STRIPE_SECRET_KEY sk_live_xxx --secret
 
 ---
 
-## 🌐 Resources & Support
+## Resources and support
 
 - **Platform Homepage**: [https://wawesome.io](https://wawesome.io)
 - **Documentation**: [https://docs.wawesome.io](https://docs.wawesome.io)

package/dist/index.mjs

@@ -331,10 +331,10 @@ function decodeVlq(encoded) {
 //#endregion
 //#region src/guest-surface-scan.ts
 const MAX_LOCATIONS = 3;
-const ABSENT_PROBLEM = "the guest does not define it — evaluating this reference throws a ReferenceError";
-const METHOD_PROBLEM = "the guest carries no ICU, so it ignores the locale argument";
-const GUARDED_PROBLEM = "the guest does not define it — this bundle guards the reference, so the path it takes when the global is missing is the one that runs";
-const DEFERRED_PROBLEM = "the guest does not define it — the code holding this reference throws a ReferenceError if it ever runs";
+const ABSENT_PROBLEM = "The guest does not define it, so evaluating this reference throws a ReferenceError.";
+const METHOD_PROBLEM = "The guest carries no ICU, so it ignores the locale argument.";
+const GUARDED_PROBLEM = "The guest does not define it. This bundle guards the reference, so what runs is the path it takes when the global is missing.";
+const DEFERRED_PROBLEM = "The guest does not define it. The code holding this reference throws a ReferenceError if it ever runs.";
 const GLOBAL_OBJECTS = /* @__PURE__ */ new Set([
 	"globalThis",
 	"window",
@@ -472,7 +472,7 @@ function surfaceReportLines(findings) {
 	const lines = [];
 	for (const finding of findings) {
 		const headline = finding.severity === "refuse" ? "Refusing to deploy" : "Warning";
-		lines.push(`[wawesome] ${headline}: \`${finding.name}\` — ${finding.problem}.`);
+		lines.push(`[wawesome] ${headline}: \`${finding.name}\`. ${finding.problem}`);
 		for (const location of finding.locations) lines.push(`[wawesome]   at ${location.file}:${location.line}:${location.column}`);
 		if (finding.undisplayedLocations > 0) lines.push(`[wawesome]   and ${finding.undisplayedLocations} more reference${finding.undisplayedLocations === 1 ? "" : "s"}`);
 		lines.push(`[wawesome]   Remedy: ${finding.remedy}`);
@@ -883,7 +883,7 @@ async function buildJs(entryInput, options) {
 * that has to name this version — `--version`, the dependency a scaffolded
 * project pins — reads it here, so a release bumps one file.
 */
-const CLI_VERSION = "0.10.0";
+const CLI_VERSION = "0.12.0";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -1158,7 +1158,7 @@ async function promptForWorkspaceName(options) {
 	const supplied = options.workspace?.trim();
 	if (supplied) return supplied;
 	if (!isInteractive()) throw new Error("No workspace found, and no name to create one with. Re-run with --workspace <name>.");
-	console.log("\n[wawesome] You don't have a workspace yet — let's create one.");
+	console.log("\n[wawesome] You don't have a workspace yet. Let's create one.");
 	console.log("  (this is the name you'll see in the dashboard; its public address is set separately)");
 	const session = openPromptSession();
 	try {
@@ -1454,11 +1454,11 @@ async function reportCredential(creds) {
 function whenItRuns(schedule) {
 	const undeclared = schedule.declared === false;
 	if (schedule.state === "suspended") {
-		const why = "the workspace owes payment, its subscription ended, or it has spent past its plan's allowance";
-		return undeclared ? `suspended, and not in this config file — ${why}; declare it again too` : `suspended — ${why}`;
+		const why = "The workspace owes payment, its subscription ended, or it has spent past its plan's allowance";
+		return undeclared ? `suspended, and not in this config file. ${why}; declare it again too` : `suspended. ${why}`;
 	}
-	if (schedule.state === "paused") return undeclared ? "paused, and not in this config file — declare it again, then resume" : "paused — resume it to run again";
-	if (undeclared) return "not in this config file — disabled, kept";
+	if (schedule.state === "paused") return undeclared ? "paused, and not in this config file. Declare it again, then resume" : "paused. Resume it to run again";
+	if (undeclared) return "not in this config file, so it is disabled. Its history is kept";
 	if (schedule.state !== "active") return schedule.state;
 	return schedule.next_fire_at ? `next run ${asUtc$1(schedule.next_fire_at)}` : "next run unknown";
 }
@@ -1553,11 +1553,33 @@ async function applyDeclaredDomain(creds, app, hostname) {
 			kind: "refused",
 			hostname,
 			said: whatWentWrong(err),
-			advice: planLimitAdvice(refusal?.reason)
+			advice: planLimitAdvice(refusal?.reason),
+			held: held.find((domain) => !domain.detaching)?.hostname
 		};
 	}
 }
 /**
+* What the App carries that its configuration does not, for a deploy that
+* declares no domain at all.
+*
+* Reports and never acts. A read that fails says nothing rather than guessing:
+* a project with no domain in its file has nothing to be told about one, and a
+* false alarm here is one about a client's site that is up.
+*/
+async function findUndeclaredDomain(creds, app) {
+	let held;
+	try {
+		held = await listDomains(creds, app);
+	} catch {
+		return null;
+	}
+	const domain = held.find((candidate) => !candidate.detaching);
+	return domain ? {
+		kind: "undeclared",
+		domain
+	} : null;
+}
+/**
 * The platform's own words where it has any. A credential refusal is read
 * through the same reading every other command gives one, so a CI runner is
 * told what its credential lacks rather than to sign in again.
@@ -1597,6 +1619,62 @@ async function attachDomain(creds, app, hostname) {
 	const { domain } = await res.json();
 	return domain;
 }
+/**
+* Take a domain off the App, naming it. The name is the route's requirement and
+* ADR-0025's argument, not this function's.
+*/
+async function detachDomain(creds, app, hostname) {
+	const res = await authorizedFetch(`${domainsUrl(creds, app)}/${encodeURIComponent(hostname)}`, {
+		method: "DELETE",
+		headers: { Authorization: `Bearer ${creds.tenant_jwt}` }
+	});
+	if (!res.ok) throw await asGatewayError(res, `'${hostname}' could not be detached (HTTP ${res.status}).`);
+}
+/** A missing name is refused here rather than sent, so the reason reads at the keyboard. */
+async function detachDomainCommand(hostname, options = {}) {
+	if (!hostname || !hostname.trim()) {
+		console.error("[wawesome] Error: Missing domain. Usage: wawesome domains detach <hostname>");
+		console.error("[wawesome] The domain is typed out because detaching one takes it dark.");
+		process.exit(1);
+	}
+	const creds = readCredentials();
+	if (!creds) {
+		console.error("[wawesome] Error: Not logged in. Run 'wawesome login' first.");
+		process.exit(1);
+	}
+	const app = options.app?.trim() || readFunctionConfig()?.app?.trim();
+	if (!app) {
+		console.error("[wawesome] Error: No wawesome-function.json found in the current directory.");
+		console.error("[wawesome] Run this from your project, or name the app with --app <slug>.");
+		process.exit(1);
+	}
+	const name = hostname.trim();
+	console.log(`[wawesome] Detaching '${name}' from app '${app}':`);
+	console.log("[wawesome]   • the domain stops resolving here, so anything pointed at it stops");
+	console.log("[wawesome]     reaching this app");
+	console.log("[wawesome]   • this app's own address is unaffected and keeps serving");
+	console.log("[wawesome]   • the certificate is given back, and none is held for the name");
+	try {
+		await detachDomain(creds, app, name);
+	} catch (err) {
+		console.error(`[wawesome] Error: ${whatWentWrong(err)}`);
+		process.exit(1);
+	}
+	console.log(`[wawesome] ✅ Detached '${name}' from app '${app}'.`);
+	console.log("[wawesome] The domain is free to attach again by declaring it and deploying.");
+	const declared = readFunctionConfig()?.domain;
+	if (typeof declared === "string" && isSameHostname(declared, name)) {
+		console.log(`[wawesome] wawesome-function.json still declares '${declared}'. Remove the line,`);
+		console.log("[wawesome] or the next deploy attaches the domain again.");
+	}
+}
+async function domainsCommand(action, target, options = {}) {
+	if ((action || "").toLowerCase().trim() === "detach") return detachDomainCommand(target, options);
+	console.error(`[wawesome] Error: Unknown command '${["domains", action].filter(Boolean).join(" ")}'.`);
+	console.error("[wawesome] Usage: wawesome domains detach <hostname>");
+	console.error("[wawesome] A domain is attached by declaring it in wawesome-function.json.");
+	process.exit(1);
+}
 function domainsUrl(creds, app) {
 	return `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/domains`;
 }
@@ -1607,11 +1685,16 @@ function domainsUrl(creds, app) {
 * added a day apart: the TXT issues the certificate, and the CNAME is pointed
 * here afterwards so a site that is already live never answers on a
 * certificate that is not there yet.
+*
+* Read off the records too, never the states alone: naming a record the payload
+* does not carry left a reader holding the CNAME alone (#610).
 */
-function whereItGotTo(state) {
+function whereItGotTo(domain) {
+	const { state } = domain;
 	if (state.serving) return "serving";
 	if (state.certificate_active) return "certificate issued, so point the CNAME here to cut over";
 	if (state.ownership_verified) return "ownership verified, and the certificate is being issued";
+	if (domain.certificate_record_pending) return "not verified yet, and the TXT record is not ready";
 	return "not verified yet, so add the TXT record below";
 }
 function whatItIsFor(record) {
@@ -1625,19 +1708,37 @@ const VALUE_COLUMN = " ".repeat(14);
 function domainLines(outcome) {
 	if (outcome.kind === "unread") return [
 		"",
-		`  Domain:     \x1b[33m${outcome.hostname} — could not be read\x1b[0m`,
+		`  Domain:     \x1b[33m${outcome.hostname}: where it got to is unknown\x1b[0m`,
 		...wrapped(outcome.said).map((line) => `${VALUE_COLUMN}${line}`),
 		`${VALUE_COLUMN}Nothing about the domain changed, and the deploy landed.`
 	];
+	if (outcome.kind === "undeclared") {
+		const { hostname, state } = outcome.domain;
+		const left = state.serving ? "it is still serving" : "nothing changed";
+		return [
+			"",
+			`  Domain:     \x1b[33m${hostname}: attached, and this project declares no domain\x1b[0m`,
+			...wrapped(`Nothing was detached and ${left}. A domain comes off an App when somebody names it, never because a line was deleted. Declare it again in wawesome-function.json, or take it off with`).map((line) => `${VALUE_COLUMN}${line}`),
+			`${VALUE_COLUMN}  \x1b[36mwawesome domains detach ${hostname}\x1b[0m`
+		];
+	}
 	if (outcome.kind === "refused") return [
 		"",
-		`  Domain:     \x1b[33m${outcome.hostname} — not attached\x1b[0m`,
+		`  Domain:     \x1b[33m${outcome.hostname}: not attached\x1b[0m`,
 		...wrapped(outcome.said).map((line) => `${VALUE_COLUMN}${line}`),
 		...outcome.advice ? [`${VALUE_COLUMN}${outcome.advice}`] : [],
+		...outcome.held ? [`${VALUE_COLUMN}Nothing was detached. Take '${outcome.held}' off first with`, `${VALUE_COLUMN}  \x1b[36mwawesome domains detach ${outcome.held}\x1b[0m`] : [],
 		`${VALUE_COLUMN}The deploy landed, and this App's other address still answers.`
 	];
-	const { hostname, records, state, last_checked_at } = outcome.domain;
-	const lines = ["", `  Domain:     \x1b[36m${hostname}\x1b[0m — ${whereItGotTo(state)}`];
+	const { hostname, records, state, last_checked_at, detaching, certificate_record_pending } = outcome.domain;
+	if (detaching) return [
+		"",
+		`  Domain:     \x1b[33m${hostname}: being detached\x1b[0m`,
+		`${VALUE_COLUMN}It has stopped answering, and the certificate is being given back.`,
+		`${VALUE_COLUMN}Remove 'domain' from wawesome-function.json, or deploy again`,
+		`${VALUE_COLUMN}once it is gone to attach it afresh.`
+	];
+	const lines = ["", `  Domain:     \x1b[36m${hostname}\x1b[0m: ${whereItGotTo(outcome.domain)}`];
 	if (state.serving) {
 		lines.push(`${VALUE_COLUMN}The address above answers too, so nothing pointed at it breaks.`);
 		return lines;
@@ -1646,7 +1747,9 @@ function domainLines(outcome) {
 	const nameWidth = Math.max(...records.map((record) => record.name.length));
 	lines.push("", "  DNS records to add at your registrar:");
 	for (const record of records) lines.push("", `    ${whatItIsFor(record)}:`, `      ${record.type.padEnd(5)}  ${record.name.padEnd(nameWidth)}  ${record.value}`);
-	lines.push("", `${VALUE_COLUMN}The deploy is finished. This domain comes up on its own`, `${VALUE_COLUMN}once the records resolve.`);
+	lines.push("");
+	if (certificate_record_pending) lines.push(`${VALUE_COLUMN}The TXT record that proves you own the name is not ready`, `${VALUE_COLUMN}yet. Deploy again in a minute and it prints here. The`, `${VALUE_COLUMN}deploy is finished either way.`);
+	else lines.push(`${VALUE_COLUMN}The deploy is finished. This domain comes up on its own`, `${VALUE_COLUMN}once the records resolve.`);
 	return lines;
 }
 /** The platform's own prose, kept inside the block it is printed in. */
@@ -1738,7 +1841,7 @@ const MONTHS = [
 ];
 /** Indented to sit inside the receipt the deploy already prints. */
 function headroomLines(usage) {
-	const lines = [`  Plan:     ${usage.plan.name} — this deploy does not change your bill.`, `  Apps:     ${usage.occupied_app_slots} / ${usage.plan.limits.app_slots} slots`];
+	const lines = [`  Plan:     ${usage.plan.name}. This deploy does not change your bill.`, `  Apps:     ${usage.occupied_app_slots} / ${usage.plan.limits.app_slots} slots`];
 	const stored = storedLine(usage);
 	if (stored !== null) lines.push(stored);
 	lines.push(`  Usage:    ${periodLabel(usage.period.start, usage.period.end)}`);
@@ -2020,8 +2123,8 @@ function divergenceLines(previous, target, addresses) {
 		`[wawesome] wawesome-function.json now says ${qualifiedName(target)}.`,
 		"",
 		"[wawesome] Deploying will not rename it. A Function's address is built from its",
-		"[wawesome] name, so this deploy lands on a Function of its own and leaves the old",
-		"[wawesome] one exactly as it is — promoted, and still answering the code on it:",
+		"[wawesome] name, so this deploy lands on a Function of its own. The old one stays",
+		"[wawesome] promoted, and still answers the code on it:",
 		"",
 		`[wawesome]   stays live:       ${addresses.previous ?? qualifiedName(previous)}`,
 		`[wawesome]   gets this deploy: ${addresses.next ?? qualifiedName(target)}`,
@@ -2075,7 +2178,7 @@ function declaredVisibility(value) {
 function reportPublishRefusal(message) {
 	console.error(`\n[wawesome] \x1b[31mError: ${message}\x1b[0m`);
 	console.error("[wawesome] Nothing was deployed. This Function is private, so its address");
-	console.error("[wawesome] resolves for nobody — publishing it puts it back on the open");
+	console.error("[wawesome] resolves for nobody. Publishing it puts it back on the open");
 	console.error("[wawesome] internet.");
 	console.error("[wawesome] Re-run with \x1B[36mwawesome deploy --publish\x1B[0m to publish it, or put");
 	console.error("[wawesome] \x1B[36m\"visibility\": \"private\"\x1B[0m back in wawesome-function.json.\n");
@@ -2236,7 +2339,7 @@ async function deploy(entryInput, options) {
 	} catch (err) {
 		if (isVerbose) console.log(`[wawesome:verbose] Could not resolve the workspace address: ${err instanceof Error ? err.message : err}`);
 	}
-	const domain = domainName ? await applyDeclaredDomain(creds, app, domainName) : null;
+	const domain = domainName ? await applyDeclaredDomain(creds, app, domainName) : await findUndeclaredDomain(creds, app);
 	let headroom = null;
 	try {
 		headroom = headroomLines(await fetchTenantUsage(creds));
@@ -2256,13 +2359,13 @@ async function deploy(entryInput, options) {
 		for (const line of scheduleLines(schedules)) console.log(line);
 	}
 	if (visibility === "private") {
-		console.log("\n  URL:        none — this Function is private, so it is not reachable");
+		console.log("\n  URL:        none. This Function is private, so it is not reachable");
 		console.log("              from the web at all.");
 	} else if (address) {
 		console.log(`\n  URL:        \x1b[36m${address}\x1b[0m`);
 		console.log(`              ${SUBTREE_NOTE}`);
 	} else if (surface) {
-		console.log("\n  URL:        none — this gateway serves no public address form.");
+		console.log("\n  URL:        none. This gateway serves no public address form.");
 		console.log("              Set CONTENT_ORIGIN on it, or ALLOW_PATH_INVOCATION_FORM");
 		console.log("              for local development.");
 	}
@@ -2358,8 +2461,8 @@ async function uploadAssets(creds, app, funcName, bundle, assets, declared, isVe
 //#region src/env.ts
 const STANDARD_SECRET_MESSAGES = [
 	"Encrypted at rest using AES-256",
-	"This value can't be viewed again after you save it — only updated or deleted",
-	"Only decrypted at the moment your function runs — never returned by the CLI, dashboard, or API after creation."
+	"This value can't be viewed again after you save it, only updated or deleted",
+	"Only decrypted at the moment your function runs, and never returned by the CLI, dashboard, or API after creation."
 ];
 /**
 * Load credentials and validate project config.
@@ -3048,7 +3151,7 @@ async function listTemplates(options) {
 	}
 	console.log("\n📦 \x1B[1mTemplates\x1B[0m\n");
 	for (const template of templates) {
-		console.log(`  \x1b[36m${template.name}\x1b[0m — ${template.title}`);
+		console.log(`  \x1b[36m${template.name}\x1b[0m: ${template.title}`);
 		console.log(`    ${template.description}`);
 		if (template.tags.length > 0) console.log(`    \x1b[90m${template.tags.join(", ")}\x1b[0m`);
 		console.log(`    \x1b[90m${template.source_url}\x1b[0m`);
@@ -3170,7 +3273,7 @@ async function ensureSession(options) {
 		const probed = await probeSession(stored);
 		if (probed) return probed;
 	}
-	console.log(stored ? "\n[wawesome] Your session has expired." : "\n[wawesome] You're not logged in yet — that's what a deploy needs.");
+	console.log(stored ? "\n[wawesome] Your session has expired." : "\n[wawesome] You're not logged in yet, which is what a deploy needs.");
 	if (!isInteractive()) {
 		console.log("[wawesome] Run 'wawesome login', then 'wawesome deploy'.");
 		return null;
@@ -3234,12 +3337,12 @@ async function offerWorkspaceAddress(session, creds, tenant, appSlug, functionNa
 		return;
 	}
 	if (tenant.slug_locked) {
-		console.log(`  🔒 '${current}' is fixed — a Function version has been promoted, and live URLs already carry it.\n`);
+		console.log(`  🔒 '${current}' is fixed. A Function version has been promoted, and live URLs already carry it.\n`);
 		return;
 	}
-	console.log(`  '${current}' is your workspace address — the part of that URL that is yours`);
-	console.log("  rather than this project's, and this is the moment to change it: it locks");
-	console.log("  for good the first time you deploy, because live URLs carry it.");
+	console.log(`  '${current}' is your workspace address, the part of that URL that is`);
+	console.log("  yours rather than this project's. Now is the moment to change it. It");
+	console.log("  locks for good the first time you deploy, because live URLs carry it.");
 	console.log("  Press enter to keep it.\n");
 	let refusal;
 	for (let attempt = 0; attempt < MAX_RENAME_ATTEMPTS; attempt++) {
@@ -3271,7 +3374,7 @@ async function offerWorkspaceAddress(session, creds, tenant, appSlug, functionNa
 * template from needing a CLI release.
 */
 async function wireUp(creds, appSlug, manifest, answers) {
-	const scaffolded = "Your project is scaffolded — fix this, then run 'wawesome deploy'.";
+	const scaffolded = "Your project is scaffolded. Fix this, then run 'wawesome deploy'.";
 	try {
 		await ensureApp(creds, appSlug);
 	} catch (err) {
@@ -3354,7 +3457,7 @@ async function initFromTemplate(templateName, options) {
 		const session = openPromptSession();
 		try {
 			functionName = await promptForSlug(session, "Function name", readFunctionConfig(staging)?.function || dirName);
-			console.log("  (an App groups the Functions of one project — its slug is part of the public URL)");
+			console.log("  (an App groups the Functions of one project, and its slug is part of the public URL)");
 			appSlug = await promptForSlug(session, "App slug", dirName);
 			let repinned = null;
 			try {
@@ -3368,7 +3471,7 @@ async function initFromTemplate(templateName, options) {
 				fail$1(errorText(err), `Some of '${template.name}' may have been written to ${cwd}.`);
 			}
 			console.log(`\n[wawesome] ✅ Scaffolded ${files.length} files from '${template.name}'.`);
-			if (repinned) console.log(`[wawesome] Using wawesome ${repinned.to} — the template pinned ${repinned.from}.`);
+			if (repinned) console.log(`[wawesome] Using wawesome ${repinned.to}. The template pinned ${repinned.from}.`);
 			if (tenantSession) await offerWorkspaceAddress(session, tenantSession.creds, tenantSession.tenant, appSlug, functionName);
 			answers = tenantSession ? await promptForDeclaredEnv(session, manifest.env) : [];
 		} finally {
@@ -3417,7 +3520,7 @@ async function init(options) {
 			functionName = "root";
 			console.log("  Function name? root  (locked by --root)");
 		} else functionName = await promptForSlug(session, "Function name", dirName);
-		console.log("  (an App groups the Functions of one project — its slug is part of the public URL)");
+		console.log("  (an App groups the Functions of one project, and its slug is part of the public URL)");
 		appSlug = await promptForSlug(session, "App slug", dirName);
 	} finally {
 		session.close();
@@ -4424,7 +4527,7 @@ async function showWorkspace(options) {
 			console.log(`            ${SUBTREE_NOTE}`);
 		}
 	}
-	if (tenant.slug_locked) console.log("\n  🔒 The address is fixed — a Function version has been promoted and live URLs carry it.");
+	if (tenant.slug_locked) console.log("\n  🔒 The address is fixed. A Function version has been promoted, and live URLs carry it.");
 	else {
 		console.log("\n  The address can still be changed: \x1B[36mwawesome workspace rename <name>\x1B[0m");
 		console.log("  It locks for good the first time you deploy.");
@@ -5196,6 +5299,8 @@ cli.command("env [action] [key] [value]", "Manage environment variables (set, li
 cli.command("env set <key> <value>", "Set or overwrite an environment variable on the current app").option("-s, --secret", "Flag variable as secret (write-only)").option("-v, --verbose", "Enable verbose debug output").action((key, value, options) => setEnvVar(key, value, options));
 cli.command("env list", "List environment variables for the current app").alias("env ls").option("-v, --verbose", "Enable verbose debug output").action((options) => listEnvVars(options));
 cli.command("env rm <key>", "Delete an environment variable from the current app").alias("env remove").alias("env delete").alias("env unset").option("-v, --verbose", "Enable verbose debug output").action((key, options) => removeEnvVar(key, options));
+cli.command("domains [action] [hostname]", "Manage the custom domain on the current app (detach)").usage("domains <action> [hostname]\n\nActions:\n  detach <hostname>   Stop serving the app at a domain you attached\n\nA domain is attached by declaring it in wawesome-function.json and deploying.").example("wawesome domains detach shop.client.com").option("-a, --app <slug>", "App to act on (default: the app in wawesome-function.json)").action((action, hostname, options) => domainsCommand(action, hostname, options));
+cli.command("domains detach <hostname>", "Stop serving the current app at a domain you attached").option("-a, --app <slug>", "App to act on (default: the app in wawesome-function.json)").action((hostname, options) => detachDomainCommand(hostname, options));
 cli.command("login", "Authenticate with the wawesome.io platform").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("--gateway <url>", "Alias for --api <url>").option("--dashboard <url>", "Dashboard URL (default: https://dashboard.wawesome.io)").option("--provider <name>", "OAuth provider (default: github)").option("--workspace <name>", "Name for the workspace, when signing up without a terminal to prompt").option("--accept-terms", "Accept the terms of service and privacy policy, when signing up without a terminal to prompt").option("-v, --verbose", "Enable verbose debug output").action((options) => login(options));
 cli.command("logout", "Clear stored authentication credentials").action(() => logout());
 cli.command("whoami", "Show current login session info").action(() => whoami());
@@ -5217,34 +5322,35 @@ cli.command("credentials [action] [target]", "Mint, list and revoke deploy crede
     wawesome credentials mint ci-pipeline
     wawesome credentials mint agent -c logs:read --expires never
     wawesome credentials mint prod-deploy -c deploy -a prod --expires 30
+    wawesome credentials mint ci -c deploy,domains:attach -a prod
     wawesome credentials mint ci-pipeline > /tmp/secret
     wawesome credentials revoke ci-pipeline
-    wawesome credentials revoke wawe_ab3k9x --yes`).option("-c, --capability <capability>", "Capability to grant: deploy, logs:read (repeatable or comma-separated, default: deploy)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated, default: every App)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-y, --yes", "Skip the revoke confirmation").option("-v, --verbose", "Enable verbose debug output").action((action, target, options) => credentialsCommand(action, target, options));
-cli.command("credentials mint <name>", "Mint a deploy credential, printing its secret exactly once").option("-c, --capability <capability>", "Capability to grant: deploy, logs:read (repeatable or comma-separated)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-v, --verbose", "Enable verbose debug output").action((name, options) => mintCredentialCommand(name, options));
-cli.command("credentials list", "List deploy credentials — never their secrets").alias("credentials ls").option("-v, --verbose", "Enable verbose debug output").action((options) => listCredentialsCommand(options));
+    wawesome credentials revoke wawe_ab3k9x --yes`).option("-c, --capability <capability>", "Capability to grant: deploy, logs:read, domains:attach (repeatable or comma-separated, default: deploy)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated, default: every App)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-y, --yes", "Skip the revoke confirmation").option("-v, --verbose", "Enable verbose debug output").action((action, target, options) => credentialsCommand(action, target, options));
+cli.command("credentials mint <name>", "Mint a deploy credential, printing its secret exactly once").option("-c, --capability <capability>", "Capability to grant: deploy, logs:read, domains:attach (repeatable or comma-separated)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-v, --verbose", "Enable verbose debug output").action((name, options) => mintCredentialCommand(name, options));
+cli.command("credentials list", "List deploy credentials, never their secrets").alias("credentials ls").option("-v, --verbose", "Enable verbose debug output").action((options) => listCredentialsCommand(options));
 cli.command("credentials revoke <name-or-prefix>", "Revoke a deploy credential, immediately and for good").option("-y, --yes", "Revoke without being asked to confirm").option("-v, --verbose", "Enable verbose debug output").action((target, options) => revokeCredentialCommand(target, options));
 cli.command("init", "Scaffold a new function project in the current directory").usage("init [options]\n\nWith --template, the project is fetched from the template catalog, wired up\nfrom what the template declares it needs, and deployed. Run 'wawesome templates'\nto see what is available.").example("wawesome init").example("wawesome init --template stripe-webhook").option("-t, --template <name>", "Scaffold from a catalog template and deploy it").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("--dashboard <url>", "Dashboard URL (default: https://dashboard.wawesome.io)").option("--no-install", "Skip installing dependencies after scaffolding").option("--root", "Generate a root function router template").option("-v, --verbose", "Enable verbose debug output").action((options) => init(options));
 cli.command("logs [function-name-or-invocation-id]", "View invocation history, fetch log output, or follow live").usage(`logs [target] [options]
 
   The target argument determines what the command does:
 
-  MODE 1 — List invocations (no UUID target)
+  MODE 1: list invocations (no UUID target)
     wawesome logs                          # list invocations for the function in the current directory
     wawesome logs my-function              # list invocations for 'my-function'
     wawesome logs my-function --error      # only show failed invocations
     wawesome logs my-function --running    # only show currently running invocations
 
-  MODE 2 — Fetch captured log body (UUID target or --invocation)
+  MODE 2: fetch the captured log body (UUID target or --invocation)
     wawesome logs <invocation-id>                    # print stdout/stderr for a specific invocation
     wawesome logs my-function --invocation <id>      # same, explicit flag form
 
-  MODE 3 — Follow live output (--follow / -f)
+  MODE 3: follow live output (--follow / -f)
     wawesome logs my-function --follow               # follow the function: stream output from every invocation as it runs
     wawesome logs <invocation-id> --follow            # follow one specific in-flight invocation by ID
 
-  With a function name, --follow streams the function's output continuously across
-  invocations — new output appears each time the function runs, no need to catch a
-  specific invocation. Press Ctrl-C to stop at any time.`).option("-f, --follow", "Stream live output (tail -f style). Follows a running invocation or waits for the next one. Ctrl-C to stop").option("-i, --invocation <id>", "Fetch stdout/stderr log body for a specific invocation ID").option("-a, --app <app>", "App slug override (defaults to wawesome-function.json)").option("-s, --status <status>", "Filter invocations by status (success, error, timeout, running)").option("--success", "Shorthand for --status success").option("--error", "Shorthand for --status error").option("--timeout", "Shorthand for --status timeout").option("--running", "Shorthand for --status running").option("-v, --verbose", "Enable verbose debug output").action((target, options) => logsCommand(target, options));
+  With a function name, --follow streams the function's output across invocations.
+  New output appears each time the function runs, so you never have to catch a
+  specific one. Press Ctrl-C to stop at any time.`).option("-f, --follow", "Stream live output (tail -f style). Follows a running invocation or waits for the next one. Ctrl-C to stop").option("-i, --invocation <id>", "Fetch stdout/stderr log body for a specific invocation ID").option("-a, --app <app>", "App slug override (defaults to wawesome-function.json)").option("-s, --status <status>", "Filter invocations by status (success, error, timeout, running)").option("--success", "Shorthand for --status success").option("--error", "Shorthand for --status error").option("--timeout", "Shorthand for --status timeout").option("--running", "Shorthand for --status running").option("-v, --verbose", "Enable verbose debug output").action((target, options) => logsCommand(target, options));
 cli.command("invoke [function]", "Fire a background run of a serverless function").usage(`invoke [function] [options]
 
   Fire a Function run now through the authenticated API, without deploying anything

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wawesome",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "CLI tool for building and deploying serverless functions on wawesome.io platform",
   "type": "module",
   "bin": {