wawesome 0.11.0 → 0.13.0

package/README.md

@@ -117,6 +117,8 @@ npx wawesome deploy
 | `npx wawesome env list`                 | View environment variables for the current app                      |
 | `npx wawesome env set <key> <val>`      | Set an environment variable (add `--secret` for write-only)         |
 | `npx wawesome env rm <key>`             | Delete an environment variable                                      |
+| `npx wawesome domains`                  | Show the app's domain, its state, and the DNS records to add        |
+| `npx wawesome domains detach <host>`    | Stop serving the app at a domain you attached                       |
 | `npx wawesome credentials`              | List deploy credentials: name, prefix, capabilities, Apps, last use |
 | `npx wawesome credentials mint <name>`  | Mint a deploy credential and print its secret, once                 |
 | `npx wawesome credentials revoke <name>`| Revoke a deploy credential by name or prefix                        |
@@ -314,11 +316,14 @@ you say otherwise:
 ```bash
 # reads logs and cannot deploy, restricted to one App, never expires
 npx wawesome credentials mint agent -c logs:read -a prod --expires never
+
+# ships code and attaches the domain the project declares
+npx wawesome credentials mint ci -c deploy,domains:attach -a prod
 ```
 
 | Flag                 | Meaning                                                                       |
 |:---------------------|:------------------------------------------------------------------------------|
-| `-c, --capability`   | `deploy`, `logs:read`, or both. Repeatable or comma-separated. Default `deploy` |
+| `-c, --capability`   | `deploy`, `logs:read`, `domains:attach`, or any mix. Repeatable or comma-separated. Default `deploy` |
 | `-a, --app`          | Restrict to these Apps, by slug. Repeatable. Default: every App in the workspace |
 | `--expires`          | Days, or `never`. Default: 90                                                   |
 
@@ -524,6 +529,19 @@ Your deploy waits for neither. It attaches the domain, prints the records and fi
 later deploy states where the domain got to: not verified, ownership verified, certificate issued, or
 serving. A domain that is already serving is a line saying so and nothing else.
 
+The same block is there when you are not deploying:
+
+```bash
+npx wawesome domains
+```
+
+It prints the domain, where it got to, when the platform last checked, and the records to add. It
+changes nothing, and a deploy credential carrying `deploy` can run it, so a pipeline reads the same
+thing you do. The TXT record is minted a moment after the name is claimed, and an attach that outran
+it prints a row saying so rather than dropping the record from the list. That row is what this
+command fills in, and it is where the deploy sends you: deploying again would change nothing, and a
+deploy that changes nothing is refused.
+
 A custom domain is granted from the Solo plan upwards, one per App. On a plan that grants none, the
 deploy prints the refusal and lands everything else it was doing.
 

package/dist/index.mjs

@@ -883,7 +883,7 @@ async function buildJs(entryInput, options) {
 * that has to name this version — `--version`, the dependency a scaffolded
 * project pins — reads it here, so a release bumps one file.
 */
-const CLI_VERSION = "0.11.0";
+const CLI_VERSION = "0.13.0";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -1630,13 +1630,11 @@ async function detachDomain(creds, app, hostname) {
 	});
 	if (!res.ok) throw await asGatewayError(res, `'${hostname}' could not be detached (HTTP ${res.status}).`);
 }
-/** A missing name is refused here rather than sent, so the reason reads at the keyboard. */
-async function detachDomainCommand(hostname, options = {}) {
-	if (!hostname || !hostname.trim()) {
-		console.error("[wawesome] Error: Missing domain. Usage: wawesome domains detach <hostname>");
-		console.error("[wawesome] The domain is typed out because detaching one takes it dark.");
-		process.exit(1);
-	}
+/**
+* Who is asking and which App they are asking about. A deploy credential in the
+* environment is a caller here, so this never insists on a session.
+*/
+function credentialsAndApp(options) {
 	const creds = readCredentials();
 	if (!creds) {
 		console.error("[wawesome] Error: Not logged in. Run 'wawesome login' first.");
@@ -1648,6 +1646,19 @@ async function detachDomainCommand(hostname, options = {}) {
 		console.error("[wawesome] Run this from your project, or name the app with --app <slug>.");
 		process.exit(1);
 	}
+	return {
+		creds,
+		app
+	};
+}
+/** A missing name is refused here rather than sent, so the reason reads at the keyboard. */
+async function detachDomainCommand(hostname, options = {}) {
+	if (!hostname || !hostname.trim()) {
+		console.error("[wawesome] Error: Missing domain. Usage: wawesome domains detach <hostname>");
+		console.error("[wawesome] The domain is typed out because detaching one takes it dark.");
+		process.exit(1);
+	}
+	const { creds, app } = credentialsAndApp(options);
 	const name = hostname.trim();
 	console.log(`[wawesome] Detaching '${name}' from app '${app}':`);
 	console.log("[wawesome]   • the domain stops resolving here, so anything pointed at it stops");
@@ -1668,10 +1679,40 @@ async function detachDomainCommand(hostname, options = {}) {
 		console.log("[wawesome] or the next deploy attaches the domain again.");
 	}
 }
+/**
+* What this App answers at, read and printed.
+*
+* The one place a Tenant can ask. The records used to exist only in the output
+* of a deploy that changed something, so a deploy that outran the vendor left
+* nothing to run but a second deploy, which is refused for changing nothing
+* (#617). Open to a deploy credential carrying `deploy`, since a pipeline asks
+* this too.
+*/
+async function showDomainCommand(options = {}) {
+	const { creds, app } = credentialsAndApp(options);
+	let held;
+	try {
+		held = await listDomains(creds, app);
+	} catch (err) {
+		console.error(`[wawesome] Error: ${whatWentWrong(err)}`);
+		process.exit(1);
+	}
+	if (held.length === 0) {
+		console.log(`[wawesome] No domain is attached to app '${app}'.`);
+		console.log("[wawesome] Declare one in wawesome-function.json and deploy:");
+		console.log(`[wawesome]   \x1b[36m${DOMAIN_CONFIG_LINE}\x1b[0m`);
+		console.log("[wawesome] The deploy attaches it and prints the records to add.");
+		return;
+	}
+	console.log(`[wawesome] The domain on app '${app}':`);
+	for (const domain of held) for (const line of attachedDomainLines(domain, "domains")) console.log(line);
+}
 async function domainsCommand(action, target, options = {}) {
-	if ((action || "").toLowerCase().trim() === "detach") return detachDomainCommand(target, options);
+	const verb = (action || "").toLowerCase().trim();
+	if (verb === "detach") return detachDomainCommand(target, options);
+	if (!verb) return showDomainCommand(options);
 	console.error(`[wawesome] Error: Unknown command '${["domains", action].filter(Boolean).join(" ")}'.`);
-	console.error("[wawesome] Usage: wawesome domains detach <hostname>");
+	console.error("[wawesome] Usage: wawesome domains [detach <hostname>]");
 	console.error("[wawesome] A domain is attached by declaring it in wawesome-function.json.");
 	process.exit(1);
 }
@@ -1685,17 +1726,34 @@ function domainsUrl(creds, app) {
 * added a day apart: the TXT issues the certificate, and the CNAME is pointed
 * here afterwards so a site that is already live never answers on a
 * certificate that is not there yet.
+*
+* Read off the records too, never the states alone: naming a record the payload
+* does not carry left a reader holding the CNAME alone (#610).
 */
-function whereItGotTo(state) {
+function whereItGotTo(domain) {
+	const { state } = domain;
 	if (state.serving) return "serving";
 	if (state.certificate_active) return "certificate issued, so point the CNAME here to cut over";
 	if (state.ownership_verified) return "ownership verified, and the certificate is being issued";
+	if (domain.certificate_record_pending) return "not verified yet, and the TXT record is not ready";
 	return "not verified yet, so add the TXT record below";
 }
-function whatItIsFor(record) {
-	return record.purpose === "certificate" ? "Proves you own the name, and issues the certificate" : "Points traffic here, once the certificate is issued";
+/**
+* What a record is for, and when to add it.
+*
+* The order is stated rather than implied. The TXT proves control and issues
+* the certificate; the CNAME is pointed here afterwards, so a name already
+* serving a live site never answers on a certificate that is not there yet.
+* That is why the platform validates before the cutover, and a reader holding
+* the CNAME alone could read the old caption as a label rather than as an
+* instruction to wait (#617).
+*/
+function whatItIsFor(purpose) {
+	return purpose === "certificate" ? "Add this first. It proves you own the name and issues the certificate" : "Add this once the certificate is active. It points traffic here";
 }
 const VALUE_COLUMN = " ".repeat(14);
+/** What the dashboard's empty state shows. Kept the same by hand, not by anything. */
+const DOMAIN_CONFIG_LINE = "\"domain\": \"shop.client.com\"";
 /**
 * The block a deploy prints for the domain its configuration declares, in the
 * columns the visibility and URL lines above it already use.
@@ -1725,7 +1783,18 @@ function domainLines(outcome) {
 		...outcome.held ? [`${VALUE_COLUMN}Nothing was detached. Take '${outcome.held}' off first with`, `${VALUE_COLUMN}  \x1b[36mwawesome domains detach ${outcome.held}\x1b[0m`] : [],
 		`${VALUE_COLUMN}The deploy landed, and this App's other address still answers.`
 	];
-	const { hostname, records, state, last_checked_at, detaching } = outcome.domain;
+	return attachedDomainLines(outcome.domain, "deploy");
+}
+/**
+* The block for a domain the App carries: where it got to, when the platform
+* last looked, and the records to add.
+*
+* The deploy and `wawesome domains` print this same block. One renderer rather
+* than two, because two of them drift, and a record going missing from one is
+* the whole of #610 and #617.
+*/
+function attachedDomainLines(domain, printedBy = "deploy") {
+	const { hostname, records, state, last_checked_at, detaching, certificate_record_pending } = domain;
 	if (detaching) return [
 		"",
 		`  Domain:     \x1b[33m${hostname}: being detached\x1b[0m`,
@@ -1733,18 +1802,36 @@ function domainLines(outcome) {
 		`${VALUE_COLUMN}Remove 'domain' from wawesome-function.json, or deploy again`,
 		`${VALUE_COLUMN}once it is gone to attach it afresh.`
 	];
-	const lines = ["", `  Domain:     \x1b[36m${hostname}\x1b[0m: ${whereItGotTo(state)}`];
+	const lines = ["", `  Domain:     \x1b[36m${hostname}\x1b[0m: ${whereItGotTo(domain)}`];
+	if (last_checked_at) lines.push(`${VALUE_COLUMN}Last checked ${asUtc$1(last_checked_at)}.`);
 	if (state.serving) {
-		lines.push(`${VALUE_COLUMN}The address above answers too, so nothing pointed at it breaks.`);
+		lines.push(`${VALUE_COLUMN}This app's own address answers too, so nothing pointed at it breaks.`);
 		return lines;
 	}
-	if (last_checked_at) lines.push(`${VALUE_COLUMN}Last checked ${asUtc$1(last_checked_at)}.`);
 	const nameWidth = Math.max(...records.map((record) => record.name.length));
+	const row = (type, name, value = "") => `      ${type.padEnd(5)}  ${name.padEnd(nameWidth)}  ${value}`.trimEnd();
 	lines.push("", "  DNS records to add at your registrar:");
-	for (const record of records) lines.push("", `    ${whatItIsFor(record)}:`, `      ${record.type.padEnd(5)}  ${record.name.padEnd(nameWidth)}  ${record.value}`);
-	lines.push("", `${VALUE_COLUMN}The deploy is finished. This domain comes up on its own`, `${VALUE_COLUMN}once the records resolve.`);
+	if (certificate_record_pending) lines.push("", `    ${whatItIsFor("certificate")}:`, row("TXT", "not ready yet"));
+	for (const record of records) lines.push("", `    ${whatItIsFor(record.purpose)}:`, row(record.type, record.name, record.value));
+	lines.push("", ...closingLines(certificate_record_pending, printedBy));
 	return lines;
 }
+/**
+* What is left to do, which is nothing.
+*
+* The pending case pointed at another deploy until #617: a deploy that changed
+* nothing is refused, so the one piece of advice the reader was given was the
+* one they could not take.
+*/
+function closingLines(certificateRecordPending, printedBy) {
+	if (!certificateRecordPending) return indented(`${printedBy === "deploy" ? "The deploy is finished. " : ""}This domain comes up on its own once the records resolve.`);
+	const asking = "The TXT record is not ready yet. The platform asks the certificate vendor again on its own.";
+	if (printedBy === "domains") return indented(`${asking} Run this again in a minute.`);
+	return [...indented(`${asking} The deploy is finished either way. To read the record when it lands, run`), `${VALUE_COLUMN}  \x1b[36mwawesome domains\x1b[0m`];
+}
+function indented(said) {
+	return wrapped(said).map((line) => `${VALUE_COLUMN}${line}`);
+}
 /** The platform's own prose, kept inside the block it is printed in. */
 function wrapped(said) {
 	const width = 64;
@@ -5292,7 +5379,7 @@ cli.command("env [action] [key] [value]", "Manage environment variables (set, li
 cli.command("env set <key> <value>", "Set or overwrite an environment variable on the current app").option("-s, --secret", "Flag variable as secret (write-only)").option("-v, --verbose", "Enable verbose debug output").action((key, value, options) => setEnvVar(key, value, options));
 cli.command("env list", "List environment variables for the current app").alias("env ls").option("-v, --verbose", "Enable verbose debug output").action((options) => listEnvVars(options));
 cli.command("env rm <key>", "Delete an environment variable from the current app").alias("env remove").alias("env delete").alias("env unset").option("-v, --verbose", "Enable verbose debug output").action((key, options) => removeEnvVar(key, options));
-cli.command("domains [action] [hostname]", "Manage the custom domain on the current app (detach)").usage("domains <action> [hostname]\n\nActions:\n  detach <hostname>   Stop serving the app at a domain you attached\n\nA domain is attached by declaring it in wawesome-function.json and deploying.").example("wawesome domains detach shop.client.com").option("-a, --app <slug>", "App to act on (default: the app in wawesome-function.json)").action((action, hostname, options) => domainsCommand(action, hostname, options));
+cli.command("domains [action] [hostname]", "Show the custom domain on the current app, its state and its DNS records").usage("domains [action] [hostname]\n\nWith no action, prints the app's domain, where it got to, when the platform last checked, and the records to add.\n\nActions:\n  detach <hostname>   Stop serving the app at a domain you attached\n\nA domain is attached by declaring it in wawesome-function.json and deploying.").example("wawesome domains").example("wawesome domains detach shop.client.com").option("-a, --app <slug>", "App to act on (default: the app in wawesome-function.json)").action((action, hostname, options) => domainsCommand(action, hostname, options));
 cli.command("domains detach <hostname>", "Stop serving the current app at a domain you attached").option("-a, --app <slug>", "App to act on (default: the app in wawesome-function.json)").action((hostname, options) => detachDomainCommand(hostname, options));
 cli.command("login", "Authenticate with the wawesome.io platform").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("--gateway <url>", "Alias for --api <url>").option("--dashboard <url>", "Dashboard URL (default: https://dashboard.wawesome.io)").option("--provider <name>", "OAuth provider (default: github)").option("--workspace <name>", "Name for the workspace, when signing up without a terminal to prompt").option("--accept-terms", "Accept the terms of service and privacy policy, when signing up without a terminal to prompt").option("-v, --verbose", "Enable verbose debug output").action((options) => login(options));
 cli.command("logout", "Clear stored authentication credentials").action(() => logout());
@@ -5315,10 +5402,11 @@ cli.command("credentials [action] [target]", "Mint, list and revoke deploy crede
     wawesome credentials mint ci-pipeline
     wawesome credentials mint agent -c logs:read --expires never
     wawesome credentials mint prod-deploy -c deploy -a prod --expires 30
+    wawesome credentials mint ci -c deploy,domains:attach -a prod
     wawesome credentials mint ci-pipeline > /tmp/secret
     wawesome credentials revoke ci-pipeline
-    wawesome credentials revoke wawe_ab3k9x --yes`).option("-c, --capability <capability>", "Capability to grant: deploy, logs:read (repeatable or comma-separated, default: deploy)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated, default: every App)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-y, --yes", "Skip the revoke confirmation").option("-v, --verbose", "Enable verbose debug output").action((action, target, options) => credentialsCommand(action, target, options));
-cli.command("credentials mint <name>", "Mint a deploy credential, printing its secret exactly once").option("-c, --capability <capability>", "Capability to grant: deploy, logs:read (repeatable or comma-separated)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-v, --verbose", "Enable verbose debug output").action((name, options) => mintCredentialCommand(name, options));
+    wawesome credentials revoke wawe_ab3k9x --yes`).option("-c, --capability <capability>", "Capability to grant: deploy, logs:read, domains:attach (repeatable or comma-separated, default: deploy)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated, default: every App)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-y, --yes", "Skip the revoke confirmation").option("-v, --verbose", "Enable verbose debug output").action((action, target, options) => credentialsCommand(action, target, options));
+cli.command("credentials mint <name>", "Mint a deploy credential, printing its secret exactly once").option("-c, --capability <capability>", "Capability to grant: deploy, logs:read, domains:attach (repeatable or comma-separated)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-v, --verbose", "Enable verbose debug output").action((name, options) => mintCredentialCommand(name, options));
 cli.command("credentials list", "List deploy credentials, never their secrets").alias("credentials ls").option("-v, --verbose", "Enable verbose debug output").action((options) => listCredentialsCommand(options));
 cli.command("credentials revoke <name-or-prefix>", "Revoke a deploy credential, immediately and for good").option("-y, --yes", "Revoke without being asked to confirm").option("-v, --verbose", "Enable verbose debug output").action((target, options) => revokeCredentialCommand(target, options));
 cli.command("init", "Scaffold a new function project in the current directory").usage("init [options]\n\nWith --template, the project is fetched from the template catalog, wired up\nfrom what the template declares it needs, and deployed. Run 'wawesome templates'\nto see what is available.").example("wawesome init").example("wawesome init --template stripe-webhook").option("-t, --template <name>", "Scaffold from a catalog template and deploy it").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("--dashboard <url>", "Dashboard URL (default: https://dashboard.wawesome.io)").option("--no-install", "Skip installing dependencies after scaffolding").option("--root", "Generate a root function router template").option("-v, --verbose", "Enable verbose debug output").action((options) => init(options));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wawesome",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "CLI tool for building and deploying serverless functions on wawesome.io platform",
   "type": "module",
   "bin": {