wawesome 0.12.0 → 0.14.0

package/README.md

@@ -117,9 +117,13 @@ npx wawesome deploy
 | `npx wawesome env list`                 | View environment variables for the current app                      |
 | `npx wawesome env set <key> <val>`      | Set an environment variable (add `--secret` for write-only)         |
 | `npx wawesome env rm <key>`             | Delete an environment variable                                      |
+| `npx wawesome domains`                  | Show the app's domain, its state, and the DNS records to add        |
+| `npx wawesome domains detach <host>`    | Stop serving the app at a domain you attached                       |
 | `npx wawesome credentials`              | List deploy credentials: name, prefix, capabilities, Apps, last use |
 | `npx wawesome credentials mint <name>`  | Mint a deploy credential and print its secret, once                 |
+| `npx wawesome credentials regenerate <name>`| Replace a deploy credential's secret, keeping its name          |
 | `npx wawesome credentials revoke <name>`| Revoke a deploy credential by name or prefix                        |
+| `npx wawesome credentials delete <name>`| Delete a revoked or expired credential, freeing its name            |
 
 ---
 
@@ -290,9 +294,9 @@ keyboard to log in. It belongs to the workspace rather than to you: it keeps wor
 and revoking it does not end your own session. Once you have one, [Deploying from CI](#deploying-from-ci)
 is what to do with it.
 
-Minting, listing and revoking belong to the workspace owner. They are closed to deploy credentials
-themselves, whatever those carry, so a leaked credential cannot mint another. All three run on your
-ordinary `npx wawesome login` session.
+Minting, listing, regenerating, revoking and deleting belong to the workspace owner. They are closed
+to deploy credentials themselves, whatever those carry, so a leaked credential cannot mint another or
+renew its own expiry. All five run on your ordinary `npx wawesome login` session.
 
 ### Mint one
 
@@ -340,6 +344,27 @@ Name, displayable prefix, capabilities, Apps, last use and expiry. Never the sec
 platform no longer holds. `LAST USED` lags by a few minutes and reads `never` for a credential
 nothing has ever presented, which is a better reason to revoke one than any calendar date.
 
+### Rotate one
+
+```bash
+npx wawesome credentials regenerate ci-pipeline
+npx wawesome credentials regenerate ci --expires never --yes
+npx wawesome credentials regenerate ci-pipeline > secret.txt
+```
+
+Regenerating replaces the secret where it stands. The credential keeps its id, its name, its
+capabilities and the Apps it may reach, so the only thing to change in your CI settings is the secret
+itself. Its displayable prefix changes with it, since the prefix is what you match one against. The
+new secret is printed once, on stdout alone, exactly as at minting.
+
+It asks first, because anything holding the old secret stops working the moment this lands and has to
+be given the new one; `--yes` is the answer where nobody is at the keyboard. Without `--expires` the
+new secret lives ninety days, the same rule minting follows, including on a credential that never
+expired.
+
+An expired credential regenerates into a working one — that is the ordinary reason to reach for this.
+A revoked one is refused, because nothing un-revokes a credential.
+
 ### Revoke one
 
 ```bash
@@ -352,6 +377,22 @@ where nobody is at the keyboard, and a prefix naming more than one credential is
 guessed at. A revocation lands on the very next request presenting the secret, and nothing un-revokes
 it.
 
+### Delete one
+
+```bash
+npx wawesome credentials delete ci-pipeline
+npx wawesome credentials delete wawe_ab3k9x --yes
+```
+
+Deleting is a second act, not a shortcut through revoking, so only a credential that has already
+stopped working can be deleted. Revoke a live one first. It resolves its target the way revoking
+does, by name or by displayable prefix, and asks before it does it unless you pass `--yes`.
+
+What deleting gives up is the reason revoking left the record behind. The credential leaves the
+listing, the name comes free to mint again, and a pipeline still presenting the secret is told the
+secret is unknown rather than that somebody revoked it. Whoever is debugging that pipeline goes
+looking in their CI settings instead of your dashboard.
+
 ---
 
 ## Configuration and a custom gateway
@@ -527,6 +568,19 @@ Your deploy waits for neither. It attaches the domain, prints the records and fi
 later deploy states where the domain got to: not verified, ownership verified, certificate issued, or
 serving. A domain that is already serving is a line saying so and nothing else.
 
+The same block is there when you are not deploying:
+
+```bash
+npx wawesome domains
+```
+
+It prints the domain, where it got to, when the platform last checked, and the records to add. It
+changes nothing, and a deploy credential carrying `deploy` can run it, so a pipeline reads the same
+thing you do. The TXT record is minted a moment after the name is claimed, and an attach that outran
+it prints a row saying so rather than dropping the record from the list. That row is what this
+command fills in, and it is where the deploy sends you: deploying again would change nothing, and a
+deploy that changes nothing is refused.
+
 A custom domain is granted from the Solo plan upwards, one per App. On a plan that grants none, the
 deploy prints the refusal and lands everything else it was doing.
 
@@ -651,8 +705,8 @@ While it is set:
 - a refusal names which of four things happened: the credential is unknown, revoked, expired, or does not carry what
   the command needs. It does not ask you to sign in again, which a pipeline cannot do;
 - `login` and `logout` refuse, because neither would change what the next command authenticates as;
-- `credentials` is refused by the platform, because minting, listing and revoking are closed to
-  credentials whatever they carry;
+- `credentials` is refused by the platform, because minting, listing, regenerating, revoking and
+  deleting are closed to credentials whatever they carry;
 - `whoami` names the credential by its prefix, so you can match it against the one in your CI settings.
 
 ---

package/dist/index.mjs

@@ -883,7 +883,7 @@ async function buildJs(entryInput, options) {
 * that has to name this version — `--version`, the dependency a scaffolded
 * project pins — reads it here, so a release bumps one file.
 */
-const CLI_VERSION = "0.12.0";
+const CLI_VERSION = "0.14.0";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -1630,13 +1630,11 @@ async function detachDomain(creds, app, hostname) {
 	});
 	if (!res.ok) throw await asGatewayError(res, `'${hostname}' could not be detached (HTTP ${res.status}).`);
 }
-/** A missing name is refused here rather than sent, so the reason reads at the keyboard. */
-async function detachDomainCommand(hostname, options = {}) {
-	if (!hostname || !hostname.trim()) {
-		console.error("[wawesome] Error: Missing domain. Usage: wawesome domains detach <hostname>");
-		console.error("[wawesome] The domain is typed out because detaching one takes it dark.");
-		process.exit(1);
-	}
+/**
+* Who is asking and which App they are asking about. A deploy credential in the
+* environment is a caller here, so this never insists on a session.
+*/
+function credentialsAndApp(options) {
 	const creds = readCredentials();
 	if (!creds) {
 		console.error("[wawesome] Error: Not logged in. Run 'wawesome login' first.");
@@ -1648,6 +1646,19 @@ async function detachDomainCommand(hostname, options = {}) {
 		console.error("[wawesome] Run this from your project, or name the app with --app <slug>.");
 		process.exit(1);
 	}
+	return {
+		creds,
+		app
+	};
+}
+/** A missing name is refused here rather than sent, so the reason reads at the keyboard. */
+async function detachDomainCommand(hostname, options = {}) {
+	if (!hostname || !hostname.trim()) {
+		console.error("[wawesome] Error: Missing domain. Usage: wawesome domains detach <hostname>");
+		console.error("[wawesome] The domain is typed out because detaching one takes it dark.");
+		process.exit(1);
+	}
+	const { creds, app } = credentialsAndApp(options);
 	const name = hostname.trim();
 	console.log(`[wawesome] Detaching '${name}' from app '${app}':`);
 	console.log("[wawesome]   • the domain stops resolving here, so anything pointed at it stops");
@@ -1668,10 +1679,40 @@ async function detachDomainCommand(hostname, options = {}) {
 		console.log("[wawesome] or the next deploy attaches the domain again.");
 	}
 }
+/**
+* What this App answers at, read and printed.
+*
+* The one place a Tenant can ask. The records used to exist only in the output
+* of a deploy that changed something, so a deploy that outran the vendor left
+* nothing to run but a second deploy, which is refused for changing nothing
+* (#617). Open to a deploy credential carrying `deploy`, since a pipeline asks
+* this too.
+*/
+async function showDomainCommand(options = {}) {
+	const { creds, app } = credentialsAndApp(options);
+	let held;
+	try {
+		held = await listDomains(creds, app);
+	} catch (err) {
+		console.error(`[wawesome] Error: ${whatWentWrong(err)}`);
+		process.exit(1);
+	}
+	if (held.length === 0) {
+		console.log(`[wawesome] No domain is attached to app '${app}'.`);
+		console.log("[wawesome] Declare one in wawesome-function.json and deploy:");
+		console.log(`[wawesome]   \x1b[36m${DOMAIN_CONFIG_LINE}\x1b[0m`);
+		console.log("[wawesome] The deploy attaches it and prints the records to add.");
+		return;
+	}
+	console.log(`[wawesome] The domain on app '${app}':`);
+	for (const domain of held) for (const line of attachedDomainLines(domain, "domains")) console.log(line);
+}
 async function domainsCommand(action, target, options = {}) {
-	if ((action || "").toLowerCase().trim() === "detach") return detachDomainCommand(target, options);
+	const verb = (action || "").toLowerCase().trim();
+	if (verb === "detach") return detachDomainCommand(target, options);
+	if (!verb) return showDomainCommand(options);
 	console.error(`[wawesome] Error: Unknown command '${["domains", action].filter(Boolean).join(" ")}'.`);
-	console.error("[wawesome] Usage: wawesome domains detach <hostname>");
+	console.error("[wawesome] Usage: wawesome domains [detach <hostname>]");
 	console.error("[wawesome] A domain is attached by declaring it in wawesome-function.json.");
 	process.exit(1);
 }
@@ -1697,10 +1738,22 @@ function whereItGotTo(domain) {
 	if (domain.certificate_record_pending) return "not verified yet, and the TXT record is not ready";
 	return "not verified yet, so add the TXT record below";
 }
-function whatItIsFor(record) {
-	return record.purpose === "certificate" ? "Proves you own the name, and issues the certificate" : "Points traffic here, once the certificate is issued";
+/**
+* What a record is for, and when to add it.
+*
+* The order is stated rather than implied. The TXT proves control and issues
+* the certificate; the CNAME is pointed here afterwards, so a name already
+* serving a live site never answers on a certificate that is not there yet.
+* That is why the platform validates before the cutover, and a reader holding
+* the CNAME alone could read the old caption as a label rather than as an
+* instruction to wait (#617).
+*/
+function whatItIsFor(purpose) {
+	return purpose === "certificate" ? "Add this first. It proves you own the name and issues the certificate" : "Add this once the certificate is active. It points traffic here";
 }
 const VALUE_COLUMN = " ".repeat(14);
+/** What the dashboard's empty state shows. Kept the same by hand, not by anything. */
+const DOMAIN_CONFIG_LINE = "\"domain\": \"shop.client.com\"";
 /**
 * The block a deploy prints for the domain its configuration declares, in the
 * columns the visibility and URL lines above it already use.
@@ -1730,7 +1783,18 @@ function domainLines(outcome) {
 		...outcome.held ? [`${VALUE_COLUMN}Nothing was detached. Take '${outcome.held}' off first with`, `${VALUE_COLUMN}  \x1b[36mwawesome domains detach ${outcome.held}\x1b[0m`] : [],
 		`${VALUE_COLUMN}The deploy landed, and this App's other address still answers.`
 	];
-	const { hostname, records, state, last_checked_at, detaching, certificate_record_pending } = outcome.domain;
+	return attachedDomainLines(outcome.domain, "deploy");
+}
+/**
+* The block for a domain the App carries: where it got to, when the platform
+* last looked, and the records to add.
+*
+* The deploy and `wawesome domains` print this same block. One renderer rather
+* than two, because two of them drift, and a record going missing from one is
+* the whole of #610 and #617.
+*/
+function attachedDomainLines(domain, printedBy = "deploy") {
+	const { hostname, records, state, last_checked_at, detaching, certificate_record_pending } = domain;
 	if (detaching) return [
 		"",
 		`  Domain:     \x1b[33m${hostname}: being detached\x1b[0m`,
@@ -1738,20 +1802,36 @@ function domainLines(outcome) {
 		`${VALUE_COLUMN}Remove 'domain' from wawesome-function.json, or deploy again`,
 		`${VALUE_COLUMN}once it is gone to attach it afresh.`
 	];
-	const lines = ["", `  Domain:     \x1b[36m${hostname}\x1b[0m: ${whereItGotTo(outcome.domain)}`];
+	const lines = ["", `  Domain:     \x1b[36m${hostname}\x1b[0m: ${whereItGotTo(domain)}`];
+	if (last_checked_at) lines.push(`${VALUE_COLUMN}Last checked ${asUtc$1(last_checked_at)}.`);
 	if (state.serving) {
-		lines.push(`${VALUE_COLUMN}The address above answers too, so nothing pointed at it breaks.`);
+		lines.push(`${VALUE_COLUMN}This app's own address answers too, so nothing pointed at it breaks.`);
 		return lines;
 	}
-	if (last_checked_at) lines.push(`${VALUE_COLUMN}Last checked ${asUtc$1(last_checked_at)}.`);
 	const nameWidth = Math.max(...records.map((record) => record.name.length));
+	const row = (type, name, value = "") => `      ${type.padEnd(5)}  ${name.padEnd(nameWidth)}  ${value}`.trimEnd();
 	lines.push("", "  DNS records to add at your registrar:");
-	for (const record of records) lines.push("", `    ${whatItIsFor(record)}:`, `      ${record.type.padEnd(5)}  ${record.name.padEnd(nameWidth)}  ${record.value}`);
-	lines.push("");
-	if (certificate_record_pending) lines.push(`${VALUE_COLUMN}The TXT record that proves you own the name is not ready`, `${VALUE_COLUMN}yet. Deploy again in a minute and it prints here. The`, `${VALUE_COLUMN}deploy is finished either way.`);
-	else lines.push(`${VALUE_COLUMN}The deploy is finished. This domain comes up on its own`, `${VALUE_COLUMN}once the records resolve.`);
+	if (certificate_record_pending) lines.push("", `    ${whatItIsFor("certificate")}:`, row("TXT", "not ready yet"));
+	for (const record of records) lines.push("", `    ${whatItIsFor(record.purpose)}:`, row(record.type, record.name, record.value));
+	lines.push("", ...closingLines(certificate_record_pending, printedBy));
 	return lines;
 }
+/**
+* What is left to do, which is nothing.
+*
+* The pending case pointed at another deploy until #617: a deploy that changed
+* nothing is refused, so the one piece of advice the reader was given was the
+* one they could not take.
+*/
+function closingLines(certificateRecordPending, printedBy) {
+	if (!certificateRecordPending) return indented(`${printedBy === "deploy" ? "The deploy is finished. " : ""}This domain comes up on its own once the records resolve.`);
+	const asking = "The TXT record is not ready yet. The platform asks the certificate vendor again on its own.";
+	if (printedBy === "domains") return indented(`${asking} Run this again in a minute.`);
+	return [...indented(`${asking} The deploy is finished either way. To read the record when it lands, run`), `${VALUE_COLUMN}  \x1b[36mwawesome domains\x1b[0m`];
+}
+function indented(said) {
+	return wrapped(said).map((line) => `${VALUE_COLUMN}${line}`);
+}
 /** The platform's own prose, kept inside the block it is printed in. */
 function wrapped(said) {
 	const width = 64;
@@ -4589,6 +4669,7 @@ async function workspaceCommand(action, target, options) {
 //#endregion
 //#region src/deploy-credentials.ts
 const SECRET_SHOWN_ONCE = "Copy it now. This is the only time it will be shown. If you lose it, revoke this credential and mint another.";
+const REGENERATED_SECRET_SHOWN_ONCE = "Copy it now. This is the only time it will be shown. If you lose it, regenerate this credential again.";
 function requireCredentials$1() {
 	const creds = readCredentials();
 	if (!creds) {
@@ -4670,6 +4751,18 @@ async function fetchCredentials(creds) {
 	if (!res.ok) throw await refusal(res, `Failed to read the credentials (HTTP ${res.status}).`);
 	return (await res.json()).credentials ?? [];
 }
+async function regenerateCredential(creds, credentialId, payload) {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials/${encodeURIComponent(credentialId)}/regenerate`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${creds.tenant_jwt}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify(payload)
+	});
+	if (!res.ok) throw await refusal(res, `Failed to regenerate the credential (HTTP ${res.status}).`);
+	return await res.json();
+}
 async function revokeCredential(creds, credentialId) {
 	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials/${encodeURIComponent(credentialId)}/revoke`, {
 		method: "POST",
@@ -4678,6 +4771,13 @@ async function revokeCredential(creds, credentialId) {
 	if (!res.ok) throw await refusal(res, `Failed to revoke the credential (HTTP ${res.status}).`);
 	return await res.json();
 }
+async function deleteCredential(creds, credentialId) {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials/${encodeURIComponent(credentialId)}`, {
+		method: "DELETE",
+		headers: { Authorization: `Bearer ${creds.tenant_jwt}` }
+	});
+	if (!res.ok) throw await refusal(res, `Failed to delete the credential (HTTP ${res.status}).`);
+}
 /**
 * Mint one credential.
 *
@@ -4705,12 +4805,22 @@ async function mintCredentialCommand(name, options) {
 	} catch (err) {
 		fail(errorText(err));
 	}
-	console.error(`\n[wawesome] ✔ Minted deploy credential '${credential.name}'.\n`);
+	reveal(`Minted deploy credential '${credential.name}'.`, credential, SECRET_SHOWN_ONCE);
+}
+/**
+* Hand the secret over, once.
+*
+* The secret goes to stdout on a line of its own and everything a person reads
+* goes to stderr, so `wawesome credentials mint ci > secret` writes the secret
+* and not one character besides.
+*/
+function reveal(headline, credential, shownOnce) {
+	console.error(`\n[wawesome] ✔ ${headline}\n`);
 	console.error(`  Prefix:       ${credential.prefix}`);
 	console.error(`  Capabilities: ${credential.capabilities.join(", ")}`);
 	console.error(`  Apps:         ${namedApps(credential.apps) ?? "every App in the workspace"}`);
 	console.error(`  Expires:      ${asUtc(credential.expires_at)}`);
-	console.error(`\n  ${SECRET_SHOWN_ONCE}\n`);
+	console.error(`\n  ${shownOnce}\n`);
 	console.log(credential.secret);
 	console.error("");
 }
@@ -4796,9 +4906,8 @@ function matchCredentials(credentials, target) {
 	const wanted = typed.startsWith("wawe_") ? credentialPrefix(typed) : typed;
 	return credentials.filter((credential) => credential.prefix.startsWith(wanted));
 }
-async function revokeCredentialCommand(target, options) {
-	if (!target || !target.trim()) fail("No credential given. Usage: wawesome credentials revoke <name-or-prefix>");
-	const creds = requireCredentials$1();
+/** The one credential a typed name or prefix means, or an exit saying why none. */
+async function resolveCredential(creds, target, options) {
 	if (options.verbose) console.error(`[wawesome:verbose] GET ${creds.gateway_url}/v1/tenant/credentials`);
 	let credentials;
 	try {
@@ -4809,7 +4918,57 @@ async function revokeCredentialCommand(target, options) {
 	const matched = matchCredentials(credentials, target);
 	if (matched.length === 0) fail(`No deploy credential named or prefixed '${asShown(target)}' in this workspace.`, "Run 'wawesome credentials list' to see what this workspace has.");
 	if (matched.length > 1) fail(`'${asShown(target)}' names more than one credential:`, ...matched.map((credential) => `  ${credential.name} (${credential.prefix})`), "Name one of them, or give more of its prefix.");
-	const credential = matched[0];
+	return matched[0];
+}
+/**
+* Replace a credential's secret where it stands, keeping the name a pipeline's
+* settings already refer to.
+*
+* Confirmed like a revoke, because it is one for whatever holds the old secret:
+* the pipeline stops on its very next request until somebody gives it the new
+* one.
+*/
+async function regenerateCredentialCommand(target, options) {
+	if (!target || !target.trim()) fail("No credential given. Usage: wawesome credentials regenerate <name-or-prefix>");
+	const creds = requireCredentials$1();
+	const credential = await resolveCredential(creds, target, options);
+	if (credential.revoked_at) fail(`'${credential.name}' (${credential.prefix}) was revoked at ${asUtc(credential.revoked_at)}, and nothing un-revokes one.`, `Mint a replacement, or delete this one first to free its name for it.`);
+	const payload = {};
+	const expiry = parseExpiry(options.expires);
+	if (expiry !== void 0) payload.expiry = expiry;
+	if (!options.yes) {
+		if (!isInteractive()) fail(`Regenerating asks for confirmation, and there is nobody to ask.`, `Pass --yes to regenerate '${credential.name}' (${credential.prefix}) without being asked.`);
+		let confirmed;
+		try {
+			confirmed = await confirm({
+				message: `Regenerate '${credential.name}' (${credential.prefix})? Anything holding the old secret stops working at once and has to be given the new one.`,
+				default: false
+			});
+		} catch {
+			confirmed = false;
+		}
+		if (!confirmed) {
+			console.error(`[wawesome] Cancelled. '${credential.name}' still works.`);
+			return;
+		}
+	}
+	if (options.verbose) {
+		console.error(`[wawesome:verbose] POST ${creds.gateway_url}/v1/tenant/credentials/${credential.id}/regenerate`);
+		console.error(`[wawesome:verbose] Payload: ${JSON.stringify(payload)}`);
+	}
+	let regenerated;
+	try {
+		regenerated = await regenerateCredential(creds, credential.id, payload);
+	} catch (err) {
+		if (err instanceof GatewayError && err.status === 404) fail(`'${credential.name}' (${credential.prefix}) no longer exists in this workspace.`);
+		fail(errorText(err));
+	}
+	reveal(`Regenerated '${regenerated.name}'. Anything still presenting the old secret is refused from its very next request.`, regenerated, REGENERATED_SECRET_SHOWN_ONCE);
+}
+async function revokeCredentialCommand(target, options) {
+	if (!target || !target.trim()) fail("No credential given. Usage: wawesome credentials revoke <name-or-prefix>");
+	const creds = requireCredentials$1();
+	const credential = await resolveCredential(creds, target, options);
 	if (credential.revoked_at) {
 		console.log(`[wawesome] '${credential.name}' (${credential.prefix}) was already revoked at ${asUtc(credential.revoked_at)}. Nothing to do.`);
 		return;
@@ -4841,11 +5000,49 @@ async function revokeCredentialCommand(target, options) {
 	console.log(`\n[wawesome] ✔ Revoked '${revoked.name}' (${revoked.prefix}).`);
 	console.log("[wawesome] Anything still presenting it is refused from its very next request.\n");
 }
+async function deleteCredentialCommand(target, options) {
+	if (!target || !target.trim()) fail("No credential given. Usage: wawesome credentials delete <name-or-prefix>");
+	const creds = requireCredentials$1();
+	const credential = await resolveCredential(creds, target, options);
+	const named = `'${credential.name}' (${credential.prefix})`;
+	if (statusOf(credential, Date.now()) === "active") fail(`${named} still works, and only a credential that has stopped working is deleted.`, `Revoke it first: wawesome credentials revoke ${credential.name}`);
+	if (!options.yes) {
+		if (!isInteractive()) fail("Deleting asks for confirmation, and there is nobody to ask.", `Pass --yes to delete ${named} without being asked.`);
+		console.log(`\n[wawesome] Deleting ${named} forgets it.`);
+		console.log(`[wawesome]   It leaves the listing, and the name '${credential.name}' comes free.`);
+		console.log("[wawesome]   Anything still presenting its secret is told the secret is unknown, rather");
+		console.log("[wawesome]   than that somebody here revoked it.\n");
+		let confirmed;
+		try {
+			confirmed = await confirm({
+				message: `Delete ${named}?`,
+				default: false
+			});
+		} catch {
+			confirmed = false;
+		}
+		if (!confirmed) {
+			console.log(`[wawesome] Cancelled. ${named} is still listed.`);
+			return;
+		}
+	}
+	if (options.verbose) console.error(`[wawesome:verbose] DELETE ${creds.gateway_url}/v1/tenant/credentials/${credential.id}`);
+	try {
+		await deleteCredential(creds, credential.id);
+	} catch (err) {
+		if (err instanceof GatewayError && err.status === 404) fail(`${named} no longer exists in this workspace.`);
+		fail(errorText(err));
+	}
+	console.log(`\n[wawesome] ✔ Deleted ${named}. The name '${credential.name}' is free again.`);
+	console.log("[wawesome] Anything still presenting its secret is told the secret is unknown.\n");
+}
 async function credentialsCommand(action, target, options) {
 	if (!action || action === "list" || action === "ls") return listCredentialsCommand(options);
 	if (action === "mint") return mintCredentialCommand(target, options);
+	if (action === "regenerate") return regenerateCredentialCommand(target, options);
 	if (action === "revoke") return revokeCredentialCommand(target, options);
-	fail(`Unknown credentials action '${action}'.`, "Usage: wawesome credentials [list|mint <name>|revoke <name-or-prefix>]");
+	if (action === "delete") return deleteCredentialCommand(target, options);
+	fail(`Unknown credentials action '${action}'.`, "Usage: wawesome credentials [list|mint <name>|regenerate <name-or-prefix>|revoke <name-or-prefix>|delete <name-or-prefix>]");
 }
 //#endregion
 //#region src/cron.ts
@@ -5299,14 +5496,14 @@ cli.command("env [action] [key] [value]", "Manage environment variables (set, li
 cli.command("env set <key> <value>", "Set or overwrite an environment variable on the current app").option("-s, --secret", "Flag variable as secret (write-only)").option("-v, --verbose", "Enable verbose debug output").action((key, value, options) => setEnvVar(key, value, options));
 cli.command("env list", "List environment variables for the current app").alias("env ls").option("-v, --verbose", "Enable verbose debug output").action((options) => listEnvVars(options));
 cli.command("env rm <key>", "Delete an environment variable from the current app").alias("env remove").alias("env delete").alias("env unset").option("-v, --verbose", "Enable verbose debug output").action((key, options) => removeEnvVar(key, options));
-cli.command("domains [action] [hostname]", "Manage the custom domain on the current app (detach)").usage("domains <action> [hostname]\n\nActions:\n  detach <hostname>   Stop serving the app at a domain you attached\n\nA domain is attached by declaring it in wawesome-function.json and deploying.").example("wawesome domains detach shop.client.com").option("-a, --app <slug>", "App to act on (default: the app in wawesome-function.json)").action((action, hostname, options) => domainsCommand(action, hostname, options));
+cli.command("domains [action] [hostname]", "Show the custom domain on the current app, its state and its DNS records").usage("domains [action] [hostname]\n\nWith no action, prints the app's domain, where it got to, when the platform last checked, and the records to add.\n\nActions:\n  detach <hostname>   Stop serving the app at a domain you attached\n\nA domain is attached by declaring it in wawesome-function.json and deploying.").example("wawesome domains").example("wawesome domains detach shop.client.com").option("-a, --app <slug>", "App to act on (default: the app in wawesome-function.json)").action((action, hostname, options) => domainsCommand(action, hostname, options));
 cli.command("domains detach <hostname>", "Stop serving the current app at a domain you attached").option("-a, --app <slug>", "App to act on (default: the app in wawesome-function.json)").action((hostname, options) => detachDomainCommand(hostname, options));
 cli.command("login", "Authenticate with the wawesome.io platform").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("--gateway <url>", "Alias for --api <url>").option("--dashboard <url>", "Dashboard URL (default: https://dashboard.wawesome.io)").option("--provider <name>", "OAuth provider (default: github)").option("--workspace <name>", "Name for the workspace, when signing up without a terminal to prompt").option("--accept-terms", "Accept the terms of service and privacy policy, when signing up without a terminal to prompt").option("-v, --verbose", "Enable verbose debug output").action((options) => login(options));
 cli.command("logout", "Clear stored authentication credentials").action(() => logout());
 cli.command("whoami", "Show current login session info").action(() => whoami());
 cli.command("workspace [action] [name]", "Show the workspace, or rename its public address").usage("workspace <action> [name]\n\nActions:\n  show                Show the workspace name, address, and whether it can still change\n  rename <name>       Change the public address, while nothing live depends on it").example("wawesome workspace").example("wawesome workspace rename northwind").option("-v, --verbose", "Enable verbose debug output").action((action, name, options) => workspaceCommand(action, name, options));
 cli.command("templates [action]", "Browse the template catalog").usage("templates [action]\n\nActions:\n  list (ls)           Show every available template (default)").example("wawesome templates").example("wawesome templates list").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("-v, --verbose", "Enable verbose debug output").action((action, options) => templatesCommand(action, options));
-cli.command("credentials [action] [target]", "Mint, list and revoke deploy credentials").alias("credential").usage(`credentials <action> [options]
+cli.command("credentials [action] [target]", "Mint, list, regenerate, revoke and delete deploy credentials").alias("credential").usage(`credentials <action> [options]
 
   A deploy credential is what a CI pipeline or an agent authenticates with, where
   there is nobody at a keyboard to log in. Minting is the only time the secret is
@@ -5315,7 +5512,9 @@ cli.command("credentials [action] [target]", "Mint, list and revoke deploy crede
   Actions:
     list (ls)                       Show every credential: name, prefix, capabilities, Apps, last use, expiry (default)
     mint <name>                     Mint one, printing the secret exactly once
+    regenerate <name-or-prefix>     Replace one's secret, keeping its name, capabilities and Apps
     revoke <name-or-prefix>         Revoke one, immediately and for good
+    delete <name-or-prefix>         Forget a revoked or expired one, freeing its name
 
   Examples:
     wawesome credentials
@@ -5324,11 +5523,16 @@ cli.command("credentials [action] [target]", "Mint, list and revoke deploy crede
     wawesome credentials mint prod-deploy -c deploy -a prod --expires 30
     wawesome credentials mint ci -c deploy,domains:attach -a prod
     wawesome credentials mint ci-pipeline > /tmp/secret
+    wawesome credentials regenerate ci-pipeline
+    wawesome credentials regenerate ci --expires never --yes
     wawesome credentials revoke ci-pipeline
-    wawesome credentials revoke wawe_ab3k9x --yes`).option("-c, --capability <capability>", "Capability to grant: deploy, logs:read, domains:attach (repeatable or comma-separated, default: deploy)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated, default: every App)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-y, --yes", "Skip the revoke confirmation").option("-v, --verbose", "Enable verbose debug output").action((action, target, options) => credentialsCommand(action, target, options));
+    wawesome credentials revoke wawe_ab3k9x --yes
+    wawesome credentials delete ci-pipeline`).option("-c, --capability <capability>", "Capability to grant: deploy, logs:read, domains:attach (repeatable or comma-separated, default: deploy)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated, default: every App)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-y, --yes", "Skip the confirmation a regenerate, revoke or delete asks for").option("-v, --verbose", "Enable verbose debug output").action((action, target, options) => credentialsCommand(action, target, options));
 cli.command("credentials mint <name>", "Mint a deploy credential, printing its secret exactly once").option("-c, --capability <capability>", "Capability to grant: deploy, logs:read, domains:attach (repeatable or comma-separated)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-v, --verbose", "Enable verbose debug output").action((name, options) => mintCredentialCommand(name, options));
 cli.command("credentials list", "List deploy credentials, never their secrets").alias("credentials ls").option("-v, --verbose", "Enable verbose debug output").action((options) => listCredentialsCommand(options));
+cli.command("credentials regenerate <name-or-prefix>", "Replace a deploy credential's secret, keeping its name, capabilities and Apps").option("--expires <days|never>", "Days until the regenerated credential expires, or 'never' (default: 90)").option("-y, --yes", "Regenerate without being asked to confirm").option("-v, --verbose", "Enable verbose debug output").action((target, options) => regenerateCredentialCommand(target, options));
 cli.command("credentials revoke <name-or-prefix>", "Revoke a deploy credential, immediately and for good").option("-y, --yes", "Revoke without being asked to confirm").option("-v, --verbose", "Enable verbose debug output").action((target, options) => revokeCredentialCommand(target, options));
+cli.command("credentials delete <name-or-prefix>", "Delete a revoked or expired deploy credential, freeing its name").option("-y, --yes", "Delete without being asked to confirm").option("-v, --verbose", "Enable verbose debug output").action((target, options) => deleteCredentialCommand(target, options));
 cli.command("init", "Scaffold a new function project in the current directory").usage("init [options]\n\nWith --template, the project is fetched from the template catalog, wired up\nfrom what the template declares it needs, and deployed. Run 'wawesome templates'\nto see what is available.").example("wawesome init").example("wawesome init --template stripe-webhook").option("-t, --template <name>", "Scaffold from a catalog template and deploy it").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("--dashboard <url>", "Dashboard URL (default: https://dashboard.wawesome.io)").option("--no-install", "Skip installing dependencies after scaffolding").option("--root", "Generate a root function router template").option("-v, --verbose", "Enable verbose debug output").action((options) => init(options));
 cli.command("logs [function-name-or-invocation-id]", "View invocation history, fetch log output, or follow live").usage(`logs [target] [options]
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wawesome",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "CLI tool for building and deploying serverless functions on wawesome.io platform",
   "type": "module",
   "bin": {