wawesome 0.13.0 → 0.14.1

package/README.md

@@ -121,7 +121,9 @@ npx wawesome deploy
 | `npx wawesome domains detach <host>`    | Stop serving the app at a domain you attached                       |
 | `npx wawesome credentials`              | List deploy credentials: name, prefix, capabilities, Apps, last use |
 | `npx wawesome credentials mint <name>`  | Mint a deploy credential and print its secret, once                 |
+| `npx wawesome credentials regenerate <name>`| Replace a deploy credential's secret, keeping its name          |
 | `npx wawesome credentials revoke <name>`| Revoke a deploy credential by name or prefix                        |
+| `npx wawesome credentials delete <name>`| Delete a revoked or expired credential, freeing its name            |
 
 ---
 
@@ -292,9 +294,9 @@ keyboard to log in. It belongs to the workspace rather than to you: it keeps wor
 and revoking it does not end your own session. Once you have one, [Deploying from CI](#deploying-from-ci)
 is what to do with it.
 
-Minting, listing and revoking belong to the workspace owner. They are closed to deploy credentials
-themselves, whatever those carry, so a leaked credential cannot mint another. All three run on your
-ordinary `npx wawesome login` session.
+Minting, listing, regenerating, revoking and deleting belong to the workspace owner. They are closed
+to deploy credentials themselves, whatever those carry, so a leaked credential cannot mint another or
+renew its own expiry. All five run on your ordinary `npx wawesome login` session.
 
 ### Mint one
 
@@ -314,8 +316,8 @@ A credential carries `deploy`, reaches every App in the workspace, and expires i
 you say otherwise:
 
 ```bash
-# reads logs and cannot deploy, restricted to one App, never expires
-npx wawesome credentials mint agent -c logs:read -a prod --expires never
+# reads and runs what somebody else shipped, restricted to one App, never expires
+npx wawesome credentials mint agent -c read,logs:read,invoke -a prod --expires never
 
 # ships code and attaches the domain the project declares
 npx wawesome credentials mint ci -c deploy,domains:attach -a prod
@@ -323,7 +325,7 @@ npx wawesome credentials mint ci -c deploy,domains:attach -a prod
 
 | Flag                 | Meaning                                                                       |
 |:---------------------|:------------------------------------------------------------------------------|
-| `-c, --capability`   | `deploy`, `logs:read`, `domains:attach`, or any mix. Repeatable or comma-separated. Default `deploy` |
+| `-c, --capability`   | `deploy`, `read`, `logs:read`, `invoke`, `domains:attach`, or any mix. Repeatable or comma-separated. Default `deploy` |
 | `-a, --app`          | Restrict to these Apps, by slug. Repeatable. Default: every App in the workspace |
 | `--expires`          | Days, or `never`. Default: 90                                                   |
 
@@ -342,6 +344,27 @@ Name, displayable prefix, capabilities, Apps, last use and expiry. Never the sec
 platform no longer holds. `LAST USED` lags by a few minutes and reads `never` for a credential
 nothing has ever presented, which is a better reason to revoke one than any calendar date.
 
+### Rotate one
+
+```bash
+npx wawesome credentials regenerate ci-pipeline
+npx wawesome credentials regenerate ci --expires never --yes
+npx wawesome credentials regenerate ci-pipeline > secret.txt
+```
+
+Regenerating replaces the secret where it stands. The credential keeps its id, its name, its
+capabilities and the Apps it may reach, so the only thing to change in your CI settings is the secret
+itself. Its displayable prefix changes with it, since the prefix is what you match one against. The
+new secret is printed once, on stdout alone, exactly as at minting.
+
+It asks first, because anything holding the old secret stops working the moment this lands and has to
+be given the new one; `--yes` is the answer where nobody is at the keyboard. Without `--expires` the
+new secret lives ninety days, the same rule minting follows, including on a credential that never
+expired.
+
+An expired credential regenerates into a working one — that is the ordinary reason to reach for this.
+A revoked one is refused, because nothing un-revokes a credential.
+
 ### Revoke one
 
 ```bash
@@ -354,6 +377,178 @@ where nobody is at the keyboard, and a prefix naming more than one credential is
 guessed at. A revocation lands on the very next request presenting the secret, and nothing un-revokes
 it.
 
+### Delete one
+
+```bash
+npx wawesome credentials delete ci-pipeline
+npx wawesome credentials delete wawe_ab3k9x --yes
+```
+
+Deleting is a second act, not a shortcut through revoking, so only a credential that has already
+stopped working can be deleted. Revoke a live one first. It resolves its target the way revoking
+does, by name or by displayable prefix, and asks before it does it unless you pass `--yes`.
+
+What deleting gives up is the reason revoking left the record behind. The credential leaves the
+listing, the name comes free to mint again, and a pipeline still presenting the secret is told the
+secret is unknown rather than that somebody revoked it. Whoever is debugging that pipeline goes
+looking in their CI settings instead of your dashboard.
+
+---
+
+## Your agent, over MCP
+
+The same deploy credential connects a coding agent to your workspace, over MCP. Nothing to install and
+no local process to keep running: it is an endpoint on the gateway, `https://api.wawesome.io/v1/mcp`,
+and the credential is the whole of the authentication.
+
+### Install it
+
+In Claude Code, one command:
+
+```bash
+claude mcp add --transport http wawesome https://api.wawesome.io/v1/mcp \
+  --header "Authorization: Bearer wawe_..."
+```
+
+In Cursor, `.cursor/mcp.json` in the project, or `~/.cursor/mcp.json` for every project:
+
+```json
+{
+  "mcpServers": {
+    "wawesome": {
+      "url": "https://api.wawesome.io/v1/mcp",
+      "headers": { "Authorization": "Bearer wawe_..." }
+    }
+  }
+}
+```
+
+In VS Code, `.vscode/mcp.json` in the workspace, or the file **MCP: Open User Configuration** opens.
+The shape is the same address and header map, under the key `servers` rather than `mcpServers`:
+
+```json
+{
+  "servers": {
+    "wawesome": {
+      "type": "http",
+      "url": "https://api.wawesome.io/v1/mcp",
+      "headers": { "Authorization": "Bearer wawe_..." }
+    }
+  }
+}
+```
+
+A file inside the project is a file your repository carries, and the secret with it. VS Code takes an
+`inputs` entry and a `${input:...}` placeholder in the header, so it asks once and holds the value
+itself. In Cursor, put the credential in `~/.cursor/mcp.json`, which is outside every repository.
+
+### Where a bearer credential reaches
+
+It works in Claude Code, the Claude Agent SDK, Cursor, VS Code, Windsurf, Zed and the Gemini CLI. It
+works in every agent framework that takes a URL and a header map, among them the OpenAI Agents SDK,
+LangChain, the Vercel AI SDK and Pydantic AI. Anything that speaks streamable HTTP MCP and lets you
+set a header can connect.
+
+Whichever protocol revision your client speaks, the endpoint answers it. It holds both eras at one
+address: the current revision, `2026-07-28`, and the three handshake-based ones the installed base is
+still on. A client ahead of your editor's next release connects, and so does one behind it.
+
+It does **not** work in the connector dialog in claude.ai or Claude Desktop, or in ChatGPT
+connectors. Those three accept "no authentication" or OAuth and have no field for a token, so there
+is nowhere to put `wawe_...`. Reaching them needs an OAuth authorization server, which the platform
+does not run today, and nothing you can configure works around that.
+
+### What your agent gets
+
+Every tool is listed for every credential, and each one names the capability it needs. A credential
+that does not carry that word is refused by name, so your agent tells you what to mint rather than
+concluding the platform cannot do it.
+
+| Tool                       | What it does                                                            | Needs         |
+|:---------------------------|:------------------------------------------------------------------------|:--------------|
+| `list_templates`           | The template catalogue, with what each one is for                       | nothing       |
+| `get_template`             | One template's files, environment contract and outbound providers        | nothing       |
+| `list_apps`                | The Apps in the workspace, with the slug each is addressed by            | `deploy`      |
+| `list_functions`           | The Functions in one App, and what their live version carries            | `read`        |
+| `list_versions`            | A Function's Versions, and which one is live                             | `read`        |
+| `get_usage`                | The Tenant's usage and headroom                                          | `read`        |
+| `list_invocations`         | Recent Invocations of a Function, failures included                      | `logs:read`   |
+| `get_invocation`           | One Invocation by id                                                     | `logs:read`   |
+| `read_invocation_logs`     | An Invocation's log body, a page at a time                               | `logs:read`   |
+| `diagnose_latest_failure`  | The latest failure, its logs and the Version that ran it, in one call    | `logs:read`, `read` |
+| `deploy_function`          | Deploys code and the static files it carries                             | `deploy`      |
+| `deploy_status`            | How a deploy went, by the handle it answered with                        | `deploy`      |
+| `rollback_function`        | Puts a Version the Function already has back on its public address       | `deploy`      |
+| `set_env_var`              | Sets an App's environment variable, read at the next invocation          | `deploy`      |
+| `invoke_function`          | Runs a deployed Function once and answers with the Invocation id         | `invoke`      |
+
+A deploy is two calls. The first says which of your files the platform does not already hold, by
+content hash; your agent uploads those bytes to `PUT /v1/assets/{content_hash}` with the same
+credential and asks again, so a redeploy that changed only its code uploads nothing. The second
+answers with a handle rather than waiting for the build, because a dropped connection would otherwise
+cancel a deploy that was going fine. `deploy_status` reads the handle whenever your agent asks.
+
+When the deploy is out and something is wrong, `diagnose_latest_failure` answers the latest failed
+run of a Function, that run's log output, and the version that ran it, in one call. Mirroring the
+routes there costs four round trips and four chances to carry the wrong identifier between them.
+
+Log output comes back a page at a time, with a cursor for the next one, and nothing is held open.
+Your own `wawesome logs --follow` keeps running while your agent reads. One live tail per credential
+is all the platform permits, and an agent taking it would end yours.
+
+### Which credential for which job
+
+A credential carries the words its job needs and stops there. They are the same words
+[Deploy credentials](#mint-one) mints with.
+
+**Read and investigate, without the ability to ship.** The agent reads Functions, Versions,
+Invocations and log bodies, diagnoses a failure, checks usage, and browses templates. Every tool that
+ships code or runs it refuses:
+
+```bash
+npx wawesome credentials mint investigator -c read,logs:read -a prod
+```
+
+One thing to know before you hand it over: `list_apps` sits behind `deploy`, the same word the HTTP
+route behind it asks for, so an investigation credential cannot enumerate your Apps. Name the App in
+the task and every other read works.
+
+**Read, investigate and run.** The same, plus `invoke_function`, so the agent can exercise a Function
+and read what it did. It still cannot deploy, roll back, or set a variable:
+
+```bash
+npx wawesome credentials mint runner -c read,logs:read,invoke -a prod
+```
+
+**The whole loop.** Deploy, run, diagnose, roll back, set a key. Every tool in the table:
+
+```bash
+npx wawesome credentials mint agent -c deploy,read,logs:read,invoke -a prod
+```
+
+Add `domains:attach` where the project declares a custom domain the deploy should claim. Nothing
+gives an agent billing, plan changes, credential management or your workspace's slug: those are
+closed to every credential, whatever it carries.
+
+Keep `-a` on all three. A credential restricted to one App is refused on every tool that names
+another, which is what stops an agent working on one client's project from touching another's.
+`get_invocation` and `read_invocation_logs` take an Invocation id rather than an App, and neither is
+held to the restriction yet, so an agent already holding an id can read that Invocation's telemetry
+and log body whichever App it belongs to.
+
+### When a tool refuses
+
+A refusal is the tool's answer, not a protocol error, and it carries the same `reason` code the CLI
+prints:
+
+- `credential-missing-capability`. The credential does not carry a word this tool needs. The refusal
+  names it in `missing_capability`, which is the word to mint a credential with.
+- `app-outside-credential-scope`. The credential is restricted to named Apps and this is not one of
+  them. A wider capability changes nothing here.
+
+A quota refusal carries its numbers under `allowance` beside the prose, so your agent reports
+"3 of 3 App slots" rather than handing you a sentence to read.
+
 ---
 
 ## Configuration and a custom gateway
@@ -666,8 +861,8 @@ While it is set:
 - a refusal names which of four things happened: the credential is unknown, revoked, expired, or does not carry what
   the command needs. It does not ask you to sign in again, which a pipeline cannot do;
 - `login` and `logout` refuse, because neither would change what the next command authenticates as;
-- `credentials` is refused by the platform, because minting, listing and revoking are closed to
-  credentials whatever they carry;
+- `credentials` is refused by the platform, because minting, listing, regenerating, revoking and
+  deleting are closed to credentials whatever they carry;
 - `whoami` names the credential by its prefix, so you can match it against the one in your CI settings.
 
 ---

package/dist/index.mjs

@@ -883,7 +883,7 @@ async function buildJs(entryInput, options) {
 * that has to name this version — `--version`, the dependency a scaffolded
 * project pins — reads it here, so a release bumps one file.
 */
-const CLI_VERSION = "0.13.0";
+const CLI_VERSION = "0.14.1";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -4669,6 +4669,7 @@ async function workspaceCommand(action, target, options) {
 //#endregion
 //#region src/deploy-credentials.ts
 const SECRET_SHOWN_ONCE = "Copy it now. This is the only time it will be shown. If you lose it, revoke this credential and mint another.";
+const REGENERATED_SECRET_SHOWN_ONCE = "Copy it now. This is the only time it will be shown. If you lose it, regenerate this credential again.";
 function requireCredentials$1() {
 	const creds = readCredentials();
 	if (!creds) {
@@ -4750,6 +4751,18 @@ async function fetchCredentials(creds) {
 	if (!res.ok) throw await refusal(res, `Failed to read the credentials (HTTP ${res.status}).`);
 	return (await res.json()).credentials ?? [];
 }
+async function regenerateCredential(creds, credentialId, payload) {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials/${encodeURIComponent(credentialId)}/regenerate`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${creds.tenant_jwt}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify(payload)
+	});
+	if (!res.ok) throw await refusal(res, `Failed to regenerate the credential (HTTP ${res.status}).`);
+	return await res.json();
+}
 async function revokeCredential(creds, credentialId) {
 	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials/${encodeURIComponent(credentialId)}/revoke`, {
 		method: "POST",
@@ -4758,6 +4771,13 @@ async function revokeCredential(creds, credentialId) {
 	if (!res.ok) throw await refusal(res, `Failed to revoke the credential (HTTP ${res.status}).`);
 	return await res.json();
 }
+async function deleteCredential(creds, credentialId) {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials/${encodeURIComponent(credentialId)}`, {
+		method: "DELETE",
+		headers: { Authorization: `Bearer ${creds.tenant_jwt}` }
+	});
+	if (!res.ok) throw await refusal(res, `Failed to delete the credential (HTTP ${res.status}).`);
+}
 /**
 * Mint one credential.
 *
@@ -4785,12 +4805,22 @@ async function mintCredentialCommand(name, options) {
 	} catch (err) {
 		fail(errorText(err));
 	}
-	console.error(`\n[wawesome] ✔ Minted deploy credential '${credential.name}'.\n`);
+	reveal(`Minted deploy credential '${credential.name}'.`, credential, SECRET_SHOWN_ONCE);
+}
+/**
+* Hand the secret over, once.
+*
+* The secret goes to stdout on a line of its own and everything a person reads
+* goes to stderr, so `wawesome credentials mint ci > secret` writes the secret
+* and not one character besides.
+*/
+function reveal(headline, credential, shownOnce) {
+	console.error(`\n[wawesome] ✔ ${headline}\n`);
 	console.error(`  Prefix:       ${credential.prefix}`);
 	console.error(`  Capabilities: ${credential.capabilities.join(", ")}`);
 	console.error(`  Apps:         ${namedApps(credential.apps) ?? "every App in the workspace"}`);
 	console.error(`  Expires:      ${asUtc(credential.expires_at)}`);
-	console.error(`\n  ${SECRET_SHOWN_ONCE}\n`);
+	console.error(`\n  ${shownOnce}\n`);
 	console.log(credential.secret);
 	console.error("");
 }
@@ -4876,9 +4906,8 @@ function matchCredentials(credentials, target) {
 	const wanted = typed.startsWith("wawe_") ? credentialPrefix(typed) : typed;
 	return credentials.filter((credential) => credential.prefix.startsWith(wanted));
 }
-async function revokeCredentialCommand(target, options) {
-	if (!target || !target.trim()) fail("No credential given. Usage: wawesome credentials revoke <name-or-prefix>");
-	const creds = requireCredentials$1();
+/** The one credential a typed name or prefix means, or an exit saying why none. */
+async function resolveCredential(creds, target, options) {
 	if (options.verbose) console.error(`[wawesome:verbose] GET ${creds.gateway_url}/v1/tenant/credentials`);
 	let credentials;
 	try {
@@ -4889,7 +4918,57 @@ async function revokeCredentialCommand(target, options) {
 	const matched = matchCredentials(credentials, target);
 	if (matched.length === 0) fail(`No deploy credential named or prefixed '${asShown(target)}' in this workspace.`, "Run 'wawesome credentials list' to see what this workspace has.");
 	if (matched.length > 1) fail(`'${asShown(target)}' names more than one credential:`, ...matched.map((credential) => `  ${credential.name} (${credential.prefix})`), "Name one of them, or give more of its prefix.");
-	const credential = matched[0];
+	return matched[0];
+}
+/**
+* Replace a credential's secret where it stands, keeping the name a pipeline's
+* settings already refer to.
+*
+* Confirmed like a revoke, because it is one for whatever holds the old secret:
+* the pipeline stops on its very next request until somebody gives it the new
+* one.
+*/
+async function regenerateCredentialCommand(target, options) {
+	if (!target || !target.trim()) fail("No credential given. Usage: wawesome credentials regenerate <name-or-prefix>");
+	const creds = requireCredentials$1();
+	const credential = await resolveCredential(creds, target, options);
+	if (credential.revoked_at) fail(`'${credential.name}' (${credential.prefix}) was revoked at ${asUtc(credential.revoked_at)}, and nothing un-revokes one.`, `Mint a replacement, or delete this one first to free its name for it.`);
+	const payload = {};
+	const expiry = parseExpiry(options.expires);
+	if (expiry !== void 0) payload.expiry = expiry;
+	if (!options.yes) {
+		if (!isInteractive()) fail(`Regenerating asks for confirmation, and there is nobody to ask.`, `Pass --yes to regenerate '${credential.name}' (${credential.prefix}) without being asked.`);
+		let confirmed;
+		try {
+			confirmed = await confirm({
+				message: `Regenerate '${credential.name}' (${credential.prefix})? Anything holding the old secret stops working at once and has to be given the new one.`,
+				default: false
+			});
+		} catch {
+			confirmed = false;
+		}
+		if (!confirmed) {
+			console.error(`[wawesome] Cancelled. '${credential.name}' still works.`);
+			return;
+		}
+	}
+	if (options.verbose) {
+		console.error(`[wawesome:verbose] POST ${creds.gateway_url}/v1/tenant/credentials/${credential.id}/regenerate`);
+		console.error(`[wawesome:verbose] Payload: ${JSON.stringify(payload)}`);
+	}
+	let regenerated;
+	try {
+		regenerated = await regenerateCredential(creds, credential.id, payload);
+	} catch (err) {
+		if (err instanceof GatewayError && err.status === 404) fail(`'${credential.name}' (${credential.prefix}) no longer exists in this workspace.`);
+		fail(errorText(err));
+	}
+	reveal(`Regenerated '${regenerated.name}'. Anything still presenting the old secret is refused from its very next request.`, regenerated, REGENERATED_SECRET_SHOWN_ONCE);
+}
+async function revokeCredentialCommand(target, options) {
+	if (!target || !target.trim()) fail("No credential given. Usage: wawesome credentials revoke <name-or-prefix>");
+	const creds = requireCredentials$1();
+	const credential = await resolveCredential(creds, target, options);
 	if (credential.revoked_at) {
 		console.log(`[wawesome] '${credential.name}' (${credential.prefix}) was already revoked at ${asUtc(credential.revoked_at)}. Nothing to do.`);
 		return;
@@ -4921,11 +5000,49 @@ async function revokeCredentialCommand(target, options) {
 	console.log(`\n[wawesome] ✔ Revoked '${revoked.name}' (${revoked.prefix}).`);
 	console.log("[wawesome] Anything still presenting it is refused from its very next request.\n");
 }
+async function deleteCredentialCommand(target, options) {
+	if (!target || !target.trim()) fail("No credential given. Usage: wawesome credentials delete <name-or-prefix>");
+	const creds = requireCredentials$1();
+	const credential = await resolveCredential(creds, target, options);
+	const named = `'${credential.name}' (${credential.prefix})`;
+	if (statusOf(credential, Date.now()) === "active") fail(`${named} still works, and only a credential that has stopped working is deleted.`, `Revoke it first: wawesome credentials revoke ${credential.name}`);
+	if (!options.yes) {
+		if (!isInteractive()) fail("Deleting asks for confirmation, and there is nobody to ask.", `Pass --yes to delete ${named} without being asked.`);
+		console.log(`\n[wawesome] Deleting ${named} forgets it.`);
+		console.log(`[wawesome]   It leaves the listing, and the name '${credential.name}' comes free.`);
+		console.log("[wawesome]   Anything still presenting its secret is told the secret is unknown, rather");
+		console.log("[wawesome]   than that somebody here revoked it.\n");
+		let confirmed;
+		try {
+			confirmed = await confirm({
+				message: `Delete ${named}?`,
+				default: false
+			});
+		} catch {
+			confirmed = false;
+		}
+		if (!confirmed) {
+			console.log(`[wawesome] Cancelled. ${named} is still listed.`);
+			return;
+		}
+	}
+	if (options.verbose) console.error(`[wawesome:verbose] DELETE ${creds.gateway_url}/v1/tenant/credentials/${credential.id}`);
+	try {
+		await deleteCredential(creds, credential.id);
+	} catch (err) {
+		if (err instanceof GatewayError && err.status === 404) fail(`${named} no longer exists in this workspace.`);
+		fail(errorText(err));
+	}
+	console.log(`\n[wawesome] ✔ Deleted ${named}. The name '${credential.name}' is free again.`);
+	console.log("[wawesome] Anything still presenting its secret is told the secret is unknown.\n");
+}
 async function credentialsCommand(action, target, options) {
 	if (!action || action === "list" || action === "ls") return listCredentialsCommand(options);
 	if (action === "mint") return mintCredentialCommand(target, options);
+	if (action === "regenerate") return regenerateCredentialCommand(target, options);
 	if (action === "revoke") return revokeCredentialCommand(target, options);
-	fail(`Unknown credentials action '${action}'.`, "Usage: wawesome credentials [list|mint <name>|revoke <name-or-prefix>]");
+	if (action === "delete") return deleteCredentialCommand(target, options);
+	fail(`Unknown credentials action '${action}'.`, "Usage: wawesome credentials [list|mint <name>|regenerate <name-or-prefix>|revoke <name-or-prefix>|delete <name-or-prefix>]");
 }
 //#endregion
 //#region src/cron.ts
@@ -5386,7 +5503,7 @@ cli.command("logout", "Clear stored authentication credentials").action(() => lo
 cli.command("whoami", "Show current login session info").action(() => whoami());
 cli.command("workspace [action] [name]", "Show the workspace, or rename its public address").usage("workspace <action> [name]\n\nActions:\n  show                Show the workspace name, address, and whether it can still change\n  rename <name>       Change the public address, while nothing live depends on it").example("wawesome workspace").example("wawesome workspace rename northwind").option("-v, --verbose", "Enable verbose debug output").action((action, name, options) => workspaceCommand(action, name, options));
 cli.command("templates [action]", "Browse the template catalog").usage("templates [action]\n\nActions:\n  list (ls)           Show every available template (default)").example("wawesome templates").example("wawesome templates list").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("-v, --verbose", "Enable verbose debug output").action((action, options) => templatesCommand(action, options));
-cli.command("credentials [action] [target]", "Mint, list and revoke deploy credentials").alias("credential").usage(`credentials <action> [options]
+cli.command("credentials [action] [target]", "Mint, list, regenerate, revoke and delete deploy credentials").alias("credential").usage(`credentials <action> [options]
 
   A deploy credential is what a CI pipeline or an agent authenticates with, where
   there is nobody at a keyboard to log in. Minting is the only time the secret is
@@ -5395,20 +5512,27 @@ cli.command("credentials [action] [target]", "Mint, list and revoke deploy crede
   Actions:
     list (ls)                       Show every credential: name, prefix, capabilities, Apps, last use, expiry (default)
     mint <name>                     Mint one, printing the secret exactly once
+    regenerate <name-or-prefix>     Replace one's secret, keeping its name, capabilities and Apps
     revoke <name-or-prefix>         Revoke one, immediately and for good
+    delete <name-or-prefix>         Forget a revoked or expired one, freeing its name
 
   Examples:
     wawesome credentials
     wawesome credentials mint ci-pipeline
-    wawesome credentials mint agent -c logs:read --expires never
+    wawesome credentials mint agent -c read,logs:read,invoke --expires never
     wawesome credentials mint prod-deploy -c deploy -a prod --expires 30
     wawesome credentials mint ci -c deploy,domains:attach -a prod
     wawesome credentials mint ci-pipeline > /tmp/secret
+    wawesome credentials regenerate ci-pipeline
+    wawesome credentials regenerate ci --expires never --yes
     wawesome credentials revoke ci-pipeline
-    wawesome credentials revoke wawe_ab3k9x --yes`).option("-c, --capability <capability>", "Capability to grant: deploy, logs:read, domains:attach (repeatable or comma-separated, default: deploy)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated, default: every App)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-y, --yes", "Skip the revoke confirmation").option("-v, --verbose", "Enable verbose debug output").action((action, target, options) => credentialsCommand(action, target, options));
-cli.command("credentials mint <name>", "Mint a deploy credential, printing its secret exactly once").option("-c, --capability <capability>", "Capability to grant: deploy, logs:read, domains:attach (repeatable or comma-separated)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-v, --verbose", "Enable verbose debug output").action((name, options) => mintCredentialCommand(name, options));
+    wawesome credentials revoke wawe_ab3k9x --yes
+    wawesome credentials delete ci-pipeline`).option("-c, --capability <capability>", "Capability to grant: deploy, read, logs:read, invoke, domains:attach (repeatable or comma-separated, default: deploy)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated, default: every App)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-y, --yes", "Skip the confirmation a regenerate, revoke or delete asks for").option("-v, --verbose", "Enable verbose debug output").action((action, target, options) => credentialsCommand(action, target, options));
+cli.command("credentials mint <name>", "Mint a deploy credential, printing its secret exactly once").option("-c, --capability <capability>", "Capability to grant: deploy, read, logs:read, invoke, domains:attach (repeatable or comma-separated)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-v, --verbose", "Enable verbose debug output").action((name, options) => mintCredentialCommand(name, options));
 cli.command("credentials list", "List deploy credentials, never their secrets").alias("credentials ls").option("-v, --verbose", "Enable verbose debug output").action((options) => listCredentialsCommand(options));
+cli.command("credentials regenerate <name-or-prefix>", "Replace a deploy credential's secret, keeping its name, capabilities and Apps").option("--expires <days|never>", "Days until the regenerated credential expires, or 'never' (default: 90)").option("-y, --yes", "Regenerate without being asked to confirm").option("-v, --verbose", "Enable verbose debug output").action((target, options) => regenerateCredentialCommand(target, options));
 cli.command("credentials revoke <name-or-prefix>", "Revoke a deploy credential, immediately and for good").option("-y, --yes", "Revoke without being asked to confirm").option("-v, --verbose", "Enable verbose debug output").action((target, options) => revokeCredentialCommand(target, options));
+cli.command("credentials delete <name-or-prefix>", "Delete a revoked or expired deploy credential, freeing its name").option("-y, --yes", "Delete without being asked to confirm").option("-v, --verbose", "Enable verbose debug output").action((target, options) => deleteCredentialCommand(target, options));
 cli.command("init", "Scaffold a new function project in the current directory").usage("init [options]\n\nWith --template, the project is fetched from the template catalog, wired up\nfrom what the template declares it needs, and deployed. Run 'wawesome templates'\nto see what is available.").example("wawesome init").example("wawesome init --template stripe-webhook").option("-t, --template <name>", "Scaffold from a catalog template and deploy it").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("--dashboard <url>", "Dashboard URL (default: https://dashboard.wawesome.io)").option("--no-install", "Skip installing dependencies after scaffolding").option("--root", "Generate a root function router template").option("-v, --verbose", "Enable verbose debug output").action((options) => init(options));
 cli.command("logs [function-name-or-invocation-id]", "View invocation history, fetch log output, or follow live").usage(`logs [target] [options]
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wawesome",
-  "version": "0.13.0",
+  "version": "0.14.1",
   "description": "CLI tool for building and deploying serverless functions on wawesome.io platform",
   "type": "module",
   "bin": {