wawesome 0.14.1 → 0.14.2

package/README.md

@@ -329,10 +329,14 @@ npx wawesome credentials mint ci -c deploy,domains:attach -a prod
 | `-a, --app`          | Restrict to these Apps, by slug. Repeatable. Default: every App in the workspace |
 | `--expires`          | Days, or `never`. Default: 90                                                   |
 
+`deploy` reaches the reads of what it writes, so a credential minted with it carries `read` as well:
+it lists the workspace, the Apps in it, the Functions in an App and their versions. The command
+prints the words the credential ended up with.
+
 An App named in a restriction does not have to exist yet. A pipeline whose first deploy creates the
-App it was minted for is the ordinary case. A restriction bounds what a credential can disturb, not
-what it can read. A Function deployed into one App still reads the whole workspace's environment at
-runtime.
+App it was minted for is the ordinary case. A restriction bounds what a credential reads as well as
+what it disturbs, and `deploy` is the hole in it: a Function deployed into an App the credential does
+reach still reads the whole workspace's environment at runtime.
 
 ### List them
 
@@ -468,7 +472,7 @@ concluding the platform cannot do it.
 |:---------------------------|:------------------------------------------------------------------------|:--------------|
 | `list_templates`           | The template catalogue, with what each one is for                       | nothing       |
 | `get_template`             | One template's files, environment contract and outbound providers        | nothing       |
-| `list_apps`                | The Apps in the workspace, with the slug each is addressed by            | `deploy`      |
+| `list_apps`                | The Apps the credential reaches, with the slug each is addressed by      | `read`        |
 | `list_functions`           | The Functions in one App, and what their live version carries            | `read`        |
 | `list_versions`            | A Function's Versions, and which one is live                             | `read`        |
 | `get_usage`                | The Tenant's usage and headroom                                          | `read`        |
@@ -501,18 +505,14 @@ is all the platform permits, and an agent taking it would end yours.
 A credential carries the words its job needs and stops there. They are the same words
 [Deploy credentials](#mint-one) mints with.
 
-**Read and investigate, without the ability to ship.** The agent reads Functions, Versions,
-Invocations and log bodies, diagnoses a failure, checks usage, and browses templates. Every tool that
-ships code or runs it refuses:
+**Read and investigate, without the ability to ship.** The agent enumerates your Apps, reads
+Functions, Versions, Invocations and log bodies, diagnoses a failure, checks usage, and browses
+templates. Every tool that ships code or runs it refuses:
 
 ```bash
 npx wawesome credentials mint investigator -c read,logs:read -a prod
 ```
 
-One thing to know before you hand it over: `list_apps` sits behind `deploy`, the same word the HTTP
-route behind it asks for, so an investigation credential cannot enumerate your Apps. Name the App in
-the task and every other read works.
-
 **Read, investigate and run.** The same, plus `invoke_function`, so the agent can exercise a Function
 and read what it did. It still cannot deploy, roll back, or set a variable:
 
@@ -532,9 +532,10 @@ closed to every credential, whatever it carries.
 
 Keep `-a` on all three. A credential restricted to one App is refused on every tool that names
 another, which is what stops an agent working on one client's project from touching another's.
-`get_invocation` and `read_invocation_logs` take an Invocation id rather than an App, and neither is
-held to the restriction yet, so an agent already holding an id can read that Invocation's telemetry
-and log body whichever App it belongs to.
+`get_invocation` and `read_invocation_logs` take an Invocation id rather than an App, and an id
+belonging to an App the credential cannot reach is answered as an id naming nothing. `list_apps`
+answers a set rather than one App, so it is narrowed instead of refused: the credential is listed the
+Apps it reaches and told nothing about the rest.
 
 ### When a tool refuses
 

package/dist/index.mjs

@@ -883,7 +883,7 @@ async function buildJs(entryInput, options) {
 * that has to name this version — `--version`, the dependency a scaffolded
 * project pins — reads it here, so a release bumps one file.
 */
-const CLI_VERSION = "0.14.1";
+const CLI_VERSION = "0.14.2";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -5527,8 +5527,8 @@ cli.command("credentials [action] [target]", "Mint, list, regenerate, revoke and
     wawesome credentials regenerate ci --expires never --yes
     wawesome credentials revoke ci-pipeline
     wawesome credentials revoke wawe_ab3k9x --yes
-    wawesome credentials delete ci-pipeline`).option("-c, --capability <capability>", "Capability to grant: deploy, read, logs:read, invoke, domains:attach (repeatable or comma-separated, default: deploy)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated, default: every App)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-y, --yes", "Skip the confirmation a regenerate, revoke or delete asks for").option("-v, --verbose", "Enable verbose debug output").action((action, target, options) => credentialsCommand(action, target, options));
-cli.command("credentials mint <name>", "Mint a deploy credential, printing its secret exactly once").option("-c, --capability <capability>", "Capability to grant: deploy, read, logs:read, invoke, domains:attach (repeatable or comma-separated)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-v, --verbose", "Enable verbose debug output").action((name, options) => mintCredentialCommand(name, options));
+    wawesome credentials delete ci-pipeline`).option("-c, --capability <capability>", "Capability to grant: deploy, read, logs:read, invoke, domains:attach (repeatable or comma-separated, default: deploy, which carries read)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated, default: every App)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-y, --yes", "Skip the confirmation a regenerate, revoke or delete asks for").option("-v, --verbose", "Enable verbose debug output").action((action, target, options) => credentialsCommand(action, target, options));
+cli.command("credentials mint <name>", "Mint a deploy credential, printing its secret exactly once").option("-c, --capability <capability>", "Capability to grant: deploy, read, logs:read, invoke, domains:attach (repeatable or comma-separated; deploy carries read)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-v, --verbose", "Enable verbose debug output").action((name, options) => mintCredentialCommand(name, options));
 cli.command("credentials list", "List deploy credentials, never their secrets").alias("credentials ls").option("-v, --verbose", "Enable verbose debug output").action((options) => listCredentialsCommand(options));
 cli.command("credentials regenerate <name-or-prefix>", "Replace a deploy credential's secret, keeping its name, capabilities and Apps").option("--expires <days|never>", "Days until the regenerated credential expires, or 'never' (default: 90)").option("-y, --yes", "Regenerate without being asked to confirm").option("-v, --verbose", "Enable verbose debug output").action((target, options) => regenerateCredentialCommand(target, options));
 cli.command("credentials revoke <name-or-prefix>", "Revoke a deploy credential, immediately and for good").option("-y, --yes", "Revoke without being asked to confirm").option("-v, --verbose", "Enable verbose debug output").action((target, options) => revokeCredentialCommand(target, options));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wawesome",
-  "version": "0.14.1",
+  "version": "0.14.2",
   "description": "CLI tool for building and deploying serverless functions on wawesome.io platform",
   "type": "module",
   "bin": {