wawesome 0.14.2 → 0.15.0

package/dist/index.mjs

@@ -802,17 +802,40 @@ function withBinDirectories(projectDir, existing) {
 }
 //#endregion
 //#region src/build.ts
+const DEFAULT_ENTRY = "src/index.ts";
+/**
+* Read after the project's own build has run: for a **Produced entry point**,
+* that run is what puts the file there.
+*/
+function hasHandler(entryInput, config) {
+	return Boolean(entryInput || config?.entry) || fs.existsSync("src/index.ts");
+}
 /**
 * Bundles user TS/JS entry point into a single optimized ESM JavaScript file using esbuild.
 */
 async function buildJs(entryInput, options) {
+	const built = await buildHandler(entryInput, readFunctionConfig(), options);
+	if (built === null) {
+		console.error(`[wawesome] Error: Entry file '${DEFAULT_ENTRY}' not found.`);
+		process.exit(1);
+	}
+	return built;
+}
+/**
+* The bundle this project's handler is built from, or `null` where it declares
+* none at all — nothing named an entry and the default file is not there, which
+* is how a project with only **Document**s says so (ADR-0032). A *declared*
+* entry that is missing is the hard error it always was.
+*/
+async function buildHandler(entryInput, config, options) {
 	const startTime = Date.now();
-	const config = readFunctionConfig();
-	const entry = entryInput || config?.entry || "src/index.ts";
+	const declaredEntry = entryInput || config?.entry;
+	const entry = declaredEntry || "src/index.ts";
 	const outPath = path.resolve(options.out);
 	const isVerbose = Boolean(options.verbose);
 	if (config?.build) runProjectBuild(config.build, process.cwd(), isVerbose);
 	if (!fs.existsSync(entry)) {
+		if (!declaredEntry) return null;
 		console.error(`[wawesome] Error: Entry file '${entry}' not found.`);
 		process.exit(1);
 	}
@@ -883,7 +906,7 @@ async function buildJs(entryInput, options) {
 * that has to name this version — `--version`, the dependency a scaffolded
 * project pins — reads it here, so a release bumps one file.
 */
-const CLI_VERSION = "0.14.2";
+const CLI_VERSION = "0.15.0";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -1504,6 +1527,25 @@ function planLimitAdvice(reason) {
 	return `Where to resolve it: ${billingPageUrl()}`;
 }
 //#endregion
+//#region src/report.ts
+/** Where a value sits in the deploy's summary block, so every line under one label agrees. */
+const VALUE_COLUMN = " ".repeat(14);
+/** The platform's own prose, kept inside the block it is printed in. */
+function wrapped(said) {
+	const width = 64;
+	const lines = [];
+	let line = "";
+	for (const word of said.split(/\s+/).filter(Boolean)) if (line && `${line} ${word}`.length > width) {
+		lines.push(line);
+		line = word;
+	} else line = line ? `${line} ${word}` : word;
+	if (line) lines.push(line);
+	return lines;
+}
+function indented(said) {
+	return wrapped(said).map((line) => `${VALUE_COLUMN}${line}`);
+}
+//#endregion
 //#region src/domains.ts
 /**
 * The domain this project declares, refused here rather than at the gateway so
@@ -1685,7 +1727,7 @@ async function detachDomainCommand(hostname, options = {}) {
 * The one place a Tenant can ask. The records used to exist only in the output
 * of a deploy that changed something, so a deploy that outran the vendor left
 * nothing to run but a second deploy, which is refused for changing nothing
-* (#617). Open to a deploy credential carrying `deploy`, since a pipeline asks
+* (#617). Open to a deploy credential carrying `read:domains`, since a pipeline asks
 * this too.
 */
 async function showDomainCommand(options = {}) {
@@ -1751,7 +1793,6 @@ function whereItGotTo(domain) {
 function whatItIsFor(purpose) {
 	return purpose === "certificate" ? "Add this first. It proves you own the name and issues the certificate" : "Add this once the certificate is active. It points traffic here";
 }
-const VALUE_COLUMN = " ".repeat(14);
 /** What the dashboard's empty state shows. Kept the same by hand, not by anything. */
 const DOMAIN_CONFIG_LINE = "\"domain\": \"shop.client.com\"";
 /**
@@ -1829,21 +1870,6 @@ function closingLines(certificateRecordPending, printedBy) {
 	if (printedBy === "domains") return indented(`${asking} Run this again in a minute.`);
 	return [...indented(`${asking} The deploy is finished either way. To read the record when it lands, run`), `${VALUE_COLUMN}  \x1b[36mwawesome domains\x1b[0m`];
 }
-function indented(said) {
-	return wrapped(said).map((line) => `${VALUE_COLUMN}${line}`);
-}
-/** The platform's own prose, kept inside the block it is printed in. */
-function wrapped(said) {
-	const width = 64;
-	const lines = [];
-	let line = "";
-	for (const word of said.split(/\s+/).filter(Boolean)) if (line && `${line} ${word}`.length > width) {
-		lines.push(line);
-		line = word;
-	} else line = line ? `${line} ${word}` : word;
-	if (line) lines.push(line);
-	return lines;
-}
 //#endregion
 //#region src/usage.ts
 const USAGE_TIMEOUT_MS = 2e3;
@@ -2031,6 +2057,17 @@ function collectAssets(dir) {
 	walk(dir, "");
 	return assets;
 }
+/**
+* A **Static asset** a browser renders as a page. Read off the extension, as the
+* content type the platform records is — mirrors `content_type_for_path` in
+* `server/crates/core/src/features/assets/content_type.rs`.
+*/
+function isDocument(assetPath) {
+	const name = assetPath.split("/").pop() ?? "";
+	const dot = name.lastIndexOf(".");
+	const extension = dot === -1 ? "" : name.slice(dot + 1).toLowerCase();
+	return extension === "html" || extension === "htm";
+}
 function hashFile(file) {
 	return sha256(fs.readFileSync(file));
 }
@@ -2068,6 +2105,7 @@ const INVOCATION_PREFIX = "/x";
 const SLUG_SEPARATOR = "--";
 const SURFACE_ROUTE = "/v1/invocation-surface";
 const SUBTREE_NOTE = "Every path beneath this address reaches the Function.";
+const ROOT_FUNCTION_SLUG = "root";
 /**
 * A gateway that serves no form of the address — and the value a client uses for
 * one that did not answer at all, deliberately the same: both name no address,
@@ -2094,6 +2132,19 @@ function publicAddress(surface, tenantSlug, appSlug, functionSlug) {
 	if (functionSlug === "root") return base;
 	return `${base}/${encodeURIComponent(functionSlug)}`;
 }
+/**
+* Where one of a Function's static files answers, `null` where none of them do.
+*
+* A **Static asset** is served on the App's own hostname and on no other
+* address, so a gateway serving only the path form has no address to give for
+* one — see **Static route** in `CONTEXT.md`.
+*/
+function assetAddress(surface, tenantSlug, appSlug, functionSlug, assetPath) {
+	if (!surface.contentOrigin) return null;
+	const mount = publicAddress(surface, tenantSlug, appSlug, functionSlug);
+	if (mount === null) return null;
+	return `${mount}/${assetPath.split("/").map(encodeURIComponent).join("/")}`;
+}
 /** The same address with the app and function still to be chosen. */
 function publicAddressTemplate(surface, tenantSlug) {
 	if (surface.contentOrigin) {
@@ -2237,107 +2288,629 @@ async function addressesFor(creds, previous, target) {
 	}
 }
 //#endregion
-//#region src/deploy.ts
-function declaredFields(declared) {
-	return {
-		...declared.visibility ? { visibility: declared.visibility } : {},
-		...declared.confirmPublish ? { confirm_publish: true } : {}
-	};
+//#region src/cron.ts
+/** `2026-08-23 03:00:00 UTC` with second-precision for run history timestamps. */
+function asUtcWithSeconds(iso) {
+	const at = new Date(iso);
+	if (Number.isNaN(at.getTime())) return iso;
+	const pad = (n) => String(n).padStart(2, "0");
+	return `${at.getUTCFullYear()}-${pad(at.getUTCMonth() + 1)}-${pad(at.getUTCDate())} ${pad(at.getUTCHours())}:${pad(at.getUTCMinutes())}:${pad(at.getUTCSeconds())} UTC`;
+}
+/** Format execution delay in ms or s. */
+function formatDelay(delayMs) {
+	if (delayMs === void 0 || delayMs === null || isNaN(delayMs) || delayMs < 0) return "-";
+	if (delayMs < 1e3) return `${delayMs}ms`;
+	return `${(delayMs / 1e3).toFixed(2)}s`;
+}
+/** Colorize state names for terminal output. */
+function colorizeRunState(state, text) {
+	const display = text ?? state;
+	switch (state.toLowerCase()) {
+		case "dispatched":
+		case "success": return `\x1b[32m${display}\x1b[0m`;
+		case "running": return `\x1b[36m${display}\x1b[0m`;
+		case "pending":
+		case "queued": return `\x1b[33m${display}\x1b[0m`;
+		case "missed": return `\x1b[33m${display}\x1b[0m`;
+		case "cancelled":
+		case "skipped": return `\x1b[90m${display}\x1b[0m`;
+		case "failed":
+		case "lost":
+		case "error": return `\x1b[31m${display}\x1b[0m`;
+		default: return display;
+	}
 }
 /**
-* The visibility this project declares, refused here rather than at the gateway
-* so a typo is a message at the keyboard.
+* Format a list of schedules for a single function.
 */
-function declaredVisibility(value) {
-	if (value === void 0 || value === null) return void 0;
-	if (value === "public" || value === "private") return value;
-	console.error(`[wawesome] Error: 'visibility' in wawesome-function.json is '${String(value)}'.`);
-	console.error("[wawesome] It must be \"public\" or \"private\".");
-	process.exit(1);
-}
-function reportPublishRefusal(message) {
-	console.error(`\n[wawesome] \x1b[31mError: ${message}\x1b[0m`);
-	console.error("[wawesome] Nothing was deployed. This Function is private, so its address");
-	console.error("[wawesome] resolves for nobody. Publishing it puts it back on the open");
-	console.error("[wawesome] internet.");
-	console.error("[wawesome] Re-run with \x1B[36mwawesome deploy --publish\x1B[0m to publish it, or put");
-	console.error("[wawesome] \x1B[36m\"visibility\": \"private\"\x1B[0m back in wawesome-function.json.\n");
+function formatFunctionSchedules(funcName, appSlug, schedules) {
+	const displayTarget = appSlug ? `${appSlug}/${funcName}` : funcName;
+	if (schedules.length === 0) return [`[wawesome] No schedules found for '${displayTarget}'.`];
+	const nameWidth = Math.max(8, ...schedules.map((s) => s.name.length));
+	const exprWidth = Math.max(10, ...schedules.map((s) => s.expression.length));
+	return [
+		`\n🗓  \x1b[1mSchedules for '${displayTarget}'\x1b[0m\n`,
+		...[...schedules].sort((a, b) => a.name.localeCompare(b.name)).map((schedule) => `  ${schedule.name.padEnd(nameWidth)}  ${schedule.expression.padEnd(exprWidth)}  ${whenItRuns(schedule)}`),
+		""
+	];
 }
 /**
-* Deploy a function: build → upload JS to gateway → promote.
+* Format schedules across all functions in an App.
 */
-async function deploy(entryInput, options) {
-	const isVerbose = Boolean(options.verbose);
-	const creds = readCredentials();
-	if (!creds) {
-		console.error("[wawesome] Error: Not logged in. Run 'wawesome login' first.");
-		process.exit(1);
-	}
-	const config = readFunctionConfig();
-	if (!config) {
-		console.error("[wawesome] Error: No wawesome-function.json found in the current directory.");
-		console.error("[wawesome] Run 'wawesome init' to create one, or create it manually.");
-		process.exit(1);
-	}
-	const { app, function: funcName } = config;
-	const declared = {
-		visibility: declaredVisibility(config.visibility),
-		confirmPublish: Boolean(options.publish)
-	};
-	const domainName = declaredDomain(config.domain);
-	if (isVerbose) {
-		console.log(`[wawesome:verbose] Deploying to app=${app}, function=${funcName}`);
-		console.log(`[wawesome:verbose] Gateway: ${creds.gateway_url}`);
-	}
-	if (!await confirmDeployTarget(creds, {
-		app,
-		function: funcName
-	})) {
-		console.log("[wawesome] Nothing was deployed.");
-		process.exit(0);
+function formatAppSchedules(appSlug, functionSchedules) {
+	if (functionSchedules.reduce((acc, f) => acc + f.schedules.length, 0) === 0) return [`[wawesome] No schedules found for app '${appSlug}'.`];
+	const allSchedules = functionSchedules.flatMap((f) => f.schedules);
+	const nameWidth = Math.max(8, ...allSchedules.map((s) => s.name.length));
+	const exprWidth = Math.max(10, ...allSchedules.map((s) => s.expression.length));
+	const out = [`\n🗓  \x1b[1mSchedules for app '${appSlug}'\x1b[0m\n`];
+	for (const fn of functionSchedules) {
+		out.push(`  Function: \x1b[1m${fn.functionName}\x1b[0m`);
+		if (fn.schedules.length === 0) out.push("    (no schedules)");
+		else for (const s of [...fn.schedules].sort((a, b) => a.name.localeCompare(b.name))) out.push(`    ${s.name.padEnd(nameWidth)}  ${s.expression.padEnd(exprWidth)}  ${whenItRuns(s)}`);
+		out.push("");
 	}
-	let bundlePath;
-	if (options.skipBuild) {
-		bundlePath = path.resolve(options.out);
-		if (!fs.existsSync(bundlePath)) {
-			console.error(`[wawesome] Error: Built bundle not found at '${bundlePath}'. Run 'wawesome build' first or remove --skip-build.`);
-			process.exit(1);
-		}
-		console.log(`[wawesome] Skipping build, using existing bundle: ${bundlePath}`);
-	} else {
-		const buildOpts = {
-			out: options.out,
-			verbose: options.verbose
+	return out;
+}
+/**
+* Format background run history table.
+*/
+function formatRunHistoryTable(runs) {
+	if (runs.length === 0) return [];
+	const scheduleColHeader = "SCHEDULE";
+	const stateColHeader = "STATE";
+	const dueColHeader = "DUE AT (UTC)";
+	const startedColHeader = "STARTED AT (UTC)";
+	const delayColHeader = "DELAY";
+	const invColHeader = "INVOCATION ID";
+	const rows = runs.map((run) => {
+		const schedName = run.schedule_name || "manual";
+		const stateDisplay = run.failure_reason ? `${run.state} (${run.failure_reason})` : run.state;
+		const dueAt = asUtcWithSeconds(run.fire_at);
+		const startedAt = run.claimed_at ? asUtcWithSeconds(run.claimed_at) : "-";
+		const delay = formatDelay(run.delay_ms);
+		const invId = run.invocation_id;
+		return {
+			schedName,
+			stateDisplay,
+			rawState: run.state,
+			dueAt,
+			startedAt,
+			delay,
+			invId
 		};
-		bundlePath = await buildJs(entryInput || config.entry, buildOpts);
-	}
-	const jsCode = fs.readFileSync(bundlePath, "utf-8");
-	if (!jsCode.trim()) {
-		console.error("[wawesome] Error: Built bundle is empty.");
-		process.exit(1);
-	}
-	if (isVerbose) console.log(`[wawesome:verbose] Bundle size: ${(Buffer.byteLength(jsCode) / 1024).toFixed(2)} KB`);
-	if (options.skipBuild) {
-		const findings = scanBundle(jsCode, { bundlePath });
-		const refused = refusesDeploy(findings);
-		for (const line of surfaceReportLines(findings)) (refused ? console.error : console.warn)(line);
-		if (refused) process.exit(1);
+	});
+	const schedWidth = Math.max(8, ...rows.map((r) => r.schedName.length));
+	const stateWidth = Math.max(5, ...rows.map((r) => r.stateDisplay.length));
+	const dueWidth = Math.max(12, ...rows.map((r) => r.dueAt.length));
+	const startedWidth = Math.max(16, ...rows.map((r) => r.startedAt.length));
+	const delayWidth = Math.max(5, ...rows.map((r) => r.delay.length));
+	const invWidth = Math.max(13, ...rows.map((r) => r.invId.length));
+	return [
+		`${scheduleColHeader.padEnd(schedWidth)} | ${stateColHeader.padEnd(stateWidth)} | ${dueColHeader.padEnd(dueWidth)} | ${startedColHeader.padEnd(startedWidth)} | ${delayColHeader.padEnd(delayWidth)} | ${invColHeader.padEnd(invWidth)}`,
+		`${"-".repeat(schedWidth)}-|-${"-".repeat(stateWidth)}-|-${"-".repeat(dueWidth)}-|-${"-".repeat(startedWidth)}-|-${"-".repeat(delayWidth)}-|-${"-".repeat(invWidth)}`,
+		...rows.map((r) => {
+			const schedPad = r.schedName.padEnd(schedWidth);
+			const coloredState = colorizeRunState(r.rawState, r.stateDisplay);
+			return `${schedPad} | ${r.stateDisplay.length < stateWidth ? coloredState + " ".repeat(stateWidth - r.stateDisplay.length) : coloredState} | ${r.dueAt.padEnd(dueWidth)} | ${r.startedAt.padEnd(startedWidth)} | ${r.delay.padEnd(delayWidth)} | ${r.invId.padEnd(invWidth)}`;
+		})
+	];
+}
+async function fetchFunctionSchedules(gatewayUrl, tenantJwt, funcName, appSlug, isVerbose) {
+	const scopedUrl = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/schedules` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules`;
+	if (isVerbose) console.log(`[wawesome:verbose] GET ${scopedUrl}`);
+	let res = await authorizedFetch(scopedUrl, {
+		method: "GET",
+		headers: { Authorization: `Bearer ${tenantJwt}` }
+	});
+	if (res.status === 404 && appSlug) {
+		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules`;
+		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: GET ${fallbackUrl}`);
+		try {
+			const fallbackRes = await authorizedFetch(fallbackUrl, {
+				method: "GET",
+				headers: { Authorization: `Bearer ${tenantJwt}` }
+			});
+			if (fallbackRes.ok) res = fallbackRes;
+		} catch {}
 	}
-	const declaresSchedules = config.schedules !== void 0;
-	const assets = config.assets ? collectAssets(path.resolve(config.assets)) : [];
-	if (assets.length > 0) await uploadAssets(creds, app, funcName, jsCode, assets, declared, isVerbose, declaresSchedules);
-	console.log(`[wawesome] Uploading code for ${app}/${funcName}...`);
-	const uploadUrl = `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/code`;
-	if (isVerbose) console.log(`[wawesome:verbose] POST ${uploadUrl}`);
-	const declaredOnTheWire = declaredFields(declared);
-	const uploadRes = assets.length > 0 || declaresSchedules || Object.keys(declaredOnTheWire).length > 0 ? await authorizedFetch(uploadUrl, {
+	if (!res.ok) return null;
+	const data = await res.json();
+	return Array.isArray(data.schedules) ? data.schedules : [];
+}
+async function fetchAppFunctions(gatewayUrl, tenantJwt, appSlug, isVerbose) {
+	const url = `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions`;
+	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
+	const res = await authorizedFetch(url, {
+		method: "GET",
+		headers: { Authorization: `Bearer ${tenantJwt}` }
+	});
+	if (!res.ok) return null;
+	return await res.json();
+}
+async function pauseScheduleApi(gatewayUrl, tenantJwt, funcName, scheduleName, appSlug, reason, isVerbose) {
+	const scopedUrl = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/pause` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/pause`;
+	const body = reason?.trim() ? JSON.stringify({ reason: reason.trim() }) : void 0;
+	if (isVerbose) console.log(`[wawesome:verbose] POST ${scopedUrl}`);
+	let res = await authorizedFetch(scopedUrl, {
 		method: "POST",
 		headers: {
-			Authorization: `Bearer ${creds.tenant_jwt}`,
-			"Content-Type": "application/json"
+			Authorization: `Bearer ${tenantJwt}`,
+			...body ? { "Content-Type": "application/json" } : {}
+		},
+		body
+	});
+	if (res.status === 404 && appSlug) {
+		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/pause`;
+		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: POST ${fallbackUrl}`);
+		try {
+			const fallbackRes = await authorizedFetch(fallbackUrl, {
+				method: "POST",
+				headers: {
+					Authorization: `Bearer ${tenantJwt}`,
+					...body ? { "Content-Type": "application/json" } : {}
+				},
+				body
+			});
+			if (fallbackRes) res = fallbackRes;
+		} catch {}
+	}
+	return res;
+}
+async function resumeScheduleApi(gatewayUrl, tenantJwt, funcName, scheduleName, appSlug, isVerbose) {
+	const scopedUrl = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/resume` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/resume`;
+	if (isVerbose) console.log(`[wawesome:verbose] POST ${scopedUrl}`);
+	let res = await authorizedFetch(scopedUrl, {
+		method: "POST",
+		headers: { Authorization: `Bearer ${tenantJwt}` }
+	});
+	if (res.status === 404 && appSlug) {
+		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/resume`;
+		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: POST ${fallbackUrl}`);
+		try {
+			const fallbackRes = await authorizedFetch(fallbackUrl, {
+				method: "POST",
+				headers: { Authorization: `Bearer ${tenantJwt}` }
+			});
+			if (fallbackRes) res = fallbackRes;
+		} catch {}
+	}
+	return res;
+}
+async function fetchBackgroundRunsApi(gatewayUrl, tenantJwt, funcName, appSlug, queryParams, isVerbose) {
+	const params = new URLSearchParams();
+	if (queryParams?.limit) params.set("limit", String(queryParams.limit));
+	if (queryParams?.page) params.set("page", String(queryParams.page));
+	if (queryParams?.state && queryParams.state.toLowerCase() !== "all") params.set("state", queryParams.state.toLowerCase());
+	const qs = params.toString() ? `?${params.toString()}` : "";
+	const scopedUrl = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/runs${qs}` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/runs${qs}`;
+	if (isVerbose) console.log(`[wawesome:verbose] GET ${scopedUrl}`);
+	let res = await authorizedFetch(scopedUrl, {
+		method: "GET",
+		headers: { Authorization: `Bearer ${tenantJwt}` }
+	});
+	if (res.status === 404 && appSlug) {
+		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/runs${qs}`;
+		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: GET ${fallbackUrl}`);
+		try {
+			const fallbackRes = await authorizedFetch(fallbackUrl, {
+				method: "GET",
+				headers: { Authorization: `Bearer ${tenantJwt}` }
+			});
+			if (fallbackRes) res = fallbackRes;
+		} catch {}
+	}
+	return res;
+}
+function requireCredentials$2() {
+	const creds = readCredentials();
+	if (!creds) {
+		console.error("[wawesome] Error: Not logged in. Run 'wawesome login' first.");
+		process.exit(1);
+	}
+	return creds;
+}
+async function listSchedulesCommand(target, options = {}) {
+	const isVerbose = Boolean(options.verbose);
+	const creds = requireCredentials$2();
+	const config = readFunctionConfig();
+	const explicitApp = options.app;
+	const appSlug = explicitApp || config?.app;
+	const funcName = target || options.function || (explicitApp ? void 0 : config?.function);
+	if (funcName) {
+		const schedules = await fetchFunctionSchedules(creds.gateway_url, creds.tenant_jwt, funcName, appSlug, isVerbose);
+		if (schedules === null) {
+			if (target && !options.app) {
+				const appFuncs = await fetchAppFunctions(creds.gateway_url, creds.tenant_jwt, target, isVerbose);
+				if (appFuncs !== null) {
+					const functionSchedules = [];
+					for (const item of appFuncs) {
+						const scheds = await fetchFunctionSchedules(creds.gateway_url, creds.tenant_jwt, item.function.name, target, isVerbose);
+						functionSchedules.push({
+							functionName: item.function.name,
+							schedules: scheds || []
+						});
+					}
+					const lines = formatAppSchedules(target, functionSchedules);
+					for (const line of lines) console.log(line);
+					return;
+				}
+			}
+			console.error(`[wawesome] Error: Function '${funcName}' not found.`);
+			process.exit(1);
+		}
+		const lines = formatFunctionSchedules(funcName, appSlug, schedules);
+		for (const line of lines) console.log(line);
+		return;
+	}
+	if (appSlug) {
+		const appFuncs = await fetchAppFunctions(creds.gateway_url, creds.tenant_jwt, appSlug, isVerbose);
+		if (appFuncs === null) {
+			console.error(`[wawesome] Error: App '${appSlug}' not found.`);
+			process.exit(1);
+		}
+		const functionSchedules = [];
+		for (const item of appFuncs) {
+			const scheds = await fetchFunctionSchedules(creds.gateway_url, creds.tenant_jwt, item.function.name, appSlug, isVerbose);
+			functionSchedules.push({
+				functionName: item.function.name,
+				schedules: scheds || []
+			});
+		}
+		const lines = formatAppSchedules(appSlug, functionSchedules);
+		for (const line of lines) console.log(line);
+		return;
+	}
+	console.error("[wawesome] Error: Missing function or app name.");
+	console.error("[wawesome] Usage: wawesome cron list [function-or-app] or run inside a function directory with wawesome-function.json.");
+	process.exit(1);
+}
+async function pauseScheduleCommand(target, subtarget, options = {}) {
+	const isVerbose = Boolean(options.verbose);
+	const creds = requireCredentials$2();
+	const config = readFunctionConfig();
+	let funcName;
+	let scheduleName;
+	if (target && subtarget) {
+		funcName = target;
+		scheduleName = subtarget;
+	} else if (target) {
+		scheduleName = target;
+		funcName = options.function || config?.function;
+	}
+	if (options.function) funcName = options.function;
+	const appSlug = options.app || config?.app;
+	if (!scheduleName) {
+		console.error("[wawesome] Error: Missing schedule name.");
+		console.error("[wawesome] Usage: wawesome cron pause <schedule-name> [--reason <reason>] or wawesome cron pause <function> <schedule-name>");
+		process.exit(1);
+	}
+	if (!funcName) {
+		console.error("[wawesome] Error: Missing function name.");
+		console.error("[wawesome] Usage: wawesome cron pause <function> <schedule-name> or specify -f/--function <name>.");
+		process.exit(1);
+	}
+	const res = await pauseScheduleApi(creds.gateway_url, creds.tenant_jwt, funcName, scheduleName, appSlug, options.reason, isVerbose);
+	if (!res.ok) {
+		const errorBody = await res.text();
+		if (res.status === 401 || res.status === 403) {
+			console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorBody)}`);
+			process.exit(1);
+		}
+		if (res.status === 404) {
+			console.error(`[wawesome] Error: Schedule '${scheduleName}' or function '${funcName}' not found.`);
+			process.exit(1);
+		}
+		const refusal = rejectionOf(errorBody, res.status, `Failed to pause schedule (HTTP ${res.status}).`);
+		console.error(`[wawesome] Error: ${refusal.message}`);
+		const advice = planLimitAdvice(refusal.reason) || (res.status === 402 ? `Where to resolve it: ${billingPageUrl()}` : "");
+		if (advice) console.error(`[wawesome] ${advice}`);
+		if (isVerbose) console.error(`[wawesome:verbose] Response: ${errorBody}`);
+		process.exit(1);
+	}
+	const data = await res.json();
+	const displayTarget = appSlug ? `${appSlug}/${funcName}` : funcName;
+	console.log(`[wawesome] ✔ Paused schedule '${data.schedule.name}' on '${displayTarget}'.`);
+	console.log(`  State: ${whenItRuns(data.schedule)} (survives future deploys)`);
+	if (data.schedule.pause_reason) console.log(`  Reason: ${data.schedule.pause_reason}`);
+	if (data.cancelled_runs && data.cancelled_runs.length > 0) {
+		const count = data.cancelled_runs.length;
+		console.log(`  Cancelled ${count} queued run${count === 1 ? "" : "s"} (never started).`);
+	}
+	if (data.running_runs && data.running_runs.length > 0) {
+		const count = data.running_runs.length;
+		console.log(`  Left ${count} in-flight run${count === 1 ? "" : "s"} to complete.`);
+	}
+}
+async function resumeScheduleCommand(target, subtarget, options = {}) {
+	const isVerbose = Boolean(options.verbose);
+	const creds = requireCredentials$2();
+	const config = readFunctionConfig();
+	let funcName;
+	let scheduleName;
+	if (target && subtarget) {
+		funcName = target;
+		scheduleName = subtarget;
+	} else if (target) {
+		scheduleName = target;
+		funcName = options.function || config?.function;
+	}
+	if (options.function) funcName = options.function;
+	const appSlug = options.app || config?.app;
+	if (!scheduleName) {
+		console.error("[wawesome] Error: Missing schedule name.");
+		console.error("[wawesome] Usage: wawesome cron resume <schedule-name> or wawesome cron resume <function> <schedule-name>");
+		process.exit(1);
+	}
+	if (!funcName) {
+		console.error("[wawesome] Error: Missing function name.");
+		console.error("[wawesome] Usage: wawesome cron resume <function> <schedule-name> or specify -f/--function <name>.");
+		process.exit(1);
+	}
+	const res = await resumeScheduleApi(creds.gateway_url, creds.tenant_jwt, funcName, scheduleName, appSlug, isVerbose);
+	if (!res.ok) {
+		const errorBody = await res.text();
+		if (res.status === 401 || res.status === 403) {
+			console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorBody)}`);
+			process.exit(1);
+		}
+		if (res.status === 404) {
+			console.error(`[wawesome] Error: Schedule '${scheduleName}' or function '${funcName}' not found.`);
+			process.exit(1);
+		}
+		const refusal = rejectionOf(errorBody, res.status, `Failed to resume schedule (HTTP ${res.status}).`);
+		console.error(`[wawesome] Error: ${refusal.message}`);
+		const advice = planLimitAdvice(refusal.reason) || (res.status === 402 ? `Where to resolve it: ${billingPageUrl()}` : "");
+		if (advice) console.error(`[wawesome] ${advice}`);
+		if (isVerbose) console.error(`[wawesome:verbose] Response: ${errorBody}`);
+		process.exit(1);
+	}
+	const data = await res.json();
+	const displayTarget = appSlug ? `${appSlug}/${funcName}` : funcName;
+	console.log(`[wawesome] ✔ Resumed schedule '${data.schedule.name}' on '${displayTarget}'.`);
+	console.log(`  ${whenItRuns(data.schedule)} (no backfill)`);
+}
+async function runHistoryCommand(target, options = {}) {
+	const isVerbose = Boolean(options.verbose);
+	const creds = requireCredentials$2();
+	const config = readFunctionConfig();
+	const funcName = target || options.function || config?.function;
+	const appSlug = options.app || config?.app;
+	if (!funcName) {
+		console.error("[wawesome] Error: Missing function name.");
+		console.error("[wawesome] Usage: wawesome cron history [function-name] or run inside a function directory with wawesome-function.json.");
+		process.exit(1);
+	}
+	const limit = options.limit ? Number(options.limit) : 50;
+	const stateFilter = options.state || options.status;
+	const res = await fetchBackgroundRunsApi(creds.gateway_url, creds.tenant_jwt, funcName, appSlug, {
+		state: stateFilter,
+		limit
+	}, isVerbose);
+	if (!res.ok) {
+		const errorBody = await res.text();
+		if (res.status === 401 || res.status === 403) {
+			console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorBody)}`);
+			process.exit(1);
+		}
+		if (res.status === 404) {
+			console.error(`[wawesome] Error: Function '${funcName}' not found.`);
+			process.exit(1);
+		}
+		const refusal = rejectionOf(errorBody, res.status, `Failed to fetch run history (HTTP ${res.status}).`);
+		console.error(`[wawesome] Error: ${refusal.message}`);
+		const advice = planLimitAdvice(refusal.reason) || (res.status === 402 ? `Where to resolve it: ${billingPageUrl()}` : "");
+		if (advice) console.error(`[wawesome] ${advice}`);
+		if (isVerbose) console.error(`[wawesome:verbose] Response: ${errorBody}`);
+		process.exit(1);
+	}
+	const data = await res.json();
+	const displayTarget = appSlug ? `${appSlug}/${funcName}` : funcName;
+	if (!data.runs || data.runs.length === 0) {
+		console.log(`[wawesome] No run history found for '${displayTarget}'.`);
+		return;
+	}
+	const total = data.total ?? data.runs.length;
+	console.log(`\n📜 \x1b[1mRun history for '${displayTarget}' (Showing ${data.runs.length} of ${total} records)\x1b[0m\n`);
+	const tableLines = formatRunHistoryTable(data.runs);
+	for (const line of tableLines) console.log(line);
+	console.log("");
+}
+async function cronCommand(action, target, subtarget, options = {}) {
+	const normAction = (action || "").toLowerCase().trim();
+	if (!normAction || normAction === "list" || normAction === "ls") return listSchedulesCommand(target, options);
+	if (normAction === "pause") return pauseScheduleCommand(target, subtarget, options);
+	if (normAction === "resume") return resumeScheduleCommand(target, subtarget, options);
+	if (normAction === "history" || normAction === "runs" || normAction === "log" || normAction === "logs") return runHistoryCommand(target, options);
+	return listSchedulesCommand(action, options);
+}
+//#endregion
+//#region src/mount-shadow.ts
+/**
+* The address a **Document** answers at, relative to its Function's mount: a
+* request path whose last segment carries no extension has `/index.html`
+* appended, so the Document at `about/index.html` is the address `about`.
+*/
+function documentAddressPath(assetPath) {
+	return assetPath.replace(/(^|\/)index\.html$/, "");
+}
+/** See **Mount** in `CONTEXT.md` for why only the root Function's can be. */
+function mountsCanShadow(functionSlug) {
+	return functionSlug === ROOT_FUNCTION_SLUG;
+}
+/**
+* The Documents this deploy carries that a sibling Function's **Mount** owns.
+*
+* A private sibling is not one of them: it registers no mount, so an address
+* reaching for it falls through to the root Function and the Document is
+* served after all.
+*/
+function shadowedDocuments(functionSlug, documentPaths, siblings) {
+	if (!mountsCanShadow(functionSlug)) return [];
+	const owners = new Set(siblings.filter((sibling) => sibling.slug !== functionSlug && sibling.visibility !== "private").map((sibling) => sibling.slug));
+	return documentPaths.flatMap((assetPath) => {
+		const owner = documentAddressPath(assetPath).split("/")[0];
+		return owner && owners.has(owner) ? [{
+			path: assetPath,
+			owner
+		}] : [];
+	});
+}
+/**
+* The same, with both addresses on them.
+*
+* Best-effort like the address the deploy prints: this is asked after the
+* deploy has landed, so a gateway that will not say which Functions the App
+* holds costs a warning and never the deploy.
+*/
+async function shadowedAddresses(creds, addresses, functionSlug, documentPaths, isVerbose) {
+	const { app, surface, tenantSlug } = addresses;
+	if (documentPaths.length === 0 || !mountsCanShadow(functionSlug)) return [];
+	let siblings;
+	try {
+		siblings = await fetchAppFunctions(creds.gateway_url, creds.tenant_jwt, app, isVerbose);
+	} catch (err) {
+		if (isVerbose) console.log(`[wawesome:verbose] Could not read the App's other Functions: ${errorText(err)}`);
+		return [];
+	}
+	if (!siblings) return [];
+	return shadowedDocuments(functionSlug, documentPaths, siblings.map((item) => ({
+		slug: item.function.slug,
+		visibility: item.function.visibility
+	}))).map((document) => {
+		const answered = documentAddressPath(document.path);
+		const page = surface && tenantSlug ? assetAddress(surface, tenantSlug, app, functionSlug, answered) : null;
+		const mount = surface && tenantSlug ? publicAddress(surface, tenantSlug, app, document.owner) : null;
+		return {
+			...document,
+			page: page ?? `/${answered}`,
+			mount: mount ?? `/${document.owner}`
+		};
+	});
+}
+/** What the deploy says about a page it landed that nothing will reach. */
+function shadowingLines(shadowed) {
+	if (shadowed.length === 0) return [];
+	const lines = [];
+	for (const [index, document] of shadowed.entries()) lines.push("", `  ${index === 0 ? "Shadowed:  " : "           "} \x1b[33m${document.path}\x1b[0m`, ...indented(`This page would answer at ${document.page}, and that address belongs to the '${document.owner}' Function: it answers ${document.mount} and everything beneath it, so the page is not served there.`));
+	return [
+		...lines,
+		`${VALUE_COLUMN}Nothing was refused — the two Functions are versioned`,
+		`${VALUE_COLUMN}independently, and either one may deploy first.`
+	];
+}
+//#endregion
+//#region src/deploy.ts
+function declaredFields(declared) {
+	return {
+		...declared.visibility ? { visibility: declared.visibility } : {},
+		...declared.confirmPublish ? { confirm_publish: true } : {}
+	};
+}
+/**
+* The visibility this project declares, refused here rather than at the gateway
+* so a typo is a message at the keyboard.
+*/
+function declaredVisibility(value) {
+	if (value === void 0 || value === null) return void 0;
+	if (value === "public" || value === "private") return value;
+	console.error(`[wawesome] Error: 'visibility' in wawesome-function.json is '${String(value)}'.`);
+	console.error("[wawesome] It must be \"public\" or \"private\".");
+	process.exit(1);
+}
+function reportPublishRefusal(message) {
+	console.error(`\n[wawesome] \x1b[31mError: ${message}\x1b[0m`);
+	console.error("[wawesome] Nothing was deployed. This Function is private, so its address");
+	console.error("[wawesome] resolves for nobody. Publishing it puts it back on the open");
+	console.error("[wawesome] internet.");
+	console.error("[wawesome] Re-run with \x1B[36mwawesome deploy --publish\x1B[0m to publish it, or put");
+	console.error("[wawesome] \x1B[36m\"visibility\": \"private\"\x1B[0m back in wawesome-function.json.\n");
+}
+/**
+* Deploy a function: build → upload JS to gateway → promote.
+*/
+async function deploy(entryInput, options) {
+	const isVerbose = Boolean(options.verbose);
+	const creds = readCredentials();
+	if (!creds) {
+		console.error("[wawesome] Error: Not logged in. Run 'wawesome login' first.");
+		process.exit(1);
+	}
+	const config = readFunctionConfig();
+	if (!config) {
+		console.error("[wawesome] Error: No wawesome-function.json found in the current directory.");
+		console.error("[wawesome] Run 'wawesome init' to create one, or create it manually.");
+		process.exit(1);
+	}
+	const { app, function: funcName } = config;
+	const declared = {
+		visibility: declaredVisibility(config.visibility),
+		confirmPublish: Boolean(options.publish)
+	};
+	const domainName = declaredDomain(config.domain);
+	if (isVerbose) {
+		console.log(`[wawesome:verbose] Deploying to app=${app}, function=${funcName}`);
+		console.log(`[wawesome:verbose] Gateway: ${creds.gateway_url}`);
+	}
+	if (!await confirmDeployTarget(creds, {
+		app,
+		function: funcName
+	})) {
+		console.log("[wawesome] Nothing was deployed.");
+		process.exit(0);
+	}
+	let bundlePath;
+	if (options.skipBuild) {
+		const built = path.resolve(options.out);
+		if (!hasHandler(entryInput, config)) bundlePath = null;
+		else if (fs.existsSync(built)) {
+			bundlePath = built;
+			console.log(`[wawesome] Skipping build, using existing bundle: ${built}`);
+		} else {
+			console.error(`[wawesome] Error: Built bundle not found at '${built}'. Run 'wawesome build' first or remove --skip-build.`);
+			process.exit(1);
+		}
+	} else bundlePath = await buildHandler(entryInput, config, {
+		out: options.out,
+		verbose: options.verbose
+	});
+	let jsCode = null;
+	if (bundlePath !== null) {
+		jsCode = fs.readFileSync(bundlePath, "utf-8");
+		if (!jsCode.trim()) {
+			console.error("[wawesome] Error: Built bundle is empty.");
+			process.exit(1);
+		}
+		if (isVerbose) console.log(`[wawesome:verbose] Bundle size: ${(Buffer.byteLength(jsCode) / 1024).toFixed(2)} KB`);
+		if (options.skipBuild) {
+			const findings = scanBundle(jsCode, { bundlePath });
+			const refused = refusesDeploy(findings);
+			for (const line of surfaceReportLines(findings)) (refused ? console.error : console.warn)(line);
+			if (refused) process.exit(1);
+		}
+	}
+	const declaresSchedules = config.schedules !== void 0;
+	const assets = config.assets ? collectAssets(path.resolve(config.assets)) : [];
+	const documents = assets.filter((asset) => isDocument(asset.path));
+	if (jsCode === null && documents.length === 0) {
+		console.error(`[wawesome] Error: Entry file '${DEFAULT_ENTRY}' not found, and this project carries no pages.`);
+		console.error("[wawesome] A deploy carries a handler, pages, or both. Write that file, name");
+		console.error("[wawesome] another one with \x1B[36m\"entry\"\x1B[0m in wawesome-function.json, or point");
+		console.error("[wawesome] \x1B[36m\"assets\"\x1B[0m at a directory holding an index.html.");
+		process.exit(1);
+	}
+	if (assets.length > 0) await uploadAssets(creds, app, funcName, jsCode ?? "", assets, declared, isVerbose, declaresSchedules);
+	console.log(`[wawesome] Uploading code for ${app}/${funcName}...`);
+	const uploadUrl = `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/code`;
+	if (isVerbose) console.log(`[wawesome:verbose] POST ${uploadUrl}`);
+	const declaredOnTheWire = declaredFields(declared);
+	const uploadRes = assets.length > 0 || declaresSchedules || Object.keys(declaredOnTheWire).length > 0 || jsCode === null ? await authorizedFetch(uploadUrl, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${creds.tenant_jwt}`,
+			"Content-Type": "application/json"
 		},
 		body: JSON.stringify({
-			code: jsCode,
+			...jsCode !== null ? { code: jsCode } : {},
 			...assets.length > 0 ? { assets: manifestOf(assets) } : {},
 			...declaresSchedules ? { schedules: config.schedules } : {},
 			...declaredOnTheWire
@@ -2412,14 +2985,21 @@ async function deploy(entryInput, options) {
 	});
 	let address = null;
 	let surface = null;
+	let tenantSlug = null;
 	if (visibility === "public") try {
 		const { slug } = await resolveWorkspace(creds);
+		tenantSlug = slug;
 		surface = await fetchInvocationSurface(creds.gateway_url);
 		address = publicAddress(surface, slug, app, funcName);
 	} catch (err) {
 		if (isVerbose) console.log(`[wawesome:verbose] Could not resolve the workspace address: ${err instanceof Error ? err.message : err}`);
 	}
 	const domain = domainName ? await applyDeclaredDomain(creds, app, domainName) : await findUndeclaredDomain(creds, app);
+	const shadowed = visibility === "public" ? await shadowedAddresses(creds, {
+		app,
+		surface,
+		tenantSlug
+	}, funcName, documents.map((document) => document.path), isVerbose) : [];
 	let headroom = null;
 	try {
 		headroom = headroomLines(await fetchTenantUsage(creds));
@@ -2432,7 +3012,8 @@ async function deploy(entryInput, options) {
 	console.log(`\n  App:        ${app}`);
 	console.log(`  Function:   ${funcName}`);
 	if (version !== void 0) console.log(`  Version:    ${version}${nothingBuilt ? " (already live, nothing promoted)" : ""}`);
-	if (assets.length > 0) console.log(`  Assets:     ${assets.length}`);
+	for (const line of handlerLines(bundlePath)) console.log(line);
+	if (assets.length > 0) console.log(`  Assets:     ${assets.length}${pageCount(documents.length)}`);
 	console.log(`  Visibility: ${visibility}`);
 	if (schedules.length > 0) {
 		console.log("");
@@ -2450,6 +3031,7 @@ async function deploy(entryInput, options) {
 		console.log("              for local development.");
 	}
 	if (domain) for (const line of domainLines(domain)) console.log(line);
+	for (const line of shadowingLines(shadowed)) console.log(line);
 	if (headroom) {
 		console.log("");
 		for (const line of headroom) console.log(line);
@@ -2464,6 +3046,15 @@ async function deploy(entryInput, options) {
 		domain
 	};
 }
+/** What this deploy landed of the two things a **Version** carries. */
+function handlerLines(bundlePath) {
+	if (bundlePath !== null) return [`  Handler:    ${path.relative(process.cwd(), bundlePath) || bundlePath}`];
+	return ["  Handler:    \x1B[33mnone\x1B[0m", ...indented("This Version carries no handler at all. It serves the pages it carries, and no code runs.")];
+}
+function pageCount(pages) {
+	if (pages === 0) return "";
+	return ` (${pages} page${pages === 1 ? "" : "s"})`;
+}
 /**
 * Ask the gateway which of this deploy's files it does not hold, and send only
 * those.
@@ -4565,920 +5156,600 @@ async function invokeCommand(target, options = {}) {
 		const advice = planLimitAdvice(refusal.reason) || (res.status === 402 ? `Where to resolve it: ${billingPageUrl()}` : "");
 		if (advice) console.error(`[wawesome] ${advice}`);
 		if (isVerbose && res.status !== 409 && res.status !== 402) console.error(`[wawesome:verbose] Response: ${errorBody}`);
-		process.exit(1);
-	}
-	const data = await res.json();
-	const displayTarget = appSlug ? `${appSlug}/${funcName}` : funcName;
-	console.log(`[wawesome] ⏳ Run ${data.invocation_id} queued for '${displayTarget}'...`);
-	if (options.follow === false) return;
-	await followRun(creds.gateway_url, creds.tenant_jwt, data.invocation_id, isVerbose);
-}
-//#endregion
-//#region src/workspace.ts
-function requireCredentials$2() {
-	const creds = readCredentials();
-	if (!creds) {
-		console.error("[wawesome] Error: Not logged in. Run 'wawesome login' first.");
-		process.exit(1);
-	}
-	return creds;
-}
-/**
-* Show the workspace's name, address, and whether that address is still free to
-* change — the rename is offered here rather than discovered by attempting it.
-*/
-async function showWorkspace(options) {
-	const creds = requireCredentials$2();
-	let tenant;
-	try {
-		tenant = await fetchTenantDetails(creds);
-	} catch (err) {
-		console.error(`[wawesome] Error: ${err instanceof Error ? err.message : err}`);
-		process.exit(1);
-	}
-	console.log("\n[wawesome] Workspace:");
-	console.log(`  Name:     ${tenant.name}`);
-	console.log(`  Address:  ${tenant.tenant_slug}`);
-	console.log(`  Tenant:   ${tenant.id}`);
-	if (options.verbose) {
-		const template = publicAddressTemplate(await invocationSurfaceOrNone(creds.gateway_url), tenant.tenant_slug);
-		if (template) {
-			console.log(`  URLs:     ${template}`);
-			console.log(`            ${SUBTREE_NOTE}`);
-		}
-	}
-	if (tenant.slug_locked) console.log("\n  🔒 The address is fixed. A Function version has been promoted, and live URLs carry it.");
-	else {
-		console.log("\n  The address can still be changed: \x1B[36mwawesome workspace rename <name>\x1B[0m");
-		console.log("  It locks for good the first time you deploy.");
-	}
-	console.log("");
-}
-/**
-* Change the workspace's public address.
-*
-* The lock is read from the gateway before asking, so a user who cannot rename
-* is told why instead of being walked into a rejection. The rejection is still
-* handled: a promotion landing between the two calls is the one case where the
-* gateway knows something this command could not.
-*/
-async function renameWorkspace(slug, options) {
-	const creds = requireCredentials$2();
-	if (!slug || !slug.trim()) {
-		console.error("[wawesome] Error: No name given. Usage: wawesome workspace rename <name>");
-		process.exit(1);
-		return;
-	}
-	try {
-		const tenant = await fetchTenantDetails(creds);
-		if (tenant.slug_locked) {
-			console.error("\n[wawesome] \x1B[31mThe workspace address can no longer be changed.\x1B[0m");
-			console.error(`[wawesome] '${tenant.tenant_slug}' is fixed: a Function version has been promoted, and live URLs already carry it.`);
-			process.exit(1);
-			return;
-		}
-		if (options.verbose) console.log(`[wawesome:verbose] Renaming '${tenant.tenant_slug}' → '${slug}'`);
-		const result = await renameTenantSlug(creds, slug.trim());
-		console.log("\n======================================================");
-		console.log("✅ \x1B[32mWORKSPACE RENAMED\x1B[0m");
-		console.log("======================================================");
-		console.log(`\n  Address:  ${result.tenant_slug}`);
-		console.log(`  Previous: ${result.previous_slug} (still resolves)`);
-		console.log("======================================================\n");
-	} catch (err) {
-		if (err instanceof GatewayError) {
-			console.error(`\n[wawesome] \x1b[31m${err.message}\x1b[0m`);
-			const { text } = renameAdvice(err.reason);
-			if (text) console.error(`[wawesome] ${text}`);
-			console.error("");
-			process.exit(1);
-			return;
-		}
-		console.error(`[wawesome] Error: ${err instanceof Error ? err.message : err}`);
-		process.exit(1);
-	}
-}
-/** Dispatch for `wawesome workspace [action]`. */
-async function workspaceCommand(action, target, options) {
-	if (!action || action === "show" || action === "info") return showWorkspace(options);
-	if (action === "rename") return renameWorkspace(target, options);
-	console.error(`[wawesome] Error: Unknown workspace action '${action}'.`);
-	console.error("[wawesome] Usage: wawesome workspace [show|rename <name>]");
-	process.exit(1);
-}
-//#endregion
-//#region src/deploy-credentials.ts
-const SECRET_SHOWN_ONCE = "Copy it now. This is the only time it will be shown. If you lose it, revoke this credential and mint another.";
-const REGENERATED_SECRET_SHOWN_ONCE = "Copy it now. This is the only time it will be shown. If you lose it, regenerate this credential again.";
-function requireCredentials$1() {
-	const creds = readCredentials();
-	if (!creds) {
-		console.error("[wawesome] Error: Not logged in. Run 'wawesome login' first.");
-		process.exit(1);
-	}
-	return creds;
-}
-function fail(message, ...rest) {
-	console.error(`[wawesome] Error: ${message}`);
-	for (const line of rest) console.error(`[wawesome] ${line}`);
-	process.exit(1);
-}
-/** A repeated flag and a comma-separated one, read as the same list. */
-function asList(raw) {
-	if (raw === void 0) return void 0;
-	const words = (Array.isArray(raw) ? raw : [raw]).flatMap((word) => String(word).split(",")).map((word) => word.trim()).filter((word) => word.length > 0);
-	return words.length > 0 ? words : void 0;
-}
-function parseExpiry(raw) {
-	if (raw === void 0) return void 0;
-	const asked = String(raw).trim().toLowerCase();
-	if (asked === "never") return "never";
-	const days = /^(\d+)\s*d(ays?)?$/.exec(asked) ?? /^(\d+)$/.exec(asked);
-	if (!days) fail(`'${raw}' is not an expiry. Name a number of days (--expires 30) or 'never' (--expires never).`);
-	return { days: Number(days[1]) };
-}
-/**
-* What a target may be repeated back as.
-*
-* Somebody revoking a leak pastes the whole secret as often as the prefix, and
-* a refusal that echoed it would write it into a shell history and a CI log —
-* for the one feature built on the secret being shown exactly once.
-*/
-function asShown(target) {
-	if (!target.startsWith("wawe_")) return target;
-	const shown = credentialPrefix(target);
-	return shown === target ? target : `${shown}…`;
-}
-/** The Apps a credential names, or `null` where it names none and reaches all. */
-function namedApps(apps) {
-	return apps && apps.scope === "only" ? apps.apps.join(", ") : null;
-}
-/** `2026-11-30 12:00 UTC`. Minutes, because nothing here is read to the second. */
-function asUtc(iso) {
-	if (!iso) return "never";
-	const at = new Date(iso);
-	if (Number.isNaN(at.getTime())) return iso;
-	return `${at.toISOString().slice(0, 16).replace("T", " ")} UTC`;
-}
-function isExpired(credential, now) {
-	if (!credential.expires_at) return false;
-	const at = new Date(credential.expires_at).getTime();
-	return !Number.isNaN(at) && at <= now;
-}
-function statusOf(credential, now) {
-	if (credential.revoked_at) return "revoked";
-	if (isExpired(credential, now)) return "expired";
-	return "active";
-}
-async function refusal(res, fallback) {
-	if (res.status === 401 || res.status === 403) return new GatewayError(unauthorizedMessage(res.status, await res.text().catch(() => "")), res.status);
-	return asGatewayError(res, fallback);
-}
-async function mintCredential(creds, payload) {
-	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials`, {
-		method: "POST",
-		headers: {
-			Authorization: `Bearer ${creds.tenant_jwt}`,
-			"Content-Type": "application/json"
-		},
-		body: JSON.stringify(payload)
-	});
-	if (!res.ok) throw await refusal(res, `Failed to mint the credential (HTTP ${res.status}).`);
-	return await res.json();
-}
-async function fetchCredentials(creds) {
-	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials`, { headers: { Authorization: `Bearer ${creds.tenant_jwt}` } });
-	if (!res.ok) throw await refusal(res, `Failed to read the credentials (HTTP ${res.status}).`);
-	return (await res.json()).credentials ?? [];
-}
-async function regenerateCredential(creds, credentialId, payload) {
-	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials/${encodeURIComponent(credentialId)}/regenerate`, {
-		method: "POST",
-		headers: {
-			Authorization: `Bearer ${creds.tenant_jwt}`,
-			"Content-Type": "application/json"
-		},
-		body: JSON.stringify(payload)
-	});
-	if (!res.ok) throw await refusal(res, `Failed to regenerate the credential (HTTP ${res.status}).`);
-	return await res.json();
-}
-async function revokeCredential(creds, credentialId) {
-	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials/${encodeURIComponent(credentialId)}/revoke`, {
-		method: "POST",
-		headers: { Authorization: `Bearer ${creds.tenant_jwt}` }
-	});
-	if (!res.ok) throw await refusal(res, `Failed to revoke the credential (HTTP ${res.status}).`);
-	return await res.json();
-}
-async function deleteCredential(creds, credentialId) {
-	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials/${encodeURIComponent(credentialId)}`, {
-		method: "DELETE",
-		headers: { Authorization: `Bearer ${creds.tenant_jwt}` }
-	});
-	if (!res.ok) throw await refusal(res, `Failed to delete the credential (HTTP ${res.status}).`);
-}
-/**
-* Mint one credential.
-*
-* The secret goes to stdout on a line of its own and everything a person reads
-* goes to stderr, so `wawesome credentials mint ci > secret` writes the secret
-* and not one character besides.
-*/
-async function mintCredentialCommand(name, options) {
-	if (!name || !name.trim()) fail("No name given. Usage: wawesome credentials mint <name> [--capability deploy] [--app <app>] [--expires 90|never]", "The name is what tells the CI one from the agent one a year from now.");
-	const creds = requireCredentials$1();
-	const payload = { name: name.trim() };
-	const capabilities = asList(options.capability);
-	if (capabilities) payload.capabilities = capabilities;
-	const apps = asList(options.app);
-	if (apps) payload.apps = apps;
-	const expiry = parseExpiry(options.expires);
-	if (expiry !== void 0) payload.expiry = expiry;
-	if (options.verbose) {
-		console.error(`[wawesome:verbose] POST ${creds.gateway_url}/v1/tenant/credentials`);
-		console.error(`[wawesome:verbose] Payload: ${JSON.stringify({ ...payload })}`);
+		process.exit(1);
 	}
-	let credential;
-	try {
-		credential = await mintCredential(creds, payload);
-	} catch (err) {
-		fail(errorText(err));
+	const data = await res.json();
+	const displayTarget = appSlug ? `${appSlug}/${funcName}` : funcName;
+	console.log(`[wawesome] ⏳ Run ${data.invocation_id} queued for '${displayTarget}'...`);
+	if (options.follow === false) return;
+	await followRun(creds.gateway_url, creds.tenant_jwt, data.invocation_id, isVerbose);
+}
+//#endregion
+//#region src/workspace.ts
+function requireCredentials$1() {
+	const creds = readCredentials();
+	if (!creds) {
+		console.error("[wawesome] Error: Not logged in. Run 'wawesome login' first.");
+		process.exit(1);
 	}
-	reveal(`Minted deploy credential '${credential.name}'.`, credential, SECRET_SHOWN_ONCE);
+	return creds;
 }
 /**
-* Hand the secret over, once.
-*
-* The secret goes to stdout on a line of its own and everything a person reads
-* goes to stderr, so `wawesome credentials mint ci > secret` writes the secret
-* and not one character besides.
+* Show the workspace's name, address, and whether that address is still free to
+* change — the rename is offered here rather than discovered by attempting it.
 */
-function reveal(headline, credential, shownOnce) {
-	console.error(`\n[wawesome] ✔ ${headline}\n`);
-	console.error(`  Prefix:       ${credential.prefix}`);
-	console.error(`  Capabilities: ${credential.capabilities.join(", ")}`);
-	console.error(`  Apps:         ${namedApps(credential.apps) ?? "every App in the workspace"}`);
-	console.error(`  Expires:      ${asUtc(credential.expires_at)}`);
-	console.error(`\n  ${shownOnce}\n`);
-	console.log(credential.secret);
-	console.error("");
-}
-async function listCredentialsCommand(options) {
+async function showWorkspace(options) {
 	const creds = requireCredentials$1();
-	if (options.verbose) console.error(`[wawesome:verbose] GET ${creds.gateway_url}/v1/tenant/credentials`);
-	let credentials;
+	let tenant;
 	try {
-		credentials = await fetchCredentials(creds);
+		tenant = await fetchTenantDetails(creds);
 	} catch (err) {
-		fail(errorText(err));
-	}
-	if (credentials.length === 0) {
-		console.log("\n[wawesome] This workspace has no deploy credentials.");
-		console.log("[wawesome] Mint one: \x1B[36mwawesome credentials mint <name>\x1B[0m\n");
-		return;
+		console.error(`[wawesome] Error: ${err instanceof Error ? err.message : err}`);
+		process.exit(1);
 	}
-	console.log("\n🔑 \x1B[1mDeploy credentials\x1B[0m\n");
-	for (const line of formatCredentials(credentials, Date.now())) console.log(line);
-	console.log("");
-}
-/** Never the secret: no read after minting carries one. */
-function formatCredentials(credentials, now) {
-	const rows = credentials.map((credential) => ({
-		name: credential.name,
-		prefix: credential.prefix,
-		capabilities: credential.capabilities.join(", "),
-		apps: namedApps(credential.apps) ?? "every App",
-		lastUsed: asUtc(credential.last_used_at),
-		expires: asUtc(credential.expires_at),
-		status: statusOf(credential, now)
-	}));
-	const columns = [
-		{
-			header: "NAME",
-			of: (row) => row.name
-		},
-		{
-			header: "PREFIX",
-			of: (row) => row.prefix
-		},
-		{
-			header: "CAPABILITIES",
-			of: (row) => row.capabilities
-		},
-		{
-			header: "APPS",
-			of: (row) => row.apps
-		},
-		{
-			header: "LAST USED",
-			of: (row) => row.lastUsed
-		},
-		{
-			header: "EXPIRES",
-			of: (row) => row.expires
-		},
-		{
-			header: "STATUS",
-			of: (row) => row.status
+	console.log("\n[wawesome] Workspace:");
+	console.log(`  Name:     ${tenant.name}`);
+	console.log(`  Address:  ${tenant.tenant_slug}`);
+	console.log(`  Tenant:   ${tenant.id}`);
+	if (options.verbose) {
+		const template = publicAddressTemplate(await invocationSurfaceOrNone(creds.gateway_url), tenant.tenant_slug);
+		if (template) {
+			console.log(`  URLs:     ${template}`);
+			console.log(`            ${SUBTREE_NOTE}`);
 		}
-	];
-	const widths = columns.map((column) => Math.max(column.header.length, ...rows.map((row) => column.of(row).length)));
-	const line = (cells) => `  ${cells.map((cell, i) => cell.padEnd(widths[i])).join(" | ")}`.trimEnd();
-	return [
-		line(columns.map((column) => column.header)),
-		`  ${widths.map((width) => "-".repeat(width)).join("-|-")}`,
-		...rows.map((row) => line(columns.map((column) => column.of(row))))
-	];
-}
-/**
-* Which credential a user meant by a name or a prefix.
-*
-* A partial prefix matches, because the point of the displayable prefix is
-* matching one against a CI settings page by eye — and a partial that names
-* more than one is refused rather than guessed at, since the guess would be a
-* revocation.
-*/
-function matchCredentials(credentials, target) {
-	const typed = target.trim();
-	const named = credentials.filter((credential) => credential.name === typed);
-	if (named.length > 0) return named;
-	const wanted = typed.startsWith("wawe_") ? credentialPrefix(typed) : typed;
-	return credentials.filter((credential) => credential.prefix.startsWith(wanted));
-}
-/** The one credential a typed name or prefix means, or an exit saying why none. */
-async function resolveCredential(creds, target, options) {
-	if (options.verbose) console.error(`[wawesome:verbose] GET ${creds.gateway_url}/v1/tenant/credentials`);
-	let credentials;
-	try {
-		credentials = await fetchCredentials(creds);
-	} catch (err) {
-		fail(errorText(err));
 	}
-	const matched = matchCredentials(credentials, target);
-	if (matched.length === 0) fail(`No deploy credential named or prefixed '${asShown(target)}' in this workspace.`, "Run 'wawesome credentials list' to see what this workspace has.");
-	if (matched.length > 1) fail(`'${asShown(target)}' names more than one credential:`, ...matched.map((credential) => `  ${credential.name} (${credential.prefix})`), "Name one of them, or give more of its prefix.");
-	return matched[0];
+	if (tenant.slug_locked) console.log("\n  🔒 The address is fixed. A Function version has been promoted, and live URLs carry it.");
+	else {
+		console.log("\n  The address can still be changed: \x1B[36mwawesome workspace rename <name>\x1B[0m");
+		console.log("  It locks for good the first time you deploy.");
+	}
+	console.log("");
 }
 /**
-* Replace a credential's secret where it stands, keeping the name a pipeline's
-* settings already refer to.
+* Change the workspace's public address.
 *
-* Confirmed like a revoke, because it is one for whatever holds the old secret:
-* the pipeline stops on its very next request until somebody gives it the new
-* one.
+* The lock is read from the gateway before asking, so a user who cannot rename
+* is told why instead of being walked into a rejection. The rejection is still
+* handled: a promotion landing between the two calls is the one case where the
+* gateway knows something this command could not.
 */
-async function regenerateCredentialCommand(target, options) {
-	if (!target || !target.trim()) fail("No credential given. Usage: wawesome credentials regenerate <name-or-prefix>");
-	const creds = requireCredentials$1();
-	const credential = await resolveCredential(creds, target, options);
-	if (credential.revoked_at) fail(`'${credential.name}' (${credential.prefix}) was revoked at ${asUtc(credential.revoked_at)}, and nothing un-revokes one.`, `Mint a replacement, or delete this one first to free its name for it.`);
-	const payload = {};
-	const expiry = parseExpiry(options.expires);
-	if (expiry !== void 0) payload.expiry = expiry;
-	if (!options.yes) {
-		if (!isInteractive()) fail(`Regenerating asks for confirmation, and there is nobody to ask.`, `Pass --yes to regenerate '${credential.name}' (${credential.prefix}) without being asked.`);
-		let confirmed;
-		try {
-			confirmed = await confirm({
-				message: `Regenerate '${credential.name}' (${credential.prefix})? Anything holding the old secret stops working at once and has to be given the new one.`,
-				default: false
-			});
-		} catch {
-			confirmed = false;
-		}
-		if (!confirmed) {
-			console.error(`[wawesome] Cancelled. '${credential.name}' still works.`);
-			return;
-		}
-	}
-	if (options.verbose) {
-		console.error(`[wawesome:verbose] POST ${creds.gateway_url}/v1/tenant/credentials/${credential.id}/regenerate`);
-		console.error(`[wawesome:verbose] Payload: ${JSON.stringify(payload)}`);
-	}
-	let regenerated;
-	try {
-		regenerated = await regenerateCredential(creds, credential.id, payload);
-	} catch (err) {
-		if (err instanceof GatewayError && err.status === 404) fail(`'${credential.name}' (${credential.prefix}) no longer exists in this workspace.`);
-		fail(errorText(err));
-	}
-	reveal(`Regenerated '${regenerated.name}'. Anything still presenting the old secret is refused from its very next request.`, regenerated, REGENERATED_SECRET_SHOWN_ONCE);
-}
-async function revokeCredentialCommand(target, options) {
-	if (!target || !target.trim()) fail("No credential given. Usage: wawesome credentials revoke <name-or-prefix>");
+async function renameWorkspace(slug, options) {
 	const creds = requireCredentials$1();
-	const credential = await resolveCredential(creds, target, options);
-	if (credential.revoked_at) {
-		console.log(`[wawesome] '${credential.name}' (${credential.prefix}) was already revoked at ${asUtc(credential.revoked_at)}. Nothing to do.`);
+	if (!slug || !slug.trim()) {
+		console.error("[wawesome] Error: No name given. Usage: wawesome workspace rename <name>");
+		process.exit(1);
 		return;
 	}
-	if (!options.yes) {
-		if (!isInteractive()) fail(`Revoking asks for confirmation, and there is nobody to ask.`, `Pass --yes to revoke '${credential.name}' (${credential.prefix}) without being asked.`);
-		let confirmed;
-		try {
-			confirmed = await confirm({
-				message: `Revoke '${credential.name}' (${credential.prefix})? Nothing un-revokes it.`,
-				default: false
-			});
-		} catch {
-			confirmed = false;
-		}
-		if (!confirmed) {
-			console.log(`[wawesome] Cancelled. '${credential.name}' still works.`);
-			return;
-		}
-	}
-	if (options.verbose) console.error(`[wawesome:verbose] POST ${creds.gateway_url}/v1/tenant/credentials/${credential.id}/revoke`);
-	let revoked;
 	try {
-		revoked = await revokeCredential(creds, credential.id);
-	} catch (err) {
-		if (err instanceof GatewayError && err.status === 404) fail(`'${credential.name}' (${credential.prefix}) no longer exists in this workspace.`);
-		fail(errorText(err));
-	}
-	console.log(`\n[wawesome] ✔ Revoked '${revoked.name}' (${revoked.prefix}).`);
-	console.log("[wawesome] Anything still presenting it is refused from its very next request.\n");
-}
-async function deleteCredentialCommand(target, options) {
-	if (!target || !target.trim()) fail("No credential given. Usage: wawesome credentials delete <name-or-prefix>");
-	const creds = requireCredentials$1();
-	const credential = await resolveCredential(creds, target, options);
-	const named = `'${credential.name}' (${credential.prefix})`;
-	if (statusOf(credential, Date.now()) === "active") fail(`${named} still works, and only a credential that has stopped working is deleted.`, `Revoke it first: wawesome credentials revoke ${credential.name}`);
-	if (!options.yes) {
-		if (!isInteractive()) fail("Deleting asks for confirmation, and there is nobody to ask.", `Pass --yes to delete ${named} without being asked.`);
-		console.log(`\n[wawesome] Deleting ${named} forgets it.`);
-		console.log(`[wawesome]   It leaves the listing, and the name '${credential.name}' comes free.`);
-		console.log("[wawesome]   Anything still presenting its secret is told the secret is unknown, rather");
-		console.log("[wawesome]   than that somebody here revoked it.\n");
-		let confirmed;
-		try {
-			confirmed = await confirm({
-				message: `Delete ${named}?`,
-				default: false
-			});
-		} catch {
-			confirmed = false;
-		}
-		if (!confirmed) {
-			console.log(`[wawesome] Cancelled. ${named} is still listed.`);
+		const tenant = await fetchTenantDetails(creds);
+		if (tenant.slug_locked) {
+			console.error("\n[wawesome] \x1B[31mThe workspace address can no longer be changed.\x1B[0m");
+			console.error(`[wawesome] '${tenant.tenant_slug}' is fixed: a Function version has been promoted, and live URLs already carry it.`);
+			process.exit(1);
 			return;
 		}
-	}
-	if (options.verbose) console.error(`[wawesome:verbose] DELETE ${creds.gateway_url}/v1/tenant/credentials/${credential.id}`);
-	try {
-		await deleteCredential(creds, credential.id);
+		if (options.verbose) console.log(`[wawesome:verbose] Renaming '${tenant.tenant_slug}' → '${slug}'`);
+		const result = await renameTenantSlug(creds, slug.trim());
+		console.log("\n======================================================");
+		console.log("✅ \x1B[32mWORKSPACE RENAMED\x1B[0m");
+		console.log("======================================================");
+		console.log(`\n  Address:  ${result.tenant_slug}`);
+		console.log(`  Previous: ${result.previous_slug} (still resolves)`);
+		console.log("======================================================\n");
 	} catch (err) {
-		if (err instanceof GatewayError && err.status === 404) fail(`${named} no longer exists in this workspace.`);
-		fail(errorText(err));
+		if (err instanceof GatewayError) {
+			console.error(`\n[wawesome] \x1b[31m${err.message}\x1b[0m`);
+			const { text } = renameAdvice(err.reason);
+			if (text) console.error(`[wawesome] ${text}`);
+			console.error("");
+			process.exit(1);
+			return;
+		}
+		console.error(`[wawesome] Error: ${err instanceof Error ? err.message : err}`);
+		process.exit(1);
 	}
-	console.log(`\n[wawesome] ✔ Deleted ${named}. The name '${credential.name}' is free again.`);
-	console.log("[wawesome] Anything still presenting its secret is told the secret is unknown.\n");
 }
-async function credentialsCommand(action, target, options) {
-	if (!action || action === "list" || action === "ls") return listCredentialsCommand(options);
-	if (action === "mint") return mintCredentialCommand(target, options);
-	if (action === "regenerate") return regenerateCredentialCommand(target, options);
-	if (action === "revoke") return revokeCredentialCommand(target, options);
-	if (action === "delete") return deleteCredentialCommand(target, options);
-	fail(`Unknown credentials action '${action}'.`, "Usage: wawesome credentials [list|mint <name>|regenerate <name-or-prefix>|revoke <name-or-prefix>|delete <name-or-prefix>]");
+/** Dispatch for `wawesome workspace [action]`. */
+async function workspaceCommand(action, target, options) {
+	if (!action || action === "show" || action === "info") return showWorkspace(options);
+	if (action === "rename") return renameWorkspace(target, options);
+	console.error(`[wawesome] Error: Unknown workspace action '${action}'.`);
+	console.error("[wawesome] Usage: wawesome workspace [show|rename <name>]");
+	process.exit(1);
 }
 //#endregion
-//#region src/cron.ts
-/** `2026-08-23 03:00:00 UTC` with second-precision for run history timestamps. */
-function asUtcWithSeconds(iso) {
-	const at = new Date(iso);
-	if (Number.isNaN(at.getTime())) return iso;
-	const pad = (n) => String(n).padStart(2, "0");
-	return `${at.getUTCFullYear()}-${pad(at.getUTCMonth() + 1)}-${pad(at.getUTCDate())} ${pad(at.getUTCHours())}:${pad(at.getUTCMinutes())}:${pad(at.getUTCSeconds())} UTC`;
-}
-/** Format execution delay in ms or s. */
-function formatDelay(delayMs) {
-	if (delayMs === void 0 || delayMs === null || isNaN(delayMs) || delayMs < 0) return "-";
-	if (delayMs < 1e3) return `${delayMs}ms`;
-	return `${(delayMs / 1e3).toFixed(2)}s`;
+//#region ../shared/mint-surface.generated.ts
+const MINT_PRESETS = [
+	{
+		name: "viewer",
+		job: "Read and investigate",
+		capabilities: [
+			"read:tenant",
+			"read:apps",
+			"read:functions",
+			"read:env",
+			"read:domains",
+			"read:invocations",
+			"read:runs",
+			"read:schedules",
+			"read:previews",
+			"read:egress"
+		],
+		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist. It writes nothing."
+	},
+	{
+		name: "deployer",
+		job: "Ship and read back",
+		capabilities: [
+			"read:tenant",
+			"read:apps",
+			"read:functions",
+			"read:env",
+			"read:domains",
+			"read:invocations",
+			"read:runs",
+			"read:schedules",
+			"read:previews",
+			"read:egress",
+			"write:apps",
+			"write:functions",
+			"write:env",
+			"write:runs"
+		],
+		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist, and can create Apps, deploy Functions, set environment variables and run Functions. It does not attach domains, pause and resume schedules or create previews."
+	},
+	{
+		name: "member",
+		job: "Build in the workspace",
+		capabilities: [
+			"read:tenant",
+			"read:apps",
+			"read:functions",
+			"read:env",
+			"read:domains",
+			"read:invocations",
+			"read:runs",
+			"read:schedules",
+			"read:previews",
+			"read:egress",
+			"write:apps",
+			"write:functions",
+			"write:env",
+			"write:runs",
+			"write:schedules",
+			"write:previews"
+		],
+		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist, and can create Apps, deploy Functions, set environment variables, run Functions, pause and resume schedules and create previews. It does not attach domains."
+	}
+];
+function mintPreset(name) {
+	return MINT_PRESETS.find((preset) => preset.name === name);
 }
-/** Colorize state names for terminal output. */
-function colorizeRunState(state, text) {
-	const display = text ?? state;
-	switch (state.toLowerCase()) {
-		case "dispatched":
-		case "success": return `\x1b[32m${display}\x1b[0m`;
-		case "running": return `\x1b[36m${display}\x1b[0m`;
-		case "pending":
-		case "queued": return `\x1b[33m${display}\x1b[0m`;
-		case "missed": return `\x1b[33m${display}\x1b[0m`;
-		case "cancelled":
-		case "skipped": return `\x1b[90m${display}\x1b[0m`;
-		case "failed":
-		case "lost":
-		case "error": return `\x1b[31m${display}\x1b[0m`;
-		default: return display;
+//#endregion
+//#region src/deploy-credentials.ts
+const SECRET_SHOWN_ONCE = "Copy it now. This is the only time it will be shown. If you lose it, revoke this credential and mint another.";
+const REGENERATED_SECRET_SHOWN_ONCE = "Copy it now. This is the only time it will be shown. If you lose it, regenerate this credential again.";
+function requireCredentials() {
+	const creds = readCredentials();
+	if (!creds) {
+		console.error("[wawesome] Error: Not logged in. Run 'wawesome login' first.");
+		process.exit(1);
 	}
+	return creds;
+}
+function fail(message, ...rest) {
+	console.error(`[wawesome] Error: ${message}`);
+	for (const line of rest) console.error(`[wawesome] ${line}`);
+	process.exit(1);
+}
+/** A repeated flag and a comma-separated one, read as the same list. */
+function asList(raw) {
+	if (raw === void 0) return void 0;
+	const words = (Array.isArray(raw) ? raw : [raw]).flatMap((word) => String(word).split(",")).map((word) => word.trim()).filter((word) => word.length > 0);
+	return words.length > 0 ? words : void 0;
+}
+/** What the help block is written to fit. A narrower terminal wraps it again;
+* a wider one leaves the words where they are put. */
+const HELP_WIDTH = 88;
+function wordsUnder(words, gutter) {
+	const lines = [];
+	let line = "";
+	words.forEach((word, i) => {
+		const piece = i < words.length - 1 ? `${word},` : word;
+		const joined = line ? `${line} ${piece}` : piece;
+		if (line && gutter.length + joined.length > HELP_WIDTH) {
+			lines.push(gutter + line);
+			line = piece;
+		} else line = joined;
+	});
+	return line ? [...lines, gutter + line] : lines;
 }
 /**
-* Format a list of schedules for a single function.
+* Every preset with the job on one line and the words it grants under it,
+* wherever one is offered or refused.
+*
+* The words are printed rather than stood for: a name on its own would be a
+* label an owner has to trust, free to drift from the grant it makes. They are
+* under the name rather than beside it because a grid word names one resource
+* and one verb, so a job takes ten of them or more.
 */
-function formatFunctionSchedules(funcName, appSlug, schedules) {
-	const displayTarget = appSlug ? `${appSlug}/${funcName}` : funcName;
-	if (schedules.length === 0) return [`[wawesome] No schedules found for '${displayTarget}'.`];
-	const nameWidth = Math.max(8, ...schedules.map((s) => s.name.length));
-	const exprWidth = Math.max(10, ...schedules.map((s) => s.expression.length));
-	return [
-		`\n🗓  \x1b[1mSchedules for '${displayTarget}'\x1b[0m\n`,
-		...[...schedules].sort((a, b) => a.name.localeCompare(b.name)).map((schedule) => `  ${schedule.name.padEnd(nameWidth)}  ${schedule.expression.padEnd(exprWidth)}  ${whenItRuns(schedule)}`),
-		""
-	];
+function presetsOffered(indent = "  ", pad = 12) {
+	return MINT_PRESETS.flatMap((preset) => [`${indent}${preset.name.padEnd(pad)}${preset.job}`, ...wordsUnder(preset.capabilities, `${indent}${" ".repeat(pad)}`)]);
 }
+/** The `--preset` flag as `--help` states it: the job each one is for, the
+* words being too many to fit on a flag's line and printed by the command's
+* own help. */
+const PRESET_FLAG_HELP = `Grant the words a job needs: ${MINT_PRESETS.map((preset) => `${preset.name} (${preset.job.toLowerCase()})`).join(", ")}. 'wawesome credentials --help' prints what each one grants. Not with --capability`;
 /**
-* Format schedules across all functions in an App.
+* The words to mint with: the ones named, or the ones a preset names.
+*
+* A preset expands here rather than travelling as a name, so what the command
+* sends and prints is the vocabulary itself: a label the platform never sees
+* would be free to drift from the words it stands for.
 */
-function formatAppSchedules(appSlug, functionSchedules) {
-	if (functionSchedules.reduce((acc, f) => acc + f.schedules.length, 0) === 0) return [`[wawesome] No schedules found for app '${appSlug}'.`];
-	const allSchedules = functionSchedules.flatMap((f) => f.schedules);
-	const nameWidth = Math.max(8, ...allSchedules.map((s) => s.name.length));
-	const exprWidth = Math.max(10, ...allSchedules.map((s) => s.expression.length));
-	const out = [`\n🗓  \x1b[1mSchedules for app '${appSlug}'\x1b[0m\n`];
-	for (const fn of functionSchedules) {
-		out.push(`  Function: \x1b[1m${fn.functionName}\x1b[0m`);
-		if (fn.schedules.length === 0) out.push("    (no schedules)");
-		else for (const s of [...fn.schedules].sort((a, b) => a.name.localeCompare(b.name))) out.push(`    ${s.name.padEnd(nameWidth)}  ${s.expression.padEnd(exprWidth)}  ${whenItRuns(s)}`);
-		out.push("");
-	}
-	return out;
+function capabilitiesAsked(options) {
+	const named = asList(options.capability);
+	const preset = options.preset?.trim();
+	if (!preset) return named;
+	if (named) fail(`--preset ${preset} and --capability ${named.join(",")} both name what this credential carries.`, "Name one of them. A preset is a fill, so pass its words to --capability if you mean to edit them:", ...presetsOffered());
+	const found = mintPreset(preset);
+	if (!found) fail(`'${preset}' is not a preset. The ones offered are:`, ...presetsOffered());
+	return [...found.capabilities];
+}
+function parseExpiry(raw) {
+	if (raw === void 0) return void 0;
+	const asked = String(raw).trim().toLowerCase();
+	if (asked === "never") return "never";
+	const days = /^(\d+)\s*d(ays?)?$/.exec(asked) ?? /^(\d+)$/.exec(asked);
+	if (!days) fail(`'${raw}' is not an expiry. Name a number of days (--expires 30) or 'never' (--expires never).`);
+	return { days: Number(days[1]) };
 }
 /**
-* Format background run history table.
+* What a target may be repeated back as.
+*
+* Somebody revoking a leak pastes the whole secret as often as the prefix, and
+* a refusal that echoed it would write it into a shell history and a CI log —
+* for the one feature built on the secret being shown exactly once.
 */
-function formatRunHistoryTable(runs) {
-	if (runs.length === 0) return [];
-	const scheduleColHeader = "SCHEDULE";
-	const stateColHeader = "STATE";
-	const dueColHeader = "DUE AT (UTC)";
-	const startedColHeader = "STARTED AT (UTC)";
-	const delayColHeader = "DELAY";
-	const invColHeader = "INVOCATION ID";
-	const rows = runs.map((run) => {
-		const schedName = run.schedule_name || "manual";
-		const stateDisplay = run.failure_reason ? `${run.state} (${run.failure_reason})` : run.state;
-		const dueAt = asUtcWithSeconds(run.fire_at);
-		const startedAt = run.claimed_at ? asUtcWithSeconds(run.claimed_at) : "-";
-		const delay = formatDelay(run.delay_ms);
-		const invId = run.invocation_id;
-		return {
-			schedName,
-			stateDisplay,
-			rawState: run.state,
-			dueAt,
-			startedAt,
-			delay,
-			invId
-		};
-	});
-	const schedWidth = Math.max(8, ...rows.map((r) => r.schedName.length));
-	const stateWidth = Math.max(5, ...rows.map((r) => r.stateDisplay.length));
-	const dueWidth = Math.max(12, ...rows.map((r) => r.dueAt.length));
-	const startedWidth = Math.max(16, ...rows.map((r) => r.startedAt.length));
-	const delayWidth = Math.max(5, ...rows.map((r) => r.delay.length));
-	const invWidth = Math.max(13, ...rows.map((r) => r.invId.length));
-	return [
-		`${scheduleColHeader.padEnd(schedWidth)} | ${stateColHeader.padEnd(stateWidth)} | ${dueColHeader.padEnd(dueWidth)} | ${startedColHeader.padEnd(startedWidth)} | ${delayColHeader.padEnd(delayWidth)} | ${invColHeader.padEnd(invWidth)}`,
-		`${"-".repeat(schedWidth)}-|-${"-".repeat(stateWidth)}-|-${"-".repeat(dueWidth)}-|-${"-".repeat(startedWidth)}-|-${"-".repeat(delayWidth)}-|-${"-".repeat(invWidth)}`,
-		...rows.map((r) => {
-			const schedPad = r.schedName.padEnd(schedWidth);
-			const coloredState = colorizeRunState(r.rawState, r.stateDisplay);
-			return `${schedPad} | ${r.stateDisplay.length < stateWidth ? coloredState + " ".repeat(stateWidth - r.stateDisplay.length) : coloredState} | ${r.dueAt.padEnd(dueWidth)} | ${r.startedAt.padEnd(startedWidth)} | ${r.delay.padEnd(delayWidth)} | ${r.invId.padEnd(invWidth)}`;
-		})
-	];
+function asShown(target) {
+	if (!target.startsWith("wawe_")) return target;
+	const shown = credentialPrefix(target);
+	return shown === target ? target : `${shown}…`;
 }
-async function fetchFunctionSchedules(gatewayUrl, tenantJwt, funcName, appSlug, isVerbose) {
-	const scopedUrl = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/schedules` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules`;
-	if (isVerbose) console.log(`[wawesome:verbose] GET ${scopedUrl}`);
-	let res = await authorizedFetch(scopedUrl, {
-		method: "GET",
-		headers: { Authorization: `Bearer ${tenantJwt}` }
-	});
-	if (res.status === 404 && appSlug) {
-		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules`;
-		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: GET ${fallbackUrl}`);
-		try {
-			const fallbackRes = await authorizedFetch(fallbackUrl, {
-				method: "GET",
-				headers: { Authorization: `Bearer ${tenantJwt}` }
-			});
-			if (fallbackRes.ok) res = fallbackRes;
-		} catch {}
-	}
-	if (!res.ok) return null;
-	const data = await res.json();
-	return Array.isArray(data.schedules) ? data.schedules : [];
+/** The Apps a credential names, or `null` where it names none and reaches all. */
+function namedApps(apps) {
+	return apps && apps.scope === "only" ? apps.apps.join(", ") : null;
 }
-async function fetchAppFunctions(gatewayUrl, tenantJwt, appSlug, isVerbose) {
-	const url = `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions`;
-	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
-	const res = await authorizedFetch(url, {
-		method: "GET",
-		headers: { Authorization: `Bearer ${tenantJwt}` }
+/** `2026-11-30 12:00 UTC`. Minutes, because nothing here is read to the second. */
+function asUtc(iso) {
+	if (!iso) return "never";
+	const at = new Date(iso);
+	if (Number.isNaN(at.getTime())) return iso;
+	return `${at.toISOString().slice(0, 16).replace("T", " ")} UTC`;
+}
+function isExpired(credential, now) {
+	if (!credential.expires_at) return false;
+	const at = new Date(credential.expires_at).getTime();
+	return !Number.isNaN(at) && at <= now;
+}
+function statusOf(credential, now) {
+	if (credential.revoked_at) return "revoked";
+	if (isExpired(credential, now)) return "expired";
+	return "active";
+}
+async function refusal(res, fallback) {
+	if (res.status === 401 || res.status === 403) return new GatewayError(unauthorizedMessage(res.status, await res.text().catch(() => "")), res.status);
+	return asGatewayError(res, fallback);
+}
+async function mintCredential(creds, payload) {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${creds.tenant_jwt}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify(payload)
 	});
-	if (!res.ok) return null;
+	if (!res.ok) throw await refusal(res, `Failed to mint the credential (HTTP ${res.status}).`);
 	return await res.json();
 }
-async function pauseScheduleApi(gatewayUrl, tenantJwt, funcName, scheduleName, appSlug, reason, isVerbose) {
-	const scopedUrl = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/pause` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/pause`;
-	const body = reason?.trim() ? JSON.stringify({ reason: reason.trim() }) : void 0;
-	if (isVerbose) console.log(`[wawesome:verbose] POST ${scopedUrl}`);
-	let res = await authorizedFetch(scopedUrl, {
+async function fetchCredentials(creds) {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials`, { headers: { Authorization: `Bearer ${creds.tenant_jwt}` } });
+	if (!res.ok) throw await refusal(res, `Failed to read the credentials (HTTP ${res.status}).`);
+	return (await res.json()).credentials ?? [];
+}
+async function regenerateCredential(creds, credentialId, payload) {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials/${encodeURIComponent(credentialId)}/regenerate`, {
 		method: "POST",
 		headers: {
-			Authorization: `Bearer ${tenantJwt}`,
-			...body ? { "Content-Type": "application/json" } : {}
+			Authorization: `Bearer ${creds.tenant_jwt}`,
+			"Content-Type": "application/json"
 		},
-		body
+		body: JSON.stringify(payload)
 	});
-	if (res.status === 404 && appSlug) {
-		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/pause`;
-		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: POST ${fallbackUrl}`);
-		try {
-			const fallbackRes = await authorizedFetch(fallbackUrl, {
-				method: "POST",
-				headers: {
-					Authorization: `Bearer ${tenantJwt}`,
-					...body ? { "Content-Type": "application/json" } : {}
-				},
-				body
-			});
-			if (fallbackRes) res = fallbackRes;
-		} catch {}
-	}
-	return res;
+	if (!res.ok) throw await refusal(res, `Failed to regenerate the credential (HTTP ${res.status}).`);
+	return await res.json();
 }
-async function resumeScheduleApi(gatewayUrl, tenantJwt, funcName, scheduleName, appSlug, isVerbose) {
-	const scopedUrl = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/resume` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/resume`;
-	if (isVerbose) console.log(`[wawesome:verbose] POST ${scopedUrl}`);
-	let res = await authorizedFetch(scopedUrl, {
+async function revokeCredential(creds, credentialId) {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials/${encodeURIComponent(credentialId)}/revoke`, {
 		method: "POST",
-		headers: { Authorization: `Bearer ${tenantJwt}` }
+		headers: { Authorization: `Bearer ${creds.tenant_jwt}` }
 	});
-	if (res.status === 404 && appSlug) {
-		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/resume`;
-		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: POST ${fallbackUrl}`);
-		try {
-			const fallbackRes = await authorizedFetch(fallbackUrl, {
-				method: "POST",
-				headers: { Authorization: `Bearer ${tenantJwt}` }
-			});
-			if (fallbackRes) res = fallbackRes;
-		} catch {}
-	}
-	return res;
+	if (!res.ok) throw await refusal(res, `Failed to revoke the credential (HTTP ${res.status}).`);
+	return await res.json();
 }
-async function fetchBackgroundRunsApi(gatewayUrl, tenantJwt, funcName, appSlug, queryParams, isVerbose) {
-	const params = new URLSearchParams();
-	if (queryParams?.limit) params.set("limit", String(queryParams.limit));
-	if (queryParams?.page) params.set("page", String(queryParams.page));
-	if (queryParams?.state && queryParams.state.toLowerCase() !== "all") params.set("state", queryParams.state.toLowerCase());
-	const qs = params.toString() ? `?${params.toString()}` : "";
-	const scopedUrl = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/runs${qs}` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/runs${qs}`;
-	if (isVerbose) console.log(`[wawesome:verbose] GET ${scopedUrl}`);
-	let res = await authorizedFetch(scopedUrl, {
-		method: "GET",
-		headers: { Authorization: `Bearer ${tenantJwt}` }
+async function deleteCredential(creds, credentialId) {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials/${encodeURIComponent(credentialId)}`, {
+		method: "DELETE",
+		headers: { Authorization: `Bearer ${creds.tenant_jwt}` }
 	});
-	if (res.status === 404 && appSlug) {
-		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/runs${qs}`;
-		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: GET ${fallbackUrl}`);
-		try {
-			const fallbackRes = await authorizedFetch(fallbackUrl, {
-				method: "GET",
-				headers: { Authorization: `Bearer ${tenantJwt}` }
-			});
-			if (fallbackRes) res = fallbackRes;
-		} catch {}
-	}
-	return res;
+	if (!res.ok) throw await refusal(res, `Failed to delete the credential (HTTP ${res.status}).`);
 }
-function requireCredentials() {
-	const creds = readCredentials();
-	if (!creds) {
-		console.error("[wawesome] Error: Not logged in. Run 'wawesome login' first.");
-		process.exit(1);
+/**
+* Mint one credential.
+*
+* The secret goes to stdout on a line of its own and everything a person reads
+* goes to stderr, so `wawesome credentials mint ci > secret` writes the secret
+* and not one character besides.
+*/
+async function mintCredentialCommand(name, options) {
+	if (!name || !name.trim()) fail("No name given. Usage: wawesome credentials mint <name> [--capability write:functions] [--app <app>] [--expires 90|never]", "The name is what tells the CI one from the agent one a year from now.");
+	const capabilities = capabilitiesAsked(options);
+	const creds = requireCredentials();
+	const payload = { name: name.trim() };
+	if (capabilities) payload.capabilities = capabilities;
+	const apps = asList(options.app);
+	if (apps) payload.apps = apps;
+	const expiry = parseExpiry(options.expires);
+	if (expiry !== void 0) payload.expiry = expiry;
+	if (options.verbose) {
+		console.error(`[wawesome:verbose] POST ${creds.gateway_url}/v1/tenant/credentials`);
+		console.error(`[wawesome:verbose] Payload: ${JSON.stringify({ ...payload })}`);
 	}
-	return creds;
+	let credential;
+	try {
+		credential = await mintCredential(creds, payload);
+	} catch (err) {
+		fail(errorText(err));
+	}
+	reveal(`Minted deploy credential '${credential.name}'.`, credential, SECRET_SHOWN_ONCE);
 }
-async function listSchedulesCommand(target, options = {}) {
-	const isVerbose = Boolean(options.verbose);
+/**
+* Hand the secret over, once.
+*
+* The secret goes to stdout on a line of its own and everything a person reads
+* goes to stderr, so `wawesome credentials mint ci > secret` writes the secret
+* and not one character besides.
+*/
+function reveal(headline, credential, shownOnce) {
+	console.error(`\n[wawesome] ✔ ${headline}\n`);
+	console.error(`  Prefix:       ${credential.prefix}`);
+	console.error(`  Capabilities: ${credential.capabilities.join(", ")}`);
+	console.error(`  Apps:         ${namedApps(credential.apps) ?? "every App in the workspace"}`);
+	console.error(`  Expires:      ${asUtc(credential.expires_at)}`);
+	console.error(`\n  ${shownOnce}\n`);
+	console.log(credential.secret);
+	console.error("");
+}
+async function listCredentialsCommand(options) {
 	const creds = requireCredentials();
-	const config = readFunctionConfig();
-	const explicitApp = options.app;
-	const appSlug = explicitApp || config?.app;
-	const funcName = target || options.function || (explicitApp ? void 0 : config?.function);
-	if (funcName) {
-		const schedules = await fetchFunctionSchedules(creds.gateway_url, creds.tenant_jwt, funcName, appSlug, isVerbose);
-		if (schedules === null) {
-			if (target && !options.app) {
-				const appFuncs = await fetchAppFunctions(creds.gateway_url, creds.tenant_jwt, target, isVerbose);
-				if (appFuncs !== null) {
-					const functionSchedules = [];
-					for (const item of appFuncs) {
-						const scheds = await fetchFunctionSchedules(creds.gateway_url, creds.tenant_jwt, item.function.name, target, isVerbose);
-						functionSchedules.push({
-							functionName: item.function.name,
-							schedules: scheds || []
-						});
-					}
-					const lines = formatAppSchedules(target, functionSchedules);
-					for (const line of lines) console.log(line);
-					return;
-				}
-			}
-			console.error(`[wawesome] Error: Function '${funcName}' not found.`);
-			process.exit(1);
-		}
-		const lines = formatFunctionSchedules(funcName, appSlug, schedules);
-		for (const line of lines) console.log(line);
+	if (options.verbose) console.error(`[wawesome:verbose] GET ${creds.gateway_url}/v1/tenant/credentials`);
+	let credentials;
+	try {
+		credentials = await fetchCredentials(creds);
+	} catch (err) {
+		fail(errorText(err));
+	}
+	if (credentials.length === 0) {
+		console.log("\n[wawesome] This workspace has no deploy credentials.");
+		console.log("[wawesome] Mint one: \x1B[36mwawesome credentials mint <name>\x1B[0m\n");
 		return;
 	}
-	if (appSlug) {
-		const appFuncs = await fetchAppFunctions(creds.gateway_url, creds.tenant_jwt, appSlug, isVerbose);
-		if (appFuncs === null) {
-			console.error(`[wawesome] Error: App '${appSlug}' not found.`);
-			process.exit(1);
-		}
-		const functionSchedules = [];
-		for (const item of appFuncs) {
-			const scheds = await fetchFunctionSchedules(creds.gateway_url, creds.tenant_jwt, item.function.name, appSlug, isVerbose);
-			functionSchedules.push({
-				functionName: item.function.name,
-				schedules: scheds || []
-			});
+	console.log("\n🔑 \x1B[1mDeploy credentials\x1B[0m\n");
+	for (const line of formatCredentials(credentials, Date.now())) console.log(line);
+	console.log("");
+}
+/** Never the secret: no read after minting carries one. */
+function formatCredentials(credentials, now) {
+	const rows = credentials.map((credential) => ({
+		name: credential.name,
+		prefix: credential.prefix,
+		capabilities: credential.capabilities.join(", "),
+		apps: namedApps(credential.apps) ?? "every App",
+		lastUsed: asUtc(credential.last_used_at),
+		expires: asUtc(credential.expires_at),
+		status: statusOf(credential, now)
+	}));
+	const columns = [
+		{
+			header: "NAME",
+			of: (row) => row.name
+		},
+		{
+			header: "PREFIX",
+			of: (row) => row.prefix
+		},
+		{
+			header: "CAPABILITIES",
+			of: (row) => row.capabilities
+		},
+		{
+			header: "APPS",
+			of: (row) => row.apps
+		},
+		{
+			header: "LAST USED",
+			of: (row) => row.lastUsed
+		},
+		{
+			header: "EXPIRES",
+			of: (row) => row.expires
+		},
+		{
+			header: "STATUS",
+			of: (row) => row.status
 		}
-		const lines = formatAppSchedules(appSlug, functionSchedules);
-		for (const line of lines) console.log(line);
-		return;
+	];
+	const widths = columns.map((column) => Math.max(column.header.length, ...rows.map((row) => column.of(row).length)));
+	const line = (cells) => `  ${cells.map((cell, i) => cell.padEnd(widths[i])).join(" | ")}`.trimEnd();
+	return [
+		line(columns.map((column) => column.header)),
+		`  ${widths.map((width) => "-".repeat(width)).join("-|-")}`,
+		...rows.map((row) => line(columns.map((column) => column.of(row))))
+	];
+}
+/**
+* Which credential a user meant by a name or a prefix.
+*
+* A partial prefix matches, because the point of the displayable prefix is
+* matching one against a CI settings page by eye — and a partial that names
+* more than one is refused rather than guessed at, since the guess would be a
+* revocation.
+*/
+function matchCredentials(credentials, target) {
+	const typed = target.trim();
+	const named = credentials.filter((credential) => credential.name === typed);
+	if (named.length > 0) return named;
+	const wanted = typed.startsWith("wawe_") ? credentialPrefix(typed) : typed;
+	return credentials.filter((credential) => credential.prefix.startsWith(wanted));
+}
+/** The one credential a typed name or prefix means, or an exit saying why none. */
+async function resolveCredential(creds, target, options) {
+	if (options.verbose) console.error(`[wawesome:verbose] GET ${creds.gateway_url}/v1/tenant/credentials`);
+	let credentials;
+	try {
+		credentials = await fetchCredentials(creds);
+	} catch (err) {
+		fail(errorText(err));
 	}
-	console.error("[wawesome] Error: Missing function or app name.");
-	console.error("[wawesome] Usage: wawesome cron list [function-or-app] or run inside a function directory with wawesome-function.json.");
-	process.exit(1);
+	const matched = matchCredentials(credentials, target);
+	if (matched.length === 0) fail(`No deploy credential named or prefixed '${asShown(target)}' in this workspace.`, "Run 'wawesome credentials list' to see what this workspace has.");
+	if (matched.length > 1) fail(`'${asShown(target)}' names more than one credential:`, ...matched.map((credential) => `  ${credential.name} (${credential.prefix})`), "Name one of them, or give more of its prefix.");
+	return matched[0];
 }
-async function pauseScheduleCommand(target, subtarget, options = {}) {
-	const isVerbose = Boolean(options.verbose);
+/**
+* Replace a credential's secret where it stands, keeping the name a pipeline's
+* settings already refer to.
+*
+* Confirmed like a revoke, because it is one for whatever holds the old secret:
+* the pipeline stops on its very next request until somebody gives it the new
+* one.
+*/
+async function regenerateCredentialCommand(target, options) {
+	if (!target || !target.trim()) fail("No credential given. Usage: wawesome credentials regenerate <name-or-prefix>");
 	const creds = requireCredentials();
-	const config = readFunctionConfig();
-	let funcName;
-	let scheduleName;
-	if (target && subtarget) {
-		funcName = target;
-		scheduleName = subtarget;
-	} else if (target) {
-		scheduleName = target;
-		funcName = options.function || config?.function;
-	}
-	if (options.function) funcName = options.function;
-	const appSlug = options.app || config?.app;
-	if (!scheduleName) {
-		console.error("[wawesome] Error: Missing schedule name.");
-		console.error("[wawesome] Usage: wawesome cron pause <schedule-name> [--reason <reason>] or wawesome cron pause <function> <schedule-name>");
-		process.exit(1);
-	}
-	if (!funcName) {
-		console.error("[wawesome] Error: Missing function name.");
-		console.error("[wawesome] Usage: wawesome cron pause <function> <schedule-name> or specify -f/--function <name>.");
-		process.exit(1);
-	}
-	const res = await pauseScheduleApi(creds.gateway_url, creds.tenant_jwt, funcName, scheduleName, appSlug, options.reason, isVerbose);
-	if (!res.ok) {
-		const errorBody = await res.text();
-		if (res.status === 401 || res.status === 403) {
-			console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorBody)}`);
-			process.exit(1);
+	const credential = await resolveCredential(creds, target, options);
+	if (credential.revoked_at) fail(`'${credential.name}' (${credential.prefix}) was revoked at ${asUtc(credential.revoked_at)}, and nothing un-revokes one.`, `Mint a replacement, or delete this one first to free its name for it.`);
+	const payload = {};
+	const expiry = parseExpiry(options.expires);
+	if (expiry !== void 0) payload.expiry = expiry;
+	if (!options.yes) {
+		if (!isInteractive()) fail(`Regenerating asks for confirmation, and there is nobody to ask.`, `Pass --yes to regenerate '${credential.name}' (${credential.prefix}) without being asked.`);
+		let confirmed;
+		try {
+			confirmed = await confirm({
+				message: `Regenerate '${credential.name}' (${credential.prefix})? Anything holding the old secret stops working at once and has to be given the new one.`,
+				default: false
+			});
+		} catch {
+			confirmed = false;
 		}
-		if (res.status === 404) {
-			console.error(`[wawesome] Error: Schedule '${scheduleName}' or function '${funcName}' not found.`);
-			process.exit(1);
+		if (!confirmed) {
+			console.error(`[wawesome] Cancelled. '${credential.name}' still works.`);
+			return;
 		}
-		const refusal = rejectionOf(errorBody, res.status, `Failed to pause schedule (HTTP ${res.status}).`);
-		console.error(`[wawesome] Error: ${refusal.message}`);
-		const advice = planLimitAdvice(refusal.reason) || (res.status === 402 ? `Where to resolve it: ${billingPageUrl()}` : "");
-		if (advice) console.error(`[wawesome] ${advice}`);
-		if (isVerbose) console.error(`[wawesome:verbose] Response: ${errorBody}`);
-		process.exit(1);
 	}
-	const data = await res.json();
-	const displayTarget = appSlug ? `${appSlug}/${funcName}` : funcName;
-	console.log(`[wawesome] ✔ Paused schedule '${data.schedule.name}' on '${displayTarget}'.`);
-	console.log(`  State: ${whenItRuns(data.schedule)} (survives future deploys)`);
-	if (data.schedule.pause_reason) console.log(`  Reason: ${data.schedule.pause_reason}`);
-	if (data.cancelled_runs && data.cancelled_runs.length > 0) {
-		const count = data.cancelled_runs.length;
-		console.log(`  Cancelled ${count} queued run${count === 1 ? "" : "s"} (never started).`);
+	if (options.verbose) {
+		console.error(`[wawesome:verbose] POST ${creds.gateway_url}/v1/tenant/credentials/${credential.id}/regenerate`);
+		console.error(`[wawesome:verbose] Payload: ${JSON.stringify(payload)}`);
 	}
-	if (data.running_runs && data.running_runs.length > 0) {
-		const count = data.running_runs.length;
-		console.log(`  Left ${count} in-flight run${count === 1 ? "" : "s"} to complete.`);
+	let regenerated;
+	try {
+		regenerated = await regenerateCredential(creds, credential.id, payload);
+	} catch (err) {
+		if (err instanceof GatewayError && err.status === 404) fail(`'${credential.name}' (${credential.prefix}) no longer exists in this workspace.`);
+		fail(errorText(err));
 	}
+	reveal(`Regenerated '${regenerated.name}'. Anything still presenting the old secret is refused from its very next request.`, regenerated, REGENERATED_SECRET_SHOWN_ONCE);
 }
-async function resumeScheduleCommand(target, subtarget, options = {}) {
-	const isVerbose = Boolean(options.verbose);
+async function revokeCredentialCommand(target, options) {
+	if (!target || !target.trim()) fail("No credential given. Usage: wawesome credentials revoke <name-or-prefix>");
 	const creds = requireCredentials();
-	const config = readFunctionConfig();
-	let funcName;
-	let scheduleName;
-	if (target && subtarget) {
-		funcName = target;
-		scheduleName = subtarget;
-	} else if (target) {
-		scheduleName = target;
-		funcName = options.function || config?.function;
-	}
-	if (options.function) funcName = options.function;
-	const appSlug = options.app || config?.app;
-	if (!scheduleName) {
-		console.error("[wawesome] Error: Missing schedule name.");
-		console.error("[wawesome] Usage: wawesome cron resume <schedule-name> or wawesome cron resume <function> <schedule-name>");
-		process.exit(1);
-	}
-	if (!funcName) {
-		console.error("[wawesome] Error: Missing function name.");
-		console.error("[wawesome] Usage: wawesome cron resume <function> <schedule-name> or specify -f/--function <name>.");
-		process.exit(1);
+	const credential = await resolveCredential(creds, target, options);
+	if (credential.revoked_at) {
+		console.log(`[wawesome] '${credential.name}' (${credential.prefix}) was already revoked at ${asUtc(credential.revoked_at)}. Nothing to do.`);
+		return;
 	}
-	const res = await resumeScheduleApi(creds.gateway_url, creds.tenant_jwt, funcName, scheduleName, appSlug, isVerbose);
-	if (!res.ok) {
-		const errorBody = await res.text();
-		if (res.status === 401 || res.status === 403) {
-			console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorBody)}`);
-			process.exit(1);
+	if (!options.yes) {
+		if (!isInteractive()) fail(`Revoking asks for confirmation, and there is nobody to ask.`, `Pass --yes to revoke '${credential.name}' (${credential.prefix}) without being asked.`);
+		let confirmed;
+		try {
+			confirmed = await confirm({
+				message: `Revoke '${credential.name}' (${credential.prefix})? Nothing un-revokes it.`,
+				default: false
+			});
+		} catch {
+			confirmed = false;
 		}
-		if (res.status === 404) {
-			console.error(`[wawesome] Error: Schedule '${scheduleName}' or function '${funcName}' not found.`);
-			process.exit(1);
+		if (!confirmed) {
+			console.log(`[wawesome] Cancelled. '${credential.name}' still works.`);
+			return;
 		}
-		const refusal = rejectionOf(errorBody, res.status, `Failed to resume schedule (HTTP ${res.status}).`);
-		console.error(`[wawesome] Error: ${refusal.message}`);
-		const advice = planLimitAdvice(refusal.reason) || (res.status === 402 ? `Where to resolve it: ${billingPageUrl()}` : "");
-		if (advice) console.error(`[wawesome] ${advice}`);
-		if (isVerbose) console.error(`[wawesome:verbose] Response: ${errorBody}`);
-		process.exit(1);
 	}
-	const data = await res.json();
-	const displayTarget = appSlug ? `${appSlug}/${funcName}` : funcName;
-	console.log(`[wawesome] ✔ Resumed schedule '${data.schedule.name}' on '${displayTarget}'.`);
-	console.log(`  ${whenItRuns(data.schedule)} (no backfill)`);
+	if (options.verbose) console.error(`[wawesome:verbose] POST ${creds.gateway_url}/v1/tenant/credentials/${credential.id}/revoke`);
+	let revoked;
+	try {
+		revoked = await revokeCredential(creds, credential.id);
+	} catch (err) {
+		if (err instanceof GatewayError && err.status === 404) fail(`'${credential.name}' (${credential.prefix}) no longer exists in this workspace.`);
+		fail(errorText(err));
+	}
+	console.log(`\n[wawesome] ✔ Revoked '${revoked.name}' (${revoked.prefix}).`);
+	console.log("[wawesome] Anything still presenting it is refused from its very next request.\n");
 }
-async function runHistoryCommand(target, options = {}) {
-	const isVerbose = Boolean(options.verbose);
+async function deleteCredentialCommand(target, options) {
+	if (!target || !target.trim()) fail("No credential given. Usage: wawesome credentials delete <name-or-prefix>");
 	const creds = requireCredentials();
-	const config = readFunctionConfig();
-	const funcName = target || options.function || config?.function;
-	const appSlug = options.app || config?.app;
-	if (!funcName) {
-		console.error("[wawesome] Error: Missing function name.");
-		console.error("[wawesome] Usage: wawesome cron history [function-name] or run inside a function directory with wawesome-function.json.");
-		process.exit(1);
-	}
-	const limit = options.limit ? Number(options.limit) : 50;
-	const stateFilter = options.state || options.status;
-	const res = await fetchBackgroundRunsApi(creds.gateway_url, creds.tenant_jwt, funcName, appSlug, {
-		state: stateFilter,
-		limit
-	}, isVerbose);
-	if (!res.ok) {
-		const errorBody = await res.text();
-		if (res.status === 401 || res.status === 403) {
-			console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorBody)}`);
-			process.exit(1);
+	const credential = await resolveCredential(creds, target, options);
+	const named = `'${credential.name}' (${credential.prefix})`;
+	if (statusOf(credential, Date.now()) === "active") fail(`${named} still works, and only a credential that has stopped working is deleted.`, `Revoke it first: wawesome credentials revoke ${credential.name}`);
+	if (!options.yes) {
+		if (!isInteractive()) fail("Deleting asks for confirmation, and there is nobody to ask.", `Pass --yes to delete ${named} without being asked.`);
+		console.log(`\n[wawesome] Deleting ${named} forgets it.`);
+		console.log(`[wawesome]   It leaves the listing, and the name '${credential.name}' comes free.`);
+		console.log("[wawesome]   Anything still presenting its secret is told the secret is unknown, rather");
+		console.log("[wawesome]   than that somebody here revoked it.\n");
+		let confirmed;
+		try {
+			confirmed = await confirm({
+				message: `Delete ${named}?`,
+				default: false
+			});
+		} catch {
+			confirmed = false;
 		}
-		if (res.status === 404) {
-			console.error(`[wawesome] Error: Function '${funcName}' not found.`);
-			process.exit(1);
+		if (!confirmed) {
+			console.log(`[wawesome] Cancelled. ${named} is still listed.`);
+			return;
 		}
-		const refusal = rejectionOf(errorBody, res.status, `Failed to fetch run history (HTTP ${res.status}).`);
-		console.error(`[wawesome] Error: ${refusal.message}`);
-		const advice = planLimitAdvice(refusal.reason) || (res.status === 402 ? `Where to resolve it: ${billingPageUrl()}` : "");
-		if (advice) console.error(`[wawesome] ${advice}`);
-		if (isVerbose) console.error(`[wawesome:verbose] Response: ${errorBody}`);
-		process.exit(1);
 	}
-	const data = await res.json();
-	const displayTarget = appSlug ? `${appSlug}/${funcName}` : funcName;
-	if (!data.runs || data.runs.length === 0) {
-		console.log(`[wawesome] No run history found for '${displayTarget}'.`);
-		return;
+	if (options.verbose) console.error(`[wawesome:verbose] DELETE ${creds.gateway_url}/v1/tenant/credentials/${credential.id}`);
+	try {
+		await deleteCredential(creds, credential.id);
+	} catch (err) {
+		if (err instanceof GatewayError && err.status === 404) fail(`${named} no longer exists in this workspace.`);
+		fail(errorText(err));
 	}
-	const total = data.total ?? data.runs.length;
-	console.log(`\n📜 \x1b[1mRun history for '${displayTarget}' (Showing ${data.runs.length} of ${total} records)\x1b[0m\n`);
-	const tableLines = formatRunHistoryTable(data.runs);
-	for (const line of tableLines) console.log(line);
-	console.log("");
+	console.log(`\n[wawesome] ✔ Deleted ${named}. The name '${credential.name}' is free again.`);
+	console.log("[wawesome] Anything still presenting its secret is told the secret is unknown.\n");
 }
-async function cronCommand(action, target, subtarget, options = {}) {
-	const normAction = (action || "").toLowerCase().trim();
-	if (!normAction || normAction === "list" || normAction === "ls") return listSchedulesCommand(target, options);
-	if (normAction === "pause") return pauseScheduleCommand(target, subtarget, options);
-	if (normAction === "resume") return resumeScheduleCommand(target, subtarget, options);
-	if (normAction === "history" || normAction === "runs" || normAction === "log" || normAction === "logs") return runHistoryCommand(target, options);
-	return listSchedulesCommand(action, options);
+async function credentialsCommand(action, target, options) {
+	if (!action || action === "list" || action === "ls") return listCredentialsCommand(options);
+	if (action === "mint") return mintCredentialCommand(target, options);
+	if (action === "regenerate") return regenerateCredentialCommand(target, options);
+	if (action === "revoke") return revokeCredentialCommand(target, options);
+	if (action === "delete") return deleteCredentialCommand(target, options);
+	fail(`Unknown credentials action '${action}'.`, "Usage: wawesome credentials [list|mint <name>|regenerate <name-or-prefix>|revoke <name-or-prefix>|delete <name-or-prefix>]");
 }
 //#endregion
 //#region src/index.ts
@@ -5516,19 +5787,23 @@ cli.command("credentials [action] [target]", "Mint, list, regenerate, revoke and
     revoke <name-or-prefix>         Revoke one, immediately and for good
     delete <name-or-prefix>         Forget a revoked or expired one, freeing its name
 
+  Presets (--preset), each the words one job needs, a write carrying its read:
+${presetsOffered("    ").join("\n")}
+
   Examples:
     wawesome credentials
     wawesome credentials mint ci-pipeline
-    wawesome credentials mint agent -c read,logs:read,invoke --expires never
-    wawesome credentials mint prod-deploy -c deploy -a prod --expires 30
-    wawesome credentials mint ci -c deploy,domains:attach -a prod
+    wawesome credentials mint viewer --preset viewer -a prod
+    wawesome credentials mint reader -c read:apps,read:functions,read:invocations -a prod
+    wawesome credentials mint ci --preset deployer --expires never
+    wawesome credentials mint ci -c write:apps,write:functions,write:env,read:tenant,write:domains -a prod
     wawesome credentials mint ci-pipeline > /tmp/secret
     wawesome credentials regenerate ci-pipeline
     wawesome credentials regenerate ci --expires never --yes
     wawesome credentials revoke ci-pipeline
     wawesome credentials revoke wawe_ab3k9x --yes
-    wawesome credentials delete ci-pipeline`).option("-c, --capability <capability>", "Capability to grant: deploy, read, logs:read, invoke, domains:attach (repeatable or comma-separated, default: deploy, which carries read)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated, default: every App)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-y, --yes", "Skip the confirmation a regenerate, revoke or delete asks for").option("-v, --verbose", "Enable verbose debug output").action((action, target, options) => credentialsCommand(action, target, options));
-cli.command("credentials mint <name>", "Mint a deploy credential, printing its secret exactly once").option("-c, --capability <capability>", "Capability to grant: deploy, read, logs:read, invoke, domains:attach (repeatable or comma-separated; deploy carries read)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-v, --verbose", "Enable verbose debug output").action((name, options) => mintCredentialCommand(name, options));
+    wawesome credentials delete ci-pipeline`).option("-c, --capability <capability>", "Capability to grant, as {read|write}:{resource}: read:apps, write:functions, write:env, write:runs and the rest (repeatable or comma-separated, default: what a deploy needs)").option("--preset <preset>", PRESET_FLAG_HELP).option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated, default: every App)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-y, --yes", "Skip the confirmation a regenerate, revoke or delete asks for").option("-v, --verbose", "Enable verbose debug output").action((action, target, options) => credentialsCommand(action, target, options));
+cli.command("credentials mint <name>", "Mint a deploy credential, printing its secret exactly once").option("-c, --capability <capability>", "Capability to grant, as {read|write}:{resource}: read:apps, write:functions, write:env, write:runs and the rest (repeatable or comma-separated; a write carries its read)").option("--preset <preset>", PRESET_FLAG_HELP).option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-v, --verbose", "Enable verbose debug output").action((name, options) => mintCredentialCommand(name, options));
 cli.command("credentials list", "List deploy credentials, never their secrets").alias("credentials ls").option("-v, --verbose", "Enable verbose debug output").action((options) => listCredentialsCommand(options));
 cli.command("credentials regenerate <name-or-prefix>", "Replace a deploy credential's secret, keeping its name, capabilities and Apps").option("--expires <days|never>", "Days until the regenerated credential expires, or 'never' (default: 90)").option("-y, --yes", "Regenerate without being asked to confirm").option("-v, --verbose", "Enable verbose debug output").action((target, options) => regenerateCredentialCommand(target, options));
 cli.command("credentials revoke <name-or-prefix>", "Revoke a deploy credential, immediately and for good").option("-y, --yes", "Revoke without being asked to confirm").option("-v, --verbose", "Enable verbose debug output").action((target, options) => revokeCredentialCommand(target, options));