wawesome 0.18.1 → 0.20.0

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { a as unsupportedGlobals, n as methodRemedy, r as polyfilledGlobals, t as declaredMethods } from "./guest-surface-CXON0L5V.mjs";
+import { a as unsupportedGlobals, n as methodRemedy, r as polyfilledGlobals, t as declaredMethods } from "./guest-surface-D5X-IMAN.mjs";
 import cac from "cac";
 import fs from "node:fs";
 import path from "node:path";
@@ -6,10 +6,10 @@ import { build } from "esbuild";
 import os from "node:os";
 import { parse } from "acorn";
 import { spawnSync } from "node:child_process";
+import crypto from "node:crypto";
 import http from "node:http";
-import readline from "node:readline";
 import { Readable } from "node:stream";
-import crypto from "node:crypto";
+import readline from "node:readline";
 import { confirm, select } from "@inquirer/prompts";
 import zlib from "node:zlib";
 //#region src/errors.ts
@@ -82,21 +82,6 @@ function reportSessionCommandRefused(secret, consequence) {
 }
 //#endregion
 //#region src/config.ts
-/**
-* Hardcoded Supabase project config for the wawesome.io platform.
-* These are public values — the anon key is designed to be embedded in clients.
-*/
-const SUPABASE_URL = "https://vclasavxxoufwymrutai.supabase.co";
-/**
-* Where the documents accepted at signup are published. Fixed rather than
-* resolved per environment: there is one website, and a signup has to be able
-* to link at something a person can actually read before they accept it.
-*/
-const LEGAL_URLS = {
-	terms: "https://wawesome.io/legal/terms-of-service",
-	privacy: "https://wawesome.io/legal/privacy-policy"
-};
-const SUPABASE_ANON_KEY = "sb_publishable_ZlgDAI9cNZkefEwVPKIngA_ktuvTpjD";
 /** Path to the user-level settings file (~/.wawesome/settings.json) */
 function getSettingsPath() {
 	return path.join(os.homedir(), ".wawesome", "settings.json");
@@ -149,18 +134,23 @@ function getDashboardUrl(overrideUrl) {
 /**
 * The dashboard for the environment this login is going to.
 *
-* The two addresses describe one environment, so the stored rung is read only
-* where the gateway being logged into is the one the credentials already name.
-* Carrying a dashboard across a change of gateway is the wrong workspace, and
-* so is dropping one where the gateway did not change at all.
-*/
-function resolveDashboardUrlForLogin(overrideUrl, gatewayUrl) {
-	const creds = readStoredCredentials();
-	const sameEnvironment = creds?.gateway_url === gatewayUrl;
-	return resolveAddress(overrideUrl, DASHBOARD_ENV_NAMES, "dashboard_url", sameEnvironment ? creds?.dashboard_url : void 0, DASHBOARD_URL_FALLBACK);
-}
-/** Localhost port used during OAuth callback */
-const OAUTH_CALLBACK_PORT = 9999;
+* Taken from the address the platform handed back to open, so a login that
+* configures nothing stores the dashboard belonging to the gateway it signed
+* into. An explicit flag, `DASHBOARD_URL` or a settings file still outrank it,
+* on the rung they outrank every other address on.
+*/
+function resolveDashboardUrlForLogin(overrideUrl, signInUrl) {
+	return resolveAddress(overrideUrl, DASHBOARD_ENV_NAMES, "dashboard_url", originOf(signInUrl), DASHBOARD_URL_FALLBACK);
+}
+/** Undefined rather than throwing: an unreadable address falls to the rung below. */
+function originOf(url) {
+	try {
+		return new URL(url).origin;
+	} catch {
+		return;
+	}
+}
+const LOGIN_CALLBACK_PORT = 9999;
 /** Path to the user-level credentials file */
 function getCredentialsPath() {
 	return path.join(os.homedir(), ".wawesome", "credentials.json");
@@ -905,61 +895,198 @@ async function buildHandler(entryInput, config, options) {
 * that has to name this version — `--version`, the dependency a scaffolded
 * project pins — reads it here, so a release bumps one file.
 */
-const CLI_VERSION = "0.18.1";
+const CLI_VERSION = "0.20.0";
 //#endregion
-//#region src/prompt.ts
+//#region src/cli-login.ts
+const START_PATH = "/v1/cli/login/start";
+const EXCHANGE_PATH = "/v1/cli/login/exchange";
+function mintProof() {
+	const verifier = crypto.randomBytes(32).toString("base64url");
+	return {
+		verifier,
+		challenge: crypto.createHash("sha256").update(verifier).digest("base64url")
+	};
+}
 /**
-* Open a prompt session on stdin, queueing lines as they arrive.
-*
-* Reading one `rl.question` at a time drops piped input: it lands as a single
-* chunk, so every line after the first is emitted with no question pending.
-* End of input answers the remaining questions with their defaults.
+* The address to open comes back from the platform rather than being composed
+* here: which dashboard belongs to a gateway is the gateway's own fact, and a
+* CLI that spelled it would be a CLI to reinstall whenever it moved.
 */
-function openPromptSession() {
-	const rl = readline.createInterface({
-		input: process.stdin,
-		output: process.stdout
+async function startSignIn(gatewayUrl, asked) {
+	const started = await post(gatewayUrl, START_PATH, {
+		redirect_uri: asked.redirectUri,
+		code_challenge: asked.challenge,
+		code_challenge_method: "S256",
+		state: asked.state
+	}, "The platform could not start a sign-in");
+	if (!started.sign_in_url) throw new Error("The platform started a sign-in without saying where to finish it.");
+	return started;
+}
+/**
+* The verifier travels here and nowhere else: it is what proves this terminal
+* is the one that started the sign-in.
+*/
+async function exchangeCode(gatewayUrl, code, verifier) {
+	const session = await post(gatewayUrl, EXCHANGE_PATH, {
+		code,
+		code_verifier: verifier
+	}, "This sign-in could not be finished");
+	if (!session.tenant_jwt || !session.refresh_token) throw new Error("The platform answered this sign-in with half a session.");
+	return session;
+}
+/**
+* The code, or the sign-in running out first.
+*
+* Without the deadline, a tab somebody walked away from leaves the terminal
+* waiting on a sign-in the platform has already forgotten.
+*/
+function waitForCode(answer, expiresAt) {
+	const runsOutIn = new Date(expiresAt).getTime() - Date.now();
+	if (!Number.isFinite(runsOutIn)) return answer;
+	let timer;
+	const ranOut = new Promise((_, reject) => {
+		timer = setTimeout(() => reject(/* @__PURE__ */ new Error("This sign-in ran out before the browser came back. Run 'wawesome login' again.")), Math.max(runsOutIn, 0));
 	});
-	const queued = [];
-	const waiting = [];
-	let ended = false;
-	rl.on("line", (line) => {
-		const next = waiting.shift();
-		if (next) next(line);
-		else queued.push(line);
+	return Promise.race([answer, ranOut]).finally(() => clearTimeout(timer));
+}
+async function post(gatewayUrl, path, body, fallback) {
+	const res = await fetch(`${gatewayUrl}${path}`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body)
 	});
-	rl.on("close", () => {
-		ended = true;
-		while (waiting.length > 0) waiting.shift()?.(null);
+	if (!res.ok) throw await asGatewayError(res, `${fallback} (HTTP ${res.status}).`);
+	return await res.json();
+}
+//#endregion
+//#region src/login-callback.ts
+/**
+* Where a browser hands a finished sign-in back to this terminal.
+*
+* Two things make the answer this server takes the developer's own. It binds
+* loopback, so nothing on the network can reach it. And it mints a `state` that
+* travels out with the sign-in and has to come back with the answer, so a page
+* open in another tab cannot hand this CLI a code belonging to somebody else.
+* Everything that fails either test is turned away in prose, and the login
+* stays open for the tab it did open — a stray request is not a reason to end a
+* sign-in a developer is in the middle of.
+*
+* What arrives is a single-use code bound to a verifier this process never
+* sent anywhere but the exchange, which is why it may ride in a URL where an
+* access token never could.
+*/
+/** The address is `localhost` so the platform's loopback rule still matches it. */
+const CALLBACK_HOST = "localhost";
+const LOOPBACK = "127.0.0.1";
+const REFUSED_ELSEWHERE = "This sign-in did not come from the login running in your terminal, so it was refused. Nothing was signed in. Run 'wawesome login' again and finish in the tab it opens.";
+const NO_CODE = "The browser came back from the sign-in without a code. Nothing was signed in — run 'wawesome login' again.";
+async function listenForLoginCallback({ port = LOGIN_CALLBACK_PORT } = {}) {
+	const state = crypto.randomBytes(32).toString("base64url");
+	let settle = () => {};
+	let refuse = () => {};
+	const answer = new Promise((resolve, reject) => {
+		settle = resolve;
+		refuse = reject;
 	});
-	function nextLine() {
-		if (queued.length > 0) return Promise.resolve(queued.shift());
-		if (ended) return Promise.resolve(null);
-		return new Promise((resolve) => waiting.push(resolve));
-	}
+	const server = http.createServer((req, res) => {
+		try {
+			handle(req, res, {
+				state,
+				settle,
+				refuse
+			});
+		} catch {
+			if (res.headersSent || res.destroyed) return;
+			res.writeHead(500, { "Content-Type": "text/plain" });
+			res.end("This login could not read what the browser sent. Nothing was signed in.");
+		}
+	});
+	const listening = await listen(server, port);
 	return {
-		async ask(question, defaultVal) {
-			const offered = defaultVal ? ` (${defaultVal})` : "";
-			process.stdout.write(`${question}${offered}: `);
-			const line = await nextLine();
-			if (line === null) {
-				process.stdout.write("\n");
-				return defaultVal;
-			}
-			return line.trim() || defaultVal;
-		},
-		close() {
-			rl.close();
+		redirectUrl: `http://${CALLBACK_HOST}:${listening}/callback`,
+		state,
+		answer,
+		close: () => {
+			server.closeAllConnections();
+			server.close();
 		}
 	};
 }
+function handle(req, res, login) {
+	const url = new URL(req.url || "/", `http://${LOOPBACK}`);
+	if (url.pathname !== "/callback") {
+		res.writeHead(404, { "Content-Type": "text/plain" });
+		res.end("Not Found");
+		return;
+	}
+	if (!isThisLogin(url.searchParams.get("state"), login.state)) {
+		reportStranger();
+		res.writeHead(400, { "Content-Type": "text/html" });
+		res.end(page("Sign-in refused", REFUSED_ELSEWHERE));
+		return;
+	}
+	const refused = url.searchParams.get("error_description") || url.searchParams.get("error");
+	if (refused) return report(res, login, `The sign-in was refused: ${refused}`);
+	const code = url.searchParams.get("code");
+	if (!code) return report(res, login, NO_CODE);
+	res.writeHead(200, { "Content-Type": "text/html" });
+	res.end(page("Signed in", "You can close this tab and go back to your terminal."));
+	login.settle(code);
+}
 /**
-* Whether a question can actually be put to somebody. A piped or redirected
-* stdin still answers — with end-of-input — so this only tells a caller whether
-* a *default* is going to be what the user gets.
-*/
-function isInteractive() {
-	return Boolean(process.stdin.isTTY);
+* Say, in the terminal, that a request nobody asked for was turned away.
+*
+* The login itself is left open on purpose. Ending it here would mean any page
+* that can reach loopback could end a developer's sign-in by asking once, and
+* the tab this login did open is still coming.
+*/
+function reportStranger() {
+	console.error("[wawesome] Refused a sign-in that did not carry this login's state. Nothing was signed in, and this login is still waiting for the tab it opened.");
+}
+/** A failure of this login: said on the page, and thrown in the terminal. */
+function report(res, login, said) {
+	res.writeHead(400, { "Content-Type": "text/html" });
+	res.end(page("Sign-in refused", said));
+	login.refuse(new Error(said));
+}
+function isThisLogin(given, expected) {
+	if (!given) return false;
+	const a = Buffer.from(given);
+	const b = Buffer.from(expected);
+	return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+function listen(server, port) {
+	return new Promise((resolve, reject) => {
+		server.once("error", (err) => {
+			if (err.code === "EADDRINUSE") return reject(/* @__PURE__ */ new Error(`Port ${port} is already in use, and that is where the browser hands the sign-in back. Stop whatever is holding it — often an earlier 'wawesome login' that never finished — then run 'wawesome login' again.`));
+			reject(err);
+		});
+		server.listen(port, LOOPBACK, () => {
+			const address = server.address();
+			if (typeof address === "string" || address === null) return reject(/* @__PURE__ */ new Error("The callback server started without an address."));
+			resolve(address.port);
+		});
+	});
+}
+const STYLE = "font-family: system-ui; text-align: center; padding: 50px; background: #0f172a; color: #f8fafc;";
+function page(title, said) {
+	return `<!DOCTYPE html>
+<html>
+<head><title>wawesome — ${escapeHtml(title.toLowerCase())}</title></head>
+<body style="${STYLE}">
+<h2>${escapeHtml(title)}</h2>
+<p>${escapeHtml(said)}</p>
+</body>
+</html>`;
+}
+function escapeHtml(text) {
+	return text.replace(/[&<>"']/g, (char) => ({
+		"&": "&amp;",
+		"<": "&lt;",
+		">": "&gt;",
+		"\"": "&quot;",
+		"'": "&#39;"
+	})[char] || char);
 }
 //#endregion
 //#region src/session.ts
@@ -1015,9 +1142,9 @@ function forgetRenewedSession() {
 	renewedAt = 0;
 }
 /**
-* Supabase rotates the refresh token on every use and revokes the whole family
-* if a spent one comes back, so requests that meet the 401 together share one
-* renewal instead of racing with the same token.
+* The platform rotates the refresh token on every use, and a token from a
+* generation it has moved past ends the session, so requests that meet the 401
+* together share one renewal instead of racing with the same token.
 */
 function renewSession() {
 	if (!renewal) {
@@ -1036,50 +1163,114 @@ function renewSession() {
 async function renewOnce() {
 	const creds = readCredentials();
 	if (!creds?.refresh_token) return null;
-	const session = await refreshSupabaseSession(creds.refresh_token);
-	const exchanged = await exchangeForTenantJwt(creds, session.access_token);
+	return storeRenewed(creds, await renewedSession(creds));
+}
+/**
+* What this process has learned about the session is written down beside it, so
+* a request still holding the old token does not spend a second 401 finding
+* out.
+*/
+function storeRenewed(creds, session) {
 	const renewed = {
 		...creds,
-		tenant_jwt: exchanged.tenant_jwt,
-		refresh_token: session.refresh_token || creds.refresh_token,
-		tenant_slug: exchanged.tenant_slug || creds.tenant_slug,
-		tenant_name: exchanged.tenant_name || creds.tenant_name
+		tenant_jwt: session.tenant_jwt,
+		refresh_token: session.refresh_token,
+		tenant_id: session.tenant_id || creds.tenant_id,
+		tenant_slug: session.tenant_slug || creds.tenant_slug,
+		tenant_name: session.tenant_name || creds.tenant_name,
+		user_email: session.email || creds.user_email
 	};
 	writeCredentials(renewed);
 	renewedJwt = renewed.tenant_jwt;
 	renewedAt = Date.now();
 	return renewed;
 }
-async function refreshSupabaseSession(refreshToken) {
-	const res = await fetch(`${SUPABASE_URL}/auth/v1/token?grant_type=refresh_token`, {
+/** Where a terminal renews, and where `logout` ends its session on the server. */
+const SESSION_REFRESH_PATH = "/v1/cli/session/refresh";
+const SESSION_REVOKE_PATH = "/v1/cli/session/revoke";
+/** Where the workspaces this session could move to are read. */
+const SESSION_WORKSPACES_PATH = "/v1/cli/session/workspaces";
+/**
+* Renew against this platform. The refresh token is what authenticates the
+* request, and the only other thing it ever carries is the workspace a
+* `workspace switch` is moving the session to.
+*/
+async function renewedSession(creds, tenantId) {
+	const res = await fetch(`${creds.gateway_url}${SESSION_REFRESH_PATH}`, {
 		method: "POST",
-		headers: {
-			apikey: SUPABASE_ANON_KEY,
-			"Content-Type": "application/json"
-		},
-		body: JSON.stringify({ refresh_token: refreshToken })
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			refresh_token: creds.refresh_token,
+			tenant_id: tenantId
+		})
 	});
-	if (res.status >= 400 && res.status < 500 && res.status !== 429) endSession("Your sign-in was revoked or has expired, so the session could not be renewed.");
-	if (!res.ok) throw new Error(`Could not renew your session (Supabase HTTP ${res.status}).`);
+	if (res.status === 429) throw await asGatewayError(res, "The platform is rate limiting this session's renewals.");
+	if (res.status >= 400 && res.status < 500) {
+		const refused = await asGatewayError(res, "Your session could not be renewed.");
+		if (tenantId && refused.reason === "not-a-member") throw refused;
+		endSession(refused.message);
+	}
+	if (!res.ok) throw new Error(`Could not renew your session (HTTP ${res.status}).`);
 	const session = await res.json();
-	if (!session.access_token) throw new Error("Could not renew your session (Supabase returned no access token).");
+	if (!session.tenant_jwt || !session.refresh_token) throw new Error("Could not renew your session (the platform answered half a session).");
 	return session;
 }
-async function exchangeForTenantJwt(creds, supabaseAccessToken) {
-	const res = await fetch(`${creds.gateway_url}/api/v1/auth/token-exchange`, {
+/**
+* The workspaces this session could move to. On the refresh token, which is
+* what makes the question answerable at all: the token belongs to the person,
+* where the tenant token names one workspace.
+*/
+async function readWorkspaces(creds) {
+	const res = await fetch(`${creds.gateway_url}${SESSION_WORKSPACES_PATH}`, {
 		method: "POST",
-		headers: {
-			Authorization: `Bearer ${supabaseAccessToken}`,
-			"Content-Type": "application/json"
-		},
-		body: JSON.stringify({ tenant_id: creds.tenant_id })
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({ refresh_token: creds.refresh_token })
 	});
-	if (res.status === 401 || res.status === 403) endSession("Your access to this workspace has been withdrawn.");
-	if (!res.ok) throw new Error(`Could not renew your session (token exchange HTTP ${res.status}).`);
+	if (!res.ok) throw await asGatewayError(res, `Your workspaces could not be read (HTTP ${res.status}).`);
 	return await res.json();
 }
-function endSession(reason) {
-	console.error(`[wawesome] Error: ${reason} Run 'wawesome login' to sign in again.`);
+/**
+* Move the session to another workspace, which is a renewal that names it. No
+* browser: the refresh token is the person's, and the **Membership** the
+* platform checks is theirs too.
+*/
+async function switchWorkspaceTo(creds, tenantId) {
+	return storeRenewed(creds, await renewedSession(creds, tenantId));
+}
+/**
+* End the session on the server, which is what makes a copy of the credentials
+* file worthless once its owner has signed out.
+*
+* Answers why the session may still be open, and `null` where it is over. A
+* refusal is not a session left open — a token the platform will not take names
+* a session that is already gone — but a platform that could not answer at all
+* leaves one standing, and the file holding the only copy of the token that
+* could end it is then worth keeping.
+*/
+async function revokeSession(creds) {
+	if (!creds.refresh_token) return null;
+	try {
+		const res = await fetch(`${creds.gateway_url}${SESSION_REVOKE_PATH}`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ refresh_token: creds.refresh_token })
+		});
+		if (res.ok || res.status < 500) return null;
+		return (await asGatewayError(res, `The platform answered HTTP ${res.status}.`)).message;
+	} catch (err) {
+		return err instanceof Error ? err.message : String(err);
+	}
+}
+/**
+* What the platform said, and what to do about it.
+*
+* The next action is added only where the platform did not already name one:
+* its own refusals for a dead session end by saying to sign in again, and
+* repeating that reads like a stutter.
+*/
+function endSession(said) {
+	const next = said.includes("wawesome login") ? "" : " Run 'wawesome login' to sign in again.";
+	console.error(`[wawesome] Error: ${said}${next}`);
 	process.exit(1);
 }
 //#endregion
@@ -1169,141 +1360,37 @@ async function renameTenantSlug(creds, slug) {
 }
 //#endregion
 //#region src/auth.ts
-/**
-* Ask what to call the workspace being created.
-*
-* There is no default worth offering: a name nobody typed is exactly what this
-* replaced. A non-interactive login has nobody to ask, so it says what flag to
-* pass rather than inventing one and minting a workspace under it.
-*/
-async function promptForWorkspaceName(options) {
-	const supplied = options.workspace?.trim();
-	if (supplied) return supplied;
-	if (!isInteractive()) throw new Error("No workspace found, and no name to create one with. Re-run with --workspace <name>.");
-	console.log("\n[wawesome] You don't have a workspace yet. Let's create one.");
-	console.log("  (this is the name you'll see in the dashboard; its public address is set separately)");
-	const session = openPromptSession();
-	try {
-		for (let attempt = 0; attempt < 3; attempt++) {
-			const answer = await session.ask("  Workspace name?", "");
-			if (answer.trim()) return answer.trim();
-			console.log("[wawesome] A workspace needs a name.");
-		}
-	} finally {
-		session.close();
-	}
-	throw new Error("No workspace name given. Nothing was created.");
-}
-/**
-* Ask the person to accept the terms, which is what creating a workspace
-* through this door means too.
-*
-* Declining is the default answer, not the one that needs typing: end of input
-* takes the default, so a piped login that says nothing has accepted nothing —
-* the terminal's version of an unticked box. The flag is a word from the person
-* running the command rather than a prompt, so a pipeline reads the same as a
-* terminal, and both documents are linked either way.
-*/
-async function confirmTermsAccepted(options) {
-	if (options.acceptTerms) return;
-	if (!isInteractive()) throw new Error(`Creating a workspace means accepting the terms of service and the privacy policy, and there is no terminal to ask in. Read ${LEGAL_URLS.terms} and ${LEGAL_URLS.privacy}, then re-run with --accept-terms.`);
-	console.log("\n[wawesome] Creating a workspace means accepting:");
-	console.log(`    Terms of Service   ${LEGAL_URLS.terms}`);
-	console.log(`    Privacy Policy     ${LEGAL_URLS.privacy}`);
-	const session = openPromptSession();
-	try {
-		const answer = await session.ask("  Accept both?", "n");
-		if (/^y(es)?$/i.test(answer.trim())) return;
-	} finally {
-		session.close();
-	}
-	throw new Error("The terms were not accepted. Nothing was created.");
-}
-/**
-* Turn a finished OAuth callback into stored credentials.
-*
-* Split from the callback server so what login stores can be exercised without
-* a browser and a port.
-*/
-async function completeLogin({ gatewayUrl, dashboardUrl, accessToken, refreshToken, options }) {
-	const isVerbose = Boolean(options.verbose);
-	console.log("[wawesome] Fetching your workspaces...");
-	const tenantsRes = await fetch(`${gatewayUrl}/api/v1/me/tenants`, { headers: { Authorization: `Bearer ${accessToken}` } });
-	if (!tenantsRes.ok) throw new Error(`Failed to fetch tenants (HTTP ${tenantsRes.status}). Have you completed onboarding?`);
-	const tenants = await tenantsRes.json();
-	let primaryTenantId;
-	let workspaceName;
-	let workspaceSlug;
-	if (tenants.length === 0) {
-		const chosenName = await promptForWorkspaceName(options);
-		await confirmTermsAccepted(options);
-		console.log(`[wawesome] Creating workspace "${chosenName}"...`);
-		const initRes = await fetch(`${gatewayUrl}/api/v1/onboarding/init`, {
-			method: "POST",
-			headers: {
-				Authorization: `Bearer ${accessToken}`,
-				"Content-Type": "application/json"
-			},
-			body: JSON.stringify({
-				tenant_name: chosenName,
-				accepted_terms: true
-			})
-		});
-		if (!initRes.ok) throw await asGatewayError(initRes, `Failed to initialize workspace (HTTP ${initRes.status}).`);
-		const initData = await initRes.json();
-		primaryTenantId = initData.tenant_id;
-		workspaceSlug = initData.tenant_slug;
-		workspaceName = initData.tenant_name || chosenName;
-	} else primaryTenantId = tenants[0].tenant_id;
-	if (isVerbose) console.log(`[wawesome:verbose] Using tenant: ${primaryTenantId}`);
-	console.log("[wawesome] Exchanging for tenant-scoped credentials...");
-	const exchangeRes = await fetch(`${gatewayUrl}/api/v1/auth/token-exchange`, {
-		method: "POST",
-		headers: {
-			Authorization: `Bearer ${accessToken}`,
-			"Content-Type": "application/json"
-		},
-		body: JSON.stringify({ tenant_id: primaryTenantId })
-	});
-	if (!exchangeRes.ok) throw new Error(`Token exchange failed (HTTP ${exchangeRes.status}).`);
-	const exchangeData = await exchangeRes.json();
-	workspaceSlug = exchangeData.tenant_slug || workspaceSlug;
-	workspaceName = exchangeData.tenant_name || workspaceName;
-	let userEmail = exchangeData.email || "unknown";
-	try {
-		const payloadPart = exchangeData.tenant_jwt.split(".")[1];
-		const decoded = JSON.parse(Buffer.from(payloadPart, "base64url").toString("utf-8"));
-		if (decoded.email) userEmail = decoded.email;
-	} catch {}
+function storeSession({ gatewayUrl, dashboardUrl, session }) {
 	forgetRenewedSession();
 	writeCredentials({
 		gateway_url: gatewayUrl,
 		dashboard_url: dashboardUrl,
-		tenant_jwt: exchangeData.tenant_jwt,
-		refresh_token: refreshToken,
-		tenant_id: primaryTenantId,
-		user_email: userEmail,
-		tenant_slug: workspaceSlug,
-		tenant_name: workspaceName
+		tenant_jwt: session.tenant_jwt,
+		refresh_token: session.refresh_token,
+		tenant_id: session.tenant_id,
+		user_email: session.email,
+		tenant_slug: session.tenant_slug,
+		tenant_name: session.tenant_name
 	});
 	console.log("\n======================================================");
 	console.log("🎉 \x1B[32mLOGIN SUCCESSFUL!\x1B[0m");
 	console.log("======================================================");
-	if (workspaceName) console.log(`\n  Workspace: ${workspaceName}`);
-	if (workspaceSlug) console.log(`  Address:   ${workspaceSlug}`);
-	console.log(`  Tenant:    ${primaryTenantId}`);
+	if (session.tenant_name) console.log(`\n  Workspace: ${session.tenant_name}`);
+	if (session.tenant_slug) console.log(`  Address:   ${session.tenant_slug}`);
+	console.log(`  Tenant:    ${session.tenant_id}`);
 	console.log(`  Gateway:   ${gatewayUrl}`);
-	console.log(`  Email:     ${userEmail}`);
+	console.log(`  Email:     ${session.email}`);
 	console.log("\n  Credentials saved to ~/.wawesome/credentials.json");
 	console.log("======================================================\n");
 }
 /**
-* OAuth login flow:
-* 1. Build Supabase OAuth URL
-* 2. Open browser
-* 3. Listen on localhost for callback with access_token
-* 4. Exchange Supabase JWT for tenant-scoped JWT via gateway
-* 5. Store credentials in ~/.wawesome/credentials.json
+* Sign in: open the browser at the page built for it, and wait on loopback.
+*
+* Everything a person chooses happens there — which identity they sign in with,
+* which workspace the terminal acts in, and making one where they hold none —
+* so this end asks for nothing and knows no identity provider (#1113). What the
+* browser hands back is a single-use code, spent here against a verifier that
+* left this process only at the exchange.
 */
 async function login(options) {
 	const credential = credentialFromEnvironment();
@@ -1312,102 +1399,63 @@ async function login(options) {
 		process.exit(1);
 	}
 	const gatewayUrl = resolveGatewayUrlWithoutSession(options.gateway || options.api);
-	const dashboardUrl = resolveDashboardUrlForLogin(options.dashboard, gatewayUrl);
-	const provider = options.provider || "github";
 	const isVerbose = Boolean(options.verbose);
-	const authUrl = `${SUPABASE_URL}/auth/v1/authorize?provider=${provider}&redirect_to=${encodeURIComponent(`http://localhost:${OAUTH_CALLBACK_PORT}/callback`)}`;
-	console.log(`[wawesome] Starting ${provider} OAuth login...`);
 	console.log(`[wawesome] Gateway: ${gatewayUrl}`);
-	if (isVerbose) {
-		console.log(`[wawesome:verbose] Supabase URL: ${SUPABASE_URL}`);
-		console.log(`[wawesome:verbose] Auth URL: ${authUrl}`);
-	}
-	return new Promise((resolve, reject) => {
-		const server = http.createServer(async (req, res) => {
-			const reqUrl = new URL(req.url || "/", `http://localhost:${OAUTH_CALLBACK_PORT}`);
-			if (reqUrl.pathname === "/callback") {
-				res.writeHead(200, { "Content-Type": "text/html" });
-				res.end(`
-          <!DOCTYPE html>
-          <html>
-          <head><title>wawesome - Authentication</title></head>
-          <body style="font-family: system-ui; text-align: center; padding: 50px; background: #0f172a; color: #f8fafc;">
-            <h2>🔐 Authenticating with ${provider}...</h2>
-            <p>Transferring auth tokens back to CLI terminal...</p>
-            <script>
-              const hash = window.location.hash.substring(1);
-              const params = new URLSearchParams(hash);
-              const accessToken = params.get('access_token');
-              const refreshToken = params.get('refresh_token');
-
-              if (accessToken) {
-                fetch('/token?access_token=' + encodeURIComponent(accessToken) + '&refresh_token=' + encodeURIComponent(refreshToken || ''))
-                  .then(() => {
-                    document.body.innerHTML = '<h1>✅ Success!</h1><p>You can close this tab and return to your terminal.</p>';
-                  });
-              } else {
-                document.body.innerHTML = '<h1>❌ Error</h1><p>No access token found in URL hash.</p>';
-              }
-            <\/script>
-          </body>
-          </html>
-        `);
-				return;
-			}
-			if (reqUrl.pathname === "/token") {
-				const accessToken = reqUrl.searchParams.get("access_token");
-				const refreshToken = reqUrl.searchParams.get("refresh_token");
-				res.writeHead(200, { "Content-Type": "text/plain" });
-				res.end("Token received by CLI.");
-				if (!accessToken) {
-					console.error("[wawesome] Error: No access token received.");
-					server.close();
-					reject(/* @__PURE__ */ new Error("No access token received"));
-					return;
-				}
-				if (isVerbose) console.log("[wawesome:verbose] Supabase access token received.");
-				try {
-					await completeLogin({
-						gatewayUrl,
-						dashboardUrl,
-						accessToken,
-						refreshToken: refreshToken || void 0,
-						options
-					});
-					server.close();
-					resolve();
-				} catch (err) {
-					console.error(`[wawesome] Login failed: ${err instanceof Error ? err.message : err}`);
-					server.close();
-					reject(err);
-				}
-			} else {
-				res.writeHead(404, { "Content-Type": "text/plain" });
-				res.end("Not Found");
-			}
+	const callback = await listenForLoginCallback().catch((err) => {
+		console.error(`[wawesome] Error: ${errorText(err)}`);
+		process.exit(1);
+	});
+	const proof = mintProof();
+	try {
+		const started = await startSignIn(gatewayUrl, {
+			redirectUri: callback.redirectUrl,
+			challenge: proof.challenge,
+			state: callback.state
 		});
-		server.listen(OAUTH_CALLBACK_PORT, async () => {
-			console.log(`\n🌐 Listening for OAuth callback on http://localhost:${OAUTH_CALLBACK_PORT}/callback ...`);
-			console.log(`🚀 Opening browser for ${provider} authentication...`);
-			console.log(`👉 ${authUrl}\n`);
-			try {
-				const open = (await import("open")).default;
-				await open(authUrl);
-			} catch {
-				console.log("[wawesome] Could not open browser automatically. Please visit the URL above manually.");
-			}
+		if (isVerbose) console.log(`[wawesome:verbose] Sign-in: ${started.request}`);
+		console.log(`\n🌐 Waiting for the browser to come back to ${callback.redirectUrl} ...`);
+		console.log("🚀 Opening your browser to finish signing in...");
+		console.log(`👉 ${started.sign_in_url}\n`);
+		try {
+			const open = (await import("open")).default;
+			await open(started.sign_in_url);
+		} catch {
+			console.log("[wawesome] Could not open browser automatically. Please visit the URL above manually.");
+		}
+		const session = await exchangeCode(gatewayUrl, await waitForCode(callback.answer, started.expires_at), proof.verifier);
+		storeSession({
+			gatewayUrl,
+			dashboardUrl: resolveDashboardUrlForLogin(options.dashboard, started.sign_in_url),
+			session
 		});
-	});
+	} catch (err) {
+		console.error(`[wawesome] Login failed: ${errorText(err)}`);
+		throw err;
+	} finally {
+		callback.close();
+	}
 }
 /**
-* Clear stored credentials.
+* End the session, on the server and then on disk.
+*
+* The server first, because that is the half that makes a copy of the
+* credentials file worthless. Where the platform could not answer at all, the
+* file stays: it holds the only copy of the token that could end the session,
+* and deleting it would leave one open with nothing able to close it.
 */
-function logout() {
+async function logout() {
 	const credential = credentialFromEnvironment();
 	if (credential) {
 		reportSessionCommandRefused(credential, "The next command would authenticate all the same.");
 		process.exit(1);
 	}
+	const creds = readCredentials();
+	const stillOpen = creds ? await revokeSession(creds) : null;
+	if (stillOpen) {
+		console.error(`[wawesome] Error: your session could not be ended: ${stillOpen}`);
+		console.error("[wawesome] You are still signed in, and your credentials were kept. Run 'wawesome logout' again once you can reach the platform.");
+		process.exit(1);
+	}
 	forgetRenewedSession();
 	if (deleteCredentials()) console.log("[wawesome] ✅ Logged out. Credentials removed.");
 	else console.log("[wawesome] Not logged in (no credentials found).");
@@ -1544,6 +1592,17 @@ function wrapped(said) {
 function indented(said) {
 	return wrapped(said).map((line) => `${VALUE_COLUMN}${line}`);
 }
+/**
+* What fits in `room` characters, with an ellipsis where it does not. Cut
+* rather than wrapped: a row that took two lines would push the row above it
+* out of sight. A room too small for even that shows nothing, so nothing ever
+* runs past the width it was given.
+*/
+function truncate(said, room) {
+	if (said.length <= room) return said;
+	if (room <= 1) return "";
+	return `${said.slice(0, room - 1)}…`;
+}
 //#endregion
 //#region src/domains.ts
 /**
@@ -2281,6 +2340,61 @@ function manifestOf(assets) {
 	}));
 }
 //#endregion
+//#region src/prompt.ts
+/**
+* Open a prompt session on stdin, queueing lines as they arrive.
+*
+* Reading one `rl.question` at a time drops piped input: it lands as a single
+* chunk, so every line after the first is emitted with no question pending.
+* End of input answers the remaining questions with their defaults.
+*/
+function openPromptSession() {
+	const rl = readline.createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	const queued = [];
+	const waiting = [];
+	let ended = false;
+	rl.on("line", (line) => {
+		const next = waiting.shift();
+		if (next) next(line);
+		else queued.push(line);
+	});
+	rl.on("close", () => {
+		ended = true;
+		while (waiting.length > 0) waiting.shift()?.(null);
+	});
+	function nextLine() {
+		if (queued.length > 0) return Promise.resolve(queued.shift());
+		if (ended) return Promise.resolve(null);
+		return new Promise((resolve) => waiting.push(resolve));
+	}
+	return {
+		async ask(question, defaultVal) {
+			const offered = defaultVal ? ` (${defaultVal})` : "";
+			process.stdout.write(`${question}${offered}: `);
+			const line = await nextLine();
+			if (line === null) {
+				process.stdout.write("\n");
+				return defaultVal;
+			}
+			return line.trim() || defaultVal;
+		},
+		close() {
+			rl.close();
+		}
+	};
+}
+/**
+* Whether a question can actually be put to somebody. A piped or redirected
+* stdin still answers — with end-of-input — so this only tells a caller whether
+* a *default* is going to be what the user gets.
+*/
+function isInteractive() {
+	return Boolean(process.stdin.isTTY);
+}
+//#endregion
 //#region ../shared/public-address.ts
 const INVOCATION_PREFIX = "/x";
 const SLUG_SEPARATOR = "--";
@@ -2370,6 +2484,20 @@ async function invocationSurfaceOrNone(gatewayUrl) {
 function pathFormBase(origin, tenantSlug) {
 	return `${trimTrailingSlashes(origin)}${INVOCATION_PREFIX}/${encodeURIComponent(tenantSlug)}`;
 }
+/**
+* The legal DNS label closest to what somebody typed, empty where nothing legal
+* survives. What a workspace name suggests as an address, and what the CLI
+* offers as a default — never applied to a typed address, which is refused
+* rather than rewritten into a name nobody chose.
+*/
+function slugifyLabel(raw) {
+	let label = "";
+	for (const c of raw.trim().toLowerCase()) if (c >= "a" && c <= "z" || c >= "0" && c <= "9") label += c;
+	else if (label.length > 0 && !label.endsWith("-")) label += "-";
+	label = label.slice(0, 63);
+	while (label.endsWith("-")) label = label.slice(0, -1);
+	return label;
+}
 /** Must match `dns_label::is_legal` in `server/crates/core/src/value_objects.rs`. */
 function isLegalDnsLabel(candidate) {
 	return candidate.length > 0 && candidate.length <= 63 && !candidate.startsWith("-") && !candidate.endsWith("-") && !candidate.includes("--") && /^[a-z0-9-]+$/.test(candidate);
@@ -2910,7 +3038,8 @@ async function cronCommand(action, target, subtarget, options = {}) {
 * The address a **Document** answers at, relative to its Function's mount: a
 * request path whose last segment carries no extension resolves to that path,
 * to it with `.html` appended and to it with `/index.html` appended, so both
-* `about.html` and `about/index.html` are the address `about`.
+* `about.html` and `about/index.html` are the address `about`. A last segment
+* spelled `index` skips the middle one, which is what this strips first.
 */
 function documentAddressPath(assetPath) {
 	return assetPath.replace(/(^|\/)index\.html$/, "").replace(/\.html$/, "");
@@ -3037,6 +3166,17 @@ function declaredFields(declared) {
 	};
 }
 /**
+* What this deploy says it carries.
+*
+* Trimmed here so that a flag whose value came out of a shell variable nobody
+* set is a deploy that said nothing rather than one the gateway turns down. How
+* long a message may be and whether it is one line are the platform's rule, and
+* holding them here as well is two places for them to drift.
+*/
+function declaredMessage(stated) {
+	return typeof stated === "string" ? stated.trim() || void 0 : void 0;
+}
+/**
 * The fallback this project declares.
 *
 * A declaration missing either half is refused here rather than at the gateway,
@@ -3107,7 +3247,8 @@ async function deploy(entryInput, options) {
 		visibility: declaredVisibility(config.visibility),
 		confirmPublish: Boolean(options.publish),
 		confirmAssetDrop: Boolean(options.dropAssets),
-		fallback: declaredFallback(config.fallback)
+		fallback: declaredFallback(config.fallback),
+		message: declaredMessage(options.message)
 	};
 	const domainName = declaredDomain(config.domain);
 	if (isVerbose) {
@@ -3166,7 +3307,10 @@ async function deploy(entryInput, options) {
 	console.log(`[wawesome] Uploading code for ${app}/${funcName}...`);
 	const uploadUrl = `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/code`;
 	if (isVerbose) console.log(`[wawesome:verbose] POST ${uploadUrl}`);
-	const declaredOnTheWire = declaredFields(declared);
+	const declaredOnTheWire = {
+		...declaredFields(declared),
+		...declared.message ? { message: declared.message } : {}
+	};
 	const uploadRes = assets.length > 0 || declaresSchedules || declaresFallback || Object.keys(declaredOnTheWire).length > 0 || jsCode === null ? await authorizedFetch(uploadUrl, {
 		method: "POST",
 		headers: {
@@ -3190,7 +3334,7 @@ async function deploy(entryInput, options) {
 	});
 	if (!uploadRes.ok) {
 		const errorBody = await uploadRes.text();
-		const refusal = rejectionOf(errorBody, uploadRes.status, "Version with this code bundle already exists.");
+		const refusal = rejectionOf(errorBody, uploadRes.status, uploadRes.status === 409 ? "Version with this code bundle already exists." : `Code upload failed (HTTP ${uploadRes.status}).`);
 		if (uploadRes.status === 401 || uploadRes.status === 403) console.error(`[wawesome] Error: ${unauthorizedMessage(uploadRes.status, errorBody)}`);
 		else if (refusal.reason === "paid-plan-required") {
 			console.error(`\n[wawesome] \x1b[31mError: ${refusal.message}\x1b[0m`);
@@ -3212,7 +3356,7 @@ async function deploy(entryInput, options) {
 				console.error("[wawesome] To switch active version, run: \x1B[36mwawesome version switch\x1B[0m\n");
 			}
 		} else {
-			console.error(`[wawesome] Error: Code upload failed (HTTP ${uploadRes.status}).`);
+			console.error(`\n[wawesome] \x1b[31mError: ${refusal.message}\x1b[0m\n`);
 			if (isVerbose) console.error(`[wawesome:verbose] Response: ${errorBody}`);
 		}
 		process.exit(1);
@@ -3483,11 +3627,6 @@ async function setEnvVar(key, value, options) {
 		console.log("");
 	} else console.log(`[wawesome] ✅ Set variable '${key}' on app '${app}'.`);
 }
-function truncate(str, maxLen) {
-	if (str.length <= maxLen) return str;
-	if (maxLen <= 3) return str.slice(0, maxLen);
-	return str.slice(0, maxLen - 1) + "…";
-}
 /**
 * List environment variables on the current app.
 */
@@ -3808,25 +3947,32 @@ function renderPostDeploy(postDeploy, address) {
 	if (!address) return postDeploy;
 	return postDeploy.split("{{url}}").join(address);
 }
+//#endregion
+//#region src/slug.ts
+/**
+* The character rules every slug on the platform obeys, mirrored from the
+* `dns_label` module in `server/crates/core/src/value_objects.rs`.
+*
+* A typed name is checked while the user is still standing there, rather than
+* accepted, sent, and rewritten by the gateway into something else that ends up
+* in a client's dashboard. The rules live beside the address they build, so the
+* CLI and the dashboard cannot come to disagree about what a legal name is.
+*/
+/** Maximum length of a single DNS label (RFC 1035 §2.3.4). */
+const MAX_SLUG_LENGTH = 63;
 /**
 * Normalise arbitrary input into a legal DNS label, returning an empty string
 * when nothing legal survives — callers decide whether that is an error.
 */
 function sanitizeSlug(raw) {
-	let label = "";
-	for (const c of raw.trim().toLowerCase()) if (c >= "a" && c <= "z") label += c;
-	else if (c >= "0" && c <= "9") label += c;
-	else if (label.length > 0 && !label.endsWith("-")) label += "-";
-	label = label.slice(0, 63);
-	while (label.endsWith("-")) label = label.slice(0, -1);
-	return label;
+	return slugifyLabel(raw);
 }
 /**
 * Whether `candidate` is already a legal DNS label — i.e. whether
 * {@link sanitizeSlug} would leave it untouched.
 */
 function isLegalSlug(candidate) {
-	return candidate.length > 0 && candidate.length <= 63 && !candidate.startsWith("-") && !candidate.endsWith("-") && !candidate.includes("--") && /^[a-z0-9-]+$/.test(candidate);
+	return candidate.length > 0 && candidate.length <= MAX_SLUG_LENGTH && !candidate.startsWith("-") && !candidate.endsWith("-") && !candidate.includes("--") && /^[a-z0-9-]+$/.test(candidate);
 }
 //#endregion
 //#region src/tarball.ts
@@ -4577,6 +4723,24 @@ export default {
 //#region src/version.ts
 /** How both surfaces name a version nobody can switch to. */
 const RECLAIMED = "⚠ [assets reclaimed]";
+/** Where the message sits, under the row rather than in a column of its own. */
+const MESSAGE_INDENT = " ".repeat(10);
+const ASSUMED_WIDTH = 80;
+function terminalWidth() {
+	const columns = process.stdout.columns;
+	return columns && columns > 40 ? columns : ASSUMED_WIDTH;
+}
+/**
+* The lines one version takes in the listing: its row, and the words its deploy
+* stated beneath it where it stated any.
+*/
+function versionLines(v, activeNumber, width) {
+	const isActive = v.version_number === activeNumber;
+	const row = `${`#${v.version_number}`.padEnd(7)} | ${v.cwasm_hash.slice(0, 8).padEnd(8)} | ${new Date(v.created_at).toISOString().replace("T", " ").slice(0, 19).padEnd(20)} | ${v.status.padEnd(9)} | ${isActive ? "\x1B[32m★ [active]\x1B[0m" : v.rollbackable === false ? `\x1b[33m${RECLAIMED}\x1b[0m` : ""}`;
+	const message = v.message?.trim();
+	if (!message) return [row];
+	return [row, `${MESSAGE_INDENT}\x1b[2m${truncate(message, width - MESSAGE_INDENT.length)}\x1b[0m`];
+}
 async function fetchVersions(gatewayUrl, tenantJwt, app, funcName, env, isVerbose) {
 	const url = `${gatewayUrl}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/versions?environment=${encodeURIComponent(env)}`;
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
@@ -4620,15 +4784,8 @@ async function listVersions(options) {
 	console.log(`\n📦 \x1b[1mVersions for '${app}/${funcName}' (environment: ${env})\x1b[0m\n`);
 	console.log("VERSION | HASH     | CREATED AT           | STATUS    | ACTIVE");
 	console.log("--------|----------|----------------------|-----------|-------");
-	for (const v of data.versions) {
-		const isActive = v.version_number === data.active_version_number;
-		const verStr = `#${v.version_number}`.padEnd(7);
-		const hashStr = v.cwasm_hash.slice(0, 8).padEnd(8);
-		const dateStr = new Date(v.created_at).toISOString().replace("T", " ").slice(0, 19).padEnd(20);
-		const statusStr = v.status.padEnd(9);
-		const badge = isActive ? "\x1B[32m★ [active]\x1B[0m" : v.rollbackable === false ? `\x1b[33m${RECLAIMED}\x1b[0m` : "";
-		console.log(`${verStr} | ${hashStr} | ${dateStr} | ${statusStr} | ${badge}`);
-	}
+	const width = terminalWidth();
+	for (const v of data.versions) for (const line of versionLines(v, data.active_version_number, width)) console.log(line);
 	console.log("");
 }
 /**
@@ -4676,8 +4833,11 @@ async function switchVersion(targetInput, options) {
 			const hashShort = v.cwasm_hash.slice(0, 8);
 			const dateStr = new Date(v.created_at).toISOString().replace("T", " ").slice(0, 19);
 			const badge = isActive ? " ★ [active]" : v.rollbackable === false ? ` ${RECLAIMED}` : "";
+			const said = v.message?.trim();
+			const row = `v${v.version_number} (${hashShort}) • ${dateStr}${badge}`;
+			const room = terminalWidth() - row.length - 3 - 2;
 			return {
-				name: `v${v.version_number} (${hashShort}) • ${dateStr}${badge}`,
+				name: said ? `${row} • ${truncate(said, room)}` : row,
 				value: v.version_number
 			};
 		});
@@ -4717,6 +4877,8 @@ async function switchVersion(targetInput, options) {
 	console.log(`  Function:    ${funcName}`);
 	console.log(`  Environment: ${env}`);
 	console.log(`  Active Ver:  v${selectedVersionNum}`);
+	const restored = data.versions.find((v) => v.version_number === selectedVersionNum)?.message?.trim();
+	if (restored) console.log(`  Message:     ${truncate(restored, terminalWidth() - 15)}`);
 	console.log(`======================================================\n`);
 }
 //#endregion
@@ -5504,7 +5666,7 @@ async function renameWorkspace(slug, options) {
 		console.log("✅ \x1B[32mWORKSPACE RENAMED\x1B[0m");
 		console.log("======================================================");
 		console.log(`\n  Address:  ${result.tenant_slug}`);
-		console.log(`  Previous: ${result.previous_slug} (still resolves)`);
+		console.log(`  Previous: ${result.previous_slug} (no longer resolves)`);
 		console.log("======================================================\n");
 	} catch (err) {
 		if (err instanceof GatewayError) {
@@ -5519,12 +5681,117 @@ async function renameWorkspace(slug, options) {
 		process.exit(1);
 	}
 }
+/**
+* The workspaces this person belongs to, with the one the session is in
+* marked.
+*
+* Which one that is comes from the platform rather than from the credentials
+* file: a switch in another terminal moved the session without this one
+* hearing about it.
+*/
+async function listWorkspaces(options) {
+	const read = await requireWorkspaces(requireSession("Your workspaces would be read for that credential's Tenant alone."));
+	console.log("\n[wawesome] Your workspaces:\n");
+	const width = Math.max(...read.workspaces.map((workspace) => workspace.name.length));
+	for (const workspace of read.workspaces) {
+		const mark = workspace.tenant_id === read.current_tenant_id ? "\x1B[32m*\x1B[0m" : " ";
+		const tenant = options.verbose ? `  ${workspace.tenant_id}` : "";
+		console.log(`  ${mark} ${workspace.name.padEnd(width)}  ${workspace.tenant_slug}  (${workspace.role})${tenant}`);
+	}
+	if (read.workspaces.length > 1) console.log("\n  Move with: \x1B[36mwawesome workspace switch <name>\x1B[0m");
+	console.log("");
+}
+/**
+* Move the session to another workspace.
+*
+* The list is read first, so a name is resolved against what the person
+* actually belongs to and a workspace that is none of theirs is answered with
+* the ones that are. The platform checks the **Membership** again either way,
+* so this is where somebody is told rather than where it is decided.
+*/
+async function switchWorkspace(target, options) {
+	const creds = requireSession("A switch would move a session that credential does not have.");
+	if (!target || !target.trim()) {
+		console.error("[wawesome] Error: No workspace given. Usage: wawesome workspace switch <name>");
+		process.exit(1);
+		return;
+	}
+	const read = await requireWorkspaces(creds);
+	const asked = target.trim();
+	const matched = read.workspaces.filter((workspace) => workspace.tenant_slug === asked || workspace.tenant_id === asked || workspace.name.toLowerCase() === asked.toLowerCase());
+	if (matched.length === 0) return notYours(asked, read);
+	if (matched.length > 1) return sharedName(asked, matched);
+	const [moving] = matched;
+	if (moving.tenant_id === read.current_tenant_id) {
+		console.log(`[wawesome] Already in ${moving.name} (${moving.tenant_slug}). Nothing changed.`);
+		return;
+	}
+	if (options.verbose) console.log(`[wawesome:verbose] Switching to ${moving.tenant_id}`);
+	try {
+		await switchWorkspaceTo(creds, moving.tenant_id);
+	} catch (err) {
+		console.error(`[wawesome] Error: ${errorText(err)}`);
+		process.exit(1);
+		return;
+	}
+	console.log("\n======================================================");
+	console.log("✅ \x1B[32mWORKSPACE SWITCHED\x1B[0m");
+	console.log("======================================================");
+	console.log(`\n  Workspace: ${moving.name}`);
+	console.log(`  Address:   ${moving.tenant_slug}`);
+	console.log(`  Role:      ${moving.role}`);
+	console.log("======================================================\n");
+}
 /** Dispatch for `wawesome workspace [action]`. */
 async function workspaceCommand(action, target, options) {
 	if (!action || action === "show" || action === "info") return showWorkspace(options);
 	if (action === "rename") return renameWorkspace(target, options);
+	if (action === "list" || action === "ls") return listWorkspaces(options);
+	if (action === "switch") return switchWorkspace(target, options);
 	console.error(`[wawesome] Error: Unknown workspace action '${action}'.`);
-	console.error("[wawesome] Usage: wawesome workspace [show|rename <name>]");
+	console.error("[wawesome] Usage: wawesome workspace [show|list|switch <name>|rename <name>]");
+	process.exit(1);
+}
+/**
+* The session these two commands act on, which is a person's and never a
+* **Deploy credential**: a credential names one Tenant and holds no
+* **Membership** anywhere, so there is nothing for it to list or move.
+*/
+function requireSession(consequence) {
+	const credential = credentialFromEnvironment();
+	if (credential) {
+		reportSessionCommandRefused(credential, consequence);
+		process.exit(1);
+	}
+	const creds = requireCredentials$1();
+	if (!creds.refresh_token) {
+		console.error("[wawesome] Error: This session predates workspace switching.");
+		console.error("[wawesome] Run 'wawesome login' to sign in again.");
+		process.exit(1);
+	}
+	return creds;
+}
+async function requireWorkspaces(creds) {
+	try {
+		return await readWorkspaces(creds);
+	} catch (err) {
+		console.error(`[wawesome] Error: ${errorText(err)}`);
+		process.exit(1);
+	}
+}
+/** Refused here rather than at the platform, and answered with the ones that are theirs. */
+function notYours(asked, read) {
+	refuse(`You are not a member of '${asked}'.`, "The workspaces you are in:", read.workspaces.map((workspace) => `${workspace.name} (${workspace.tenant_slug})`));
+}
+/** Two workspaces may be called the same thing; their addresses cannot. */
+function sharedName(asked, matched) {
+	refuse(`More than one of your workspaces is called '${asked}'.`, "Name one by its address instead:", matched.map((workspace) => `wawesome workspace switch ${workspace.tenant_slug}`));
+}
+function refuse(headline, next, lines) {
+	console.error(`\n[wawesome] \x1b[31m${headline}\x1b[0m`);
+	console.error(`[wawesome] ${next}`);
+	for (const line of lines) console.error(`             ${line}`);
+	console.error("");
 	process.exit(1);
 }
 //#endregion
@@ -5585,16 +5852,144 @@ const MINT_PRESETS = [
 			"write:apps",
 			"write:functions",
 			"write:env",
+			"write:domains",
 			"write:runs",
 			"write:schedules",
 			"write:previews"
 		],
-		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist, and can create Apps, deploy Functions, set environment variables, run Functions, pause and resume schedules and create previews. It does not attach domains."
+		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist, and can create Apps, deploy Functions, set environment variables, attach domains, run Functions, pause and resume schedules and create previews."
 	}
 ];
 function mintPreset(name) {
 	return MINT_PRESETS.find((preset) => preset.name === name);
 }
+[
+	{
+		code: "owner",
+		job: "Own the workspace",
+		capabilities: [
+			"read:tenant",
+			"write:tenant",
+			"read:apps",
+			"write:apps",
+			"read:functions",
+			"write:functions",
+			"read:env",
+			"write:env",
+			"read:domains",
+			"write:domains",
+			"delete:domains",
+			"read:invocations",
+			"read:runs",
+			"write:runs",
+			"read:schedules",
+			"write:schedules",
+			"read:previews",
+			"write:previews",
+			"read:egress",
+			"write:egress",
+			"write:billing",
+			"write:credentials",
+			"write:members"
+		],
+		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist, and can rename the workspace, create Apps, deploy Functions, set environment variables, attach domains, detach domains, run Functions, pause and resume schedules, create previews, widen the egress allowlist, change billing, manage credentials and manage members.",
+		withheldFromAPerson: "A workspace has one owner, so 'owner' is not a standing anybody is put at."
+	},
+	{
+		code: "admin",
+		job: "Administer the workspace",
+		capabilities: [
+			"read:tenant",
+			"read:apps",
+			"write:apps",
+			"read:functions",
+			"write:functions",
+			"read:env",
+			"write:env",
+			"read:domains",
+			"write:domains",
+			"delete:domains",
+			"read:invocations",
+			"read:runs",
+			"write:runs",
+			"read:schedules",
+			"write:schedules",
+			"read:previews",
+			"write:previews",
+			"read:egress",
+			"write:egress",
+			"write:credentials",
+			"write:members"
+		],
+		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist, and can create Apps, deploy Functions, set environment variables, attach domains, detach domains, run Functions, pause and resume schedules, create previews, widen the egress allowlist, manage credentials and manage members. It does not rename the workspace or change billing.",
+		withheldFromAPerson: null
+	},
+	{
+		code: "member",
+		job: "Build in the workspace",
+		capabilities: [
+			"read:tenant",
+			"read:apps",
+			"read:functions",
+			"read:env",
+			"read:domains",
+			"read:invocations",
+			"read:runs",
+			"read:schedules",
+			"read:previews",
+			"read:egress",
+			"write:apps",
+			"write:functions",
+			"write:env",
+			"write:domains",
+			"write:runs",
+			"write:schedules",
+			"write:previews"
+		],
+		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist, and can create Apps, deploy Functions, set environment variables, attach domains, run Functions, pause and resume schedules and create previews. It does not rename the workspace, detach domains, widen the egress allowlist, change billing, manage credentials or manage members.",
+		withheldFromAPerson: null
+	},
+	{
+		code: "deployer",
+		job: "Ship and read back",
+		capabilities: [
+			"read:tenant",
+			"read:apps",
+			"read:functions",
+			"read:env",
+			"read:domains",
+			"read:invocations",
+			"read:runs",
+			"read:schedules",
+			"read:previews",
+			"read:egress",
+			"write:apps",
+			"write:functions",
+			"write:env",
+			"write:runs"
+		],
+		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist, and can create Apps, deploy Functions, set environment variables and run Functions. It does not rename the workspace, attach domains, detach domains, pause and resume schedules, create previews, widen the egress allowlist, change billing, manage credentials or manage members.",
+		withheldFromAPerson: "'deployer' is the recipe a Deploy credential is cut from. A pipeline gets a credential of its own rather than somebody's account."
+	},
+	{
+		code: "viewer",
+		job: "Read and investigate",
+		capabilities: [
+			"read:tenant",
+			"read:apps",
+			"read:functions",
+			"read:env",
+			"read:domains",
+			"read:invocations",
+			"read:runs",
+			"read:schedules",
+			"read:previews",
+			"read:egress"
+		],
+		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist. It writes nothing.",
+		withheldFromAPerson: "'viewer' reaches every read in the workspace: the plan, what it has spent, the environment variables and every App. Nobody is put at it."
+	}
+].filter((role) => role.withheldFromAPerson === null);
 //#endregion
 //#region src/deploy-credentials.ts
 const SECRET_SHOWN_ONCE = "Copy it now. This is the only time it will be shown. If you lose it, revoke this credential and mint another.";
@@ -6040,7 +6435,7 @@ async function credentialsCommand(action, target, options) {
 //#region src/index.ts
 const cli = cac("wawesome");
 cli.command("build [entry]", "Bundle a serverless function to an optimized JS file").option("-o, --out <path>", "Output JS bundle path", { default: "dist/index.js" }).option("-v, --verbose", "Enable verbose debug output").action((entry, options) => buildJs(entry, options));
-cli.command("deploy [entry]", "Build, upload, and promote a serverless function").option("-o, --out <path>", "Output JS bundle path", { default: "dist/index.js" }).option("-v, --verbose", "Enable verbose debug output").option("--skip-build", "Skip the build step, deploy an already-built bundle").option("--publish", "Confirm putting a private function back on its public address").option("--drop-assets", "Confirm a deploy carrying no static files where the live version serves some").action((entry, options) => deploy(entry, options));
+cli.command("deploy [entry]", "Build, upload, and promote a serverless function").option("-o, --out <path>", "Output JS bundle path", { default: "dist/index.js" }).option("-v, --verbose", "Enable verbose debug output").option("--skip-build", "Skip the build step, deploy an already-built bundle").option("--publish", "Confirm putting a private function back on its public address").option("--drop-assets", "Confirm a deploy carrying no static files where the live version serves some").option("-m, --message <text>", "One line about what this deploy carries, kept on the version it makes").action((entry, options) => deploy(entry, options));
 cli.command("version [action] [target]", "Manage versions (e.g. 'version list', 'version switch [version]')").option("-e, --env <environment>", "Target environment (default: production)").option("-v, --verbose", "Enable verbose debug output").action((action, target, options) => {
 	if (!action || action === "list" || action === "ls") return listVersions(options);
 	if (action === "switch" || action === "use" || action === "select") return switchVersion(target, options);
@@ -6055,10 +6450,10 @@ cli.command("env rm <key>", "Delete an environment variable from the current app
 cli.command("domains [action] [hostname]", "Show the custom domain on the current app, its state and its DNS records").usage("domains [action] [hostname]\n\nWith no action, prints the app's domain, every half of it, where each got to, when the platform last checked, and the records to add.\n\nActions:\n  adopt               Write the attached domain into wawesome-function.json\n  detach <hostname>   Stop serving the app at a domain you attached\n\nA domain is attached by declaring it in wawesome-function.json and deploying, from the dashboard, or by an agent.").example("wawesome domains").example("wawesome domains adopt").example("wawesome domains detach shop.client.com").option("-a, --app <slug>", "App to act on (default: the app in wawesome-function.json)").action((action, hostname, options) => domainsCommand(action, hostname, options));
 cli.command("domains adopt", "Write the domain the current app answers at into wawesome-function.json").option("-a, --app <slug>", "App to act on (default: the app in wawesome-function.json)").action((options) => adoptDomainCommand(void 0, options));
 cli.command("domains detach <hostname>", "Stop serving the current app at a domain you attached").option("-a, --app <slug>", "App to act on (default: the app in wawesome-function.json)").action((hostname, options) => detachDomainCommand(hostname, options));
-cli.command("login", "Authenticate with the wawesome.io platform").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("--gateway <url>", "Alias for --api <url>").option("--dashboard <url>", "Dashboard URL (default: https://dashboard.wawesome.io)").option("--provider <name>", "OAuth provider (default: github)").option("--workspace <name>", "Name for the workspace, when signing up without a terminal to prompt").option("--accept-terms", "Accept the terms of service and privacy policy, when signing up without a terminal to prompt").option("-v, --verbose", "Enable verbose debug output").action((options) => login(options));
-cli.command("logout", "Clear stored authentication credentials").action(() => logout());
+cli.command("login", "Authenticate with the wawesome.io platform").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("--gateway <url>", "Alias for --api <url>").option("--dashboard <url>", "Dashboard URL to record (default: the one the platform names)").option("-v, --verbose", "Enable verbose debug output").action((options) => login(options));
+cli.command("logout", "Clear stored authentication credentials").action(async () => await logout());
 cli.command("whoami", "Show current login session info").action(() => whoami());
-cli.command("workspace [action] [name]", "Show the workspace, or rename its public address").usage("workspace <action> [name]\n\nActions:\n  show                Show the workspace name, address, and whether it can still change\n  rename <name>       Change the public address, while nothing live depends on it").example("wawesome workspace").example("wawesome workspace rename northwind").option("-v, --verbose", "Enable verbose debug output").action((action, name, options) => workspaceCommand(action, name, options));
+cli.command("workspace [action] [name]", "Show the workspace, move between workspaces, or rename the public address").usage("workspace <action> [name]\n\nActions:\n  show                Show the workspace name, address, and whether it can still change\n  list (ls)           Show the workspaces you belong to, and which one you are in\n  switch <name>       Move this terminal to another workspace you belong to\n  rename <name>       Change the public address, while nothing live depends on it").example("wawesome workspace").example("wawesome workspace list").example("wawesome workspace switch northwind").example("wawesome workspace rename northwind").option("-v, --verbose", "Enable verbose debug output").action((action, name, options) => workspaceCommand(action, name, options));
 cli.command("templates [action]", "Browse the template catalog").usage("templates [action]\n\nActions:\n  list (ls)           Show every available template (default)").example("wawesome templates").example("wawesome templates list").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("-v, --verbose", "Enable verbose debug output").action((action, options) => templatesCommand(action, options));
 cli.command("credentials [action] [target]", "Mint, list, regenerate, revoke and delete deploy credentials").alias("credential").usage(`credentials <action> [options]
 
@@ -6094,7 +6489,7 @@ cli.command("credentials list", "List deploy credentials, never their secrets").
 cli.command("credentials regenerate <name-or-prefix>", "Replace a deploy credential's secret, keeping its name, capabilities and Apps").option("--expires <days|never>", "Days until the regenerated credential expires, or 'never' (default: 90)").option("-y, --yes", "Regenerate without being asked to confirm").option("-v, --verbose", "Enable verbose debug output").action((target, options) => regenerateCredentialCommand(target, options));
 cli.command("credentials revoke <name-or-prefix>", "Revoke a deploy credential, immediately and for good").option("-y, --yes", "Revoke without being asked to confirm").option("-v, --verbose", "Enable verbose debug output").action((target, options) => revokeCredentialCommand(target, options));
 cli.command("credentials delete <name-or-prefix>", "Delete a revoked or expired deploy credential, freeing its name").option("-y, --yes", "Delete without being asked to confirm").option("-v, --verbose", "Enable verbose debug output").action((target, options) => deleteCredentialCommand(target, options));
-cli.command("init", "Scaffold a new function project in the current directory").usage("init [options]\n\nWith --template, the project is fetched from the template catalog, wired up\nfrom what the template declares it needs, and deployed. Run 'wawesome templates'\nto see what is available.").example("wawesome init").example("wawesome init --template stripe-webhook").option("-t, --template <name>", "Scaffold from a catalog template and deploy it").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("--dashboard <url>", "Dashboard URL (default: https://dashboard.wawesome.io)").option("--no-install", "Skip installing dependencies after scaffolding").option("--root", "Generate a root function router template").option("-v, --verbose", "Enable verbose debug output").action((options) => init(options));
+cli.command("init", "Scaffold a new function project in the current directory").usage("init [options]\n\nWith --template, the project is fetched from the template catalog, wired up\nfrom what the template declares it needs, and deployed. Run 'wawesome templates'\nto see what is available.").example("wawesome init").example("wawesome init --template stripe-webhook").option("-t, --template <name>", "Scaffold from a catalog template and deploy it").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("--dashboard <url>", "Dashboard URL to record (default: the one the platform names)").option("--no-install", "Skip installing dependencies after scaffolding").option("--root", "Generate a root function router template").option("-v, --verbose", "Enable verbose debug output").action((options) => init(options));
 cli.command("logs [function-name-or-invocation-id]", "View invocation history, fetch log output, or follow live").usage(`logs [target] [options]
 
   The target argument determines what the command does: