wawesome 0.19.0 → 0.20.0

package/dist/index.mjs

@@ -1,4 +1,4 @@
-import { a as unsupportedGlobals, n as methodRemedy, r as polyfilledGlobals, t as declaredMethods } from "./guest-surface-4bHyTMIy.mjs";
+import { a as unsupportedGlobals, n as methodRemedy, r as polyfilledGlobals, t as declaredMethods } from "./guest-surface-D5X-IMAN.mjs";
 import cac from "cac";
 import fs from "node:fs";
 import path from "node:path";
@@ -6,10 +6,10 @@ import { build } from "esbuild";
 import os from "node:os";
 import { parse } from "acorn";
 import { spawnSync } from "node:child_process";
+import crypto from "node:crypto";
 import http from "node:http";
-import readline from "node:readline";
 import { Readable } from "node:stream";
-import crypto from "node:crypto";
+import readline from "node:readline";
 import { confirm, select } from "@inquirer/prompts";
 import zlib from "node:zlib";
 //#region src/errors.ts
@@ -82,21 +82,6 @@ function reportSessionCommandRefused(secret, consequence) {
 }
 //#endregion
 //#region src/config.ts
-/**
-* Hardcoded Supabase project config for the wawesome.io platform.
-* These are public values — the anon key is designed to be embedded in clients.
-*/
-const SUPABASE_URL = "https://vclasavxxoufwymrutai.supabase.co";
-/**
-* Where the documents accepted at signup are published. Fixed rather than
-* resolved per environment: there is one website, and a signup has to be able
-* to link at something a person can actually read before they accept it.
-*/
-const LEGAL_URLS = {
-	terms: "https://wawesome.io/legal/terms-of-service",
-	privacy: "https://wawesome.io/legal/privacy-policy"
-};
-const SUPABASE_ANON_KEY = "sb_publishable_ZlgDAI9cNZkefEwVPKIngA_ktuvTpjD";
 /** Path to the user-level settings file (~/.wawesome/settings.json) */
 function getSettingsPath() {
 	return path.join(os.homedir(), ".wawesome", "settings.json");
@@ -149,18 +134,23 @@ function getDashboardUrl(overrideUrl) {
 /**
 * The dashboard for the environment this login is going to.
 *
-* The two addresses describe one environment, so the stored rung is read only
-* where the gateway being logged into is the one the credentials already name.
-* Carrying a dashboard across a change of gateway is the wrong workspace, and
-* so is dropping one where the gateway did not change at all.
-*/
-function resolveDashboardUrlForLogin(overrideUrl, gatewayUrl) {
-	const creds = readStoredCredentials();
-	const sameEnvironment = creds?.gateway_url === gatewayUrl;
-	return resolveAddress(overrideUrl, DASHBOARD_ENV_NAMES, "dashboard_url", sameEnvironment ? creds?.dashboard_url : void 0, DASHBOARD_URL_FALLBACK);
-}
-/** Localhost port used during OAuth callback */
-const OAUTH_CALLBACK_PORT = 9999;
+* Taken from the address the platform handed back to open, so a login that
+* configures nothing stores the dashboard belonging to the gateway it signed
+* into. An explicit flag, `DASHBOARD_URL` or a settings file still outrank it,
+* on the rung they outrank every other address on.
+*/
+function resolveDashboardUrlForLogin(overrideUrl, signInUrl) {
+	return resolveAddress(overrideUrl, DASHBOARD_ENV_NAMES, "dashboard_url", originOf(signInUrl), DASHBOARD_URL_FALLBACK);
+}
+/** Undefined rather than throwing: an unreadable address falls to the rung below. */
+function originOf(url) {
+	try {
+		return new URL(url).origin;
+	} catch {
+		return;
+	}
+}
+const LOGIN_CALLBACK_PORT = 9999;
 /** Path to the user-level credentials file */
 function getCredentialsPath() {
 	return path.join(os.homedir(), ".wawesome", "credentials.json");
@@ -905,199 +895,198 @@ async function buildHandler(entryInput, config, options) {
 * that has to name this version — `--version`, the dependency a scaffolded
 * project pins — reads it here, so a release bumps one file.
 */
-const CLI_VERSION = "0.19.0";
+const CLI_VERSION = "0.20.0";
 //#endregion
-//#region src/prompt.ts
-/**
-* Open a prompt session on stdin, queueing lines as they arrive.
-*
-* Reading one `rl.question` at a time drops piped input: it lands as a single
-* chunk, so every line after the first is emitted with no question pending.
-* End of input answers the remaining questions with their defaults.
-*/
-function openPromptSession() {
-	const rl = readline.createInterface({
-		input: process.stdin,
-		output: process.stdout
-	});
-	const queued = [];
-	const waiting = [];
-	let ended = false;
-	rl.on("line", (line) => {
-		const next = waiting.shift();
-		if (next) next(line);
-		else queued.push(line);
-	});
-	rl.on("close", () => {
-		ended = true;
-		while (waiting.length > 0) waiting.shift()?.(null);
-	});
-	function nextLine() {
-		if (queued.length > 0) return Promise.resolve(queued.shift());
-		if (ended) return Promise.resolve(null);
-		return new Promise((resolve) => waiting.push(resolve));
-	}
+//#region src/cli-login.ts
+const START_PATH = "/v1/cli/login/start";
+const EXCHANGE_PATH = "/v1/cli/login/exchange";
+function mintProof() {
+	const verifier = crypto.randomBytes(32).toString("base64url");
 	return {
-		async ask(question, defaultVal) {
-			const offered = defaultVal ? ` (${defaultVal})` : "";
-			process.stdout.write(`${question}${offered}: `);
-			const line = await nextLine();
-			if (line === null) {
-				process.stdout.write("\n");
-				return defaultVal;
-			}
-			return line.trim() || defaultVal;
-		},
-		close() {
-			rl.close();
-		}
+		verifier,
+		challenge: crypto.createHash("sha256").update(verifier).digest("base64url")
 	};
 }
 /**
-* Whether a question can actually be put to somebody. A piped or redirected
-* stdin still answers — with end-of-input — so this only tells a caller whether
-* a *default* is going to be what the user gets.
+* The address to open comes back from the platform rather than being composed
+* here: which dashboard belongs to a gateway is the gateway's own fact, and a
+* CLI that spelled it would be a CLI to reinstall whenever it moved.
 */
-function isInteractive() {
-	return Boolean(process.stdin.isTTY);
+async function startSignIn(gatewayUrl, asked) {
+	const started = await post(gatewayUrl, START_PATH, {
+		redirect_uri: asked.redirectUri,
+		code_challenge: asked.challenge,
+		code_challenge_method: "S256",
+		state: asked.state
+	}, "The platform could not start a sign-in");
+	if (!started.sign_in_url) throw new Error("The platform started a sign-in without saying where to finish it.");
+	return started;
 }
-//#endregion
-//#region ../shared/public-address.ts
-const INVOCATION_PREFIX = "/x";
-const SLUG_SEPARATOR = "--";
-const SURFACE_ROUTE = "/v1/invocation-surface";
-const SUBTREE_NOTE = "Every path beneath this address reaches the Function.";
-const ROOT_FUNCTION_SLUG = "root";
 /**
-* A gateway that serves no form of the address — and the value a client uses for
-* one that did not answer at all, deliberately the same: both name no address,
-* and there is nothing else either could honestly do.
+* The verifier travels here and nowhere else: it is what proves this terminal
+* is the one that started the sign-in.
 */
-const NO_INVOCATION_SURFACE = {
-	contentOrigin: null,
-	pathFormOrigin: null
-};
-async function fetchInvocationSurface(gatewayUrl) {
-	const origin = trimTrailingSlashes(gatewayUrl);
-	const res = await fetch(`${origin}${SURFACE_ROUTE}`);
-	if (!res.ok) throw new Error(`Failed to read the gateway's address forms (HTTP ${res.status}).`);
-	const body = await res.json();
-	return {
-		contentOrigin: body.content_origin ?? null,
-		pathFormOrigin: body.path_form ? origin : null
-	};
-}
-/** The one address the Function answers at, `null` where it has none. */
-function publicAddress(surface, tenantSlug, appSlug, functionSlug) {
-	const base = appBase(surface, tenantSlug, appSlug);
-	if (base === null) return null;
-	if (functionSlug === "root") return base;
-	return `${base}/${encodeURIComponent(functionSlug)}`;
+async function exchangeCode(gatewayUrl, code, verifier) {
+	const session = await post(gatewayUrl, EXCHANGE_PATH, {
+		code,
+		code_verifier: verifier
+	}, "This sign-in could not be finished");
+	if (!session.tenant_jwt || !session.refresh_token) throw new Error("The platform answered this sign-in with half a session.");
+	return session;
 }
 /**
-* Where one of a Function's static files answers, `null` where none of them do.
+* The code, or the sign-in running out first.
 *
-* A **Static asset** is served on the App's own hostname and on no other
-* address, so a gateway serving only the path form has no address to give for
-* one — see **Static route** in `CONTEXT.md`.
-*/
-function assetAddress(surface, tenantSlug, appSlug, functionSlug, assetPath) {
-	if (!surface.contentOrigin) return null;
-	const mount = publicAddress(surface, tenantSlug, appSlug, functionSlug);
-	if (mount === null) return null;
-	return `${mount}/${assetPath.split("/").map(encodeURIComponent).join("/")}`;
-}
-/** The same address with the app and function still to be chosen. */
-function publicAddressTemplate(surface, tenantSlug) {
-	if (surface.contentOrigin) {
-		if (!isLegalDnsLabel(tenantSlug)) return null;
-		const hostname = appHostname(surface.contentOrigin, `${tenantSlug}${SLUG_SEPARATOR}<app>`);
-		return hostname === null ? null : `${hostname}/<function>`;
-	}
-	if (surface.pathFormOrigin) return `${pathFormBase(surface.pathFormOrigin, tenantSlug)}/<app>/<function>`;
-	return null;
+* Without the deadline, a tab somebody walked away from leaves the terminal
+* waiting on a sign-in the platform has already forgotten.
+*/
+function waitForCode(answer, expiresAt) {
+	const runsOutIn = new Date(expiresAt).getTime() - Date.now();
+	if (!Number.isFinite(runsOutIn)) return answer;
+	let timer;
+	const ranOut = new Promise((_, reject) => {
+		timer = setTimeout(() => reject(/* @__PURE__ */ new Error("This sign-in ran out before the browser came back. Run 'wawesome login' again.")), Math.max(runsOutIn, 0));
+	});
+	return Promise.race([answer, ranOut]).finally(() => clearTimeout(timer));
 }
-function appBase(surface, tenantSlug, appSlug) {
-	if (surface.contentOrigin) {
-		if (!isLegalDnsLabel(tenantSlug) || !isLegalDnsLabel(appSlug)) return null;
-		return appHostname(surface.contentOrigin, `${tenantSlug}${SLUG_SEPARATOR}${appSlug}`);
-	}
-	if (surface.pathFormOrigin) return `${pathFormBase(surface.pathFormOrigin, tenantSlug)}/${encodeURIComponent(appSlug)}`;
-	return null;
+async function post(gatewayUrl, path, body, fallback) {
+	const res = await fetch(`${gatewayUrl}${path}`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body)
+	});
+	if (!res.ok) throw await asGatewayError(res, `${fallback} (HTTP ${res.status}).`);
+	return await res.json();
 }
+//#endregion
+//#region src/login-callback.ts
 /**
-* The App's own hostname, built the way the gateway rebuilds it from its own
-* configuration: the label one level beneath the content domain. Callers check
-* the slugs the label is made of, since a slug the gateway would refuse to read
-* a `Host` for names no App there.
-*/
-function appHostname(contentOrigin, label) {
-	let origin;
-	try {
-		origin = new URL(contentOrigin);
-	} catch {
-		return null;
-	}
-	return `${origin.protocol}//${label}.${origin.host}`;
+* Where a browser hands a finished sign-in back to this terminal.
+*
+* Two things make the answer this server takes the developer's own. It binds
+* loopback, so nothing on the network can reach it. And it mints a `state` that
+* travels out with the sign-in and has to come back with the answer, so a page
+* open in another tab cannot hand this CLI a code belonging to somebody else.
+* Everything that fails either test is turned away in prose, and the login
+* stays open for the tab it did open — a stray request is not a reason to end a
+* sign-in a developer is in the middle of.
+*
+* What arrives is a single-use code bound to a verifier this process never
+* sent anywhere but the exchange, which is why it may ride in a URL where an
+* access token never could.
+*/
+/** The address is `localhost` so the platform's loopback rule still matches it. */
+const CALLBACK_HOST = "localhost";
+const LOOPBACK = "127.0.0.1";
+const REFUSED_ELSEWHERE = "This sign-in did not come from the login running in your terminal, so it was refused. Nothing was signed in. Run 'wawesome login' again and finish in the tab it opens.";
+const NO_CODE = "The browser came back from the sign-in without a code. Nothing was signed in — run 'wawesome login' again.";
+async function listenForLoginCallback({ port = LOGIN_CALLBACK_PORT } = {}) {
+	const state = crypto.randomBytes(32).toString("base64url");
+	let settle = () => {};
+	let refuse = () => {};
+	const answer = new Promise((resolve, reject) => {
+		settle = resolve;
+		refuse = reject;
+	});
+	const server = http.createServer((req, res) => {
+		try {
+			handle(req, res, {
+				state,
+				settle,
+				refuse
+			});
+		} catch {
+			if (res.headersSent || res.destroyed) return;
+			res.writeHead(500, { "Content-Type": "text/plain" });
+			res.end("This login could not read what the browser sent. Nothing was signed in.");
+		}
+	});
+	const listening = await listen(server, port);
+	return {
+		redirectUrl: `http://${CALLBACK_HOST}:${listening}/callback`,
+		state,
+		answer,
+		close: () => {
+			server.closeAllConnections();
+			server.close();
+		}
+	};
 }
-/** The surface, or none where the gateway did not answer. */
-async function invocationSurfaceOrNone(gatewayUrl) {
-	try {
-		return await fetchInvocationSurface(gatewayUrl);
-	} catch {
-		return NO_INVOCATION_SURFACE;
+function handle(req, res, login) {
+	const url = new URL(req.url || "/", `http://${LOOPBACK}`);
+	if (url.pathname !== "/callback") {
+		res.writeHead(404, { "Content-Type": "text/plain" });
+		res.end("Not Found");
+		return;
 	}
+	if (!isThisLogin(url.searchParams.get("state"), login.state)) {
+		reportStranger();
+		res.writeHead(400, { "Content-Type": "text/html" });
+		res.end(page("Sign-in refused", REFUSED_ELSEWHERE));
+		return;
+	}
+	const refused = url.searchParams.get("error_description") || url.searchParams.get("error");
+	if (refused) return report(res, login, `The sign-in was refused: ${refused}`);
+	const code = url.searchParams.get("code");
+	if (!code) return report(res, login, NO_CODE);
+	res.writeHead(200, { "Content-Type": "text/html" });
+	res.end(page("Signed in", "You can close this tab and go back to your terminal."));
+	login.settle(code);
 }
-function pathFormBase(origin, tenantSlug) {
-	return `${trimTrailingSlashes(origin)}${INVOCATION_PREFIX}/${encodeURIComponent(tenantSlug)}`;
-}
-/**
-* The legal DNS label closest to what somebody typed, empty where nothing legal
-* survives. What a workspace name suggests as an address, and what the CLI
-* offers as a default — never applied to a typed address, which is refused
-* rather than rewritten into a name nobody chose.
-*/
-function slugifyLabel(raw) {
-	let label = "";
-	for (const c of raw.trim().toLowerCase()) if (c >= "a" && c <= "z" || c >= "0" && c <= "9") label += c;
-	else if (label.length > 0 && !label.endsWith("-")) label += "-";
-	label = label.slice(0, 63);
-	while (label.endsWith("-")) label = label.slice(0, -1);
-	return label;
-}
-/** Must match `dns_label::is_legal` in `server/crates/core/src/value_objects.rs`. */
-function isLegalDnsLabel(candidate) {
-	return candidate.length > 0 && candidate.length <= 63 && !candidate.startsWith("-") && !candidate.endsWith("-") && !candidate.includes("--") && /^[a-z0-9-]+$/.test(candidate);
-}
-function trimTrailingSlashes(origin) {
-	return origin.replace(/\/+$/, "");
-}
-//#endregion
-//#region src/slug.ts
 /**
-* The character rules every slug on the platform obeys, mirrored from the
-* `dns_label` module in `server/crates/core/src/value_objects.rs`.
+* Say, in the terminal, that a request nobody asked for was turned away.
 *
-* A typed name is checked while the user is still standing there, rather than
-* accepted, sent, and rewritten by the gateway into something else that ends up
-* in a client's dashboard. The rules live beside the address they build, so the
-* CLI and the dashboard cannot come to disagree about what a legal name is.
-*/
-/** Maximum length of a single DNS label (RFC 1035 §2.3.4). */
-const MAX_SLUG_LENGTH = 63;
-/**
-* Normalise arbitrary input into a legal DNS label, returning an empty string
-* when nothing legal survives — callers decide whether that is an error.
-*/
-function sanitizeSlug(raw) {
-	return slugifyLabel(raw);
+* The login itself is left open on purpose. Ending it here would mean any page
+* that can reach loopback could end a developer's sign-in by asking once, and
+* the tab this login did open is still coming.
+*/
+function reportStranger() {
+	console.error("[wawesome] Refused a sign-in that did not carry this login's state. Nothing was signed in, and this login is still waiting for the tab it opened.");
+}
+/** A failure of this login: said on the page, and thrown in the terminal. */
+function report(res, login, said) {
+	res.writeHead(400, { "Content-Type": "text/html" });
+	res.end(page("Sign-in refused", said));
+	login.refuse(new Error(said));
+}
+function isThisLogin(given, expected) {
+	if (!given) return false;
+	const a = Buffer.from(given);
+	const b = Buffer.from(expected);
+	return a.length === b.length && crypto.timingSafeEqual(a, b);
+}
+function listen(server, port) {
+	return new Promise((resolve, reject) => {
+		server.once("error", (err) => {
+			if (err.code === "EADDRINUSE") return reject(/* @__PURE__ */ new Error(`Port ${port} is already in use, and that is where the browser hands the sign-in back. Stop whatever is holding it — often an earlier 'wawesome login' that never finished — then run 'wawesome login' again.`));
+			reject(err);
+		});
+		server.listen(port, LOOPBACK, () => {
+			const address = server.address();
+			if (typeof address === "string" || address === null) return reject(/* @__PURE__ */ new Error("The callback server started without an address."));
+			resolve(address.port);
+		});
+	});
 }
-/**
-* Whether `candidate` is already a legal DNS label — i.e. whether
-* {@link sanitizeSlug} would leave it untouched.
-*/
-function isLegalSlug(candidate) {
-	return candidate.length > 0 && candidate.length <= MAX_SLUG_LENGTH && !candidate.startsWith("-") && !candidate.endsWith("-") && !candidate.includes("--") && /^[a-z0-9-]+$/.test(candidate);
+const STYLE = "font-family: system-ui; text-align: center; padding: 50px; background: #0f172a; color: #f8fafc;";
+function page(title, said) {
+	return `<!DOCTYPE html>
+<html>
+<head><title>wawesome — ${escapeHtml(title.toLowerCase())}</title></head>
+<body style="${STYLE}">
+<h2>${escapeHtml(title)}</h2>
+<p>${escapeHtml(said)}</p>
+</body>
+</html>`;
+}
+function escapeHtml(text) {
+	return text.replace(/[&<>"']/g, (char) => ({
+		"&": "&amp;",
+		"<": "&lt;",
+		">": "&gt;",
+		"\"": "&quot;",
+		"'": "&#39;"
+	})[char] || char);
 }
 //#endregion
 //#region src/session.ts
@@ -1153,9 +1142,9 @@ function forgetRenewedSession() {
 	renewedAt = 0;
 }
 /**
-* Supabase rotates the refresh token on every use and revokes the whole family
-* if a spent one comes back, so requests that meet the 401 together share one
-* renewal instead of racing with the same token.
+* The platform rotates the refresh token on every use, and a token from a
+* generation it has moved past ends the session, so requests that meet the 401
+* together share one renewal instead of racing with the same token.
 */
 function renewSession() {
 	if (!renewal) {
@@ -1174,50 +1163,114 @@ function renewSession() {
 async function renewOnce() {
 	const creds = readCredentials();
 	if (!creds?.refresh_token) return null;
-	const session = await refreshSupabaseSession(creds.refresh_token);
-	const exchanged = await exchangeForTenantJwt(creds, session.access_token);
+	return storeRenewed(creds, await renewedSession(creds));
+}
+/**
+* What this process has learned about the session is written down beside it, so
+* a request still holding the old token does not spend a second 401 finding
+* out.
+*/
+function storeRenewed(creds, session) {
 	const renewed = {
 		...creds,
-		tenant_jwt: exchanged.tenant_jwt,
-		refresh_token: session.refresh_token || creds.refresh_token,
-		tenant_slug: exchanged.tenant_slug || creds.tenant_slug,
-		tenant_name: exchanged.tenant_name || creds.tenant_name
+		tenant_jwt: session.tenant_jwt,
+		refresh_token: session.refresh_token,
+		tenant_id: session.tenant_id || creds.tenant_id,
+		tenant_slug: session.tenant_slug || creds.tenant_slug,
+		tenant_name: session.tenant_name || creds.tenant_name,
+		user_email: session.email || creds.user_email
 	};
 	writeCredentials(renewed);
 	renewedJwt = renewed.tenant_jwt;
 	renewedAt = Date.now();
 	return renewed;
 }
-async function refreshSupabaseSession(refreshToken) {
-	const res = await fetch(`${SUPABASE_URL}/auth/v1/token?grant_type=refresh_token`, {
+/** Where a terminal renews, and where `logout` ends its session on the server. */
+const SESSION_REFRESH_PATH = "/v1/cli/session/refresh";
+const SESSION_REVOKE_PATH = "/v1/cli/session/revoke";
+/** Where the workspaces this session could move to are read. */
+const SESSION_WORKSPACES_PATH = "/v1/cli/session/workspaces";
+/**
+* Renew against this platform. The refresh token is what authenticates the
+* request, and the only other thing it ever carries is the workspace a
+* `workspace switch` is moving the session to.
+*/
+async function renewedSession(creds, tenantId) {
+	const res = await fetch(`${creds.gateway_url}${SESSION_REFRESH_PATH}`, {
 		method: "POST",
-		headers: {
-			apikey: SUPABASE_ANON_KEY,
-			"Content-Type": "application/json"
-		},
-		body: JSON.stringify({ refresh_token: refreshToken })
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			refresh_token: creds.refresh_token,
+			tenant_id: tenantId
+		})
 	});
-	if (res.status >= 400 && res.status < 500 && res.status !== 429) endSession("Your sign-in was revoked or has expired, so the session could not be renewed.");
-	if (!res.ok) throw new Error(`Could not renew your session (Supabase HTTP ${res.status}).`);
+	if (res.status === 429) throw await asGatewayError(res, "The platform is rate limiting this session's renewals.");
+	if (res.status >= 400 && res.status < 500) {
+		const refused = await asGatewayError(res, "Your session could not be renewed.");
+		if (tenantId && refused.reason === "not-a-member") throw refused;
+		endSession(refused.message);
+	}
+	if (!res.ok) throw new Error(`Could not renew your session (HTTP ${res.status}).`);
 	const session = await res.json();
-	if (!session.access_token) throw new Error("Could not renew your session (Supabase returned no access token).");
+	if (!session.tenant_jwt || !session.refresh_token) throw new Error("Could not renew your session (the platform answered half a session).");
 	return session;
 }
-async function exchangeForTenantJwt(creds, supabaseAccessToken) {
-	const res = await fetch(`${creds.gateway_url}/api/v1/auth/token-exchange`, {
+/**
+* The workspaces this session could move to. On the refresh token, which is
+* what makes the question answerable at all: the token belongs to the person,
+* where the tenant token names one workspace.
+*/
+async function readWorkspaces(creds) {
+	const res = await fetch(`${creds.gateway_url}${SESSION_WORKSPACES_PATH}`, {
 		method: "POST",
-		headers: {
-			Authorization: `Bearer ${supabaseAccessToken}`,
-			"Content-Type": "application/json"
-		},
-		body: JSON.stringify({ tenant_id: creds.tenant_id })
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({ refresh_token: creds.refresh_token })
 	});
-	if (res.status === 401 || res.status === 403) endSession("Your access to this workspace has been withdrawn.");
-	if (!res.ok) throw new Error(`Could not renew your session (token exchange HTTP ${res.status}).`);
+	if (!res.ok) throw await asGatewayError(res, `Your workspaces could not be read (HTTP ${res.status}).`);
 	return await res.json();
 }
-function endSession(reason) {
-	console.error(`[wawesome] Error: ${reason} Run 'wawesome login' to sign in again.`);
+/**
+* Move the session to another workspace, which is a renewal that names it. No
+* browser: the refresh token is the person's, and the **Membership** the
+* platform checks is theirs too.
+*/
+async function switchWorkspaceTo(creds, tenantId) {
+	return storeRenewed(creds, await renewedSession(creds, tenantId));
+}
+/**
+* End the session on the server, which is what makes a copy of the credentials
+* file worthless once its owner has signed out.
+*
+* Answers why the session may still be open, and `null` where it is over. A
+* refusal is not a session left open — a token the platform will not take names
+* a session that is already gone — but a platform that could not answer at all
+* leaves one standing, and the file holding the only copy of the token that
+* could end it is then worth keeping.
+*/
+async function revokeSession(creds) {
+	if (!creds.refresh_token) return null;
+	try {
+		const res = await fetch(`${creds.gateway_url}${SESSION_REVOKE_PATH}`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({ refresh_token: creds.refresh_token })
+		});
+		if (res.ok || res.status < 500) return null;
+		return (await asGatewayError(res, `The platform answered HTTP ${res.status}.`)).message;
+	} catch (err) {
+		return err instanceof Error ? err.message : String(err);
+	}
+}
+/**
+* What the platform said, and what to do about it.
+*
+* The next action is added only where the platform did not already name one:
+* its own refusals for a dead session end by saying to sign in again, and
+* repeating that reads like a stutter.
+*/
+function endSession(said) {
+	const next = said.includes("wawesome login") ? "" : " Run 'wawesome login' to sign in again.";
+	console.error(`[wawesome] Error: ${said}${next}`);
 	process.exit(1);
 }
 //#endregion
@@ -1307,154 +1360,37 @@ async function renameTenantSlug(creds, slug) {
 }
 //#endregion
 //#region src/auth.ts
-/**
-* Ask what to call the workspace being created, and what it should answer at.
-*
-* There is no default name worth offering: a name nobody typed is exactly what
-* this replaced. The address has one — the name, slugified — because it is a
-* DNS label and typing it a second time is work the name already did. A
-* non-interactive login has nobody to ask, so it says what flag to pass rather
-* than inventing a name and minting a workspace under it; an address it is not
-* given is still minted, which is what a pipeline that says nothing gets.
-*/
-async function promptForWorkspace(options) {
-	const supplied = options.workspace?.trim();
-	if (supplied) return {
-		name: supplied,
-		address: options.address?.trim() || ""
-	};
-	if (!isInteractive()) throw new Error("No workspace found, and no name to create one with. Re-run with --workspace <name>.");
-	console.log("\n[wawesome] You don't have a workspace yet. Let's create one.");
-	console.log("  (the name is what you'll see in the dashboard; the address is the first half of every URL you deploy)");
-	const session = openPromptSession();
-	try {
-		for (let attempt = 0; attempt < 3; attempt++) {
-			const name = (await session.ask("  Workspace name?", "")).trim();
-			if (!name) {
-				console.log("[wawesome] A workspace needs a name.");
-				continue;
-			}
-			return {
-				name,
-				address: (await session.ask("  Public address?", options.address?.trim() || sanitizeSlug(name))).trim()
-			};
-		}
-	} finally {
-		session.close();
-	}
-	throw new Error("No workspace name given. Nothing was created.");
-}
-/**
-* Ask the person to accept the terms, which is what creating a workspace
-* through this door means too.
-*
-* Declining is the default answer, not the one that needs typing: end of input
-* takes the default, so a piped login that says nothing has accepted nothing —
-* the terminal's version of an unticked box. The flag is a word from the person
-* running the command rather than a prompt, so a pipeline reads the same as a
-* terminal, and both documents are linked either way.
-*/
-async function confirmTermsAccepted(options) {
-	if (options.acceptTerms) return;
-	if (!isInteractive()) throw new Error(`Creating a workspace means accepting the terms of service and the privacy policy, and there is no terminal to ask in. Read ${LEGAL_URLS.terms} and ${LEGAL_URLS.privacy}, then re-run with --accept-terms.`);
-	console.log("\n[wawesome] Creating a workspace means accepting:");
-	console.log(`    Terms of Service   ${LEGAL_URLS.terms}`);
-	console.log(`    Privacy Policy     ${LEGAL_URLS.privacy}`);
-	const session = openPromptSession();
-	try {
-		const answer = await session.ask("  Accept both?", "n");
-		if (/^y(es)?$/i.test(answer.trim())) return;
-	} finally {
-		session.close();
-	}
-	throw new Error("The terms were not accepted. Nothing was created.");
-}
-/**
-* Turn a finished OAuth callback into stored credentials.
-*
-* Split from the callback server so what login stores can be exercised without
-* a browser and a port.
-*/
-async function completeLogin({ gatewayUrl, dashboardUrl, accessToken, refreshToken, options }) {
-	const isVerbose = Boolean(options.verbose);
-	console.log("[wawesome] Fetching your workspaces...");
-	const tenantsRes = await fetch(`${gatewayUrl}/api/v1/me/tenants`, { headers: { Authorization: `Bearer ${accessToken}` } });
-	if (!tenantsRes.ok) throw new Error(`Failed to fetch tenants (HTTP ${tenantsRes.status}). Have you completed onboarding?`);
-	const tenants = await tenantsRes.json();
-	let primaryTenantId;
-	let workspaceName;
-	let workspaceSlug;
-	if (tenants.length === 0) {
-		const chosen = await promptForWorkspace(options);
-		await confirmTermsAccepted(options);
-		console.log(`[wawesome] Creating workspace "${chosen.name}"...`);
-		const initRes = await fetch(`${gatewayUrl}/api/v1/onboarding/init`, {
-			method: "POST",
-			headers: {
-				Authorization: `Bearer ${accessToken}`,
-				"Content-Type": "application/json"
-			},
-			body: JSON.stringify({
-				tenant_name: chosen.name,
-				tenant_slug: chosen.address || void 0,
-				accepted_terms: true
-			})
-		});
-		if (!initRes.ok) throw await asGatewayError(initRes, `Failed to initialize workspace (HTTP ${initRes.status}).`);
-		const initData = await initRes.json();
-		primaryTenantId = initData.tenant_id;
-		workspaceSlug = initData.tenant_slug;
-		workspaceName = initData.tenant_name || chosen.name;
-	} else primaryTenantId = tenants[0].tenant_id;
-	if (isVerbose) console.log(`[wawesome:verbose] Using tenant: ${primaryTenantId}`);
-	console.log("[wawesome] Exchanging for tenant-scoped credentials...");
-	const exchangeRes = await fetch(`${gatewayUrl}/api/v1/auth/token-exchange`, {
-		method: "POST",
-		headers: {
-			Authorization: `Bearer ${accessToken}`,
-			"Content-Type": "application/json"
-		},
-		body: JSON.stringify({ tenant_id: primaryTenantId })
-	});
-	if (!exchangeRes.ok) throw new Error(`Token exchange failed (HTTP ${exchangeRes.status}).`);
-	const exchangeData = await exchangeRes.json();
-	workspaceSlug = exchangeData.tenant_slug || workspaceSlug;
-	workspaceName = exchangeData.tenant_name || workspaceName;
-	let userEmail = exchangeData.email || "unknown";
-	try {
-		const payloadPart = exchangeData.tenant_jwt.split(".")[1];
-		const decoded = JSON.parse(Buffer.from(payloadPart, "base64url").toString("utf-8"));
-		if (decoded.email) userEmail = decoded.email;
-	} catch {}
+function storeSession({ gatewayUrl, dashboardUrl, session }) {
 	forgetRenewedSession();
 	writeCredentials({
 		gateway_url: gatewayUrl,
 		dashboard_url: dashboardUrl,
-		tenant_jwt: exchangeData.tenant_jwt,
-		refresh_token: refreshToken,
-		tenant_id: primaryTenantId,
-		user_email: userEmail,
-		tenant_slug: workspaceSlug,
-		tenant_name: workspaceName
+		tenant_jwt: session.tenant_jwt,
+		refresh_token: session.refresh_token,
+		tenant_id: session.tenant_id,
+		user_email: session.email,
+		tenant_slug: session.tenant_slug,
+		tenant_name: session.tenant_name
 	});
 	console.log("\n======================================================");
 	console.log("🎉 \x1B[32mLOGIN SUCCESSFUL!\x1B[0m");
 	console.log("======================================================");
-	if (workspaceName) console.log(`\n  Workspace: ${workspaceName}`);
-	if (workspaceSlug) console.log(`  Address:   ${workspaceSlug}`);
-	console.log(`  Tenant:    ${primaryTenantId}`);
+	if (session.tenant_name) console.log(`\n  Workspace: ${session.tenant_name}`);
+	if (session.tenant_slug) console.log(`  Address:   ${session.tenant_slug}`);
+	console.log(`  Tenant:    ${session.tenant_id}`);
 	console.log(`  Gateway:   ${gatewayUrl}`);
-	console.log(`  Email:     ${userEmail}`);
+	console.log(`  Email:     ${session.email}`);
 	console.log("\n  Credentials saved to ~/.wawesome/credentials.json");
 	console.log("======================================================\n");
 }
 /**
-* OAuth login flow:
-* 1. Build Supabase OAuth URL
-* 2. Open browser
-* 3. Listen on localhost for callback with access_token
-* 4. Exchange Supabase JWT for tenant-scoped JWT via gateway
-* 5. Store credentials in ~/.wawesome/credentials.json
+* Sign in: open the browser at the page built for it, and wait on loopback.
+*
+* Everything a person chooses happens there — which identity they sign in with,
+* which workspace the terminal acts in, and making one where they hold none —
+* so this end asks for nothing and knows no identity provider (#1113). What the
+* browser hands back is a single-use code, spent here against a verifier that
+* left this process only at the exchange.
 */
 async function login(options) {
 	const credential = credentialFromEnvironment();
@@ -1463,102 +1399,63 @@ async function login(options) {
 		process.exit(1);
 	}
 	const gatewayUrl = resolveGatewayUrlWithoutSession(options.gateway || options.api);
-	const dashboardUrl = resolveDashboardUrlForLogin(options.dashboard, gatewayUrl);
-	const provider = options.provider || "github";
 	const isVerbose = Boolean(options.verbose);
-	const authUrl = `${SUPABASE_URL}/auth/v1/authorize?provider=${provider}&redirect_to=${encodeURIComponent(`http://localhost:${OAUTH_CALLBACK_PORT}/callback`)}`;
-	console.log(`[wawesome] Starting ${provider} OAuth login...`);
 	console.log(`[wawesome] Gateway: ${gatewayUrl}`);
-	if (isVerbose) {
-		console.log(`[wawesome:verbose] Supabase URL: ${SUPABASE_URL}`);
-		console.log(`[wawesome:verbose] Auth URL: ${authUrl}`);
-	}
-	return new Promise((resolve, reject) => {
-		const server = http.createServer(async (req, res) => {
-			const reqUrl = new URL(req.url || "/", `http://localhost:${OAUTH_CALLBACK_PORT}`);
-			if (reqUrl.pathname === "/callback") {
-				res.writeHead(200, { "Content-Type": "text/html" });
-				res.end(`
-          <!DOCTYPE html>
-          <html>
-          <head><title>wawesome - Authentication</title></head>
-          <body style="font-family: system-ui; text-align: center; padding: 50px; background: #0f172a; color: #f8fafc;">
-            <h2>🔐 Authenticating with ${provider}...</h2>
-            <p>Transferring auth tokens back to CLI terminal...</p>
-            <script>
-              const hash = window.location.hash.substring(1);
-              const params = new URLSearchParams(hash);
-              const accessToken = params.get('access_token');
-              const refreshToken = params.get('refresh_token');
-
-              if (accessToken) {
-                fetch('/token?access_token=' + encodeURIComponent(accessToken) + '&refresh_token=' + encodeURIComponent(refreshToken || ''))
-                  .then(() => {
-                    document.body.innerHTML = '<h1>✅ Success!</h1><p>You can close this tab and return to your terminal.</p>';
-                  });
-              } else {
-                document.body.innerHTML = '<h1>❌ Error</h1><p>No access token found in URL hash.</p>';
-              }
-            <\/script>
-          </body>
-          </html>
-        `);
-				return;
-			}
-			if (reqUrl.pathname === "/token") {
-				const accessToken = reqUrl.searchParams.get("access_token");
-				const refreshToken = reqUrl.searchParams.get("refresh_token");
-				res.writeHead(200, { "Content-Type": "text/plain" });
-				res.end("Token received by CLI.");
-				if (!accessToken) {
-					console.error("[wawesome] Error: No access token received.");
-					server.close();
-					reject(/* @__PURE__ */ new Error("No access token received"));
-					return;
-				}
-				if (isVerbose) console.log("[wawesome:verbose] Supabase access token received.");
-				try {
-					await completeLogin({
-						gatewayUrl,
-						dashboardUrl,
-						accessToken,
-						refreshToken: refreshToken || void 0,
-						options
-					});
-					server.close();
-					resolve();
-				} catch (err) {
-					console.error(`[wawesome] Login failed: ${err instanceof Error ? err.message : err}`);
-					server.close();
-					reject(err);
-				}
-			} else {
-				res.writeHead(404, { "Content-Type": "text/plain" });
-				res.end("Not Found");
-			}
+	const callback = await listenForLoginCallback().catch((err) => {
+		console.error(`[wawesome] Error: ${errorText(err)}`);
+		process.exit(1);
+	});
+	const proof = mintProof();
+	try {
+		const started = await startSignIn(gatewayUrl, {
+			redirectUri: callback.redirectUrl,
+			challenge: proof.challenge,
+			state: callback.state
 		});
-		server.listen(OAUTH_CALLBACK_PORT, async () => {
-			console.log(`\n🌐 Listening for OAuth callback on http://localhost:${OAUTH_CALLBACK_PORT}/callback ...`);
-			console.log(`🚀 Opening browser for ${provider} authentication...`);
-			console.log(`👉 ${authUrl}\n`);
-			try {
-				const open = (await import("open")).default;
-				await open(authUrl);
-			} catch {
-				console.log("[wawesome] Could not open browser automatically. Please visit the URL above manually.");
-			}
+		if (isVerbose) console.log(`[wawesome:verbose] Sign-in: ${started.request}`);
+		console.log(`\n🌐 Waiting for the browser to come back to ${callback.redirectUrl} ...`);
+		console.log("🚀 Opening your browser to finish signing in...");
+		console.log(`👉 ${started.sign_in_url}\n`);
+		try {
+			const open = (await import("open")).default;
+			await open(started.sign_in_url);
+		} catch {
+			console.log("[wawesome] Could not open browser automatically. Please visit the URL above manually.");
+		}
+		const session = await exchangeCode(gatewayUrl, await waitForCode(callback.answer, started.expires_at), proof.verifier);
+		storeSession({
+			gatewayUrl,
+			dashboardUrl: resolveDashboardUrlForLogin(options.dashboard, started.sign_in_url),
+			session
 		});
-	});
+	} catch (err) {
+		console.error(`[wawesome] Login failed: ${errorText(err)}`);
+		throw err;
+	} finally {
+		callback.close();
+	}
 }
 /**
-* Clear stored credentials.
+* End the session, on the server and then on disk.
+*
+* The server first, because that is the half that makes a copy of the
+* credentials file worthless. Where the platform could not answer at all, the
+* file stays: it holds the only copy of the token that could end the session,
+* and deleting it would leave one open with nothing able to close it.
 */
-function logout() {
+async function logout() {
 	const credential = credentialFromEnvironment();
 	if (credential) {
 		reportSessionCommandRefused(credential, "The next command would authenticate all the same.");
 		process.exit(1);
 	}
+	const creds = readCredentials();
+	const stillOpen = creds ? await revokeSession(creds) : null;
+	if (stillOpen) {
+		console.error(`[wawesome] Error: your session could not be ended: ${stillOpen}`);
+		console.error("[wawesome] You are still signed in, and your credentials were kept. Run 'wawesome logout' again once you can reach the platform.");
+		process.exit(1);
+	}
 	forgetRenewedSession();
 	if (deleteCredentials()) console.log("[wawesome] ✅ Logged out. Credentials removed.");
 	else console.log("[wawesome] Not logged in (no credentials found).");
@@ -2397,50 +2294,216 @@ function collectAssets(dir) {
 	return assets;
 }
 /**
-* A **Static asset** a browser renders as a page. Read off the extension, as the
-* content type the platform records is — mirrors `content_type_for_path` in
-* `server/crates/core/src/features/assets/content_type.rs`.
+* A **Static asset** a browser renders as a page. Read off the extension, as the
+* content type the platform records is — mirrors `content_type_for_path` in
+* `server/crates/core/src/features/assets/content_type.rs`.
+*/
+function isDocument(assetPath) {
+	const name = assetPath.split("/").pop() ?? "";
+	const dot = name.lastIndexOf(".");
+	const extension = dot === -1 ? "" : name.slice(dot + 1).toLowerCase();
+	return extension === "html" || extension === "htm";
+}
+function hashFile(file) {
+	return sha256(fs.readFileSync(file));
+}
+function sha256(bytes) {
+	return crypto.createHash("sha256").update(bytes).digest("hex");
+}
+/**
+* What this deploy *is*: the server bundle together with the sorted set of
+* asset path and content-hash pairs, and the **Fallback document** it declares.
+*
+* Computed here, before anything is uploaded, so a deploy that changed nothing
+* is refused before a byte moves. Mirrors `deploy_digest` in
+* `server/crates/core/src/features/assets/identity.rs` — the gateway recomputes
+* it from what actually arrives, so the two have to agree exactly.
+*
+* A deploy declaring no fallback contributes nothing here rather than a stated
+* absence, so every digest computed before fallbacks existed is unmoved.
+*/
+const DEPLOY_DIGEST_DOMAIN = "wawesome-deploy-v1";
+function deployDigest(bundle, assets, fallback) {
+	const digest = crypto.createHash("sha256");
+	digest.update(`${DEPLOY_DIGEST_DOMAIN}\n`);
+	digest.update(`${sha256(bundle)}\n`);
+	for (const asset of [...assets].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0)) digest.update(`${asset.path}\0${asset.content_hash}\n`);
+	if (fallback) digest.update(`fallback\0${fallback.path}\0${fallback.status}\n`);
+	return digest.digest("hex");
+}
+/** The manifest as the gateway reads it — the bytes on disk are the CLI's business. */
+function manifestOf(assets) {
+	return assets.map(({ path, content_hash, size_bytes }) => ({
+		path,
+		content_hash,
+		size_bytes
+	}));
+}
+//#endregion
+//#region src/prompt.ts
+/**
+* Open a prompt session on stdin, queueing lines as they arrive.
+*
+* Reading one `rl.question` at a time drops piped input: it lands as a single
+* chunk, so every line after the first is emitted with no question pending.
+* End of input answers the remaining questions with their defaults.
+*/
+function openPromptSession() {
+	const rl = readline.createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	const queued = [];
+	const waiting = [];
+	let ended = false;
+	rl.on("line", (line) => {
+		const next = waiting.shift();
+		if (next) next(line);
+		else queued.push(line);
+	});
+	rl.on("close", () => {
+		ended = true;
+		while (waiting.length > 0) waiting.shift()?.(null);
+	});
+	function nextLine() {
+		if (queued.length > 0) return Promise.resolve(queued.shift());
+		if (ended) return Promise.resolve(null);
+		return new Promise((resolve) => waiting.push(resolve));
+	}
+	return {
+		async ask(question, defaultVal) {
+			const offered = defaultVal ? ` (${defaultVal})` : "";
+			process.stdout.write(`${question}${offered}: `);
+			const line = await nextLine();
+			if (line === null) {
+				process.stdout.write("\n");
+				return defaultVal;
+			}
+			return line.trim() || defaultVal;
+		},
+		close() {
+			rl.close();
+		}
+	};
+}
+/**
+* Whether a question can actually be put to somebody. A piped or redirected
+* stdin still answers — with end-of-input — so this only tells a caller whether
+* a *default* is going to be what the user gets.
+*/
+function isInteractive() {
+	return Boolean(process.stdin.isTTY);
+}
+//#endregion
+//#region ../shared/public-address.ts
+const INVOCATION_PREFIX = "/x";
+const SLUG_SEPARATOR = "--";
+const SURFACE_ROUTE = "/v1/invocation-surface";
+const SUBTREE_NOTE = "Every path beneath this address reaches the Function.";
+const ROOT_FUNCTION_SLUG = "root";
+/**
+* A gateway that serves no form of the address — and the value a client uses for
+* one that did not answer at all, deliberately the same: both name no address,
+* and there is nothing else either could honestly do.
+*/
+const NO_INVOCATION_SURFACE = {
+	contentOrigin: null,
+	pathFormOrigin: null
+};
+async function fetchInvocationSurface(gatewayUrl) {
+	const origin = trimTrailingSlashes(gatewayUrl);
+	const res = await fetch(`${origin}${SURFACE_ROUTE}`);
+	if (!res.ok) throw new Error(`Failed to read the gateway's address forms (HTTP ${res.status}).`);
+	const body = await res.json();
+	return {
+		contentOrigin: body.content_origin ?? null,
+		pathFormOrigin: body.path_form ? origin : null
+	};
+}
+/** The one address the Function answers at, `null` where it has none. */
+function publicAddress(surface, tenantSlug, appSlug, functionSlug) {
+	const base = appBase(surface, tenantSlug, appSlug);
+	if (base === null) return null;
+	if (functionSlug === "root") return base;
+	return `${base}/${encodeURIComponent(functionSlug)}`;
+}
+/**
+* Where one of a Function's static files answers, `null` where none of them do.
+*
+* A **Static asset** is served on the App's own hostname and on no other
+* address, so a gateway serving only the path form has no address to give for
+* one — see **Static route** in `CONTEXT.md`.
+*/
+function assetAddress(surface, tenantSlug, appSlug, functionSlug, assetPath) {
+	if (!surface.contentOrigin) return null;
+	const mount = publicAddress(surface, tenantSlug, appSlug, functionSlug);
+	if (mount === null) return null;
+	return `${mount}/${assetPath.split("/").map(encodeURIComponent).join("/")}`;
+}
+/** The same address with the app and function still to be chosen. */
+function publicAddressTemplate(surface, tenantSlug) {
+	if (surface.contentOrigin) {
+		if (!isLegalDnsLabel(tenantSlug)) return null;
+		const hostname = appHostname(surface.contentOrigin, `${tenantSlug}${SLUG_SEPARATOR}<app>`);
+		return hostname === null ? null : `${hostname}/<function>`;
+	}
+	if (surface.pathFormOrigin) return `${pathFormBase(surface.pathFormOrigin, tenantSlug)}/<app>/<function>`;
+	return null;
+}
+function appBase(surface, tenantSlug, appSlug) {
+	if (surface.contentOrigin) {
+		if (!isLegalDnsLabel(tenantSlug) || !isLegalDnsLabel(appSlug)) return null;
+		return appHostname(surface.contentOrigin, `${tenantSlug}${SLUG_SEPARATOR}${appSlug}`);
+	}
+	if (surface.pathFormOrigin) return `${pathFormBase(surface.pathFormOrigin, tenantSlug)}/${encodeURIComponent(appSlug)}`;
+	return null;
+}
+/**
+* The App's own hostname, built the way the gateway rebuilds it from its own
+* configuration: the label one level beneath the content domain. Callers check
+* the slugs the label is made of, since a slug the gateway would refuse to read
+* a `Host` for names no App there.
 */
-function isDocument(assetPath) {
-	const name = assetPath.split("/").pop() ?? "";
-	const dot = name.lastIndexOf(".");
-	const extension = dot === -1 ? "" : name.slice(dot + 1).toLowerCase();
-	return extension === "html" || extension === "htm";
+function appHostname(contentOrigin, label) {
+	let origin;
+	try {
+		origin = new URL(contentOrigin);
+	} catch {
+		return null;
+	}
+	return `${origin.protocol}//${label}.${origin.host}`;
 }
-function hashFile(file) {
-	return sha256(fs.readFileSync(file));
+/** The surface, or none where the gateway did not answer. */
+async function invocationSurfaceOrNone(gatewayUrl) {
+	try {
+		return await fetchInvocationSurface(gatewayUrl);
+	} catch {
+		return NO_INVOCATION_SURFACE;
+	}
 }
-function sha256(bytes) {
-	return crypto.createHash("sha256").update(bytes).digest("hex");
+function pathFormBase(origin, tenantSlug) {
+	return `${trimTrailingSlashes(origin)}${INVOCATION_PREFIX}/${encodeURIComponent(tenantSlug)}`;
 }
 /**
-* What this deploy *is*: the server bundle together with the sorted set of
-* asset path and content-hash pairs, and the **Fallback document** it declares.
-*
-* Computed here, before anything is uploaded, so a deploy that changed nothing
-* is refused before a byte moves. Mirrors `deploy_digest` in
-* `server/crates/core/src/features/assets/identity.rs` — the gateway recomputes
-* it from what actually arrives, so the two have to agree exactly.
-*
-* A deploy declaring no fallback contributes nothing here rather than a stated
-* absence, so every digest computed before fallbacks existed is unmoved.
+* The legal DNS label closest to what somebody typed, empty where nothing legal
+* survives. What a workspace name suggests as an address, and what the CLI
+* offers as a default — never applied to a typed address, which is refused
+* rather than rewritten into a name nobody chose.
 */
-const DEPLOY_DIGEST_DOMAIN = "wawesome-deploy-v1";
-function deployDigest(bundle, assets, fallback) {
-	const digest = crypto.createHash("sha256");
-	digest.update(`${DEPLOY_DIGEST_DOMAIN}\n`);
-	digest.update(`${sha256(bundle)}\n`);
-	for (const asset of [...assets].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0)) digest.update(`${asset.path}\0${asset.content_hash}\n`);
-	if (fallback) digest.update(`fallback\0${fallback.path}\0${fallback.status}\n`);
-	return digest.digest("hex");
+function slugifyLabel(raw) {
+	let label = "";
+	for (const c of raw.trim().toLowerCase()) if (c >= "a" && c <= "z" || c >= "0" && c <= "9") label += c;
+	else if (label.length > 0 && !label.endsWith("-")) label += "-";
+	label = label.slice(0, 63);
+	while (label.endsWith("-")) label = label.slice(0, -1);
+	return label;
 }
-/** The manifest as the gateway reads it — the bytes on disk are the CLI's business. */
-function manifestOf(assets) {
-	return assets.map(({ path, content_hash, size_bytes }) => ({
-		path,
-		content_hash,
-		size_bytes
-	}));
+/** Must match `dns_label::is_legal` in `server/crates/core/src/value_objects.rs`. */
+function isLegalDnsLabel(candidate) {
+	return candidate.length > 0 && candidate.length <= 63 && !candidate.startsWith("-") && !candidate.endsWith("-") && !candidate.includes("--") && /^[a-z0-9-]+$/.test(candidate);
+}
+function trimTrailingSlashes(origin) {
+	return origin.replace(/\/+$/, "");
 }
 //#endregion
 //#region src/deploy-target.ts
@@ -3885,6 +3948,33 @@ function renderPostDeploy(postDeploy, address) {
 	return postDeploy.split("{{url}}").join(address);
 }
 //#endregion
+//#region src/slug.ts
+/**
+* The character rules every slug on the platform obeys, mirrored from the
+* `dns_label` module in `server/crates/core/src/value_objects.rs`.
+*
+* A typed name is checked while the user is still standing there, rather than
+* accepted, sent, and rewritten by the gateway into something else that ends up
+* in a client's dashboard. The rules live beside the address they build, so the
+* CLI and the dashboard cannot come to disagree about what a legal name is.
+*/
+/** Maximum length of a single DNS label (RFC 1035 §2.3.4). */
+const MAX_SLUG_LENGTH = 63;
+/**
+* Normalise arbitrary input into a legal DNS label, returning an empty string
+* when nothing legal survives — callers decide whether that is an error.
+*/
+function sanitizeSlug(raw) {
+	return slugifyLabel(raw);
+}
+/**
+* Whether `candidate` is already a legal DNS label — i.e. whether
+* {@link sanitizeSlug} would leave it untouched.
+*/
+function isLegalSlug(candidate) {
+	return candidate.length > 0 && candidate.length <= MAX_SLUG_LENGTH && !candidate.startsWith("-") && !candidate.endsWith("-") && !candidate.includes("--") && /^[a-z0-9-]+$/.test(candidate);
+}
+//#endregion
 //#region src/tarball.ts
 /**
 * Reading a repository archive, so scaffolding needs no git.
@@ -5576,7 +5666,7 @@ async function renameWorkspace(slug, options) {
 		console.log("✅ \x1B[32mWORKSPACE RENAMED\x1B[0m");
 		console.log("======================================================");
 		console.log(`\n  Address:  ${result.tenant_slug}`);
-		console.log(`  Previous: ${result.previous_slug} (still resolves)`);
+		console.log(`  Previous: ${result.previous_slug} (no longer resolves)`);
 		console.log("======================================================\n");
 	} catch (err) {
 		if (err instanceof GatewayError) {
@@ -5591,12 +5681,117 @@ async function renameWorkspace(slug, options) {
 		process.exit(1);
 	}
 }
+/**
+* The workspaces this person belongs to, with the one the session is in
+* marked.
+*
+* Which one that is comes from the platform rather than from the credentials
+* file: a switch in another terminal moved the session without this one
+* hearing about it.
+*/
+async function listWorkspaces(options) {
+	const read = await requireWorkspaces(requireSession("Your workspaces would be read for that credential's Tenant alone."));
+	console.log("\n[wawesome] Your workspaces:\n");
+	const width = Math.max(...read.workspaces.map((workspace) => workspace.name.length));
+	for (const workspace of read.workspaces) {
+		const mark = workspace.tenant_id === read.current_tenant_id ? "\x1B[32m*\x1B[0m" : " ";
+		const tenant = options.verbose ? `  ${workspace.tenant_id}` : "";
+		console.log(`  ${mark} ${workspace.name.padEnd(width)}  ${workspace.tenant_slug}  (${workspace.role})${tenant}`);
+	}
+	if (read.workspaces.length > 1) console.log("\n  Move with: \x1B[36mwawesome workspace switch <name>\x1B[0m");
+	console.log("");
+}
+/**
+* Move the session to another workspace.
+*
+* The list is read first, so a name is resolved against what the person
+* actually belongs to and a workspace that is none of theirs is answered with
+* the ones that are. The platform checks the **Membership** again either way,
+* so this is where somebody is told rather than where it is decided.
+*/
+async function switchWorkspace(target, options) {
+	const creds = requireSession("A switch would move a session that credential does not have.");
+	if (!target || !target.trim()) {
+		console.error("[wawesome] Error: No workspace given. Usage: wawesome workspace switch <name>");
+		process.exit(1);
+		return;
+	}
+	const read = await requireWorkspaces(creds);
+	const asked = target.trim();
+	const matched = read.workspaces.filter((workspace) => workspace.tenant_slug === asked || workspace.tenant_id === asked || workspace.name.toLowerCase() === asked.toLowerCase());
+	if (matched.length === 0) return notYours(asked, read);
+	if (matched.length > 1) return sharedName(asked, matched);
+	const [moving] = matched;
+	if (moving.tenant_id === read.current_tenant_id) {
+		console.log(`[wawesome] Already in ${moving.name} (${moving.tenant_slug}). Nothing changed.`);
+		return;
+	}
+	if (options.verbose) console.log(`[wawesome:verbose] Switching to ${moving.tenant_id}`);
+	try {
+		await switchWorkspaceTo(creds, moving.tenant_id);
+	} catch (err) {
+		console.error(`[wawesome] Error: ${errorText(err)}`);
+		process.exit(1);
+		return;
+	}
+	console.log("\n======================================================");
+	console.log("✅ \x1B[32mWORKSPACE SWITCHED\x1B[0m");
+	console.log("======================================================");
+	console.log(`\n  Workspace: ${moving.name}`);
+	console.log(`  Address:   ${moving.tenant_slug}`);
+	console.log(`  Role:      ${moving.role}`);
+	console.log("======================================================\n");
+}
 /** Dispatch for `wawesome workspace [action]`. */
 async function workspaceCommand(action, target, options) {
 	if (!action || action === "show" || action === "info") return showWorkspace(options);
 	if (action === "rename") return renameWorkspace(target, options);
+	if (action === "list" || action === "ls") return listWorkspaces(options);
+	if (action === "switch") return switchWorkspace(target, options);
 	console.error(`[wawesome] Error: Unknown workspace action '${action}'.`);
-	console.error("[wawesome] Usage: wawesome workspace [show|rename <name>]");
+	console.error("[wawesome] Usage: wawesome workspace [show|list|switch <name>|rename <name>]");
+	process.exit(1);
+}
+/**
+* The session these two commands act on, which is a person's and never a
+* **Deploy credential**: a credential names one Tenant and holds no
+* **Membership** anywhere, so there is nothing for it to list or move.
+*/
+function requireSession(consequence) {
+	const credential = credentialFromEnvironment();
+	if (credential) {
+		reportSessionCommandRefused(credential, consequence);
+		process.exit(1);
+	}
+	const creds = requireCredentials$1();
+	if (!creds.refresh_token) {
+		console.error("[wawesome] Error: This session predates workspace switching.");
+		console.error("[wawesome] Run 'wawesome login' to sign in again.");
+		process.exit(1);
+	}
+	return creds;
+}
+async function requireWorkspaces(creds) {
+	try {
+		return await readWorkspaces(creds);
+	} catch (err) {
+		console.error(`[wawesome] Error: ${errorText(err)}`);
+		process.exit(1);
+	}
+}
+/** Refused here rather than at the platform, and answered with the ones that are theirs. */
+function notYours(asked, read) {
+	refuse(`You are not a member of '${asked}'.`, "The workspaces you are in:", read.workspaces.map((workspace) => `${workspace.name} (${workspace.tenant_slug})`));
+}
+/** Two workspaces may be called the same thing; their addresses cannot. */
+function sharedName(asked, matched) {
+	refuse(`More than one of your workspaces is called '${asked}'.`, "Name one by its address instead:", matched.map((workspace) => `wawesome workspace switch ${workspace.tenant_slug}`));
+}
+function refuse(headline, next, lines) {
+	console.error(`\n[wawesome] \x1b[31m${headline}\x1b[0m`);
+	console.error(`[wawesome] ${next}`);
+	for (const line of lines) console.error(`             ${line}`);
+	console.error("");
 	process.exit(1);
 }
 //#endregion
@@ -5657,16 +5852,144 @@ const MINT_PRESETS = [
 			"write:apps",
 			"write:functions",
 			"write:env",
+			"write:domains",
 			"write:runs",
 			"write:schedules",
 			"write:previews"
 		],
-		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist, and can create Apps, deploy Functions, set environment variables, run Functions, pause and resume schedules and create previews. It does not attach domains."
+		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist, and can create Apps, deploy Functions, set environment variables, attach domains, run Functions, pause and resume schedules and create previews."
 	}
 ];
 function mintPreset(name) {
 	return MINT_PRESETS.find((preset) => preset.name === name);
 }
+[
+	{
+		code: "owner",
+		job: "Own the workspace",
+		capabilities: [
+			"read:tenant",
+			"write:tenant",
+			"read:apps",
+			"write:apps",
+			"read:functions",
+			"write:functions",
+			"read:env",
+			"write:env",
+			"read:domains",
+			"write:domains",
+			"delete:domains",
+			"read:invocations",
+			"read:runs",
+			"write:runs",
+			"read:schedules",
+			"write:schedules",
+			"read:previews",
+			"write:previews",
+			"read:egress",
+			"write:egress",
+			"write:billing",
+			"write:credentials",
+			"write:members"
+		],
+		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist, and can rename the workspace, create Apps, deploy Functions, set environment variables, attach domains, detach domains, run Functions, pause and resume schedules, create previews, widen the egress allowlist, change billing, manage credentials and manage members.",
+		withheldFromAPerson: "A workspace has one owner, so 'owner' is not a standing anybody is put at."
+	},
+	{
+		code: "admin",
+		job: "Administer the workspace",
+		capabilities: [
+			"read:tenant",
+			"read:apps",
+			"write:apps",
+			"read:functions",
+			"write:functions",
+			"read:env",
+			"write:env",
+			"read:domains",
+			"write:domains",
+			"delete:domains",
+			"read:invocations",
+			"read:runs",
+			"write:runs",
+			"read:schedules",
+			"write:schedules",
+			"read:previews",
+			"write:previews",
+			"read:egress",
+			"write:egress",
+			"write:credentials",
+			"write:members"
+		],
+		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist, and can create Apps, deploy Functions, set environment variables, attach domains, detach domains, run Functions, pause and resume schedules, create previews, widen the egress allowlist, manage credentials and manage members. It does not rename the workspace or change billing.",
+		withheldFromAPerson: null
+	},
+	{
+		code: "member",
+		job: "Build in the workspace",
+		capabilities: [
+			"read:tenant",
+			"read:apps",
+			"read:functions",
+			"read:env",
+			"read:domains",
+			"read:invocations",
+			"read:runs",
+			"read:schedules",
+			"read:previews",
+			"read:egress",
+			"write:apps",
+			"write:functions",
+			"write:env",
+			"write:domains",
+			"write:runs",
+			"write:schedules",
+			"write:previews"
+		],
+		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist, and can create Apps, deploy Functions, set environment variables, attach domains, run Functions, pause and resume schedules and create previews. It does not rename the workspace, detach domains, widen the egress allowlist, change billing, manage credentials or manage members.",
+		withheldFromAPerson: null
+	},
+	{
+		code: "deployer",
+		job: "Ship and read back",
+		capabilities: [
+			"read:tenant",
+			"read:apps",
+			"read:functions",
+			"read:env",
+			"read:domains",
+			"read:invocations",
+			"read:runs",
+			"read:schedules",
+			"read:previews",
+			"read:egress",
+			"write:apps",
+			"write:functions",
+			"write:env",
+			"write:runs"
+		],
+		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist, and can create Apps, deploy Functions, set environment variables and run Functions. It does not rename the workspace, attach domains, detach domains, pause and resume schedules, create previews, widen the egress allowlist, change billing, manage credentials or manage members.",
+		withheldFromAPerson: "'deployer' is the recipe a Deploy credential is cut from. A pipeline gets a credential of its own rather than somebody's account."
+	},
+	{
+		code: "viewer",
+		job: "Read and investigate",
+		capabilities: [
+			"read:tenant",
+			"read:apps",
+			"read:functions",
+			"read:env",
+			"read:domains",
+			"read:invocations",
+			"read:runs",
+			"read:schedules",
+			"read:previews",
+			"read:egress"
+		],
+		summary: "Reads the workspace, Apps, Functions, environment variables, domains, invocations, runs, schedules, previews and the egress allowlist. It writes nothing.",
+		withheldFromAPerson: "'viewer' reaches every read in the workspace: the plan, what it has spent, the environment variables and every App. Nobody is put at it."
+	}
+].filter((role) => role.withheldFromAPerson === null);
 //#endregion
 //#region src/deploy-credentials.ts
 const SECRET_SHOWN_ONCE = "Copy it now. This is the only time it will be shown. If you lose it, revoke this credential and mint another.";
@@ -6127,10 +6450,10 @@ cli.command("env rm <key>", "Delete an environment variable from the current app
 cli.command("domains [action] [hostname]", "Show the custom domain on the current app, its state and its DNS records").usage("domains [action] [hostname]\n\nWith no action, prints the app's domain, every half of it, where each got to, when the platform last checked, and the records to add.\n\nActions:\n  adopt               Write the attached domain into wawesome-function.json\n  detach <hostname>   Stop serving the app at a domain you attached\n\nA domain is attached by declaring it in wawesome-function.json and deploying, from the dashboard, or by an agent.").example("wawesome domains").example("wawesome domains adopt").example("wawesome domains detach shop.client.com").option("-a, --app <slug>", "App to act on (default: the app in wawesome-function.json)").action((action, hostname, options) => domainsCommand(action, hostname, options));
 cli.command("domains adopt", "Write the domain the current app answers at into wawesome-function.json").option("-a, --app <slug>", "App to act on (default: the app in wawesome-function.json)").action((options) => adoptDomainCommand(void 0, options));
 cli.command("domains detach <hostname>", "Stop serving the current app at a domain you attached").option("-a, --app <slug>", "App to act on (default: the app in wawesome-function.json)").action((hostname, options) => detachDomainCommand(hostname, options));
-cli.command("login", "Authenticate with the wawesome.io platform").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("--gateway <url>", "Alias for --api <url>").option("--dashboard <url>", "Dashboard URL (default: https://dashboard.wawesome.io)").option("--provider <name>", "OAuth provider (default: github)").option("--workspace <name>", "Name for the workspace, when signing up without a terminal to prompt").option("--address <name>", "Public address for the workspace being created (default: one is minted)").option("--accept-terms", "Accept the terms of service and privacy policy, when signing up without a terminal to prompt").option("-v, --verbose", "Enable verbose debug output").action((options) => login(options));
-cli.command("logout", "Clear stored authentication credentials").action(() => logout());
+cli.command("login", "Authenticate with the wawesome.io platform").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("--gateway <url>", "Alias for --api <url>").option("--dashboard <url>", "Dashboard URL to record (default: the one the platform names)").option("-v, --verbose", "Enable verbose debug output").action((options) => login(options));
+cli.command("logout", "Clear stored authentication credentials").action(async () => await logout());
 cli.command("whoami", "Show current login session info").action(() => whoami());
-cli.command("workspace [action] [name]", "Show the workspace, or rename its public address").usage("workspace <action> [name]\n\nActions:\n  show                Show the workspace name, address, and whether it can still change\n  rename <name>       Change the public address, while nothing live depends on it").example("wawesome workspace").example("wawesome workspace rename northwind").option("-v, --verbose", "Enable verbose debug output").action((action, name, options) => workspaceCommand(action, name, options));
+cli.command("workspace [action] [name]", "Show the workspace, move between workspaces, or rename the public address").usage("workspace <action> [name]\n\nActions:\n  show                Show the workspace name, address, and whether it can still change\n  list (ls)           Show the workspaces you belong to, and which one you are in\n  switch <name>       Move this terminal to another workspace you belong to\n  rename <name>       Change the public address, while nothing live depends on it").example("wawesome workspace").example("wawesome workspace list").example("wawesome workspace switch northwind").example("wawesome workspace rename northwind").option("-v, --verbose", "Enable verbose debug output").action((action, name, options) => workspaceCommand(action, name, options));
 cli.command("templates [action]", "Browse the template catalog").usage("templates [action]\n\nActions:\n  list (ls)           Show every available template (default)").example("wawesome templates").example("wawesome templates list").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("-v, --verbose", "Enable verbose debug output").action((action, options) => templatesCommand(action, options));
 cli.command("credentials [action] [target]", "Mint, list, regenerate, revoke and delete deploy credentials").alias("credential").usage(`credentials <action> [options]
 
@@ -6166,7 +6489,7 @@ cli.command("credentials list", "List deploy credentials, never their secrets").
 cli.command("credentials regenerate <name-or-prefix>", "Replace a deploy credential's secret, keeping its name, capabilities and Apps").option("--expires <days|never>", "Days until the regenerated credential expires, or 'never' (default: 90)").option("-y, --yes", "Regenerate without being asked to confirm").option("-v, --verbose", "Enable verbose debug output").action((target, options) => regenerateCredentialCommand(target, options));
 cli.command("credentials revoke <name-or-prefix>", "Revoke a deploy credential, immediately and for good").option("-y, --yes", "Revoke without being asked to confirm").option("-v, --verbose", "Enable verbose debug output").action((target, options) => revokeCredentialCommand(target, options));
 cli.command("credentials delete <name-or-prefix>", "Delete a revoked or expired deploy credential, freeing its name").option("-y, --yes", "Delete without being asked to confirm").option("-v, --verbose", "Enable verbose debug output").action((target, options) => deleteCredentialCommand(target, options));
-cli.command("init", "Scaffold a new function project in the current directory").usage("init [options]\n\nWith --template, the project is fetched from the template catalog, wired up\nfrom what the template declares it needs, and deployed. Run 'wawesome templates'\nto see what is available.").example("wawesome init").example("wawesome init --template stripe-webhook").option("-t, --template <name>", "Scaffold from a catalog template and deploy it").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("--dashboard <url>", "Dashboard URL (default: https://dashboard.wawesome.io)").option("--no-install", "Skip installing dependencies after scaffolding").option("--root", "Generate a root function router template").option("-v, --verbose", "Enable verbose debug output").action((options) => init(options));
+cli.command("init", "Scaffold a new function project in the current directory").usage("init [options]\n\nWith --template, the project is fetched from the template catalog, wired up\nfrom what the template declares it needs, and deployed. Run 'wawesome templates'\nto see what is available.").example("wawesome init").example("wawesome init --template stripe-webhook").option("-t, --template <name>", "Scaffold from a catalog template and deploy it").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("--dashboard <url>", "Dashboard URL to record (default: the one the platform names)").option("--no-install", "Skip installing dependencies after scaffolding").option("--root", "Generate a root function router template").option("-v, --verbose", "Enable verbose debug output").action((options) => init(options));
 cli.command("logs [function-name-or-invocation-id]", "View invocation history, fetch log output, or follow live").usage(`logs [target] [options]
 
   The target argument determines what the command does: