wawesome 0.22.0 → 0.24.0

package/dist/index.mjs

@@ -1,3 +1,4 @@
+import { C as asGatewayError, E as rejectionOf, S as GatewayError, T as reasonOf, a as manifestOf, b as reportSessionCommandRefused, c as getDashboardUrl, d as readCredentials, f as readFunctionConfig, g as CREDENTIAL_ENV_VAR, h as writeCredentials, l as getFunctionConfigPath, m as resolveGatewayUrlWithoutSession, n as deployDigest, o as LOGIN_CALLBACK_PORT, p as resolveDashboardUrlForLogin, r as isDocument, s as deleteCredentials, t as collectAssets, u as getGatewayUrl, v as credentialFromEnvironment, w as errorText, x as unauthorizedMessage, y as credentialPrefix } from "./assets-Cgw3_rAq.mjs";
 import { i as polyfilledGlobals, n as declaredModules, o as unsupportedGlobals, r as methodRemedy, t as declaredMethods } from "./guest-surface-BwrNP2Cz.mjs";
 import cac from "cac";
 import fs from "node:fs";
@@ -10,7 +11,7 @@ import crypto from "node:crypto";
 import http from "node:http";
 import { Readable } from "node:stream";
 import readline from "node:readline";
-import { confirm, select } from "@inquirer/prompts";
+import { confirm, input, select } from "@inquirer/prompts";
 import zlib from "node:zlib";
 //#region src/brand.ts
 const PLAIN = "[w] wawesome";
@@ -26,249 +27,6 @@ function lockup(stream = process.stdout, env = process.env) {
 }
 const LOCKUP_HTML = "<div style=\"margin-bottom: 24px; font: 700 20px/1 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; letter-spacing: -0.02em; color: #e8eaf0\"><span style=\"font-size: 22px; letter-spacing: -0.06em\"><span style=\"color: #6b7cff\">[</span>w<span style=\"color: #6b7cff\">]</span></span>&nbsp;wawesome</div>";
 //#endregion
-//#region src/errors.ts
-/**
-* A rejection carrying the gateway's own prose and, where given, its reason.
-*
-* The call's trace id rides in the message itself, on a line of its own, so
-* every place that prints a refusal prints the one thing support can search by.
-*/
-var GatewayError = class extends Error {
-	status;
-	reason;
-	/** The raw response, for `--verbose` to print when the prose is not enough. */
-	body;
-	traceId;
-	constructor(message, status, reason, body = "", traceId) {
-		super(traceId ? `${message}\n${traceLine(traceId)}` : message);
-		this.name = "GatewayError";
-		this.status = status;
-		this.reason = reason;
-		this.body = body;
-		this.traceId = traceId;
-	}
-};
-function traceLine(traceId) {
-	return `Trace ID: ${traceId}`;
-}
-/**
-* Read a failed response into a `GatewayError`.
-*
-* `fallback` is used only when the response carries no prose of its own — a
-* proxy's HTML error page, or an empty body. A 401 is deliberately *not* special
-* cased here: what to say about an expired session depends on what the caller
-* was doing, so callers handle it before reaching this.
-*/
-async function asGatewayError(res, fallback) {
-	const traceId = res.headers?.get("x-wawesome-trace-id") ?? void 0;
-	return rejectionOf(await res.text().catch(() => ""), res.status, fallback, traceId);
-}
-/**
-* The same reading, for a caller that has already taken the body off the wire.
-* `traceId` is the header's, for a body that never made it here as JSON.
-*/
-function rejectionOf(body, status, fallback, traceId) {
-	try {
-		const parsed = JSON.parse(body);
-		return new GatewayError(parsed.error || fallback, status, parsed.reason, body, parsed.trace_id || traceId);
-	} catch {
-		return new GatewayError(fallback, status, void 0, body, traceId);
-	}
-}
-/** Why the gateway refused, where what was thrown might not be a refusal at all. */
-function reasonOf(err) {
-	return err instanceof GatewayError ? err.reason : void 0;
-}
-/** What went wrong, as text, whatever was thrown. */
-function errorText(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-//#endregion
-//#region src/credential.ts
-const CREDENTIAL_ENV_VAR = "WAWESOME_DEPLOY_CREDENTIAL";
-function credentialFromEnvironment() {
-	const secret = process.env[CREDENTIAL_ENV_VAR]?.trim();
-	return secret ? secret : null;
-}
-/** Enough to match a credential against the one in a CI settings page, and no more. */
-function credentialPrefix(secret) {
-	return secret.slice(0, 11);
-}
-/**
-* A credential has no session behind it, so the platform's own reason — unknown,
-* revoked, expired, or a scope it does not carry — is the whole answer, and
-* "sign in again" names a door a CI runner cannot open.
-*/
-function unauthorizedMessage(status, body) {
-	const secret = credentialFromEnvironment();
-	if (!secret) {
-		const refusal = rejectionOf(body, status, `The platform refused this request (HTTP ${status}).`);
-		if (status !== 401) return refusal.message;
-		const expired = "Authentication expired. Run 'wawesome login' again.";
-		return refusal.traceId ? `${expired}\n${traceLine(refusal.traceId)}` : expired;
-	}
-	return rejectionOf(body, status, `The deploy credential ${credentialPrefix(secret)} was refused (HTTP ${status}).`).message;
-}
-function reportSessionCommandRefused(secret, consequence) {
-	console.error(`[wawesome] Error: ${CREDENTIAL_ENV_VAR} is set, so this CLI authenticates as deploy credential ${credentialPrefix(secret)}.`);
-	console.error(`[wawesome] ${consequence} Unset ${CREDENTIAL_ENV_VAR} first.`);
-}
-//#endregion
-//#region src/config.ts
-/** Path to the user-level settings file (~/.wawesome/settings.json) */
-function getSettingsPath() {
-	return path.join(os.homedir(), ".wawesome", "settings.json");
-}
-/**
-* Read stored user settings from ~/.wawesome/settings.json.
-*/
-function readSettings() {
-	const settingsPath = getSettingsPath();
-	if (!fs.existsSync(settingsPath)) return {};
-	try {
-		const raw = fs.readFileSync(settingsPath, "utf-8");
-		return JSON.parse(raw);
-	} catch {
-		return {};
-	}
-}
-const GATEWAY_ENV_NAMES = ["GATEWAY_URL", "WAWESOME_GATEWAY_URL"];
-const DASHBOARD_ENV_NAMES = ["DASHBOARD_URL", "WAWESOME_DASHBOARD_URL"];
-const GATEWAY_URL_FALLBACK = "https://api.wawesome.io";
-const DASHBOARD_URL_FALLBACK = "https://dashboard.wawesome.io";
-function resolveAddress(overrideUrl, envNames, settingsKey, stored, fallback) {
-	if (overrideUrl) return overrideUrl;
-	for (const name of envNames) {
-		const fromEnv = process.env[name];
-		if (fromEnv) return fromEnv;
-	}
-	const configured = readSettings()[settingsKey];
-	if (configured && typeof configured === "string") return configured;
-	return stored || fallback;
-}
-function getGatewayUrl(overrideUrl) {
-	return resolveAddress(overrideUrl, GATEWAY_ENV_NAMES, "gateway_url", readStoredCredentials()?.gateway_url, GATEWAY_URL_FALLBACK);
-}
-/**
-* A tenant token is only valid at the gateway that issued it, so every other
-* command has to follow the credentials. A login holds no token yet, and
-* reading that rung here made a local gateway outlive the removal of every
-* documented override, since only `logout` clears it. A **Deploy credential**
-* reads the same rungs, and for a sharper reason: following a stale file would
-* present it at a gateway that never minted it.
-*/
-function resolveGatewayUrlWithoutSession(overrideUrl) {
-	return resolveAddress(overrideUrl, GATEWAY_ENV_NAMES, "gateway_url", void 0, GATEWAY_URL_FALLBACK);
-}
-getGatewayUrl();
-function getDashboardUrl(overrideUrl) {
-	return resolveAddress(overrideUrl, DASHBOARD_ENV_NAMES, "dashboard_url", readStoredCredentials()?.dashboard_url, DASHBOARD_URL_FALLBACK);
-}
-/**
-* The dashboard for the environment this login is going to.
-*
-* Taken from the address the platform handed back to open, so a login that
-* configures nothing stores the dashboard belonging to the gateway it signed
-* into. An explicit flag, `DASHBOARD_URL` or a settings file still outrank it,
-* on the rung they outrank every other address on.
-*/
-function resolveDashboardUrlForLogin(overrideUrl, signInUrl) {
-	return resolveAddress(overrideUrl, DASHBOARD_ENV_NAMES, "dashboard_url", originOf(signInUrl), DASHBOARD_URL_FALLBACK);
-}
-/** Undefined rather than throwing: an unreadable address falls to the rung below. */
-function originOf(url) {
-	try {
-		return new URL(url).origin;
-	} catch {
-		return;
-	}
-}
-const LOGIN_CALLBACK_PORT = 9999;
-/** Path to the user-level credentials file */
-function getCredentialsPath() {
-	return path.join(os.homedir(), ".wawesome", "credentials.json");
-}
-/**
-* What this process authenticates with: the **Deploy credential** in the
-* environment where one is set, and otherwise the session `login` left on disk.
-*
-* The environment wins outright rather than filling a gap, so a CI runner
-* carrying a stale cached home directory still authenticates as itself.
-*/
-function readCredentials() {
-	const secret = credentialFromEnvironment();
-	return secret ? environmentCredential(secret) : readStoredCredentials();
-}
-/**
-* A credential wears the shape of a session so that every command reaches the
-* platform the same way. What it does not carry is the point: no refresh token,
-* because there is nothing behind it to renew, and no Tenant, because the
-* platform resolves that from the credential.
-*/
-function environmentCredential(secret) {
-	return {
-		gateway_url: resolveGatewayUrlWithoutSession(void 0),
-		tenant_jwt: secret,
-		credential_prefix: credentialPrefix(secret)
-	};
-}
-/** The session on disk, whatever the environment says. */
-function readStoredCredentials() {
-	const credPath = getCredentialsPath();
-	if (!fs.existsSync(credPath)) return null;
-	try {
-		const raw = fs.readFileSync(credPath, "utf-8");
-		return JSON.parse(raw);
-	} catch {
-		return null;
-	}
-}
-/**
-* Write credentials to disk, creating the directory if needed.
-*
-* Owner-only, because the file holds a refresh token. The `chmod` is what
-* tightens a file an older CLI left world-readable; a mode passed to
-* `writeFileSync` applies only where it creates the file.
-*/
-function writeCredentials(creds) {
-	if (credentialFromEnvironment()) return;
-	const credPath = getCredentialsPath();
-	const dir = path.dirname(credPath);
-	fs.mkdirSync(dir, {
-		recursive: true,
-		mode: 448
-	});
-	fs.writeFileSync(credPath, JSON.stringify(creds, null, 2), {
-		encoding: "utf-8",
-		mode: 384
-	});
-	fs.chmodSync(credPath, 384);
-}
-/**
-* Delete stored credentials.
-*/
-function deleteCredentials() {
-	const credPath = getCredentialsPath();
-	if (fs.existsSync(credPath)) {
-		fs.rmSync(credPath, { force: true });
-		return true;
-	}
-	return false;
-}
-function getFunctionConfigPath(projectDir) {
-	return path.join(projectDir || process.cwd(), "wawesome-function.json");
-}
-function readFunctionConfig(projectDir) {
-	const configPath = getFunctionConfigPath(projectDir);
-	if (!fs.existsSync(configPath)) return null;
-	try {
-		const raw = fs.readFileSync(configPath, "utf-8");
-		return JSON.parse(raw);
-	} catch {
-		return null;
-	}
-}
-//#endregion
 //#region src/sourcemap.ts
 const BASE64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 const NO_POSITION = () => null;
@@ -929,7 +687,7 @@ async function buildHandler(entryInput, config, options) {
 * that has to name this version — `--version`, the dependency a scaffolded
 * project pins — reads it here, so a release bumps one file.
 */
-const CLI_VERSION = "0.22.0";
+const CLI_VERSION = "0.24.0";
 //#endregion
 //#region src/cli-login.ts
 const START_PATH = "/v1/cli/login/start";
@@ -1309,6 +1067,44 @@ function endSession(said) {
 	process.exit(1);
 }
 //#endregion
+//#region src/schedules.ts
+/**
+* When a schedule next runs, or why it does not run at all.
+*
+* The three ways of being off never render alike, and a schedule that is off
+* twice over says so: someone who reads only the pause will declare it again,
+* press resume, and file a bug when neither starts it.
+*/
+function whenItRuns(schedule) {
+	const undeclared = schedule.declared === false;
+	if (schedule.state === "suspended") {
+		const why = "The workspace owes payment, its subscription ended, or it has spent past its plan's allowance";
+		return undeclared ? `suspended, and not in this config file. ${why}; declare it again too` : `suspended. ${why}`;
+	}
+	if (schedule.state === "paused") return undeclared ? "paused, and not in this config file. Declare it again, then resume" : "paused. Resume it to run again";
+	if (undeclared) return "not in this config file, so it is disabled. Its history is kept";
+	if (schedule.state !== "active") return schedule.state;
+	return schedule.next_fire_at ? `next run ${asUtc$1(schedule.next_fire_at)}` : "next run unknown";
+}
+/** `2026-08-23 03:00 UTC`, which is the zone every expression is read in. */
+function asUtc$1(iso) {
+	const at = new Date(iso);
+	if (Number.isNaN(at.getTime())) return iso;
+	const pad = (n) => String(n).padStart(2, "0");
+	return `${at.getUTCFullYear()}-${pad(at.getUTCMonth() + 1)}-${pad(at.getUTCDate())} ${pad(at.getUTCHours())}:${pad(at.getUTCMinutes())} UTC`;
+}
+/**
+* The block a deploy prints for the schedules it just applied. Every schedule
+* appears, including the ones that are off, so putting recurring compute on the
+* bill — or taking it off — is never silent.
+*/
+function scheduleLines(schedules) {
+	if (schedules.length === 0) return [];
+	const nameWidth = Math.max(...schedules.map((s) => s.name.length));
+	const expressionWidth = Math.max(...schedules.map((s) => s.expression.length));
+	return ["  Schedules:", ...[...schedules].sort((a, b) => a.name.localeCompare(b.name)).map((schedule) => `    ${schedule.name.padEnd(nameWidth)}  ${schedule.expression.padEnd(expressionWidth)}  ${whenItRuns(schedule)}`)];
+}
+//#endregion
 //#region src/tenant.ts
 async function fetchTenantDetails(creds) {
 	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant`, { headers: { Authorization: `Bearer ${creds.tenant_jwt}` } });
@@ -1344,8 +1140,12 @@ async function resolveWorkspace(creds) {
 * telling a user different things about the same reason — and `retryable` is
 * what separates a name worth retyping from one that no name would fix.
 */
-function renameAdvice(reason) {
-	switch (reason) {
+function renameAdvice(err) {
+	if (!(err instanceof GatewayError)) return {
+		text: "",
+		retryable: false
+	};
+	switch (err.reason) {
 		case "taken":
 		case "reserved": return {
 			text: "Pick a different name.",
@@ -1360,7 +1160,7 @@ function renameAdvice(reason) {
 			retryable: true
 		};
 		case "locked": return {
-			text: "A deploy landed while this was running, which fixed the address for good.",
+			text: err.renamableAt ? nextRenameAllowed(err.renamableAt) : "",
 			retryable: false
 		};
 		default: return {
@@ -1369,6 +1169,9 @@ function renameAdvice(reason) {
 		};
 	}
 }
+function nextRenameAllowed(renamableAt) {
+	return `The next rename is allowed from ${asUtc$1(renamableAt)}.`;
+}
 /**
 * Ask for the workspace's public address to become `slug`.
 *
@@ -1548,44 +1351,6 @@ async function reportCredential(creds) {
 	console.log("");
 }
 //#endregion
-//#region src/schedules.ts
-/**
-* When a schedule next runs, or why it does not run at all.
-*
-* The three ways of being off never render alike, and a schedule that is off
-* twice over says so: someone who reads only the pause will declare it again,
-* press resume, and file a bug when neither starts it.
-*/
-function whenItRuns(schedule) {
-	const undeclared = schedule.declared === false;
-	if (schedule.state === "suspended") {
-		const why = "The workspace owes payment, its subscription ended, or it has spent past its plan's allowance";
-		return undeclared ? `suspended, and not in this config file. ${why}; declare it again too` : `suspended. ${why}`;
-	}
-	if (schedule.state === "paused") return undeclared ? "paused, and not in this config file. Declare it again, then resume" : "paused. Resume it to run again";
-	if (undeclared) return "not in this config file, so it is disabled. Its history is kept";
-	if (schedule.state !== "active") return schedule.state;
-	return schedule.next_fire_at ? `next run ${asUtc$1(schedule.next_fire_at)}` : "next run unknown";
-}
-/** `2026-08-23 03:00 UTC`, which is the zone every expression is read in. */
-function asUtc$1(iso) {
-	const at = new Date(iso);
-	if (Number.isNaN(at.getTime())) return iso;
-	const pad = (n) => String(n).padStart(2, "0");
-	return `${at.getUTCFullYear()}-${pad(at.getUTCMonth() + 1)}-${pad(at.getUTCDate())} ${pad(at.getUTCHours())}:${pad(at.getUTCMinutes())} UTC`;
-}
-/**
-* The block a deploy prints for the schedules it just applied. Every schedule
-* appears, including the ones that are off, so putting recurring compute on the
-* bill — or taking it off — is never silent.
-*/
-function scheduleLines(schedules) {
-	if (schedules.length === 0) return [];
-	const nameWidth = Math.max(...schedules.map((s) => s.name.length));
-	const expressionWidth = Math.max(...schedules.map((s) => s.expression.length));
-	return ["  Schedules:", ...[...schedules].sort((a, b) => a.name.localeCompare(b.name)).map((schedule) => `    ${schedule.name.padEnd(nameWidth)}  ${schedule.expression.padEnd(expressionWidth)}  ${whenItRuns(schedule)}`)];
-}
-//#endregion
 //#region src/billing.ts
 function billingPageUrl() {
 	const base = getDashboardUrl().replace(/\/+$/, "");
@@ -2315,84 +2080,6 @@ function widest(values) {
 	return values.reduce((longest, value) => Math.max(longest, value.length), 0);
 }
 //#endregion
-//#region src/assets.ts
-/**
-* The files under `dir`, hashed.
-*
-* Hashes are read off disk in a stream rather than by reading each file whole:
-* a client build's largest chunk is not something to hold in memory just to
-* find out the platform already has it.
-*/
-function collectAssets(dir) {
-	if (!fs.existsSync(dir)) return [];
-	const assets = [];
-	const walk = (current, prefix) => {
-		for (const entry of fs.readdirSync(current, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-			const absolute = path.join(current, entry.name);
-			const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
-			if (entry.isDirectory()) walk(absolute, relative);
-			else if (entry.isFile()) assets.push({
-				path: relative,
-				content_hash: hashFile(absolute),
-				size_bytes: fs.statSync(absolute).size,
-				source: absolute
-			});
-		}
-	};
-	walk(dir, "");
-	return assets;
-}
-/**
-* A **Static asset** a browser renders as a page. Read off the extension, as the
-* content type the platform records is — mirrors `content_type_for_path` in
-* `server/crates/core/src/features/assets/content_type.rs`.
-*/
-function isDocument(assetPath) {
-	const name = assetPath.split("/").pop() ?? "";
-	const dot = name.lastIndexOf(".");
-	const extension = dot === -1 ? "" : name.slice(dot + 1).toLowerCase();
-	return extension === "html" || extension === "htm";
-}
-function hashFile(file) {
-	return sha256(fs.readFileSync(file));
-}
-function sha256(bytes) {
-	return crypto.createHash("sha256").update(bytes).digest("hex");
-}
-/**
-* What this deploy *is*: the server bundle together with the sorted set of
-* asset path and content-hash pairs, the same set for its **Private file**s
-* marked apart, and the **Fallback document** it declares.
-*
-* Computed here, before anything is uploaded, so a deploy that changed nothing
-* is refused before a byte moves. Mirrors `deploy_digest` in
-* `server/crates/core/src/features/assets/identity.rs` — the gateway recomputes
-* it from what actually arrives, so the two have to agree exactly.
-*
-* A deploy declaring no fallback and no private files contributes nothing here
-* for either rather than a stated absence, so every digest computed before
-* they existed is unmoved.
-*/
-const DEPLOY_DIGEST_DOMAIN = "wawesome-deploy-v1";
-function deployDigest(bundle, assets, fallback, privateFiles = []) {
-	const byPath = (files) => [...files].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
-	const digest = crypto.createHash("sha256");
-	digest.update(`${DEPLOY_DIGEST_DOMAIN}\n`);
-	digest.update(`${sha256(bundle)}\n`);
-	for (const asset of byPath(assets)) digest.update(`${asset.path}\0${asset.content_hash}\n`);
-	for (const file of byPath(privateFiles)) digest.update(`private\0${file.path}\0${file.content_hash}\n`);
-	if (fallback) digest.update(`fallback\0${fallback.path}\0${fallback.status}\n`);
-	return digest.digest("hex");
-}
-/** The manifest as the gateway reads it — the bytes on disk are the CLI's business. */
-function manifestOf(assets) {
-	return assets.map(({ path, content_hash, size_bytes }) => ({
-		path,
-		content_hash,
-		size_bytes
-	}));
-}
-//#endregion
 //#region src/prompt.ts
 /**
 * Open a prompt session on stdin, queueing lines as they arrive.
@@ -3379,7 +3066,7 @@ async function deploy(entryInput, options) {
 	if (assets.length > 0 || privateFiles.length > 0) await uploadAssets(creds, app, funcName, jsCode ?? "", {
 		assets,
 		privateFiles
-	}, declared, isVerbose, declaresSchedules);
+	}, declared, isVerbose, declaresSchedules || domainName !== void 0);
 	console.log(`[wawesome] Uploading code for ${app}/${funcName}...`);
 	const uploadUrl = `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/code`;
 	if (isVerbose) console.log(`[wawesome:verbose] POST ${uploadUrl}`);
@@ -3387,7 +3074,7 @@ async function deploy(entryInput, options) {
 		...declaredFields(declared),
 		...declared.message ? { message: declared.message } : {}
 	};
-	const uploadRes = assets.length > 0 || privateFiles.length > 0 || declaresSchedules || declaresFallback || Object.keys(declaredOnTheWire).length > 0 || jsCode === null ? await authorizedFetch(uploadUrl, {
+	const uploadRes = assets.length > 0 || privateFiles.length > 0 || declaresSchedules || declaresFallback || domainName !== void 0 || Object.keys(declaredOnTheWire).length > 0 || jsCode === null ? await authorizedFetch(uploadUrl, {
 		method: "POST",
 		headers: {
 			Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -3399,6 +3086,7 @@ async function deploy(entryInput, options) {
 			...privateFiles.length > 0 ? { files: manifestOf(privateFiles) } : {},
 			...declaresSchedules ? { schedules: config.schedules } : {},
 			...declaresFallback ? { fallback: declared.fallback } : {},
+			...domainName !== void 0 ? { domain: domainName } : {},
 			...declaredOnTheWire
 		})
 	}) : await authorizedFetch(uploadUrl, {
@@ -3573,7 +3261,7 @@ async function uploadAssets(creds, app, funcName, bundle, { assets, privateFiles
 		if (manifestRes.status === 401 || manifestRes.status === 403) console.error(`[wawesome] Error: ${unauthorizedMessage(manifestRes.status, errorBody)}`);
 		else if (manifestRes.status === 409) {
 			if (continueWhenUnchanged) {
-				console.log("[wawesome] Code and files unchanged since the last deploy; applying schedules.");
+				console.log("[wawesome] Code and files unchanged since the last deploy; applying the config file.");
 				return;
 			}
 			const refusal = rejectionOf(errorBody, manifestRes.status, "This deploy is already deployed.");
@@ -4574,18 +4262,19 @@ function announceUrl(surface, slug, appSlug, functionName) {
 	console.log(`    ${SUBTREE_NOTE}\n`);
 }
 /**
-* Show the URL, and offer to fix the workspace address while it can still be fixed.
+* Show the URL, and offer to change the workspace address while a rename is free.
 *
-* This is the last moment that address is free: it locks the first time a
-* version is promoted, which is what the deploy at the end of this flow does.
-* Asking here rather than at signup is the whole reason naming was deferred —
-* it is client-facing branding, and nobody chooses it well before seeing the
-* product work. The URL comes first so the offer is about something concrete.
+* This is the last moment a rename costs nothing: after the first promotion,
+* which the deploy at the end of this flow does, the old name redirects and
+* renames wait 30 days apart. Asking here rather than at signup is the whole
+* reason naming was deferred — it is client-facing branding, and nobody chooses
+* it well before seeing the product work. The URL comes first so the offer is
+* about something concrete.
 *
-* The lock is read from the gateway rather than guessed, so a user who cannot
-* rename is told why instead of being walked into a rejection. Nothing here can
-* fail the flow: the project is already on disk and the deploy still works under
-* the address the workspace has.
+* A published workspace is not offered one: its rename moves live links, and
+* `wawesome workspace rename` is where that is confirmed. Nothing here can fail
+* the flow: the project is already on disk and the deploy still works under the
+* address the workspace has.
 */
 async function offerWorkspaceAddress(session, creds, tenant, appSlug, functionName) {
 	const current = tenant?.tenant_slug ?? creds.tenant_slug;
@@ -4597,13 +4286,14 @@ async function offerWorkspaceAddress(session, creds, tenant, appSlug, functionNa
 		console.log("  is a question for the gateway, which did not answer.\n");
 		return;
 	}
-	if (tenant.slug_locked) {
-		console.log(`  🔒 '${current}' is fixed. A Function version has been promoted, and live URLs already carry it.\n`);
+	if (tenant.published) {
+		console.log(`  '${current}' is your workspace address. It is already live, so change it`);
+		console.log("  with: wawesome workspace rename <name>\n");
 		return;
 	}
 	console.log(`  '${current}' is your workspace address, the part of that URL that is`);
-	console.log("  yours rather than this project's. Now is the moment to change it. It");
-	console.log("  locks for good the first time you deploy, because live URLs carry it.");
+	console.log("  yours rather than this project's. Now is a good moment to change it.");
+	console.log("  You can change it later too, once every 30 days after your first deploy.");
 	console.log("  Press enter to keep it.\n");
 	let refusal;
 	for (let attempt = 0; attempt < MAX_RENAME_ATTEMPTS; attempt++) {
@@ -4620,7 +4310,7 @@ async function offerWorkspaceAddress(session, creds, tenant, appSlug, functionNa
 		} catch (err) {
 			console.log(`[wawesome] ${errorText(err)}`);
 			refusal = reasonOf(err);
-			const { text, retryable } = renameAdvice(refusal);
+			const { text, retryable } = renameAdvice(err);
 			if (text) console.log(`[wawesome] ${text}`);
 			if (!retryable) break;
 		}
@@ -5840,20 +5530,27 @@ async function showWorkspace(options) {
 			console.log(`            ${SUBTREE_NOTE}`);
 		}
 	}
-	if (tenant.slug_locked) console.log("\n  🔒 The address is fixed. A Function version has been promoted, and live URLs carry it.");
-	else {
-		console.log("\n  The address can still be changed: \x1B[36mwawesome workspace rename <name>\x1B[0m");
-		console.log("  It locks for good the first time you deploy.");
+	const waitUntil = renameWaitsUntil(tenant);
+	if (waitUntil) {
+		console.log(`\n  The address can be changed again from ${asUtc$1(waitUntil)}.`);
+		console.log("  One rename is allowed every 30 days.");
+	} else {
+		console.log("\n  The address can be changed: \x1B[36mwawesome workspace rename <name>\x1B[0m");
+		console.log(tenant.published ? "  The old address then redirects to the new one for 90 days. One rename every 30 days." : "  Rename it freely until your first deploy. After that, once every 30 days.");
 	}
 	console.log("");
 }
+function renameWaitsUntil(tenant) {
+	if (!tenant.renamable_at) return null;
+	return new Date(tenant.renamable_at).getTime() > Date.now() ? tenant.renamable_at : null;
+}
 /**
 * Change the workspace's public address.
 *
-* The lock is read from the gateway before asking, so a user who cannot rename
-* is told why instead of being walked into a rejection. The rejection is still
-* handled: a promotion landing between the two calls is the one case where the
-* gateway knows something this command could not.
+* The 30-day wait is read from the gateway before asking, so a user who cannot
+* rename is told when they can instead of being walked into a rejection. The
+* rejection is still handled: another rename landing between the two calls is
+* something only the gateway knows.
 */
 async function renameWorkspace(slug, options) {
 	const creds = requireCredentials$1();
@@ -5864,24 +5561,27 @@ async function renameWorkspace(slug, options) {
 	}
 	try {
 		const tenant = await fetchTenantDetails(creds);
-		if (tenant.slug_locked) {
-			console.error("\n[wawesome] \x1B[31mThe workspace address can no longer be changed.\x1B[0m");
-			console.error(`[wawesome] '${tenant.tenant_slug}' is fixed: a Function version has been promoted, and live URLs already carry it.`);
+		const waitUntil = renameWaitsUntil(tenant);
+		if (waitUntil) {
+			console.error("\n[wawesome] \x1B[31mThe workspace address cannot be changed yet.\x1B[0m");
+			console.error(`[wawesome] It was renamed less than 30 days ago. ${nextRenameAllowed(waitUntil)}`);
 			process.exit(1);
 			return;
 		}
-		if (options.verbose) console.log(`[wawesome:verbose] Renaming '${tenant.tenant_slug}' → '${slug}'`);
-		const result = await renameTenantSlug(creds, slug.trim());
+		const typed = slug.trim();
+		if (tenant.published && !options.yes) await confirmRename(tenant.tenant_slug, typed);
+		if (options.verbose) console.log(`[wawesome:verbose] Renaming '${tenant.tenant_slug}' → '${typed}'`);
+		const result = await renameTenantSlug(creds, typed);
 		console.log("\n======================================================");
 		console.log("✅ \x1B[32mWORKSPACE RENAMED\x1B[0m");
 		console.log("======================================================");
 		console.log(`\n  Address:  ${result.tenant_slug}`);
-		console.log(`  Previous: ${result.previous_slug} (no longer resolves)`);
+		console.log(tenant.published ? `  Previous: ${result.previous_slug} (redirects to the new address for 90 days)` : `  Previous: ${result.previous_slug} (no longer resolves)`);
 		console.log("======================================================\n");
 	} catch (err) {
 		if (err instanceof GatewayError) {
 			console.error(`\n[wawesome] \x1b[31m${err.message}\x1b[0m`);
-			const { text } = renameAdvice(err.reason);
+			const { text } = renameAdvice(err);
 			if (text) console.error(`[wawesome] ${text}`);
 			console.error("");
 			process.exit(1);
@@ -5892,6 +5592,32 @@ async function renameWorkspace(slug, options) {
 	}
 }
 /**
+* Links are already out under a published address, so the new name is typed
+* twice, as the dashboard asks: a typo here would move every client's URL.
+*/
+async function confirmRename(current, next) {
+	if (!isInteractive()) {
+		console.error("\n[wawesome] \x1B[31mA rename after publishing asks for confirmation, and there is nobody to ask.\x1B[0m");
+		console.error(`[wawesome] Pass --yes to rename '${current}' to '${next}' without being asked.`);
+		process.exit(1);
+	}
+	console.log(`\n  Rename '${current}' to '${next}'?`);
+	console.log(`  - The new address is '${next}'.`);
+	console.log(`  - '${current}' redirects to the new address for 90 days. After that it is held`);
+	console.log("    for 90 more days, and only you can take it back.");
+	console.log("  - Open preview links stop working now.\n");
+	let retyped;
+	try {
+		retyped = await input({ message: "Type the new address again to confirm:" });
+	} catch {
+		retyped = "";
+	}
+	if (retyped.trim() !== next) {
+		console.error(`[wawesome] Cancelled. The address is still '${current}'.`);
+		process.exit(1);
+	}
+}
+/**
 * The workspaces this person belongs to, with the one the session is in
 * marked.
 *
@@ -6751,7 +6477,7 @@ cli.command("domains detach <hostname>", "Stop serving the current app at a doma
 cli.command("login", "Authenticate with the wawesome.io platform").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("--gateway <url>", "Alias for --api <url>").option("--dashboard <url>", "Dashboard URL to record (default: the one the platform names)").option("-v, --verbose", "Enable verbose debug output").action((options) => login(options));
 cli.command("logout", "Clear stored authentication credentials").action(async () => await logout());
 cli.command("whoami", "Show current login session info").action(() => whoami());
-cli.command("workspace [action] [name]", "Show the workspace, move between workspaces, or rename the public address").usage("workspace <action> [name]\n\nActions:\n  show                Show the workspace name, address, and whether it can still change\n  list (ls)           Show the workspaces you belong to, and which one you are in\n  switch <name>       Move this terminal to another workspace you belong to\n  rename <name>       Change the public address, while nothing live depends on it").example("wawesome workspace").example("wawesome workspace list").example("wawesome workspace switch northwind").example("wawesome workspace rename northwind").option("-v, --verbose", "Enable verbose debug output").action((action, name, options) => workspaceCommand(action, name, options));
+cli.command("workspace [action] [name]", "Show the workspace, move between workspaces, or rename the public address").usage("workspace <action> [name]\n\nActions:\n  show                Show the workspace name, address, and whether it can still change\n  list (ls)           Show the workspaces you belong to, and which one you are in\n  switch <name>       Move this terminal to another workspace you belong to\n  rename <name>       Change the public address. After your first deploy, once every 30 days").example("wawesome workspace").example("wawesome workspace list").example("wawesome workspace switch northwind").example("wawesome workspace rename northwind").option("-y, --yes", "Rename without typing the new address again").option("-v, --verbose", "Enable verbose debug output").action((action, name, options) => workspaceCommand(action, name, options));
 cli.command("export [action]", "Export the whole workspace as one archive, and print the link to it").usage("export [status]\n\nWith no action, asks for an export and waits until it is ready.\n  status              Show the latest export, and a new link if it is ready").example("wawesome export").example("wawesome export status").option("--no-wait", "Ask for the export and return without waiting for it").option("-v, --verbose", "Enable verbose debug output").action((action, options) => exportCommand(action, options));
 cli.command("templates [action]", "Browse the template catalog").usage("templates [action]\n\nActions:\n  list (ls)           Show every available template (default)").example("wawesome templates").example("wawesome templates list").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("-v, --verbose", "Enable verbose debug output").action((action, options) => templatesCommand(action, options));
 cli.command("credentials [action] [target]", "Mint, list, regenerate, revoke and delete deploy credentials").alias("credential").usage(`credentials <action> [options]