wawesome 0.6.0 → 0.8.0

package/dist/index.mjs

@@ -18,6 +18,7 @@ import zlib from "node:zlib";
 * These are public values — the anon key is designed to be embedded in clients.
 */
 const SUPABASE_URL = "https://vclasavxxoufwymrutai.supabase.co";
+const SUPABASE_ANON_KEY = "sb_publishable_ZlgDAI9cNZkefEwVPKIngA_ktuvTpjD";
 /** Path to the user-level settings file (~/.wawesome/settings.json) */
 function getSettingsPath() {
 	return path.join(os.homedir(), ".wawesome", "settings.json");
@@ -90,12 +91,23 @@ function readCredentials() {
 }
 /**
 * Write credentials to disk, creating the directory if needed.
+*
+* Owner-only, because the file holds a refresh token. The `chmod` is what
+* tightens a file an older CLI left world-readable; a mode passed to
+* `writeFileSync` applies only where it creates the file.
 */
 function writeCredentials(creds) {
 	const credPath = getCredentialsPath();
 	const dir = path.dirname(credPath);
-	fs.mkdirSync(dir, { recursive: true });
-	fs.writeFileSync(credPath, JSON.stringify(creds, null, 2), "utf-8");
+	fs.mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	fs.writeFileSync(credPath, JSON.stringify(creds, null, 2), {
+		encoding: "utf-8",
+		mode: 384
+	});
+	fs.chmodSync(credPath, 384);
 }
 /**
 * Delete stored credentials.
@@ -759,7 +771,7 @@ async function buildJs(entryInput, options) {
 * that has to name this version — `--version`, the dependency a scaffolded
 * project pins — reads it here, so a release bumps one file.
 */
-const CLI_VERSION = "0.6.0";
+const CLI_VERSION = "0.8.0";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -816,6 +828,126 @@ function isInteractive() {
 	return Boolean(process.stdin.isTTY);
 }
 //#endregion
+//#region src/session.ts
+/**
+* A gateway request, retried once against a renewed session if it comes back 401.
+*
+* A caller's `Authorization` is a snapshot of what was on disk when the command
+* started, so a renewal here replaces it. Otherwise every later request in the
+* same command would spend a 401 learning what this already knows.
+*
+* A body that can only be read once, an asset streamed off disk, passes a
+* function so the retry is built one of its own.
+*/
+async function authorizedFetch(url, init = {}) {
+	const request = typeof init === "function" ? init : () => init;
+	const sentAt = Date.now();
+	const res = await fetch(url, renewedJwt ? withBearer(request(), renewedJwt) : request());
+	if (res.status !== 401) return res;
+	if (renewedJwt && renewedAt > sentAt) return retry(url, request, renewedJwt, res);
+	if (renewedJwt && Date.now() - renewedAt < JUST_RENEWED_MS) return res;
+	const renewed = await renewSession();
+	if (!renewed) return res;
+	return retry(url, request, renewed.tenant_jwt, res);
+}
+/** Thirty minutes of token life leaves this nowhere near a genuine expiry. */
+const JUST_RENEWED_MS = 6e4;
+async function retry(url, request, tenantJwt, refused) {
+	await refused.body?.cancel().catch(() => {});
+	return fetch(url, withBearer(request(), tenantJwt));
+}
+function withBearer(init, tenantJwt) {
+	return {
+		...init,
+		headers: {
+			...headerRecord(init.headers),
+			Authorization: `Bearer ${tenantJwt}`
+		}
+	};
+}
+function headerRecord(headers) {
+	if (!headers) return {};
+	if (headers instanceof Headers || Array.isArray(headers)) return Object.fromEntries(new Headers(headers).entries());
+	return { ...headers };
+}
+let renewal = null;
+let renewedJwt = null;
+let renewedAt = 0;
+/** Drop what this process learned about the session, as ending one does. */
+function forgetRenewedSession() {
+	renewal = null;
+	renewedJwt = null;
+	renewedAt = 0;
+}
+/**
+* Supabase rotates the refresh token on every use and revokes the whole family
+* if a spent one comes back, so requests that meet the 401 together share one
+* renewal instead of racing with the same token.
+*/
+function renewSession() {
+	if (!renewal) {
+		const inFlight = renewOnce().finally(() => {
+			if (renewal === inFlight) renewal = null;
+		});
+		renewal = inFlight;
+	}
+	return renewal;
+}
+/**
+* Null where there is nothing to renew from. Credentials written before refresh
+* tokens were stored still describe a session, so the 401 goes back to the
+* caller, whose own message for it is the right one.
+*/
+async function renewOnce() {
+	const creds = readCredentials();
+	if (!creds?.refresh_token) return null;
+	const session = await refreshSupabaseSession(creds.refresh_token);
+	const exchanged = await exchangeForTenantJwt(creds, session.access_token);
+	const renewed = {
+		...creds,
+		tenant_jwt: exchanged.tenant_jwt,
+		refresh_token: session.refresh_token || creds.refresh_token,
+		tenant_slug: exchanged.tenant_slug || creds.tenant_slug,
+		tenant_name: exchanged.tenant_name || creds.tenant_name
+	};
+	writeCredentials(renewed);
+	renewedJwt = renewed.tenant_jwt;
+	renewedAt = Date.now();
+	return renewed;
+}
+async function refreshSupabaseSession(refreshToken) {
+	const res = await fetch(`${SUPABASE_URL}/auth/v1/token?grant_type=refresh_token`, {
+		method: "POST",
+		headers: {
+			apikey: SUPABASE_ANON_KEY,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({ refresh_token: refreshToken })
+	});
+	if (res.status >= 400 && res.status < 500 && res.status !== 429) endSession("Your sign-in was revoked or has expired, so the session could not be renewed.");
+	if (!res.ok) throw new Error(`Could not renew your session (Supabase HTTP ${res.status}).`);
+	const session = await res.json();
+	if (!session.access_token) throw new Error("Could not renew your session (Supabase returned no access token).");
+	return session;
+}
+async function exchangeForTenantJwt(creds, supabaseAccessToken) {
+	const res = await fetch(`${creds.gateway_url}/api/v1/auth/token-exchange`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${supabaseAccessToken}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({ tenant_id: creds.tenant_id })
+	});
+	if (res.status === 401 || res.status === 403) endSession("Your access to this workspace has been withdrawn.");
+	if (!res.ok) throw new Error(`Could not renew your session (token exchange HTTP ${res.status}).`);
+	return await res.json();
+}
+function endSession(reason) {
+	console.error(`[wawesome] Error: ${reason} Run 'wawesome login' to sign in again.`);
+	process.exit(1);
+}
+//#endregion
 //#region src/errors.ts
 /** A rejection carrying the gateway's own prose and, where given, its reason. */
 var GatewayError = class extends Error {
@@ -862,7 +994,7 @@ function errorText(err) {
 //#endregion
 //#region src/tenant.ts
 async function fetchTenantDetails(creds) {
-	const res = await fetch(`${creds.gateway_url}/v1/tenant`, { headers: { Authorization: `Bearer ${creds.tenant_jwt}` } });
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant`, { headers: { Authorization: `Bearer ${creds.tenant_jwt}` } });
 	if (!res.ok) throw await asGatewayError(res, `Failed to read workspace (HTTP ${res.status}).`);
 	return await res.json();
 }
@@ -928,7 +1060,7 @@ function renameAdvice(reason) {
 * unusable name comes back as a `malformed` rejection instead.
 */
 async function renameTenantSlug(creds, slug) {
-	const res = await fetch(`${creds.gateway_url}/v1/tenant/slug`, {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/slug`, {
 		method: "PUT",
 		headers: {
 			Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -972,6 +1104,80 @@ async function promptForWorkspaceName(options) {
 	throw new Error("No workspace name given. Nothing was created.");
 }
 /**
+* Turn a finished OAuth callback into stored credentials.
+*
+* Split from the callback server so what login stores can be exercised without
+* a browser and a port.
+*/
+async function completeLogin({ gatewayUrl, dashboardUrl, accessToken, refreshToken, options }) {
+	const isVerbose = Boolean(options.verbose);
+	console.log("[wawesome] Fetching your workspaces...");
+	const tenantsRes = await fetch(`${gatewayUrl}/api/v1/me/tenants`, { headers: { Authorization: `Bearer ${accessToken}` } });
+	if (!tenantsRes.ok) throw new Error(`Failed to fetch tenants (HTTP ${tenantsRes.status}). Have you completed onboarding?`);
+	const tenants = await tenantsRes.json();
+	let primaryTenantId;
+	let workspaceName;
+	let workspaceSlug;
+	if (tenants.length === 0) {
+		const chosenName = await promptForWorkspaceName(options);
+		console.log(`[wawesome] Creating workspace "${chosenName}"...`);
+		const initRes = await fetch(`${gatewayUrl}/api/v1/onboarding/init`, {
+			method: "POST",
+			headers: {
+				Authorization: `Bearer ${accessToken}`,
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify({ tenant_name: chosenName })
+		});
+		if (!initRes.ok) throw new Error(`Failed to initialize workspace (HTTP ${initRes.status}).`);
+		const initData = await initRes.json();
+		primaryTenantId = initData.tenant_id;
+		workspaceSlug = initData.tenant_slug;
+		workspaceName = initData.tenant_name || chosenName;
+	} else primaryTenantId = tenants[0].tenant_id;
+	if (isVerbose) console.log(`[wawesome:verbose] Using tenant: ${primaryTenantId}`);
+	console.log("[wawesome] Exchanging for tenant-scoped credentials...");
+	const exchangeRes = await fetch(`${gatewayUrl}/api/v1/auth/token-exchange`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${accessToken}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({ tenant_id: primaryTenantId })
+	});
+	if (!exchangeRes.ok) throw new Error(`Token exchange failed (HTTP ${exchangeRes.status}).`);
+	const exchangeData = await exchangeRes.json();
+	workspaceSlug = exchangeData.tenant_slug || workspaceSlug;
+	workspaceName = exchangeData.tenant_name || workspaceName;
+	let userEmail = exchangeData.email || "unknown";
+	try {
+		const payloadPart = exchangeData.tenant_jwt.split(".")[1];
+		const decoded = JSON.parse(Buffer.from(payloadPart, "base64url").toString("utf-8"));
+		if (decoded.email) userEmail = decoded.email;
+	} catch {}
+	forgetRenewedSession();
+	writeCredentials({
+		gateway_url: gatewayUrl,
+		dashboard_url: dashboardUrl,
+		tenant_jwt: exchangeData.tenant_jwt,
+		refresh_token: refreshToken,
+		tenant_id: primaryTenantId,
+		user_email: userEmail,
+		tenant_slug: workspaceSlug,
+		tenant_name: workspaceName
+	});
+	console.log("\n======================================================");
+	console.log("🎉 \x1B[32mLOGIN SUCCESSFUL!\x1B[0m");
+	console.log("======================================================");
+	if (workspaceName) console.log(`\n  Workspace: ${workspaceName}`);
+	if (workspaceSlug) console.log(`  Address:   ${workspaceSlug}`);
+	console.log(`  Tenant:    ${primaryTenantId}`);
+	console.log(`  Gateway:   ${gatewayUrl}`);
+	console.log(`  Email:     ${userEmail}`);
+	console.log("\n  Credentials saved to ~/.wawesome/credentials.json");
+	console.log("======================================================\n");
+}
+/**
 * OAuth login flow:
 * 1. Build Supabase OAuth URL
 * 2. Open browser
@@ -1025,6 +1231,7 @@ async function login(options) {
 			}
 			if (reqUrl.pathname === "/token") {
 				const accessToken = reqUrl.searchParams.get("access_token");
+				const refreshToken = reqUrl.searchParams.get("refresh_token");
 				res.writeHead(200, { "Content-Type": "text/plain" });
 				res.end("Token received by CLI.");
 				if (!accessToken) {
@@ -1035,69 +1242,13 @@ async function login(options) {
 				}
 				if (isVerbose) console.log("[wawesome:verbose] Supabase access token received.");
 				try {
-					console.log("[wawesome] Fetching your workspaces...");
-					const tenantsRes = await fetch(`${gatewayUrl}/api/v1/me/tenants`, { headers: { Authorization: `Bearer ${accessToken}` } });
-					if (!tenantsRes.ok) throw new Error(`Failed to fetch tenants (HTTP ${tenantsRes.status}). Have you completed onboarding?`);
-					const tenants = await tenantsRes.json();
-					let primaryTenantId;
-					let workspaceName;
-					let workspaceSlug;
-					if (tenants.length === 0) {
-						const chosenName = await promptForWorkspaceName(options);
-						console.log(`[wawesome] Creating workspace "${chosenName}"...`);
-						const initRes = await fetch(`${gatewayUrl}/api/v1/onboarding/init`, {
-							method: "POST",
-							headers: {
-								Authorization: `Bearer ${accessToken}`,
-								"Content-Type": "application/json"
-							},
-							body: JSON.stringify({ tenant_name: chosenName })
-						});
-						if (!initRes.ok) throw new Error(`Failed to initialize workspace (HTTP ${initRes.status}).`);
-						const initData = await initRes.json();
-						primaryTenantId = initData.tenant_id;
-						workspaceSlug = initData.tenant_slug;
-						workspaceName = initData.tenant_name || chosenName;
-					} else primaryTenantId = tenants[0].tenant_id;
-					if (isVerbose) console.log(`[wawesome:verbose] Using tenant: ${primaryTenantId}`);
-					console.log("[wawesome] Exchanging for tenant-scoped credentials...");
-					const exchangeRes = await fetch(`${gatewayUrl}/api/v1/auth/token-exchange`, {
-						method: "POST",
-						headers: {
-							Authorization: `Bearer ${accessToken}`,
-							"Content-Type": "application/json"
-						},
-						body: JSON.stringify({ tenant_id: primaryTenantId })
-					});
-					if (!exchangeRes.ok) throw new Error(`Token exchange failed (HTTP ${exchangeRes.status}).`);
-					const exchangeData = await exchangeRes.json();
-					workspaceSlug = exchangeData.tenant_slug || workspaceSlug;
-					workspaceName = exchangeData.tenant_name || workspaceName;
-					let userEmail = exchangeData.email || "unknown";
-					try {
-						const payloadPart = exchangeData.tenant_jwt.split(".")[1];
-						const decoded = JSON.parse(Buffer.from(payloadPart, "base64url").toString("utf-8"));
-						if (decoded.email) userEmail = decoded.email;
-					} catch {}
-					writeCredentials({
-						gateway_url: gatewayUrl,
-						dashboard_url: dashboardUrl,
-						tenant_jwt: exchangeData.tenant_jwt,
-						tenant_id: primaryTenantId,
-						user_email: userEmail,
-						tenant_slug: workspaceSlug,
-						tenant_name: workspaceName
+					await completeLogin({
+						gatewayUrl,
+						dashboardUrl,
+						accessToken,
+						refreshToken: refreshToken || void 0,
+						options
 					});
-					console.log("\n======================================================");
-					console.log("🎉 \x1B[32mLOGIN SUCCESSFUL!\x1B[0m");
-					console.log("======================================================");
-					if (workspaceName) console.log(`\n  Workspace: ${workspaceName}`);
-					if (workspaceSlug) console.log(`  Address:   ${workspaceSlug}`);
-					console.log(`  Tenant:    ${primaryTenantId}`);
-					console.log(`  Gateway:   ${gatewayUrl}`);
-					console.log(`  Email:     ${userEmail}`);
-					console.log("\n  Credentials saved to ~/.wawesome/credentials.json");
-					console.log("======================================================\n");
 					server.close();
 					resolve();
 				} catch (err) {
@@ -1127,6 +1278,7 @@ async function login(options) {
 * Clear stored credentials.
 */
 function logout() {
+	forgetRenewedSession();
 	if (deleteCredentials()) console.log("[wawesome] ✅ Logged out. Credentials removed.");
 	else console.log("[wawesome] Not logged in (no credentials found).");
 }
@@ -1159,18 +1311,17 @@ async function whoami() {
 /**
 * When a schedule next runs, or why it does not run at all.
 *
-* The three ways of being off never render alike: someone who cannot tell a
-* pause from a schedule they deleted from their config file will press resume
-* and watch nothing happen.
+* The three ways of being off never render alike, and a schedule that is off
+* twice over says so: someone who reads only the pause will declare it again,
+* press resume, and file a bug when neither starts it.
 */
 function whenItRuns(schedule) {
-	switch (schedule.state) {
-		case "active": return schedule.next_fire_at ? `next run ${asUtc(schedule.next_fire_at)}` : "next run unknown";
-		case "paused": return "paused — resume it to run again";
-		case "undeclared": return "not in this config file — disabled, kept";
-		case "suspended": return "suspended — the workspace owes payment";
-		default: return schedule.state;
-	}
+	if (schedule.state === "suspended") return "suspended — the workspace owes payment";
+	const undeclared = schedule.declared === false;
+	if (schedule.state === "paused") return undeclared ? "paused, and not in this config file — declare it again, then resume" : "paused — resume it to run again";
+	if (undeclared) return "not in this config file — disabled, kept";
+	if (schedule.state !== "active") return schedule.state;
+	return schedule.next_fire_at ? `next run ${asUtc(schedule.next_fire_at)}` : "next run unknown";
 }
 /** `2026-08-23 03:00 UTC`, which is the zone every expression is read in. */
 function asUtc(iso) {
@@ -1202,7 +1353,7 @@ async function fetchTenantUsage(creds, timeoutMs = USAGE_TIMEOUT_MS) {
 	const controller = new AbortController();
 	const timer = setTimeout(() => controller.abort(), timeoutMs);
 	try {
-		const res = await fetch(`${creds.gateway_url}/v1/tenant/usage`, {
+		const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/usage`, {
 			headers: { Authorization: `Bearer ${creds.tenant_jwt}` },
 			signal: controller.signal
 		});
@@ -1363,7 +1514,9 @@ function billingPageUrl() {
 const PLAN_LIMITS = [
 	"app-slots-exhausted",
 	"storage-exhausted",
-	"paid-plan-required"
+	"paid-plan-required",
+	"payment-required",
+	"schedule-suspended"
 ];
 /** The rule itself is the gateway's prose, and is deliberately not restated here. */
 function planLimitAdvice(reason) {
@@ -1513,6 +1666,97 @@ function trimTrailingSlashes(origin) {
 	return origin.replace(/\/+$/, "");
 }
 //#endregion
+//#region src/deploy-target.ts
+const RECORD_PATH = path.join(".wawesome", "last-deploy.json");
+function readLastDeployTarget(projectDir = process.cwd()) {
+	let parsed;
+	try {
+		parsed = JSON.parse(fs.readFileSync(path.join(projectDir, RECORD_PATH), "utf-8"));
+	} catch {
+		return null;
+	}
+	if (typeof parsed.app !== "string" || typeof parsed.function !== "string") return null;
+	return {
+		app: parsed.app,
+		function: parsed.function
+	};
+}
+/**
+* The directory ignores itself rather than relying on the project's `.gitignore`,
+* since this is per-checkout state and most projects reaching it were scaffolded
+* before it existed. A write that fails is dropped: the deploy has already
+* landed, and reporting a read-only project directory as a failed deploy would
+* be a worse lie than forgetting the name.
+*/
+function recordDeployTarget(target, projectDir = process.cwd()) {
+	const file = path.join(projectDir, RECORD_PATH);
+	try {
+		fs.mkdirSync(path.dirname(file), { recursive: true });
+		fs.writeFileSync(path.join(path.dirname(file), ".gitignore"), "*\n", "utf-8");
+		fs.writeFileSync(file, JSON.stringify(target, null, 2) + "\n", "utf-8");
+	} catch {
+		return;
+	}
+}
+/** See ADR-0016 for the fork this asks about, and why no rename is on offer. */
+async function confirmDeployTarget(creds, target, projectDir = process.cwd()) {
+	const previous = readLastDeployTarget(projectDir);
+	if (!previous || previous.app === target.app && previous.function === target.function) return true;
+	const surface = await addressesFor(creds, previous, target);
+	for (const line of divergenceLines(previous, target, surface)) console.warn(line);
+	if (!isInteractive()) {
+		console.warn("[wawesome] There is no terminal to confirm at, so the deploy continues.\n");
+		return true;
+	}
+	const session = openPromptSession();
+	try {
+		const answer = await session.ask(`  Deploy to '${qualifiedName(target)}' and leave '${qualifiedName(previous)}' live? [y/N]`, "");
+		return /^y(es)?$/i.test(answer.trim());
+	} finally {
+		session.close();
+	}
+}
+function divergenceLines(previous, target, addresses) {
+	return [
+		"",
+		`[wawesome] \x1b[33mThis project last deployed to ${qualifiedName(previous)}.\x1b[0m`,
+		`[wawesome] wawesome-function.json now says ${qualifiedName(target)}.`,
+		"",
+		"[wawesome] Deploying will not rename it. A Function's address is built from its",
+		"[wawesome] name, so this deploy lands on a Function of its own and leaves the old",
+		"[wawesome] one exactly as it is — promoted, and still answering the code on it:",
+		"",
+		`[wawesome]   stays live:       ${addresses.previous ?? qualifiedName(previous)}`,
+		`[wawesome]   gets this deploy: ${addresses.next ?? qualifiedName(target)}`,
+		"",
+		"[wawesome] Anything holding the old address keeps reaching the old code. Delete",
+		"[wawesome] the old Function from the dashboard once nothing calls it.",
+		""
+	];
+}
+function qualifiedName(target) {
+	return `${target.app}/${target.function}`;
+}
+/**
+* A gateway that cannot be reached must not turn this into a failed deploy: the
+* names alone still say what is about to happen, which is the point of saying it.
+*/
+async function addressesFor(creds, previous, target) {
+	try {
+		const { slug } = await resolveWorkspace(creds);
+		const surface = await invocationSurfaceOrNone(creds.gateway_url);
+		return {
+			previous: publicAddress(surface, slug, previous.app, previous.function),
+			next: publicAddress(surface, slug, target.app, target.function)
+		};
+	} catch {
+		return {
+			previous: null,
+			next: null
+		};
+	}
+}
+//#endregion
 //#region src/deploy.ts
 function declaredFields(declared) {
 	return {
@@ -1564,6 +1808,13 @@ async function deploy(entryInput, options) {
 		console.log(`[wawesome:verbose] Deploying to app=${app}, function=${funcName}`);
 		console.log(`[wawesome:verbose] Gateway: ${creds.gateway_url}`);
 	}
+	if (!await confirmDeployTarget(creds, {
+		app,
+		function: funcName
+	})) {
+		console.log("[wawesome] Nothing was deployed.");
+		process.exit(0);
+	}
 	let bundlePath;
 	if (options.skipBuild) {
 		bundlePath = path.resolve(options.out);
@@ -1598,7 +1849,7 @@ async function deploy(entryInput, options) {
 	const uploadUrl = `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/code`;
 	if (isVerbose) console.log(`[wawesome:verbose] POST ${uploadUrl}`);
 	const declaredOnTheWire = declaredFields(declared);
-	const uploadRes = assets.length > 0 || declaresSchedules || Object.keys(declaredOnTheWire).length > 0 ? await fetch(uploadUrl, {
+	const uploadRes = assets.length > 0 || declaresSchedules || Object.keys(declaredOnTheWire).length > 0 ? await authorizedFetch(uploadUrl, {
 		method: "POST",
 		headers: {
 			Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -1610,7 +1861,7 @@ async function deploy(entryInput, options) {
 			...declaresSchedules ? { schedules: config.schedules } : {},
 			...declaredOnTheWire
 		})
-	}) : await fetch(uploadUrl, {
+	}) : await authorizedFetch(uploadUrl, {
 		method: "POST",
 		headers: {
 			Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -1631,8 +1882,12 @@ async function deploy(entryInput, options) {
 				process.exit(1);
 			}
 			console.error(`\n[wawesome] \x1b[31mError: ${refusal.message}\x1b[0m`);
-			console.error("[wawesome] Code versions are immutable and cannot be overwritten.");
-			console.error("[wawesome] To switch active version, run: \x1B[36mwawesome version switch\x1B[0m\n");
+			const advice = planLimitAdvice(refusal.reason);
+			if (advice) console.error(`[wawesome] ${advice}\n`);
+			else if (!refusal.reason) {
+				console.error("[wawesome] Code versions are immutable and cannot be overwritten.");
+				console.error("[wawesome] To switch active version, run: \x1B[36mwawesome version switch\x1B[0m\n");
+			}
 		} else {
 			console.error(`[wawesome] Error: Code upload failed (HTTP ${uploadRes.status}).`);
 			if (isVerbose) console.error(`[wawesome:verbose] Response: ${errorBody}`);
@@ -1652,7 +1907,7 @@ async function deploy(entryInput, options) {
 		if (isVerbose) console.log(`[wawesome:verbose] POST ${deployUrl}`);
 		const deployBody = {};
 		if (version !== void 0) deployBody.version_number = version;
-		const deployRes = await fetch(deployUrl, {
+		const deployRes = await authorizedFetch(deployUrl, {
 			method: "POST",
 			headers: {
 				Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -1670,6 +1925,10 @@ async function deploy(entryInput, options) {
 			process.exit(1);
 		}
 	}
+	recordDeployTarget({
+		app,
+		function: funcName
+	});
 	let address = null;
 	let surface = null;
 	if (visibility === "public") try {
@@ -1729,8 +1988,7 @@ async function deploy(entryInput, options) {
 * changed nothing at all is refused here — before a byte of it has moved.
 */
 async function uploadAssets(creds, app, funcName, bundle, assets, declared, isVerbose, continueWhenUnchanged) {
-	const manifestUrl = `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/assets/manifest`;
-	const manifestRes = await fetch(manifestUrl, {
+	const manifestRes = await authorizedFetch(`${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/assets/manifest`, {
 		method: "POST",
 		headers: {
 			Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -1773,7 +2031,7 @@ async function uploadAssets(creds, app, funcName, bundle, assets, declared, isVe
 	console.log(`[wawesome] Uploading ${toUpload.length} of ${assets.length} asset(s)...`);
 	for (const asset of toUpload) {
 		if (isVerbose) console.log(`[wawesome:verbose] PUT ${asset.path} (${asset.size_bytes} bytes)`);
-		const res = await fetch(`${creds.gateway_url}/v1/assets/${asset.content_hash}`, {
+		const res = await authorizedFetch(`${creds.gateway_url}/v1/assets/${asset.content_hash}`, () => ({
 			method: "PUT",
 			headers: {
 				Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -1782,7 +2040,7 @@ async function uploadAssets(creds, app, funcName, bundle, assets, declared, isVe
 			},
 			body: Readable.toWeb(fs.createReadStream(asset.source)),
 			duplex: "half"
-		});
+		}));
 		if (!res.ok) {
 			const errorBody = await res.text();
 			const refusal = rejectionOf(errorBody, res.status, `Upload of '${asset.path}' failed (HTTP ${res.status}).`);
@@ -1830,8 +2088,7 @@ function loadClientContext() {
 * the time it does, so it needs to say what did land before it gives up.
 */
 async function putEnvVar(creds, app, key, value, isSecret) {
-	const url = `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/env`;
-	const res = await fetch(url, {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/env`, {
 		method: "POST",
 		headers: {
 			Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -1894,7 +2151,7 @@ async function listEnvVars(options) {
 	const { creds, app } = loadClientContext();
 	const url = `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/env`;
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
-	const res = await fetch(url, {
+	const res = await authorizedFetch(url, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${creds.tenant_jwt}` }
 	});
@@ -1948,7 +2205,7 @@ async function removeEnvVar(key, options) {
 	const { creds, app } = loadClientContext();
 	const url = `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/env/${encodeURIComponent(key)}`;
 	if (isVerbose) console.log(`[wawesome:verbose] DELETE ${url}`);
-	const res = await fetch(url, {
+	const res = await authorizedFetch(url, {
 		method: "DELETE",
 		headers: { Authorization: `Bearer ${creds.tenant_jwt}` }
 	});
@@ -2051,10 +2308,10 @@ function authHeaders(creds) {
 * between is still treated as the success it is.
 */
 async function ensureApp(creds, appSlug) {
-	const listRes = await fetch(`${creds.gateway_url}/v1/apps`, { headers: { Authorization: `Bearer ${creds.tenant_jwt}` } });
+	const listRes = await authorizedFetch(`${creds.gateway_url}/v1/apps`, { headers: { Authorization: `Bearer ${creds.tenant_jwt}` } });
 	if (!listRes.ok) throw await rejected(listRes, "Could not list the Tenant's apps");
 	if ((await listRes.json()).applications?.some((app) => app.slug === appSlug)) return;
-	const createRes = await fetch(`${creds.gateway_url}/v1/apps`, {
+	const createRes = await authorizedFetch(`${creds.gateway_url}/v1/apps`, {
 		method: "POST",
 		headers: authHeaders(creds),
 		body: JSON.stringify({
@@ -2075,8 +2332,7 @@ async function ensureApp(creds, appSlug) {
 * scaffolded template and an outbound request that silently fails at runtime.
 */
 async function enableEgressProvider(creds, appSlug, providerKey) {
-	const url = `${creds.gateway_url}/v1/apps/${encodeURIComponent(appSlug)}/egress/subscriptions`;
-	const res = await fetch(url, {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/apps/${encodeURIComponent(appSlug)}/egress/subscriptions`, {
 		method: "POST",
 		headers: authHeaders(creds),
 		body: JSON.stringify({ provider_key: providerKey })
@@ -2979,7 +3235,7 @@ const RECLAIMED = "⚠ [assets reclaimed]";
 async function fetchVersions(gatewayUrl, tenantJwt, app, funcName, env, isVerbose) {
 	const url = `${gatewayUrl}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/versions?environment=${encodeURIComponent(env)}`;
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
-	const res = await fetch(url, {
+	const res = await authorizedFetch(url, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${tenantJwt}` }
 	});
@@ -3092,8 +3348,7 @@ async function switchVersion(targetInput, options) {
 		}
 	}
 	console.log(`[wawesome] Promoting v${selectedVersionNum} to ${env}...`);
-	const deployUrl = `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/deploy`;
-	const deployRes = await fetch(deployUrl, {
+	const deployRes = await authorizedFetch(`${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/deploy`, {
 		method: "POST",
 		headers: {
 			Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -3183,7 +3438,7 @@ async function logsCommand(target, options = {}) {
 async function fetchInvocationLogBody(gatewayUrl, tenantJwt, invocationId, isVerbose) {
 	const url = `${gatewayUrl}/v1/invocations/${encodeURIComponent(invocationId)}/logs`;
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
-	const res = await fetch(url, {
+	const res = await authorizedFetch(url, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${tenantJwt}` }
 	});
@@ -3259,7 +3514,7 @@ async function listInvocations(gatewayUrl, tenantJwt, funcNameInput, appOverride
 async function fetchInvocationsResponse(gatewayUrl, tenantJwt, funcName, appSlug, appOverride, queryString, isVerbose) {
 	const url = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/invocations${queryString}` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/invocations${queryString}`;
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
-	let res = await fetch(url, {
+	let res = await authorizedFetch(url, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${tenantJwt}` }
 	});
@@ -3267,7 +3522,7 @@ async function fetchInvocationsResponse(gatewayUrl, tenantJwt, funcName, appSlug
 		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/invocations${queryString}`;
 		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: GET ${fallbackUrl}`);
 		try {
-			const fallbackRes = await fetch(fallbackUrl, {
+			const fallbackRes = await authorizedFetch(fallbackUrl, {
 				method: "GET",
 				headers: { Authorization: `Bearer ${tenantJwt}` }
 			});
@@ -3379,7 +3634,7 @@ async function followInvocationLog(gatewayUrl, tenantJwt, invocationId, isVerbos
 		while (true) {
 			let res = null;
 			try {
-				res = await fetch(url, {
+				res = await authorizedFetch(url, {
 					method: "GET",
 					headers: {
 						Authorization: `Bearer ${tenantJwt}`,
@@ -3511,18 +3766,18 @@ async function followFunctionLog(gatewayUrl, tenantJwt, funcNameInput, appOverri
 			let res = null;
 			try {
 				if (scopedUrl) {
-					res = await fetch(scopedUrl, {
+					res = await authorizedFetch(scopedUrl, {
 						headers,
 						signal: controller.signal
 					});
 					if (res.status === 404) {
 						if (isVerbose) console.error(`[wawesome:verbose] 404 on app-scoped route, retrying unscoped.`);
-						res = await fetch(unscopedUrl, {
+						res = await authorizedFetch(unscopedUrl, {
 							headers,
 							signal: controller.signal
 						});
 					}
-				} else res = await fetch(unscopedUrl, {
+				} else res = await authorizedFetch(unscopedUrl, {
 					headers,
 					signal: controller.signal
 				});
@@ -3606,8 +3861,237 @@ async function followFunctionLog(gatewayUrl, tenantJwt, funcNameInput, appOverri
 	}
 }
 //#endregion
+//#region src/invoke.ts
+const MAX_STREAM_RETRIES = 3;
+function formatOutcomeDuration(meta) {
+	if (!meta) return "-";
+	if (meta.duration_ms !== void 0 && meta.duration_ms !== null && !isNaN(meta.duration_ms) && meta.duration_ms >= 0) {
+		if (meta.duration_ms < 1e3) return `${meta.duration_ms}ms`;
+		return `${(meta.duration_ms / 1e3).toFixed(2)}s`;
+	}
+	if (meta.started_at) return formatDuration(meta.started_at, meta.ended_at);
+	return "-";
+}
+function printOutcome(meta) {
+	const durationStr = formatOutcomeDuration(meta);
+	const statusStr = colorizeStatus(meta.status, meta.status);
+	if (meta.status === "success") console.log(`[wawesome] ✔ Run completed: ${statusStr} (${durationStr})`);
+	else console.log(`[wawesome] ✖ Run completed: ${statusStr} (${durationStr})`);
+}
+async function triggerRun(gatewayUrl, tenantJwt, funcName, appSlug, appOverride, payload, isVerbose) {
+	const url = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/runs` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/runs`;
+	if (isVerbose) console.log(`[wawesome:verbose] POST ${url}`);
+	let res = await authorizedFetch(url, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${tenantJwt}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify(payload)
+	});
+	if (res.status === 404 && appSlug && !appOverride) {
+		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/runs`;
+		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: POST ${fallbackUrl}`);
+		try {
+			const fallbackRes = await authorizedFetch(fallbackUrl, {
+				method: "POST",
+				headers: {
+					Authorization: `Bearer ${tenantJwt}`,
+					"Content-Type": "application/json"
+				},
+				body: JSON.stringify(payload)
+			});
+			if (fallbackRes) res = fallbackRes;
+		} catch {}
+	}
+	return res;
+}
+async function fetchInvocationMetadata(gatewayUrl, tenantJwt, invocationId, isVerbose) {
+	const url = `${gatewayUrl}/v1/invocations/${encodeURIComponent(invocationId)}`;
+	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
+	const res = await authorizedFetch(url, {
+		method: "GET",
+		headers: { Authorization: `Bearer ${tenantJwt}` }
+	});
+	if (!res.ok) return null;
+	return await res.json();
+}
+async function fetchInvocationLogs(gatewayUrl, tenantJwt, invocationId, isVerbose) {
+	const url = `${gatewayUrl}/v1/invocations/${encodeURIComponent(invocationId)}/logs`;
+	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
+	const res = await authorizedFetch(url, {
+		method: "GET",
+		headers: { Authorization: `Bearer ${tenantJwt}` }
+	});
+	if (!res.ok) return null;
+	return await res.text();
+}
+async function followRun(gatewayUrl, tenantJwt, invocationId, isVerbose, pollIntervalMs = 250) {
+	const streamUrl = `${gatewayUrl}/v1/invocations/${encodeURIComponent(invocationId)}/logs/stream`;
+	const controller = new AbortController();
+	const onSigint = () => {
+		controller.abort();
+		process.stderr.write("\n[wawesome] Stopped following.\n");
+		process.exit(0);
+	};
+	process.on("SIGINT", onSigint);
+	try {
+		let attempt = 0;
+		let streamReadComplete = false;
+		let printedAny = false;
+		while (!streamReadComplete) {
+			if (controller.signal.aborted) return;
+			let res = null;
+			try {
+				res = await authorizedFetch(streamUrl, {
+					method: "GET",
+					headers: {
+						Authorization: `Bearer ${tenantJwt}`,
+						Accept: "text/event-stream"
+					},
+					signal: controller.signal
+				});
+			} catch (err) {
+				if (controller.signal.aborted) return;
+				if (attempt < MAX_STREAM_RETRIES) {
+					const delay = retryDelay(attempt);
+					if (isVerbose) console.error(`[wawesome:verbose] Stream connection failed (${String(err)}), retrying in ${Math.round(delay)}ms (attempt ${attempt + 1}/${MAX_STREAM_RETRIES})...`);
+					await retrySleep(delay, controller.signal);
+					attempt++;
+					continue;
+				}
+				console.error("[wawesome] Error: Failed to connect to the live tail after retries.");
+				process.exit(1);
+			}
+			if (res.status === 404) {
+				const meta = await fetchInvocationMetadata(gatewayUrl, tenantJwt, invocationId, isVerbose);
+				if (!meta) {
+					console.error(`[wawesome] Error: Invocation '${invocationId}' not found.`);
+					process.exit(1);
+				}
+				if (meta.status === "queued" || meta.status === "running") {
+					await retrySleep(pollIntervalMs, controller.signal);
+					continue;
+				}
+				if (meta.status === "success" || meta.status === "error" || meta.status === "timeout") {
+					const logBody = await fetchInvocationLogs(gatewayUrl, tenantJwt, invocationId, isVerbose);
+					if (logBody) for (const line of logBody.split("\n")) printFollowLine(line);
+					printOutcome(meta);
+					return;
+				}
+				console.error(`[wawesome] ✖ Run ${meta.status}${meta.failure_reason ? `: ${meta.failure_reason}` : ""}`);
+				return;
+			}
+			if (res.status === 401) {
+				console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+				process.exit(1);
+			}
+			if (!res.ok && res.status >= 500) {
+				if (attempt < MAX_STREAM_RETRIES) {
+					const delay = retryDelay(attempt);
+					if (isVerbose) console.error(`[wawesome:verbose] Server error (${res.status}), retrying in ${Math.round(delay)}ms (attempt ${attempt + 1}/${MAX_STREAM_RETRIES})...`);
+					await retrySleep(delay, controller.signal);
+					attempt++;
+					continue;
+				}
+				console.error(`[wawesome] Error: Failed to open live tail (HTTP ${res.status}) after retries.`);
+				process.exit(1);
+			}
+			if (!res.ok) {
+				console.error(`[wawesome] Error: Failed to open live tail (HTTP ${res.status}).`);
+				process.exit(1);
+			}
+			if (!res.body) {
+				console.error("[wawesome] Error: Live tail response had no body stream.");
+				process.exit(1);
+			}
+			attempt = 0;
+			try {
+				const reader = res.body.getReader();
+				const decoder = new TextDecoder();
+				let buffer = "";
+				for (;;) {
+					const { value, done } = await reader.read();
+					if (done) break;
+					buffer += decoder.decode(value, { stream: true });
+					const { events, rest } = splitSseEvents(buffer);
+					buffer = rest;
+					for (const chunk of events) for (const line of chunk.split("\n")) {
+						printFollowLine(line);
+						printedAny = true;
+					}
+				}
+				streamReadComplete = true;
+			} catch (streamErr) {
+				if (controller.signal.aborted) return;
+				if (attempt < MAX_STREAM_RETRIES) {
+					await retrySleep(retryDelay(attempt), controller.signal);
+					attempt++;
+					continue;
+				}
+				console.error("[wawesome] Error: Live tail stream interrupted and retries exhausted.");
+				process.exit(1);
+			}
+		}
+		const meta = await fetchInvocationMetadata(gatewayUrl, tenantJwt, invocationId, isVerbose);
+		if (meta) {
+			if (!printedAny && (meta.status === "success" || meta.status === "error" || meta.status === "timeout")) {
+				const logBody = await fetchInvocationLogs(gatewayUrl, tenantJwt, invocationId, isVerbose);
+				if (logBody) for (const line of logBody.split("\n")) printFollowLine(line);
+			}
+			printOutcome(meta);
+		}
+	} finally {
+		process.removeListener("SIGINT", onSigint);
+	}
+}
+async function invokeCommand(target, options = {}) {
+	const isVerbose = Boolean(options.verbose);
+	const creds = readCredentials();
+	if (!creds) {
+		console.error("[wawesome] Error: Not logged in. Run 'wawesome login' first.");
+		process.exit(1);
+	}
+	const config = readFunctionConfig();
+	const funcName = target || config?.function;
+	const appSlug = options.app || config?.app;
+	if (!funcName) {
+		console.error("[wawesome] Error: Missing function name.");
+		console.error("[wawesome] Usage: wawesome invoke [function-name] or run inside a function directory with wawesome-function.json.");
+		process.exit(1);
+	}
+	const method = options.method?.trim();
+	const body = options.body ?? options.data;
+	const triggerPayload = {};
+	if (method) triggerPayload.method = method;
+	if (body !== void 0) triggerPayload.body = body;
+	const res = await triggerRun(creds.gateway_url, creds.tenant_jwt, funcName, appSlug, options.app, triggerPayload, isVerbose);
+	if (!res.ok) {
+		const errorBody = await res.text();
+		if (res.status === 401) {
+			console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+			process.exit(1);
+		}
+		if (res.status === 404) {
+			console.error(`[wawesome] Error: Function '${funcName}' not found.`);
+			process.exit(1);
+		}
+		const refusal = rejectionOf(errorBody, res.status, `Failed to invoke function (HTTP ${res.status}).`);
+		console.error(`[wawesome] Error: ${refusal.message}`);
+		const advice = planLimitAdvice(refusal.reason) || (res.status === 402 ? `Where to resolve it: ${billingPageUrl()}` : "");
+		if (advice) console.error(`[wawesome] ${advice}`);
+		if (isVerbose && res.status !== 409 && res.status !== 402) console.error(`[wawesome:verbose] Response: ${errorBody}`);
+		process.exit(1);
+	}
+	const data = await res.json();
+	const displayTarget = appSlug ? `${appSlug}/${funcName}` : funcName;
+	console.log(`[wawesome] ⏳ Run ${data.invocation_id} queued for '${displayTarget}'...`);
+	if (options.follow === false) return;
+	await followRun(creds.gateway_url, creds.tenant_jwt, data.invocation_id, isVerbose);
+}
+//#endregion
 //#region src/workspace.ts
-function requireCredentials() {
+function requireCredentials$1() {
 	const creds = readCredentials();
 	if (!creds) {
 		console.error("[wawesome] Error: Not logged in. Run 'wawesome login' first.");
@@ -3620,7 +4104,7 @@ function requireCredentials() {
 * change — the rename is offered here rather than discovered by attempting it.
 */
 async function showWorkspace(options) {
-	const creds = requireCredentials();
+	const creds = requireCredentials$1();
 	let tenant;
 	try {
 		tenant = await fetchTenantDetails(creds);
@@ -3655,7 +4139,7 @@ async function showWorkspace(options) {
 * gateway knows something this command could not.
 */
 async function renameWorkspace(slug, options) {
-	const creds = requireCredentials();
+	const creds = requireCredentials$1();
 	if (!slug || !slug.trim()) {
 		console.error("[wawesome] Error: No name given. Usage: wawesome workspace rename <name>");
 		process.exit(1);
@@ -3699,6 +4183,442 @@ async function workspaceCommand(action, target, options) {
 	process.exit(1);
 }
 //#endregion
+//#region src/cron.ts
+/** `2026-08-23 03:00:00 UTC` with second-precision for run history timestamps. */
+function asUtcWithSeconds(iso) {
+	const at = new Date(iso);
+	if (Number.isNaN(at.getTime())) return iso;
+	const pad = (n) => String(n).padStart(2, "0");
+	return `${at.getUTCFullYear()}-${pad(at.getUTCMonth() + 1)}-${pad(at.getUTCDate())} ${pad(at.getUTCHours())}:${pad(at.getUTCMinutes())}:${pad(at.getUTCSeconds())} UTC`;
+}
+/** Format execution delay in ms or s. */
+function formatDelay(delayMs) {
+	if (delayMs === void 0 || delayMs === null || isNaN(delayMs) || delayMs < 0) return "-";
+	if (delayMs < 1e3) return `${delayMs}ms`;
+	return `${(delayMs / 1e3).toFixed(2)}s`;
+}
+/** Colorize state names for terminal output. */
+function colorizeRunState(state, text) {
+	const display = text ?? state;
+	switch (state.toLowerCase()) {
+		case "dispatched":
+		case "success": return `\x1b[32m${display}\x1b[0m`;
+		case "running": return `\x1b[36m${display}\x1b[0m`;
+		case "pending":
+		case "queued": return `\x1b[33m${display}\x1b[0m`;
+		case "missed": return `\x1b[33m${display}\x1b[0m`;
+		case "cancelled":
+		case "skipped": return `\x1b[90m${display}\x1b[0m`;
+		case "failed":
+		case "lost":
+		case "error": return `\x1b[31m${display}\x1b[0m`;
+		default: return display;
+	}
+}
+/**
+* Format a list of schedules for a single function.
+*/
+function formatFunctionSchedules(funcName, appSlug, schedules) {
+	const displayTarget = appSlug ? `${appSlug}/${funcName}` : funcName;
+	if (schedules.length === 0) return [`[wawesome] No schedules found for '${displayTarget}'.`];
+	const nameWidth = Math.max(8, ...schedules.map((s) => s.name.length));
+	const exprWidth = Math.max(10, ...schedules.map((s) => s.expression.length));
+	return [
+		`\n🗓  \x1b[1mSchedules for '${displayTarget}'\x1b[0m\n`,
+		...[...schedules].sort((a, b) => a.name.localeCompare(b.name)).map((schedule) => `  ${schedule.name.padEnd(nameWidth)}  ${schedule.expression.padEnd(exprWidth)}  ${whenItRuns(schedule)}`),
+		""
+	];
+}
+/**
+* Format schedules across all functions in an App.
+*/
+function formatAppSchedules(appSlug, functionSchedules) {
+	if (functionSchedules.reduce((acc, f) => acc + f.schedules.length, 0) === 0) return [`[wawesome] No schedules found for app '${appSlug}'.`];
+	const allSchedules = functionSchedules.flatMap((f) => f.schedules);
+	const nameWidth = Math.max(8, ...allSchedules.map((s) => s.name.length));
+	const exprWidth = Math.max(10, ...allSchedules.map((s) => s.expression.length));
+	const out = [`\n🗓  \x1b[1mSchedules for app '${appSlug}'\x1b[0m\n`];
+	for (const fn of functionSchedules) {
+		out.push(`  Function: \x1b[1m${fn.functionName}\x1b[0m`);
+		if (fn.schedules.length === 0) out.push("    (no schedules)");
+		else for (const s of [...fn.schedules].sort((a, b) => a.name.localeCompare(b.name))) out.push(`    ${s.name.padEnd(nameWidth)}  ${s.expression.padEnd(exprWidth)}  ${whenItRuns(s)}`);
+		out.push("");
+	}
+	return out;
+}
+/**
+* Format background run history table.
+*/
+function formatRunHistoryTable(runs) {
+	if (runs.length === 0) return [];
+	const scheduleColHeader = "SCHEDULE";
+	const stateColHeader = "STATE";
+	const dueColHeader = "DUE AT (UTC)";
+	const startedColHeader = "STARTED AT (UTC)";
+	const delayColHeader = "DELAY";
+	const invColHeader = "INVOCATION ID";
+	const rows = runs.map((run) => {
+		const schedName = run.schedule_name || "manual";
+		const stateDisplay = run.failure_reason ? `${run.state} (${run.failure_reason})` : run.state;
+		const dueAt = asUtcWithSeconds(run.fire_at);
+		const startedAt = run.claimed_at ? asUtcWithSeconds(run.claimed_at) : "-";
+		const delay = formatDelay(run.delay_ms);
+		const invId = run.invocation_id;
+		return {
+			schedName,
+			stateDisplay,
+			rawState: run.state,
+			dueAt,
+			startedAt,
+			delay,
+			invId
+		};
+	});
+	const schedWidth = Math.max(8, ...rows.map((r) => r.schedName.length));
+	const stateWidth = Math.max(5, ...rows.map((r) => r.stateDisplay.length));
+	const dueWidth = Math.max(12, ...rows.map((r) => r.dueAt.length));
+	const startedWidth = Math.max(16, ...rows.map((r) => r.startedAt.length));
+	const delayWidth = Math.max(5, ...rows.map((r) => r.delay.length));
+	const invWidth = Math.max(13, ...rows.map((r) => r.invId.length));
+	return [
+		`${scheduleColHeader.padEnd(schedWidth)} | ${stateColHeader.padEnd(stateWidth)} | ${dueColHeader.padEnd(dueWidth)} | ${startedColHeader.padEnd(startedWidth)} | ${delayColHeader.padEnd(delayWidth)} | ${invColHeader.padEnd(invWidth)}`,
+		`${"-".repeat(schedWidth)}-|-${"-".repeat(stateWidth)}-|-${"-".repeat(dueWidth)}-|-${"-".repeat(startedWidth)}-|-${"-".repeat(delayWidth)}-|-${"-".repeat(invWidth)}`,
+		...rows.map((r) => {
+			const schedPad = r.schedName.padEnd(schedWidth);
+			const coloredState = colorizeRunState(r.rawState, r.stateDisplay);
+			return `${schedPad} | ${r.stateDisplay.length < stateWidth ? coloredState + " ".repeat(stateWidth - r.stateDisplay.length) : coloredState} | ${r.dueAt.padEnd(dueWidth)} | ${r.startedAt.padEnd(startedWidth)} | ${r.delay.padEnd(delayWidth)} | ${r.invId.padEnd(invWidth)}`;
+		})
+	];
+}
+async function fetchFunctionSchedules(gatewayUrl, tenantJwt, funcName, appSlug, isVerbose) {
+	const scopedUrl = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/schedules` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules`;
+	if (isVerbose) console.log(`[wawesome:verbose] GET ${scopedUrl}`);
+	let res = await authorizedFetch(scopedUrl, {
+		method: "GET",
+		headers: { Authorization: `Bearer ${tenantJwt}` }
+	});
+	if (res.status === 404 && appSlug) {
+		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules`;
+		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: GET ${fallbackUrl}`);
+		try {
+			const fallbackRes = await authorizedFetch(fallbackUrl, {
+				method: "GET",
+				headers: { Authorization: `Bearer ${tenantJwt}` }
+			});
+			if (fallbackRes.ok) res = fallbackRes;
+		} catch {}
+	}
+	if (!res.ok) return null;
+	const data = await res.json();
+	return Array.isArray(data.schedules) ? data.schedules : [];
+}
+async function fetchAppFunctions(gatewayUrl, tenantJwt, appSlug, isVerbose) {
+	const url = `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions`;
+	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
+	const res = await authorizedFetch(url, {
+		method: "GET",
+		headers: { Authorization: `Bearer ${tenantJwt}` }
+	});
+	if (!res.ok) return null;
+	return await res.json();
+}
+async function pauseScheduleApi(gatewayUrl, tenantJwt, funcName, scheduleName, appSlug, reason, isVerbose) {
+	const scopedUrl = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/pause` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/pause`;
+	const body = reason?.trim() ? JSON.stringify({ reason: reason.trim() }) : void 0;
+	if (isVerbose) console.log(`[wawesome:verbose] POST ${scopedUrl}`);
+	let res = await authorizedFetch(scopedUrl, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${tenantJwt}`,
+			...body ? { "Content-Type": "application/json" } : {}
+		},
+		body
+	});
+	if (res.status === 404 && appSlug) {
+		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/pause`;
+		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: POST ${fallbackUrl}`);
+		try {
+			const fallbackRes = await authorizedFetch(fallbackUrl, {
+				method: "POST",
+				headers: {
+					Authorization: `Bearer ${tenantJwt}`,
+					...body ? { "Content-Type": "application/json" } : {}
+				},
+				body
+			});
+			if (fallbackRes) res = fallbackRes;
+		} catch {}
+	}
+	return res;
+}
+async function resumeScheduleApi(gatewayUrl, tenantJwt, funcName, scheduleName, appSlug, isVerbose) {
+	const scopedUrl = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/resume` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/resume`;
+	if (isVerbose) console.log(`[wawesome:verbose] POST ${scopedUrl}`);
+	let res = await authorizedFetch(scopedUrl, {
+		method: "POST",
+		headers: { Authorization: `Bearer ${tenantJwt}` }
+	});
+	if (res.status === 404 && appSlug) {
+		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/resume`;
+		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: POST ${fallbackUrl}`);
+		try {
+			const fallbackRes = await authorizedFetch(fallbackUrl, {
+				method: "POST",
+				headers: { Authorization: `Bearer ${tenantJwt}` }
+			});
+			if (fallbackRes) res = fallbackRes;
+		} catch {}
+	}
+	return res;
+}
+async function fetchBackgroundRunsApi(gatewayUrl, tenantJwt, funcName, appSlug, queryParams, isVerbose) {
+	const params = new URLSearchParams();
+	if (queryParams?.limit) params.set("limit", String(queryParams.limit));
+	if (queryParams?.page) params.set("page", String(queryParams.page));
+	if (queryParams?.state && queryParams.state.toLowerCase() !== "all") params.set("state", queryParams.state.toLowerCase());
+	const qs = params.toString() ? `?${params.toString()}` : "";
+	const scopedUrl = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/runs${qs}` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/runs${qs}`;
+	if (isVerbose) console.log(`[wawesome:verbose] GET ${scopedUrl}`);
+	let res = await authorizedFetch(scopedUrl, {
+		method: "GET",
+		headers: { Authorization: `Bearer ${tenantJwt}` }
+	});
+	if (res.status === 404 && appSlug) {
+		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/runs${qs}`;
+		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: GET ${fallbackUrl}`);
+		try {
+			const fallbackRes = await authorizedFetch(fallbackUrl, {
+				method: "GET",
+				headers: { Authorization: `Bearer ${tenantJwt}` }
+			});
+			if (fallbackRes) res = fallbackRes;
+		} catch {}
+	}
+	return res;
+}
+function requireCredentials() {
+	const creds = readCredentials();
+	if (!creds) {
+		console.error("[wawesome] Error: Not logged in. Run 'wawesome login' first.");
+		process.exit(1);
+	}
+	return creds;
+}
+async function listSchedulesCommand(target, options = {}) {
+	const isVerbose = Boolean(options.verbose);
+	const creds = requireCredentials();
+	const config = readFunctionConfig();
+	const explicitApp = options.app;
+	const appSlug = explicitApp || config?.app;
+	const funcName = target || options.function || (explicitApp ? void 0 : config?.function);
+	if (funcName) {
+		const schedules = await fetchFunctionSchedules(creds.gateway_url, creds.tenant_jwt, funcName, appSlug, isVerbose);
+		if (schedules === null) {
+			if (target && !options.app) {
+				const appFuncs = await fetchAppFunctions(creds.gateway_url, creds.tenant_jwt, target, isVerbose);
+				if (appFuncs !== null) {
+					const functionSchedules = [];
+					for (const item of appFuncs) {
+						const scheds = await fetchFunctionSchedules(creds.gateway_url, creds.tenant_jwt, item.function.name, target, isVerbose);
+						functionSchedules.push({
+							functionName: item.function.name,
+							schedules: scheds || []
+						});
+					}
+					const lines = formatAppSchedules(target, functionSchedules);
+					for (const line of lines) console.log(line);
+					return;
+				}
+			}
+			console.error(`[wawesome] Error: Function '${funcName}' not found.`);
+			process.exit(1);
+		}
+		const lines = formatFunctionSchedules(funcName, appSlug, schedules);
+		for (const line of lines) console.log(line);
+		return;
+	}
+	if (appSlug) {
+		const appFuncs = await fetchAppFunctions(creds.gateway_url, creds.tenant_jwt, appSlug, isVerbose);
+		if (appFuncs === null) {
+			console.error(`[wawesome] Error: App '${appSlug}' not found.`);
+			process.exit(1);
+		}
+		const functionSchedules = [];
+		for (const item of appFuncs) {
+			const scheds = await fetchFunctionSchedules(creds.gateway_url, creds.tenant_jwt, item.function.name, appSlug, isVerbose);
+			functionSchedules.push({
+				functionName: item.function.name,
+				schedules: scheds || []
+			});
+		}
+		const lines = formatAppSchedules(appSlug, functionSchedules);
+		for (const line of lines) console.log(line);
+		return;
+	}
+	console.error("[wawesome] Error: Missing function or app name.");
+	console.error("[wawesome] Usage: wawesome cron list [function-or-app] or run inside a function directory with wawesome-function.json.");
+	process.exit(1);
+}
+async function pauseScheduleCommand(target, subtarget, options = {}) {
+	const isVerbose = Boolean(options.verbose);
+	const creds = requireCredentials();
+	const config = readFunctionConfig();
+	let funcName;
+	let scheduleName;
+	if (target && subtarget) {
+		funcName = target;
+		scheduleName = subtarget;
+	} else if (target) {
+		scheduleName = target;
+		funcName = options.function || config?.function;
+	}
+	if (options.function) funcName = options.function;
+	const appSlug = options.app || config?.app;
+	if (!scheduleName) {
+		console.error("[wawesome] Error: Missing schedule name.");
+		console.error("[wawesome] Usage: wawesome cron pause <schedule-name> [--reason <reason>] or wawesome cron pause <function> <schedule-name>");
+		process.exit(1);
+	}
+	if (!funcName) {
+		console.error("[wawesome] Error: Missing function name.");
+		console.error("[wawesome] Usage: wawesome cron pause <function> <schedule-name> or specify -f/--function <name>.");
+		process.exit(1);
+	}
+	const res = await pauseScheduleApi(creds.gateway_url, creds.tenant_jwt, funcName, scheduleName, appSlug, options.reason, isVerbose);
+	if (!res.ok) {
+		const errorBody = await res.text();
+		if (res.status === 401) {
+			console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+			process.exit(1);
+		}
+		if (res.status === 404) {
+			console.error(`[wawesome] Error: Schedule '${scheduleName}' or function '${funcName}' not found.`);
+			process.exit(1);
+		}
+		const refusal = rejectionOf(errorBody, res.status, `Failed to pause schedule (HTTP ${res.status}).`);
+		console.error(`[wawesome] Error: ${refusal.message}`);
+		const advice = planLimitAdvice(refusal.reason) || (res.status === 402 ? `Where to resolve it: ${billingPageUrl()}` : "");
+		if (advice) console.error(`[wawesome] ${advice}`);
+		if (isVerbose) console.error(`[wawesome:verbose] Response: ${errorBody}`);
+		process.exit(1);
+	}
+	const data = await res.json();
+	const displayTarget = appSlug ? `${appSlug}/${funcName}` : funcName;
+	console.log(`[wawesome] ✔ Paused schedule '${data.schedule.name}' on '${displayTarget}'.`);
+	console.log(`  State: ${whenItRuns(data.schedule)} (survives future deploys)`);
+	if (data.schedule.pause_reason) console.log(`  Reason: ${data.schedule.pause_reason}`);
+	if (data.cancelled_runs && data.cancelled_runs.length > 0) {
+		const count = data.cancelled_runs.length;
+		console.log(`  Cancelled ${count} queued run${count === 1 ? "" : "s"} (never started).`);
+	}
+	if (data.running_runs && data.running_runs.length > 0) {
+		const count = data.running_runs.length;
+		console.log(`  Left ${count} in-flight run${count === 1 ? "" : "s"} to complete.`);
+	}
+}
+async function resumeScheduleCommand(target, subtarget, options = {}) {
+	const isVerbose = Boolean(options.verbose);
+	const creds = requireCredentials();
+	const config = readFunctionConfig();
+	let funcName;
+	let scheduleName;
+	if (target && subtarget) {
+		funcName = target;
+		scheduleName = subtarget;
+	} else if (target) {
+		scheduleName = target;
+		funcName = options.function || config?.function;
+	}
+	if (options.function) funcName = options.function;
+	const appSlug = options.app || config?.app;
+	if (!scheduleName) {
+		console.error("[wawesome] Error: Missing schedule name.");
+		console.error("[wawesome] Usage: wawesome cron resume <schedule-name> or wawesome cron resume <function> <schedule-name>");
+		process.exit(1);
+	}
+	if (!funcName) {
+		console.error("[wawesome] Error: Missing function name.");
+		console.error("[wawesome] Usage: wawesome cron resume <function> <schedule-name> or specify -f/--function <name>.");
+		process.exit(1);
+	}
+	const res = await resumeScheduleApi(creds.gateway_url, creds.tenant_jwt, funcName, scheduleName, appSlug, isVerbose);
+	if (!res.ok) {
+		const errorBody = await res.text();
+		if (res.status === 401) {
+			console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+			process.exit(1);
+		}
+		if (res.status === 404) {
+			console.error(`[wawesome] Error: Schedule '${scheduleName}' or function '${funcName}' not found.`);
+			process.exit(1);
+		}
+		const refusal = rejectionOf(errorBody, res.status, `Failed to resume schedule (HTTP ${res.status}).`);
+		console.error(`[wawesome] Error: ${refusal.message}`);
+		const advice = planLimitAdvice(refusal.reason) || (res.status === 402 ? `Where to resolve it: ${billingPageUrl()}` : "");
+		if (advice) console.error(`[wawesome] ${advice}`);
+		if (isVerbose) console.error(`[wawesome:verbose] Response: ${errorBody}`);
+		process.exit(1);
+	}
+	const data = await res.json();
+	const displayTarget = appSlug ? `${appSlug}/${funcName}` : funcName;
+	console.log(`[wawesome] ✔ Resumed schedule '${data.schedule.name}' on '${displayTarget}'.`);
+	console.log(`  ${whenItRuns(data.schedule)} (no backfill)`);
+}
+async function runHistoryCommand(target, options = {}) {
+	const isVerbose = Boolean(options.verbose);
+	const creds = requireCredentials();
+	const config = readFunctionConfig();
+	const funcName = target || options.function || config?.function;
+	const appSlug = options.app || config?.app;
+	if (!funcName) {
+		console.error("[wawesome] Error: Missing function name.");
+		console.error("[wawesome] Usage: wawesome cron history [function-name] or run inside a function directory with wawesome-function.json.");
+		process.exit(1);
+	}
+	const limit = options.limit ? Number(options.limit) : 50;
+	const stateFilter = options.state || options.status;
+	const res = await fetchBackgroundRunsApi(creds.gateway_url, creds.tenant_jwt, funcName, appSlug, {
+		state: stateFilter,
+		limit
+	}, isVerbose);
+	if (!res.ok) {
+		const errorBody = await res.text();
+		if (res.status === 401) {
+			console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+			process.exit(1);
+		}
+		if (res.status === 404) {
+			console.error(`[wawesome] Error: Function '${funcName}' not found.`);
+			process.exit(1);
+		}
+		const refusal = rejectionOf(errorBody, res.status, `Failed to fetch run history (HTTP ${res.status}).`);
+		console.error(`[wawesome] Error: ${refusal.message}`);
+		const advice = planLimitAdvice(refusal.reason) || (res.status === 402 ? `Where to resolve it: ${billingPageUrl()}` : "");
+		if (advice) console.error(`[wawesome] ${advice}`);
+		if (isVerbose) console.error(`[wawesome:verbose] Response: ${errorBody}`);
+		process.exit(1);
+	}
+	const data = await res.json();
+	const displayTarget = appSlug ? `${appSlug}/${funcName}` : funcName;
+	if (!data.runs || data.runs.length === 0) {
+		console.log(`[wawesome] No run history found for '${displayTarget}'.`);
+		return;
+	}
+	const total = data.total ?? data.runs.length;
+	console.log(`\n📜 \x1b[1mRun history for '${displayTarget}' (Showing ${data.runs.length} of ${total} records)\x1b[0m\n`);
+	const tableLines = formatRunHistoryTable(data.runs);
+	for (const line of tableLines) console.log(line);
+	console.log("");
+}
+async function cronCommand(action, target, subtarget, options = {}) {
+	const normAction = (action || "").toLowerCase().trim();
+	if (!normAction || normAction === "list" || normAction === "ls") return listSchedulesCommand(target, options);
+	if (normAction === "pause") return pauseScheduleCommand(target, subtarget, options);
+	if (normAction === "resume") return resumeScheduleCommand(target, subtarget, options);
+	if (normAction === "history" || normAction === "runs" || normAction === "log" || normAction === "logs") return runHistoryCommand(target, options);
+	return listSchedulesCommand(action, options);
+}
+//#endregion
 //#region src/index.ts
 const cli = cac("wawesome");
 cli.command("build [entry]", "Bundle a serverless function to an optimized JS file").option("-o, --out <path>", "Output JS bundle path", { default: "dist/index.js" }).option("-v, --verbose", "Enable verbose debug output").action((entry, options) => buildJs(entry, options));
@@ -3741,6 +4661,40 @@ cli.command("logs [function-name-or-invocation-id]", "View invocation history, f
   With a function name, --follow streams the function's output continuously across
   invocations — new output appears each time the function runs, no need to catch a
   specific invocation. Press Ctrl-C to stop at any time.`).option("-f, --follow", "Stream live output (tail -f style). Follows a running invocation or waits for the next one. Ctrl-C to stop").option("-i, --invocation <id>", "Fetch stdout/stderr log body for a specific invocation ID").option("-a, --app <app>", "App slug override (defaults to wawesome-function.json)").option("-s, --status <status>", "Filter invocations by status (success, error, timeout, running)").option("--success", "Shorthand for --status success").option("--error", "Shorthand for --status error").option("--timeout", "Shorthand for --status timeout").option("--running", "Shorthand for --status running").option("-v, --verbose", "Enable verbose debug output").action((target, options) => logsCommand(target, options));
+cli.command("invoke [function]", "Fire a background run of a serverless function").usage(`invoke [function] [options]
+
+  Fire a Function run now through the authenticated API, without deploying anything
+  or waiting for a scheduled tick.
+
+  By default, follows the run's output live and prints the outcome with duration.
+
+  Examples:
+    wawesome invoke                       # invoke function in current directory
+    wawesome invoke my-function           # invoke 'my-function'
+    wawesome invoke --no-follow           # fire and exit without following output
+    wawesome invoke -m POST -d '{"k":"v"}' # send custom HTTP method and body`).option("-m, --method <method>", "HTTP method to send to the function (default: POST)").option("-b, --body <body>", "Request body to send to the function").option("-d, --data <data>", "Alias for --body").option("--no-follow", "Do not follow the run's output live").option("-a, --app <app>", "App slug override (defaults to wawesome-function.json)").option("-v, --verbose", "Enable verbose debug output").action((target, options) => invokeCommand(target, options));
+cli.command("cron [action] [target] [subtarget]", "Manage schedules and read run history").usage(`cron <action> [options]
+
+  Actions:
+    list [function]                 List schedules for a function or app (default)
+    pause <schedule>                Pause a schedule by name
+    resume <schedule>               Resume a paused schedule
+    history [function]              Read run history for scheduled and manual runs
+
+  Examples:
+    wawesome cron                                      # list schedules for current function
+    wawesome cron list my-function                     # list schedules for 'my-function'
+    wawesome cron list --app my-app                    # list schedules across all functions in 'my-app'
+    wawesome cron pause nightly-reconcile              # pause a schedule
+    wawesome cron pause nightly-reconcile -r "maint"   # pause with reason
+    wawesome cron resume nightly-reconcile             # resume a schedule
+    wawesome cron history                              # view run history
+    wawesome cron history my-function --state failed   # filter run history by state`).option("-r, --reason <reason>", "Reason for pausing a schedule").option("-f, --function <function>", "Function name override").option("-a, --app <app>", "App slug override (defaults to wawesome-function.json)").option("-s, --state <state>", "Filter run history by state (pending, running, dispatched, skipped, missed, cancelled, lost, failed)").option("--status <status>", "Alias for --state").option("-l, --limit <limit>", "Limit number of history rows (default: 50)").option("-v, --verbose", "Enable verbose debug output").action((action, target, subtarget, options) => cronCommand(action, target, subtarget, options));
+cli.command("cron list [target]", "List schedules for a function or app").alias("cron ls").option("-a, --app <app>", "App slug override").option("-v, --verbose", "Enable verbose debug output").action((target, options) => listSchedulesCommand(target, options));
+cli.command("cron pause <schedule>", "Pause a schedule by name").option("-r, --reason <reason>", "Reason for pausing a schedule").option("-f, --function <function>", "Function name override").option("-a, --app <app>", "App slug override").option("-v, --verbose", "Enable verbose debug output").action((schedule, options) => pauseScheduleCommand(schedule, void 0, options));
+cli.command("cron resume <schedule>", "Resume a paused schedule").option("-f, --function <function>", "Function name override").option("-a, --app <app>", "App slug override").option("-v, --verbose", "Enable verbose debug output").action((schedule, options) => resumeScheduleCommand(schedule, void 0, options));
+cli.command("cron history [target]", "Read background run history").alias("cron runs").option("-s, --state <state>", "Filter run history by state (pending, running, dispatched, skipped, missed, cancelled, lost, failed)").option("--status <status>", "Alias for --state").option("-l, --limit <limit>", "Limit number of history rows (default: 50)").option("-a, --app <app>", "App slug override").option("-v, --verbose", "Enable verbose debug output").action((target, options) => runHistoryCommand(target, options));
+cli.command("schedules [action] [target]", "Alias for 'cron'").option("-a, --app <app>", "App slug override").option("-v, --verbose", "Enable verbose debug output").action((action, target, options) => cronCommand(action, target, void 0, options));
 cli.help();
 cli.version(CLI_VERSION);
 cli.parse();