wawesome 0.7.0 → 0.8.0

package/dist/index.mjs

@@ -18,6 +18,7 @@ import zlib from "node:zlib";
 * These are public values — the anon key is designed to be embedded in clients.
 */
 const SUPABASE_URL = "https://vclasavxxoufwymrutai.supabase.co";
+const SUPABASE_ANON_KEY = "sb_publishable_ZlgDAI9cNZkefEwVPKIngA_ktuvTpjD";
 /** Path to the user-level settings file (~/.wawesome/settings.json) */
 function getSettingsPath() {
 	return path.join(os.homedir(), ".wawesome", "settings.json");
@@ -90,12 +91,23 @@ function readCredentials() {
 }
 /**
 * Write credentials to disk, creating the directory if needed.
+*
+* Owner-only, because the file holds a refresh token. The `chmod` is what
+* tightens a file an older CLI left world-readable; a mode passed to
+* `writeFileSync` applies only where it creates the file.
 */
 function writeCredentials(creds) {
 	const credPath = getCredentialsPath();
 	const dir = path.dirname(credPath);
-	fs.mkdirSync(dir, { recursive: true });
-	fs.writeFileSync(credPath, JSON.stringify(creds, null, 2), "utf-8");
+	fs.mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	fs.writeFileSync(credPath, JSON.stringify(creds, null, 2), {
+		encoding: "utf-8",
+		mode: 384
+	});
+	fs.chmodSync(credPath, 384);
 }
 /**
 * Delete stored credentials.
@@ -759,7 +771,7 @@ async function buildJs(entryInput, options) {
 * that has to name this version — `--version`, the dependency a scaffolded
 * project pins — reads it here, so a release bumps one file.
 */
-const CLI_VERSION = "0.7.0";
+const CLI_VERSION = "0.8.0";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -816,6 +828,126 @@ function isInteractive() {
 	return Boolean(process.stdin.isTTY);
 }
 //#endregion
+//#region src/session.ts
+/**
+* A gateway request, retried once against a renewed session if it comes back 401.
+*
+* A caller's `Authorization` is a snapshot of what was on disk when the command
+* started, so a renewal here replaces it. Otherwise every later request in the
+* same command would spend a 401 learning what this already knows.
+*
+* A body that can only be read once, an asset streamed off disk, passes a
+* function so the retry is built one of its own.
+*/
+async function authorizedFetch(url, init = {}) {
+	const request = typeof init === "function" ? init : () => init;
+	const sentAt = Date.now();
+	const res = await fetch(url, renewedJwt ? withBearer(request(), renewedJwt) : request());
+	if (res.status !== 401) return res;
+	if (renewedJwt && renewedAt > sentAt) return retry(url, request, renewedJwt, res);
+	if (renewedJwt && Date.now() - renewedAt < JUST_RENEWED_MS) return res;
+	const renewed = await renewSession();
+	if (!renewed) return res;
+	return retry(url, request, renewed.tenant_jwt, res);
+}
+/** Thirty minutes of token life leaves this nowhere near a genuine expiry. */
+const JUST_RENEWED_MS = 6e4;
+async function retry(url, request, tenantJwt, refused) {
+	await refused.body?.cancel().catch(() => {});
+	return fetch(url, withBearer(request(), tenantJwt));
+}
+function withBearer(init, tenantJwt) {
+	return {
+		...init,
+		headers: {
+			...headerRecord(init.headers),
+			Authorization: `Bearer ${tenantJwt}`
+		}
+	};
+}
+function headerRecord(headers) {
+	if (!headers) return {};
+	if (headers instanceof Headers || Array.isArray(headers)) return Object.fromEntries(new Headers(headers).entries());
+	return { ...headers };
+}
+let renewal = null;
+let renewedJwt = null;
+let renewedAt = 0;
+/** Drop what this process learned about the session, as ending one does. */
+function forgetRenewedSession() {
+	renewal = null;
+	renewedJwt = null;
+	renewedAt = 0;
+}
+/**
+* Supabase rotates the refresh token on every use and revokes the whole family
+* if a spent one comes back, so requests that meet the 401 together share one
+* renewal instead of racing with the same token.
+*/
+function renewSession() {
+	if (!renewal) {
+		const inFlight = renewOnce().finally(() => {
+			if (renewal === inFlight) renewal = null;
+		});
+		renewal = inFlight;
+	}
+	return renewal;
+}
+/**
+* Null where there is nothing to renew from. Credentials written before refresh
+* tokens were stored still describe a session, so the 401 goes back to the
+* caller, whose own message for it is the right one.
+*/
+async function renewOnce() {
+	const creds = readCredentials();
+	if (!creds?.refresh_token) return null;
+	const session = await refreshSupabaseSession(creds.refresh_token);
+	const exchanged = await exchangeForTenantJwt(creds, session.access_token);
+	const renewed = {
+		...creds,
+		tenant_jwt: exchanged.tenant_jwt,
+		refresh_token: session.refresh_token || creds.refresh_token,
+		tenant_slug: exchanged.tenant_slug || creds.tenant_slug,
+		tenant_name: exchanged.tenant_name || creds.tenant_name
+	};
+	writeCredentials(renewed);
+	renewedJwt = renewed.tenant_jwt;
+	renewedAt = Date.now();
+	return renewed;
+}
+async function refreshSupabaseSession(refreshToken) {
+	const res = await fetch(`${SUPABASE_URL}/auth/v1/token?grant_type=refresh_token`, {
+		method: "POST",
+		headers: {
+			apikey: SUPABASE_ANON_KEY,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({ refresh_token: refreshToken })
+	});
+	if (res.status >= 400 && res.status < 500 && res.status !== 429) endSession("Your sign-in was revoked or has expired, so the session could not be renewed.");
+	if (!res.ok) throw new Error(`Could not renew your session (Supabase HTTP ${res.status}).`);
+	const session = await res.json();
+	if (!session.access_token) throw new Error("Could not renew your session (Supabase returned no access token).");
+	return session;
+}
+async function exchangeForTenantJwt(creds, supabaseAccessToken) {
+	const res = await fetch(`${creds.gateway_url}/api/v1/auth/token-exchange`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${supabaseAccessToken}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({ tenant_id: creds.tenant_id })
+	});
+	if (res.status === 401 || res.status === 403) endSession("Your access to this workspace has been withdrawn.");
+	if (!res.ok) throw new Error(`Could not renew your session (token exchange HTTP ${res.status}).`);
+	return await res.json();
+}
+function endSession(reason) {
+	console.error(`[wawesome] Error: ${reason} Run 'wawesome login' to sign in again.`);
+	process.exit(1);
+}
+//#endregion
 //#region src/errors.ts
 /** A rejection carrying the gateway's own prose and, where given, its reason. */
 var GatewayError = class extends Error {
@@ -862,7 +994,7 @@ function errorText(err) {
 //#endregion
 //#region src/tenant.ts
 async function fetchTenantDetails(creds) {
-	const res = await fetch(`${creds.gateway_url}/v1/tenant`, { headers: { Authorization: `Bearer ${creds.tenant_jwt}` } });
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant`, { headers: { Authorization: `Bearer ${creds.tenant_jwt}` } });
 	if (!res.ok) throw await asGatewayError(res, `Failed to read workspace (HTTP ${res.status}).`);
 	return await res.json();
 }
@@ -928,7 +1060,7 @@ function renameAdvice(reason) {
 * unusable name comes back as a `malformed` rejection instead.
 */
 async function renameTenantSlug(creds, slug) {
-	const res = await fetch(`${creds.gateway_url}/v1/tenant/slug`, {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/slug`, {
 		method: "PUT",
 		headers: {
 			Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -972,6 +1104,80 @@ async function promptForWorkspaceName(options) {
 	throw new Error("No workspace name given. Nothing was created.");
 }
 /**
+* Turn a finished OAuth callback into stored credentials.
+*
+* Split from the callback server so what login stores can be exercised without
+* a browser and a port.
+*/
+async function completeLogin({ gatewayUrl, dashboardUrl, accessToken, refreshToken, options }) {
+	const isVerbose = Boolean(options.verbose);
+	console.log("[wawesome] Fetching your workspaces...");
+	const tenantsRes = await fetch(`${gatewayUrl}/api/v1/me/tenants`, { headers: { Authorization: `Bearer ${accessToken}` } });
+	if (!tenantsRes.ok) throw new Error(`Failed to fetch tenants (HTTP ${tenantsRes.status}). Have you completed onboarding?`);
+	const tenants = await tenantsRes.json();
+	let primaryTenantId;
+	let workspaceName;
+	let workspaceSlug;
+	if (tenants.length === 0) {
+		const chosenName = await promptForWorkspaceName(options);
+		console.log(`[wawesome] Creating workspace "${chosenName}"...`);
+		const initRes = await fetch(`${gatewayUrl}/api/v1/onboarding/init`, {
+			method: "POST",
+			headers: {
+				Authorization: `Bearer ${accessToken}`,
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify({ tenant_name: chosenName })
+		});
+		if (!initRes.ok) throw new Error(`Failed to initialize workspace (HTTP ${initRes.status}).`);
+		const initData = await initRes.json();
+		primaryTenantId = initData.tenant_id;
+		workspaceSlug = initData.tenant_slug;
+		workspaceName = initData.tenant_name || chosenName;
+	} else primaryTenantId = tenants[0].tenant_id;
+	if (isVerbose) console.log(`[wawesome:verbose] Using tenant: ${primaryTenantId}`);
+	console.log("[wawesome] Exchanging for tenant-scoped credentials...");
+	const exchangeRes = await fetch(`${gatewayUrl}/api/v1/auth/token-exchange`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${accessToken}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({ tenant_id: primaryTenantId })
+	});
+	if (!exchangeRes.ok) throw new Error(`Token exchange failed (HTTP ${exchangeRes.status}).`);
+	const exchangeData = await exchangeRes.json();
+	workspaceSlug = exchangeData.tenant_slug || workspaceSlug;
+	workspaceName = exchangeData.tenant_name || workspaceName;
+	let userEmail = exchangeData.email || "unknown";
+	try {
+		const payloadPart = exchangeData.tenant_jwt.split(".")[1];
+		const decoded = JSON.parse(Buffer.from(payloadPart, "base64url").toString("utf-8"));
+		if (decoded.email) userEmail = decoded.email;
+	} catch {}
+	forgetRenewedSession();
+	writeCredentials({
+		gateway_url: gatewayUrl,
+		dashboard_url: dashboardUrl,
+		tenant_jwt: exchangeData.tenant_jwt,
+		refresh_token: refreshToken,
+		tenant_id: primaryTenantId,
+		user_email: userEmail,
+		tenant_slug: workspaceSlug,
+		tenant_name: workspaceName
+	});
+	console.log("\n======================================================");
+	console.log("🎉 \x1B[32mLOGIN SUCCESSFUL!\x1B[0m");
+	console.log("======================================================");
+	if (workspaceName) console.log(`\n  Workspace: ${workspaceName}`);
+	if (workspaceSlug) console.log(`  Address:   ${workspaceSlug}`);
+	console.log(`  Tenant:    ${primaryTenantId}`);
+	console.log(`  Gateway:   ${gatewayUrl}`);
+	console.log(`  Email:     ${userEmail}`);
+	console.log("\n  Credentials saved to ~/.wawesome/credentials.json");
+	console.log("======================================================\n");
+}
+/**
 * OAuth login flow:
 * 1. Build Supabase OAuth URL
 * 2. Open browser
@@ -1025,6 +1231,7 @@ async function login(options) {
 			}
 			if (reqUrl.pathname === "/token") {
 				const accessToken = reqUrl.searchParams.get("access_token");
+				const refreshToken = reqUrl.searchParams.get("refresh_token");
 				res.writeHead(200, { "Content-Type": "text/plain" });
 				res.end("Token received by CLI.");
 				if (!accessToken) {
@@ -1035,69 +1242,13 @@ async function login(options) {
 				}
 				if (isVerbose) console.log("[wawesome:verbose] Supabase access token received.");
 				try {
-					console.log("[wawesome] Fetching your workspaces...");
-					const tenantsRes = await fetch(`${gatewayUrl}/api/v1/me/tenants`, { headers: { Authorization: `Bearer ${accessToken}` } });
-					if (!tenantsRes.ok) throw new Error(`Failed to fetch tenants (HTTP ${tenantsRes.status}). Have you completed onboarding?`);
-					const tenants = await tenantsRes.json();
-					let primaryTenantId;
-					let workspaceName;
-					let workspaceSlug;
-					if (tenants.length === 0) {
-						const chosenName = await promptForWorkspaceName(options);
-						console.log(`[wawesome] Creating workspace "${chosenName}"...`);
-						const initRes = await fetch(`${gatewayUrl}/api/v1/onboarding/init`, {
-							method: "POST",
-							headers: {
-								Authorization: `Bearer ${accessToken}`,
-								"Content-Type": "application/json"
-							},
-							body: JSON.stringify({ tenant_name: chosenName })
-						});
-						if (!initRes.ok) throw new Error(`Failed to initialize workspace (HTTP ${initRes.status}).`);
-						const initData = await initRes.json();
-						primaryTenantId = initData.tenant_id;
-						workspaceSlug = initData.tenant_slug;
-						workspaceName = initData.tenant_name || chosenName;
-					} else primaryTenantId = tenants[0].tenant_id;
-					if (isVerbose) console.log(`[wawesome:verbose] Using tenant: ${primaryTenantId}`);
-					console.log("[wawesome] Exchanging for tenant-scoped credentials...");
-					const exchangeRes = await fetch(`${gatewayUrl}/api/v1/auth/token-exchange`, {
-						method: "POST",
-						headers: {
-							Authorization: `Bearer ${accessToken}`,
-							"Content-Type": "application/json"
-						},
-						body: JSON.stringify({ tenant_id: primaryTenantId })
-					});
-					if (!exchangeRes.ok) throw new Error(`Token exchange failed (HTTP ${exchangeRes.status}).`);
-					const exchangeData = await exchangeRes.json();
-					workspaceSlug = exchangeData.tenant_slug || workspaceSlug;
-					workspaceName = exchangeData.tenant_name || workspaceName;
-					let userEmail = exchangeData.email || "unknown";
-					try {
-						const payloadPart = exchangeData.tenant_jwt.split(".")[1];
-						const decoded = JSON.parse(Buffer.from(payloadPart, "base64url").toString("utf-8"));
-						if (decoded.email) userEmail = decoded.email;
-					} catch {}
-					writeCredentials({
-						gateway_url: gatewayUrl,
-						dashboard_url: dashboardUrl,
-						tenant_jwt: exchangeData.tenant_jwt,
-						tenant_id: primaryTenantId,
-						user_email: userEmail,
-						tenant_slug: workspaceSlug,
-						tenant_name: workspaceName
+					await completeLogin({
+						gatewayUrl,
+						dashboardUrl,
+						accessToken,
+						refreshToken: refreshToken || void 0,
+						options
 					});
-					console.log("\n======================================================");
-					console.log("🎉 \x1B[32mLOGIN SUCCESSFUL!\x1B[0m");
-					console.log("======================================================");
-					if (workspaceName) console.log(`\n  Workspace: ${workspaceName}`);
-					if (workspaceSlug) console.log(`  Address:   ${workspaceSlug}`);
-					console.log(`  Tenant:    ${primaryTenantId}`);
-					console.log(`  Gateway:   ${gatewayUrl}`);
-					console.log(`  Email:     ${userEmail}`);
-					console.log("\n  Credentials saved to ~/.wawesome/credentials.json");
-					console.log("======================================================\n");
 					server.close();
 					resolve();
 				} catch (err) {
@@ -1127,6 +1278,7 @@ async function login(options) {
 * Clear stored credentials.
 */
 function logout() {
+	forgetRenewedSession();
 	if (deleteCredentials()) console.log("[wawesome] ✅ Logged out. Credentials removed.");
 	else console.log("[wawesome] Not logged in (no credentials found).");
 }
@@ -1201,7 +1353,7 @@ async function fetchTenantUsage(creds, timeoutMs = USAGE_TIMEOUT_MS) {
 	const controller = new AbortController();
 	const timer = setTimeout(() => controller.abort(), timeoutMs);
 	try {
-		const res = await fetch(`${creds.gateway_url}/v1/tenant/usage`, {
+		const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/usage`, {
 			headers: { Authorization: `Bearer ${creds.tenant_jwt}` },
 			signal: controller.signal
 		});
@@ -1697,7 +1849,7 @@ async function deploy(entryInput, options) {
 	const uploadUrl = `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/code`;
 	if (isVerbose) console.log(`[wawesome:verbose] POST ${uploadUrl}`);
 	const declaredOnTheWire = declaredFields(declared);
-	const uploadRes = assets.length > 0 || declaresSchedules || Object.keys(declaredOnTheWire).length > 0 ? await fetch(uploadUrl, {
+	const uploadRes = assets.length > 0 || declaresSchedules || Object.keys(declaredOnTheWire).length > 0 ? await authorizedFetch(uploadUrl, {
 		method: "POST",
 		headers: {
 			Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -1709,7 +1861,7 @@ async function deploy(entryInput, options) {
 			...declaresSchedules ? { schedules: config.schedules } : {},
 			...declaredOnTheWire
 		})
-	}) : await fetch(uploadUrl, {
+	}) : await authorizedFetch(uploadUrl, {
 		method: "POST",
 		headers: {
 			Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -1755,7 +1907,7 @@ async function deploy(entryInput, options) {
 		if (isVerbose) console.log(`[wawesome:verbose] POST ${deployUrl}`);
 		const deployBody = {};
 		if (version !== void 0) deployBody.version_number = version;
-		const deployRes = await fetch(deployUrl, {
+		const deployRes = await authorizedFetch(deployUrl, {
 			method: "POST",
 			headers: {
 				Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -1836,8 +1988,7 @@ async function deploy(entryInput, options) {
 * changed nothing at all is refused here — before a byte of it has moved.
 */
 async function uploadAssets(creds, app, funcName, bundle, assets, declared, isVerbose, continueWhenUnchanged) {
-	const manifestUrl = `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/assets/manifest`;
-	const manifestRes = await fetch(manifestUrl, {
+	const manifestRes = await authorizedFetch(`${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/assets/manifest`, {
 		method: "POST",
 		headers: {
 			Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -1880,7 +2031,7 @@ async function uploadAssets(creds, app, funcName, bundle, assets, declared, isVe
 	console.log(`[wawesome] Uploading ${toUpload.length} of ${assets.length} asset(s)...`);
 	for (const asset of toUpload) {
 		if (isVerbose) console.log(`[wawesome:verbose] PUT ${asset.path} (${asset.size_bytes} bytes)`);
-		const res = await fetch(`${creds.gateway_url}/v1/assets/${asset.content_hash}`, {
+		const res = await authorizedFetch(`${creds.gateway_url}/v1/assets/${asset.content_hash}`, () => ({
 			method: "PUT",
 			headers: {
 				Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -1889,7 +2040,7 @@ async function uploadAssets(creds, app, funcName, bundle, assets, declared, isVe
 			},
 			body: Readable.toWeb(fs.createReadStream(asset.source)),
 			duplex: "half"
-		});
+		}));
 		if (!res.ok) {
 			const errorBody = await res.text();
 			const refusal = rejectionOf(errorBody, res.status, `Upload of '${asset.path}' failed (HTTP ${res.status}).`);
@@ -1937,8 +2088,7 @@ function loadClientContext() {
 * the time it does, so it needs to say what did land before it gives up.
 */
 async function putEnvVar(creds, app, key, value, isSecret) {
-	const url = `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/env`;
-	const res = await fetch(url, {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/env`, {
 		method: "POST",
 		headers: {
 			Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -2001,7 +2151,7 @@ async function listEnvVars(options) {
 	const { creds, app } = loadClientContext();
 	const url = `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/env`;
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
-	const res = await fetch(url, {
+	const res = await authorizedFetch(url, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${creds.tenant_jwt}` }
 	});
@@ -2055,7 +2205,7 @@ async function removeEnvVar(key, options) {
 	const { creds, app } = loadClientContext();
 	const url = `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/env/${encodeURIComponent(key)}`;
 	if (isVerbose) console.log(`[wawesome:verbose] DELETE ${url}`);
-	const res = await fetch(url, {
+	const res = await authorizedFetch(url, {
 		method: "DELETE",
 		headers: { Authorization: `Bearer ${creds.tenant_jwt}` }
 	});
@@ -2158,10 +2308,10 @@ function authHeaders(creds) {
 * between is still treated as the success it is.
 */
 async function ensureApp(creds, appSlug) {
-	const listRes = await fetch(`${creds.gateway_url}/v1/apps`, { headers: { Authorization: `Bearer ${creds.tenant_jwt}` } });
+	const listRes = await authorizedFetch(`${creds.gateway_url}/v1/apps`, { headers: { Authorization: `Bearer ${creds.tenant_jwt}` } });
 	if (!listRes.ok) throw await rejected(listRes, "Could not list the Tenant's apps");
 	if ((await listRes.json()).applications?.some((app) => app.slug === appSlug)) return;
-	const createRes = await fetch(`${creds.gateway_url}/v1/apps`, {
+	const createRes = await authorizedFetch(`${creds.gateway_url}/v1/apps`, {
 		method: "POST",
 		headers: authHeaders(creds),
 		body: JSON.stringify({
@@ -2182,8 +2332,7 @@ async function ensureApp(creds, appSlug) {
 * scaffolded template and an outbound request that silently fails at runtime.
 */
 async function enableEgressProvider(creds, appSlug, providerKey) {
-	const url = `${creds.gateway_url}/v1/apps/${encodeURIComponent(appSlug)}/egress/subscriptions`;
-	const res = await fetch(url, {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/apps/${encodeURIComponent(appSlug)}/egress/subscriptions`, {
 		method: "POST",
 		headers: authHeaders(creds),
 		body: JSON.stringify({ provider_key: providerKey })
@@ -3086,7 +3235,7 @@ const RECLAIMED = "⚠ [assets reclaimed]";
 async function fetchVersions(gatewayUrl, tenantJwt, app, funcName, env, isVerbose) {
 	const url = `${gatewayUrl}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/versions?environment=${encodeURIComponent(env)}`;
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
-	const res = await fetch(url, {
+	const res = await authorizedFetch(url, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${tenantJwt}` }
 	});
@@ -3199,8 +3348,7 @@ async function switchVersion(targetInput, options) {
 		}
 	}
 	console.log(`[wawesome] Promoting v${selectedVersionNum} to ${env}...`);
-	const deployUrl = `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/deploy`;
-	const deployRes = await fetch(deployUrl, {
+	const deployRes = await authorizedFetch(`${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/deploy`, {
 		method: "POST",
 		headers: {
 			Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -3290,7 +3438,7 @@ async function logsCommand(target, options = {}) {
 async function fetchInvocationLogBody(gatewayUrl, tenantJwt, invocationId, isVerbose) {
 	const url = `${gatewayUrl}/v1/invocations/${encodeURIComponent(invocationId)}/logs`;
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
-	const res = await fetch(url, {
+	const res = await authorizedFetch(url, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${tenantJwt}` }
 	});
@@ -3366,7 +3514,7 @@ async function listInvocations(gatewayUrl, tenantJwt, funcNameInput, appOverride
 async function fetchInvocationsResponse(gatewayUrl, tenantJwt, funcName, appSlug, appOverride, queryString, isVerbose) {
 	const url = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/invocations${queryString}` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/invocations${queryString}`;
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
-	let res = await fetch(url, {
+	let res = await authorizedFetch(url, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${tenantJwt}` }
 	});
@@ -3374,7 +3522,7 @@ async function fetchInvocationsResponse(gatewayUrl, tenantJwt, funcName, appSlug
 		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/invocations${queryString}`;
 		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: GET ${fallbackUrl}`);
 		try {
-			const fallbackRes = await fetch(fallbackUrl, {
+			const fallbackRes = await authorizedFetch(fallbackUrl, {
 				method: "GET",
 				headers: { Authorization: `Bearer ${tenantJwt}` }
 			});
@@ -3486,7 +3634,7 @@ async function followInvocationLog(gatewayUrl, tenantJwt, invocationId, isVerbos
 		while (true) {
 			let res = null;
 			try {
-				res = await fetch(url, {
+				res = await authorizedFetch(url, {
 					method: "GET",
 					headers: {
 						Authorization: `Bearer ${tenantJwt}`,
@@ -3618,18 +3766,18 @@ async function followFunctionLog(gatewayUrl, tenantJwt, funcNameInput, appOverri
 			let res = null;
 			try {
 				if (scopedUrl) {
-					res = await fetch(scopedUrl, {
+					res = await authorizedFetch(scopedUrl, {
 						headers,
 						signal: controller.signal
 					});
 					if (res.status === 404) {
 						if (isVerbose) console.error(`[wawesome:verbose] 404 on app-scoped route, retrying unscoped.`);
-						res = await fetch(unscopedUrl, {
+						res = await authorizedFetch(unscopedUrl, {
 							headers,
 							signal: controller.signal
 						});
 					}
-				} else res = await fetch(unscopedUrl, {
+				} else res = await authorizedFetch(unscopedUrl, {
 					headers,
 					signal: controller.signal
 				});
@@ -3733,7 +3881,7 @@ function printOutcome(meta) {
 async function triggerRun(gatewayUrl, tenantJwt, funcName, appSlug, appOverride, payload, isVerbose) {
 	const url = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/runs` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/runs`;
 	if (isVerbose) console.log(`[wawesome:verbose] POST ${url}`);
-	let res = await fetch(url, {
+	let res = await authorizedFetch(url, {
 		method: "POST",
 		headers: {
 			Authorization: `Bearer ${tenantJwt}`,
@@ -3745,7 +3893,7 @@ async function triggerRun(gatewayUrl, tenantJwt, funcName, appSlug, appOverride,
 		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/runs`;
 		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: POST ${fallbackUrl}`);
 		try {
-			const fallbackRes = await fetch(fallbackUrl, {
+			const fallbackRes = await authorizedFetch(fallbackUrl, {
 				method: "POST",
 				headers: {
 					Authorization: `Bearer ${tenantJwt}`,
@@ -3761,7 +3909,7 @@ async function triggerRun(gatewayUrl, tenantJwt, funcName, appSlug, appOverride,
 async function fetchInvocationMetadata(gatewayUrl, tenantJwt, invocationId, isVerbose) {
 	const url = `${gatewayUrl}/v1/invocations/${encodeURIComponent(invocationId)}`;
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
-	const res = await fetch(url, {
+	const res = await authorizedFetch(url, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${tenantJwt}` }
 	});
@@ -3771,7 +3919,7 @@ async function fetchInvocationMetadata(gatewayUrl, tenantJwt, invocationId, isVe
 async function fetchInvocationLogs(gatewayUrl, tenantJwt, invocationId, isVerbose) {
 	const url = `${gatewayUrl}/v1/invocations/${encodeURIComponent(invocationId)}/logs`;
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
-	const res = await fetch(url, {
+	const res = await authorizedFetch(url, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${tenantJwt}` }
 	});
@@ -3795,7 +3943,7 @@ async function followRun(gatewayUrl, tenantJwt, invocationId, isVerbose, pollInt
 			if (controller.signal.aborted) return;
 			let res = null;
 			try {
-				res = await fetch(streamUrl, {
+				res = await authorizedFetch(streamUrl, {
 					method: "GET",
 					headers: {
 						Authorization: `Bearer ${tenantJwt}`,
@@ -4145,7 +4293,7 @@ function formatRunHistoryTable(runs) {
 async function fetchFunctionSchedules(gatewayUrl, tenantJwt, funcName, appSlug, isVerbose) {
 	const scopedUrl = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/schedules` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules`;
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${scopedUrl}`);
-	let res = await fetch(scopedUrl, {
+	let res = await authorizedFetch(scopedUrl, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${tenantJwt}` }
 	});
@@ -4153,7 +4301,7 @@ async function fetchFunctionSchedules(gatewayUrl, tenantJwt, funcName, appSlug,
 		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules`;
 		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: GET ${fallbackUrl}`);
 		try {
-			const fallbackRes = await fetch(fallbackUrl, {
+			const fallbackRes = await authorizedFetch(fallbackUrl, {
 				method: "GET",
 				headers: { Authorization: `Bearer ${tenantJwt}` }
 			});
@@ -4167,7 +4315,7 @@ async function fetchFunctionSchedules(gatewayUrl, tenantJwt, funcName, appSlug,
 async function fetchAppFunctions(gatewayUrl, tenantJwt, appSlug, isVerbose) {
 	const url = `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions`;
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
-	const res = await fetch(url, {
+	const res = await authorizedFetch(url, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${tenantJwt}` }
 	});
@@ -4178,7 +4326,7 @@ async function pauseScheduleApi(gatewayUrl, tenantJwt, funcName, scheduleName, a
 	const scopedUrl = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/pause` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/pause`;
 	const body = reason?.trim() ? JSON.stringify({ reason: reason.trim() }) : void 0;
 	if (isVerbose) console.log(`[wawesome:verbose] POST ${scopedUrl}`);
-	let res = await fetch(scopedUrl, {
+	let res = await authorizedFetch(scopedUrl, {
 		method: "POST",
 		headers: {
 			Authorization: `Bearer ${tenantJwt}`,
@@ -4190,7 +4338,7 @@ async function pauseScheduleApi(gatewayUrl, tenantJwt, funcName, scheduleName, a
 		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/pause`;
 		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: POST ${fallbackUrl}`);
 		try {
-			const fallbackRes = await fetch(fallbackUrl, {
+			const fallbackRes = await authorizedFetch(fallbackUrl, {
 				method: "POST",
 				headers: {
 					Authorization: `Bearer ${tenantJwt}`,
@@ -4206,7 +4354,7 @@ async function pauseScheduleApi(gatewayUrl, tenantJwt, funcName, scheduleName, a
 async function resumeScheduleApi(gatewayUrl, tenantJwt, funcName, scheduleName, appSlug, isVerbose) {
 	const scopedUrl = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/resume` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/resume`;
 	if (isVerbose) console.log(`[wawesome:verbose] POST ${scopedUrl}`);
-	let res = await fetch(scopedUrl, {
+	let res = await authorizedFetch(scopedUrl, {
 		method: "POST",
 		headers: { Authorization: `Bearer ${tenantJwt}` }
 	});
@@ -4214,7 +4362,7 @@ async function resumeScheduleApi(gatewayUrl, tenantJwt, funcName, scheduleName,
 		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/resume`;
 		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: POST ${fallbackUrl}`);
 		try {
-			const fallbackRes = await fetch(fallbackUrl, {
+			const fallbackRes = await authorizedFetch(fallbackUrl, {
 				method: "POST",
 				headers: { Authorization: `Bearer ${tenantJwt}` }
 			});
@@ -4231,7 +4379,7 @@ async function fetchBackgroundRunsApi(gatewayUrl, tenantJwt, funcName, appSlug,
 	const qs = params.toString() ? `?${params.toString()}` : "";
 	const scopedUrl = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/runs${qs}` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/runs${qs}`;
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${scopedUrl}`);
-	let res = await fetch(scopedUrl, {
+	let res = await authorizedFetch(scopedUrl, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${tenantJwt}` }
 	});
@@ -4239,7 +4387,7 @@ async function fetchBackgroundRunsApi(gatewayUrl, tenantJwt, funcName, appSlug,
 		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/runs${qs}`;
 		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: GET ${fallbackUrl}`);
 		try {
-			const fallbackRes = await fetch(fallbackUrl, {
+			const fallbackRes = await authorizedFetch(fallbackUrl, {
 				method: "GET",
 				headers: { Authorization: `Bearer ${tenantJwt}` }
 			});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wawesome",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "CLI tool for building and deploying serverless functions on wawesome.io platform",
   "type": "module",
   "bin": {