wawesome 0.7.0 → 0.9.0

package/dist/index.mjs

@@ -12,12 +12,91 @@ import { Readable } from "node:stream";
 import crypto from "node:crypto";
 import { confirm, select } from "@inquirer/prompts";
 import zlib from "node:zlib";
+//#region src/errors.ts
+/** A rejection carrying the gateway's own prose and, where given, its reason. */
+var GatewayError = class extends Error {
+	status;
+	reason;
+	/** The raw response, for `--verbose` to print when the prose is not enough. */
+	body;
+	constructor(message, status, reason, body = "") {
+		super(message);
+		this.name = "GatewayError";
+		this.status = status;
+		this.reason = reason;
+		this.body = body;
+	}
+};
+/**
+* Read a failed response into a `GatewayError`.
+*
+* `fallback` is used only when the response carries no prose of its own — a
+* proxy's HTML error page, or an empty body. A 401 is deliberately *not* special
+* cased here: what to say about an expired session depends on what the caller
+* was doing, so callers handle it before reaching this.
+*/
+async function asGatewayError(res, fallback) {
+	return rejectionOf(await res.text().catch(() => ""), res.status, fallback);
+}
+/** The same reading, for a caller that has already taken the body off the wire. */
+function rejectionOf(body, status, fallback) {
+	try {
+		const parsed = JSON.parse(body);
+		return new GatewayError(parsed.error || fallback, status, parsed.reason, body);
+	} catch {
+		return new GatewayError(fallback, status, void 0, body);
+	}
+}
+/** Why the gateway refused, where what was thrown might not be a refusal at all. */
+function reasonOf(err) {
+	return err instanceof GatewayError ? err.reason : void 0;
+}
+/** What went wrong, as text, whatever was thrown. */
+function errorText(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+//#endregion
+//#region src/credential.ts
+const CREDENTIAL_ENV_VAR = "WAWESOME_DEPLOY_CREDENTIAL";
+function credentialFromEnvironment() {
+	const secret = process.env[CREDENTIAL_ENV_VAR]?.trim();
+	return secret ? secret : null;
+}
+/** Enough to match a credential against the one in a CI settings page, and no more. */
+function credentialPrefix(secret) {
+	return secret.slice(0, 11);
+}
+/**
+* A credential has no session behind it, so the platform's own reason — unknown,
+* revoked, expired, or a scope it does not carry — is the whole answer, and
+* "sign in again" names a door a CI runner cannot open.
+*/
+function unauthorizedMessage(status, body) {
+	const secret = credentialFromEnvironment();
+	if (!secret) return status === 401 ? "Authentication expired. Run 'wawesome login' again." : rejectionOf(body, status, `The platform refused this request (HTTP ${status}).`).message;
+	return rejectionOf(body, status, `The deploy credential ${credentialPrefix(secret)} was refused (HTTP ${status}).`).message;
+}
+function reportSessionCommandRefused(secret, consequence) {
+	console.error(`[wawesome] Error: ${CREDENTIAL_ENV_VAR} is set, so this CLI authenticates as deploy credential ${credentialPrefix(secret)}.`);
+	console.error(`[wawesome] ${consequence} Unset ${CREDENTIAL_ENV_VAR} first.`);
+}
+//#endregion
 //#region src/config.ts
 /**
 * Hardcoded Supabase project config for the wawesome.io platform.
 * These are public values — the anon key is designed to be embedded in clients.
 */
 const SUPABASE_URL = "https://vclasavxxoufwymrutai.supabase.co";
+/**
+* Where the documents accepted at signup are published. Fixed rather than
+* resolved per environment: there is one website, and a signup has to be able
+* to link at something a person can actually read before they accept it.
+*/
+const LEGAL_URLS = {
+	terms: "https://wawesome.io/legal/terms-of-service",
+	privacy: "https://wawesome.io/legal/privacy-policy"
+};
+const SUPABASE_ANON_KEY = "sb_publishable_ZlgDAI9cNZkefEwVPKIngA_ktuvTpjD";
 /** Path to the user-level settings file (~/.wawesome/settings.json) */
 function getSettingsPath() {
 	return path.join(os.homedir(), ".wawesome", "settings.json");
@@ -50,11 +129,22 @@ function resolveAddress(overrideUrl, envNames, settingsKey, stored, fallback) {
 	return stored || fallback;
 }
 function getGatewayUrl(overrideUrl) {
-	return resolveAddress(overrideUrl, GATEWAY_ENV_NAMES, "gateway_url", readCredentials()?.gateway_url, GATEWAY_URL_FALLBACK);
+	return resolveAddress(overrideUrl, GATEWAY_ENV_NAMES, "gateway_url", readStoredCredentials()?.gateway_url, GATEWAY_URL_FALLBACK);
+}
+/**
+* A tenant token is only valid at the gateway that issued it, so every other
+* command has to follow the credentials. A login holds no token yet, and
+* reading that rung here made a local gateway outlive the removal of every
+* documented override, since only `logout` clears it. A **Deploy credential**
+* reads the same rungs, and for a sharper reason: following a stale file would
+* present it at a gateway that never minted it.
+*/
+function resolveGatewayUrlWithoutSession(overrideUrl) {
+	return resolveAddress(overrideUrl, GATEWAY_ENV_NAMES, "gateway_url", void 0, GATEWAY_URL_FALLBACK);
 }
 getGatewayUrl();
 function getDashboardUrl(overrideUrl) {
-	return resolveAddress(overrideUrl, DASHBOARD_ENV_NAMES, "dashboard_url", readCredentials()?.dashboard_url, DASHBOARD_URL_FALLBACK);
+	return resolveAddress(overrideUrl, DASHBOARD_ENV_NAMES, "dashboard_url", readStoredCredentials()?.dashboard_url, DASHBOARD_URL_FALLBACK);
 }
 /**
 * The dashboard for the environment this login is going to.
@@ -65,7 +155,7 @@ function getDashboardUrl(overrideUrl) {
 * so is dropping one where the gateway did not change at all.
 */
 function resolveDashboardUrlForLogin(overrideUrl, gatewayUrl) {
-	const creds = readCredentials();
+	const creds = readStoredCredentials();
 	const sameEnvironment = creds?.gateway_url === gatewayUrl;
 	return resolveAddress(overrideUrl, DASHBOARD_ENV_NAMES, "dashboard_url", sameEnvironment ? creds?.dashboard_url : void 0, DASHBOARD_URL_FALLBACK);
 }
@@ -76,9 +166,31 @@ function getCredentialsPath() {
 	return path.join(os.homedir(), ".wawesome", "credentials.json");
 }
 /**
-* Read stored credentials. Returns null if not logged in.
+* What this process authenticates with: the **Deploy credential** in the
+* environment where one is set, and otherwise the session `login` left on disk.
+*
+* The environment wins outright rather than filling a gap, so a CI runner
+* carrying a stale cached home directory still authenticates as itself.
 */
 function readCredentials() {
+	const secret = credentialFromEnvironment();
+	return secret ? environmentCredential(secret) : readStoredCredentials();
+}
+/**
+* A credential wears the shape of a session so that every command reaches the
+* platform the same way. What it does not carry is the point: no refresh token,
+* because there is nothing behind it to renew, and no Tenant, because the
+* platform resolves that from the credential.
+*/
+function environmentCredential(secret) {
+	return {
+		gateway_url: resolveGatewayUrlWithoutSession(void 0),
+		tenant_jwt: secret,
+		credential_prefix: credentialPrefix(secret)
+	};
+}
+/** The session on disk, whatever the environment says. */
+function readStoredCredentials() {
 	const credPath = getCredentialsPath();
 	if (!fs.existsSync(credPath)) return null;
 	try {
@@ -90,12 +202,24 @@ function readCredentials() {
 }
 /**
 * Write credentials to disk, creating the directory if needed.
+*
+* Owner-only, because the file holds a refresh token. The `chmod` is what
+* tightens a file an older CLI left world-readable; a mode passed to
+* `writeFileSync` applies only where it creates the file.
 */
 function writeCredentials(creds) {
+	if (credentialFromEnvironment()) return;
 	const credPath = getCredentialsPath();
 	const dir = path.dirname(credPath);
-	fs.mkdirSync(dir, { recursive: true });
-	fs.writeFileSync(credPath, JSON.stringify(creds, null, 2), "utf-8");
+	fs.mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	fs.writeFileSync(credPath, JSON.stringify(creds, null, 2), {
+		encoding: "utf-8",
+		mode: 384
+	});
+	fs.chmodSync(credPath, 384);
 }
 /**
 * Delete stored credentials.
@@ -759,7 +883,7 @@ async function buildJs(entryInput, options) {
 * that has to name this version — `--version`, the dependency a scaffolded
 * project pins — reads it here, so a release bumps one file.
 */
-const CLI_VERSION = "0.7.0";
+const CLI_VERSION = "0.9.0";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -816,53 +940,130 @@ function isInteractive() {
 	return Boolean(process.stdin.isTTY);
 }
 //#endregion
-//#region src/errors.ts
-/** A rejection carrying the gateway's own prose and, where given, its reason. */
-var GatewayError = class extends Error {
-	status;
-	reason;
-	/** The raw response, for `--verbose` to print when the prose is not enough. */
-	body;
-	constructor(message, status, reason, body = "") {
-		super(message);
-		this.name = "GatewayError";
-		this.status = status;
-		this.reason = reason;
-		this.body = body;
-	}
-};
+//#region src/session.ts
 /**
-* Read a failed response into a `GatewayError`.
+* A gateway request, retried once against a renewed session if it comes back 401.
 *
-* `fallback` is used only when the response carries no prose of its own — a
-* proxy's HTML error page, or an empty body. A 401 is deliberately *not* special
-* cased here: what to say about an expired session depends on what the caller
-* was doing, so callers handle it before reaching this.
+* A caller's `Authorization` is a snapshot of what was on disk when the command
+* started, so a renewal here replaces it. Otherwise every later request in the
+* same command would spend a 401 learning what this already knows.
+*
+* A body that can only be read once, an asset streamed off disk, passes a
+* function so the retry is built one of its own.
 */
-async function asGatewayError(res, fallback) {
-	return rejectionOf(await res.text().catch(() => ""), res.status, fallback);
+async function authorizedFetch(url, init = {}) {
+	const request = typeof init === "function" ? init : () => init;
+	const sentAt = Date.now();
+	const res = await fetch(url, renewedJwt ? withBearer(request(), renewedJwt) : request());
+	if (res.status !== 401) return res;
+	if (credentialFromEnvironment()) return res;
+	if (renewedJwt && renewedAt > sentAt) return retry(url, request, renewedJwt, res);
+	if (renewedJwt && Date.now() - renewedAt < JUST_RENEWED_MS) return res;
+	const renewed = await renewSession();
+	if (!renewed) return res;
+	return retry(url, request, renewed.tenant_jwt, res);
+}
+/** Thirty minutes of token life leaves this nowhere near a genuine expiry. */
+const JUST_RENEWED_MS = 6e4;
+async function retry(url, request, tenantJwt, refused) {
+	await refused.body?.cancel().catch(() => {});
+	return fetch(url, withBearer(request(), tenantJwt));
+}
+function withBearer(init, tenantJwt) {
+	return {
+		...init,
+		headers: {
+			...headerRecord(init.headers),
+			Authorization: `Bearer ${tenantJwt}`
+		}
+	};
 }
-/** The same reading, for a caller that has already taken the body off the wire. */
-function rejectionOf(body, status, fallback) {
-	try {
-		const parsed = JSON.parse(body);
-		return new GatewayError(parsed.error || fallback, status, parsed.reason, body);
-	} catch {
-		return new GatewayError(fallback, status, void 0, body);
+function headerRecord(headers) {
+	if (!headers) return {};
+	if (headers instanceof Headers || Array.isArray(headers)) return Object.fromEntries(new Headers(headers).entries());
+	return { ...headers };
+}
+let renewal = null;
+let renewedJwt = null;
+let renewedAt = 0;
+/** Drop what this process learned about the session, as ending one does. */
+function forgetRenewedSession() {
+	renewal = null;
+	renewedJwt = null;
+	renewedAt = 0;
+}
+/**
+* Supabase rotates the refresh token on every use and revokes the whole family
+* if a spent one comes back, so requests that meet the 401 together share one
+* renewal instead of racing with the same token.
+*/
+function renewSession() {
+	if (!renewal) {
+		const inFlight = renewOnce().finally(() => {
+			if (renewal === inFlight) renewal = null;
+		});
+		renewal = inFlight;
 	}
+	return renewal;
 }
-/** Why the gateway refused, where what was thrown might not be a refusal at all. */
-function reasonOf(err) {
-	return err instanceof GatewayError ? err.reason : void 0;
+/**
+* Null where there is nothing to renew from. Credentials written before refresh
+* tokens were stored still describe a session, so the 401 goes back to the
+* caller, whose own message for it is the right one.
+*/
+async function renewOnce() {
+	const creds = readCredentials();
+	if (!creds?.refresh_token) return null;
+	const session = await refreshSupabaseSession(creds.refresh_token);
+	const exchanged = await exchangeForTenantJwt(creds, session.access_token);
+	const renewed = {
+		...creds,
+		tenant_jwt: exchanged.tenant_jwt,
+		refresh_token: session.refresh_token || creds.refresh_token,
+		tenant_slug: exchanged.tenant_slug || creds.tenant_slug,
+		tenant_name: exchanged.tenant_name || creds.tenant_name
+	};
+	writeCredentials(renewed);
+	renewedJwt = renewed.tenant_jwt;
+	renewedAt = Date.now();
+	return renewed;
 }
-/** What went wrong, as text, whatever was thrown. */
-function errorText(err) {
-	return err instanceof Error ? err.message : String(err);
+async function refreshSupabaseSession(refreshToken) {
+	const res = await fetch(`${SUPABASE_URL}/auth/v1/token?grant_type=refresh_token`, {
+		method: "POST",
+		headers: {
+			apikey: SUPABASE_ANON_KEY,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({ refresh_token: refreshToken })
+	});
+	if (res.status >= 400 && res.status < 500 && res.status !== 429) endSession("Your sign-in was revoked or has expired, so the session could not be renewed.");
+	if (!res.ok) throw new Error(`Could not renew your session (Supabase HTTP ${res.status}).`);
+	const session = await res.json();
+	if (!session.access_token) throw new Error("Could not renew your session (Supabase returned no access token).");
+	return session;
+}
+async function exchangeForTenantJwt(creds, supabaseAccessToken) {
+	const res = await fetch(`${creds.gateway_url}/api/v1/auth/token-exchange`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${supabaseAccessToken}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({ tenant_id: creds.tenant_id })
+	});
+	if (res.status === 401 || res.status === 403) endSession("Your access to this workspace has been withdrawn.");
+	if (!res.ok) throw new Error(`Could not renew your session (token exchange HTTP ${res.status}).`);
+	return await res.json();
+}
+function endSession(reason) {
+	console.error(`[wawesome] Error: ${reason} Run 'wawesome login' to sign in again.`);
+	process.exit(1);
 }
 //#endregion
 //#region src/tenant.ts
 async function fetchTenantDetails(creds) {
-	const res = await fetch(`${creds.gateway_url}/v1/tenant`, { headers: { Authorization: `Bearer ${creds.tenant_jwt}` } });
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant`, { headers: { Authorization: `Bearer ${creds.tenant_jwt}` } });
 	if (!res.ok) throw await asGatewayError(res, `Failed to read workspace (HTTP ${res.status}).`);
 	return await res.json();
 }
@@ -928,7 +1129,7 @@ function renameAdvice(reason) {
 * unusable name comes back as a `malformed` rejection instead.
 */
 async function renameTenantSlug(creds, slug) {
-	const res = await fetch(`${creds.gateway_url}/v1/tenant/slug`, {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/slug`, {
 		method: "PUT",
 		headers: {
 			Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -972,6 +1173,109 @@ async function promptForWorkspaceName(options) {
 	throw new Error("No workspace name given. Nothing was created.");
 }
 /**
+* Ask the person to accept the terms, which is what creating a workspace
+* through this door means too.
+*
+* Declining is the default answer, not the one that needs typing: end of input
+* takes the default, so a piped login that says nothing has accepted nothing —
+* the terminal's version of an unticked box. The flag is a word from the person
+* running the command rather than a prompt, so a pipeline reads the same as a
+* terminal, and both documents are linked either way.
+*/
+async function confirmTermsAccepted(options) {
+	if (options.acceptTerms) return;
+	if (!isInteractive()) throw new Error(`Creating a workspace means accepting the terms of service and the privacy policy, and there is no terminal to ask in. Read ${LEGAL_URLS.terms} and ${LEGAL_URLS.privacy}, then re-run with --accept-terms.`);
+	console.log("\n[wawesome] Creating a workspace means accepting:");
+	console.log(`    Terms of Service   ${LEGAL_URLS.terms}`);
+	console.log(`    Privacy Policy     ${LEGAL_URLS.privacy}`);
+	const session = openPromptSession();
+	try {
+		const answer = await session.ask("  Accept both?", "n");
+		if (/^y(es)?$/i.test(answer.trim())) return;
+	} finally {
+		session.close();
+	}
+	throw new Error("The terms were not accepted. Nothing was created.");
+}
+/**
+* Turn a finished OAuth callback into stored credentials.
+*
+* Split from the callback server so what login stores can be exercised without
+* a browser and a port.
+*/
+async function completeLogin({ gatewayUrl, dashboardUrl, accessToken, refreshToken, options }) {
+	const isVerbose = Boolean(options.verbose);
+	console.log("[wawesome] Fetching your workspaces...");
+	const tenantsRes = await fetch(`${gatewayUrl}/api/v1/me/tenants`, { headers: { Authorization: `Bearer ${accessToken}` } });
+	if (!tenantsRes.ok) throw new Error(`Failed to fetch tenants (HTTP ${tenantsRes.status}). Have you completed onboarding?`);
+	const tenants = await tenantsRes.json();
+	let primaryTenantId;
+	let workspaceName;
+	let workspaceSlug;
+	if (tenants.length === 0) {
+		const chosenName = await promptForWorkspaceName(options);
+		await confirmTermsAccepted(options);
+		console.log(`[wawesome] Creating workspace "${chosenName}"...`);
+		const initRes = await fetch(`${gatewayUrl}/api/v1/onboarding/init`, {
+			method: "POST",
+			headers: {
+				Authorization: `Bearer ${accessToken}`,
+				"Content-Type": "application/json"
+			},
+			body: JSON.stringify({
+				tenant_name: chosenName,
+				accepted_terms: true
+			})
+		});
+		if (!initRes.ok) throw await asGatewayError(initRes, `Failed to initialize workspace (HTTP ${initRes.status}).`);
+		const initData = await initRes.json();
+		primaryTenantId = initData.tenant_id;
+		workspaceSlug = initData.tenant_slug;
+		workspaceName = initData.tenant_name || chosenName;
+	} else primaryTenantId = tenants[0].tenant_id;
+	if (isVerbose) console.log(`[wawesome:verbose] Using tenant: ${primaryTenantId}`);
+	console.log("[wawesome] Exchanging for tenant-scoped credentials...");
+	const exchangeRes = await fetch(`${gatewayUrl}/api/v1/auth/token-exchange`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${accessToken}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({ tenant_id: primaryTenantId })
+	});
+	if (!exchangeRes.ok) throw new Error(`Token exchange failed (HTTP ${exchangeRes.status}).`);
+	const exchangeData = await exchangeRes.json();
+	workspaceSlug = exchangeData.tenant_slug || workspaceSlug;
+	workspaceName = exchangeData.tenant_name || workspaceName;
+	let userEmail = exchangeData.email || "unknown";
+	try {
+		const payloadPart = exchangeData.tenant_jwt.split(".")[1];
+		const decoded = JSON.parse(Buffer.from(payloadPart, "base64url").toString("utf-8"));
+		if (decoded.email) userEmail = decoded.email;
+	} catch {}
+	forgetRenewedSession();
+	writeCredentials({
+		gateway_url: gatewayUrl,
+		dashboard_url: dashboardUrl,
+		tenant_jwt: exchangeData.tenant_jwt,
+		refresh_token: refreshToken,
+		tenant_id: primaryTenantId,
+		user_email: userEmail,
+		tenant_slug: workspaceSlug,
+		tenant_name: workspaceName
+	});
+	console.log("\n======================================================");
+	console.log("🎉 \x1B[32mLOGIN SUCCESSFUL!\x1B[0m");
+	console.log("======================================================");
+	if (workspaceName) console.log(`\n  Workspace: ${workspaceName}`);
+	if (workspaceSlug) console.log(`  Address:   ${workspaceSlug}`);
+	console.log(`  Tenant:    ${primaryTenantId}`);
+	console.log(`  Gateway:   ${gatewayUrl}`);
+	console.log(`  Email:     ${userEmail}`);
+	console.log("\n  Credentials saved to ~/.wawesome/credentials.json");
+	console.log("======================================================\n");
+}
+/**
 * OAuth login flow:
 * 1. Build Supabase OAuth URL
 * 2. Open browser
@@ -980,7 +1284,12 @@ async function promptForWorkspaceName(options) {
 * 5. Store credentials in ~/.wawesome/credentials.json
 */
 async function login(options) {
-	const gatewayUrl = getGatewayUrl(options.gateway || options.api);
+	const credential = credentialFromEnvironment();
+	if (credential) {
+		reportSessionCommandRefused(credential, "A session signed in here would be read by nothing.");
+		process.exit(1);
+	}
+	const gatewayUrl = resolveGatewayUrlWithoutSession(options.gateway || options.api);
 	const dashboardUrl = resolveDashboardUrlForLogin(options.dashboard, gatewayUrl);
 	const provider = options.provider || "github";
 	const isVerbose = Boolean(options.verbose);
@@ -1025,6 +1334,7 @@ async function login(options) {
 			}
 			if (reqUrl.pathname === "/token") {
 				const accessToken = reqUrl.searchParams.get("access_token");
+				const refreshToken = reqUrl.searchParams.get("refresh_token");
 				res.writeHead(200, { "Content-Type": "text/plain" });
 				res.end("Token received by CLI.");
 				if (!accessToken) {
@@ -1035,69 +1345,13 @@ async function login(options) {
 				}
 				if (isVerbose) console.log("[wawesome:verbose] Supabase access token received.");
 				try {
-					console.log("[wawesome] Fetching your workspaces...");
-					const tenantsRes = await fetch(`${gatewayUrl}/api/v1/me/tenants`, { headers: { Authorization: `Bearer ${accessToken}` } });
-					if (!tenantsRes.ok) throw new Error(`Failed to fetch tenants (HTTP ${tenantsRes.status}). Have you completed onboarding?`);
-					const tenants = await tenantsRes.json();
-					let primaryTenantId;
-					let workspaceName;
-					let workspaceSlug;
-					if (tenants.length === 0) {
-						const chosenName = await promptForWorkspaceName(options);
-						console.log(`[wawesome] Creating workspace "${chosenName}"...`);
-						const initRes = await fetch(`${gatewayUrl}/api/v1/onboarding/init`, {
-							method: "POST",
-							headers: {
-								Authorization: `Bearer ${accessToken}`,
-								"Content-Type": "application/json"
-							},
-							body: JSON.stringify({ tenant_name: chosenName })
-						});
-						if (!initRes.ok) throw new Error(`Failed to initialize workspace (HTTP ${initRes.status}).`);
-						const initData = await initRes.json();
-						primaryTenantId = initData.tenant_id;
-						workspaceSlug = initData.tenant_slug;
-						workspaceName = initData.tenant_name || chosenName;
-					} else primaryTenantId = tenants[0].tenant_id;
-					if (isVerbose) console.log(`[wawesome:verbose] Using tenant: ${primaryTenantId}`);
-					console.log("[wawesome] Exchanging for tenant-scoped credentials...");
-					const exchangeRes = await fetch(`${gatewayUrl}/api/v1/auth/token-exchange`, {
-						method: "POST",
-						headers: {
-							Authorization: `Bearer ${accessToken}`,
-							"Content-Type": "application/json"
-						},
-						body: JSON.stringify({ tenant_id: primaryTenantId })
-					});
-					if (!exchangeRes.ok) throw new Error(`Token exchange failed (HTTP ${exchangeRes.status}).`);
-					const exchangeData = await exchangeRes.json();
-					workspaceSlug = exchangeData.tenant_slug || workspaceSlug;
-					workspaceName = exchangeData.tenant_name || workspaceName;
-					let userEmail = exchangeData.email || "unknown";
-					try {
-						const payloadPart = exchangeData.tenant_jwt.split(".")[1];
-						const decoded = JSON.parse(Buffer.from(payloadPart, "base64url").toString("utf-8"));
-						if (decoded.email) userEmail = decoded.email;
-					} catch {}
-					writeCredentials({
-						gateway_url: gatewayUrl,
-						dashboard_url: dashboardUrl,
-						tenant_jwt: exchangeData.tenant_jwt,
-						tenant_id: primaryTenantId,
-						user_email: userEmail,
-						tenant_slug: workspaceSlug,
-						tenant_name: workspaceName
+					await completeLogin({
+						gatewayUrl,
+						dashboardUrl,
+						accessToken,
+						refreshToken: refreshToken || void 0,
+						options
 					});
-					console.log("\n======================================================");
-					console.log("🎉 \x1B[32mLOGIN SUCCESSFUL!\x1B[0m");
-					console.log("======================================================");
-					if (workspaceName) console.log(`\n  Workspace: ${workspaceName}`);
-					if (workspaceSlug) console.log(`  Address:   ${workspaceSlug}`);
-					console.log(`  Tenant:    ${primaryTenantId}`);
-					console.log(`  Gateway:   ${gatewayUrl}`);
-					console.log(`  Email:     ${userEmail}`);
-					console.log("\n  Credentials saved to ~/.wawesome/credentials.json");
-					console.log("======================================================\n");
 					server.close();
 					resolve();
 				} catch (err) {
@@ -1127,6 +1381,12 @@ async function login(options) {
 * Clear stored credentials.
 */
 function logout() {
+	const credential = credentialFromEnvironment();
+	if (credential) {
+		reportSessionCommandRefused(credential, "The next command would authenticate all the same.");
+		process.exit(1);
+	}
+	forgetRenewedSession();
 	if (deleteCredentials()) console.log("[wawesome] ✅ Logged out. Credentials removed.");
 	else console.log("[wawesome] Not logged in (no credentials found).");
 }
@@ -1135,6 +1395,7 @@ function logout() {
 */
 async function whoami() {
 	const creds = readCredentials();
+	if (creds?.credential_prefix) return reportCredential(creds);
 	if (!creds) {
 		console.log("[wawesome] Not logged in. Run 'wawesome login' to authenticate.");
 		return;
@@ -1154,6 +1415,33 @@ async function whoami() {
 	console.log(`  Tenant:    ${creds.tenant_id}`);
 	console.log(`  Gateway:   ${creds.gateway_url}\n`);
 }
+/**
+* Name the credential the commands here run as.
+*
+* By its prefix, never the secret: what a developer needs is to match the
+* identity in front of them against the one in their CI settings, and the
+* output of `whoami` is the sort of thing that ends up pasted into an issue.
+* The workspace is asked for rather than read, because a credential names no
+* Tenant of its own — the platform resolves that from the credential.
+*/
+async function reportCredential(creds) {
+	let workspace = null;
+	let refusal = null;
+	try {
+		workspace = await resolveWorkspace(creds);
+	} catch (err) {
+		if (err instanceof GatewayError && (err.status === 401 || err.status === 403)) refusal = err.message;
+	}
+	console.log("\n[wawesome] Acting as a deploy credential:");
+	console.log(`  Credential: ${creds.credential_prefix} (from ${CREDENTIAL_ENV_VAR})`);
+	if (workspace) {
+		console.log(`  Workspace:  ${workspace.name}`);
+		console.log(`  Address:    ${workspace.slug}`);
+	}
+	console.log(`  Gateway:    ${creds.gateway_url}`);
+	if (refusal) console.log(`  Refused:    ${refusal}`);
+	console.log("");
+}
 //#endregion
 //#region src/schedules.ts
 /**
@@ -1164,15 +1452,18 @@ async function whoami() {
 * press resume, and file a bug when neither starts it.
 */
 function whenItRuns(schedule) {
-	if (schedule.state === "suspended") return "suspended — the workspace owes payment";
 	const undeclared = schedule.declared === false;
+	if (schedule.state === "suspended") {
+		const why = "the workspace owes payment, its subscription ended, or it has spent past its plan's allowance";
+		return undeclared ? `suspended, and not in this config file — ${why}; declare it again too` : `suspended — ${why}`;
+	}
 	if (schedule.state === "paused") return undeclared ? "paused, and not in this config file — declare it again, then resume" : "paused — resume it to run again";
 	if (undeclared) return "not in this config file — disabled, kept";
 	if (schedule.state !== "active") return schedule.state;
-	return schedule.next_fire_at ? `next run ${asUtc(schedule.next_fire_at)}` : "next run unknown";
+	return schedule.next_fire_at ? `next run ${asUtc$1(schedule.next_fire_at)}` : "next run unknown";
 }
 /** `2026-08-23 03:00 UTC`, which is the zone every expression is read in. */
-function asUtc(iso) {
+function asUtc$1(iso) {
 	const at = new Date(iso);
 	if (Number.isNaN(at.getTime())) return iso;
 	const pad = (n) => String(n).padStart(2, "0");
@@ -1201,7 +1492,7 @@ async function fetchTenantUsage(creds, timeoutMs = USAGE_TIMEOUT_MS) {
 	const controller = new AbortController();
 	const timer = setTimeout(() => controller.abort(), timeoutMs);
 	try {
-		const res = await fetch(`${creds.gateway_url}/v1/tenant/usage`, {
+		const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/usage`, {
 			headers: { Authorization: `Bearer ${creds.tenant_jwt}` },
 			signal: controller.signal
 		});
@@ -1697,7 +1988,7 @@ async function deploy(entryInput, options) {
 	const uploadUrl = `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/code`;
 	if (isVerbose) console.log(`[wawesome:verbose] POST ${uploadUrl}`);
 	const declaredOnTheWire = declaredFields(declared);
-	const uploadRes = assets.length > 0 || declaresSchedules || Object.keys(declaredOnTheWire).length > 0 ? await fetch(uploadUrl, {
+	const uploadRes = assets.length > 0 || declaresSchedules || Object.keys(declaredOnTheWire).length > 0 ? await authorizedFetch(uploadUrl, {
 		method: "POST",
 		headers: {
 			Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -1709,7 +2000,7 @@ async function deploy(entryInput, options) {
 			...declaresSchedules ? { schedules: config.schedules } : {},
 			...declaredOnTheWire
 		})
-	}) : await fetch(uploadUrl, {
+	}) : await authorizedFetch(uploadUrl, {
 		method: "POST",
 		headers: {
 			Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -1720,7 +2011,7 @@ async function deploy(entryInput, options) {
 	if (!uploadRes.ok) {
 		const errorBody = await uploadRes.text();
 		const refusal = rejectionOf(errorBody, uploadRes.status, "Version with this code bundle already exists.");
-		if (uploadRes.status === 401) console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+		if (uploadRes.status === 401 || uploadRes.status === 403) console.error(`[wawesome] Error: ${unauthorizedMessage(uploadRes.status, errorBody)}`);
 		else if (refusal.reason === "paid-plan-required") {
 			console.error(`\n[wawesome] \x1b[31mError: ${refusal.message}\x1b[0m`);
 			console.error(`[wawesome] ${planLimitAdvice(refusal.reason)}\n`);
@@ -1755,7 +2046,7 @@ async function deploy(entryInput, options) {
 		if (isVerbose) console.log(`[wawesome:verbose] POST ${deployUrl}`);
 		const deployBody = {};
 		if (version !== void 0) deployBody.version_number = version;
-		const deployRes = await fetch(deployUrl, {
+		const deployRes = await authorizedFetch(deployUrl, {
 			method: "POST",
 			headers: {
 				Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -1765,7 +2056,7 @@ async function deploy(entryInput, options) {
 		});
 		if (!deployRes.ok) {
 			const errorBody = await deployRes.text();
-			if (deployRes.status === 401) console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+			if (deployRes.status === 401 || deployRes.status === 403) console.error(`[wawesome] Error: ${unauthorizedMessage(deployRes.status, errorBody)}`);
 			else {
 				console.error(`[wawesome] Error: Deployment failed (HTTP ${deployRes.status}).`);
 				if (isVerbose) console.error(`[wawesome:verbose] Response: ${errorBody}`);
@@ -1836,8 +2127,7 @@ async function deploy(entryInput, options) {
 * changed nothing at all is refused here — before a byte of it has moved.
 */
 async function uploadAssets(creds, app, funcName, bundle, assets, declared, isVerbose, continueWhenUnchanged) {
-	const manifestUrl = `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/assets/manifest`;
-	const manifestRes = await fetch(manifestUrl, {
+	const manifestRes = await authorizedFetch(`${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/assets/manifest`, {
 		method: "POST",
 		headers: {
 			Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -1851,7 +2141,7 @@ async function uploadAssets(creds, app, funcName, bundle, assets, declared, isVe
 	});
 	if (!manifestRes.ok) {
 		const errorBody = await manifestRes.text();
-		if (manifestRes.status === 401) console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+		if (manifestRes.status === 401 || manifestRes.status === 403) console.error(`[wawesome] Error: ${unauthorizedMessage(manifestRes.status, errorBody)}`);
 		else if (manifestRes.status === 409) {
 			if (continueWhenUnchanged) {
 				console.log("[wawesome] Code and files unchanged since the last deploy; applying schedules.");
@@ -1880,7 +2170,7 @@ async function uploadAssets(creds, app, funcName, bundle, assets, declared, isVe
 	console.log(`[wawesome] Uploading ${toUpload.length} of ${assets.length} asset(s)...`);
 	for (const asset of toUpload) {
 		if (isVerbose) console.log(`[wawesome:verbose] PUT ${asset.path} (${asset.size_bytes} bytes)`);
-		const res = await fetch(`${creds.gateway_url}/v1/assets/${asset.content_hash}`, {
+		const res = await authorizedFetch(`${creds.gateway_url}/v1/assets/${asset.content_hash}`, () => ({
 			method: "PUT",
 			headers: {
 				Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -1889,7 +2179,7 @@ async function uploadAssets(creds, app, funcName, bundle, assets, declared, isVe
 			},
 			body: Readable.toWeb(fs.createReadStream(asset.source)),
 			duplex: "half"
-		});
+		}));
 		if (!res.ok) {
 			const errorBody = await res.text();
 			const refusal = rejectionOf(errorBody, res.status, `Upload of '${asset.path}' failed (HTTP ${res.status}).`);
@@ -1937,8 +2227,7 @@ function loadClientContext() {
 * the time it does, so it needs to say what did land before it gives up.
 */
 async function putEnvVar(creds, app, key, value, isSecret) {
-	const url = `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/env`;
-	const res = await fetch(url, {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/env`, {
 		method: "POST",
 		headers: {
 			Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -1951,7 +2240,7 @@ async function putEnvVar(creds, app, key, value, isSecret) {
 		})
 	});
 	if (!res.ok) {
-		if (res.status === 401) throw new GatewayError("Authentication expired. Run 'wawesome login' again.", 401);
+		if (res.status === 401 || res.status === 403) throw new GatewayError(unauthorizedMessage(res.status, await res.text().catch(() => "")), res.status);
 		throw await asGatewayError(res, `Failed to set variable '${key}' (HTTP ${res.status}).`);
 	}
 	return await res.json();
@@ -2001,13 +2290,13 @@ async function listEnvVars(options) {
 	const { creds, app } = loadClientContext();
 	const url = `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/env`;
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
-	const res = await fetch(url, {
+	const res = await authorizedFetch(url, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${creds.tenant_jwt}` }
 	});
 	if (!res.ok) {
 		const errorBody = await res.text();
-		if (res.status === 401) console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+		if (res.status === 401 || res.status === 403) console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorBody)}`);
 		else {
 			console.error(`[wawesome] Error: Failed to list variables (HTTP ${res.status}).`);
 			if (isVerbose) console.error(`[wawesome:verbose] Response: ${errorBody}`);
@@ -2055,13 +2344,13 @@ async function removeEnvVar(key, options) {
 	const { creds, app } = loadClientContext();
 	const url = `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/env/${encodeURIComponent(key)}`;
 	if (isVerbose) console.log(`[wawesome:verbose] DELETE ${url}`);
-	const res = await fetch(url, {
+	const res = await authorizedFetch(url, {
 		method: "DELETE",
 		headers: { Authorization: `Bearer ${creds.tenant_jwt}` }
 	});
 	if (!res.ok) {
 		const errorBody = await res.text();
-		if (res.status === 401) console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+		if (res.status === 401 || res.status === 403) console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorBody)}`);
 		else if (res.status === 404) console.error(`[wawesome] Error: Variable '${key}' not found on app '${app}'.`);
 		else {
 			console.error(`[wawesome] Error: Failed to delete variable '${key}' (HTTP ${res.status}).`);
@@ -2137,7 +2426,7 @@ function installDependencies(dir, options = {}) {
 //#region src/provision.ts
 /** The gateway's own words for a failure, or a plain HTTP status if it gave none. */
 async function rejected(res, fallback) {
-	if (res.status === 401) return new GatewayError("Authentication expired. Run 'wawesome login' again.", 401);
+	if (res.status === 401 || res.status === 403) return new GatewayError(unauthorizedMessage(res.status, await res.text().catch(() => "")), res.status);
 	return asGatewayError(res, `${fallback} (HTTP ${res.status}).`);
 }
 function authHeaders(creds) {
@@ -2158,10 +2447,10 @@ function authHeaders(creds) {
 * between is still treated as the success it is.
 */
 async function ensureApp(creds, appSlug) {
-	const listRes = await fetch(`${creds.gateway_url}/v1/apps`, { headers: { Authorization: `Bearer ${creds.tenant_jwt}` } });
+	const listRes = await authorizedFetch(`${creds.gateway_url}/v1/apps`, { headers: { Authorization: `Bearer ${creds.tenant_jwt}` } });
 	if (!listRes.ok) throw await rejected(listRes, "Could not list the Tenant's apps");
 	if ((await listRes.json()).applications?.some((app) => app.slug === appSlug)) return;
-	const createRes = await fetch(`${creds.gateway_url}/v1/apps`, {
+	const createRes = await authorizedFetch(`${creds.gateway_url}/v1/apps`, {
 		method: "POST",
 		headers: authHeaders(creds),
 		body: JSON.stringify({
@@ -2182,8 +2471,7 @@ async function ensureApp(creds, appSlug) {
 * scaffolded template and an outbound request that silently fails at runtime.
 */
 async function enableEgressProvider(creds, appSlug, providerKey) {
-	const url = `${creds.gateway_url}/v1/apps/${encodeURIComponent(appSlug)}/egress/subscriptions`;
-	const res = await fetch(url, {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/apps/${encodeURIComponent(appSlug)}/egress/subscriptions`, {
 		method: "POST",
 		headers: authHeaders(creds),
 		body: JSON.stringify({ provider_key: providerKey })
@@ -2645,7 +2933,7 @@ function anArticle(label, capitalized = false) {
 	return `${capitalized ? article[0].toUpperCase() + article.slice(1) : article} ${label}`;
 }
 /** Report a failure the user can act on, and stop. */
-function fail(message, ...advice) {
+function fail$1(message, ...advice) {
 	console.error(`[wawesome] Error: ${message}`);
 	for (const line of advice) console.error(`[wawesome] ${line}`);
 	process.exit(1);
@@ -2825,7 +3113,7 @@ async function wireUp(creds, appSlug, manifest, answers) {
 	try {
 		await ensureApp(creds, appSlug);
 	} catch (err) {
-		fail(errorText(err), ...[planLimitAdvice(reasonOf(err)), scaffolded].filter(Boolean));
+		fail$1(errorText(err), ...[planLimitAdvice(reasonOf(err)), scaffolded].filter(Boolean));
 	}
 	for (const { declared, value } of answers) {
 		if (!value) {
@@ -2836,7 +3124,7 @@ async function wireUp(creds, appSlug, manifest, answers) {
 		try {
 			await putEnvVar(creds, appSlug, declared.key, value, declared.secret);
 		} catch (err) {
-			fail(errorText(err), scaffolded);
+			fail$1(errorText(err), scaffolded);
 		}
 		console.log(`[wawesome] ✅ Stored ${declared.key}${declared.secret ? " (secret)" : ""}.`);
 	}
@@ -2844,7 +3132,7 @@ async function wireUp(creds, appSlug, manifest, answers) {
 		try {
 			await enableEgressProvider(creds, appSlug, provider);
 		} catch (err) {
-			fail(errorText(err), scaffolded);
+			fail$1(errorText(err), scaffolded);
 		}
 		console.log(`[wawesome] ✅ Enabled outbound calls to '${provider}'.`);
 	}
@@ -2866,7 +3154,7 @@ async function initFromTemplate(templateName, options) {
 	try {
 		template = await resolveTemplate(gatewayUrl, templateName);
 	} catch (err) {
-		fail(errorText(err));
+		fail$1(errorText(err));
 	}
 	console.log(`[wawesome] Fetching ${template.title} (${template.ref})...`);
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${template.archive_url}`);
@@ -2874,7 +3162,7 @@ async function initFromTemplate(templateName, options) {
 	try {
 		archive = await downloadTemplateArchive(template.archive_url);
 	} catch (err) {
-		fail(errorText(err));
+		fail$1(errorText(err));
 	}
 	const staging = fs.mkdtempSync(path.join(os.tmpdir(), "wawesome-template-"));
 	const sweepStaging = () => fs.rmSync(staging, {
@@ -2896,10 +3184,10 @@ async function initFromTemplate(templateName, options) {
 			});
 			manifest = readTemplateManifest(staging);
 		} catch (err) {
-			fail(errorText(err));
+			fail$1(errorText(err));
 		}
 		const collisions = collidingPaths(cwd, files);
-		if (collisions.length > 0) fail(`${collisions.join(", ")} already exist${collisions.length === 1 ? "s" : ""} here.`, "Run this in an empty directory, or move those files aside first. Nothing was written.");
+		if (collisions.length > 0) fail$1(`${collisions.join(", ")} already exist${collisions.length === 1 ? "s" : ""} here.`, "Run this in an empty directory, or move those files aside first. Nothing was written.");
 		tenantSession = await ensureSession(options);
 		const session = openPromptSession();
 		try {
@@ -2915,7 +3203,7 @@ async function initFromTemplate(templateName, options) {
 				});
 				repinned = alignCliDependency(cwd, CLI_VERSION);
 			} catch (err) {
-				fail(errorText(err), `Some of '${template.name}' may have been written to ${cwd}.`);
+				fail$1(errorText(err), `Some of '${template.name}' may have been written to ${cwd}.`);
 			}
 			console.log(`\n[wawesome] ✅ Scaffolded ${files.length} files from '${template.name}'.`);
 			if (repinned) console.log(`[wawesome] Using wawesome ${repinned.to} — the template pinned ${repinned.from}.`);
@@ -3086,13 +3374,13 @@ const RECLAIMED = "⚠ [assets reclaimed]";
 async function fetchVersions(gatewayUrl, tenantJwt, app, funcName, env, isVerbose) {
 	const url = `${gatewayUrl}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/versions?environment=${encodeURIComponent(env)}`;
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
-	const res = await fetch(url, {
+	const res = await authorizedFetch(url, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${tenantJwt}` }
 	});
 	if (!res.ok) {
 		const errorBody = await res.text();
-		if (res.status === 401) console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+		if (res.status === 401 || res.status === 403) console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorBody)}`);
 		else {
 			console.error(`[wawesome] Error: Failed to list versions (HTTP ${res.status}).`);
 			if (isVerbose) console.error(`[wawesome:verbose] Response: ${errorBody}`);
@@ -3199,8 +3487,7 @@ async function switchVersion(targetInput, options) {
 		}
 	}
 	console.log(`[wawesome] Promoting v${selectedVersionNum} to ${env}...`);
-	const deployUrl = `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/deploy`;
-	const deployRes = await fetch(deployUrl, {
+	const deployRes = await authorizedFetch(`${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/deploy`, {
 		method: "POST",
 		headers: {
 			Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -3290,13 +3577,13 @@ async function logsCommand(target, options = {}) {
 async function fetchInvocationLogBody(gatewayUrl, tenantJwt, invocationId, isVerbose) {
 	const url = `${gatewayUrl}/v1/invocations/${encodeURIComponent(invocationId)}/logs`;
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
-	const res = await fetch(url, {
+	const res = await authorizedFetch(url, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${tenantJwt}` }
 	});
 	if (!res.ok) {
 		const errorText = await res.text();
-		if (res.status === 401) console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+		if (res.status === 401 || res.status === 403) console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorText)}`);
 		else if (res.status === 404) console.error(`[wawesome] Error: Invocation log '${invocationId}' not found or expired (logs are retained for 14 days).`);
 		else if (res.status === 400) console.error(`[wawesome] Error: Invalid invocation ID '${invocationId}'.`);
 		else {
@@ -3326,7 +3613,7 @@ async function listInvocations(gatewayUrl, tenantJwt, funcNameInput, appOverride
 	const res = await fetchInvocationsResponse(gatewayUrl, tenantJwt, funcName, appSlug, appOverride, `?${queryParams.toString()}`, isVerbose);
 	if (!res.ok) {
 		const errorText = await res.text();
-		if (res.status === 401) console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+		if (res.status === 401 || res.status === 403) console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorText)}`);
 		else if (res.status === 404) console.error(`[wawesome] Error: Function '${funcName}' not found.`);
 		else {
 			console.error(`[wawesome] Error: Failed to list invocations (HTTP ${res.status}).`);
@@ -3366,7 +3653,7 @@ async function listInvocations(gatewayUrl, tenantJwt, funcNameInput, appOverride
 async function fetchInvocationsResponse(gatewayUrl, tenantJwt, funcName, appSlug, appOverride, queryString, isVerbose) {
 	const url = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/invocations${queryString}` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/invocations${queryString}`;
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
-	let res = await fetch(url, {
+	let res = await authorizedFetch(url, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${tenantJwt}` }
 	});
@@ -3374,7 +3661,7 @@ async function fetchInvocationsResponse(gatewayUrl, tenantJwt, funcName, appSlug
 		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/invocations${queryString}`;
 		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: GET ${fallbackUrl}`);
 		try {
-			const fallbackRes = await fetch(fallbackUrl, {
+			const fallbackRes = await authorizedFetch(fallbackUrl, {
 				method: "GET",
 				headers: { Authorization: `Bearer ${tenantJwt}` }
 			});
@@ -3486,7 +3773,7 @@ async function followInvocationLog(gatewayUrl, tenantJwt, invocationId, isVerbos
 		while (true) {
 			let res = null;
 			try {
-				res = await fetch(url, {
+				res = await authorizedFetch(url, {
 					method: "GET",
 					headers: {
 						Authorization: `Bearer ${tenantJwt}`,
@@ -3508,8 +3795,8 @@ async function followInvocationLog(gatewayUrl, tenantJwt, invocationId, isVerbos
 				if (isVerbose) console.error(`[wawesome:verbose] ${String(err)}`);
 				process.exit(1);
 			}
-			if (res.status === 401) {
-				console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+			if (res.status === 401 || res.status === 403) {
+				console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, await res.text().catch(() => ""))}`);
 				process.exit(1);
 			}
 			if (res.status === 404) {
@@ -3618,18 +3905,18 @@ async function followFunctionLog(gatewayUrl, tenantJwt, funcNameInput, appOverri
 			let res = null;
 			try {
 				if (scopedUrl) {
-					res = await fetch(scopedUrl, {
+					res = await authorizedFetch(scopedUrl, {
 						headers,
 						signal: controller.signal
 					});
 					if (res.status === 404) {
 						if (isVerbose) console.error(`[wawesome:verbose] 404 on app-scoped route, retrying unscoped.`);
-						res = await fetch(unscopedUrl, {
+						res = await authorizedFetch(unscopedUrl, {
 							headers,
 							signal: controller.signal
 						});
 					}
-				} else res = await fetch(unscopedUrl, {
+				} else res = await authorizedFetch(unscopedUrl, {
 					headers,
 					signal: controller.signal
 				});
@@ -3646,8 +3933,8 @@ async function followFunctionLog(gatewayUrl, tenantJwt, funcNameInput, appOverri
 				console.error("[wawesome] Error: Failed to connect to the live tail after retries.");
 				process.exit(1);
 			}
-			if (res.status === 401) {
-				console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+			if (res.status === 401 || res.status === 403) {
+				console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, await res.text().catch(() => ""))}`);
 				process.exit(1);
 			}
 			if (res.status === 404) {
@@ -3733,7 +4020,7 @@ function printOutcome(meta) {
 async function triggerRun(gatewayUrl, tenantJwt, funcName, appSlug, appOverride, payload, isVerbose) {
 	const url = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/runs` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/runs`;
 	if (isVerbose) console.log(`[wawesome:verbose] POST ${url}`);
-	let res = await fetch(url, {
+	let res = await authorizedFetch(url, {
 		method: "POST",
 		headers: {
 			Authorization: `Bearer ${tenantJwt}`,
@@ -3745,7 +4032,7 @@ async function triggerRun(gatewayUrl, tenantJwt, funcName, appSlug, appOverride,
 		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/runs`;
 		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: POST ${fallbackUrl}`);
 		try {
-			const fallbackRes = await fetch(fallbackUrl, {
+			const fallbackRes = await authorizedFetch(fallbackUrl, {
 				method: "POST",
 				headers: {
 					Authorization: `Bearer ${tenantJwt}`,
@@ -3761,7 +4048,7 @@ async function triggerRun(gatewayUrl, tenantJwt, funcName, appSlug, appOverride,
 async function fetchInvocationMetadata(gatewayUrl, tenantJwt, invocationId, isVerbose) {
 	const url = `${gatewayUrl}/v1/invocations/${encodeURIComponent(invocationId)}`;
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
-	const res = await fetch(url, {
+	const res = await authorizedFetch(url, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${tenantJwt}` }
 	});
@@ -3771,7 +4058,7 @@ async function fetchInvocationMetadata(gatewayUrl, tenantJwt, invocationId, isVe
 async function fetchInvocationLogs(gatewayUrl, tenantJwt, invocationId, isVerbose) {
 	const url = `${gatewayUrl}/v1/invocations/${encodeURIComponent(invocationId)}/logs`;
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
-	const res = await fetch(url, {
+	const res = await authorizedFetch(url, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${tenantJwt}` }
 	});
@@ -3795,7 +4082,7 @@ async function followRun(gatewayUrl, tenantJwt, invocationId, isVerbose, pollInt
 			if (controller.signal.aborted) return;
 			let res = null;
 			try {
-				res = await fetch(streamUrl, {
+				res = await authorizedFetch(streamUrl, {
 					method: "GET",
 					headers: {
 						Authorization: `Bearer ${tenantJwt}`,
@@ -3834,8 +4121,8 @@ async function followRun(gatewayUrl, tenantJwt, invocationId, isVerbose, pollInt
 				console.error(`[wawesome] ✖ Run ${meta.status}${meta.failure_reason ? `: ${meta.failure_reason}` : ""}`);
 				return;
 			}
-			if (res.status === 401) {
-				console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+			if (res.status === 401 || res.status === 403) {
+				console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, await res.text().catch(() => ""))}`);
 				process.exit(1);
 			}
 			if (!res.ok && res.status >= 500) {
@@ -3920,8 +4207,8 @@ async function invokeCommand(target, options = {}) {
 	const res = await triggerRun(creds.gateway_url, creds.tenant_jwt, funcName, appSlug, options.app, triggerPayload, isVerbose);
 	if (!res.ok) {
 		const errorBody = await res.text();
-		if (res.status === 401) {
-			console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+		if (res.status === 401 || res.status === 403) {
+			console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorBody)}`);
 			process.exit(1);
 		}
 		if (res.status === 404) {
@@ -3943,7 +4230,7 @@ async function invokeCommand(target, options = {}) {
 }
 //#endregion
 //#region src/workspace.ts
-function requireCredentials$1() {
+function requireCredentials$2() {
 	const creds = readCredentials();
 	if (!creds) {
 		console.error("[wawesome] Error: Not logged in. Run 'wawesome login' first.");
@@ -3956,7 +4243,7 @@ function requireCredentials$1() {
 * change — the rename is offered here rather than discovered by attempting it.
 */
 async function showWorkspace(options) {
-	const creds = requireCredentials$1();
+	const creds = requireCredentials$2();
 	let tenant;
 	try {
 		tenant = await fetchTenantDetails(creds);
@@ -3991,7 +4278,7 @@ async function showWorkspace(options) {
 * gateway knows something this command could not.
 */
 async function renameWorkspace(slug, options) {
-	const creds = requireCredentials$1();
+	const creds = requireCredentials$2();
 	if (!slug || !slug.trim()) {
 		console.error("[wawesome] Error: No name given. Usage: wawesome workspace rename <name>");
 		process.exit(1);
@@ -4035,6 +4322,267 @@ async function workspaceCommand(action, target, options) {
 	process.exit(1);
 }
 //#endregion
+//#region src/deploy-credentials.ts
+const SECRET_SHOWN_ONCE = "Copy it now. This is the only time it will be shown. If you lose it, revoke this credential and mint another.";
+function requireCredentials$1() {
+	const creds = readCredentials();
+	if (!creds) {
+		console.error("[wawesome] Error: Not logged in. Run 'wawesome login' first.");
+		process.exit(1);
+	}
+	return creds;
+}
+function fail(message, ...rest) {
+	console.error(`[wawesome] Error: ${message}`);
+	for (const line of rest) console.error(`[wawesome] ${line}`);
+	process.exit(1);
+}
+/** A repeated flag and a comma-separated one, read as the same list. */
+function asList(raw) {
+	if (raw === void 0) return void 0;
+	const words = (Array.isArray(raw) ? raw : [raw]).flatMap((word) => String(word).split(",")).map((word) => word.trim()).filter((word) => word.length > 0);
+	return words.length > 0 ? words : void 0;
+}
+function parseExpiry(raw) {
+	if (raw === void 0) return void 0;
+	const asked = String(raw).trim().toLowerCase();
+	if (asked === "never") return "never";
+	const days = /^(\d+)\s*d(ays?)?$/.exec(asked) ?? /^(\d+)$/.exec(asked);
+	if (!days) fail(`'${raw}' is not an expiry. Name a number of days (--expires 30) or 'never' (--expires never).`);
+	return { days: Number(days[1]) };
+}
+/**
+* What a target may be repeated back as.
+*
+* Somebody revoking a leak pastes the whole secret as often as the prefix, and
+* a refusal that echoed it would write it into a shell history and a CI log —
+* for the one feature built on the secret being shown exactly once.
+*/
+function asShown(target) {
+	if (!target.startsWith("wawe_")) return target;
+	const shown = credentialPrefix(target);
+	return shown === target ? target : `${shown}…`;
+}
+/** The Apps a credential names, or `null` where it names none and reaches all. */
+function namedApps(apps) {
+	return apps && apps.scope === "only" ? apps.apps.join(", ") : null;
+}
+/** `2026-11-30 12:00 UTC`. Minutes, because nothing here is read to the second. */
+function asUtc(iso) {
+	if (!iso) return "never";
+	const at = new Date(iso);
+	if (Number.isNaN(at.getTime())) return iso;
+	return `${at.toISOString().slice(0, 16).replace("T", " ")} UTC`;
+}
+function isExpired(credential, now) {
+	if (!credential.expires_at) return false;
+	const at = new Date(credential.expires_at).getTime();
+	return !Number.isNaN(at) && at <= now;
+}
+function statusOf(credential, now) {
+	if (credential.revoked_at) return "revoked";
+	if (isExpired(credential, now)) return "expired";
+	return "active";
+}
+async function refusal(res, fallback) {
+	if (res.status === 401 || res.status === 403) return new GatewayError(unauthorizedMessage(res.status, await res.text().catch(() => "")), res.status);
+	return asGatewayError(res, fallback);
+}
+async function mintCredential(creds, payload) {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${creds.tenant_jwt}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify(payload)
+	});
+	if (!res.ok) throw await refusal(res, `Failed to mint the credential (HTTP ${res.status}).`);
+	return await res.json();
+}
+async function fetchCredentials(creds) {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials`, { headers: { Authorization: `Bearer ${creds.tenant_jwt}` } });
+	if (!res.ok) throw await refusal(res, `Failed to read the credentials (HTTP ${res.status}).`);
+	return (await res.json()).credentials ?? [];
+}
+async function revokeCredential(creds, credentialId) {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials/${encodeURIComponent(credentialId)}/revoke`, {
+		method: "POST",
+		headers: { Authorization: `Bearer ${creds.tenant_jwt}` }
+	});
+	if (!res.ok) throw await refusal(res, `Failed to revoke the credential (HTTP ${res.status}).`);
+	return await res.json();
+}
+/**
+* Mint one credential.
+*
+* The secret goes to stdout on a line of its own and everything a person reads
+* goes to stderr, so `wawesome credentials mint ci > secret` writes the secret
+* and not one character besides.
+*/
+async function mintCredentialCommand(name, options) {
+	if (!name || !name.trim()) fail("No name given. Usage: wawesome credentials mint <name> [--capability deploy] [--app <app>] [--expires 90|never]", "The name is what tells the CI one from the agent one a year from now.");
+	const creds = requireCredentials$1();
+	const payload = { name: name.trim() };
+	const capabilities = asList(options.capability);
+	if (capabilities) payload.capabilities = capabilities;
+	const apps = asList(options.app);
+	if (apps) payload.apps = apps;
+	const expiry = parseExpiry(options.expires);
+	if (expiry !== void 0) payload.expiry = expiry;
+	if (options.verbose) {
+		console.error(`[wawesome:verbose] POST ${creds.gateway_url}/v1/tenant/credentials`);
+		console.error(`[wawesome:verbose] Payload: ${JSON.stringify({ ...payload })}`);
+	}
+	let credential;
+	try {
+		credential = await mintCredential(creds, payload);
+	} catch (err) {
+		fail(errorText(err));
+	}
+	console.error(`\n[wawesome] ✔ Minted deploy credential '${credential.name}'.\n`);
+	console.error(`  Prefix:       ${credential.prefix}`);
+	console.error(`  Capabilities: ${credential.capabilities.join(", ")}`);
+	console.error(`  Apps:         ${namedApps(credential.apps) ?? "every App in the workspace"}`);
+	console.error(`  Expires:      ${asUtc(credential.expires_at)}`);
+	console.error(`\n  ${SECRET_SHOWN_ONCE}\n`);
+	console.log(credential.secret);
+	console.error("");
+}
+async function listCredentialsCommand(options) {
+	const creds = requireCredentials$1();
+	if (options.verbose) console.error(`[wawesome:verbose] GET ${creds.gateway_url}/v1/tenant/credentials`);
+	let credentials;
+	try {
+		credentials = await fetchCredentials(creds);
+	} catch (err) {
+		fail(errorText(err));
+	}
+	if (credentials.length === 0) {
+		console.log("\n[wawesome] This workspace has no deploy credentials.");
+		console.log("[wawesome] Mint one: \x1B[36mwawesome credentials mint <name>\x1B[0m\n");
+		return;
+	}
+	console.log("\n🔑 \x1B[1mDeploy credentials\x1B[0m\n");
+	for (const line of formatCredentials(credentials, Date.now())) console.log(line);
+	console.log("");
+}
+/** Never the secret: no read after minting carries one. */
+function formatCredentials(credentials, now) {
+	const rows = credentials.map((credential) => ({
+		name: credential.name,
+		prefix: credential.prefix,
+		capabilities: credential.capabilities.join(", "),
+		apps: namedApps(credential.apps) ?? "every App",
+		lastUsed: asUtc(credential.last_used_at),
+		expires: asUtc(credential.expires_at),
+		status: statusOf(credential, now)
+	}));
+	const columns = [
+		{
+			header: "NAME",
+			of: (row) => row.name
+		},
+		{
+			header: "PREFIX",
+			of: (row) => row.prefix
+		},
+		{
+			header: "CAPABILITIES",
+			of: (row) => row.capabilities
+		},
+		{
+			header: "APPS",
+			of: (row) => row.apps
+		},
+		{
+			header: "LAST USED",
+			of: (row) => row.lastUsed
+		},
+		{
+			header: "EXPIRES",
+			of: (row) => row.expires
+		},
+		{
+			header: "STATUS",
+			of: (row) => row.status
+		}
+	];
+	const widths = columns.map((column) => Math.max(column.header.length, ...rows.map((row) => column.of(row).length)));
+	const line = (cells) => `  ${cells.map((cell, i) => cell.padEnd(widths[i])).join(" | ")}`.trimEnd();
+	return [
+		line(columns.map((column) => column.header)),
+		`  ${widths.map((width) => "-".repeat(width)).join("-|-")}`,
+		...rows.map((row) => line(columns.map((column) => column.of(row))))
+	];
+}
+/**
+* Which credential a user meant by a name or a prefix.
+*
+* A partial prefix matches, because the point of the displayable prefix is
+* matching one against a CI settings page by eye — and a partial that names
+* more than one is refused rather than guessed at, since the guess would be a
+* revocation.
+*/
+function matchCredentials(credentials, target) {
+	const typed = target.trim();
+	const named = credentials.filter((credential) => credential.name === typed);
+	if (named.length > 0) return named;
+	const wanted = typed.startsWith("wawe_") ? credentialPrefix(typed) : typed;
+	return credentials.filter((credential) => credential.prefix.startsWith(wanted));
+}
+async function revokeCredentialCommand(target, options) {
+	if (!target || !target.trim()) fail("No credential given. Usage: wawesome credentials revoke <name-or-prefix>");
+	const creds = requireCredentials$1();
+	if (options.verbose) console.error(`[wawesome:verbose] GET ${creds.gateway_url}/v1/tenant/credentials`);
+	let credentials;
+	try {
+		credentials = await fetchCredentials(creds);
+	} catch (err) {
+		fail(errorText(err));
+	}
+	const matched = matchCredentials(credentials, target);
+	if (matched.length === 0) fail(`No deploy credential named or prefixed '${asShown(target)}' in this workspace.`, "Run 'wawesome credentials list' to see what this workspace has.");
+	if (matched.length > 1) fail(`'${asShown(target)}' names more than one credential:`, ...matched.map((credential) => `  ${credential.name} (${credential.prefix})`), "Name one of them, or give more of its prefix.");
+	const credential = matched[0];
+	if (credential.revoked_at) {
+		console.log(`[wawesome] '${credential.name}' (${credential.prefix}) was already revoked at ${asUtc(credential.revoked_at)}. Nothing to do.`);
+		return;
+	}
+	if (!options.yes) {
+		if (!isInteractive()) fail(`Revoking asks for confirmation, and there is nobody to ask.`, `Pass --yes to revoke '${credential.name}' (${credential.prefix}) without being asked.`);
+		let confirmed;
+		try {
+			confirmed = await confirm({
+				message: `Revoke '${credential.name}' (${credential.prefix})? Nothing un-revokes it.`,
+				default: false
+			});
+		} catch {
+			confirmed = false;
+		}
+		if (!confirmed) {
+			console.log(`[wawesome] Cancelled. '${credential.name}' still works.`);
+			return;
+		}
+	}
+	if (options.verbose) console.error(`[wawesome:verbose] POST ${creds.gateway_url}/v1/tenant/credentials/${credential.id}/revoke`);
+	let revoked;
+	try {
+		revoked = await revokeCredential(creds, credential.id);
+	} catch (err) {
+		if (err instanceof GatewayError && err.status === 404) fail(`'${credential.name}' (${credential.prefix}) no longer exists in this workspace.`);
+		fail(errorText(err));
+	}
+	console.log(`\n[wawesome] ✔ Revoked '${revoked.name}' (${revoked.prefix}).`);
+	console.log("[wawesome] Anything still presenting it is refused from its very next request.\n");
+}
+async function credentialsCommand(action, target, options) {
+	if (!action || action === "list" || action === "ls") return listCredentialsCommand(options);
+	if (action === "mint") return mintCredentialCommand(target, options);
+	if (action === "revoke") return revokeCredentialCommand(target, options);
+	fail(`Unknown credentials action '${action}'.`, "Usage: wawesome credentials [list|mint <name>|revoke <name-or-prefix>]");
+}
+//#endregion
 //#region src/cron.ts
 /** `2026-08-23 03:00:00 UTC` with second-precision for run history timestamps. */
 function asUtcWithSeconds(iso) {
@@ -4145,7 +4693,7 @@ function formatRunHistoryTable(runs) {
 async function fetchFunctionSchedules(gatewayUrl, tenantJwt, funcName, appSlug, isVerbose) {
 	const scopedUrl = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/schedules` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules`;
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${scopedUrl}`);
-	let res = await fetch(scopedUrl, {
+	let res = await authorizedFetch(scopedUrl, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${tenantJwt}` }
 	});
@@ -4153,7 +4701,7 @@ async function fetchFunctionSchedules(gatewayUrl, tenantJwt, funcName, appSlug,
 		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules`;
 		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: GET ${fallbackUrl}`);
 		try {
-			const fallbackRes = await fetch(fallbackUrl, {
+			const fallbackRes = await authorizedFetch(fallbackUrl, {
 				method: "GET",
 				headers: { Authorization: `Bearer ${tenantJwt}` }
 			});
@@ -4167,7 +4715,7 @@ async function fetchFunctionSchedules(gatewayUrl, tenantJwt, funcName, appSlug,
 async function fetchAppFunctions(gatewayUrl, tenantJwt, appSlug, isVerbose) {
 	const url = `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions`;
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${url}`);
-	const res = await fetch(url, {
+	const res = await authorizedFetch(url, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${tenantJwt}` }
 	});
@@ -4178,7 +4726,7 @@ async function pauseScheduleApi(gatewayUrl, tenantJwt, funcName, scheduleName, a
 	const scopedUrl = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/pause` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/pause`;
 	const body = reason?.trim() ? JSON.stringify({ reason: reason.trim() }) : void 0;
 	if (isVerbose) console.log(`[wawesome:verbose] POST ${scopedUrl}`);
-	let res = await fetch(scopedUrl, {
+	let res = await authorizedFetch(scopedUrl, {
 		method: "POST",
 		headers: {
 			Authorization: `Bearer ${tenantJwt}`,
@@ -4190,7 +4738,7 @@ async function pauseScheduleApi(gatewayUrl, tenantJwt, funcName, scheduleName, a
 		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/pause`;
 		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: POST ${fallbackUrl}`);
 		try {
-			const fallbackRes = await fetch(fallbackUrl, {
+			const fallbackRes = await authorizedFetch(fallbackUrl, {
 				method: "POST",
 				headers: {
 					Authorization: `Bearer ${tenantJwt}`,
@@ -4206,7 +4754,7 @@ async function pauseScheduleApi(gatewayUrl, tenantJwt, funcName, scheduleName, a
 async function resumeScheduleApi(gatewayUrl, tenantJwt, funcName, scheduleName, appSlug, isVerbose) {
 	const scopedUrl = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/resume` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/resume`;
 	if (isVerbose) console.log(`[wawesome:verbose] POST ${scopedUrl}`);
-	let res = await fetch(scopedUrl, {
+	let res = await authorizedFetch(scopedUrl, {
 		method: "POST",
 		headers: { Authorization: `Bearer ${tenantJwt}` }
 	});
@@ -4214,7 +4762,7 @@ async function resumeScheduleApi(gatewayUrl, tenantJwt, funcName, scheduleName,
 		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/schedules/${encodeURIComponent(scheduleName)}/resume`;
 		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: POST ${fallbackUrl}`);
 		try {
-			const fallbackRes = await fetch(fallbackUrl, {
+			const fallbackRes = await authorizedFetch(fallbackUrl, {
 				method: "POST",
 				headers: { Authorization: `Bearer ${tenantJwt}` }
 			});
@@ -4231,7 +4779,7 @@ async function fetchBackgroundRunsApi(gatewayUrl, tenantJwt, funcName, appSlug,
 	const qs = params.toString() ? `?${params.toString()}` : "";
 	const scopedUrl = appSlug ? `${gatewayUrl}/v1/apps/${encodeURIComponent(appSlug)}/functions/${encodeURIComponent(funcName)}/runs${qs}` : `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/runs${qs}`;
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${scopedUrl}`);
-	let res = await fetch(scopedUrl, {
+	let res = await authorizedFetch(scopedUrl, {
 		method: "GET",
 		headers: { Authorization: `Bearer ${tenantJwt}` }
 	});
@@ -4239,7 +4787,7 @@ async function fetchBackgroundRunsApi(gatewayUrl, tenantJwt, funcName, appSlug,
 		const fallbackUrl = `${gatewayUrl}/v1/functions/${encodeURIComponent(funcName)}/runs${qs}`;
 		if (isVerbose) console.log(`[wawesome:verbose] 404 on app-scoped route. Retrying unscoped: GET ${fallbackUrl}`);
 		try {
-			const fallbackRes = await fetch(fallbackUrl, {
+			const fallbackRes = await authorizedFetch(fallbackUrl, {
 				method: "GET",
 				headers: { Authorization: `Bearer ${tenantJwt}` }
 			});
@@ -4339,8 +4887,8 @@ async function pauseScheduleCommand(target, subtarget, options = {}) {
 	const res = await pauseScheduleApi(creds.gateway_url, creds.tenant_jwt, funcName, scheduleName, appSlug, options.reason, isVerbose);
 	if (!res.ok) {
 		const errorBody = await res.text();
-		if (res.status === 401) {
-			console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+		if (res.status === 401 || res.status === 403) {
+			console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorBody)}`);
 			process.exit(1);
 		}
 		if (res.status === 404) {
@@ -4396,8 +4944,8 @@ async function resumeScheduleCommand(target, subtarget, options = {}) {
 	const res = await resumeScheduleApi(creds.gateway_url, creds.tenant_jwt, funcName, scheduleName, appSlug, isVerbose);
 	if (!res.ok) {
 		const errorBody = await res.text();
-		if (res.status === 401) {
-			console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+		if (res.status === 401 || res.status === 403) {
+			console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorBody)}`);
 			process.exit(1);
 		}
 		if (res.status === 404) {
@@ -4435,8 +4983,8 @@ async function runHistoryCommand(target, options = {}) {
 	}, isVerbose);
 	if (!res.ok) {
 		const errorBody = await res.text();
-		if (res.status === 401) {
-			console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+		if (res.status === 401 || res.status === 403) {
+			console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorBody)}`);
 			process.exit(1);
 		}
 		if (res.status === 404) {
@@ -4486,11 +5034,33 @@ cli.command("env [action] [key] [value]", "Manage environment variables (set, li
 cli.command("env set <key> <value>", "Set or overwrite an environment variable on the current app").option("-s, --secret", "Flag variable as secret (write-only)").option("-v, --verbose", "Enable verbose debug output").action((key, value, options) => setEnvVar(key, value, options));
 cli.command("env list", "List environment variables for the current app").alias("env ls").option("-v, --verbose", "Enable verbose debug output").action((options) => listEnvVars(options));
 cli.command("env rm <key>", "Delete an environment variable from the current app").alias("env remove").alias("env delete").alias("env unset").option("-v, --verbose", "Enable verbose debug output").action((key, options) => removeEnvVar(key, options));
-cli.command("login", "Authenticate with the wawesome.io platform").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("--gateway <url>", "Alias for --api <url>").option("--dashboard <url>", "Dashboard URL (default: https://dashboard.wawesome.io)").option("--provider <name>", "OAuth provider (default: github)").option("--workspace <name>", "Name for the workspace, when signing up without a terminal to prompt").option("-v, --verbose", "Enable verbose debug output").action((options) => login(options));
+cli.command("login", "Authenticate with the wawesome.io platform").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("--gateway <url>", "Alias for --api <url>").option("--dashboard <url>", "Dashboard URL (default: https://dashboard.wawesome.io)").option("--provider <name>", "OAuth provider (default: github)").option("--workspace <name>", "Name for the workspace, when signing up without a terminal to prompt").option("--accept-terms", "Accept the terms of service and privacy policy, when signing up without a terminal to prompt").option("-v, --verbose", "Enable verbose debug output").action((options) => login(options));
 cli.command("logout", "Clear stored authentication credentials").action(() => logout());
 cli.command("whoami", "Show current login session info").action(() => whoami());
 cli.command("workspace [action] [name]", "Show the workspace, or rename its public address").usage("workspace <action> [name]\n\nActions:\n  show                Show the workspace name, address, and whether it can still change\n  rename <name>       Change the public address, while nothing live depends on it").example("wawesome workspace").example("wawesome workspace rename northwind").option("-v, --verbose", "Enable verbose debug output").action((action, name, options) => workspaceCommand(action, name, options));
 cli.command("templates [action]", "Browse the template catalog").usage("templates [action]\n\nActions:\n  list (ls)           Show every available template (default)").example("wawesome templates").example("wawesome templates list").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("-v, --verbose", "Enable verbose debug output").action((action, options) => templatesCommand(action, options));
+cli.command("credentials [action] [target]", "Mint, list and revoke deploy credentials").alias("credential").usage(`credentials <action> [options]
+
+  A deploy credential is what a CI pipeline or an agent authenticates with, where
+  there is nobody at a keyboard to log in. Minting is the only time the secret is
+  shown. It is printed on its own line, so a pipe catches it and nothing else.
+
+  Actions:
+    list (ls)                       Show every credential: name, prefix, capabilities, Apps, last use, expiry (default)
+    mint <name>                     Mint one, printing the secret exactly once
+    revoke <name-or-prefix>         Revoke one, immediately and for good
+
+  Examples:
+    wawesome credentials
+    wawesome credentials mint ci-pipeline
+    wawesome credentials mint agent -c logs:read --expires never
+    wawesome credentials mint prod-deploy -c deploy -a prod --expires 30
+    wawesome credentials mint ci-pipeline > /tmp/secret
+    wawesome credentials revoke ci-pipeline
+    wawesome credentials revoke wawe_ab3k9x --yes`).option("-c, --capability <capability>", "Capability to grant: deploy, logs:read (repeatable or comma-separated, default: deploy)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated, default: every App)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-y, --yes", "Skip the revoke confirmation").option("-v, --verbose", "Enable verbose debug output").action((action, target, options) => credentialsCommand(action, target, options));
+cli.command("credentials mint <name>", "Mint a deploy credential, printing its secret exactly once").option("-c, --capability <capability>", "Capability to grant: deploy, logs:read (repeatable or comma-separated)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-v, --verbose", "Enable verbose debug output").action((name, options) => mintCredentialCommand(name, options));
+cli.command("credentials list", "List deploy credentials — never their secrets").alias("credentials ls").option("-v, --verbose", "Enable verbose debug output").action((options) => listCredentialsCommand(options));
+cli.command("credentials revoke <name-or-prefix>", "Revoke a deploy credential, immediately and for good").option("-y, --yes", "Revoke without being asked to confirm").option("-v, --verbose", "Enable verbose debug output").action((target, options) => revokeCredentialCommand(target, options));
 cli.command("init", "Scaffold a new function project in the current directory").usage("init [options]\n\nWith --template, the project is fetched from the template catalog, wired up\nfrom what the template declares it needs, and deployed. Run 'wawesome templates'\nto see what is available.").example("wawesome init").example("wawesome init --template stripe-webhook").option("-t, --template <name>", "Scaffold from a catalog template and deploy it").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("--dashboard <url>", "Dashboard URL (default: https://dashboard.wawesome.io)").option("--no-install", "Skip installing dependencies after scaffolding").option("--root", "Generate a root function router template").option("-v, --verbose", "Enable verbose debug output").action((options) => init(options));
 cli.command("logs [function-name-or-invocation-id]", "View invocation history, fetch log output, or follow live").usage(`logs [target] [options]