wawesome 0.8.0 → 0.9.0

package/README.md

@@ -116,6 +116,9 @@ npx wawesome deploy
 | `npx wawesome env list`                 | View environment variables for the current app                      |
 | `npx wawesome env set <key> <val>`      | Set an environment variable (add `--secret` for write-only)         |
 | `npx wawesome env rm <key>`             | Delete an environment variable                                      |
+| `npx wawesome credentials`              | List deploy credentials — name, prefix, capabilities, Apps, last use |
+| `npx wawesome credentials mint <name>`  | Mint a deploy credential and print its secret, once                 |
+| `npx wawesome credentials revoke <name>`| Revoke a deploy credential by name or prefix                        |
 
 ---
 
@@ -279,6 +282,74 @@ npx wawesome cron history my-function --state failed
 
 ---
 
+## 🔑 Deploy Credentials
+
+A deploy credential is what a CI pipeline or an agent authenticates with, where there is nobody at a
+keyboard to log in. It belongs to the workspace rather than to you: it keeps working after you leave,
+and revoking it does not end your own session. Once you have one, [Deploying from CI](#-deploying-from-ci)
+is what to do with it.
+
+Minting, listing and revoking are the workspace owner's, and are closed to deploy credentials
+themselves whatever they carry — a leaked credential cannot mint another. So these three run on your
+ordinary `npx wawesome login` session.
+
+### Mint one
+
+```bash
+npx wawesome credentials mint ci-pipeline
+```
+
+The secret is printed once and never again — the platform stores a digest of it, so no later read can
+rebuild it. It goes to stdout on a line of its own and everything else the command prints goes to
+stderr, so a redirect catches the secret and not one character besides:
+
+```bash
+npx wawesome credentials mint ci-pipeline > secret.txt
+```
+
+A credential carries `deploy`, reaches every App in the workspace, and expires in ninety days unless
+you say otherwise:
+
+```bash
+# reads logs and cannot deploy, restricted to one App, never expires
+npx wawesome credentials mint agent -c logs:read -a prod --expires never
+```
+
+| Flag                 | Meaning                                                                       |
+|:---------------------|:------------------------------------------------------------------------------|
+| `-c, --capability`   | `deploy`, `logs:read`, or both. Repeatable or comma-separated. Default `deploy` |
+| `-a, --app`          | Restrict to these Apps, by slug. Repeatable. Default: every App in the workspace |
+| `--expires`          | Days, or `never`. Default: 90                                                   |
+
+An App named in a restriction does not have to exist yet — a pipeline whose first deploy creates the
+App it was minted for is the ordinary case. A restriction bounds what a credential can disturb, not
+what it can read: a Function deployed into one App still reads the whole workspace's environment at
+runtime.
+
+### List them
+
+```bash
+npx wawesome credentials
+```
+
+Name, displayable prefix, capabilities, Apps, last use and expiry — never the secret, which the
+platform no longer holds. `LAST USED` lags by a few minutes and reads `never` for a credential
+nothing has ever presented, which is a better reason to revoke one than any calendar date.
+
+### Revoke one
+
+```bash
+npx wawesome credentials revoke ci-pipeline
+npx wawesome credentials revoke wawe_ab3k9x --yes
+```
+
+By name or by displayable prefix, whole or partial. It asks before it does it, `--yes` is the answer
+where nobody is at the keyboard, and a prefix naming more than one credential is refused rather than
+guessed at. A revocation lands on the very next request presenting the secret, and nothing un-revokes
+it.
+
+---
+
 ## ⚙️ Configuration & Custom Gateway
 
 ### `wawesome-function.json`
@@ -340,11 +411,14 @@ Two rules to know about:
 **HTML is refused at deploy time.** Your Function renders its own markup, and a document served from
 your App's own origin is the sharpest same-origin vector a static file has.
 
-**An SVG is served with script denied.** The rule behind the refusal above is that nothing you deploy
-as a file runs script on your App's own origin, and an SVG opened directly in a browser would. It is
-served rather than refused because denying it costs the file nothing: an `<img src="logo.svg">` never
-ran that script, so your drawings render as they always did — every SVG and XML file carries
-`Content-Security-Policy: script-src 'none'`, and only navigating straight to one loses anything.
+**An SVG is served inert.** The rule behind the refusal above is that nothing you deploy as a file
+becomes a page on your App's own origin, and an SVG opened directly in a browser would — it runs
+script, and it renders whatever HTML a `<foreignObject>` holds. It is served rather than refused
+because making it inert costs the file nothing: an `<img src="logo.svg">` never ran that script and
+is never checked against the policy, so your drawings render as they always did. Every SVG and XML
+file carries `Content-Security-Policy: script-src 'none'; sandbox`, and only navigating straight to
+one loses anything — such a file is sandboxed onto an origin of its own, so its links no longer
+navigate and a page embedding it through `<object>` or `<iframe>` cannot reach into its DOM.
 
 ### Schedules
 
@@ -497,6 +571,40 @@ export WAWESOME_GATEWAY_URL="http://localhost:3000"
 npx wawesome login --gateway http://localhost:3000
 ```
 
+A successful login records the gateway it used, and every later command goes there, because a token is only valid at
+the gateway that issued it. `login` itself ignores that record and reads only the three overrides above, so a bare
+`npx wawesome login` with none of them set goes to `https://api.wawesome.io`. `npx wawesome logout` clears the recorded
+gateway along with the credentials.
+
+---
+
+## 🤖 Deploying from CI
+
+A **deploy credential** is what deploys without a person at a keyboard. Your workspace mints one, and the CLI reads it
+from a single environment variable — there is no login, and no credentials file is involved at any point:
+
+```bash
+export WAWESOME_DEPLOY_CREDENTIAL="wawe_..."
+export WAWESOME_GATEWAY_URL="https://api.wawesome.io"
+
+npx wawesome deploy
+```
+
+The workspace is resolved from the credential itself, so nothing in your pipeline has to carry a workspace identifier.
+The variable name is prefixed and has no shorter alias, so it cannot collide with another tool's CI variable.
+
+While it is set:
+
+- it wins over any `~/.wawesome/credentials.json` on the machine, so a runner with a stale cached home directory still
+  deploys as the credential rather than as whoever last logged in there;
+- nothing is written to disk, and the secret stays in the environment where you put it;
+- a refusal says which of four things happened — the credential is unknown, revoked, expired, or does not carry what the
+  command needs — instead of asking you to sign in again, which a pipeline cannot do;
+- `login` and `logout` refuse, because neither would change what the next command authenticates as;
+- `credentials` is refused by the platform, because minting, listing and revoking are closed to
+  credentials whatever they carry;
+- `whoami` names the credential by its prefix, so you can match it against the one in your CI settings.
+
 ---
 
 ## 🔒 Security & Secrets

package/dist/index.mjs

@@ -12,12 +12,90 @@ import { Readable } from "node:stream";
 import crypto from "node:crypto";
 import { confirm, select } from "@inquirer/prompts";
 import zlib from "node:zlib";
+//#region src/errors.ts
+/** A rejection carrying the gateway's own prose and, where given, its reason. */
+var GatewayError = class extends Error {
+	status;
+	reason;
+	/** The raw response, for `--verbose` to print when the prose is not enough. */
+	body;
+	constructor(message, status, reason, body = "") {
+		super(message);
+		this.name = "GatewayError";
+		this.status = status;
+		this.reason = reason;
+		this.body = body;
+	}
+};
+/**
+* Read a failed response into a `GatewayError`.
+*
+* `fallback` is used only when the response carries no prose of its own — a
+* proxy's HTML error page, or an empty body. A 401 is deliberately *not* special
+* cased here: what to say about an expired session depends on what the caller
+* was doing, so callers handle it before reaching this.
+*/
+async function asGatewayError(res, fallback) {
+	return rejectionOf(await res.text().catch(() => ""), res.status, fallback);
+}
+/** The same reading, for a caller that has already taken the body off the wire. */
+function rejectionOf(body, status, fallback) {
+	try {
+		const parsed = JSON.parse(body);
+		return new GatewayError(parsed.error || fallback, status, parsed.reason, body);
+	} catch {
+		return new GatewayError(fallback, status, void 0, body);
+	}
+}
+/** Why the gateway refused, where what was thrown might not be a refusal at all. */
+function reasonOf(err) {
+	return err instanceof GatewayError ? err.reason : void 0;
+}
+/** What went wrong, as text, whatever was thrown. */
+function errorText(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+//#endregion
+//#region src/credential.ts
+const CREDENTIAL_ENV_VAR = "WAWESOME_DEPLOY_CREDENTIAL";
+function credentialFromEnvironment() {
+	const secret = process.env[CREDENTIAL_ENV_VAR]?.trim();
+	return secret ? secret : null;
+}
+/** Enough to match a credential against the one in a CI settings page, and no more. */
+function credentialPrefix(secret) {
+	return secret.slice(0, 11);
+}
+/**
+* A credential has no session behind it, so the platform's own reason — unknown,
+* revoked, expired, or a scope it does not carry — is the whole answer, and
+* "sign in again" names a door a CI runner cannot open.
+*/
+function unauthorizedMessage(status, body) {
+	const secret = credentialFromEnvironment();
+	if (!secret) return status === 401 ? "Authentication expired. Run 'wawesome login' again." : rejectionOf(body, status, `The platform refused this request (HTTP ${status}).`).message;
+	return rejectionOf(body, status, `The deploy credential ${credentialPrefix(secret)} was refused (HTTP ${status}).`).message;
+}
+function reportSessionCommandRefused(secret, consequence) {
+	console.error(`[wawesome] Error: ${CREDENTIAL_ENV_VAR} is set, so this CLI authenticates as deploy credential ${credentialPrefix(secret)}.`);
+	console.error(`[wawesome] ${consequence} Unset ${CREDENTIAL_ENV_VAR} first.`);
+}
+//#endregion
 //#region src/config.ts
 /**
 * Hardcoded Supabase project config for the wawesome.io platform.
 * These are public values — the anon key is designed to be embedded in clients.
 */
 const SUPABASE_URL = "https://vclasavxxoufwymrutai.supabase.co";
+/**
+* Where the documents accepted at signup are published. Fixed rather than
+* resolved per environment: there is one website, and a signup has to be able
+* to link at something a person can actually read before they accept it.
+*/
+const LEGAL_URLS = {
+	terms: "https://wawesome.io/legal/terms-of-service",
+	privacy: "https://wawesome.io/legal/privacy-policy"
+};
 const SUPABASE_ANON_KEY = "sb_publishable_ZlgDAI9cNZkefEwVPKIngA_ktuvTpjD";
 /** Path to the user-level settings file (~/.wawesome/settings.json) */
 function getSettingsPath() {
@@ -51,11 +129,22 @@ function resolveAddress(overrideUrl, envNames, settingsKey, stored, fallback) {
 	return stored || fallback;
 }
 function getGatewayUrl(overrideUrl) {
-	return resolveAddress(overrideUrl, GATEWAY_ENV_NAMES, "gateway_url", readCredentials()?.gateway_url, GATEWAY_URL_FALLBACK);
+	return resolveAddress(overrideUrl, GATEWAY_ENV_NAMES, "gateway_url", readStoredCredentials()?.gateway_url, GATEWAY_URL_FALLBACK);
+}
+/**
+* A tenant token is only valid at the gateway that issued it, so every other
+* command has to follow the credentials. A login holds no token yet, and
+* reading that rung here made a local gateway outlive the removal of every
+* documented override, since only `logout` clears it. A **Deploy credential**
+* reads the same rungs, and for a sharper reason: following a stale file would
+* present it at a gateway that never minted it.
+*/
+function resolveGatewayUrlWithoutSession(overrideUrl) {
+	return resolveAddress(overrideUrl, GATEWAY_ENV_NAMES, "gateway_url", void 0, GATEWAY_URL_FALLBACK);
 }
 getGatewayUrl();
 function getDashboardUrl(overrideUrl) {
-	return resolveAddress(overrideUrl, DASHBOARD_ENV_NAMES, "dashboard_url", readCredentials()?.dashboard_url, DASHBOARD_URL_FALLBACK);
+	return resolveAddress(overrideUrl, DASHBOARD_ENV_NAMES, "dashboard_url", readStoredCredentials()?.dashboard_url, DASHBOARD_URL_FALLBACK);
 }
 /**
 * The dashboard for the environment this login is going to.
@@ -66,7 +155,7 @@ function getDashboardUrl(overrideUrl) {
 * so is dropping one where the gateway did not change at all.
 */
 function resolveDashboardUrlForLogin(overrideUrl, gatewayUrl) {
-	const creds = readCredentials();
+	const creds = readStoredCredentials();
 	const sameEnvironment = creds?.gateway_url === gatewayUrl;
 	return resolveAddress(overrideUrl, DASHBOARD_ENV_NAMES, "dashboard_url", sameEnvironment ? creds?.dashboard_url : void 0, DASHBOARD_URL_FALLBACK);
 }
@@ -77,9 +166,31 @@ function getCredentialsPath() {
 	return path.join(os.homedir(), ".wawesome", "credentials.json");
 }
 /**
-* Read stored credentials. Returns null if not logged in.
+* What this process authenticates with: the **Deploy credential** in the
+* environment where one is set, and otherwise the session `login` left on disk.
+*
+* The environment wins outright rather than filling a gap, so a CI runner
+* carrying a stale cached home directory still authenticates as itself.
 */
 function readCredentials() {
+	const secret = credentialFromEnvironment();
+	return secret ? environmentCredential(secret) : readStoredCredentials();
+}
+/**
+* A credential wears the shape of a session so that every command reaches the
+* platform the same way. What it does not carry is the point: no refresh token,
+* because there is nothing behind it to renew, and no Tenant, because the
+* platform resolves that from the credential.
+*/
+function environmentCredential(secret) {
+	return {
+		gateway_url: resolveGatewayUrlWithoutSession(void 0),
+		tenant_jwt: secret,
+		credential_prefix: credentialPrefix(secret)
+	};
+}
+/** The session on disk, whatever the environment says. */
+function readStoredCredentials() {
 	const credPath = getCredentialsPath();
 	if (!fs.existsSync(credPath)) return null;
 	try {
@@ -97,6 +208,7 @@ function readCredentials() {
 * `writeFileSync` applies only where it creates the file.
 */
 function writeCredentials(creds) {
+	if (credentialFromEnvironment()) return;
 	const credPath = getCredentialsPath();
 	const dir = path.dirname(credPath);
 	fs.mkdirSync(dir, {
@@ -771,7 +883,7 @@ async function buildJs(entryInput, options) {
 * that has to name this version — `--version`, the dependency a scaffolded
 * project pins — reads it here, so a release bumps one file.
 */
-const CLI_VERSION = "0.8.0";
+const CLI_VERSION = "0.9.0";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -844,6 +956,7 @@ async function authorizedFetch(url, init = {}) {
 	const sentAt = Date.now();
 	const res = await fetch(url, renewedJwt ? withBearer(request(), renewedJwt) : request());
 	if (res.status !== 401) return res;
+	if (credentialFromEnvironment()) return res;
 	if (renewedJwt && renewedAt > sentAt) return retry(url, request, renewedJwt, res);
 	if (renewedJwt && Date.now() - renewedAt < JUST_RENEWED_MS) return res;
 	const renewed = await renewSession();
@@ -948,50 +1061,6 @@ function endSession(reason) {
 	process.exit(1);
 }
 //#endregion
-//#region src/errors.ts
-/** A rejection carrying the gateway's own prose and, where given, its reason. */
-var GatewayError = class extends Error {
-	status;
-	reason;
-	/** The raw response, for `--verbose` to print when the prose is not enough. */
-	body;
-	constructor(message, status, reason, body = "") {
-		super(message);
-		this.name = "GatewayError";
-		this.status = status;
-		this.reason = reason;
-		this.body = body;
-	}
-};
-/**
-* Read a failed response into a `GatewayError`.
-*
-* `fallback` is used only when the response carries no prose of its own — a
-* proxy's HTML error page, or an empty body. A 401 is deliberately *not* special
-* cased here: what to say about an expired session depends on what the caller
-* was doing, so callers handle it before reaching this.
-*/
-async function asGatewayError(res, fallback) {
-	return rejectionOf(await res.text().catch(() => ""), res.status, fallback);
-}
-/** The same reading, for a caller that has already taken the body off the wire. */
-function rejectionOf(body, status, fallback) {
-	try {
-		const parsed = JSON.parse(body);
-		return new GatewayError(parsed.error || fallback, status, parsed.reason, body);
-	} catch {
-		return new GatewayError(fallback, status, void 0, body);
-	}
-}
-/** Why the gateway refused, where what was thrown might not be a refusal at all. */
-function reasonOf(err) {
-	return err instanceof GatewayError ? err.reason : void 0;
-}
-/** What went wrong, as text, whatever was thrown. */
-function errorText(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-//#endregion
 //#region src/tenant.ts
 async function fetchTenantDetails(creds) {
 	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant`, { headers: { Authorization: `Bearer ${creds.tenant_jwt}` } });
@@ -1104,6 +1173,31 @@ async function promptForWorkspaceName(options) {
 	throw new Error("No workspace name given. Nothing was created.");
 }
 /**
+* Ask the person to accept the terms, which is what creating a workspace
+* through this door means too.
+*
+* Declining is the default answer, not the one that needs typing: end of input
+* takes the default, so a piped login that says nothing has accepted nothing —
+* the terminal's version of an unticked box. The flag is a word from the person
+* running the command rather than a prompt, so a pipeline reads the same as a
+* terminal, and both documents are linked either way.
+*/
+async function confirmTermsAccepted(options) {
+	if (options.acceptTerms) return;
+	if (!isInteractive()) throw new Error(`Creating a workspace means accepting the terms of service and the privacy policy, and there is no terminal to ask in. Read ${LEGAL_URLS.terms} and ${LEGAL_URLS.privacy}, then re-run with --accept-terms.`);
+	console.log("\n[wawesome] Creating a workspace means accepting:");
+	console.log(`    Terms of Service   ${LEGAL_URLS.terms}`);
+	console.log(`    Privacy Policy     ${LEGAL_URLS.privacy}`);
+	const session = openPromptSession();
+	try {
+		const answer = await session.ask("  Accept both?", "n");
+		if (/^y(es)?$/i.test(answer.trim())) return;
+	} finally {
+		session.close();
+	}
+	throw new Error("The terms were not accepted. Nothing was created.");
+}
+/**
 * Turn a finished OAuth callback into stored credentials.
 *
 * Split from the callback server so what login stores can be exercised without
@@ -1120,6 +1214,7 @@ async function completeLogin({ gatewayUrl, dashboardUrl, accessToken, refreshTok
 	let workspaceSlug;
 	if (tenants.length === 0) {
 		const chosenName = await promptForWorkspaceName(options);
+		await confirmTermsAccepted(options);
 		console.log(`[wawesome] Creating workspace "${chosenName}"...`);
 		const initRes = await fetch(`${gatewayUrl}/api/v1/onboarding/init`, {
 			method: "POST",
@@ -1127,9 +1222,12 @@ async function completeLogin({ gatewayUrl, dashboardUrl, accessToken, refreshTok
 				Authorization: `Bearer ${accessToken}`,
 				"Content-Type": "application/json"
 			},
-			body: JSON.stringify({ tenant_name: chosenName })
+			body: JSON.stringify({
+				tenant_name: chosenName,
+				accepted_terms: true
+			})
 		});
-		if (!initRes.ok) throw new Error(`Failed to initialize workspace (HTTP ${initRes.status}).`);
+		if (!initRes.ok) throw await asGatewayError(initRes, `Failed to initialize workspace (HTTP ${initRes.status}).`);
 		const initData = await initRes.json();
 		primaryTenantId = initData.tenant_id;
 		workspaceSlug = initData.tenant_slug;
@@ -1186,7 +1284,12 @@ async function completeLogin({ gatewayUrl, dashboardUrl, accessToken, refreshTok
 * 5. Store credentials in ~/.wawesome/credentials.json
 */
 async function login(options) {
-	const gatewayUrl = getGatewayUrl(options.gateway || options.api);
+	const credential = credentialFromEnvironment();
+	if (credential) {
+		reportSessionCommandRefused(credential, "A session signed in here would be read by nothing.");
+		process.exit(1);
+	}
+	const gatewayUrl = resolveGatewayUrlWithoutSession(options.gateway || options.api);
 	const dashboardUrl = resolveDashboardUrlForLogin(options.dashboard, gatewayUrl);
 	const provider = options.provider || "github";
 	const isVerbose = Boolean(options.verbose);
@@ -1278,6 +1381,11 @@ async function login(options) {
 * Clear stored credentials.
 */
 function logout() {
+	const credential = credentialFromEnvironment();
+	if (credential) {
+		reportSessionCommandRefused(credential, "The next command would authenticate all the same.");
+		process.exit(1);
+	}
 	forgetRenewedSession();
 	if (deleteCredentials()) console.log("[wawesome] ✅ Logged out. Credentials removed.");
 	else console.log("[wawesome] Not logged in (no credentials found).");
@@ -1287,6 +1395,7 @@ function logout() {
 */
 async function whoami() {
 	const creds = readCredentials();
+	if (creds?.credential_prefix) return reportCredential(creds);
 	if (!creds) {
 		console.log("[wawesome] Not logged in. Run 'wawesome login' to authenticate.");
 		return;
@@ -1306,6 +1415,33 @@ async function whoami() {
 	console.log(`  Tenant:    ${creds.tenant_id}`);
 	console.log(`  Gateway:   ${creds.gateway_url}\n`);
 }
+/**
+* Name the credential the commands here run as.
+*
+* By its prefix, never the secret: what a developer needs is to match the
+* identity in front of them against the one in their CI settings, and the
+* output of `whoami` is the sort of thing that ends up pasted into an issue.
+* The workspace is asked for rather than read, because a credential names no
+* Tenant of its own — the platform resolves that from the credential.
+*/
+async function reportCredential(creds) {
+	let workspace = null;
+	let refusal = null;
+	try {
+		workspace = await resolveWorkspace(creds);
+	} catch (err) {
+		if (err instanceof GatewayError && (err.status === 401 || err.status === 403)) refusal = err.message;
+	}
+	console.log("\n[wawesome] Acting as a deploy credential:");
+	console.log(`  Credential: ${creds.credential_prefix} (from ${CREDENTIAL_ENV_VAR})`);
+	if (workspace) {
+		console.log(`  Workspace:  ${workspace.name}`);
+		console.log(`  Address:    ${workspace.slug}`);
+	}
+	console.log(`  Gateway:    ${creds.gateway_url}`);
+	if (refusal) console.log(`  Refused:    ${refusal}`);
+	console.log("");
+}
 //#endregion
 //#region src/schedules.ts
 /**
@@ -1316,15 +1452,18 @@ async function whoami() {
 * press resume, and file a bug when neither starts it.
 */
 function whenItRuns(schedule) {
-	if (schedule.state === "suspended") return "suspended — the workspace owes payment";
 	const undeclared = schedule.declared === false;
+	if (schedule.state === "suspended") {
+		const why = "the workspace owes payment, its subscription ended, or it has spent past its plan's allowance";
+		return undeclared ? `suspended, and not in this config file — ${why}; declare it again too` : `suspended — ${why}`;
+	}
 	if (schedule.state === "paused") return undeclared ? "paused, and not in this config file — declare it again, then resume" : "paused — resume it to run again";
 	if (undeclared) return "not in this config file — disabled, kept";
 	if (schedule.state !== "active") return schedule.state;
-	return schedule.next_fire_at ? `next run ${asUtc(schedule.next_fire_at)}` : "next run unknown";
+	return schedule.next_fire_at ? `next run ${asUtc$1(schedule.next_fire_at)}` : "next run unknown";
 }
 /** `2026-08-23 03:00 UTC`, which is the zone every expression is read in. */
-function asUtc(iso) {
+function asUtc$1(iso) {
 	const at = new Date(iso);
 	if (Number.isNaN(at.getTime())) return iso;
 	const pad = (n) => String(n).padStart(2, "0");
@@ -1872,7 +2011,7 @@ async function deploy(entryInput, options) {
 	if (!uploadRes.ok) {
 		const errorBody = await uploadRes.text();
 		const refusal = rejectionOf(errorBody, uploadRes.status, "Version with this code bundle already exists.");
-		if (uploadRes.status === 401) console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+		if (uploadRes.status === 401 || uploadRes.status === 403) console.error(`[wawesome] Error: ${unauthorizedMessage(uploadRes.status, errorBody)}`);
 		else if (refusal.reason === "paid-plan-required") {
 			console.error(`\n[wawesome] \x1b[31mError: ${refusal.message}\x1b[0m`);
 			console.error(`[wawesome] ${planLimitAdvice(refusal.reason)}\n`);
@@ -1917,7 +2056,7 @@ async function deploy(entryInput, options) {
 		});
 		if (!deployRes.ok) {
 			const errorBody = await deployRes.text();
-			if (deployRes.status === 401) console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+			if (deployRes.status === 401 || deployRes.status === 403) console.error(`[wawesome] Error: ${unauthorizedMessage(deployRes.status, errorBody)}`);
 			else {
 				console.error(`[wawesome] Error: Deployment failed (HTTP ${deployRes.status}).`);
 				if (isVerbose) console.error(`[wawesome:verbose] Response: ${errorBody}`);
@@ -2002,7 +2141,7 @@ async function uploadAssets(creds, app, funcName, bundle, assets, declared, isVe
 	});
 	if (!manifestRes.ok) {
 		const errorBody = await manifestRes.text();
-		if (manifestRes.status === 401) console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+		if (manifestRes.status === 401 || manifestRes.status === 403) console.error(`[wawesome] Error: ${unauthorizedMessage(manifestRes.status, errorBody)}`);
 		else if (manifestRes.status === 409) {
 			if (continueWhenUnchanged) {
 				console.log("[wawesome] Code and files unchanged since the last deploy; applying schedules.");
@@ -2101,7 +2240,7 @@ async function putEnvVar(creds, app, key, value, isSecret) {
 		})
 	});
 	if (!res.ok) {
-		if (res.status === 401) throw new GatewayError("Authentication expired. Run 'wawesome login' again.", 401);
+		if (res.status === 401 || res.status === 403) throw new GatewayError(unauthorizedMessage(res.status, await res.text().catch(() => "")), res.status);
 		throw await asGatewayError(res, `Failed to set variable '${key}' (HTTP ${res.status}).`);
 	}
 	return await res.json();
@@ -2157,7 +2296,7 @@ async function listEnvVars(options) {
 	});
 	if (!res.ok) {
 		const errorBody = await res.text();
-		if (res.status === 401) console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+		if (res.status === 401 || res.status === 403) console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorBody)}`);
 		else {
 			console.error(`[wawesome] Error: Failed to list variables (HTTP ${res.status}).`);
 			if (isVerbose) console.error(`[wawesome:verbose] Response: ${errorBody}`);
@@ -2211,7 +2350,7 @@ async function removeEnvVar(key, options) {
 	});
 	if (!res.ok) {
 		const errorBody = await res.text();
-		if (res.status === 401) console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+		if (res.status === 401 || res.status === 403) console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorBody)}`);
 		else if (res.status === 404) console.error(`[wawesome] Error: Variable '${key}' not found on app '${app}'.`);
 		else {
 			console.error(`[wawesome] Error: Failed to delete variable '${key}' (HTTP ${res.status}).`);
@@ -2287,7 +2426,7 @@ function installDependencies(dir, options = {}) {
 //#region src/provision.ts
 /** The gateway's own words for a failure, or a plain HTTP status if it gave none. */
 async function rejected(res, fallback) {
-	if (res.status === 401) return new GatewayError("Authentication expired. Run 'wawesome login' again.", 401);
+	if (res.status === 401 || res.status === 403) return new GatewayError(unauthorizedMessage(res.status, await res.text().catch(() => "")), res.status);
 	return asGatewayError(res, `${fallback} (HTTP ${res.status}).`);
 }
 function authHeaders(creds) {
@@ -2794,7 +2933,7 @@ function anArticle(label, capitalized = false) {
 	return `${capitalized ? article[0].toUpperCase() + article.slice(1) : article} ${label}`;
 }
 /** Report a failure the user can act on, and stop. */
-function fail(message, ...advice) {
+function fail$1(message, ...advice) {
 	console.error(`[wawesome] Error: ${message}`);
 	for (const line of advice) console.error(`[wawesome] ${line}`);
 	process.exit(1);
@@ -2974,7 +3113,7 @@ async function wireUp(creds, appSlug, manifest, answers) {
 	try {
 		await ensureApp(creds, appSlug);
 	} catch (err) {
-		fail(errorText(err), ...[planLimitAdvice(reasonOf(err)), scaffolded].filter(Boolean));
+		fail$1(errorText(err), ...[planLimitAdvice(reasonOf(err)), scaffolded].filter(Boolean));
 	}
 	for (const { declared, value } of answers) {
 		if (!value) {
@@ -2985,7 +3124,7 @@ async function wireUp(creds, appSlug, manifest, answers) {
 		try {
 			await putEnvVar(creds, appSlug, declared.key, value, declared.secret);
 		} catch (err) {
-			fail(errorText(err), scaffolded);
+			fail$1(errorText(err), scaffolded);
 		}
 		console.log(`[wawesome] ✅ Stored ${declared.key}${declared.secret ? " (secret)" : ""}.`);
 	}
@@ -2993,7 +3132,7 @@ async function wireUp(creds, appSlug, manifest, answers) {
 		try {
 			await enableEgressProvider(creds, appSlug, provider);
 		} catch (err) {
-			fail(errorText(err), scaffolded);
+			fail$1(errorText(err), scaffolded);
 		}
 		console.log(`[wawesome] ✅ Enabled outbound calls to '${provider}'.`);
 	}
@@ -3015,7 +3154,7 @@ async function initFromTemplate(templateName, options) {
 	try {
 		template = await resolveTemplate(gatewayUrl, templateName);
 	} catch (err) {
-		fail(errorText(err));
+		fail$1(errorText(err));
 	}
 	console.log(`[wawesome] Fetching ${template.title} (${template.ref})...`);
 	if (isVerbose) console.log(`[wawesome:verbose] GET ${template.archive_url}`);
@@ -3023,7 +3162,7 @@ async function initFromTemplate(templateName, options) {
 	try {
 		archive = await downloadTemplateArchive(template.archive_url);
 	} catch (err) {
-		fail(errorText(err));
+		fail$1(errorText(err));
 	}
 	const staging = fs.mkdtempSync(path.join(os.tmpdir(), "wawesome-template-"));
 	const sweepStaging = () => fs.rmSync(staging, {
@@ -3045,10 +3184,10 @@ async function initFromTemplate(templateName, options) {
 			});
 			manifest = readTemplateManifest(staging);
 		} catch (err) {
-			fail(errorText(err));
+			fail$1(errorText(err));
 		}
 		const collisions = collidingPaths(cwd, files);
-		if (collisions.length > 0) fail(`${collisions.join(", ")} already exist${collisions.length === 1 ? "s" : ""} here.`, "Run this in an empty directory, or move those files aside first. Nothing was written.");
+		if (collisions.length > 0) fail$1(`${collisions.join(", ")} already exist${collisions.length === 1 ? "s" : ""} here.`, "Run this in an empty directory, or move those files aside first. Nothing was written.");
 		tenantSession = await ensureSession(options);
 		const session = openPromptSession();
 		try {
@@ -3064,7 +3203,7 @@ async function initFromTemplate(templateName, options) {
 				});
 				repinned = alignCliDependency(cwd, CLI_VERSION);
 			} catch (err) {
-				fail(errorText(err), `Some of '${template.name}' may have been written to ${cwd}.`);
+				fail$1(errorText(err), `Some of '${template.name}' may have been written to ${cwd}.`);
 			}
 			console.log(`\n[wawesome] ✅ Scaffolded ${files.length} files from '${template.name}'.`);
 			if (repinned) console.log(`[wawesome] Using wawesome ${repinned.to} — the template pinned ${repinned.from}.`);
@@ -3241,7 +3380,7 @@ async function fetchVersions(gatewayUrl, tenantJwt, app, funcName, env, isVerbos
 	});
 	if (!res.ok) {
 		const errorBody = await res.text();
-		if (res.status === 401) console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+		if (res.status === 401 || res.status === 403) console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorBody)}`);
 		else {
 			console.error(`[wawesome] Error: Failed to list versions (HTTP ${res.status}).`);
 			if (isVerbose) console.error(`[wawesome:verbose] Response: ${errorBody}`);
@@ -3444,7 +3583,7 @@ async function fetchInvocationLogBody(gatewayUrl, tenantJwt, invocationId, isVer
 	});
 	if (!res.ok) {
 		const errorText = await res.text();
-		if (res.status === 401) console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+		if (res.status === 401 || res.status === 403) console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorText)}`);
 		else if (res.status === 404) console.error(`[wawesome] Error: Invocation log '${invocationId}' not found or expired (logs are retained for 14 days).`);
 		else if (res.status === 400) console.error(`[wawesome] Error: Invalid invocation ID '${invocationId}'.`);
 		else {
@@ -3474,7 +3613,7 @@ async function listInvocations(gatewayUrl, tenantJwt, funcNameInput, appOverride
 	const res = await fetchInvocationsResponse(gatewayUrl, tenantJwt, funcName, appSlug, appOverride, `?${queryParams.toString()}`, isVerbose);
 	if (!res.ok) {
 		const errorText = await res.text();
-		if (res.status === 401) console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+		if (res.status === 401 || res.status === 403) console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorText)}`);
 		else if (res.status === 404) console.error(`[wawesome] Error: Function '${funcName}' not found.`);
 		else {
 			console.error(`[wawesome] Error: Failed to list invocations (HTTP ${res.status}).`);
@@ -3656,8 +3795,8 @@ async function followInvocationLog(gatewayUrl, tenantJwt, invocationId, isVerbos
 				if (isVerbose) console.error(`[wawesome:verbose] ${String(err)}`);
 				process.exit(1);
 			}
-			if (res.status === 401) {
-				console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+			if (res.status === 401 || res.status === 403) {
+				console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, await res.text().catch(() => ""))}`);
 				process.exit(1);
 			}
 			if (res.status === 404) {
@@ -3794,8 +3933,8 @@ async function followFunctionLog(gatewayUrl, tenantJwt, funcNameInput, appOverri
 				console.error("[wawesome] Error: Failed to connect to the live tail after retries.");
 				process.exit(1);
 			}
-			if (res.status === 401) {
-				console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+			if (res.status === 401 || res.status === 403) {
+				console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, await res.text().catch(() => ""))}`);
 				process.exit(1);
 			}
 			if (res.status === 404) {
@@ -3982,8 +4121,8 @@ async function followRun(gatewayUrl, tenantJwt, invocationId, isVerbose, pollInt
 				console.error(`[wawesome] ✖ Run ${meta.status}${meta.failure_reason ? `: ${meta.failure_reason}` : ""}`);
 				return;
 			}
-			if (res.status === 401) {
-				console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+			if (res.status === 401 || res.status === 403) {
+				console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, await res.text().catch(() => ""))}`);
 				process.exit(1);
 			}
 			if (!res.ok && res.status >= 500) {
@@ -4068,8 +4207,8 @@ async function invokeCommand(target, options = {}) {
 	const res = await triggerRun(creds.gateway_url, creds.tenant_jwt, funcName, appSlug, options.app, triggerPayload, isVerbose);
 	if (!res.ok) {
 		const errorBody = await res.text();
-		if (res.status === 401) {
-			console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+		if (res.status === 401 || res.status === 403) {
+			console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorBody)}`);
 			process.exit(1);
 		}
 		if (res.status === 404) {
@@ -4091,7 +4230,7 @@ async function invokeCommand(target, options = {}) {
 }
 //#endregion
 //#region src/workspace.ts
-function requireCredentials$1() {
+function requireCredentials$2() {
 	const creds = readCredentials();
 	if (!creds) {
 		console.error("[wawesome] Error: Not logged in. Run 'wawesome login' first.");
@@ -4104,7 +4243,7 @@ function requireCredentials$1() {
 * change — the rename is offered here rather than discovered by attempting it.
 */
 async function showWorkspace(options) {
-	const creds = requireCredentials$1();
+	const creds = requireCredentials$2();
 	let tenant;
 	try {
 		tenant = await fetchTenantDetails(creds);
@@ -4139,7 +4278,7 @@ async function showWorkspace(options) {
 * gateway knows something this command could not.
 */
 async function renameWorkspace(slug, options) {
-	const creds = requireCredentials$1();
+	const creds = requireCredentials$2();
 	if (!slug || !slug.trim()) {
 		console.error("[wawesome] Error: No name given. Usage: wawesome workspace rename <name>");
 		process.exit(1);
@@ -4183,6 +4322,267 @@ async function workspaceCommand(action, target, options) {
 	process.exit(1);
 }
 //#endregion
+//#region src/deploy-credentials.ts
+const SECRET_SHOWN_ONCE = "Copy it now. This is the only time it will be shown. If you lose it, revoke this credential and mint another.";
+function requireCredentials$1() {
+	const creds = readCredentials();
+	if (!creds) {
+		console.error("[wawesome] Error: Not logged in. Run 'wawesome login' first.");
+		process.exit(1);
+	}
+	return creds;
+}
+function fail(message, ...rest) {
+	console.error(`[wawesome] Error: ${message}`);
+	for (const line of rest) console.error(`[wawesome] ${line}`);
+	process.exit(1);
+}
+/** A repeated flag and a comma-separated one, read as the same list. */
+function asList(raw) {
+	if (raw === void 0) return void 0;
+	const words = (Array.isArray(raw) ? raw : [raw]).flatMap((word) => String(word).split(",")).map((word) => word.trim()).filter((word) => word.length > 0);
+	return words.length > 0 ? words : void 0;
+}
+function parseExpiry(raw) {
+	if (raw === void 0) return void 0;
+	const asked = String(raw).trim().toLowerCase();
+	if (asked === "never") return "never";
+	const days = /^(\d+)\s*d(ays?)?$/.exec(asked) ?? /^(\d+)$/.exec(asked);
+	if (!days) fail(`'${raw}' is not an expiry. Name a number of days (--expires 30) or 'never' (--expires never).`);
+	return { days: Number(days[1]) };
+}
+/**
+* What a target may be repeated back as.
+*
+* Somebody revoking a leak pastes the whole secret as often as the prefix, and
+* a refusal that echoed it would write it into a shell history and a CI log —
+* for the one feature built on the secret being shown exactly once.
+*/
+function asShown(target) {
+	if (!target.startsWith("wawe_")) return target;
+	const shown = credentialPrefix(target);
+	return shown === target ? target : `${shown}…`;
+}
+/** The Apps a credential names, or `null` where it names none and reaches all. */
+function namedApps(apps) {
+	return apps && apps.scope === "only" ? apps.apps.join(", ") : null;
+}
+/** `2026-11-30 12:00 UTC`. Minutes, because nothing here is read to the second. */
+function asUtc(iso) {
+	if (!iso) return "never";
+	const at = new Date(iso);
+	if (Number.isNaN(at.getTime())) return iso;
+	return `${at.toISOString().slice(0, 16).replace("T", " ")} UTC`;
+}
+function isExpired(credential, now) {
+	if (!credential.expires_at) return false;
+	const at = new Date(credential.expires_at).getTime();
+	return !Number.isNaN(at) && at <= now;
+}
+function statusOf(credential, now) {
+	if (credential.revoked_at) return "revoked";
+	if (isExpired(credential, now)) return "expired";
+	return "active";
+}
+async function refusal(res, fallback) {
+	if (res.status === 401 || res.status === 403) return new GatewayError(unauthorizedMessage(res.status, await res.text().catch(() => "")), res.status);
+	return asGatewayError(res, fallback);
+}
+async function mintCredential(creds, payload) {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${creds.tenant_jwt}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify(payload)
+	});
+	if (!res.ok) throw await refusal(res, `Failed to mint the credential (HTTP ${res.status}).`);
+	return await res.json();
+}
+async function fetchCredentials(creds) {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials`, { headers: { Authorization: `Bearer ${creds.tenant_jwt}` } });
+	if (!res.ok) throw await refusal(res, `Failed to read the credentials (HTTP ${res.status}).`);
+	return (await res.json()).credentials ?? [];
+}
+async function revokeCredential(creds, credentialId) {
+	const res = await authorizedFetch(`${creds.gateway_url}/v1/tenant/credentials/${encodeURIComponent(credentialId)}/revoke`, {
+		method: "POST",
+		headers: { Authorization: `Bearer ${creds.tenant_jwt}` }
+	});
+	if (!res.ok) throw await refusal(res, `Failed to revoke the credential (HTTP ${res.status}).`);
+	return await res.json();
+}
+/**
+* Mint one credential.
+*
+* The secret goes to stdout on a line of its own and everything a person reads
+* goes to stderr, so `wawesome credentials mint ci > secret` writes the secret
+* and not one character besides.
+*/
+async function mintCredentialCommand(name, options) {
+	if (!name || !name.trim()) fail("No name given. Usage: wawesome credentials mint <name> [--capability deploy] [--app <app>] [--expires 90|never]", "The name is what tells the CI one from the agent one a year from now.");
+	const creds = requireCredentials$1();
+	const payload = { name: name.trim() };
+	const capabilities = asList(options.capability);
+	if (capabilities) payload.capabilities = capabilities;
+	const apps = asList(options.app);
+	if (apps) payload.apps = apps;
+	const expiry = parseExpiry(options.expires);
+	if (expiry !== void 0) payload.expiry = expiry;
+	if (options.verbose) {
+		console.error(`[wawesome:verbose] POST ${creds.gateway_url}/v1/tenant/credentials`);
+		console.error(`[wawesome:verbose] Payload: ${JSON.stringify({ ...payload })}`);
+	}
+	let credential;
+	try {
+		credential = await mintCredential(creds, payload);
+	} catch (err) {
+		fail(errorText(err));
+	}
+	console.error(`\n[wawesome] ✔ Minted deploy credential '${credential.name}'.\n`);
+	console.error(`  Prefix:       ${credential.prefix}`);
+	console.error(`  Capabilities: ${credential.capabilities.join(", ")}`);
+	console.error(`  Apps:         ${namedApps(credential.apps) ?? "every App in the workspace"}`);
+	console.error(`  Expires:      ${asUtc(credential.expires_at)}`);
+	console.error(`\n  ${SECRET_SHOWN_ONCE}\n`);
+	console.log(credential.secret);
+	console.error("");
+}
+async function listCredentialsCommand(options) {
+	const creds = requireCredentials$1();
+	if (options.verbose) console.error(`[wawesome:verbose] GET ${creds.gateway_url}/v1/tenant/credentials`);
+	let credentials;
+	try {
+		credentials = await fetchCredentials(creds);
+	} catch (err) {
+		fail(errorText(err));
+	}
+	if (credentials.length === 0) {
+		console.log("\n[wawesome] This workspace has no deploy credentials.");
+		console.log("[wawesome] Mint one: \x1B[36mwawesome credentials mint <name>\x1B[0m\n");
+		return;
+	}
+	console.log("\n🔑 \x1B[1mDeploy credentials\x1B[0m\n");
+	for (const line of formatCredentials(credentials, Date.now())) console.log(line);
+	console.log("");
+}
+/** Never the secret: no read after minting carries one. */
+function formatCredentials(credentials, now) {
+	const rows = credentials.map((credential) => ({
+		name: credential.name,
+		prefix: credential.prefix,
+		capabilities: credential.capabilities.join(", "),
+		apps: namedApps(credential.apps) ?? "every App",
+		lastUsed: asUtc(credential.last_used_at),
+		expires: asUtc(credential.expires_at),
+		status: statusOf(credential, now)
+	}));
+	const columns = [
+		{
+			header: "NAME",
+			of: (row) => row.name
+		},
+		{
+			header: "PREFIX",
+			of: (row) => row.prefix
+		},
+		{
+			header: "CAPABILITIES",
+			of: (row) => row.capabilities
+		},
+		{
+			header: "APPS",
+			of: (row) => row.apps
+		},
+		{
+			header: "LAST USED",
+			of: (row) => row.lastUsed
+		},
+		{
+			header: "EXPIRES",
+			of: (row) => row.expires
+		},
+		{
+			header: "STATUS",
+			of: (row) => row.status
+		}
+	];
+	const widths = columns.map((column) => Math.max(column.header.length, ...rows.map((row) => column.of(row).length)));
+	const line = (cells) => `  ${cells.map((cell, i) => cell.padEnd(widths[i])).join(" | ")}`.trimEnd();
+	return [
+		line(columns.map((column) => column.header)),
+		`  ${widths.map((width) => "-".repeat(width)).join("-|-")}`,
+		...rows.map((row) => line(columns.map((column) => column.of(row))))
+	];
+}
+/**
+* Which credential a user meant by a name or a prefix.
+*
+* A partial prefix matches, because the point of the displayable prefix is
+* matching one against a CI settings page by eye — and a partial that names
+* more than one is refused rather than guessed at, since the guess would be a
+* revocation.
+*/
+function matchCredentials(credentials, target) {
+	const typed = target.trim();
+	const named = credentials.filter((credential) => credential.name === typed);
+	if (named.length > 0) return named;
+	const wanted = typed.startsWith("wawe_") ? credentialPrefix(typed) : typed;
+	return credentials.filter((credential) => credential.prefix.startsWith(wanted));
+}
+async function revokeCredentialCommand(target, options) {
+	if (!target || !target.trim()) fail("No credential given. Usage: wawesome credentials revoke <name-or-prefix>");
+	const creds = requireCredentials$1();
+	if (options.verbose) console.error(`[wawesome:verbose] GET ${creds.gateway_url}/v1/tenant/credentials`);
+	let credentials;
+	try {
+		credentials = await fetchCredentials(creds);
+	} catch (err) {
+		fail(errorText(err));
+	}
+	const matched = matchCredentials(credentials, target);
+	if (matched.length === 0) fail(`No deploy credential named or prefixed '${asShown(target)}' in this workspace.`, "Run 'wawesome credentials list' to see what this workspace has.");
+	if (matched.length > 1) fail(`'${asShown(target)}' names more than one credential:`, ...matched.map((credential) => `  ${credential.name} (${credential.prefix})`), "Name one of them, or give more of its prefix.");
+	const credential = matched[0];
+	if (credential.revoked_at) {
+		console.log(`[wawesome] '${credential.name}' (${credential.prefix}) was already revoked at ${asUtc(credential.revoked_at)}. Nothing to do.`);
+		return;
+	}
+	if (!options.yes) {
+		if (!isInteractive()) fail(`Revoking asks for confirmation, and there is nobody to ask.`, `Pass --yes to revoke '${credential.name}' (${credential.prefix}) without being asked.`);
+		let confirmed;
+		try {
+			confirmed = await confirm({
+				message: `Revoke '${credential.name}' (${credential.prefix})? Nothing un-revokes it.`,
+				default: false
+			});
+		} catch {
+			confirmed = false;
+		}
+		if (!confirmed) {
+			console.log(`[wawesome] Cancelled. '${credential.name}' still works.`);
+			return;
+		}
+	}
+	if (options.verbose) console.error(`[wawesome:verbose] POST ${creds.gateway_url}/v1/tenant/credentials/${credential.id}/revoke`);
+	let revoked;
+	try {
+		revoked = await revokeCredential(creds, credential.id);
+	} catch (err) {
+		if (err instanceof GatewayError && err.status === 404) fail(`'${credential.name}' (${credential.prefix}) no longer exists in this workspace.`);
+		fail(errorText(err));
+	}
+	console.log(`\n[wawesome] ✔ Revoked '${revoked.name}' (${revoked.prefix}).`);
+	console.log("[wawesome] Anything still presenting it is refused from its very next request.\n");
+}
+async function credentialsCommand(action, target, options) {
+	if (!action || action === "list" || action === "ls") return listCredentialsCommand(options);
+	if (action === "mint") return mintCredentialCommand(target, options);
+	if (action === "revoke") return revokeCredentialCommand(target, options);
+	fail(`Unknown credentials action '${action}'.`, "Usage: wawesome credentials [list|mint <name>|revoke <name-or-prefix>]");
+}
+//#endregion
 //#region src/cron.ts
 /** `2026-08-23 03:00:00 UTC` with second-precision for run history timestamps. */
 function asUtcWithSeconds(iso) {
@@ -4487,8 +4887,8 @@ async function pauseScheduleCommand(target, subtarget, options = {}) {
 	const res = await pauseScheduleApi(creds.gateway_url, creds.tenant_jwt, funcName, scheduleName, appSlug, options.reason, isVerbose);
 	if (!res.ok) {
 		const errorBody = await res.text();
-		if (res.status === 401) {
-			console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+		if (res.status === 401 || res.status === 403) {
+			console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorBody)}`);
 			process.exit(1);
 		}
 		if (res.status === 404) {
@@ -4544,8 +4944,8 @@ async function resumeScheduleCommand(target, subtarget, options = {}) {
 	const res = await resumeScheduleApi(creds.gateway_url, creds.tenant_jwt, funcName, scheduleName, appSlug, isVerbose);
 	if (!res.ok) {
 		const errorBody = await res.text();
-		if (res.status === 401) {
-			console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+		if (res.status === 401 || res.status === 403) {
+			console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorBody)}`);
 			process.exit(1);
 		}
 		if (res.status === 404) {
@@ -4583,8 +4983,8 @@ async function runHistoryCommand(target, options = {}) {
 	}, isVerbose);
 	if (!res.ok) {
 		const errorBody = await res.text();
-		if (res.status === 401) {
-			console.error("[wawesome] Error: Authentication expired. Run 'wawesome login' again.");
+		if (res.status === 401 || res.status === 403) {
+			console.error(`[wawesome] Error: ${unauthorizedMessage(res.status, errorBody)}`);
 			process.exit(1);
 		}
 		if (res.status === 404) {
@@ -4634,11 +5034,33 @@ cli.command("env [action] [key] [value]", "Manage environment variables (set, li
 cli.command("env set <key> <value>", "Set or overwrite an environment variable on the current app").option("-s, --secret", "Flag variable as secret (write-only)").option("-v, --verbose", "Enable verbose debug output").action((key, value, options) => setEnvVar(key, value, options));
 cli.command("env list", "List environment variables for the current app").alias("env ls").option("-v, --verbose", "Enable verbose debug output").action((options) => listEnvVars(options));
 cli.command("env rm <key>", "Delete an environment variable from the current app").alias("env remove").alias("env delete").alias("env unset").option("-v, --verbose", "Enable verbose debug output").action((key, options) => removeEnvVar(key, options));
-cli.command("login", "Authenticate with the wawesome.io platform").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("--gateway <url>", "Alias for --api <url>").option("--dashboard <url>", "Dashboard URL (default: https://dashboard.wawesome.io)").option("--provider <name>", "OAuth provider (default: github)").option("--workspace <name>", "Name for the workspace, when signing up without a terminal to prompt").option("-v, --verbose", "Enable verbose debug output").action((options) => login(options));
+cli.command("login", "Authenticate with the wawesome.io platform").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("--gateway <url>", "Alias for --api <url>").option("--dashboard <url>", "Dashboard URL (default: https://dashboard.wawesome.io)").option("--provider <name>", "OAuth provider (default: github)").option("--workspace <name>", "Name for the workspace, when signing up without a terminal to prompt").option("--accept-terms", "Accept the terms of service and privacy policy, when signing up without a terminal to prompt").option("-v, --verbose", "Enable verbose debug output").action((options) => login(options));
 cli.command("logout", "Clear stored authentication credentials").action(() => logout());
 cli.command("whoami", "Show current login session info").action(() => whoami());
 cli.command("workspace [action] [name]", "Show the workspace, or rename its public address").usage("workspace <action> [name]\n\nActions:\n  show                Show the workspace name, address, and whether it can still change\n  rename <name>       Change the public address, while nothing live depends on it").example("wawesome workspace").example("wawesome workspace rename northwind").option("-v, --verbose", "Enable verbose debug output").action((action, name, options) => workspaceCommand(action, name, options));
 cli.command("templates [action]", "Browse the template catalog").usage("templates [action]\n\nActions:\n  list (ls)           Show every available template (default)").example("wawesome templates").example("wawesome templates list").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("-v, --verbose", "Enable verbose debug output").action((action, options) => templatesCommand(action, options));
+cli.command("credentials [action] [target]", "Mint, list and revoke deploy credentials").alias("credential").usage(`credentials <action> [options]
+
+  A deploy credential is what a CI pipeline or an agent authenticates with, where
+  there is nobody at a keyboard to log in. Minting is the only time the secret is
+  shown. It is printed on its own line, so a pipe catches it and nothing else.
+
+  Actions:
+    list (ls)                       Show every credential: name, prefix, capabilities, Apps, last use, expiry (default)
+    mint <name>                     Mint one, printing the secret exactly once
+    revoke <name-or-prefix>         Revoke one, immediately and for good
+
+  Examples:
+    wawesome credentials
+    wawesome credentials mint ci-pipeline
+    wawesome credentials mint agent -c logs:read --expires never
+    wawesome credentials mint prod-deploy -c deploy -a prod --expires 30
+    wawesome credentials mint ci-pipeline > /tmp/secret
+    wawesome credentials revoke ci-pipeline
+    wawesome credentials revoke wawe_ab3k9x --yes`).option("-c, --capability <capability>", "Capability to grant: deploy, logs:read (repeatable or comma-separated, default: deploy)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated, default: every App)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-y, --yes", "Skip the revoke confirmation").option("-v, --verbose", "Enable verbose debug output").action((action, target, options) => credentialsCommand(action, target, options));
+cli.command("credentials mint <name>", "Mint a deploy credential, printing its secret exactly once").option("-c, --capability <capability>", "Capability to grant: deploy, logs:read (repeatable or comma-separated)").option("-a, --app <app>", "Restrict the credential to this App (repeatable or comma-separated)").option("--expires <days|never>", "Days until the credential expires, or 'never' (default: 90)").option("-v, --verbose", "Enable verbose debug output").action((name, options) => mintCredentialCommand(name, options));
+cli.command("credentials list", "List deploy credentials — never their secrets").alias("credentials ls").option("-v, --verbose", "Enable verbose debug output").action((options) => listCredentialsCommand(options));
+cli.command("credentials revoke <name-or-prefix>", "Revoke a deploy credential, immediately and for good").option("-y, --yes", "Revoke without being asked to confirm").option("-v, --verbose", "Enable verbose debug output").action((target, options) => revokeCredentialCommand(target, options));
 cli.command("init", "Scaffold a new function project in the current directory").usage("init [options]\n\nWith --template, the project is fetched from the template catalog, wired up\nfrom what the template declares it needs, and deployed. Run 'wawesome templates'\nto see what is available.").example("wawesome init").example("wawesome init --template stripe-webhook").option("-t, --template <name>", "Scaffold from a catalog template and deploy it").option("--api <url>", "API URL (default: https://api.wawesome.io)").option("--dashboard <url>", "Dashboard URL (default: https://dashboard.wawesome.io)").option("--no-install", "Skip installing dependencies after scaffolding").option("--root", "Generate a root function router template").option("-v, --verbose", "Enable verbose debug output").action((options) => init(options));
 cli.command("logs [function-name-or-invocation-id]", "View invocation history, fetch log output, or follow live").usage(`logs [target] [options]
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wawesome",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "CLI tool for building and deploying serverless functions on wawesome.io platform",
   "type": "module",
   "bin": {