wawesome 0.5.0 → 0.6.0

package/README.md

@@ -313,17 +313,25 @@ A job on a timer should not also be sitting at a guessable URL where a stranger
 }
 ```
 
-A private Function has **no address at all** — not a hidden one, not one behind a credential. A
-request for it is answered with the same 404 as a Function that was never deployed, on your App's
-own hostname and on the development path form alike. This is how you deploy a job with side effects
-without leaving it where a stranger who guesses the slug can fire it.
+A private Function has **no public address at all** in production — not a hidden one, not one
+behind a credential. A request for it against your App's own hostname is answered with the same 404
+as a Function that was never deployed. This is how you deploy a job with side effects without leaving
+it where a stranger who guesses the slug can fire it.
 
 Leave the line out and your Function is public, which is what every Function without it has always
 been.
 
-Today that is all a private Function is: there is no way *in* to one yet. Schedules do not fire yet,
-and the authenticated trigger that runs a Function by hand is not built — so make one private when
-you want it off the web, and expect to publish it again to call it until those land.
+On your own machine, the local development surface serves Functions regardless of visibility, and
+honours an explicit `x-wawesome-trigger` header so you can exercise a scheduled run by hand:
+
+```bash
+# Exercise a private or scheduled function locally on the development path form:
+curl -X POST http://localhost:3000/x/my-tenant-slug/default-app/nightly-reconcile \
+  -H "x-wawesome-trigger: schedule"
+```
+
+Because production strips the reserved header namespace inbound, a request that works locally
+provably cannot work against the Public address.
 
 Making a Function private takes nothing but the deploy. Making it public again does not: deleting
 the line is refused, and the deploy tells you so having written nothing.
@@ -348,7 +356,7 @@ Four headers arrive or leave on it, and the stripping is what makes them worth t
 | Header | Direction | What it means |
 | --- | --- | --- |
 | `x-wawesome-forwarded-prefix` | inbound | The mount that was stripped from the path. Join it to the path you observe to rebuild the caller's URL. |
-| `x-wawesome-trigger` | inbound | How this run started: `caller` when someone called your address. A caller cannot forge it, so you may skip your own authorization on anything else and open nothing. |
+| `x-wawesome-trigger` | inbound | How this run started: `caller` when someone called your address, `schedule` when fired by a Schedule. A caller cannot forge it in production (stripped inbound). On the local development surface, pass `x-wawesome-trigger: schedule` to exercise a background run by hand with the collapsed budget. |
 | `x-wawesome-invocation-id` | outbound | The id of this run — the key to fetch its logs with `npx wawesome logs --invocation <id>`. |
 | `x-wawesome-error` | outbound | Present only when the platform failed, never when your Function did. Its *absence* means the status on the wire is yours — up to the moment your response is committed, and no further. |
 

package/dist/index.mjs

@@ -759,7 +759,7 @@ async function buildJs(entryInput, options) {
 * that has to name this version — `--version`, the dependency a scaffolded
 * project pins — reads it here, so a release bumps one file.
 */
-const CLI_VERSION = "0.5.0";
+const CLI_VERSION = "0.6.0";
 //#endregion
 //#region src/prompt.ts
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wawesome",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "CLI tool for building and deploying serverless functions on wawesome.io platform",
   "type": "module",
   "bin": {