@frontera-sdk/functions 1.52.47 → 1.53.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontera-sdk/functions",
-  "version": "1.52.47",
+  "version": "1.53.0",
   "description": "Author Frontera functions: manifest, triggers and the typed handler contract.",
   "keywords": [
     "frontera",
@@ -42,7 +42,7 @@
     "typescript": "^5.9.3"
   },
   "dependencies": {
-    "@frontera-sdk/blueprint": "1.52.47",
+    "@frontera-sdk/blueprint": "1.53.0",
     "cron-parser": "^5.0.6"
   }
 }

package/src/types.ts

@@ -712,8 +712,19 @@ export interface HttpRequest {
   headers?: Record<string, string>
   /** String only — no streaming, no binary. */
   body?: string
-  /** Inject a workspace secret into one header. Needs a `secret:<name>` grant. */
-  auth?: { header: string; secret: string; prefix?: string }
+  /**
+   * A credential the platform adds, which this process never sees. Needs a
+   * `secret:<name>` grant either way.
+   *
+   * - `{ header, secret, prefix? }` puts the secret's value in one header.
+   * - `{ githubApp: { secret, installationId } }` calls GitHub as a GitHub App
+   *   installation: the platform signs a JWT with the App's private key from
+   *   the secret (JSON `{ "appId": 123, "privateKey": "-----BEGIN …" }`), trades
+   *   it for the installation's one-hour token, reuses that until five minutes
+   *   before it expires, and sends `Authorization: Bearer <token>`. An event
+   *   GitHub sends to the App carries the id as `payload.installation.id`.
+   */
+  auth?: { header: string; secret: string; prefix?: string } | { githubApp: { secret: string; installationId: number | string } }
 }
 
 export interface HttpResponse {