@frontera-sdk/functions 1.52.48 → 1.53.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontera-sdk/functions",
-  "version": "1.52.48",
+  "version": "1.53.1",
   "description": "Author Frontera functions: manifest, triggers and the typed handler contract.",
   "keywords": [
     "frontera",
@@ -42,7 +42,7 @@
     "typescript": "^5.9.3"
   },
   "dependencies": {
-    "@frontera-sdk/blueprint": "1.52.48",
+    "@frontera-sdk/blueprint": "1.53.1",
     "cron-parser": "^5.0.6"
   }
 }

package/src/types.ts

@@ -712,8 +712,19 @@ export interface HttpRequest {
   headers?: Record<string, string>
   /** String only — no streaming, no binary. */
   body?: string
-  /** Inject a workspace secret into one header. Needs a `secret:<name>` grant. */
-  auth?: { header: string; secret: string; prefix?: string }
+  /**
+   * A credential the platform adds, which this process never sees. Needs a
+   * `secret:<name>` grant either way.
+   *
+   * - `{ header, secret, prefix? }` puts the secret's value in one header.
+   * - `{ githubApp: { secret, installationId } }` calls GitHub as a GitHub App
+   *   installation: the platform signs a JWT with the App's private key from
+   *   the secret (JSON `{ "appId": 123, "privateKey": "-----BEGIN …" }`), trades
+   *   it for the installation's one-hour token, reuses that until five minutes
+   *   before it expires, and sends `Authorization: Bearer <token>`. An event
+   *   GitHub sends to the App carries the id as `payload.installation.id`.
+   */
+  auth?: { header: string; secret: string; prefix?: string } | { githubApp: { secret: string; installationId: number | string } }
 }
 
 export interface HttpResponse {
@@ -811,7 +822,7 @@ export interface AutomationDescriptor {
  * `cron` is deliberately absent: it is what the runner INFERS when the event
  * names no source at all, so it is never carried on an event.
  */
-export const EVENT_TRIGGER_SOURCES = ['manual', 'rehearsal', 'agent', 'app', 'workflow', 'channel'] as const
+export const EVENT_TRIGGER_SOURCES = ['manual', 'rehearsal', 'agent', 'app', 'mcp', 'workflow', 'channel'] as const
 export type EventTriggerSource = (typeof EVENT_TRIGGER_SOURCES)[number]
 
 /**
@@ -822,7 +833,7 @@ export type EventTriggerSource = (typeof EVENT_TRIGGER_SOURCES)[number]
  * under any other source is refused too — it means the event was tampered with
  * or two payloads got mixed.
  */
-export const TICKETED_TRIGGER_SOURCES = ['agent', 'app'] as const
+export const TICKETED_TRIGGER_SOURCES = ['agent', 'app', 'mcp'] as const
 export type TicketedTriggerSource = (typeof TICKETED_TRIGGER_SOURCES)[number]
 
 export function isEventTriggerSource(value: unknown): value is EventTriggerSource {