@koolbase/core 10.0.0

package/dist/esm/device-id.d.ts

@@ -0,0 +1 @@
+export declare function getOrCreateDeviceId(): Promise<string>;

package/dist/esm/device-id.js

@@ -0,0 +1,54 @@
+import { getPlatform } from './platform.js';
+// Single source of the anonymous device identifier for the whole SDK.
+// Generated once, persisted, and shared by messaging (registration keying),
+// feature flags (rollout bucketing: stableHash(deviceId + ":" + key) % 100),
+// code push (targeting), and analytics. Previously each subsystem was handed a
+// hardcoded 'rn-device' literal, so every RN device collided on one messaging
+// registration row and bucketed identically for every rollout — a 10% flag was
+// on for everyone or no one, never 10%.
+//
+// The id is anonymous, not a secret: what matters is uniform DISTRIBUTION so
+// hash(id) % 100 is even, not unpredictability. We use crypto.getRandomValues
+// when the runtime provides it (best distribution, no modulo bias) and fall
+// back to Math.random otherwise — mirroring the runtime-guarded crypto use
+// already in code-push.ts, and adding no dependency (per the SDK's stated
+// preference against a crypto-grade UUID dependency for non-security ids).
+const DEVICE_ID_KEY = 'koolbase:device_id';
+let _cached = null;
+export async function getOrCreateDeviceId() {
+    if (_cached)
+        return _cached;
+    try {
+        const existing = await getPlatform().storage.getItem(DEVICE_ID_KEY);
+        if (existing) {
+            _cached = existing;
+            return existing;
+        }
+        const newId = generateUUID();
+        await getPlatform().storage.setItem(DEVICE_ID_KEY, newId);
+        _cached = newId;
+        return newId;
+    }
+    catch {
+        // Storage unavailable — return an ephemeral (unpersisted) id so the SDK
+        // stays functional rather than throwing. Not stable across launches.
+        return generateUUID();
+    }
+}
+// UUID v4. Uses crypto.getRandomValues where available for uniform,
+// modulo-bias-free bytes; Math.random fallback keeps it dependency-free.
+function generateUUID() {
+    const bytes = new Uint8Array(16);
+    const c = typeof crypto !== 'undefined' ? crypto : undefined;
+    if (c && typeof c.getRandomValues === 'function') {
+        c.getRandomValues(bytes);
+    }
+    else {
+        for (let i = 0; i < 16; i++)
+            bytes[i] = (Math.random() * 256) | 0;
+    }
+    bytes[6] = (bytes[6] & 0x0f) | 0x40; // version 4
+    bytes[8] = (bytes[8] & 0x3f) | 0x80; // variant
+    const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}

package/dist/esm/device-metadata.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Koolbase React Native SDK version. Sent in the `x-koolbase-sdk-version`
+ * header on every authenticated request so the server can route
+ * version-conditional logic (deprecation warnings, schema migrations,
+ * feature flags). Must match the `version` field in package.json.
+ */
+export declare const koolbaseSdkVersion = "10.0.0";
+/**
+ * Builds device-identifying headers attached to every Koolbase auth
+ * request. Mirrors the Flutter SDK's `DeviceMetadata` for parity. Apps
+ * with privacy concerns can swap in a custom storage adapter to avoid
+ * persisting the device label.
+ *
+ * Headers emitted:
+ * - User-Agent: koolbase-react-native/<sdk> (<platform> <version>)
+ * - x-koolbase-sdk:              react-native
+ * - x-koolbase-sdk-version:      <koolbaseSdkVersion>
+ * - x-koolbase-platform:         ios | android | web | etc.
+ * - x-koolbase-platform-version: numeric SDK level or OS version string
+ * - x-koolbase-app-version:      from KoolbaseConfig.appVersion or 'unknown'
+ * - x-koolbase-device-label:     persistent UUID per install
+ */
+export declare class DeviceMetadata {
+    private cached;
+    private ephemeralLabel;
+    private readonly appVersion;
+    constructor(appVersion?: string);
+    /**
+     * Build (or return cached) device headers. The first call may perform
+     * an async keychain read to look up the persisted device label;
+     * subsequent calls return the in-memory cache synchronously via the
+     * returned Promise.
+     */
+    build(): Promise<Record<string, string>>;
+    private getOrCreateDeviceLabel;
+}

package/dist/esm/device-metadata.js

@@ -0,0 +1,90 @@
+import { getPlatform } from './platform.js';
+/**
+ * Koolbase React Native SDK version. Sent in the `x-koolbase-sdk-version`
+ * header on every authenticated request so the server can route
+ * version-conditional logic (deprecation warnings, schema migrations,
+ * feature flags). Must match the `version` field in package.json.
+ */
+export const koolbaseSdkVersion = '10.0.0';
+/**
+ * Generate a UUIDv4-shaped string for use as a stable per-install
+ * device label. Not cryptographically secure — this is a label, not a
+ * security primitive. Avoids pulling in a crypto-grade UUID dependency.
+ */
+function generateDeviceLabel() {
+    return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (c) => {
+        const r = (Math.random() * 16) | 0;
+        const v = c === 'x' ? r : (r & 0x3) | 0x8;
+        return v.toString(16);
+    });
+}
+/**
+ * Builds device-identifying headers attached to every Koolbase auth
+ * request. Mirrors the Flutter SDK's `DeviceMetadata` for parity. Apps
+ * with privacy concerns can swap in a custom storage adapter to avoid
+ * persisting the device label.
+ *
+ * Headers emitted:
+ * - User-Agent: koolbase-react-native/<sdk> (<platform> <version>)
+ * - x-koolbase-sdk:              react-native
+ * - x-koolbase-sdk-version:      <koolbaseSdkVersion>
+ * - x-koolbase-platform:         ios | android | web | etc.
+ * - x-koolbase-platform-version: numeric SDK level or OS version string
+ * - x-koolbase-app-version:      from KoolbaseConfig.appVersion or 'unknown'
+ * - x-koolbase-device-label:     persistent UUID per install
+ */
+export class DeviceMetadata {
+    constructor(appVersion) {
+        this.cached = null;
+        this.ephemeralLabel = null;
+        this.appVersion = appVersion ?? 'unknown';
+    }
+    /**
+     * Build (or return cached) device headers. The first call may perform
+     * an async keychain read to look up the persisted device label;
+     * subsequent calls return the in-memory cache synchronously via the
+     * returned Promise.
+     */
+    async build() {
+        if (this.cached)
+            return this.cached;
+        const platform = getPlatform().info.os;
+        const platformVersion = getPlatform().info.version;
+        const deviceLabel = await this.getOrCreateDeviceLabel();
+        // No User-Agent: a browser forbids setting it, and the same header set
+        // now goes out from both hosts. The platform and version below carry
+        // what it used to say.
+        this.cached = {
+            'x-koolbase-sdk': getPlatform().info.os === 'web' ? 'js' : 'react-native',
+            'x-koolbase-sdk-version': koolbaseSdkVersion,
+            'x-koolbase-platform': platform,
+            'x-koolbase-platform-version': platformVersion,
+            'x-koolbase-app-version': this.appVersion,
+            'x-koolbase-device-label': deviceLabel,
+        };
+        return this.cached;
+    }
+    async getOrCreateDeviceLabel() {
+        // A stable per-install label, kept in the platform's storage. On a host
+        // with nothing persistent (the in-memory adapter) it lives for the
+        // session, which is still useful for in-session debugging.
+        const key = 'koolbase_device_label_v1';
+        const storage = getPlatform().storage;
+        try {
+            const existing = await storage.getItem(key);
+            if (existing)
+                return existing;
+        }
+        catch {
+            // fall through to create
+        }
+        const newLabel = generateDeviceLabel();
+        try {
+            await storage.setItem(key, newLabel);
+        }
+        catch {
+            // storage refused; the label still serves this session
+        }
+        return newLabel;
+    }
+}

package/dist/esm/errors.d.ts

@@ -0,0 +1,64 @@
+/**
+ * The root of every error the SDK raises.
+ *
+ * Each subsystem has its own family beneath this — data, storage, auth — so an
+ * application can catch narrowly where it wants to and broadly where it does
+ * not:
+ *
+ * ```ts
+ * try {
+ *   await Koolbase.storage.upload(...);
+ * } catch (e) {
+ *   if (e instanceof KoolbaseUnauthenticatedError) return goToLogin();
+ *   if (e instanceof KoolbaseStorageError) return showError(e.message);
+ *   throw e;
+ * }
+ * ```
+ *
+ * The families used to be unrelated roots, which meant a failure belonging to no
+ * single subsystem — a rejected credential, discovered by whichever call
+ * happened to make it — had to be redefined in each one.
+ */
+export declare class KoolbaseError extends Error {
+    code?: string;
+    constructor(message: string, code?: string);
+}
+/**
+ * The server would not accept the caller's credentials.
+ *
+ * Raised by any surface — a query, an upload, a Function invoke — because a
+ * session stops working for the whole SDK at once, not one subsystem at a time.
+ *
+ * Named for what the server actually reports. A 401 covers an expired session, a
+ * revoked key, a malformed header, and no credentials at all, and the server
+ * does not distinguish them: calling this "session expired" would claim a
+ * precision that does not exist, and an app that signed a user out on a revoked
+ * API key would be acting on it.
+ *
+ * When the SDK holds a session it clears it before throwing, so by the time an
+ * application catches this the user is already signed out.
+ */
+export declare class KoolbaseUnauthenticatedError extends KoolbaseError {
+    constructor(message: string);
+}
+/**
+ * An offline update or delete could not be queued, because the SDK has no
+ * record of what the change was composed against.
+ *
+ * Replaying a mutation without knowing the state it was based on means applying
+ * it blindly: whatever changed on the server in the meantime is overwritten,
+ * silently, with nobody able to tell it happened.
+ *
+ * A baseline is available when the record is in the local cache — read through
+ * a query, a single fetch, or seen over the socket — or when it was created
+ * offline and its insert is still queued. It is unavailable when the record has
+ * never been seen on this device, so read it first, or make the change while
+ * online where the server arbitrates directly.
+ *
+ * Deliberate rather than lenient. Queueing these anyway would mean most offline
+ * updates are conflict-safe and some quietly are not, which is a worse guarantee
+ * than a clear refusal.
+ */
+export declare class KoolbaseOfflineBaselineUnavailableError extends KoolbaseError {
+    constructor(message: string);
+}

package/dist/esm/errors.js

@@ -0,0 +1,79 @@
+/**
+ * The root of every error the SDK raises.
+ *
+ * Each subsystem has its own family beneath this — data, storage, auth — so an
+ * application can catch narrowly where it wants to and broadly where it does
+ * not:
+ *
+ * ```ts
+ * try {
+ *   await Koolbase.storage.upload(...);
+ * } catch (e) {
+ *   if (e instanceof KoolbaseUnauthenticatedError) return goToLogin();
+ *   if (e instanceof KoolbaseStorageError) return showError(e.message);
+ *   throw e;
+ * }
+ * ```
+ *
+ * The families used to be unrelated roots, which meant a failure belonging to no
+ * single subsystem — a rejected credential, discovered by whichever call
+ * happened to make it — had to be redefined in each one.
+ */
+export class KoolbaseError extends Error {
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = 'KoolbaseError';
+        // Required for `instanceof` to work across the prototype chain when
+        // targeting ES5-era output, which TypeScript's class extension otherwise
+        // breaks. Every subclass repeats it for the same reason.
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/**
+ * The server would not accept the caller's credentials.
+ *
+ * Raised by any surface — a query, an upload, a Function invoke — because a
+ * session stops working for the whole SDK at once, not one subsystem at a time.
+ *
+ * Named for what the server actually reports. A 401 covers an expired session, a
+ * revoked key, a malformed header, and no credentials at all, and the server
+ * does not distinguish them: calling this "session expired" would claim a
+ * precision that does not exist, and an app that signed a user out on a revoked
+ * API key would be acting on it.
+ *
+ * When the SDK holds a session it clears it before throwing, so by the time an
+ * application catches this the user is already signed out.
+ */
+export class KoolbaseUnauthenticatedError extends KoolbaseError {
+    constructor(message) {
+        super(message, 'unauthenticated');
+        this.name = 'KoolbaseUnauthenticatedError';
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/**
+ * An offline update or delete could not be queued, because the SDK has no
+ * record of what the change was composed against.
+ *
+ * Replaying a mutation without knowing the state it was based on means applying
+ * it blindly: whatever changed on the server in the meantime is overwritten,
+ * silently, with nobody able to tell it happened.
+ *
+ * A baseline is available when the record is in the local cache — read through
+ * a query, a single fetch, or seen over the socket — or when it was created
+ * offline and its insert is still queued. It is unavailable when the record has
+ * never been seen on this device, so read it first, or make the change while
+ * online where the server arbitrates directly.
+ *
+ * Deliberate rather than lenient. Queueing these anyway would mean most offline
+ * updates are conflict-safe and some quietly are not, which is a worse guarantee
+ * than a clear refusal.
+ */
+export class KoolbaseOfflineBaselineUnavailableError extends KoolbaseError {
+    constructor(message) {
+        super(message, 'offline_baseline_unavailable');
+        this.name = 'KoolbaseOfflineBaselineUnavailableError';
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}

package/dist/esm/flags.d.ts

@@ -0,0 +1,15 @@
+import { KoolbaseConfig, VersionCheckResult } from './types.js';
+export declare class KoolbaseFlags {
+    private config;
+    private payload;
+    private deviceId;
+    constructor(config: KoolbaseConfig, deviceId: string);
+    fetch(appVersion: string, platform: string): Promise<void>;
+    isEnabled(key: string): boolean;
+    getString(key: string, fallback?: string): string;
+    getNumber(key: string, fallback?: number): number;
+    getBool(key: string, fallback?: boolean): boolean;
+    checkVersion(currentVersion: string): VersionCheckResult;
+    private parseVersion;
+    private stableHash;
+}

package/dist/esm/flags.js

@@ -0,0 +1,72 @@
+export class KoolbaseFlags {
+    constructor(config, deviceId) {
+        this.payload = null;
+        this.config = config;
+        this.deviceId = deviceId;
+    }
+    async fetch(appVersion, platform) {
+        try {
+            const res = await fetch(`${this.config.baseUrl}/v1/bootstrap?public_key=${this.config.publicKey}&device_id=${this.deviceId}&app_version=${appVersion}&platform=${platform}`);
+            if (res.ok) {
+                this.payload = await res.json();
+            }
+        }
+        catch (_) { }
+    }
+    isEnabled(key) {
+        const flag = this.payload?.flags[key];
+        if (!flag || !flag.enabled || flag.kill_switch)
+            return false;
+        const bucket = this.stableHash(`${this.deviceId}:${key}`) % 100;
+        return bucket < flag.rollout_percentage;
+    }
+    getString(key, fallback = '') {
+        const val = this.payload?.config[key];
+        return val !== undefined ? String(val) : fallback;
+    }
+    getNumber(key, fallback = 0) {
+        const val = this.payload?.config[key];
+        return typeof val === 'number' ? val : Number(val) || fallback;
+    }
+    getBool(key, fallback = false) {
+        const val = this.payload?.config[key];
+        if (typeof val === 'boolean')
+            return val;
+        return val === 'true' ? true : fallback;
+    }
+    checkVersion(currentVersion) {
+        const policy = this.payload?.version;
+        if (!policy?.min_version) {
+            return { status: 'up_to_date', message: '', latestVersion: '' };
+        }
+        const current = this.parseVersion(currentVersion);
+        const min = this.parseVersion(policy.min_version);
+        const latest = this.parseVersion(policy.latest_version);
+        if (current < min) {
+            return {
+                status: 'force_update',
+                message: policy.update_message,
+                latestVersion: policy.latest_version,
+            };
+        }
+        if (policy.latest_version && current < latest) {
+            return {
+                status: policy.force_update ? 'force_update' : 'soft_update',
+                message: policy.update_message,
+                latestVersion: policy.latest_version,
+            };
+        }
+        return { status: 'up_to_date', message: '', latestVersion: policy.latest_version };
+    }
+    parseVersion(v) {
+        const parts = v.split('.').map(Number);
+        return (parts[0] ?? 0) * 10000 + (parts[1] ?? 0) * 100 + (parts[2] ?? 0);
+    }
+    stableHash(s) {
+        let hash = 0;
+        for (let i = 0; i < s.length; i++) {
+            hash = (Math.imul(31, hash) + s.charCodeAt(i)) | 0;
+        }
+        return Math.abs(hash);
+    }
+}

package/dist/esm/function-errors.d.ts

@@ -0,0 +1,51 @@
+import { KoolbaseError } from './errors.js';
+/**
+ * A Function call did not succeed.
+ *
+ * Every failure used to be a bare `Error`, so an application could only match on
+ * message text — and a missing Function, a caller without permission, a Function
+ * that threw, and an exhausted plan limit all looked alike, though they call for
+ * entirely different responses.
+ */
+export declare class FunctionInvokeError extends KoolbaseError {
+    statusCode?: number;
+    constructor(message: string, statusCode?: number, code?: string);
+}
+/** No Function by that name is deployed to this project. */
+export declare class FunctionNotFoundError extends FunctionInvokeError {
+    constructor(message: string);
+}
+/**
+ * The caller may not invoke this Function.
+ *
+ * Distinct from an authentication failure: the credentials were accepted and
+ * this caller is not permitted. Retrying will not help, and signing the user out
+ * would be wrong.
+ */
+export declare class FunctionPermissionError extends FunctionInvokeError {
+    constructor(message: string);
+}
+/** The Function rejected its arguments. */
+export declare class FunctionValidationError extends FunctionInvokeError {
+    constructor(message: string);
+}
+/**
+ * The project's Function invocations are used up.
+ *
+ * Nothing about the call is wrong — retrying will not help until the plan
+ * allows it. The one failure here fixed by changing a plan rather than code.
+ */
+export declare class FunctionQuotaExceededError extends FunctionInvokeError {
+    constructor(message: string);
+}
+/**
+ * The Function ran and threw.
+ *
+ * The message is the Function's own, not the platform's — it comes from the code
+ * that was deployed.
+ */
+export declare class FunctionExecutionError extends FunctionInvokeError {
+    constructor(message: string, statusCode?: number);
+}
+/** Builds the right error for a failed invocation. */
+export declare function functionInvokeError(status: number, message: string): KoolbaseError;

package/dist/esm/function-errors.js

@@ -0,0 +1,93 @@
+import { KoolbaseError, KoolbaseUnauthenticatedError } from './errors.js';
+/**
+ * A Function call did not succeed.
+ *
+ * Every failure used to be a bare `Error`, so an application could only match on
+ * message text — and a missing Function, a caller without permission, a Function
+ * that threw, and an exhausted plan limit all looked alike, though they call for
+ * entirely different responses.
+ */
+export class FunctionInvokeError extends KoolbaseError {
+    constructor(message, statusCode, code) {
+        super(message, code);
+        this.statusCode = statusCode;
+        this.name = 'FunctionInvokeError';
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/** No Function by that name is deployed to this project. */
+export class FunctionNotFoundError extends FunctionInvokeError {
+    constructor(message) {
+        super(message, 404, 'not_found');
+        this.name = 'FunctionNotFoundError';
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/**
+ * The caller may not invoke this Function.
+ *
+ * Distinct from an authentication failure: the credentials were accepted and
+ * this caller is not permitted. Retrying will not help, and signing the user out
+ * would be wrong.
+ */
+export class FunctionPermissionError extends FunctionInvokeError {
+    constructor(message) {
+        super(message, 403, 'permission_denied');
+        this.name = 'FunctionPermissionError';
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/** The Function rejected its arguments. */
+export class FunctionValidationError extends FunctionInvokeError {
+    constructor(message) {
+        super(message, 400, 'validation_error');
+        this.name = 'FunctionValidationError';
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/**
+ * The project's Function invocations are used up.
+ *
+ * Nothing about the call is wrong — retrying will not help until the plan
+ * allows it. The one failure here fixed by changing a plan rather than code.
+ */
+export class FunctionQuotaExceededError extends FunctionInvokeError {
+    constructor(message) {
+        super(message, 402, 'limit_reached');
+        this.name = 'FunctionQuotaExceededError';
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/**
+ * The Function ran and threw.
+ *
+ * The message is the Function's own, not the platform's — it comes from the code
+ * that was deployed.
+ */
+export class FunctionExecutionError extends FunctionInvokeError {
+    constructor(message, statusCode) {
+        super(message, statusCode, 'execution_failed');
+        this.name = 'FunctionExecutionError';
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+/** Builds the right error for a failed invocation. */
+export function functionInvokeError(status, message) {
+    switch (status) {
+        case 401:
+            // Not a Function failure. A rejected credential stops the whole SDK
+            // working, so it raises the shared type.
+            return new KoolbaseUnauthenticatedError(message);
+        case 403:
+            return new FunctionPermissionError(message);
+        case 404:
+            return new FunctionNotFoundError(message);
+        case 400:
+            return new FunctionValidationError(message);
+        case 402:
+            return new FunctionQuotaExceededError(message);
+    }
+    if (status >= 500)
+        return new FunctionExecutionError(message, status);
+    return new FunctionInvokeError(message, status);
+}

package/dist/esm/functions.d.ts

@@ -0,0 +1,15 @@
+import { KoolbaseConfig, FunctionInvokeResult, DeployOptions, DeployResult } from './types.js';
+export declare class KoolbaseFunctions {
+    private config;
+    private getUserAccessToken?;
+    /**
+     * Called when the server rejects the caller's credentials.
+     *
+     * A session stops working for the whole SDK at once, so an app whose failing
+     * call happens to be a Function invoke must not keep believing it is signed in.
+     */
+    private onSessionExpired?;
+    constructor(config: KoolbaseConfig, getUserAccessToken?: () => Promise<string | null>, onSessionExpired?: () => Promise<void>);
+    deploy(options: DeployOptions): Promise<DeployResult>;
+    invoke(name: string, body?: Record<string, unknown>): Promise<FunctionInvokeResult>;
+}

package/dist/esm/functions.js

@@ -0,0 +1,79 @@
+import { functionInvokeError } from './function-errors.js';
+import { KoolbaseUnauthenticatedError } from './errors.js';
+import { FunctionRuntime, } from './types.js';
+export class KoolbaseFunctions {
+    constructor(config, getUserAccessToken, onSessionExpired) {
+        this.config = config;
+        this.onSessionExpired = onSessionExpired;
+        this.getUserAccessToken = getUserAccessToken;
+    }
+    // ─── Deploy ────────────────────────────────────────────────────────────────
+    async deploy(options) {
+        const runtime = options.runtime ?? FunctionRuntime.Deno;
+        const res = await fetch(`${this.config.baseUrl}/v1/sdk/functions/deploy`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'x-api-key': this.config.publicKey,
+            },
+            body: JSON.stringify({
+                name: options.name,
+                code: options.code,
+                runtime,
+                timeout_ms: options.timeoutMs ?? 10000,
+            }),
+        });
+        const data = await res.json().catch(() => null);
+        if (!res.ok) {
+            const message = data?.error ??
+                'Function deploy failed';
+            const err = functionInvokeError(res.status, message);
+            if (err instanceof KoolbaseUnauthenticatedError) {
+                await this.onSessionExpired?.();
+            }
+            throw err;
+        }
+        const d = data;
+        return {
+            id: d.id,
+            name: d.name,
+            runtime: d.runtime,
+            version: d.version,
+            isActive: d.is_active,
+            timeoutMs: d.timeout_ms,
+            lastDeployedAt: d.last_deployed_at,
+        };
+    }
+    // ─── Invoke ────────────────────────────────────────────────────────────────
+    async invoke(name, body) {
+        const headers = {
+            'Content-Type': 'application/json',
+            'x-api-key': this.config.publicKey,
+        };
+        const userToken = await this.getUserAccessToken?.();
+        if (userToken) {
+            headers['Authorization'] = `Bearer ${userToken}`;
+        }
+        const res = await fetch(`${this.config.baseUrl}/v1/sdk/functions/${name}`, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({ body: body ?? {} }),
+        });
+        const data = await res.json().catch(() => null);
+        const success = res.status >= 200 && res.status < 300;
+        if (!success) {
+            const message = data?.error ??
+                'Function invocation failed';
+            const err = functionInvokeError(res.status, message);
+            if (err instanceof KoolbaseUnauthenticatedError) {
+                await this.onSessionExpired?.();
+            }
+            throw err;
+        }
+        return {
+            statusCode: res.status,
+            data: data,
+            success,
+        };
+    }
+}