@proveanything/smartlinks 2.0.21 → 2.0.22

package/dist/api/functions.d.ts

@@ -8,9 +8,16 @@ export interface FunctionListEntry {
 export interface FunctionListResponse {
     functions: FunctionListEntry[];
 }
-/** Options for a function call. `appId` scopes resolution to one app (recommended). */
+/**
+ * Options for a function call.
+ * - `appId` scopes resolution to one app (recommended; falls back to the SDK app context).
+ * - `channel` selects which release to run when addressing an app that is NOT enabled on the
+ *   collection (enablement isn't required — the app is resolved directly by id). Defaults to
+ *   `stable` server-side, so pass `channel: 'dev'` to test a dev build before installing it.
+ */
 export interface FunctionCallOptions {
     appId?: string;
+    channel?: string;
 }
 export declare namespace functions {
     /**

package/dist/api/functions.js

@@ -14,13 +14,15 @@
 // which the server resolves by bare name and REJECTS with 409 AMBIGUOUS_FUNCTION when more than one
 // installed app defines that name. Always prefer an appId.
 import { post, request, getAppContext } from "../http.js";
-function fnPath(surface, collectionId, name, appId) {
+function fnPath(surface, collectionId, name, opts = {}) {
+    var _a;
     const c = encodeURIComponent(collectionId);
     const n = encodeURIComponent(name);
-    const app = appId !== null && appId !== void 0 ? appId : getAppContext();
+    const app = (_a = opts.appId) !== null && _a !== void 0 ? _a : getAppContext();
+    const q = opts.channel ? `?channel=${encodeURIComponent(opts.channel)}` : '';
     return app
-        ? `/${surface}/collection/${c}/app/${encodeURIComponent(app)}/functions/${n}`
-        : `/${surface}/collection/${c}/functions/${n}`; // deprecated flat alias
+        ? `/${surface}/collection/${c}/app/${encodeURIComponent(app)}/functions/${n}${q}`
+        : `/${surface}/collection/${c}/functions/${n}${q}`; // deprecated flat alias
 }
 export var functions;
 (function (functions) {
@@ -35,7 +37,7 @@ export var functions;
      * await SL.functions.call(collectionId, 'pressCounter', {}, { appId: 'my-counter-app' })
      */
     async function call(collectionId, name, body = {}, opts = {}) {
-        return post(fnPath('public', collectionId, name, opts.appId), body);
+        return post(fnPath('public', collectionId, name, opts), body);
     }
     functions.call = call;
     /**
@@ -43,7 +45,7 @@ export var functions;
      * App-scoped: `POST /admin/collection/:c/app/:appId/functions/:name`.
      */
     async function callAdmin(collectionId, name, body = {}, opts = {}) {
-        return post(fnPath('admin', collectionId, name, opts.appId), body);
+        return post(fnPath('admin', collectionId, name, opts), body);
     }
     functions.callAdmin = callAdmin;
     /**
@@ -54,9 +56,10 @@ export var functions;
         var _a;
         const c = encodeURIComponent(collectionId);
         const app = (_a = opts.appId) !== null && _a !== void 0 ? _a : getAppContext();
+        const q = opts.channel ? `?channel=${encodeURIComponent(opts.channel)}` : '';
         const path = app
-            ? `/public/collection/${c}/app/${encodeURIComponent(app)}/functions`
-            : `/public/collection/${c}/functions`;
+            ? `/public/collection/${c}/app/${encodeURIComponent(app)}/functions${q}`
+            : `/public/collection/${c}/functions${q}`;
         return request(path);
     }
     functions.list = list;

package/dist/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 2.0.21  |  Generated: 2026-09-25T17:47:14.766Z
+Version: 2.0.22  |  Generated: 2026-09-25T18:07:22.478Z
 
 This is a concise summary of all available API functions and types.
 
@@ -8969,7 +8969,7 @@ interface FunctionListResponse {
 **FunctionCallOptions** (interface)
 ```typescript
 interface FunctionCallOptions {
-  appId?: string
+  appId?: string; channel?: string
 }
 ```
 

package/dist/docs/server-functions.md

@@ -248,10 +248,21 @@ To call a *different* app's function, pass the appId explicitly:
 await SL.functions.call(collectionId, 'pressCounter', {}, { appId: 'some-other-app' })
 ```
 
+**The app does NOT have to be enabled on the collection.** Because the appId is explicit, the
+function is resolved directly from the app's release — so you can test an app on any collection
+before installing it (and without it showing up in that collection's menus). Enabling an app is
+currently just a UX courtesy (dropdowns/menus), not a gate on running its functions. For a build
+that isn't the default `stable` channel — e.g. a **dev** app you haven't installed — pass the
+channel:
+
+```ts
+await SL.functions.call(collectionId, 'pressCounter', {}, { appId: 'my-counter-app', channel: 'dev' })
+```
+
 If no appId is available (not set on init, none passed), the call falls back to the **deprecated
-flat path** `/collection/:c/functions/:name`, which the server resolves by bare name and **rejects
-with `409 AMBIGUOUS_FUNCTION`** when more than one installed app defines that name (a first-party
-builtin still wins). Always prefer an appId.
+flat path** `/collection/:c/functions/:name`, which searches only the collection's **enabled** apps,
+resolves by bare name, and **rejects with `409 AMBIGUOUS_FUNCTION`** when more than one defines that
+name (a first-party builtin still wins). Always prefer an appId.
 
 > There is no such thing as an app-less function. First-party builtins (e.g. the `functions.ping`
 > diagnostic) belong to the reserved `smartlinks` app. A "global" function is just an app enabled on
@@ -376,10 +387,21 @@ POST /public/collection/:collectionId/app/:appId/functions/:name   # visibility:
 GET  /{admin|public}/collection/:collectionId/app/:appId/functions # list this app's functions on the surface
 ```
 
+The app-scoped route resolves the app **directly by id**, so the app need not be enabled on the
+collection — handy for testing an un-installed (dev) app. Add `?channel=dev` (default `stable`) to
+pick the release. Enablement (`appConfig.apps[]`) currently only controls menus/discovery, not
+whether a function can run.
+
 The bare-name form (`/collection/:c/functions/:name`, no `/app/:appId`) is a **deprecated alias**:
-it resolves by name across all installed apps, lets a first-party builtin win, and returns
-`409 AMBIGUOUS_FUNCTION` when two apps define the same name. Prefer the app-scoped route (the SDK
-emits it automatically once an appId is set — see "Calling a function from your app").
+it searches only the collection's **enabled** apps, resolves by name, lets a first-party builtin
+win, and returns `409 AMBIGUOUS_FUNCTION` when two enabled apps define the same name. Prefer the
+app-scoped route (the SDK emits it automatically once an appId is set — see "Calling a function
+from your app").
+
+> **Security note (first-party model, today):** because enablement is not an auth gate, any app's
+> function can be invoked on any collection by id. That's fine while all apps are first-party and
+> trusted. When untrusted third-party apps arrive, gate *elevated* (`public` + `collection`)
+> invocation of a **non-enabled** app behind install/consent — the app-scoped resolver is the seam.
 
 The request body is delivered to the handler as `event.body` (query string as
 `event.query`). A function only runs on its own surface — calling an `admin` function on

package/dist/openapi.yaml

@@ -29290,7 +29290,8 @@ components:
       type: object
       properties:
         appId:
-          type: string
+          type: object
+          additionalProperties: true
     AllocateSequenceInput:
       type: object
       properties:

package/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 2.0.21  |  Generated: 2026-09-25T17:47:14.766Z
+Version: 2.0.22  |  Generated: 2026-09-25T18:07:22.478Z
 
 This is a concise summary of all available API functions and types.
 
@@ -8969,7 +8969,7 @@ interface FunctionListResponse {
 **FunctionCallOptions** (interface)
 ```typescript
 interface FunctionCallOptions {
-  appId?: string
+  appId?: string; channel?: string
 }
 ```
 

package/docs/server-functions.md

@@ -248,10 +248,21 @@ To call a *different* app's function, pass the appId explicitly:
 await SL.functions.call(collectionId, 'pressCounter', {}, { appId: 'some-other-app' })
 ```
 
+**The app does NOT have to be enabled on the collection.** Because the appId is explicit, the
+function is resolved directly from the app's release — so you can test an app on any collection
+before installing it (and without it showing up in that collection's menus). Enabling an app is
+currently just a UX courtesy (dropdowns/menus), not a gate on running its functions. For a build
+that isn't the default `stable` channel — e.g. a **dev** app you haven't installed — pass the
+channel:
+
+```ts
+await SL.functions.call(collectionId, 'pressCounter', {}, { appId: 'my-counter-app', channel: 'dev' })
+```
+
 If no appId is available (not set on init, none passed), the call falls back to the **deprecated
-flat path** `/collection/:c/functions/:name`, which the server resolves by bare name and **rejects
-with `409 AMBIGUOUS_FUNCTION`** when more than one installed app defines that name (a first-party
-builtin still wins). Always prefer an appId.
+flat path** `/collection/:c/functions/:name`, which searches only the collection's **enabled** apps,
+resolves by bare name, and **rejects with `409 AMBIGUOUS_FUNCTION`** when more than one defines that
+name (a first-party builtin still wins). Always prefer an appId.
 
 > There is no such thing as an app-less function. First-party builtins (e.g. the `functions.ping`
 > diagnostic) belong to the reserved `smartlinks` app. A "global" function is just an app enabled on
@@ -376,10 +387,21 @@ POST /public/collection/:collectionId/app/:appId/functions/:name   # visibility:
 GET  /{admin|public}/collection/:collectionId/app/:appId/functions # list this app's functions on the surface
 ```
 
+The app-scoped route resolves the app **directly by id**, so the app need not be enabled on the
+collection — handy for testing an un-installed (dev) app. Add `?channel=dev` (default `stable`) to
+pick the release. Enablement (`appConfig.apps[]`) currently only controls menus/discovery, not
+whether a function can run.
+
 The bare-name form (`/collection/:c/functions/:name`, no `/app/:appId`) is a **deprecated alias**:
-it resolves by name across all installed apps, lets a first-party builtin win, and returns
-`409 AMBIGUOUS_FUNCTION` when two apps define the same name. Prefer the app-scoped route (the SDK
-emits it automatically once an appId is set — see "Calling a function from your app").
+it searches only the collection's **enabled** apps, resolves by name, lets a first-party builtin
+win, and returns `409 AMBIGUOUS_FUNCTION` when two enabled apps define the same name. Prefer the
+app-scoped route (the SDK emits it automatically once an appId is set — see "Calling a function
+from your app").
+
+> **Security note (first-party model, today):** because enablement is not an auth gate, any app's
+> function can be invoked on any collection by id. That's fine while all apps are first-party and
+> trusted. When untrusted third-party apps arrive, gate *elevated* (`public` + `collection`)
+> invocation of a **non-enabled** app behind install/consent — the app-scoped resolver is the seam.
 
 The request body is delivered to the handler as `event.body` (query string as
 `event.query`). A function only runs on its own surface — calling an `admin` function on

package/openapi.yaml

@@ -29290,7 +29290,8 @@ components:
       type: object
       properties:
         appId:
-          type: string
+          type: object
+          additionalProperties: true
     AllocateSequenceInput:
       type: object
       properties:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proveanything/smartlinks",
-  "version": "2.0.21",
+  "version": "2.0.22",
   "description": "Official JavaScript/TypeScript SDK for the Smartlinks API",
   "type": "module",
   "main": "dist/index.js",