@proveanything/smartlinks 2.0.40 → 2.0.42

package/dist/api/secrets.d.ts

@@ -1,8 +1,28 @@
 import type { SecretMeta, SecretList, SetSecretInput, SetSecretResult, ListSecretsQuery } from "../types/integrations.js";
+export interface AppSecretOptions {
+    /** The app whose secret this is. Defaults to the SDK's app context (`initializeApi({ appId })`). */
+    appId?: string;
+}
 export declare namespace secrets {
+    /**
+     * Save this app's secret `name` on the collection (create or replace) — what the app's server
+     * functions read with `ctx.secrets.get(name)` (declare `secrets:<name>` in the manifest). Call it
+     * from your admin screen as a collection admin. Write-only: returns `{ ref: name, hint }`, never
+     * the value. PUT /app/:appId/secrets/:name
+     */
+    function put(collectionId: string, name: string, value: string, opts?: AppSecretOptions): Promise<SetSecretResult>;
+    /** This app's secrets on the collection: names + masked hints (never values). GET /app/:appId/secrets */
+    function listOwn(collectionId: string, opts?: AppSecretOptions): Promise<SecretList>;
+    /** Delete this app's secret `name`. DELETE /app/:appId/secrets/:name */
+    function removeOwn(collectionId: string, name: string, opts?: AppSecretOptions): Promise<{
+        deleted: boolean;
+    }>;
     /** List secrets as refs + masked hints + metadata (never values). GET /secrets */
     function list(collectionId: string, query?: ListSecretsQuery): Promise<SecretList>;
-    /** Create a secret. POST /secrets → { ref, hint }. Store the ref on a flow. */
+    /**
+     * Create a collection secret with a GENERATED ref. POST /secrets → { ref, hint }. Store the ref on a
+     * flow. For a secret your app's server functions read by name, use `put` instead.
+     */
     function set(collectionId: string, input: SetSecretInput): Promise<SetSecretResult>;
     /** Metadata for one secret (never the value). GET /secrets/:ref */
     function get(collectionId: string, ref: string): Promise<SecretMeta>;

package/dist/api/secrets.js

@@ -5,11 +5,15 @@
 // (refs + masked hints + metadata) and delete, but a value NEVER comes back over the
 // API. It is sealed at rest and resolved server-side only, at execution time.
 //
-// Typical use: `set` a credential, take the returned `ref`, and put it on a flow's
-// config.connection.auth.credentialRef.
+// Two kinds:
+//   - an APP's own secret (`put` / `listOwn` / `removeOwn`): saved by name from the app's admin
+//     screen, read by that app's server functions with ctx.secrets.get('<name>'). Another app's
+//     secret of the same name is a different secret.
+//   - a collection secret (`set` / `rotate` / ...): `set` returns a generated `ref` to put on an
+//     integration flow's config.connection.auth.credentialRef.
 //
-// Endpoints: /admin/collection/:collectionId/secrets
-import { request, post, put, del } from "../http.js";
+// Endpoints: /admin/collection/:collectionId/app/:appId/secrets, /admin/collection/:collectionId/secrets
+import { request, post, put as put_, del, getAppContext } from "../http.js";
 function enc(v) { return encodeURIComponent(v); }
 function encodeQuery(params = {}) {
     const search = new URLSearchParams();
@@ -24,12 +28,42 @@ function encodeQuery(params = {}) {
 export var secrets;
 (function (secrets) {
     const base = (collectionId) => `/admin/collection/${enc(collectionId)}/secrets`;
+    const appBase = (collectionId, opts) => {
+        var _a;
+        const app = (_a = opts.appId) !== null && _a !== void 0 ? _a : getAppContext();
+        if (!app)
+            throw new Error("secrets: no app — pass { appId } or initializeApi({ appId })");
+        return `/admin/collection/${enc(collectionId)}/app/${enc(app)}/secrets`;
+    };
+    /**
+     * Save this app's secret `name` on the collection (create or replace) — what the app's server
+     * functions read with `ctx.secrets.get(name)` (declare `secrets:<name>` in the manifest). Call it
+     * from your admin screen as a collection admin. Write-only: returns `{ ref: name, hint }`, never
+     * the value. PUT /app/:appId/secrets/:name
+     */
+    async function put(collectionId, name, value, opts = {}) {
+        return put_(`${appBase(collectionId, opts)}/${enc(name)}`, { value });
+    }
+    secrets.put = put;
+    /** This app's secrets on the collection: names + masked hints (never values). GET /app/:appId/secrets */
+    async function listOwn(collectionId, opts = {}) {
+        return request(appBase(collectionId, opts));
+    }
+    secrets.listOwn = listOwn;
+    /** Delete this app's secret `name`. DELETE /app/:appId/secrets/:name */
+    async function removeOwn(collectionId, name, opts = {}) {
+        return del(`${appBase(collectionId, opts)}/${enc(name)}`);
+    }
+    secrets.removeOwn = removeOwn;
     /** List secrets as refs + masked hints + metadata (never values). GET /secrets */
     async function list(collectionId, query = {}) {
         return request(`${base(collectionId)}${encodeQuery(query)}`);
     }
     secrets.list = list;
-    /** Create a secret. POST /secrets → { ref, hint }. Store the ref on a flow. */
+    /**
+     * Create a collection secret with a GENERATED ref. POST /secrets → { ref, hint }. Store the ref on a
+     * flow. For a secret your app's server functions read by name, use `put` instead.
+     */
     async function set(collectionId, input) {
         return post(base(collectionId), input);
     }
@@ -41,7 +75,7 @@ export var secrets;
     secrets.get = get;
     /** Rotate/update a secret's value (and optionally name/purpose). PUT /secrets/:ref → { ref, hint } */
     async function rotate(collectionId, ref, input) {
-        return put(`${base(collectionId)}/${enc(ref)}`, input);
+        return put_(`${base(collectionId)}/${enc(ref)}`, input);
     }
     secrets.rotate = rotate;
     /** Soft-delete a secret. DELETE /secrets/:ref */

package/dist/docs/API_SUMMARY.md

@@ -1,6 +1,6 @@
 # Smartlinks API Summary
 
-Version: 2.0.40  |  Generated: 2026-10-05T14:51:09.158Z
+Version: 2.0.42  |  Generated: 2026-10-06T15:17:04.562Z
 
 This is a concise summary of all available API functions and types.
 
@@ -2523,6 +2523,7 @@ interface AppFunctionTrigger {
   type: AppFunctionTriggerType;
   eventTypes?: string[];
   schedule?: string;
+  timezone?: string;
   route?: string;
   methods?: Array<'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE'>;
 }
@@ -2539,6 +2540,7 @@ interface AppFunctionDef {
   elevated?: boolean;
   capabilities?: string[];
   dataScope?: 'collection' | 'global';
+  inputs?: AppFunctionInputs;
   apiVersion?: string;
   handler?: string;
   agent?: AppFunctionAgentExposure;
@@ -2622,6 +2624,27 @@ interface ServerFunctionContext {
   caller: ServerFunctionCaller;
   fetch: typeof fetch;
   log: (message: string, data?: Record<string, any>) => void;
+  inputs: Readonly<ServerFunctionInputs>;
+}
+```
+
+**AppFunctionInputs** (interface)
+```typescript
+interface AppFunctionInputs {
+  entity?: boolean;
+  collection?: boolean;
+  appConfig?: boolean;
+  product?: { from: `body.${string}` | `query.${string}` | 'path' };
+}
+```
+
+**ServerFunctionInputs** (interface)
+```typescript
+interface ServerFunctionInputs {
+  entity?: Record<string, any> | null;
+  collection?: Record<string, any> | null;
+  appConfig?: Record<string, any> | null;
+  product?: Record<string, any> | null;
 }
 ```
 
@@ -9697,6 +9720,15 @@ interface FunctionSiteUrlOptions {
 
 **FunctionCallResult** = `any`
 
+### secrets (api)
+
+**AppSecretOptions** (interface)
+```typescript
+interface AppSecretOptions {
+  appId?: string
+}
+```
+
 ### sequence (api)
 
 **AllocateSequenceInput** (interface)
@@ -12026,11 +12058,20 @@ Fetch + extract a web page: clean markdown, page metadata, and any schema.org JS
 
 ### secrets
 
+**put**(collectionId: string, name: string, value: string, opts: AppSecretOptions = {}) → `Promise<SetSecretResult>`
+Save this app's secret `name` on the collection (create or replace) — what the app's server functions read with `ctx.secrets.get(name)` (declare `secrets:<name>` in the manifest). Call it from your admin screen as a collection admin. Write-only: returns `{ ref: name, hint }`, never the value. PUT /app/:appId/secrets/:name
+
+**listOwn**(collectionId: string, opts: AppSecretOptions = {}) → `Promise<SecretList>`
+This app's secrets on the collection: names + masked hints (never values). GET /app/:appId/secrets
+
+**removeOwn**(collectionId: string, name: string, opts: AppSecretOptions = {}) → `Promise<`
+Delete this app's secret `name`. DELETE /app/:appId/secrets/:name
+
 **list**(collectionId: string, query: ListSecretsQuery = {}) → `Promise<SecretList>`
 List secrets as refs + masked hints + metadata (never values). GET /secrets
 
 **set**(collectionId: string, input: SetSecretInput) → `Promise<SetSecretResult>`
-Create a secret. POST /secrets → { ref, hint }. Store the ref on a flow.
+Create a collection secret with a GENERATED ref. POST /secrets → { ref, hint }. Store the ref on a flow. For a secret your app's server functions read by name, use `put` instead.
 
 **get**(collectionId: string, ref: string) → `Promise<SecretMeta>`
 Metadata for one secret (never the value). GET /secrets/:ref