@spacelr/sdk 0.1.9 → 0.1.10

package/dist/index.d.mts

@@ -744,9 +744,15 @@ interface FunctionInvokeOptions {
     /** Webhook secret — used for `webhook` and `hybrid` invokeMode. */
     secret?: string;
     /**
-     * If true, the SDK attaches the currently signed-in user's bearer token
-     * via `Authorization` (managed by the SDK's TokenManager). Use for
-     * `authenticated`, `hybrid`, or `public` invokeMode.
+     * Whether to attach the signed-in user's bearer token via `Authorization`
+     * (managed by the SDK's TokenManager).
+     *
+     * Default: `true` when no `secret` is provided, `false` when `secret` is
+     * set. Override explicitly for the hybrid case (provide both) or to
+     * suppress the header even when logged in.
+     *
+     * If `true` but the user is not signed in, the header is simply omitted —
+     * safe for `public` invokeMode.
      */
     authenticated?: boolean;
     payload?: Record<string, unknown>;
@@ -761,12 +767,17 @@ declare class FunctionsModule {
     constructor(http: HttpClient);
     /**
      * Invoke a function.
-     * Calls POST /api/v1/functions/:projectId/:functionId/invoke
+     * Calls POST `/functions/:projectId/:functionId/invoke`, resolved against
+     * `config.apiUrl` (which already carries the `/api/v1` prefix).
+     *
+     * Auth defaults, based on `invokeMode` semantics:
+     *  - webhook:       pass `secret` → Authorization is NOT attached
+     *  - authenticated: pass nothing  → Authorization IS attached (from token manager)
+     *  - public:        pass nothing  → Authorization is attached if logged in, else omitted
+     *  - hybrid:        pass both `secret` and `authenticated: true`
      *
-     * Provide `secret` for webhook/hybrid functions, `authenticated: true` for
-     * JWT-based invocation, or both for hybrid (JWT wins). Public mode needs
-     * neither, though `authenticated: true` still populates `event.auth` inside
-     * the function.
+     * To force a specific behaviour, set `authenticated` explicitly — it wins
+     * over the `secret`-based default.
      */
     invoke(projectId: string, functionId: string, options?: FunctionInvokeOptions): Promise<FunctionInvokeResult>;
 }

package/dist/index.d.ts

@@ -744,9 +744,15 @@ interface FunctionInvokeOptions {
     /** Webhook secret — used for `webhook` and `hybrid` invokeMode. */
     secret?: string;
     /**
-     * If true, the SDK attaches the currently signed-in user's bearer token
-     * via `Authorization` (managed by the SDK's TokenManager). Use for
-     * `authenticated`, `hybrid`, or `public` invokeMode.
+     * Whether to attach the signed-in user's bearer token via `Authorization`
+     * (managed by the SDK's TokenManager).
+     *
+     * Default: `true` when no `secret` is provided, `false` when `secret` is
+     * set. Override explicitly for the hybrid case (provide both) or to
+     * suppress the header even when logged in.
+     *
+     * If `true` but the user is not signed in, the header is simply omitted —
+     * safe for `public` invokeMode.
      */
     authenticated?: boolean;
     payload?: Record<string, unknown>;
@@ -761,12 +767,17 @@ declare class FunctionsModule {
     constructor(http: HttpClient);
     /**
      * Invoke a function.
-     * Calls POST /api/v1/functions/:projectId/:functionId/invoke
+     * Calls POST `/functions/:projectId/:functionId/invoke`, resolved against
+     * `config.apiUrl` (which already carries the `/api/v1` prefix).
+     *
+     * Auth defaults, based on `invokeMode` semantics:
+     *  - webhook:       pass `secret` → Authorization is NOT attached
+     *  - authenticated: pass nothing  → Authorization IS attached (from token manager)
+     *  - public:        pass nothing  → Authorization is attached if logged in, else omitted
+     *  - hybrid:        pass both `secret` and `authenticated: true`
      *
-     * Provide `secret` for webhook/hybrid functions, `authenticated: true` for
-     * JWT-based invocation, or both for hybrid (JWT wins). Public mode needs
-     * neither, though `authenticated: true` still populates `event.auth` inside
-     * the function.
+     * To force a specific behaviour, set `authenticated` explicitly — it wins
+     * over the `secret`-based default.
      */
     invoke(projectId: string, functionId: string, options?: FunctionInvokeOptions): Promise<FunctionInvokeResult>;
 }

package/dist/index.js

@@ -1773,24 +1773,31 @@ var FunctionsModule = class {
   }
   /**
    * Invoke a function.
-   * Calls POST /api/v1/functions/:projectId/:functionId/invoke
+   * Calls POST `/functions/:projectId/:functionId/invoke`, resolved against
+   * `config.apiUrl` (which already carries the `/api/v1` prefix).
    *
-   * Provide `secret` for webhook/hybrid functions, `authenticated: true` for
-   * JWT-based invocation, or both for hybrid (JWT wins). Public mode needs
-   * neither, though `authenticated: true` still populates `event.auth` inside
-   * the function.
+   * Auth defaults, based on `invokeMode` semantics:
+   *  - webhook:       pass `secret` → Authorization is NOT attached
+   *  - authenticated: pass nothing  → Authorization IS attached (from token manager)
+   *  - public:        pass nothing  → Authorization is attached if logged in, else omitted
+   *  - hybrid:        pass both `secret` and `authenticated: true`
+   *
+   * To force a specific behaviour, set `authenticated` explicitly — it wins
+   * over the `secret`-based default.
    */
   async invoke(projectId, functionId, options = {}) {
+    const hasSecret = (options.secret?.length ?? 0) > 0;
     const headers = {};
-    if (options.secret) {
+    if (hasSecret) {
       headers["X-Webhook-Secret"] = options.secret;
     }
+    const authenticated = options.authenticated ?? !hasSecret;
     return this.http.request({
       method: "POST",
-      path: `/api/v1/functions/${encodeURIComponent(projectId)}/${encodeURIComponent(functionId)}/invoke`,
+      path: `/functions/${encodeURIComponent(projectId)}/${encodeURIComponent(functionId)}/invoke`,
       headers,
       body: options.payload ?? {},
-      authenticated: options.authenticated ?? false
+      authenticated
     });
   }
 };