@spacelr/sdk 0.1.9 → 0.1.10

package/dist/index.mjs

@@ -1741,24 +1741,31 @@ var FunctionsModule = class {
   }
   /**
    * Invoke a function.
-   * Calls POST /api/v1/functions/:projectId/:functionId/invoke
+   * Calls POST `/functions/:projectId/:functionId/invoke`, resolved against
+   * `config.apiUrl` (which already carries the `/api/v1` prefix).
    *
-   * Provide `secret` for webhook/hybrid functions, `authenticated: true` for
-   * JWT-based invocation, or both for hybrid (JWT wins). Public mode needs
-   * neither, though `authenticated: true` still populates `event.auth` inside
-   * the function.
+   * Auth defaults, based on `invokeMode` semantics:
+   *  - webhook:       pass `secret` → Authorization is NOT attached
+   *  - authenticated: pass nothing  → Authorization IS attached (from token manager)
+   *  - public:        pass nothing  → Authorization is attached if logged in, else omitted
+   *  - hybrid:        pass both `secret` and `authenticated: true`
+   *
+   * To force a specific behaviour, set `authenticated` explicitly — it wins
+   * over the `secret`-based default.
    */
   async invoke(projectId, functionId, options = {}) {
+    const hasSecret = (options.secret?.length ?? 0) > 0;
     const headers = {};
-    if (options.secret) {
+    if (hasSecret) {
       headers["X-Webhook-Secret"] = options.secret;
     }
+    const authenticated = options.authenticated ?? !hasSecret;
     return this.http.request({
       method: "POST",
-      path: `/api/v1/functions/${encodeURIComponent(projectId)}/${encodeURIComponent(functionId)}/invoke`,
+      path: `/functions/${encodeURIComponent(projectId)}/${encodeURIComponent(functionId)}/invoke`,
       headers,
       body: options.payload ?? {},
-      authenticated: options.authenticated ?? false
+      authenticated
     });
   }
 };