@hey-research-lab/virtuals-plugin 0.1.0 → 0.1.1

package/CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project uses
 [Semantic Versioning](https://semver.org/).
 
+## 0.1.1 — unreleased (not yet on npm)
+
+- Security: `HEY_API_KEY` from the environment is sent to `https://heyresearch.xyz` only. With a custom
+  `baseUrl` (a mock, a proxy, a local server) no key is sent unless the caller passes `apiKey`
+  explicitly, as the AgentKit, GOAT and CLI integrations already do.
+- Development: vitest 4.1.12.
+
 ## 0.1.0 — 2026-10-13
 
 Initial release.

package/README.md

@@ -93,7 +93,8 @@ Source: HEY Research Lab — heyresearch.xyz · https://heyresearch.xyz/project/
 ```
 
 `heyResearchWorker(options)` takes `apiKey`, `baseUrl` (tests and local mocks only: `https:` or
-`http://localhost`), `fetchImpl`, `timeoutMs`, `client`, and `id` / `name` / `description` /
+`http://localhost`; the environment's `HEY_API_KEY` goes to heyresearch.xyz only, so a custom `baseUrl`
+needs an explicit `apiKey`), `fetchImpl`, `timeoutMs`, `client`, and `id` / `name` / `description` /
 `getEnvironment` overrides. `heyResearchFunctions(options)` returns the five `GameFunction`s for
 your own worker. The framework-neutral reads (`researchProject`, `findProjects`, `recentChanges`,
 `projectTimeline`, `chainOverview`) are exported too.
@@ -170,8 +171,9 @@ changes no status, score or order on HEY.
 
 **GAME (game-node plugins).**
 
-1. Publish this package to npm under `@hey-research-lab` (`npm publish <tarball> --access public`)
-   and push the repository to `github.com/hey-research-lab/hey-virtuals-plugin`.
+1. Done: the package is on npm as
+   [`@hey-research-lab/virtuals-plugin`](https://www.npmjs.com/package/@hey-research-lab/virtuals-plugin)
+   and this repository is public.
 2. Fork [game-by-virtuals/game-node](https://github.com/game-by-virtuals/game-node), add
    `plugins/heyResearchPlugin/` with a `README.md` (install, usage, functions, troubleshooting) and
    the [`plugin_metadata.yml`](plugin_metadata.yml) in this repository (filled from their

package/dist/acp.d.ts

@@ -6,7 +6,9 @@ import { JobRoomEntry, AssetToken } from '@virtuals-protocol/acp-node-v2';
 type HeyPluginOptions = {
     /**
      * A HEY API key from heyresearch.xyz/account. Optional: it lifts the anonymous rate limit and
-     * nothing else. Defaults to `HEY_API_KEY` from the environment. Sent as a bearer token, never logged.
+     * nothing else. Defaults to `HEY_API_KEY` from the environment, which is sent to heyresearch.xyz
+     * only: with a custom `baseUrl`, pass the key here explicitly or none is sent. Sent as a bearer
+     * token, never logged.
      */
     apiKey?: string;
     /**

package/dist/acp.js

@@ -2,7 +2,7 @@
 import { HeyClient } from "@hey-research-lab/sdk";
 
 // src/version.ts
-var VERSION = "0.1.0";
+var VERSION = "0.1.1";
 var INTEGRATION = `hey-virtuals-plugin/${VERSION}`;
 
 // src/client.ts
@@ -25,15 +25,17 @@ function assertBaseUrl(value) {
   }
   return url.origin;
 }
+var HEY_ORIGIN = "https://heyresearch.xyz";
 function envApiKey() {
   const value = typeof process === "undefined" ? void 0 : process.env.HEY_API_KEY;
   return value && value.trim() ? value.trim() : void 0;
 }
 function createHeyClient(options = {}) {
   if (options.client) return options.client;
-  const apiKey = options.apiKey?.trim() || envApiKey();
+  const baseUrl = options.baseUrl ? assertBaseUrl(options.baseUrl) : void 0;
+  const apiKey = options.apiKey?.trim() || (baseUrl === void 0 || baseUrl === HEY_ORIGIN ? envApiKey() : void 0);
   return new HeyClient({
-    ...options.baseUrl ? { baseUrl: assertBaseUrl(options.baseUrl) } : {},
+    ...baseUrl ? { baseUrl } : {},
     ...apiKey ? { apiKey } : {},
     ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {},
     ...options.timeoutMs ? { timeoutMs: options.timeoutMs } : {},

package/dist/index.cjs

@@ -71,7 +71,7 @@ function assertChainId(value) {
 var import_sdk = require("@hey-research-lab/sdk");
 
 // src/version.ts
-var VERSION = "0.1.0";
+var VERSION = "0.1.1";
 var INTEGRATION = `hey-virtuals-plugin/${VERSION}`;
 
 // src/client.ts
@@ -94,15 +94,17 @@ function assertBaseUrl(value) {
   }
   return url.origin;
 }
+var HEY_ORIGIN = "https://heyresearch.xyz";
 function envApiKey() {
   const value = typeof process === "undefined" ? void 0 : process.env.HEY_API_KEY;
   return value && value.trim() ? value.trim() : void 0;
 }
 function createHeyClient(options = {}) {
   if (options.client) return options.client;
-  const apiKey = options.apiKey?.trim() || envApiKey();
+  const baseUrl = options.baseUrl ? assertBaseUrl(options.baseUrl) : void 0;
+  const apiKey = options.apiKey?.trim() || (baseUrl === void 0 || baseUrl === HEY_ORIGIN ? envApiKey() : void 0);
   return new import_sdk.HeyClient({
-    ...options.baseUrl ? { baseUrl: assertBaseUrl(options.baseUrl) } : {},
+    ...baseUrl ? { baseUrl } : {},
     ...apiKey ? { apiKey } : {},
     ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {},
     ...options.timeoutMs ? { timeoutMs: options.timeoutMs } : {},

package/dist/index.d.cts

@@ -5,7 +5,9 @@ import { FetchLike, HeyClient, HeyAgentResponse } from '@hey-research-lab/sdk';
 type HeyPluginOptions = {
     /**
      * A HEY API key from heyresearch.xyz/account. Optional: it lifts the anonymous rate limit and
-     * nothing else. Defaults to `HEY_API_KEY` from the environment. Sent as a bearer token, never logged.
+     * nothing else. Defaults to `HEY_API_KEY` from the environment, which is sent to heyresearch.xyz
+     * only: with a custom `baseUrl`, pass the key here explicitly or none is sent. Sent as a bearer
+     * token, never logged.
      */
     apiKey?: string;
     /**
@@ -154,8 +156,8 @@ declare class UnsupportedChainError extends Error {
 declare function assertChainId(value: unknown): asserts value is typeof CHAIN_ID;
 
 /** The package version; a test holds it equal to package.json. */
-declare const VERSION = "0.1.0";
+declare const VERSION = "0.1.1";
 /** Sent to HEY as `x-hey-integration` so the lab can count this plugin's calls by version. */
-declare const INTEGRATION = "hey-virtuals-plugin/0.1.0";
+declare const INTEGRATION = "hey-virtuals-plugin/0.1.1";
 
 export { ATTRIBUTION, CAIP2, CHAIN_ID, CHAIN_NAME, type ChangesArgs, HEY_FUNCTION_NAMES, HEY_WORKER_DESCRIPTION, HEY_WORKER_ID, HEY_WORKER_NAME, type HeyFunctionName, type HeyFunctionOptions, type HeyOutcome, type HeyPluginOptions, type HeyResearchWorkerOptions, type HeyResult, INTEGRATION, InvalidBaseUrlError, type ReadContext, UnsupportedChainError, VERSION, assertChainId, chainOverview, checkChain, createHeyClient, findProjects, heyEnvironment, heyResearchFunctions, heyResearchWorker, projectTimeline, recentChanges, researchProject, sourceLine, toGameResponse };

package/dist/index.d.ts

@@ -5,7 +5,9 @@ import { FetchLike, HeyClient, HeyAgentResponse } from '@hey-research-lab/sdk';
 type HeyPluginOptions = {
     /**
      * A HEY API key from heyresearch.xyz/account. Optional: it lifts the anonymous rate limit and
-     * nothing else. Defaults to `HEY_API_KEY` from the environment. Sent as a bearer token, never logged.
+     * nothing else. Defaults to `HEY_API_KEY` from the environment, which is sent to heyresearch.xyz
+     * only: with a custom `baseUrl`, pass the key here explicitly or none is sent. Sent as a bearer
+     * token, never logged.
      */
     apiKey?: string;
     /**
@@ -154,8 +156,8 @@ declare class UnsupportedChainError extends Error {
 declare function assertChainId(value: unknown): asserts value is typeof CHAIN_ID;
 
 /** The package version; a test holds it equal to package.json. */
-declare const VERSION = "0.1.0";
+declare const VERSION = "0.1.1";
 /** Sent to HEY as `x-hey-integration` so the lab can count this plugin's calls by version. */
-declare const INTEGRATION = "hey-virtuals-plugin/0.1.0";
+declare const INTEGRATION = "hey-virtuals-plugin/0.1.1";
 
 export { ATTRIBUTION, CAIP2, CHAIN_ID, CHAIN_NAME, type ChangesArgs, HEY_FUNCTION_NAMES, HEY_WORKER_DESCRIPTION, HEY_WORKER_ID, HEY_WORKER_NAME, type HeyFunctionName, type HeyFunctionOptions, type HeyOutcome, type HeyPluginOptions, type HeyResearchWorkerOptions, type HeyResult, INTEGRATION, InvalidBaseUrlError, type ReadContext, UnsupportedChainError, VERSION, assertChainId, chainOverview, checkChain, createHeyClient, findProjects, heyEnvironment, heyResearchFunctions, heyResearchWorker, projectTimeline, recentChanges, researchProject, sourceLine, toGameResponse };

package/dist/index.js

@@ -26,7 +26,7 @@ function assertChainId(value) {
 import { HeyClient } from "@hey-research-lab/sdk";
 
 // src/version.ts
-var VERSION = "0.1.0";
+var VERSION = "0.1.1";
 var INTEGRATION = `hey-virtuals-plugin/${VERSION}`;
 
 // src/client.ts
@@ -49,15 +49,17 @@ function assertBaseUrl(value) {
   }
   return url.origin;
 }
+var HEY_ORIGIN = "https://heyresearch.xyz";
 function envApiKey() {
   const value = typeof process === "undefined" ? void 0 : process.env.HEY_API_KEY;
   return value && value.trim() ? value.trim() : void 0;
 }
 function createHeyClient(options = {}) {
   if (options.client) return options.client;
-  const apiKey = options.apiKey?.trim() || envApiKey();
+  const baseUrl = options.baseUrl ? assertBaseUrl(options.baseUrl) : void 0;
+  const apiKey = options.apiKey?.trim() || (baseUrl === void 0 || baseUrl === HEY_ORIGIN ? envApiKey() : void 0);
   return new HeyClient({
-    ...options.baseUrl ? { baseUrl: assertBaseUrl(options.baseUrl) } : {},
+    ...baseUrl ? { baseUrl } : {},
     ...apiKey ? { apiKey } : {},
     ...options.fetchImpl ? { fetchImpl: options.fetchImpl } : {},
     ...options.timeoutMs ? { timeoutMs: options.timeoutMs } : {},

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hey-research-lab/virtuals-plugin",
-  "version": "0.1.0",
-  "description": "Virtuals Protocol GAME worker and ACP provider scaffold for HEY Research Lab: evidence-backed builder research on Robinhood Chain projects, tickers and contracts — still building, what shipped, what is unknown.",
+  "version": "0.1.1",
+  "description": "Virtuals Protocol GAME worker and ACP provider scaffold for HEY Research Lab: evidence-backed builder research on Robinhood Chain projects, tickers and contracts \u2014 still building, what shipped, what is unknown.",
   "license": "MIT",
   "author": "HEY Research Lab",
   "type": "module",
@@ -59,6 +59,16 @@
   "publishConfig": {
     "access": "public"
   },
+  "packageManager": "pnpm@9.15.1",
+  "scripts": {
+    "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsup",
+    "lint": "eslint .",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "scan": "node scripts/scan.mjs .",
+    "format:check": "prettier --check .",
+    "format": "prettier --write ."
+  },
   "dependencies": {
     "@hey-research-lab/sdk": "^0.2.0"
   },
@@ -82,15 +92,11 @@
     "tsup": "^8.5.1",
     "typescript": "^5.7.2",
     "typescript-eslint": "^8.18.0",
-    "vitest": "^4.1.11"
+    "vitest": "^4.1.12"
   },
-  "scripts": {
-    "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsup",
-    "lint": "eslint .",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
-    "test": "vitest run",
-    "scan": "node scripts/scan.mjs .",
-    "format:check": "prettier --check .",
-    "format": "prettier --write ."
+  "pnpm": {
+    "overrides": {
+      "esbuild": "^0.28.1"
+    }
   }
-}
+}