@secondlayer/sdk 14.0.1 → 14.2.0

package/AGENTS.md

@@ -6,6 +6,12 @@ silently loses or corrupts data.
 
 ## 1. `/v1` reads are open on loopback; `/api` needs the token
 
+The key follows the host. On `https://api.secondlayer.tools` the client sends
+`SECONDLAYER_API_KEY` (`sk-sl_*`) automatically and `INSTANCE_TOKEN` is not
+used. Hosted subgraph sources are event filters and `contract_call` /
+`contract_deploy` only (`422 SOURCE_NOT_HOSTABLE`), and subgraph webhooks are
+self-host only. What follows describes a self-hosted instance.
+
 `sl.index.*`, `sl.streams.*`, `sl.subgraphs.rows`, and the typed `subscribe`
 read `/v1`, open on loopback. Construct the client with no credentials and start reading:
 

package/README.md

@@ -19,7 +19,11 @@ const sl = new SecondLayer({
 });
 ```
 
-Auth, once: `sl.index`, `sl.streams`, `sl.subgraphs.rows`, and the typed
+Hosted: point the client at `https://api.secondlayer.tools` (`SECONDLAYER_API_URL`)
+and it sends `SECONDLAYER_API_KEY` (`sk-sl_*`) automatically. Self-host: use
+`INSTANCE_TOKEN` as below. The key follows the host.
+
+Auth, once (self-hosted instance): `sl.index`, `sl.streams`, `sl.subgraphs.rows`, and the typed
 `subscribe` read `/v1`, which is open on loopback and needs `INSTANCE_TOKEN`
 once the API is bound beyond it. Everything under `sl.subgraphs.*` and `sl.webhooks.*` calls
 `/api`, which needs `INSTANCE_TOKEN` as soon as one is configured, loopback

package/dist/index.d.ts

@@ -153,10 +153,13 @@ type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<
 interface SecondLayerOptions {
 	/** Base URL of the instance API (trailing slashes are stripped). */
 	baseUrl: string;
-	/** Bearer token for authenticated instance requests (`INSTANCE_TOKEN`). */
+	/** Bearer token for authenticated requests. Defaults to
+	*  `SECONDLAYER_API_KEY` on `api.secondlayer.tools`, `INSTANCE_TOKEN`
+	*  elsewhere. */
 	apiKey?: string;
 	/** Hosted account key (`sk-sl_*`). Env `SECONDLAYER_API_KEY`. Used by
-	*  `sl.archive` quote/fetch/credits, never by instance `/v1` or `/api`. */
+	*  `sl.archive` quote/fetch/credits; reaches `/v1` and `/api` only through
+	*  `apiKey` when the base URL is the hosted API. */
 	accountKey?: string;
 	/** Fetch implementation. Tests and edge runtimes can provide their own. */
 	fetchImpl?: FetchLike;
@@ -229,10 +232,15 @@ declare const INSTANCE_TOKEN_ENV = "INSTANCE_TOKEN";
 /** Hosted account key (`sk-sl_*`) for api.secondlayer.tools. */
 declare const ACCOUNT_KEY_ENV = "SECONDLAYER_API_KEY";
 declare function resolveBaseUrl(explicit?: string): string;
-/** Resolve the instance credential. Precedence: explicit `apiKey` (including
-*  `""` for keyless) → `INSTANCE_TOKEN`. Does not read the hosted account key
-*  env vars. Guarded for browsers and edge runtimes. */
-declare function resolveApiKey(apiKey?: string): string | undefined;
+/** True when `url` is the hosted Secondlayer API (`api.secondlayer.tools`). */
+declare function isHostedApiUrl(url: string): boolean;
+/** Resolve the bearer credential; the key follows the host. Precedence:
+*  explicit `apiKey` (including `""` for keyless) → on the hosted API,
+*  `SECONDLAYER_API_KEY`; anywhere else (or with no `baseUrl`),
+*  `INSTANCE_TOKEN`. Never crosses over: the instance token is not sent to the
+*  hosted API and the account key is not sent to an instance. Guarded for
+*  browsers and edge runtimes. */
+declare function resolveApiKey(apiKey?: string, baseUrl?: string): string | undefined;
 /** Resolve the hosted account key for archive quote/fetch/credits.
 *  Precedence: explicit `accountKey` → `SECONDLAYER_API_KEY`. Does not read
 *  `INSTANCE_TOKEN`. */
@@ -3723,4 +3731,4 @@ declare const Cursor: {
 	};
 };
 import { decodeClarityValue, toJsonSafe } from "@secondlayer/shared/streams-rows";
-export { ACCOUNT_KEY_ENV, ActiveSubgraphOperation, ApiError, ArchiveAuthError, ArchiveClient, ArchiveCreditsBalance, ArchiveDataset, ArchiveFetchItem, ArchiveFetchResult, ArchiveFlow, ArchiveGateNotConfiguredError, ArchiveLoadOptions, ArchiveManifest, ArchivePartition, ArchiveQuote, ArchiveSignatureError, ArchiveStatus, ArchiveVerifyInput, ArchiveVerifyRangeStatus, ArchiveVerifyResult, AuthError, BlockEnvelope, BlocksEnvelope, BlocksListParams, BlocksWalkParams, CanonicalEnvelope, CanonicalListParams, CanonicalWalkParams, ChainApplyDeliveryOf, ChainApplyEnvelope, ChainApplyEnvelopeOf, ChainEventEnvelope, ChainFtBurnData, ChainFtMintData, ChainFtTransferData, ChainNftBurnData, ChainNftMintData, ChainNftTransferData, ChainPrintEventData, ChainReorgOrphanedEntry, ChainReorgRollbackDelivery, ChainReorgRollbackEnvelope, ChainStxBurnData, ChainStxLockData, ChainStxMintData, ChainStxTransferData, ChainTestDelivery, ChainTrigger, ChainTriggerType, ChainTxLevelEvent, ChainWebhookDelivery2 as ChainWebhookDelivery, ChainWebhookEnvelope, ConsumerBatchContext, ConsumerHealth, ConsumerSink, ContextAccount, ContextField, ContextFieldError, ContextSnapshot, ContractCallsConsumeParams, ContractCallsEnvelope, ContractCallsListParams, ContractCallsWalkParams, ContractConformance, ContractSummary, Contracts, ContractsEnvelope, ContractsListParams, CreateArchiveClientOptions, CreateWebhookRequest2 as CreateWebhookRequest, CreateWebhookResponse2 as CreateWebhookResponse, Cursor, DEFAULT_REQUEST_TIMEOUT_MS, DOWN_MIN_CONSECUTIVE, DeadRow2 as DeadRow, DecodedEventColumns, DecodedEventRow, DecodedFtBurn, DecodedFtBurnPayload, DecodedFtMint, DecodedFtMintPayload, DecodedFtTransfer, DecodedFtTransferPayload, DecodedNftBurn, DecodedNftBurnPayload, DecodedNftMint, DecodedNftMintPayload, DecodedNftTransfer, DecodedNftTransferPayload, DecodedPrint, DecodedPrintPayload, DecodedPrintValue, DecodedStxBurn, DecodedStxBurnPayload, DecodedStxLock, DecodedStxLockPayload, DecodedStxMint, DecodedStxMintPayload, DecodedStxTransfer, DecodedStxTransferPayload, DeliveryRow2 as DeliveryRow, DoctorEvidence, DoctorFix, DoctorIssue, DoctorIssueCode, DoctorReport, DoctorSeverity, EtagCache, EtagEntry, EventsConsumeParams, EventsEnvelope, EventsListParams, EventsWalkParams, FetchLike2 as FetchLike, FtTransfer, FtTransferEvent, FtTransferPayload2 as FtTransferPayload, FtTransfersEnvelope, FtTransfersListParams, FtTransfersResource, FtTransfersWalkParams, INDEX_MAX_PAGE_SIZE, INSTANCE_TOKEN_ENV, Index, IndexAlwaysFields, IndexBitcoinTip, IndexBlock, IndexBtcReorg, IndexCanonicalBlock, IndexConsumeOptions, IndexContractCall, IndexDiscovery, IndexEvent, IndexEventFields, IndexEventOf, IndexEventType, IndexEventTypeFilters, IndexEventsResource, IndexFeedEnvelope, IndexFeedFetcher, IndexFeedItem, IndexFtBurn, IndexFtMint, IndexFtTransfer, IndexMapDelete, IndexMapInsert, IndexMapSet, IndexMempoolTransaction, IndexNestedContractCall, IndexNftBurn, IndexNftMint, IndexNftTransfer, IndexPostCondition, IndexPox5Event, IndexPox5EventTopic, IndexPoxCycle, IndexPoxCycleSigner, IndexPrint, IndexReorg, IndexRuneBalance, IndexRuneEntry, IndexRuneEvent, IndexRuneEventKind, IndexRuneRefSummary, IndexRuneTerms, IndexSbtcDeposit, IndexSbtcDepositDetail, IndexSbtcEvent, IndexSbtcSummary, IndexSbtcWithdrawal, IndexSbtcWithdrawalDetail, IndexSbtcWithdrawalPhase, IndexStackingAction, IndexStxBurn, IndexStxLock, IndexStxMint, IndexStxTransfer, IndexTip, IndexTransaction, IndexVarSet, InstanceClient, InstanceDiagnosis3 as InstanceDiagnosis, InstanceIssue, InstanceState, InstanceStatus, InsufficientArchiveCreditsError, LOCAL_API_URL, LoadedArchive, MemoryEtagCache, MempoolEnvelope, MempoolListParams, MempoolTransactionEnvelope, MempoolWalkParams, NftTransfer, NftTransferEvent, NftTransferPayload2 as NftTransferPayload, NftTransfersEnvelope, NftTransfersListParams, NftTransfersResource, NftTransfersWalkParams, Pox5EventsConsumeParams, Pox5EventsEnvelope, Pox5EventsListParams, Pox5EventsWalkParams, Pox5Resource, PoxCycleEnvelope, PoxCyclesEnvelope, PoxCyclesListParams, PoxCyclesWalkParams, PoxResource, PrintSchemaResponse, PublicStatus2 as PublicStatus, RateLimitError, ReplayResult2 as ReplayResult, RequestOptions, RewardSet2 as RewardSet, RotateSecretResponse2 as RotateSecretResponse, RuneActivityEnvelope, RuneActivityListParams, RuneActivityWalkParams, RuneApplyDeliveryOf, RuneApplyEnvelope, RuneBalancesEnvelope, RuneBalancesListParams, RuneEnvelope, RuneEtchEntry, RuneEventPayload, RuneEventType, RuneId, RuneRef, RuneStreamsEvent, RunesEnvelope, RunesListParams, RunesResource, SbtcDepositEnvelope, SbtcDepositEvent, SbtcDepositsConsumeParams, SbtcDepositsEnvelope, SbtcDepositsListParams, SbtcDepositsWalkParams, SbtcEventTopic2 as SbtcEventTopic, SbtcEventsConsumeParams, SbtcEventsEnvelope, SbtcEventsListParams, SbtcEventsWalkParams, SbtcResource, SbtcSummaryEnvelope, SbtcWithdrawalEnvelope, SbtcWithdrawalEvent, SbtcWithdrawalStatus, SbtcWithdrawalSweptConfirmedEvent, SbtcWithdrawalsEnvelope, SbtcWithdrawalsListParams, SbtcWithdrawalsWalkParams, SecondLayer, SecondLayerArchive, SecondLayerError, SecondLayerErrorOptions, SecondLayerOptions, SinkTx, StackingEnvelope, StackingListParams, StackingWalkParams, StandardWebhooksHeaders2 as StandardWebhooksHeaders, StreamsBatch, StreamsBatchContext, StreamsBitcoinCanonicalBlock, StreamsBitcoinTip, StreamsCanonicalBlock, StreamsClient, StreamsConsumeBitcoinParams, StreamsConsumeParams, StreamsConsumeStacksParams, StreamsDumpFile, StreamsDumps, StreamsDumpsManifest, StreamsEvent, StreamsEventPayload, StreamsEventType, StreamsEventsBitcoinListParams, StreamsEventsConsumeBitcoinParams, StreamsEventsConsumeParams, StreamsEventsConsumeResult, StreamsEventsEnvelope, StreamsEventsListEnvelope, StreamsEventsListParams, StreamsEventsStacksListParams, StreamsEventsStreamBitcoinParams, StreamsEventsStreamParams, StreamsEventsStreamStacksParams, StreamsEventsSubscribeBitcoinParams, StreamsEventsSubscribeParams, StreamsEventsSubscribeStacksParams, StreamsReorg, StreamsReorgContext, StreamsReorgsListEnvelope, StreamsReorgsListParams, StreamsServerError, StreamsSignatureError, StreamsSubscription, StreamsTip, StreamsWireEvent2 as StreamsWireEvent, SubgraphAgentSchema3 as SubgraphAgentSchema, SubgraphOperationStatus, SubgraphSpecFormat2 as SubgraphSpecFormat, SubgraphSpecOptions3 as SubgraphSpecOptions, Subgraphs, TransactionEnvelope, TransactionProof, TransactionProofVerifyResult, TransactionsEnvelope, TransactionsListParams, TransactionsWalkParams, UpdateWebhookRequest2 as UpdateWebhookRequest, ValidationError, VmStreamsEvent, WalkOptions, WebhookActivity2 as WebhookActivity, WebhookActivityHour, WebhookAuth, WebhookDeliveryDetail2 as WebhookDeliveryDetail, WebhookDetail2 as WebhookDetail, WebhookFormat, WebhookHeaderInput, WebhookKind, WebhookRuntime, WebhookStatus, WebhookSummary2 as WebhookSummary, WebhookTestResult2 as WebhookTestResult, Webhooks, WithSinkTx, buildDoctorReport, buildListIssue, consumeIndexFeed, consumerHealth, contextField, createArchiveClient, createStreamsClient, decode, decodeChainWebhook, decodeClarityValue, decodeFtBurn, decodeFtMint, decodeFtTransfer, decodeNftBurn, decodeNftMint, decodeNftTransfer, decodePrint, decodeStxBurn, decodeStxLock, decodeStxMint, decodeStxTransfer, fetchRewardSet, getSubgraph, isFtBurn, isFtMint, isFtTransfer, isNftBurn, isNftMint, isNftTransfer, isPrint, isStxBurn, isStxLock, isStxMint, isStxTransfer, isSuccessDelivery, parseRetryAfter, resolveAccountKey, resolveApiKey, resolveBaseUrl, shutdownSignal, toJsonSafe, trigger, verifySecondlayerSignature, verify as verifyStandardWebhooksHeaders, verifyTransactionProof, verifyWebhookSignature };
+export { ACCOUNT_KEY_ENV, ActiveSubgraphOperation, ApiError, ArchiveAuthError, ArchiveClient, ArchiveCreditsBalance, ArchiveDataset, ArchiveFetchItem, ArchiveFetchResult, ArchiveFlow, ArchiveGateNotConfiguredError, ArchiveLoadOptions, ArchiveManifest, ArchivePartition, ArchiveQuote, ArchiveSignatureError, ArchiveStatus, ArchiveVerifyInput, ArchiveVerifyRangeStatus, ArchiveVerifyResult, AuthError, BlockEnvelope, BlocksEnvelope, BlocksListParams, BlocksWalkParams, CanonicalEnvelope, CanonicalListParams, CanonicalWalkParams, ChainApplyDeliveryOf, ChainApplyEnvelope, ChainApplyEnvelopeOf, ChainEventEnvelope, ChainFtBurnData, ChainFtMintData, ChainFtTransferData, ChainNftBurnData, ChainNftMintData, ChainNftTransferData, ChainPrintEventData, ChainReorgOrphanedEntry, ChainReorgRollbackDelivery, ChainReorgRollbackEnvelope, ChainStxBurnData, ChainStxLockData, ChainStxMintData, ChainStxTransferData, ChainTestDelivery, ChainTrigger, ChainTriggerType, ChainTxLevelEvent, ChainWebhookDelivery2 as ChainWebhookDelivery, ChainWebhookEnvelope, ConsumerBatchContext, ConsumerHealth, ConsumerSink, ContextAccount, ContextField, ContextFieldError, ContextSnapshot, ContractCallsConsumeParams, ContractCallsEnvelope, ContractCallsListParams, ContractCallsWalkParams, ContractConformance, ContractSummary, Contracts, ContractsEnvelope, ContractsListParams, CreateArchiveClientOptions, CreateWebhookRequest2 as CreateWebhookRequest, CreateWebhookResponse2 as CreateWebhookResponse, Cursor, DEFAULT_REQUEST_TIMEOUT_MS, DOWN_MIN_CONSECUTIVE, DeadRow2 as DeadRow, DecodedEventColumns, DecodedEventRow, DecodedFtBurn, DecodedFtBurnPayload, DecodedFtMint, DecodedFtMintPayload, DecodedFtTransfer, DecodedFtTransferPayload, DecodedNftBurn, DecodedNftBurnPayload, DecodedNftMint, DecodedNftMintPayload, DecodedNftTransfer, DecodedNftTransferPayload, DecodedPrint, DecodedPrintPayload, DecodedPrintValue, DecodedStxBurn, DecodedStxBurnPayload, DecodedStxLock, DecodedStxLockPayload, DecodedStxMint, DecodedStxMintPayload, DecodedStxTransfer, DecodedStxTransferPayload, DeliveryRow2 as DeliveryRow, DoctorEvidence, DoctorFix, DoctorIssue, DoctorIssueCode, DoctorReport, DoctorSeverity, EtagCache, EtagEntry, EventsConsumeParams, EventsEnvelope, EventsListParams, EventsWalkParams, FetchLike2 as FetchLike, FtTransfer, FtTransferEvent, FtTransferPayload2 as FtTransferPayload, FtTransfersEnvelope, FtTransfersListParams, FtTransfersResource, FtTransfersWalkParams, INDEX_MAX_PAGE_SIZE, INSTANCE_TOKEN_ENV, Index, IndexAlwaysFields, IndexBitcoinTip, IndexBlock, IndexBtcReorg, IndexCanonicalBlock, IndexConsumeOptions, IndexContractCall, IndexDiscovery, IndexEvent, IndexEventFields, IndexEventOf, IndexEventType, IndexEventTypeFilters, IndexEventsResource, IndexFeedEnvelope, IndexFeedFetcher, IndexFeedItem, IndexFtBurn, IndexFtMint, IndexFtTransfer, IndexMapDelete, IndexMapInsert, IndexMapSet, IndexMempoolTransaction, IndexNestedContractCall, IndexNftBurn, IndexNftMint, IndexNftTransfer, IndexPostCondition, IndexPox5Event, IndexPox5EventTopic, IndexPoxCycle, IndexPoxCycleSigner, IndexPrint, IndexReorg, IndexRuneBalance, IndexRuneEntry, IndexRuneEvent, IndexRuneEventKind, IndexRuneRefSummary, IndexRuneTerms, IndexSbtcDeposit, IndexSbtcDepositDetail, IndexSbtcEvent, IndexSbtcSummary, IndexSbtcWithdrawal, IndexSbtcWithdrawalDetail, IndexSbtcWithdrawalPhase, IndexStackingAction, IndexStxBurn, IndexStxLock, IndexStxMint, IndexStxTransfer, IndexTip, IndexTransaction, IndexVarSet, InstanceClient, InstanceDiagnosis3 as InstanceDiagnosis, InstanceIssue, InstanceState, InstanceStatus, InsufficientArchiveCreditsError, LOCAL_API_URL, LoadedArchive, MemoryEtagCache, MempoolEnvelope, MempoolListParams, MempoolTransactionEnvelope, MempoolWalkParams, NftTransfer, NftTransferEvent, NftTransferPayload2 as NftTransferPayload, NftTransfersEnvelope, NftTransfersListParams, NftTransfersResource, NftTransfersWalkParams, Pox5EventsConsumeParams, Pox5EventsEnvelope, Pox5EventsListParams, Pox5EventsWalkParams, Pox5Resource, PoxCycleEnvelope, PoxCyclesEnvelope, PoxCyclesListParams, PoxCyclesWalkParams, PoxResource, PrintSchemaResponse, PublicStatus2 as PublicStatus, RateLimitError, ReplayResult2 as ReplayResult, RequestOptions, RewardSet2 as RewardSet, RotateSecretResponse2 as RotateSecretResponse, RuneActivityEnvelope, RuneActivityListParams, RuneActivityWalkParams, RuneApplyDeliveryOf, RuneApplyEnvelope, RuneBalancesEnvelope, RuneBalancesListParams, RuneEnvelope, RuneEtchEntry, RuneEventPayload, RuneEventType, RuneId, RuneRef, RuneStreamsEvent, RunesEnvelope, RunesListParams, RunesResource, SbtcDepositEnvelope, SbtcDepositEvent, SbtcDepositsConsumeParams, SbtcDepositsEnvelope, SbtcDepositsListParams, SbtcDepositsWalkParams, SbtcEventTopic2 as SbtcEventTopic, SbtcEventsConsumeParams, SbtcEventsEnvelope, SbtcEventsListParams, SbtcEventsWalkParams, SbtcResource, SbtcSummaryEnvelope, SbtcWithdrawalEnvelope, SbtcWithdrawalEvent, SbtcWithdrawalStatus, SbtcWithdrawalSweptConfirmedEvent, SbtcWithdrawalsEnvelope, SbtcWithdrawalsListParams, SbtcWithdrawalsWalkParams, SecondLayer, SecondLayerArchive, SecondLayerError, SecondLayerErrorOptions, SecondLayerOptions, SinkTx, StackingEnvelope, StackingListParams, StackingWalkParams, StandardWebhooksHeaders2 as StandardWebhooksHeaders, StreamsBatch, StreamsBatchContext, StreamsBitcoinCanonicalBlock, StreamsBitcoinTip, StreamsCanonicalBlock, StreamsClient, StreamsConsumeBitcoinParams, StreamsConsumeParams, StreamsConsumeStacksParams, StreamsDumpFile, StreamsDumps, StreamsDumpsManifest, StreamsEvent, StreamsEventPayload, StreamsEventType, StreamsEventsBitcoinListParams, StreamsEventsConsumeBitcoinParams, StreamsEventsConsumeParams, StreamsEventsConsumeResult, StreamsEventsEnvelope, StreamsEventsListEnvelope, StreamsEventsListParams, StreamsEventsStacksListParams, StreamsEventsStreamBitcoinParams, StreamsEventsStreamParams, StreamsEventsStreamStacksParams, StreamsEventsSubscribeBitcoinParams, StreamsEventsSubscribeParams, StreamsEventsSubscribeStacksParams, StreamsReorg, StreamsReorgContext, StreamsReorgsListEnvelope, StreamsReorgsListParams, StreamsServerError, StreamsSignatureError, StreamsSubscription, StreamsTip, StreamsWireEvent2 as StreamsWireEvent, SubgraphAgentSchema3 as SubgraphAgentSchema, SubgraphOperationStatus, SubgraphSpecFormat2 as SubgraphSpecFormat, SubgraphSpecOptions3 as SubgraphSpecOptions, Subgraphs, TransactionEnvelope, TransactionProof, TransactionProofVerifyResult, TransactionsEnvelope, TransactionsListParams, TransactionsWalkParams, UpdateWebhookRequest2 as UpdateWebhookRequest, ValidationError, VmStreamsEvent, WalkOptions, WebhookActivity2 as WebhookActivity, WebhookActivityHour, WebhookAuth, WebhookDeliveryDetail2 as WebhookDeliveryDetail, WebhookDetail2 as WebhookDetail, WebhookFormat, WebhookHeaderInput, WebhookKind, WebhookRuntime, WebhookStatus, WebhookSummary2 as WebhookSummary, WebhookTestResult2 as WebhookTestResult, Webhooks, WithSinkTx, buildDoctorReport, buildListIssue, consumeIndexFeed, consumerHealth, contextField, createArchiveClient, createStreamsClient, decode, decodeChainWebhook, decodeClarityValue, decodeFtBurn, decodeFtMint, decodeFtTransfer, decodeNftBurn, decodeNftMint, decodeNftTransfer, decodePrint, decodeStxBurn, decodeStxLock, decodeStxMint, decodeStxTransfer, fetchRewardSet, getSubgraph, isFtBurn, isFtMint, isFtTransfer, isHostedApiUrl, isNftBurn, isNftMint, isNftTransfer, isPrint, isStxBurn, isStxLock, isStxMint, isStxTransfer, isSuccessDelivery, parseRetryAfter, resolveAccountKey, resolveApiKey, resolveBaseUrl, shutdownSignal, toJsonSafe, trigger, verifySecondlayerSignature, verify as verifyStandardWebhooksHeaders, verifyTransactionProof, verifyWebhookSignature };

package/dist/index.js

@@ -215,13 +215,20 @@ function resolveBaseUrl(explicit) {
   }
   return LOCAL_API_URL;
 }
-function resolveApiKey(apiKey) {
+function isHostedApiUrl(url) {
+  try {
+    return new URL(url).hostname === "api.secondlayer.tools";
+  } catch {
+    return false;
+  }
+}
+function resolveApiKey(apiKey, baseUrl) {
   if (apiKey !== undefined)
     return apiKey;
   if (typeof process === "undefined")
     return;
-  const token = process.env?.INSTANCE_TOKEN || undefined;
-  return token;
+  const name = baseUrl !== undefined && isHostedApiUrl(baseUrl) ? ACCOUNT_KEY_ENV : INSTANCE_TOKEN_ENV;
+  return process.env?.[name] || undefined;
 }
 function resolveAccountKey(accountKey) {
   if (accountKey !== undefined)
@@ -279,7 +286,7 @@ class BaseClient {
   etagCache;
   constructor(options = {}) {
     this.baseUrl = resolveBaseUrl(options.baseUrl);
-    this.apiKey = resolveApiKey(options.apiKey);
+    this.apiKey = resolveApiKey(options.apiKey, this.baseUrl);
     this.origin = options.origin ?? "cli";
     this.requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
     this.fetchImpl = options.fetchImpl ?? ((...args) => fetch(...args));
@@ -2028,7 +2035,7 @@ function isLoopbackUrl(baseUrl) {
 }
 function createStreamsClient(options) {
   const baseUrl = normalizeBaseUrl(resolveBaseUrl(options.baseUrl));
-  const apiKey = resolveApiKey(options.apiKey);
+  const apiKey = resolveApiKey(options.apiKey, baseUrl);
   const origin = options.origin ?? "cli";
   const authHeaders = () => ({
     "x-sl-origin": origin,
@@ -3417,6 +3424,7 @@ export {
   isFtBurn,
   isFtMint,
   isFtTransfer,
+  isHostedApiUrl,
   isNftBurn,
   isNftMint,
   isNftTransfer,
@@ -3439,5 +3447,5 @@ export {
   verifyWebhookSignature
 };
 
-//# debugId=5CEBD3F2D96129FA64756E2164756E21
+//# debugId=1E4B8B01D0F7E0FC64756E2164756E21
 //# sourceMappingURL=index.js.map