@secondlayer/sdk 16.0.0 → 16.1.0

package/README.md

@@ -15,13 +15,13 @@ import { SecondLayer } from "@secondlayer/sdk";
 
 const sl = new SecondLayer({
   apiKey: process.env.INSTANCE_TOKEN, // from secondlayer init; read from the env when omitted
-  // default baseUrl: http://127.0.0.1:3800  (or SECONDLAYER_API_URL)
+  // default baseUrl: SECONDLAYER_API_URL, else http://127.0.0.1:3800
 });
 ```
 
-Hosted: point the client at `https://api.secondlayer.tools` (`SECONDLAYER_API_URL`)
-and it sends `SECONDLAYER_API_KEY` (`sk-sl_*`) automatically. Self-host: use
-`INSTANCE_TOKEN` as below. The key follows the host.
+Hosted: set `SECONDLAYER_API_KEY` (`sk-sl_*`) and the client uses
+`https://api.secondlayer.tools`. Self-host: use `INSTANCE_TOKEN` as below, which
+keeps the client on your instance even with an account key set. The key follows the host.
 
 Auth, once (self-hosted instance): `sl.index`, `sl.streams`, `sl.subgraphs.rows`, and the typed
 `subscribe` read `/v1`, which is open on loopback and needs `INSTANCE_TOKEN`
@@ -585,7 +585,7 @@ Every delivery, any `format`, also carries a universal authenticity
 signature you can verify with one published key, no per-webhook secret. The
 headers are `webhook-id`, `x-secondlayer-signature`, and
 `x-secondlayer-signature-keyid`; the signed content is `` `${webhook-id}.${rawBody}` ``
-(ed25519). Fetch the public key from `GET /public/streams/signing-key`.
+(ed25519). Fetch the public key from `GET /api/webhooks/signing-key`, which takes your account key.
 
 ```typescript
 import { verifySecondlayerSignature } from "@secondlayer/sdk";

package/dist/index.d.ts

@@ -298,8 +298,8 @@ type RequestOptions = {
 	*  signal's reason, an `AbortError` by default, never an `ApiError`. */
 	signal?: AbortSignal;
 };
-/** Product default: the local one-box API. Override with `baseUrl` or
-*  `SECONDLAYER_API_URL`. */
+/** Default when nothing points at the hosted API: the local one-box API.
+*  Override with `baseUrl` or `SECONDLAYER_API_URL`. */
 declare const LOCAL_API_URL = "http://127.0.0.1:3800";
 /** Instance credential. `secondlayer init` writes this. */
 declare const INSTANCE_TOKEN_ENV = "INSTANCE_TOKEN";

package/dist/index.js

@@ -214,6 +214,7 @@ function raceAbort(promise, signal) {
   });
 }
 var LOCAL_API_URL = "http://127.0.0.1:3800";
+var HOSTED_API_URL = "https://api.secondlayer.tools";
 var INSTANCE_TOKEN_ENV = "INSTANCE_TOKEN";
 var ACCOUNT_KEY_ENV = "SECONDLAYER_API_KEY";
 function resolveBaseUrl(explicit) {
@@ -223,6 +224,9 @@ function resolveBaseUrl(explicit) {
     const primary = process.env?.SECONDLAYER_API_URL || undefined;
     if (primary)
       return primary.replace(/\/+$/, "");
+    if (process.env?.[ACCOUNT_KEY_ENV]?.startsWith("sk-sl_") && !process.env?.[INSTANCE_TOKEN_ENV]) {
+      return HOSTED_API_URL;
+    }
   }
   return LOCAL_API_URL;
 }
@@ -3418,5 +3422,5 @@ export {
   verifyWebhookSignature
 };
 
-//# debugId=9551CE26B3E76ABF64756E2164756E21
+//# debugId=8E37F0B7E094194F64756E2164756E21
 //# sourceMappingURL=index.js.map