@secondlayer/sdk 16.0.0 → 16.2.0

package/README.md

@@ -15,13 +15,13 @@ import { SecondLayer } from "@secondlayer/sdk";
 
 const sl = new SecondLayer({
   apiKey: process.env.INSTANCE_TOKEN, // from secondlayer init; read from the env when omitted
-  // default baseUrl: http://127.0.0.1:3800  (or SECONDLAYER_API_URL)
+  // default baseUrl: SECONDLAYER_API_URL, else http://127.0.0.1:3800
 });
 ```
 
-Hosted: point the client at `https://api.secondlayer.tools` (`SECONDLAYER_API_URL`)
-and it sends `SECONDLAYER_API_KEY` (`sk-sl_*`) automatically. Self-host: use
-`INSTANCE_TOKEN` as below. The key follows the host.
+Hosted: set `SECONDLAYER_API_KEY` or pass `apiKey` (`sk-sl_*`) and the client uses
+`https://api.secondlayer.tools`. Self-host: use `INSTANCE_TOKEN` as below, which
+keeps the client on your instance even with an account key set. The key follows the host.
 
 Auth, once (self-hosted instance): `sl.index`, `sl.streams`, `sl.subgraphs.rows`, and the typed
 `subscribe` read `/v1`, which is open on loopback and needs `INSTANCE_TOKEN`
@@ -585,7 +585,7 @@ Every delivery, any `format`, also carries a universal authenticity
 signature you can verify with one published key, no per-webhook secret. The
 headers are `webhook-id`, `x-secondlayer-signature`, and
 `x-secondlayer-signature-keyid`; the signed content is `` `${webhook-id}.${rawBody}` ``
-(ed25519). Fetch the public key from `GET /public/streams/signing-key`.
+(ed25519). Fetch the public key from `GET /api/webhooks/signing-key`, which takes your account key.
 
 ```typescript
 import { verifySecondlayerSignature } from "@secondlayer/sdk";

package/dist/index.d.ts

@@ -298,14 +298,19 @@ type RequestOptions = {
 	*  signal's reason, an `AbortError` by default, never an `ApiError`. */
 	signal?: AbortSignal;
 };
-/** Product default: the local one-box API. Override with `baseUrl` or
-*  `SECONDLAYER_API_URL`. */
+/** Default when nothing points at the hosted API: the local one-box API.
+*  Override with `baseUrl` or `SECONDLAYER_API_URL`. */
 declare const LOCAL_API_URL = "http://127.0.0.1:3800";
 /** Instance credential. `secondlayer init` writes this. */
 declare const INSTANCE_TOKEN_ENV = "INSTANCE_TOKEN";
 /** Hosted account key (`sk-sl_*`) for api.secondlayer.tools. */
 declare const ACCOUNT_KEY_ENV = "SECONDLAYER_API_KEY";
-declare function resolveBaseUrl(explicit?: string): string;
+/** The API to call. A named URL wins (`explicit`, then `SECONDLAYER_API_URL`).
+*  Otherwise the key picks the host, so a credential never reaches the wrong
+*  one: `apiKey` if the caller passed one, else a lone account key in the env.
+*  Self-hosters often hold an account key for archive credits too, so an env
+*  instance token keeps them on their instance. */
+declare function resolveBaseUrl(explicit?: string, apiKey?: string): string;
 /** True when `url` is the hosted Secondlayer API (`api.secondlayer.tools`). */
 declare function isHostedApiUrl(url: string): boolean;
 /** Resolve the bearer credential; the key follows the host. Precedence:

package/dist/index.js

@@ -60,7 +60,9 @@ ${detailBlocks.join(`
     };
   }
 }
-function statusRetryable(status) {
+function statusRetryable(status, code) {
+  if (code === "STACK_ASLEEP")
+    return false;
   return status === 429 || status >= 500;
 }
 function docsFor(status, code) {
@@ -77,7 +79,7 @@ class ApiError extends SecondLayerError {
   constructor(status, message, body, code, options = {}) {
     super(message, {
       code,
-      retryable: options.retryable ?? statusRetryable(status),
+      retryable: options.retryable ?? statusRetryable(status, code),
       docsUrl: options.docsUrl ?? docsFor(status, code),
       ...options.cause ? { cause: options.cause } : {},
       ...options.details ? { details: options.details } : {},
@@ -214,17 +216,18 @@ function raceAbort(promise, signal) {
   });
 }
 var LOCAL_API_URL = "http://127.0.0.1:3800";
+var HOSTED_API_URL = "https://api.secondlayer.tools";
 var INSTANCE_TOKEN_ENV = "INSTANCE_TOKEN";
 var ACCOUNT_KEY_ENV = "SECONDLAYER_API_KEY";
-function resolveBaseUrl(explicit) {
+function resolveBaseUrl(explicit, apiKey) {
   if (explicit && explicit.length > 0)
     return explicit.replace(/\/+$/, "");
-  if (typeof process !== "undefined") {
-    const primary = process.env?.SECONDLAYER_API_URL || undefined;
-    if (primary)
-      return primary.replace(/\/+$/, "");
-  }
-  return LOCAL_API_URL;
+  const env = typeof process !== "undefined" ? process.env : undefined;
+  const primary = env?.SECONDLAYER_API_URL || undefined;
+  if (primary)
+    return primary.replace(/\/+$/, "");
+  const key = apiKey ?? (env?.[INSTANCE_TOKEN_ENV] ? undefined : env?.[ACCOUNT_KEY_ENV]);
+  return key?.startsWith("sk-sl_") ? HOSTED_API_URL : LOCAL_API_URL;
 }
 function isHostedApiUrl(url) {
   try {
@@ -296,7 +299,7 @@ class BaseClient {
   requestTimeoutMs;
   etagCache;
   constructor(options = {}) {
-    this.baseUrl = resolveBaseUrl(options.baseUrl);
+    this.baseUrl = resolveBaseUrl(options.baseUrl, options.apiKey);
     this.apiKey = resolveApiKey(options.apiKey, this.baseUrl);
     this.origin = options.origin ?? "cli";
     this.requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
@@ -2071,7 +2074,7 @@ function isLoopbackUrl(baseUrl) {
   }
 }
 function createStreamsClient(options) {
-  const baseUrl = normalizeBaseUrl(resolveBaseUrl(options.baseUrl));
+  const baseUrl = normalizeBaseUrl(resolveBaseUrl(options.baseUrl, options.apiKey));
   const apiKey = resolveApiKey(options.apiKey, baseUrl);
   const origin = options.origin ?? "cli";
   const authHeaders = () => ({
@@ -3418,5 +3421,5 @@ export {
   verifyWebhookSignature
 };
 
-//# debugId=9551CE26B3E76ABF64756E2164756E21
+//# debugId=F50384CF029DB60E64756E2164756E21
 //# sourceMappingURL=index.js.map