@secondlayer/shared 10.0.1 → 11.0.0

package/dist/src/errors.js.map

@@ -2,9 +2,9 @@
   "version": 3,
   "sources": ["../src/errors.ts"],
   "sourcesContent": [
-    "export const ErrorCodes = {\n\tVALIDATION_ERROR: \"VALIDATION_ERROR\",\n\tDATABASE_ERROR: \"DATABASE_ERROR\",\n\tAUTHENTICATION_ERROR: \"AUTHENTICATION_ERROR\",\n\tAUTHORIZATION_ERROR: \"AUTHORIZATION_ERROR\",\n\tRATE_LIMIT_ERROR: \"RATE_LIMIT_ERROR\",\n\tPAYMENT_REQUIRED: \"PAYMENT_REQUIRED\",\n\tFORBIDDEN: \"FORBIDDEN\",\n\tVERSION_CONFLICT: \"VERSION_CONFLICT\",\n\tNOT_FOUND: \"NOT_FOUND\",\n\t// Tenant lifecycle (CLI surfaces these verbatim)\n\tKEY_ROTATED: \"KEY_ROTATED\",\n\tTENANT_SUSPENDED: \"TENANT_SUSPENDED\",\n\tNO_TENANT_FOR_PROJECT: \"NO_TENANT_FOR_PROJECT\",\n\tINSTANCE_EXISTS: \"INSTANCE_EXISTS\",\n} as const;\n\nexport type ErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];\n\n/** Base error class for all Secondlayer errors. */\nexport class SecondLayerError extends Error {\n\tpublic code: ErrorCode;\n\tpublic override cause?: unknown;\n\t/** Optional structured payload merged into the HTTP error body (machine-readable hints). */\n\tpublic details?: Record<string, unknown>;\n\n\tconstructor(\n\t\tcode: ErrorCode,\n\t\tmessage: string,\n\t\tcause?: unknown,\n\t\tdetails?: Record<string, unknown>,\n\t) {\n\t\tsuper(message);\n\t\tthis.code = code;\n\t\tthis.cause = cause;\n\t\tthis.details = details;\n\t\tthis.name = this.constructor.name;\n\t\tError.captureStackTrace?.(this, this.constructor);\n\t}\n\n\ttoJSON(): {\n\t\tname: string;\n\t\tcode: string;\n\t\tmessage: string;\n\t\tstack: string | undefined;\n\t\tcause: unknown;\n\t\tdetails: Record<string, unknown> | undefined;\n\t} {\n\t\treturn {\n\t\t\tname: this.name,\n\t\t\tcode: this.code,\n\t\t\tmessage: this.message,\n\t\t\tstack: this.stack,\n\t\t\tcause: this.cause,\n\t\t\tdetails: this.details,\n\t\t};\n\t}\n}\n\nexport class NotFoundError extends SecondLayerError {\n\tconstructor(message: string) {\n\t\tsuper(\"NOT_FOUND\", message);\n\t}\n}\n\nexport class ValidationError extends SecondLayerError {\n\tconstructor(message: string, cause?: unknown) {\n\t\tsuper(\"VALIDATION_ERROR\", message, cause);\n\t}\n}\n\nexport class DatabaseError extends SecondLayerError {\n\tconstructor(message: string, cause?: unknown) {\n\t\tsuper(\"DATABASE_ERROR\", message, cause);\n\t}\n}\n\nexport class AuthenticationError extends SecondLayerError {\n\tconstructor(message: string) {\n\t\tsuper(\"AUTHENTICATION_ERROR\", message);\n\t}\n}\n\nexport class AuthorizationError extends SecondLayerError {\n\tconstructor(message: string, details?: Record<string, unknown>) {\n\t\tsuper(\"AUTHORIZATION_ERROR\", message, undefined, details);\n\t}\n}\n\nexport class RateLimitError extends SecondLayerError {\n\tconstructor(message: string) {\n\t\tsuper(\"RATE_LIMIT_ERROR\", message);\n\t}\n}\n\n/**\n * HTTP 402. Carries the x402 challenge (or a retry-later reason) in `details` so\n * the global error handler emits it in the body. The wire `PAYMENT-REQUIRED`\n * header is set separately by the x402 middleware on the challenge path.\n */\nexport class PaymentRequiredError extends SecondLayerError {\n\tconstructor(message: string, details?: Record<string, unknown>) {\n\t\tsuper(\"PAYMENT_REQUIRED\", message, undefined, details);\n\t}\n}\n\nexport class ForbiddenError extends SecondLayerError {\n\tconstructor(message = \"Forbidden\") {\n\t\tsuper(\"FORBIDDEN\", message);\n\t}\n}\n\nexport class VersionConflictError extends SecondLayerError {\n\tpublic currentVersion: string;\n\tpublic expectedVersion: string;\n\n\tconstructor(currentVersion: string, expectedVersion: string) {\n\t\tsuper(\n\t\t\t\"VERSION_CONFLICT\",\n\t\t\t`Version conflict: expected ${expectedVersion}, current ${currentVersion}`,\n\t\t);\n\t\tthis.currentVersion = currentVersion;\n\t\tthis.expectedVersion = expectedVersion;\n\t}\n}\n\nexport class KeyRotatedError extends SecondLayerError {\n\tconstructor(message = \"Token has been rotated\") {\n\t\tsuper(\"KEY_ROTATED\", message);\n\t}\n}\n\nexport class TenantSuspendedError extends SecondLayerError {\n\tconstructor(message = \"Instance is suspended\") {\n\t\tsuper(\"TENANT_SUSPENDED\", message);\n\t}\n}\n\n/** Error code → HTTP status. Used by API middleware for code-based matching\n *  (avoids cross-bundle instanceof failures from bunup class duplication). */\n// String literal map — codes don't have to be in the central ErrorCode\n// enum (route-local error classes can supply any code; we just map the\n// HTTP status here). This keeps cross-bundle instanceof failures out of\n// the equation.\nexport const CODE_TO_STATUS: Record<\n\tstring,\n\t400 | 401 | 402 | 403 | 404 | 409 | 422 | 423 | 429 | 503\n> = {\n\t// The chain plane has no data yet — a fresh self-host install before the\n\t// first block lands. Retryable, and not the operator's mistake, so it is a\n\t// 503 with a name rather than an opaque 500.\n\tCHAIN_DATA_UNAVAILABLE: 503,\n\tAUTHENTICATION_ERROR: 401,\n\tAUTHORIZATION_ERROR: 403,\n\tPAYMENT_REQUIRED: 402,\n\tRATE_LIMIT_ERROR: 429,\n\tFORBIDDEN: 403,\n\tNOT_FOUND: 404,\n\tVALIDATION_ERROR: 400,\n\tKEY_ROTATED: 401,\n\tTENANT_SUSPENDED: 423,\n\tNO_TENANT_FOR_PROJECT: 404,\n\tINSTANCE_EXISTS: 409,\n\tSUBGRAPH_NOT_FOUND: 404,\n\tPUBLIC_NAME_TAKEN: 409,\n\tGHOST_KEY_READ_ONLY: 403,\n} as const;\n\nexport function getErrorMessage(err: unknown): string {\n\treturn err instanceof Error ? err.message : String(err);\n}\n"
+    "export const ErrorCodes = {\n\tVALIDATION_ERROR: \"VALIDATION_ERROR\",\n\tDATABASE_ERROR: \"DATABASE_ERROR\",\n\tAUTHENTICATION_ERROR: \"AUTHENTICATION_ERROR\",\n\tAUTHORIZATION_ERROR: \"AUTHORIZATION_ERROR\",\n\tRATE_LIMIT_ERROR: \"RATE_LIMIT_ERROR\",\n\tPAYMENT_REQUIRED: \"PAYMENT_REQUIRED\",\n\tFORBIDDEN: \"FORBIDDEN\",\n\tVERSION_CONFLICT: \"VERSION_CONFLICT\",\n\tNOT_FOUND: \"NOT_FOUND\",\n\t// Tenant lifecycle (CLI surfaces these verbatim)\n\tKEY_ROTATED: \"KEY_ROTATED\",\n\tTENANT_SUSPENDED: \"TENANT_SUSPENDED\",\n\tNO_TENANT_FOR_PROJECT: \"NO_TENANT_FOR_PROJECT\",\n\tINSTANCE_EXISTS: \"INSTANCE_EXISTS\",\n} as const;\n\nexport type ErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];\n\n/** Base error class for all Secondlayer errors. */\nexport class SecondLayerError extends Error {\n\tpublic code: ErrorCode;\n\tpublic override cause?: unknown;\n\t/** Optional structured payload merged into the HTTP error body (machine-readable hints). */\n\tpublic details?: Record<string, unknown>;\n\n\tconstructor(\n\t\tcode: ErrorCode,\n\t\tmessage: string,\n\t\tcause?: unknown,\n\t\tdetails?: Record<string, unknown>,\n\t) {\n\t\tsuper(message);\n\t\tthis.code = code;\n\t\tthis.cause = cause;\n\t\tthis.details = details;\n\t\tthis.name = this.constructor.name;\n\t\tError.captureStackTrace?.(this, this.constructor);\n\t}\n\n\ttoJSON(): {\n\t\tname: string;\n\t\tcode: string;\n\t\tmessage: string;\n\t\tstack: string | undefined;\n\t\tcause: unknown;\n\t\tdetails: Record<string, unknown> | undefined;\n\t} {\n\t\treturn {\n\t\t\tname: this.name,\n\t\t\tcode: this.code,\n\t\t\tmessage: this.message,\n\t\t\tstack: this.stack,\n\t\t\tcause: this.cause,\n\t\t\tdetails: this.details,\n\t\t};\n\t}\n}\n\nexport class NotFoundError extends SecondLayerError {\n\tconstructor(message: string) {\n\t\tsuper(\"NOT_FOUND\", message);\n\t}\n}\n\nexport class ValidationError extends SecondLayerError {\n\tconstructor(message: string, cause?: unknown) {\n\t\tsuper(\"VALIDATION_ERROR\", message, cause);\n\t}\n}\n\nexport class DatabaseError extends SecondLayerError {\n\tconstructor(message: string, cause?: unknown) {\n\t\tsuper(\"DATABASE_ERROR\", message, cause);\n\t}\n}\n\nexport class AuthenticationError extends SecondLayerError {\n\t/** `details` is merged into the HTTP body — use it to carry the recovery\n\t *  hint (which credential, where it comes from) instead of a bare \"invalid\n\t *  key\" the caller cannot act on. */\n\tconstructor(message: string, details?: Record<string, unknown>) {\n\t\tsuper(\"AUTHENTICATION_ERROR\", message, undefined, details);\n\t}\n}\n\nexport class AuthorizationError extends SecondLayerError {\n\tconstructor(message: string, details?: Record<string, unknown>) {\n\t\tsuper(\"AUTHORIZATION_ERROR\", message, undefined, details);\n\t}\n}\n\nexport class RateLimitError extends SecondLayerError {\n\tconstructor(message: string) {\n\t\tsuper(\"RATE_LIMIT_ERROR\", message);\n\t}\n}\n\n/**\n * HTTP 402. Carries the x402 challenge (or a retry-later reason) in `details` so\n * the global error handler emits it in the body. The wire `PAYMENT-REQUIRED`\n * header is set separately by the x402 middleware on the challenge path.\n */\nexport class PaymentRequiredError extends SecondLayerError {\n\tconstructor(message: string, details?: Record<string, unknown>) {\n\t\tsuper(\"PAYMENT_REQUIRED\", message, undefined, details);\n\t}\n}\n\nexport class ForbiddenError extends SecondLayerError {\n\tconstructor(message = \"Forbidden\") {\n\t\tsuper(\"FORBIDDEN\", message);\n\t}\n}\n\nexport class VersionConflictError extends SecondLayerError {\n\tpublic currentVersion: string;\n\tpublic expectedVersion: string;\n\n\tconstructor(currentVersion: string, expectedVersion: string) {\n\t\tsuper(\n\t\t\t\"VERSION_CONFLICT\",\n\t\t\t`Version conflict: expected ${expectedVersion}, current ${currentVersion}`,\n\t\t);\n\t\tthis.currentVersion = currentVersion;\n\t\tthis.expectedVersion = expectedVersion;\n\t}\n}\n\nexport class KeyRotatedError extends SecondLayerError {\n\tconstructor(message = \"Token has been rotated\") {\n\t\tsuper(\"KEY_ROTATED\", message);\n\t}\n}\n\nexport class TenantSuspendedError extends SecondLayerError {\n\tconstructor(message = \"Instance is suspended\") {\n\t\tsuper(\"TENANT_SUSPENDED\", message);\n\t}\n}\n\n/** Error code → HTTP status. Used by API middleware for code-based matching\n *  (avoids cross-bundle instanceof failures from bunup class duplication). */\n// String literal map — codes don't have to be in the central ErrorCode\n// enum (route-local error classes can supply any code; we just map the\n// HTTP status here). This keeps cross-bundle instanceof failures out of\n// the equation.\nexport const CODE_TO_STATUS: Record<\n\tstring,\n\t400 | 401 | 402 | 403 | 404 | 409 | 415 | 422 | 423 | 429 | 503\n> = {\n\t// The chain plane has no data yet — a fresh self-host install before the\n\t// first block lands. Retryable, and not the operator's mistake, so it is a\n\t// 503 with a name rather than an opaque 500.\n\tCHAIN_DATA_UNAVAILABLE: 503,\n\tAUTHENTICATION_ERROR: 401,\n\tAUTHORIZATION_ERROR: 403,\n\tPAYMENT_REQUIRED: 402,\n\tRATE_LIMIT_ERROR: 429,\n\tFORBIDDEN: 403,\n\tNOT_FOUND: 404,\n\tVALIDATION_ERROR: 400,\n\tKEY_ROTATED: 401,\n\tTENANT_SUSPENDED: 423,\n\tNO_TENANT_FOR_PROJECT: 404,\n\tINSTANCE_EXISTS: 409,\n\tSUBGRAPH_NOT_FOUND: 404,\n\tGHOST_KEY_READ_ONLY: 403,\n\t// A write that did not declare `Content-Type: application/json`. Shaped\n\t// like something a browser could have forged cross-origin without a CORS\n\t// preflight — see the API's `middleware/csrf.ts`.\n\tUNSUPPORTED_MEDIA_TYPE: 415,\n} as const;\n\nexport function getErrorMessage(err: unknown): string {\n\treturn err instanceof Error ? err.message : String(err);\n}\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;;;;AAAO,IAAM,aAAa;AAAA,EACzB,kBAAkB;AAAA,EAClB,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,qBAAqB;AAAA,EACrB,kBAAkB;AAAA,EAClB,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,WAAW;AAAA,EAEX,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,uBAAuB;AAAA,EACvB,iBAAiB;AAClB;AAAA;AAKO,MAAM,yBAAyB,MAAM;AAAA,EACpC;AAAA,EACS;AAAA,EAET;AAAA,EAEP,WAAW,CACV,MACA,SACA,OACA,SACC;AAAA,IACD,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA,IACZ,KAAK,QAAQ;AAAA,IACb,KAAK,UAAU;AAAA,IACf,KAAK,OAAO,KAAK,YAAY;AAAA,IAC7B,MAAM,oBAAoB,MAAM,KAAK,WAAW;AAAA;AAAA,EAGjD,MAAM,GAOJ;AAAA,IACD,OAAO;AAAA,MACN,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IACf;AAAA;AAEF;AAAA;AAEO,MAAM,sBAAsB,iBAAiB;AAAA,EACnD,WAAW,CAAC,SAAiB;AAAA,IAC5B,MAAM,aAAa,OAAO;AAAA;AAE5B;AAAA;AAEO,MAAM,wBAAwB,iBAAiB;AAAA,EACrD,WAAW,CAAC,SAAiB,OAAiB;AAAA,IAC7C,MAAM,oBAAoB,SAAS,KAAK;AAAA;AAE1C;AAAA;AAEO,MAAM,sBAAsB,iBAAiB;AAAA,EACnD,WAAW,CAAC,SAAiB,OAAiB;AAAA,IAC7C,MAAM,kBAAkB,SAAS,KAAK;AAAA;AAExC;AAAA;AAEO,MAAM,4BAA4B,iBAAiB;AAAA,EACzD,WAAW,CAAC,SAAiB;AAAA,IAC5B,MAAM,wBAAwB,OAAO;AAAA;AAEvC;AAAA;AAEO,MAAM,2BAA2B,iBAAiB;AAAA,EACxD,WAAW,CAAC,SAAiB,SAAmC;AAAA,IAC/D,MAAM,uBAAuB,SAAS,WAAW,OAAO;AAAA;AAE1D;AAAA;AAEO,MAAM,uBAAuB,iBAAiB;AAAA,EACpD,WAAW,CAAC,SAAiB;AAAA,IAC5B,MAAM,oBAAoB,OAAO;AAAA;AAEnC;AAAA;AAOO,MAAM,6BAA6B,iBAAiB;AAAA,EAC1D,WAAW,CAAC,SAAiB,SAAmC;AAAA,IAC/D,MAAM,oBAAoB,SAAS,WAAW,OAAO;AAAA;AAEvD;AAAA;AAEO,MAAM,uBAAuB,iBAAiB;AAAA,EACpD,WAAW,CAAC,UAAU,aAAa;AAAA,IAClC,MAAM,aAAa,OAAO;AAAA;AAE5B;AAAA;AAEO,MAAM,6BAA6B,iBAAiB;AAAA,EACnD;AAAA,EACA;AAAA,EAEP,WAAW,CAAC,gBAAwB,iBAAyB;AAAA,IAC5D,MACC,oBACA,8BAA8B,4BAA4B,gBAC3D;AAAA,IACA,KAAK,iBAAiB;AAAA,IACtB,KAAK,kBAAkB;AAAA;AAEzB;AAAA;AAEO,MAAM,wBAAwB,iBAAiB;AAAA,EACrD,WAAW,CAAC,UAAU,0BAA0B;AAAA,IAC/C,MAAM,eAAe,OAAO;AAAA;AAE9B;AAAA;AAEO,MAAM,6BAA6B,iBAAiB;AAAA,EAC1D,WAAW,CAAC,UAAU,yBAAyB;AAAA,IAC9C,MAAM,oBAAoB,OAAO;AAAA;AAEnC;AAQO,IAAM,iBAGT;AAAA,EAIH,wBAAwB;AAAA,EACxB,sBAAsB;AAAA,EACtB,qBAAqB;AAAA,EACrB,kBAAkB;AAAA,EAClB,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,uBAAuB;AAAA,EACvB,iBAAiB;AAAA,EACjB,oBAAoB;AAAA,EACpB,mBAAmB;AAAA,EACnB,qBAAqB;AACtB;AAEO,SAAS,eAAe,CAAC,KAAsB;AAAA,EACrD,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA;",
-  "debugId": "5807B9DB95B688C664756E2164756E21",
+  "mappings": ";;;;;;;;;;;;;;;;;AAAO,IAAM,aAAa;AAAA,EACzB,kBAAkB;AAAA,EAClB,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,qBAAqB;AAAA,EACrB,kBAAkB;AAAA,EAClB,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,WAAW;AAAA,EAEX,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,uBAAuB;AAAA,EACvB,iBAAiB;AAClB;AAAA;AAKO,MAAM,yBAAyB,MAAM;AAAA,EACpC;AAAA,EACS;AAAA,EAET;AAAA,EAEP,WAAW,CACV,MACA,SACA,OACA,SACC;AAAA,IACD,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA,IACZ,KAAK,QAAQ;AAAA,IACb,KAAK,UAAU;AAAA,IACf,KAAK,OAAO,KAAK,YAAY;AAAA,IAC7B,MAAM,oBAAoB,MAAM,KAAK,WAAW;AAAA;AAAA,EAGjD,MAAM,GAOJ;AAAA,IACD,OAAO;AAAA,MACN,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IACf;AAAA;AAEF;AAAA;AAEO,MAAM,sBAAsB,iBAAiB;AAAA,EACnD,WAAW,CAAC,SAAiB;AAAA,IAC5B,MAAM,aAAa,OAAO;AAAA;AAE5B;AAAA;AAEO,MAAM,wBAAwB,iBAAiB;AAAA,EACrD,WAAW,CAAC,SAAiB,OAAiB;AAAA,IAC7C,MAAM,oBAAoB,SAAS,KAAK;AAAA;AAE1C;AAAA;AAEO,MAAM,sBAAsB,iBAAiB;AAAA,EACnD,WAAW,CAAC,SAAiB,OAAiB;AAAA,IAC7C,MAAM,kBAAkB,SAAS,KAAK;AAAA;AAExC;AAAA;AAEO,MAAM,4BAA4B,iBAAiB;AAAA,EAIzD,WAAW,CAAC,SAAiB,SAAmC;AAAA,IAC/D,MAAM,wBAAwB,SAAS,WAAW,OAAO;AAAA;AAE3D;AAAA;AAEO,MAAM,2BAA2B,iBAAiB;AAAA,EACxD,WAAW,CAAC,SAAiB,SAAmC;AAAA,IAC/D,MAAM,uBAAuB,SAAS,WAAW,OAAO;AAAA;AAE1D;AAAA;AAEO,MAAM,uBAAuB,iBAAiB;AAAA,EACpD,WAAW,CAAC,SAAiB;AAAA,IAC5B,MAAM,oBAAoB,OAAO;AAAA;AAEnC;AAAA;AAOO,MAAM,6BAA6B,iBAAiB;AAAA,EAC1D,WAAW,CAAC,SAAiB,SAAmC;AAAA,IAC/D,MAAM,oBAAoB,SAAS,WAAW,OAAO;AAAA;AAEvD;AAAA;AAEO,MAAM,uBAAuB,iBAAiB;AAAA,EACpD,WAAW,CAAC,UAAU,aAAa;AAAA,IAClC,MAAM,aAAa,OAAO;AAAA;AAE5B;AAAA;AAEO,MAAM,6BAA6B,iBAAiB;AAAA,EACnD;AAAA,EACA;AAAA,EAEP,WAAW,CAAC,gBAAwB,iBAAyB;AAAA,IAC5D,MACC,oBACA,8BAA8B,4BAA4B,gBAC3D;AAAA,IACA,KAAK,iBAAiB;AAAA,IACtB,KAAK,kBAAkB;AAAA;AAEzB;AAAA;AAEO,MAAM,wBAAwB,iBAAiB;AAAA,EACrD,WAAW,CAAC,UAAU,0BAA0B;AAAA,IAC/C,MAAM,eAAe,OAAO;AAAA;AAE9B;AAAA;AAEO,MAAM,6BAA6B,iBAAiB;AAAA,EAC1D,WAAW,CAAC,UAAU,yBAAyB;AAAA,IAC9C,MAAM,oBAAoB,OAAO;AAAA;AAEnC;AAQO,IAAM,iBAGT;AAAA,EAIH,wBAAwB;AAAA,EACxB,sBAAsB;AAAA,EACtB,qBAAqB;AAAA,EACrB,kBAAkB;AAAA,EAClB,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,uBAAuB;AAAA,EACvB,iBAAiB;AAAA,EACjB,oBAAoB;AAAA,EACpB,qBAAqB;AAAA,EAIrB,wBAAwB;AACzB;AAEO,SAAS,eAAe,CAAC,KAAsB;AAAA,EACrD,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA;",
+  "debugId": "D8A474DF7664F17764756E2164756E21",
   "names": []
 }

package/dist/src/index.d.ts

@@ -2119,7 +2119,10 @@ declare class DatabaseError extends SecondLayerError {
 	constructor(message: string, cause?: unknown);
 }
 declare class AuthenticationError extends SecondLayerError {
-	constructor(message: string);
+	/** `details` is merged into the HTTP body — use it to carry the recovery
+	*  hint (which credential, where it comes from) instead of a bare "invalid
+	*  key" the caller cannot act on. */
+	constructor(message: string, details?: Record<string, unknown>);
 }
 declare class AuthorizationError extends SecondLayerError {
 	constructor(message: string, details?: Record<string, unknown>);
@@ -2151,7 +2154,7 @@ declare class TenantSuspendedError extends SecondLayerError {
 }
 /** Error code → HTTP status. Used by API middleware for code-based matching
 *  (avoids cross-bundle instanceof failures from bunup class duplication). */
-declare const CODE_TO_STATUS: Record<string, 400 | 401 | 402 | 403 | 404 | 409 | 422 | 423 | 429 | 503>;
+declare const CODE_TO_STATUS: Record<string, 400 | 401 | 402 | 403 | 404 | 409 | 415 | 422 | 423 | 429 | 503>;
 declare function getErrorMessage(err: unknown): string;
 declare class Logger {
 	private _level?;
@@ -2182,18 +2185,12 @@ interface DeploySubgraphRequest {
 	sourceCode?: string;
 	/** Validate the definition + print the DDL plan without deploying. */
 	dryRun?: boolean;
-	/**
-	* Read visibility. Server-side default: deploys → public (anon reads on
-	* /v1/subgraphs, name claimed in the global public namespace).
-	*/
-	visibility?: "public" | "private";
 }
 declare const DeploySubgraphRequestSchema: z2.ZodType<DeploySubgraphRequest>;
 interface DeploySubgraphResponse {
 	action: "created" | "unchanged" | "handler_updated" | "updated" | "reindexed";
 	subgraphId: string;
 	version: string;
-	visibility?: "public" | "private";
 	message: string;
 	/** Effective indexing start height. */
 	start_block?: number;
@@ -2628,6 +2625,15 @@ type SubgraphSpecFormat = "openapi" | "agent" | "markdown";
 interface SubgraphSpecOptions {
 	serverUrl?: string;
 	generatedAt?: string;
+	/**
+	* Self-hosted instances ignore the `visibility` column when deciding
+	* whether a read needs a key (`/v1/subgraphs` auth is the loopback rule,
+	* not the flag) — but this generator still branched on it, so a spec built
+	* for a self-hosted deploy pointed readers at the authenticated `/api`
+	* path for a read that was actually open. Callers on that mode should set
+	* this so the generated URLs match the auth the API actually enforces.
+	*/
+	forcePublicRead?: boolean;
 }
 interface SubgraphAgentSchema {
 	name: string;

package/dist/src/index.js

@@ -1023,8 +1023,8 @@ class DatabaseError extends SecondLayerError {
 }
 
 class AuthenticationError extends SecondLayerError {
-  constructor(message) {
-    super("AUTHENTICATION_ERROR", message);
+  constructor(message, details) {
+    super("AUTHENTICATION_ERROR", message, undefined, details);
   }
 }
 
@@ -1087,8 +1087,8 @@ var CODE_TO_STATUS = {
   NO_TENANT_FOR_PROJECT: 404,
   INSTANCE_EXISTS: 409,
   SUBGRAPH_NOT_FOUND: 404,
-  PUBLIC_NAME_TAKEN: 409,
-  GHOST_KEY_READ_ONLY: 403
+  GHOST_KEY_READ_ONLY: 403,
+  UNSUPPORTED_MEDIA_TYPE: 415
 };
 function getErrorMessage(err) {
   return err instanceof Error ? err.message : String(err);
@@ -1105,8 +1105,7 @@ var DeploySubgraphRequestSchema = z2.object({
   handlerCode: z2.string().max(1048576, "handler code exceeds 1MB limit"),
   startBlock: z2.number().int().nonnegative().optional(),
   sourceCode: z2.string().max(1048576, "source code exceeds 1MB limit").optional(),
-  dryRun: z2.boolean().optional(),
-  visibility: z2.enum(["public", "private"]).optional()
+  dryRun: z2.boolean().optional()
 });
 
 // src/schemas/subscriptions.ts
@@ -1482,14 +1481,14 @@ var SYSTEM_COLUMNS = ["_id", "_block_height", "_tx_id", "_created_at"];
 var BASE_QUERY_PARAMS = ["_limit", "_offset", "_sort", "_order", "_fields"];
 var PUBLIC_BASE_QUERY_PARAMS = ["_limit", "cursor", "_order", "_fields"];
 var COMPARISON_OPS = ["neq", "gt", "gte", "lt", "lte"];
-function isPublicRead(detail) {
-  return detail.visibility === "public";
+function isPublicRead(detail, options) {
+  return options.forcePublicRead ?? detail.visibility === "public";
 }
 function generatedAt(options) {
   return options.generatedAt ?? new Date().toISOString();
 }
 function normalizeServerUrl(serverUrl) {
-  return (serverUrl ?? "https://api.secondlayer.tools").replace(/\/+$/, "");
+  return (serverUrl ?? "http://127.0.0.1:3800").replace(/\/+$/, "");
 }
 function tablePath(subgraphName, tableName, publicRead) {
   const base = publicRead ? "/v1/subgraphs" : "/api/subgraphs";
@@ -1676,7 +1675,7 @@ function tableParameters(table, publicRead) {
 }
 function generateSubgraphAgentSchema(detail, options = {}) {
   const serverUrl = normalizeServerUrl(options.serverUrl);
-  const publicRead = isPublicRead(detail);
+  const publicRead = isPublicRead(detail, options);
   const tables = {};
   for (const [tableName, table] of Object.entries(detail.tables)) {
     const path = tablePath(detail.name, tableName, publicRead);
@@ -1718,7 +1717,7 @@ function generateSubgraphAgentSchema(detail, options = {}) {
 }
 function generateSubgraphOpenApi(detail, options = {}) {
   const serverUrl = normalizeServerUrl(options.serverUrl);
-  const publicRead = isPublicRead(detail);
+  const publicRead = isPublicRead(detail, options);
   const paths = {};
   const schemas = {};
   for (const [tableName, table] of Object.entries(detail.tables)) {
@@ -1830,7 +1829,7 @@ function generateSubgraphOpenApi(detail, options = {}) {
 }
 function generateSubgraphMarkdown(detail, options = {}) {
   const agent = generateSubgraphAgentSchema(detail, options);
-  const publicRead = isPublicRead(detail);
+  const publicRead = isPublicRead(detail, options);
   const lines = [
     `# ${detail.name} Subgraph API`,
     "",
@@ -2148,5 +2147,5 @@ export {
   AuthenticationError
 };
 
-//# debugId=50742DF34BFE24EE64756E2164756E21
+//# debugId=CC94EE7EB04C7F8864756E2164756E21
 //# sourceMappingURL=index.js.map