@toloka-platform/sdk 0.10.1 → 0.11.1

package/README.md

@@ -99,6 +99,8 @@ Two rules the platform enforces and the SDK will not paper over:
 
 `createClient` takes the platform URL and one credential. `{ baseUrl, apiKey }` sends the key with the `ApiKey` authorization scheme on every request; the key does not expire until it is deleted in the Business Console. `{ baseUrl, accessToken }` calls the `accessToken` function before every request and sends its result as a Bearer token, so a renewable session can back the client. The two forms are exclusive. The CLI uses the second form for its browser sign-in.
 
+`baseUrl` may carry a path, for a gateway that serves the platform under a prefix: every request keeps that path, so `https://gateway.example/ss/pp.1` sends `GET /api/v2-beta/projects/pp.1` to `https://gateway.example/ss/pp.1/api/v2-beta/projects/pp.1`. A trailing slash makes no difference. A plain origin such as `https://platform.toloka.ai` behaves as it always has.
+
 A project-scoped token (`toloka project token`, or `POST /api/v2-beta/projects/:id/tokens`) is passed as `apiKey` too; the client recognizes the `pst_` prefix and sends it in the `X-Scoped-Token` header instead of `Authorization` (the platform gateway forwards only platform credentials in `Authorization`). Such a token acts as its minting user, confined to one or more projects of one team (`--projects` adds more) and the granted permissions, for at most six hours — hand it to an agent as `TOLOKA_API_KEY` instead of a long-lived key. `toloka project tokens` lists the live tokens of the selected project, `toloka project revoke-token <id>` kills one, and `toloka project revoke-tokens` kills every live token of the project at once (a token that covers several projects dies as a whole); a token can also end itself with `client.projects.revokeCurrentToken()`. One user may hold at most 1000 live tokens per project, counted against every project a token covers; past that, minting returns `429 You already hold 1000 live tokens for project <id>; revoke unused tokens first`. In code, `client.projects.listTokens` returns one page and `client.projects.listAllTokens` iterates them all; `client.projects.revokeAllTokens` is the bulk revoke.
 
 File downloads differ for a scoped token: `ProjectFile.url` points at the platform's file proxy, which redirects a human credential to the storage URL but answers a scoped token with `200 {"url": "<storage URL>"}`. Read `url` from that body and fetch it as a plain request, without the `X-Scoped-Token` header, because HTTP clients replay custom headers across redirects and the token must never reach the storage host.