feat: bundle SDK, add isMarketplaceApp, per-instance Proxy

package.json

@@ -57,7 +57,6 @@
   },
   "peerDependencies": {
     "@assembly-js/app-bridge": "^1.1.1",
-    "@assembly-js/node-sdk": "^3.19.1",
     "pino": ">=9",
     "pino-pretty": ">=10",
     "react": ">=18",

src/client/base-resource.ts

@@ -1,5 +1,5 @@
-import type { AssemblyAPI } from "@assembly-js/node-sdk";
 import pRetry from "p-retry";
+import type { AssemblySDK } from "src/sdk-init";
 import type { z } from "zod";
 
 import type { RetryOptions } from "./options";
@@ -17,7 +17,7 @@ const isRetryableError = (error: unknown): boolean => {
  * Wraps an SDK instance with a Proxy that retries every method call
  * on 429/5xx errors using p-retry.
  */
-const withRetry = (sdk: AssemblyAPI, retry: RetryOptions): AssemblyAPI =>
+const withRetry = (sdk: AssemblySDK, retry: RetryOptions): AssemblySDK =>
   new Proxy(sdk, {
     get(target, prop, receiver) {
       const value = Reflect.get(target, prop, receiver);
@@ -36,10 +36,10 @@ const withRetry = (sdk: AssemblyAPI, retry: RetryOptions): AssemblyAPI =>
   });
 
 export abstract class BaseResource {
-  protected readonly sdk: AssemblyAPI;
+  protected readonly sdk: AssemblySDK;
   protected readonly validateResponses: boolean;
 
-  constructor(sdk: AssemblyAPI, validateResponses: boolean, retry: RetryOptions | false) {
+  constructor(sdk: AssemblySDK, validateResponses: boolean, retry: RetryOptions | false) {
     this.sdk = retry === false ? sdk : withRetry(sdk, retry);
     this.validateResponses = validateResponses;
   }

src/client/index.ts

@@ -1,5 +1,5 @@
-import { assemblyApi } from "@assembly-js/node-sdk";
 import { AssemblyNoTokenError } from "src/errors/no-token";
+import { initSdk } from "src/sdk-init";
 import type { TokenPayload } from "src/schemas/shared/token";
 import { AssemblyToken } from "src/token/assembly-token";
 import type { ClientTokenPayload, InternalUserTokenPayload } from "src/token/assembly-token";
@@ -99,34 +99,35 @@
   readonly workspace: WorkspaceResource;
 
   constructor(options: AssemblyKitOptions) {
-    if (!options.token && !options.workspaceId) {
+    const isMarketplace: boolean = options.isMarketplaceApp ?? false;
+
+    if (isMarketplace && !options.token) {
       throw new AssemblyNoTokenError({
-        message: "Either `token` or `workspaceId` must be provided.",
+        message: "Marketplace apps require a `token`. Provide an encrypted token from Assembly.",
+      });
+    }
+    if (!isMarketplace && !options.token && !options.workspaceId) {
+      throw new AssemblyNoTokenError({
+        message: "`workspaceId` is required when `token` is not provided.",
       });
     }
 
     this.currentToken = options.token;
 
     if (options.token) {
-      // Token mode: decrypt token to get payload + let the underlying SDK build the compound key.
       this.token = new AssemblyToken({ token: options.token, apiKey: options.apiKey });
       this.payload = this.token.payload;
     } else {
-      // Workspace-only mode: no token to decrypt.
       this.token = undefined;
       this.payload = undefined;
     }
 
-    // When no token is provided, set ASSEMBLY_ENV=local so the underlying SDK
-    // accepts the raw apiKey, then pass the compound key (workspaceId/apiKey)
-    // as the apiKey directly.
-    let sdkApiKey: string = options.apiKey;
-    if (!options.token) {
-      process.env.ASSEMBLY_ENV = "local";
-      sdkApiKey = `${options.workspaceId}/${options.apiKey}`;
-    }
+    // Build compound key ourselves — no ASSEMBLY_ENV hack, no upstream init.js.
+    const compoundKey: string = this.token
+      ? this.token.buildCompoundKey({ apiKey: options.apiKey })
+      : `${options.workspaceId}/${options.apiKey}`;
 
-    const sdk = assemblyApi({ apiKey: sdkApiKey, token: options.token });
+    const sdk = initSdk({ compoundKey });
     const validate = options.validateResponses ?? true;
     const retry = options.retry === false ? false : { ...DEFAULT_RETRY, ...options.retry };
 

src/client/options.ts

@@ -20,17 +20,23 @@ export const DEFAULT_RETRY: RetryOptions = {
 /**
  * Options for `createAssemblyKit()`.
  *
- * At least one of `token` or `workspaceId` must be provided at runtime.
- * If both are provided, `token` takes precedence (workspaceId is ignored).
- * If only `workspaceId` is provided, the compound key is built as `workspaceId/apiKey`.
+ * - `isMarketplaceApp: true` → `token` is required (marketplace apps receive it from the platform).
+ * - `isMarketplaceApp: false` (default) → `workspaceId` is required; `token` is optional.
+ * - When both `token` and `workspaceId` are provided, `token` takes precedence.
  */
 export interface AssemblyKitOptions {
   /** Assembly API key. */
   apiKey: string;
-  /** Encrypted token from Assembly. Takes precedence over `workspaceId` when provided. */
+  /** Encrypted token from Assembly. Required when `isMarketplaceApp` is `true`. */
   token?: string;
-  /** Workspace ID. Required when `token` is not provided. Ignored when `token` is present. */
+  /** Workspace ID. Required when `isMarketplaceApp` is `false` and `token` is not provided. */
   workspaceId?: string;
+  /**
+   * When `true`, `token` is required at construction time (marketplace apps).
+   * When `false` (default), `workspaceId` is required instead.
+   * @default false
+   */
+  isMarketplaceApp?: boolean;
   /** Retry configuration, or `false` to disable retry entirely. */
   retry?: RetryOptions | false;
   /** When true, all responses are validated through Zod schemas. Default: true. */

src/sdk-init.ts

@@ -0,0 +1,51 @@
+/**
+ * Custom SDK initializer that wraps `@assembly-js/node-sdk`.
+ *
+ * Calls `assemblyApi()` once with a dummy key (under ASSEMBLY_ENV=local) to
+ * obtain the `DefaultService` reference + `sendWebhook`. Then wraps it in a
+ * Proxy that sets `OpenAPI.HEADERS` to this instance's compound key before
+ * every method call — making multiple `createAssemblyKit()` instances safe
+ * in the same process.
+ *
+ * With `unbundle: false` in vite.config.ts, the SDK is inlined into
+ * assembly-kit's dist. Consumers never need to install `@assembly-js/node-sdk`.
+ */
+
+import { type AssemblyAPI, OpenAPI, assemblyApi } from "@assembly-js/node-sdk";
+
+const SDK_VERSION: string = "3.19.1";
+
+/** The underlying SDK type returned by `assemblyApi()`. */
+export type AssemblySDK = AssemblyAPI;
+
+// Obtain the DefaultService reference once. We pass a placeholder key and
+// set ASSEMBLY_ENV=local so init.js skips token decryption. The headers it
+// sets are immediately overwritten per-instance via the Proxy.
+const _prevEnv: string | undefined = process.env.ASSEMBLY_ENV;
+process.env.ASSEMBLY_ENV = "local";
+const _baseSdk: AssemblyAPI = assemblyApi({ apiKey: "__placeholder__" });
+process.env.ASSEMBLY_ENV = _prevEnv;
+
+/**
+ * Create a per-instance SDK wrapper that sets `OpenAPI.HEADERS` to this
+ * instance's compound key before every method call.
+ *
+ * JS is single-threaded, so the header is always correct when the fetch fires.
+ */
+export function initSdk({ compoundKey }: { compoundKey: string }): AssemblySDK {
+  const headers: Record<string, string> = {
+    "X-API-Key": compoundKey,
+    "X-Assembly-SDK-Version": SDK_VERSION,
+  };
+
+  return new Proxy(_baseSdk, {
+    get(target, prop, receiver) {
+      const value = Reflect.get(target, prop, receiver);
+      if (typeof value !== "function") return value;
+      return (...args: unknown[]) => {
+        OpenAPI.HEADERS = headers;
+        return (value as (...a: unknown[]) => unknown).apply(target, args);
+      };
+    },
+  });
+}

vite.config.ts

@@ -21,7 +21,7 @@ export default defineConfig({
       "src/schemas/index.ts",
       "src/token/index.ts",
     ],
-    unbundle: true,
+    unbundle: false,
     exports: true,
     sourcemap: true,
     dts: {