@secondlayer/cli 10.0.0 → 10.2.0

package/README.md

@@ -62,6 +62,19 @@ sl subscriptions create my-hook \
 
 ## Commands
 
+### Local runtime
+
+No account. Writes `.env.local`, restores history, prints the Stacks observer stanza.
+
+| Command | What it does |
+|---|---|
+| `sl init [--network mainnet\|testnet\|devnet] [--api-url <url>] [--force]` | Write `.env.local` (token, secrets key, webhook signing key). Idempotent |
+| `sl start [--print]` | Validate one-box config and print `docker compose up` |
+| `sl bootstrap --against <manifest> [--to-block <n>] [--public-key <pem>] [-y] [--json]` | Restore chain history from a verified archive into an empty database. Exit `0` restored, `1` diverged, `2` refused |
+| `sl observer [--mode indexer\|signer-shared] [--endpoint host:port] [--recovery journal\|archive] [--network …]` | Print the `[[events_observer]]` stanza. Signer-shared requires `--recovery` |
+| `sl verify [all\|raw\|decode:<name>\|subgraph:<name>] --against <manifest> [--quick\|--deep\|--anchor]` | Compare local data to a signed archive. Default target `raw`. Exit `0` clean, `1` diverged, `2` unanchored |
+| `sl repair --against <archive> [--apply]` | Plan (default) or apply an archive repair |
+
 ### Auth & project
 
 | Command | What it does |
@@ -90,10 +103,10 @@ scoped reads and cannot mint (403). Minted keys inherit your plan's tier.
 | `sl subgraphs create <name>` | Scaffold a definition file |
 | `sl subgraphs scaffold <SP...::contract> [-o <path>] [--no-install]` | Generate a subgraph from a deployed contract |
 | `sl subgraphs deploy <file> [--start-block <n>] [--visibility public\|private]` | Deploy; `--start-block` overrides the definition. Managed deploys default `public`, BYO default `private` |
-| `sl subgraphs publish <name>` / `unpublish <name>` | Flip visibility; publish claims the global public name (409 `PUBLIC_NAME_TAKEN` if claimed) |
+| `sl subgraphs list` | List deployments (`ls` alias) |
 | `sl subgraphs dev <file>` | Watch + hot-redeploy |
 | `sl subgraphs query <name> <table>` | Query a table with filters, sort, pagination |
-| `sl subgraphs list` / `status <name>` / `gaps <name>` | Inspect deployments |
+| `sl subgraphs status <name>` / `gaps <name>` | Inspect a deployment |
 | `sl subgraphs spec <nameOrFile> [--format openapi\|agent\|markdown]` | Export API docs for a deployed subgraph or a local definition file |
 | `sl subgraphs deploy <file> --database-url <url>` | BYO: write the subgraph's rows to your own Postgres |
 | `sl subgraphs codegen <file> --target prisma\|drizzle [-o <path>]` | Generate an ORM schema for the subgraph's tables (BYO DB) |
@@ -141,9 +154,6 @@ deliveries/...) operates on both kinds.
 |---|---|
 | `sl contracts generate [files...]` (alias `gen`) | Generate TS interfaces from Clarity contracts |
 | `sl context` | Print a headless orientation snapshot — account, Streams + Index tips, your subgraphs, subscriptions, and in-flight reindex operations. CLI counterpart to the MCP `secondlayer://context` resource |
-| `sl init` | Write `.env.local` (token, secrets key, webhook signing key) |
-| `sl bootstrap` | Restore chain history from a verified archive |
-| `sl observer` | Print the Stacks `events_observer` stanza |
 | `sl doctor` / `sl status` | Reachability + health checks |
 | `sl account get` / `sl account update` | Show or update display name / bio / slug |
 | `sl account billing` | Show plan, subscription, trial, discounts |

package/dist/cli.js

@@ -2551,7 +2551,7 @@ var init_session = __esm(() => {
 
 // src/lib/resolve-auth.ts
 function resolveApiUrl() {
-  return process.env.SL_API_URL ?? process.env.SL_PLATFORM_API_URL ?? DEFAULT_API_URL;
+  return (process.env.SL_API_URL ?? process.env.SL_PLATFORM_API_URL ?? LOCAL_API_URL).replace(/\/+$/, "");
 }
 function resolveEnvKey() {
   return process.env.SL_API_KEY;
@@ -2574,9 +2574,13 @@ async function resolveAuth() {
   return { apiUrl, ephemeralKey: session.token, fromEnv: false };
 }
 function isOssMode() {
-  return !!process.env.SL_API_URL;
+  try {
+    return new URL(resolveApiUrl()).hostname !== "api.secondlayer.tools";
+  } catch {
+    return true;
+  }
 }
-var DEFAULT_API_URL = "https://api.secondlayer.tools";
+var LOCAL_API_URL = "http://127.0.0.1:3800";
 var init_resolve_auth = __esm(() => {
   init_session();
 });
@@ -30902,7 +30906,7 @@ import { resolve as resolve4 } from "node:path";
 import { Index as Index2 } from "@secondlayer/sdk";
 function client() {
   return new Index2({
-    baseUrl: process.env.SL_API_URL ?? DEFAULT_BASE_URL,
+    baseUrl: resolveApiUrl(),
     apiKey: resolveEnvKey()
   });
 }
@@ -30910,7 +30914,7 @@ function fail(action2, err) {
   const message = err instanceof Error ? err.message : String(err);
   error(`Failed to ${action2}: ${message}`);
   if (/\b403\b/.test(message) || /forbidden/i.test(message)) {
-    note("The Index API requires a Build+ tier key (free-tier keys are rejected).");
+    note("The local API refused this read. Check INSTANCE_TOKEN / SL_API_KEY.");
   }
   process.exit(1);
 }
@@ -31101,7 +31105,6 @@ async function runIndexCodegen(o3) {
     process.exit(1);
   }
 }
-var DEFAULT_BASE_URL = "https://api.secondlayer.tools";
 var init_index_api = __esm(() => {
   init_fs();
   init_output();
@@ -34784,7 +34787,7 @@ init_esm();
 // package.json
 var package_default = {
   name: "@secondlayer/cli",
-  version: "10.0.0",
+  version: "10.2.0",
   repository: {
     type: "git",
     url: "git+https://github.com/ryanwaits/secondlayer.git",
@@ -34825,10 +34828,10 @@ var package_default = {
     "@biomejs/wasm-nodejs": "^1.9.0",
     "@dsnp/parquetjs": "^1.8.8",
     "@inquirer/prompts": "^8.2.0",
-    "@secondlayer/bundler": "^0.4.1",
+    "@secondlayer/bundler": "^0.5.0",
     "@secondlayer/scaffold": "^1.5.1",
-    "@secondlayer/sdk": "^6.51.0",
-    "@secondlayer/shared": "^7.9.0",
+    "@secondlayer/sdk": "^6.54.0",
+    "@secondlayer/shared": "^7.11.0",
     "@secondlayer/stacks": "^3.3.1",
     "@secondlayer/subgraphs": "^3.26.4",
     esbuild: "^0.27.4",
@@ -35383,12 +35386,11 @@ async function validateDatabaseConnection(url) {
 init_output();
 init_resolve_auth();
 import { SecondLayer as SecondLayer2 } from "@secondlayer/sdk";
-var DEFAULT_BASE_URL2 = "https://api.secondlayer.tools";
 function registerContextCommand(program2) {
   program2.command("context").description("Print an agent orientation snapshot: account, live Streams/Index tips, your subgraphs/subscriptions, and in-flight reindex operations").option("--json", "Print as JSON (default)").action(async (o3) => {
     try {
       const sl = new SecondLayer2({
-        baseUrl: process.env.SL_API_URL ?? DEFAULT_BASE_URL2,
+        baseUrl: resolveApiUrl(),
         apiKey: resolveEnvKey()
       });
       const snapshot = await sl.context();
@@ -35411,7 +35413,8 @@ function registerStatusCommand(program2) {
   program2.command("status").description("Show system status").option("--json", "Output as JSON").action(async (options3) => {
     const config = await loadConfig2();
     try {
-      const status = await httpPlatform("/status");
+      const local = process.env.INSTANCE_MODE === "oss" || (process.env.SL_API_URL ?? "").includes("127.0.0.1") || (process.env.SL_API_URL ?? "").includes("localhost");
+      const status = local ? await httpPlatform("/public/status") : await httpPlatform("/status");
       output({
         json: options3.json,
         data: status,
@@ -37065,20 +37068,11 @@ import { mkdir as mkdir3, writeFile as writeFile3 } from "node:fs/promises";
 import { dirname as dirname9, join as join10 } from "node:path";
 import { createStreamsClient } from "@secondlayer/sdk";
 import { STREAMS_EVENT_TYPES } from "@secondlayer/shared";
-var DEFAULT_BASE_URL3 = "https://api.secondlayer.tools";
 var VALID_TYPES = STREAMS_EVENT_TYPES;
-function readApiKey() {
-  const key = resolveEnvKey();
-  if (!key) {
-    error("No API key set. Export SL_API_KEY (issue one at https://www.secondlayer.tools/platform/api-keys).");
-    process.exit(1);
-  }
-  return key;
-}
 function client2() {
   return createStreamsClient({
-    baseUrl: process.env.SL_API_URL ?? DEFAULT_BASE_URL3,
-    apiKey: readApiKey()
+    baseUrl: resolveApiUrl(),
+    apiKey: resolveEnvKey() ?? ""
   });
 }
 function dumpsClient(dumpsUrl) {
@@ -37088,7 +37082,7 @@ function dumpsClient(dumpsUrl) {
     process.exit(1);
   }
   return createStreamsClient({
-    baseUrl: process.env.SL_API_URL ?? DEFAULT_BASE_URL3,
+    baseUrl: resolveApiUrl(),
     apiKey: resolveEnvKey() ?? "",
     dumpsBaseUrl
   });
@@ -37131,7 +37125,7 @@ function parseHeight(value, name) {
   return n3;
 }
 function registerStreamsCommand(program2) {
-  const streams = program2.command("streams").description("Read raw chain events from Streams (requires SL_API_KEY)");
+  const streams = program2.command("streams").description("Read raw chain events from Streams");
   streams.command("tip").description("Print current canonical tip").option("--json", "Output as JSON (streams always emits JSON)").action(async () => {
     try {
       const tip = await client2().tip();
@@ -37285,7 +37279,6 @@ init_index_api();
 init_output();
 init_resolve_auth();
 import { SecondLayer as SecondLayer4 } from "@secondlayer/sdk";
-var DEFAULT_BASE_URL4 = "https://api.secondlayer.tools";
 function registerKeysCommand(program2) {
   const keys = program2.command("keys", { hidden: true }).description("Manage API keys");
   keys.command("create").description("Mint a scoped streams/index read key (requires an account-level key)").option("--product <product>", "Key scope: streams or index", "streams").option("--name <name>", "Optional label for the key").option("--json", "Print the full response as JSON").action(async (o3) => {
@@ -37300,7 +37293,7 @@ function registerKeysCommand(program2) {
     }
     try {
       const sl = new SecondLayer4({
-        baseUrl: process.env.SL_API_URL ?? DEFAULT_BASE_URL4,
+        baseUrl: resolveApiUrl(),
         apiKey
       });
       const minted = await sl.apiKeys.create({
@@ -37481,7 +37474,7 @@ function registerDoctorCommand(program2) {
 }
 async function runHostedDoctor(jsonOutput) {
   const config = await loadConfig2();
-  const apiUrl = process.env.SL_PLATFORM_API_URL ?? "https://api.secondlayer.tools";
+  const apiUrl = process.env.SL_PLATFORM_API_URL ?? process.env.SL_API_URL ?? "http://127.0.0.1:3800";
   const issues = [];
   const results = { network: config.network, apiUrl };
   let apiHealthy = false;
@@ -38738,6 +38731,11 @@ import {
   comparePartitionSemanticDigests,
   computePartitionSemanticDigest
 } from "@secondlayer/shared/archive/semantic-digest-builder";
+import {
+  datasetMatchesTarget,
+  parseVerifyTarget,
+  reportVerify
+} from "@secondlayer/shared/coverage";
 import { getDb as getDb2 } from "@secondlayer/shared/db";
 
 // src/lib/archive-reference.ts
@@ -38881,17 +38879,21 @@ function statusLabel(status2) {
   return yellow("missing");
 }
 function registerVerifyCommand(program2) {
-  program2.command("verify").description("Compare local chain data against a signed archive (read-only; nothing is uploaded)").requiredOption("--against <manifest>", "archive manifest: an https URL or a local file path").option("--from-block <n>", "first height to check").option("--to-block <n>", "last height to check").option("--counts", "also compare transaction/event row counts (slower)").option("--semantic", "also recompute per-partition semantic digests locally and compare (slow: full re-stream)").option("--public-key <pem>", "pin the signing key instead of fetching it").option("--insecure", "skip the manifest signature check (not recommended)").option("--json", "Output as JSON").addHelpText("after", `
+  program2.command("verify").description("Compare local chain data against a signed archive (read-only; nothing is uploaded)").argument("[target]", "all | raw | decode:<name> | subgraph:<name>", "raw").option("--quick", "coverage/identity only (default)").option("--deep", "include semantic / scratch replay where available").option("--anchor", "require a verified archive signature").requiredOption("--against <manifest>", "archive manifest: an https URL or a local file path").option("--from-block <n>", "first height to check").option("--to-block <n>", "last height to check").option("--counts", "also compare transaction/event row counts (slower)").option("--semantic", "also recompute per-partition semantic digests locally and compare (slow: full re-stream)").option("--public-key <pem>", "pin the signing key instead of fetching it").option("--insecure", "skip the manifest signature check (not recommended)").option("--json", "Output as JSON").addHelpText("after", `
 Examples:
   $ sl verify --against https://archive.secondlayer.tools/.../snapshots/<digest>.json
-  $ sl verify --against ./snapshot.json --from-block 8000000 --to-block 8499999
-  $ sl verify --against ./snapshot.json --counts --json
+  $ sl verify raw --against ./snapshot.json --from-block 8000000 --to-block 8499999
+  $ sl verify all --against ./snapshot.json --json
+  $ sl verify decode:ft_transfer --against ./snapshot.json --quick
+  $ sl verify subgraph:sbtc --against ./snapshot.json --deep
 
 Exit codes:
   0  local data matches the archive
   1  divergence found (divergent ranges are listed)
-  2  unanchored — reference unavailable or unverifiable`).action(async (opts) => {
+  2  unanchored — reference unavailable or unverifiable`).action(async (targetArg, opts) => {
     try {
+      const target = parseVerifyTarget(targetArg);
+      const mode = opts.deep ? "deep" : opts.anchor ? "anchor" : "quick";
       const fromBlock = opts.fromBlock === undefined ? undefined : parseHeight2(opts.fromBlock, "--from-block");
       const toBlock = opts.toBlock === undefined ? undefined : parseHeight2(opts.toBlock, "--to-block");
       if (fromBlock !== undefined && toBlock !== undefined && toBlock < fromBlock) {
@@ -38907,6 +38909,12 @@ Exit codes:
         output({
           json: opts.json,
           data: {
+            ...reportVerify({
+              target,
+              mode,
+              anchored: false,
+              detail: signature.reason
+            }),
             status: "unanchored",
             reference: origin,
             reason: signature.reason
@@ -38916,6 +38924,8 @@ Exit codes:
         process.exit(VERIFY_EXIT.UNANCHORED);
       }
       const reference = (manifest.range_digests ?? []).filter((d2) => {
+        if (!datasetMatchesTarget(d2.dataset, target))
+          return false;
         if (fromBlock !== undefined && d2.to_block < fromBlock)
           return false;
         if (toBlock !== undefined && d2.from_block > toBlock)
@@ -38963,13 +38973,15 @@ Exit codes:
       }
       const semanticChecks = [];
       const referenceSemantic = (manifest.partition_semantic_digests ?? []).filter((d2) => {
+        if (!datasetMatchesTarget(d2.dataset, target))
+          return false;
         if (fromBlock !== undefined && d2.to_block < fromBlock)
           return false;
         if (toBlock !== undefined && d2.from_block > toBlock)
           return false;
         return true;
       });
-      if (opts.semantic) {
+      if (opts.semantic || opts.deep) {
         if (referenceSemantic.length === 0) {
           warn("Reference publishes no semantic digests; --semantic had nothing to compare.");
         } else {
@@ -39001,8 +39013,14 @@ Exit codes:
         }))
       ];
       const diverged = all2.filter((c4) => c4.status !== "match");
+      const verdict = reportVerify({
+        target,
+        mode,
+        diverged: diverged.length > 0
+      });
       const report = {
-        status: diverged.length === 0 ? "clean" : "diverged",
+        ...verdict,
+        status: verdict.status,
         reference: origin,
         signature_verified: signature.verified,
         ranges_checked: all2.length,
@@ -39776,6 +39794,39 @@ function registerObserverCommand(program2) {
     writeData(renderObserverStanza({ mode, endpoint, network, recovery }));
   });
 }
+// src/commands/start.ts
+init_output();
+import { parseRuntimeConfig } from "@secondlayer/shared/runtime";
+function registerStartCommand(program2) {
+  program2.command("start").description("Validate one-box runtime config and print the compose command").option("--print", "print the compose invocation only").action((opts) => {
+    const parsed = parseRuntimeConfig({
+      NETWORK: process.env.NETWORK ?? process.env.STACKS_NETWORK,
+      DATABASE_URL: process.env.DATABASE_URL,
+      NODE_MODE: process.env.NODE_MODE ?? "external",
+      DATA_DIR: process.env.DATA_DIR ?? "/data",
+      API_PORT: process.env.API_PORT ?? "3800",
+      INDEXER_PORT: process.env.INDEXER_PORT ?? "3700",
+      STACKS_NODE_RPC_URL: process.env.STACKS_NODE_RPC_URL,
+      LISTEN_HOST: process.env.LISTEN_HOST,
+      LOG_LEVEL: process.env.LOG_LEVEL,
+      BITCOIN_RPC_PASSWORD: process.env.BITCOIN_RPC_PASSWORD
+    });
+    if (!parsed.ok) {
+      printError(parsed.errors.join("; "), {
+        hint: "Set NETWORK, DATABASE_URL, and NODE_MODE (external | stacks | full)."
+      });
+      process.exit(1);
+    }
+    const extra = parsed.config.NODE_MODE === "full" ? " --profile full-node" : parsed.config.NODE_MODE === "stacks" ? " --profile stacks-node" : "";
+    const cmd = `docker compose -f docker/oss/docker-compose.yml${extra} up -d`;
+    if (opts.print) {
+      console.log(cmd);
+      return;
+    }
+    success(`config ok (${parsed.config.NETWORK}, ${parsed.config.NODE_MODE})`);
+    console.log(cmd);
+  });
+}
 // src/cli.ts
 var { version } = package_default;
 program.name("secondlayer").alias("sl").description("Secondlayer CLI — self-hosted Stacks data runtime").version(version).option("--network <network>", "Override network (local, testnet, mainnet)").option("--api-key <key>", "API credential (overrides SL_API_KEY)").option("--api-url <url>", "API endpoint (overrides SL_API_URL)").showSuggestionAfterError(true).showHelpAfterError("(run `sl --help` to see available commands)");
@@ -39799,6 +39850,7 @@ program.commandsGroup("Getting started:");
 registerInitCommand(program);
 registerBootstrapCommand(program);
 registerObserverCommand(program);
+registerStartCommand(program);
 registerLoginCommand(program);
 registerLogoutCommand(program);
 registerWhoamiCommand(program);
@@ -39838,5 +39890,5 @@ registerAccountCommand(program);
 registerKeysCommand(program);
 program.parse();
 
-//# debugId=8F8395688EA7983464756E2164756E21
+//# debugId=E414197C37677A7F64756E2164756E21
 //# sourceMappingURL=cli.js.map