@secondlayer/cli 14.1.1 → 14.1.2

package/dist/cli.js

@@ -34963,14 +34963,13 @@ var init_node_impl = __esm(() => {
 // src/lib/archive-reference.ts
 import { createHash as createHash4 } from "node:crypto";
 import { readFile as readFile5 } from "node:fs/promises";
-import { dirname as dirname16, join as join13, resolve as resolve13, sep as sep2 } from "node:path";
+import { join as join13, resolve as resolve13, sep as sep2 } from "node:path";
 import { parseRetryAfter } from "@secondlayer/sdk";
-import { ARCHIVE_ROOT_PUBLIC_KEY_PEM } from "@secondlayer/shared/archive/root-key";
-import { verifyStreamsBulkManifestSignature } from "@secondlayer/shared/streams-bulk-manifest";
-function isLatestPointer(value) {
-  const pointer = value;
-  return typeof pointer.snapshot_path === "string" && (value.partitions === undefined || value.partitions.length === 0);
-}
+import {
+  checkSignature,
+  loadReference,
+  resolveArchivePublicKey
+} from "@secondlayer/shared/archive/reference";
 function assertPathWithinRoot(path11, root) {
   const segments = path11.split("/");
   const leaves = path11.startsWith("/") || path11.includes("\\") || /^[a-z][a-z0-9+.-]*:/i.test(path11) || /[%?#]/.test(path11) || segments.some((part) => part === "" || part === "." || part === "..");
@@ -34985,109 +34984,6 @@ function assertPathWithinRoot(path11, root) {
     }
   }
 }
-async function fetchJson(url) {
-  const response2 = await fetch(url, { signal: AbortSignal.timeout(30000) });
-  if (!response2.ok) {
-    throw new Error(`could not fetch manifest (${response2.status} ${response2.statusText})`);
-  }
-  return response2.json();
-}
-async function loadReference(source, options3 = {}) {
-  const isRemote = /^https?:\/\//.test(source);
-  let manifest;
-  let root;
-  if (isRemote) {
-    manifest = await fetchJson(source);
-    const url = new URL(source);
-    url.pathname = url.pathname.replace(/\/snapshots\/[^/]+$/, "").replace(/\/[^/]+\.json$/, "");
-    root = url.toString();
-  } else {
-    const path11 = resolve13(source);
-    manifest = JSON.parse(await readFile5(path11, "utf8"));
-    root = isLatestPointer(manifest) ? dirname16(path11) : dirname16(dirname16(path11));
-  }
-  if (!isLatestPointer(manifest)) {
-    return { manifest, origin: source, root, isRemote };
-  }
-  const pointer = manifest;
-  const snapshotPath = pointer.snapshot_path;
-  if (!SNAPSHOT_PATH_PATTERN.test(snapshotPath)) {
-    throw new Error(`pointer names an invalid snapshot path: ${snapshotPath} (expected snapshots/<sha256>.json)`);
-  }
-  if (typeof pointer.snapshot_digest !== "string" || !/^[0-9a-f]{64}$/.test(pointer.snapshot_digest)) {
-    throw new Error("pointer carries no snapshot_digest, so it cannot prove which snapshot is current");
-  }
-  if (pointer.signature !== undefined) {
-    if (!options3.publicKeyPem) {
-      throw new Error("pointer is signed but no public key is available to verify it");
-    }
-    let verified = false;
-    try {
-      verified = verifyStreamsBulkManifestSignature(pointer, options3.publicKeyPem);
-    } catch {
-      verified = false;
-    }
-    if (!verified) {
-      throw new Error("pointer signature did not verify against the archive key");
-    }
-  }
-  const resolved = isRemote ? await fetchJson(`${root.replace(/\/$/, "")}/${snapshotPath}`) : JSON.parse(await readFile5(join13(root, snapshotPath), "utf8"));
-  const digest = createHash4("sha256").update(JSON.stringify((({ signature: _s, key_id: _k, ...rest }) => rest)(resolved))).digest("hex");
-  if (digest !== pointer.snapshot_digest) {
-    throw new Error(`pointer/snapshot mismatch: latest.json names ${pointer.snapshot_digest}, resolved manifest hashes to ${digest}`);
-  }
-  return { manifest: resolved, origin: source, root, isRemote };
-}
-function checkSignature(manifest, publicKeyPem, insecure) {
-  if (insecure)
-    return { verified: false, reason: "signature check skipped" };
-  if (!manifest.signature) {
-    return { verified: false, reason: "manifest carries no signature" };
-  }
-  if (!publicKeyPem) {
-    return {
-      verified: false,
-      reason: "no public key available to verify with"
-    };
-  }
-  try {
-    const verified = verifyStreamsBulkManifestSignature(manifest, publicKeyPem);
-    return {
-      verified,
-      reason: verified ? undefined : "signature did not verify"
-    };
-  } catch (err) {
-    return {
-      verified: false,
-      reason: err instanceof Error ? err.message : "signature check failed"
-    };
-  }
-}
-async function fetchHostedKey(url) {
-  if (!url.startsWith("https://"))
-    return;
-  try {
-    const response2 = await fetch(url, { signal: AbortSignal.timeout(1e4) });
-    if (!response2.ok)
-      return;
-    const body = await response2.json();
-    return typeof body.public_key_pem === "string" ? body.public_key_pem : undefined;
-  } catch {
-    return;
-  }
-}
-async function resolveArchivePublicKey(input4) {
-  if (input4.explicitPem)
-    return input4.explicitPem;
-  if (input4.envPem)
-    return input4.envPem;
-  if (input4.allowHostedApi) {
-    const hosted = await fetchHostedKey(input4.hostedKeyUrl ?? HOSTED_SIGNING_KEY_URL);
-    if (hosted)
-      return hosted;
-  }
-  return ARCHIVE_ROOT_PUBLIC_KEY_PEM;
-}
 function isTransientCode(code) {
   return typeof code === "string" && (TRANSIENT_ERROR_CODES.has(code) || code.startsWith("UND_ERR_"));
 }
@@ -35178,9 +35074,8 @@ async function fetchVerifiedPartition(reference, partition, gate, fetchOpts) {
   }
   return bytes;
 }
-var SNAPSHOT_PATH_PATTERN, HOSTED_SIGNING_KEY_URL = "https://api.secondlayer.tools/public/streams/signing-key", ArchiveFetchError, TRANSIENT_ERROR_CODES, PARTITION_FETCH_RETRIES = 3, PARTITION_FETCH_TIMEOUT_MS = 300000, RETRY_BASE_MS = 1000, RETRY_AFTER_CAP_MS = 60000;
+var ArchiveFetchError, TRANSIENT_ERROR_CODES, PARTITION_FETCH_RETRIES = 3, PARTITION_FETCH_TIMEOUT_MS = 300000, RETRY_BASE_MS = 1000, RETRY_AFTER_CAP_MS = 60000;
 var init_archive_reference = __esm(() => {
-  SNAPSHOT_PATH_PATTERN = /^snapshots\/[0-9a-f]{64}\.json$/;
   ArchiveFetchError = class ArchiveFetchError extends Error {
     transient;
     attempts;
@@ -35207,7 +35102,7 @@ var init_archive_reference = __esm(() => {
 import { randomBytes as randomBytes3 } from "node:crypto";
 import { existsSync as existsSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "node:fs";
 import { resolve as resolve14 } from "node:path";
-import { ARCHIVE_ROOT_PUBLIC_KEY_PEM as ARCHIVE_ROOT_PUBLIC_KEY_PEM2 } from "@secondlayer/shared/archive/root-key";
+import { ARCHIVE_ROOT_PUBLIC_KEY_PEM } from "@secondlayer/shared/archive/root-key";
 import { generateEd25519KeyPair } from "@secondlayer/shared/crypto/ed25519";
 import { INSTANCE_NETWORKS } from "@secondlayer/shared/db/queries/instance";
 function parseInstanceNetwork(value) {
@@ -35261,7 +35156,7 @@ function buildInstanceEnv(input4) {
   const secrets = input4.existing?.SECONDLAYER_SECRETS_KEY || generateSecretsKey();
   const signing = input4.existing?.STREAMS_SIGNING_PRIVATE_KEY || input4.existing?.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY || generateSigningPrivateKey();
   const apiUrl = input4.apiUrl ?? "http://127.0.0.1:3800";
-  const archiveKey = input4.existing?.ARCHIVE_SIGNING_PUBLIC_KEY || input4.archivePublicKeyPem || ARCHIVE_ROOT_PUBLIC_KEY_PEM2;
+  const archiveKey = input4.existing?.ARCHIVE_SIGNING_PUBLIC_KEY || input4.archivePublicKeyPem || ARCHIVE_ROOT_PUBLIC_KEY_PEM;
   return {
     INSTANCE_MODE: "oss",
     STACKS_NETWORK: input4.network,
@@ -36792,7 +36687,7 @@ var {
 // package.json
 var package_default = {
   name: "@secondlayer/cli",
-  version: "14.1.1",
+  version: "14.1.2",
   description: "Run a Stacks index on your own hardware — set it up, restore verified history, and keep it current.",
   repository: {
     type: "git",
@@ -36837,8 +36732,8 @@ var package_default = {
     "@opentui/react": "^0.5.3",
     "@secondlayer/bundler": "^0.5.1",
     "@secondlayer/scaffold": "^1.5.5",
-    "@secondlayer/sdk": "^10.1.1",
-    "@secondlayer/shared": "^11.2.1",
+    "@secondlayer/sdk": "^10.2.0",
+    "@secondlayer/shared": "^11.3.0",
     "@secondlayer/stacks": "^5.1.0",
     "@secondlayer/subgraphs": "^4.1.5",
     esbuild: "^0.27.4",
@@ -37456,112 +37351,14 @@ import {
 } from "@secondlayer/sdk";
 
 // src/lib/instance-diagnosis.ts
-var BOOTSTRAP_STEP = "Restore verified history: secondlayer bootstrap --against <manifest>";
-var OBSERVER_STEP = "Confirm your node streams into this instance — secondlayer observer --mode indexer --endpoint secondlayer:3700 prints the stanza its config needs";
-var SELF_HOST_DOCS_STEP = "Docs: https://www.secondlayer.tools/docs/self-host";
-function hasNoChainData(status) {
-  const integrity = status.chainIntegrity;
-  if (!integrity || integrity.reason === "check_failed")
-    return false;
-  if (integrity.maxHeight !== 0)
-    return false;
-  return (status.chainTip ?? null) === null;
-}
-function emptyIndexIssue(status) {
-  const decoders = status.index?.decoders ?? [];
-  const stalled = decoders.filter((d2) => d2.status !== "ok").length;
-  const decoderClause = stalled > 0 ? ` and ${stalled} decoder${stalled === 1 ? "" : "s"} report unavailable because there is nothing to decode` : "";
-  return {
-    title: "No blocks indexed yet — this instance holds 0 blocks.",
-    detail: `Streams has no tip${decoderClause}, which is what makes the overall status DEGRADED. This is the expected state for a fresh instance: nothing is broken, but no read returns data until history lands.`,
-    nextSteps: [BOOTSTRAP_STEP, OBSERVER_STEP, SELF_HOST_DOCS_STEP]
-  };
-}
-var SERVICE_STEPS = [
-  "See the raw per-service report: secondlayer status --json",
-  "Check the containers from docker/oss: docker compose ps, then docker compose logs --tail=50 secondlayer"
-];
-function diagnoseInstanceStatus(status) {
-  const overall = String(status.status ?? "unknown");
-  if (hasNoChainData(status)) {
-    return { state: "empty-index", overall, issues: [emptyIndexIssue(status)] };
-  }
-  const issues = [];
-  for (const service of status.services ?? []) {
-    if (service.status === "ok")
-      continue;
-    issues.push({
-      title: `Service ${service.name} reports ${service.status}.`,
-      nextSteps: SERVICE_STEPS
-    });
-  }
-  const integrity = status.chainIntegrity;
-  if (integrity && integrity.ok === false) {
-    issues.push({
-      title: "Chain-data integrity check failed.",
-      detail: integrity.reason ?? "The tip the instance serves is not backed by the history it implies.",
-      nextSteps: [
-        "Verify against the archive: secondlayer verify all --against <manifest>",
-        "Repair what diverged: secondlayer repair --against <manifest> --apply"
-      ]
-    });
-  }
-  if (issues.length === 0 && overall !== "healthy") {
-    issues.push({
-      title: `The API reports status=${overall} but names no failing service.`,
-      detail: "Every service in the report is ok, so the degradation is in a surface this command does not summarize.",
-      nextSteps: SERVICE_STEPS
-    });
-  }
-  return {
-    state: issues.length > 0 ? "degraded" : "healthy",
-    overall,
-    issues
-  };
-}
-var CONTEXT_FIELDS = [
-  "account",
-  "streamsTip",
-  "indexTip",
-  "subgraphs",
-  "subscriptions",
-  "activeOperations"
-];
-function explainContextNulls(snapshot, probe) {
-  const nullFields = CONTEXT_FIELDS.filter((field) => (snapshot[field] ?? null) === null);
-  if (nullFields.length === 0) {
-    return { summary: "Every field resolved.", nulls: {} };
-  }
-  if (!probe.status) {
-    const reason = `No instance answered at ${probe.apiUrl} (${probe.statusError ?? "unreachable"}), so this read never reached an API.`;
-    return {
-      summary: `${reason} Start it from docker/oss with: docker compose up -d — or point SL_API_URL at the instance you meant.`,
-      nulls: Object.fromEntries(nullFields.map((field) => [field, reason]))
-    };
-  }
-  const emptyIndex = hasNoChainData(probe.status);
-  const blocks = probe.status.chainIntegrity?.maxHeight ?? null;
-  const accountReason = probe.selfHosted ? "Expected: a self-hosted instance has no account system. Accounts exist only on the metered archive deployment at api.secondlayer.tools, so null here is normal and not a failure." : "Not authenticated — run `secondlayer login`, or export INSTANCE_TOKEN.";
-  const listReason = unresolvedReadReason(probe, blocks);
-  const chainReason = emptyIndex ? `No blocks indexed yet — this instance holds 0 blocks, so there is no tip to report. ${BOOTSTRAP_STEP}` : listReason;
-  const nulls = {};
-  for (const field of nullFields) {
-    if (field === "account")
-      nulls[field] = accountReason;
-    else if (field === "streamsTip" || field === "indexTip")
-      nulls[field] = chainReason;
-    else if (field === "activeOperations")
-      nulls[field] = (snapshot.subgraphs ?? null) === null ? "Not probed: in-flight operations are read per subgraph, and the subgraph list did not resolve." : listReason;
-    else
-      nulls[field] = listReason;
-  }
-  const summary = emptyIndex ? `Instance at ${probe.apiUrl} is reachable but holds 0 blocks — the chain fields are null because nothing has been indexed yet. ${BOOTSTRAP_STEP}` : nullFields.length === 1 && nullFields[0] === "account" ? `Instance at ${probe.apiUrl} is reachable and indexed to block ${blocks ?? "unknown"}; only \`account\` is null, which is normal when self-hosting.` : `Instance at ${probe.apiUrl} is reachable, but ${nullFields.length} field${nullFields.length === 1 ? "" : "s"} did not resolve — see \`nulls\` below for each one.`;
-  return { summary, nulls };
-}
-function unresolvedReadReason(probe, blocks) {
-  const where = `The instance at ${probe.apiUrl} is reachable${blocks !== null ? ` and indexed to block ${blocks}` : ""}, but this read returned nothing.`;
-  return probe.hasCredential ? `${where} Check the surface directly: secondlayer status --json` : `${where} No credential resolved: export INSTANCE_TOKEN — an instance published past loopback requires it on every /v1 read.`;
-}
+import {
+  BOOTSTRAP_STEP,
+  OBSERVER_STEP,
+  SELF_HOST_DOCS_STEP,
+  diagnoseInstanceStatus,
+  explainContextNulls,
+  hasNoChainData
+} from "@secondlayer/shared/archive/instance-diagnosis";
 
 // src/commands/context.ts
 init_output();
@@ -42769,5 +42566,5 @@ program.commandsGroup("Archive:");
 registerCreditsCommand(program);
 program.parse();
 
-//# debugId=A5FE446DEB77888264756E2164756E21
+//# debugId=54476D3169B18AA964756E2164756E21
 //# sourceMappingURL=cli.js.map