@secondlayer/cli 14.1.1 → 14.2.0

package/dist/cli.js

@@ -2483,11 +2483,24 @@ var require_commander = __commonJS((exports) => {
 
 // src/lib/api-url.ts
 function resolveApiUrl() {
-  return (process.env.SL_API_URL ?? process.env.SL_PLATFORM_API_URL ?? LOCAL_API_URL).replace(/\/+$/, "");
+  return (process.env.SECONDLAYER_API_URL ?? process.env.SL_API_URL ?? process.env.SL_PLATFORM_API_URL ?? LOCAL_API_URL).replace(/\/+$/, "");
 }
 function resolveArchiveOpsUrl() {
   return (process.env.SL_CREDITS_API_URL ?? ARCHIVE_OPS_API_URL).replace(/\/+$/, "");
 }
+function isMerchantUrl(url = resolveApiUrl()) {
+  try {
+    return new URL(url).hostname === "api.secondlayer.tools";
+  } catch {
+    return false;
+  }
+}
+function assertInstanceUrl(url = resolveApiUrl()) {
+  if (!isMerchantUrl(url))
+    return;
+  throw new Error(`this command runs on your instance, not api.secondlayer.tools.
+unset SECONDLAYER_API_URL, or pass --api-url http://127.0.0.1:3800`);
+}
 var LOCAL_API_URL = "http://127.0.0.1:3800", ARCHIVE_OPS_API_URL = "https://api.secondlayer.tools";
 
 // src/lib/session.ts
@@ -2578,10 +2591,18 @@ var init_session = __esm(() => {
 });
 
 // src/lib/resolve-auth.ts
-import { resolveApiKey } from "@secondlayer/sdk";
+import { resolveAccountKey, resolveApiKey } from "@secondlayer/sdk";
 function resolveEnvKey() {
   return resolveApiKey();
 }
+function applyApiKeyFlag(apiKey) {
+  if (/^s[ks]-sl_/.test(apiKey)) {
+    process.env.SECONDLAYER_API_KEY = apiKey;
+    process.env.SL_API_KEY = apiKey;
+  } else {
+    process.env.INSTANCE_TOKEN = apiKey;
+  }
+}
 async function resolveAuth() {
   const apiUrl = resolveApiUrl();
   const envKey = resolveEnvKey();
@@ -2600,17 +2621,19 @@ async function resolveAuth() {
   return { apiUrl, ephemeralKey: session.token, fromEnv: false };
 }
 function isOssMode() {
-  try {
-    return new URL(resolveApiUrl()).hostname !== "api.secondlayer.tools";
-  } catch {
-    return true;
-  }
+  return !isMerchantUrl();
+}
+function resolveDataPlaneKey() {
+  if (isMerchantUrl())
+    return resolveAccountKey();
+  return resolveApiKey();
 }
 var init_resolve_auth = __esm(() => {
   init_session();
 });
 
 // src/lib/http.ts
+import { resolveAccountKey as resolveAccountKey2, resolveApiKey as resolveApiKey2 } from "@secondlayer/sdk";
 async function request(url, opts) {
   const headers = {
     "content-type": "application/json",
@@ -2649,7 +2672,7 @@ async function httpArchiveOpsAnon(path2, opts = {}) {
   return httpAt(resolveArchiveOpsUrl(), path2, opts);
 }
 async function resolveArchiveOpsBearer() {
-  const envKey = resolveEnvKey();
+  const envKey = resolveAccountKey2();
   const session = await readSession(resolveArchiveOpsUrl());
   if (session) {
     return {
@@ -2664,7 +2687,7 @@ async function resolveArchiveOpsBearer() {
   return {
     bearer: undefined,
     source: null,
-    ignoredEnvKey: envKey !== undefined
+    ignoredEnvKey: resolveApiKey2() !== undefined && envKey === undefined
   };
 }
 function ignoredEnvKeyNote(ignored) {
@@ -16318,7 +16341,7 @@ class StacksApiClient {
       const statusCode = typeof error2 === "object" && error2 !== null && "response" in error2 && typeof error2.response === "object" && error2.response !== null && "statusCode" in error2.response ? error2.response.statusCode : undefined;
       const message = error2 instanceof Error ? error2.message : String(error2);
       if (statusCode === 401) {
-        throw new Error(isOssMode() ? "Authentication required. Set INSTANCE_TOKEN from `secondlayer init` (SL_API_KEY is a legacy alias)." : "Authentication required. Run: secondlayer login");
+        throw new Error(isOssMode() ? "Authentication required. Set INSTANCE_TOKEN from `secondlayer init`." : "Authentication required. Run: secondlayer login");
       }
       if (statusCode === 404) {
         throw new Error(`${resourceType} not found: ${resourceId}`);
@@ -28610,7 +28633,7 @@ function handleApiError(err, action2) {
   const status = err instanceof ApiError || err instanceof CliHttpError ? err.status : undefined;
   if (err instanceof CliHttpError && err.code === "SESSION_EXPIRED" || status === 401) {
     printError("Authentication required.", {
-      hint: isOssMode() ? "Set INSTANCE_TOKEN from `secondlayer init` (SL_API_KEY is a legacy alias)." : "Run `secondlayer login` to re-authenticate."
+      hint: isOssMode() ? "Set INSTANCE_TOKEN from `secondlayer init`." : "Run `secondlayer login` to re-authenticate."
     });
     process.exit(1);
   }
@@ -29097,143 +29120,6 @@ function inspectSourceGitState(absPath) {
 }
 var init_git_status = () => {};
 
-// src/commands/login.ts
-import { confirm as confirm2, input } from "@inquirer/prompts";
-function sessionExpiry() {
-  return new Date(Date.now() + 90 * 24 * 60 * 60 * 1000).toISOString();
-}
-async function readStdin() {
-  const chunks = [];
-  for await (const chunk of process.stdin)
-    chunks.push(chunk);
-  return Buffer.concat(chunks).toString("utf8").trim();
-}
-function loginTarget(opts) {
-  return opts.credits ? resolveArchiveOpsUrl() : resolveApiUrl();
-}
-async function runTokenLogin(opts) {
-  const token = await readStdin();
-  if (!token) {
-    error('No token on stdin. Usage: echo "$KEY" | secondlayer login --with-token');
-    process.exit(1);
-  }
-  const target = loginTarget(opts);
-  let account;
-  try {
-    account = await httpAt(target, "/api/accounts/me", { bearer: token });
-  } catch (err) {
-    error(err instanceof CliHttpError ? `Token rejected by ${target}: ${err.message}` : err instanceof Error ? err.message : String(err));
-    process.exit(1);
-  }
-  await writeSession({
-    token,
-    email: account.email,
-    accountId: account.id,
-    expiresAt: sessionExpiry()
-  }, target);
-  success(`Logged in as ${account.email} (${target})`);
-}
-async function runLoginFlow(options3 = {}) {
-  const target = loginTarget(options3);
-  if (!options3.force) {
-    const existing = await readSession(target);
-    if (existing) {
-      info(`Already logged in as ${existing.email} (${target}).`);
-      if (!process.stdin.isTTY) {
-        info(dim("Run 'secondlayer logout' first, or re-run with --force to switch accounts."));
-        return;
-      }
-      try {
-        const proceed = await confirm2({
-          message: "Log in as a different user?",
-          default: false
-        });
-        if (!proceed) {
-          info(dim("Run 'secondlayer logout' to sign out."));
-          return;
-        }
-      } catch {
-        info(dim("Run 'secondlayer logout' first, or re-run with --force to switch accounts."));
-        return;
-      }
-    }
-  }
-  const email = await input({
-    message: "Email",
-    validate: (v2) => /^.+@.+\..+$/.test(v2) ? true : "Invalid email"
-  });
-  try {
-    const res = await httpAt(target, "/api/auth/magic-link", {
-      method: "POST",
-      body: { email }
-    });
-    info("Check your inbox for a 6-digit code.");
-    if (res.code) {
-      info(dim(`(DEV_MODE code: ${res.code})`));
-    }
-  } catch (err) {
-    if (err instanceof CliHttpError) {
-      error(err.message);
-    } else {
-      error(err instanceof Error ? err.message : String(err));
-    }
-    process.exit(1);
-  }
-  const code = await input({
-    message: "Enter the 6-digit code",
-    validate: (v2) => /^\d{6}$/.test(v2) ? true : "Expected 6 digits"
-  });
-  try {
-    const verified = await httpAt(target, "/api/auth/verify", {
-      method: "POST",
-      body: { email, code }
-    });
-    await writeSession({
-      token: verified.sessionToken,
-      email: verified.account.email,
-      accountId: verified.account.id,
-      expiresAt: sessionExpiry()
-    }, target);
-    success(`Logged in as ${verified.account.email}`);
-    info(dim(options3.credits ? "Run 'secondlayer credits balance' to see your archive credits." : "Run 'secondlayer whoami' to see your account status."));
-  } catch (err) {
-    if (err instanceof CliHttpError) {
-      error(err.message);
-    } else {
-      error(err instanceof Error ? err.message : String(err));
-    }
-    process.exit(1);
-  }
-}
-function registerLoginCommand(program2) {
-  program2.command("login", { hidden: true }).description("Log in to Secondlayer (magic-link email)").option("--force", "Skip the already-logged-in check and re-run the flow").option("--with-token", "Read an API key from stdin (non-interactive)").option("--credits", "Log in to the archive credits account used by bootstrap, repair, and credits").addHelpText("after", `
-Examples:
-  $ secondlayer login --credits
-  $ echo "$INSTANCE_TOKEN" | secondlayer login --with-token`).action((opts) => opts.withToken ? runTokenLogin({ credits: opts.credits }) : runLoginFlow({ force: opts.force, credits: opts.credits }));
-}
-var init_login = __esm(() => {
-  init_http();
-  init_output();
-  init_session();
-});
-
-// src/lib/require-auth.ts
-async function requireAuth() {
-  if (isOssMode())
-    return;
-  const session = await readSession();
-  if (session)
-    return;
-  info("You're not logged in. Starting login flow.");
-  await runLoginFlow();
-}
-var init_require_auth = __esm(() => {
-  init_login();
-  init_output();
-  init_resolve_auth();
-  init_session();
-});
-
 // src/templates/subgraph.ts
 function generateSubgraphStarter(name) {
   return `${nextStepsHeader(name)}${starter(name)}`;
@@ -29323,7 +29209,7 @@ __export(exports_subgraph_test, {
 import { createHash as createHash2 } from "node:crypto";
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname4, resolve as resolve2 } from "node:path";
-import { Index, resolveApiKey as resolveApiKey2, resolveBaseUrl } from "@secondlayer/sdk";
+import { Index, resolveApiKey as resolveApiKey3, resolveBaseUrl } from "@secondlayer/sdk";
 import {
   DECODED_EVENT_TYPES
 } from "@secondlayer/stacks/filters";
@@ -29376,7 +29262,7 @@ function indexReadFailure(err, ctx) {
     };
   }
   if (status === 401 || status === 403) {
-    const credential = resolveApiKey2() ? "INSTANCE_TOKEN is set in this shell" : "no INSTANCE_TOKEN is set in this shell";
+    const credential = resolveApiKey3() ? "INSTANCE_TOKEN is set in this shell" : "no INSTANCE_TOKEN is set in this shell";
     return {
       message: `Index read rejected (HTTP ${status}) while ${where}.`,
       hint: `${credential}. This read uses the same SL_API_URL + INSTANCE_TOKEN pair as \`secondlayer subgraphs deploy\` — confirm both point at the instance you deployed to (\`secondlayer status\`), then retry. ${offlineHint}`
@@ -29611,7 +29497,7 @@ import {
 } from "node:fs";
 import { basename, dirname as dirname5, extname, join as join4, resolve as resolve3 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
-import { confirm as confirm3 } from "@inquirer/prompts";
+import { confirm as confirm2 } from "@inquirer/prompts";
 import {
   generatePrintPayloadTypes,
   generatePrintSchemaSubgraph
@@ -29627,7 +29513,7 @@ async function loadSubgraphWithDepCheck(absPath) {
     if (!missingSdk)
       throw err;
     warn("Missing dependency: @secondlayer/subgraphs");
-    const install = await confirm3({
+    const install = await confirm2({
       message: "Install with `bun add @secondlayer/subgraphs`?",
       default: true
     });
@@ -29797,9 +29683,9 @@ async function specFromLocalFile(absPath, format2, specOptions) {
   });
   return format2 === "openapi" ? generateSubgraphOpenApi(detail, specOptions) : format2 === "agent" ? generateSubgraphAgentSchema(detail, specOptions) : generateSubgraphMarkdown(detail, specOptions);
 }
-function createLocalSubgraphDetail(input2) {
+function createLocalSubgraphDetail(input) {
   const tables = {};
-  for (const [tableName, rawTable] of Object.entries(input2.schema)) {
+  for (const [tableName, rawTable] of Object.entries(input.schema)) {
     const table = rawTable;
     const columns = {};
     for (const [columnName, column] of Object.entries(table.columns ?? {})) {
@@ -29816,22 +29702,22 @@ function createLocalSubgraphDetail(input2) {
     columns._tx_id = { type: "text" };
     columns._created_at = { type: "timestamp" };
     tables[tableName] = {
-      endpoint: `/subgraphs/${input2.name}/${tableName}`,
+      endpoint: `/subgraphs/${input.name}/${tableName}`,
       columns,
       rowCount: 0,
-      example: `/subgraphs/${input2.name}/${tableName}?_sort=_block_height&_order=desc&_limit=10`,
+      example: `/subgraphs/${input.name}/${tableName}?_sort=_block_height&_order=desc&_limit=10`,
       ...table.indexes && { indexes: table.indexes },
       ...table.uniqueKeys && { uniqueKeys: table.uniqueKeys }
     };
   }
   return {
-    name: input2.name,
-    version: input2.version ?? "0.0.0",
-    schemaHash: input2.schemaHash,
+    name: input.name,
+    version: input.version ?? "0.0.0",
+    schemaHash: input.schemaHash,
     status: "local",
     lastProcessedBlock: 0,
-    ...input2.description && { description: input2.description },
-    sources: input2.sources,
+    ...input.description && { description: input.description },
+    sources: input.sources,
     health: {
       totalProcessed: 0,
       totalErrors: 0,
@@ -30050,6 +29936,7 @@ function formatSubgraphSync(sync) {
 }
 function registerSubgraphsCommand(program2) {
   const subgraphs = program2.command("subgraphs").description("Manage materialized subgraphs");
+  subgraphs.hook("preAction", () => assertInstanceUrl());
   subgraphs.command("create <name>").description("Start here: create a new subgraph definition file (see also: subgraphs scaffold)").option("--from-contract <contractId>", "Generate sources/schema/handlers from the contract's observed print events (requires network)").option("--table-per-topic", "With --from-contract: one table per print topic instead of a single wide table").addHelpText("after", `
 create is the default way to start a subgraph. It writes subgraphs/<name>.ts —
 an empty starter, or with --from-contract a schema inferred from the print
@@ -30186,7 +30073,7 @@ otherwise the deployed definition's only copy is the row in the database. Pass
             const message = `${file} is ${reason}. Deploy it and the only copy of this definition is a row in the database.`;
             if (process.stdin.isTTY) {
               warn(message);
-              const confirmed = await confirm3({
+              const confirmed = await confirm2({
                 message: "Deploy anyway?",
                 default: false
               });
@@ -30202,9 +30089,6 @@ otherwise the deployed definition's only copy is the row in the database. Pass
         }
       }
       const config = await loadConfig2();
-      if (config.network !== "local" && !isOssMode()) {
-        await requireAuth();
-      }
       const dryRun = options3.dryRun;
       const startBlock = parseStartBlockOption(options3.startBlock);
       if (startBlock !== undefined) {
@@ -30927,8 +30811,6 @@ var init_subgraphs2 = __esm(() => {
   init_fs();
   init_git_status();
   init_output();
-  init_require_auth();
-  init_resolve_auth();
   init_resolve_auth();
   init_clarity();
   init_api();
@@ -30973,14 +30855,14 @@ function parseIndexEventType(eventType, types5) {
 function client() {
   return new Index2({
     baseUrl: resolveApiUrl(),
-    apiKey: resolveEnvKey()
+    apiKey: resolveDataPlaneKey()
   });
 }
 function fail(action2, err) {
   const message = err instanceof Error ? err.message : String(err);
   error(`Failed to ${action2}: ${message}`);
   if (/\b403\b/.test(message) || /forbidden/i.test(message)) {
-    note("The local API refused this read. Check INSTANCE_TOKEN.");
+    note(isMerchantUrl() ? "The API refused this read. Check SECONDLAYER_API_KEY." : "The local API refused this read. Check INSTANCE_TOKEN.");
   }
   process.exit(1);
 }
@@ -34578,7 +34460,7 @@ __export(exports_node_impl, {
   runSetupWizard: () => runSetupWizard,
   restartNode: () => restartNode
 });
-import { confirm as confirm5, input as input3, select as select4 } from "@inquirer/prompts";
+import { confirm as confirm4, input as input2, select as select4 } from "@inquirer/prompts";
 async function runSetupWizard() {
   console.log("");
   console.log(blue("Stacks Node Setup Wizard"));
@@ -34596,7 +34478,7 @@ async function runSetupWizard() {
   }
   success("Docker is running");
   console.log("");
-  const installPath = await input3({
+  const installPath = await input2({
     message: "Where is stacks-blockchain-docker installed?",
     validate: async (value) => {
       if (!value.trim())
@@ -34615,18 +34497,18 @@ async function runSetupWizard() {
     ],
     default: "mainnet"
   });
-  const autoStartIndexer = await confirm5({
+  const autoStartIndexer = await confirm4({
     message: "Auto-start indexer when node starts?",
     default: true
   });
   let indexerPort = 3700;
   if (autoStartIndexer) {
-    const customPort = await confirm5({
+    const customPort = await confirm4({
       message: "Use default indexer port (3700)?",
       default: true
     });
     if (!customPort) {
-      const portInput = await input3({
+      const portInput = await input2({
         message: "Enter custom indexer port:",
         default: "3700",
         validate: (value) => {
@@ -34727,7 +34609,7 @@ async function stopNode(_pathOverride, force, _wait) {
     return;
   }
   if (!force) {
-    const proceed = await confirm5({
+    const proceed = await confirm4({
       message: "Stop the Stacks node?",
       default: false
     });
@@ -34757,7 +34639,7 @@ async function restartNode(pathOverride, force, _wait) {
   const wasRunning = await isNodeRunning();
   if (wasRunning) {
     if (!force) {
-      const proceed = await confirm5({
+      const proceed = await confirm4({
         message: "Restart the Stacks node?",
         default: false
       });
@@ -34963,14 +34845,13 @@ var init_node_impl = __esm(() => {
 // src/lib/archive-reference.ts
 import { createHash as createHash4 } from "node:crypto";
 import { readFile as readFile5 } from "node:fs/promises";
-import { dirname as dirname16, join as join13, resolve as resolve13, sep as sep2 } from "node:path";
+import { join as join13, resolve as resolve13, sep as sep2 } from "node:path";
 import { parseRetryAfter } from "@secondlayer/sdk";
-import { ARCHIVE_ROOT_PUBLIC_KEY_PEM } from "@secondlayer/shared/archive/root-key";
-import { verifyStreamsBulkManifestSignature } from "@secondlayer/shared/streams-bulk-manifest";
-function isLatestPointer(value) {
-  const pointer = value;
-  return typeof pointer.snapshot_path === "string" && (value.partitions === undefined || value.partitions.length === 0);
-}
+import {
+  checkSignature,
+  loadReference,
+  resolveArchivePublicKey
+} from "@secondlayer/shared/archive/reference";
 function assertPathWithinRoot(path11, root) {
   const segments = path11.split("/");
   const leaves = path11.startsWith("/") || path11.includes("\\") || /^[a-z][a-z0-9+.-]*:/i.test(path11) || /[%?#]/.test(path11) || segments.some((part) => part === "" || part === "." || part === "..");
@@ -34985,109 +34866,6 @@ function assertPathWithinRoot(path11, root) {
     }
   }
 }
-async function fetchJson(url) {
-  const response2 = await fetch(url, { signal: AbortSignal.timeout(30000) });
-  if (!response2.ok) {
-    throw new Error(`could not fetch manifest (${response2.status} ${response2.statusText})`);
-  }
-  return response2.json();
-}
-async function loadReference(source, options3 = {}) {
-  const isRemote = /^https?:\/\//.test(source);
-  let manifest;
-  let root;
-  if (isRemote) {
-    manifest = await fetchJson(source);
-    const url = new URL(source);
-    url.pathname = url.pathname.replace(/\/snapshots\/[^/]+$/, "").replace(/\/[^/]+\.json$/, "");
-    root = url.toString();
-  } else {
-    const path11 = resolve13(source);
-    manifest = JSON.parse(await readFile5(path11, "utf8"));
-    root = isLatestPointer(manifest) ? dirname16(path11) : dirname16(dirname16(path11));
-  }
-  if (!isLatestPointer(manifest)) {
-    return { manifest, origin: source, root, isRemote };
-  }
-  const pointer = manifest;
-  const snapshotPath = pointer.snapshot_path;
-  if (!SNAPSHOT_PATH_PATTERN.test(snapshotPath)) {
-    throw new Error(`pointer names an invalid snapshot path: ${snapshotPath} (expected snapshots/<sha256>.json)`);
-  }
-  if (typeof pointer.snapshot_digest !== "string" || !/^[0-9a-f]{64}$/.test(pointer.snapshot_digest)) {
-    throw new Error("pointer carries no snapshot_digest, so it cannot prove which snapshot is current");
-  }
-  if (pointer.signature !== undefined) {
-    if (!options3.publicKeyPem) {
-      throw new Error("pointer is signed but no public key is available to verify it");
-    }
-    let verified = false;
-    try {
-      verified = verifyStreamsBulkManifestSignature(pointer, options3.publicKeyPem);
-    } catch {
-      verified = false;
-    }
-    if (!verified) {
-      throw new Error("pointer signature did not verify against the archive key");
-    }
-  }
-  const resolved = isRemote ? await fetchJson(`${root.replace(/\/$/, "")}/${snapshotPath}`) : JSON.parse(await readFile5(join13(root, snapshotPath), "utf8"));
-  const digest = createHash4("sha256").update(JSON.stringify((({ signature: _s, key_id: _k, ...rest }) => rest)(resolved))).digest("hex");
-  if (digest !== pointer.snapshot_digest) {
-    throw new Error(`pointer/snapshot mismatch: latest.json names ${pointer.snapshot_digest}, resolved manifest hashes to ${digest}`);
-  }
-  return { manifest: resolved, origin: source, root, isRemote };
-}
-function checkSignature(manifest, publicKeyPem, insecure) {
-  if (insecure)
-    return { verified: false, reason: "signature check skipped" };
-  if (!manifest.signature) {
-    return { verified: false, reason: "manifest carries no signature" };
-  }
-  if (!publicKeyPem) {
-    return {
-      verified: false,
-      reason: "no public key available to verify with"
-    };
-  }
-  try {
-    const verified = verifyStreamsBulkManifestSignature(manifest, publicKeyPem);
-    return {
-      verified,
-      reason: verified ? undefined : "signature did not verify"
-    };
-  } catch (err) {
-    return {
-      verified: false,
-      reason: err instanceof Error ? err.message : "signature check failed"
-    };
-  }
-}
-async function fetchHostedKey(url) {
-  if (!url.startsWith("https://"))
-    return;
-  try {
-    const response2 = await fetch(url, { signal: AbortSignal.timeout(1e4) });
-    if (!response2.ok)
-      return;
-    const body = await response2.json();
-    return typeof body.public_key_pem === "string" ? body.public_key_pem : undefined;
-  } catch {
-    return;
-  }
-}
-async function resolveArchivePublicKey(input4) {
-  if (input4.explicitPem)
-    return input4.explicitPem;
-  if (input4.envPem)
-    return input4.envPem;
-  if (input4.allowHostedApi) {
-    const hosted = await fetchHostedKey(input4.hostedKeyUrl ?? HOSTED_SIGNING_KEY_URL);
-    if (hosted)
-      return hosted;
-  }
-  return ARCHIVE_ROOT_PUBLIC_KEY_PEM;
-}
 function isTransientCode(code) {
   return typeof code === "string" && (TRANSIENT_ERROR_CODES.has(code) || code.startsWith("UND_ERR_"));
 }
@@ -35178,9 +34956,8 @@ async function fetchVerifiedPartition(reference, partition, gate, fetchOpts) {
   }
   return bytes;
 }
-var SNAPSHOT_PATH_PATTERN, HOSTED_SIGNING_KEY_URL = "https://api.secondlayer.tools/public/streams/signing-key", ArchiveFetchError, TRANSIENT_ERROR_CODES, PARTITION_FETCH_RETRIES = 3, PARTITION_FETCH_TIMEOUT_MS = 300000, RETRY_BASE_MS = 1000, RETRY_AFTER_CAP_MS = 60000;
+var ArchiveFetchError, TRANSIENT_ERROR_CODES, PARTITION_FETCH_RETRIES = 3, PARTITION_FETCH_TIMEOUT_MS = 300000, RETRY_BASE_MS = 1000, RETRY_AFTER_CAP_MS = 60000;
 var init_archive_reference = __esm(() => {
-  SNAPSHOT_PATH_PATTERN = /^snapshots\/[0-9a-f]{64}\.json$/;
   ArchiveFetchError = class ArchiveFetchError extends Error {
     transient;
     attempts;
@@ -35207,9 +34984,12 @@ var init_archive_reference = __esm(() => {
 import { randomBytes as randomBytes3 } from "node:crypto";
 import { existsSync as existsSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "node:fs";
 import { resolve as resolve14 } from "node:path";
-import { ARCHIVE_ROOT_PUBLIC_KEY_PEM as ARCHIVE_ROOT_PUBLIC_KEY_PEM2 } from "@secondlayer/shared/archive/root-key";
+import { ARCHIVE_ROOT_PUBLIC_KEY_PEM } from "@secondlayer/shared/archive/root-key";
 import { generateEd25519KeyPair } from "@secondlayer/shared/crypto/ed25519";
 import { INSTANCE_NETWORKS } from "@secondlayer/shared/db/queries/instance";
+function isHostedAccountKey(value) {
+  return value.startsWith("sk-sl_") || value.startsWith("ss-sl_");
+}
 function parseInstanceNetwork(value) {
   const network = value.trim().toLowerCase();
   if (INSTANCE_NETWORKS.includes(network)) {
@@ -35257,11 +35037,15 @@ function readEnvValue(envPath, key) {
   return match ? unescapeEnvValue(match[1]) : null;
 }
 function buildInstanceEnv(input4) {
-  const token = input4.existing?.INSTANCE_TOKEN || input4.existing?.SL_API_KEY || generateInstanceToken();
+  const existingAlias = input4.existing?.SL_API_KEY;
+  const aliasIsHex = existingAlias && !existingAlias.startsWith("sk-sl_") && !existingAlias.startsWith("ss-sl_");
+  const token = input4.existing?.INSTANCE_TOKEN || (aliasIsHex ? existingAlias : undefined) || generateInstanceToken();
   const secrets = input4.existing?.SECONDLAYER_SECRETS_KEY || generateSecretsKey();
   const signing = input4.existing?.STREAMS_SIGNING_PRIVATE_KEY || input4.existing?.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY || generateSigningPrivateKey();
-  const apiUrl = input4.apiUrl ?? "http://127.0.0.1:3800";
-  const archiveKey = input4.existing?.ARCHIVE_SIGNING_PUBLIC_KEY || input4.archivePublicKeyPem || ARCHIVE_ROOT_PUBLIC_KEY_PEM2;
+  const apiUrl = input4.existing?.SECONDLAYER_API_URL || input4.existing?.SL_API_URL || input4.apiUrl || "http://127.0.0.1:3800";
+  const archiveKey = input4.existing?.ARCHIVE_SIGNING_PUBLIC_KEY || input4.archivePublicKeyPem || ARCHIVE_ROOT_PUBLIC_KEY_PEM;
+  const hostedCandidate = input4.existing?.SECONDLAYER_API_KEY || input4.existing?.SL_API_KEY || undefined;
+  const hostedKey = hostedCandidate && isHostedAccountKey(hostedCandidate) ? hostedCandidate : undefined;
   return {
     INSTANCE_MODE: "oss",
     STACKS_NETWORK: input4.network,
@@ -35270,8 +35054,9 @@ function buildInstanceEnv(input4) {
     STREAMS_SIGNING_PRIVATE_KEY: signing,
     SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY: signing,
     ALLOW_UNSIGNED_WEBHOOKS: "false",
-    SL_API_URL: input4.existing?.SL_API_URL || apiUrl,
-    SL_API_KEY: token,
+    SECONDLAYER_API_URL: apiUrl,
+    SL_API_URL: apiUrl,
+    ...hostedKey ? { SECONDLAYER_API_KEY: hostedKey, SL_API_KEY: hostedKey } : {},
     ARCHIVE_SIGNING_PUBLIC_KEY: archiveKey
   };
 }
@@ -35287,11 +35072,12 @@ function renderInstanceEnv(env2) {
     `STREAMS_SIGNING_PRIVATE_KEY=${escapeEnvValue(env2.STREAMS_SIGNING_PRIVATE_KEY)}`,
     `SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY=${escapeEnvValue(env2.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY)}`,
     `ALLOW_UNSIGNED_WEBHOOKS=${env2.ALLOW_UNSIGNED_WEBHOOKS}`,
-    `SL_API_URL=${env2.SL_API_URL}`,
-    "# Legacy alias of INSTANCE_TOKEN, same value. Kept for existing setups;",
-    "# INSTANCE_TOKEN wins if the two ever disagree.",
-    `SL_API_KEY=${env2.SL_API_KEY}`
+    `SECONDLAYER_API_URL=${env2.SECONDLAYER_API_URL}`,
+    `SL_API_URL=${env2.SL_API_URL}`
   ];
+  if (env2.SECONDLAYER_API_KEY) {
+    lines2.push("# Hosted account key for archive credits (sk-sl_*).", `SECONDLAYER_API_KEY=${env2.SECONDLAYER_API_KEY}`, `SL_API_KEY=${env2.SL_API_KEY ?? env2.SECONDLAYER_API_KEY}`);
+  }
   lines2.push("# Archive trust root: bootstrap, verify, and repair check manifests", "# against this key. Replace it to pin a different archive.", `ARCHIVE_SIGNING_PUBLIC_KEY=${escapeEnvValue(env2.ARCHIVE_SIGNING_PUBLIC_KEY)}`, "");
   return lines2.join(`
 `);
@@ -35308,7 +35094,9 @@ function loadExistingInstanceEnv(cwd, file = INSTANCE_ENV_FILE) {
     SECONDLAYER_SECRETS_KEY: readEnvValue(path11, "SECONDLAYER_SECRETS_KEY"),
     STREAMS_SIGNING_PRIVATE_KEY: readEnvValue(path11, "STREAMS_SIGNING_PRIVATE_KEY"),
     SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY: readEnvValue(path11, "SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY"),
+    SECONDLAYER_API_URL: readEnvValue(path11, "SECONDLAYER_API_URL"),
     SL_API_URL: readEnvValue(path11, "SL_API_URL"),
+    SECONDLAYER_API_KEY: readEnvValue(path11, "SECONDLAYER_API_KEY"),
     SL_API_KEY: readEnvValue(path11, "SL_API_KEY"),
     ARCHIVE_SIGNING_PUBLIC_KEY: readEnvValue(path11, "ARCHIVE_SIGNING_PUBLIC_KEY")
   };
@@ -35693,7 +35481,9 @@ function resolveSecrets(config) {
       SECONDLAYER_SECRETS_KEY: existing.SECONDLAYER_SECRETS_KEY,
       STREAMS_SIGNING_PRIVATE_KEY: existing.STREAMS_SIGNING_PRIVATE_KEY,
       SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY: existing.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY,
+      SECONDLAYER_API_URL: existing.SECONDLAYER_API_URL,
       SL_API_URL: existing.SL_API_URL,
+      SECONDLAYER_API_KEY: existing.SECONDLAYER_API_KEY,
       SL_API_KEY: existing.SL_API_KEY,
       ARCHIVE_SIGNING_PUBLIC_KEY: existing.ARCHIVE_SIGNING_PUBLIC_KEY
     },
@@ -35761,10 +35551,12 @@ function renderSetupEnv(config, secrets) {
     `STREAMS_SIGNING_PRIVATE_KEY=${escapeEnvValue(i3.STREAMS_SIGNING_PRIVATE_KEY)}`,
     `SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY=${escapeEnvValue(i3.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY)}`,
     `ALLOW_UNSIGNED_WEBHOOKS=${i3.ALLOW_UNSIGNED_WEBHOOKS}`,
-    "# Legacy alias of INSTANCE_TOKEN, same value.",
-    `SL_API_KEY=${i3.SL_API_KEY}`,
+    `SECONDLAYER_API_URL=${i3.SECONDLAYER_API_URL}`,
     `SL_API_URL=${i3.SL_API_URL}`
   ];
+  if (i3.SECONDLAYER_API_KEY) {
+    lines2.push("# Hosted account key for archive credits (sk-sl_*).", `SECONDLAYER_API_KEY=${i3.SECONDLAYER_API_KEY}`, `SL_API_KEY=${i3.SL_API_KEY ?? i3.SECONDLAYER_API_KEY}`);
+  }
   lines2.push("# Archive trust root: bootstrap, verify, and repair check manifests", "# against this key. Replace it to pin a different archive.", `ARCHIVE_SIGNING_PUBLIC_KEY=${escapeEnvValue(i3.ARCHIVE_SIGNING_PUBLIC_KEY)}`);
   if (config.nodeMode === "full") {
     lines2.push("BITCOIN_RPC_USER=stacks", `BITCOIN_RPC_PASSWORD=${secrets.bitcoinRpcPassword}`);
@@ -36792,7 +36584,7 @@ var {
 // package.json
 var package_default = {
   name: "@secondlayer/cli",
-  version: "14.1.1",
+  version: "14.2.0",
   description: "Run a Stacks index on your own hardware — set it up, restore verified history, and keep it current.",
   repository: {
     type: "git",
@@ -36837,8 +36629,8 @@ var package_default = {
     "@opentui/react": "^0.5.3",
     "@secondlayer/bundler": "^0.5.1",
     "@secondlayer/scaffold": "^1.5.5",
-    "@secondlayer/sdk": "^10.1.1",
-    "@secondlayer/shared": "^11.2.1",
+    "@secondlayer/sdk": "^10.3.0",
+    "@secondlayer/shared": "^11.4.0",
     "@secondlayer/stacks": "^5.1.0",
     "@secondlayer/subgraphs": "^4.1.5",
     esbuild: "^0.27.4",
@@ -37431,6 +37223,7 @@ function openBrowser(url) {
 }
 function registerConsoleCommand(program2) {
   program2.command("console").description("Open the console UI in a browser").option("--url <url>", `Console URL (default ${DEFAULT_CONSOLE_URL})`).option("--no-open", "Print the console URL instead of opening a browser").action(async (options3) => {
+    assertInstanceUrl();
     const url = resolveConsoleUrl(options3.url);
     if (options3.open === false) {
       writeData(url);
@@ -37456,112 +37249,14 @@ import {
 } from "@secondlayer/sdk";
 
 // src/lib/instance-diagnosis.ts
-var BOOTSTRAP_STEP = "Restore verified history: secondlayer bootstrap --against <manifest>";
-var OBSERVER_STEP = "Confirm your node streams into this instance — secondlayer observer --mode indexer --endpoint secondlayer:3700 prints the stanza its config needs";
-var SELF_HOST_DOCS_STEP = "Docs: https://www.secondlayer.tools/docs/self-host";
-function hasNoChainData(status) {
-  const integrity = status.chainIntegrity;
-  if (!integrity || integrity.reason === "check_failed")
-    return false;
-  if (integrity.maxHeight !== 0)
-    return false;
-  return (status.chainTip ?? null) === null;
-}
-function emptyIndexIssue(status) {
-  const decoders = status.index?.decoders ?? [];
-  const stalled = decoders.filter((d2) => d2.status !== "ok").length;
-  const decoderClause = stalled > 0 ? ` and ${stalled} decoder${stalled === 1 ? "" : "s"} report unavailable because there is nothing to decode` : "";
-  return {
-    title: "No blocks indexed yet — this instance holds 0 blocks.",
-    detail: `Streams has no tip${decoderClause}, which is what makes the overall status DEGRADED. This is the expected state for a fresh instance: nothing is broken, but no read returns data until history lands.`,
-    nextSteps: [BOOTSTRAP_STEP, OBSERVER_STEP, SELF_HOST_DOCS_STEP]
-  };
-}
-var SERVICE_STEPS = [
-  "See the raw per-service report: secondlayer status --json",
-  "Check the containers from docker/oss: docker compose ps, then docker compose logs --tail=50 secondlayer"
-];
-function diagnoseInstanceStatus(status) {
-  const overall = String(status.status ?? "unknown");
-  if (hasNoChainData(status)) {
-    return { state: "empty-index", overall, issues: [emptyIndexIssue(status)] };
-  }
-  const issues = [];
-  for (const service of status.services ?? []) {
-    if (service.status === "ok")
-      continue;
-    issues.push({
-      title: `Service ${service.name} reports ${service.status}.`,
-      nextSteps: SERVICE_STEPS
-    });
-  }
-  const integrity = status.chainIntegrity;
-  if (integrity && integrity.ok === false) {
-    issues.push({
-      title: "Chain-data integrity check failed.",
-      detail: integrity.reason ?? "The tip the instance serves is not backed by the history it implies.",
-      nextSteps: [
-        "Verify against the archive: secondlayer verify all --against <manifest>",
-        "Repair what diverged: secondlayer repair --against <manifest> --apply"
-      ]
-    });
-  }
-  if (issues.length === 0 && overall !== "healthy") {
-    issues.push({
-      title: `The API reports status=${overall} but names no failing service.`,
-      detail: "Every service in the report is ok, so the degradation is in a surface this command does not summarize.",
-      nextSteps: SERVICE_STEPS
-    });
-  }
-  return {
-    state: issues.length > 0 ? "degraded" : "healthy",
-    overall,
-    issues
-  };
-}
-var CONTEXT_FIELDS = [
-  "account",
-  "streamsTip",
-  "indexTip",
-  "subgraphs",
-  "subscriptions",
-  "activeOperations"
-];
-function explainContextNulls(snapshot, probe) {
-  const nullFields = CONTEXT_FIELDS.filter((field) => (snapshot[field] ?? null) === null);
-  if (nullFields.length === 0) {
-    return { summary: "Every field resolved.", nulls: {} };
-  }
-  if (!probe.status) {
-    const reason = `No instance answered at ${probe.apiUrl} (${probe.statusError ?? "unreachable"}), so this read never reached an API.`;
-    return {
-      summary: `${reason} Start it from docker/oss with: docker compose up -d — or point SL_API_URL at the instance you meant.`,
-      nulls: Object.fromEntries(nullFields.map((field) => [field, reason]))
-    };
-  }
-  const emptyIndex = hasNoChainData(probe.status);
-  const blocks = probe.status.chainIntegrity?.maxHeight ?? null;
-  const accountReason = probe.selfHosted ? "Expected: a self-hosted instance has no account system. Accounts exist only on the metered archive deployment at api.secondlayer.tools, so null here is normal and not a failure." : "Not authenticated — run `secondlayer login`, or export INSTANCE_TOKEN.";
-  const listReason = unresolvedReadReason(probe, blocks);
-  const chainReason = emptyIndex ? `No blocks indexed yet — this instance holds 0 blocks, so there is no tip to report. ${BOOTSTRAP_STEP}` : listReason;
-  const nulls = {};
-  for (const field of nullFields) {
-    if (field === "account")
-      nulls[field] = accountReason;
-    else if (field === "streamsTip" || field === "indexTip")
-      nulls[field] = chainReason;
-    else if (field === "activeOperations")
-      nulls[field] = (snapshot.subgraphs ?? null) === null ? "Not probed: in-flight operations are read per subgraph, and the subgraph list did not resolve." : listReason;
-    else
-      nulls[field] = listReason;
-  }
-  const summary = emptyIndex ? `Instance at ${probe.apiUrl} is reachable but holds 0 blocks — the chain fields are null because nothing has been indexed yet. ${BOOTSTRAP_STEP}` : nullFields.length === 1 && nullFields[0] === "account" ? `Instance at ${probe.apiUrl} is reachable and indexed to block ${blocks ?? "unknown"}; only \`account\` is null, which is normal when self-hosting.` : `Instance at ${probe.apiUrl} is reachable, but ${nullFields.length} field${nullFields.length === 1 ? "" : "s"} did not resolve — see \`nulls\` below for each one.`;
-  return { summary, nulls };
-}
-function unresolvedReadReason(probe, blocks) {
-  const where = `The instance at ${probe.apiUrl} is reachable${blocks !== null ? ` and indexed to block ${blocks}` : ""}, but this read returned nothing.`;
-  return probe.hasCredential ? `${where} Check the surface directly: secondlayer status --json` : `${where} No credential resolved: export INSTANCE_TOKEN — an instance published past loopback requires it on every /v1 read.`;
-}
+import {
+  BOOTSTRAP_STEP,
+  OBSERVER_STEP,
+  SELF_HOST_DOCS_STEP,
+  diagnoseInstanceStatus,
+  explainContextNulls,
+  hasNoChainData
+} from "@secondlayer/shared/archive/instance-diagnosis";
 
 // src/commands/context.ts
 init_output();
@@ -37705,18 +37400,19 @@ function printPublicStatus(status, diagnosis) {
 init_api_client();
 init_filter_params();
 init_output();
+init_resolve_auth();
 import { sign } from "@secondlayer/shared/crypto/standard-webhooks";
 
 // src/lib/subscription-validation.ts
 import {
   validateSubscriptionFilterForTable
 } from "@secondlayer/shared/schemas/subscriptions";
-async function validateSubscriptionTargetFromApi(client2, input2) {
-  const subgraph = await client2.subgraphs.status(input2.subgraphName);
+async function validateSubscriptionTargetFromApi(client2, input) {
+  const subgraph = await client2.subgraphs.status(input.subgraphName);
   const errors2 = validateSubscriptionFilterForTable({
-    subgraphName: input2.subgraphName,
-    tableName: input2.tableName,
-    filter: input2.filter,
+    subgraphName: input.subgraphName,
+    tableName: input.tableName,
+    filter: input.filter,
     tables: subgraph.tables
   });
   if (errors2.length > 0) {
@@ -37741,7 +37437,7 @@ import {
 } from "node:fs";
 import { dirname as dirname6, join as join6, relative, resolve as resolve5 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
-import { input as input2, select as select3 } from "@inquirer/prompts";
+import { input, select as select3 } from "@inquirer/prompts";
 import { SecondLayer as SecondLayer3 } from "@secondlayer/sdk";
 import {
   ChainTriggerSchema
@@ -37835,7 +37531,7 @@ async function promptFor(_name, opts) {
   let subgraph = opts.subgraph;
   if (subgraph === undefined) {
     requireTtyFor("--subgraph");
-    subgraph = await input2({
+    subgraph = await input({
       message: "Subgraph name (must already be deployed):",
       validate: (v2) => v2.trim().length > 0 ? true : "required"
     });
@@ -37843,7 +37539,7 @@ async function promptFor(_name, opts) {
   let table = opts.table;
   if (table === undefined) {
     requireTtyFor("--table");
-    table = await input2({
+    table = await input({
       message: "Table to subscribe to:",
       validate: (v2) => v2.trim().length > 0 ? true : "required"
     });
@@ -37851,7 +37547,7 @@ async function promptFor(_name, opts) {
   let url = opts.url;
   if (url === undefined) {
     requireTtyFor("--url");
-    url = await input2({
+    url = await input({
       message: runtime === "inngest" ? "Inngest event endpoint URL (e.g. https://inn.gs/e/<KEY> or http://localhost:8288/e/<KEY>):" : runtime === "trigger" ? "Trigger.dev task URL (e.g. https://api.trigger.dev/api/v1/tasks/<TASK_ID>/trigger):" : runtime === "cloudflare" ? "Cloudflare Workflows instances URL:" : "Your HTTP receiver URL (e.g. https://yourapp.example/webhook):",
       validate: (v2) => v2.startsWith("http://") || v2.startsWith("https://") ? true : "must be http(s) URL"
     });
@@ -38184,52 +37880,52 @@ Auth config:`));
     console.log(JSON.stringify(sub.authConfig, null, 2));
   }
 }
-function buildDoctorReport(input3) {
-  const successful = input3.deliveries.filter(isSuccessDelivery).length;
-  const failed = input3.deliveries.length - successful;
-  const subgraph = input3.subgraph ? {
-    name: input3.subgraph.name,
-    status: input3.subgraph.status,
-    syncStatus: input3.subgraph.sync.status,
-    lastProcessedBlock: input3.subgraph.sync.lastProcessedBlock,
-    chainTip: input3.subgraph.sync.chainTip,
-    gapCount: input3.subgraph.sync.gaps.count,
-    integrity: input3.subgraph.sync.integrity
+function buildDoctorReport(input2) {
+  const successful = input2.deliveries.filter(isSuccessDelivery).length;
+  const failed = input2.deliveries.length - successful;
+  const subgraph = input2.subgraph ? {
+    name: input2.subgraph.name,
+    status: input2.subgraph.status,
+    syncStatus: input2.subgraph.sync.status,
+    lastProcessedBlock: input2.subgraph.sync.lastProcessedBlock,
+    chainTip: input2.subgraph.sync.chainTip,
+    gapCount: input2.subgraph.sync.gaps.count,
+    integrity: input2.subgraph.sync.integrity
   } : null;
   const hints = [];
-  if (input3.subscription.status === "paused") {
-    hints.push(`Resume when the receiver is healthy: secondlayer subscriptions resume ${input3.subscription.id}`);
+  if (input2.subscription.status === "paused") {
+    hints.push(`Resume when the receiver is healthy: secondlayer subscriptions resume ${input2.subscription.id}`);
   }
-  if (input3.subscription.lastError) {
+  if (input2.subscription.lastError) {
     hints.push("Run secondlayer subscriptions test to reproduce the receiver request.");
   }
-  if (input3.subscription.circuitOpenedAt || input3.subscription.circuitFailures > 0) {
+  if (input2.subscription.circuitOpenedAt || input2.subscription.circuitFailures > 0) {
     hints.push("Circuit breaker has failures; inspect receiver logs and delivery status codes.");
   }
-  if (input3.dead.length > 0) {
-    hints.push(`Dead-letter rows exist; inspect with secondlayer subscriptions dead ${input3.subscription.id} and requeue selected rows.`);
+  if (input2.dead.length > 0) {
+    hints.push(`Dead-letter rows exist; inspect with secondlayer subscriptions dead ${input2.subscription.id} and requeue selected rows.`);
   }
   if (subgraph?.gapCount && subgraph.gapCount > 0) {
-    hints.push(`Linked subgraph has gaps; run secondlayer subgraphs gaps ${input3.subscription.subgraphName}.`);
+    hints.push(`Linked subgraph has gaps; run secondlayer subgraphs gaps ${input2.subscription.subgraphName}.`);
   }
   if (subgraph?.syncStatus === "catching_up") {
     hints.push("Linked subgraph is still catching up; new matching rows may arrive later.");
   }
-  if (input3.deliveries.length === 0) {
+  if (input2.deliveries.length === 0) {
     hints.push("No deliveries yet; confirm the table is receiving inserted rows that match the filter.");
   }
   if (hints.length === 0) {
     hints.push("No immediate action needed.");
   }
   return {
-    subscription: input3.subscription,
+    subscription: input2.subscription,
     deliverySummary: {
-      total: input3.deliveries.length,
+      total: input2.deliveries.length,
       successful,
       failed,
-      last: input3.deliveries[0] ?? null
+      last: input2.deliveries[0] ?? null
     },
-    deadCount: input3.dead.length,
+    deadCount: input2.dead.length,
     subgraph,
     hints
   };
@@ -38322,9 +38018,9 @@ function resolveSigningSecret(options3, env2 = process.env) {
 function shellQuote(value) {
   return `'${value.replace(/'/g, "'\\''")}'`;
 }
-function buildSubscriptionTestFixture(input3) {
-  const nowSeconds = input3.nowSeconds ?? Math.floor(Date.now() / 1000);
-  const sub = input3.subscription;
+function buildSubscriptionTestFixture(input2) {
+  const nowSeconds = input2.nowSeconds ?? Math.floor(Date.now() / 1000);
+  const sub = input2.subscription;
   const isChain = sub.kind === "chain";
   const type = isChain ? `chain.${sub.triggers?.[0]?.type ?? "event"}.apply` : `${sub.subgraphName}.${sub.tableName}.created`;
   const data = isChain ? {
@@ -38332,10 +38028,10 @@ function buildSubscriptionTestFixture(input3) {
     canonical: true,
     block_hash: "0xexampleblock",
     block_height: 0,
-    tx_id: input3.row.tx_id ?? "0xexampletransaction",
+    tx_id: input2.row.tx_id ?? "0xexampletransaction",
     trigger: sub.triggers?.[0]?.type ?? "event",
-    event: input3.row
-  } : input3.row;
+    event: input2.row
+  } : input2.row;
   const body = JSON.stringify({
     type,
     timestamp: new Date(nowSeconds * 1000).toISOString(),
@@ -38343,15 +38039,15 @@ function buildSubscriptionTestFixture(input3) {
   });
   const headers = {
     "content-type": "application/json",
-    ...sign(body, input3.signingSecret, {
-      id: input3.id ?? `test-${input3.subscription.id}`,
+    ...sign(body, input2.signingSecret, {
+      id: input2.id ?? `test-${input2.subscription.id}`,
       timestampSeconds: nowSeconds
     })
   };
   const headerArgs = Object.entries(headers).map(([key, value]) => `  -H ${shellQuote(`${key}: ${value}`)} \\`).join(`
 `);
   const curl = [
-    `curl -X POST ${shellQuote(input3.subscription.url)} \\`,
+    `curl -X POST ${shellQuote(input2.subscription.url)} \\`,
     headerArgs,
     `  --data ${shellQuote(body)}`
   ].join(`
@@ -38414,6 +38110,7 @@ async function confirmOrExit(message, yes) {
 }
 function registerSubscriptionsCommand(program2) {
   const subscriptions = program2.command("subscriptions").alias("subs").description("Manage subgraph table subscriptions");
+  subscriptions.hook("preAction", () => assertInstanceUrl());
   addSubscriptionsCreateCommand(subscriptions);
   subscriptions.command("list").alias("ls").description("List subscriptions").option("--json", "Output as JSON").action(async (options3) => {
     try {
@@ -39149,7 +38846,7 @@ var VALID_TYPES = STREAMS_EVENT_TYPES;
 function client2() {
   return createStreamsClient({
     baseUrl: resolveApiUrl(),
-    apiKey: resolveEnvKey() ?? ""
+    apiKey: resolveDataPlaneKey() ?? ""
   });
 }
 function dumpsClient(dumpsUrl) {
@@ -39160,7 +38857,7 @@ function dumpsClient(dumpsUrl) {
   }
   return createStreamsClient({
     baseUrl: resolveApiUrl(),
-    apiKey: resolveEnvKey() ?? "",
+    apiKey: resolveDataPlaneKey() ?? "",
     dumpsBaseUrl
   });
 }
@@ -39789,7 +39486,7 @@ function markFrozen(cmd) {
 init_config2();
 init_dev_state();
 init_output();
-import { confirm as confirm4 } from "@inquirer/prompts";
+import { confirm as confirm3 } from "@inquirer/prompts";
 import { getDb, sql } from "@secondlayer/shared/db";
 import {
   countMissingBlocks,
@@ -40009,7 +39706,7 @@ async function resetDatabase(skipConfirm) {
     console.log(dim("Note: Subgraph configurations will be preserved."));
     console.log("");
     if (!skipConfirm) {
-      const confirmed = await confirm4({
+      const confirmed = await confirm3({
         message: "Are you sure you want to reset the database?",
         default: false
       });
@@ -40046,7 +39743,7 @@ async function resyncDatabase(skipConfirm, backfill) {
     console.log(dim("Note: Subgraph configurations will be preserved."));
     console.log("");
     if (!skipConfirm) {
-      const confirmed = await confirm4({
+      const confirmed = await confirm3({
         message: "Are you sure you want to resync?",
         default: false
       });
@@ -40614,6 +40311,7 @@ function formatLogLine3(service, line) {
 init_config2();
 init_http();
 init_output();
+import { resolveApiKey as resolveApiKey4 } from "@secondlayer/sdk";
 
 // src/lib/project-file.ts
 import { existsSync as existsSync7 } from "node:fs";
@@ -40658,58 +40356,188 @@ async function readActiveProject(cwd, globalDefault) {
 }
 
 // src/commands/whoami.ts
+async function runWhoami() {
+  const instanceUrl = resolveApiUrl();
+  const merchantUrl = resolveArchiveOpsUrl();
+  const instanceSet = resolveApiKey4() !== undefined;
+  const { source } = await resolveArchiveOpsBearer();
+  let email = null;
+  let merchantOk = false;
+  try {
+    const account = await httpArchiveOps("/api/accounts/me");
+    email = account.email;
+    merchantOk = true;
+  } catch {
+    merchantOk = false;
+  }
+  const merchantCredential = source === "env" ? "SECONDLAYER_API_KEY" : source === "session" ? "session" : null;
+  const config = await loadConfig2();
+  const active = await readActiveProject(process.cwd(), config.defaultProject);
+  return {
+    instance: {
+      url: instanceUrl,
+      credential: "INSTANCE_TOKEN",
+      status: instanceSet ? "set" : "missing"
+    },
+    merchant: {
+      url: merchantUrl,
+      credential: merchantCredential,
+      status: merchantOk ? "set" : "missing",
+      email
+    },
+    project: active ? { slug: active.slug, source: active.resolvedFrom } : null
+  };
+}
 function registerWhoamiCommand(program2) {
-  program2.command("whoami", { hidden: true }).description("Show the archive credits account, credential source, and project").option("--json", "Output as JSON").action(async (options3) => {
-    const creditsUrl = resolveArchiveOpsUrl();
-    const { source } = await resolveArchiveOpsBearer();
-    let account;
-    try {
-      account = await httpArchiveOps("/api/accounts/me");
-    } catch (err) {
-      if (err instanceof CliHttpError) {
-        error(err.message);
-        process.exit(1);
-      }
-      throw err;
-    }
-    const config = await loadConfig2();
-    const active = await readActiveProject(process.cwd(), config.defaultProject);
-    const authSource = source === "env" ? "API key (env)" : `session (${ARCHIVE_LOGIN_COMMAND})`;
+  program2.command("whoami").description("Show instance and merchant targets.").option("--json", "Output as JSON").action(async (options3) => {
+    const result = await runWhoami();
     output({
       json: options3.json,
-      data: {
-        email: account.email,
-        creditsUrl,
-        apiUrl: resolveApiUrl(),
-        authSource,
-        project: active ? { slug: active.slug, source: active.resolvedFrom } : null
-      },
+      data: result,
       human: () => {
         const rows = [];
-        rows.push(["Email", account.email]);
-        rows.push(["Credits API", creditsUrl]);
-        rows.push(["Instance API", resolveApiUrl()]);
-        rows.push(["Auth", dim(authSource)]);
-        if (active) {
-          rows.push(["Project", active.slug]);
-          rows.push(["Project source", dim(active.resolvedFrom)]);
+        rows.push([
+          "instance",
+          `${result.instance.url}  ${result.instance.credential}  ${result.instance.status}`
+        ]);
+        const merchantCred = result.merchant.credential ?? "SECONDLAYER_API_KEY|session";
+        const merchantValue = result.merchant.email ? `${result.merchant.url}  ${merchantCred}  ${result.merchant.status}  (${result.merchant.email})` : `${result.merchant.url}  ${merchantCred}  ${result.merchant.status}`;
+        rows.push(["merchant", merchantValue]);
+        if (result.project) {
+          rows.push(["project", result.project.slug]);
+          rows.push(["project source", dim(result.project.source)]);
         } else {
-          rows.push(["Project", dim("(none)")]);
+          rows.push(["project", dim("(none)")]);
         }
         console.log(formatKeyValue(rows));
+        if (result.merchant.status === "missing") {
+          note(`merchant identity missing - run \`${ARCHIVE_LOGIN_COMMAND}\``);
+        }
       }
     });
   });
 }
-
-// src/commands/index.ts
-init_login();
-
+// src/commands/login.ts
+init_http();
+init_output();
+init_session();
+import { confirm as confirm5, input as input3 } from "@inquirer/prompts";
+function sessionExpiry() {
+  return new Date(Date.now() + 90 * 24 * 60 * 60 * 1000).toISOString();
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin)
+    chunks.push(chunk);
+  return Buffer.concat(chunks).toString("utf8").trim();
+}
+function loginTarget(opts) {
+  return opts.credits ? resolveArchiveOpsUrl() : resolveApiUrl();
+}
+async function runTokenLogin(opts) {
+  const token = await readStdin();
+  if (!token) {
+    error('No token on stdin. Usage: echo "$KEY" | secondlayer login --with-token');
+    process.exit(1);
+  }
+  const target = loginTarget(opts);
+  let account;
+  try {
+    account = await httpAt(target, "/api/accounts/me", { bearer: token });
+  } catch (err) {
+    error(err instanceof CliHttpError ? `Token rejected by ${target}: ${err.message}` : err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+  await writeSession({
+    token,
+    email: account.email,
+    accountId: account.id,
+    expiresAt: sessionExpiry()
+  }, target);
+  success(`Logged in as ${account.email} (${target})`);
+}
+async function runLoginFlow(options3 = {}) {
+  const target = loginTarget(options3);
+  if (!options3.force) {
+    const existing = await readSession(target);
+    if (existing) {
+      info(`Already logged in as ${existing.email} (${target}).`);
+      if (!process.stdin.isTTY) {
+        info(dim("Run 'secondlayer logout' first, or re-run with --force to switch accounts."));
+        return;
+      }
+      try {
+        const proceed = await confirm5({
+          message: "Log in as a different user?",
+          default: false
+        });
+        if (!proceed) {
+          info(dim("Run 'secondlayer logout' to sign out."));
+          return;
+        }
+      } catch {
+        info(dim("Run 'secondlayer logout' first, or re-run with --force to switch accounts."));
+        return;
+      }
+    }
+  }
+  const email = await input3({
+    message: "Email",
+    validate: (v2) => /^.+@.+\..+$/.test(v2) ? true : "Invalid email"
+  });
+  try {
+    const res = await httpAt(target, "/api/auth/magic-link", {
+      method: "POST",
+      body: { email }
+    });
+    info("Check your inbox for a 6-digit code.");
+    if (res.code) {
+      info(dim(`(DEV_MODE code: ${res.code})`));
+    }
+  } catch (err) {
+    if (err instanceof CliHttpError) {
+      error(err.message);
+    } else {
+      error(err instanceof Error ? err.message : String(err));
+    }
+    process.exit(1);
+  }
+  const code = await input3({
+    message: "Enter the 6-digit code",
+    validate: (v2) => /^\d{6}$/.test(v2) ? true : "Expected 6 digits"
+  });
+  try {
+    const verified = await httpAt(target, "/api/auth/verify", {
+      method: "POST",
+      body: { email, code }
+    });
+    await writeSession({
+      token: verified.sessionToken,
+      email: verified.account.email,
+      accountId: verified.account.id,
+      expiresAt: sessionExpiry()
+    }, target);
+    success(`Logged in as ${verified.account.email}`);
+    info(dim(options3.credits ? "Run 'secondlayer credits balance' to see your archive credits." : "Run 'secondlayer whoami' to see your account status."));
+  } catch (err) {
+    if (err instanceof CliHttpError) {
+      error(err.message);
+    } else {
+      error(err instanceof Error ? err.message : String(err));
+    }
+    process.exit(1);
+  }
+}
+function registerLoginCommand(program2) {
+  program2.command("login", { hidden: true }).description("Log in to Secondlayer (magic-link email)").option("--force", "Skip the already-logged-in check and re-run the flow").option("--with-token", "Read an API key from stdin (non-interactive)").option("--credits", "Log in to the archive credits account used by bootstrap, repair, and credits").addHelpText("after", `
+Examples:
+  $ secondlayer login --credits
+  $ echo "$SECONDLAYER_API_KEY" | secondlayer login --with-token`).action((opts) => opts.withToken ? runTokenLogin({ credits: opts.credits }) : runLoginFlow({ force: opts.force, credits: opts.credits }));
+}
 // src/commands/logout.ts
 init_http();
 init_output();
 init_session();
-init_login();
 async function runLogout(opts = {}) {
   const target = loginTarget(opts);
   const session = await readSession(target);
@@ -41988,6 +41816,7 @@ function registerBootstrapCommand(program2) {
 // src/commands/uninstall.ts
 init_instance_init();
 init_output();
+init_resolve_auth();
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { existsSync as existsSync9, readFileSync as readFileSync8 } from "node:fs";
 import { join as join16, resolve as resolve15 } from "node:path";
@@ -42042,6 +41871,7 @@ function composeDownArgs(plan, layout) {
 }
 function registerUninstallCommand(program2) {
   program2.command("uninstall").description("Stop the stack; the index, chainstate, and keys survive").option("--compose <file>", `compose file to tear down (default: ./docker-compose.yml from setup, else ${REPO_COMPOSE})`).option("--purge", "also destroy the volumes (wipes the index)").option("--yes", "confirm a purge").option("--backup <dir>", "a bundle proving the keys exist elsewhere (required to purge)").option("--apply", "actually run it (default is a dry run)").option("--json", "Output as JSON").action(async (opts) => {
+    assertInstanceUrl();
     const dataDir = process.env.DATA_DIR ?? "./data";
     const layout = resolveUninstallLayout(process.cwd(), opts.compose);
     const secretsPresent = !!process.env.SECONDLAYER_SECRETS_KEY || !!layout.secretsFile;
@@ -42116,6 +41946,7 @@ function registerUninstallCommand(program2) {
 // src/commands/backup.ts
 init_fs();
 init_output();
+init_resolve_auth();
 import {
   chmodSync as chmodSync2,
   existsSync as existsSync10,
@@ -42425,10 +42256,10 @@ async function runRestore(opts) {
   });
 }
 function registerBackupCommand(program2) {
-  attachBackupCommand(program2.command("backup").description("Write a restorable bundle: index, keys, and scope"));
+  attachBackupCommand(program2.command("backup").description("Write a restorable bundle: index, keys, and scope").hook("preAction", () => assertInstanceUrl()));
 }
 function registerRestoreCommand(program2) {
-  attachRestoreCommand(program2.command("restore").description("Restore an instance from a backup bundle"));
+  attachRestoreCommand(program2.command("restore").description("Restore an instance from a backup bundle").hook("preAction", () => assertInstanceUrl()));
 }
 // src/commands/init.ts
 init_archive_reference();
@@ -42441,6 +42272,7 @@ function registerInitCommand(program2) {
 --network <mainnet|testnet|devnet> and --api-url <url> are top-level global
 flags (see \`secondlayer --help\`). Defaults: mainnet, http://127.0.0.1:3800.
 `).action(async (opts) => {
+    assertInstanceUrl();
     const network = instanceNetworkFromEnv();
     const existing = opts.force ? {} : loadExistingInstanceEnv(process.cwd());
     const env2 = buildInstanceEnv({
@@ -42466,11 +42298,13 @@ flags (see \`secondlayer --help\`). Defaults: mainnet, http://127.0.0.1:3800.
 init_instance_init();
 init_observer_stanza();
 init_output();
+init_resolve_auth();
 function registerObserverCommand(program2) {
   program2.command("observer").description("Print the Stacks events_observer stanza for this node mode").option("--mode <mode>", "indexer (retry) or signer-shared (no retry)", "indexer").option("--endpoint <host:port>", "Observer callback the node will POST to").option("--recovery <source>", "Required for signer-shared: journal or archive").addHelpText("after", `
 --network <mainnet|testnet|devnet> is the top-level global flag (see
 \`secondlayer --help\`) — default mainnet, same as before.
 `).action((opts) => {
+    assertInstanceUrl();
     const mode = parseObserverMode(opts.mode);
     const network = instanceNetworkFromEnv();
     const endpoint = opts.endpoint ?? defaultObserverEndpoint(network);
@@ -42483,6 +42317,7 @@ function registerObserverCommand(program2) {
 }
 // src/commands/setup.ts
 init_output();
+init_resolve_auth();
 
 // src/lib/setup-prompts.ts
 init_instance_init();
@@ -42689,6 +42524,7 @@ Without a TTY (piped, CI, an agent), or with --yes, the TUI is skipped: every
 decision with no safe default (--network, --node-mode, and --against unless
 --skip-bootstrap) must come from a flag or the command fails fast naming it.
 `).action(async (opts) => {
+    assertInstanceUrl();
     const flags = {
       ...opts,
       network: opts.network ?? process.env.STACKS_NETWORK
@@ -42712,18 +42548,19 @@ decision with no safe default (--network, --node-mode, and --against unless
   });
 }
 // src/cli.ts
+init_resolve_auth();
 var { version } = package_default;
-program.name("secondlayer").alias("sl").description("Secondlayer CLI — run a Stacks index on your own hardware").version(version).option("--network <network>", "Override network (mainnet, testnet, devnet)").option("--api-key <key>", "Instance or archive credential; prefer INSTANCE_TOKEN in env, a flag lands in shell history and ps").option("--api-url <url>", "API endpoint (overrides SL_API_URL)").showSuggestionAfterError(true).showHelpAfterError("(run `secondlayer --help` to see available commands)");
+program.name("secondlayer").alias("sl").description("Secondlayer CLI — run a Stacks index on your own hardware").version(version).option("--network <network>", "Override network (mainnet, testnet, devnet)").option("--api-key <key>", "Credential for this invocation: INSTANCE_TOKEN (hex) for the instance, or sk-sl_* for hosted/archive. Prefer env. A flag lands in shell history and ps").option("--api-url <url>", "API endpoint (overrides SECONDLAYER_API_URL)").showSuggestionAfterError(true).showHelpAfterError("(run `secondlayer --help` to see available commands)");
 program.hook("preAction", (thisCommand) => {
   const { network, apiKey, apiUrl } = thisCommand.opts();
   if (network)
     process.env.STACKS_NETWORK = network;
-  if (apiKey) {
-    process.env.INSTANCE_TOKEN = apiKey;
-    process.env.SL_API_KEY = apiKey;
-  }
-  if (apiUrl)
+  if (apiKey)
+    applyApiKeyFlag(apiKey);
+  if (apiUrl) {
+    process.env.SECONDLAYER_API_URL = apiUrl;
     process.env.SL_API_URL = apiUrl;
+  }
 });
 program.addHelpText("after", `
 Quickstart:
@@ -42769,5 +42606,5 @@ program.commandsGroup("Archive:");
 registerCreditsCommand(program);
 program.parse();
 
-//# debugId=A5FE446DEB77888264756E2164756E21
+//# debugId=CAE75BE93848EF8E64756E2164756E21
 //# sourceMappingURL=cli.js.map