@secondlayer/cli 21.2.0 → 22.0.0

package/README.md

@@ -15,8 +15,8 @@ secondlayer --version
 Default API is `http://127.0.0.1:3800`. Override with `SECONDLAYER_API_URL`.
 
 Writes against a published bind use `INSTANCE_TOKEN` from `secondlayer init`.
-Loopback reads need no token. Hosted API and archive credits use
-`SECONDLAYER_API_KEY` (`sk-sl_*`).
+Loopback reads need no token. Your hosted account (credits, archive fetches)
+uses `secondlayer login` or `SECONDLAYER_API_KEY` (`sk-sl_*`).
 
 ```bash
 export SECONDLAYER_API_URL=http://127.0.0.1:3800

package/dist/cli.js

@@ -2369,12 +2369,12 @@ async function resolveArchiveOpsBearer() {
   };
 }
 function ignoredEnvKeyNote(ignored) {
-  return ignored ? " INSTANCE_TOKEN was ignored: it unlocks this instance, not archive credits." : "";
+  return ignored ? " INSTANCE_TOKEN was ignored: it unlocks this instance, not your account." : "";
 }
 async function httpArchiveOps(path, opts = {}) {
   const { bearer, ignoredEnvKey } = await resolveArchiveOpsBearer();
   if (!bearer) {
-    throw new CliHttpError(401, "SESSION_EXPIRED", { error: "Not logged in" }, `Archive credits need an account key. ${ARCHIVE_AUTH_HINT}${ignoredEnvKeyNote(ignoredEnvKey)}`);
+    throw new CliHttpError(401, "SESSION_EXPIRED", { error: "Not logged in" }, `This needs your Secondlayer account. ${ARCHIVE_AUTH_HINT}${ignoredEnvKeyNote(ignoredEnvKey)}`);
   }
   try {
     return await request(`${resolveArchiveOpsUrl()}${path}`, {
@@ -2383,12 +2383,12 @@ async function httpArchiveOps(path, opts = {}) {
     });
   } catch (err) {
     if (err instanceof CliHttpError && err.status === 401) {
-      throw new CliHttpError(401, err.code, err.body, `Archive credits rejected the credential (${err.message}). ${ARCHIVE_AUTH_HINT}${ignoredEnvKeyNote(ignoredEnvKey)}`);
+      throw new CliHttpError(401, err.code, err.body, `Your account rejected the credential (${err.message}). ${ARCHIVE_AUTH_HINT}${ignoredEnvKeyNote(ignoredEnvKey)}`);
     }
     throw err;
   }
 }
-var CliHttpError, REQUEST_TIMEOUT_MS = 30000, ARCHIVE_AUTH_HINT = "Set SECONDLAYER_API_KEY to your account key (sk-sl_…, from /account/keys), or run `secondlayer login --credits`.", ARCHIVE_CREDENTIAL_RE;
+var CliHttpError, REQUEST_TIMEOUT_MS = 30000, ARCHIVE_AUTH_HINT = "Set SECONDLAYER_API_KEY to your account key (sk-sl_…, from /account/keys), or run `secondlayer login`.", ARCHIVE_CREDENTIAL_RE;
 var init_http = __esm(() => {
   init_api_url();
   init_resolve_auth();
@@ -202692,7 +202692,7 @@ var {
 // package.json
 var package_default = {
   name: "@secondlayer/cli",
-  version: "21.2.0",
+  version: "22.0.0",
   description: "Run a Stacks index on your own hardware — set it up, restore verified history, and keep it current.",
   repository: {
     type: "git",
@@ -202732,7 +202732,7 @@ var package_default = {
     "@secondlayer/bundler": "^0.7.1",
     "@secondlayer/scaffold": "^1.6.2",
     "@secondlayer/sdk": "^15.1.0",
-    "@secondlayer/shared": "^13.1.0",
+    "@secondlayer/shared": "^13.7.0",
     "@secondlayer/stacks": "^6.4.0",
     "@secondlayer/subgraphs": "^7.2.0",
     "@secondlayer/verify": "^0.6.0",
@@ -202811,7 +202811,7 @@ var BUY_CREDITS_COMMAND = "secondlayer credits buy";
 function formatInsufficientMessage(quote) {
   const shortfallUsd = ((quote.usdMicros - quote.balanceUsdMicros) / 1e6).toFixed(2);
   const balanceUsd = (quote.balanceUsdMicros / 1e6).toFixed(2);
-  return `Insufficient archive credits: quote $${quote.usd}, balance $${balanceUsd}, short $${shortfallUsd}. Buy more with \`${BUY_CREDITS_COMMAND}\`.`;
+  return `Insufficient credits: quote $${quote.usd}, balance $${balanceUsd}, short $${shortfallUsd}. Buy more with \`${BUY_CREDITS_COMMAND}\`.`;
 }
 var ARCHIVE_GATE_NOT_CONFIGURED_MESSAGE = "the archive gate is not configured on the server; contact the operator";
 var ALLOWANCE_MONTHLY_BUNDLES = 6;
@@ -204986,7 +204986,7 @@ async function runBuy(opts) {
     human: () => {
       success(`Checkout for $${amount} → ${email}`);
       console.log(res.url);
-      console.log(dim("After payment: set SECONDLAYER_API_KEY (or run `secondlayer login --credits`), then run `secondlayer credits balance`"));
+      console.log(dim("After payment: set SECONDLAYER_API_KEY (or run `secondlayer login`), then run `secondlayer credits balance`"));
     }
   });
 }
@@ -205061,8 +205061,8 @@ async function runUsage(opts) {
   });
 }
 function registerCreditsCommand(program) {
-  const credits = program.command("credits").description("Buy and check archive credits");
-  credits.command("buy").description("Open a one-time Stripe checkout for archive credits").requiredOption("--email <email>", "Receipt email; becomes the account").option("--pack <usd>", `One of ${PACKS.join(", ")}`, "25").option("--json", "Output as JSON").action((opts) => runBuy(opts));
+  const credits = program.command("credits").description("Buy and check your credits");
+  credits.command("buy").description("Open a one-time Stripe checkout for credits").requiredOption("--email <email>", "Receipt email; becomes the account").option("--pack <usd>", `One of ${PACKS.join(", ")}`, "25").option("--json", "Output as JSON").action((opts) => runBuy(opts));
   credits.command("balance").description("Show prepaid archive credit balance").option("--json", "Output as JSON").action((opts) => runBalance(opts));
   credits.command("usage").description("Rows delivered per day: free vs paid, by source").option("--days <n>", "Days to show (max 30)", "30").option("--json", "Output as JSON").action((opts) => runUsage(opts));
   credits.command("refill").description("Opt-in auto-refill when the balance drops under a threshold").option("--below <usd>", "Trigger when balance is under this USD amount").option("--pack <usd>", `Pack to buy (${PACKS.join(", ")})`, "25").option("--off", "Turn auto-refill off").option("--json", "Output as JSON").action((opts) => runRefill(opts));
@@ -207801,9 +207801,32 @@ function registerWhoamiCommand(program) {
 // src/commands/login.ts
 init_api_url();
 init_http();
+import { hostname } from "node:os";
+import { createInterface } from "node:readline";
+import { confirm as confirm3, input } from "@inquirer/prompts";
+
+// src/lib/open-browser.ts
+import { spawn as spawn3 } from "node:child_process";
+function browserCommand(url, platform = process.platform) {
+  if (platform === "darwin")
+    return { cmd: "open", args: [url] };
+  if (platform === "win32") {
+    return { cmd: "cmd", args: ["/c", "start", "", url] };
+  }
+  return { cmd: "xdg-open", args: [url] };
+}
+function openBrowser(url) {
+  try {
+    const { cmd, args } = browserCommand(url);
+    const child = spawn3(cmd, args, { detached: true, stdio: "ignore" });
+    child.on("error", () => {});
+    child.unref();
+  } catch {}
+}
+
+// src/commands/login.ts
 init_output();
 init_session();
-import { confirm as confirm3, input } from "@inquirer/prompts";
 function sessionExpiry() {
   return new Date(Date.now() + 90 * 24 * 60 * 60 * 1000).toISOString();
 }
@@ -207813,16 +207836,16 @@ async function readStdin() {
     chunks.push(chunk);
   return Buffer.concat(chunks).toString("utf8").trim();
 }
-function loginTarget(opts) {
-  return opts.credits ? resolveArchiveOpsUrl() : resolveApiUrl();
+function loginTarget() {
+  return resolveArchiveOpsUrl();
 }
-async function runTokenLogin(opts) {
+async function runTokenLogin() {
   const token = await readStdin();
   if (!token) {
     error('No token on stdin. Usage: echo "$KEY" | secondlayer login --with-token');
     process.exit(1);
   }
-  const target = loginTarget(opts);
+  const target = loginTarget();
   let account;
   try {
     account = await httpAt(target, "/api/accounts/me", { bearer: token });
@@ -207838,31 +207861,123 @@ async function runTokenLogin(opts) {
   }, target);
   success(`Logged in as ${account.email} (${target})`);
 }
-async function runLoginFlow(options = {}) {
-  const target = loginTarget(options);
-  if (!options.force) {
-    const existing = await readSession(target);
-    if (existing) {
-      info(`Already logged in as ${existing.email} (${target}).`);
-      if (!process.stdin.isTTY) {
-        info(dim("Run 'secondlayer logout' first, or re-run with --force to switch accounts."));
-        return;
-      }
-      try {
-        const proceed = await confirm3({
-          message: "Log in as a different user?",
-          default: false
-        });
-        if (!proceed) {
-          info(dim("Run 'secondlayer logout' to sign out."));
-          return;
+async function shouldContinueLogin(target, options) {
+  if (options.force)
+    return true;
+  const existing = await readSession(target);
+  if (!existing)
+    return true;
+  info(`Already logged in as ${existing.email} (${target}).`);
+  const hint = "Run 'secondlayer logout' first, or re-run with --force to switch accounts.";
+  if (!process.stdin.isTTY) {
+    info(dim(hint));
+    return false;
+  }
+  try {
+    const proceed = await confirm3({
+      message: "Log in as a different user?",
+      default: false
+    });
+    if (!proceed) {
+      info(dim("Run 'secondlayer logout' to sign out."));
+      return false;
+    }
+  } catch {
+    info(dim(hint));
+    return false;
+  }
+  return true;
+}
+async function pollDeviceToken(start, deps) {
+  const deadline = deps.now() + start.expiresIn * 1000;
+  let failures = 0;
+  while (deps.now() < deadline) {
+    await deps.sleep(start.interval * 1000);
+    try {
+      const res = await deps.post("/api/cli/device/token", { deviceCode: start.deviceCode });
+      return {
+        kind: "approved",
+        sessionToken: res.sessionToken,
+        account: res.account
+      };
+    } catch (err) {
+      if (err instanceof CliHttpError) {
+        if (err.status === 428) {
+          failures = 0;
+          continue;
         }
-      } catch {
-        info(dim("Run 'secondlayer logout' first, or re-run with --force to switch accounts."));
-        return;
+        if (err.status === 403 && err.body.error === "access_denied") {
+          return { kind: "denied" };
+        }
+        if (err.status === 410)
+          return { kind: "expired" };
+        throw err;
       }
+      if (++failures >= 3)
+        throw err;
     }
   }
+  return { kind: "expired" };
+}
+function clientName() {
+  return hostname().trim().slice(0, 64) || "this machine";
+}
+async function runDeviceLogin(options = {}) {
+  const target = loginTarget();
+  if (!await shouldContinueLogin(target, options))
+    return;
+  let start;
+  try {
+    start = await httpAt(target, "/api/cli/device", {
+      method: "POST",
+      body: { clientName: clientName() }
+    });
+  } catch (err) {
+    error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+  info(`First copy your one-time code: ${start.userCode}`);
+  const readline = process.stdin.isTTY ? createInterface({ input: process.stdin }) : null;
+  if (readline) {
+    info("Press Enter to open secondlayer.tools in your browser...");
+    readline.once("line", () => openBrowser(start.verificationUrl));
+  }
+  info(dim(`Or open ${start.verificationUrl}`));
+  info(dim("Waiting for you to approve in the browser..."));
+  let outcome;
+  try {
+    outcome = await pollDeviceToken(start, {
+      post: (path, body) => httpAt(target, path, { method: "POST", body }),
+      sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
+      now: Date.now
+    });
+  } catch (err) {
+    readline?.close();
+    error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
+  readline?.close();
+  if (outcome.kind === "denied") {
+    error("Cancelled in the browser.");
+    process.exit(1);
+  }
+  if (outcome.kind === "expired") {
+    error("The code expired. Run secondlayer login again.");
+    process.exit(1);
+  }
+  await writeSession({
+    token: outcome.sessionToken,
+    email: outcome.account.email,
+    accountId: outcome.account.id,
+    expiresAt: sessionExpiry()
+  }, target);
+  success(`Logged in as ${outcome.account.email} on ${clientName()}`);
+  info(dim("Run 'secondlayer logout' to sign this machine out."));
+}
+async function runLoginFlow(options = {}) {
+  const target = loginTarget();
+  if (!await shouldContinueLogin(target, options))
+    return;
   const email = await input({
     message: "Email",
     validate: (v) => /^.+@.+\..+$/.test(v) ? true : "Invalid email"
@@ -207900,7 +208015,7 @@ async function runLoginFlow(options = {}) {
       expiresAt: sessionExpiry()
     }, target);
     success(`Logged in as ${verified.account.email}`);
-    info(dim(options.credits ? "Run 'secondlayer credits balance' to see your archive credits." : "Run 'secondlayer whoami' to see your account status."));
+    info(dim("Run 'secondlayer whoami' to see your account status."));
   } catch (err) {
     if (err instanceof CliHttpError) {
       error(err.message);
@@ -207911,17 +208026,18 @@ async function runLoginFlow(options = {}) {
   }
 }
 function registerLoginCommand(program) {
-  program.command("login").description("Log in to Secondlayer (magic-link email)").option("--force", "Skip the already-logged-in check and re-run the flow").option("--with-token", "Read an API key from stdin (non-interactive)").option("--credits", "Log in to the archive credits account used by bootstrap, repair, and credits").addHelpText("after", `
+  program.command("login").description("Log in to Secondlayer through your browser").option("--force", "Skip the already-logged-in check and re-run the flow").option("--email", "Sign in with an emailed 6-digit code instead of a browser").option("--with-token", "Read an API key from stdin (non-interactive)").addHelpText("after", `
 Examples:
-  $ secondlayer login --credits
-  $ echo "$SECONDLAYER_API_KEY" | secondlayer login --with-token`).action((opts) => opts.withToken ? runTokenLogin({ credits: opts.credits }) : runLoginFlow({ force: opts.force, credits: opts.credits }));
+  $ secondlayer login
+  $ secondlayer login --email
+  $ echo "$SECONDLAYER_API_KEY" | secondlayer login --with-token`).action((opts) => opts.withToken ? runTokenLogin() : opts.email ? runLoginFlow({ force: opts.force }) : runDeviceLogin({ force: opts.force }));
 }
 // src/commands/logout.ts
 init_http();
 init_output();
 init_session();
-async function runLogout(opts = {}) {
-  const target = loginTarget(opts);
+async function runLogout() {
+  const target = loginTarget();
   const session = await readSession(target);
   if (!session) {
     info(`Not logged in (${target}).`);
@@ -207941,7 +208057,7 @@ async function runLogout(opts = {}) {
   success(`Logged out (${target}).`);
 }
 function registerLogoutCommand(program) {
-  program.command("logout").description("Log out and revoke the local session").option("--credits", "Log out of the archive credits account used by bootstrap, repair, and credits").action((opts) => runLogout({ credits: opts.credits }));
+  program.command("logout").description("Sign this machine out of your Secondlayer account").action(() => runLogout());
 }
 // src/commands/backup.ts
 init_fs();
@@ -208355,7 +208471,7 @@ function renderInstanceEnv(env) {
     `SECONDLAYER_API_URL=${env.SECONDLAYER_API_URL}`
   ];
   if (env.SECONDLAYER_API_KEY) {
-    lines.push("# Hosted account key for archive credits (sk-sl_*).", `SECONDLAYER_API_KEY=${env.SECONDLAYER_API_KEY}`);
+    lines.push("# Hosted account key for credits and archive fetches (sk-sl_*).", `SECONDLAYER_API_KEY=${env.SECONDLAYER_API_KEY}`);
   }
   lines.push("# Archive trust root: bootstrap, verify, and repair check manifests", "# against this key. Replace it to pin a different archive.", `ARCHIVE_SIGNING_PUBLIC_KEY=${escapeEnvValue(env.ARCHIVE_SIGNING_PUBLIC_KEY)}`, "");
   return lines.join(`
@@ -208543,5 +208659,5 @@ registerCreditsCommand(program);
 registerArchiveCommand(program);
 program.parse();
 
-//# debugId=FA7A9048A9D4FA1264756E2164756E21
+//# debugId=32DC3B7BA2B6602D64756E2164756E21
 //# sourceMappingURL=cli.js.map