@secondlayer/cli 21.3.0 → 22.0.0

package/README.md

@@ -15,8 +15,8 @@ secondlayer --version
 Default API is `http://127.0.0.1:3800`. Override with `SECONDLAYER_API_URL`.
 
 Writes against a published bind use `INSTANCE_TOKEN` from `secondlayer init`.
-Loopback reads need no token. Hosted API and archive credits use
-`SECONDLAYER_API_KEY` (`sk-sl_*`).
+Loopback reads need no token. Your hosted account (credits, archive fetches)
+uses `secondlayer login` or `SECONDLAYER_API_KEY` (`sk-sl_*`).
 
 ```bash
 export SECONDLAYER_API_URL=http://127.0.0.1:3800

package/dist/cli.js

@@ -2369,12 +2369,12 @@ async function resolveArchiveOpsBearer() {
   };
 }
 function ignoredEnvKeyNote(ignored) {
-  return ignored ? " INSTANCE_TOKEN was ignored: it unlocks this instance, not archive credits." : "";
+  return ignored ? " INSTANCE_TOKEN was ignored: it unlocks this instance, not your account." : "";
 }
 async function httpArchiveOps(path, opts = {}) {
   const { bearer, ignoredEnvKey } = await resolveArchiveOpsBearer();
   if (!bearer) {
-    throw new CliHttpError(401, "SESSION_EXPIRED", { error: "Not logged in" }, `Archive credits need an account key. ${ARCHIVE_AUTH_HINT}${ignoredEnvKeyNote(ignoredEnvKey)}`);
+    throw new CliHttpError(401, "SESSION_EXPIRED", { error: "Not logged in" }, `This needs your Secondlayer account. ${ARCHIVE_AUTH_HINT}${ignoredEnvKeyNote(ignoredEnvKey)}`);
   }
   try {
     return await request(`${resolveArchiveOpsUrl()}${path}`, {
@@ -2383,12 +2383,12 @@ async function httpArchiveOps(path, opts = {}) {
     });
   } catch (err) {
     if (err instanceof CliHttpError && err.status === 401) {
-      throw new CliHttpError(401, err.code, err.body, `Archive credits rejected the credential (${err.message}). ${ARCHIVE_AUTH_HINT}${ignoredEnvKeyNote(ignoredEnvKey)}`);
+      throw new CliHttpError(401, err.code, err.body, `Your account rejected the credential (${err.message}). ${ARCHIVE_AUTH_HINT}${ignoredEnvKeyNote(ignoredEnvKey)}`);
     }
     throw err;
   }
 }
-var CliHttpError, REQUEST_TIMEOUT_MS = 30000, ARCHIVE_AUTH_HINT = "Set SECONDLAYER_API_KEY to your account key (sk-sl_…, from /account/keys), or run `secondlayer login --credits`.", ARCHIVE_CREDENTIAL_RE;
+var CliHttpError, REQUEST_TIMEOUT_MS = 30000, ARCHIVE_AUTH_HINT = "Set SECONDLAYER_API_KEY to your account key (sk-sl_…, from /account/keys), or run `secondlayer login`.", ARCHIVE_CREDENTIAL_RE;
 var init_http = __esm(() => {
   init_api_url();
   init_resolve_auth();
@@ -202692,7 +202692,7 @@ var {
 // package.json
 var package_default = {
   name: "@secondlayer/cli",
-  version: "21.3.0",
+  version: "22.0.0",
   description: "Run a Stacks index on your own hardware — set it up, restore verified history, and keep it current.",
   repository: {
     type: "git",
@@ -202811,7 +202811,7 @@ var BUY_CREDITS_COMMAND = "secondlayer credits buy";
 function formatInsufficientMessage(quote) {
   const shortfallUsd = ((quote.usdMicros - quote.balanceUsdMicros) / 1e6).toFixed(2);
   const balanceUsd = (quote.balanceUsdMicros / 1e6).toFixed(2);
-  return `Insufficient archive credits: quote $${quote.usd}, balance $${balanceUsd}, short $${shortfallUsd}. Buy more with \`${BUY_CREDITS_COMMAND}\`.`;
+  return `Insufficient credits: quote $${quote.usd}, balance $${balanceUsd}, short $${shortfallUsd}. Buy more with \`${BUY_CREDITS_COMMAND}\`.`;
 }
 var ARCHIVE_GATE_NOT_CONFIGURED_MESSAGE = "the archive gate is not configured on the server; contact the operator";
 var ALLOWANCE_MONTHLY_BUNDLES = 6;
@@ -204986,7 +204986,7 @@ async function runBuy(opts) {
     human: () => {
       success(`Checkout for $${amount} → ${email}`);
       console.log(res.url);
-      console.log(dim("After payment: set SECONDLAYER_API_KEY (or run `secondlayer login --credits`), then run `secondlayer credits balance`"));
+      console.log(dim("After payment: set SECONDLAYER_API_KEY (or run `secondlayer login`), then run `secondlayer credits balance`"));
     }
   });
 }
@@ -205061,8 +205061,8 @@ async function runUsage(opts) {
   });
 }
 function registerCreditsCommand(program) {
-  const credits = program.command("credits").description("Buy and check archive credits");
-  credits.command("buy").description("Open a one-time Stripe checkout for archive credits").requiredOption("--email <email>", "Receipt email; becomes the account").option("--pack <usd>", `One of ${PACKS.join(", ")}`, "25").option("--json", "Output as JSON").action((opts) => runBuy(opts));
+  const credits = program.command("credits").description("Buy and check your credits");
+  credits.command("buy").description("Open a one-time Stripe checkout for credits").requiredOption("--email <email>", "Receipt email; becomes the account").option("--pack <usd>", `One of ${PACKS.join(", ")}`, "25").option("--json", "Output as JSON").action((opts) => runBuy(opts));
   credits.command("balance").description("Show prepaid archive credit balance").option("--json", "Output as JSON").action((opts) => runBalance(opts));
   credits.command("usage").description("Rows delivered per day: free vs paid, by source").option("--days <n>", "Days to show (max 30)", "30").option("--json", "Output as JSON").action((opts) => runUsage(opts));
   credits.command("refill").description("Opt-in auto-refill when the balance drops under a threshold").option("--below <usd>", "Trigger when balance is under this USD amount").option("--pack <usd>", `Pack to buy (${PACKS.join(", ")})`, "25").option("--off", "Turn auto-refill off").option("--json", "Output as JSON").action((opts) => runRefill(opts));
@@ -207836,16 +207836,16 @@ async function readStdin() {
     chunks.push(chunk);
   return Buffer.concat(chunks).toString("utf8").trim();
 }
-function loginTarget(opts) {
-  return opts.credits ? resolveArchiveOpsUrl() : resolveApiUrl();
+function loginTarget() {
+  return resolveArchiveOpsUrl();
 }
-async function runTokenLogin(opts) {
+async function runTokenLogin() {
   const token = await readStdin();
   if (!token) {
     error('No token on stdin. Usage: echo "$KEY" | secondlayer login --with-token');
     process.exit(1);
   }
-  const target = loginTarget(opts);
+  const target = loginTarget();
   let account;
   try {
     account = await httpAt(target, "/api/accounts/me", { bearer: token });
@@ -207895,7 +207895,11 @@ async function pollDeviceToken(start, deps) {
     await deps.sleep(start.interval * 1000);
     try {
       const res = await deps.post("/api/cli/device/token", { deviceCode: start.deviceCode });
-      return { kind: "approved", key: res.key, account: res.account };
+      return {
+        kind: "approved",
+        sessionToken: res.sessionToken,
+        account: res.account
+      };
     } catch (err) {
       if (err instanceof CliHttpError) {
         if (err.status === 428) {
@@ -207905,9 +207909,6 @@ async function pollDeviceToken(start, deps) {
         if (err.status === 403 && err.body.error === "access_denied") {
           return { kind: "denied" };
         }
-        if (err.status === 409 && err.body.error === "key_limit") {
-          return { kind: "key_limit" };
-        }
         if (err.status === 410)
           return { kind: "expired" };
         throw err;
@@ -207918,12 +207919,11 @@ async function pollDeviceToken(start, deps) {
   }
   return { kind: "expired" };
 }
-var KEY_LIMIT_MESSAGE = "You have 50 keys. Revoke one under Keys, then run secondlayer login again.";
 function clientName() {
   return hostname().trim().slice(0, 64) || "this machine";
 }
 async function runDeviceLogin(options = {}) {
-  const target = loginTarget(options);
+  const target = loginTarget();
   if (!await shouldContinueLogin(target, options))
     return;
   let start;
@@ -207961,25 +207961,21 @@ async function runDeviceLogin(options = {}) {
     error("Cancelled in the browser.");
     process.exit(1);
   }
-  if (outcome.kind === "key_limit") {
-    error(KEY_LIMIT_MESSAGE);
-    process.exit(1);
-  }
   if (outcome.kind === "expired") {
     error("The code expired. Run secondlayer login again.");
     process.exit(1);
   }
   await writeSession({
-    token: outcome.key,
+    token: outcome.sessionToken,
     email: outcome.account.email,
     accountId: outcome.account.id,
     expiresAt: sessionExpiry()
   }, target);
   success(`Logged in as ${outcome.account.email} on ${clientName()}`);
-  info(dim("This machine has its own key. Revoke it under Keys."));
+  info(dim("Run 'secondlayer logout' to sign this machine out."));
 }
 async function runLoginFlow(options = {}) {
-  const target = loginTarget(options);
+  const target = loginTarget();
   if (!await shouldContinueLogin(target, options))
     return;
   const email = await input({
@@ -208019,7 +208015,7 @@ async function runLoginFlow(options = {}) {
       expiresAt: sessionExpiry()
     }, target);
     success(`Logged in as ${verified.account.email}`);
-    info(dim(options.credits ? "Run 'secondlayer credits balance' to see your archive credits." : "Run 'secondlayer whoami' to see your account status."));
+    info(dim("Run 'secondlayer whoami' to see your account status."));
   } catch (err) {
     if (err instanceof CliHttpError) {
       error(err.message);
@@ -208030,19 +208026,18 @@ async function runLoginFlow(options = {}) {
   }
 }
 function registerLoginCommand(program) {
-  program.command("login").description("Log in to Secondlayer through your browser").option("--force", "Skip the already-logged-in check and re-run the flow").option("--email", "Sign in with an emailed 6-digit code instead of a browser").option("--with-token", "Read an API key from stdin (non-interactive)").option("--credits", "Log in to the archive credits account used by bootstrap, repair, and credits").addHelpText("after", `
+  program.command("login").description("Log in to Secondlayer through your browser").option("--force", "Skip the already-logged-in check and re-run the flow").option("--email", "Sign in with an emailed 6-digit code instead of a browser").option("--with-token", "Read an API key from stdin (non-interactive)").addHelpText("after", `
 Examples:
   $ secondlayer login
   $ secondlayer login --email
-  $ secondlayer login --credits
-  $ echo "$SECONDLAYER_API_KEY" | secondlayer login --with-token`).action((opts) => opts.withToken ? runTokenLogin({ credits: opts.credits }) : opts.email ? runLoginFlow({ force: opts.force, credits: opts.credits }) : runDeviceLogin({ force: opts.force, credits: opts.credits }));
+  $ echo "$SECONDLAYER_API_KEY" | secondlayer login --with-token`).action((opts) => opts.withToken ? runTokenLogin() : opts.email ? runLoginFlow({ force: opts.force }) : runDeviceLogin({ force: opts.force }));
 }
 // src/commands/logout.ts
 init_http();
 init_output();
 init_session();
-async function runLogout(opts = {}) {
-  const target = loginTarget(opts);
+async function runLogout() {
+  const target = loginTarget();
   const session = await readSession(target);
   if (!session) {
     info(`Not logged in (${target}).`);
@@ -208062,7 +208057,7 @@ async function runLogout(opts = {}) {
   success(`Logged out (${target}).`);
 }
 function registerLogoutCommand(program) {
-  program.command("logout").description("Log out and revoke the local session").option("--credits", "Log out of the archive credits account used by bootstrap, repair, and credits").action((opts) => runLogout({ credits: opts.credits }));
+  program.command("logout").description("Sign this machine out of your Secondlayer account").action(() => runLogout());
 }
 // src/commands/backup.ts
 init_fs();
@@ -208476,7 +208471,7 @@ function renderInstanceEnv(env) {
     `SECONDLAYER_API_URL=${env.SECONDLAYER_API_URL}`
   ];
   if (env.SECONDLAYER_API_KEY) {
-    lines.push("# Hosted account key for archive credits (sk-sl_*).", `SECONDLAYER_API_KEY=${env.SECONDLAYER_API_KEY}`);
+    lines.push("# Hosted account key for credits and archive fetches (sk-sl_*).", `SECONDLAYER_API_KEY=${env.SECONDLAYER_API_KEY}`);
   }
   lines.push("# Archive trust root: bootstrap, verify, and repair check manifests", "# against this key. Replace it to pin a different archive.", `ARCHIVE_SIGNING_PUBLIC_KEY=${escapeEnvValue(env.ARCHIVE_SIGNING_PUBLIC_KEY)}`, "");
   return lines.join(`
@@ -208664,5 +208659,5 @@ registerCreditsCommand(program);
 registerArchiveCommand(program);
 program.parse();
 
-//# debugId=9552E9D4123BD8E564756E2164756E21
+//# debugId=32DC3B7BA2B6602D64756E2164756E21
 //# sourceMappingURL=cli.js.map