@secondlayer/cli 21.3.0 → 22.0.1

package/README.md

@@ -15,8 +15,8 @@ secondlayer --version
 Default API is `http://127.0.0.1:3800`. Override with `SECONDLAYER_API_URL`.
 
 Writes against a published bind use `INSTANCE_TOKEN` from `secondlayer init`.
-Loopback reads need no token. Hosted API and archive credits use
-`SECONDLAYER_API_KEY` (`sk-sl_*`).
+Loopback reads need no token. Your hosted account (credits, archive fetches)
+uses `secondlayer login` or `SECONDLAYER_API_KEY` (`sk-sl_*`).
 
 ```bash
 export SECONDLAYER_API_URL=http://127.0.0.1:3800

package/dist/cli.js

@@ -2369,12 +2369,12 @@ async function resolveArchiveOpsBearer() {
   };
 }
 function ignoredEnvKeyNote(ignored) {
-  return ignored ? " INSTANCE_TOKEN was ignored: it unlocks this instance, not archive credits." : "";
+  return ignored ? " INSTANCE_TOKEN was ignored: it unlocks this instance, not your account." : "";
 }
 async function httpArchiveOps(path, opts = {}) {
   const { bearer, ignoredEnvKey } = await resolveArchiveOpsBearer();
   if (!bearer) {
-    throw new CliHttpError(401, "SESSION_EXPIRED", { error: "Not logged in" }, `Archive credits need an account key. ${ARCHIVE_AUTH_HINT}${ignoredEnvKeyNote(ignoredEnvKey)}`);
+    throw new CliHttpError(401, "SESSION_EXPIRED", { error: "Not logged in" }, `This needs your Secondlayer account. ${ARCHIVE_AUTH_HINT}${ignoredEnvKeyNote(ignoredEnvKey)}`);
   }
   try {
     return await request(`${resolveArchiveOpsUrl()}${path}`, {
@@ -2383,12 +2383,12 @@ async function httpArchiveOps(path, opts = {}) {
     });
   } catch (err) {
     if (err instanceof CliHttpError && err.status === 401) {
-      throw new CliHttpError(401, err.code, err.body, `Archive credits rejected the credential (${err.message}). ${ARCHIVE_AUTH_HINT}${ignoredEnvKeyNote(ignoredEnvKey)}`);
+      throw new CliHttpError(401, err.code, err.body, `Your account rejected the credential (${err.message}). ${ARCHIVE_AUTH_HINT}${ignoredEnvKeyNote(ignoredEnvKey)}`);
     }
     throw err;
   }
 }
-var CliHttpError, REQUEST_TIMEOUT_MS = 30000, ARCHIVE_AUTH_HINT = "Set SECONDLAYER_API_KEY to your account key (sk-sl_…, from /account/keys), or run `secondlayer login --credits`.", ARCHIVE_CREDENTIAL_RE;
+var CliHttpError, REQUEST_TIMEOUT_MS = 30000, ARCHIVE_AUTH_HINT = "Set SECONDLAYER_API_KEY to your account key (sk-sl_…, from /account/keys), or run `secondlayer login`.", ARCHIVE_CREDENTIAL_RE;
 var init_http = __esm(() => {
   init_api_url();
   init_resolve_auth();
@@ -2567,12 +2567,27 @@ function nextStepHint(status) {
     return "Server error — retry shortly, or check `secondlayer status`.";
   return;
 }
+function authFailureMessage(code, status, ossMode) {
+  if (code === "KEY_REVOKED") {
+    return {
+      message: "Your saved login was revoked.",
+      hint: "Run `secondlayer login` to sign in again. If you set SECONDLAYER_API_KEY, replace it with a key from /account/keys."
+    };
+  }
+  if (code === "SESSION_EXPIRED" || status === 401) {
+    return {
+      message: "Authentication required.",
+      hint: ossMode ? "Set INSTANCE_TOKEN from `secondlayer init`." : "Run `secondlayer login` to re-authenticate."
+    };
+  }
+  return null;
+}
 function handleApiError(err, action) {
   const status = err instanceof ApiError || err instanceof CliHttpError ? err.status : undefined;
-  if (err instanceof CliHttpError && err.code === "SESSION_EXPIRED" || status === 401) {
-    printError("Authentication required.", {
-      hint: isOssMode() ? "Set INSTANCE_TOKEN from `secondlayer init`." : "Run `secondlayer login` to re-authenticate."
-    });
+  const code = err instanceof ApiError || err instanceof CliHttpError ? err.code : undefined;
+  const auth = authFailureMessage(code, status, isOssMode());
+  if (auth) {
+    printError(auth.message, { hint: auth.hint });
     process.exit(1);
   }
   const detail = err instanceof Error ? err.message : String(err);
@@ -16181,7 +16196,11 @@ class StacksApiClient {
       return response.body;
     } catch (error) {
       const statusCode = typeof error === "object" && error !== null && "response" in error && typeof error.response === "object" && error.response !== null && "statusCode" in error.response ? error.response.statusCode : undefined;
+      const responseBody = typeof error === "object" && error !== null && "response" in error && typeof error.response === "object" && error.response !== null && "body" in error.response ? error.response.body : undefined;
       const message = error instanceof Error ? error.message : String(error);
+      if (statusCode === 401 && typeof responseBody === "object" && responseBody !== null && "code" in responseBody && responseBody.code === "KEY_REVOKED") {
+        throw new Error("Your saved login was revoked. Run `secondlayer login` to sign in again.");
+      }
       if (statusCode === 401) {
         throw new Error(isOssMode() ? "Authentication required. Set INSTANCE_TOKEN from `secondlayer init`." : "Authentication required. Run: secondlayer login");
       }
@@ -202692,7 +202711,7 @@ var {
 // package.json
 var package_default = {
   name: "@secondlayer/cli",
-  version: "21.3.0",
+  version: "22.0.1",
   description: "Run a Stacks index on your own hardware — set it up, restore verified history, and keep it current.",
   repository: {
     type: "git",
@@ -202811,7 +202830,7 @@ var BUY_CREDITS_COMMAND = "secondlayer credits buy";
 function formatInsufficientMessage(quote) {
   const shortfallUsd = ((quote.usdMicros - quote.balanceUsdMicros) / 1e6).toFixed(2);
   const balanceUsd = (quote.balanceUsdMicros / 1e6).toFixed(2);
-  return `Insufficient archive credits: quote $${quote.usd}, balance $${balanceUsd}, short $${shortfallUsd}. Buy more with \`${BUY_CREDITS_COMMAND}\`.`;
+  return `Insufficient credits: quote $${quote.usd}, balance $${balanceUsd}, short $${shortfallUsd}. Buy more with \`${BUY_CREDITS_COMMAND}\`.`;
 }
 var ARCHIVE_GATE_NOT_CONFIGURED_MESSAGE = "the archive gate is not configured on the server; contact the operator";
 var ALLOWANCE_MONTHLY_BUNDLES = 6;
@@ -204986,7 +205005,7 @@ async function runBuy(opts) {
     human: () => {
       success(`Checkout for $${amount} → ${email}`);
       console.log(res.url);
-      console.log(dim("After payment: set SECONDLAYER_API_KEY (or run `secondlayer login --credits`), then run `secondlayer credits balance`"));
+      console.log(dim("After payment: set SECONDLAYER_API_KEY (or run `secondlayer login`), then run `secondlayer credits balance`"));
     }
   });
 }
@@ -205061,8 +205080,8 @@ async function runUsage(opts) {
   });
 }
 function registerCreditsCommand(program) {
-  const credits = program.command("credits").description("Buy and check archive credits");
-  credits.command("buy").description("Open a one-time Stripe checkout for archive credits").requiredOption("--email <email>", "Receipt email; becomes the account").option("--pack <usd>", `One of ${PACKS.join(", ")}`, "25").option("--json", "Output as JSON").action((opts) => runBuy(opts));
+  const credits = program.command("credits").description("Buy and check your credits");
+  credits.command("buy").description("Open a one-time Stripe checkout for credits").requiredOption("--email <email>", "Receipt email; becomes the account").option("--pack <usd>", `One of ${PACKS.join(", ")}`, "25").option("--json", "Output as JSON").action((opts) => runBuy(opts));
   credits.command("balance").description("Show prepaid archive credit balance").option("--json", "Output as JSON").action((opts) => runBalance(opts));
   credits.command("usage").description("Rows delivered per day: free vs paid, by source").option("--days <n>", "Days to show (max 30)", "30").option("--json", "Output as JSON").action((opts) => runUsage(opts));
   credits.command("refill").description("Opt-in auto-refill when the balance drops under a threshold").option("--below <usd>", "Trigger when balance is under this USD amount").option("--pack <usd>", `Pack to buy (${PACKS.join(", ")})`, "25").option("--off", "Turn auto-refill off").option("--json", "Output as JSON").action((opts) => runRefill(opts));
@@ -207836,16 +207855,16 @@ async function readStdin() {
     chunks.push(chunk);
   return Buffer.concat(chunks).toString("utf8").trim();
 }
-function loginTarget(opts) {
-  return opts.credits ? resolveArchiveOpsUrl() : resolveApiUrl();
+function loginTarget() {
+  return resolveArchiveOpsUrl();
 }
-async function runTokenLogin(opts) {
+async function runTokenLogin() {
   const token = await readStdin();
   if (!token) {
     error('No token on stdin. Usage: echo "$KEY" | secondlayer login --with-token');
     process.exit(1);
   }
-  const target = loginTarget(opts);
+  const target = loginTarget();
   let account;
   try {
     account = await httpAt(target, "/api/accounts/me", { bearer: token });
@@ -207861,12 +207880,24 @@ async function runTokenLogin(opts) {
   }, target);
   success(`Logged in as ${account.email} (${target})`);
 }
-async function shouldContinueLogin(target, options) {
+var defaultLoginCheckDeps = {
+  readSession,
+  verify: (target, token) => httpAt(target, "/api/accounts/me", { bearer: token })
+};
+async function shouldContinueLogin(target, options, deps = defaultLoginCheckDeps) {
   if (options.force)
     return true;
-  const existing = await readSession(target);
+  const existing = await deps.readSession(target);
   if (!existing)
     return true;
+  try {
+    await deps.verify(target, existing.token);
+  } catch (err) {
+    if (err instanceof CliHttpError && (err.status === 401 || err.status === 403)) {
+      info(`Your saved login for ${existing.email} stopped working (revoked or expired). Signing in again.`);
+      return true;
+    }
+  }
   info(`Already logged in as ${existing.email} (${target}).`);
   const hint = "Run 'secondlayer logout' first, or re-run with --force to switch accounts.";
   if (!process.stdin.isTTY) {
@@ -207895,7 +207926,11 @@ async function pollDeviceToken(start, deps) {
     await deps.sleep(start.interval * 1000);
     try {
       const res = await deps.post("/api/cli/device/token", { deviceCode: start.deviceCode });
-      return { kind: "approved", key: res.key, account: res.account };
+      return {
+        kind: "approved",
+        sessionToken: res.sessionToken,
+        account: res.account
+      };
     } catch (err) {
       if (err instanceof CliHttpError) {
         if (err.status === 428) {
@@ -207905,9 +207940,6 @@ async function pollDeviceToken(start, deps) {
         if (err.status === 403 && err.body.error === "access_denied") {
           return { kind: "denied" };
         }
-        if (err.status === 409 && err.body.error === "key_limit") {
-          return { kind: "key_limit" };
-        }
         if (err.status === 410)
           return { kind: "expired" };
         throw err;
@@ -207918,12 +207950,11 @@ async function pollDeviceToken(start, deps) {
   }
   return { kind: "expired" };
 }
-var KEY_LIMIT_MESSAGE = "You have 50 keys. Revoke one under Keys, then run secondlayer login again.";
 function clientName() {
   return hostname().trim().slice(0, 64) || "this machine";
 }
 async function runDeviceLogin(options = {}) {
-  const target = loginTarget(options);
+  const target = loginTarget();
   if (!await shouldContinueLogin(target, options))
     return;
   let start;
@@ -207936,10 +207967,10 @@ async function runDeviceLogin(options = {}) {
     error(err instanceof Error ? err.message : String(err));
     process.exit(1);
   }
-  info(`First copy your one-time code: ${start.userCode}`);
+  info(`Your one-time code: ${start.userCode}`);
   const readline = process.stdin.isTTY ? createInterface({ input: process.stdin }) : null;
   if (readline) {
-    info("Press Enter to open secondlayer.tools in your browser...");
+    info("Press Enter to open the sign-in page, then check the code matches.");
     readline.once("line", () => openBrowser(start.verificationUrl));
   }
   info(dim(`Or open ${start.verificationUrl}`));
@@ -207961,25 +207992,21 @@ async function runDeviceLogin(options = {}) {
     error("Cancelled in the browser.");
     process.exit(1);
   }
-  if (outcome.kind === "key_limit") {
-    error(KEY_LIMIT_MESSAGE);
-    process.exit(1);
-  }
   if (outcome.kind === "expired") {
     error("The code expired. Run secondlayer login again.");
     process.exit(1);
   }
   await writeSession({
-    token: outcome.key,
+    token: outcome.sessionToken,
     email: outcome.account.email,
     accountId: outcome.account.id,
     expiresAt: sessionExpiry()
   }, target);
   success(`Logged in as ${outcome.account.email} on ${clientName()}`);
-  info(dim("This machine has its own key. Revoke it under Keys."));
+  info(dim("Run 'secondlayer logout' to sign this machine out."));
 }
 async function runLoginFlow(options = {}) {
-  const target = loginTarget(options);
+  const target = loginTarget();
   if (!await shouldContinueLogin(target, options))
     return;
   const email = await input({
@@ -208019,7 +208046,7 @@ async function runLoginFlow(options = {}) {
       expiresAt: sessionExpiry()
     }, target);
     success(`Logged in as ${verified.account.email}`);
-    info(dim(options.credits ? "Run 'secondlayer credits balance' to see your archive credits." : "Run 'secondlayer whoami' to see your account status."));
+    info(dim("Run 'secondlayer whoami' to see your account status."));
   } catch (err) {
     if (err instanceof CliHttpError) {
       error(err.message);
@@ -208030,19 +208057,18 @@ async function runLoginFlow(options = {}) {
   }
 }
 function registerLoginCommand(program) {
-  program.command("login").description("Log in to Secondlayer through your browser").option("--force", "Skip the already-logged-in check and re-run the flow").option("--email", "Sign in with an emailed 6-digit code instead of a browser").option("--with-token", "Read an API key from stdin (non-interactive)").option("--credits", "Log in to the archive credits account used by bootstrap, repair, and credits").addHelpText("after", `
+  program.command("login").description("Log in to Secondlayer through your browser").option("--force", "Skip the already-logged-in check and re-run the flow").option("--email", "Sign in with an emailed 6-digit code instead of a browser").option("--with-token", "Read an API key from stdin (non-interactive)").addHelpText("after", `
 Examples:
   $ secondlayer login
   $ secondlayer login --email
-  $ secondlayer login --credits
-  $ echo "$SECONDLAYER_API_KEY" | secondlayer login --with-token`).action((opts) => opts.withToken ? runTokenLogin({ credits: opts.credits }) : opts.email ? runLoginFlow({ force: opts.force, credits: opts.credits }) : runDeviceLogin({ force: opts.force, credits: opts.credits }));
+  $ echo "$SECONDLAYER_API_KEY" | secondlayer login --with-token`).action((opts) => opts.withToken ? runTokenLogin() : opts.email ? runLoginFlow({ force: opts.force }) : runDeviceLogin({ force: opts.force }));
 }
 // src/commands/logout.ts
 init_http();
 init_output();
 init_session();
-async function runLogout(opts = {}) {
-  const target = loginTarget(opts);
+async function runLogout() {
+  const target = loginTarget();
   const session = await readSession(target);
   if (!session) {
     info(`Not logged in (${target}).`);
@@ -208062,7 +208088,7 @@ async function runLogout(opts = {}) {
   success(`Logged out (${target}).`);
 }
 function registerLogoutCommand(program) {
-  program.command("logout").description("Log out and revoke the local session").option("--credits", "Log out of the archive credits account used by bootstrap, repair, and credits").action((opts) => runLogout({ credits: opts.credits }));
+  program.command("logout").description("Sign this machine out of your Secondlayer account").action(() => runLogout());
 }
 // src/commands/backup.ts
 init_fs();
@@ -208476,7 +208502,7 @@ function renderInstanceEnv(env) {
     `SECONDLAYER_API_URL=${env.SECONDLAYER_API_URL}`
   ];
   if (env.SECONDLAYER_API_KEY) {
-    lines.push("# Hosted account key for archive credits (sk-sl_*).", `SECONDLAYER_API_KEY=${env.SECONDLAYER_API_KEY}`);
+    lines.push("# Hosted account key for credits and archive fetches (sk-sl_*).", `SECONDLAYER_API_KEY=${env.SECONDLAYER_API_KEY}`);
   }
   lines.push("# Archive trust root: bootstrap, verify, and repair check manifests", "# against this key. Replace it to pin a different archive.", `ARCHIVE_SIGNING_PUBLIC_KEY=${escapeEnvValue(env.ARCHIVE_SIGNING_PUBLIC_KEY)}`, "");
   return lines.join(`
@@ -208664,5 +208690,5 @@ registerCreditsCommand(program);
 registerArchiveCommand(program);
 program.parse();
 
-//# debugId=9552E9D4123BD8E564756E2164756E21
+//# debugId=77FBD5CCBD0906B064756E2164756E21
 //# sourceMappingURL=cli.js.map