@secondlayer/cli 22.0.0 → 22.1.0

package/dist/cli.js

@@ -2567,12 +2567,27 @@ function nextStepHint(status) {
     return "Server error — retry shortly, or check `secondlayer status`.";
   return;
 }
+function authFailureMessage(code, status, ossMode) {
+  if (code === "KEY_REVOKED") {
+    return {
+      message: "Your saved login was revoked.",
+      hint: "Run `secondlayer login` to sign in again. If you set SECONDLAYER_API_KEY, replace it with a key from /account/keys."
+    };
+  }
+  if (code === "SESSION_EXPIRED" || status === 401) {
+    return {
+      message: "Authentication required.",
+      hint: ossMode ? "Set INSTANCE_TOKEN from `secondlayer init`." : "Run `secondlayer login` to re-authenticate."
+    };
+  }
+  return null;
+}
 function handleApiError(err, action) {
   const status = err instanceof ApiError || err instanceof CliHttpError ? err.status : undefined;
-  if (err instanceof CliHttpError && err.code === "SESSION_EXPIRED" || status === 401) {
-    printError("Authentication required.", {
-      hint: isOssMode() ? "Set INSTANCE_TOKEN from `secondlayer init`." : "Run `secondlayer login` to re-authenticate."
-    });
+  const code = err instanceof ApiError || err instanceof CliHttpError ? err.code : undefined;
+  const auth = authFailureMessage(code, status, isOssMode());
+  if (auth) {
+    printError(auth.message, { hint: auth.hint });
     process.exit(1);
   }
   const detail = err instanceof Error ? err.message : String(err);
@@ -16181,7 +16196,11 @@ class StacksApiClient {
       return response.body;
     } catch (error) {
       const statusCode = typeof error === "object" && error !== null && "response" in error && typeof error.response === "object" && error.response !== null && "statusCode" in error.response ? error.response.statusCode : undefined;
+      const responseBody = typeof error === "object" && error !== null && "response" in error && typeof error.response === "object" && error.response !== null && "body" in error.response ? error.response.body : undefined;
       const message = error instanceof Error ? error.message : String(error);
+      if (statusCode === 401 && typeof responseBody === "object" && responseBody !== null && "code" in responseBody && responseBody.code === "KEY_REVOKED") {
+        throw new Error("Your saved login was revoked. Run `secondlayer login` to sign in again.");
+      }
       if (statusCode === 401) {
         throw new Error(isOssMode() ? "Authentication required. Set INSTANCE_TOKEN from `secondlayer init`." : "Authentication required. Run: secondlayer login");
       }
@@ -29469,7 +29488,7 @@ var init_git_status = () => {};
 
 // ../../node_modules/typescript/lib/typescript.js
 var require_typescript = __commonJS(function(exports, module) {
-  var __dirname = "/Users/ryan/projects/secondlayer/node_modules/typescript/lib", __filename = "/Users/ryan/projects/secondlayer/node_modules/typescript/lib/typescript.js";
+  var __dirname = "/Users/ryan/projects/secondlayer/.claude/worktrees/rel313/node_modules/typescript/lib", __filename = "/Users/ryan/projects/secondlayer/.claude/worktrees/rel313/node_modules/typescript/lib/typescript.js";
   /*! *****************************************************************************
   Copyright (c) Microsoft Corporation. All rights reserved.
   Licensed under the Apache License, Version 2.0 (the "License"); you may not use
@@ -202692,7 +202711,7 @@ var {
 // package.json
 var package_default = {
   name: "@secondlayer/cli",
-  version: "22.0.0",
+  version: "22.1.0",
   description: "Run a Stacks index on your own hardware — set it up, restore verified history, and keep it current.",
   repository: {
     type: "git",
@@ -204165,6 +204184,126 @@ import {
   reportVerify
 } from "@secondlayer/shared/coverage";
 import { getDb as getDb3 } from "@secondlayer/shared/db";
+
+// src/lib/archive-heights.ts
+import {
+  PerHeightDigestAccumulator
+} from "@secondlayer/shared/archive/per-height-digest";
+import {
+  streamHeightDigests
+} from "@secondlayer/shared/archive/semantic-digest-builder";
+var PART_FOR_DATASET = {
+  blocks: "block",
+  transactions: "transactions",
+  events: "events"
+};
+async function localPerHeightDigests(db, fromBlock, toBlock, datasets = ["blocks", "transactions", "events"]) {
+  const accumulator = new PerHeightDigestAccumulator;
+  for await (const { height, digest } of streamHeightDigests(db, "blocks", fromBlock, toBlock)) {
+    accumulator.setBlockDigest(height, digest);
+  }
+  if (datasets.includes("transactions")) {
+    for await (const { height, digest } of streamHeightDigests(db, "transactions", fromBlock, toBlock)) {
+      accumulator.appendTransactionDigest(height, digest);
+    }
+  }
+  if (datasets.includes("events")) {
+    for await (const { height, digest } of streamHeightDigests(db, "events", fromBlock, toBlock)) {
+      accumulator.appendEventDigest(height, digest);
+    }
+  }
+  const rows = new Map;
+  for (const row of accumulator.drain(fromBlock, toBlock)) {
+    rows.set(row.height, row);
+  }
+  return rows;
+}
+function sidecarsCovering(digestIndex, fromBlock, toBlock) {
+  return (digestIndex ?? []).filter((p) => p.from_block <= toBlock && p.to_block >= fromBlock);
+}
+async function fetchSidecarRows(reference, partition) {
+  const bytes = await fetchVerifiedPartition(reference, partition);
+  const rows = [];
+  for await (const raw of readPartitionRows(bytes, `digests-${partition.from_block}-${partition.to_block}`)) {
+    const row = raw;
+    rows.push({
+      height: Number(row.height),
+      block_digest: String(row.block_digest),
+      transactions_rollup: row.transactions_rollup == null ? null : String(row.transactions_rollup),
+      events_rollup: row.events_rollup == null ? null : String(row.events_rollup)
+    });
+  }
+  return rows;
+}
+function compareHeights(params) {
+  const { dataset, fromBlock, toBlock, local, archive, covered } = params;
+  const inCoverage = (h) => covered.some((c) => h >= c.from_block && h <= c.to_block);
+  const heights = new Set;
+  for (const h of archive.keys())
+    heights.add(h);
+  for (const h of local.keys())
+    if (inCoverage(h))
+      heights.add(h);
+  const out = [];
+  for (const height of [...heights].sort((a, b) => a - b)) {
+    if (height < fromBlock || height > toBlock)
+      continue;
+    const mine = local.get(height);
+    const theirs = archive.get(height);
+    if (!mine && theirs) {
+      out.push({ height, parts: ["missing-local"] });
+    } else if (mine && !theirs) {
+      out.push({ height, parts: ["missing-archive"] });
+    } else if (mine && theirs && !partsMatch(dataset, mine, theirs)) {
+      out.push({ height, parts: [PART_FOR_DATASET[dataset]] });
+    }
+  }
+  return out;
+}
+function partsMatch(dataset, a, b) {
+  if (dataset === "blocks")
+    return a.block_digest === b.block_digest;
+  if (dataset === "transactions") {
+    return a.transactions_rollup === b.transactions_rollup;
+  }
+  return a.events_rollup === b.events_rollup;
+}
+async function divergentHeightsForRange(params) {
+  const { db, reference, dataset, fromBlock, toBlock } = params;
+  const sidecars = sidecarsCovering(params.digestIndex, fromBlock, toBlock);
+  if (sidecars.length === 0)
+    return null;
+  const archive = new Map;
+  for (const sidecar of sidecars) {
+    for (const row of await fetchSidecarRows(reference, sidecar)) {
+      archive.set(row.height, row);
+    }
+  }
+  const local = await localPerHeightDigests(db, fromBlock, toBlock, [dataset]);
+  return compareHeights({
+    dataset,
+    fromBlock,
+    toBlock,
+    local,
+    archive,
+    covered: sidecars
+  });
+}
+function mergeRepairRanges(ranges) {
+  const sorted = [...ranges].sort((a, b) => a.from_block - b.from_block || a.to_block - b.to_block);
+  const merged = [];
+  for (const range of sorted) {
+    const last = merged[merged.length - 1];
+    if (last && range.from_block <= last.to_block + 1) {
+      last.to_block = Math.max(last.to_block, range.to_block);
+    } else {
+      merged.push({ from_block: range.from_block, to_block: range.to_block });
+    }
+  }
+  return merged;
+}
+
+// src/commands/verify.ts
 init_output();
 init_resolve_auth();
 
@@ -204559,6 +204698,7 @@ function parseHeight3(value, flag) {
   }
   return parsed;
 }
+var MAX_HEIGHTS_SHOWN = 20;
 function statusLabel(status) {
   if (status === "match")
     return green("ok");
@@ -204597,9 +204737,10 @@ Exit codes:
         envPem: process.env.ARCHIVE_SIGNING_PUBLIC_KEY ?? process.env.STREAMS_SIGNING_PUBLIC_KEY,
         allowHostedApi: !isOssMode()
       });
-      const { manifest, origin } = await loadReference(opts.against, {
+      const loaded = await loadReference(opts.against, {
         publicKeyPem: publicKey
       });
+      const { manifest, origin } = loaded;
       const signature = checkSignature(manifest, publicKey, !!opts.insecure);
       if (!signature.verified && !opts.insecure) {
         printError(`Cannot trust the reference: ${signature.reason}.`, {
@@ -204732,6 +204873,30 @@ Exit codes:
         }))
       ];
       const diverged = all.filter((c) => c.status !== "match");
+      const digestIndex = manifest.digest_index;
+      const heightNotes = [];
+      if (diverged.length > 0 && !digestIndex?.length) {
+        heightNotes.push("This snapshot has no per-height digests; exact diverging heights need a newer snapshot.");
+      } else {
+        for (const range of diverged) {
+          try {
+            const heights = await divergentHeightsForRange({
+              db,
+              reference: loaded,
+              digestIndex,
+              dataset: range.dataset,
+              fromBlock: range.from_block,
+              toBlock: range.to_block
+            });
+            if (heights)
+              range.divergent_heights = heights;
+            else
+              heightNotes.push(`No per-height digests cover ${range.from_block}-${range.to_block}.`);
+          } catch (err) {
+            heightNotes.push(`Could not narrow ${range.from_block}-${range.to_block} to heights: ${err instanceof Error ? err.message : String(err)}`);
+          }
+        }
+      }
       const verdict = reportVerify({
         target,
         mode,
@@ -204744,7 +204909,8 @@ Exit codes:
         signature_verified: signature.verified,
         ranges_checked: all.length,
         semantic_checks: semanticChecks.length,
-        divergent_ranges: diverged
+        divergent_ranges: diverged,
+        ...heightNotes.length > 0 ? { note: heightNotes.join(" ") } : {}
       };
       output({
         json: opts.json,
@@ -204764,11 +204930,28 @@ Exit codes:
             String(d.expected_rows),
             String(d.actual_rows)
           ])));
+          for (const range of diverged) {
+            const heights = range.divergent_heights;
+            if (!heights)
+              continue;
+            console.error("");
+            console.error(`${range.from_block}-${range.to_block} ${range.dataset}: ${heights.length} diverging height${heights.length === 1 ? "" : "s"}`);
+            for (const h of heights.slice(0, MAX_HEIGHTS_SHOWN)) {
+              console.error(`  ${h.height}  ${h.parts.join(", ")}`);
+            }
+            if (heights.length > MAX_HEIGHTS_SHOWN) {
+              console.error(dim(`  and ${heights.length - MAX_HEIGHTS_SHOWN} more (see --json)`));
+            }
+          }
+          if (heightNotes.length > 0) {
+            console.error("");
+            for (const line of heightNotes)
+              console.error(dim(`  ${line}`));
+          }
           console.error("");
           console.error(dim("These ranges hold different data than the signed archive. Repair with:"));
-          const first = diverged[0];
-          if (first) {
-            console.error(dim(`  secondlayer repair --from-block ${first.from_block} --to-block ${first.to_block}`));
+          for (const range of mergeRepairRanges(diverged)) {
+            console.error(dim(`  secondlayer repair --from-block ${range.from_block} --to-block ${range.to_block}`));
           }
         }
       });
@@ -207861,12 +208044,24 @@ async function runTokenLogin() {
   }, target);
   success(`Logged in as ${account.email} (${target})`);
 }
-async function shouldContinueLogin(target, options) {
+var defaultLoginCheckDeps = {
+  readSession,
+  verify: (target, token) => httpAt(target, "/api/accounts/me", { bearer: token })
+};
+async function shouldContinueLogin(target, options, deps = defaultLoginCheckDeps) {
   if (options.force)
     return true;
-  const existing = await readSession(target);
+  const existing = await deps.readSession(target);
   if (!existing)
     return true;
+  try {
+    await deps.verify(target, existing.token);
+  } catch (err) {
+    if (err instanceof CliHttpError && (err.status === 401 || err.status === 403)) {
+      info(`Your saved login for ${existing.email} stopped working (revoked or expired). Signing in again.`);
+      return true;
+    }
+  }
   info(`Already logged in as ${existing.email} (${target}).`);
   const hint = "Run 'secondlayer logout' first, or re-run with --force to switch accounts.";
   if (!process.stdin.isTTY) {
@@ -207936,10 +208131,10 @@ async function runDeviceLogin(options = {}) {
     error(err instanceof Error ? err.message : String(err));
     process.exit(1);
   }
-  info(`First copy your one-time code: ${start.userCode}`);
+  info(`Your one-time code: ${start.userCode}`);
   const readline = process.stdin.isTTY ? createInterface({ input: process.stdin }) : null;
   if (readline) {
-    info("Press Enter to open secondlayer.tools in your browser...");
+    info("Press Enter to open the sign-in page, then check the code matches.");
     readline.once("line", () => openBrowser(start.verificationUrl));
   }
   info(dim(`Or open ${start.verificationUrl}`));
@@ -208659,5 +208854,5 @@ registerCreditsCommand(program);
 registerArchiveCommand(program);
 program.parse();
 
-//# debugId=32DC3B7BA2B6602D64756E2164756E21
+//# debugId=32F86A2D9F7E084964756E2164756E21
 //# sourceMappingURL=cli.js.map