@secondlayer/cli 23.0.0 → 23.2.0

package/README.md

@@ -12,7 +12,7 @@ secondlayer --version
 
 ## Auth
 
-Default API is `http://127.0.0.1:3800`. Override with `SECONDLAYER_API_URL`.
+Default API is `http://127.0.0.1:3800`, or the hosted API when only `SECONDLAYER_API_KEY` is set. Override with `SECONDLAYER_API_URL`.
 
 Writes against a published bind use `INSTANCE_TOKEN` from `secondlayer init`.
 Loopback reads need no token. Your hosted account (credits, archive fetches)
@@ -191,7 +191,7 @@ or poll the subgraph API: see
 |---|---|
 | `INSTANCE_TOKEN` | From `secondlayer init` for writes. Loopback reads need no token |
 | `SECONDLAYER_API_KEY` | Hosted account key (`sk-sl_*`) |
-| `SECONDLAYER_API_URL` | Instance API. Default `http://127.0.0.1:3800` |
+| `SECONDLAYER_API_URL` | API URL. Default `http://127.0.0.1:3800`, or hosted with only `SECONDLAYER_API_KEY` set |
 | `STACKS_NETWORK` | Default network (also via `--network <mainnet\|testnet\|devnet>`) |
 | `DATABASE_URL` | Postgres that `bootstrap`, `verify`, `repair`, and `backup` connect to. Point it at the compose Postgres (`postgres://secondlayer:<POSTGRES_PASSWORD>@127.0.0.1:5432/secondlayer`); unset, the shared dev URL `postgres://postgres:postgres@localhost:5432/secondlayer_dev` is used |
 | `HIRO_API_KEY` | Used by `secondlayer codegen contracts` for remote contract fetches |

package/dist/cli.js

@@ -2129,9 +2129,9 @@ Expecting one of '${allowedValues.join("', '")}'`);
 });
 
 // src/lib/api-url.ts
-import { isHostedApiUrl } from "@secondlayer/sdk";
+import { isHostedApiUrl, resolveBaseUrl } from "@secondlayer/sdk";
 function resolveApiUrl() {
-  return (process.env.SECONDLAYER_API_URL ?? LOCAL_API_URL).replace(/\/+$/, "");
+  return resolveBaseUrl();
 }
 function resolveArchiveOpsUrl() {
   return (process.env.SL_CREDITS_API_URL ?? ARCHIVE_OPS_API_URL).replace(/\/+$/, "");
@@ -2142,8 +2142,9 @@ function isMerchantUrl(url = resolveApiUrl()) {
 function assertInstanceUrl(url = resolveApiUrl()) {
   if (!isMerchantUrl(url))
     return;
+  const fix = process.env.SECONDLAYER_API_URL ? "unset SECONDLAYER_API_URL" : "set INSTANCE_TOKEN";
   throw new Error(`this command runs on your instance, not api.secondlayer.tools.
-unset SECONDLAYER_API_URL, or pass --api-url http://127.0.0.1:3800`);
+${fix}, or pass --api-url http://127.0.0.1:3800`);
 }
 var LOCAL_API_URL = "http://127.0.0.1:3800", ARCHIVE_OPS_API_URL = "https://api.secondlayer.tools";
 var init_api_url = () => {};
@@ -2539,9 +2540,11 @@ var init_output = __esm(() => {
 
 // src/lib/api-client.ts
 import { ApiError, SecondLayer } from "@secondlayer/sdk";
-function nextStepHint(status, detail) {
+function nextStepHint(status, detail, code) {
   if (status === undefined)
     return;
+  if (code === "STACK_ASLEEP")
+    return "Any write starts it, such as creating or updating a webhook.";
   if (status === 402)
     return detail === "spend_cap_reached" ? `You reached your monthly spend cap. Raise it: ${CREDITS_URL}` : `Add credits to create webhooks and deploy subgraphs: ${CREDITS_URL}`;
   if (status === 403)
@@ -2581,7 +2584,7 @@ function handleApiError(err, action) {
   }
   const detail = err instanceof Error ? err.message : String(err);
   printError(`Failed to ${action}: ${detail}`, {
-    hint: nextStepHint(status, detail)
+    hint: nextStepHint(status, detail, code)
   });
   process.exit(1);
 }
@@ -29542,7 +29545,7 @@ export default defineSubgraph({
 import { createHash as createHash4 } from "node:crypto";
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname4, resolve as resolve3 } from "node:path";
-import { Index, resolveApiKey as resolveApiKey3, resolveBaseUrl } from "@secondlayer/sdk";
+import { Index, resolveApiKey as resolveApiKey3, resolveBaseUrl as resolveBaseUrl2 } from "@secondlayer/sdk";
 import {
   DECODED_EVENT_TYPES,
   VM_EVENT_TYPES
@@ -29591,7 +29594,7 @@ function eventTypeFor(filter) {
   return null;
 }
 function indexApiUrl() {
-  return resolveBaseUrl();
+  return resolveBaseUrl2();
 }
 function indexReadFailure(err, ctx) {
   const e = err;
@@ -29808,7 +29811,7 @@ import { existsSync as existsSync3 } from "node:fs";
 import { resolve as resolve4 } from "node:path";
 import {
   Index as Index2,
-  resolveBaseUrl as resolveBaseUrl2
+  resolveBaseUrl as resolveBaseUrl3
 } from "@secondlayer/sdk";
 import {
   DECODED_EVENT_TYPES as DECODED_EVENT_TYPES2
@@ -29903,7 +29906,7 @@ async function runSubgraphPreview(file, options) {
           source: name,
           fromHeight,
           toHeight,
-          apiUrl: resolveBaseUrl2(),
+          apiUrl: resolveBaseUrl3(),
           file
         });
         printError(failure.message, { hint: failure.hint });
@@ -29934,7 +29937,7 @@ async function runSubgraphPreview(file, options) {
         source: name,
         fromHeight,
         toHeight,
-        apiUrl: resolveBaseUrl2(),
+        apiUrl: resolveBaseUrl3(),
         file
       });
       printError(failure.message, { hint: failure.hint });
@@ -31507,7 +31510,7 @@ function client() {
     apiKey: resolveDataPlaneKey()
   });
 }
-function fail(action, err) {
+function fail2(action, err) {
   const message = err instanceof Error ? err.message : String(err);
   error(`Failed to ${action}: ${message}`);
   if (/\b403\b/.test(message) || /forbidden/i.test(message)) {
@@ -31598,7 +31601,7 @@ function registerIndexCommand(program) {
         recipient: o.recipient
       }), o.json);
     } catch (err) {
-      fail("list ft transfers", err);
+      fail2("list ft transfers", err);
     }
   });
   orderFlag(rangeFlags(index.command("nft-transfers"))).description("List decoded SIP-009 non-fungible-token transfers").option("--sender <principal>", "Filter by sender").option("--recipient <principal>", "Filter by recipient").option("--asset-identifier <id>", "Filter by asset identifier").action(async (o) => {
@@ -31611,7 +31614,7 @@ function registerIndexCommand(program) {
         assetIdentifier: o.assetIdentifier
       }), o.json);
     } catch (err) {
-      fail("list nft transfers", err);
+      fail2("list nft transfers", err);
     }
   });
   orderFlag(rangeFlags(index.command("events"))).description("List decoded events by type (stx_*, ft/nft mint/burn, print, …)").option("--event-type <type>", `decoded event type (${VALID_INDEX_TYPES.join(", ")})`).option("--types <type>", "alias for --event-type, ONE value (the Streams spelling)").option("--sender <principal>", "Filter by sender").option("--recipient <principal>", "Filter by recipient").option("--asset-identifier <id>", "Filter by asset identifier").action(async (o) => {
@@ -31625,7 +31628,7 @@ function registerIndexCommand(program) {
         assetIdentifier: o.assetIdentifier
       }), o.json);
     } catch (err) {
-      fail("list events", err);
+      fail2("list events", err);
     }
   });
   rangeFlags(index.command("contract-calls")).description("List decoded contract calls (function, args, result)").option("--function-name <name>", "Filter by called function").option("--sender <principal>", "Filter by caller").action(async (o) => {
@@ -31636,21 +31639,21 @@ function registerIndexCommand(program) {
         sender: o.sender
       }), o.json);
     } catch (err) {
-      fail("list contract calls", err);
+      fail2("list contract calls", err);
     }
   });
   heightFlags(index.command("canonical")).description("List the canonical Stacks block sequence (height + hash)").action(async (o) => {
     try {
       emit(await client().canonical.list(heightParams(o)), o.json);
     } catch (err) {
-      fail("list canonical blocks", err);
+      fail2("list canonical blocks", err);
     }
   });
   const blocks = heightFlags(index.command("blocks")).description("List decoded blocks (run `blocks get <ref>` for one block)").action(async (o) => {
     try {
       emit(await client().blocks.list(heightParams(o)), o.json);
     } catch (err) {
-      fail("list blocks", err);
+      fail2("list blocks", err);
     }
   });
   blocks.command("get <ref>").description("Get a single block by height or block hash").option("--json", "Print as JSON").action(async (ref, o) => {
@@ -31658,7 +31661,7 @@ function registerIndexCommand(program) {
       const block = await client().blocks.get(/^\d+$/.test(ref) ? Number.parseInt(ref, 10) : ref);
       emitOne(block, `block ${ref}`, o.json);
     } catch (err) {
-      fail("get block", err);
+      fail2("get block", err);
     }
   });
   const transactions = rangeFlags(index.command("transactions")).description("List decoded transactions (run `transactions get <txId>` for one)").option("--type <type>", "Filter by transaction type").option("--sender <principal>", "Filter by sender").action(async (o) => {
@@ -31669,14 +31672,14 @@ function registerIndexCommand(program) {
         sender: o.sender
       }), o.json);
     } catch (err) {
-      fail("list transactions", err);
+      fail2("list transactions", err);
     }
   });
   transactions.command("get <txId>").description("Get a single transaction by tx_id").option("--json", "Print as JSON").action(async (txId, o) => {
     try {
       emitOne(await client().transactions.get(txId), `tx ${txId}`, o.json);
     } catch (err) {
-      fail("get transaction", err);
+      fail2("get transaction", err);
     }
   });
   heightFlags(index.command("stacking")).description("List decoded PoX-4 stacking actions").option("--function-name <name>", "Filter by PoX function name").option("--stacker <principal>", "Filter by stacker").option("--caller <principal>", "Filter by caller").action(async (o) => {
@@ -31688,7 +31691,7 @@ function registerIndexCommand(program) {
         caller: o.caller
       }), o.json);
     } catch (err) {
-      fail("list stacking actions", err);
+      fail2("list stacking actions", err);
     }
   });
   const mempool = index.command("mempool").description("List pending mempool transactions (run `mempool get <txId>` for one)").option("--contract-id <id>", "Filter to pending calls to a contract").option("--function-name <name>", "Filter to pending calls to a function").option("--sender <principal>", "Filter by sender").option("--type <type>", "Filter by transaction type").option("--cursor <cursor>", "Resume token from a previous next_cursor").option("--limit <n>", "Rows per page").option("--json", "Print the full envelope as JSON").action(async (o) => {
@@ -31702,14 +31705,14 @@ function registerIndexCommand(program) {
         limit: o.limit ? Number.parseInt(o.limit, 10) : undefined
       }), o.json);
     } catch (err) {
-      fail("list mempool", err);
+      fail2("list mempool", err);
     }
   });
   mempool.command("get <txId>").description("Get a single pending transaction by tx_id (404 once mined)").option("--json", "Print as JSON").action(async (txId, o) => {
     try {
       emitOne(await client().mempool.get(txId), `pending tx ${txId}`, o.json);
     } catch (err) {
-      fail("get mempool tx", err);
+      fail2("get mempool tx", err);
     }
   });
   const runes = index.command("runes").description("List etched runes (Bitcoin; run `runes get <rune>` for one)").option("--search <prefix>", "Name prefix, spacers and case ignored").option("--sort <order>", "number (etch order) or mints (busiest first)").option("--cursor <cursor>", "Resume token from a previous next_cursor").option("--limit <n>", "Rows per page").option("--json", "Print the full envelope as JSON").action(async (o) => {
@@ -31721,7 +31724,7 @@ function registerIndexCommand(program) {
         limit: o.limit ? Number.parseInt(o.limit, 10) : undefined
       }), o.json);
     } catch (err) {
-      fail("list runes", err);
+      fail2("list runes", err);
     }
   });
   runes.command("get <rune>").description("Get one rune by id (840000:3) or name, any spacing or case").option("--json", "Print as JSON").action(async (rune, _o, cmd) => {
@@ -31729,7 +31732,7 @@ function registerIndexCommand(program) {
     try {
       emitOne(await client().runes.get(rune), `rune ${rune}`, o.json);
     } catch (err) {
-      fail("get rune", err);
+      fail2("get rune", err);
     }
   });
   runes.command("balances").description("Current rune balances by address or outpoint (Bitcoin)").option("--address <address>", "Bitcoin address").option("--outpoint <txid:vout>", "Unspent output").option("--rune <ref>", "Narrow to one rune (id or name)").option("--cursor <cursor>", "Resume token from a previous next_cursor").option("--limit <n>", "Rows per page").option("--json", "Print the full envelope as JSON").action(async (_o, cmd) => {
@@ -31742,7 +31745,7 @@ function registerIndexCommand(program) {
         limit: o.limit ? Number.parseInt(o.limit, 10) : undefined
       }), o.json);
     } catch (err) {
-      fail("list rune balances", err);
+      fail2("list rune balances", err);
     }
   });
   runes.command("activity").description("List rune etches, mints, transfers and burns (Bitcoin)").option("--rune <ref>", "Filter by rune (id or name)").option("--address <address>", "Filter by Bitcoin address").option("--kind <kinds>", `Comma list of ${RUNE_KINDS.join(", ")}`).option("--txid <txid>", "Filter by Bitcoin transaction id").option("--from-height <n>", "Start Bitcoin block height (inclusive)").option("--to-height <n>", "End Bitcoin block height (inclusive)").option("--cursor <cursor>", "Resume token from a previous next_cursor").option("--limit <n>", "Rows per page").option("--json", "Print the full envelope as JSON").action(async (_o, cmd) => {
@@ -31756,7 +31759,7 @@ function registerIndexCommand(program) {
         txid: o.txid
       }), o.json);
     } catch (err) {
-      fail("list rune activity", err);
+      fail2("list rune activity", err);
     }
   });
 }
@@ -31888,7 +31891,7 @@ var {
 // package.json
 var package_default = {
   name: "@secondlayer/cli",
-  version: "23.0.0",
+  version: "23.2.0",
   description: "Run a Stacks index on your own hardware — set it up, restore verified history, and keep it current.",
   repository: {
     type: "git",
@@ -31937,7 +31940,7 @@ var package_default = {
     "@inquirer/prompts": "^8.2.0",
     "@secondlayer/bundler": "^0.7.3",
     "@secondlayer/scaffold": "^1.6.3",
-    "@secondlayer/sdk": "^16.0.0",
+    "@secondlayer/sdk": "^16.2.0",
     "@secondlayer/shared": "^15.0.0",
     "@secondlayer/stacks": "^6.5.3",
     "@secondlayer/subgraphs": "^8.0.1",
@@ -34546,6 +34549,144 @@ async function runRefill(opts) {
     }
   });
 }
+// src/commands/keys.ts
+init_http();
+init_output();
+init_session();
+import { resolveAccountKey as resolveAccountKey4 } from "@secondlayer/sdk";
+var MIN_ID_REF_LENGTH = 8;
+function rotatableKeys(keys) {
+  return keys.filter((k) => k.status === "active" && k.product === "account");
+}
+function describeKey(key) {
+  return `${key.id.slice(0, 8)} ${key.name ?? "(unnamed)"}`;
+}
+function resolveKeyRef(keys, ref) {
+  const candidates = rotatableKeys(keys);
+  const barePrefix = ref.replace(/…$/, "");
+  const kinds = [
+    (k) => k.id === ref || ref.length >= MIN_ID_REF_LENGTH && k.id.startsWith(ref),
+    (k) => k.prefix === barePrefix,
+    (k) => k.name === ref
+  ];
+  for (const matches of kinds) {
+    const found = candidates.filter(matches);
+    if (found.length === 1)
+      return found[0];
+    if (found.length > 1) {
+      throw new Error(`"${ref}" matches ${found.length} keys: ${found.map(describeKey).join(", ")}. Use an id.`);
+    }
+  }
+  throw new Error(`No active account key matches "${ref}". Run: secondlayer keys list`);
+}
+async function applyRotationToLogin(prefix, newKey, deps = {}) {
+  const apiUrl = deps.apiUrl ?? resolveArchiveOpsUrl();
+  const read = deps.readSession ?? readSession;
+  const write = deps.writeSession ?? writeSession;
+  const envKey = "envKey" in deps ? deps.envKey : resolveAccountKey4();
+  if (!prefix)
+    return { loginUpdated: false, envStale: false };
+  let loginUpdated = false;
+  const session = await read(apiUrl);
+  if (session?.token.startsWith(prefix)) {
+    await write({ ...session, token: newKey }, apiUrl);
+    loginUpdated = true;
+  }
+  return { loginUpdated, envStale: envKey?.startsWith(prefix) ?? false };
+}
+async function saveRotatedLogin(prefix, newKey, deps = {}) {
+  try {
+    return await applyRotationToLogin(prefix, newKey, deps);
+  } catch (err) {
+    const envKey = "envKey" in deps ? deps.envKey : resolveAccountKey4();
+    return {
+      loginUpdated: false,
+      envStale: Boolean(prefix) && (envKey?.startsWith(prefix) ?? false),
+      loginError: err instanceof Error ? err.message : String(err)
+    };
+  }
+}
+function fail(err) {
+  if (err instanceof Error) {
+    error(err.message);
+    process.exit(1);
+  }
+  throw err;
+}
+async function fetchKeys() {
+  const res = await httpArchiveOps("/api/keys");
+  return res.keys;
+}
+async function runList(opts) {
+  let keys;
+  try {
+    keys = rotatableKeys(await fetchKeys());
+  } catch (err) {
+    fail(err);
+  }
+  output({
+    json: opts.json,
+    data: {
+      keys: keys.map(({ rowsDaily: _rowsDaily, ...rest }) => rest)
+    },
+    human: () => {
+      if (keys.length === 0) {
+        note("No active account keys. Make one at https://www.secondlayer.tools/account/keys");
+        return;
+      }
+      console.log(formatTable(["ID", "NAME", "KEY", "LAST READ", "ROWS 30D"], keys.map((k) => [
+        k.id.slice(0, 8),
+        k.name ?? "(unnamed)",
+        `${k.prefix}…`,
+        k.lastUsedAt ?? "never",
+        k.rows30d.toLocaleString("en-US")
+      ])));
+    }
+  });
+}
+async function runRotate(ref, opts) {
+  let target;
+  try {
+    target = resolveKeyRef(await fetchKeys(), ref);
+  } catch (err) {
+    fail(err);
+  }
+  const label = target.name ?? "(unnamed)";
+  const ok = await confirmDestructive({
+    message: `Rotate "${label}" (${target.prefix}…)? Anything using it gets a 401 at once.`,
+    yes: opts.yes
+  });
+  if (!ok) {
+    info("Cancelled");
+    return;
+  }
+  let rotated;
+  try {
+    rotated = await httpArchiveOps(`/api/keys/${target.id}/rotate`, { method: "POST", body: {} });
+  } catch (err) {
+    fail(err);
+  }
+  const { loginUpdated, envStale, loginError } = await saveRotatedLogin(target.prefix, rotated.key);
+  if (opts.json) {
+    writeData(JSON.stringify({ ...rotated, loginUpdated }, null, 2));
+  } else {
+    success(`Rotated ${blue(label)}. The old key has stopped working.`);
+    writeData(rotated.key);
+    note("Shown once. Copy it now.");
+  }
+  if (loginError) {
+    warn(`Couldn't update your CLI login: ${loginError}. Run: secondlayer login --with-token`);
+  }
+  if (loginUpdated)
+    info("Updated your CLI login to the new key.");
+  if (envStale)
+    warn("SECONDLAYER_API_KEY still holds the old key. Update it.");
+}
+function registerKeysCommand(program) {
+  const keys = program.command("keys").description("Manage account keys");
+  keys.command("list").alias("ls").description("List your active account keys").option("--json", "Output as JSON").action((opts) => runList(opts));
+  keys.command("rotate <ref>").description("Replace a key's secret; the old one stops working at once").option("-y, --yes", "Skip confirmation").option("--json", "Output as JSON").action((ref, opts) => runRotate(ref, opts));
+}
 // src/commands/codegen.ts
 function registerCodegenCommand(program) {
   const codegen = program.command("codegen").description("Generate typed code: contracts, subgraphs, Index, clients");
@@ -35822,7 +35963,7 @@ function dockerCompose(composePath, args) {
   });
   return res.status ?? 1;
 }
-var API_URL = resolveApiUrl();
+var API_URL = (process.env.SECONDLAYER_API_URL || LOCAL_API_URL).replace(/\/+$/, "");
 var INDEXER_URL = process.env.INDEXER_URL ?? "http://localhost:3700";
 var SERVICES = [
   "indexer",
@@ -37615,6 +37756,7 @@ registerObserverCommand(program);
 registerLoginCommand(program);
 registerLogoutCommand(program);
 registerWhoamiCommand(program);
+registerKeysCommand(program);
 program.commandsGroup("Your data:");
 registerSubgraphsCommand(program);
 registerWebhooksCommand(program);
@@ -37638,5 +37780,5 @@ registerCreditsCommand(program);
 registerArchiveCommand(program);
 program.parse();
 
-//# debugId=4D42122E1253AE8B64756E2164756E21
+//# debugId=E3E81976D75D13F864756E2164756E21
 //# sourceMappingURL=cli.js.map