@secondlayer/cli 23.2.0 → 23.3.0

package/dist/cli.js

@@ -2360,7 +2360,7 @@ function ignoredEnvKeyNote(ignored) {
   return ignored ? " INSTANCE_TOKEN was ignored: it unlocks this instance, not your account." : "";
 }
 async function httpArchiveOps(path, opts = {}) {
-  const { bearer, ignoredEnvKey } = await resolveArchiveOpsBearer();
+  const { bearer, source, ignoredEnvKey } = await resolveArchiveOpsBearer();
   if (!bearer) {
     throw new CliHttpError(401, "SESSION_EXPIRED", { error: "Not logged in" }, `This needs your Secondlayer account. ${ARCHIVE_AUTH_HINT}${ignoredEnvKeyNote(ignoredEnvKey)}`);
   }
@@ -2371,7 +2371,8 @@ async function httpArchiveOps(path, opts = {}) {
     });
   } catch (err) {
     if (err instanceof CliHttpError && err.status === 401) {
-      throw new CliHttpError(401, err.code, err.body, `Your account rejected the credential (${err.message}). ${ARCHIVE_AUTH_HINT}${ignoredEnvKeyNote(ignoredEnvKey)}`);
+      const remedy = source === "session" ? `Your saved login was rejected (${err.message}). Run \`secondlayer login\`, or \`secondlayer logout\` to use SECONDLAYER_API_KEY.` : `Your account rejected the credential (${err.message}). ${ARCHIVE_AUTH_HINT}${ignoredEnvKeyNote(ignoredEnvKey)}`;
+      throw new CliHttpError(401, err.code, err.body, remedy);
     }
     throw err;
   }
@@ -31891,7 +31892,7 @@ var {
 // package.json
 var package_default = {
   name: "@secondlayer/cli",
-  version: "23.2.0",
+  version: "23.3.0",
   description: "Run a Stacks index on your own hardware — set it up, restore verified history, and keep it current.",
   repository: {
     type: "git",
@@ -31917,7 +31918,7 @@ var package_default = {
     build: "bunup",
     dev: "bunup --watch",
     test: "bun test",
-    typecheck: "tsc --noEmit",
+    typecheck: "bun check",
     prepublishOnly: "bun run build"
   },
   keywords: [
@@ -31941,7 +31942,7 @@ var package_default = {
     "@secondlayer/bundler": "^0.7.3",
     "@secondlayer/scaffold": "^1.6.3",
     "@secondlayer/sdk": "^16.2.0",
-    "@secondlayer/shared": "^15.0.0",
+    "@secondlayer/shared": "^15.0.1",
     "@secondlayer/stacks": "^6.5.3",
     "@secondlayer/subgraphs": "^8.0.1",
     "@secondlayer/verify": "^0.6.1",
@@ -35610,14 +35611,14 @@ import { dirname as dirname7, join as join10 } from "node:path";
 var DEFAULT_IMAGE_OWNER = "ryanwaits";
 var DEFAULT_IMAGE_TAG = "latest";
 var DEV_INSTANCE_TOKEN = "dev-instance-token";
+var DEV_WEBHOOK_SIGNING_KEY = "-----BEGIN PRIVATE KEY-----\\nMC4CAQAwBQYDK2VwBCIEIIczaKV9CBblFKXjqGwrA3A1FOJxY2HiST7++XGea/jX\\n-----END PRIVATE KEY-----";
 function buildDevnetCompose(opts = {}) {
   const owner = opts.owner ?? DEFAULT_IMAGE_OWNER;
   const tag = opts.imageTag ?? DEFAULT_IMAGE_TAG;
   const apiPort = opts.apiPort ?? 3800;
   const indexerPort = opts.indexerPort ?? 3700;
   const apiPublish = `127.0.0.1:${apiPort}`;
-  const apiImage = `ghcr.io/${owner}/secondlayer-api:${tag}`;
-  const indexerImage = `ghcr.io/${owner}/secondlayer-indexer:${tag}`;
+  const runtimeImage = `ghcr.io/${owner}/secondlayer-runtime:${tag}`;
   const dbUrl = "postgres://secondlayer:secondlayer@postgres:5432/secondlayer";
   const DEV_SECRETS_KEY = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef";
   return `# Generated by \`secondlayer devnet connect\` — do not edit by hand.
@@ -35640,22 +35641,24 @@ services:
       retries: 10
     restart: unless-stopped
 
-  migrate:
-    image: ${apiImage}
-    command: ["bun", "run", "packages/shared/src/db/migrate.ts"]
-    environment:
-      DATABASE_URL: ${dbUrl}
-    depends_on:
-      postgres:
-        condition: service_healthy
-    restart: "no"
-
-  api:
-    image: ${apiImage}
+  secondlayer:
+    image: ${runtimeImage}
     environment:
       INSTANCE_MODE: oss
+      # Keep every network key aligned: the indexer writes index_progress under
+      # STACKS_NETWORK, the subgraph processor reads it under NETWORK. If they
+      # differ, catch-up finds no progress row and subgraphs never advance.
+      NETWORKS: testnet
+      STACKS_NETWORK: testnet
+      NETWORK: testnet
+      NODE_MODE: external
+      # A devnet index is tiny; the runtime's RAM/disk floors target real
+      # networks and a laptop's Docker VM often has less than 80 GB free.
+      SECONDLAYER_ALLOW_UNDERSIZED: "true"
       DATABASE_URL: ${dbUrl}
-      PORT: 3800
+      DATA_DIR: /data
+      API_PORT: "3800"
+      INDEXER_PORT: "3700"
       # 0.0.0.0 is forced: a container process that binds loopback is
       # unreachable through a published port. The real reach is the publish
       # spec below, handed over verbatim so /v1 reads stay keyless on devnet.
@@ -35664,93 +35667,48 @@ services:
       # Boot guard reads LISTEN_HOST, so a token is required to start at all.
       # It gates writes only — reads are open on this loopback publish.
       INSTANCE_TOKEN: ${DEV_INSTANCE_TOKEN}
-      NODE_ENV: production
-      DATA_DIR: /data
-      # Shared across api + subgraph-processor so the secret the api encrypts
-      # (e.g. a webhook's signing secret) can be decrypted by the emitter.
-      # OSS auto-generates a per-process key when unset — that splits them.
-      # Local-dev fixed value; not a production secret.
+      # Fixed so the secret the api encrypts (e.g. a webhook's signing secret)
+      # can be decrypted by the emitter across restarts. Not a production secret.
       SECONDLAYER_SECRETS_KEY: ${DEV_SECRETS_KEY}
-    ports:
-      - "${apiPublish}:3800"
-    volumes:
-      - subgraphs_data:/data/subgraphs
-    depends_on:
-      migrate:
-        condition: service_completed_successfully
-      postgres:
-        condition: service_healthy
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:3800/health"]
-      interval: 10s
-      timeout: 3s
-      start_period: 10s
-      retries: 5
-    restart: unless-stopped
-
-  indexer:
-    image: ${indexerImage}
-    environment:
-      DATABASE_URL: ${dbUrl}
-      PORT: 3700
-      NODE_ENV: production
-      # Keep every network key aligned: the indexer writes index_progress under
-      # STACKS_NETWORK, the subgraph processor reads it under NETWORK. If they
-      # differ, catch-up finds no progress row and subgraphs never advance.
-      NETWORKS: testnet
-      STACKS_NETWORK: testnet
-      NETWORK: testnet
+      # Signed deliveries, so receivers can test verification. Publicly known.
+      SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY: "${DEV_WEBHOOK_SIGNING_KEY}"
+      # The emitter blocks webhook delivery to private/loopback IPs by default.
+      # On a local devnet you deliver to your own localhost receiver, so allow it.
+      SECONDLAYER_ALLOW_PRIVATE_EGRESS: "true"
+      # An OSS indexer with no index_progress spools observer blocks until an
+      # archive import finishes. A devnet has no archive, so ingest live.
+      INGEST_MODE: live
       # Fed by the devnet node's event observer — never reach out to Hiro mainnet.
       AUTO_BACKFILL_ENABLED: "false"
       TIP_FOLLOWER_ENABLED: "false"
-    # Deliberately published on every interface, unlike the api: the devnet's
-    # stacks-node runs in its own container and POSTs events to
-    # host.docker.internal:3700, which resolves to the host gateway address,
-    # not 127.0.0.1. A loopback publish here would drop every block.
+      # clarinet publishes the devnet node RPC on the host's 20443.
+      STACKS_NODE_RPC_URL: http://host.docker.internal:20443
+      STREAMS_API_URL: http://127.0.0.1:3800
+      SUBGRAPH_SOURCE: streams-index
+      SUBGRAPH_INDEX_API_URL: http://127.0.0.1:3800
+      NODE_ENV: production
+    # The api is loopback-only; the indexer is deliberately published on every
+    # interface: the devnet's stacks-node runs in its own container and POSTs
+    # events to host.docker.internal:3700, which resolves to the host gateway
+    # address, not 127.0.0.1. A loopback publish would drop every block.
     ports:
+      - "${apiPublish}:3800"
       - "${indexerPort}:3700"
     extra_hosts:
       - "host.docker.internal:host-gateway"
+    volumes:
+      - subgraphs_data:/data/subgraphs
     depends_on:
-      migrate:
-        condition: service_completed_successfully
       postgres:
         condition: service_healthy
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:3700/health"]
+      test: ["CMD", "curl", "-f", "http://localhost:3800/health"]
       interval: 10s
       timeout: 3s
-      start_period: 10s
+      start_period: 40s
       retries: 5
     restart: unless-stopped
 
-  subgraph-processor:
-    image: ${apiImage}
-    command: ["bun", "run", "packages/subgraphs/src/service.ts"]
-    environment:
-      DATABASE_URL: ${dbUrl}
-      NODE_ENV: production
-      DATA_DIR: /data
-      # Must match the indexer's network key (see indexer note) — catch-up reads
-      # index_progress under NETWORK.
-      NETWORK: testnet
-      STACKS_NETWORK: testnet
-      # The emitter blocks webhook delivery to private/loopback IPs by default.
-      # On a local devnet you deliver to your own localhost receiver, so allow it.
-      SECONDLAYER_ALLOW_PRIVATE_EGRESS: "true"
-      # Must match the api's key so the emitter can decrypt signing secrets.
-      SECONDLAYER_SECRETS_KEY: ${DEV_SECRETS_KEY}
-    volumes:
-      - subgraphs_data:/data/subgraphs
-    depends_on:
-      migrate:
-        condition: service_completed_successfully
-      postgres:
-        condition: service_healthy
-    healthcheck:
-      disable: true
-    restart: unless-stopped
-
 volumes:
   postgres_data:
   subgraphs_data:
@@ -35965,13 +35923,7 @@ function dockerCompose(composePath, args) {
 }
 var API_URL = (process.env.SECONDLAYER_API_URL || LOCAL_API_URL).replace(/\/+$/, "");
 var INDEXER_URL = process.env.INDEXER_URL ?? "http://localhost:3700";
-var SERVICES = [
-  "indexer",
-  "api",
-  "subgraph-processor",
-  "postgres",
-  "migrate"
-];
+var SERVICES = ["secondlayer", "postgres"];
 function registerDevnetCommand(program) {
   const devnet = program.command("devnet").description("Run Secondlayer services against a local Clarinet devnet");
   registerFaucetCommand(devnet);
@@ -35984,7 +35936,7 @@ function registerDevnetCommand(program) {
   devnet.command("status").description("Snapshot of the local stack: ingest, subgraphs, and recent activity").option("-w, --watch", "Refresh every 2s until Ctrl-C").option("--limit <n>", "Recent activity rows to show", "12").action(async (options) => {
     await status(options);
   });
-  devnet.command("logs [service]").description("Tail stack logs — all services, or one of: indexer, api, subgraph-processor, postgres").option("--project <dir>", "Clarinet project directory").option("-f, --follow", "Follow log output").option("-n, --lines <n>", "Lines to show from the end of each log").action(async (service, options) => {
+  devnet.command("logs [service]").description("Tail stack logs — all services, or one of: secondlayer, postgres").option("--project <dir>", "Clarinet project directory").option("-f, --follow", "Follow log output").option("-n, --lines <n>", "Lines to show from the end of each log").action(async (service, options) => {
     await logs(service, options);
   });
 }
@@ -36028,6 +35980,11 @@ Skipped docker. Start it with:
   }
   ensureDocker();
   console.log(dim(`
+Pulling latest images…`));
+  if (dockerCompose(composePath, ["pull"]) !== 0) {
+    console.log(yellow("couldn't pull the latest images — starting with what's cached"));
+  }
+  console.log(dim(`
 Starting Secondlayer stack (docker compose up -d)…`));
   if (dockerCompose(composePath, ["up", "-d"]) !== 0) {
     error("docker compose up failed — see output above.");
@@ -36104,7 +36061,7 @@ var SYS_COLS = new Set([
   "tx_id"
 ]);
 function shortVal(v) {
-  const s = String(v);
+  const s = typeof v === "object" && v !== null ? JSON.stringify(v) : String(v);
   return s.length > 18 ? `${s.slice(0, 6)}…${s.slice(-4)}` : s;
 }
 async function renderStatus(limit) {
@@ -37780,5 +37737,5 @@ registerCreditsCommand(program);
 registerArchiveCommand(program);
 program.parse();
 
-//# debugId=E3E81976D75D13F864756E2164756E21
+//# debugId=599D8A8ADF6556BF64756E2164756E21
 //# sourceMappingURL=cli.js.map