@secondlayer/sdk 10.2.0 → 10.3.0

package/README.md

@@ -15,7 +15,7 @@ import { SecondLayer } from "@secondlayer/sdk";
 
 const sl = new SecondLayer({
   apiKey: process.env.INSTANCE_TOKEN, // from secondlayer init; read from the env when omitted
-  // default baseUrl: http://127.0.0.1:3800  (or SL_API_URL)
+  // default baseUrl: http://127.0.0.1:3800  (or SECONDLAYER_API_URL)
 });
 ```
 
@@ -245,8 +245,9 @@ and bootstrap remain CLI.
 
 ```typescript
 const sl = new SecondLayer({
-  apiKey: process.env.SL_API_KEY, // account key sk-sl_* for quote/fetch/credits
+  accountKey: process.env.SECONDLAYER_API_KEY,
 });
+// SECONDLAYER_API_KEY is the hosted account key (sk-sl_*). It is not the instance token.
 
 const ref = await sl.archive.latest();
 const partitions = sl.archive.partitions(ref, { dataset: "blocks" });

package/dist/index.d.ts

@@ -6,8 +6,11 @@ type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<
 interface SecondLayerOptions {
 	/** Base URL of the instance API (trailing slashes are stripped). */
 	baseUrl: string;
-	/** Bearer token for authenticated requests. */
+	/** Bearer token for authenticated instance requests (`INSTANCE_TOKEN`). */
 	apiKey?: string;
+	/** Hosted account key (`sk-sl_*`). Env `SECONDLAYER_API_KEY`. Used by
+	*  `sl.archive` quote/fetch/credits, never by instance `/v1` or `/api`. */
+	accountKey?: string;
 	/** Fetch implementation. Tests and edge runtimes can provide their own. */
 	fetchImpl?: FetchLike;
 	/** Public base URL for Streams bulk parquet dumps (the cold backfill plane).
@@ -46,34 +49,23 @@ type RequestOptions = {
 	*  signal's reason, an `AbortError` by default, never an `ApiError`. */
 	signal?: AbortSignal;
 };
-/** Product default: the local one-box API. Override with `baseUrl` or `SL_API_URL`. */
+/** Product default: the local one-box API. Override with `baseUrl` or
+*  `SECONDLAYER_API_URL`. */
 declare const LOCAL_API_URL = "http://127.0.0.1:3800";
+/** Instance credential. `secondlayer init` writes this. */
+declare const INSTANCE_TOKEN_ENV = "INSTANCE_TOKEN";
+/** Hosted account key (`sk-sl_*`) for api.secondlayer.tools. */
+declare const ACCOUNT_KEY_ENV = "SECONDLAYER_API_KEY";
 declare function resolveBaseUrl(explicit?: string): string;
-/** Credential env vars, highest precedence first. `INSTANCE_TOKEN` is the
-*  canonical name — it is what `secondlayer init` writes into `.env.local` and
-*  what the instance API validates bearer tokens against. `SL_API_KEY` is a
-*  legacy alias, kept working so existing exports and CI secrets don't break. */
-declare const CREDENTIAL_ENV_VARS: readonly ["INSTANCE_TOKEN", "SL_API_KEY"];
-/** Resolve the credential a client should use. Precedence, highest first:
-*
-*   1. an explicit `apiKey` option — including an explicit `""`, which is how
-*      you opt a client back into keyless reads on a machine that has a key
-*      exported;
-*   2. `INSTANCE_TOKEN` — the canonical credential var, shared with the CLI
-*      and MCP server;
-*   3. `SL_API_KEY` — legacy alias for the same value.
-*
-*  Env values that are empty strings count as unset. Falling back to the env at
-*  all is what stops `new Index()` from silently running keyless and 402-ing on
-*  the first deep-history read.
-*
-*  When both env vars are set to *different* non-empty values there is no
-*  correct silent answer, so `INSTANCE_TOKEN` wins and we warn once on stderr —
-*  the whole point of this precedence is that a misconfigured credential should
-*  never authenticate as nobody without saying so.
-*
-*  Guarded for browsers and edge runtimes, where `process` is undefined. */
+/** Resolve the instance credential. Precedence: explicit `apiKey` (including
+*  `""` for keyless) → `INSTANCE_TOKEN`. Does not read the hosted account key
+*  env vars. Guarded for browsers and edge runtimes. */
 declare function resolveApiKey(apiKey?: string): string | undefined;
+/** Resolve the hosted account key for archive quote/fetch/credits.
+*  Precedence: explicit `accountKey` → `SECONDLAYER_API_KEY` → `SL_API_KEY` /
+*  `SL_ARCHIVE_API_KEY` (one-release warn-fallbacks). Does not read
+*  `INSTANCE_TOKEN`. */
+declare function resolveAccountKey(accountKey?: string): string | undefined;
 declare abstract class BaseClient {
 	protected baseUrl: string;
 	protected apiKey?: string;
@@ -2975,7 +2967,9 @@ declare function shutdownSignal(options?: {
 	signals?: readonly ("SIGTERM" | "SIGINT")[];
 }): AbortSignal;
 type CreateArchiveClientOptions = {
+	/** @deprecated Prefer `accountKey`. Kept one release as an alias. */
 	apiKey?: string;
+	accountKey?: string;
 	fetchImpl?: FetchLike;
 	archiveBaseUrl?: string;
 	archiveOpsUrl?: string;
@@ -3141,4 +3135,4 @@ declare function verifySecondlayerSignature(rawBody: string, headers: WebhookHea
 declare function decodeChainWebhook(rawBody: string): ChainWebhookDelivery;
 import { RewardSet as RewardSet2 } from "@secondlayer/shared/node/consensus";
 import { decodeClarityValue, toJsonSafe } from "@secondlayer/shared/streams-rows";
-export { verifyWebhookSignature, verifyTransactionProof, verify as verifyStandardWebhooksHeaders, verifySecondlayerSignature, trigger, toJsonSafe, shutdownSignal, resolveBaseUrl, resolveApiKey, parseRetryAfter, isStxTransfer, isStxMint, isStxLock, isStxBurn, isPrint, isNftTransfer, isNftMint, isNftBurn, isFtTransfer, isFtMint, isFtBurn, getSubgraph, fetchRewardSet, decodeStxTransfer, decodeStxMint, decodeStxLock, decodeStxBurn, decodePrint, decodeNftTransfer, decodeNftMint, decodeNftBurn, decodeFtTransfer, decodeFtMint, decodeFtBurn, decodeClarityValue, decodeChainWebhook, decode, createStreamsClient, createArchiveClient, contextField, consumerHealth, consumeIndexFeed, WithSinkTx, WebhookHeaderInput, WalkOptions, ValidationError, UpdateSubscriptionRequest2 as UpdateSubscriptionRequest, TransactionsWalkParams, TransactionsListParams, TransactionsEnvelope, TransactionProofVerifyResult, TransactionProof, TransactionEnvelope, Subscriptions, SubscriptionSummary2 as SubscriptionSummary, SubscriptionStatus, SubscriptionRuntime, SubscriptionKind, SubscriptionFormat, SubscriptionDetail2 as SubscriptionDetail, Subgraphs, SubgraphSpecOptions3 as SubgraphSpecOptions, SubgraphSpecFormat2 as SubgraphSpecFormat, SubgraphOperationStatus, SubgraphAgentSchema3 as SubgraphAgentSchema, StreamsTip, StreamsSubscription, StreamsSignatureError, StreamsServerError, StreamsReorgsListParams, StreamsReorgsListEnvelope, StreamsReorgContext, StreamsReorg, StreamsEventsSubscribeParams, StreamsEventsStreamParams, StreamsEventsListParams, StreamsEventsListEnvelope, StreamsEventsEnvelope, StreamsEventsConsumeResult, StreamsEventsConsumeParams, StreamsEventType, StreamsEventPayload, StreamsEvent, StreamsDumpsManifest, StreamsDumps, StreamsDumpFile, StreamsConsumeParams, StreamsClient, StreamsCanonicalBlock, StreamsBatchContext, StreamsBatch, StandardWebhooksHeaders2 as StandardWebhooksHeaders, StackingWalkParams, StackingListParams, StackingEnvelope, SinkTx, SecondLayerOptions, SecondLayerErrorOptions, SecondLayerError, SecondLayerArchive, SecondLayer, SbtcWithdrawalsWalkParams, SbtcWithdrawalsListParams, SbtcWithdrawalsEnvelope, SbtcWithdrawalSweptConfirmedEvent, SbtcWithdrawalStatus, SbtcWithdrawalEvent, SbtcWithdrawalEnvelope, SbtcSummaryEnvelope, SbtcResource, SbtcEventsWalkParams, SbtcEventsListParams, SbtcEventsEnvelope, SbtcEventsConsumeParams, SbtcEventTopic2 as SbtcEventTopic, SbtcDepositsWalkParams, SbtcDepositsListParams, SbtcDepositsEnvelope, SbtcDepositsConsumeParams, SbtcDepositEvent, SbtcDepositEnvelope, RotateSecretResponse2 as RotateSecretResponse, RewardSet2 as RewardSet, RequestOptions, ReplayResult2 as ReplayResult, RateLimitError, PublicStatus2 as PublicStatus, PrintSchemaResponse, PoxResource, PoxCyclesWalkParams, PoxCyclesListParams, PoxCyclesEnvelope, PoxCycleEnvelope, Pox5Resource, Pox5EventsWalkParams, Pox5EventsListParams, Pox5EventsEnvelope, NftTransfersWalkParams, NftTransfersResource, NftTransfersListParams, NftTransfersEnvelope, NftTransferPayload2 as NftTransferPayload, NftTransferEvent, NftTransfer, MempoolWalkParams, MempoolTransactionEnvelope, MempoolListParams, MempoolEnvelope, LoadedArchive, LOCAL_API_URL, InsufficientArchiveCreditsError, InstanceStatus, InstanceState, InstanceIssue, InstanceDiagnosis3 as InstanceDiagnosis, InstanceClient, IndexTransaction, IndexTip, IndexStxTransfer, IndexStxMint, IndexStxLock, IndexStxBurn, IndexStackingAction, IndexSbtcWithdrawalPhase, IndexSbtcWithdrawalDetail, IndexSbtcWithdrawal, IndexSbtcSummary, IndexSbtcEvent, IndexSbtcDepositDetail, IndexSbtcDeposit, IndexReorg, IndexPrint, IndexPoxFunctionCount, IndexPoxCycle, IndexPox5EventTopic, IndexPox5Event, IndexPostCondition, IndexNftTransfer, IndexNftMint, IndexNftBurn, IndexMempoolTransaction, IndexFtTransfer, IndexFtMint, IndexFtBurn, IndexFeedItem, IndexFeedFetcher, IndexFeedEnvelope, IndexEventsResource, IndexEventTypeFilters, IndexEventType, IndexEventOf, IndexEventFields, IndexEvent, IndexDiscovery, IndexContractCall, IndexConsumeOptions, IndexCanonicalBlock, IndexBlock, IndexAlwaysFields, Index, INDEX_MAX_PAGE_SIZE, FtTransfersWalkParams, FtTransfersResource, FtTransfersListParams, FtTransfersEnvelope, FtTransferPayload2 as FtTransferPayload, FtTransferEvent, FtTransfer, FetchLike2 as FetchLike, EventsWalkParams, EventsListParams, EventsEnvelope, EventsConsumeParams, DeliveryRow2 as DeliveryRow, DecodedStxTransferPayload, DecodedStxTransfer, DecodedStxMintPayload, DecodedStxMint, DecodedStxLockPayload, DecodedStxLock, DecodedStxBurnPayload, DecodedStxBurn, DecodedPrintValue, DecodedPrintPayload, DecodedPrint, DecodedNftTransferPayload, DecodedNftTransfer, DecodedNftMintPayload, DecodedNftMint, DecodedNftBurnPayload, DecodedNftBurn, DecodedFtTransferPayload, DecodedFtTransfer, DecodedFtMintPayload, DecodedFtMint, DecodedFtBurnPayload, DecodedFtBurn, DecodedEventRow, DecodedEventColumns, DeadRow2 as DeadRow, DEFAULT_REQUEST_TIMEOUT_MS, Cursor, CreateSubscriptionResponse2 as CreateSubscriptionResponse, CreateSubscriptionRequest2 as CreateSubscriptionRequest, CreateArchiveClientOptions, ContractsListParams, ContractsEnvelope, Contracts, ContractSummary, ContractConformance, ContractCallsWalkParams, ContractCallsListParams, ContractCallsEnvelope, ContractCallsConsumeParams, ContextSnapshot, ContextFieldError, ContextField, ContextAccount, ConsumerSink, ConsumerHealth, ConsumerBatchContext, ChainWebhookEnvelope, ChainWebhookDelivery2 as ChainWebhookDelivery, ChainTxLevelEvent, ChainTriggerType, ChainTrigger, ChainTestDelivery, ChainStxTransferData, ChainStxMintData, ChainStxLockData, ChainStxBurnData, ChainReorgRollbackEnvelope, ChainReorgRollbackDelivery, ChainReorgOrphanedEntry, ChainPrintEventData, ChainNftTransferData, ChainNftMintData, ChainNftBurnData, ChainFtTransferData, ChainFtMintData, ChainFtBurnData, ChainEventEnvelope, ChainApplyEnvelopeOf, ChainApplyEnvelope, ChainApplyDeliveryOf, CanonicalWalkParams, CanonicalListParams, CanonicalEnvelope, CREDENTIAL_ENV_VARS, BlocksWalkParams, BlocksListParams, BlocksEnvelope, BlockEnvelope, AuthError, ArchiveVerifyResult, ArchiveVerifyRangeStatus, ArchiveVerifyInput, ArchiveSignatureError, ArchiveQuote, ArchivePartition, ArchiveManifest, ArchiveLoadOptions, ArchiveGateNotConfiguredError, ArchiveFlow, ArchiveFetchResult, ArchiveFetchItem, ArchiveDataset, ArchiveCreditsBalance, ArchiveClient, ArchiveAuthError, ApiError, ActiveSubgraphOperation };
+export { verifyWebhookSignature, verifyTransactionProof, verify as verifyStandardWebhooksHeaders, verifySecondlayerSignature, trigger, toJsonSafe, shutdownSignal, resolveBaseUrl, resolveApiKey, resolveAccountKey, parseRetryAfter, isStxTransfer, isStxMint, isStxLock, isStxBurn, isPrint, isNftTransfer, isNftMint, isNftBurn, isFtTransfer, isFtMint, isFtBurn, getSubgraph, fetchRewardSet, decodeStxTransfer, decodeStxMint, decodeStxLock, decodeStxBurn, decodePrint, decodeNftTransfer, decodeNftMint, decodeNftBurn, decodeFtTransfer, decodeFtMint, decodeFtBurn, decodeClarityValue, decodeChainWebhook, decode, createStreamsClient, createArchiveClient, contextField, consumerHealth, consumeIndexFeed, WithSinkTx, WebhookHeaderInput, WalkOptions, ValidationError, UpdateSubscriptionRequest2 as UpdateSubscriptionRequest, TransactionsWalkParams, TransactionsListParams, TransactionsEnvelope, TransactionProofVerifyResult, TransactionProof, TransactionEnvelope, Subscriptions, SubscriptionSummary2 as SubscriptionSummary, SubscriptionStatus, SubscriptionRuntime, SubscriptionKind, SubscriptionFormat, SubscriptionDetail2 as SubscriptionDetail, Subgraphs, SubgraphSpecOptions3 as SubgraphSpecOptions, SubgraphSpecFormat2 as SubgraphSpecFormat, SubgraphOperationStatus, SubgraphAgentSchema3 as SubgraphAgentSchema, StreamsTip, StreamsSubscription, StreamsSignatureError, StreamsServerError, StreamsReorgsListParams, StreamsReorgsListEnvelope, StreamsReorgContext, StreamsReorg, StreamsEventsSubscribeParams, StreamsEventsStreamParams, StreamsEventsListParams, StreamsEventsListEnvelope, StreamsEventsEnvelope, StreamsEventsConsumeResult, StreamsEventsConsumeParams, StreamsEventType, StreamsEventPayload, StreamsEvent, StreamsDumpsManifest, StreamsDumps, StreamsDumpFile, StreamsConsumeParams, StreamsClient, StreamsCanonicalBlock, StreamsBatchContext, StreamsBatch, StandardWebhooksHeaders2 as StandardWebhooksHeaders, StackingWalkParams, StackingListParams, StackingEnvelope, SinkTx, SecondLayerOptions, SecondLayerErrorOptions, SecondLayerError, SecondLayerArchive, SecondLayer, SbtcWithdrawalsWalkParams, SbtcWithdrawalsListParams, SbtcWithdrawalsEnvelope, SbtcWithdrawalSweptConfirmedEvent, SbtcWithdrawalStatus, SbtcWithdrawalEvent, SbtcWithdrawalEnvelope, SbtcSummaryEnvelope, SbtcResource, SbtcEventsWalkParams, SbtcEventsListParams, SbtcEventsEnvelope, SbtcEventsConsumeParams, SbtcEventTopic2 as SbtcEventTopic, SbtcDepositsWalkParams, SbtcDepositsListParams, SbtcDepositsEnvelope, SbtcDepositsConsumeParams, SbtcDepositEvent, SbtcDepositEnvelope, RotateSecretResponse2 as RotateSecretResponse, RewardSet2 as RewardSet, RequestOptions, ReplayResult2 as ReplayResult, RateLimitError, PublicStatus2 as PublicStatus, PrintSchemaResponse, PoxResource, PoxCyclesWalkParams, PoxCyclesListParams, PoxCyclesEnvelope, PoxCycleEnvelope, Pox5Resource, Pox5EventsWalkParams, Pox5EventsListParams, Pox5EventsEnvelope, NftTransfersWalkParams, NftTransfersResource, NftTransfersListParams, NftTransfersEnvelope, NftTransferPayload2 as NftTransferPayload, NftTransferEvent, NftTransfer, MempoolWalkParams, MempoolTransactionEnvelope, MempoolListParams, MempoolEnvelope, LoadedArchive, LOCAL_API_URL, InsufficientArchiveCreditsError, InstanceStatus, InstanceState, InstanceIssue, InstanceDiagnosis3 as InstanceDiagnosis, InstanceClient, IndexTransaction, IndexTip, IndexStxTransfer, IndexStxMint, IndexStxLock, IndexStxBurn, IndexStackingAction, IndexSbtcWithdrawalPhase, IndexSbtcWithdrawalDetail, IndexSbtcWithdrawal, IndexSbtcSummary, IndexSbtcEvent, IndexSbtcDepositDetail, IndexSbtcDeposit, IndexReorg, IndexPrint, IndexPoxFunctionCount, IndexPoxCycle, IndexPox5EventTopic, IndexPox5Event, IndexPostCondition, IndexNftTransfer, IndexNftMint, IndexNftBurn, IndexMempoolTransaction, IndexFtTransfer, IndexFtMint, IndexFtBurn, IndexFeedItem, IndexFeedFetcher, IndexFeedEnvelope, IndexEventsResource, IndexEventTypeFilters, IndexEventType, IndexEventOf, IndexEventFields, IndexEvent, IndexDiscovery, IndexContractCall, IndexConsumeOptions, IndexCanonicalBlock, IndexBlock, IndexAlwaysFields, Index, INSTANCE_TOKEN_ENV, INDEX_MAX_PAGE_SIZE, FtTransfersWalkParams, FtTransfersResource, FtTransfersListParams, FtTransfersEnvelope, FtTransferPayload2 as FtTransferPayload, FtTransferEvent, FtTransfer, FetchLike2 as FetchLike, EventsWalkParams, EventsListParams, EventsEnvelope, EventsConsumeParams, DeliveryRow2 as DeliveryRow, DecodedStxTransferPayload, DecodedStxTransfer, DecodedStxMintPayload, DecodedStxMint, DecodedStxLockPayload, DecodedStxLock, DecodedStxBurnPayload, DecodedStxBurn, DecodedPrintValue, DecodedPrintPayload, DecodedPrint, DecodedNftTransferPayload, DecodedNftTransfer, DecodedNftMintPayload, DecodedNftMint, DecodedNftBurnPayload, DecodedNftBurn, DecodedFtTransferPayload, DecodedFtTransfer, DecodedFtMintPayload, DecodedFtMint, DecodedFtBurnPayload, DecodedFtBurn, DecodedEventRow, DecodedEventColumns, DeadRow2 as DeadRow, DEFAULT_REQUEST_TIMEOUT_MS, Cursor, CreateSubscriptionResponse2 as CreateSubscriptionResponse, CreateSubscriptionRequest2 as CreateSubscriptionRequest, CreateArchiveClientOptions, ContractsListParams, ContractsEnvelope, Contracts, ContractSummary, ContractConformance, ContractCallsWalkParams, ContractCallsListParams, ContractCallsEnvelope, ContractCallsConsumeParams, ContextSnapshot, ContextFieldError, ContextField, ContextAccount, ConsumerSink, ConsumerHealth, ConsumerBatchContext, ChainWebhookEnvelope, ChainWebhookDelivery2 as ChainWebhookDelivery, ChainTxLevelEvent, ChainTriggerType, ChainTrigger, ChainTestDelivery, ChainStxTransferData, ChainStxMintData, ChainStxLockData, ChainStxBurnData, ChainReorgRollbackEnvelope, ChainReorgRollbackDelivery, ChainReorgOrphanedEntry, ChainPrintEventData, ChainNftTransferData, ChainNftMintData, ChainNftBurnData, ChainFtTransferData, ChainFtMintData, ChainFtBurnData, ChainEventEnvelope, ChainApplyEnvelopeOf, ChainApplyEnvelope, ChainApplyDeliveryOf, CanonicalWalkParams, CanonicalListParams, CanonicalEnvelope, BlocksWalkParams, BlocksListParams, BlocksEnvelope, BlockEnvelope, AuthError, ArchiveVerifyResult, ArchiveVerifyRangeStatus, ArchiveVerifyInput, ArchiveSignatureError, ArchiveQuote, ArchivePartition, ArchiveManifest, ArchiveLoadOptions, ArchiveGateNotConfiguredError, ArchiveFlow, ArchiveFetchResult, ArchiveFetchItem, ArchiveDataset, ArchiveCreditsBalance, ArchiveClient, ArchiveAuthError, ApiError, ActiveSubgraphOperation, ACCOUNT_KEY_ENV };

package/dist/index.js

@@ -172,33 +172,55 @@ function raceAbort(promise, signal) {
   });
 }
 var LOCAL_API_URL = "http://127.0.0.1:3800";
+var INSTANCE_TOKEN_ENV = "INSTANCE_TOKEN";
+var ACCOUNT_KEY_ENV = "SECONDLAYER_API_KEY";
+var warnedUrlAlias = false;
 function resolveBaseUrl(explicit) {
   if (explicit && explicit.length > 0)
     return explicit.replace(/\/+$/, "");
   if (typeof process !== "undefined") {
-    const fromEnv = process.env?.SL_API_URL || process.env?.SECONDLAYER_API_URL;
-    if (fromEnv)
-      return fromEnv.replace(/\/+$/, "");
+    const primary = process.env?.SECONDLAYER_API_URL || undefined;
+    if (primary)
+      return primary.replace(/\/+$/, "");
+    const legacy = process.env?.SL_API_URL || undefined;
+    if (legacy) {
+      if (!warnedUrlAlias) {
+        warnedUrlAlias = true;
+        console.warn("[secondlayer] SL_API_URL is a legacy alias of SECONDLAYER_API_URL; using the alias this once.");
+      }
+      return legacy.replace(/\/+$/, "");
+    }
   }
   return LOCAL_API_URL;
 }
-var CREDENTIAL_ENV_VARS = ["INSTANCE_TOKEN", "SL_API_KEY"];
-var warnedConflicts = new Set;
 function resolveApiKey(apiKey) {
   if (apiKey !== undefined)
     return apiKey;
   if (typeof process === "undefined")
     return;
-  const instanceToken = process.env?.INSTANCE_TOKEN || undefined;
-  const legacyKey = process.env?.SL_API_KEY || undefined;
-  if (instanceToken && legacyKey && instanceToken !== legacyKey) {
-    const pair = `${instanceToken}\x00${legacyKey}`;
-    if (!warnedConflicts.has(pair)) {
-      warnedConflicts.add(pair);
-      console.warn("[secondlayer] INSTANCE_TOKEN and SL_API_KEY are set to different values — using INSTANCE_TOKEN (SL_API_KEY is a legacy alias for it).");
-    }
+  const token = process.env?.INSTANCE_TOKEN || undefined;
+  return token;
+}
+var warnedArchiveAlias = false;
+function resolveAccountKey(accountKey) {
+  if (accountKey !== undefined)
+    return accountKey;
+  if (typeof process === "undefined")
+    return;
+  const primary = process.env?.SECONDLAYER_API_KEY || undefined;
+  const slAlias = process.env?.SL_API_KEY || undefined;
+  const archiveAlias = process.env?.SL_ARCHIVE_API_KEY || undefined;
+  if (primary)
+    return primary;
+  const legacy = slAlias ?? archiveAlias;
+  if (legacy) {
+    if (!warnedArchiveAlias) {
+      warnedArchiveAlias = true;
+      console.warn("[secondlayer] SL_API_KEY / SL_ARCHIVE_API_KEY are legacy aliases of SECONDLAYER_API_KEY; using the alias this once.");
+    }
+    return legacy;
   }
-  return instanceToken ?? legacyKey;
+  return;
 }
 function seg(value) {
   return encodeURIComponent(String(value));
@@ -857,6 +879,7 @@ var OFFICIAL_ARCHIVE_HOST = "archive.secondlayer.tools";
 var DEFAULT_ARCHIVE_BASE_URL = "https://archive.secondlayer.tools";
 var DEFAULT_ARCHIVE_OPS_URL = "https://api.secondlayer.tools";
 var MAX_FETCH_BATCH = 64;
+var ARCHIVE_CREDENTIAL_RE = /^s[ks]-sl_/;
 function quoteFromBody(body) {
   return {
     partitions: body.partitions,
@@ -873,7 +896,7 @@ function stripSlash(url) {
   return url.replace(/\/+$/, "");
 }
 function createArchiveClient(options = {}) {
-  const apiKey = resolveApiKey(options.apiKey);
+  const accountKey = resolveAccountKey(options.accountKey ?? options.apiKey);
   const fetchImpl = options.fetchImpl ?? ((input, init) => fetch(input, init));
   const archiveBaseUrl = stripSlash(options.archiveBaseUrl ?? DEFAULT_ARCHIVE_BASE_URL);
   const archiveOpsUrl = stripSlash(options.archiveOpsUrl ?? DEFAULT_ARCHIVE_OPS_URL);
@@ -921,8 +944,12 @@ function createArchiveClient(options = {}) {
     const headers = {
       "Content-Type": "application/json"
     };
-    if (authed && apiKey)
-      headers.Authorization = `Bearer ${apiKey}`;
+    if (authed && accountKey) {
+      if (!ARCHIVE_CREDENTIAL_RE.test(accountKey)) {
+        throw new ArchiveAuthError("archive ops need SECONDLAYER_API_KEY (sk-sl_*), not INSTANCE_TOKEN");
+      }
+      headers.Authorization = `Bearer ${accountKey}`;
+    }
     const response = await fetchImpl(`${archiveOpsUrl}${path}`, {
       method,
       headers,
@@ -2518,7 +2545,7 @@ class SecondLayer extends BaseClient {
     const request = (method, path, body) => this.request(method, path, body);
     this.archive = {
       ...createArchiveClient({
-        apiKey: this.apiKey,
+        accountKey: options.accountKey,
         fetchImpl: options.fetchImpl,
         archiveBaseUrl: options.archiveBaseUrl,
         archiveOpsUrl: options.archiveOpsUrl
@@ -2850,6 +2877,7 @@ export {
   shutdownSignal,
   resolveBaseUrl,
   resolveApiKey,
+  resolveAccountKey,
   parseRetryAfter,
   isStxTransfer,
   isStxMint,
@@ -2894,17 +2922,18 @@ export {
   LOCAL_API_URL,
   InsufficientArchiveCreditsError,
   Index,
+  INSTANCE_TOKEN_ENV,
   INDEX_MAX_PAGE_SIZE,
   DEFAULT_REQUEST_TIMEOUT_MS,
   Cursor,
   Contracts,
-  CREDENTIAL_ENV_VARS,
   AuthError,
   ArchiveSignatureError,
   ArchiveGateNotConfiguredError,
   ArchiveAuthError,
-  ApiError
+  ApiError,
+  ACCOUNT_KEY_ENV
 };
 
-//# debugId=ACBBAC86B270FAEA64756E2164756E21
+//# debugId=4C4D7DCC9A7B5FE064756E2164756E21
 //# sourceMappingURL=index.js.map