@secondlayer/shared 13.8.0 → 13.9.0

package/dist/src/archive/range-digest.d.ts

@@ -306,6 +306,9 @@ interface AccountsTable {
 	email: string | null;
 	/** True for anonymous self-serve accounts until claimed via magic link. */
 	ghost: Generated<boolean>;
+	/** First-party service account: usage priced at $0, never gated on
+	*  credits. Set by ops only. */
+	internal: Generated<boolean>;
 	/** Stacks principal owning a wallet-ghost account. */
 	wallet_principal: string | null;
 	display_name: string | null;
@@ -1196,6 +1199,8 @@ interface ApiFailedRequestsTable {
 	message: Generated<string>;
 	query: Record<string, unknown>;
 	origin: string | null;
+	/** Revoked account key the request presented (`KEY_REVOKED` only). */
+	api_key_id: string | null;
 	created_at: Generated<Date>;
 }
 /**

package/dist/src/archive/semantic-digest-builder.d.ts

@@ -306,6 +306,9 @@ interface AccountsTable {
 	email: string | null;
 	/** True for anonymous self-serve accounts until claimed via magic link. */
 	ghost: Generated<boolean>;
+	/** First-party service account: usage priced at $0, never gated on
+	*  credits. Set by ops only. */
+	internal: Generated<boolean>;
 	/** Stacks principal owning a wallet-ghost account. */
 	wallet_principal: string | null;
 	display_name: string | null;
@@ -1196,6 +1199,8 @@ interface ApiFailedRequestsTable {
 	message: Generated<string>;
 	query: Record<string, unknown>;
 	origin: string | null;
+	/** Revoked account key the request presented (`KEY_REVOKED` only). */
+	api_key_id: string | null;
 	created_at: Generated<Date>;
 }
 /**

package/dist/src/coverage/index.d.ts

@@ -623,6 +623,9 @@ interface AccountsTable {
 	email: string | null;
 	/** True for anonymous self-serve accounts until claimed via magic link. */
 	ghost: Generated<boolean>;
+	/** First-party service account: usage priced at $0, never gated on
+	*  credits. Set by ops only. */
+	internal: Generated<boolean>;
 	/** Stacks principal owning a wallet-ghost account. */
 	wallet_principal: string | null;
 	display_name: string | null;
@@ -1513,6 +1516,8 @@ interface ApiFailedRequestsTable {
 	message: Generated<string>;
 	query: Record<string, unknown>;
 	origin: string | null;
+	/** Revoked account key the request presented (`KEY_REVOKED` only). */
+	api_key_id: string | null;
 	created_at: Generated<Date>;
 }
 /**

package/dist/src/db/index.d.ts

@@ -307,6 +307,9 @@ interface AccountsTable {
 	email: string | null;
 	/** True for anonymous self-serve accounts until claimed via magic link. */
 	ghost: Generated<boolean>;
+	/** First-party service account: usage priced at $0, never gated on
+	*  credits. Set by ops only. */
+	internal: Generated<boolean>;
 	/** Stacks principal owning a wallet-ghost account. */
 	wallet_principal: string | null;
 	display_name: string | null;
@@ -1265,6 +1268,8 @@ interface ApiFailedRequestsTable {
 	message: Generated<string>;
 	query: Record<string, unknown>;
 	origin: string | null;
+	/** Revoked account key the request presented (`KEY_REVOKED` only). */
+	api_key_id: string | null;
 	created_at: Generated<Date>;
 }
 type ApiFailedRequest = Selectable<ApiFailedRequestsTable>;

package/dist/src/db/queries/chain-reorgs.d.ts

@@ -306,6 +306,9 @@ interface AccountsTable {
 	email: string | null;
 	/** True for anonymous self-serve accounts until claimed via magic link. */
 	ghost: Generated<boolean>;
+	/** First-party service account: usage priced at $0, never gated on
+	*  credits. Set by ops only. */
+	internal: Generated<boolean>;
 	/** Stacks principal owning a wallet-ghost account. */
 	wallet_principal: string | null;
 	display_name: string | null;
@@ -1196,6 +1199,8 @@ interface ApiFailedRequestsTable {
 	message: Generated<string>;
 	query: Record<string, unknown>;
 	origin: string | null;
+	/** Revoked account key the request presented (`KEY_REVOKED` only). */
+	api_key_id: string | null;
 	created_at: Generated<Date>;
 }
 /**

package/dist/src/db/queries/contracts.d.ts

@@ -306,6 +306,9 @@ interface AccountsTable {
 	email: string | null;
 	/** True for anonymous self-serve accounts until claimed via magic link. */
 	ghost: Generated<boolean>;
+	/** First-party service account: usage priced at $0, never gated on
+	*  credits. Set by ops only. */
+	internal: Generated<boolean>;
 	/** Stacks principal owning a wallet-ghost account. */
 	wallet_principal: string | null;
 	display_name: string | null;
@@ -1197,6 +1200,8 @@ interface ApiFailedRequestsTable {
 	message: Generated<string>;
 	query: Record<string, unknown>;
 	origin: string | null;
+	/** Revoked account key the request presented (`KEY_REVOKED` only). */
+	api_key_id: string | null;
 	created_at: Generated<Date>;
 }
 /**

package/dist/src/db/queries/instance.d.ts

@@ -306,6 +306,9 @@ interface AccountsTable {
 	email: string | null;
 	/** True for anonymous self-serve accounts until claimed via magic link. */
 	ghost: Generated<boolean>;
+	/** First-party service account: usage priced at $0, never gated on
+	*  credits. Set by ops only. */
+	internal: Generated<boolean>;
 	/** Stacks principal owning a wallet-ghost account. */
 	wallet_principal: string | null;
 	display_name: string | null;
@@ -1196,6 +1199,8 @@ interface ApiFailedRequestsTable {
 	message: Generated<string>;
 	query: Record<string, unknown>;
 	origin: string | null;
+	/** Revoked account key the request presented (`KEY_REVOKED` only). */
+	api_key_id: string | null;
 	created_at: Generated<Date>;
 }
 /**

package/dist/src/db/queries/integrity.d.ts

@@ -306,6 +306,9 @@ interface AccountsTable {
 	email: string | null;
 	/** True for anonymous self-serve accounts until claimed via magic link. */
 	ghost: Generated<boolean>;
+	/** First-party service account: usage priced at $0, never gated on
+	*  credits. Set by ops only. */
+	internal: Generated<boolean>;
 	/** Stacks principal owning a wallet-ghost account. */
 	wallet_principal: string | null;
 	display_name: string | null;
@@ -1196,6 +1199,8 @@ interface ApiFailedRequestsTable {
 	message: Generated<string>;
 	query: Record<string, unknown>;
 	origin: string | null;
+	/** Revoked account key the request presented (`KEY_REVOKED` only). */
+	api_key_id: string | null;
 	created_at: Generated<Date>;
 }
 /**

package/dist/src/db/queries/subgraph-gaps.d.ts

@@ -306,6 +306,9 @@ interface AccountsTable {
 	email: string | null;
 	/** True for anonymous self-serve accounts until claimed via magic link. */
 	ghost: Generated<boolean>;
+	/** First-party service account: usage priced at $0, never gated on
+	*  credits. Set by ops only. */
+	internal: Generated<boolean>;
 	/** Stacks principal owning a wallet-ghost account. */
 	wallet_principal: string | null;
 	display_name: string | null;
@@ -1196,6 +1199,8 @@ interface ApiFailedRequestsTable {
 	message: Generated<string>;
 	query: Record<string, unknown>;
 	origin: string | null;
+	/** Revoked account key the request presented (`KEY_REVOKED` only). */
+	api_key_id: string | null;
 	created_at: Generated<Date>;
 }
 /**

package/dist/src/db/queries/subgraph-operations.d.ts

@@ -306,6 +306,9 @@ interface AccountsTable {
 	email: string | null;
 	/** True for anonymous self-serve accounts until claimed via magic link. */
 	ghost: Generated<boolean>;
+	/** First-party service account: usage priced at $0, never gated on
+	*  credits. Set by ops only. */
+	internal: Generated<boolean>;
 	/** Stacks principal owning a wallet-ghost account. */
 	wallet_principal: string | null;
 	display_name: string | null;
@@ -1197,6 +1200,8 @@ interface ApiFailedRequestsTable {
 	message: Generated<string>;
 	query: Record<string, unknown>;
 	origin: string | null;
+	/** Revoked account key the request presented (`KEY_REVOKED` only). */
+	api_key_id: string | null;
 	created_at: Generated<Date>;
 }
 /**

package/dist/src/db/queries/subgraphs.d.ts

@@ -306,6 +306,9 @@ interface AccountsTable {
 	email: string | null;
 	/** True for anonymous self-serve accounts until claimed via magic link. */
 	ghost: Generated<boolean>;
+	/** First-party service account: usage priced at $0, never gated on
+	*  credits. Set by ops only. */
+	internal: Generated<boolean>;
 	/** Stacks principal owning a wallet-ghost account. */
 	wallet_principal: string | null;
 	display_name: string | null;
@@ -1197,6 +1200,8 @@ interface ApiFailedRequestsTable {
 	message: Generated<string>;
 	query: Record<string, unknown>;
 	origin: string | null;
+	/** Revoked account key the request presented (`KEY_REVOKED` only). */
+	api_key_id: string | null;
 	created_at: Generated<Date>;
 }
 /**

package/dist/src/db/queries/sync-scope.d.ts

@@ -316,6 +316,9 @@ interface AccountsTable {
 	email: string | null;
 	/** True for anonymous self-serve accounts until claimed via magic link. */
 	ghost: Generated<boolean>;
+	/** First-party service account: usage priced at $0, never gated on
+	*  credits. Set by ops only. */
+	internal: Generated<boolean>;
 	/** Stacks principal owning a wallet-ghost account. */
 	wallet_principal: string | null;
 	display_name: string | null;
@@ -1206,6 +1209,8 @@ interface ApiFailedRequestsTable {
 	message: Generated<string>;
 	query: Record<string, unknown>;
 	origin: string | null;
+	/** Revoked account key the request presented (`KEY_REVOKED` only). */
+	api_key_id: string | null;
 	created_at: Generated<Date>;
 }
 /**

package/dist/src/db/queries/webhooks.d.ts

@@ -306,6 +306,9 @@ interface AccountsTable {
 	email: string | null;
 	/** True for anonymous self-serve accounts until claimed via magic link. */
 	ghost: Generated<boolean>;
+	/** First-party service account: usage priced at $0, never gated on
+	*  credits. Set by ops only. */
+	internal: Generated<boolean>;
 	/** Stacks principal owning a wallet-ghost account. */
 	wallet_principal: string | null;
 	display_name: string | null;
@@ -1197,6 +1200,8 @@ interface ApiFailedRequestsTable {
 	message: Generated<string>;
 	query: Record<string, unknown>;
 	origin: string | null;
+	/** Revoked account key the request presented (`KEY_REVOKED` only). */
+	api_key_id: string | null;
 	created_at: Generated<Date>;
 }
 /**

package/dist/src/db/schema.d.ts

@@ -305,6 +305,9 @@ interface AccountsTable {
 	email: string | null;
 	/** True for anonymous self-serve accounts until claimed via magic link. */
 	ghost: Generated<boolean>;
+	/** First-party service account: usage priced at $0, never gated on
+	*  credits. Set by ops only. */
+	internal: Generated<boolean>;
 	/** Stacks principal owning a wallet-ghost account. */
 	wallet_principal: string | null;
 	display_name: string | null;
@@ -1263,6 +1266,8 @@ interface ApiFailedRequestsTable {
 	message: Generated<string>;
 	query: Record<string, unknown>;
 	origin: string | null;
+	/** Revoked account key the request presented (`KEY_REVOKED` only). */
+	api_key_id: string | null;
 	created_at: Generated<Date>;
 }
 type ApiFailedRequest = Selectable<ApiFailedRequestsTable>;

package/dist/src/error-envelope.d.ts

@@ -21,6 +21,7 @@ type FailedRequestRecord = {
 	message: string
 	query: Record<string, unknown>
 	origin: string | null
+	api_key_id?: string | null
 };
 /** Incoming `X-Request-Id` values matching this are reused. */
 declare const REQUEST_ID_PATTERN: RegExp;

package/dist/src/error-envelope.js.map

@@ -2,9 +2,9 @@
   "version": 3,
   "sources": ["../src/error-envelope.ts"],
   "sourcesContent": [
-    "/**\n * Pure, dependency-free pieces of the API error envelope: request ids,\n * default codes by status, feedback pointers and query redaction. Shared by\n * the API middleware and the workload gateway so both emit the same shape.\n */\n\n/** Default `code` for an error body that set none, keyed by HTTP status. */\nexport const DEFAULT_CODE_BY_STATUS: Record<number, string> = {\n\t400: \"VALIDATION_ERROR\",\n\t401: \"AUTHENTICATION_ERROR\",\n\t402: \"PAYMENT_REQUIRED\",\n\t403: \"FORBIDDEN\",\n\t404: \"NOT_FOUND\",\n\t409: \"CONFLICT\",\n\t410: \"GONE\",\n\t415: \"UNSUPPORTED_MEDIA_TYPE\",\n\t422: \"VALIDATION_ERROR\",\n\t429: \"RATE_LIMIT_ERROR\",\n\t500: \"INTERNAL_ERROR\",\n\t502: \"UPSTREAM_ERROR\",\n\t503: \"SERVICE_UNAVAILABLE\",\n};\n\n/** Where to report a gap: a path on hosted, the issue tracker on self-host. */\nexport const FEEDBACK_URL = {\n\tplatform: \"/v1/feedback\",\n\toss: \"https://github.com/ryanwaits/secondlayer/issues/new\",\n} as const;\n\n/** One hosted failed-request record (account-scoped, kept 24h). */\nexport type FailedRequestRecord = {\n\trequest_id: string;\n\taccount_id: string;\n\tmethod: string;\n\tpath: string;\n\tstatus: number;\n\tcode: string;\n\tmessage: string;\n\tquery: Record<string, unknown>;\n\torigin: string | null;\n};\n\n/** Incoming `X-Request-Id` values matching this are reused. */\nexport const REQUEST_ID_PATTERN: RegExp = /^[A-Za-z0-9._-]{8,64}$/;\n\n/** `req_` plus 24 lowercase hex chars. */\nexport function newRequestId(): string {\n\tconst bytes = crypto.getRandomValues(new Uint8Array(12));\n\tlet hex = \"\";\n\tfor (const b of bytes) hex += b.toString(16).padStart(2, \"0\");\n\treturn `req_${hex}`;\n}\n\nconst SENSITIVE_KEY = /token|key|secret|signature|password|auth/i;\nconst MAX_VALUE_CHARS = 200;\nconst MAX_QUERY_JSON_CHARS = 2048;\n\n/**\n * Query params safe to store: sensitive keys dropped, values capped at 200\n * chars, and a `{ _truncated, keys }` stub when the result is over 2048 chars.\n */\nexport function redactQuery(params: URLSearchParams): Record<string, unknown> {\n\tconst out: Record<string, unknown> = {};\n\tfor (const [key, value] of params) {\n\t\tif (SENSITIVE_KEY.test(key)) continue;\n\t\tout[key] = value.slice(0, MAX_VALUE_CHARS);\n\t}\n\tif (JSON.stringify(out).length > MAX_QUERY_JSON_CHARS) {\n\t\treturn { _truncated: true, keys: Object.keys(out) };\n\t}\n\treturn out;\n}\n\n/**\n * Additive error body: `request_id` always set, `code` only when absent or\n * not a string, `feedback` only when absent (or always with\n * `overrideFeedback`). Returns null when `body` is not an object carrying an\n * `error` key, so callers leave such responses alone.\n */\nexport function augmentErrorBody(\n\tbody: unknown,\n\topts: {\n\t\tstatus: number;\n\t\trequestId: string;\n\t\tfeedbackUrl: string;\n\t\toverrideFeedback?: boolean;\n\t},\n): Record<string, unknown> | null {\n\tif (typeof body !== \"object\" || body === null || Array.isArray(body)) {\n\t\treturn null;\n\t}\n\tif (!(\"error\" in body)) return null;\n\tconst src = body as Record<string, unknown>;\n\tconst next: Record<string, unknown> = { ...src, request_id: opts.requestId };\n\tif (typeof src.code !== \"string\") {\n\t\tnext.code = DEFAULT_CODE_BY_STATUS[opts.status] ?? \"HTTP_ERROR\";\n\t}\n\tif (opts.overrideFeedback || src.feedback === undefined) {\n\t\tnext.feedback = { url: opts.feedbackUrl };\n\t}\n\treturn next;\n}\n\nconst KNOWN_ORIGINS = [\"cli\", \"mcp\", \"session\"];\n\n/** `x-sl-origin` header reduced to a known value, else null. */\nexport function normalizeOrigin(header: string | undefined): string | null {\n\tconst v = header?.toLowerCase();\n\treturn v !== undefined && KNOWN_ORIGINS.includes(v) ? v : null;\n}\n"
+    "/**\n * Pure, dependency-free pieces of the API error envelope: request ids,\n * default codes by status, feedback pointers and query redaction. Shared by\n * the API middleware and the workload gateway so both emit the same shape.\n */\n\n/** Default `code` for an error body that set none, keyed by HTTP status. */\nexport const DEFAULT_CODE_BY_STATUS: Record<number, string> = {\n\t400: \"VALIDATION_ERROR\",\n\t401: \"AUTHENTICATION_ERROR\",\n\t402: \"PAYMENT_REQUIRED\",\n\t403: \"FORBIDDEN\",\n\t404: \"NOT_FOUND\",\n\t409: \"CONFLICT\",\n\t410: \"GONE\",\n\t415: \"UNSUPPORTED_MEDIA_TYPE\",\n\t422: \"VALIDATION_ERROR\",\n\t429: \"RATE_LIMIT_ERROR\",\n\t500: \"INTERNAL_ERROR\",\n\t502: \"UPSTREAM_ERROR\",\n\t503: \"SERVICE_UNAVAILABLE\",\n};\n\n/** Where to report a gap: a path on hosted, the issue tracker on self-host. */\nexport const FEEDBACK_URL = {\n\tplatform: \"/v1/feedback\",\n\toss: \"https://github.com/ryanwaits/secondlayer/issues/new\",\n} as const;\n\n/** One hosted failed-request record (account-scoped, kept 24h). */\nexport type FailedRequestRecord = {\n\trequest_id: string;\n\taccount_id: string;\n\tmethod: string;\n\tpath: string;\n\tstatus: number;\n\tcode: string;\n\tmessage: string;\n\tquery: Record<string, unknown>;\n\torigin: string | null;\n\tapi_key_id?: string | null;\n};\n\n/** Incoming `X-Request-Id` values matching this are reused. */\nexport const REQUEST_ID_PATTERN: RegExp = /^[A-Za-z0-9._-]{8,64}$/;\n\n/** `req_` plus 24 lowercase hex chars. */\nexport function newRequestId(): string {\n\tconst bytes = crypto.getRandomValues(new Uint8Array(12));\n\tlet hex = \"\";\n\tfor (const b of bytes) hex += b.toString(16).padStart(2, \"0\");\n\treturn `req_${hex}`;\n}\n\nconst SENSITIVE_KEY = /token|key|secret|signature|password|auth/i;\nconst MAX_VALUE_CHARS = 200;\nconst MAX_QUERY_JSON_CHARS = 2048;\n\n/**\n * Query params safe to store: sensitive keys dropped, values capped at 200\n * chars, and a `{ _truncated, keys }` stub when the result is over 2048 chars.\n */\nexport function redactQuery(params: URLSearchParams): Record<string, unknown> {\n\tconst out: Record<string, unknown> = {};\n\tfor (const [key, value] of params) {\n\t\tif (SENSITIVE_KEY.test(key)) continue;\n\t\tout[key] = value.slice(0, MAX_VALUE_CHARS);\n\t}\n\tif (JSON.stringify(out).length > MAX_QUERY_JSON_CHARS) {\n\t\treturn { _truncated: true, keys: Object.keys(out) };\n\t}\n\treturn out;\n}\n\n/**\n * Additive error body: `request_id` always set, `code` only when absent or\n * not a string, `feedback` only when absent (or always with\n * `overrideFeedback`). Returns null when `body` is not an object carrying an\n * `error` key, so callers leave such responses alone.\n */\nexport function augmentErrorBody(\n\tbody: unknown,\n\topts: {\n\t\tstatus: number;\n\t\trequestId: string;\n\t\tfeedbackUrl: string;\n\t\toverrideFeedback?: boolean;\n\t},\n): Record<string, unknown> | null {\n\tif (typeof body !== \"object\" || body === null || Array.isArray(body)) {\n\t\treturn null;\n\t}\n\tif (!(\"error\" in body)) return null;\n\tconst src = body as Record<string, unknown>;\n\tconst next: Record<string, unknown> = { ...src, request_id: opts.requestId };\n\tif (typeof src.code !== \"string\") {\n\t\tnext.code = DEFAULT_CODE_BY_STATUS[opts.status] ?? \"HTTP_ERROR\";\n\t}\n\tif (opts.overrideFeedback || src.feedback === undefined) {\n\t\tnext.feedback = { url: opts.feedbackUrl };\n\t}\n\treturn next;\n}\n\nconst KNOWN_ORIGINS = [\"cli\", \"mcp\", \"session\"];\n\n/** `x-sl-origin` header reduced to a known value, else null. */\nexport function normalizeOrigin(header: string | undefined): string | null {\n\tconst v = header?.toLowerCase();\n\treturn v !== undefined && KNOWN_ORIGINS.includes(v) ? v : null;\n}\n"
   ],
-  "mappings": ";AAOO,IAAM,yBAAiD;AAAA,EAC7D,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AACN;AAGO,IAAM,eAAe;AAAA,EAC3B,UAAU;AAAA,EACV,KAAK;AACN;AAgBO,IAAM,qBAA6B;AAGnC,SAAS,YAAY,GAAW;AAAA,EACtC,MAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAAA,EACvD,IAAI,MAAM;AAAA,EACV,WAAW,KAAK;AAAA,IAAO,OAAO,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAAA,EAC5D,OAAO,OAAO;AAAA;AAGf,IAAM,gBAAgB;AACtB,IAAM,kBAAkB;AACxB,IAAM,uBAAuB;AAMtB,SAAS,WAAW,CAAC,QAAkD;AAAA,EAC7E,MAAM,MAA+B,CAAC;AAAA,EACtC,YAAY,KAAK,UAAU,QAAQ;AAAA,IAClC,IAAI,cAAc,KAAK,GAAG;AAAA,MAAG;AAAA,IAC7B,IAAI,OAAO,MAAM,MAAM,GAAG,eAAe;AAAA,EAC1C;AAAA,EACA,IAAI,KAAK,UAAU,GAAG,EAAE,SAAS,sBAAsB;AAAA,IACtD,OAAO,EAAE,YAAY,MAAM,MAAM,OAAO,KAAK,GAAG,EAAE;AAAA,EACnD;AAAA,EACA,OAAO;AAAA;AASD,SAAS,gBAAgB,CAC/B,MACA,MAMiC;AAAA,EACjC,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,GAAG;AAAA,IACrE,OAAO;AAAA,EACR;AAAA,EACA,IAAI,EAAE,WAAW;AAAA,IAAO,OAAO;AAAA,EAC/B,MAAM,MAAM;AAAA,EACZ,MAAM,OAAgC,KAAK,KAAK,YAAY,KAAK,UAAU;AAAA,EAC3E,IAAI,OAAO,IAAI,SAAS,UAAU;AAAA,IACjC,KAAK,OAAO,uBAAuB,KAAK,WAAW;AAAA,EACpD;AAAA,EACA,IAAI,KAAK,oBAAoB,IAAI,aAAa,WAAW;AAAA,IACxD,KAAK,WAAW,EAAE,KAAK,KAAK,YAAY;AAAA,EACzC;AAAA,EACA,OAAO;AAAA;AAGR,IAAM,gBAAgB,CAAC,OAAO,OAAO,SAAS;AAGvC,SAAS,eAAe,CAAC,QAA2C;AAAA,EAC1E,MAAM,IAAI,QAAQ,YAAY;AAAA,EAC9B,OAAO,MAAM,aAAa,cAAc,SAAS,CAAC,IAAI,IAAI;AAAA;",
+  "mappings": ";AAOO,IAAM,yBAAiD;AAAA,EAC7D,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AACN;AAGO,IAAM,eAAe;AAAA,EAC3B,UAAU;AAAA,EACV,KAAK;AACN;AAiBO,IAAM,qBAA6B;AAGnC,SAAS,YAAY,GAAW;AAAA,EACtC,MAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAAA,EACvD,IAAI,MAAM;AAAA,EACV,WAAW,KAAK;AAAA,IAAO,OAAO,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAAA,EAC5D,OAAO,OAAO;AAAA;AAGf,IAAM,gBAAgB;AACtB,IAAM,kBAAkB;AACxB,IAAM,uBAAuB;AAMtB,SAAS,WAAW,CAAC,QAAkD;AAAA,EAC7E,MAAM,MAA+B,CAAC;AAAA,EACtC,YAAY,KAAK,UAAU,QAAQ;AAAA,IAClC,IAAI,cAAc,KAAK,GAAG;AAAA,MAAG;AAAA,IAC7B,IAAI,OAAO,MAAM,MAAM,GAAG,eAAe;AAAA,EAC1C;AAAA,EACA,IAAI,KAAK,UAAU,GAAG,EAAE,SAAS,sBAAsB;AAAA,IACtD,OAAO,EAAE,YAAY,MAAM,MAAM,OAAO,KAAK,GAAG,EAAE;AAAA,EACnD;AAAA,EACA,OAAO;AAAA;AASD,SAAS,gBAAgB,CAC/B,MACA,MAMiC;AAAA,EACjC,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,GAAG;AAAA,IACrE,OAAO;AAAA,EACR;AAAA,EACA,IAAI,EAAE,WAAW;AAAA,IAAO,OAAO;AAAA,EAC/B,MAAM,MAAM;AAAA,EACZ,MAAM,OAAgC,KAAK,KAAK,YAAY,KAAK,UAAU;AAAA,EAC3E,IAAI,OAAO,IAAI,SAAS,UAAU;AAAA,IACjC,KAAK,OAAO,uBAAuB,KAAK,WAAW;AAAA,EACpD;AAAA,EACA,IAAI,KAAK,oBAAoB,IAAI,aAAa,WAAW;AAAA,IACxD,KAAK,WAAW,EAAE,KAAK,KAAK,YAAY;AAAA,EACzC;AAAA,EACA,OAAO;AAAA;AAGR,IAAM,gBAAgB,CAAC,OAAO,OAAO,SAAS;AAGvC,SAAS,eAAe,CAAC,QAA2C;AAAA,EAC1E,MAAM,IAAI,QAAQ,YAAY;AAAA,EAC9B,OAAO,MAAM,aAAa,cAAc,SAAS,CAAC,IAAI,IAAI;AAAA;",
   "debugId": "5A36C709A44A1A2864756E2164756E21",
   "names": []
 }

package/dist/src/errors.d.ts

@@ -9,6 +9,7 @@ declare const ErrorCodes: {
 	readonly VERSION_CONFLICT: "VERSION_CONFLICT"
 	readonly NOT_FOUND: "NOT_FOUND"
 	readonly KEY_ROTATED: "KEY_ROTATED"
+	readonly KEY_REVOKED: "KEY_REVOKED"
 	readonly TENANT_SUSPENDED: "TENANT_SUSPENDED"
 	readonly NO_TENANT_FOR_PROJECT: "NO_TENANT_FOR_PROJECT"
 	readonly INSTANCE_EXISTS: "INSTANCE_EXISTS"
@@ -48,6 +49,11 @@ declare class AuthenticationError extends SecondLayerError {
 declare class AuthorizationError extends SecondLayerError {
 	constructor(message: string, details?: Record<string, unknown>);
 }
+/** A real account key that was revoked. Distinct from an unknown key so the
+*  caller (and the account's error log) can tell which one it is. */
+declare class ApiKeyRevokedError extends SecondLayerError {
+	constructor();
+}
 declare class RateLimitError extends SecondLayerError {
 	constructor(message: string);
 }
@@ -77,4 +83,4 @@ declare class TenantSuspendedError extends SecondLayerError {
 *  (avoids cross-bundle instanceof failures from bunup class duplication). */
 declare const CODE_TO_STATUS: Record<string, 400 | 401 | 402 | 403 | 404 | 409 | 415 | 422 | 423 | 429 | 503>;
 declare function getErrorMessage(err: unknown): string;
-export { AuthenticationError, AuthorizationError, CODE_TO_STATUS, DatabaseError, ErrorCode, ErrorCodes, ForbiddenError, KeyRotatedError, NotFoundError, PaymentRequiredError, RateLimitError, SecondLayerError, TenantSuspendedError, ValidationError, VersionConflictError, getErrorMessage };
+export { ApiKeyRevokedError, AuthenticationError, AuthorizationError, CODE_TO_STATUS, DatabaseError, ErrorCode, ErrorCodes, ForbiddenError, KeyRotatedError, NotFoundError, PaymentRequiredError, RateLimitError, SecondLayerError, TenantSuspendedError, ValidationError, VersionConflictError, getErrorMessage };

package/dist/src/errors.js

@@ -10,6 +10,7 @@ var ErrorCodes = {
   VERSION_CONFLICT: "VERSION_CONFLICT",
   NOT_FOUND: "NOT_FOUND",
   KEY_ROTATED: "KEY_ROTATED",
+  KEY_REVOKED: "KEY_REVOKED",
   TENANT_SUSPENDED: "TENANT_SUSPENDED",
   NO_TENANT_FOR_PROJECT: "NO_TENANT_FOR_PROJECT",
   INSTANCE_EXISTS: "INSTANCE_EXISTS"
@@ -69,6 +70,14 @@ class AuthorizationError extends SecondLayerError {
   }
 }
 
+class ApiKeyRevokedError extends SecondLayerError {
+  constructor() {
+    super("KEY_REVOKED", "API key has been revoked", undefined, {
+      hint: "Make a new key at https://secondlayer.tools/account/keys and replace the revoked one wherever it is configured."
+    });
+  }
+}
+
 class RateLimitError extends SecondLayerError {
   constructor(message) {
     super("RATE_LIMIT_ERROR", message);
@@ -118,6 +127,7 @@ var CODE_TO_STATUS = {
   NOT_FOUND: 404,
   VALIDATION_ERROR: 400,
   KEY_ROTATED: 401,
+  KEY_REVOKED: 401,
   TENANT_SUSPENDED: 423,
   NO_TENANT_FOR_PROJECT: 404,
   INSTANCE_EXISTS: 409,
@@ -129,6 +139,7 @@ function getErrorMessage(err) {
   return err instanceof Error ? err.message : String(err);
 }
 export {
+  ApiKeyRevokedError,
   AuthenticationError,
   AuthorizationError,
   CODE_TO_STATUS,
@@ -146,5 +157,5 @@ export {
   getErrorMessage
 };
 
-//# debugId=342CE76CCD6FF26D64756E2164756E21
+//# debugId=7D27C3B75AB151ED64756E2164756E21
 //# sourceMappingURL=errors.js.map

package/dist/src/errors.js.map

@@ -2,9 +2,9 @@
   "version": 3,
   "sources": ["../src/errors.ts"],
   "sourcesContent": [
-    "export const ErrorCodes = {\n\tVALIDATION_ERROR: \"VALIDATION_ERROR\",\n\tDATABASE_ERROR: \"DATABASE_ERROR\",\n\tAUTHENTICATION_ERROR: \"AUTHENTICATION_ERROR\",\n\tAUTHORIZATION_ERROR: \"AUTHORIZATION_ERROR\",\n\tRATE_LIMIT_ERROR: \"RATE_LIMIT_ERROR\",\n\tPAYMENT_REQUIRED: \"PAYMENT_REQUIRED\",\n\tFORBIDDEN: \"FORBIDDEN\",\n\tVERSION_CONFLICT: \"VERSION_CONFLICT\",\n\tNOT_FOUND: \"NOT_FOUND\",\n\t// Tenant lifecycle (CLI surfaces these verbatim)\n\tKEY_ROTATED: \"KEY_ROTATED\",\n\tTENANT_SUSPENDED: \"TENANT_SUSPENDED\",\n\tNO_TENANT_FOR_PROJECT: \"NO_TENANT_FOR_PROJECT\",\n\tINSTANCE_EXISTS: \"INSTANCE_EXISTS\",\n} as const;\n\nexport type ErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];\n\n/** Base error class for all Secondlayer errors. */\nexport class SecondLayerError extends Error {\n\tpublic code: ErrorCode;\n\tpublic override cause?: unknown;\n\t/** Optional structured payload merged into the HTTP error body (machine-readable hints). */\n\tpublic details?: Record<string, unknown>;\n\n\tconstructor(\n\t\tcode: ErrorCode,\n\t\tmessage: string,\n\t\tcause?: unknown,\n\t\tdetails?: Record<string, unknown>,\n\t) {\n\t\tsuper(message);\n\t\tthis.code = code;\n\t\tthis.cause = cause;\n\t\tthis.details = details;\n\t\tthis.name = this.constructor.name;\n\t\tError.captureStackTrace?.(this, this.constructor);\n\t}\n\n\ttoJSON(): {\n\t\tname: string;\n\t\tcode: string;\n\t\tmessage: string;\n\t\tstack: string | undefined;\n\t\tcause: unknown;\n\t\tdetails: Record<string, unknown> | undefined;\n\t} {\n\t\treturn {\n\t\t\tname: this.name,\n\t\t\tcode: this.code,\n\t\t\tmessage: this.message,\n\t\t\tstack: this.stack,\n\t\t\tcause: this.cause,\n\t\t\tdetails: this.details,\n\t\t};\n\t}\n}\n\nexport class NotFoundError extends SecondLayerError {\n\tconstructor(message: string) {\n\t\tsuper(\"NOT_FOUND\", message);\n\t}\n}\n\nexport class ValidationError extends SecondLayerError {\n\tconstructor(message: string, cause?: unknown) {\n\t\tsuper(\"VALIDATION_ERROR\", message, cause);\n\t}\n}\n\nexport class DatabaseError extends SecondLayerError {\n\tconstructor(message: string, cause?: unknown) {\n\t\tsuper(\"DATABASE_ERROR\", message, cause);\n\t}\n}\n\nexport class AuthenticationError extends SecondLayerError {\n\t/** `details` is merged into the HTTP body — use it to carry the recovery\n\t *  hint (which credential, where it comes from) instead of a bare \"invalid\n\t *  key\" the caller cannot act on. */\n\tconstructor(message: string, details?: Record<string, unknown>) {\n\t\tsuper(\"AUTHENTICATION_ERROR\", message, undefined, details);\n\t}\n}\n\nexport class AuthorizationError extends SecondLayerError {\n\tconstructor(message: string, details?: Record<string, unknown>) {\n\t\tsuper(\"AUTHORIZATION_ERROR\", message, undefined, details);\n\t}\n}\n\nexport class RateLimitError extends SecondLayerError {\n\tconstructor(message: string) {\n\t\tsuper(\"RATE_LIMIT_ERROR\", message);\n\t}\n}\n\n/**\n * HTTP 402: insufficient credits. Carries a machine-readable reason (e.g.\n * `insufficient_credits`, `UPGRADE_REQUIRED`) in `details` so the global\n * error handler emits it in the body, alongside a top-up hint/link.\n */\nexport class PaymentRequiredError extends SecondLayerError {\n\tconstructor(message: string, details?: Record<string, unknown>) {\n\t\tsuper(\"PAYMENT_REQUIRED\", message, undefined, details);\n\t}\n}\n\nexport class ForbiddenError extends SecondLayerError {\n\tconstructor(message = \"Forbidden\") {\n\t\tsuper(\"FORBIDDEN\", message);\n\t}\n}\n\nexport class VersionConflictError extends SecondLayerError {\n\tpublic currentVersion: string;\n\tpublic expectedVersion: string;\n\n\tconstructor(currentVersion: string, expectedVersion: string) {\n\t\tsuper(\n\t\t\t\"VERSION_CONFLICT\",\n\t\t\t`Version conflict: expected ${expectedVersion}, current ${currentVersion}`,\n\t\t);\n\t\tthis.currentVersion = currentVersion;\n\t\tthis.expectedVersion = expectedVersion;\n\t}\n}\n\nexport class KeyRotatedError extends SecondLayerError {\n\tconstructor(message = \"Token has been rotated\") {\n\t\tsuper(\"KEY_ROTATED\", message);\n\t}\n}\n\nexport class TenantSuspendedError extends SecondLayerError {\n\tconstructor(message = \"Instance is suspended\") {\n\t\tsuper(\"TENANT_SUSPENDED\", message);\n\t}\n}\n\n/** Error code → HTTP status. Used by API middleware for code-based matching\n *  (avoids cross-bundle instanceof failures from bunup class duplication). */\n// String literal map — codes don't have to be in the central ErrorCode\n// enum (route-local error classes can supply any code; we just map the\n// HTTP status here). This keeps cross-bundle instanceof failures out of\n// the equation.\nexport const CODE_TO_STATUS: Record<\n\tstring,\n\t400 | 401 | 402 | 403 | 404 | 409 | 415 | 422 | 423 | 429 | 503\n> = {\n\t// The chain plane has no data yet — a fresh self-host install before the\n\t// first block lands. Retryable, and not the operator's mistake, so it is a\n\t// 503 with a name rather than an opaque 500.\n\tCHAIN_DATA_UNAVAILABLE: 503,\n\tAUTHENTICATION_ERROR: 401,\n\tAUTHORIZATION_ERROR: 403,\n\tPAYMENT_REQUIRED: 402,\n\tRATE_LIMIT_ERROR: 429,\n\tFORBIDDEN: 403,\n\tNOT_FOUND: 404,\n\tVALIDATION_ERROR: 400,\n\tKEY_ROTATED: 401,\n\tTENANT_SUSPENDED: 423,\n\tNO_TENANT_FOR_PROJECT: 404,\n\tINSTANCE_EXISTS: 409,\n\tSUBGRAPH_NOT_FOUND: 404,\n\tGHOST_KEY_READ_ONLY: 403,\n\t// A write that did not declare `Content-Type: application/json`. Shaped\n\t// like something a browser could have forged cross-origin without a CORS\n\t// preflight — see the API's `middleware/csrf.ts`.\n\tUNSUPPORTED_MEDIA_TYPE: 415,\n} as const;\n\nexport function getErrorMessage(err: unknown): string {\n\treturn err instanceof Error ? err.message : String(err);\n}\n"
+    "export const ErrorCodes = {\n\tVALIDATION_ERROR: \"VALIDATION_ERROR\",\n\tDATABASE_ERROR: \"DATABASE_ERROR\",\n\tAUTHENTICATION_ERROR: \"AUTHENTICATION_ERROR\",\n\tAUTHORIZATION_ERROR: \"AUTHORIZATION_ERROR\",\n\tRATE_LIMIT_ERROR: \"RATE_LIMIT_ERROR\",\n\tPAYMENT_REQUIRED: \"PAYMENT_REQUIRED\",\n\tFORBIDDEN: \"FORBIDDEN\",\n\tVERSION_CONFLICT: \"VERSION_CONFLICT\",\n\tNOT_FOUND: \"NOT_FOUND\",\n\t// Tenant lifecycle (CLI surfaces these verbatim)\n\tKEY_ROTATED: \"KEY_ROTATED\",\n\tKEY_REVOKED: \"KEY_REVOKED\",\n\tTENANT_SUSPENDED: \"TENANT_SUSPENDED\",\n\tNO_TENANT_FOR_PROJECT: \"NO_TENANT_FOR_PROJECT\",\n\tINSTANCE_EXISTS: \"INSTANCE_EXISTS\",\n} as const;\n\nexport type ErrorCode = (typeof ErrorCodes)[keyof typeof ErrorCodes];\n\n/** Base error class for all Secondlayer errors. */\nexport class SecondLayerError extends Error {\n\tpublic code: ErrorCode;\n\tpublic override cause?: unknown;\n\t/** Optional structured payload merged into the HTTP error body (machine-readable hints). */\n\tpublic details?: Record<string, unknown>;\n\n\tconstructor(\n\t\tcode: ErrorCode,\n\t\tmessage: string,\n\t\tcause?: unknown,\n\t\tdetails?: Record<string, unknown>,\n\t) {\n\t\tsuper(message);\n\t\tthis.code = code;\n\t\tthis.cause = cause;\n\t\tthis.details = details;\n\t\tthis.name = this.constructor.name;\n\t\tError.captureStackTrace?.(this, this.constructor);\n\t}\n\n\ttoJSON(): {\n\t\tname: string;\n\t\tcode: string;\n\t\tmessage: string;\n\t\tstack: string | undefined;\n\t\tcause: unknown;\n\t\tdetails: Record<string, unknown> | undefined;\n\t} {\n\t\treturn {\n\t\t\tname: this.name,\n\t\t\tcode: this.code,\n\t\t\tmessage: this.message,\n\t\t\tstack: this.stack,\n\t\t\tcause: this.cause,\n\t\t\tdetails: this.details,\n\t\t};\n\t}\n}\n\nexport class NotFoundError extends SecondLayerError {\n\tconstructor(message: string) {\n\t\tsuper(\"NOT_FOUND\", message);\n\t}\n}\n\nexport class ValidationError extends SecondLayerError {\n\tconstructor(message: string, cause?: unknown) {\n\t\tsuper(\"VALIDATION_ERROR\", message, cause);\n\t}\n}\n\nexport class DatabaseError extends SecondLayerError {\n\tconstructor(message: string, cause?: unknown) {\n\t\tsuper(\"DATABASE_ERROR\", message, cause);\n\t}\n}\n\nexport class AuthenticationError extends SecondLayerError {\n\t/** `details` is merged into the HTTP body — use it to carry the recovery\n\t *  hint (which credential, where it comes from) instead of a bare \"invalid\n\t *  key\" the caller cannot act on. */\n\tconstructor(message: string, details?: Record<string, unknown>) {\n\t\tsuper(\"AUTHENTICATION_ERROR\", message, undefined, details);\n\t}\n}\n\nexport class AuthorizationError extends SecondLayerError {\n\tconstructor(message: string, details?: Record<string, unknown>) {\n\t\tsuper(\"AUTHORIZATION_ERROR\", message, undefined, details);\n\t}\n}\n\n/** A real account key that was revoked. Distinct from an unknown key so the\n *  caller (and the account's error log) can tell which one it is. */\nexport class ApiKeyRevokedError extends SecondLayerError {\n\tconstructor() {\n\t\tsuper(\"KEY_REVOKED\", \"API key has been revoked\", undefined, {\n\t\t\thint: \"Make a new key at https://secondlayer.tools/account/keys and replace the revoked one wherever it is configured.\",\n\t\t});\n\t}\n}\n\nexport class RateLimitError extends SecondLayerError {\n\tconstructor(message: string) {\n\t\tsuper(\"RATE_LIMIT_ERROR\", message);\n\t}\n}\n\n/**\n * HTTP 402: insufficient credits. Carries a machine-readable reason (e.g.\n * `insufficient_credits`, `UPGRADE_REQUIRED`) in `details` so the global\n * error handler emits it in the body, alongside a top-up hint/link.\n */\nexport class PaymentRequiredError extends SecondLayerError {\n\tconstructor(message: string, details?: Record<string, unknown>) {\n\t\tsuper(\"PAYMENT_REQUIRED\", message, undefined, details);\n\t}\n}\n\nexport class ForbiddenError extends SecondLayerError {\n\tconstructor(message = \"Forbidden\") {\n\t\tsuper(\"FORBIDDEN\", message);\n\t}\n}\n\nexport class VersionConflictError extends SecondLayerError {\n\tpublic currentVersion: string;\n\tpublic expectedVersion: string;\n\n\tconstructor(currentVersion: string, expectedVersion: string) {\n\t\tsuper(\n\t\t\t\"VERSION_CONFLICT\",\n\t\t\t`Version conflict: expected ${expectedVersion}, current ${currentVersion}`,\n\t\t);\n\t\tthis.currentVersion = currentVersion;\n\t\tthis.expectedVersion = expectedVersion;\n\t}\n}\n\nexport class KeyRotatedError extends SecondLayerError {\n\tconstructor(message = \"Token has been rotated\") {\n\t\tsuper(\"KEY_ROTATED\", message);\n\t}\n}\n\nexport class TenantSuspendedError extends SecondLayerError {\n\tconstructor(message = \"Instance is suspended\") {\n\t\tsuper(\"TENANT_SUSPENDED\", message);\n\t}\n}\n\n/** Error code → HTTP status. Used by API middleware for code-based matching\n *  (avoids cross-bundle instanceof failures from bunup class duplication). */\n// String literal map — codes don't have to be in the central ErrorCode\n// enum (route-local error classes can supply any code; we just map the\n// HTTP status here). This keeps cross-bundle instanceof failures out of\n// the equation.\nexport const CODE_TO_STATUS: Record<\n\tstring,\n\t400 | 401 | 402 | 403 | 404 | 409 | 415 | 422 | 423 | 429 | 503\n> = {\n\t// The chain plane has no data yet — a fresh self-host install before the\n\t// first block lands. Retryable, and not the operator's mistake, so it is a\n\t// 503 with a name rather than an opaque 500.\n\tCHAIN_DATA_UNAVAILABLE: 503,\n\tAUTHENTICATION_ERROR: 401,\n\tAUTHORIZATION_ERROR: 403,\n\tPAYMENT_REQUIRED: 402,\n\tRATE_LIMIT_ERROR: 429,\n\tFORBIDDEN: 403,\n\tNOT_FOUND: 404,\n\tVALIDATION_ERROR: 400,\n\tKEY_ROTATED: 401,\n\tKEY_REVOKED: 401,\n\tTENANT_SUSPENDED: 423,\n\tNO_TENANT_FOR_PROJECT: 404,\n\tINSTANCE_EXISTS: 409,\n\tSUBGRAPH_NOT_FOUND: 404,\n\tGHOST_KEY_READ_ONLY: 403,\n\t// A write that did not declare `Content-Type: application/json`. Shaped\n\t// like something a browser could have forged cross-origin without a CORS\n\t// preflight — see the API's `middleware/csrf.ts`.\n\tUNSUPPORTED_MEDIA_TYPE: 415,\n} as const;\n\nexport function getErrorMessage(err: unknown): string {\n\treturn err instanceof Error ? err.message : String(err);\n}\n"
   ],
-  "mappings": ";AAAO,IAAM,aAAa;AAAA,EACzB,kBAAkB;AAAA,EAClB,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,qBAAqB;AAAA,EACrB,kBAAkB;AAAA,EAClB,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,WAAW;AAAA,EAEX,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,uBAAuB;AAAA,EACvB,iBAAiB;AAClB;AAAA;AAKO,MAAM,yBAAyB,MAAM;AAAA,EACpC;AAAA,EACS;AAAA,EAET;AAAA,EAEP,WAAW,CACV,MACA,SACA,OACA,SACC;AAAA,IACD,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA,IACZ,KAAK,QAAQ;AAAA,IACb,KAAK,UAAU;AAAA,IACf,KAAK,OAAO,KAAK,YAAY;AAAA,IAC7B,MAAM,oBAAoB,MAAM,KAAK,WAAW;AAAA;AAAA,EAGjD,MAAM,GAOJ;AAAA,IACD,OAAO;AAAA,MACN,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IACf;AAAA;AAEF;AAAA;AAEO,MAAM,sBAAsB,iBAAiB;AAAA,EACnD,WAAW,CAAC,SAAiB;AAAA,IAC5B,MAAM,aAAa,OAAO;AAAA;AAE5B;AAAA;AAEO,MAAM,wBAAwB,iBAAiB;AAAA,EACrD,WAAW,CAAC,SAAiB,OAAiB;AAAA,IAC7C,MAAM,oBAAoB,SAAS,KAAK;AAAA;AAE1C;AAAA;AAEO,MAAM,sBAAsB,iBAAiB;AAAA,EACnD,WAAW,CAAC,SAAiB,OAAiB;AAAA,IAC7C,MAAM,kBAAkB,SAAS,KAAK;AAAA;AAExC;AAAA;AAEO,MAAM,4BAA4B,iBAAiB;AAAA,EAIzD,WAAW,CAAC,SAAiB,SAAmC;AAAA,IAC/D,MAAM,wBAAwB,SAAS,WAAW,OAAO;AAAA;AAE3D;AAAA;AAEO,MAAM,2BAA2B,iBAAiB;AAAA,EACxD,WAAW,CAAC,SAAiB,SAAmC;AAAA,IAC/D,MAAM,uBAAuB,SAAS,WAAW,OAAO;AAAA;AAE1D;AAAA;AAEO,MAAM,uBAAuB,iBAAiB;AAAA,EACpD,WAAW,CAAC,SAAiB;AAAA,IAC5B,MAAM,oBAAoB,OAAO;AAAA;AAEnC;AAAA;AAOO,MAAM,6BAA6B,iBAAiB;AAAA,EAC1D,WAAW,CAAC,SAAiB,SAAmC;AAAA,IAC/D,MAAM,oBAAoB,SAAS,WAAW,OAAO;AAAA;AAEvD;AAAA;AAEO,MAAM,uBAAuB,iBAAiB;AAAA,EACpD,WAAW,CAAC,UAAU,aAAa;AAAA,IAClC,MAAM,aAAa,OAAO;AAAA;AAE5B;AAAA;AAEO,MAAM,6BAA6B,iBAAiB;AAAA,EACnD;AAAA,EACA;AAAA,EAEP,WAAW,CAAC,gBAAwB,iBAAyB;AAAA,IAC5D,MACC,oBACA,8BAA8B,4BAA4B,gBAC3D;AAAA,IACA,KAAK,iBAAiB;AAAA,IACtB,KAAK,kBAAkB;AAAA;AAEzB;AAAA;AAEO,MAAM,wBAAwB,iBAAiB;AAAA,EACrD,WAAW,CAAC,UAAU,0BAA0B;AAAA,IAC/C,MAAM,eAAe,OAAO;AAAA;AAE9B;AAAA;AAEO,MAAM,6BAA6B,iBAAiB;AAAA,EAC1D,WAAW,CAAC,UAAU,yBAAyB;AAAA,IAC9C,MAAM,oBAAoB,OAAO;AAAA;AAEnC;AAQO,IAAM,iBAGT;AAAA,EAIH,wBAAwB;AAAA,EACxB,sBAAsB;AAAA,EACtB,qBAAqB;AAAA,EACrB,kBAAkB;AAAA,EAClB,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,uBAAuB;AAAA,EACvB,iBAAiB;AAAA,EACjB,oBAAoB;AAAA,EACpB,qBAAqB;AAAA,EAIrB,wBAAwB;AACzB;AAEO,SAAS,eAAe,CAAC,KAAsB;AAAA,EACrD,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA;",
-  "debugId": "342CE76CCD6FF26D64756E2164756E21",
+  "mappings": ";AAAO,IAAM,aAAa;AAAA,EACzB,kBAAkB;AAAA,EAClB,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,qBAAqB;AAAA,EACrB,kBAAkB;AAAA,EAClB,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,WAAW;AAAA,EAEX,aAAa;AAAA,EACb,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,uBAAuB;AAAA,EACvB,iBAAiB;AAClB;AAAA;AAKO,MAAM,yBAAyB,MAAM;AAAA,EACpC;AAAA,EACS;AAAA,EAET;AAAA,EAEP,WAAW,CACV,MACA,SACA,OACA,SACC;AAAA,IACD,MAAM,OAAO;AAAA,IACb,KAAK,OAAO;AAAA,IACZ,KAAK,QAAQ;AAAA,IACb,KAAK,UAAU;AAAA,IACf,KAAK,OAAO,KAAK,YAAY;AAAA,IAC7B,MAAM,oBAAoB,MAAM,KAAK,WAAW;AAAA;AAAA,EAGjD,MAAM,GAOJ;AAAA,IACD,OAAO;AAAA,MACN,MAAM,KAAK;AAAA,MACX,MAAM,KAAK;AAAA,MACX,SAAS,KAAK;AAAA,MACd,OAAO,KAAK;AAAA,MACZ,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,IACf;AAAA;AAEF;AAAA;AAEO,MAAM,sBAAsB,iBAAiB;AAAA,EACnD,WAAW,CAAC,SAAiB;AAAA,IAC5B,MAAM,aAAa,OAAO;AAAA;AAE5B;AAAA;AAEO,MAAM,wBAAwB,iBAAiB;AAAA,EACrD,WAAW,CAAC,SAAiB,OAAiB;AAAA,IAC7C,MAAM,oBAAoB,SAAS,KAAK;AAAA;AAE1C;AAAA;AAEO,MAAM,sBAAsB,iBAAiB;AAAA,EACnD,WAAW,CAAC,SAAiB,OAAiB;AAAA,IAC7C,MAAM,kBAAkB,SAAS,KAAK;AAAA;AAExC;AAAA;AAEO,MAAM,4BAA4B,iBAAiB;AAAA,EAIzD,WAAW,CAAC,SAAiB,SAAmC;AAAA,IAC/D,MAAM,wBAAwB,SAAS,WAAW,OAAO;AAAA;AAE3D;AAAA;AAEO,MAAM,2BAA2B,iBAAiB;AAAA,EACxD,WAAW,CAAC,SAAiB,SAAmC;AAAA,IAC/D,MAAM,uBAAuB,SAAS,WAAW,OAAO;AAAA;AAE1D;AAAA;AAIO,MAAM,2BAA2B,iBAAiB;AAAA,EACxD,WAAW,GAAG;AAAA,IACb,MAAM,eAAe,4BAA4B,WAAW;AAAA,MAC3D,MAAM;AAAA,IACP,CAAC;AAAA;AAEH;AAAA;AAEO,MAAM,uBAAuB,iBAAiB;AAAA,EACpD,WAAW,CAAC,SAAiB;AAAA,IAC5B,MAAM,oBAAoB,OAAO;AAAA;AAEnC;AAAA;AAOO,MAAM,6BAA6B,iBAAiB;AAAA,EAC1D,WAAW,CAAC,SAAiB,SAAmC;AAAA,IAC/D,MAAM,oBAAoB,SAAS,WAAW,OAAO;AAAA;AAEvD;AAAA;AAEO,MAAM,uBAAuB,iBAAiB;AAAA,EACpD,WAAW,CAAC,UAAU,aAAa;AAAA,IAClC,MAAM,aAAa,OAAO;AAAA;AAE5B;AAAA;AAEO,MAAM,6BAA6B,iBAAiB;AAAA,EACnD;AAAA,EACA;AAAA,EAEP,WAAW,CAAC,gBAAwB,iBAAyB;AAAA,IAC5D,MACC,oBACA,8BAA8B,4BAA4B,gBAC3D;AAAA,IACA,KAAK,iBAAiB;AAAA,IACtB,KAAK,kBAAkB;AAAA;AAEzB;AAAA;AAEO,MAAM,wBAAwB,iBAAiB;AAAA,EACrD,WAAW,CAAC,UAAU,0BAA0B;AAAA,IAC/C,MAAM,eAAe,OAAO;AAAA;AAE9B;AAAA;AAEO,MAAM,6BAA6B,iBAAiB;AAAA,EAC1D,WAAW,CAAC,UAAU,yBAAyB;AAAA,IAC9C,MAAM,oBAAoB,OAAO;AAAA;AAEnC;AAQO,IAAM,iBAGT;AAAA,EAIH,wBAAwB;AAAA,EACxB,sBAAsB;AAAA,EACtB,qBAAqB;AAAA,EACrB,kBAAkB;AAAA,EAClB,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,WAAW;AAAA,EACX,kBAAkB;AAAA,EAClB,aAAa;AAAA,EACb,aAAa;AAAA,EACb,kBAAkB;AAAA,EAClB,uBAAuB;AAAA,EACvB,iBAAiB;AAAA,EACjB,oBAAoB;AAAA,EACpB,qBAAqB;AAAA,EAIrB,wBAAwB;AACzB;AAEO,SAAS,eAAe,CAAC,KAAsB;AAAA,EACrD,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA;",
+  "debugId": "7D27C3B75AB151ED64756E2164756E21",
   "names": []
 }

package/dist/src/index.d.ts

@@ -524,6 +524,9 @@ interface AccountsTable {
 	email: string | null;
 	/** True for anonymous self-serve accounts until claimed via magic link. */
 	ghost: Generated<boolean>;
+	/** First-party service account: usage priced at $0, never gated on
+	*  credits. Set by ops only. */
+	internal: Generated<boolean>;
 	/** Stacks principal owning a wallet-ghost account. */
 	wallet_principal: string | null;
 	display_name: string | null;
@@ -1482,6 +1485,8 @@ interface ApiFailedRequestsTable {
 	message: Generated<string>;
 	query: Record<string, unknown>;
 	origin: string | null;
+	/** Revoked account key the request presented (`KEY_REVOKED` only). */
+	api_key_id: string | null;
 	created_at: Generated<Date>;
 }
 type ApiFailedRequest = Selectable<ApiFailedRequestsTable>;
@@ -2678,6 +2683,7 @@ declare const ErrorCodes: {
 	readonly VERSION_CONFLICT: "VERSION_CONFLICT"
 	readonly NOT_FOUND: "NOT_FOUND"
 	readonly KEY_ROTATED: "KEY_ROTATED"
+	readonly KEY_REVOKED: "KEY_REVOKED"
 	readonly TENANT_SUSPENDED: "TENANT_SUSPENDED"
 	readonly NO_TENANT_FOR_PROJECT: "NO_TENANT_FOR_PROJECT"
 	readonly INSTANCE_EXISTS: "INSTANCE_EXISTS"
@@ -2717,6 +2723,11 @@ declare class AuthenticationError extends SecondLayerError {
 declare class AuthorizationError extends SecondLayerError {
 	constructor(message: string, details?: Record<string, unknown>);
 }
+/** A real account key that was revoked. Distinct from an unknown key so the
+*  caller (and the account's error log) can tell which one it is. */
+declare class ApiKeyRevokedError extends SecondLayerError {
+	constructor();
+}
 declare class RateLimitError extends SecondLayerError {
 	constructor(message: string);
 }
@@ -3651,4 +3662,4 @@ declare function publicKeyPemFromPrivate(privateKeyPem: string): string;
 declare function ed25519KeyId(publicKeyPem: string): string;
 declare function signEd25519(payload: string, privateKey: KeyObject): string;
 declare function verifyEd25519(payload: string, signatureBase64: string, publicKey: KeyObject): boolean;
-export { Account, AccountBalanceAlerts, AccountBalanceAlertsTable, AccountCredits, AccountCreditsTable, AccountSpendCap, AccountSpendCapsTable, AccountsTable, ApiFailedRequest, ApiFailedRequestsTable, ApiKey, ApiKeysTable, ApiRequestLogRow, ApiRequestLogTable, ArchiveFetch, ArchiveFetchesTable, AuthenticationError, AuthorizationError, BILLING_PAUSED_PREFIX, Block, BlocksTable, BnsMarketplaceAction, BnsMarketplaceEventsTable, BnsNameEventTopic, BnsNameEventsTable, BnsNamesTable, BnsNamespaceEventStatus, BnsNamespaceEventsTable, BnsNamespacesTable, BurnBlockRewardSlotsTable, BurnBlockRewardsTable, CHAIN_TRIGGER_FIELDS, CHAIN_TRIGGER_TYPES, CODE_TO_STATUS, ChainApplyDeliveryOf, ChainApplyEnvelope, ChainApplyEnvelopeOf, ChainEventEnvelope, ChainFtBurnData, ChainFtMintData, ChainFtTransferData, ChainNftBurnData, ChainNftMintData, ChainNftTransferData, ChainPrintEventData, ChainReadCacheTable, ChainReorgOrphanedEntry, ChainReorgRollbackDelivery, ChainReorgRollbackEnvelope, ChainReorgsTable, ChainStxBurnData, ChainStxLockData, ChainStxMintData, ChainStxTransferData, ChainTestDelivery, ChainTxLevelEvent, ChainWebhookDelivery, ChainWebhookEnvelope, CliDeviceLogin, CliDeviceLoginStatus, CliDeviceLoginsTable, ContactRequest, ContactRequestsTable, Contract, ContractsTable, CoverageSegmentsTable, CreateWebhookRequest, CreateWebhookRequestSchema, CreateWebhookResponse, DB_TO_STREAMS_EVENT_TYPE, DECODED_EVENT_TYPES2 as DECODED_EVENT_TYPES, DEFAULT_BTC_CONFIRMATIONS, Database, DatabaseError, DbPlane, DbReadRow, DbSplitStatus, DeadLetterEventsTable, DeadRow, DecodedEventType2 as DecodedEventType, DecodedEventsTable, DecoderCheckpointsTable, DeliveryRow, DeploySubgraphRequest, DeploySubgraphRequestSchema, DeploySubgraphResponse, EMPTY_RANGE_EVENT_INDEX_SENTINEL, Env, ErrorCode, ErrorCodes, Event, EventsArchiveTable, EventsTable, FailureClass, FailureUnit, FeedbackTicket, FeedbackTicketsTable, ForbiddenError, HealthHour, HealthSnapshotPoint, INSIGHT_SEVERITIES, IndexColumn, IndexColumnType, IndexPrimaryKey, IndexProgress, IndexProgressTable, InsertAccount, InsertAccountBalanceAlerts, InsertAccountCredits, InsertAccountSpendCap, InsertApiFailedRequest, InsertApiKey, InsertApiRequestLogRow, InsertArchiveFetch, InsertBlock, InsertContactRequest, InsertContract, InsertEvent, InsertFeedbackTicket, InsertIndexProgress, InsertMagicLink, InsertMempoolTransaction, InsertSession, InsertStateWrite, InsertSubgraph, InsertSubgraphGap, InsertSubgraphHealthSnapshot, InsertSubgraphOperation, InsertTransaction, InsertUsageLedgerRow, InsertVmEvent, InsertWaitlistSignup, InsertWebhook, InsertWebhookDelivery, InsertWebhookOutbox, Insight, InsightEvidence, InsightEvidenceSchema, InsightListResponse, InsightListResponseSchema, InsightMutesTable, InsightResourceKind, InsightResourceKindSchema, InsightSchema, InsightSeverity, InsightSeveritySchema, InsightsTable, InstancesTable, KeyRotatedError, MagicLink, MagicLinksTable, MempoolTransaction, MempoolTransactionsTable, MigrationRole, NativeClock, NotFoundError, NumericAsText, ObserverJournalStatus, ObserverJournalTable, OutboxStatus, ParsedCreateWebhookRequest, ParsedReplayWebhookRequest, ParsedUpdateWebhookRequest, PaymentRequiredError, PendingForkBlocksTable, Pox4CallsTable, Pox4FunctionName, Pox5CycleSignersTable, Pox5CyclesTable, Pox5EventTopic, Pox5EventsTable, ProcessedStripeEventsTable, RUNE_EVENT_TYPES, RateLimitError, ReindexResponse, RepairMode, ReplayResult, ReplayWebhookRequest, ReplayWebhookRequestSchema, RetryState, RotateSecretResponse, RunStatus, RuneApplyDeliveryOf, RuneApplyEnvelope, RuneEventType, SEVERITY_ORDER, SOURCE_READ_COLUMNS, SOURCE_READ_PKS, SOURCE_READ_TYPES, STREAMS_DB_EVENT_TYPES, STREAMS_EVENT_TYPES, STREAMS_TO_DB_EVENT_TYPES, SbtcDepositEvent, SbtcEventTopic, SbtcEventsTable, SbtcSettlementsTable, SbtcTokenEventType, SbtcTokenEventsTable, SbtcWithdrawalEvent, SbtcWithdrawalSweptConfirmedEvent, SecondLayerError, SentinelAccount, SentinelAccountsTable, ServiceHeartbeatsTable, Session, SessionsTable, StageBlockReceiptsTable, StageFailuresTable, StageKind, StageRegistryTable, StageRunsTable, StateWrite, StateWritesArchiveTable, StateWritesTable, StreamsCursor, StreamsDbEventType, StreamsEventType, Subgraph, SubgraphAgentSchema, SubgraphAggregateParams, SubgraphAggregateResponse, SubgraphDetail, SubgraphErrorGroupsTable, SubgraphGap, SubgraphGapEntry, SubgraphGapRange, SubgraphGapsResponse, SubgraphGapsTable, SubgraphHealthSnapshot, SubgraphHealthSnapshotsTable, SubgraphOperation, SubgraphOperationKind, SubgraphOperationStatus, SubgraphOperationsTable, SubgraphProcessingStatsTable, SubgraphQueryParams, SubgraphSpecFormat, SubgraphSpecOptions, SubgraphSummary, SubgraphSyncInfo, SubgraphVerification, SubgraphViolationsTable, SubgraphsTable, SyncScopesTable, TABLE_TO_DB, TenantSuspendedError, Transaction, TransactionsArchiveTable, TransactionsTable, TriggerEvaluatorState, TriggerEvaluatorStateTable, UpdateAccountBalanceAlerts, UpdateAccountCredits, UpdateAccountSpendCap, UpdateApiKey, UpdateArchiveFetch, UpdateBlock, UpdateContract, UpdateEvent, UpdateIndexProgress, UpdateSubgraph, UpdateSubgraphOperation, UpdateTransaction, UpdateUsageLedgerRow, UpdateVmEvent, UpdateWebhook, UpdateWebhookOutbox, UpdateWebhookRequest, UpdateWebhookRequestSchema, UsageLedgerRow, UsageLedgerTable, VM_EVENT_TYPES, VM_NODE_TO_STORED_TYPE2 as VM_NODE_TO_STORED_TYPE, VM_STORED_TO_NODE_TYPE, ValidationError, VersionConflictError, VmEvent, VmEventType, VmEventsArchiveTable, VmEventsTable, VmNodeEventType, WEBHOOK_FORMATS, WEBHOOK_STATUSES, Waitlist, WaitlistSignup, WaitlistSignupsTable, WaitlistsTable, Webhook, WebhookDeliveriesTable, WebhookDelivery, WebhookDetail, WebhookFormat, WebhookFormatSchema, WebhookIncidentAlert, WebhookIncidentAlertsTable, WebhookKind, WebhookOutbox, WebhookOutboxTable, WebhookStatus, WebhookStatusSchema, WebhookSummary, WebhooksTable, applicationDatabaseUrl, assertDbSplit, billingPausedCode, blockEndCursor, bucketHourly, closeDb, closeDbOrTimeout, committedHeight, compareStreamsCursor, exports_hmac as crypto, decodeStreamsCursor, describeDbUrl, exports_ed25519 as ed25519, encodeStreamsCursor, finalizedBurnHeight, formatWebhookSchemaErrors, generateSubgraphAgentSchema, generateSubgraphMarkdown, generateSubgraphOpenApi, generateSubgraphSpec, getDb, getDbSplitStatus, getEnv, getErrorMessage, getMigrationRole, getRawClient, getSourceDb, getTargetDb, isBnsDecoderEnabled, isEmptyRangeCursor, isPox4DecoderEnabled, isPox5DecoderEnabled, isSbtcDecoderEnabled, jsonb, logger, onChainPlane, onControlPlane, parseJsonb, resolveSourceUrl, resolveTargetUrl, setMigrationRole, sql };
+export { Account, AccountBalanceAlerts, AccountBalanceAlertsTable, AccountCredits, AccountCreditsTable, AccountSpendCap, AccountSpendCapsTable, AccountsTable, ApiFailedRequest, ApiFailedRequestsTable, ApiKey, ApiKeyRevokedError, ApiKeysTable, ApiRequestLogRow, ApiRequestLogTable, ArchiveFetch, ArchiveFetchesTable, AuthenticationError, AuthorizationError, BILLING_PAUSED_PREFIX, Block, BlocksTable, BnsMarketplaceAction, BnsMarketplaceEventsTable, BnsNameEventTopic, BnsNameEventsTable, BnsNamesTable, BnsNamespaceEventStatus, BnsNamespaceEventsTable, BnsNamespacesTable, BurnBlockRewardSlotsTable, BurnBlockRewardsTable, CHAIN_TRIGGER_FIELDS, CHAIN_TRIGGER_TYPES, CODE_TO_STATUS, ChainApplyDeliveryOf, ChainApplyEnvelope, ChainApplyEnvelopeOf, ChainEventEnvelope, ChainFtBurnData, ChainFtMintData, ChainFtTransferData, ChainNftBurnData, ChainNftMintData, ChainNftTransferData, ChainPrintEventData, ChainReadCacheTable, ChainReorgOrphanedEntry, ChainReorgRollbackDelivery, ChainReorgRollbackEnvelope, ChainReorgsTable, ChainStxBurnData, ChainStxLockData, ChainStxMintData, ChainStxTransferData, ChainTestDelivery, ChainTxLevelEvent, ChainWebhookDelivery, ChainWebhookEnvelope, CliDeviceLogin, CliDeviceLoginStatus, CliDeviceLoginsTable, ContactRequest, ContactRequestsTable, Contract, ContractsTable, CoverageSegmentsTable, CreateWebhookRequest, CreateWebhookRequestSchema, CreateWebhookResponse, DB_TO_STREAMS_EVENT_TYPE, DECODED_EVENT_TYPES2 as DECODED_EVENT_TYPES, DEFAULT_BTC_CONFIRMATIONS, Database, DatabaseError, DbPlane, DbReadRow, DbSplitStatus, DeadLetterEventsTable, DeadRow, DecodedEventType2 as DecodedEventType, DecodedEventsTable, DecoderCheckpointsTable, DeliveryRow, DeploySubgraphRequest, DeploySubgraphRequestSchema, DeploySubgraphResponse, EMPTY_RANGE_EVENT_INDEX_SENTINEL, Env, ErrorCode, ErrorCodes, Event, EventsArchiveTable, EventsTable, FailureClass, FailureUnit, FeedbackTicket, FeedbackTicketsTable, ForbiddenError, HealthHour, HealthSnapshotPoint, INSIGHT_SEVERITIES, IndexColumn, IndexColumnType, IndexPrimaryKey, IndexProgress, IndexProgressTable, InsertAccount, InsertAccountBalanceAlerts, InsertAccountCredits, InsertAccountSpendCap, InsertApiFailedRequest, InsertApiKey, InsertApiRequestLogRow, InsertArchiveFetch, InsertBlock, InsertContactRequest, InsertContract, InsertEvent, InsertFeedbackTicket, InsertIndexProgress, InsertMagicLink, InsertMempoolTransaction, InsertSession, InsertStateWrite, InsertSubgraph, InsertSubgraphGap, InsertSubgraphHealthSnapshot, InsertSubgraphOperation, InsertTransaction, InsertUsageLedgerRow, InsertVmEvent, InsertWaitlistSignup, InsertWebhook, InsertWebhookDelivery, InsertWebhookOutbox, Insight, InsightEvidence, InsightEvidenceSchema, InsightListResponse, InsightListResponseSchema, InsightMutesTable, InsightResourceKind, InsightResourceKindSchema, InsightSchema, InsightSeverity, InsightSeveritySchema, InsightsTable, InstancesTable, KeyRotatedError, MagicLink, MagicLinksTable, MempoolTransaction, MempoolTransactionsTable, MigrationRole, NativeClock, NotFoundError, NumericAsText, ObserverJournalStatus, ObserverJournalTable, OutboxStatus, ParsedCreateWebhookRequest, ParsedReplayWebhookRequest, ParsedUpdateWebhookRequest, PaymentRequiredError, PendingForkBlocksTable, Pox4CallsTable, Pox4FunctionName, Pox5CycleSignersTable, Pox5CyclesTable, Pox5EventTopic, Pox5EventsTable, ProcessedStripeEventsTable, RUNE_EVENT_TYPES, RateLimitError, ReindexResponse, RepairMode, ReplayResult, ReplayWebhookRequest, ReplayWebhookRequestSchema, RetryState, RotateSecretResponse, RunStatus, RuneApplyDeliveryOf, RuneApplyEnvelope, RuneEventType, SEVERITY_ORDER, SOURCE_READ_COLUMNS, SOURCE_READ_PKS, SOURCE_READ_TYPES, STREAMS_DB_EVENT_TYPES, STREAMS_EVENT_TYPES, STREAMS_TO_DB_EVENT_TYPES, SbtcDepositEvent, SbtcEventTopic, SbtcEventsTable, SbtcSettlementsTable, SbtcTokenEventType, SbtcTokenEventsTable, SbtcWithdrawalEvent, SbtcWithdrawalSweptConfirmedEvent, SecondLayerError, SentinelAccount, SentinelAccountsTable, ServiceHeartbeatsTable, Session, SessionsTable, StageBlockReceiptsTable, StageFailuresTable, StageKind, StageRegistryTable, StageRunsTable, StateWrite, StateWritesArchiveTable, StateWritesTable, StreamsCursor, StreamsDbEventType, StreamsEventType, Subgraph, SubgraphAgentSchema, SubgraphAggregateParams, SubgraphAggregateResponse, SubgraphDetail, SubgraphErrorGroupsTable, SubgraphGap, SubgraphGapEntry, SubgraphGapRange, SubgraphGapsResponse, SubgraphGapsTable, SubgraphHealthSnapshot, SubgraphHealthSnapshotsTable, SubgraphOperation, SubgraphOperationKind, SubgraphOperationStatus, SubgraphOperationsTable, SubgraphProcessingStatsTable, SubgraphQueryParams, SubgraphSpecFormat, SubgraphSpecOptions, SubgraphSummary, SubgraphSyncInfo, SubgraphVerification, SubgraphViolationsTable, SubgraphsTable, SyncScopesTable, TABLE_TO_DB, TenantSuspendedError, Transaction, TransactionsArchiveTable, TransactionsTable, TriggerEvaluatorState, TriggerEvaluatorStateTable, UpdateAccountBalanceAlerts, UpdateAccountCredits, UpdateAccountSpendCap, UpdateApiKey, UpdateArchiveFetch, UpdateBlock, UpdateContract, UpdateEvent, UpdateIndexProgress, UpdateSubgraph, UpdateSubgraphOperation, UpdateTransaction, UpdateUsageLedgerRow, UpdateVmEvent, UpdateWebhook, UpdateWebhookOutbox, UpdateWebhookRequest, UpdateWebhookRequestSchema, UsageLedgerRow, UsageLedgerTable, VM_EVENT_TYPES, VM_NODE_TO_STORED_TYPE2 as VM_NODE_TO_STORED_TYPE, VM_STORED_TO_NODE_TYPE, ValidationError, VersionConflictError, VmEvent, VmEventType, VmEventsArchiveTable, VmEventsTable, VmNodeEventType, WEBHOOK_FORMATS, WEBHOOK_STATUSES, Waitlist, WaitlistSignup, WaitlistSignupsTable, WaitlistsTable, Webhook, WebhookDeliveriesTable, WebhookDelivery, WebhookDetail, WebhookFormat, WebhookFormatSchema, WebhookIncidentAlert, WebhookIncidentAlertsTable, WebhookKind, WebhookOutbox, WebhookOutboxTable, WebhookStatus, WebhookStatusSchema, WebhookSummary, WebhooksTable, applicationDatabaseUrl, assertDbSplit, billingPausedCode, blockEndCursor, bucketHourly, closeDb, closeDbOrTimeout, committedHeight, compareStreamsCursor, exports_hmac as crypto, decodeStreamsCursor, describeDbUrl, exports_ed25519 as ed25519, encodeStreamsCursor, finalizedBurnHeight, formatWebhookSchemaErrors, generateSubgraphAgentSchema, generateSubgraphMarkdown, generateSubgraphOpenApi, generateSubgraphSpec, getDb, getDbSplitStatus, getEnv, getErrorMessage, getMigrationRole, getRawClient, getSourceDb, getTargetDb, isBnsDecoderEnabled, isEmptyRangeCursor, isPox4DecoderEnabled, isPox5DecoderEnabled, isSbtcDecoderEnabled, jsonb, logger, onChainPlane, onControlPlane, parseJsonb, resolveSourceUrl, resolveTargetUrl, setMigrationRole, sql };

package/dist/src/index.js

@@ -1066,6 +1066,7 @@ var ErrorCodes = {
   VERSION_CONFLICT: "VERSION_CONFLICT",
   NOT_FOUND: "NOT_FOUND",
   KEY_ROTATED: "KEY_ROTATED",
+  KEY_REVOKED: "KEY_REVOKED",
   TENANT_SUSPENDED: "TENANT_SUSPENDED",
   NO_TENANT_FOR_PROJECT: "NO_TENANT_FOR_PROJECT",
   INSTANCE_EXISTS: "INSTANCE_EXISTS"
@@ -1125,6 +1126,14 @@ class AuthorizationError extends SecondLayerError {
   }
 }
 
+class ApiKeyRevokedError extends SecondLayerError {
+  constructor() {
+    super("KEY_REVOKED", "API key has been revoked", undefined, {
+      hint: "Make a new key at https://secondlayer.tools/account/keys and replace the revoked one wherever it is configured."
+    });
+  }
+}
+
 class RateLimitError extends SecondLayerError {
   constructor(message) {
     super("RATE_LIMIT_ERROR", message);
@@ -1174,6 +1183,7 @@ var CODE_TO_STATUS = {
   NOT_FOUND: 404,
   VALIDATION_ERROR: 400,
   KEY_ROTATED: 401,
+  KEY_REVOKED: 401,
   TENANT_SUSPENDED: 423,
   NO_TENANT_FOR_PROJECT: 404,
   INSTANCE_EXISTS: 409,
@@ -2289,6 +2299,7 @@ function verifyEd25519(payload, signatureBase64, publicKey) {
   }
 }
 export {
+  ApiKeyRevokedError,
   AuthenticationError,
   AuthorizationError,
   BILLING_PAUSED_PREFIX,
@@ -2380,5 +2391,5 @@ export {
   sql2 as sql
 };
 
-//# debugId=88F87DB20189B39F64756E2164756E21
+//# debugId=E4DE5C06B261EC6A64756E2164756E21
 //# sourceMappingURL=index.js.map