@secondlayer/cli 10.4.0 → 12.0.0

package/dist/cli.js

@@ -2772,118 +2772,6 @@ var init_output = __esm(() => {
   ANSI_ESCAPE_PATTERN = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, "g");
 });
 
-// src/lib/api-client.ts
-import { ApiError, SecondLayer } from "@secondlayer/sdk";
-function nextStepHint(status) {
-  if (status === undefined)
-    return;
-  if (status === 403)
-    return "You may not have access — check your active project with `secondlayer whoami`.";
-  if (status === 404)
-    return "Check the name/slug — run the matching `list` command to see what exists.";
-  if (status === 400 || status === 422)
-    return "Check the command arguments and flags — see `--help` for the expected format.";
-  if (status === 429)
-    return "Rate limited — wait a moment and retry.";
-  if (status >= 500)
-    return "Server error — retry shortly, or check `secondlayer status`.";
-  return;
-}
-function handleApiError(err, action) {
-  const status = err instanceof ApiError || err instanceof CliHttpError ? err.status : undefined;
-  if (err instanceof CliHttpError && err.code === "SESSION_EXPIRED" || status === 401) {
-    printError("Authentication required.", {
-      hint: isOssMode() ? "Set SL_API_KEY / INSTANCE_TOKEN from `secondlayer init`." : "Run `secondlayer login` to re-authenticate."
-    });
-    process.exit(1);
-  }
-  const detail = err instanceof Error ? err.message : String(err);
-  printError(`Failed to ${action}: ${detail}`, { hint: nextStepHint(status) });
-  process.exit(1);
-}
-function withErrorHandling(fn, options) {
-  return async (...args) => {
-    try {
-      await fn(...args);
-    } catch (err) {
-      if (options?.onError) {
-        options.onError(err);
-      } else {
-        handleApiError(err, options?.action ?? "execute command");
-      }
-    }
-  };
-}
-async function getPlatformClient() {
-  const { apiUrl, ephemeralKey } = await resolveAuth();
-  return new SecondLayer({ baseUrl: apiUrl, apiKey: ephemeralKey });
-}
-async function listSubgraphsApi() {
-  return (await getPlatformClient()).subgraphs.list();
-}
-async function getSubgraphApi(name) {
-  return (await getPlatformClient()).subgraphs.get(name);
-}
-async function getSubgraphOpenApi(name, options) {
-  return (await getPlatformClient()).subgraphs.openapi(name, options);
-}
-async function getSubgraphAgentSchema(name, options) {
-  return (await getPlatformClient()).subgraphs.schema(name, options);
-}
-async function getSubgraphMarkdown(name, options) {
-  return (await getPlatformClient()).subgraphs.markdown(name, options);
-}
-async function reindexSubgraphApi(name) {
-  return (await getPlatformClient()).subgraphs.reindex(name);
-}
-async function backfillSubgraphApi(name, options) {
-  return (await getPlatformClient()).subgraphs.backfill(name, options);
-}
-async function stopSubgraphApi(name) {
-  return (await getPlatformClient()).subgraphs.stop(name);
-}
-async function deleteSubgraphApi(name, options) {
-  return (await getPlatformClient()).subgraphs.delete(name, options);
-}
-async function deploySubgraphApi(data) {
-  return (await getPlatformClient()).subgraphs.deploy(data);
-}
-async function publishSubgraphApi(name) {
-  return (await getPlatformClient()).subgraphs.publish(name);
-}
-async function unpublishSubgraphApi(name) {
-  return (await getPlatformClient()).subgraphs.unpublish(name);
-}
-async function querySubgraphTable(name, table, params = {}) {
-  return (await getPlatformClient()).subgraphs.queryTable(name, table, params);
-}
-async function querySubgraphTableCount(name, table, params = {}) {
-  return (await getPlatformClient()).subgraphs.queryTableCount(name, table, params);
-}
-async function getSubgraphGaps(name, opts) {
-  return (await getPlatformClient()).subgraphs.gaps(name, opts);
-}
-async function getContractPrintSchema(contractId) {
-  let client;
-  try {
-    client = await getPlatformClient();
-  } catch {
-    client = new SecondLayer({ baseUrl: resolveApiUrl() });
-  }
-  return client.index.printSchema(contractId);
-}
-async function getAccountProfile() {
-  return httpPlatform("/api/accounts/me");
-}
-async function updateAccountProfile(data) {
-  return httpPlatform("/api/accounts/me", { method: "PATCH", body: data });
-}
-var init_api_client = __esm(() => {
-  init_http();
-  init_output();
-  init_resolve_auth();
-});
-
 // ../../node_modules/chalk/source/vendor/ansi-styles/index.js
 function assembleStyles() {
   const codes = new Map;
@@ -10526,9 +10414,9 @@ function lowercaseKeys(object) {
 
 // ../../node_modules/responselike/index.js
 import { Readable as ReadableStream2 } from "node:stream";
-var Response;
+var Response2;
 var init_responselike = __esm(() => {
-  Response = class Response extends ReadableStream2 {
+  Response2 = class Response2 extends ReadableStream2 {
     statusCode;
     headers;
     body;
@@ -10966,7 +10854,7 @@ class CacheableRequest {
                 response.once("end", resolve);
               });
               const headers = convertHeaders(revalidatedPolicy.policy.responseHeaders());
-              response = new Response({ statusCode: revalidate.statusCode, headers, body: revalidate.body, url: revalidate.url });
+              response = new Response2({ statusCode: revalidate.statusCode, headers, body: revalidate.body, url: revalidate.url });
               response.cachePolicy = revalidatedPolicy.policy;
               response.fromCache = true;
             }
@@ -11042,7 +10930,7 @@ class CacheableRequest {
           const policy = import_http_cache_semantics.default.fromObject(cacheEntry.cachePolicy);
           if (policy.satisfiesWithoutRevalidation(options_) && !options_.forceRefresh) {
             const headers = convertHeaders(policy.responseHeaders());
-            const response = new Response({ statusCode: cacheEntry.statusCode, headers, body: cacheEntry.body, url: cacheEntry.url });
+            const response = new Response2({ statusCode: cacheEntry.statusCode, headers, body: cacheEntry.body, url: cacheEntry.url });
             response.cachePolicy = policy;
             response.fromCache = true;
             ee.emit("response", response);
@@ -28400,6 +28288,93 @@ var init_subgraphs = __esm(() => {
   init_format();
 });
 
+// src/lib/api-client.ts
+import { ApiError, SecondLayer } from "@secondlayer/sdk";
+function nextStepHint(status) {
+  if (status === undefined)
+    return;
+  if (status === 403)
+    return "You may not have access — check your active project with `secondlayer whoami`.";
+  if (status === 404)
+    return "Check the name/slug — run the matching `list` command to see what exists.";
+  if (status === 400 || status === 422)
+    return "Check the command arguments and flags — see `--help` for the expected format.";
+  if (status === 429)
+    return "Rate limited — wait a moment and retry.";
+  if (status >= 500)
+    return "Server error — retry shortly, or check `secondlayer status`.";
+  return;
+}
+function handleApiError(err, action2) {
+  const status = err instanceof ApiError || err instanceof CliHttpError ? err.status : undefined;
+  if (err instanceof CliHttpError && err.code === "SESSION_EXPIRED" || status === 401) {
+    printError("Authentication required.", {
+      hint: isOssMode() ? "Set SL_API_KEY / INSTANCE_TOKEN from `secondlayer init`." : "Run `secondlayer login` to re-authenticate."
+    });
+    process.exit(1);
+  }
+  const detail = err instanceof Error ? err.message : String(err);
+  printError(`Failed to ${action2}: ${detail}`, { hint: nextStepHint(status) });
+  process.exit(1);
+}
+async function getPlatformClient() {
+  const { apiUrl, ephemeralKey } = await resolveAuth();
+  return new SecondLayer({ baseUrl: apiUrl, apiKey: ephemeralKey });
+}
+async function listSubgraphsApi() {
+  return (await getPlatformClient()).subgraphs.list();
+}
+async function getSubgraphApi(name) {
+  return (await getPlatformClient()).subgraphs.get(name);
+}
+async function getSubgraphOpenApi(name, options3) {
+  return (await getPlatformClient()).subgraphs.openapi(name, options3);
+}
+async function getSubgraphAgentSchema(name, options3) {
+  return (await getPlatformClient()).subgraphs.schema(name, options3);
+}
+async function getSubgraphMarkdown(name, options3) {
+  return (await getPlatformClient()).subgraphs.markdown(name, options3);
+}
+async function reindexSubgraphApi(name) {
+  return (await getPlatformClient()).subgraphs.reindex(name);
+}
+async function backfillSubgraphApi(name, options3) {
+  return (await getPlatformClient()).subgraphs.backfill(name, options3);
+}
+async function stopSubgraphApi(name) {
+  return (await getPlatformClient()).subgraphs.stop(name);
+}
+async function deleteSubgraphApi(name, options3) {
+  return (await getPlatformClient()).subgraphs.delete(name, options3);
+}
+async function deploySubgraphApi(data) {
+  return (await getPlatformClient()).subgraphs.deploy(data);
+}
+async function querySubgraphTable(name, table, params = {}) {
+  return (await getPlatformClient()).subgraphs.queryTable(name, table, params);
+}
+async function querySubgraphTableCount(name, table, params = {}) {
+  return (await getPlatformClient()).subgraphs.queryTableCount(name, table, params);
+}
+async function getSubgraphGaps(name, opts) {
+  return (await getPlatformClient()).subgraphs.gaps(name, opts);
+}
+async function getContractPrintSchema(contractId) {
+  let client;
+  try {
+    client = await getPlatformClient();
+  } catch {
+    client = new SecondLayer({ baseUrl: resolveApiUrl() });
+  }
+  return client.index.printSchema(contractId);
+}
+var init_api_client = __esm(() => {
+  init_http();
+  init_output();
+  init_resolve_auth();
+});
+
 // src/lib/fs.ts
 import { mkdir as mkdir2, readFile as readFile2, stat, unlink, writeFile as writeFile2 } from "node:fs/promises";
 async function readJsonFile(path11) {
@@ -28903,23 +28878,8 @@ var init_require_auth = __esm(() => {
 });
 
 // src/templates/subgraph.ts
-function generateSubgraphTemplate(name, slug = "basic") {
-  const body = (() => {
-    switch (slug) {
-      case "sip-010-balances":
-        return sip010Balances(name);
-      case "sbtc-flows":
-        return sbtcFlows(name);
-      case "pox-stacking":
-        return poxStacking(name);
-      case "bns-names":
-        return bnsNames(name);
-      default:
-        return basic(name);
-    }
-  })();
-  return `${nextStepsHeader(name)}
-${body}`;
+function generateSubgraphStarter(name) {
+  return `${nextStepsHeader(name)}${starter(name)}`;
 }
 function nextStepsHeader(name) {
   return `// ───────────────────────────────────────────────────────────────────
@@ -28928,20 +28888,19 @@ function nextStepsHeader(name) {
 //   1. Edit the source filter + schema below to match what you want to track.
 //   2. Edit the handler at the bottom — it runs once per matching event.
 //   3. Deploy:   secondlayer subgraphs deploy ${name}.ts
-//      (You'll be prompted to log in if this is your first remote deploy.)
 //   4. Wait for sync:   secondlayer subgraphs status ${name}
-//      Mainnet backfill from genesis can take an hour or more depending on
-//      your filter scope. Use --start-block to skip ahead.
+//      Backfill from genesis can take an hour or more depending on your
+//      filter scope. Use --start-block to skip ahead.
 //   5. Query:    secondlayer subgraphs query ${name} <table-name>
-//      Or hit the auto-generated REST endpoint listed in the deploy output.
+//      Or hit the REST endpoint listed in the deploy output.
 //
-// Bind a typed Subscription to any table you write here — see
-// https://www.secondlayer.tools/docs/subscriptions
+// Prefer generating from a real contract:
+//   secondlayer subgraphs create ${name} --from-contract SP....my-contract
 // ───────────────────────────────────────────────────────────────────
 
 `;
 }
-function basic(name) {
+function starter(name) {
   return `import { defineSubgraph } from "@secondlayer/subgraphs";
 
 export default defineSubgraph({
@@ -28949,7 +28908,7 @@ export default defineSubgraph({
   version: "1.0.0",
   description: "TODO: describe what this subgraph tracks",
 
-  // Sources define what blockchain data this subgraph processes.
+  // Sources define what chain data this subgraph processes.
   // Each source is named — the name becomes the handler key.
   //
   // Filter types:
@@ -28994,345 +28953,6 @@ export default defineSubgraph({
 });
 `;
 }
-function sip010Balances(name) {
-  return `import { defineSchema, defineSubgraph, readContractAt, type TypedSubgraphContext } from "@secondlayer/subgraphs";
-
-/**
- * Track SIP-010 token balances per (asset_identifier, holder).
- * Mirrors the shape of the curated sBTC token-events view
- * surface — but works for ANY SIP-010 token. Constrain to a single
- * token by adding \`assetIdentifier: "SP...token::token-name"\` to each
- * source filter.
- *
- * Balances are moved with \`ctx.increment\`, which applies a DELTA in one
- * atomic statement. That matters: a read-modify-write (findOne → compute →
- * upsert) loses concurrent updates to the same row, and it is not replay-safe
- * under \`backfillMode: "concurrent"\`. Deltas commute, so order doesn't
- * matter and a reorg rewind reverses cleanly via the journal.
- *
- * Token metadata (decimals/symbol) comes from the token contract itself via
- * \`readContractAt\`, so \`amount\` stops being a bare integer nobody can
- * render. The read is pinned to the block being processed — a handler stays a
- * pure function of its block — and \`cache: "contract-constant"\` says these
- * two values can never change for a given token, so each is fetched ONCE
- * instead of once per block.
- *
- * Query examples once deployed:
- *   GET /v1/subgraphs/${name}/balances?_search=SP1...
- *   GET /v1/subgraphs/${name}/balances?holder=SP1...
- *   GET /v1/subgraphs/${name}/tokens
- */
-
-/** The two SIP-010 read-only functions this subgraph calls. */
-const SIP010_ABI = {
-  functions: [
-    { name: "get-decimals", access: "read-only", args: [], outputs: { response: { ok: "uint128", error: "uint128" } } },
-    { name: "get-symbol", access: "read-only", args: [], outputs: { response: { ok: { "string-ascii": { length: 32 } }, error: "uint128" } } },
-  ],
-} as const;
-
-/** Tokens already labelled in this process — metadata is immutable, so one
- *  resolution per token is enough even across a backfill. */
-const labelled = new Set<string>();
-
-// Hoisted so the helper below can be typed against it.
-const schema = defineSchema({
-  balances: {
-    columns: {
-      asset_identifier: { type: "text", indexed: true, search: true },
-      holder: { type: "principal", indexed: true, search: true },
-      amount: { type: "uint" },
-    },
-    // increment() upserts on this key.
-    uniqueKeys: [["asset_identifier", "holder"]],
-  },
-  tokens: {
-    columns: {
-      asset_identifier: { type: "text", indexed: true },
-      contract_id: { type: "text" },
-      symbol: { type: "text" },
-      decimals: { type: "uint" },
-    },
-    uniqueKeys: [["asset_identifier"]],
-  },
-});
-
-export default defineSubgraph({
-  name: "${name}",
-  version: "1.0.0",
-  description: "Per-token balance tracking for any SIP-010 asset",
-
-  sources: {
-    transfer: { type: "ft_transfer" },
-    mint: { type: "ft_mint" },
-    burn: { type: "ft_burn" },
-  },
-
-  schema,
-
-  handlers: {
-    transfer: async (event, ctx) => {
-      await labelToken(event.assetIdentifier, ctx);
-      const amount = BigInt(event.amount ?? 0);
-      if (event.sender) {
-        ctx.increment("balances", { asset_identifier: event.assetIdentifier, holder: event.sender }, { amount: -amount });
-      }
-      if (event.recipient) {
-        ctx.increment("balances", { asset_identifier: event.assetIdentifier, holder: event.recipient }, { amount });
-      }
-    },
-    mint: (event, ctx) => {
-      if (event.recipient) {
-        ctx.increment("balances", { asset_identifier: event.assetIdentifier, holder: event.recipient }, { amount: BigInt(event.amount ?? 0) });
-      }
-    },
-    burn: (event, ctx) => {
-      if (event.sender) {
-        ctx.increment("balances", { asset_identifier: event.assetIdentifier, holder: event.sender }, { amount: -BigInt(event.amount ?? 0) });
-      }
-    },
-  },
-});
-
-/** Resolve a token's symbol + decimals from its contract, once. */
-async function labelToken(
-  assetIdentifier: string | undefined,
-  ctx: TypedSubgraphContext<typeof schema>,
-) {
-  if (!assetIdentifier || labelled.has(assetIdentifier)) return;
-  labelled.add(assetIdentifier);
-  const contractId = assetIdentifier.split("::")[0];
-  const token = readContractAt(ctx, contractId, SIP010_ABI, { cache: "contract-constant" });
-  const [decimals, symbol] = await Promise.all([
-    token.read.getDecimals({}),
-    token.read.getSymbol({}),
-  ]);
-  ctx.upsert("tokens", { asset_identifier: assetIdentifier }, { asset_identifier: assetIdentifier, contract_id: contractId, symbol, decimals });
-}
-`;
-}
-function sbtcFlows(name) {
-  return `import { defineSubgraph } from "@secondlayer/subgraphs";
-
-/**
- * Track sBTC protocol flows: deposits, withdrawals, signer rotations,
- * governance updates — your own indexed view of the sbtc-registry contract.
- *
- * Source contract: sbtc-registry (mainnet).
- *
- * Query examples once deployed:
- *   GET /v1/subgraphs/${name}/flows?topic=completed-deposit
- *   GET /v1/subgraphs/${name}/flows?topic=withdrawal-create
- */
-export default defineSubgraph({
-  name: "${name}",
-  version: "1.0.0",
-  description: "sBTC deposits, withdrawals, signer rotations, governance",
-
-  // Skip pre-sBTC history. Raise this (e.g., to a recent block near tip) for
-  // a smaller backfill, or lower it if you need every sBTC event from genesis.
-  startBlock: 860000,
-
-  sources: {
-    registry: {
-      type: "print_event",
-      contractId: "SM3VDXK3WZZSA84XXFKAFAF15NNZX32CTSG82JFQ4.sbtc-registry",
-    },
-  },
-
-  schema: {
-    flows: {
-      columns: {
-        topic: { type: "text", indexed: true, search: true },
-        request_id: { type: "uint", nullable: true, indexed: true },
-        amount: { type: "text", nullable: true },
-        sender: { type: "principal", nullable: true, indexed: true },
-        bitcoin_txid: { type: "text", nullable: true, search: true },
-        burn_height: { type: "uint", nullable: true },
-      },
-    },
-  },
-
-  handlers: {
-    registry: (event, ctx) => {
-      if (!event.topic) return;
-      // event.data is untyped across topics — cast to the fields you read, or
-      // declare \`prints\` per topic on the source for fully typed event.data.
-      const data = event.data as {
-        requestId?: bigint;
-        amount?: bigint | string;
-        sender?: string;
-        bitcoinTxid?: string;
-        burnHeight?: bigint;
-      };
-      ctx.insert("flows", {
-        topic: event.topic,
-        request_id: data.requestId ?? null,
-        amount: data.amount != null ? String(data.amount) : null,
-        sender: data.sender ?? null,
-        bitcoin_txid: data.bitcoinTxid ?? null,
-        burn_height: data.burnHeight ?? null,
-      });
-    },
-  },
-});
-`;
-}
-function poxStacking(name) {
-  return `import { defineSubgraph } from "@secondlayer/subgraphs";
-import { POX5_ABI } from "@secondlayer/stacks/pox5";
-
-/**
- * Track PoX-5 \`stake\` calls with their arguments already decoded.
- *
- * pox-5 replaced pox-4 when Epoch 4.0 activated (Bitcoin block 960,230,
- * 2026-07-30). SIP-045 reshaped the API: stacking became bonds + staking, so
- * the entry point is \`stake\`, not \`stack-stx\`.
- *
- * The source pairs \`abi\` with \`functionName\`, which is what makes
- * \`event.input\` a typed, named argument set instead of positional
- * \`args[0] as bigint\`. Add one source per function you want to track.
- *
- * Query examples once deployed:
- *   GET /v1/subgraphs/${name}/calls?caller=SP1...
- *   GET /v1/subgraphs/${name}/calls?caller=SP1...
- */
-export default defineSubgraph({
-  name: "${name}",
-  version: "1.0.0",
-  description: "PoX-5 stake calls with decoded arguments",
-
-  sources: {
-    pox: {
-      type: "contract_call",
-      // pox-5 is the live PoX contract since Epoch 4.0 activated at Bitcoin
-      // block 960,230 (2026-07-30). Stacking history before that is pox-4 —
-      // point a second source at \`.pox-4\` if you need it.
-      contractId: "SP000000000000000000002Q6VF78.pox-5",
-      // \`abi\` + \`functionName\` together are what type \`event.input\`: the
-      // arguments cannot be typed without knowing which function was called.
-      // POX5_ABI ships \`as const\` in @secondlayer/stacks, so there is no
-      // hand-copied ABI to drift. Add a source per function you care about.
-      functionName: "stake",
-      abi: POX5_ABI,
-    },
-  },
-
-  schema: {
-    calls: {
-      columns: {
-        function_name: { type: "text", indexed: true, search: true },
-        caller: { type: "principal", indexed: true, search: true },
-        amount_ustx: { type: "uint" },
-        num_cycles: { type: "uint" },
-        result_ok: { type: "boolean" },
-      },
-    },
-  },
-
-  handlers: {
-    pox: (event, ctx) => {
-      // \`event.input\` is the decoded, named, typed argument set — no
-      // \`args[0] as bigint\`. Hover \`amountUstx\` and it is a bigint.
-      const resultHex = event.resultHex ?? "";
-      ctx.insert("calls", {
-        function_name: event.functionName || ctx.tx.functionName || "",
-        caller: ctx.tx.sender,
-        amount_ustx: event.input.amountUstx,
-        num_cycles: event.input.numCycles,
-        result_ok: resultHex.startsWith("0x07"), // 0x07 = response-ok type tag
-      });
-    },
-  },
-});
-`;
-}
-function bnsNames(name) {
-  return `import { defineSubgraph } from "@secondlayer/subgraphs";
-
-/**
- * Track BNS-V2 name lifecycle events — registrations, transfers,
- * renewals, burns, airdrops.
- *
- * Source: BNS-V2 print events (topic-discriminated payloads).
- *
- * Query examples once deployed:
- *   GET /v1/subgraphs/${name}/names?owner=SP1...
- *   GET /v1/subgraphs/${name}/names?_search=alice
- */
-export default defineSubgraph({
-  name: "${name}",
-  version: "1.0.0",
-  description: "BNS-V2 name ownership and lifecycle",
-
-  sources: {
-    bns: {
-      type: "print_event",
-      contractId: "SP2QEZ06AGJ3RKJPBV14SY1V5BBFNAW33D96YPGZF.BNS-V2",
-    },
-  },
-
-  schema: {
-    names: {
-      columns: {
-        topic: { type: "text", indexed: true },
-        namespace: { type: "text", indexed: true, search: true },
-        name: { type: "text", indexed: true, search: true },
-        fqn: { type: "text", indexed: true, search: true },
-        owner: { type: "principal", nullable: true, indexed: true, search: true },
-      },
-    },
-  },
-
-  handlers: {
-    bns: (event, ctx) => {
-      if (!event.topic) return;
-      const data = event.data as { namespace?: unknown; name?: unknown; owner?: string };
-      const namespace = decodeBuffUtf8(data.namespace);
-      const nameLabel = decodeBuffUtf8(data.name);
-      if (!namespace || !nameLabel) return;
-      ctx.insert("names", {
-        topic: event.topic,
-        namespace,
-        name: nameLabel,
-        fqn: \`\${nameLabel}.\${namespace}\`,
-        owner: event.topic === "burn-name" ? null : (data.owner ?? null),
-      });
-    },
-  },
-});
-
-function decodeBuffUtf8(value: unknown): string | null {
-  if (typeof value !== "string") return null;
-  const hex = value.startsWith("0x") ? value.slice(2) : value;
-  if (hex.length === 0) return null;
-  const bytes = new Uint8Array(hex.length / 2);
-  for (let i = 0; i < bytes.length; i++) {
-    bytes[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
-  }
-  let end = bytes.length;
-  while (end > 0 && bytes[end - 1] === 0) end -= 1;
-  return new TextDecoder("utf-8").decode(bytes.subarray(0, end));
-}
-`;
-}
-var SUBGRAPH_TEMPLATE_SLUGS, SUBGRAPH_TEMPLATE_DESCRIPTIONS;
-var init_subgraph = __esm(() => {
-  SUBGRAPH_TEMPLATE_SLUGS = [
-    "basic",
-    "sip-010-balances",
-    "sbtc-flows",
-    "pox-stacking",
-    "bns-names"
-  ];
-  SUBGRAPH_TEMPLATE_DESCRIPTIONS = {
-    basic: "Empty starter — pick any source filter type",
-    "sip-010-balances": "SIP-010 token balances (transfers + mints + burns)",
-    "sbtc-flows": "sBTC protocol flows (deposits, withdrawals, signer rotations)",
-    "pox-stacking": "PoX-4 stacking lifecycle calls",
-    "bns-names": "BNS-V2 name ownership and lifecycle"
-  };
-});
 
 // src/commands/subgraph-test.ts
 var exports_subgraph_test = {};
@@ -29587,7 +29207,6 @@ import {
   generatePrintPayloadTypes,
   generatePrintSchemaSubgraph
 } from "@secondlayer/scaffold";
-import { ByoBreakingChangeError } from "@secondlayer/sdk";
 import { TRAIT_STANDARDS } from "@secondlayer/stacks/clarity";
 async function loadSubgraphWithDepCheck(absPath) {
   try {
@@ -29940,27 +29559,6 @@ ${dim("Columns")}`);
   const deployTarget = context.bundled ? "tenant API" : "local database";
   info(`Dry run only. No ${deployTarget} changes were made.`);
 }
-function printByoBreakingPlan(details) {
-  error("Refusing breaking schema change on BYO subgraph (no data dropped).");
-  console.log(`
-Breaking changes:`);
-  for (const r2 of details.reasons)
-    console.log(`  ${red("✗")} ${r2}`);
-  console.log(`
-To rebuild manually, run on YOUR database:`);
-  console.log(`  ${details.plan.dropStatement}`);
-  console.log(`  ${details.plan.statements.join(`;
-  `)}`);
-  console.log(`
-Grant (first deploy only):`);
-  for (const line of details.plan.grantScript.split(`
-`)) {
-    console.log(`  ${dim(line)}`);
-  }
-  console.log(`
-${yellow("This DROPS all rows in that schema, then rebuilds it. Re-deploy after.")}`);
-  console.log(dim("(--force destructive rebuild not yet supported — manual DROP required.)"));
-}
 function formatDuration(seconds2) {
   if (seconds2 < 90)
     return `${Math.max(1, Math.round(seconds2))}s`;
@@ -30016,27 +29614,15 @@ function formatSubgraphSync(sync) {
 }
 function registerSubgraphsCommand(program2) {
   const subgraphs = program2.command("subgraphs").description("Manage materialized subgraphs");
-  subgraphs.command("create <name>").description("Create a new subgraph definition file").option("--template <slug>", `Starter template (one of: ${SUBGRAPH_TEMPLATE_SLUGS.join(", ")})`).option("--from-contract <contractId>", "Generate sources/schema/handlers from the contract's observed print events (requires network)").option("--table-per-topic", "With --from-contract: one table per print topic instead of a single wide table").addHelpText("after", `
+  subgraphs.command("create <name>").description("Create a new subgraph definition file").option("--from-contract <contractId>", "Generate sources/schema/handlers from the contract's observed print events (requires network)").option("--table-per-topic", "With --from-contract: one table per print topic instead of a single wide table").addHelpText("after", `
 Examples:
   $ secondlayer subgraphs create my-graph
-  $ secondlayer subgraphs create token-balances --template sip-010-balances
   $ secondlayer subgraphs create sbtc-flows --from-contract SM3VDXK3WZZSA84XXFKAFAF15NNZX32CTSG82JFQ4.sbtc-registry
   $ secondlayer subgraphs create sbtc-flows --from-contract SM3....sbtc-registry --table-per-topic`).action(async (name, opts) => {
-    if (opts.fromContract && opts.template) {
-      error("--from-contract and --template are mutually exclusive");
-      process.exit(1);
-    }
     if (opts.tablePerTopic && !opts.fromContract) {
       error("--table-per-topic requires --from-contract");
       process.exit(1);
     }
-    const slug = opts.template ?? "basic";
-    if (!opts.fromContract && !SUBGRAPH_TEMPLATE_SLUGS.includes(slug)) {
-      error(`Unknown template "${opts.template}". Available templates:
-${SUBGRAPH_TEMPLATE_SLUGS.map((s2) => `  ${s2.padEnd(20)} ${SUBGRAPH_TEMPLATE_DESCRIPTIONS[s2]}`).join(`
-`)}`);
-      process.exit(1);
-    }
     const dir = resolve3("subgraphs");
     const filePath = resolve3(dir, `${name}.ts`);
     if (existsSync3(filePath)) {
@@ -30065,7 +29651,7 @@ Check the contract id, and that the contract has emitted print events (schemas a
         sample: schema.sample
       }));
     } else {
-      content = generateSubgraphTemplate(name, slug);
+      content = generateSubgraphStarter(name);
     }
     if (!existsSync3(dir)) {
       mkdirSync2(dir, { recursive: true });
@@ -30074,8 +29660,6 @@ Check the contract id, and that the contract has emitted print events (schemas a
     success(`Created ${filePath}`);
     if (opts.fromContract) {
       info(`Schema inferred from ${opts.fromContract} print events (${opts.tablePerTopic ? "table per topic" : "single wide table"})`);
-    } else if (slug !== "basic") {
-      info(`Template: ${slug} — ${SUBGRAPH_TEMPLATE_DESCRIPTIONS[slug]}`);
     }
     info(`Next: secondlayer subgraphs deploy subgraphs/${name}.ts`);
   });
@@ -30140,7 +29724,7 @@ Stopped watching.`);
     });
     await new Promise(() => {});
   });
-  subgraphs.command("deploy <file>").alias("update").description("Deploy a subgraph definition file (alias: update — deploy is create-or-update)").option("--start-block <n>", "Override the subgraph definition startBlock for this deploy").option("--tip-first", "Go live at chain tip immediately; history backfills in the background (requires order-tolerant handlers — commutative or insert-only writes)").option("--dry-run", "Validate and preview deploy without writing changes").option("-y, --yes", "Skip the reindex confirmation prompt").option("--database-url <url>", "BYO data plane: write the subgraph's schema/rows to your own Postgres. With --dry-run, prints the DDL + grant script and verifies the connection.").option("--strict", "Run `tsc --noEmit` against the handler before deploy (slower; catches TS type errors)").addOption(new Option("--visibility <visibility>", "Hosted only. Public/private namespace.").hideHelp()).option("--allow-uncommitted", "Deploy even though the source file is not committed to git (the deployed definition will exist only in the database)").action(async (file, options3) => {
+  subgraphs.command("deploy <file>").alias("update").description("Deploy a subgraph definition file (alias: update — deploy is create-or-update)").option("--start-block <n>", "Override the subgraph definition startBlock for this deploy").option("--tip-first", "Go live at chain tip immediately; history backfills in the background (requires order-tolerant handlers — commutative or insert-only writes)").option("--dry-run", "Validate and preview deploy without writing changes").option("-y, --yes", "Skip the reindex confirmation prompt").option("--strict", "Run `tsc --noEmit` against the handler before deploy (slower; catches TS type errors)").addOption(new Option("--visibility <visibility>", "Hosted only. Public/private namespace.").hideHelp()).option("--allow-uncommitted", "Deploy even though the source file is not committed to git (the deployed definition will exist only in the database)").action(async (file, options3) => {
     try {
       const absPath = resolve3(file);
       if (!options3.dryRun) {
@@ -30173,15 +29757,6 @@ Stopped watching.`);
       }
       const dryRun = options3.dryRun;
       const visibility = parseVisibilityOption(options3.visibility);
-      if (visibility === "public" && options3.databaseUrl && !options3.yes) {
-        const confirmed = await confirm3({
-          message: "⚠  Public BYO subgraph: anonymous reads will query YOUR database. Continue?"
-        });
-        if (!confirmed) {
-          info("Aborted.");
-          process.exit(0);
-        }
-      }
       const startBlock = parseStartBlockOption(options3.startBlock);
       if (startBlock !== undefined) {
         warn(`--start-block ${startBlock} overrides the definition's startBlock for this deploy.`);
@@ -30246,9 +29821,6 @@ Stopped watching.`);
             }
           }
         }
-        if (options3.databaseUrl) {
-          info("BYO data plane: schema + rows will live in your database. The server verifies the connection before deploying.");
-        }
         const result = await deploySubgraphApi({
           name: effectiveDef.name,
           version: undefined,
@@ -30258,12 +29830,8 @@ Stopped watching.`);
           handlerCode,
           sourceCode: source,
           ...deployStartBlock !== undefined ? { startBlock: deployStartBlock } : {},
-          ...options3.databaseUrl ? { databaseUrl: options3.databaseUrl } : {},
           ...visibility ? { visibility } : {}
         });
-        if (result.start_block_clamped) {
-          info(`  Free tier indexes forward from deploy (start block ${result.start_block}) — upgrade for genesis backfill.`);
-        }
         for (const w2 of result.warnings ?? [])
           warn(w2);
         const printDeployFooter = async () => {
@@ -30276,7 +29844,6 @@ Stopped watching.`);
               info(`  Share:     ${apiUrl}/v1/subgraphs/${effectiveDef.name} (public — no key needed)`);
             } else if (firstTable) {
               info(`  REST:      ${apiUrl}/api/subgraphs/${effectiveDef.name}/${firstTable}`);
-              info(`  Publish:   secondlayer subgraphs publish ${effectiveDef.name} (open anon /v1 reads)`);
             }
             if (result.reindexStarted) {
               const denom = result.estimatedEvents != null ? ` ~${result.estimatedEvents.toLocaleString()} events —` : "";
@@ -30356,14 +29923,6 @@ Stopped watching.`);
         await closeDb();
       }
     } catch (err) {
-      if (err instanceof ByoBreakingChangeError) {
-        printByoBreakingPlan(err.details);
-        process.exit(1);
-      }
-      if (err && typeof err === "object" && err.code === "BYO_BREAKING_CHANGE" && err.details) {
-        printByoBreakingPlan(err.details);
-        process.exit(1);
-      }
       error(`Failed to deploy subgraph: ${err}`);
       process.exit(1);
     }
@@ -30700,33 +30259,6 @@ ${rows.length} row(s)`));
       handleApiError(err, "delete subgraph");
     }
   });
-  subgraphs.command("publish <name>", { hidden: true }).description("Make a subgraph publicly readable on /v1/subgraphs/<name> (claims the name globally, no key needed to read)").action(async (name) => {
-    try {
-      await requireAuth();
-      const result = await publishSubgraphApi(name);
-      success(`Subgraph "${name}" is now public`);
-      try {
-        const { apiUrl } = await resolveAuth();
-        info(`  Share: ${apiUrl}${result.url} (no key needed)`);
-      } catch {}
-    } catch (err) {
-      const status = err?.status;
-      if (status === 409) {
-        error(`Public name "${name}" is already taken by another account. Rename the subgraph (redeploy under a new name) or keep it private.`);
-        process.exit(1);
-      }
-      handleApiError(err, "publish subgraph");
-    }
-  });
-  subgraphs.command("unpublish <name>", { hidden: true }).description("Make a subgraph private again — reads require your API key, the public name claim is released").action(async (name) => {
-    try {
-      await requireAuth();
-      await unpublishSubgraphApi(name);
-      success(`Subgraph "${name}" is now private (reads need your key)`);
-    } catch (err) {
-      handleApiError(err, "unpublish subgraph");
-    }
-  });
   subgraphs.command("scaffold [contractAddress]").description("Scaffold a defineSubgraph() file from a contract or trait").option("-o, --output <path>", "Output file path (required)").option("-k, --api-key <key>", "Stacks node API key for direct RPC URLs").option("--functions <names>", "Comma-separated public functions to index as typed contract_call tables").option("--trait <std>", "Scaffold a trait-scoped source (sip-009|sip-010|sip-013) — no contract needed").option("--no-install", "Skip bun install after writing package.json").addHelpText("after", `
 Examples:
   $ secondlayer subgraphs scaffold SP3D6PV2ACBPEKYJTCMH7HEN02KP87QSP8KTEH335.megapont-ape-club-nft -o subgraphs/apes.ts
@@ -30887,7 +30419,6 @@ var init_subgraphs2 = __esm(() => {
   init_resolve_auth();
   init_resolve_auth();
   init_clarity();
-  init_subgraph();
   init_api();
   init_format();
   ORM_ONLY_CODEGEN_FLAGS = {
@@ -34789,7 +34320,7 @@ init_esm();
 // package.json
 var package_default = {
   name: "@secondlayer/cli",
-  version: "10.4.0",
+  version: "12.0.0",
   repository: {
     type: "git",
     url: "git+https://github.com/ryanwaits/secondlayer.git",
@@ -34830,12 +34361,12 @@ var package_default = {
     "@biomejs/wasm-nodejs": "^1.9.0",
     "@dsnp/parquetjs": "^1.8.8",
     "@inquirer/prompts": "^8.2.0",
-    "@secondlayer/bundler": "^0.5.0",
-    "@secondlayer/scaffold": "^1.5.1",
-    "@secondlayer/sdk": "^6.54.1",
-    "@secondlayer/shared": "^7.11.2",
-    "@secondlayer/stacks": "^3.3.1",
-    "@secondlayer/subgraphs": "^3.26.4",
+    "@secondlayer/bundler": "^0.5.1",
+    "@secondlayer/scaffold": "^1.5.4",
+    "@secondlayer/sdk": "^8.0.0",
+    "@secondlayer/shared": "^9.0.0",
+    "@secondlayer/stacks": "^4.0.0",
+    "@secondlayer/subgraphs": "^4.0.1",
     esbuild: "^0.27.4",
     "smol-toml": "^1.6.1",
     zod: "^4.3.6"
@@ -34855,134 +34386,6 @@ var package_default = {
   }
 };
 
-// src/commands/account.ts
-init_api_client();
-init_output();
-
-// src/commands/billing.ts
-init_http();
-init_output();
-async function runBillingStatus(json) {
-  let res;
-  try {
-    res = await httpPlatform("/api/billing/status");
-  } catch (err) {
-    if (err instanceof CliHttpError) {
-      error(err.message);
-      process.exit(1);
-    }
-    throw err;
-  }
-  output({ json, data: res, human: () => renderBillingStatus(res) });
-}
-function addBillingCommand(parent) {
-  parent.command("billing").description("Show archive credit balance (hidden; use secondlayer credits)").option("--json", "Output as JSON").action((options) => runBillingStatus(options.json));
-}
-function renderBillingStatus(res) {
-  if (!res.subscription) {
-    console.log(formatKeyValue([
-      ["Credits", dim("secondlayer credits balance")],
-      [
-        "Buy",
-        dim("secondlayer credits buy --email you@example.com --pack 25")
-      ]
-    ]));
-    return;
-  }
-  const rows = [];
-  rows.push(["Plan", res.plan]);
-  rows.push([
-    "Customer",
-    res.stripeCustomerId ?? dim("(none — no subscription yet)")
-  ]);
-  const sub = res.subscription;
-  rows.push(["Subscription", `${sub.id} (${sub.status})`]);
-  if (sub.tier)
-    rows.push(["Tier", sub.tier]);
-  if (sub.amountCents !== null && sub.interval) {
-    const dollars = (sub.amountCents / 100).toFixed(2);
-    rows.push(["Price", `$${dollars} / ${sub.interval}`]);
-  }
-  if (sub.trialEnd) {
-    const days = Math.max(0, Math.round((new Date(sub.trialEnd).getTime() - Date.now()) / 86400000));
-    rows.push([
-      "Trial ends",
-      `${formatDate(sub.trialEnd)} (${days}d remaining)`
-    ]);
-  }
-  if (sub.currentPeriodEnd) {
-    rows.push(["Renews", formatDate(sub.currentPeriodEnd)]);
-  }
-  if (sub.cancelAtPeriodEnd) {
-    rows.push(["Cancels at period end", "yes"]);
-  }
-  if (sub.discount) {
-    const off = sub.discount.percentOff !== null ? `${sub.discount.percentOff}% off` : sub.discount.amountOff !== null ? `$${(sub.discount.amountOff / 100).toFixed(2)} off` : "discount";
-    const label = sub.discount.code ? `${sub.discount.code} (${sub.discount.name ?? "coupon"})` : sub.discount.name ?? "applied";
-    rows.push(["Discount", `${label} — ${off}, ${sub.discount.duration}`]);
-  }
-  console.log(formatKeyValue(rows));
-}
-function formatDate(iso) {
-  return new Date(iso).toISOString().slice(0, 10);
-}
-
-// src/commands/account.ts
-async function showProfile(json) {
-  const profile = await getAccountProfile();
-  output({
-    json,
-    data: profile,
-    human: () => console.log(formatKeyValue([
-      ["Email", profile.email],
-      ["Plan", profile.plan],
-      ["Display Name", profile.displayName ?? dim("—")],
-      ["Bio", profile.bio ?? dim("—")],
-      ["Slug", profile.slug ?? dim("—")],
-      [
-        "Notify on reindex complete",
-        profile.notifyReindexComplete ? "on" : "off"
-      ]
-    ]))
-  });
-}
-async function applyProfileUpdate(options, getOptionValueSource) {
-  const data = {};
-  if (options.name)
-    data.display_name = options.name;
-  if (options.bio)
-    data.bio = options.bio;
-  if (options.slug)
-    data.slug = options.slug;
-  if (getOptionValueSource("notifyReindexComplete") === "cli") {
-    data.notify_reindex_complete = options.notifyReindexComplete;
-  }
-  const updated = await updateAccountProfile(data);
-  output({
-    json: options.json,
-    data: updated,
-    human: () => {
-      success("Profile updated");
-      console.log(formatKeyValue([
-        ["Display Name", updated.displayName ?? dim("—")],
-        ["Bio", updated.bio ?? dim("—")],
-        ["Slug", updated.slug ?? dim("—")],
-        [
-          "Notify on reindex complete",
-          updated.notifyReindexComplete ? "on" : "off"
-        ]
-      ]));
-    }
-  });
-}
-function registerAccountCommand(program2) {
-  const account = program2.command("account", { hidden: true }).description("Manage your account profile");
-  addBillingCommand(account);
-  account.command("get").description("Show your account profile").option("--json", "Output as JSON").action(withErrorHandling(async (options) => showProfile(options.json), { action: "show profile" }));
-  account.command("update").description("Update your public profile").option("--name <name>", "Set display name").option("--bio <bio>", "Set bio").option("--slug <slug>", "Set public URL slug").option("--notify-reindex-complete", "Email me when a subgraph reindex finishes").option("--no-notify-reindex-complete", "Don't email me when a subgraph reindex finishes").option("--json", "Output as JSON").action(withErrorHandling(async (options, command) => applyProfileUpdate(options, (key) => command.getOptionValueSource(key)), {
-    action: "update profile"
-  }));
-}
 // src/commands/credits.ts
 init_http();
 init_output();
@@ -37409,46 +36812,6 @@ Examples:
 // src/commands/index.ts
 init_index_api();
 
-// src/commands/keys.ts
-init_output();
-init_resolve_auth();
-import { SecondLayer as SecondLayer4 } from "@secondlayer/sdk";
-function registerKeysCommand(program2) {
-  const keys = program2.command("keys", { hidden: true }).description("Manage API keys");
-  keys.command("create").description("Mint a scoped streams/index read key (requires an account-level key)").option("--product <product>", "Key scope: streams or index", "streams").option("--name <name>", "Optional label for the key").option("--json", "Print the full response as JSON").action(async (o3) => {
-    if (o3.product && o3.product !== "streams" && o3.product !== "index") {
-      error("--product must be 'streams' or 'index'");
-      process.exit(1);
-    }
-    const apiKey = resolveEnvKey();
-    if (!apiKey) {
-      error("No API key set. Export SL_API_KEY with an account-level key (issue one at https://www.secondlayer.tools/platform/api-keys).");
-      process.exit(1);
-    }
-    try {
-      const sl = new SecondLayer4({
-        baseUrl: resolveApiUrl(),
-        apiKey
-      });
-      const minted = await sl.apiKeys.create({
-        product: o3.product === "index" ? "index" : "streams",
-        name: o3.name
-      });
-      output({
-        json: o3.json,
-        data: minted,
-        human: () => {
-          success(`Created ${minted.product} key (${minted.prefix}…)`);
-          note("This key is shown once — store it now:");
-          writeData(minted.key);
-        }
-      });
-    } catch (err) {
-      error(err instanceof Error ? err.message : String(err));
-      process.exit(1);
-    }
-  });
-}
 // src/commands/doctor.ts
 init_config2();
 
@@ -38662,14 +38025,6 @@ async function readActiveProject(cwd, globalDefault) {
   }
   return null;
 }
-async function writeActiveProject(slug, cwd) {
-  const dir = join13(resolve11(cwd), DIRNAME);
-  await mkdir4(dir, { recursive: true });
-  const file = join13(dir, FILENAME);
-  await writeFile4(file, `${JSON.stringify({ slug }, null, 2)}
-`, "utf8");
-  return file;
-}
 
 // src/commands/whoami.ts
 init_resolve_auth();
@@ -38699,7 +38054,6 @@ function registerWhoamiCommand(program2) {
       json: options3.json,
       data: {
         email: account.email,
-        plan: account.plan,
         apiUrl: auth.apiUrl,
         authSource,
         project: active ? { slug: active.slug, source: active.resolvedFrom } : null
@@ -38707,7 +38061,6 @@ function registerWhoamiCommand(program2) {
       human: () => {
         const rows = [];
         rows.push(["Email", account.email]);
-        rows.push(["Plan", account.plan]);
         rows.push(["API URL", auth.apiUrl]);
         rows.push(["Auth", dim(authSource)]);
         if (active) {
@@ -38750,85 +38103,6 @@ function registerLogoutCommand(program2) {
     success("Logged out.");
   });
 }
-// src/commands/project.ts
-init_config2();
-init_http();
-init_output();
-function registerProjectCommand(program2) {
-  const project = program2.command("projects", { hidden: true }).alias("project").description("Manage your Secondlayer project");
-  project.command("list").alias("ls").description("List projects in your account").option("--json", "Output as JSON").action(async (options3) => {
-    try {
-      const res = await httpPlatform("/api/projects");
-      const active = await readActiveProject(process.cwd(), (await loadConfig2()).defaultProject);
-      output({
-        json: options3.json,
-        data: { projects: res.projects, active: active?.slug ?? null },
-        human: () => {
-          if (res.projects.length === 0) {
-            info("No project found.");
-            return;
-          }
-          const rows = res.projects.map((p2) => [
-            p2.slug === active?.slug ? `* ${p2.slug}` : `  ${p2.slug}`,
-            p2.name,
-            p2.network,
-            new Date(p2.createdAt).toLocaleDateString()
-          ]);
-          console.log(formatTable(["", "Name", "Network", "Created"], rows));
-          if (active) {
-            console.log(dim(`Active: ${active.slug} (from ${active.resolvedFrom})`));
-          }
-        }
-      });
-    } catch (err) {
-      handleProjectError(err);
-    }
-  });
-  project.command("use <slug>").description("Bind this directory to a project (writes ./.secondlayer/project)").action(async (slug) => {
-    try {
-      await httpPlatform(`/api/projects/${encodeURIComponent(slug)}`);
-    } catch (err) {
-      if (err instanceof CliHttpError && err.status === 404) {
-        error(`Project "${slug}" not found — run 'secondlayer project list' to see available projects`);
-        process.exit(1);
-      }
-      handleProjectError(err);
-    }
-    const path11 = await writeActiveProject(slug, process.cwd());
-    success(`Bound to project "${slug}"`);
-    info(dim(`Written to ${path11}`));
-    info(dim("Tip: add `.secondlayer/` to .gitignore — it's account-personal."));
-  });
-  project.command("get").description("Show the active project for this directory").option("--json", "Output as JSON").action(async (options3) => {
-    const config = await loadConfig2();
-    const active = await readActiveProject(process.cwd(), config.defaultProject);
-    output({
-      json: options3.json,
-      data: active ? { slug: active.slug, source: active.resolvedFrom } : null,
-      human: () => {
-        if (!active) {
-          info("No active project.");
-          info(dim("Run 'secondlayer project use <slug>' to bind this directory."));
-          return;
-        }
-        console.log(active.slug);
-        console.log(dim(`(from ${active.resolvedFrom})`));
-      }
-    });
-  });
-}
-function handleProjectError(err) {
-  if (err instanceof CliHttpError) {
-    if (err.code === "SESSION_EXPIRED") {
-      error("Session expired. Run: secondlayer login");
-      process.exit(1);
-    }
-    error(err.message);
-    process.exit(1);
-  }
-  error(err instanceof Error ? err.message : String(err));
-  process.exit(1);
-}
 // src/commands/verify.ts
 import {
   compareRangeDigests,
@@ -39419,6 +38693,7 @@ Exit codes:
   });
 }
 // src/commands/bootstrap.ts
+import { createHash as createHash3 } from "node:crypto";
 import { unlink as unlink3, writeFile as writeFile6 } from "node:fs/promises";
 import { tmpdir as tmpdir3 } from "node:os";
 import { join as join16 } from "node:path";
@@ -39430,6 +38705,7 @@ import {
 } from "@secondlayer/shared/archive/copy-loader";
 import { computeRangeDigest as computeRangeDigest3 } from "@secondlayer/shared/archive/range-digest";
 import { getDb as getDb4, getRawClient, sql as sql3 } from "@secondlayer/shared/db";
+import { upsertSyncScope } from "@secondlayer/shared/db/queries/sync-scope";
 
 // src/lib/bootstrap-resume.ts
 function planTornImport(input4) {
@@ -39466,6 +38742,18 @@ var BOOTSTRAP_EXIT = {
 };
 var BLOCKS_PER_DAY_ESTIMATE = 5400;
 var RESTORE_ROWS_PER_SECOND = 30000;
+function archiveScopeBounds(partitions) {
+  if (partitions.length === 0)
+    return null;
+  return {
+    start_height: Math.min(...partitions.map((p2) => p2.from_block)),
+    tip_height: Math.max(...partitions.map((p2) => p2.to_block))
+  };
+}
+function manifestDigest(manifest) {
+  const { signature: _signature, key_id: _keyId, ...payload } = manifest;
+  return createHash3("sha256").update(JSON.stringify(payload)).digest("hex");
+}
 async function readNodeTip() {
   const url = process.env.STACKS_NODE_RPC_URL ?? "http://localhost:20443";
   try {
@@ -39520,10 +38808,11 @@ async function loadPartition(reference, partition, rawClient) {
   return written;
 }
 function attachBootstrapCommand(cmd) {
-  return cmd.requiredOption("--against <manifest>", "archive manifest: an https URL or a local file path").option("--to-block <n>", "stop at this height instead of the archive tip").option("--public-key <pem>", "pin the signing key instead of fetching it").option("-y, --yes", "skip the confirmation prompt").option("--json", "Output as JSON").addHelpText("after", `
+  return cmd.requiredOption("--against <manifest>", "archive manifest: an https URL or a local file path").option("--to-block <n>", "stop at this height instead of the archive tip").option("--from-block <n>", "forward-only: restore from this height instead of genesis; earlier history is declared out of scope").option("--public-key <pem>", "pin the signing key instead of fetching it").option("-y, --yes", "skip the confirmation prompt").option("--json", "Output as JSON").addHelpText("after", `
 Examples:
   $ secondlayer bootstrap --against https://archive.secondlayer.tools/.../snapshots/<digest>.json
   $ secondlayer bootstrap --against ./snapshot.json --to-block 4000000 --yes
+  $ secondlayer bootstrap --against ./snapshot.json --from-block 8000000 --yes
 
 Exit codes:
   0  restored and verified
@@ -39548,7 +38837,8 @@ Exit codes:
       const maxHeightRow = await db.selectFrom("blocks").select(({ fn }) => fn.max("height").as("max")).executeTakeFirst();
       const maxBlockHeight = maxHeightRow?.max === null || maxHeightRow?.max === undefined ? null : Number(maxHeightRow.max);
       const toBlock = opts.toBlock === undefined ? undefined : Number(opts.toBlock);
-      const declared = (reference.manifest.partitions ?? []).filter((p2) => toBlock === undefined || p2.to_block <= toBlock);
+      const fromBlock = opts.fromBlock === undefined ? undefined : Number(opts.fromBlock);
+      const declared = (reference.manifest.partitions ?? []).filter((p2) => (toBlock === undefined || p2.to_block <= toBlock) && (fromBlock === undefined || p2.from_block >= fromBlock));
       const resume = planTornImport({
         hasIndexProgress: !!progress,
         maxBlockHeight,
@@ -39575,6 +38865,8 @@ Exit codes:
         });
         process.exit(BOOTSTRAP_EXIT.REFUSED);
       }
+      const scopeBounds = archiveScopeBounds(declared);
+      const startHeight = scopeBounds?.start_height ?? 0;
       const totalRows = partitions.reduce((sum, p2) => sum + p2.row_count, 0);
       const totalBytes = partitions.reduce((sum, p2) => sum + p2.byte_size, 0);
       const tipHeight = Math.max(...partitions.map((p2) => p2.to_block));
@@ -39584,7 +38876,10 @@ Exit codes:
         console.error("");
         console.error(formatKeyValue([
           ["archive", reference.origin],
-          ["coverage", `genesis → ${tipHeight.toLocaleString()}`],
+          [
+            "coverage",
+            `${startHeight === 0 ? "genesis" : startHeight.toLocaleString()} → ${tipHeight.toLocaleString()}`
+          ],
           ["rows", totalRows.toLocaleString()],
           ["download", `${(totalBytes / 1e9).toFixed(1)} GB`],
           ["signature", "verified"]
@@ -39642,6 +38937,17 @@ Exit codes:
 						highest_seen_block = GREATEST(index_progress.highest_seen_block, EXCLUDED.highest_seen_block),
 						updated_at = NOW()
 				`.execute(db);
+      const genesisRow = startHeight === 0 ? await db.selectFrom("blocks").select("hash").where("canonical", "=", true).where("height", "=", 0).executeTakeFirst() : undefined;
+      await upsertSyncScope(db, {
+        network,
+        start_height: startHeight,
+        target_height: null,
+        bootstrap: {
+          source: "archive",
+          manifest_digest: manifestDigest(reference.manifest),
+          genesis_hash: genesisRow?.hash ?? null
+        }
+      });
       const seam = nodeTipAtStart !== null && nodeTipAtStart > tipHeight ? {
         nodeTip: nodeTipAtStart,
         gap: nodeTipAtStart - tipHeight
@@ -39650,6 +38956,7 @@ Exit codes:
       const report = {
         status: divergent === 0 ? "restored" : "divergent",
         archive: reference.origin,
+        start_height: startHeight,
         tip_height: tipHeight,
         rows: loaded,
         ranges_verified: referenceDigests.length,
@@ -39672,6 +38979,9 @@ Exit codes:
             }
             console.error("");
             console.error(dim(`Your instance holds history through ${tipHeight.toLocaleString()} and will resume at ${(tipHeight + 1).toLocaleString()}.`));
+            if (startHeight > 0) {
+              console.error(dim(`  Scope starts at ${startHeight.toLocaleString()} — earlier history is declared out of scope, not missing.`));
+            }
             if (seam) {
               console.error(dim(`The chain advanced to ${seam.nodeTip.toLocaleString()} while restoring — ${seam.gap.toLocaleString()} blocks to catch up.`));
               console.error(dim("  Start the indexer; it backfills that range before following the tip."));
@@ -39696,10 +39006,265 @@ Exit codes:
 function registerBootstrapCommand(program2) {
   attachBootstrapCommand(program2.command("bootstrap").description("Restore chain history from a verified archive instead of syncing from genesis"));
 }
+// src/commands/backup.ts
+init_output();
+import { createHash as createHash4 } from "node:crypto";
+import {
+  chmodSync,
+  existsSync as existsSync8,
+  mkdirSync as mkdirSync6,
+  readFileSync as readFileSync7,
+  statSync as statSync3,
+  writeFileSync as writeFileSync7
+} from "node:fs";
+import { join as join17, resolve as resolve13 } from "node:path";
+import { getDb as getDb5, sql as sql4 } from "@secondlayer/shared/db";
+import {
+  decryptBundle,
+  encryptBundle,
+  keyMatchesCanary,
+  planBackup,
+  precheckRestore,
+  sealKeyCanary
+} from "@secondlayer/shared/runtime";
+var BACKUP_EXIT = { OK: 0, FAILED: 1, REFUSED: 2 };
+var MANIFEST_FILE = "manifest.json";
+var DB_FILE = "db.dump";
+var SECRETS_FILE = "secrets.enc";
+var SECRET_ENV_KEYS = [
+  "INSTANCE_TOKEN",
+  "SECONDLAYER_SECRETS_KEY",
+  "STREAMS_SIGNING_PRIVATE_KEY",
+  "SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY",
+  "SL_API_KEY",
+  "ARCHIVE_SIGNING_PUBLIC_KEY"
+];
+function readSecretsKey() {
+  const key = process.env.SECONDLAYER_SECRETS_KEY?.trim();
+  return key ? key : undefined;
+}
+function sha256File(path11) {
+  return createHash4("sha256").update(readFileSync7(path11)).digest("hex");
+}
+async function readScope() {
+  const db = getDb5();
+  const bounds = await sql4`SELECT MIN(height)::text AS min, MAX(height)::text AS max FROM blocks WHERE canonical = true`.execute(db);
+  const row = bounds.rows[0];
+  const network = process.env.STACKS_NETWORK ?? "mainnet";
+  return {
+    network,
+    fromHeight: row?.min ? Number(row.min) : 0,
+    toHeight: row?.max ? Number(row.max) : null
+  };
+}
+function requireDatabaseUrl() {
+  const url = process.env.DATABASE_URL?.trim();
+  if (!url)
+    throw new Error("DATABASE_URL is required");
+  return url;
+}
+async function runProcess(cmd, label) {
+  const proc = Bun.spawn(cmd, { stdout: "pipe", stderr: "pipe" });
+  const stderr = await new Response(proc.stderr).text();
+  const code = await proc.exited;
+  if (code !== 0) {
+    return { ok: false, stderr: `${label} exited ${code}: ${stderr.trim()}` };
+  }
+  return { ok: true, stderr };
+}
+function attachBackupCommand(cmd) {
+  return cmd.requiredOption("--out <dir>", "directory to write the bundle into").option("--passphrase <passphrase>", "encrypt bundled secrets (or set SECONDLAYER_BACKUP_PASSPHRASE)").option("--no-secrets", "omit keys; the bundle restores data only").option("--json", "Output as JSON").action(async (opts) => {
+    try {
+      await runBackup(opts);
+    } catch (error2) {
+      printError(error2 instanceof Error ? error2.message : String(error2));
+      process.exit(BACKUP_EXIT.FAILED);
+    }
+  });
+}
+async function runBackup(opts) {
+  const databaseUrl = requireDatabaseUrl();
+  const includeSecrets = opts.secrets !== false;
+  const passphrase = opts.passphrase ?? process.env.SECONDLAYER_BACKUP_PASSPHRASE ?? "";
+  const secretsKey = readSecretsKey();
+  if (includeSecrets && !secretsKey) {
+    printError("SECONDLAYER_SECRETS_KEY is not set, so this backup cannot carry the keys that decrypt your data. Set it, or pass --no-secrets to take a data-only bundle.");
+    process.exit(BACKUP_EXIT.REFUSED);
+  }
+  const scope = await readScope();
+  const plan = planBackup({
+    network: scope.network,
+    fromHeight: scope.fromHeight,
+    toHeight: scope.toHeight,
+    includeSecrets,
+    secretsEncrypted: includeSecrets && passphrase.length > 0,
+    canary: secretsKey ? sealKeyCanary(secretsKey) : undefined
+  });
+  if (!plan.ok) {
+    printError(plan.reason);
+    process.exit(BACKUP_EXIT.REFUSED);
+  }
+  const outDir = resolve13(opts.out);
+  mkdirSync6(outDir, { recursive: true });
+  console.error("dumping database…");
+  const dumpPath = join17(outDir, DB_FILE);
+  const dump = await runProcess(["pg_dump", "-Fc", "--no-owner", "--no-acl", "-f", dumpPath, databaseUrl], "pg_dump");
+  if (!dump.ok) {
+    printError(dump.stderr);
+    process.exit(BACKUP_EXIT.FAILED);
+  }
+  const manifest = {
+    ...plan.manifest,
+    db: {
+      file: DB_FILE,
+      sha256: sha256File(dumpPath),
+      bytes: statSync3(dumpPath).size,
+      format: "pg_dump-custom"
+    }
+  };
+  if (includeSecrets && secretsKey) {
+    const lines2 = SECRET_ENV_KEYS.filter((k2) => process.env[k2]).map((k2) => `${k2}=${process.env[k2]}`);
+    const sealed = encryptBundle(lines2.join(`
+`), passphrase);
+    const secretsPath = join17(outDir, SECRETS_FILE);
+    writeFileSync7(secretsPath, sealed);
+    chmodSync(secretsPath, 384);
+    manifest.secrets = {
+      file: SECRETS_FILE,
+      encrypted: true,
+      canary: sealKeyCanary(secretsKey)
+    };
+  }
+  writeFileSync7(join17(outDir, MANIFEST_FILE), `${JSON.stringify(manifest, null, 2)}
+`);
+  output({
+    json: opts.json,
+    data: { out: outDir, manifest },
+    human: () => {
+      success(`backup written to ${outDir}`);
+      note(`blocks ${manifest.scope.from_height}–${manifest.scope.to_height ?? "?"} · ${(manifest.db?.bytes ?? 0) / 1024 ** 2 | 0} MB`);
+      if (!manifest.secrets) {
+        warn("no keys in this bundle — it can restore data, but not a working instance");
+      } else {
+        note("keys are encrypted; keep the passphrase somewhere else");
+      }
+    }
+  });
+}
+function attachRestoreCommand(cmd) {
+  return cmd.requiredOption("--from <dir>", "bundle directory to restore from").option("--passphrase <passphrase>", "decrypt bundled secrets (or set SECONDLAYER_BACKUP_PASSPHRASE)").option("--apply", "actually restore (default is a dry run)").option("--force", "restore over a database that already holds chain data").option("--json", "Output as JSON").action(async (opts) => {
+    try {
+      await runRestore(opts);
+    } catch (error2) {
+      printError(error2 instanceof Error ? error2.message : String(error2));
+      process.exit(BACKUP_EXIT.FAILED);
+    }
+  });
+}
+async function runRestore(opts) {
+  const databaseUrl = requireDatabaseUrl();
+  const dir = resolve13(opts.from);
+  const manifestPath = join17(dir, MANIFEST_FILE);
+  if (!existsSync8(manifestPath)) {
+    printError(`no ${MANIFEST_FILE} in ${dir}`);
+    process.exit(BACKUP_EXIT.REFUSED);
+  }
+  const manifest = JSON.parse(readFileSync7(manifestPath, "utf8"));
+  const dumpPath = join17(dir, manifest.db?.file ?? DB_FILE);
+  if (manifest.db && sha256File(dumpPath) !== manifest.db.sha256) {
+    printError("the database dump does not match the digest in the manifest; this bundle is corrupt or truncated");
+    process.exit(BACKUP_EXIT.REFUSED);
+  }
+  const envKey = readSecretsKey();
+  let bundleKey;
+  if (manifest.secrets) {
+    const passphrase = opts.passphrase ?? process.env.SECONDLAYER_BACKUP_PASSPHRASE ?? "";
+    if (!passphrase) {
+      printError("this bundle carries encrypted keys; supply --passphrase to read them");
+      process.exit(BACKUP_EXIT.REFUSED);
+    }
+    try {
+      const env2 = decryptBundle(readFileSync7(join17(dir, manifest.secrets.file)), passphrase);
+      bundleKey = env2.split(`
+`).find((l2) => l2.startsWith("SECONDLAYER_SECRETS_KEY="))?.slice("SECONDLAYER_SECRETS_KEY=".length).trim();
+    } catch {
+      printError("could not decrypt the secrets bundle — wrong passphrase?");
+      process.exit(BACKUP_EXIT.REFUSED);
+    }
+  }
+  if (envKey && manifest.secrets && !keyMatchesCanary(manifest.secrets.canary, envKey)) {
+    printError("SECONDLAYER_SECRETS_KEY in this environment is NOT the key this backup was taken with. Restoring would leave every encrypted column unreadable. Unset it to install the bundle's key, or point this restore at the matching instance.");
+    process.exit(BACKUP_EXIT.REFUSED);
+  }
+  const db = getDb5();
+  const present = await sql4`SELECT to_regclass('public.blocks') IS NOT NULL AS present`.execute(db);
+  let targetIsEmpty = true;
+  if (present.rows[0]?.present) {
+    const existing = await sql4`SELECT COUNT(*)::text AS count FROM blocks`.execute(db);
+    targetIsEmpty = (existing.rows[0]?.count ?? "0") === "0";
+  }
+  const check = precheckRestore({
+    manifest,
+    targetNetwork: process.env.STACKS_NETWORK ?? "mainnet",
+    targetIsEmpty,
+    force: opts.force === true,
+    secretsKeyHex: envKey ?? bundleKey
+  });
+  if (!check.ok) {
+    printError(check.reason);
+    process.exit(BACKUP_EXIT.REFUSED);
+  }
+  if (!opts.apply) {
+    output({
+      json: opts.json,
+      data: { dryRun: true, manifest, targetIsEmpty },
+      human: () => {
+        note("dry run — nothing written. Pass --apply to restore.");
+        note(`would restore ${manifest.network} blocks ${manifest.scope.from_height}–${manifest.scope.to_height ?? "?"}`);
+        if (bundleKey && !envKey) {
+          note("after restoring, install the bundle's keys before starting the runtime");
+        }
+      }
+    });
+    return;
+  }
+  console.error("restoring database…");
+  const restore = await runProcess([
+    "pg_restore",
+    "--no-owner",
+    "--no-acl",
+    "--clean",
+    "--if-exists",
+    "-d",
+    databaseUrl,
+    dumpPath
+  ], "pg_restore");
+  if (!restore.ok) {
+    printError(restore.stderr);
+    process.exit(BACKUP_EXIT.FAILED);
+  }
+  output({
+    json: opts.json,
+    data: { restored: true, manifest },
+    human: () => {
+      success("restore complete");
+      if (bundleKey && !envKey) {
+        warn("set SECONDLAYER_SECRETS_KEY from the bundle before starting the runtime, or it will generate a new one and the restored data will not decrypt");
+      }
+      note("verify with: secondlayer verify all --against <manifest>");
+    }
+  });
+}
+function registerBackupCommand(program2) {
+  attachBackupCommand(program2.command("backup").description("Write a restorable bundle: index, keys, and scope"));
+}
+function registerRestoreCommand(program2) {
+  attachRestoreCommand(program2.command("restore").description("Restore an instance from a backup bundle"));
+}
 // src/lib/instance-init.ts
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { existsSync as existsSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "node:fs";
-import { resolve as resolve13 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync8 } from "node:fs";
+import { resolve as resolve14 } from "node:path";
 import { generateEd25519KeyPair } from "@secondlayer/shared/crypto/ed25519";
 import { INSTANCE_NETWORKS } from "@secondlayer/shared/db/queries/instance";
 var INSTANCE_ENV_FILE = ".env.local";
@@ -39733,9 +39298,9 @@ function unescapeEnvValue(raw) {
 `).replace(/\\"/g, '"').replace(/\\\\/g, "\\");
 }
 function readEnvValue(envPath, key) {
-  if (!existsSync8(envPath))
+  if (!existsSync9(envPath))
     return null;
-  const match = readFileSync7(envPath, "utf8").match(new RegExp(`^${key}=(.*)$`, "m"));
+  const match = readFileSync8(envPath, "utf8").match(new RegExp(`^${key}=(.*)$`, "m"));
   return match ? unescapeEnvValue(match[1]) : null;
 }
 function buildInstanceEnv(input4) {
@@ -39778,12 +39343,12 @@ function renderInstanceEnv(env2) {
 `);
 }
 function writeInstanceEnv(cwd, env2, file = INSTANCE_ENV_FILE) {
-  const path11 = resolve13(cwd, file);
-  writeFileSync7(path11, renderInstanceEnv(env2), { mode: 384 });
+  const path11 = resolve14(cwd, file);
+  writeFileSync8(path11, renderInstanceEnv(env2), { mode: 384 });
   return path11;
 }
 function loadExistingInstanceEnv(cwd, file = INSTANCE_ENV_FILE) {
-  const path11 = resolve13(cwd, file);
+  const path11 = resolve14(cwd, file);
   return {
     INSTANCE_TOKEN: readEnvValue(path11, "INSTANCE_TOKEN"),
     SECONDLAYER_SECRETS_KEY: readEnvValue(path11, "SECONDLAYER_SECRETS_KEY"),
@@ -39969,7 +39534,6 @@ registerSubscriptionsCommand(program);
 registerStreamsCommand(program);
 registerIndexCommand(program);
 program.commandsGroup("Project & codegen:");
-registerProjectCommand(program);
 registerCodegenCommand(program);
 var configureGenerate = (cmd) => cmd.option("-c, --config <path>", "Path to config file").option("-o, --output <path>", "Output file path (required when using direct files)").option("-k, --api-key <key>", "Stacks node API key for direct RPC URLs").option("-w, --watch", "Watch for changes").action(async (files, options3) => {
   const { deprecatedCodegenNotice: deprecatedCodegenNotice2 } = await Promise.resolve().then(() => (init_codegen(), exports_codegen));
@@ -39994,11 +39558,11 @@ registerConfigCommand(program);
 registerContextCommand(program);
 registerVerifyCommand(program);
 registerRepairCommand(program);
+registerBackupCommand(program);
+registerRestoreCommand(program);
 program.commandsGroup("Account:");
 registerCreditsCommand(program);
-registerAccountCommand(program);
-registerKeysCommand(program);
 program.parse();
 
-//# debugId=1A69CC6C65B95E8B64756E2164756E21
+//# debugId=D0F621CCA5D6F2E664756E2164756E21
 //# sourceMappingURL=cli.js.map