@secondlayer/cli 13.0.3 → 14.0.0

package/dist/cli.js

@@ -2481,6 +2481,15 @@ var require_commander = __commonJS((exports) => {
   exports.InvalidOptionArgumentError = InvalidArgumentError;
 });
 
+// src/lib/api-url.ts
+function resolveApiUrl() {
+  return (process.env.SL_API_URL ?? process.env.SL_PLATFORM_API_URL ?? LOCAL_API_URL).replace(/\/+$/, "");
+}
+function resolveArchiveOpsUrl() {
+  return (process.env.SL_CREDITS_API_URL ?? ARCHIVE_OPS_API_URL).replace(/\/+$/, "");
+}
+var LOCAL_API_URL = "http://127.0.0.1:3800", ARCHIVE_OPS_API_URL = "https://api.secondlayer.tools";
+
 // src/lib/session.ts
 import {
   chmod,
@@ -2493,21 +2502,47 @@ import {
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { z } from "zod";
-async function readSession() {
+function getSessionPath() {
+  return join(process.env.HOME || homedir(), ".secondlayer", "session.json");
+}
+function sessionKey(apiUrl) {
+  return apiUrl.replace(/\/+$/, "");
+}
+function parseSessionFile(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { sessions: {} };
+  }
+  const scoped = SessionFileSchema.safeParse(parsed);
+  if (scoped.success)
+    return scoped.data;
+  const flat = SessionSchema.safeParse(parsed);
+  if (flat.success) {
+    return { sessions: { [sessionKey(ARCHIVE_OPS_API_URL)]: flat.data } };
+  }
+  return { sessions: {} };
+}
+async function readSessionFile(path2) {
   try {
-    const raw = await readFile(SESSION_PATH, "utf8");
-    return SessionSchema.parse(JSON.parse(raw));
+    return parseSessionFile(await readFile(path2, "utf8"));
   } catch (err) {
-    if (err?.code === "ENOENT")
-      return null;
-    return null;
+    if (err?.code === "ENOENT") {
+      return { sessions: {} };
+    }
+    return { sessions: {} };
   }
 }
-async function writeSession(session, path2 = SESSION_PATH) {
+async function readSession(apiUrl = resolveApiUrl(), path2 = getSessionPath()) {
+  const file = await readSessionFile(path2);
+  return file.sessions[sessionKey(apiUrl)] ?? null;
+}
+async function writeSessionFile(file, path2) {
   const dir = dirname(path2);
   await mkdir(dir, { recursive: true });
   const tmp = join(dir, `.session.${process.pid}.tmp`);
-  await writeFile(tmp, `${JSON.stringify(session, null, 2)}
+  await writeFile(tmp, `${JSON.stringify(file, null, 2)}
 `, {
     mode: 384,
     encoding: "utf8"
@@ -2515,10 +2550,21 @@ async function writeSession(session, path2 = SESSION_PATH) {
   await chmod(tmp, 384);
   await rename(tmp, path2);
 }
-async function clearSession() {
-  await rm(SESSION_PATH, { force: true });
+async function writeSession(session, apiUrl = resolveApiUrl(), path2 = getSessionPath()) {
+  const file = await readSessionFile(path2);
+  file.sessions[sessionKey(apiUrl)] = session;
+  await writeSessionFile(file, path2);
+}
+async function clearSession(apiUrl = resolveApiUrl(), path2 = getSessionPath()) {
+  const file = await readSessionFile(path2);
+  delete file.sessions[sessionKey(apiUrl)];
+  if (Object.keys(file.sessions).length === 0) {
+    await rm(path2, { force: true });
+    return;
+  }
+  await writeSessionFile(file, path2);
 }
-var SessionSchema, SESSION_DIR, SESSION_PATH;
+var SessionSchema, SessionFileSchema;
 var init_session = __esm(() => {
   SessionSchema = z.object({
     token: z.string().min(1),
@@ -2526,15 +2572,13 @@ var init_session = __esm(() => {
     accountId: z.string().uuid(),
     expiresAt: z.string()
   });
-  SESSION_DIR = join(homedir(), ".secondlayer");
-  SESSION_PATH = join(SESSION_DIR, "session.json");
+  SessionFileSchema = z.object({
+    sessions: z.record(z.string(), SessionSchema)
+  });
 });
 
 // src/lib/resolve-auth.ts
 import { resolveApiKey } from "@secondlayer/sdk";
-function resolveApiUrl() {
-  return (process.env.SL_API_URL ?? process.env.SL_PLATFORM_API_URL ?? LOCAL_API_URL).replace(/\/+$/, "");
-}
 function resolveEnvKey() {
   return resolveApiKey();
 }
@@ -2562,7 +2606,6 @@ function isOssMode() {
     return true;
   }
 }
-var LOCAL_API_URL = "http://127.0.0.1:3800", ARCHIVE_OPS_API_URL = "https://api.secondlayer.tools";
 var init_resolve_auth = __esm(() => {
   init_session();
 });
@@ -2596,40 +2639,55 @@ async function request(url, opts) {
     return;
   return await res.json();
 }
-async function httpPlatform(path2, opts = {}) {
-  let auth;
-  try {
-    auth = await resolveAuth();
-  } catch {
-    throw new CliHttpError(401, "SESSION_EXPIRED", { error: "Not logged in" }, isOssMode() ? "Not authenticated — set INSTANCE_TOKEN from `secondlayer init`" : "Not logged in — run `secondlayer login`");
-  }
-  return request(`${auth.apiUrl}${path2}`, {
-    ...opts,
-    bearer: auth.ephemeralKey
-  });
+async function httpAt(baseUrl, path2, opts = {}) {
+  return request(`${baseUrl.replace(/\/+$/, "")}${path2}`, opts);
 }
 async function httpPlatformAnon(path2, opts = {}) {
-  return request(`${resolveApiUrl()}${path2}`, opts);
-}
-function resolveArchiveOpsUrl() {
-  return (process.env.SL_CREDITS_API_URL ?? ARCHIVE_OPS_API_URL).replace(/\/+$/, "");
+  return httpAt(resolveApiUrl(), path2, opts);
 }
 async function httpArchiveOpsAnon(path2, opts = {}) {
-  return request(`${resolveArchiveOpsUrl()}${path2}`, opts);
+  return httpAt(resolveArchiveOpsUrl(), path2, opts);
 }
-async function httpArchiveOps(path2, opts = {}) {
+async function resolveArchiveOpsBearer() {
   const envKey = resolveEnvKey();
-  const session = envKey ? null : await readSession();
-  const bearer = envKey ?? session?.token;
+  const session = await readSession(resolveArchiveOpsUrl());
+  if (session) {
+    return {
+      bearer: session.token,
+      source: "session",
+      ignoredEnvKey: false
+    };
+  }
+  if (envKey && ARCHIVE_CREDENTIAL_RE.test(envKey)) {
+    return { bearer: envKey, source: "env", ignoredEnvKey: false };
+  }
+  return {
+    bearer: undefined,
+    source: null,
+    ignoredEnvKey: envKey !== undefined
+  };
+}
+function ignoredEnvKeyNote(ignored) {
+  return ignored ? " INSTANCE_TOKEN was ignored: it unlocks this instance, not archive credits." : "";
+}
+async function httpArchiveOps(path2, opts = {}) {
+  const { bearer, ignoredEnvKey } = await resolveArchiveOpsBearer();
   if (!bearer) {
-    throw new CliHttpError(401, "SESSION_EXPIRED", { error: "Not logged in" }, "Not logged in — run `SL_API_URL=https://api.secondlayer.tools secondlayer login`");
+    throw new CliHttpError(401, "SESSION_EXPIRED", { error: "Not logged in" }, `Archive credits need a login. Run \`${ARCHIVE_LOGIN_COMMAND}\`.${ignoredEnvKeyNote(ignoredEnvKey)}`);
+  }
+  try {
+    return await request(`${resolveArchiveOpsUrl()}${path2}`, {
+      ...opts,
+      bearer
+    });
+  } catch (err) {
+    if (err instanceof CliHttpError && err.status === 401) {
+      throw new CliHttpError(401, err.code, err.body, `Archive credits rejected the login (${err.message}). Run \`${ARCHIVE_LOGIN_COMMAND}\` again.${ignoredEnvKeyNote(ignoredEnvKey)}`);
+    }
+    throw err;
   }
-  return request(`${resolveArchiveOpsUrl()}${path2}`, {
-    ...opts,
-    bearer
-  });
 }
-var CliHttpError, REQUEST_TIMEOUT_MS = 30000;
+var CliHttpError, REQUEST_TIMEOUT_MS = 30000, ARCHIVE_LOGIN_COMMAND = "secondlayer login --credits", ARCHIVE_CREDENTIAL_RE;
 var init_http = __esm(() => {
   init_resolve_auth();
   init_session();
@@ -2645,6 +2703,7 @@ var init_http = __esm(() => {
       this.body = body;
     }
   };
+  ARCHIVE_CREDENTIAL_RE = /^s[ks]-sl_/;
 });
 
 // src/lib/output.ts
@@ -2748,6 +2807,25 @@ function formatKeyValue(pairs) {
   return pairs.map(([key, value]) => `${dim(key.padEnd(maxKeyLen))}  ${value}`).join(`
 `);
 }
+async function confirmDestructive(opts) {
+  if (opts.yes)
+    return true;
+  if (!process.stdin.isTTY) {
+    error("Interactive prompt unavailable (stdin is not a TTY). Re-run with -y to skip confirmation.");
+    process.exit(1);
+  }
+  const { confirm } = await import("@inquirer/prompts");
+  try {
+    return await confirm({ message: opts.message, default: false });
+  } catch (promptErr) {
+    const m = promptErr instanceof Error ? promptErr.message : String(promptErr);
+    if (m.includes("ExitPromptError") || m.includes("force closed")) {
+      error("Interactive prompt unavailable. Re-run with -y to skip confirmation.");
+      process.exit(1);
+    }
+    throw promptErr;
+  }
+}
 var colorEnabled, colors, ANSI_ESCAPE_PATTERN;
 var init_output = __esm(() => {
   colorEnabled = (() => {
@@ -28398,7 +28476,15 @@ var init_api_client = __esm(() => {
 });
 
 // src/lib/fs.ts
-import { mkdir as mkdir2, readFile as readFile2, stat, unlink, writeFile as writeFile2 } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import {
+  mkdir as mkdir2,
+  open,
+  readFile as readFile2,
+  stat,
+  unlink,
+  writeFile as writeFile2
+} from "node:fs/promises";
 async function readJsonFile(path11) {
   const text2 = await readFile2(path11, "utf-8");
   return JSON.parse(text2);
@@ -28420,6 +28506,24 @@ async function ensureDir(path11) {
 async function removeFile(path11) {
   await unlink(path11);
 }
+async function sha256File(path11) {
+  const hash = createHash("sha256");
+  const chunk = Buffer.allocUnsafe(1024 * 1024);
+  const fh = await open(path11, "r");
+  try {
+    let position = 0;
+    for (;; ) {
+      const { bytesRead } = await fh.read(chunk, 0, chunk.length, position);
+      if (bytesRead === 0)
+        break;
+      hash.update(chunk.subarray(0, bytesRead));
+      position += bytesRead;
+    }
+  } finally {
+    await fh.close();
+  }
+  return hash.digest("hex");
+}
 var init_fs = () => {};
 
 // src/lib/config.ts
@@ -28521,6 +28625,10 @@ function applyEnvOverrides(config) {
     const net2 = process.env.STACKS_NETWORK;
     if (net2 === "local" || net2 === "testnet" || net2 === "mainnet") {
       result.network = net2;
+    } else if (net2 === "devnet") {
+      result.network = "local";
+    } else {
+      console.error(`Warning: STACKS_NETWORK=${net2} is not mainnet, testnet, or devnet; using ${result.network}`);
     }
   }
   if (process.env.SL_DATA_DIR) {
@@ -28755,11 +28863,11 @@ function inspectSourceGitState(absPath) {
   if (tracked === null) {
     return { kind: "untracked" };
   }
-  const status = runGit(["status", "--porcelain", "--", absPath], cwd);
-  if (status === null) {
+  const unstaged = runGit(["diff", "--name-only", "--", absPath], cwd);
+  if (unstaged === null) {
     return { kind: "not-a-repo" };
   }
-  if (status.length > 0) {
+  if (unstaged.length > 0) {
     return { kind: "modified" };
   }
   return { kind: "clean" };
@@ -28777,19 +28885,21 @@ async function readStdin() {
     chunks.push(chunk);
   return Buffer.concat(chunks).toString("utf8").trim();
 }
-async function runTokenLogin() {
+function loginTarget(opts) {
+  return opts.credits ? resolveArchiveOpsUrl() : resolveApiUrl();
+}
+async function runTokenLogin(opts) {
   const token = await readStdin();
   if (!token) {
     error('No token on stdin. Usage: echo "$KEY" | secondlayer login --with-token');
     process.exit(1);
   }
-  process.env.INSTANCE_TOKEN = token;
-  process.env.SL_API_KEY = token;
+  const target = loginTarget(opts);
   let account;
   try {
-    account = await httpPlatform("/api/accounts/me");
+    account = await httpAt(target, "/api/accounts/me", { bearer: token });
   } catch (err) {
-    error(err instanceof CliHttpError ? `Token rejected: ${err.message}` : err instanceof Error ? err.message : String(err));
+    error(err instanceof CliHttpError ? `Token rejected by ${target}: ${err.message}` : err instanceof Error ? err.message : String(err));
     process.exit(1);
   }
   await writeSession({
@@ -28797,14 +28907,15 @@ async function runTokenLogin() {
     email: account.email,
     accountId: account.id,
     expiresAt: sessionExpiry()
-  });
-  success(`Logged in as ${account.email}`);
+  }, target);
+  success(`Logged in as ${account.email} (${target})`);
 }
 async function runLoginFlow(options3 = {}) {
+  const target = loginTarget(options3);
   if (!options3.force) {
-    const existing = await readSession();
+    const existing = await readSession(target);
     if (existing) {
-      info(`Already logged in as ${existing.email}.`);
+      info(`Already logged in as ${existing.email} (${target}).`);
       if (!process.stdin.isTTY) {
         info(dim("Run 'secondlayer logout' first, or re-run with --force to switch accounts."));
         return;
@@ -28829,7 +28940,7 @@ async function runLoginFlow(options3 = {}) {
     validate: (v2) => /^.+@.+\..+$/.test(v2) ? true : "Invalid email"
   });
   try {
-    const res = await httpPlatformAnon("/api/auth/magic-link", {
+    const res = await httpAt(target, "/api/auth/magic-link", {
       method: "POST",
       body: { email }
     });
@@ -28850,7 +28961,7 @@ async function runLoginFlow(options3 = {}) {
     validate: (v2) => /^\d{6}$/.test(v2) ? true : "Expected 6 digits"
   });
   try {
-    const verified = await httpPlatformAnon("/api/auth/verify", {
+    const verified = await httpAt(target, "/api/auth/verify", {
       method: "POST",
       body: { email, code }
     });
@@ -28859,9 +28970,9 @@ async function runLoginFlow(options3 = {}) {
       email: verified.account.email,
       accountId: verified.account.id,
       expiresAt: sessionExpiry()
-    });
+    }, target);
     success(`Logged in as ${verified.account.email}`);
-    info(dim("Run 'secondlayer whoami' to see your account status."));
+    info(dim(options3.credits ? "Run 'secondlayer credits balance' to see your archive credits." : "Run 'secondlayer whoami' to see your account status."));
   } catch (err) {
     if (err instanceof CliHttpError) {
       error(err.message);
@@ -28872,10 +28983,10 @@ async function runLoginFlow(options3 = {}) {
   }
 }
 function registerLoginCommand(program2) {
-  program2.command("login", { hidden: true }).description("Log in to Secondlayer (magic-link email)").option("--force", "Skip the already-logged-in check and re-run the flow").option("--with-token", "Read an API key from stdin (non-interactive)").addHelpText("after", `
+  program2.command("login", { hidden: true }).description("Log in to Secondlayer (magic-link email)").option("--force", "Skip the already-logged-in check and re-run the flow").option("--with-token", "Read an API key from stdin (non-interactive)").option("--credits", "Log in to the archive credits account used by bootstrap, repair, and credits").addHelpText("after", `
 Examples:
-  $ secondlayer login
-  $ echo "$INSTANCE_TOKEN" | secondlayer login --with-token`).action((opts) => opts.withToken ? runTokenLogin() : runLoginFlow({ force: opts.force }));
+  $ secondlayer login --credits
+  $ echo "$INSTANCE_TOKEN" | secondlayer login --with-token`).action((opts) => opts.withToken ? runTokenLogin({ credits: opts.credits }) : runLoginFlow({ force: opts.force, credits: opts.credits }));
 }
 var init_login = __esm(() => {
   init_http();
@@ -28986,7 +29097,7 @@ __export(exports_subgraph_test, {
   filterHashOf: () => filterHashOf,
   DECODER_VERSION: () => DECODER_VERSION
 });
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
 import { dirname as dirname4, resolve as resolve2 } from "node:path";
 import { Index, resolveApiKey as resolveApiKey2, resolveBaseUrl } from "@secondlayer/sdk";
@@ -28995,7 +29106,7 @@ import {
 } from "@secondlayer/stacks/filters";
 function filterHashOf(sources) {
   const stable = JSON.stringify(Object.fromEntries(Object.entries(sources).sort(([a4], [b2]) => a4.localeCompare(b2))), (_k, v2) => typeof v2 === "bigint" ? `${v2}n` : v2);
-  return createHash("sha256").update(stable).digest("hex").slice(0, 16);
+  return createHash2("sha256").update(stable).digest("hex").slice(0, 16);
 }
 function cassettePath(name, dir = CASSETTE_DIR) {
   return resolve2(dir, `${name}.json`);
@@ -29772,7 +29883,8 @@ Check the contract id, and that the contract has emitted print events (schemas a
     if (opts.fromContract) {
       info(`Schema inferred from ${opts.fromContract} print events (${opts.tablePerTopic ? "table per topic" : "single wide table"})`);
     }
-    info(`Next: secondlayer subgraphs deploy subgraphs/${name}.ts`);
+    info(`Next: git add subgraphs/${name}.ts && secondlayer subgraphs deploy subgraphs/${name}.ts`);
+    note("  deploy refuses an unstaged file unless you pass --allow-uncommitted: a staged copy is the one git can recover.");
   });
   subgraphs.command("dev <file>").description("Watch a subgraph file and auto-redeploy on change").action(async (file) => {
     await requireLocalNetwork();
@@ -29835,9 +29947,9 @@ Stopped watching.`);
     });
     await new Promise(() => {});
   });
-  subgraphs.command("deploy <file>").alias("update").description("Deploy a subgraph definition file (alias: update — deploy is create-or-update)").option("--start-block <n>", "Override the subgraph definition startBlock for this deploy").option("--tip-first", "Go live at chain tip immediately; history backfills in the background (requires order-tolerant handlers — commutative or insert-only writes)").option("--dry-run", "Validate and preview deploy without writing changes").option("-y, --yes", "Skip the reindex confirmation prompt").option("--strict", "Run `tsc --noEmit` against the handler before deploy (slower; catches TS type errors)").option("--allow-uncommitted", "Deploy even though the source file is not committed to git (the deployed definition will exist only in the database)").addHelpText("after", `
-By default the source file must be committed to git — otherwise the
-deployed definition's only copy is the row in the database. Pass
+  subgraphs.command("deploy <file>").alias("update").description("Deploy a subgraph definition file (alias: update — deploy is create-or-update)").option("--start-block <n>", "Override the subgraph definition startBlock for this deploy").option("--tip-first", "Go live at chain tip immediately; history backfills in the background (requires order-tolerant handlers — commutative or insert-only writes)").option("--dry-run", "Validate and preview deploy without writing changes").option("-y, --yes", "Skip the reindex confirmation prompt").option("--strict", "Run `tsc --noEmit` against the handler before deploy (slower; catches TS type errors)").option("--allow-uncommitted", "Deploy even though the source file is not staged or committed in git (the deployed definition will exist only in the database)").addHelpText("after", `
+By default the source file must be staged or committed in git (\`git add <file>\`),
+otherwise the deployed definition's only copy is the row in the database. Pass
 --allow-uncommitted to deploy anyway.`).action(async (file, options3) => {
     try {
       const absPath = resolve3(file);
@@ -29848,18 +29960,19 @@ deployed definition's only copy is the row in the database. Pass
           const gitState = inspectSourceGitState(absPath);
           if (gitState.kind === "untracked" || gitState.kind === "modified") {
             const reason = gitState.kind === "untracked" ? "not tracked by git" : "modified with uncommitted changes";
-            const message = `${file} is ${reason}. If you deploy it, the only copy of this definition will be a row in the database — this has already caused two production recoveries.`;
-            if (process.stdout.isTTY) {
+            const message = `${file} is ${reason}. Deploy it and the only copy of this definition is a row in the database.`;
+            if (process.stdin.isTTY) {
               warn(message);
               const confirmed = await confirm3({
-                message: "Deploy anyway?"
+                message: "Deploy anyway?",
+                default: false
               });
               if (!confirmed) {
-                info("Aborted.");
+                info("Nothing was deployed.");
                 process.exit(0);
               }
             } else {
-              error(`${message} Commit it, or pass --allow-uncommitted.`);
+              error(`${message} Stage it with \`git add ${file}\`, or pass --allow-uncommitted.`);
               process.exit(1);
             }
           }
@@ -29924,11 +30037,12 @@ deployed definition's only copy is the row in the database. Pass
               } else {
                 warn(`startBlock change (${existingStart ?? "unset"} → ${deployStartBlock}) forces a reindex.`);
               }
-              const confirmed = await confirm3({
-                message: "⚠  This will drop all data and reindex from scratch. Continue?"
+              const confirmed = await confirmDestructive({
+                message: "This will drop all data and reindex from scratch. Continue?",
+                yes: options3.yes
               });
               if (!confirmed) {
-                info("Aborted — nothing was deployed.");
+                info("Nothing was deployed.");
                 process.exit(0);
               }
             }
@@ -30063,8 +30177,10 @@ ${data.length} subgraph(s) total`));
     }
   });
   subgraphs.command("status <name>").alias("get").description("Show detailed subgraph status").option("-w, --watch", "Refresh every 2s until synced or Ctrl-C").action(async (name, options3) => {
-    const renderOnce = async () => {
+    const renderOnce = async (opts = {}) => {
       const subgraph = await getSubgraphApi(name);
+      if (opts.clearScreen)
+        process.stdout.write("\x1Bc");
       const rowCounts = Object.entries(subgraph.tables).map(([t2, info2]) => `${t2}: ${info2.rowCount}`).join(", ") || "N/A";
       const totalRows = Object.values(subgraph.tables).reduce((sum, info2) => sum + info2.rowCount, 0);
       const errorRate = subgraph.health.totalProcessed > 0 ? `${(subgraph.health.errorRate * 100).toFixed(2)}%` : "N/A";
@@ -30113,12 +30229,23 @@ Table endpoints:`));
         await renderOnce();
         return;
       }
+      let consecutiveFailures = 0;
       while (true) {
-        process.stdout.write("\x1Bc");
-        const sg = await renderOnce();
-        if (sg && sg.status === "synced") {
+        let sg;
+        try {
+          sg = await renderOnce({ clearScreen: true });
+          consecutiveFailures = 0;
+        } catch (err) {
+          consecutiveFailures += 1;
+          if (consecutiveFailures > WATCH_TRANSIENT_FAILURE_LIMIT)
+            throw err;
+          console.log(dim(`poll failed (${consecutiveFailures}/${WATCH_TRANSIENT_FAILURE_LIMIT}): ${err instanceof Error ? err.message : String(err)}; retrying`));
+          await new Promise((res) => setTimeout(res, 2000));
+          continue;
+        }
+        if (sg?.sync?.status === "synced") {
           console.log(dim(`
-Synced — exiting watch.`));
+Synced, exiting watch.`));
           return;
         }
         await new Promise((res) => setTimeout(res, 2000));
@@ -30167,30 +30294,13 @@ dropping anything, use "secondlayer subgraphs backfill".
 Examples:
   $ secondlayer subgraphs reindex my-graph -y`).action(async (name, options3) => {
     try {
-      if (!options3.yes) {
-        if (!process.stdin.isTTY) {
-          error("Interactive prompt unavailable (stdin is not a TTY). Re-run with -y to skip confirmation.");
-          process.exit(1);
-        }
-        const { confirm: confirm4 } = await import("@inquirer/prompts");
-        let ok = false;
-        try {
-          ok = await confirm4({
-            message: `Reindex subgraph "${name}"? ALL of its data will be dropped and rebuilt from its start block. This cannot be undone.`,
-            default: false
-          });
-        } catch (promptErr) {
-          const m2 = promptErr instanceof Error ? promptErr.message : String(promptErr);
-          if (m2.includes("ExitPromptError") || m2.includes("force closed")) {
-            error("Interactive prompt unavailable. Re-run with -y to skip confirmation.");
-            process.exit(1);
-          }
-          throw promptErr;
-        }
-        if (!ok) {
-          info("Cancelled.");
-          return;
-        }
+      const ok = await confirmDestructive({
+        message: `Reindex subgraph "${name}"? ALL of its data will be dropped and rebuilt from its start block. This cannot be undone.`,
+        yes: options3.yes
+      });
+      if (!ok) {
+        info("Cancelled.");
+        return;
       }
       info(`Reindexing subgraph "${name}"...`);
       const result = await reindexSubgraphApi(name);
@@ -30412,29 +30522,13 @@ ${rows.length} row(s)`));
   });
   subgraphs.command("delete <name>").alias("rm").description("Delete a subgraph and its data").option("-y, --yes", "Skip confirmation").option("--force", "Cancel active operations and force delete").action(async (name, options3) => {
     try {
-      if (!options3.yes && !options3.force) {
-        if (!process.stdin.isTTY) {
-          error("Interactive prompt unavailable (stdin is not a TTY). Re-run with -y to skip confirmation.");
-          process.exit(1);
-        }
-        const { confirm: confirm4 } = await import("@inquirer/prompts");
-        let ok = false;
-        try {
-          ok = await confirm4({
-            message: `Delete subgraph "${name}" and all its data? This cannot be undone.`
-          });
-        } catch (promptErr) {
-          const m2 = promptErr instanceof Error ? promptErr.message : String(promptErr);
-          if (m2.includes("ExitPromptError") || m2.includes("force closed")) {
-            error("Interactive prompt unavailable. Re-run with -y to skip confirmation.");
-            process.exit(1);
-          }
-          throw promptErr;
-        }
-        if (!ok) {
-          info("Cancelled");
-          return;
-        }
+      const ok = await confirmDestructive({
+        message: `Delete subgraph "${name}" and all its data? This cannot be undone.`,
+        yes: options3.yes || options3.force
+      });
+      if (!ok) {
+        info("Cancelled");
+        return;
       }
       try {
         const result = await deleteSubgraphApi(name, {
@@ -30454,7 +30548,7 @@ ${rows.length} row(s)`));
       handleApiError(err, "delete subgraph");
     }
   });
-  subgraphs.command("scaffold [contractAddress]").description("Generate a defineSubgraph() file from a contract ABI or trait (start with: subgraphs create)").option("-o, --output <path>", "Output file path (required)").option("-k, --api-key <key>", "Stacks node API key for direct RPC URLs").option("--functions <names>", "Comma-separated public functions to index as typed contract_call tables").option("--trait <std>", "Scaffold a trait-scoped source (sip-009|sip-010|sip-013) — no contract needed").option("--no-install", "Skip bun install after writing package.json").addHelpText("after", `
+  subgraphs.command("scaffold [contractAddress]").description("Generate a defineSubgraph() file from a contract ABI or trait (start with: subgraphs create)").option("-o, --output <path>", "Output file path (required)").option("--functions <names>", "Comma-separated public functions to index as typed contract_call tables").option("--trait <std>", "Scaffold a trait-scoped source (sip-009|sip-010|sip-013) — no contract needed").option("--no-install", "Skip bun install after writing package.json").addHelpText("after", `
 "secondlayer subgraphs create <name>" is the documented starting point. Reach
 for scaffold when you need what create cannot infer: typed contract_call tables
 from the contract's ABI, or a trait-wide source (--trait sip-010). scaffold
@@ -30488,8 +30582,7 @@ Examples:
       } else {
         const address = contractAddress;
         const network = inferNetwork(address) ?? "mainnet";
-        const apiKey = options3.apiKey ?? process.env.STACKS_NODE_API_KEY;
-        const client = new StacksApiClient(network, apiKey);
+        const client = new StacksApiClient(network);
         info(`Fetching ABI for ${address} via ${client.describeContractInfoSource()}...`);
         const contractInfo = await client.getContractInfo(address);
         const abi = parseApiResponse(contractInfo);
@@ -30601,7 +30694,7 @@ async function runSubgraphSchemaCodegen(file, options3, optionSource, defaultTar
     process.exit(1);
   }
 }
-var ORM_ONLY_CODEGEN_FLAGS;
+var WATCH_TRANSIENT_FAILURE_LIMIT = 3, ORM_ONLY_CODEGEN_FLAGS;
 var init_subgraphs2 = __esm(() => {
   init_subgraph_scaffold();
   init_subgraphs();
@@ -32468,7 +32561,7 @@ import fs6 from "fs";
 function Postgres(a4, b3) {
   const options3 = parseOptions(a4, b3), subscribe = options3.no_subscribe || Subscribe(Postgres, { ...options3 });
   let ending = false;
-  const queries = queue_default(), connecting = queue_default(), reserved = queue_default(), closed = queue_default(), ended = queue_default(), open = queue_default(), busy = queue_default(), full = queue_default(), queues = { connecting, reserved, closed, ended, open, busy, full };
+  const queries = queue_default(), connecting = queue_default(), reserved = queue_default(), closed = queue_default(), ended = queue_default(), open2 = queue_default(), busy = queue_default(), full = queue_default(), queues = { connecting, reserved, closed, ended, open: open2, busy, full };
   const connections = [...Array(options3.max)].map(() => connection_default(options3, queues, { onopen, onend, onclose }));
   const sql = Sql(handler);
   Object.assign(sql, {
@@ -32580,7 +32673,7 @@ function Postgres(a4, b3) {
   }
   async function reserve() {
     const queue = queue_default();
-    const c4 = open.length ? open.shift() : await new Promise((resolve5, reject) => {
+    const c4 = open2.length ? open2.shift() : await new Promise((resolve5, reject) => {
       const query = { reserve: resolve5, reject };
       queries.push(query);
       closed.length && connect(closed.shift(), query);
@@ -32653,7 +32746,7 @@ function Postgres(a4, b3) {
     c4.queue.remove(c4);
     queue.push(c4);
     c4.queue = queue;
-    queue === open ? c4.idleTimer.start() : c4.idleTimer.cancel();
+    queue === open2 ? c4.idleTimer.start() : c4.idleTimer.cancel();
     return c4;
   }
   function json(x2) {
@@ -32667,8 +32760,8 @@ function Postgres(a4, b3) {
   function handler(query) {
     if (ending)
       return query.reject(Errors.connection("CONNECTION_ENDED", options3, options3));
-    if (open.length)
-      return go(open.shift(), query);
+    if (open2.length)
+      return go(open2.shift(), query);
     if (closed.length)
       return connect(closed.shift(), query);
     busy.length ? go(busy.shift(), query) : queries.push(query);
@@ -32710,7 +32803,7 @@ function Postgres(a4, b3) {
   }
   function onopen(c4) {
     if (queries.length === 0)
-      return move(c4, open);
+      return move(c4, open2);
     let max = Math.ceil(queries.length / (connecting.length + 1)), ready = true;
     while (ready && queries.length && max-- > 0) {
       const query = queries.shift();
@@ -33032,12 +33125,12 @@ __export(exports_dev_state, {
   clearDevState: () => clearDevState
 });
 import { homedir as homedir4 } from "node:os";
-import { join as join11 } from "node:path";
+import { join as join10 } from "node:path";
 function getLogsDir() {
   return LOGS_DIR;
 }
 function getLogFile(service) {
-  return join11(LOGS_DIR, `${service}.log`);
+  return join10(LOGS_DIR, `${service}.log`);
 }
 async function ensureDirs() {
   await Bun.$`mkdir -p ${STATE_DIR}`.quiet();
@@ -33094,9 +33187,9 @@ async function isDevRunning() {
 }
 var STATE_DIR, DEV_STATE_PATH, LOGS_DIR;
 var init_dev_state = __esm(() => {
-  STATE_DIR = join11(homedir4(), ".secondlayer");
-  DEV_STATE_PATH = join11(STATE_DIR, "dev.json");
-  LOGS_DIR = join11(STATE_DIR, "logs");
+  STATE_DIR = join10(homedir4(), ".secondlayer");
+  DEV_STATE_PATH = join10(STATE_DIR, "dev.json");
+  LOGS_DIR = join10(STATE_DIR, "logs");
 });
 
 // src/lib/network.ts
@@ -33487,11 +33580,11 @@ var init_manager = __esm(() => {
 });
 
 // src/services/indexer.ts
-import { dirname as dirname10, resolve as resolve6 } from "node:path";
+import { dirname as dirname10, resolve as resolve7 } from "node:path";
 async function startIndexer(options3) {
   const port = options3.port ?? 3700;
   const rootDir = dirname10(dirname10(dirname10(dirname10(import.meta.dir))));
-  const indexerPath = resolve6(rootDir, "packages/indexer/src/index.ts");
+  const indexerPath = resolve7(rootDir, "packages/indexer/src/index.ts");
   await serviceManager.start(SERVICE_NAME, ["bun", "run", "--watch", indexerPath], {
     port,
     env: {
@@ -33507,10 +33600,10 @@ var init_indexer = __esm(() => {
 });
 
 // src/services/worker.ts
-import { dirname as dirname11, resolve as resolve7 } from "node:path";
+import { dirname as dirname11, resolve as resolve8 } from "node:path";
 async function startWorker(options3) {
   const rootDir = dirname11(dirname11(dirname11(dirname11(import.meta.dir))));
-  const workerPath = resolve7(rootDir, "packages/worker/src/index.ts");
+  const workerPath = resolve8(rootDir, "packages/worker/src/index.ts");
   await serviceManager.start(SERVICE_NAME2, ["bun", "run", "--watch", workerPath], {
     onStdout: options3.onLog,
     onStderr: options3.onLog
@@ -33522,11 +33615,11 @@ var init_worker = __esm(() => {
 });
 
 // src/services/api.ts
-import { dirname as dirname12, resolve as resolve8 } from "node:path";
+import { dirname as dirname12, resolve as resolve9 } from "node:path";
 async function startApi(options3) {
   const port = options3.port ?? 3800;
   const rootDir = dirname12(dirname12(dirname12(dirname12(import.meta.dir))));
-  const apiPath = resolve8(rootDir, "packages/api/src/index.ts");
+  const apiPath = resolve9(rootDir, "packages/api/src/index.ts");
   await serviceManager.start(SERVICE_NAME3, ["bun", "run", "--watch", apiPath], {
     port,
     env: {
@@ -33542,10 +33635,10 @@ var init_api2 = __esm(() => {
 });
 
 // src/services/subgraph-processor.ts
-import { dirname as dirname13, resolve as resolve9 } from "node:path";
+import { dirname as dirname13, resolve as resolve10 } from "node:path";
 async function startSubgraphProcessor(options3) {
   const rootDir = dirname13(dirname13(dirname13(dirname13(import.meta.dir))));
-  const servicePath = resolve9(rootDir, "packages/subgraphs/src/service.ts");
+  const servicePath = resolve10(rootDir, "packages/subgraphs/src/service.ts");
   await serviceManager.start(SERVICE_NAME4, ["bun", "run", "--watch", servicePath], {
     env: {
       SUBGRAPH_CONCURRENCY: String(options3.concurrency ?? 5)
@@ -33580,7 +33673,7 @@ __export(exports_dev_impl, {
   isDevAlreadyRunning: () => isDevAlreadyRunning
 });
 import { mkdirSync as mkdirSync5 } from "node:fs";
-import { dirname as dirname14, join as join12, resolve as resolve10 } from "node:path";
+import { dirname as dirname14, join as join11, resolve as resolve11 } from "node:path";
 async function isDevAlreadyRunning() {
   if (await isDevRunning()) {
     const running = await getRunningServices();
@@ -33661,7 +33754,7 @@ async function runBackground(options3) {
     const packagesDir = dirname14(dirname14(dirname14(dirname14(import.meta.dir))));
     const env2 = { DATABASE_URL: databaseUrl, DEV_MODE: "true" };
     const apiLogFile = getLogFile("api");
-    const apiProc = Bun.spawn(["bun", "run", resolve10(packagesDir, "packages/api/src/index.ts")], {
+    const apiProc = Bun.spawn(["bun", "run", resolve11(packagesDir, "packages/api/src/index.ts")], {
       env: { ...process.env, ...env2, PORT: String(apiPort) },
       stdout: Bun.file(apiLogFile),
       stderr: Bun.file(apiLogFile)
@@ -33674,7 +33767,7 @@ async function runBackground(options3) {
     };
     console.log(green("  ✓ API"), dim(`http://localhost:${apiPort}`));
     const indexerLogFile = getLogFile("indexer");
-    const indexerProc = Bun.spawn(["bun", "run", resolve10(packagesDir, "packages/indexer/src/index.ts")], {
+    const indexerProc = Bun.spawn(["bun", "run", resolve11(packagesDir, "packages/indexer/src/index.ts")], {
       env: { ...process.env, ...env2, PORT: String(indexerPort) },
       stdout: Bun.file(indexerLogFile),
       stderr: Bun.file(indexerLogFile)
@@ -33688,7 +33781,7 @@ async function runBackground(options3) {
     console.log(green("  ✓ Indexer"), dim(`http://localhost:${indexerPort}`));
     if (options3.worker) {
       const workerLogFile = getLogFile("worker");
-      const workerProc = Bun.spawn(["bun", "run", resolve10(packagesDir, "packages/worker/src/index.ts")], {
+      const workerProc = Bun.spawn(["bun", "run", resolve11(packagesDir, "packages/worker/src/index.ts")], {
         env: { ...process.env, ...env2 },
         stdout: Bun.file(workerLogFile),
         stderr: Bun.file(workerLogFile)
@@ -33706,7 +33799,7 @@ async function runBackground(options3) {
       const subgraphsProc = Bun.spawn([
         "bun",
         "run",
-        resolve10(packagesDir, "packages/subgraphs/src/service.ts")
+        resolve11(packagesDir, "packages/subgraphs/src/service.ts")
       ], {
         env: { ...process.env, ...env2 },
         stdout: Bun.file(subgraphsLogFile),
@@ -34018,7 +34111,7 @@ async function restartDev() {
   };
   const apiPort = config.ports.api;
   const apiLogFile = getLogFile("api");
-  const apiProc = Bun.spawn(["bun", "run", resolve10(packagesDir, "packages/api/src/index.ts")], {
+  const apiProc = Bun.spawn(["bun", "run", resolve11(packagesDir, "packages/api/src/index.ts")], {
     env: { ...process.env, ...env2, PORT: String(apiPort) },
     stdout: Bun.file(apiLogFile),
     stderr: Bun.file(apiLogFile)
@@ -34032,7 +34125,7 @@ async function restartDev() {
   console.log(green("  ✓ API"), dim(`http://localhost:${apiPort}`));
   const indexerPort = config.ports.indexer;
   const indexerLogFile = getLogFile("indexer");
-  const indexerProc = Bun.spawn(["bun", "run", resolve10(packagesDir, "packages/indexer/src/index.ts")], {
+  const indexerProc = Bun.spawn(["bun", "run", resolve11(packagesDir, "packages/indexer/src/index.ts")], {
     env: { ...process.env, ...env2, PORT: String(indexerPort) },
     stdout: Bun.file(indexerLogFile),
     stderr: Bun.file(indexerLogFile)
@@ -34046,7 +34139,7 @@ async function restartDev() {
   console.log(green("  ✓ Indexer"), dim(`http://localhost:${indexerPort}`));
   if (state.services.worker) {
     const workerLogFile = getLogFile("worker");
-    const workerProc = Bun.spawn(["bun", "run", resolve10(packagesDir, "packages/worker/src/index.ts")], {
+    const workerProc = Bun.spawn(["bun", "run", resolve11(packagesDir, "packages/worker/src/index.ts")], {
       env: { ...process.env, ...env2 },
       stdout: Bun.file(workerLogFile),
       stderr: Bun.file(workerLogFile)
@@ -34061,7 +34154,7 @@ async function restartDev() {
   }
   if (state.services.subgraphs) {
     const subgraphsLogFile = getLogFile("subgraphs");
-    const subgraphsProc = Bun.spawn(["bun", "run", resolve10(packagesDir, "packages/subgraphs/src/service.ts")], {
+    const subgraphsProc = Bun.spawn(["bun", "run", resolve11(packagesDir, "packages/subgraphs/src/service.ts")], {
       env: { ...process.env, ...env2 },
       stdout: Bun.file(subgraphsLogFile),
       stderr: Bun.file(subgraphsLogFile)
@@ -34189,7 +34282,7 @@ async function ensureDevPostgres(dataDir) {
   if (check.stdout.toString().trim()) {
     return false;
   }
-  const pgDataDir = join12(dataDir, "postgres");
+  const pgDataDir = join11(dataDir, "postgres");
   mkdirSync5(pgDataDir, { recursive: true });
   const stopped = await Bun.$`docker ps -aq -f name=secondlayer-dev-postgres`.quiet().nothrow();
   if (stopped.stdout.toString().trim()) {
@@ -34206,7 +34299,7 @@ async function ensureDevPostgres(dataDir) {
 }
 async function runMigrations(databaseUrl) {
   const packagesDir = dirname14(dirname14(dirname14(dirname14(import.meta.dir))));
-  const migrateScript = resolve10(packagesDir, "packages/shared/src/db/migrate.ts");
+  const migrateScript = resolve11(packagesDir, "packages/shared/src/db/migrate.ts");
   const result = await Bun.$`DATABASE_URL=${databaseUrl} bun run ${migrateScript}`.quiet().nothrow();
   if (result.exitCode !== 0) {
     throw new Error(`Migration failed: ${result.stderr.toString()}`);
@@ -34239,7 +34332,7 @@ __export(exports_node_impl, {
   runSetupWizard: () => runSetupWizard,
   restartNode: () => restartNode
 });
-import { confirm as confirm6, input as input3, select as select4 } from "@inquirer/prompts";
+import { confirm as confirm5, input as input3, select as select4 } from "@inquirer/prompts";
 async function runSetupWizard() {
   console.log("");
   console.log(blue("Stacks Node Setup Wizard"));
@@ -34276,13 +34369,13 @@ async function runSetupWizard() {
     ],
     default: "mainnet"
   });
-  const autoStartIndexer = await confirm6({
+  const autoStartIndexer = await confirm5({
     message: "Auto-start indexer when node starts?",
     default: true
   });
   let indexerPort = 3700;
   if (autoStartIndexer) {
-    const customPort = await confirm6({
+    const customPort = await confirm5({
       message: "Use default indexer port (3700)?",
       default: true
     });
@@ -34388,7 +34481,7 @@ async function stopNode(_pathOverride, force, _wait) {
     return;
   }
   if (!force) {
-    const proceed = await confirm6({
+    const proceed = await confirm5({
       message: "Stop the Stacks node?",
       default: false
     });
@@ -34418,7 +34511,7 @@ async function restartNode(pathOverride, force, _wait) {
   const wasRunning = await isNodeRunning();
   if (wasRunning) {
     if (!force) {
-      const proceed = await confirm6({
+      const proceed = await confirm5({
         message: "Restart the Stacks node?",
         default: false
       });
@@ -34621,10 +34714,254 @@ var init_node_impl = __esm(() => {
   init_output();
 });
 
+// src/lib/archive-reference.ts
+import { createHash as createHash4 } from "node:crypto";
+import { readFile as readFile5 } from "node:fs/promises";
+import { dirname as dirname16, join as join13, resolve as resolve13, sep as sep2 } from "node:path";
+import { parseRetryAfter } from "@secondlayer/sdk";
+import { ARCHIVE_ROOT_PUBLIC_KEY_PEM } from "@secondlayer/shared/archive/root-key";
+import { verifyStreamsBulkManifestSignature } from "@secondlayer/shared/streams-bulk-manifest";
+function isLatestPointer(value) {
+  const pointer = value;
+  return typeof pointer.snapshot_path === "string" && (value.partitions === undefined || value.partitions.length === 0);
+}
+function assertPathWithinRoot(path11, root) {
+  const segments = path11.split("/");
+  const leaves = path11.startsWith("/") || path11.includes("\\") || /^[a-z][a-z0-9+.-]*:/i.test(path11) || /[%?#]/.test(path11) || segments.some((part) => part === "" || part === "." || part === "..");
+  if (leaves) {
+    throw new Error(`archive path ${path11} would leave the archive root`);
+  }
+  if (root !== undefined) {
+    const base2 = resolve13(root);
+    const target = resolve13(base2, path11);
+    if (target !== base2 && !target.startsWith(base2 + sep2)) {
+      throw new Error(`archive path ${path11} would leave the archive root`);
+    }
+  }
+}
+async function fetchJson(url) {
+  const response2 = await fetch(url, { signal: AbortSignal.timeout(30000) });
+  if (!response2.ok) {
+    throw new Error(`could not fetch manifest (${response2.status} ${response2.statusText})`);
+  }
+  return response2.json();
+}
+async function loadReference(source, options3 = {}) {
+  const isRemote = /^https?:\/\//.test(source);
+  let manifest;
+  let root;
+  if (isRemote) {
+    manifest = await fetchJson(source);
+    const url = new URL(source);
+    url.pathname = url.pathname.replace(/\/snapshots\/[^/]+$/, "").replace(/\/[^/]+\.json$/, "");
+    root = url.toString();
+  } else {
+    const path11 = resolve13(source);
+    manifest = JSON.parse(await readFile5(path11, "utf8"));
+    root = isLatestPointer(manifest) ? dirname16(path11) : dirname16(dirname16(path11));
+  }
+  if (!isLatestPointer(manifest)) {
+    return { manifest, origin: source, root, isRemote };
+  }
+  const pointer = manifest;
+  const snapshotPath = pointer.snapshot_path;
+  if (!SNAPSHOT_PATH_PATTERN.test(snapshotPath)) {
+    throw new Error(`pointer names an invalid snapshot path: ${snapshotPath} (expected snapshots/<sha256>.json)`);
+  }
+  if (typeof pointer.snapshot_digest !== "string" || !/^[0-9a-f]{64}$/.test(pointer.snapshot_digest)) {
+    throw new Error("pointer carries no snapshot_digest, so it cannot prove which snapshot is current");
+  }
+  if (pointer.signature !== undefined) {
+    if (!options3.publicKeyPem) {
+      throw new Error("pointer is signed but no public key is available to verify it");
+    }
+    let verified = false;
+    try {
+      verified = verifyStreamsBulkManifestSignature(pointer, options3.publicKeyPem);
+    } catch {
+      verified = false;
+    }
+    if (!verified) {
+      throw new Error("pointer signature did not verify against the archive key");
+    }
+  }
+  const resolved = isRemote ? await fetchJson(`${root.replace(/\/$/, "")}/${snapshotPath}`) : JSON.parse(await readFile5(join13(root, snapshotPath), "utf8"));
+  const digest = createHash4("sha256").update(JSON.stringify((({ signature: _s, key_id: _k, ...rest }) => rest)(resolved))).digest("hex");
+  if (digest !== pointer.snapshot_digest) {
+    throw new Error(`pointer/snapshot mismatch: latest.json names ${pointer.snapshot_digest}, resolved manifest hashes to ${digest}`);
+  }
+  return { manifest: resolved, origin: source, root, isRemote };
+}
+function checkSignature(manifest, publicKeyPem, insecure) {
+  if (insecure)
+    return { verified: false, reason: "signature check skipped" };
+  if (!manifest.signature) {
+    return { verified: false, reason: "manifest carries no signature" };
+  }
+  if (!publicKeyPem) {
+    return {
+      verified: false,
+      reason: "no public key available to verify with"
+    };
+  }
+  try {
+    const verified = verifyStreamsBulkManifestSignature(manifest, publicKeyPem);
+    return {
+      verified,
+      reason: verified ? undefined : "signature did not verify"
+    };
+  } catch (err) {
+    return {
+      verified: false,
+      reason: err instanceof Error ? err.message : "signature check failed"
+    };
+  }
+}
+async function fetchHostedKey(url) {
+  if (!url.startsWith("https://"))
+    return;
+  try {
+    const response2 = await fetch(url, { signal: AbortSignal.timeout(1e4) });
+    if (!response2.ok)
+      return;
+    const body = await response2.json();
+    return typeof body.public_key_pem === "string" ? body.public_key_pem : undefined;
+  } catch {
+    return;
+  }
+}
+async function resolveArchivePublicKey(input4) {
+  if (input4.explicitPem)
+    return input4.explicitPem;
+  if (input4.envPem)
+    return input4.envPem;
+  if (input4.allowHostedApi) {
+    const hosted = await fetchHostedKey(input4.hostedKeyUrl ?? HOSTED_SIGNING_KEY_URL);
+    if (hosted)
+      return hosted;
+  }
+  return ARCHIVE_ROOT_PUBLIC_KEY_PEM;
+}
+function isTransientCode(code) {
+  return typeof code === "string" && (TRANSIENT_ERROR_CODES.has(code) || code.startsWith("UND_ERR_"));
+}
+function isTransientFetchFailure(err) {
+  if (!(err instanceof Error))
+    return false;
+  if (err.name === "AbortError" || err.name === "TimeoutError")
+    return true;
+  const code = err.code;
+  const causeCode = err.cause?.code;
+  if (isTransientCode(code) || isTransientCode(causeCode))
+    return true;
+  return err.name === "TypeError" && /fetch failed|network|socket|connection|reset|unreachable/i.test(err.message);
+}
+function retryDelayMs(attempt, response2) {
+  const retryAfter = response2 ? parseRetryAfter(response2.headers.get("retry-after")) : undefined;
+  if (retryAfter !== undefined) {
+    return Math.min(retryAfter * 1000, RETRY_AFTER_CAP_MS);
+  }
+  return RETRY_BASE_MS * 2 ** (attempt - 1);
+}
+async function fetchWithRetry(url, opts) {
+  const retries = opts.retries ?? PARTITION_FETCH_RETRIES;
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const sleep = opts.sleep ?? ((ms) => new Promise((r2) => setTimeout(r2, ms)));
+  const timeoutMs = opts.timeoutMs ?? PARTITION_FETCH_TIMEOUT_MS;
+  let lastReason = "";
+  for (let attempt = 1;attempt <= retries + 1; attempt++) {
+    let response2;
+    try {
+      response2 = await fetchImpl(url, {
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+    } catch (err) {
+      if (!isTransientFetchFailure(err))
+        throw err;
+      lastReason = err instanceof Error ? err.message : String(err);
+    }
+    if (response2) {
+      const retryable = response2.status === 429 || response2.status >= 500;
+      if (!retryable)
+        return response2;
+      lastReason = `${response2.status} ${response2.statusText}`.trim();
+      await response2.body?.cancel().catch(() => {});
+    }
+    if (attempt <= retries) {
+      await sleep(retryDelayMs(attempt, response2));
+    }
+  }
+  throw new ArchiveFetchError(`could not fetch ${opts.label} after ${retries + 1} attempts (${lastReason})`, { transient: true, attempts: retries + 1 });
+}
+async function fetchViaGate(gate, partition, retried, fetchOpts) {
+  const url = await gate.getUrl(partition.path, retried ? { forceRefresh: true } : undefined);
+  const response2 = await fetchWithRetry(url, {
+    ...fetchOpts,
+    label: partition.path
+  });
+  if (response2.status === 403 && !retried) {
+    await response2.body?.cancel().catch(() => {});
+    return fetchViaGate(gate, partition, true, fetchOpts);
+  }
+  if (!response2.ok) {
+    throw new ArchiveFetchError(`could not fetch ${partition.path} (${response2.status} ${response2.statusText})`, { transient: false, attempts: 1 });
+  }
+  return Buffer.from(await response2.arrayBuffer());
+}
+async function fetchVerifiedPartition(reference, partition, gate, fetchOpts) {
+  assertPathWithinRoot(partition.path, reference.isRemote ? undefined : reference.root);
+  let bytes;
+  if (gate) {
+    bytes = await fetchViaGate(gate, partition, false, fetchOpts);
+  } else if (reference.isRemote) {
+    const url = `${reference.root.replace(/\/$/, "")}/${partition.path}`;
+    const response2 = await fetchWithRetry(url, {
+      ...fetchOpts,
+      label: partition.path
+    });
+    if (!response2.ok) {
+      throw new ArchiveFetchError(`could not fetch ${partition.path} (${response2.status} ${response2.statusText})`, { transient: false, attempts: 1 });
+    }
+    bytes = Buffer.from(await response2.arrayBuffer());
+  } else {
+    bytes = await readFile5(join13(reference.root, partition.path));
+  }
+  const digest = createHash4("sha256").update(bytes).digest("hex");
+  if (digest !== partition.sha256) {
+    throw new Error(`${partition.path} failed verification: expected ${partition.sha256}, got ${digest}`);
+  }
+  return bytes;
+}
+var SNAPSHOT_PATH_PATTERN, HOSTED_SIGNING_KEY_URL = "https://api.secondlayer.tools/public/streams/signing-key", ArchiveFetchError, TRANSIENT_ERROR_CODES, PARTITION_FETCH_RETRIES = 3, PARTITION_FETCH_TIMEOUT_MS = 300000, RETRY_BASE_MS = 1000, RETRY_AFTER_CAP_MS = 60000;
+var init_archive_reference = __esm(() => {
+  SNAPSHOT_PATH_PATTERN = /^snapshots\/[0-9a-f]{64}\.json$/;
+  ArchiveFetchError = class ArchiveFetchError extends Error {
+    transient;
+    attempts;
+    constructor(message, opts) {
+      super(message);
+      this.name = "ArchiveFetchError";
+      this.transient = opts.transient;
+      this.attempts = opts.attempts;
+    }
+  };
+  TRANSIENT_ERROR_CODES = new Set([
+    "ECONNRESET",
+    "ECONNREFUSED",
+    "ECONNABORTED",
+    "ETIMEDOUT",
+    "EAI_AGAIN",
+    "EPIPE",
+    "ENETUNREACH",
+    "EHOSTUNREACH"
+  ]);
+});
+
 // src/lib/instance-init.ts
 import { randomBytes as randomBytes3 } from "node:crypto";
-import { existsSync as existsSync10, readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "node:fs";
-import { resolve as resolve15 } from "node:path";
+import { existsSync as existsSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "node:fs";
+import { resolve as resolve14 } from "node:path";
+import { ARCHIVE_ROOT_PUBLIC_KEY_PEM as ARCHIVE_ROOT_PUBLIC_KEY_PEM2 } from "@secondlayer/shared/archive/root-key";
 import { generateEd25519KeyPair } from "@secondlayer/shared/crypto/ed25519";
 import { INSTANCE_NETWORKS } from "@secondlayer/shared/db/queries/instance";
 function parseInstanceNetwork(value) {
@@ -34634,6 +34971,17 @@ function parseInstanceNetwork(value) {
   }
   throw new Error(`network must be mainnet, testnet, or devnet (got ${value})`);
 }
+function instanceNetworkFromEnv(fallback = "mainnet") {
+  const raw = process.env.STACKS_NETWORK ?? fallback;
+  try {
+    return parseInstanceNetwork(raw);
+  } catch (err) {
+    printError(err instanceof Error ? err.message : String(err), {
+      hint: "Pass --network mainnet, --network testnet, or --network devnet."
+    });
+    process.exit(1);
+  }
+}
 function generateInstanceToken() {
   return randomBytes3(32).toString("hex");
 }
@@ -34657,9 +35005,9 @@ function unescapeEnvValue(raw) {
 `).replace(/\\"/g, '"').replace(/\\\\/g, "\\");
 }
 function readEnvValue(envPath, key) {
-  if (!existsSync10(envPath))
+  if (!existsSync8(envPath))
     return null;
-  const match = readFileSync9(envPath, "utf8").match(new RegExp(`^${key}=(.*)$`, "m"));
+  const match = readFileSync7(envPath, "utf8").match(new RegExp(`^${key}=(.*)$`, "m"));
   return match ? unescapeEnvValue(match[1]) : null;
 }
 function buildInstanceEnv(input4) {
@@ -34667,7 +35015,7 @@ function buildInstanceEnv(input4) {
   const secrets = input4.existing?.SECONDLAYER_SECRETS_KEY || generateSecretsKey();
   const signing = input4.existing?.STREAMS_SIGNING_PRIVATE_KEY || input4.existing?.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY || generateSigningPrivateKey();
   const apiUrl = input4.apiUrl ?? "http://127.0.0.1:3800";
-  const archiveKey = input4.existing?.ARCHIVE_SIGNING_PUBLIC_KEY;
+  const archiveKey = input4.existing?.ARCHIVE_SIGNING_PUBLIC_KEY || input4.archivePublicKeyPem || ARCHIVE_ROOT_PUBLIC_KEY_PEM2;
   return {
     INSTANCE_MODE: "oss",
     STACKS_NETWORK: input4.network,
@@ -34678,7 +35026,7 @@ function buildInstanceEnv(input4) {
     ALLOW_UNSIGNED_WEBHOOKS: "false",
     SL_API_URL: input4.existing?.SL_API_URL || apiUrl,
     SL_API_KEY: token,
-    ...archiveKey ? { ARCHIVE_SIGNING_PUBLIC_KEY: archiveKey } : {}
+    ARCHIVE_SIGNING_PUBLIC_KEY: archiveKey
   };
 }
 function renderInstanceEnv(env2) {
@@ -34698,20 +35046,17 @@ function renderInstanceEnv(env2) {
     "# INSTANCE_TOKEN wins if the two ever disagree.",
     `SL_API_KEY=${env2.SL_API_KEY}`
   ];
-  if (env2.ARCHIVE_SIGNING_PUBLIC_KEY) {
-    lines2.push(`ARCHIVE_SIGNING_PUBLIC_KEY=${escapeEnvValue(env2.ARCHIVE_SIGNING_PUBLIC_KEY)}`);
-  }
-  lines2.push("");
+  lines2.push("# Archive trust root: bootstrap, verify, and repair check manifests", "# against this key. Replace it to pin a different archive.", `ARCHIVE_SIGNING_PUBLIC_KEY=${escapeEnvValue(env2.ARCHIVE_SIGNING_PUBLIC_KEY)}`, "");
   return lines2.join(`
 `);
 }
 function writeInstanceEnv(cwd, env2, file = INSTANCE_ENV_FILE) {
-  const path11 = resolve15(cwd, file);
-  writeFileSync8(path11, renderInstanceEnv(env2), { mode: 384 });
+  const path11 = resolve14(cwd, file);
+  writeFileSync7(path11, renderInstanceEnv(env2), { mode: 384 });
   return path11;
 }
 function loadExistingInstanceEnv(cwd, file = INSTANCE_ENV_FILE) {
-  const path11 = resolve15(cwd, file);
+  const path11 = resolve14(cwd, file);
   return {
     INSTANCE_TOKEN: readEnvValue(path11, "INSTANCE_TOKEN"),
     SECONDLAYER_SECRETS_KEY: readEnvValue(path11, "SECONDLAYER_SECRETS_KEY"),
@@ -34723,7 +35068,9 @@ function loadExistingInstanceEnv(cwd, file = INSTANCE_ENV_FILE) {
   };
 }
 var INSTANCE_ENV_FILE = ".env.local";
-var init_instance_init = () => {};
+var init_instance_init = __esm(() => {
+  init_output();
+});
 
 // src/lib/observer-stanza.ts
 function parseObserverMode(value) {
@@ -34995,9 +35342,10 @@ var init_oss_compose = () => {};
 import { spawn as spawn4, spawnSync as spawnSync5 } from "node:child_process";
 import { randomBytes as randomBytes4 } from "node:crypto";
 import { existsSync as existsSync11 } from "node:fs";
-import { writeFile as writeFile7 } from "node:fs/promises";
+import { writeFile as writeFile6 } from "node:fs/promises";
 import { createServer } from "node:net";
-import { join as join19, resolve as resolvePath2 } from "node:path";
+import { join as join18, resolve as resolvePath2 } from "node:path";
+import { closeDb as closeDb2, getRawClientFor } from "@secondlayer/shared/db";
 import { FLOORS, diskFloorGb } from "@secondlayer/shared/runtime";
 function parseSetupNodeMode(value) {
   const mode = value.trim().toLowerCase();
@@ -35090,7 +35438,7 @@ function randomHex(bytes) {
   return randomBytes4(bytes).toString("hex");
 }
 function resolveSecrets(config) {
-  const envPath = join19(config.dir, ".env");
+  const envPath = join18(config.dir, ".env");
   const existing = config.force || !existsSync11(envPath) ? {} : readEnvFile(config.dir, envPath);
   const instance = buildInstanceEnv({
     network: config.network,
@@ -35103,14 +35451,33 @@ function resolveSecrets(config) {
       SL_API_KEY: existing.SL_API_KEY,
       ARCHIVE_SIGNING_PUBLIC_KEY: existing.ARCHIVE_SIGNING_PUBLIC_KEY
     },
-    apiUrl: `http://${normalizeLoopbackHost(config.apiPort)}`
+    apiUrl: `http://${normalizeLoopbackHost(config.apiPort)}`,
+    archivePublicKeyPem: config.archivePublicKeyPem
   });
   return {
     instance,
     postgresPassword: existing.POSTGRES_PASSWORD || randomHex(24),
-    bitcoinRpcPassword: existing.BITCOIN_RPC_PASSWORD || randomHex(24)
+    bitcoinRpcPassword: existing.BITCOIN_RPC_PASSWORD || randomHex(24),
+    databaseUrl: operatorEditedDatabaseUrl(existing)
   };
 }
+function operatorEditedDatabaseUrl(existing) {
+  const url = existing.DATABASE_URL;
+  if (!url)
+    return;
+  if (existing.POSTGRES_PORT && existing.POSTGRES_PASSWORD) {
+    const generated = setupDatabaseUrl({ postgresPort: existing.POSTGRES_PORT }, { postgresPassword: existing.POSTGRES_PASSWORD });
+    if (url === generated)
+      return;
+  }
+  return url;
+}
+function setupDatabaseUrl(config, secrets) {
+  if (secrets.databaseUrl)
+    return secrets.databaseUrl;
+  const password = encodeURIComponent(secrets.postgresPassword);
+  return `postgres://${SETUP_POSTGRES_USER}:${password}@${normalizeLoopbackHost(config.postgresPort)}/${SETUP_POSTGRES_DB}`;
+}
 function normalizeLoopbackHost(apiPort) {
   return apiPort.includes(":") ? apiPort : `127.0.0.1:${apiPort}`;
 }
@@ -35119,7 +35486,9 @@ function readEnvFile(dir, envPath) {
   return {
     ...shared,
     POSTGRES_PASSWORD: readEnvValue(envPath, "POSTGRES_PASSWORD"),
-    BITCOIN_RPC_PASSWORD: readEnvValue(envPath, "BITCOIN_RPC_PASSWORD")
+    POSTGRES_PORT: readEnvValue(envPath, "POSTGRES_PORT"),
+    BITCOIN_RPC_PASSWORD: readEnvValue(envPath, "BITCOIN_RPC_PASSWORD"),
+    DATABASE_URL: readEnvValue(envPath, "DATABASE_URL")
   };
 }
 function renderSetupEnv(config, secrets) {
@@ -35131,10 +35500,14 @@ function renderSetupEnv(config, secrets) {
     `NODE_MODE=${config.nodeMode}`,
     `API_PORT=${config.apiPort}`,
     `INDEXER_PORT=${config.indexerPort}`,
-    "POSTGRES_USER=secondlayer",
+    `POSTGRES_USER=${SETUP_POSTGRES_USER}`,
     `POSTGRES_PASSWORD=${secrets.postgresPassword}`,
-    "POSTGRES_DB=secondlayer",
+    `POSTGRES_DB=${SETUP_POSTGRES_DB}`,
     `POSTGRES_PORT=${config.postgresPort}`,
+    "# Where bootstrap, verify, repair, and backup connect from this directory:",
+    "# the compose Postgres above, published on the host. Point it elsewhere",
+    "# only if you moved the index.",
+    `DATABASE_URL=${escapeEnvValue(setupDatabaseUrl(config, secrets))}`,
     "# The instance credential. The API validates bearer tokens against it,",
     "# and the CLI/SDK/MCP read it first when authenticating.",
     `INSTANCE_TOKEN=${i3.INSTANCE_TOKEN}`,
@@ -35146,9 +35519,7 @@ function renderSetupEnv(config, secrets) {
     `SL_API_KEY=${i3.SL_API_KEY}`,
     `SL_API_URL=${i3.SL_API_URL}`
   ];
-  if (i3.ARCHIVE_SIGNING_PUBLIC_KEY) {
-    lines2.push(`ARCHIVE_SIGNING_PUBLIC_KEY=${escapeEnvValue(i3.ARCHIVE_SIGNING_PUBLIC_KEY)}`);
-  }
+  lines2.push("# Archive trust root: bootstrap, verify, and repair check manifests", "# against this key. Replace it to pin a different archive.", `ARCHIVE_SIGNING_PUBLIC_KEY=${escapeEnvValue(i3.ARCHIVE_SIGNING_PUBLIC_KEY)}`);
   if (config.nodeMode === "full") {
     lines2.push("BITCOIN_RPC_USER=stacks", `BITCOIN_RPC_PASSWORD=${secrets.bitcoinRpcPassword}`);
   }
@@ -35157,22 +35528,22 @@ function renderSetupEnv(config, secrets) {
 `);
 }
 async function writeSetupFiles(config, secrets) {
-  const composePath = join19(config.dir, "docker-compose.yml");
-  const envPath = join19(config.dir, ".env");
-  await writeFile7(composePath, buildOssCompose({ owner: config.owner, imageTag: config.imageTag }));
-  await writeFile7(envPath, renderSetupEnv(config, secrets), { mode: 384 });
+  const composePath = join18(config.dir, "docker-compose.yml");
+  const envPath = join18(config.dir, ".env");
+  await writeFile6(composePath, buildOssCompose({ owner: config.owner, imageTag: config.imageTag }));
+  await writeFile6(envPath, renderSetupEnv(config, secrets), { mode: 384 });
   const result = { composePath, envPath };
   if (config.nodeMode === "full") {
-    const configTomlPath = join19(config.dir, "Config.toml");
-    await writeFile7(configTomlPath, buildOssStacksConfigToml({
+    const configTomlPath = join18(config.dir, "Config.toml");
+    await writeFile6(configTomlPath, buildOssStacksConfigToml({
       network: config.network,
       bitcoinRpcPassword: secrets.bitcoinRpcPassword ?? ""
     }));
     result.configTomlPath = configTomlPath;
   }
   if (config.nodeMode === "full") {
-    const bitcoinConfPath = join19(config.dir, "bitcoin.conf");
-    await writeFile7(bitcoinConfPath, buildOssBitcoinConf({ rpcPassword: secrets.bitcoinRpcPassword ?? "" }));
+    const bitcoinConfPath = join18(config.dir, "bitcoin.conf");
+    await writeFile6(bitcoinConfPath, buildOssBitcoinConf({ rpcPassword: secrets.bitcoinRpcPassword ?? "" }));
     result.bitcoinConfPath = bitcoinConfPath;
   }
   return result;
@@ -35186,6 +35557,7 @@ function runStreaming(command, args, opts) {
   return new Promise((resolvePromise, reject) => {
     const child = spawn4(command, args, {
       cwd: opts.cwd,
+      env: opts.env ?? process.env,
       stdio: ["ignore", "pipe", "pipe"]
     });
     let stdout = "";
@@ -35261,15 +35633,74 @@ function cliEntry() {
   }
   return [process.execPath, entry];
 }
-async function runBootstrap(config, against, onLine) {
+function buildChildEnv(envPath, base2 = process.env) {
+  const env2 = { ...base2 };
+  for (const key of CHILD_ENV_KEYS) {
+    const value = readEnvValue(envPath, key);
+    if (value)
+      env2[key] = value;
+  }
+  return env2;
+}
+async function checkDatabaseReachable(databaseUrl) {
+  try {
+    const client3 = getRawClientFor(databaseUrl);
+    await client3`SELECT 1`;
+    return { ok: true };
+  } catch (err) {
+    return {
+      ok: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  } finally {
+    await closeDb2().catch(() => {});
+  }
+}
+async function preflightBootstrapDatabase(config, secrets, emit2) {
+  const databaseUrl = setupDatabaseUrl(config, secrets);
+  const reachable = await checkDatabaseReachable(databaseUrl);
+  if (!reachable.ok) {
+    emit2({
+      type: "step-error",
+      step: "bootstrap",
+      message: `Postgres at ${redactUrl(databaseUrl)} did not answer SELECT 1: ${reachable.error}. Check \`docker compose logs postgres\`, then re-run setup to resume.`
+    });
+    return null;
+  }
+  emit2({
+    type: "step-log",
+    step: "bootstrap",
+    line: `database ${redactUrl(databaseUrl)}`
+  });
+  return databaseUrl;
+}
+async function runBootstrap(config, against, files, onLine) {
   const [command, ...prefix] = cliEntry();
   const args = [...prefix, "bootstrap", "--against", against, "--yes"];
-  return runStreaming(command, args, { cwd: config.dir, onLine });
+  return runStreaming(command, args, {
+    cwd: config.dir,
+    env: buildChildEnv(files.envPath),
+    onLine
+  });
 }
-async function runVerify(config, against, onLine) {
+async function runVerify(config, against, files, onLine) {
   const [command, ...prefix] = cliEntry();
   const args = [...prefix, "verify", "all", "--against", against];
-  return runStreaming(command, args, { cwd: config.dir, onLine });
+  return runStreaming(command, args, {
+    cwd: config.dir,
+    env: buildChildEnv(files.envPath),
+    onLine
+  });
+}
+function redactUrl(url) {
+  try {
+    const u3 = new URL(url);
+    if (u3.password)
+      u3.password = "***";
+    return u3.toString();
+  } catch {
+    return url;
+  }
 }
 function buildSuccessSummary(config, secrets) {
   const apiUrl = `http://${normalizeLoopbackHost(config.apiPort)}`;
@@ -35341,7 +35772,11 @@ async function runSetup(initialConfig, emit2) {
     dir: config.dir,
     network: config.network,
     apiPort: config.apiPort,
-    force: config.force
+    force: config.force,
+    archivePublicKeyPem: await resolveArchivePublicKey({
+      envPem: process.env.ARCHIVE_SIGNING_PUBLIC_KEY ?? process.env.STREAMS_SIGNING_PUBLIC_KEY,
+      allowHostedApi: !isOssMode()
+    })
   });
   emit2({ type: "step-done", step: "secrets" });
   emit2({ type: "step-start", step: "config" });
@@ -35408,7 +35843,11 @@ ${up.stderr || up.stdout}`
     emit2({ type: "step-skip", step: "bootstrap", reason: "--skip-bootstrap" });
   } else if (config.against) {
     emit2({ type: "step-start", step: "bootstrap" });
-    const res = await runBootstrap(config, config.against, (line) => emit2({ type: "step-log", step: "bootstrap", line }));
+    const databaseUrl = await preflightBootstrapDatabase(config, secrets, emit2);
+    if (databaseUrl === null) {
+      return { ok: false, config, secrets, files, observer };
+    }
+    const res = await runBootstrap(config, config.against, files, (line) => emit2({ type: "step-log", step: "bootstrap", line }));
     if (res.code === 0) {
       bootstrapped = true;
       emit2({ type: "step-done", step: "bootstrap" });
@@ -35436,7 +35875,7 @@ ${up.stderr || up.stdout}`
     });
   } else {
     emit2({ type: "step-start", step: "verify" });
-    const res = await runVerify(config, config.against, (line) => emit2({ type: "step-log", step: "verify", line }));
+    const res = await runVerify(config, config.against, files, (line) => emit2({ type: "step-log", step: "verify", line }));
     if (res.code === 0) {
       emit2({ type: "step-done", step: "verify" });
     } else {
@@ -35452,11 +35891,13 @@ ${up.stderr || up.stdout}`
   emit2({ type: "step-done", step: "summary", detail: summary });
   return { ok: true, config, secrets, files, observer, summary };
 }
-var SETUP_NODE_MODES, DEFAULT_ARCHIVE_MANIFEST = "https://archive.secondlayer.tools/latest.json", MissingSetupFlagError;
+var SETUP_NODE_MODES, DEFAULT_ARCHIVE_MANIFEST = "https://archive.secondlayer.tools/latest.json", MissingSetupFlagError, SETUP_POSTGRES_USER = "secondlayer", SETUP_POSTGRES_DB = "secondlayer", CHILD_ENV_KEYS;
 var init_setup_wizard = __esm(() => {
+  init_archive_reference();
   init_instance_init();
   init_observer_stanza();
   init_oss_compose();
+  init_resolve_auth();
   SETUP_NODE_MODES = ["external", "stacks", "full"];
   MissingSetupFlagError = class MissingSetupFlagError extends Error {
     flag;
@@ -35466,6 +35907,12 @@ var init_setup_wizard = __esm(() => {
       this.flag = flag;
     }
   };
+  CHILD_ENV_KEYS = [
+    "DATABASE_URL",
+    "ARCHIVE_SIGNING_PUBLIC_KEY",
+    "SL_API_URL",
+    "INSTANCE_TOKEN"
+  ];
 });
 
 // src/lib/setup-tui.tsx
@@ -35473,6 +35920,7 @@ var exports_setup_tui = {};
 __export(exports_setup_tui, {
   runSetupTui: () => runSetupTui
 });
+import { resolve as resolvePath4 } from "node:path";
 import {
   CliRenderEvents,
   createCliRenderer
@@ -35578,7 +36026,7 @@ function App({ flags }) {
     apiPort: flags.apiPort ?? "127.0.0.1:3800",
     indexerPort: "127.0.0.1:3700",
     postgresPort: "127.0.0.1:5432",
-    dir: flags.dir ?? process.cwd(),
+    dir: resolvePath4(flags.dir ?? process.cwd()),
     against: skipBootstrap ? undefined : against,
     skipBootstrap,
     skipVerify: !!flags.skipVerify,
@@ -35992,13 +36440,13 @@ async function runSetupTui(flags) {
   createRoot(renderer).render(/* @__PURE__ */ jsxDEV(App, {
     flags
   }, undefined, false, undefined, this));
-  return new Promise((resolve16, reject) => {
+  return new Promise((resolve17, reject) => {
     let settled = false;
     const onDestroy = () => {
       if (settled)
         return;
       settled = true;
-      resolve16();
+      resolve17();
     };
     const onError = (event) => {
       if (settled)
@@ -36098,7 +36546,7 @@ var {
 // package.json
 var package_default = {
   name: "@secondlayer/cli",
-  version: "13.0.3",
+  version: "14.0.0",
   description: "Run a Stacks index on your own hardware — set it up, restore verified history, and keep it current.",
   repository: {
     type: "git",
@@ -36142,11 +36590,11 @@ var package_default = {
     "@opentui/core": "^0.5.3",
     "@opentui/react": "^0.5.3",
     "@secondlayer/bundler": "^0.5.1",
-    "@secondlayer/scaffold": "^1.5.4",
-    "@secondlayer/sdk": "^9.0.1",
-    "@secondlayer/shared": "^11.0.0",
-    "@secondlayer/stacks": "^4.0.0",
-    "@secondlayer/subgraphs": "^4.0.4",
+    "@secondlayer/scaffold": "^1.5.5",
+    "@secondlayer/sdk": "^10.0.0",
+    "@secondlayer/shared": "^11.2.0",
+    "@secondlayer/stacks": "^5.0.0",
+    "@secondlayer/subgraphs": "^4.1.1",
     esbuild: "^0.27.4",
     react: "^19.1.0",
     "smol-toml": "^1.6.1",
@@ -36201,7 +36649,7 @@ async function runBuy(opts) {
     human: () => {
       success(`Checkout for $${amount} → ${email}`);
       console.log(res.url);
-      console.log(dim("After payment: SL_API_URL=https://api.secondlayer.tools secondlayer login && secondlayer credits balance"));
+      console.log(dim(`After payment: ${ARCHIVE_LOGIN_COMMAND} && secondlayer credits balance`));
     }
   });
 }
@@ -36585,7 +37033,11 @@ Examples:
   });
   config.command("reset").description("Reset configuration to defaults").option("-y, --yes", "Skip confirmation").action(async (opts) => {
     try {
-      if (!opts.yes && !await confirmDestructive("Reset configuration to defaults?")) {
+      if (!await confirmDestructive({
+        message: "Reset configuration to defaults?",
+        yes: opts.yes
+      })) {
+        info("Cancelled.");
         return;
       }
       await resetConfig();
@@ -36597,7 +37049,11 @@ Examples:
   });
   config.command("delete").description("Delete all configuration (remove the config file)").option("-y, --yes", "Skip confirmation").action(async (opts) => {
     try {
-      if (!opts.yes && !await confirmDestructive("Delete the config file?")) {
+      if (!await confirmDestructive({
+        message: "Delete the config file?",
+        yes: opts.yes
+      })) {
+        info("Cancelled.");
         return;
       }
       await clearConfig();
@@ -36608,26 +37064,6 @@ Examples:
     }
   });
 }
-async function confirmDestructive(message) {
-  if (!process.stdin.isTTY) {
-    error("Interactive prompt unavailable (stdin is not a TTY). Re-run with -y to skip confirmation.");
-    process.exit(1);
-  }
-  const { confirm: confirm4 } = await import("@inquirer/prompts");
-  try {
-    const ok = await confirm4({ message, default: false });
-    if (!ok)
-      console.log("Cancelled.");
-    return ok;
-  } catch (promptErr) {
-    const m2 = promptErr instanceof Error ? promptErr.message : String(promptErr);
-    if (m2.includes("ExitPromptError") || m2.includes("force closed")) {
-      error("Interactive prompt unavailable. Re-run with -y to skip confirmation.");
-      process.exit(1);
-    }
-    throw promptErr;
-  }
-}
 async function printConfigTree(cfg) {
   const defaults2 = getDefaultConfig();
   printValue("network", cfg.network, isDefaultValue(cfg, "network"));
@@ -36761,7 +37197,9 @@ function registerConsoleCommand(program2) {
 }
 // src/commands/context.ts
 init_http();
-import { SecondLayer as SecondLayer2 } from "@secondlayer/sdk";
+import {
+  SecondLayer as SecondLayer2
+} from "@secondlayer/sdk";
 
 // src/lib/instance-diagnosis.ts
 var BOOTSTRAP_STEP = "Restore verified history: secondlayer bootstrap --against <manifest>";
@@ -36881,8 +37319,19 @@ function registerContextCommand(program2) {
       const apiKey = resolveEnvKey();
       const sl = new SecondLayer2({ baseUrl: apiUrl, apiKey });
       const snapshot = await sl.context();
-      const diagnostics = await explain(snapshot, apiUrl, apiKey);
-      const payload = { ...snapshot, diagnostics };
+      const values2 = {};
+      const errors2 = {};
+      for (const [field, entry] of Object.entries(snapshot)) {
+        values2[field] = entry.value;
+        if (entry.error)
+          errors2[field] = entry.error;
+      }
+      const diagnostics = await explain(values2, apiUrl, apiKey);
+      const payload = {
+        ...values2,
+        ...Object.keys(errors2).length > 0 ? { errors: errors2 } : {},
+        diagnostics
+      };
       output({
         json: o3.json,
         data: payload,
@@ -37002,7 +37451,6 @@ function printPublicStatus(status, diagnosis) {
 init_api_client();
 init_filter_params();
 init_output();
-import { confirm as confirm4 } from "@inquirer/prompts";
 import { sign } from "@secondlayer/shared/crypto/standard-webhooks";
 
 // src/lib/subscription-validation.ts
@@ -37028,6 +37476,7 @@ init_filter_params();
 init_output();
 init_resolve_auth();
 import {
+  chmodSync,
   copyFileSync,
   existsSync as existsSync4,
   mkdirSync as mkdirSync3,
@@ -37108,23 +37557,51 @@ function parseTriggersInput(opts) {
     return result.data;
   });
 }
+function resolveRuntime(opts) {
+  if (opts.runtime)
+    return opts.runtime;
+  const scripted = opts.subgraph !== undefined || opts.table !== undefined || opts.url !== undefined || opts.scaffold === false;
+  return scripted ? "node" : undefined;
+}
+function requireTtyFor(flag) {
+  if (process.stdin.isTTY)
+    return;
+  error(`${flag} is required when stdin is not a TTY (no prompt can run). Pass it, or run from a terminal.`);
+  process.exit(1);
+}
 async function promptFor(_name, opts) {
-  const runtime = opts.runtime ?? await select3({
-    message: "Runtime?",
-    choices: RUNTIMES.map((r2) => ({ name: r2, value: r2 }))
-  });
-  const subgraph = opts.subgraph ?? await input2({
-    message: "Subgraph name (must already be deployed):",
-    validate: (v2) => v2.trim().length > 0 ? true : "required"
-  });
-  const table = opts.table ?? await input2({
-    message: "Table to subscribe to:",
-    validate: (v2) => v2.trim().length > 0 ? true : "required"
-  });
-  const url = opts.url ?? await input2({
-    message: runtime === "inngest" ? "Inngest event endpoint URL (e.g. https://inn.gs/e/<KEY> or http://localhost:8288/e/<KEY>):" : runtime === "trigger" ? "Trigger.dev task URL (e.g. https://api.trigger.dev/api/v1/tasks/<TASK_ID>/trigger):" : runtime === "cloudflare" ? "Cloudflare Workflows instances URL:" : "Your HTTP receiver URL (e.g. https://yourapp.example/webhook):",
-    validate: (v2) => v2.startsWith("http://") || v2.startsWith("https://") ? true : "must be http(s) URL"
-  });
+  let runtime = resolveRuntime(opts);
+  if (runtime === undefined) {
+    requireTtyFor("--runtime");
+    runtime = await select3({
+      message: "Runtime?",
+      choices: RUNTIMES.map((r2) => ({ name: r2, value: r2 }))
+    });
+  }
+  let subgraph = opts.subgraph;
+  if (subgraph === undefined) {
+    requireTtyFor("--subgraph");
+    subgraph = await input2({
+      message: "Subgraph name (must already be deployed):",
+      validate: (v2) => v2.trim().length > 0 ? true : "required"
+    });
+  }
+  let table = opts.table;
+  if (table === undefined) {
+    requireTtyFor("--table");
+    table = await input2({
+      message: "Table to subscribe to:",
+      validate: (v2) => v2.trim().length > 0 ? true : "required"
+    });
+  }
+  let url = opts.url;
+  if (url === undefined) {
+    requireTtyFor("--url");
+    url = await input2({
+      message: runtime === "inngest" ? "Inngest event endpoint URL (e.g. https://inn.gs/e/<KEY> or http://localhost:8288/e/<KEY>):" : runtime === "trigger" ? "Trigger.dev task URL (e.g. https://api.trigger.dev/api/v1/tasks/<TASK_ID>/trigger):" : runtime === "cloudflare" ? "Cloudflare Workflows instances URL:" : "Your HTTP receiver URL (e.g. https://yourapp.example/webhook):",
+      validate: (v2) => v2.startsWith("http://") || v2.startsWith("https://") ? true : "must be http(s) URL"
+    });
+  }
   return { runtime, subgraph, table, url };
 }
 function buildSubscriptionAuthConfig(authToken) {
@@ -37136,6 +37613,27 @@ function buildSubscriptionAuthConfig(authToken) {
   }
   return { authType: "bearer", token };
 }
+function writeSigningSecretEnv(targetDir, signingSecret) {
+  const envTarget = join6(targetDir, ".env");
+  const envExample = join6(targetDir, ".env.example");
+  if (existsSync4(envExample) && !existsSync4(envTarget)) {
+    copyFileSync(envExample, envTarget);
+    chmodSync(envTarget, 384);
+  }
+  if (!existsSync4(envTarget)) {
+    writeFileSync4(envTarget, `SIGNING_SECRET=${signingSecret}
+`, {
+      mode: 384
+    });
+  } else {
+    const cur = readFileSync5(envTarget, "utf8");
+    writeFileSync4(envTarget, cur.match(/^SIGNING_SECRET=/m) ? cur.replace(/^SIGNING_SECRET=.*/m, `SIGNING_SECRET=${signingSecret}`) : `${cur}
+SIGNING_SECRET=${signingSecret}
+`, { mode: 384 });
+    chmodSync(envTarget, 384);
+  }
+  return envTarget;
+}
 async function createSubscription(name, opts) {
   if (opts.runtime && !RUNTIMES.includes(opts.runtime)) {
     error(`Unknown --runtime "${opts.runtime}". Valid: ${RUNTIMES.join(", ")}`);
@@ -37167,7 +37665,7 @@ async function createSubscription(name, opts) {
   }
   const eventName = `${subgraph}.${table}.created`;
   const targetDir = resolve5(process.cwd(), name);
-  if (!opts.scaffold === false) {
+  if (opts.scaffold !== false) {
     if (existsSync4(targetDir)) {
       error(`Directory already exists: ${relative(process.cwd(), targetDir)}`);
       process.exit(1);
@@ -37214,21 +37712,8 @@ async function createSubscription(name, opts) {
       subscriptionStatus = created?.status;
     } catch {}
   }
-  if (signingSecret && !opts.scaffold === false) {
-    const envTarget = join6(targetDir, ".env");
-    const envExample = join6(targetDir, ".env.example");
-    if (existsSync4(envExample) && !existsSync4(envTarget)) {
-      copyFileSync(envExample, envTarget);
-    }
-    if (!existsSync4(envTarget)) {
-      writeFileSync4(envTarget, `SIGNING_SECRET=${signingSecret}
-`);
-    } else {
-      const cur = readFileSync5(envTarget, "utf8");
-      writeFileSync4(envTarget, cur.match(/^SIGNING_SECRET=/m) ? cur.replace(/^SIGNING_SECRET=.*/m, `SIGNING_SECRET=${signingSecret}`) : `${cur}
-SIGNING_SECRET=${signingSecret}
-`);
-    }
+  if (signingSecret && opts.scaffold !== false) {
+    const envTarget = writeSigningSecretEnv(targetDir, signingSecret);
     success(`Signing secret written to ${relative(process.cwd(), envTarget)}`);
   } else if (signingSecret && opts.scaffold === false) {
     info(`Signing secret (store securely): ${signingSecret}`);
@@ -37301,7 +37786,7 @@ async function getSubscriptionClient() {
   return new SecondLayer3({ baseUrl: apiUrl, apiKey: ephemeralKey });
 }
 function addSubscriptionScaffold(parent, commandSpec, opts) {
-  parent.command(commandSpec).description(opts.description).option("-r, --runtime <runtime>", "inngest | trigger | cloudflare | node").option("-s, --subgraph <name>", "Subgraph to subscribe to").option("-t, --table <name>", "Table to subscribe to").option("-u, --url <url>", "Webhook URL").option("--auth-token <token>", "Bearer token for receiver API auth").option("--filter <kv...>", "Filter as key=value (supports .eq/.neq/.gt/.gte/.lt/.lte suffixes)").option("--trigger <json...>", `Chain-subscription trigger as JSON (repeatable), e.g. '{"type":"sbtc_deposit"}'`).option("--triggers-file <path>", "Chain-subscription triggers as a JSON array file").option("--format <format>", "Chain mode delivery format (default standard-webhooks)").option("--skip-api", "Copy template only, don't call the API").option("--no-scaffold", "Skip the local runtime template directory (webhook-only setups)").addHelpText("after", `
+  parent.command(commandSpec).description(opts.description).option("-r, --runtime <runtime>", "inngest | trigger | cloudflare | node (default: node once -s/-t/-u or --no-scaffold is given; prompts only in a terminal with no flags)").option("-s, --subgraph <name>", "Subgraph to subscribe to").option("-t, --table <name>", "Table to subscribe to").option("-u, --url <url>", "Webhook URL").option("--auth-token <token>", "Bearer token for receiver API auth; a flag lands in shell history and ps, so set it in the receiver's env and pass it here only for a throwaway token").option("--filter <kv...>", "Filter as key=value (supports .eq/.neq/.gt/.gte/.lt/.lte suffixes)").option("--trigger <json...>", `Chain-subscription trigger as JSON (repeatable), e.g. '{"type":"sbtc_deposit"}'`).option("--triggers-file <path>", "Chain-subscription triggers as a JSON array file").option("--format <format>", "Chain mode delivery format (default standard-webhooks)").option("--skip-api", "Copy template only, don't call the API").option("--no-scaffold", "Skip the local runtime template directory (webhook-only setups)").addHelpText("after", `
 Examples:
   $ ${opts.examplePrefix} my-sub -s my-graph -t transfers -u https://example.com/webhook
   $ ${opts.examplePrefix} my-sub -s my-graph -t balances -r inngest --filter amount.gte=1000
@@ -37668,28 +38153,10 @@ function printDead(rows) {
   ])));
 }
 async function confirmOrExit(message, yes) {
-  if (yes)
-    return true;
-  if (!process.stdin.isTTY) {
-    error("Interactive prompt unavailable (stdin is not a TTY). Re-run with -y to skip confirmation.");
-    process.exit(1);
-  }
-  let ok = false;
-  try {
-    ok = await confirm4({ message });
-  } catch (promptErr) {
-    const m2 = promptErr instanceof Error ? promptErr.message : String(promptErr);
-    if (m2.includes("ExitPromptError") || m2.includes("force closed")) {
-      error("Interactive prompt unavailable. Re-run with -y to skip confirmation.");
-      process.exit(1);
-    }
-    throw promptErr;
-  }
-  if (!ok) {
+  const ok = await confirmDestructive({ message, yes });
+  if (!ok)
     info("Cancelled");
-    return false;
-  }
-  return true;
+  return ok;
 }
 function registerSubscriptionsCommand(program2) {
   const subscriptions = program2.command("subscriptions").alias("subs").description("Manage subgraph table subscriptions");
@@ -37732,7 +38199,7 @@ ${data.length} subscription(s) total`));
       handleApiError(err, "get subscription");
     }
   });
-  subscriptions.command("update <idOrName>").description("Update subscription config").option("--name <name>", "Rename subscription").option("--url <url>", "Webhook URL").option("--auth-token <token>", "Set bearer token auth config").option("--format <format>", "standard-webhooks | inngest | trigger | cloudflare | cloudevents | raw").option("--runtime <runtime>", "inngest | trigger | cloudflare | node | none").option("--filter <kv...>", "Filter as key=value (supports .eq/.neq/.gt/.gte/.lt/.lte suffixes)").option("--clear-filter", "Replace filter with {}").option("--max-retries <n>", "Maximum delivery retries").option("--timeout-ms <n>", "Delivery timeout in milliseconds").option("--concurrency <n>", "Per-subscription delivery concurrency").option("--json", "Output as JSON").addHelpText("after", `
+  subscriptions.command("update <idOrName>").description("Update subscription config").option("--name <name>", "Rename subscription").option("--url <url>", "Webhook URL").option("--auth-token <token>", "Set bearer token auth config; a flag lands in shell history and ps, so pass it here only for a throwaway token").option("--format <format>", "standard-webhooks | inngest | trigger | cloudflare | cloudevents | raw").option("--runtime <runtime>", "inngest | trigger | cloudflare | node | none").option("--filter <kv...>", "Filter as key=value (supports .eq/.neq/.gt/.gte/.lt/.lte suffixes)").option("--clear-filter", "Replace filter with {}").option("--max-retries <n>", "Maximum delivery retries").option("--timeout-ms <n>", "Delivery timeout in milliseconds").option("--concurrency <n>", "Per-subscription delivery concurrency").option("--json", "Output as JSON").addHelpText("after", `
 Examples:
   $ secondlayer subscriptions update my-sub --url https://example.com/hook
   $ secondlayer subscriptions update my-sub --filter amount.gte=1000 --max-retries 5
@@ -37917,7 +38384,7 @@ Examples:
       handleApiError(err, "diagnose subscription");
     }
   });
-  subscriptions.command("test <idOrName>").description("Inspect a webhook fixture; --post sends a logged test delivery via the server (--local POSTs client-side instead)").option("--signing-secret <secret>", "Signing secret override (--local only)").option("--post", "Send a test delivery via the server (logged, all formats)").option("--local", "With --post: POST the fixture client-side (not logged)").option("--json", "Output as JSON").action(async (idOrName, options3) => {
+  subscriptions.command("test <idOrName>").description("Inspect a webhook fixture; --post sends a logged test delivery via the server (--local POSTs client-side instead)").option("--signing-secret <secret>", "Signing secret override (--local only); prefer SIGNING_SECRET in env, a flag lands in shell history and ps").option("--post", "Send a test delivery via the server (logged, all formats)").option("--local", "With --post: POST the fixture client-side (not logged)").option("--json", "Output as JSON").action(async (idOrName, options3) => {
     try {
       const signingSecret = resolveSigningSecret(options3);
       const client2 = await getSubscriptionClient();
@@ -37944,7 +38411,8 @@ Examples:
         const res = await fetch(detail.url, {
           method: "POST",
           headers: fixture.headers,
-          body: fixture.body
+          body: fixture.body,
+          signal: AbortSignal.timeout(15000)
         });
         postResult = {
           status: res.status,
@@ -38418,8 +38886,9 @@ init_subgraphs2();
 // src/commands/streams.ts
 init_output();
 init_resolve_auth();
-import { mkdir as mkdir3, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname9, join as join10 } from "node:path";
+import { createHash as createHash3 } from "node:crypto";
+import { mkdir as mkdir3, open as open2, rename as rename2 } from "node:fs/promises";
+import { dirname as dirname9, isAbsolute, resolve as resolve6, sep } from "node:path";
 import { createStreamsClient } from "@secondlayer/sdk";
 import { STREAMS_EVENT_TYPES } from "@secondlayer/shared";
 var VALID_TYPES = STREAMS_EVENT_TYPES;
@@ -38441,6 +38910,48 @@ function dumpsClient(dumpsUrl) {
     dumpsBaseUrl
   });
 }
+function resolveDumpDest(to, filePath) {
+  const root = resolve6(to);
+  const segments = filePath.split(/[\\/]/);
+  if (filePath.length === 0 || isAbsolute(filePath) || filePath.includes("\\") || segments.some((s2) => s2 === "..")) {
+    throw new Error(`refusing dump path "${filePath}": paths must be relative and stay under ${root}`);
+  }
+  const dest = resolve6(root, filePath);
+  if (!dest.startsWith(root + sep)) {
+    throw new Error(`refusing dump path "${filePath}": resolves outside ${root}`);
+  }
+  return dest;
+}
+async function downloadDumpTo(file, dest, fetchImpl, url) {
+  const res = await fetchImpl(url);
+  if (!res.ok || !res.body) {
+    throw new Error(`could not download dump ${file.path} (${res.status})`);
+  }
+  await mkdir3(dirname9(dest), { recursive: true });
+  const part = `${dest}.part`;
+  const hash = createHash3("sha256");
+  let bytes = 0;
+  const handle = await open2(part, "w");
+  try {
+    const reader = res.body.getReader();
+    for (;; ) {
+      const { value, done } = await reader.read();
+      if (done)
+        break;
+      hash.update(value);
+      bytes += value.byteLength;
+      await handle.write(value);
+    }
+  } finally {
+    await handle.close();
+  }
+  const digest = hash.digest("hex");
+  if (digest !== file.sha256) {
+    throw new Error(`dump ${file.path} sha256 mismatch (expected ${file.sha256}, got ${digest}); partial file left at ${part}`);
+  }
+  await rename2(part, dest);
+  return bytes;
+}
 function parseTypes(value, flag = "--types") {
   if (!value)
     return;
@@ -38469,6 +38980,29 @@ function parseLimit(value) {
   }
   return n3;
 }
+function parseMaxPages(value) {
+  if (value === undefined)
+    return;
+  const n3 = Number.parseInt(value, 10);
+  if (!Number.isFinite(n3) || n3 < 1 || String(n3) !== value.trim()) {
+    throw new Error("--max-pages must be a positive integer");
+  }
+  return n3;
+}
+function consumeHandlers(io) {
+  return {
+    onBatch: (events, _envelope, ctx) => {
+      for (const e2 of events)
+        io.stdout(JSON.stringify(e2));
+      if (ctx.cursor)
+        io.stderr(`# next_cursor=${ctx.cursor}`);
+    },
+    onReorg: (reorg, ctx) => {
+      io.stdout(JSON.stringify({ kind: "reorg", ...reorg }));
+      io.stderr(`# reorg at ${reorg.fork_point_height}; rewinding to ${ctx.cursor}`);
+    }
+  };
+}
 function parseHeight(value, name) {
   if (value === undefined)
     return;
@@ -38528,8 +39062,14 @@ Examples:
   $ secondlayer streams consume --not-types print --sender SP1...,SP2... --batch-size 500 --max-pages 10`).action(async (options3) => {
     try {
       const batchSize = parseLimit(options3.batchSize) ?? 100;
-      const maxPages = options3.maxPages ? Number.parseInt(options3.maxPages, 10) : undefined;
-      note("# streaming events to stdout (jsonl); next_cursor printed to stderr");
+      const maxPages = parseMaxPages(options3.maxPages);
+      note('# streaming events to stdout (jsonl); reorgs appear inline as {"kind":"reorg"}; next_cursor printed to stderr');
+      const handlers = consumeHandlers({
+        stdout: (line) => process.stdout.write(`${line}
+`),
+        stderr: (line) => process.stderr.write(`${line}
+`)
+      });
       await client2().events.consume({
         fromCursor: options3.cursor,
         types: parseTypes(options3.types),
@@ -38540,17 +39080,8 @@ Examples:
         batchSize,
         mode: "tail",
         maxPages,
-        onBatch: (events2, envelope) => {
-          for (const e2 of events2) {
-            process.stdout.write(`${JSON.stringify(e2)}
-`);
-          }
-          if (envelope.next_cursor) {
-            process.stderr.write(`# next_cursor=${envelope.next_cursor}
-`);
-          }
-          return envelope.next_cursor;
-        }
+        onBatch: handlers.onBatch,
+        onReorg: handlers.onReorg
       });
     } catch (err) {
       error(err instanceof Error ? err.message : String(err));
@@ -38582,11 +39113,9 @@ Examples:
       }
       note(`# downloading ${files.length} file(s) to ${options3.to}`);
       for (const file of files) {
-        const bytes = await dumps.download(file);
-        const dest = join10(options3.to, file.path);
-        await mkdir3(dirname9(dest), { recursive: true });
-        await writeFile3(dest, bytes);
-        process.stderr.write(`# ${file.path} (${file.row_count} rows, ${bytes.byteLength} bytes)
+        const dest = resolveDumpDest(options3.to, file.path);
+        const bytes = await downloadDumpTo(file, dest, fetch, dumps.fileUrl(file));
+        process.stderr.write(`# ${file.path} (${file.row_count} rows, ${bytes} bytes)
 `);
       }
       writeData(JSON.stringify({
@@ -39006,7 +39535,7 @@ function markFrozen(cmd) {
 init_config2();
 init_dev_state();
 init_output();
-import { confirm as confirm5 } from "@inquirer/prompts";
+import { confirm as confirm4 } from "@inquirer/prompts";
 import { getDb, sql } from "@secondlayer/shared/db";
 import {
   countMissingBlocks,
@@ -39226,7 +39755,7 @@ async function resetDatabase(skipConfirm) {
     console.log(dim("Note: Subgraph configurations will be preserved."));
     console.log("");
     if (!skipConfirm) {
-      const confirmed = await confirm5({
+      const confirmed = await confirm4({
         message: "Are you sure you want to reset the database?",
         default: false
       });
@@ -39263,7 +39792,7 @@ async function resyncDatabase(skipConfirm, backfill) {
     console.log(dim("Note: Subgraph configurations will be preserved."));
     console.log("");
     if (!skipConfirm) {
-      const confirmed = await confirm5({
+      const confirmed = await confirm4({
         message: "Are you sure you want to resync?",
         default: false
       });
@@ -39834,9 +40363,9 @@ init_output();
 
 // src/lib/project-file.ts
 import { existsSync as existsSync7 } from "node:fs";
-import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4 } from "node:fs/promises";
+import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile3 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname15, join as join13, parse as parsePath2, resolve as resolve11 } from "node:path";
+import { dirname as dirname15, join as join12, parse as parsePath2, resolve as resolve12 } from "node:path";
 import { z as z4 } from "zod";
 var ProjectFileSchema = z4.object({
   slug: z4.string().min(1)
@@ -39844,11 +40373,11 @@ var ProjectFileSchema = z4.object({
 var FILENAME = "project";
 var DIRNAME = ".secondlayer";
 async function readActiveProject(cwd, globalDefault) {
-  let dir = resolve11(cwd);
-  const home2 = resolve11(homedir5());
+  let dir = resolve12(cwd);
+  const home2 = resolve12(homedir5());
   const fsRoot = parsePath2(dir).root;
   while (true) {
-    const candidate = join13(dir, DIRNAME, FILENAME);
+    const candidate = join12(dir, DIRNAME, FILENAME);
     if (existsSync7(candidate)) {
       try {
         const raw = await readFile4(candidate, "utf8");
@@ -39856,7 +40385,7 @@ async function readActiveProject(cwd, globalDefault) {
         return { slug: parsed.slug, resolvedFrom: candidate };
       } catch {}
     }
-    if (existsSync7(join13(dir, ".git")))
+    if (existsSync7(join12(dir, ".git")))
       break;
     if (dir === home2 || dir === fsRoot)
       break;
@@ -39868,57 +40397,50 @@ async function readActiveProject(cwd, globalDefault) {
   if (globalDefault) {
     return {
       slug: globalDefault,
-      resolvedFrom: join13(homedir5(), ".secondlayer", "config.json")
+      resolvedFrom: join12(homedir5(), ".secondlayer", "config.json")
     };
   }
   return null;
 }
 
 // src/commands/whoami.ts
-init_resolve_auth();
 function registerWhoamiCommand(program2) {
-  program2.command("whoami", { hidden: true }).description("Show the active account, credential source, and project").option("--json", "Output as JSON").action(async (options3) => {
-    let auth;
-    try {
-      auth = await resolveAuth();
-    } catch {
-      error("Not logged in. Run: secondlayer login");
-      process.exit(1);
-    }
+  program2.command("whoami", { hidden: true }).description("Show the archive credits account, credential source, and project").option("--json", "Output as JSON").action(async (options3) => {
+    const creditsUrl = resolveArchiveOpsUrl();
+    const { source } = await resolveArchiveOpsBearer();
     let account;
     try {
-      account = await httpPlatform("/api/accounts/me");
+      account = await httpArchiveOps("/api/accounts/me");
     } catch (err) {
-      if (err instanceof CliHttpError && err.code === "SESSION_EXPIRED") {
-        error("Session expired. Run: secondlayer login");
+      if (err instanceof CliHttpError) {
+        error(err.message);
         process.exit(1);
       }
       throw err;
     }
     const config = await loadConfig2();
     const active = await readActiveProject(process.cwd(), config.defaultProject);
-    const authSource = auth.fromEnv ? "API key (env)" : "session";
+    const authSource = source === "env" ? "API key (env)" : `session (${ARCHIVE_LOGIN_COMMAND})`;
     output({
       json: options3.json,
       data: {
         email: account.email,
-        apiUrl: auth.apiUrl,
+        creditsUrl,
+        apiUrl: resolveApiUrl(),
         authSource,
         project: active ? { slug: active.slug, source: active.resolvedFrom } : null
       },
       human: () => {
         const rows = [];
         rows.push(["Email", account.email]);
-        rows.push(["API URL", auth.apiUrl]);
+        rows.push(["Credits API", creditsUrl]);
+        rows.push(["Instance API", resolveApiUrl()]);
         rows.push(["Auth", dim(authSource)]);
         if (active) {
           rows.push(["Project", active.slug]);
           rows.push(["Project source", dim(active.resolvedFrom)]);
         } else {
-          rows.push([
-            "Project",
-            dim("(none — run `secondlayer project use <slug>`)")
-          ]);
+          rows.push(["Project", dim("(none)")]);
         }
         console.log(formatKeyValue(rows));
       }
@@ -39933,25 +40455,34 @@ init_login();
 init_http();
 init_output();
 init_session();
-function registerLogoutCommand(program2) {
-  program2.command("logout", { hidden: true }).description("Log out and revoke the local session").action(async () => {
-    const session = await readSession();
-    if (!session) {
-      info("Not logged in.");
-      return;
-    }
-    try {
-      await httpPlatform("/api/auth/logout", { method: "POST" });
-    } catch (err) {
-      if (err instanceof CliHttpError) {
-        warn(`Server logout failed (${err.code}) — clearing local session anyway`);
-      }
+init_login();
+async function runLogout(opts = {}) {
+  const target = loginTarget(opts);
+  const session = await readSession(target);
+  if (!session) {
+    info(`Not logged in (${target}).`);
+    return;
+  }
+  try {
+    await httpAt(target, "/api/auth/logout", {
+      method: "POST",
+      bearer: session.token
+    });
+  } catch (err) {
+    if (err instanceof CliHttpError) {
+      warn(`Server logout failed (${err.code}); clearing the local session anyway`);
     }
-    await clearSession();
-    success("Logged out.");
-  });
+  }
+  await clearSession(target);
+  success(`Logged out (${target}).`);
+}
+function registerLogoutCommand(program2) {
+  program2.command("logout", { hidden: true }).description("Log out and revoke the local session").option("--credits", "Log out of the archive credits account used by bootstrap, repair, and credits").action((opts) => runLogout({ credits: opts.credits }));
 }
 // src/commands/verify.ts
+init_archive_reference();
+init_output();
+init_resolve_auth();
 import {
   compareRangeDigests,
   computeRangeDigest
@@ -39966,139 +40497,6 @@ import {
   reportVerify
 } from "@secondlayer/shared/coverage";
 import { getDb as getDb2 } from "@secondlayer/shared/db";
-
-// src/lib/archive-reference.ts
-import { createHash as createHash2 } from "node:crypto";
-import { readFile as readFile5 } from "node:fs/promises";
-import { dirname as dirname16, join as join14, resolve as resolve12 } from "node:path";
-import {
-  checkKeyTrust,
-  publicKeyFor,
-  verifyRegistry
-} from "@secondlayer/shared/archive/key-registry";
-import { verifyStreamsBulkManifestSignature } from "@secondlayer/shared/streams-bulk-manifest";
-function isLatestPointer(value) {
-  const pointer = value;
-  return typeof pointer.snapshot_path === "string" && (value.partitions === undefined || value.partitions.length === 0);
-}
-async function fetchJson(url) {
-  const response2 = await fetch(url, { signal: AbortSignal.timeout(30000) });
-  if (!response2.ok) {
-    throw new Error(`could not fetch manifest (${response2.status} ${response2.statusText})`);
-  }
-  return response2.json();
-}
-async function loadReference(source) {
-  const isRemote = /^https?:\/\//.test(source);
-  let manifest;
-  let root;
-  if (isRemote) {
-    manifest = await fetchJson(source);
-    const url = new URL(source);
-    url.pathname = url.pathname.replace(/\/snapshots\/[^/]+$/, "").replace(/\/[^/]+\.json$/, "");
-    root = url.toString();
-  } else {
-    const path11 = resolve12(source);
-    manifest = JSON.parse(await readFile5(path11, "utf8"));
-    root = isLatestPointer(manifest) ? dirname16(path11) : dirname16(dirname16(path11));
-  }
-  if (!isLatestPointer(manifest)) {
-    return { manifest, origin: source, root, isRemote };
-  }
-  const pointer = manifest;
-  const snapshotPath = pointer.snapshot_path;
-  const resolved = isRemote ? await fetchJson(`${root.replace(/\/$/, "")}/${snapshotPath}`) : JSON.parse(await readFile5(join14(root, snapshotPath), "utf8"));
-  if (pointer.snapshot_digest) {
-    const digest = createHash2("sha256").update(JSON.stringify((({ signature: _s, key_id: _k, ...rest }) => rest)(resolved))).digest("hex");
-    if (digest !== pointer.snapshot_digest) {
-      throw new Error(`pointer/snapshot mismatch: latest.json names ${pointer.snapshot_digest}, resolved manifest hashes to ${digest}`);
-    }
-  }
-  return { manifest: resolved, origin: source, root, isRemote };
-}
-function checkSignature(manifest, publicKeyPem, insecure) {
-  if (insecure)
-    return { verified: false, reason: "signature check skipped" };
-  if (!manifest.signature) {
-    return { verified: false, reason: "manifest carries no signature" };
-  }
-  if (!publicKeyPem) {
-    return {
-      verified: false,
-      reason: "no public key available to verify with"
-    };
-  }
-  try {
-    const verified = verifyStreamsBulkManifestSignature(manifest, publicKeyPem);
-    return {
-      verified,
-      reason: verified ? undefined : "signature did not verify"
-    };
-  } catch (err) {
-    return {
-      verified: false,
-      reason: err instanceof Error ? err.message : "signature check failed"
-    };
-  }
-}
-var HOSTED_API = "https://api.secondlayer.tools";
-async function resolvePublicKey(explicitPem, apiUrl) {
-  if (explicitPem)
-    return explicitPem;
-  try {
-    const response2 = await fetch(`${apiUrl.replace(/\/$/, "")}/public/streams/signing-key`, { signal: AbortSignal.timeout(1e4) });
-    if (!response2.ok)
-      return;
-    const body = await response2.json();
-    return body.public_key_pem;
-  } catch {
-    return;
-  }
-}
-async function resolveArchivePublicKey(input4) {
-  if (input4.explicitPem)
-    return input4.explicitPem;
-  if (input4.envPem)
-    return input4.envPem;
-  if (input4.allowHostedApi) {
-    return resolvePublicKey(undefined, HOSTED_API);
-  }
-  return;
-}
-async function fetchViaGate(gate, partition, retried) {
-  const url = await gate.getUrl(partition.path, retried ? { forceRefresh: true } : undefined);
-  const response2 = await fetch(url, { signal: AbortSignal.timeout(300000) });
-  if (response2.status === 403 && !retried) {
-    return fetchViaGate(gate, partition, true);
-  }
-  if (!response2.ok) {
-    throw new Error(`could not fetch ${partition.path} (${response2.status} ${response2.statusText})`);
-  }
-  return Buffer.from(await response2.arrayBuffer());
-}
-async function fetchVerifiedPartition(reference, partition, gate) {
-  let bytes;
-  if (gate) {
-    bytes = await fetchViaGate(gate, partition, false);
-  } else if (reference.isRemote) {
-    const url = `${reference.root.replace(/\/$/, "")}/${partition.path}`;
-    const response2 = await fetch(url, { signal: AbortSignal.timeout(300000) });
-    if (!response2.ok) {
-      throw new Error(`could not fetch ${partition.path} (${response2.status} ${response2.statusText})`);
-    }
-    bytes = Buffer.from(await response2.arrayBuffer());
-  } else {
-    bytes = await readFile5(join14(reference.root, partition.path));
-  }
-  const digest = createHash2("sha256").update(bytes).digest("hex");
-  if (digest !== partition.sha256) {
-    throw new Error(`${partition.path} failed verification: expected ${partition.sha256}, got ${digest}`);
-  }
-  return bytes;
-}
-
-// src/commands/verify.ts
-init_output();
 var VERIFY_EXIT = {
   CLEAN: 0,
   DIVERGED: 1,
@@ -40121,7 +40519,7 @@ function statusLabel(status2) {
   return yellow("missing");
 }
 function registerVerifyCommand(program2) {
-  program2.command("verify").description("Compare local chain data against a signed archive (read-only; nothing is uploaded)").argument("[target]", "all | raw | decode:<name> | subgraph:<name>", "raw").option("--quick", "coverage/identity only (default)").option("--deep", "include semantic / scratch replay where available").option("--anchor", "require a verified archive signature").requiredOption("--against <manifest>", "archive manifest: an https URL or a local file path").option("--from-block <n>", "first height to check").option("--to-block <n>", "last height to check").option("--counts", "also compare transaction/event row counts (slower)").option("--semantic", "also recompute per-partition semantic digests locally and compare (slow: full re-stream)").option("--public-key <pem>", "pin the signing key instead of fetching it").option("--insecure", "skip the manifest signature check (not recommended)").option("--json", "Output as JSON").addHelpText("after", `
+  program2.command("verify").description("Compare local chain data against a signed archive (read-only; nothing is uploaded)").argument("[target]", "all | raw | decode:<name> | subgraph:<name>", "raw").option("--quick", "coverage/identity only (default)").option("--deep", "include semantic / scratch replay where available").option("--anchor", "require a verified archive signature").requiredOption("--against <manifest>", "archive manifest: an https URL or a local file path").option("--from-block <n>", "first height to check").option("--to-block <n>", "last height to check").option("--counts", "also compare transaction/event row counts (slower)").option("--semantic", "also recompute per-partition semantic digests locally and compare (slow: full re-stream)").option("--public-key <pem>", "pin a signing key; default is the archive key built into this release").option("--insecure", "skip the manifest signature check (not recommended)").option("--json", "Output as JSON").addHelpText("after", `
 Examples:
   $ secondlayer verify --against https://archive.secondlayer.tools/.../snapshots/<digest>.json
   $ secondlayer verify raw --against ./snapshot.json --from-block 8000000 --to-block 8499999
@@ -40141,8 +40539,14 @@ Exit codes:
       if (fromBlock !== undefined && toBlock !== undefined && toBlock < fromBlock) {
         throw new Error("--to-block must be >= --from-block");
       }
-      const { manifest, origin } = await loadReference(opts.against);
-      const publicKey = await resolvePublicKey(opts.publicKey, process.env.SL_API_URL ?? "https://api.secondlayer.tools");
+      const publicKey = await resolveArchivePublicKey({
+        explicitPem: opts.publicKey,
+        envPem: process.env.ARCHIVE_SIGNING_PUBLIC_KEY ?? process.env.STREAMS_SIGNING_PUBLIC_KEY,
+        allowHostedApi: !isOssMode()
+      });
+      const { manifest, origin } = await loadReference(opts.against, {
+        publicKeyPem: publicKey
+      });
       const signature = checkSignature(manifest, publicKey, !!opts.insecure);
       if (!signature.verified && !opts.insecure) {
         printError(`Cannot trust the reference: ${signature.reason}.`, {
@@ -40297,24 +40701,27 @@ Exit codes:
       });
       process.exit(diverged.length === 0 ? VERIFY_EXIT.CLEAN : VERIFY_EXIT.DIVERGED);
     } catch (err) {
-      printError(err instanceof Error ? err.message : String(err), {
-        hint: "Set DATABASE_URL to the instance you want to verify."
-      });
+      const message = err instanceof Error ? err.message : String(err);
+      const hint = /pointer|leave the archive root/.test(message) ? "The archive pointer failed its integrity check. Pass --against the snapshot URL directly, and report this if the pointer is the official latest.json." : /could not fetch/.test(message) ? "Check the archive URL and your network connection." : "Set DATABASE_URL to the instance you want to verify.";
+      printError(message, { hint });
       process.exit(VERIFY_EXIT.UNANCHORED);
     }
   });
 }
 // src/commands/repair.ts
-import { unlink as unlink2, writeFile as writeFile5 } from "node:fs/promises";
-import { tmpdir as tmpdir2 } from "node:os";
+import { unlink as unlink3, writeFile as writeFile5 } from "node:fs/promises";
+import { tmpdir as tmpdir3 } from "node:os";
 import { join as join15 } from "node:path";
-import { ParquetReader } from "@dsnp/parquetjs";
-import { confirm as confirm7 } from "@inquirer/prompts";
+import { ParquetReader as ParquetReader2 } from "@dsnp/parquetjs";
+import {
+  copyStatement,
+  writeRowsToCopyStream
+} from "@secondlayer/shared/archive/copy-loader";
 import {
   compareRangeDigests as compareRangeDigests2,
   computeRangeDigest as computeRangeDigest2
 } from "@secondlayer/shared/archive/range-digest";
-import { getDb as getDb3, sql as sql2 } from "@secondlayer/shared/db";
+import { getDb as getDb3, getRawClient } from "@secondlayer/shared/db";
 
 // src/lib/archive-gate.ts
 init_http();
@@ -40373,10 +40780,18 @@ function formatQuoteValue(quote, flow) {
   return `${quote.partitions} partitions ≈ $${quote.usd} · balance ${balance}`;
 }
 function shouldPromptForGatedFetch(opts) {
-  return !opts.yes && !opts.json;
+  return !opts.yes;
+}
+function confirmationRequiredPayload(quote) {
+  return {
+    code: "CONFIRMATION_REQUIRED",
+    message: "Nothing was fetched. Re-run with -y to approve this fetch; --json never stands in for -y.",
+    quote
+  };
 }
 var FETCH_BATCH_SIZE = 16;
-function createGatedFetcher(paths, flow, deps = defaultDeps) {
+var PRESIGN_REFRESH_MARGIN_MS = 60000;
+function createGatedFetcher(paths, flow, deps = defaultDeps, now = Date.now) {
   const cache = new Map;
   const batchOf = new Map;
   for (const [index, path11] of paths.entries()) {
@@ -40386,21 +40801,29 @@ function createGatedFetcher(paths, flow, deps = defaultDeps) {
   const inFlight = new Map;
   async function fetchAndCache(batchPaths) {
     const body = await deps.httpArchiveOps("/api/archive/fetch", { method: "POST", body: { paths: batchPaths, flow } });
-    for (const u3 of body.urls)
-      cache.set(u3.path, u3.url);
+    for (const u3 of body.urls) {
+      const parsed = Date.parse(u3.expires_at);
+      cache.set(u3.path, {
+        url: u3.url,
+        expiresAt: Number.isFinite(parsed) ? parsed : null
+      });
+    }
+  }
+  async function reissue(path11, why) {
+    if (process.env.DEBUG) {
+      console.error(`[archive-gate] re-issuing ${why} URL for ${path11}`);
+    }
+    await fetchAndCache([path11]);
+    const fresh = cache.get(path11);
+    if (!fresh) {
+      throw new Error(`archive gate: no URL returned for ${path11}`);
+    }
+    return fresh.url;
   }
   return {
     async getUrl(path11, opts) {
       if (opts?.forceRefresh) {
-        if (process.env.DEBUG) {
-          console.error(`[archive-gate] re-issuing expired URL for ${path11}`);
-        }
-        await fetchAndCache([path11]);
-        const fresh = cache.get(path11);
-        if (!fresh) {
-          throw new Error(`archive gate: no URL returned for ${path11}`);
-        }
-        return fresh;
+        return reissue(path11, "expired");
       }
       const batchIndex = batchOf.get(path11);
       if (batchIndex === undefined) {
@@ -40417,16 +40840,47 @@ function createGatedFetcher(paths, flow, deps = defaultDeps) {
         }
         await inflight;
       }
-      const url = cache.get(path11);
-      if (!url)
+      const cached = cache.get(path11);
+      if (!cached) {
         throw new Error(`archive gate: no URL returned for ${path11}`);
-      return url;
+      }
+      if (cached.expiresAt !== null && cached.expiresAt - now() < PRESIGN_REFRESH_MARGIN_MS) {
+        return reissue(path11, "expiring");
+      }
+      return cached.url;
     }
   };
 }
 
 // src/commands/repair.ts
+init_archive_reference();
 init_output();
+
+// src/lib/parquet-rows.ts
+import { unlink as unlink2, writeFile as writeFile4 } from "node:fs/promises";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join14 } from "node:path";
+import { ParquetReader } from "@dsnp/parquetjs";
+async function* readPartitionRows(bytes, label) {
+  const path11 = join14(tmpdir2(), `sl-archive-${label}-${process.pid}.parquet`);
+  await writeFile4(path11, bytes);
+  try {
+    const reader = await ParquetReader.openFile(path11);
+    try {
+      const cursor = reader.getCursor();
+      for (let row = await cursor.next();row; row = await cursor.next()) {
+        yield row;
+      }
+    } finally {
+      await reader.close();
+    }
+  } finally {
+    await unlink2(path11).catch(() => {});
+  }
+}
+
+// src/commands/repair.ts
+init_resolve_auth();
 var REPAIR_EXIT = {
   OK: 0,
   DIVERGENCE_REMAINS: 1,
@@ -40442,10 +40896,10 @@ function asOptionalText(value) {
   return value === null || value === undefined ? null : asText(value);
 }
 async function readBlocksPartition(bytes, label) {
-  const path11 = join15(tmpdir2(), `sl-repair-${label}-${process.pid}.parquet`);
+  const path11 = join15(tmpdir3(), `sl-repair-${label}-${process.pid}.parquet`);
   await writeFile5(path11, bytes);
   try {
-    const reader = await ParquetReader.openFile(path11);
+    const reader = await ParquetReader2.openFile(path11);
     const rows = [];
     try {
       const cursor = reader.getCursor();
@@ -40465,7 +40919,7 @@ async function readBlocksPartition(bytes, label) {
     }
     return rows;
   } finally {
-    await unlink2(path11).catch(() => {});
+    await unlink3(path11).catch(() => {});
   }
 }
 function parseHeight3(value, flag) {
@@ -40503,24 +40957,92 @@ async function planRange(db, reference, partition, gate) {
   const extraHeights = [...localByHeight.keys()].sort((a4, b3) => a4 - b3);
   return { fixes, extraHeights };
 }
-async function applyFixes(db, reference, partition, fixes, gate) {
+var CHILD_DATASETS = ["transactions", "events"];
+var REPAIR_DATASETS = [
+  "blocks",
+  "transactions",
+  "events"
+];
+function childPartitionFor(partitions, dataset, height) {
+  return partitions.find((p2) => p2.dataset === dataset && p2.from_block <= height && p2.to_block >= height);
+}
+function planChildRewrite(partitions, heights) {
+  const missing = {
+    transactions: [],
+    events: []
+  };
+  const found = new Map;
+  for (const dataset of CHILD_DATASETS) {
+    for (const height of heights) {
+      const partition = childPartitionFor(partitions, dataset, height);
+      if (!partition) {
+        missing[dataset].push(height);
+        continue;
+      }
+      found.set(height, { ...found.get(height), [dataset]: partition });
+    }
+  }
+  const rewritable = heights.filter((h3) => {
+    const entry = found.get(h3);
+    return !!entry?.transactions && !!entry?.events;
+  });
+  const byPartition = new Map;
+  for (const height of rewritable) {
+    for (const dataset of CHILD_DATASETS) {
+      const partition = found.get(height)?.[dataset];
+      if (!partition)
+        continue;
+      const entry = byPartition.get(partition.path) ?? {
+        partition,
+        heights: []
+      };
+      entry.heights.push(height);
+      byPartition.set(partition.path, entry);
+    }
+  }
+  return { byPartition, missing, rewritable };
+}
+async function* onlyHeights(rows, heights) {
+  for await (const row of rows) {
+    if (heights.has(asNumber(row.block_height)))
+      yield row;
+  }
+}
+async function applyFixes(rawClient, reference, partition, fixes, gate) {
+  const applied = {
+    blocks: 0,
+    transactions: 0,
+    events: 0,
+    missing: { transactions: [], events: [] },
+    rewritten: []
+  };
   if (fixes.length === 0)
-    return 0;
+    return applied;
   const bytes = await fetchVerifiedPartition(reference, partition, gate);
   const archiveBlocks = await readBlocksPartition(bytes, `apply-${partition.from_block}`);
   const byHeight = new Map(archiveBlocks.map((b3) => [b3.height, b3]));
   const targets = fixes.map((fix) => byHeight.get(fix.height)).filter((b3) => b3 !== undefined);
-  await db.transaction().execute(async (tx) => {
+  const heights = targets.map((b3) => b3.height);
+  const children = planChildRewrite(reference.manifest.partitions ?? [], heights);
+  applied.missing = children.missing;
+  applied.rewritten = children.rewritable;
+  const rewritable = new Set(children.rewritable);
+  const childBytes = new Map;
+  for (const [path11, { partition: child }] of children.byPartition) {
+    childBytes.set(path11, await fetchVerifiedPartition(reference, child, gate));
+  }
+  await rawClient.begin(async (tx) => {
+    for (const height of rewritable) {
+      await tx.unsafe("DELETE FROM events WHERE block_height = $1", [height]);
+      await tx.unsafe("DELETE FROM transactions WHERE block_height = $1", [
+        height
+      ]);
+    }
     for (const block of targets) {
-      await sql2`
-				INSERT INTO blocks (
+      await tx.unsafe(`INSERT INTO blocks (
 					height, hash, parent_hash, burn_block_height,
 					burn_block_hash, index_block_hash, timestamp, canonical
-				) VALUES (
-					${block.height}, ${block.hash}, ${block.parent_hash},
-					${block.burn_block_height}, ${block.burn_block_hash},
-					${block.index_block_hash}, ${block.timestamp}, true
-				)
+				) VALUES ($1, $2, $3, $4, $5, $6, $7, true)
 				ON CONFLICT (height) DO UPDATE SET
 					hash = EXCLUDED.hash,
 					parent_hash = EXCLUDED.parent_hash,
@@ -40528,19 +41050,64 @@ async function applyFixes(db, reference, partition, fixes, gate) {
 					burn_block_hash = EXCLUDED.burn_block_hash,
 					index_block_hash = EXCLUDED.index_block_hash,
 					timestamp = EXCLUDED.timestamp,
-					canonical = true
-			`.execute(tx);
+					canonical = true`, [
+        block.height,
+        block.hash,
+        block.parent_hash,
+        block.burn_block_height,
+        block.burn_block_hash,
+        block.index_block_hash,
+        block.timestamp
+      ]);
+    }
+    applied.blocks = targets.length;
+    for (const dataset of CHILD_DATASETS) {
+      for (const [path11, { partition: child }] of children.byPartition) {
+        if (child.dataset !== dataset)
+          continue;
+        const bytes2 = childBytes.get(path11);
+        if (!bytes2)
+          continue;
+        const writable2 = await tx.unsafe(copyStatement(dataset)).writable();
+        applied[dataset] += await writeRowsToCopyStream({
+          writable: writable2,
+          dataset,
+          rows: onlyHeights(readPartitionRows(bytes2, `repair-${dataset}-${child.from_block}`), rewritable)
+        });
+      }
     }
   });
-  return targets.length;
+  return applied;
+}
+async function reverify(db, reference, ranges) {
+  const remaining = {
+    blocks: 0,
+    transactions: 0,
+    events: 0
+  };
+  const published = reference.manifest.range_digests ?? [];
+  for (const dataset of REPAIR_DATASETS) {
+    const expected = published.filter((d2) => d2.dataset === dataset && ranges.some((r2) => r2.from_block === d2.from_block && r2.to_block === d2.to_block));
+    const actual = [];
+    for (const range of expected) {
+      actual.push(await computeRangeDigest2(db, dataset, range.from_block, range.to_block));
+    }
+    remaining[dataset] = compareRangeDigests2(actual, expected).filter((c4) => c4.status !== "match").length;
+  }
+  return remaining;
 }
 function registerRepairCommand(program2) {
-  program2.command("repair").description("Replace local chain data that diverges from a signed archive (dry-run by default)").requiredOption("--against <manifest>", "archive manifest: an https URL or a local file path").option("--from-block <n>", "first height to consider").option("--to-block <n>", "last height to consider").option("--apply", "write the repair (default is a dry-run plan)").option("--public-key <pem>", "pin the signing key instead of fetching it").option("-y, --yes", "skip the confirmation prompt for a metered fetch").option("--json", "Output as JSON").addHelpText("after", `
+  program2.command("repair").description("Replace local chain data that diverges from a signed archive (dry-run by default)").requiredOption("--against <manifest>", "archive manifest: an https URL or a local file path").option("--from-block <n>", "first height to consider").option("--to-block <n>", "last height to consider").option("--apply", "write the repair (default is a dry-run plan)").option("--public-key <pem>", "pin a signing key; default is the archive key built into this release").option("-y, --yes", "skip the confirmation prompt for a metered fetch").option("--json", "Output as JSON").addHelpText("after", `
 Examples:
   $ secondlayer repair --against ./snapshot.json                      # plan only
   $ secondlayer repair --against ./snapshot.json --apply              # write the fix
   $ secondlayer repair --against ./snapshot.json --from-block 8500000 --to-block 8549999
 
+A fixed block is rewritten together with its transactions and events from the
+archive's partitions for that height. When the reference carries no
+transactions or events partition for a height, the block is rewritten alone,
+the run names the height, and it exits 1.
+
 Exit codes:
   0  nothing to repair, or the repair completed and re-verified clean
   1  divergence remains (dry-run, or repair did not fully resolve it)
@@ -40548,8 +41115,14 @@ Exit codes:
     try {
       const fromBlock = opts.fromBlock === undefined ? undefined : parseHeight3(opts.fromBlock, "--from-block");
       const toBlock = opts.toBlock === undefined ? undefined : parseHeight3(opts.toBlock, "--to-block");
-      const reference = await loadReference(opts.against);
-      const publicKey = await resolvePublicKey(opts.publicKey, process.env.SL_API_URL ?? "https://api.secondlayer.tools");
+      const publicKey = await resolveArchivePublicKey({
+        explicitPem: opts.publicKey,
+        envPem: process.env.ARCHIVE_SIGNING_PUBLIC_KEY ?? process.env.STREAMS_SIGNING_PUBLIC_KEY,
+        allowHostedApi: !isOssMode()
+      });
+      const reference = await loadReference(opts.against, {
+        publicKeyPem: publicKey
+      });
       const signature = checkSignature(reference.manifest, publicKey, false);
       if (!signature.verified) {
         printError(`Refusing to repair from an untrusted reference: ${signature.reason}.`, {
@@ -40581,9 +41154,12 @@ Exit codes:
         process.exit(REPAIR_EXIT.OK);
       }
       const partitions = (reference.manifest.partitions ?? []).filter((p2) => p2.dataset === "blocks" && divergent.some((d2) => d2.from_block === p2.from_block && d2.to_block === p2.to_block));
+      const childPartitions = opts.apply ? (reference.manifest.partitions ?? []).filter((p2) => (p2.dataset === "transactions" || p2.dataset === "events") && divergent.some((d2) => p2.from_block <= d2.to_block && p2.to_block >= d2.from_block)) : [];
+      const fetchPaths = [...partitions, ...childPartitions].map((p2) => p2.path);
       let gate;
+      let quoteLine;
       if (isOfficialArchive(reference)) {
-        const paths = partitions.map((p2) => p2.path);
+        const paths = fetchPaths;
         const result = await quoteArchiveFetch(paths, "repair");
         if (!result.ok) {
           printError(result.kind === "not_configured" ? ARCHIVE_GATE_NOT_CONFIGURED_MESSAGE : result.message);
@@ -40593,11 +41169,16 @@ Exit codes:
           printError(formatInsufficientMessage(result.quote));
           process.exit(REPAIR_EXIT.UNANCHORED);
         }
-        note(`  metered: ${formatQuoteValue(result.quote, "repair")}`);
+        quoteLine = formatQuoteValue(result.quote, "repair");
+        note(`  metered: ${quoteLine}`);
         if (shouldPromptForGatedFetch(opts)) {
-          const proceed = await confirm7({
-            message: `Fetch ${partitions.length} partition(s) from the archive?`,
-            default: true
+          if (opts.json) {
+            writeData(JSON.stringify(confirmationRequiredPayload(result.quote)));
+            process.exit(REPAIR_EXIT.UNANCHORED);
+          }
+          const proceed = await confirmDestructive({
+            message: `Fetch ${fetchPaths.length} partition(s) from the archive?`,
+            yes: opts.yes
           });
           if (!proceed) {
             note("Nothing was fetched.");
@@ -40616,30 +41197,64 @@ Exit codes:
         allFixes.push(...fixes);
         allExtra.push(...extraHeights);
       }
-      let applied = 0;
+      const applied = { blocks: 0, transactions: 0, events: 0 };
+      const missingChild = {
+        transactions: [],
+        events: []
+      };
+      let childrenRewritten = 0;
       if (opts.apply) {
+        const rawClient = getRawClient("source");
         for (const { partition, fixes } of planned) {
-          applied += await applyFixes(db, reference, partition, fixes, gate);
-        }
-      }
-      let remaining = divergent.length;
+          const result = await applyFixes(rawClient, reference, partition, fixes, gate);
+          applied.blocks += result.blocks;
+          applied.transactions += result.transactions;
+          applied.events += result.events;
+          missingChild.transactions.push(...result.missing.transactions);
+          missingChild.events.push(...result.missing.events);
+          childrenRewritten += result.rewritten.length;
+        }
+      }
+      const missingHeights = [
+        ...new Set([...missingChild.transactions, ...missingChild.events])
+      ].sort((a4, b3) => a4 - b3);
+      const rewritten = opts.apply ? REPAIR_DATASETS.filter((d2) => d2 === "blocks" || childrenRewritten > 0) : [];
+      let remainingByDataset = {
+        blocks: divergent.length,
+        transactions: 0,
+        events: 0
+      };
       if (opts.apply) {
-        const after = [];
-        for (const range of referenceDigests) {
-          after.push(await computeRangeDigest2(db, "blocks", range.from_block, range.to_block));
-        }
-        remaining = compareRangeDigests2(after, referenceDigests).filter((c4) => c4.status !== "match").length;
+        remainingByDataset = await reverify(db, reference, referenceDigests);
       }
+      const remaining = remainingByDataset.blocks + remainingByDataset.transactions + remainingByDataset.events;
+      const complete = !!opts.apply && remaining === 0 && missingHeights.length === 0;
       const report = {
-        status: opts.apply ? remaining === 0 ? "repaired" : "incomplete" : "plan",
+        status: opts.apply ? complete ? "repaired" : "incomplete" : "plan",
         reference: reference.origin,
         divergent_ranges: divergent.length,
         blocks_to_replace: allFixes.filter((f2) => f2.kind === "replace").length,
         blocks_to_insert: allFixes.filter((f2) => f2.kind === "insert").length,
         local_only_heights: allExtra,
-        applied,
-        fixes: allFixes
+        applied: applied.blocks,
+        rows_written: applied,
+        datasets_rewritten: rewritten,
+        heights_missing_child_partitions: missingHeights,
+        remaining_by_dataset: remainingByDataset,
+        fixes: allFixes,
+        metered: quoteLine ?? null
       };
+      if (missingHeights.length > 0) {
+        for (const dataset of CHILD_DATASETS) {
+          const heights = missingChild[dataset];
+          if (heights.length === 0)
+            continue;
+          warn(`  the reference has no ${dataset} partition for ${heights.length} height(s): ${heights.slice(0, 5).join(", ")}${heights.length > 5 ? ", …" : ""}`);
+        }
+        for (const height of missingHeights.slice(0, 5)) {
+          console.error(dim(`  transactions/events at ${height}: run \`secondlayer bootstrap --from-block ${height} --to-block ${height}\``));
+        }
+      }
       output({
         json: opts.json,
         data: report,
@@ -40647,10 +41262,14 @@ Exit codes:
           const replace = report.blocks_to_replace;
           const insert = report.blocks_to_insert;
           if (opts.apply) {
-            if (remaining === 0) {
-              success(`Repaired ${applied} blocks across ${divergent.length} ranges; re-verified clean.`);
+            const written = `${applied.blocks} blocks, ${applied.transactions} transactions, ${applied.events} events`;
+            if (complete) {
+              success(`Repaired ${applied.blocks} heights across ${divergent.length} ranges (rewrote ${written}); re-verified clean on ${rewritten.join(", ")}.`);
+            } else if (remaining > 0) {
+              const byDataset = REPAIR_DATASETS.map((d2) => `${remainingByDataset[d2]} ${d2}`).join(", ");
+              warn(`Rewrote ${written} but ${remaining} ranges still diverge (${byDataset}).`);
             } else {
-              warn(`Applied ${applied} blocks but ${remaining} ranges still diverge.`);
+              warn(`Rewrote ${written}; blocks re-verified clean, but transactions and events at ${missingHeights.length} height(s) were not rewritten.`);
             }
           } else {
             warn(`${divergent.length} ranges diverge — ${replace} blocks to replace, ${insert} to insert.`);
@@ -40681,31 +41300,39 @@ Exit codes:
           }
         }
       });
-      process.exit(opts.apply && remaining === 0 ? REPAIR_EXIT.OK : REPAIR_EXIT.DIVERGENCE_REMAINS);
+      process.exit(complete ? REPAIR_EXIT.OK : REPAIR_EXIT.DIVERGENCE_REMAINS);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      const hint = /failed verification/.test(message) ? "The archive object does not match its signed digest — re-download it, and report this if it persists." : /could not fetch/.test(message) ? "Check the archive URL and your network connection." : "Set DATABASE_URL to the instance you want to repair.";
+      if (err instanceof ArchiveFetchError && err.transient) {
+        printError(message, {
+          hint: "The archive could not be reached. Re-run the same command to resume; heights already repaired are kept."
+        });
+        process.exit(REPAIR_EXIT.DIVERGENCE_REMAINS);
+      }
+      const hint = /pointer|leave the archive root/.test(message) ? "The archive pointer failed its integrity check. Pass --against the snapshot URL directly, and report this if the pointer is the official latest.json." : /failed verification/.test(message) ? "The archive object does not match its signed digest. Re-download it, and report this if it persists." : /could not fetch/.test(message) ? "Check the archive URL and your network connection." : "Set DATABASE_URL to the instance you want to repair.";
       printError(message, { hint });
       process.exit(REPAIR_EXIT.UNANCHORED);
     }
   });
 }
 // src/commands/bootstrap.ts
-import { createHash as createHash3 } from "node:crypto";
-import { unlink as unlink3, writeFile as writeFile6 } from "node:fs/promises";
-import { tmpdir as tmpdir3 } from "node:os";
-import { join as join16 } from "node:path";
-import { ParquetReader as ParquetReader2 } from "@dsnp/parquetjs";
-import { confirm as confirm8 } from "@inquirer/prompts";
+import { createHash as createHash5 } from "node:crypto";
 import {
-  copyStatement,
-  writeRowsToCopyStream
+  copyStatement as copyStatement2,
+  writeRowsToCopyStream as writeRowsToCopyStream2
 } from "@secondlayer/shared/archive/copy-loader";
-import { computeRangeDigest as computeRangeDigest3 } from "@secondlayer/shared/archive/range-digest";
-import { getDb as getDb4, getRawClient, sql as sql3 } from "@secondlayer/shared/db";
+import {
+  computeRangeDigest as computeRangeDigest3
+} from "@secondlayer/shared/archive/range-digest";
+import { getDb as getDb4, getRawClient as getRawClient2, sql as sql2 } from "@secondlayer/shared/db";
 import { upsertSyncScope } from "@secondlayer/shared/db/queries/sync-scope";
+init_archive_reference();
 
 // src/lib/bootstrap-resume.ts
+var RESUME_DATASETS = ["blocks", "transactions", "events"];
+function isResumeDataset(value) {
+  return RESUME_DATASETS.includes(value);
+}
 function planTornImport(input4) {
   if (input4.hasIndexProgress) {
     return {
@@ -40713,21 +41340,50 @@ function planTornImport(input4) {
       reason: "This database already holds a completed bootstrap."
     };
   }
-  if (input4.maxBlockHeight === null || input4.maxBlockHeight <= 0) {
+  if (RESUME_DATASETS.every((d2) => input4.highWater[d2] === null)) {
     return { action: "fresh" };
   }
-  const blockPartitions = input4.partitions.filter((p2) => p2.dataset === "blocks").sort((a4, b3) => a4.from_block - b3.from_block);
-  const sealed = blockPartitions.filter((p2) => p2.to_block <= (input4.maxBlockHeight ?? 0));
-  const skipThrough = sealed.length > 0 ? Math.max(...sealed.map((p2) => p2.to_block)) : 0;
-  const torn = blockPartitions.find((p2) => p2.from_block <= (input4.maxBlockHeight ?? 0) && p2.to_block > (input4.maxBlockHeight ?? 0));
-  return {
-    action: "resume",
-    truncateFrom: torn ? torn.from_block : null,
-    skipThrough
+  const truncateFrom = {
+    blocks: null,
+    transactions: null,
+    events: null
+  };
+  const skipThrough = {
+    blocks: 0,
+    transactions: 0,
+    events: 0
+  };
+  for (const dataset of RESUME_DATASETS) {
+    const mark = input4.highWater[dataset];
+    if (mark === null)
+      continue;
+    const ranges = input4.partitions.filter((p2) => p2.dataset === dataset).sort((a4, b3) => a4.from_block - b3.from_block);
+    const sealed = ranges.filter((p2) => p2.to_block <= mark);
+    skipThrough[dataset] = sealed.length > 0 ? Math.max(...sealed.map((p2) => p2.to_block)) : 0;
+    const torn = ranges.find((p2) => p2.from_block <= mark && p2.to_block > mark);
+    truncateFrom[dataset] = torn ? torn.from_block : null;
+  }
+  const minDefined = (...values2) => {
+    const defined = values2.filter((v2) => v2 !== null);
+    return defined.length === 0 ? null : Math.min(...defined);
+  };
+  truncateFrom.transactions = minDefined(truncateFrom.blocks, truncateFrom.transactions);
+  truncateFrom.events = minDefined(truncateFrom.transactions, truncateFrom.events);
+  const capTo = (dataset, parentSealed) => {
+    if (skipThrough[dataset] <= parentSealed)
+      return;
+    skipThrough[dataset] = parentSealed;
+    truncateFrom[dataset] = minDefined(truncateFrom[dataset], parentSealed + 1);
   };
+  capTo("transactions", skipThrough.blocks);
+  capTo("events", skipThrough.transactions);
+  truncateFrom.events = minDefined(truncateFrom.transactions, truncateFrom.events);
+  return { action: "resume", truncateFrom, skipThrough };
 }
 function partitionIsLoaded(partition, skipThrough) {
-  return partition.to_block <= skipThrough;
+  if (!isResumeDataset(partition.dataset))
+    return false;
+  return partition.to_block <= skipThrough[partition.dataset];
 }
 
 // src/commands/bootstrap.ts
@@ -40750,7 +41406,7 @@ function archiveScopeBounds(partitions) {
 }
 function manifestDigest(manifest) {
   const { signature: _signature, key_id: _keyId, ...payload } = manifest;
-  return createHash3("sha256").update(JSON.stringify(payload)).digest("hex");
+  return createHash5("sha256").update(JSON.stringify(payload)).digest("hex");
 }
 async function readNodeTip() {
   const url = process.env.STACKS_NODE_RPC_URL ?? "http://localhost:20443";
@@ -40775,27 +41431,10 @@ function formatDuration2(seconds2) {
     return `${(seconds2 / 3600).toFixed(1)} hours`;
   return `${(seconds2 / 86400).toFixed(1)} days`;
 }
-async function* readPartitionRows(bytes, label) {
-  const path11 = join16(tmpdir3(), `sl-bootstrap-${label}-${process.pid}.parquet`);
-  await writeFile6(path11, bytes);
-  try {
-    const reader = await ParquetReader2.openFile(path11);
-    try {
-      const cursor = reader.getCursor();
-      for (let row = await cursor.next();row; row = await cursor.next()) {
-        yield row;
-      }
-    } finally {
-      await reader.close();
-    }
-  } finally {
-    await unlink3(path11).catch(() => {});
-  }
-}
 async function loadPartition(reference, partition, rawClient, gate) {
   const bytes = await fetchVerifiedPartition(reference, partition, gate);
-  const writable2 = await rawClient.unsafe(copyStatement(partition.dataset)).writable();
-  const written = await writeRowsToCopyStream({
+  const writable2 = await rawClient.unsafe(copyStatement2(partition.dataset)).writable();
+  const written = await writeRowsToCopyStream2({
     writable: writable2,
     dataset: partition.dataset,
     rows: readPartitionRows(bytes, `${partition.dataset}-${partition.from_block}`)
@@ -40805,8 +41444,44 @@ async function loadPartition(reference, partition, rawClient, gate) {
   }
   return written;
 }
+var LOAD_ORDER = [
+  "blocks",
+  "transactions",
+  "events"
+];
+function loadOrder(partitions) {
+  return LOAD_ORDER.flatMap((dataset) => partitions.filter((p2) => p2.dataset === dataset).sort((a4, b3) => a4.from_block - b3.from_block));
+}
+function parseVerifyDatasets(value) {
+  if (value === undefined || value === "all") {
+    return ["blocks", "transactions", "events"];
+  }
+  if (value === "blocks")
+    return ["blocks"];
+  throw new Error(`--verify must be "all" or "blocks", got "${String(value)}"`);
+}
+async function readHighWater(db) {
+  const asMark = (value) => value === null || value === undefined ? null : Number(value);
+  const blocks = await db.selectFrom("blocks").select(({ fn }) => fn.max("height").as("max")).executeTakeFirst();
+  const transactions = await db.selectFrom("transactions").select(({ fn }) => fn.max("block_height").as("max")).executeTakeFirst();
+  const events = await db.selectFrom("events").select(({ fn }) => fn.max("block_height").as("max")).executeTakeFirst();
+  return {
+    blocks: asMark(blocks?.max),
+    transactions: asMark(transactions?.max),
+    events: asMark(events?.max)
+  };
+}
+async function truncateDatasetFrom(db, dataset, from) {
+  if (dataset === "blocks") {
+    await sql2`DELETE FROM blocks WHERE height >= ${from}`.execute(db);
+  } else if (dataset === "transactions") {
+    await sql2`DELETE FROM transactions WHERE block_height >= ${from}`.execute(db);
+  } else {
+    await sql2`DELETE FROM events WHERE block_height >= ${from}`.execute(db);
+  }
+}
 function attachBootstrapCommand(cmd) {
-  return cmd.requiredOption("--against <manifest>", "archive manifest: an https URL or a local file path").option("--to-block <n>", "stop at this height instead of the archive tip").option("--from-block <n>", "forward-only: restore from this height instead of genesis; earlier history is declared out of scope").option("--public-key <pem>", "pin the signing key instead of fetching it").option("-y, --yes", "skip the confirmation prompt").option("--json", "Output as JSON").addHelpText("after", `
+  return cmd.requiredOption("--against <manifest>", "archive manifest: an https URL or a local file path").option("--to-block <n>", "stop at this height instead of the archive tip").option("--from-block <n>", "forward-only: restore from this height instead of genesis; earlier history is declared out of scope").option("--public-key <pem>", "pin a signing key; default is the archive key built into this release").option("--verify <datasets>", "digests checked after the load: all (blocks, transactions, events; adds minutes on a full chain) or blocks", "all").option("-y, --yes", "skip the confirmation prompt").option("--json", "Output as JSON").addHelpText("after", `
 Examples:
   $ secondlayer bootstrap --against https://archive.secondlayer.tools/.../snapshots/<digest>.json
   $ secondlayer bootstrap --against ./snapshot.json --to-block 4000000 --yes
@@ -40817,12 +41492,15 @@ Exit codes:
   1  restore completed but verification found divergence
   2  refused (non-empty target, or an untrusted reference)`).action(async (opts) => {
     try {
-      const reference = await loadReference(opts.against);
+      const verifyDatasets = parseVerifyDatasets(opts.verify);
       const publicKey = await resolveArchivePublicKey({
         explicitPem: opts.publicKey,
         envPem: process.env.ARCHIVE_SIGNING_PUBLIC_KEY ?? process.env.STREAMS_SIGNING_PUBLIC_KEY,
         allowHostedApi: !isOssMode()
       });
+      const reference = await loadReference(opts.against, {
+        publicKeyPem: publicKey
+      });
       const signature = checkSignature(reference.manifest, publicKey, false);
       if (!signature.verified) {
         printError(`Refusing to bootstrap from an untrusted archive: ${signature.reason}.`, {
@@ -40832,14 +41510,19 @@ Exit codes:
       }
       const db = getDb4();
       const progress = await db.selectFrom("index_progress").select("network").executeTakeFirst();
-      const maxHeightRow = await db.selectFrom("blocks").select(({ fn }) => fn.max("height").as("max")).executeTakeFirst();
-      const maxBlockHeight = maxHeightRow?.max === null || maxHeightRow?.max === undefined ? null : Number(maxHeightRow.max);
+      const highWater = await readHighWater(db);
       const toBlock = opts.toBlock === undefined ? undefined : Number(opts.toBlock);
       const fromBlock = opts.fromBlock === undefined ? undefined : Number(opts.fromBlock);
       const declared = (reference.manifest.partitions ?? []).filter((p2) => (toBlock === undefined || p2.to_block <= toBlock) && (fromBlock === undefined || p2.from_block >= fromBlock));
+      if (declared.length === 0) {
+        printError("The archive has no partitions for that range.", {
+          hint: "Check --from-block and --to-block against the manifest's coverage."
+        });
+        process.exit(BOOTSTRAP_EXIT.REFUSED);
+      }
       const resume = planTornImport({
         hasIndexProgress: !!progress,
-        maxBlockHeight,
+        highWater,
         partitions: declared
       });
       if (resume.action === "refuse") {
@@ -40848,33 +41531,38 @@ Exit codes:
         });
         process.exit(BOOTSTRAP_EXIT.REFUSED);
       }
-      if (resume.action === "resume" && resume.truncateFrom !== null) {
-        await sql3`DELETE FROM events WHERE block_height >= ${resume.truncateFrom}`.execute(db);
-        await sql3`DELETE FROM transactions WHERE block_height >= ${resume.truncateFrom}`.execute(db);
-        await sql3`DELETE FROM blocks WHERE height >= ${resume.truncateFrom}`.execute(db);
-        note(`Resuming torn import: truncated from height ${resume.truncateFrom}.`);
-      } else if (resume.action === "resume") {
-        note(`Resuming import after sealed height ${resume.skipThrough.toLocaleString()}.`);
+      if (resume.action === "resume") {
+        const truncated = [];
+        for (const dataset of [...RESUME_DATASETS].reverse()) {
+          const from = resume.truncateFrom[dataset];
+          if (from === null)
+            continue;
+          await truncateDatasetFrom(db, dataset, from);
+          truncated.push(`${dataset} from ${from.toLocaleString()}`);
+        }
+        if (truncated.length > 0) {
+          note(`Resuming torn import: truncated ${truncated.join(", ")}.`);
+        }
+        const sealed = RESUME_DATASETS.filter((d2) => resume.skipThrough[d2] > 0).map((d2) => `${d2} through ${resume.skipThrough[d2].toLocaleString()}`);
+        note(sealed.length > 0 ? `Resuming import after sealed partitions: ${sealed.join(", ")}.` : "Resuming import: no partition finished, so the load starts over from the first.");
       }
       const partitions = declared.filter((p2) => resume.action === "fresh" || !partitionIsLoaded(p2, resume.skipThrough));
       if (partitions.length === 0) {
-        printError("The archive has no partitions for that range.", {
-          hint: "Check --to-block against the manifest's coverage."
-        });
-        process.exit(BOOTSTRAP_EXIT.REFUSED);
+        note("All partitions are already loaded; verifying and finalizing the import.");
       }
       const scopeBounds = archiveScopeBounds(declared);
       const startHeight = scopeBounds?.start_height ?? 0;
       const totalRows = partitions.reduce((sum, p2) => sum + p2.row_count, 0);
       const totalBytes = partitions.reduce((sum, p2) => sum + p2.byte_size, 0);
-      const tipHeight = Math.max(...partitions.map((p2) => p2.to_block));
+      const tipHeight = scopeBounds?.tip_height ?? 0;
       const restoreSeconds = totalRows / RESTORE_ROWS_PER_SECOND;
       const genesisSeconds = tipHeight / BLOCKS_PER_DAY_ESTIMATE * 86400;
       const gated = isOfficialArchive(reference);
       let quoteLine;
+      let quote = null;
       let gate;
-      if (gated) {
-        const paths = partitions.map((p2) => p2.path);
+      if (gated && partitions.length > 0) {
+        const paths = loadOrder(partitions).map((p2) => p2.path);
         const result = await quoteArchiveFetch(paths, "bootstrap");
         if (!result.ok) {
           printError(result.kind === "not_configured" ? ARCHIVE_GATE_NOT_CONFIGURED_MESSAGE : result.message);
@@ -40884,6 +41572,7 @@ Exit codes:
           printError(formatInsufficientMessage(result.quote));
           process.exit(BOOTSTRAP_EXIT.REFUSED);
         }
+        quote = result.quote;
         quoteLine = formatQuoteValue(result.quote, "bootstrap");
         gate = createGatedFetcher(paths, "bootstrap");
       }
@@ -40905,10 +41594,16 @@ Exit codes:
         console.error(`  restore from archive ${bold(`~${formatDuration2(restoreSeconds)}`)}`);
         console.error("");
       }
-      if (shouldPromptForGatedFetch(opts)) {
-        const proceed = await confirm8({
+      if (partitions.length > 0 && shouldPromptForGatedFetch(opts)) {
+        if (opts.json) {
+          if (quoteLine)
+            note(`  metered: ${quoteLine}`);
+          writeData(JSON.stringify(confirmationRequiredPayload(quote)));
+          process.exit(BOOTSTRAP_EXIT.REFUSED);
+        }
+        const proceed = await confirmDestructive({
           message: "Restore from the verified archive?",
-          default: true
+          yes: opts.yes
         });
         if (!proceed) {
           note("Nothing was written.");
@@ -40916,12 +41611,11 @@ Exit codes:
         }
       }
       const nodeTipAtStart = await readNodeTip();
-      const order = ["blocks", "transactions", "events"];
-      const rawClient = getRawClient("source");
+      const rawClient = getRawClient2("source");
       const loaded = { blocks: 0, transactions: 0, events: 0 };
       const startedAt = Date.now();
-      for (const dataset of order) {
-        const datasetPartitions = partitions.filter((p2) => p2.dataset === dataset).sort((a4, b3) => a4.from_block - b3.from_block);
+      for (const dataset of LOAD_ORDER) {
+        const datasetPartitions = loadOrder(partitions).filter((p2) => p2.dataset === dataset);
         for (const [index, partition] of datasetPartitions.entries()) {
           loaded[dataset] += await loadPartition(reference, partition, rawClient, gate);
           const done = index + 1;
@@ -40931,16 +41625,21 @@ Exit codes:
           }
         }
       }
-      const referenceDigests = (reference.manifest.range_digests ?? []).filter((d2) => d2.dataset === "blocks" && d2.to_block <= tipHeight);
-      let divergent = 0;
+      const referenceDigests = (reference.manifest.range_digests ?? []).filter((d2) => verifyDatasets.includes(d2.dataset) && d2.from_block >= startHeight && d2.to_block <= tipHeight);
+      const divergentRanges = [];
       for (const range of referenceDigests) {
-        const actual = await computeRangeDigest3(db, "blocks", range.from_block, range.to_block);
+        const actual = await computeRangeDigest3(db, range.dataset, range.from_block, range.to_block);
         if (actual.digest !== range.digest || actual.row_count !== range.row_count) {
-          divergent++;
+          divergentRanges.push({
+            dataset: range.dataset,
+            from_block: range.from_block,
+            to_block: range.to_block
+          });
         }
       }
+      const divergent = divergentRanges.length;
       const network = process.env.STACKS_NETWORK ?? "mainnet";
-      await sql3`
+      await sql2`
 					INSERT INTO index_progress (
 						network, last_indexed_block, last_contiguous_block,
 						highest_seen_block, updated_at
@@ -40975,8 +41674,10 @@ Exit codes:
         start_height: startHeight,
         tip_height: tipHeight,
         rows: loaded,
+        verified_datasets: verifyDatasets,
         ranges_verified: referenceDigests.length,
         divergent_ranges: divergent,
+        divergent: divergentRanges,
         elapsed_seconds: Math.round(elapsed),
         resume_from: tipHeight + 1,
         node_tip_at_start: nodeTipAtStart,
@@ -40990,9 +41691,9 @@ Exit codes:
           if (divergent === 0) {
             success(`Restored ${loaded.blocks.toLocaleString()} blocks, ${loaded.transactions.toLocaleString()} transactions, ${loaded.events.toLocaleString()} events in ${formatDuration2(elapsed)}.`);
             if (referenceDigests.length > 0) {
-              note(`  verified ${referenceDigests.length} ranges against the archive`);
+              note(`  verified ${referenceDigests.length} ${verifyDatasets.join("/")} ranges against the archive`);
             } else {
-              warn("  archive published no block digests — restore is unverified");
+              warn("  archive published no digests for the restored range; the restore is unverified");
             }
             console.error("");
             console.error(dim(`Your instance holds history through ${tipHeight.toLocaleString()} and will resume at ${(tipHeight + 1).toLocaleString()}.`));
@@ -41006,7 +41707,8 @@ Exit codes:
               console.error(dim("  Start the indexer to continue from there. (Node unreachable — catch-up range unknown.)"));
             }
           } else {
-            warn(`Restored ${loaded.blocks.toLocaleString()} blocks but ${divergent} ranges do not match the archive.`);
+            const byDataset = verifyDatasets.map((d2) => `${divergentRanges.filter((r2) => r2.dataset === d2).length} ${d2}`).join(", ");
+            warn(`Restored ${loaded.blocks.toLocaleString()} blocks but ${divergent} ranges do not match the archive (${byDataset}).`);
             console.error(dim("  Investigate with: secondlayer verify --against <manifest>"));
           }
         }
@@ -41014,7 +41716,13 @@ Exit codes:
       process.exit(divergent === 0 ? BOOTSTRAP_EXIT.OK : BOOTSTRAP_EXIT.INCOMPLETE);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
-      const hint = /failed verification/.test(message) ? "An archive object does not match its signed digest — re-download and retry." : /could not fetch/.test(message) ? "Check the archive URL and your network connection." : "Set DATABASE_URL to the (empty) instance you want to bootstrap.";
+      if (err instanceof ArchiveFetchError && err.transient) {
+        printError(message, {
+          hint: "The archive could not be reached. Re-run the same command to resume; datasets already loaded are kept."
+        });
+        process.exit(BOOTSTRAP_EXIT.INCOMPLETE);
+      }
+      const hint = /^--verify must be/.test(message) ? "Pass --verify all (default) or --verify blocks." : /pointer|leave the archive root/.test(message) ? "The archive pointer failed its integrity check. Pass --against the snapshot URL directly, and report this if the pointer is the official latest.json." : /failed verification/.test(message) ? "An archive object does not match its signed digest. Re-download and retry." : /could not fetch/.test(message) ? "Check the archive URL and your network connection." : "Set DATABASE_URL to the (empty) instance you want to bootstrap.";
       printError(message, { hint });
       process.exit(BOOTSTRAP_EXIT.REFUSED);
     }
@@ -41024,29 +41732,66 @@ function registerBootstrapCommand(program2) {
   attachBootstrapCommand(program2.command("bootstrap").description("Restore chain history from a verified archive instead of syncing from genesis"));
 }
 // src/commands/uninstall.ts
+init_instance_init();
 init_output();
 import { spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync7 } from "node:fs";
-import { join as join17, resolve as resolve13 } from "node:path";
+import { existsSync as existsSync9, readFileSync as readFileSync8 } from "node:fs";
+import { join as join16, resolve as resolve15 } from "node:path";
 import { planUninstall, uninstallCommand } from "@secondlayer/shared/runtime";
 var UNINSTALL_EXIT = { OK: 0, FAILED: 1, REFUSED: 2 };
-var DEFAULT_COMPOSE = "docker/oss/docker-compose.yml";
+var REPO_COMPOSE = "docker/oss/docker-compose.yml";
 function bundleHasKeys(bundleDir) {
-  const manifest = join17(bundleDir, "manifest.json");
-  if (!existsSync8(manifest))
+  const manifest = join16(bundleDir, "manifest.json");
+  if (!existsSync9(manifest))
     return false;
   try {
-    const parsed = JSON.parse(readFileSync7(manifest, "utf8"));
+    const parsed = JSON.parse(readFileSync8(manifest, "utf8"));
     return parsed.secrets != null;
   } catch {
     return false;
   }
 }
+function resolveUninstallLayout(dir, composeOverride) {
+  const setupCompose = resolve15(dir, "docker-compose.yml");
+  const setupEnv = resolve15(dir, ".env");
+  const initEnv = resolve15(dir, ".env.local");
+  const secretsFile = [setupEnv, initEnv].find((file) => readEnvValue(file, "SECONDLAYER_SECRETS_KEY") !== null) ?? [setupEnv, initEnv].find((file) => existsSync9(file));
+  if (composeOverride) {
+    const composeFile = resolve15(dir, composeOverride);
+    const sibling = resolve15(composeFile, "..", ".env");
+    return {
+      composeFile,
+      envFile: existsSync9(sibling) ? sibling : undefined,
+      secretsFile
+    };
+  }
+  if (existsSync9(setupCompose)) {
+    return {
+      composeFile: setupCompose,
+      envFile: existsSync9(setupEnv) ? setupEnv : undefined,
+      secretsFile
+    };
+  }
+  return { composeFile: resolve15(dir, REPO_COMPOSE), secretsFile };
+}
+function composeDownArgs(plan, layout) {
+  const base2 = uninstallCommand(plan, layout.composeFile);
+  if (!layout.envFile)
+    return base2;
+  const fileFlagEnd = base2.indexOf("-f") + 2;
+  return [
+    ...base2.slice(0, fileFlagEnd),
+    "--env-file",
+    layout.envFile,
+    ...base2.slice(fileFlagEnd)
+  ];
+}
 function registerUninstallCommand(program2) {
-  program2.command("uninstall").description("Stop the stack; the index, chainstate, and keys survive").option("--compose <file>", "compose file to tear down", DEFAULT_COMPOSE).option("--purge", "also destroy the volumes (wipes the index)").option("--yes", "confirm a purge").option("--backup <dir>", "a bundle proving the keys exist elsewhere (required to purge)").option("--apply", "actually run it (default is a dry run)").option("--json", "Output as JSON").action(async (opts) => {
+  program2.command("uninstall").description("Stop the stack; the index, chainstate, and keys survive").option("--compose <file>", `compose file to tear down (default: ./docker-compose.yml from setup, else ${REPO_COMPOSE})`).option("--purge", "also destroy the volumes (wipes the index)").option("--yes", "confirm a purge").option("--backup <dir>", "a bundle proving the keys exist elsewhere (required to purge)").option("--apply", "actually run it (default is a dry run)").option("--json", "Output as JSON").action(async (opts) => {
     const dataDir = process.env.DATA_DIR ?? "./data";
-    const secretsPresent = !!process.env.SECONDLAYER_SECRETS_KEY || existsSync8(resolve13(process.cwd(), ".env.local"));
-    const keysBackedUp = opts.backup ? bundleHasKeys(resolve13(opts.backup)) : false;
+    const layout = resolveUninstallLayout(process.cwd(), opts.compose);
+    const secretsPresent = !!process.env.SECONDLAYER_SECRETS_KEY || !!layout.secretsFile;
+    const keysBackedUp = opts.backup ? bundleHasKeys(resolve15(opts.backup)) : false;
     const decision = planUninstall({
       purge: opts.purge === true,
       confirmed: opts.yes === true,
@@ -41055,16 +41800,30 @@ function registerUninstallCommand(program2) {
       dataDir
     });
     if (!decision.ok) {
-      printError(decision.reason);
+      printError(decision.reason, {
+        hint: layout.secretsFile ? `keys found in ${layout.secretsFile}` : undefined
+      });
       process.exit(UNINSTALL_EXIT.REFUSED);
     }
-    const cmd = uninstallCommand(decision.plan, opts.compose);
+    const cmd = composeDownArgs(decision.plan, layout);
     if (!opts.apply) {
       output({
         json: opts.json,
-        data: { dryRun: true, plan: decision.plan, command: cmd },
+        data: {
+          dryRun: true,
+          plan: decision.plan,
+          command: cmd,
+          composeFile: layout.composeFile,
+          envFile: layout.envFile ?? null,
+          secretsFile: layout.secretsFile ?? null
+        },
         human: () => {
           note("dry run — nothing removed. Pass --apply to proceed.");
+          note(`compose: ${layout.composeFile}`);
+          if (layout.envFile)
+            note(`env: ${layout.envFile}`);
+          if (layout.secretsFile)
+            note(`keys: ${layout.secretsFile}`);
           note(`would run: docker ${cmd.join(" ")}`);
           for (const p2 of decision.plan.preserves) {
             note(`preserved · ${p2.what}: ${p2.detail}`);
@@ -41083,7 +41842,12 @@ function registerUninstallCommand(program2) {
     }
     output({
       json: opts.json,
-      data: { removed: true, plan: decision.plan },
+      data: {
+        removed: true,
+        plan: decision.plan,
+        composeFile: layout.composeFile,
+        envFile: layout.envFile ?? null
+      },
       human: () => {
         success("stack removed");
         for (const w2 of decision.warnings)
@@ -41096,18 +41860,18 @@ function registerUninstallCommand(program2) {
   });
 }
 // src/commands/backup.ts
+init_fs();
 init_output();
-import { createHash as createHash4 } from "node:crypto";
 import {
-  chmodSync,
-  existsSync as existsSync9,
+  chmodSync as chmodSync2,
+  existsSync as existsSync10,
   mkdirSync as mkdirSync6,
-  readFileSync as readFileSync8,
+  readFileSync as readFileSync9,
   statSync as statSync3,
-  writeFileSync as writeFileSync7
+  writeFileSync as writeFileSync8
 } from "node:fs";
-import { join as join18, resolve as resolve14 } from "node:path";
-import { closeDb, getDb as getDb5, sql as sql4 } from "@secondlayer/shared/db";
+import { join as join17, resolve as resolve16 } from "node:path";
+import { closeDb, getDb as getDb5, sql as sql3 } from "@secondlayer/shared/db";
 import {
   decryptBundle,
   encryptBundle,
@@ -41132,12 +41896,9 @@ function readSecretsKey() {
   const key = process.env.SECONDLAYER_SECRETS_KEY?.trim();
   return key ? key : undefined;
 }
-function sha256File(path11) {
-  return createHash4("sha256").update(readFileSync8(path11)).digest("hex");
-}
 async function readScope() {
   const db = getDb5();
-  const bounds = await sql4`SELECT MIN(height)::text AS min, MAX(height)::text AS max FROM blocks WHERE canonical = true`.execute(db);
+  const bounds = await sql3`SELECT MIN(height)::text AS min, MAX(height)::text AS max FROM blocks WHERE canonical = true`.execute(db);
   const row = bounds.rows[0];
   const network = process.env.STACKS_NETWORK ?? "mainnet";
   return {
@@ -41152,9 +41913,73 @@ function requireDatabaseUrl() {
     throw new Error("DATABASE_URL is required");
   return url;
 }
-async function runProcess(cmd, label) {
-  const proc = Bun.spawn(cmd, { stdout: "pipe", stderr: "pipe" });
-  const stderr = await new Response(proc.stderr).text();
+function pgConnection(databaseUrl) {
+  let parsed;
+  try {
+    parsed = new URL(databaseUrl);
+  } catch {
+    return { url: databaseUrl, env: {} };
+  }
+  if (!parsed.password)
+    return { url: databaseUrl, env: {} };
+  const password = decodeURIComponent(parsed.password);
+  parsed.password = "";
+  return { url: parsed.toString(), env: { PGPASSWORD: password } };
+}
+function pgDumpInvocation(databaseUrl, dumpPath) {
+  const conn = pgConnection(databaseUrl);
+  return {
+    cmd: ["pg_dump", "-Fc", "--no-owner", "--no-acl", "-f", dumpPath, conn.url],
+    env: conn.env
+  };
+}
+function pgRestoreInvocation(databaseUrl, dumpPath) {
+  const conn = pgConnection(databaseUrl);
+  return {
+    cmd: [
+      "pg_restore",
+      "--no-owner",
+      "--no-acl",
+      "--clean",
+      "--if-exists",
+      "--single-transaction",
+      "--exit-on-error",
+      "-d",
+      conn.url,
+      dumpPath
+    ],
+    env: conn.env
+  };
+}
+function checkRestoredScope(manifest, restored) {
+  const want = manifest.scope;
+  if (want.to_height === null && restored.toHeight === null) {
+    return { ok: true };
+  }
+  if (restored.toHeight === null) {
+    return {
+      ok: false,
+      reason: `the restore finished but the target holds no canonical blocks; the manifest promised ${want.from_height} through ${want.to_height ?? "?"}`
+    };
+  }
+  if (restored.fromHeight !== want.from_height || want.to_height !== null && restored.toHeight !== want.to_height) {
+    return {
+      ok: false,
+      reason: `the restore finished with blocks ${restored.fromHeight} through ${restored.toHeight}, but the manifest promised ${want.from_height} through ${want.to_height ?? "?"}; the dump does not carry the scope it claims`
+    };
+  }
+  return { ok: true };
+}
+async function runProcess(cmd, label, env2 = {}) {
+  const proc = Bun.spawn(cmd, {
+    stdout: "pipe",
+    stderr: "pipe",
+    env: { ...process.env, ...env2 }
+  });
+  const [stderr] = await Promise.all([
+    new Response(proc.stderr).text(),
+    new Response(proc.stdout).text()
+  ]);
   const code = await proc.exited;
   if (code !== 0) {
     return { ok: false, stderr: `${label} exited ${code}: ${stderr.trim()}` };
@@ -41162,7 +41987,7 @@ async function runProcess(cmd, label) {
   return { ok: true, stderr };
 }
 function attachBackupCommand(cmd) {
-  return cmd.requiredOption("--out <dir>", "directory to write the bundle into").option("--passphrase <passphrase>", "encrypt bundled secrets (or set SECONDLAYER_BACKUP_PASSPHRASE)").option("--no-secrets", "omit keys; the bundle restores data only").option("--json", "Output as JSON").action(async (opts) => {
+  return cmd.requiredOption("--out <dir>", "directory to write the bundle into").option("--passphrase <passphrase>", "encrypt bundled secrets; prefer SECONDLAYER_BACKUP_PASSPHRASE in env, a flag lands in shell history and ps").option("--no-secrets", "omit keys; the bundle restores data only").option("--json", "Output as JSON").action(async (opts) => {
     try {
       await runBackup(opts);
       await closeDb();
@@ -41194,11 +42019,12 @@ async function runBackup(opts) {
     printError(plan.reason);
     process.exit(BACKUP_EXIT.REFUSED);
   }
-  const outDir = resolve14(opts.out);
+  const outDir = resolve16(opts.out);
   mkdirSync6(outDir, { recursive: true });
   console.error("dumping database…");
-  const dumpPath = join18(outDir, DB_FILE);
-  const dump = await runProcess(["pg_dump", "-Fc", "--no-owner", "--no-acl", "-f", dumpPath, databaseUrl], "pg_dump");
+  const dumpPath = join17(outDir, DB_FILE);
+  const dumpCmd = pgDumpInvocation(databaseUrl, dumpPath);
+  const dump = await runProcess(dumpCmd.cmd, "pg_dump", dumpCmd.env);
   if (!dump.ok) {
     printError(dump.stderr);
     process.exit(BACKUP_EXIT.FAILED);
@@ -41207,7 +42033,7 @@ async function runBackup(opts) {
     ...plan.manifest,
     db: {
       file: DB_FILE,
-      sha256: sha256File(dumpPath),
+      sha256: await sha256File(dumpPath),
       bytes: statSync3(dumpPath).size,
       format: "pg_dump-custom"
     }
@@ -41216,16 +42042,16 @@ async function runBackup(opts) {
     const lines2 = SECRET_ENV_KEYS.filter((k2) => process.env[k2]).map((k2) => `${k2}=${process.env[k2]}`);
     const sealed = encryptBundle(lines2.join(`
 `), passphrase);
-    const secretsPath = join18(outDir, SECRETS_FILE);
-    writeFileSync7(secretsPath, sealed);
-    chmodSync(secretsPath, 384);
+    const secretsPath = join17(outDir, SECRETS_FILE);
+    writeFileSync8(secretsPath, sealed);
+    chmodSync2(secretsPath, 384);
     manifest.secrets = {
       file: SECRETS_FILE,
       encrypted: true,
       canary: sealKeyCanary(secretsKey)
     };
   }
-  writeFileSync7(join18(outDir, MANIFEST_FILE), `${JSON.stringify(manifest, null, 2)}
+  writeFileSync8(join17(outDir, MANIFEST_FILE), `${JSON.stringify(manifest, null, 2)}
 `);
   output({
     json: opts.json,
@@ -41242,7 +42068,7 @@ async function runBackup(opts) {
   });
 }
 function attachRestoreCommand(cmd) {
-  return cmd.requiredOption("--from <dir>", "bundle directory to restore from").option("--passphrase <passphrase>", "decrypt bundled secrets (or set SECONDLAYER_BACKUP_PASSPHRASE)").option("--apply", "actually restore (default is a dry run)").option("--force", "restore over a database that already holds chain data").option("--json", "Output as JSON").action(async (opts) => {
+  return cmd.requiredOption("--from <dir>", "bundle directory to restore from").option("--passphrase <passphrase>", "decrypt bundled secrets; prefer SECONDLAYER_BACKUP_PASSPHRASE in env, a flag lands in shell history and ps").option("--apply", "actually restore (default is a dry run)").option("--force", "restore over a database that already holds chain data").option("--json", "Output as JSON").action(async (opts) => {
     try {
       await runRestore(opts);
       await closeDb();
@@ -41254,15 +42080,15 @@ function attachRestoreCommand(cmd) {
 }
 async function runRestore(opts) {
   const databaseUrl = requireDatabaseUrl();
-  const dir = resolve14(opts.from);
-  const manifestPath = join18(dir, MANIFEST_FILE);
-  if (!existsSync9(manifestPath)) {
+  const dir = resolve16(opts.from);
+  const manifestPath = join17(dir, MANIFEST_FILE);
+  if (!existsSync10(manifestPath)) {
     printError(`no ${MANIFEST_FILE} in ${dir}`);
     process.exit(BACKUP_EXIT.REFUSED);
   }
-  const manifest = JSON.parse(readFileSync8(manifestPath, "utf8"));
-  const dumpPath = join18(dir, manifest.db?.file ?? DB_FILE);
-  if (manifest.db && sha256File(dumpPath) !== manifest.db.sha256) {
+  const manifest = JSON.parse(readFileSync9(manifestPath, "utf8"));
+  const dumpPath = join17(dir, manifest.db?.file ?? DB_FILE);
+  if (manifest.db && await sha256File(dumpPath) !== manifest.db.sha256) {
     printError("the database dump does not match the digest in the manifest; this bundle is corrupt or truncated");
     process.exit(BACKUP_EXIT.REFUSED);
   }
@@ -41275,7 +42101,7 @@ async function runRestore(opts) {
       process.exit(BACKUP_EXIT.REFUSED);
     }
     try {
-      const env2 = decryptBundle(readFileSync8(join18(dir, manifest.secrets.file)), passphrase);
+      const env2 = decryptBundle(readFileSync9(join17(dir, manifest.secrets.file)), passphrase);
       bundleKey = env2.split(`
 `).find((l2) => l2.startsWith("SECONDLAYER_SECRETS_KEY="))?.slice("SECONDLAYER_SECRETS_KEY=".length).trim();
     } catch {
@@ -41288,10 +42114,10 @@ async function runRestore(opts) {
     process.exit(BACKUP_EXIT.REFUSED);
   }
   const db = getDb5();
-  const present = await sql4`SELECT to_regclass('public.blocks') IS NOT NULL AS present`.execute(db);
+  const present = await sql3`SELECT to_regclass('public.blocks') IS NOT NULL AS present`.execute(db);
   let targetIsEmpty = true;
   if (present.rows[0]?.present) {
-    const existing = await sql4`SELECT COUNT(*)::text AS count FROM blocks`.execute(db);
+    const existing = await sql3`SELECT COUNT(*)::text AS count FROM blocks`.execute(db);
     targetIsEmpty = (existing.rows[0]?.count ?? "0") === "0";
   }
   const check = precheckRestore({
@@ -41320,20 +42146,18 @@ async function runRestore(opts) {
     return;
   }
   console.error("restoring database…");
-  const restore = await runProcess([
-    "pg_restore",
-    "--no-owner",
-    "--no-acl",
-    "--clean",
-    "--if-exists",
-    "-d",
-    databaseUrl,
-    dumpPath
-  ], "pg_restore");
+  const restoreCmd = pgRestoreInvocation(databaseUrl, dumpPath);
+  const restore = await runProcess(restoreCmd.cmd, "pg_restore", restoreCmd.env);
   if (!restore.ok) {
     printError(restore.stderr);
     process.exit(BACKUP_EXIT.FAILED);
   }
+  const restored = await readScope();
+  const scopeCheck = checkRestoredScope(manifest, restored);
+  if (!scopeCheck.ok) {
+    printError(scopeCheck.reason);
+    process.exit(BACKUP_EXIT.FAILED);
+  }
   output({
     json: opts.json,
     data: { restored: true, manifest },
@@ -41353,19 +42177,26 @@ function registerRestoreCommand(program2) {
   attachRestoreCommand(program2.command("restore").description("Restore an instance from a backup bundle"));
 }
 // src/commands/init.ts
+init_archive_reference();
 init_instance_init();
 init_output();
+init_resolve_auth();
+var DEFAULT_INIT_API_URL = "http://127.0.0.1:3800";
 function registerInitCommand(program2) {
-  program2.command("init").description("Write local env (token, secrets key, webhook signing key). Idempotent.").option("--api-url <url>", "Local API URL", "http://127.0.0.1:3800").option("--force", "Overwrite generated values even if .env.local exists").addHelpText("after", `
---network <mainnet|testnet|devnet> is the top-level global flag (see
-\`secondlayer --help\`) — default mainnet, same as before.
-`).action((opts) => {
-    const network = parseInstanceNetwork(process.env.STACKS_NETWORK ?? "mainnet");
+  program2.command("init").description("Write local env (token, secrets key, webhook signing key). Idempotent.").option("--force", "Overwrite generated values even if .env.local exists").addHelpText("after", `
+--network <mainnet|testnet|devnet> and --api-url <url> are top-level global
+flags (see \`secondlayer --help\`). Defaults: mainnet, http://127.0.0.1:3800.
+`).action(async (opts) => {
+    const network = instanceNetworkFromEnv();
     const existing = opts.force ? {} : loadExistingInstanceEnv(process.cwd());
     const env2 = buildInstanceEnv({
       network,
       existing,
-      apiUrl: opts.apiUrl
+      apiUrl: process.env.SL_API_URL ?? DEFAULT_INIT_API_URL,
+      archivePublicKeyPem: await resolveArchivePublicKey({
+        envPem: process.env.ARCHIVE_SIGNING_PUBLIC_KEY ?? process.env.STREAMS_SIGNING_PUBLIC_KEY,
+        allowHostedApi: !isOssMode()
+      })
     });
     const path11 = writeInstanceEnv(process.cwd(), env2);
     success(`Wrote ${INSTANCE_ENV_FILE}`);
@@ -41387,7 +42218,7 @@ function registerObserverCommand(program2) {
 \`secondlayer --help\`) — default mainnet, same as before.
 `).action((opts) => {
     const mode = parseObserverMode(opts.mode);
-    const network = parseInstanceNetwork(process.env.STACKS_NETWORK ?? "mainnet");
+    const network = instanceNetworkFromEnv();
     const endpoint = opts.endpoint ?? defaultObserverEndpoint(network);
     const recovery = opts.recovery ? parseRecoverySource(opts.recovery) : undefined;
     if (mode === "signer-shared") {
@@ -41403,7 +42234,8 @@ init_output();
 init_instance_init();
 init_oss_compose();
 init_setup_wizard();
-import { confirm as confirm9, input as input4, select as select5 } from "@inquirer/prompts";
+import { resolve as resolvePath3 } from "node:path";
+import { confirm as confirm6, input as input4, select as select5 } from "@inquirer/prompts";
 
 class SetupCancelledError extends Error {
   constructor() {
@@ -41497,7 +42329,7 @@ async function promptSetupConfig(flags) {
     apiPort: flags.apiPort ?? "127.0.0.1:3800",
     indexerPort: "127.0.0.1:3700",
     postgresPort: "127.0.0.1:5432",
-    dir: flags.dir ?? process.cwd(),
+    dir: resolvePath3(flags.dir ?? process.cwd()),
     against: skipBootstrap ? undefined : against,
     skipBootstrap,
     skipVerify: !!flags.skipVerify,
@@ -41513,7 +42345,7 @@ async function promptSetupConfig(flags) {
   console.error(`  api port     ${config.apiPort}`);
   console.error(`  bootstrap    ${config.skipBootstrap ? "skip (sync from genesis)" : config.against}`);
   console.error("");
-  const proceed = await confirm9({ message: "Start setup?", default: true });
+  const proceed = await confirm6({ message: "Start setup?", default: true });
   if (!proceed)
     throw new SetupCancelledError;
   return config;
@@ -41590,7 +42422,7 @@ async function runPromptedInteractive(flags) {
   await executeAndRender(config);
 }
 function registerSetupCommand(program2) {
-  program2.command("setup").description("Guided self-host onboarding: secrets, config, docker, bootstrap, verify — one command").option("--node-mode <mode>", "external, stacks, or full (required)").option("--api-port <spec>", "API publish spec", "127.0.0.1:3800").option("--dir <path>", "Target directory for compose + .env", process.cwd()).option("--against <manifest>", `Archive manifest to bootstrap from (suggested default: ${DEFAULT_ARCHIVE_MANIFEST})`).option("--skip-bootstrap", "Sync from genesis instead of restoring an archive").option("--skip-verify", "Skip the post-bootstrap verify pass").option("--yes", "Non-interactive: skip the TUI, require flags, never prompt").option("--force", "Regenerate secrets even if a .env already exists in --dir").option("--owner <owner>", "ghcr image owner (namespace) to pull from").option("--image-tag <tag>", "Published image tag to run").addHelpText("after", `
+  program2.command("setup").description("Guided self-host onboarding: secrets, config, docker, bootstrap, verify — one command").option("--node-mode <mode>", "external, stacks, or full (required)").option("--api-port <spec>", "API publish spec", "127.0.0.1:3800").option("--dir <path>", "Target directory for compose + .env", ".").option("--against <manifest>", `Archive manifest to bootstrap from (suggested default: ${DEFAULT_ARCHIVE_MANIFEST})`).option("--skip-bootstrap", "Sync from genesis instead of restoring an archive").option("--skip-verify", "Skip the post-bootstrap verify pass").option("--yes", "Non-interactive: skip the TUI, require flags, never prompt").option("--force", "Regenerate secrets even if a .env already exists in --dir").option("--owner <owner>", "ghcr image owner (namespace) to pull from").option("--image-tag <tag>", "Published image tag to run").addHelpText("after", `
 --network <mainnet|testnet|devnet> is the top-level global flag (see
 \`secondlayer --help\`) — required here too, just parsed one level up.
 
@@ -41625,44 +42457,9 @@ decision with no safe default (--network, --node-mode, and --against unless
     }
   });
 }
-// src/commands/start.ts
-init_output();
-import { parseRuntimeConfig } from "@secondlayer/shared/runtime";
-function registerStartCommand(program2) {
-  program2.command("start").description("Validate one-box runtime config and print the compose command").option("--print", "print the compose invocation only").action((opts) => {
-    const parsed = parseRuntimeConfig({
-      NETWORK: process.env.NETWORK ?? process.env.STACKS_NETWORK,
-      DATABASE_URL: process.env.DATABASE_URL,
-      NODE_MODE: process.env.NODE_MODE ?? "external",
-      DATA_DIR: process.env.DATA_DIR ?? "/data",
-      API_PORT: process.env.API_PORT ?? "3800",
-      INDEXER_PORT: process.env.INDEXER_PORT ?? "3700",
-      STACKS_NODE_RPC_URL: process.env.STACKS_NODE_RPC_URL,
-      LISTEN_HOST: process.env.LISTEN_HOST,
-      LOG_LEVEL: process.env.LOG_LEVEL,
-      BITCOIN_RPC_PASSWORD: process.env.BITCOIN_RPC_PASSWORD
-    });
-    if (!parsed.ok) {
-      printError(parsed.errors.join("; "), {
-        hint: "Set NETWORK, DATABASE_URL, and NODE_MODE (external | stacks | full)."
-      });
-      process.exit(1);
-    }
-    const extra = parsed.config.NODE_MODE === "full" ? " --profile full-node" : "";
-    const cmd = `docker compose -f docker/oss/docker-compose.yml${extra} up -d`;
-    if (opts.print) {
-      console.log(cmd);
-      return;
-    }
-    success(`config ok (${parsed.config.NETWORK}, ${parsed.config.NODE_MODE})`);
-    console.log(cmd);
-    note("  console UI (optional): add --profile console, then `secondlayer console`");
-    note("  /extended view (optional): set EXTENDED_VIEW=1, then curl http://127.0.0.1:3999/extended/v1/status");
-  });
-}
 // src/cli.ts
 var { version } = package_default;
-program.name("secondlayer").alias("sl").description("Secondlayer CLI — run a Stacks index on your own hardware").version(version).option("--network <network>", "Override network (local, testnet, mainnet)").option("--api-key <key>", "Instance or archive credential (overrides INSTANCE_TOKEN)").option("--api-url <url>", "API endpoint (overrides SL_API_URL)").showSuggestionAfterError(true).showHelpAfterError("(run `secondlayer --help` to see available commands)");
+program.name("secondlayer").alias("sl").description("Secondlayer CLI — run a Stacks index on your own hardware").version(version).option("--network <network>", "Override network (mainnet, testnet, devnet)").option("--api-key <key>", "Instance or archive credential; prefer INSTANCE_TOKEN in env, a flag lands in shell history and ps").option("--api-url <url>", "API endpoint (overrides SL_API_URL)").showSuggestionAfterError(true).showHelpAfterError("(run `secondlayer --help` to see available commands)");
 program.hook("preAction", (thisCommand) => {
   const { network, apiKey, apiUrl } = thisCommand.opts();
   if (network)
@@ -41678,7 +42475,8 @@ program.addHelpText("after", `
 Quickstart:
   $ secondlayer setup
   $ secondlayer subgraphs create my-watcher --from-contract SP....my-contract
-  $ secondlayer subgraphs deploy subgraphs/my-watcher.ts
+  $ git add subgraphs/my-watcher.ts
+  $ secondlayer subgraphs deploy subgraphs/my-watcher.ts   # or --allow-uncommitted
 
 Manual / scripted setup, one step at a time:
   $ secondlayer init --network mainnet
@@ -41689,7 +42487,6 @@ registerSetupCommand(program);
 registerInitCommand(program);
 registerBootstrapCommand(program);
 registerObserverCommand(program);
-registerStartCommand(program);
 registerConsoleCommand(program);
 registerLoginCommand(program);
 registerLogoutCommand(program);
@@ -41718,5 +42515,5 @@ program.commandsGroup("Archive:");
 registerCreditsCommand(program);
 program.parse();
 
-//# debugId=90E04792038F19D064756E2164756E21
+//# debugId=80EA4C7A072B2FCB64756E2164756E21
 //# sourceMappingURL=cli.js.map