@secondlayer/cli 16.3.1 → 16.4.0

package/dist/cli.js

@@ -2548,144 +2548,6 @@ var init_output = __esm(() => {
   ANSI_ESCAPE_PATTERN = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, "g");
 });
 
-// src/lib/archive-reference.ts
-import { createHash } from "node:crypto";
-import { readFile as readFile2 } from "node:fs/promises";
-import { join as join2, resolve, sep } from "node:path";
-import { parseRetryAfter } from "@secondlayer/sdk";
-import {
-  checkSignature,
-  loadReference,
-  resolveArchivePublicKey
-} from "@secondlayer/shared/archive/reference";
-function assertPathWithinRoot(path, root) {
-  const segments = path.split("/");
-  const leaves = path.startsWith("/") || path.includes("\\") || /^[a-z][a-z0-9+.-]*:/i.test(path) || /[%?#]/.test(path) || segments.some((part) => part === "" || part === "." || part === "..");
-  if (leaves) {
-    throw new Error(`archive path ${path} would leave the archive root`);
-  }
-  if (root !== undefined) {
-    const base = resolve(root);
-    const target = resolve(base, path);
-    if (target !== base && !target.startsWith(base + sep)) {
-      throw new Error(`archive path ${path} would leave the archive root`);
-    }
-  }
-}
-function isTransientCode(code) {
-  return typeof code === "string" && (TRANSIENT_ERROR_CODES.has(code) || code.startsWith("UND_ERR_"));
-}
-function isTransientFetchFailure(err) {
-  if (!(err instanceof Error))
-    return false;
-  if (err.name === "AbortError" || err.name === "TimeoutError")
-    return true;
-  const code = err.code;
-  const causeCode = err.cause?.code;
-  if (isTransientCode(code) || isTransientCode(causeCode))
-    return true;
-  return err.name === "TypeError" && /fetch failed|network|socket|connection|reset|unreachable/i.test(err.message);
-}
-function retryDelayMs(attempt, response) {
-  const retryAfter = response ? parseRetryAfter(response.headers.get("retry-after")) : undefined;
-  if (retryAfter !== undefined) {
-    return Math.min(retryAfter * 1000, RETRY_AFTER_CAP_MS);
-  }
-  return RETRY_BASE_MS * 2 ** (attempt - 1);
-}
-async function fetchWithRetry(url, opts) {
-  const retries = opts.retries ?? PARTITION_FETCH_RETRIES;
-  const fetchImpl = opts.fetchImpl ?? fetch;
-  const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
-  const timeoutMs = opts.timeoutMs ?? PARTITION_FETCH_TIMEOUT_MS;
-  let lastReason = "";
-  for (let attempt = 1;attempt <= retries + 1; attempt++) {
-    let response;
-    try {
-      response = await fetchImpl(url, {
-        signal: AbortSignal.timeout(timeoutMs)
-      });
-    } catch (err) {
-      if (!isTransientFetchFailure(err))
-        throw err;
-      lastReason = err instanceof Error ? err.message : String(err);
-    }
-    if (response) {
-      const retryable = response.status === 429 || response.status >= 500;
-      if (!retryable)
-        return response;
-      lastReason = `${response.status} ${response.statusText}`.trim();
-      await response.body?.cancel().catch(() => {});
-    }
-    if (attempt <= retries) {
-      await sleep(retryDelayMs(attempt, response));
-    }
-  }
-  throw new ArchiveFetchError(`could not fetch ${opts.label} after ${retries + 1} attempts (${lastReason})`, { transient: true, attempts: retries + 1 });
-}
-async function fetchViaGate(gate, partition, retried, fetchOpts) {
-  const url = await gate.getUrl(partition.path, retried ? { forceRefresh: true } : undefined);
-  const response = await fetchWithRetry(url, {
-    ...fetchOpts,
-    label: partition.path
-  });
-  if (response.status === 403 && !retried) {
-    await response.body?.cancel().catch(() => {});
-    return fetchViaGate(gate, partition, true, fetchOpts);
-  }
-  if (!response.ok) {
-    throw new ArchiveFetchError(`could not fetch ${partition.path} (${response.status} ${response.statusText})`, { transient: false, attempts: 1 });
-  }
-  return Buffer.from(await response.arrayBuffer());
-}
-async function fetchVerifiedPartition(reference, partition, gate, fetchOpts) {
-  assertPathWithinRoot(partition.path, reference.isRemote ? undefined : reference.root);
-  let bytes;
-  if (gate) {
-    bytes = await fetchViaGate(gate, partition, false, fetchOpts);
-  } else if (reference.isRemote) {
-    const url = `${reference.root.replace(/\/$/, "")}/${partition.path}`;
-    const response = await fetchWithRetry(url, {
-      ...fetchOpts,
-      label: partition.path
-    });
-    if (!response.ok) {
-      throw new ArchiveFetchError(`could not fetch ${partition.path} (${response.status} ${response.statusText})`, { transient: false, attempts: 1 });
-    }
-    bytes = Buffer.from(await response.arrayBuffer());
-  } else {
-    bytes = await readFile2(join2(reference.root, partition.path));
-  }
-  const digest = createHash("sha256").update(bytes).digest("hex");
-  if (digest !== partition.sha256) {
-    throw new Error(`${partition.path} failed verification: expected ${partition.sha256}, got ${digest}`);
-  }
-  return bytes;
-}
-var ArchiveFetchError, TRANSIENT_ERROR_CODES, PARTITION_FETCH_RETRIES = 3, PARTITION_FETCH_TIMEOUT_MS = 300000, RETRY_BASE_MS = 1000, RETRY_AFTER_CAP_MS = 60000;
-var init_archive_reference = __esm(() => {
-  ArchiveFetchError = class ArchiveFetchError extends Error {
-    transient;
-    attempts;
-    constructor(message, opts) {
-      super(message);
-      this.name = "ArchiveFetchError";
-      this.transient = opts.transient;
-      this.attempts = opts.attempts;
-    }
-  };
-  TRANSIENT_ERROR_CODES = new Set([
-    "ECONNRESET",
-    "ECONNREFUSED",
-    "ECONNABORTED",
-    "ETIMEDOUT",
-    "EAI_AGAIN",
-    "EPIPE",
-    "ENETUNREACH",
-    "EHOSTUNREACH"
-  ]);
-});
-
 // ../../node_modules/fast-glob/out/utils/array.js
 var require_array = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
@@ -202541,155 +202403,6 @@ var init_src = __esm(() => {
   src_default = Postgres;
 });
 
-// src/lib/devnet-compose.ts
-function buildDevnetCompose(opts = {}) {
-  const owner = opts.owner ?? DEFAULT_IMAGE_OWNER;
-  const tag = opts.imageTag ?? DEFAULT_IMAGE_TAG;
-  const apiPort = opts.apiPort ?? 3800;
-  const indexerPort = opts.indexerPort ?? 3700;
-  const apiPublish = `127.0.0.1:${apiPort}`;
-  const apiImage = `ghcr.io/${owner}/secondlayer-api:${tag}`;
-  const indexerImage = `ghcr.io/${owner}/secondlayer-indexer:${tag}`;
-  const dbUrl = "postgres://secondlayer:secondlayer@postgres:5432/secondlayer";
-  const DEV_SECRETS_KEY = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef";
-  return `# Generated by \`secondlayer devnet connect\` — do not edit by hand.
-# Secondlayer app services for local clarinet devnet development.
-name: secondlayer-devnet
-
-services:
-  postgres:
-    image: postgres:17-alpine
-    environment:
-      POSTGRES_USER: secondlayer
-      POSTGRES_PASSWORD: secondlayer
-      POSTGRES_DB: secondlayer
-    volumes:
-      - postgres_data:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U secondlayer"]
-      interval: 5s
-      timeout: 5s
-      retries: 10
-    restart: unless-stopped
-
-  migrate:
-    image: ${apiImage}
-    command: ["bun", "run", "packages/shared/src/db/migrate.ts"]
-    environment:
-      DATABASE_URL: ${dbUrl}
-    depends_on:
-      postgres:
-        condition: service_healthy
-    restart: "no"
-
-  api:
-    image: ${apiImage}
-    environment:
-      INSTANCE_MODE: oss
-      DATABASE_URL: ${dbUrl}
-      PORT: 3800
-      # 0.0.0.0 is forced: a container process that binds loopback is
-      # unreachable through a published port. The real reach is the publish
-      # spec below, handed over verbatim so /v1 reads stay keyless on devnet.
-      LISTEN_HOST: "0.0.0.0"
-      API_PUBLISH_ADDR: "${apiPublish}"
-      # Boot guard reads LISTEN_HOST, so a token is required to start at all.
-      # It gates writes only — reads are open on this loopback publish.
-      INSTANCE_TOKEN: ${DEV_INSTANCE_TOKEN}
-      NODE_ENV: production
-      DATA_DIR: /data
-      # Shared across api + subgraph-processor so the secret the api encrypts
-      # (e.g. a webhook's signing secret) can be decrypted by the emitter.
-      # OSS auto-generates a per-process key when unset — that splits them.
-      # Local-dev fixed value; not a production secret.
-      SECONDLAYER_SECRETS_KEY: ${DEV_SECRETS_KEY}
-    ports:
-      - "${apiPublish}:3800"
-    volumes:
-      - subgraphs_data:/data/subgraphs
-    depends_on:
-      migrate:
-        condition: service_completed_successfully
-      postgres:
-        condition: service_healthy
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:3800/health"]
-      interval: 10s
-      timeout: 3s
-      start_period: 10s
-      retries: 5
-    restart: unless-stopped
-
-  indexer:
-    image: ${indexerImage}
-    environment:
-      DATABASE_URL: ${dbUrl}
-      PORT: 3700
-      NODE_ENV: production
-      # Keep every network key aligned: the indexer writes index_progress under
-      # STACKS_NETWORK, the subgraph processor reads it under NETWORK. If they
-      # differ, catch-up finds no progress row and subgraphs never advance.
-      NETWORKS: testnet
-      STACKS_NETWORK: testnet
-      NETWORK: testnet
-      # Fed by the devnet node's event observer — never reach out to Hiro mainnet.
-      AUTO_BACKFILL_ENABLED: "false"
-      TIP_FOLLOWER_ENABLED: "false"
-    # Deliberately published on every interface, unlike the api: the devnet's
-    # stacks-node runs in its own container and POSTs events to
-    # host.docker.internal:3700, which resolves to the host gateway address,
-    # not 127.0.0.1. A loopback publish here would drop every block.
-    ports:
-      - "${indexerPort}:3700"
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
-    depends_on:
-      migrate:
-        condition: service_completed_successfully
-      postgres:
-        condition: service_healthy
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:3700/health"]
-      interval: 10s
-      timeout: 3s
-      start_period: 10s
-      retries: 5
-    restart: unless-stopped
-
-  subgraph-processor:
-    image: ${apiImage}
-    command: ["bun", "run", "packages/subgraphs/src/service.ts"]
-    environment:
-      DATABASE_URL: ${dbUrl}
-      NODE_ENV: production
-      DATA_DIR: /data
-      # Must match the indexer's network key (see indexer note) — catch-up reads
-      # index_progress under NETWORK.
-      NETWORK: testnet
-      STACKS_NETWORK: testnet
-      # The emitter blocks webhook delivery to private/loopback IPs by default.
-      # On a local devnet you deliver to your own localhost receiver, so allow it.
-      SECONDLAYER_ALLOW_PRIVATE_EGRESS: "true"
-      # Must match the api's key so the emitter can decrypt signing secrets.
-      SECONDLAYER_SECRETS_KEY: ${DEV_SECRETS_KEY}
-    volumes:
-      - subgraphs_data:/data/subgraphs
-    depends_on:
-      migrate:
-        condition: service_completed_successfully
-      postgres:
-        condition: service_healthy
-    healthcheck:
-      disable: true
-    restart: unless-stopped
-
-volumes:
-  postgres_data:
-  subgraphs_data:
-`;
-}
-var DEFAULT_IMAGE_OWNER = "ryanwaits", DEFAULT_IMAGE_TAG = "latest", DEV_INSTANCE_TOKEN = "dev-instance-token";
-
 // src/lib/dev-state.ts
 import { homedir as homedir4 } from "node:os";
 import { join as join13 } from "node:path";
@@ -202722,1555 +202435,6 @@ var init_dev_state = __esm(() => {
   LOGS_DIR = join13(STATE_DIR, "logs");
 });
 
-// src/lib/instance-init.ts
-import { randomBytes as randomBytes3 } from "node:crypto";
-import { existsSync as existsSync9, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "node:fs";
-import { resolve as resolve10 } from "node:path";
-import { ARCHIVE_ROOT_PUBLIC_KEY_PEM } from "@secondlayer/shared/archive/root-key";
-import { generateEd25519KeyPair } from "@secondlayer/shared/crypto/ed25519";
-import { INSTANCE_NETWORKS } from "@secondlayer/shared/db/queries/instance";
-function isHostedAccountKey(value) {
-  return value.startsWith("sk-sl_") || value.startsWith("ss-sl_");
-}
-function parseInstanceNetwork(value) {
-  const network = value.trim().toLowerCase();
-  if (INSTANCE_NETWORKS.includes(network)) {
-    return network;
-  }
-  throw new Error(`network must be mainnet, testnet, or devnet (got ${value})`);
-}
-function instanceNetworkFromEnv(fallback = "mainnet") {
-  const raw = process.env.STACKS_NETWORK ?? fallback;
-  try {
-    return parseInstanceNetwork(raw);
-  } catch (err) {
-    printError(err instanceof Error ? err.message : String(err), {
-      hint: "Pass --network mainnet, --network testnet, or --network devnet."
-    });
-    process.exit(1);
-  }
-}
-function generateInstanceToken() {
-  return randomBytes3(32).toString("hex");
-}
-function generateSecretsKey() {
-  return randomBytes3(32).toString("hex");
-}
-function generateSigningPrivateKey() {
-  return generateEd25519KeyPair().privateKeyPem;
-}
-function escapeEnvValue(value) {
-  if (!/[\s#"']/.test(value) && !value.includes("\\"))
-    return value;
-  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n")}"`;
-}
-function unescapeEnvValue(raw) {
-  let value = raw.trim();
-  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
-    value = value.slice(1, -1);
-  }
-  return value.replace(/\\n/g, `
-`).replace(/\\"/g, '"').replace(/\\\\/g, "\\");
-}
-function readEnvValue(envPath, key) {
-  if (!existsSync9(envPath))
-    return null;
-  const match = readFileSync7(envPath, "utf8").match(new RegExp(`^${key}=(.*)$`, "m"));
-  return match ? unescapeEnvValue(match[1]) : null;
-}
-function buildInstanceEnv(input) {
-  const existingAlias = input.existing?.SL_API_KEY;
-  const aliasIsHex = existingAlias && !existingAlias.startsWith("sk-sl_") && !existingAlias.startsWith("ss-sl_");
-  const token = input.existing?.INSTANCE_TOKEN || (aliasIsHex ? existingAlias : undefined) || generateInstanceToken();
-  const secrets = input.existing?.SECONDLAYER_SECRETS_KEY || generateSecretsKey();
-  const signing = input.existing?.STREAMS_SIGNING_PRIVATE_KEY || input.existing?.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY || generateSigningPrivateKey();
-  const apiUrl = input.existing?.SECONDLAYER_API_URL || input.existing?.SL_API_URL || input.apiUrl || "http://127.0.0.1:3800";
-  const archiveKey = input.existing?.ARCHIVE_SIGNING_PUBLIC_KEY || input.archivePublicKeyPem || ARCHIVE_ROOT_PUBLIC_KEY_PEM;
-  const hostedCandidate = input.existing?.SECONDLAYER_API_KEY || input.existing?.SL_API_KEY || undefined;
-  const hostedKey = hostedCandidate && isHostedAccountKey(hostedCandidate) ? hostedCandidate : undefined;
-  return {
-    INSTANCE_MODE: "oss",
-    STACKS_NETWORK: input.network,
-    INSTANCE_TOKEN: token,
-    SECONDLAYER_SECRETS_KEY: secrets,
-    STREAMS_SIGNING_PRIVATE_KEY: signing,
-    SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY: signing,
-    ALLOW_UNSIGNED_WEBHOOKS: "false",
-    SECONDLAYER_API_URL: apiUrl,
-    SL_API_URL: apiUrl,
-    ...hostedKey ? { SECONDLAYER_API_KEY: hostedKey, SL_API_KEY: hostedKey } : {},
-    ARCHIVE_SIGNING_PUBLIC_KEY: archiveKey
-  };
-}
-function renderInstanceEnv(env) {
-  const lines = [
-    "# Generated by secondlayer init. Do not commit.",
-    `INSTANCE_MODE=${env.INSTANCE_MODE}`,
-    `STACKS_NETWORK=${env.STACKS_NETWORK}`,
-    "# The instance credential. The API validates bearer tokens against it,",
-    "# and the CLI/SDK/MCP read it first when authenticating.",
-    `INSTANCE_TOKEN=${env.INSTANCE_TOKEN}`,
-    `SECONDLAYER_SECRETS_KEY=${env.SECONDLAYER_SECRETS_KEY}`,
-    `STREAMS_SIGNING_PRIVATE_KEY=${escapeEnvValue(env.STREAMS_SIGNING_PRIVATE_KEY)}`,
-    `SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY=${escapeEnvValue(env.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY)}`,
-    `ALLOW_UNSIGNED_WEBHOOKS=${env.ALLOW_UNSIGNED_WEBHOOKS}`,
-    `SECONDLAYER_API_URL=${env.SECONDLAYER_API_URL}`,
-    `SL_API_URL=${env.SL_API_URL}`
-  ];
-  if (env.SECONDLAYER_API_KEY) {
-    lines.push("# Hosted account key for archive credits (sk-sl_*).", `SECONDLAYER_API_KEY=${env.SECONDLAYER_API_KEY}`, `SL_API_KEY=${env.SL_API_KEY ?? env.SECONDLAYER_API_KEY}`);
-  }
-  lines.push("# Archive trust root: bootstrap, verify, and repair check manifests", "# against this key. Replace it to pin a different archive.", `ARCHIVE_SIGNING_PUBLIC_KEY=${escapeEnvValue(env.ARCHIVE_SIGNING_PUBLIC_KEY)}`, "");
-  return lines.join(`
-`);
-}
-function writeInstanceEnv(cwd, env, file = INSTANCE_ENV_FILE) {
-  const path = resolve10(cwd, file);
-  writeFileSync7(path, renderInstanceEnv(env), { mode: 384 });
-  return path;
-}
-function loadExistingInstanceEnv(cwd, file = INSTANCE_ENV_FILE) {
-  const path = resolve10(cwd, file);
-  return {
-    INSTANCE_TOKEN: readEnvValue(path, "INSTANCE_TOKEN"),
-    SECONDLAYER_SECRETS_KEY: readEnvValue(path, "SECONDLAYER_SECRETS_KEY"),
-    STREAMS_SIGNING_PRIVATE_KEY: readEnvValue(path, "STREAMS_SIGNING_PRIVATE_KEY"),
-    SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY: readEnvValue(path, "SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY"),
-    SECONDLAYER_API_URL: readEnvValue(path, "SECONDLAYER_API_URL"),
-    SL_API_URL: readEnvValue(path, "SL_API_URL"),
-    SECONDLAYER_API_KEY: readEnvValue(path, "SECONDLAYER_API_KEY"),
-    SL_API_KEY: readEnvValue(path, "SL_API_KEY"),
-    ARCHIVE_SIGNING_PUBLIC_KEY: readEnvValue(path, "ARCHIVE_SIGNING_PUBLIC_KEY")
-  };
-}
-var INSTANCE_ENV_FILE = ".env.local";
-var init_instance_init = __esm(() => {
-  init_output();
-});
-
-// src/lib/observer-stanza.ts
-function parseObserverMode(value) {
-  const mode = value.trim().toLowerCase();
-  if (OBSERVER_MODES.includes(mode)) {
-    return mode;
-  }
-  throw new UnsupportedObserverError(`observer mode must be indexer or signer-shared (got ${value})`);
-}
-function parseObserverEndpoint(value) {
-  const trimmed = value.trim();
-  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed) || trimmed.startsWith("unix:")) {
-    throw new UnsupportedObserverError(`observer endpoint must be host:port, not a URL (${value})`);
-  }
-  const match = trimmed.match(/^([a-zA-Z0-9._-]+):(\d+)$/);
-  if (!match) {
-    throw new UnsupportedObserverError(`observer endpoint must be host:port (got ${value})`);
-  }
-  const port = Number(match[2]);
-  if (port < 1 || port > 65535) {
-    throw new UnsupportedObserverError(`observer port out of range (${port})`);
-  }
-  return trimmed;
-}
-function validateObserverStanza(input) {
-  const endpoint = parseObserverEndpoint(input.endpoint);
-  const host = endpoint.slice(0, endpoint.lastIndexOf(":"));
-  if (input.network !== "devnet" && LOOPBACK_HOSTS.has(host.toLowerCase())) {
-    throw new UnsupportedObserverError(`loopback observer endpoint is not container-visible on ${input.network}; use a docker DNS name such as indexer:3700`);
-  }
-  return { endpoint };
-}
-function renderObserverStanza(input) {
-  const { endpoint } = validateObserverStanza(input);
-  const indexer = input.mode === "indexer";
-  const timeoutMs = indexer ? 2000 : 500;
-  const disableRetries = !indexer;
-  const comment = indexer ? "# Pure indexer: retry delivery. A slow observer can stall the node." : "# Signer-shared: do not retry. A missed block stays a gap until `secondlayer repair`.";
-  return [
-    comment,
-    "[[events_observer]]",
-    `endpoint = "${endpoint}"`,
-    'events_keys = ["*"]',
-    `timeout_ms = ${timeoutMs}`,
-    `disable_retries = ${disableRetries}`,
-    ""
-  ].join(`
-`);
-}
-function defaultObserverEndpoint(network) {
-  if (network === "devnet")
-    return "127.0.0.1:3700";
-  return "indexer:3700";
-}
-var OBSERVER_MODES, UnsupportedObserverError, LOOPBACK_HOSTS;
-var init_observer_stanza = __esm(() => {
-  OBSERVER_MODES = ["indexer", "signer-shared"];
-  UnsupportedObserverError = class UnsupportedObserverError extends Error {
-    name = "UnsupportedObserverError";
-  };
-  LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "::1"]);
-});
-
-// src/lib/oss-compose.ts
-function buildOssCompose(opts = {}) {
-  const owner = opts.owner ?? DEFAULT_IMAGE_OWNER;
-  const tag = opts.imageTag ?? DEFAULT_IMAGE_TAG;
-  const runtimeImage = `ghcr.io/${owner}/secondlayer-runtime:${tag}`;
-  return `# Generated by \`secondlayer setup\` — do not edit by hand.
-# Mirrors docker/oss/docker-compose.yml; see that file for the source of truth
-# on env vars, profiles, and third-party digest pins. \`secondlayer\` is
-# swapped from a repo build to the published OSS image (no checkout here).
-name: secondlayer
-
-services:
-  postgres:
-    image: postgres:17-alpine@sha256:d4bb0a8c1b7bb2e29f976d099e7bfb9a5d8858cffe9e46b35cd302cd1f1f8168
-    environment:
-      POSTGRES_USER: \${POSTGRES_USER:-secondlayer}
-      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:-secondlayer}
-      POSTGRES_DB: \${POSTGRES_DB:-secondlayer}
-    volumes:
-      - postgres_data:/var/lib/postgresql/data
-    ports:
-      - "\${POSTGRES_PORT:-127.0.0.1:5432}:5432"
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U \${POSTGRES_USER:-secondlayer}"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-    restart: unless-stopped
-
-  secondlayer:
-    image: ${runtimeImage}
-    environment:
-      INSTANCE_MODE: oss
-      NETWORK: \${NETWORK:-\${STACKS_NETWORK:-mainnet}}
-      STACKS_NETWORK: \${STACKS_NETWORK:-mainnet}
-      NODE_MODE: \${NODE_MODE:-external}
-      SECONDLAYER_ALLOW_UNDERSIZED: \${SECONDLAYER_ALLOW_UNDERSIZED:-false}
-      DATABASE_URL: postgres://\${POSTGRES_USER:-secondlayer}:\${POSTGRES_PASSWORD:-secondlayer}@postgres:5432/\${POSTGRES_DB:-secondlayer}
-      DATA_DIR: /data
-      API_PORT: "3800"
-      INDEXER_PORT: "3700"
-      # See docker/oss/docker-compose.yml: API_PORT above is the *container*
-      # port; \${API_PORT} in ports:/here is the *publish spec* from .env.
-      LISTEN_HOST: "0.0.0.0"
-      API_PUBLISH_ADDR: \${API_PORT:-127.0.0.1:3800}
-      INSTANCE_TOKEN: \${INSTANCE_TOKEN:-}
-      SECONDLAYER_SECRETS_KEY: \${SECONDLAYER_SECRETS_KEY:-}
-      STREAMS_SIGNING_PRIVATE_KEY: \${STREAMS_SIGNING_PRIVATE_KEY:-}
-      SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY: \${SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY:-}
-      ALLOW_UNSIGNED_WEBHOOKS: \${ALLOW_UNSIGNED_WEBHOOKS:-false}
-      LOG_LEVEL: \${LOG_LEVEL:-info}
-      NODE_ENV: production
-      STACKS_NODE_RPC_URL: \${STACKS_NODE_RPC_URL:-}
-      OBSERVER_JOURNAL_ENABLED: \${OBSERVER_JOURNAL_ENABLED:-true}
-      STREAMS_API_URL: http://127.0.0.1:3800
-      STREAMS_INTERNAL_API_KEY: \${STREAMS_INTERNAL_API_KEY:-}
-      SBTC_DECODER_ENABLED: \${SBTC_DECODER_ENABLED:-true}
-      POX4_DECODER_ENABLED: \${POX4_DECODER_ENABLED:-true}
-      BNS_DECODER_ENABLED: \${BNS_DECODER_ENABLED:-false}
-      SUBGRAPH_SOURCE: \${SUBGRAPH_SOURCE:-streams-index}
-      SUBGRAPH_INDEX_API_URL: http://127.0.0.1:3800
-      BITCOIN_RPC_PASSWORD: \${BITCOIN_RPC_PASSWORD:-}
-    ports:
-      - "\${API_PORT:-127.0.0.1:3800}:3800"
-      - "\${INDEXER_PORT:-127.0.0.1:3700}:3700"
-    # \`secondlayer observer\`'s default endpoint is \`indexer:3700\` — this
-    # alias is what makes that default actually resolve on this network,
-    # without renaming the service. Mirrors docker/oss/docker-compose.yml.
-    networks:
-      default:
-        aliases:
-          - indexer
-    volumes:
-      - subgraphs_data:/data/subgraphs
-    depends_on:
-      postgres:
-        condition: service_healthy
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:3800/health"]
-      interval: 30s
-      timeout: 5s
-      start_period: 40s
-      retries: 3
-    restart: unless-stopped
-
-  bitcoind:
-    # Digest = kylemanna/bitcoind:latest as published 2026-07-20 — see
-    # docker/oss/docker-compose.yml for why the digest is the real pin here.
-    image: kylemanna/bitcoind:latest@sha256:86bbcaa99bf3bf3d5df7fd6d9217b3a41194db4c4e34385064f2cfc9fa7bdf91
-    volumes:
-      - \${BITCOIN_DATA_DIR:-./data/bitcoin}:/bitcoin/.bitcoin
-    ports:
-      - "127.0.0.1:8332:8332"
-      - "8333:8333"
-    healthcheck:
-      test: ["CMD-SHELL", "bitcoin-cli -rpcuser=\${BITCOIN_RPC_USER:-stacks} -rpcpassword=\${BITCOIN_RPC_PASSWORD:-changeme} getblockchaininfo | grep -q '\\"blocks\\"' && [ $$(bitcoin-cli -rpcuser=\${BITCOIN_RPC_USER:-stacks} -rpcpassword=\${BITCOIN_RPC_PASSWORD:-changeme} getblockcount) -gt 666050 ]"]
-      interval: 60s
-      timeout: 15s
-      start_period: 120s
-      retries: 3
-    restart: unless-stopped
-    deploy:
-      resources:
-        limits:
-          memory: 32G
-    profiles: ["full-node"]
-
-  stacks-node:
-    # Consensus-critical — digest-pinned to 4.0.1. See docker/oss/docker-compose.yml.
-    image: ghcr.io/stacks-network/stacks-core:4.0.1@sha256:ceb768f881ef52a1d2792a2b4a89d81e092b1df11293b04c31ce36613c3f9711
-    volumes:
-      - \${STACKS_DATA_DIR:-./data/stacks}:/stacks-blockchain/data
-      - ./Config.toml:/stacks-blockchain/Config.toml:ro
-    ports:
-      - "20443:20443"
-      - "20444:20444"
-    restart: unless-stopped
-    command: ["stacks-node", "start", "--config", "/stacks-blockchain/Config.toml"]
-    # full-node only — see docker/oss/docker-compose.yml. No standalone
-    # "stacks-node, public Bitcoin" profile: nothing here wires the node at
-    # a real public Bitcoin RPC, so that combination never actually synced.
-    profiles: ["full-node"]
-
-volumes:
-  postgres_data:
-  subgraphs_data:
-`;
-}
-function buildOssStacksConfigToml(opts) {
-  const mode = opts.network === "mainnet" ? "mainnet" : "testnet";
-  return `[node]
-working_dir = "/stacks-blockchain/data"
-rpc_bind = "0.0.0.0:20443"
-p2p_bind = "0.0.0.0:20444"
-seed = ""
-marf_compress = true
-bootstrap_node = "02196f005965cebe6ddc3901b7b1cc1aa7a88f305bb8c5893456b8f9a605923893@seed.mainnet.hiro.so:20444,02539449ad94e6e6392d8c1deb2b4e61f80ae2a18964349bc14336d8b903c46a8c@cet.stacksnodes.org:20444,02ececc8ce79b8adf813f13a0255f8ae58d4357309ba0cedd523d9f1a306fcfb79@sgt.stacksnodes.org:20444,0303144ba518fe7a0fb56a8a7d488f950307a4330f146e1e1458fc63fb33defe96@est.stacksnodes.org:20444"
-
-# Event observer points directly at the bundled indexer service, same docker
-# network. Retries off / low timeout: a stuck indexer must never starve a
-# co-located signer of block_proposal events. See docker/oss/Config.toml.
-[[events_observer]]
-endpoint = "secondlayer:3700"
-events_keys = ["*"]
-timeout_ms = 500
-disable_retries = true
-
-[burnchain]
-chain = "bitcoin"
-mode = "${mode}"
-peer_host = "bitcoind"
-username = "stacks"
-password = "${opts.bitcoinRpcPassword}"
-rpc_port = 8332
-peer_port = 8333
-`;
-}
-function buildOssBitcoinConf(opts) {
-  return `server=1
-txindex=1
-rpcallowip=0.0.0.0/0
-rpcbind=0.0.0.0
-rpcuser=stacks
-rpcpassword=${opts.rpcPassword}
-# Prune: 0 = archive (required for Stacks); set to 550+ only for pruned chains.
-prune=0
-dbcache=4096
-`;
-}
-var init_oss_compose = () => {};
-
-// src/lib/setup-wizard.ts
-import { spawn as spawn3, spawnSync as spawnSync5 } from "node:child_process";
-import { randomBytes as randomBytes4 } from "node:crypto";
-import { existsSync as existsSync12 } from "node:fs";
-import { writeFile as writeFile6 } from "node:fs/promises";
-import { createServer } from "node:net";
-import { join as join17, resolve as resolvePath2 } from "node:path";
-import { closeDb as closeDb2, getRawClientFor } from "@secondlayer/shared/db";
-import { FLOORS, diskFloorGb } from "@secondlayer/shared/runtime";
-function parseSetupNodeMode(value) {
-  const mode = value.trim().toLowerCase();
-  if (SETUP_NODE_MODES.includes(mode)) {
-    return mode;
-  }
-  throw new Error(`node mode must be external, stacks, or full (got ${value})`);
-}
-function resolveNonInteractiveConfig(flags) {
-  if (!flags.network) {
-    throw new MissingSetupFlagError("--network", "Missing --network <mainnet|testnet|devnet>. Non-interactive setup requires it explicitly — there is no safe default.");
-  }
-  if (!flags.nodeMode) {
-    throw new MissingSetupFlagError("--node-mode", "Missing --node-mode <external|stacks|full>. Non-interactive setup requires it explicitly — there is no safe default.");
-  }
-  if (!flags.against && !flags.skipBootstrap) {
-    throw new MissingSetupFlagError("--against", "Missing --against <manifest-url>. Pass an archive manifest to bootstrap from, or --skip-bootstrap to index only what your node sends from now on.");
-  }
-  const network = parseInstanceNetwork(flags.network);
-  const nodeMode = parseSetupNodeMode(flags.nodeMode);
-  const dir = resolvePath2(flags.dir ?? process.cwd());
-  return {
-    network,
-    nodeMode,
-    apiPort: flags.apiPort ?? "127.0.0.1:3800",
-    indexerPort: "127.0.0.1:3700",
-    postgresPort: "127.0.0.1:5432",
-    dir,
-    against: flags.against,
-    skipBootstrap: !!flags.skipBootstrap,
-    skipVerify: !!flags.skipVerify,
-    yes: !!flags.yes,
-    force: !!flags.force,
-    owner: flags.owner ?? DEFAULT_IMAGE_OWNER,
-    imageTag: flags.imageTag ?? DEFAULT_IMAGE_TAG
-  };
-}
-function guardrailPreview(nodeMode, network) {
-  return {
-    ramFloorMb: nodeMode === "full" ? FLOORS.fullRamMb : FLOORS.appRamMb,
-    diskFloorGb: diskFloorGb(nodeMode, network)
-  };
-}
-function isBunRuntime(versions = typeof process !== "undefined" ? process.versions : undefined) {
-  return typeof versions === "object" && versions !== null && typeof versions.bun === "string";
-}
-async function checkDocker() {
-  const probe = spawnSync5("docker", ["info"], { stdio: "ignore" });
-  return !probe.error && probe.status === 0;
-}
-function isPortFree(host, port) {
-  return new Promise((resolvePromise) => {
-    const srv = createServer();
-    srv.once("error", () => resolvePromise(false));
-    srv.once("listening", () => srv.close(() => resolvePromise(true)));
-    srv.listen(port, host);
-  });
-}
-function parsePublishSpec(spec) {
-  const idx = spec.lastIndexOf(":");
-  if (idx === -1)
-    return { host: "127.0.0.1", port: Number(spec) };
-  return { host: spec.slice(0, idx), port: Number(spec.slice(idx + 1)) };
-}
-function dockerPublishedHostPorts() {
-  const probe = spawnSync5("docker", ["ps", "--format", "{{.Ports}}"], {
-    encoding: "utf8"
-  });
-  const ports = new Set;
-  if (probe.error || probe.status !== 0 || !probe.stdout)
-    return ports;
-  for (const match of probe.stdout.matchAll(/:(\d+)->/g)) {
-    ports.add(Number(match[1]));
-  }
-  return ports;
-}
-async function resolveAvailablePublishSpec(spec, claimedByDocker = new Set, maxAttempts = 20) {
-  const { host, port } = parsePublishSpec(spec);
-  for (let attempt = 0;attempt < maxAttempts; attempt++) {
-    const candidate = port + attempt;
-    if (claimedByDocker.has(candidate))
-      continue;
-    if (await isPortFree(host, candidate)) {
-      return { spec: `${host}:${candidate}`, remapped: attempt > 0 };
-    }
-  }
-  return { spec, remapped: false };
-}
-function randomHex(bytes) {
-  return randomBytes4(bytes).toString("hex");
-}
-function resolveSecrets(config) {
-  const envPath = join17(config.dir, ".env");
-  const existing = config.force || !existsSync12(envPath) ? {} : readEnvFile(config.dir, envPath);
-  const instance = buildInstanceEnv({
-    network: config.network,
-    existing: {
-      INSTANCE_TOKEN: existing.INSTANCE_TOKEN,
-      SECONDLAYER_SECRETS_KEY: existing.SECONDLAYER_SECRETS_KEY,
-      STREAMS_SIGNING_PRIVATE_KEY: existing.STREAMS_SIGNING_PRIVATE_KEY,
-      SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY: existing.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY,
-      SECONDLAYER_API_URL: existing.SECONDLAYER_API_URL,
-      SL_API_URL: existing.SL_API_URL,
-      SECONDLAYER_API_KEY: existing.SECONDLAYER_API_KEY,
-      SL_API_KEY: existing.SL_API_KEY,
-      ARCHIVE_SIGNING_PUBLIC_KEY: existing.ARCHIVE_SIGNING_PUBLIC_KEY
-    },
-    apiUrl: `http://${normalizeLoopbackHost(config.apiPort)}`,
-    archivePublicKeyPem: config.archivePublicKeyPem
-  });
-  return {
-    instance,
-    postgresPassword: existing.POSTGRES_PASSWORD || randomHex(24),
-    bitcoinRpcPassword: existing.BITCOIN_RPC_PASSWORD || randomHex(24),
-    databaseUrl: operatorEditedDatabaseUrl(existing)
-  };
-}
-function operatorEditedDatabaseUrl(existing) {
-  const url = existing.DATABASE_URL;
-  if (!url)
-    return;
-  if (existing.POSTGRES_PORT && existing.POSTGRES_PASSWORD) {
-    const generated = setupDatabaseUrl({ postgresPort: existing.POSTGRES_PORT }, { postgresPassword: existing.POSTGRES_PASSWORD });
-    if (url === generated)
-      return;
-  }
-  return url;
-}
-function setupDatabaseUrl(config, secrets) {
-  if (secrets.databaseUrl)
-    return secrets.databaseUrl;
-  const password = encodeURIComponent(secrets.postgresPassword);
-  return `postgres://${SETUP_POSTGRES_USER}:${password}@${normalizeLoopbackHost(config.postgresPort)}/${SETUP_POSTGRES_DB}`;
-}
-function normalizeLoopbackHost(apiPort) {
-  return apiPort.includes(":") ? apiPort : `127.0.0.1:${apiPort}`;
-}
-function readEnvFile(dir, envPath) {
-  const shared = loadExistingInstanceEnv(dir, ".env");
-  return {
-    ...shared,
-    POSTGRES_PASSWORD: readEnvValue(envPath, "POSTGRES_PASSWORD"),
-    POSTGRES_PORT: readEnvValue(envPath, "POSTGRES_PORT"),
-    BITCOIN_RPC_PASSWORD: readEnvValue(envPath, "BITCOIN_RPC_PASSWORD"),
-    DATABASE_URL: readEnvValue(envPath, "DATABASE_URL")
-  };
-}
-function renderSetupEnv(config, secrets) {
-  const i = secrets.instance;
-  const lines = [
-    "# Generated by `secondlayer setup`. Do not commit.",
-    `NETWORK=${config.network}`,
-    `STACKS_NETWORK=${config.network}`,
-    `NODE_MODE=${config.nodeMode}`,
-    `API_PORT=${config.apiPort}`,
-    `INDEXER_PORT=${config.indexerPort}`,
-    `POSTGRES_USER=${SETUP_POSTGRES_USER}`,
-    `POSTGRES_PASSWORD=${secrets.postgresPassword}`,
-    `POSTGRES_DB=${SETUP_POSTGRES_DB}`,
-    `POSTGRES_PORT=${config.postgresPort}`,
-    "# Where bootstrap, verify, repair, and backup connect from this directory:",
-    "# the compose Postgres above, published on the host. Point it elsewhere",
-    "# only if you moved the index.",
-    `DATABASE_URL=${escapeEnvValue(setupDatabaseUrl(config, secrets))}`,
-    "# The instance credential. The API validates bearer tokens against it,",
-    "# and the CLI/SDK/MCP read it first when authenticating.",
-    `INSTANCE_TOKEN=${i.INSTANCE_TOKEN}`,
-    `SECONDLAYER_SECRETS_KEY=${i.SECONDLAYER_SECRETS_KEY}`,
-    `STREAMS_SIGNING_PRIVATE_KEY=${escapeEnvValue(i.STREAMS_SIGNING_PRIVATE_KEY)}`,
-    `SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY=${escapeEnvValue(i.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY)}`,
-    `ALLOW_UNSIGNED_WEBHOOKS=${i.ALLOW_UNSIGNED_WEBHOOKS}`,
-    `SECONDLAYER_API_URL=${i.SECONDLAYER_API_URL}`,
-    `SL_API_URL=${i.SL_API_URL}`
-  ];
-  if (i.SECONDLAYER_API_KEY) {
-    lines.push("# Hosted account key for archive credits (sk-sl_*).", `SECONDLAYER_API_KEY=${i.SECONDLAYER_API_KEY}`, `SL_API_KEY=${i.SL_API_KEY ?? i.SECONDLAYER_API_KEY}`);
-  }
-  lines.push("# Archive trust root: bootstrap, verify, and repair check manifests", "# against this key. Replace it to pin a different archive.", `ARCHIVE_SIGNING_PUBLIC_KEY=${escapeEnvValue(i.ARCHIVE_SIGNING_PUBLIC_KEY)}`);
-  if (config.nodeMode === "full") {
-    lines.push("BITCOIN_RPC_USER=stacks", `BITCOIN_RPC_PASSWORD=${secrets.bitcoinRpcPassword}`);
-  }
-  lines.push("");
-  return lines.join(`
-`);
-}
-async function writeSetupFiles(config, secrets) {
-  const composePath = join17(config.dir, "docker-compose.yml");
-  const envPath = join17(config.dir, ".env");
-  await writeFile6(composePath, buildOssCompose({ owner: config.owner, imageTag: config.imageTag }));
-  await writeFile6(envPath, renderSetupEnv(config, secrets), { mode: 384 });
-  const result = { composePath, envPath };
-  if (config.nodeMode === "full") {
-    const configTomlPath = join17(config.dir, "Config.toml");
-    await writeFile6(configTomlPath, buildOssStacksConfigToml({
-      network: config.network,
-      bitcoinRpcPassword: secrets.bitcoinRpcPassword ?? ""
-    }));
-    result.configTomlPath = configTomlPath;
-  }
-  if (config.nodeMode === "full") {
-    const bitcoinConfPath = join17(config.dir, "bitcoin.conf");
-    await writeFile6(bitcoinConfPath, buildOssBitcoinConf({ rpcPassword: secrets.bitcoinRpcPassword ?? "" }));
-    result.bitcoinConfPath = bitcoinConfPath;
-  }
-  return result;
-}
-function composeProfileArgs(nodeMode) {
-  if (nodeMode === "full")
-    return ["--profile", "full-node"];
-  return [];
-}
-function runStreaming(command, args, opts) {
-  return new Promise((resolvePromise, reject) => {
-    const child = spawn3(command, args, {
-      cwd: opts.cwd,
-      env: opts.env ?? process.env,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    let stdout = "";
-    let stderr = "";
-    const pump = (stream) => (chunk) => {
-      const text = chunk.toString("utf8");
-      if (stream === "stdout")
-        stdout += text;
-      else
-        stderr += text;
-      if (opts.onLine) {
-        for (const line of text.split(`
-`)) {
-          if (line.length > 0)
-            opts.onLine(line, stream);
-        }
-      }
-    };
-    child.stdout?.on("data", pump("stdout"));
-    child.stderr?.on("data", pump("stderr"));
-    child.once("error", reject);
-    child.once("close", (code) => {
-      resolvePromise({ code: code ?? 1, stdout, stderr });
-    });
-  });
-}
-async function dockerComposeUp(config, files, onLine) {
-  const args = [
-    "compose",
-    "-f",
-    files.composePath,
-    "--env-file",
-    files.envPath,
-    ...composeProfileArgs(config.nodeMode),
-    "up",
-    "-d"
-  ];
-  return runStreaming("docker", args, { cwd: config.dir, onLine });
-}
-async function pollHealth(config, opts = {}) {
-  const timeoutMs = opts.timeoutMs ?? 120000;
-  const intervalMs = opts.intervalMs ?? 2000;
-  const url = `http://${normalizeLoopbackHost(config.apiPort)}/health`;
-  const deadline = Date.now() + timeoutMs;
-  for (;; ) {
-    try {
-      const res = await fetch(url, { signal: AbortSignal.timeout(3000) });
-      if (res.ok)
-        return true;
-    } catch {}
-    opts.onTick?.();
-    if (Date.now() >= deadline)
-      return false;
-    await new Promise((r) => setTimeout(r, intervalMs));
-  }
-}
-function getObserverInfo(config) {
-  if (config.nodeMode !== "external") {
-    return { applicable: false };
-  }
-  const endpoint = defaultObserverEndpoint(config.network);
-  const stanza = renderObserverStanza({
-    mode: "indexer",
-    endpoint,
-    network: config.network
-  });
-  return { applicable: true, stanza, endpoint };
-}
-function cliEntry() {
-  const entry = process.argv[1];
-  if (!entry) {
-    throw new Error("Could not resolve the secondlayer CLI entry to shell out to.");
-  }
-  return [process.execPath, entry];
-}
-function buildChildEnv(envPath, base = process.env) {
-  const env = { ...base };
-  for (const key of CHILD_ENV_KEYS) {
-    const value = readEnvValue(envPath, key);
-    if (value)
-      env[key] = value;
-  }
-  return env;
-}
-async function checkDatabaseReachable(databaseUrl) {
-  try {
-    const client = getRawClientFor(databaseUrl);
-    await client`SELECT 1`;
-    return { ok: true };
-  } catch (err) {
-    return {
-      ok: false,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  } finally {
-    await closeDb2().catch(() => {});
-  }
-}
-async function preflightBootstrapDatabase(config, secrets, emit) {
-  const databaseUrl = setupDatabaseUrl(config, secrets);
-  const reachable = await checkDatabaseReachable(databaseUrl);
-  if (!reachable.ok) {
-    emit({
-      type: "step-error",
-      step: "bootstrap",
-      message: `Postgres at ${redactUrl(databaseUrl)} did not answer SELECT 1: ${reachable.error}. Check \`docker compose logs postgres\`, then re-run setup to resume.`
-    });
-    return null;
-  }
-  emit({
-    type: "step-log",
-    step: "bootstrap",
-    line: `database ${redactUrl(databaseUrl)}`
-  });
-  return databaseUrl;
-}
-async function runBootstrap(config, against, files, onLine) {
-  const [command, ...prefix] = cliEntry();
-  const args = [...prefix, "bootstrap", "--against", against, "--yes"];
-  return runStreaming(command, args, {
-    cwd: config.dir,
-    env: buildChildEnv(files.envPath),
-    onLine
-  });
-}
-async function runVerify(config, against, files, onLine) {
-  const [command, ...prefix] = cliEntry();
-  const args = [...prefix, "verify", "all", "--against", against];
-  return runStreaming(command, args, {
-    cwd: config.dir,
-    env: buildChildEnv(files.envPath),
-    onLine
-  });
-}
-function redactUrl(url) {
-  try {
-    const u = new URL(url);
-    if (u.password)
-      u.password = "***";
-    return u.toString();
-  } catch {
-    return url;
-  }
-}
-function buildSuccessSummary(config, secrets) {
-  const apiUrl = `http://${normalizeLoopbackHost(config.apiPort)}`;
-  const lines = [
-    "Secondlayer is up.",
-    "",
-    `  api        ${apiUrl}`,
-    `  network    ${config.network}`,
-    `  node mode  ${config.nodeMode}`,
-    `  dir        ${config.dir}`,
-    "",
-    "Export the instance token for writes (reads on loopback need no credential):",
-    `  export INSTANCE_TOKEN=${secrets.instance.INSTANCE_TOKEN}`,
-    "",
-    "Try it:",
-    "  secondlayer subgraphs create my-balances --from-contract SP....my-contract",
-    "  secondlayer subgraphs deploy subgraphs/my-balances.ts",
-    `  curl ${apiUrl}/v1/subgraphs/my-balances/balances`,
-    "",
-    "Docs: https://secondlayer.tools/docs/self-host"
-  ];
-  return lines.join(`
-`);
-}
-async function runSetup(initialConfig, emit) {
-  let config = initialConfig;
-  emit({ type: "step-start", step: "preflight" });
-  if (!await checkDocker()) {
-    emit({
-      type: "step-error",
-      step: "preflight",
-      message: "Docker isn't reachable. Start Docker Desktop/OrbStack, or install Docker, then re-run."
-    });
-    return { ok: false, config };
-  }
-  const claimedByDocker = dockerPublishedHostPorts();
-  const ports = {
-    api: await resolveAvailablePublishSpec(config.apiPort, claimedByDocker),
-    indexer: await resolveAvailablePublishSpec(config.indexerPort, claimedByDocker),
-    postgres: await resolveAvailablePublishSpec(config.postgresPort, claimedByDocker)
-  };
-  config = {
-    ...config,
-    apiPort: ports.api.spec,
-    indexerPort: ports.indexer.spec,
-    postgresPort: ports.postgres.spec
-  };
-  for (const [label, result] of [
-    ["api", ports.api],
-    ["indexer", ports.indexer],
-    ["postgres", ports.postgres]
-  ]) {
-    if (result.remapped) {
-      emit({
-        type: "step-log",
-        step: "preflight",
-        line: `${label} port was already in use locally, using ${result.spec} instead`
-      });
-    }
-  }
-  const floors = guardrailPreview(config.nodeMode, config.network);
-  emit({
-    type: "step-done",
-    step: "preflight",
-    detail: `NODE_MODE=${config.nodeMode} on ${config.network} needs at least ${floors.ramFloorMb}MB RAM and ${floors.diskFloorGb}GB disk.`
-  });
-  emit({ type: "step-start", step: "secrets" });
-  const secrets = resolveSecrets({
-    dir: config.dir,
-    network: config.network,
-    apiPort: config.apiPort,
-    force: config.force,
-    archivePublicKeyPem: await resolveArchivePublicKey({
-      envPem: process.env.ARCHIVE_SIGNING_PUBLIC_KEY ?? process.env.STREAMS_SIGNING_PUBLIC_KEY,
-      allowHostedApi: !isOssMode()
-    })
-  });
-  emit({ type: "step-done", step: "secrets" });
-  emit({ type: "step-start", step: "config" });
-  const files = await writeSetupFiles(config, secrets);
-  emit({
-    type: "step-done",
-    step: "config",
-    detail: `${files.composePath}, ${files.envPath}`
-  });
-  emit({ type: "step-start", step: "docker-up" });
-  const up = await dockerComposeUp(config, files, (line) => emit({ type: "step-log", step: "docker-up", line }));
-  if (up.code !== 0) {
-    emit({
-      type: "step-error",
-      step: "docker-up",
-      message: `docker compose up failed (exit ${up.code}).
-${up.stderr || up.stdout}`
-    });
-    return { ok: false, config, secrets, files };
-  }
-  const healthy = await pollHealth(config, {
-    onTick: () => emit({
-      type: "step-log",
-      step: "docker-up",
-      line: "waiting for /health…"
-    })
-  });
-  if (!healthy) {
-    emit({
-      type: "step-error",
-      step: "docker-up",
-      message: "Containers started but /health never came up. Check `docker compose logs`."
-    });
-    return { ok: false, config, secrets, files };
-  }
-  emit({ type: "step-done", step: "docker-up" });
-  emit({ type: "step-start", step: "observer" });
-  const observer = getObserverInfo(config);
-  if (observer.applicable && observer.stanza) {
-    emit({
-      type: "step-log",
-      step: "observer",
-      line: "ACTION REQUIRED — paste this into your Stacks node's Config.toml:"
-    });
-    for (const line of observer.stanza.split(`
-`)) {
-      if (line.length > 0)
-        emit({ type: "step-log", step: "observer", line });
-    }
-    emit({
-      type: "step-done",
-      step: "observer",
-      detail: `endpoint ${observer.endpoint} — see the ACTION REQUIRED lines above`
-    });
-  } else {
-    emit({
-      type: "step-done",
-      step: "observer",
-      detail: "bundled node — the observer is pre-configured, nothing to paste"
-    });
-  }
-  let bootstrapped = false;
-  if (config.skipBootstrap) {
-    emit({ type: "step-skip", step: "bootstrap", reason: "--skip-bootstrap" });
-  } else if (config.against) {
-    emit({ type: "step-start", step: "bootstrap" });
-    const databaseUrl = await preflightBootstrapDatabase(config, secrets, emit);
-    if (databaseUrl === null) {
-      return { ok: false, config, secrets, files, observer };
-    }
-    const res = await runBootstrap(config, config.against, files, (line) => emit({ type: "step-log", step: "bootstrap", line }));
-    if (res.code === 0) {
-      bootstrapped = true;
-      emit({ type: "step-done", step: "bootstrap" });
-    } else {
-      emit({
-        type: "step-error",
-        step: "bootstrap",
-        message: `secondlayer bootstrap exited ${res.code}.`
-      });
-    }
-  }
-  if (config.skipVerify) {
-    emit({ type: "step-skip", step: "verify", reason: "--skip-verify" });
-  } else if (!config.against) {
-    emit({
-      type: "step-skip",
-      step: "verify",
-      reason: "no manifest to verify against"
-    });
-  } else if (!bootstrapped) {
-    emit({
-      type: "step-skip",
-      step: "verify",
-      reason: "bootstrap did not run — nothing restored yet to verify"
-    });
-  } else {
-    emit({ type: "step-start", step: "verify" });
-    const res = await runVerify(config, config.against, files, (line) => emit({ type: "step-log", step: "verify", line }));
-    if (res.code === 0) {
-      emit({ type: "step-done", step: "verify" });
-    } else {
-      emit({
-        type: "step-error",
-        step: "verify",
-        message: `secondlayer verify exited ${res.code}.`
-      });
-    }
-  }
-  const summary = buildSuccessSummary(config, secrets);
-  emit({ type: "step-start", step: "summary" });
-  emit({ type: "step-done", step: "summary", detail: summary });
-  return { ok: true, config, secrets, files, observer, summary };
-}
-var SETUP_NODE_MODES, DEFAULT_ARCHIVE_MANIFEST = "https://archive.secondlayer.tools/latest.json", MissingSetupFlagError, SETUP_POSTGRES_USER = "secondlayer", SETUP_POSTGRES_DB = "secondlayer", CHILD_ENV_KEYS;
-var init_setup_wizard = __esm(() => {
-  init_archive_reference();
-  init_instance_init();
-  init_observer_stanza();
-  init_oss_compose();
-  init_resolve_auth();
-  SETUP_NODE_MODES = ["external", "stacks", "full"];
-  MissingSetupFlagError = class MissingSetupFlagError extends Error {
-    flag;
-    constructor(flag, message) {
-      super(message);
-      this.name = "MissingSetupFlagError";
-      this.flag = flag;
-    }
-  };
-  CHILD_ENV_KEYS = [
-    "DATABASE_URL",
-    "ARCHIVE_SIGNING_PUBLIC_KEY",
-    "SL_API_URL",
-    "INSTANCE_TOKEN"
-  ];
-});
-
-// src/lib/setup-tui.tsx
-import { resolve as resolvePath4 } from "node:path";
-import {
-  CliRenderEvents,
-  createCliRenderer
-} from "@opentui/core";
-import { createRoot, useKeyboard, useRenderer } from "@opentui/react";
-import { createContext, useContext, useEffect, useRef, useState } from "react";
-import { jsxDEV } from "@opentui/react/jsx-dev-runtime";
-function useTerminalThemeMode() {
-  const renderer = useRenderer();
-  const [mode, setMode] = useState(renderer.themeMode ?? "dark");
-  useEffect(() => {
-    let cancelled = false;
-    renderer.waitForThemeMode(500).then((resolved) => {
-      if (!cancelled && resolved)
-        setMode(resolved);
-    });
-    const onThemeMode = (next) => setMode(next);
-    renderer.on(CliRenderEvents.THEME_MODE, onThemeMode);
-    return () => {
-      cancelled = true;
-      renderer.off(CliRenderEvents.THEME_MODE, onThemeMode);
-    };
-  }, [renderer]);
-  return mode;
-}
-function formatFloor(f) {
-  return `needs ≥ ${(f.ramFloorMb / 1024).toFixed(0)}GB RAM, ≥ ${f.diskFloorGb}GB disk`;
-}
-function useSpinner(active) {
-  const [frame, setFrame] = useState(0);
-  useEffect(() => {
-    if (!active)
-      return;
-    const id = setInterval(() => setFrame((f) => (f + 1) % SPINNER_FRAMES.length), 80);
-    return () => clearInterval(id);
-  }, [active]);
-  return SPINNER_FRAMES[frame];
-}
-function App({ flags }) {
-  const renderer = useRenderer();
-  const themeMode = useTerminalThemeMode();
-  const colors = themeMode === "light" ? LIGHT_COLORS : DARK_COLORS;
-  const [stage, setStage] = useState("welcome");
-  const [network, setNetwork] = useState(safeParseNetwork(flags.network));
-  const [nodeMode, setNodeMode] = useState(safeParseNodeMode(flags.nodeMode));
-  const [preview, setPreview] = useState(guardrailPreview(NODE_MODE_OPTIONS[0].value, "mainnet"));
-  const [against, setAgainst] = useState(flags.against);
-  const [skipBootstrap, setSkipBootstrap] = useState(!!flags.skipBootstrap);
-  const [events, setEvents] = useState([]);
-  const [log, setLog] = useState([]);
-  const [fatal, setFatal] = useState(null);
-  const [summary, setSummary] = useState(null);
-  const started = useRef(false);
-  function exit(code) {
-    renderer.destroy();
-    process.exit(code);
-  }
-  useKeyboard((key) => {
-    if (key.eventType === "release")
-      return;
-    if ((stage === "done" || stage === "error") && (key.name === "q" || key.name === "return")) {
-      exit(fatal ? 1 : 0);
-      return;
-    }
-    if (stage === "welcome" && (key.name === "return" || key.name === "space")) {
-      advanceFromWelcome();
-      return;
-    }
-    if (stage === "welcome" && key.name === "q") {
-      exit(0);
-    }
-  });
-  function advanceFromWelcome() {
-    if (!network) {
-      setStage("network");
-    } else if (!nodeMode) {
-      setStage("nodeMode");
-    } else if (!against && !skipBootstrap) {
-      setStage("manifestChoice");
-    } else {
-      setStage("confirm");
-    }
-  }
-  function afterNetwork(net) {
-    setNetwork(net);
-    if (!nodeMode)
-      setStage("nodeMode");
-    else if (!against && !skipBootstrap)
-      setStage("manifestChoice");
-    else
-      setStage("confirm");
-  }
-  function afterNodeMode(mode) {
-    setNodeMode(mode);
-    if (!against && !skipBootstrap)
-      setStage("manifestChoice");
-    else
-      setStage("confirm");
-  }
-  const config = network && nodeMode ? {
-    network,
-    nodeMode,
-    apiPort: flags.apiPort ?? "127.0.0.1:3800",
-    indexerPort: "127.0.0.1:3700",
-    postgresPort: "127.0.0.1:5432",
-    dir: resolvePath4(flags.dir ?? process.cwd()),
-    against: skipBootstrap ? undefined : against,
-    skipBootstrap,
-    skipVerify: !!flags.skipVerify,
-    yes: false,
-    force: !!flags.force,
-    owner: flags.owner ?? DEFAULT_IMAGE_OWNER,
-    imageTag: flags.imageTag ?? DEFAULT_IMAGE_TAG
-  } : null;
-  useEffect(() => {
-    if (stage !== "running" || started.current || !config)
-      return;
-    started.current = true;
-    let failed = false;
-    runSetup(config, (event) => {
-      setEvents((prev) => [...prev, event]);
-      if (event.type === "step-log") {
-        setLog((prev) => [...prev.slice(-40), event.line]);
-      }
-      if (event.type === "step-error") {
-        failed = true;
-        setLog((prev) => [...prev.slice(-40), `ERROR: ${event.message}`]);
-      }
-    }).then((result) => {
-      if (!result.ok) {
-        setFatal("Setup could not finish — see the log above.");
-        setStage("error");
-        return;
-      }
-      setSummary(result.summary ?? null);
-      setStage(failed ? "error" : "done");
-      if (failed)
-        setFatal("Setup finished but at least one step reported an error.");
-    }).catch((err) => {
-      setFatal(err instanceof Error ? err.message : String(err));
-      setStage("error");
-    });
-  }, [stage, config]);
-  return /* @__PURE__ */ jsxDEV(ColorsContext.Provider, {
-    value: colors,
-    children: /* @__PURE__ */ jsxDEV("box", {
-      style: {
-        border: true,
-        borderStyle: "single",
-        borderColor: colors.borderIdle,
-        backgroundColor: colors.bg,
-        padding: 1
-      },
-      title: "secondlayer setup",
-      children: /* @__PURE__ */ jsxDEV("box", {
-        style: { flexDirection: "column" },
-        children: [
-          stage === "welcome" && /* @__PURE__ */ jsxDEV(Welcome, {}, undefined, false, undefined, this),
-          stage === "network" && /* @__PURE__ */ jsxDEV(Picker, {
-            title: "Network",
-            options: NETWORK_OPTIONS,
-            onSelect: (value) => afterNetwork(parseInstanceNetwork(value))
-          }, undefined, false, undefined, this),
-          stage === "nodeMode" && /* @__PURE__ */ jsxDEV(Picker, {
-            title: "Node mode",
-            options: NODE_MODE_OPTIONS,
-            subtitle: formatFloor(preview),
-            onChange: (value) => setPreview(guardrailPreview(parseSetupNodeMode(value), network ?? "mainnet")),
-            onSelect: (value) => afterNodeMode(parseSetupNodeMode(value))
-          }, undefined, false, undefined, this),
-          stage === "manifestChoice" && /* @__PURE__ */ jsxDEV(Picker, {
-            title: "Bootstrap from",
-            options: [
-              {
-                name: "Hosted archive (recommended)",
-                description: DEFAULT_ARCHIVE_MANIFEST,
-                value: "hosted"
-              },
-              {
-                name: "Custom manifest URL or path",
-                description: "Enter your own",
-                value: "custom"
-              },
-              {
-                name: "Sync from genesis",
-                description: "Skip bootstrap — slower, no download",
-                value: "skip"
-              }
-            ],
-            onSelect: (value) => {
-              if (value === "hosted") {
-                setAgainst(DEFAULT_ARCHIVE_MANIFEST);
-                setStage("confirm");
-              } else if (value === "skip") {
-                setSkipBootstrap(true);
-                setStage("confirm");
-              } else {
-                setStage("manifestInput");
-              }
-            }
-          }, undefined, false, undefined, this),
-          stage === "manifestInput" && /* @__PURE__ */ jsxDEV(ManifestInput, {
-            onSubmit: (value) => {
-              setAgainst(value.trim() || DEFAULT_ARCHIVE_MANIFEST);
-              setStage("confirm");
-            }
-          }, undefined, false, undefined, this),
-          stage === "confirm" && config && /* @__PURE__ */ jsxDEV(Confirm, {
-            config,
-            onConfirm: () => setStage("running")
-          }, undefined, false, undefined, this),
-          stage === "running" && /* @__PURE__ */ jsxDEV(RunningView, {
-            events,
-            log
-          }, undefined, false, undefined, this),
-          stage === "done" && summary && /* @__PURE__ */ jsxDEV(Done, {
-            summary
-          }, undefined, false, undefined, this),
-          stage === "error" && /* @__PURE__ */ jsxDEV(ErrorView, {
-            message: fatal ?? "Setup failed.",
-            log
-          }, undefined, false, undefined, this)
-        ]
-      }, undefined, true, undefined, this)
-    }, undefined, false, undefined, this)
-  }, undefined, false, undefined, this);
-}
-function safeParseNetwork(value) {
-  if (!value)
-    return;
-  try {
-    return parseInstanceNetwork(value);
-  } catch {
-    return;
-  }
-}
-function safeParseNodeMode(value) {
-  if (!value)
-    return;
-  try {
-    return parseSetupNodeMode(value);
-  } catch {
-    return;
-  }
-}
-function Welcome() {
-  const colors = useContext(ColorsContext);
-  return /* @__PURE__ */ jsxDEV("box", {
-    style: { flexDirection: "column" },
-    children: [
-      /* @__PURE__ */ jsxDEV("text", {
-        fg: colors.bright,
-        children: "Guided self-host setup."
-      }, undefined, false, undefined, this),
-      /* @__PURE__ */ jsxDEV("text", {
-        fg: colors.muted,
-        children: [
-          `
-`,
-          "This writes secrets, a docker-compose file, and .env into a target directory, brings the stack up, and (optionally) restores verified history from the archive.",
-          `
-
-`,
-          "Press Enter to begin, or q to quit."
-        ]
-      }, undefined, true, undefined, this)
-    ]
-  }, undefined, true, undefined, this);
-}
-function Picker({
-  title,
-  subtitle,
-  options,
-  onChange,
-  onSelect
-}) {
-  const colors = useContext(ColorsContext);
-  return /* @__PURE__ */ jsxDEV("box", {
-    style: { flexDirection: "column" },
-    children: [
-      /* @__PURE__ */ jsxDEV("text", {
-        fg: colors.bright,
-        children: title
-      }, undefined, false, undefined, this),
-      subtitle && /* @__PURE__ */ jsxDEV("text", {
-        fg: colors.accent,
-        children: subtitle
-      }, undefined, false, undefined, this),
-      /* @__PURE__ */ jsxDEV("select", {
-        style: { height: options.length * 2 + 1 },
-        options,
-        focused: true,
-        showDescription: true,
-        backgroundColor: "transparent",
-        textColor: colors.fg,
-        focusedBackgroundColor: colors.raise,
-        focusedTextColor: colors.bright,
-        selectedBackgroundColor: colors.raise,
-        selectedTextColor: colors.accent,
-        descriptionColor: colors.muted,
-        selectedDescriptionColor: colors.fg,
-        onChange: (_index, option) => {
-          if (option)
-            onChange?.(String(option.value));
-        },
-        onSelect: (_index, option) => {
-          if (option)
-            onSelect(String(option.value));
-        }
-      }, undefined, false, undefined, this),
-      /* @__PURE__ */ jsxDEV("text", {
-        fg: colors.muted,
-        children: [
-          `
-`,
-          "↑↓ to move, enter to choose"
-        ]
-      }, undefined, true, undefined, this)
-    ]
-  }, undefined, true, undefined, this);
-}
-function ManifestInput({ onSubmit }) {
-  const colors = useContext(ColorsContext);
-  return /* @__PURE__ */ jsxDEV("box", {
-    style: { flexDirection: "column" },
-    children: [
-      /* @__PURE__ */ jsxDEV("text", {
-        fg: colors.bright,
-        children: "Manifest URL or local path"
-      }, undefined, false, undefined, this),
-      /* @__PURE__ */ jsxDEV("text", {
-        fg: colors.muted,
-        children: [
-          "Suggested: ",
-          DEFAULT_ARCHIVE_MANIFEST
-        ]
-      }, undefined, true, undefined, this),
-      /* @__PURE__ */ jsxDEV("input", {
-        focused: true,
-        placeholder: DEFAULT_ARCHIVE_MANIFEST,
-        textColor: colors.fg,
-        focusedTextColor: colors.accent,
-        placeholderColor: colors.muted,
-        onSubmit: (value) => onSubmit(String(value ?? ""))
-      }, undefined, false, undefined, this),
-      /* @__PURE__ */ jsxDEV("text", {
-        fg: colors.muted,
-        children: [
-          `
-`,
-          "enter to accept (blank = suggested default)"
-        ]
-      }, undefined, true, undefined, this)
-    ]
-  }, undefined, true, undefined, this);
-}
-function Confirm({
-  config,
-  onConfirm
-}) {
-  const colors = useContext(ColorsContext);
-  useKeyboard((key) => {
-    if (key.eventType === "release")
-      return;
-    if (key.name === "return")
-      onConfirm();
-  });
-  return /* @__PURE__ */ jsxDEV("box", {
-    style: { flexDirection: "column" },
-    children: [
-      /* @__PURE__ */ jsxDEV("text", {
-        fg: colors.bright,
-        children: "Ready"
-      }, undefined, false, undefined, this),
-      /* @__PURE__ */ jsxDEV("text", {
-        fg: colors.fg,
-        children: [
-          `
-`,
-          "network ",
-          config.network,
-          `
-`,
-          "node mode ",
-          config.nodeMode,
-          `
-`,
-          "dir ",
-          config.dir,
-          `
-`,
-          "api port ",
-          config.apiPort,
-          `
-`,
-          "bootstrap",
-          " ",
-          config.skipBootstrap ? "skip (sync from genesis)" : config.against,
-          `
-`,
-          "image ghcr.io/",
-          config.owner,
-          "/secondlayer-runtime:",
-          config.imageTag
-        ]
-      }, undefined, true, undefined, this),
-      /* @__PURE__ */ jsxDEV("text", {
-        fg: colors.accent,
-        children: [
-          `
-`,
-          "Press Enter to start."
-        ]
-      }, undefined, true, undefined, this)
-    ]
-  }, undefined, true, undefined, this);
-}
-function RunningView({ events, log }) {
-  const colors = useContext(ColorsContext);
-  const latestByStep = new Map;
-  for (const e of events)
-    latestByStep.set(e.step, e);
-  const anyActive = STEP_ORDER.some((step) => latestByStep.get(step)?.type === "step-start");
-  const spinner = useSpinner(anyActive);
-  return /* @__PURE__ */ jsxDEV("box", {
-    style: { flexDirection: "column" },
-    children: [
-      STEP_ORDER.map((step) => {
-        const e = latestByStep.get(step);
-        const active = e?.type === "step-start";
-        const symbol = !e ? "·" : active ? spinner : e.type === "step-done" ? "✓" : e.type === "step-skip" ? "–" : e.type === "step-error" ? "✗" : " ";
-        const color = active ? colors.accent : e?.type === "step-done" ? colors.success : e?.type === "step-error" ? colors.error : e?.type === "step-skip" ? colors.muted : colors.muted;
-        return /* @__PURE__ */ jsxDEV("text", {
-          fg: color,
-          children: [
-            symbol,
-            " ",
-            STEP_LABEL[step]
-          ]
-        }, step, true, undefined, this);
-      }),
-      /* @__PURE__ */ jsxDEV("box", {
-        style: {
-          border: true,
-          borderStyle: "single",
-          borderColor: colors.borderIdle,
-          marginTop: 1,
-          height: 10
-        },
-        title: "log",
-        children: /* @__PURE__ */ jsxDEV("box", {
-          style: { flexDirection: "column", padding: 1 },
-          children: log.length === 0 ? /* @__PURE__ */ jsxDEV("text", {
-            fg: colors.muted,
-            children: "waiting…"
-          }, undefined, false, undefined, this) : log.map((line, i) => /* @__PURE__ */ jsxDEV("text", {
-            fg: line.startsWith("ERROR:") ? colors.error : colors.fg,
-            children: line
-          }, `${i}:${line}`, false, undefined, this))
-        }, undefined, false, undefined, this)
-      }, undefined, false, undefined, this)
-    ]
-  }, undefined, true, undefined, this);
-}
-function Done({ summary }) {
-  const colors = useContext(ColorsContext);
-  return /* @__PURE__ */ jsxDEV("box", {
-    style: { flexDirection: "column" },
-    children: [
-      /* @__PURE__ */ jsxDEV("box", {
-        style: { backgroundColor: colors.successBg, padding: 1 },
-        children: /* @__PURE__ */ jsxDEV("text", {
-          fg: colors.success,
-          children: summary
-        }, undefined, false, undefined, this)
-      }, undefined, false, undefined, this),
-      /* @__PURE__ */ jsxDEV("text", {
-        fg: colors.muted,
-        children: [
-          `
-`,
-          "press enter or q to exit"
-        ]
-      }, undefined, true, undefined, this)
-    ]
-  }, undefined, true, undefined, this);
-}
-function ErrorView({ message, log }) {
-  const colors = useContext(ColorsContext);
-  return /* @__PURE__ */ jsxDEV("box", {
-    style: { flexDirection: "column" },
-    children: [
-      /* @__PURE__ */ jsxDEV("box", {
-        style: { backgroundColor: colors.errorBg, padding: 1 },
-        children: /* @__PURE__ */ jsxDEV("text", {
-          fg: colors.error,
-          children: message
-        }, undefined, false, undefined, this)
-      }, undefined, false, undefined, this),
-      log.slice(-10).map((line, i) => /* @__PURE__ */ jsxDEV("text", {
-        fg: colors.muted,
-        children: line
-      }, `${i}:${line}`, false, undefined, this)),
-      /* @__PURE__ */ jsxDEV("text", {
-        fg: colors.muted,
-        children: [
-          `
-`,
-          "press enter or q to exit"
-        ]
-      }, undefined, true, undefined, this)
-    ]
-  }, undefined, true, undefined, this);
-}
-async function runSetupTui(flags) {
-  const renderer = await createCliRenderer({ exitOnCtrlC: true });
-  createRoot(renderer).render(/* @__PURE__ */ jsxDEV(App, {
-    flags
-  }, undefined, false, undefined, this));
-  return new Promise((resolve, reject) => {
-    let settled = false;
-    const onDestroy = () => {
-      if (settled)
-        return;
-      settled = true;
-      resolve();
-    };
-    const onError = (event) => {
-      if (settled)
-        return;
-      settled = true;
-      try {
-        renderer.destroy();
-      } catch {}
-      reject(event.error ?? new Error("OpenTUI renderer error"));
-    };
-    renderer.once(CliRenderEvents.DESTROY, onDestroy);
-    renderer.once(CliRenderEvents.RENDER_ERROR, onError);
-    renderer.once(CliRenderEvents.HANDLER_ERROR, onError);
-  });
-}
-var DARK_COLORS, LIGHT_COLORS, ColorsContext, NETWORK_OPTIONS, NODE_MODE_OPTIONS, SPINNER_FRAMES, STEP_LABEL, STEP_ORDER;
-var init_setup_tui = __esm(() => {
-  init_instance_init();
-  init_oss_compose();
-  init_setup_wizard();
-  DARK_COLORS = {
-    bg: "#151515",
-    raise: "#202020",
-    fg: "#d7d1c9",
-    muted: "#8d867e",
-    bright: "#f2ede5",
-    accent: "#29c6be",
-    success: "#22c55e",
-    warning: "#eab308",
-    error: "#ef4444",
-    borderIdle: "#FFFFFF14",
-    successBg: "#22c55e14",
-    errorBg: "#ef444414"
-  };
-  LIGHT_COLORS = {
-    bg: "#ffffff",
-    raise: "#f8f6f2",
-    fg: "#1f2228",
-    muted: "#7d8288",
-    bright: "#0a0a0a",
-    accent: "#29c6be",
-    success: "#22c55e",
-    warning: "#eab308",
-    error: "#ef4444",
-    borderIdle: "#0A0A0A14",
-    successBg: "#22c55e14",
-    errorBg: "#ef444414"
-  };
-  ColorsContext = createContext(DARK_COLORS);
-  NETWORK_OPTIONS = [
-    {
-      name: "mainnet",
-      description: "Production Stacks chain. Large: plan for hundreds of GB.",
-      value: "mainnet"
-    },
-    {
-      name: "testnet",
-      description: "Stacks testnet. Small history.",
-      value: "testnet"
-    },
-    { name: "devnet", description: "Local Clarinet devnet.", value: "devnet" }
-  ];
-  NODE_MODE_OPTIONS = SETUP_NODE_MODES.map((mode) => ({
-    name: mode,
-    description: mode === "external" ? "You run the Stacks node; paste an observer stanza into its Config.toml." : mode === "stacks" ? "You run the Stacks node yourself, no bundled bitcoind (same as external — no bundled-stacks-only profile exists)." : "Bundled Stacks node + bitcoind.",
-    value: mode
-  }));
-  SPINNER_FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
-  STEP_LABEL = {
-    preflight: "Preflight",
-    secrets: "Secrets",
-    config: "Write config",
-    "docker-up": "docker compose up",
-    observer: "Observer stanza",
-    bootstrap: "Bootstrap",
-    verify: "Verify",
-    summary: "Summary"
-  };
-  STEP_ORDER = Object.keys(STEP_LABEL);
-});
-
 // ../../node_modules/commander/index.js
 var exports_commander = {};
 __exportCjs(exports_commander, {
@@ -204332,7 +202496,7 @@ var {
 // package.json
 var package_default = {
   name: "@secondlayer/cli",
-  version: "16.3.1",
+  version: "16.4.0",
   description: "Run a Stacks index on your own hardware — set it up, restore verified history, and keep it current.",
   repository: {
     type: "git",
@@ -204369,8 +202533,6 @@ var package_default = {
     "@biomejs/wasm-nodejs": "^1.9.0",
     "@dsnp/parquetjs": "~1.8.8",
     "@inquirer/prompts": "^8.2.0",
-    "@opentui/core": "^0.5.3",
-    "@opentui/react": "^0.5.3",
     "@secondlayer/bundler": "^0.6.1",
     "@secondlayer/scaffold": "^1.6.1",
     "@secondlayer/sdk": "^11.0.0",
@@ -204378,7 +202540,6 @@ var package_default = {
     "@secondlayer/stacks": "^6.1.0",
     "@secondlayer/subgraphs": "^6.1.0",
     esbuild: "^0.28.2",
-    react: "^19.1.0",
     "smol-toml": "^1.8.0",
     zod: "^4.3.6"
   },
@@ -204394,7 +202555,6 @@ var package_default = {
     "@antfu/ni": "^24.4.0",
     "@stacks/clarinet-sdk": "3.21.1",
     "@types/bun": "^1.1.14",
-    "@types/react": "^19.1.5",
     chalk: "^5.3.0",
     commander: "^14.0.0",
     execa: "^9.5.3",
@@ -204553,7 +202713,146 @@ import {
 } from "@secondlayer/shared/archive/range-digest";
 import { getDb, getRawClient, sql } from "@secondlayer/shared/db";
 import { upsertSyncScope } from "@secondlayer/shared/db/queries/sync-scope";
-init_archive_reference();
+
+// src/lib/archive-reference.ts
+import { createHash } from "node:crypto";
+import { readFile as readFile2 } from "node:fs/promises";
+import { join as join2, resolve, sep } from "node:path";
+import { parseRetryAfter } from "@secondlayer/sdk";
+import {
+  checkSignature,
+  loadReference,
+  resolveArchivePublicKey
+} from "@secondlayer/shared/archive/reference";
+function assertPathWithinRoot(path, root) {
+  const segments = path.split("/");
+  const leaves = path.startsWith("/") || path.includes("\\") || /^[a-z][a-z0-9+.-]*:/i.test(path) || /[%?#]/.test(path) || segments.some((part) => part === "" || part === "." || part === "..");
+  if (leaves) {
+    throw new Error(`archive path ${path} would leave the archive root`);
+  }
+  if (root !== undefined) {
+    const base = resolve(root);
+    const target = resolve(base, path);
+    if (target !== base && !target.startsWith(base + sep)) {
+      throw new Error(`archive path ${path} would leave the archive root`);
+    }
+  }
+}
+
+class ArchiveFetchError extends Error {
+  transient;
+  attempts;
+  constructor(message, opts) {
+    super(message);
+    this.name = "ArchiveFetchError";
+    this.transient = opts.transient;
+    this.attempts = opts.attempts;
+  }
+}
+var TRANSIENT_ERROR_CODES = new Set([
+  "ECONNRESET",
+  "ECONNREFUSED",
+  "ECONNABORTED",
+  "ETIMEDOUT",
+  "EAI_AGAIN",
+  "EPIPE",
+  "ENETUNREACH",
+  "EHOSTUNREACH"
+]);
+function isTransientCode(code) {
+  return typeof code === "string" && (TRANSIENT_ERROR_CODES.has(code) || code.startsWith("UND_ERR_"));
+}
+function isTransientFetchFailure(err) {
+  if (!(err instanceof Error))
+    return false;
+  if (err.name === "AbortError" || err.name === "TimeoutError")
+    return true;
+  const code = err.code;
+  const causeCode = err.cause?.code;
+  if (isTransientCode(code) || isTransientCode(causeCode))
+    return true;
+  return err.name === "TypeError" && /fetch failed|network|socket|connection|reset|unreachable/i.test(err.message);
+}
+var PARTITION_FETCH_RETRIES = 3;
+var PARTITION_FETCH_TIMEOUT_MS = 300000;
+var RETRY_BASE_MS = 1000;
+var RETRY_AFTER_CAP_MS = 60000;
+function retryDelayMs(attempt, response) {
+  const retryAfter = response ? parseRetryAfter(response.headers.get("retry-after")) : undefined;
+  if (retryAfter !== undefined) {
+    return Math.min(retryAfter * 1000, RETRY_AFTER_CAP_MS);
+  }
+  return RETRY_BASE_MS * 2 ** (attempt - 1);
+}
+async function fetchWithRetry(url, opts) {
+  const retries = opts.retries ?? PARTITION_FETCH_RETRIES;
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const timeoutMs = opts.timeoutMs ?? PARTITION_FETCH_TIMEOUT_MS;
+  let lastReason = "";
+  for (let attempt = 1;attempt <= retries + 1; attempt++) {
+    let response;
+    try {
+      response = await fetchImpl(url, {
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+    } catch (err) {
+      if (!isTransientFetchFailure(err))
+        throw err;
+      lastReason = err instanceof Error ? err.message : String(err);
+    }
+    if (response) {
+      const retryable = response.status === 429 || response.status >= 500;
+      if (!retryable)
+        return response;
+      lastReason = `${response.status} ${response.statusText}`.trim();
+      await response.body?.cancel().catch(() => {});
+    }
+    if (attempt <= retries) {
+      await sleep(retryDelayMs(attempt, response));
+    }
+  }
+  throw new ArchiveFetchError(`could not fetch ${opts.label} after ${retries + 1} attempts (${lastReason})`, { transient: true, attempts: retries + 1 });
+}
+async function fetchViaGate(gate, partition, retried, fetchOpts) {
+  const url = await gate.getUrl(partition.path, retried ? { forceRefresh: true } : undefined);
+  const response = await fetchWithRetry(url, {
+    ...fetchOpts,
+    label: partition.path
+  });
+  if (response.status === 403 && !retried) {
+    await response.body?.cancel().catch(() => {});
+    return fetchViaGate(gate, partition, true, fetchOpts);
+  }
+  if (!response.ok) {
+    throw new ArchiveFetchError(`could not fetch ${partition.path} (${response.status} ${response.statusText})`, { transient: false, attempts: 1 });
+  }
+  return Buffer.from(await response.arrayBuffer());
+}
+async function fetchVerifiedPartition(reference, partition, gate, fetchOpts) {
+  assertPathWithinRoot(partition.path, reference.isRemote ? undefined : reference.root);
+  let bytes;
+  if (gate) {
+    bytes = await fetchViaGate(gate, partition, false, fetchOpts);
+  } else if (reference.isRemote) {
+    const url = `${reference.root.replace(/\/$/, "")}/${partition.path}`;
+    const response = await fetchWithRetry(url, {
+      ...fetchOpts,
+      label: partition.path
+    });
+    if (!response.ok) {
+      throw new ArchiveFetchError(`could not fetch ${partition.path} (${response.status} ${response.statusText})`, { transient: false, attempts: 1 });
+    }
+    bytes = Buffer.from(await response.arrayBuffer());
+  } else {
+    bytes = await readFile2(join2(reference.root, partition.path));
+  }
+  const digest = createHash("sha256").update(bytes).digest("hex");
+  if (digest !== partition.sha256) {
+    throw new Error(`${partition.path} failed verification: expected ${partition.sha256}, got ${digest}`);
+  }
+  return bytes;
+}
 
 // src/lib/bootstrap-resume.ts
 var RESUME_DATASETS = ["blocks", "transactions", "events"];
@@ -205001,7 +203300,6 @@ import {
   computeRangeDigest as computeRangeDigest2
 } from "@secondlayer/shared/archive/range-digest";
 import { getDb as getDb2, getRawClient as getRawClient2 } from "@secondlayer/shared/db";
-init_archive_reference();
 init_output();
 init_resolve_auth();
 var REPAIR_EXIT = {
@@ -205443,9 +203741,6 @@ function registerRepairCommand(program) {
 }
 
 // src/commands/verify.ts
-init_archive_reference();
-init_output();
-init_resolve_auth();
 import {
   compareRangeDigests as compareRangeDigests2,
   computeRangeDigest as computeRangeDigest3
@@ -205460,6 +203755,8 @@ import {
   reportVerify
 } from "@secondlayer/shared/coverage";
 import { getDb as getDb3 } from "@secondlayer/shared/db";
+init_output();
+init_resolve_auth();
 var VERIFY_EXIT = {
   CLEAN: 0,
   DIVERGED: 1,
@@ -207510,6 +205807,157 @@ import { spawnSync as spawnSync3 } from "node:child_process";
 import { existsSync as existsSync7, mkdirSync as mkdirSync4, writeFileSync as writeFileSync6 } from "node:fs";
 import { dirname as dirname8, join as join12 } from "node:path";
 
+// src/lib/devnet-compose.ts
+var DEFAULT_IMAGE_OWNER = "ryanwaits";
+var DEFAULT_IMAGE_TAG = "latest";
+var DEV_INSTANCE_TOKEN = "dev-instance-token";
+function buildDevnetCompose(opts = {}) {
+  const owner = opts.owner ?? DEFAULT_IMAGE_OWNER;
+  const tag = opts.imageTag ?? DEFAULT_IMAGE_TAG;
+  const apiPort = opts.apiPort ?? 3800;
+  const indexerPort = opts.indexerPort ?? 3700;
+  const apiPublish = `127.0.0.1:${apiPort}`;
+  const apiImage = `ghcr.io/${owner}/secondlayer-api:${tag}`;
+  const indexerImage = `ghcr.io/${owner}/secondlayer-indexer:${tag}`;
+  const dbUrl = "postgres://secondlayer:secondlayer@postgres:5432/secondlayer";
+  const DEV_SECRETS_KEY = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef";
+  return `# Generated by \`secondlayer devnet connect\` — do not edit by hand.
+# Secondlayer app services for local clarinet devnet development.
+name: secondlayer-devnet
+
+services:
+  postgres:
+    image: postgres:17-alpine
+    environment:
+      POSTGRES_USER: secondlayer
+      POSTGRES_PASSWORD: secondlayer
+      POSTGRES_DB: secondlayer
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U secondlayer"]
+      interval: 5s
+      timeout: 5s
+      retries: 10
+    restart: unless-stopped
+
+  migrate:
+    image: ${apiImage}
+    command: ["bun", "run", "packages/shared/src/db/migrate.ts"]
+    environment:
+      DATABASE_URL: ${dbUrl}
+    depends_on:
+      postgres:
+        condition: service_healthy
+    restart: "no"
+
+  api:
+    image: ${apiImage}
+    environment:
+      INSTANCE_MODE: oss
+      DATABASE_URL: ${dbUrl}
+      PORT: 3800
+      # 0.0.0.0 is forced: a container process that binds loopback is
+      # unreachable through a published port. The real reach is the publish
+      # spec below, handed over verbatim so /v1 reads stay keyless on devnet.
+      LISTEN_HOST: "0.0.0.0"
+      API_PUBLISH_ADDR: "${apiPublish}"
+      # Boot guard reads LISTEN_HOST, so a token is required to start at all.
+      # It gates writes only — reads are open on this loopback publish.
+      INSTANCE_TOKEN: ${DEV_INSTANCE_TOKEN}
+      NODE_ENV: production
+      DATA_DIR: /data
+      # Shared across api + subgraph-processor so the secret the api encrypts
+      # (e.g. a webhook's signing secret) can be decrypted by the emitter.
+      # OSS auto-generates a per-process key when unset — that splits them.
+      # Local-dev fixed value; not a production secret.
+      SECONDLAYER_SECRETS_KEY: ${DEV_SECRETS_KEY}
+    ports:
+      - "${apiPublish}:3800"
+    volumes:
+      - subgraphs_data:/data/subgraphs
+    depends_on:
+      migrate:
+        condition: service_completed_successfully
+      postgres:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:3800/health"]
+      interval: 10s
+      timeout: 3s
+      start_period: 10s
+      retries: 5
+    restart: unless-stopped
+
+  indexer:
+    image: ${indexerImage}
+    environment:
+      DATABASE_URL: ${dbUrl}
+      PORT: 3700
+      NODE_ENV: production
+      # Keep every network key aligned: the indexer writes index_progress under
+      # STACKS_NETWORK, the subgraph processor reads it under NETWORK. If they
+      # differ, catch-up finds no progress row and subgraphs never advance.
+      NETWORKS: testnet
+      STACKS_NETWORK: testnet
+      NETWORK: testnet
+      # Fed by the devnet node's event observer — never reach out to Hiro mainnet.
+      AUTO_BACKFILL_ENABLED: "false"
+      TIP_FOLLOWER_ENABLED: "false"
+    # Deliberately published on every interface, unlike the api: the devnet's
+    # stacks-node runs in its own container and POSTs events to
+    # host.docker.internal:3700, which resolves to the host gateway address,
+    # not 127.0.0.1. A loopback publish here would drop every block.
+    ports:
+      - "${indexerPort}:3700"
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    depends_on:
+      migrate:
+        condition: service_completed_successfully
+      postgres:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:3700/health"]
+      interval: 10s
+      timeout: 3s
+      start_period: 10s
+      retries: 5
+    restart: unless-stopped
+
+  subgraph-processor:
+    image: ${apiImage}
+    command: ["bun", "run", "packages/subgraphs/src/service.ts"]
+    environment:
+      DATABASE_URL: ${dbUrl}
+      NODE_ENV: production
+      DATA_DIR: /data
+      # Must match the indexer's network key (see indexer note) — catch-up reads
+      # index_progress under NETWORK.
+      NETWORK: testnet
+      STACKS_NETWORK: testnet
+      # The emitter blocks webhook delivery to private/loopback IPs by default.
+      # On a local devnet you deliver to your own localhost receiver, so allow it.
+      SECONDLAYER_ALLOW_PRIVATE_EGRESS: "true"
+      # Must match the api's key so the emitter can decrypt signing secrets.
+      SECONDLAYER_SECRETS_KEY: ${DEV_SECRETS_KEY}
+    volumes:
+      - subgraphs_data:/data/subgraphs
+    depends_on:
+      migrate:
+        condition: service_completed_successfully
+      postgres:
+        condition: service_healthy
+    healthcheck:
+      disable: true
+    restart: unless-stopped
+
+volumes:
+  postgres_data:
+  subgraphs_data:
+`;
+}
+
 // src/lib/devnet-config.ts
 import { existsSync as existsSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "node:fs";
 import { dirname as dirname7, join as join10, parse as parsePath } from "node:path";
@@ -208920,13 +207368,138 @@ function registerLogoutCommand(program) {
   program.command("logout", { hidden: true }).description("Log out and revoke the local session").option("--credits", "Log out of the archive credits account used by bootstrap, repair, and credits").action((opts) => runLogout({ credits: opts.credits }));
 }
 // src/commands/uninstall.ts
-init_instance_init();
-init_output();
-init_resolve_auth();
 import { spawnSync as spawnSync4 } from "node:child_process";
 import { existsSync as existsSync10, readFileSync as readFileSync8 } from "node:fs";
 import { join as join15, resolve as resolve11 } from "node:path";
 import { planUninstall, uninstallCommand } from "@secondlayer/shared/runtime";
+
+// src/lib/instance-init.ts
+init_output();
+import { randomBytes as randomBytes3 } from "node:crypto";
+import { existsSync as existsSync9, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "node:fs";
+import { resolve as resolve10 } from "node:path";
+import { ARCHIVE_ROOT_PUBLIC_KEY_PEM } from "@secondlayer/shared/archive/root-key";
+import { generateEd25519KeyPair } from "@secondlayer/shared/crypto/ed25519";
+import { INSTANCE_NETWORKS } from "@secondlayer/shared/db/queries/instance";
+var INSTANCE_ENV_FILE = ".env.local";
+function isHostedAccountKey(value) {
+  return value.startsWith("sk-sl_") || value.startsWith("ss-sl_");
+}
+function parseInstanceNetwork(value) {
+  const network = value.trim().toLowerCase();
+  if (INSTANCE_NETWORKS.includes(network)) {
+    return network;
+  }
+  throw new Error(`network must be mainnet, testnet, or devnet (got ${value})`);
+}
+function instanceNetworkFromEnv(fallback = "mainnet") {
+  const raw = process.env.STACKS_NETWORK ?? fallback;
+  try {
+    return parseInstanceNetwork(raw);
+  } catch (err) {
+    printError(err instanceof Error ? err.message : String(err), {
+      hint: "Pass --network mainnet, --network testnet, or --network devnet."
+    });
+    process.exit(1);
+  }
+}
+function generateInstanceToken() {
+  return randomBytes3(32).toString("hex");
+}
+function generateSecretsKey() {
+  return randomBytes3(32).toString("hex");
+}
+function generateSigningPrivateKey() {
+  return generateEd25519KeyPair().privateKeyPem;
+}
+function escapeEnvValue(value) {
+  if (!/[\s#"']/.test(value) && !value.includes("\\"))
+    return value;
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n")}"`;
+}
+function unescapeEnvValue(raw) {
+  let value = raw.trim();
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    value = value.slice(1, -1);
+  }
+  return value.replace(/\\n/g, `
+`).replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+}
+function readEnvValue(envPath, key) {
+  if (!existsSync9(envPath))
+    return null;
+  const match = readFileSync7(envPath, "utf8").match(new RegExp(`^${key}=(.*)$`, "m"));
+  return match ? unescapeEnvValue(match[1]) : null;
+}
+function buildInstanceEnv(input) {
+  const existingAlias = input.existing?.SL_API_KEY;
+  const aliasIsHex = existingAlias && !existingAlias.startsWith("sk-sl_") && !existingAlias.startsWith("ss-sl_");
+  const token = input.existing?.INSTANCE_TOKEN || (aliasIsHex ? existingAlias : undefined) || generateInstanceToken();
+  const secrets = input.existing?.SECONDLAYER_SECRETS_KEY || generateSecretsKey();
+  const signing = input.existing?.STREAMS_SIGNING_PRIVATE_KEY || input.existing?.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY || generateSigningPrivateKey();
+  const apiUrl = input.existing?.SECONDLAYER_API_URL || input.existing?.SL_API_URL || input.apiUrl || "http://127.0.0.1:3800";
+  const archiveKey = input.existing?.ARCHIVE_SIGNING_PUBLIC_KEY || input.archivePublicKeyPem || ARCHIVE_ROOT_PUBLIC_KEY_PEM;
+  const hostedCandidate = input.existing?.SECONDLAYER_API_KEY || input.existing?.SL_API_KEY || undefined;
+  const hostedKey = hostedCandidate && isHostedAccountKey(hostedCandidate) ? hostedCandidate : undefined;
+  return {
+    INSTANCE_MODE: "oss",
+    STACKS_NETWORK: input.network,
+    INSTANCE_TOKEN: token,
+    SECONDLAYER_SECRETS_KEY: secrets,
+    STREAMS_SIGNING_PRIVATE_KEY: signing,
+    SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY: signing,
+    ALLOW_UNSIGNED_WEBHOOKS: "false",
+    SECONDLAYER_API_URL: apiUrl,
+    SL_API_URL: apiUrl,
+    ...hostedKey ? { SECONDLAYER_API_KEY: hostedKey, SL_API_KEY: hostedKey } : {},
+    ARCHIVE_SIGNING_PUBLIC_KEY: archiveKey
+  };
+}
+function renderInstanceEnv(env) {
+  const lines = [
+    "# Generated by secondlayer init. Do not commit.",
+    `INSTANCE_MODE=${env.INSTANCE_MODE}`,
+    `STACKS_NETWORK=${env.STACKS_NETWORK}`,
+    "# The instance credential. The API validates bearer tokens against it,",
+    "# and the CLI/SDK/MCP read it first when authenticating.",
+    `INSTANCE_TOKEN=${env.INSTANCE_TOKEN}`,
+    `SECONDLAYER_SECRETS_KEY=${env.SECONDLAYER_SECRETS_KEY}`,
+    `STREAMS_SIGNING_PRIVATE_KEY=${escapeEnvValue(env.STREAMS_SIGNING_PRIVATE_KEY)}`,
+    `SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY=${escapeEnvValue(env.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY)}`,
+    `ALLOW_UNSIGNED_WEBHOOKS=${env.ALLOW_UNSIGNED_WEBHOOKS}`,
+    `SECONDLAYER_API_URL=${env.SECONDLAYER_API_URL}`,
+    `SL_API_URL=${env.SL_API_URL}`
+  ];
+  if (env.SECONDLAYER_API_KEY) {
+    lines.push("# Hosted account key for archive credits (sk-sl_*).", `SECONDLAYER_API_KEY=${env.SECONDLAYER_API_KEY}`, `SL_API_KEY=${env.SL_API_KEY ?? env.SECONDLAYER_API_KEY}`);
+  }
+  lines.push("# Archive trust root: bootstrap, verify, and repair check manifests", "# against this key. Replace it to pin a different archive.", `ARCHIVE_SIGNING_PUBLIC_KEY=${escapeEnvValue(env.ARCHIVE_SIGNING_PUBLIC_KEY)}`, "");
+  return lines.join(`
+`);
+}
+function writeInstanceEnv(cwd, env, file = INSTANCE_ENV_FILE) {
+  const path = resolve10(cwd, file);
+  writeFileSync7(path, renderInstanceEnv(env), { mode: 384 });
+  return path;
+}
+function loadExistingInstanceEnv(cwd, file = INSTANCE_ENV_FILE) {
+  const path = resolve10(cwd, file);
+  return {
+    INSTANCE_TOKEN: readEnvValue(path, "INSTANCE_TOKEN"),
+    SECONDLAYER_SECRETS_KEY: readEnvValue(path, "SECONDLAYER_SECRETS_KEY"),
+    STREAMS_SIGNING_PRIVATE_KEY: readEnvValue(path, "STREAMS_SIGNING_PRIVATE_KEY"),
+    SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY: readEnvValue(path, "SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY"),
+    SECONDLAYER_API_URL: readEnvValue(path, "SECONDLAYER_API_URL"),
+    SL_API_URL: readEnvValue(path, "SL_API_URL"),
+    SECONDLAYER_API_KEY: readEnvValue(path, "SECONDLAYER_API_KEY"),
+    SL_API_KEY: readEnvValue(path, "SL_API_KEY"),
+    ARCHIVE_SIGNING_PUBLIC_KEY: readEnvValue(path, "ARCHIVE_SIGNING_PUBLIC_KEY")
+  };
+}
+
+// src/commands/uninstall.ts
+init_output();
+init_resolve_auth();
 var UNINSTALL_EXIT = { OK: 0, FAILED: 1, REFUSED: 2 };
 var REPO_COMPOSE = "docker/oss/docker-compose.yml";
 function bundleHasKeys(bundleDir) {
@@ -209368,8 +207941,6 @@ function registerRestoreCommand(program) {
   attachRestoreCommand(program.command("restore").description("Restore an instance from a backup bundle").hook("preAction", () => assertInstanceUrl()));
 }
 // src/commands/init.ts
-init_archive_reference();
-init_instance_init();
 init_output();
 init_resolve_auth();
 var DEFAULT_INIT_API_URL = "http://127.0.0.1:3800";
@@ -209400,9 +207971,67 @@ flags (see \`secondlayer --help\`). Defaults: mainnet, http://127.0.0.1:3800.
     note("Export these or pass --env-file to compose. Do not commit the file.");
   });
 }
+// src/lib/observer-stanza.ts
+var OBSERVER_MODES = ["indexer", "signer-shared"];
+
+class UnsupportedObserverError extends Error {
+  name = "UnsupportedObserverError";
+}
+function parseObserverMode(value) {
+  const mode = value.trim().toLowerCase();
+  if (OBSERVER_MODES.includes(mode)) {
+    return mode;
+  }
+  throw new UnsupportedObserverError(`observer mode must be indexer or signer-shared (got ${value})`);
+}
+function parseObserverEndpoint(value) {
+  const trimmed = value.trim();
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed) || trimmed.startsWith("unix:")) {
+    throw new UnsupportedObserverError(`observer endpoint must be host:port, not a URL (${value})`);
+  }
+  const match = trimmed.match(/^([a-zA-Z0-9._-]+):(\d+)$/);
+  if (!match) {
+    throw new UnsupportedObserverError(`observer endpoint must be host:port (got ${value})`);
+  }
+  const port = Number(match[2]);
+  if (port < 1 || port > 65535) {
+    throw new UnsupportedObserverError(`observer port out of range (${port})`);
+  }
+  return trimmed;
+}
+var LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "::1"]);
+function validateObserverStanza(input) {
+  const endpoint = parseObserverEndpoint(input.endpoint);
+  const host = endpoint.slice(0, endpoint.lastIndexOf(":"));
+  if (input.network !== "devnet" && LOOPBACK_HOSTS.has(host.toLowerCase())) {
+    throw new UnsupportedObserverError(`loopback observer endpoint is not container-visible on ${input.network}; use a docker DNS name such as indexer:3700`);
+  }
+  return { endpoint };
+}
+function renderObserverStanza(input) {
+  const { endpoint } = validateObserverStanza(input);
+  const indexer = input.mode === "indexer";
+  const timeoutMs = indexer ? 2000 : 500;
+  const disableRetries = !indexer;
+  const comment = indexer ? "# Pure indexer: retry delivery. A slow observer can stall the node." : "# Signer-shared: do not retry. A missed block stays a gap until `secondlayer repair`.";
+  return [
+    comment,
+    "[[events_observer]]",
+    `endpoint = "${endpoint}"`,
+    'events_keys = ["*"]',
+    `timeout_ms = ${timeoutMs}`,
+    `disable_retries = ${disableRetries}`,
+    ""
+  ].join(`
+`);
+}
+function defaultObserverEndpoint(network) {
+  if (network === "devnet")
+    return "127.0.0.1:3700";
+  return "indexer:3700";
+}
+
 // src/commands/observer.ts
-init_instance_init();
-init_observer_stanza();
 init_output();
 init_resolve_auth();
 function registerObserverCommand(program) {
@@ -209425,12 +208054,752 @@ init_output();
 init_resolve_auth();
 
 // src/lib/setup-prompts.ts
-init_instance_init();
-init_oss_compose();
-init_setup_wizard();
 import { resolve as resolvePath3 } from "node:path";
 import { confirm as confirm4, input as input3, select as select4 } from "@inquirer/prompts";
 
+// src/lib/oss-compose.ts
+function buildOssCompose(opts = {}) {
+  const owner = opts.owner ?? DEFAULT_IMAGE_OWNER;
+  const tag = opts.imageTag ?? DEFAULT_IMAGE_TAG;
+  const runtimeImage = `ghcr.io/${owner}/secondlayer-runtime:${tag}`;
+  return `# Generated by \`secondlayer setup\` — do not edit by hand.
+# Mirrors docker/oss/docker-compose.yml; see that file for the source of truth
+# on env vars, profiles, and third-party digest pins. \`secondlayer\` is
+# swapped from a repo build to the published OSS image (no checkout here).
+name: secondlayer
+
+services:
+  postgres:
+    image: postgres:17-alpine@sha256:d4bb0a8c1b7bb2e29f976d099e7bfb9a5d8858cffe9e46b35cd302cd1f1f8168
+    environment:
+      POSTGRES_USER: \${POSTGRES_USER:-secondlayer}
+      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:-secondlayer}
+      POSTGRES_DB: \${POSTGRES_DB:-secondlayer}
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+    ports:
+      - "\${POSTGRES_PORT:-127.0.0.1:5432}:5432"
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U \${POSTGRES_USER:-secondlayer}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+
+  secondlayer:
+    image: ${runtimeImage}
+    environment:
+      INSTANCE_MODE: oss
+      NETWORK: \${NETWORK:-\${STACKS_NETWORK:-mainnet}}
+      STACKS_NETWORK: \${STACKS_NETWORK:-mainnet}
+      NODE_MODE: \${NODE_MODE:-external}
+      SECONDLAYER_ALLOW_UNDERSIZED: \${SECONDLAYER_ALLOW_UNDERSIZED:-false}
+      DATABASE_URL: postgres://\${POSTGRES_USER:-secondlayer}:\${POSTGRES_PASSWORD:-secondlayer}@postgres:5432/\${POSTGRES_DB:-secondlayer}
+      DATA_DIR: /data
+      API_PORT: "3800"
+      INDEXER_PORT: "3700"
+      # See docker/oss/docker-compose.yml: API_PORT above is the *container*
+      # port; \${API_PORT} in ports:/here is the *publish spec* from .env.
+      LISTEN_HOST: "0.0.0.0"
+      API_PUBLISH_ADDR: \${API_PORT:-127.0.0.1:3800}
+      INSTANCE_TOKEN: \${INSTANCE_TOKEN:-}
+      SECONDLAYER_SECRETS_KEY: \${SECONDLAYER_SECRETS_KEY:-}
+      STREAMS_SIGNING_PRIVATE_KEY: \${STREAMS_SIGNING_PRIVATE_KEY:-}
+      SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY: \${SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY:-}
+      ALLOW_UNSIGNED_WEBHOOKS: \${ALLOW_UNSIGNED_WEBHOOKS:-false}
+      LOG_LEVEL: \${LOG_LEVEL:-info}
+      NODE_ENV: production
+      STACKS_NODE_RPC_URL: \${STACKS_NODE_RPC_URL:-}
+      OBSERVER_JOURNAL_ENABLED: \${OBSERVER_JOURNAL_ENABLED:-true}
+      STREAMS_API_URL: http://127.0.0.1:3800
+      STREAMS_INTERNAL_API_KEY: \${STREAMS_INTERNAL_API_KEY:-}
+      SBTC_DECODER_ENABLED: \${SBTC_DECODER_ENABLED:-true}
+      POX4_DECODER_ENABLED: \${POX4_DECODER_ENABLED:-true}
+      BNS_DECODER_ENABLED: \${BNS_DECODER_ENABLED:-false}
+      SUBGRAPH_SOURCE: \${SUBGRAPH_SOURCE:-streams-index}
+      SUBGRAPH_INDEX_API_URL: http://127.0.0.1:3800
+      BITCOIN_RPC_PASSWORD: \${BITCOIN_RPC_PASSWORD:-}
+    ports:
+      - "\${API_PORT:-127.0.0.1:3800}:3800"
+      - "\${INDEXER_PORT:-127.0.0.1:3700}:3700"
+    # \`secondlayer observer\`'s default endpoint is \`indexer:3700\` — this
+    # alias is what makes that default actually resolve on this network,
+    # without renaming the service. Mirrors docker/oss/docker-compose.yml.
+    networks:
+      default:
+        aliases:
+          - indexer
+    volumes:
+      - subgraphs_data:/data/subgraphs
+    depends_on:
+      postgres:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:3800/health"]
+      interval: 30s
+      timeout: 5s
+      start_period: 40s
+      retries: 3
+    restart: unless-stopped
+
+  bitcoind:
+    # Digest = kylemanna/bitcoind:latest as published 2026-07-20 — see
+    # docker/oss/docker-compose.yml for why the digest is the real pin here.
+    image: kylemanna/bitcoind:latest@sha256:86bbcaa99bf3bf3d5df7fd6d9217b3a41194db4c4e34385064f2cfc9fa7bdf91
+    volumes:
+      - \${BITCOIN_DATA_DIR:-./data/bitcoin}:/bitcoin/.bitcoin
+    ports:
+      - "127.0.0.1:8332:8332"
+      - "8333:8333"
+    healthcheck:
+      test: ["CMD-SHELL", "bitcoin-cli -rpcuser=\${BITCOIN_RPC_USER:-stacks} -rpcpassword=\${BITCOIN_RPC_PASSWORD:-changeme} getblockchaininfo | grep -q '\\"blocks\\"' && [ $$(bitcoin-cli -rpcuser=\${BITCOIN_RPC_USER:-stacks} -rpcpassword=\${BITCOIN_RPC_PASSWORD:-changeme} getblockcount) -gt 666050 ]"]
+      interval: 60s
+      timeout: 15s
+      start_period: 120s
+      retries: 3
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          memory: 32G
+    profiles: ["full-node"]
+
+  stacks-node:
+    # Consensus-critical — digest-pinned to 4.0.1. See docker/oss/docker-compose.yml.
+    image: ghcr.io/stacks-network/stacks-core:4.0.1@sha256:ceb768f881ef52a1d2792a2b4a89d81e092b1df11293b04c31ce36613c3f9711
+    volumes:
+      - \${STACKS_DATA_DIR:-./data/stacks}:/stacks-blockchain/data
+      - ./Config.toml:/stacks-blockchain/Config.toml:ro
+    ports:
+      - "20443:20443"
+      - "20444:20444"
+    restart: unless-stopped
+    command: ["stacks-node", "start", "--config", "/stacks-blockchain/Config.toml"]
+    # full-node only — see docker/oss/docker-compose.yml. No standalone
+    # "stacks-node, public Bitcoin" profile: nothing here wires the node at
+    # a real public Bitcoin RPC, so that combination never actually synced.
+    profiles: ["full-node"]
+
+volumes:
+  postgres_data:
+  subgraphs_data:
+`;
+}
+function buildOssStacksConfigToml(opts) {
+  const mode = opts.network === "mainnet" ? "mainnet" : "testnet";
+  return `[node]
+working_dir = "/stacks-blockchain/data"
+rpc_bind = "0.0.0.0:20443"
+p2p_bind = "0.0.0.0:20444"
+seed = ""
+marf_compress = true
+bootstrap_node = "02196f005965cebe6ddc3901b7b1cc1aa7a88f305bb8c5893456b8f9a605923893@seed.mainnet.hiro.so:20444,02539449ad94e6e6392d8c1deb2b4e61f80ae2a18964349bc14336d8b903c46a8c@cet.stacksnodes.org:20444,02ececc8ce79b8adf813f13a0255f8ae58d4357309ba0cedd523d9f1a306fcfb79@sgt.stacksnodes.org:20444,0303144ba518fe7a0fb56a8a7d488f950307a4330f146e1e1458fc63fb33defe96@est.stacksnodes.org:20444"
+
+# Event observer points directly at the bundled indexer service, same docker
+# network. Retries off / low timeout: a stuck indexer must never starve a
+# co-located signer of block_proposal events. See docker/oss/Config.toml.
+[[events_observer]]
+endpoint = "secondlayer:3700"
+events_keys = ["*"]
+timeout_ms = 500
+disable_retries = true
+
+[burnchain]
+chain = "bitcoin"
+mode = "${mode}"
+peer_host = "bitcoind"
+username = "stacks"
+password = "${opts.bitcoinRpcPassword}"
+rpc_port = 8332
+peer_port = 8333
+`;
+}
+function buildOssBitcoinConf(opts) {
+  return `server=1
+txindex=1
+rpcallowip=0.0.0.0/0
+rpcbind=0.0.0.0
+rpcuser=stacks
+rpcpassword=${opts.rpcPassword}
+# Prune: 0 = archive (required for Stacks); set to 550+ only for pruned chains.
+prune=0
+dbcache=4096
+`;
+}
+
+// src/lib/setup-wizard.ts
+import { spawn as spawn3, spawnSync as spawnSync5 } from "node:child_process";
+import { randomBytes as randomBytes4 } from "node:crypto";
+import { existsSync as existsSync12 } from "node:fs";
+import { writeFile as writeFile6 } from "node:fs/promises";
+import { createServer } from "node:net";
+import { join as join17, resolve as resolvePath2 } from "node:path";
+import { closeDb as closeDb2, getRawClientFor } from "@secondlayer/shared/db";
+import { FLOORS, diskFloorGb } from "@secondlayer/shared/runtime";
+init_resolve_auth();
+var SETUP_NODE_MODES = ["external", "stacks", "full"];
+var DEFAULT_ARCHIVE_MANIFEST = "https://archive.secondlayer.tools/latest.json";
+class MissingSetupFlagError extends Error {
+  flag;
+  constructor(flag, message) {
+    super(message);
+    this.name = "MissingSetupFlagError";
+    this.flag = flag;
+  }
+}
+function parseSetupNodeMode(value) {
+  const mode = value.trim().toLowerCase();
+  if (SETUP_NODE_MODES.includes(mode)) {
+    return mode;
+  }
+  throw new Error(`node mode must be external, stacks, or full (got ${value})`);
+}
+function resolveNonInteractiveConfig(flags) {
+  if (!flags.network) {
+    throw new MissingSetupFlagError("--network", "Missing --network <mainnet|testnet|devnet>. Non-interactive setup requires it explicitly — there is no safe default.");
+  }
+  if (!flags.nodeMode) {
+    throw new MissingSetupFlagError("--node-mode", "Missing --node-mode <external|stacks|full>. Non-interactive setup requires it explicitly — there is no safe default.");
+  }
+  const network = parseInstanceNetwork(flags.network);
+  const nodeMode = parseSetupNodeMode(flags.nodeMode);
+  const dir = resolvePath2(flags.dir ?? process.cwd());
+  const skipBootstrap = !!flags.skipBootstrap;
+  return {
+    network,
+    nodeMode,
+    apiPort: flags.apiPort ?? "127.0.0.1:3800",
+    indexerPort: "127.0.0.1:3700",
+    postgresPort: "127.0.0.1:5432",
+    dir,
+    against: skipBootstrap ? undefined : flags.against ?? DEFAULT_ARCHIVE_MANIFEST,
+    skipBootstrap,
+    skipVerify: !!flags.skipVerify,
+    yes: !!flags.yes,
+    force: !!flags.force,
+    owner: flags.owner ?? DEFAULT_IMAGE_OWNER,
+    imageTag: flags.imageTag ?? DEFAULT_IMAGE_TAG
+  };
+}
+function guardrailPreview(nodeMode, network) {
+  return {
+    ramFloorMb: nodeMode === "full" ? FLOORS.fullRamMb : FLOORS.appRamMb,
+    diskFloorGb: diskFloorGb(nodeMode, network)
+  };
+}
+async function checkDocker() {
+  const probe = spawnSync5("docker", ["info"], { stdio: "ignore" });
+  return !probe.error && probe.status === 0;
+}
+function isPortFree(host, port) {
+  return new Promise((resolvePromise) => {
+    const srv = createServer();
+    srv.once("error", () => resolvePromise(false));
+    srv.once("listening", () => srv.close(() => resolvePromise(true)));
+    srv.listen(port, host);
+  });
+}
+function parsePublishSpec(spec) {
+  const idx = spec.lastIndexOf(":");
+  if (idx === -1)
+    return { host: "127.0.0.1", port: Number(spec) };
+  return { host: spec.slice(0, idx), port: Number(spec.slice(idx + 1)) };
+}
+function dockerPublishedHostPorts() {
+  const probe = spawnSync5("docker", ["ps", "--format", "{{.Ports}}"], {
+    encoding: "utf8"
+  });
+  const ports = new Set;
+  if (probe.error || probe.status !== 0 || !probe.stdout)
+    return ports;
+  for (const match of probe.stdout.matchAll(/:(\d+)->/g)) {
+    ports.add(Number(match[1]));
+  }
+  return ports;
+}
+async function resolveAvailablePublishSpec(spec, claimedByDocker = new Set, maxAttempts = 20) {
+  const { host, port } = parsePublishSpec(spec);
+  for (let attempt = 0;attempt < maxAttempts; attempt++) {
+    const candidate = port + attempt;
+    if (claimedByDocker.has(candidate))
+      continue;
+    if (await isPortFree(host, candidate)) {
+      return { spec: `${host}:${candidate}`, remapped: attempt > 0 };
+    }
+  }
+  return { spec, remapped: false };
+}
+function randomHex(bytes) {
+  return randomBytes4(bytes).toString("hex");
+}
+function resolveSecrets(config) {
+  const envPath = join17(config.dir, ".env");
+  const existing = config.force || !existsSync12(envPath) ? {} : readEnvFile(config.dir, envPath);
+  const instance = buildInstanceEnv({
+    network: config.network,
+    existing: {
+      INSTANCE_TOKEN: existing.INSTANCE_TOKEN,
+      SECONDLAYER_SECRETS_KEY: existing.SECONDLAYER_SECRETS_KEY,
+      STREAMS_SIGNING_PRIVATE_KEY: existing.STREAMS_SIGNING_PRIVATE_KEY,
+      SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY: existing.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY,
+      SECONDLAYER_API_URL: existing.SECONDLAYER_API_URL,
+      SL_API_URL: existing.SL_API_URL,
+      SECONDLAYER_API_KEY: existing.SECONDLAYER_API_KEY,
+      SL_API_KEY: existing.SL_API_KEY,
+      ARCHIVE_SIGNING_PUBLIC_KEY: existing.ARCHIVE_SIGNING_PUBLIC_KEY
+    },
+    apiUrl: `http://${normalizeLoopbackHost(config.apiPort)}`,
+    archivePublicKeyPem: config.archivePublicKeyPem
+  });
+  return {
+    instance,
+    postgresPassword: existing.POSTGRES_PASSWORD || randomHex(24),
+    bitcoinRpcPassword: existing.BITCOIN_RPC_PASSWORD || randomHex(24),
+    databaseUrl: operatorEditedDatabaseUrl(existing)
+  };
+}
+function operatorEditedDatabaseUrl(existing) {
+  const url = existing.DATABASE_URL;
+  if (!url)
+    return;
+  if (existing.POSTGRES_PORT && existing.POSTGRES_PASSWORD) {
+    const generated = setupDatabaseUrl({ postgresPort: existing.POSTGRES_PORT }, { postgresPassword: existing.POSTGRES_PASSWORD });
+    if (url === generated)
+      return;
+  }
+  return url;
+}
+var SETUP_POSTGRES_USER = "secondlayer";
+var SETUP_POSTGRES_DB = "secondlayer";
+function setupDatabaseUrl(config, secrets) {
+  if (secrets.databaseUrl)
+    return secrets.databaseUrl;
+  const password = encodeURIComponent(secrets.postgresPassword);
+  return `postgres://${SETUP_POSTGRES_USER}:${password}@${normalizeLoopbackHost(config.postgresPort)}/${SETUP_POSTGRES_DB}`;
+}
+function normalizeLoopbackHost(apiPort) {
+  return apiPort.includes(":") ? apiPort : `127.0.0.1:${apiPort}`;
+}
+function readEnvFile(dir, envPath) {
+  const shared = loadExistingInstanceEnv(dir, ".env");
+  return {
+    ...shared,
+    POSTGRES_PASSWORD: readEnvValue(envPath, "POSTGRES_PASSWORD"),
+    POSTGRES_PORT: readEnvValue(envPath, "POSTGRES_PORT"),
+    BITCOIN_RPC_PASSWORD: readEnvValue(envPath, "BITCOIN_RPC_PASSWORD"),
+    DATABASE_URL: readEnvValue(envPath, "DATABASE_URL")
+  };
+}
+function renderSetupEnv(config, secrets) {
+  const i = secrets.instance;
+  const lines = [
+    "# Generated by `secondlayer setup`. Do not commit.",
+    `NETWORK=${config.network}`,
+    `STACKS_NETWORK=${config.network}`,
+    `NODE_MODE=${config.nodeMode}`,
+    `API_PORT=${config.apiPort}`,
+    `INDEXER_PORT=${config.indexerPort}`,
+    `POSTGRES_USER=${SETUP_POSTGRES_USER}`,
+    `POSTGRES_PASSWORD=${secrets.postgresPassword}`,
+    `POSTGRES_DB=${SETUP_POSTGRES_DB}`,
+    `POSTGRES_PORT=${config.postgresPort}`,
+    "# Where bootstrap, verify, repair, and backup connect from this directory:",
+    "# the compose Postgres above, published on the host. Point it elsewhere",
+    "# only if you moved the index.",
+    `DATABASE_URL=${escapeEnvValue(setupDatabaseUrl(config, secrets))}`,
+    "# The instance credential. The API validates bearer tokens against it,",
+    "# and the CLI/SDK/MCP read it first when authenticating.",
+    `INSTANCE_TOKEN=${i.INSTANCE_TOKEN}`,
+    `SECONDLAYER_SECRETS_KEY=${i.SECONDLAYER_SECRETS_KEY}`,
+    `STREAMS_SIGNING_PRIVATE_KEY=${escapeEnvValue(i.STREAMS_SIGNING_PRIVATE_KEY)}`,
+    `SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY=${escapeEnvValue(i.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY)}`,
+    `ALLOW_UNSIGNED_WEBHOOKS=${i.ALLOW_UNSIGNED_WEBHOOKS}`,
+    `SECONDLAYER_API_URL=${i.SECONDLAYER_API_URL}`,
+    `SL_API_URL=${i.SL_API_URL}`
+  ];
+  if (i.SECONDLAYER_API_KEY) {
+    lines.push("# Hosted account key for archive credits (sk-sl_*).", `SECONDLAYER_API_KEY=${i.SECONDLAYER_API_KEY}`, `SL_API_KEY=${i.SL_API_KEY ?? i.SECONDLAYER_API_KEY}`);
+  }
+  lines.push("# Archive trust root: bootstrap, verify, and repair check manifests", "# against this key. Replace it to pin a different archive.", `ARCHIVE_SIGNING_PUBLIC_KEY=${escapeEnvValue(i.ARCHIVE_SIGNING_PUBLIC_KEY)}`);
+  if (config.nodeMode === "full") {
+    lines.push("BITCOIN_RPC_USER=stacks", `BITCOIN_RPC_PASSWORD=${secrets.bitcoinRpcPassword}`);
+  }
+  lines.push("");
+  return lines.join(`
+`);
+}
+async function writeSetupFiles(config, secrets) {
+  const composePath = join17(config.dir, "docker-compose.yml");
+  const envPath = join17(config.dir, ".env");
+  await writeFile6(composePath, buildOssCompose({ owner: config.owner, imageTag: config.imageTag }));
+  await writeFile6(envPath, renderSetupEnv(config, secrets), { mode: 384 });
+  const result = { composePath, envPath };
+  if (config.nodeMode === "full") {
+    const configTomlPath = join17(config.dir, "Config.toml");
+    await writeFile6(configTomlPath, buildOssStacksConfigToml({
+      network: config.network,
+      bitcoinRpcPassword: secrets.bitcoinRpcPassword ?? ""
+    }));
+    result.configTomlPath = configTomlPath;
+  }
+  if (config.nodeMode === "full") {
+    const bitcoinConfPath = join17(config.dir, "bitcoin.conf");
+    await writeFile6(bitcoinConfPath, buildOssBitcoinConf({ rpcPassword: secrets.bitcoinRpcPassword ?? "" }));
+    result.bitcoinConfPath = bitcoinConfPath;
+  }
+  return result;
+}
+function composeProfileArgs(nodeMode) {
+  if (nodeMode === "full")
+    return ["--profile", "full-node"];
+  return [];
+}
+function runStreaming(command, args, opts) {
+  return new Promise((resolvePromise, reject) => {
+    const child = spawn3(command, args, {
+      cwd: opts.cwd,
+      env: opts.env ?? process.env,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    const pump = (stream) => (chunk) => {
+      const text = chunk.toString("utf8");
+      if (stream === "stdout")
+        stdout += text;
+      else
+        stderr += text;
+      if (opts.onLine) {
+        for (const line of text.split(`
+`)) {
+          if (line.length > 0)
+            opts.onLine(line, stream);
+        }
+      }
+    };
+    child.stdout?.on("data", pump("stdout"));
+    child.stderr?.on("data", pump("stderr"));
+    child.once("error", reject);
+    child.once("close", (code) => {
+      resolvePromise({ code: code ?? 1, stdout, stderr });
+    });
+  });
+}
+async function dockerComposeUp(config, files, onLine) {
+  const args = [
+    "compose",
+    "-f",
+    files.composePath,
+    "--env-file",
+    files.envPath,
+    ...composeProfileArgs(config.nodeMode),
+    "up",
+    "-d"
+  ];
+  return runStreaming("docker", args, { cwd: config.dir, onLine });
+}
+async function pollHealth(config, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? 120000;
+  const intervalMs = opts.intervalMs ?? 2000;
+  const url = `http://${normalizeLoopbackHost(config.apiPort)}/health`;
+  const deadline = Date.now() + timeoutMs;
+  for (;; ) {
+    try {
+      const res = await fetch(url, { signal: AbortSignal.timeout(3000) });
+      if (res.ok)
+        return true;
+    } catch {}
+    opts.onTick?.();
+    if (Date.now() >= deadline)
+      return false;
+    await new Promise((r) => setTimeout(r, intervalMs));
+  }
+}
+function getObserverInfo(config) {
+  if (config.nodeMode !== "external") {
+    return { applicable: false };
+  }
+  const endpoint = defaultObserverEndpoint(config.network);
+  const stanza = renderObserverStanza({
+    mode: "indexer",
+    endpoint,
+    network: config.network
+  });
+  return { applicable: true, stanza, endpoint };
+}
+function cliEntry() {
+  const entry = process.argv[1];
+  if (!entry) {
+    throw new Error("Could not resolve the secondlayer CLI entry to shell out to.");
+  }
+  return [process.execPath, entry];
+}
+var CHILD_ENV_KEYS = [
+  "DATABASE_URL",
+  "ARCHIVE_SIGNING_PUBLIC_KEY",
+  "SL_API_URL",
+  "INSTANCE_TOKEN"
+];
+function buildChildEnv(envPath, base = process.env) {
+  const env = { ...base };
+  for (const key of CHILD_ENV_KEYS) {
+    const value = readEnvValue(envPath, key);
+    if (value)
+      env[key] = value;
+  }
+  return env;
+}
+async function checkDatabaseReachable(databaseUrl) {
+  try {
+    const client = getRawClientFor(databaseUrl);
+    await client`SELECT 1`;
+    return { ok: true };
+  } catch (err) {
+    return {
+      ok: false,
+      error: err instanceof Error ? err.message : String(err)
+    };
+  } finally {
+    await closeDb2().catch(() => {});
+  }
+}
+async function preflightBootstrapDatabase(config, secrets, emit) {
+  const databaseUrl = setupDatabaseUrl(config, secrets);
+  const reachable = await checkDatabaseReachable(databaseUrl);
+  if (!reachable.ok) {
+    emit({
+      type: "step-error",
+      step: "bootstrap",
+      message: `Postgres at ${redactUrl(databaseUrl)} did not answer SELECT 1: ${reachable.error}. Check \`docker compose logs postgres\`, then re-run setup to resume.`
+    });
+    return null;
+  }
+  emit({
+    type: "step-log",
+    step: "bootstrap",
+    line: `database ${redactUrl(databaseUrl)}`
+  });
+  return databaseUrl;
+}
+async function runBootstrap(config, against, files, onLine) {
+  const [command, ...prefix] = cliEntry();
+  const args = [...prefix, "bootstrap", "--against", against, "--yes"];
+  return runStreaming(command, args, {
+    cwd: config.dir,
+    env: buildChildEnv(files.envPath),
+    onLine
+  });
+}
+async function runVerify(config, against, files, onLine) {
+  const [command, ...prefix] = cliEntry();
+  const args = [...prefix, "verify", "all", "--against", against];
+  return runStreaming(command, args, {
+    cwd: config.dir,
+    env: buildChildEnv(files.envPath),
+    onLine
+  });
+}
+function redactUrl(url) {
+  try {
+    const u = new URL(url);
+    if (u.password)
+      u.password = "***";
+    return u.toString();
+  } catch {
+    return url;
+  }
+}
+function buildSuccessSummary(config, secrets) {
+  const apiUrl = `http://${normalizeLoopbackHost(config.apiPort)}`;
+  const lines = [
+    "Secondlayer is up.",
+    "",
+    `  api        ${apiUrl}`,
+    `  network    ${config.network}`,
+    `  node mode  ${config.nodeMode}`,
+    `  dir        ${config.dir}`,
+    "",
+    "Export the instance token for writes (reads on loopback need no credential):",
+    `  export INSTANCE_TOKEN=${secrets.instance.INSTANCE_TOKEN}`,
+    "",
+    "Try it:",
+    "  secondlayer subgraphs create my-balances --from-contract SP....my-contract",
+    "  secondlayer subgraphs deploy subgraphs/my-balances.ts",
+    `  curl ${apiUrl}/v1/subgraphs/my-balances/balances`,
+    "",
+    "Docs: https://secondlayer.tools/docs/self-host"
+  ];
+  return lines.join(`
+`);
+}
+async function runSetup(initialConfig, emit) {
+  let config = initialConfig;
+  emit({ type: "step-start", step: "preflight" });
+  if (!await checkDocker()) {
+    emit({
+      type: "step-error",
+      step: "preflight",
+      message: "Docker isn't reachable. Start Docker Desktop/OrbStack, or install Docker, then re-run."
+    });
+    return { ok: false, config };
+  }
+  const claimedByDocker = dockerPublishedHostPorts();
+  const ports = {
+    api: await resolveAvailablePublishSpec(config.apiPort, claimedByDocker),
+    indexer: await resolveAvailablePublishSpec(config.indexerPort, claimedByDocker),
+    postgres: await resolveAvailablePublishSpec(config.postgresPort, claimedByDocker)
+  };
+  config = {
+    ...config,
+    apiPort: ports.api.spec,
+    indexerPort: ports.indexer.spec,
+    postgresPort: ports.postgres.spec
+  };
+  for (const [label, result] of [
+    ["api", ports.api],
+    ["indexer", ports.indexer],
+    ["postgres", ports.postgres]
+  ]) {
+    if (result.remapped) {
+      emit({
+        type: "step-log",
+        step: "preflight",
+        line: `${label} port was already in use locally, using ${result.spec} instead`
+      });
+    }
+  }
+  const floors = guardrailPreview(config.nodeMode, config.network);
+  emit({
+    type: "step-done",
+    step: "preflight",
+    detail: `NODE_MODE=${config.nodeMode} on ${config.network} needs at least ${floors.ramFloorMb}MB RAM and ${floors.diskFloorGb}GB disk.`
+  });
+  emit({ type: "step-start", step: "secrets" });
+  const secrets = resolveSecrets({
+    dir: config.dir,
+    network: config.network,
+    apiPort: config.apiPort,
+    force: config.force,
+    archivePublicKeyPem: await resolveArchivePublicKey({
+      envPem: process.env.ARCHIVE_SIGNING_PUBLIC_KEY ?? process.env.STREAMS_SIGNING_PUBLIC_KEY,
+      allowHostedApi: !isOssMode()
+    })
+  });
+  emit({ type: "step-done", step: "secrets" });
+  emit({ type: "step-start", step: "config" });
+  const files = await writeSetupFiles(config, secrets);
+  emit({
+    type: "step-done",
+    step: "config",
+    detail: `${files.composePath}, ${files.envPath}`
+  });
+  emit({ type: "step-start", step: "docker-up" });
+  const up = await dockerComposeUp(config, files, (line) => emit({ type: "step-log", step: "docker-up", line }));
+  if (up.code !== 0) {
+    emit({
+      type: "step-error",
+      step: "docker-up",
+      message: `docker compose up failed (exit ${up.code}).
+${up.stderr || up.stdout}`
+    });
+    return { ok: false, config, secrets, files };
+  }
+  const healthy = await pollHealth(config, {
+    onTick: () => emit({
+      type: "step-log",
+      step: "docker-up",
+      line: "waiting for /health…"
+    })
+  });
+  if (!healthy) {
+    emit({
+      type: "step-error",
+      step: "docker-up",
+      message: "Containers started but /health never came up. Check `docker compose logs`."
+    });
+    return { ok: false, config, secrets, files };
+  }
+  emit({ type: "step-done", step: "docker-up" });
+  emit({ type: "step-start", step: "observer" });
+  const observer = getObserverInfo(config);
+  if (observer.applicable && observer.stanza) {
+    emit({
+      type: "step-log",
+      step: "observer",
+      line: "ACTION REQUIRED — paste this into your Stacks node's Config.toml:"
+    });
+    for (const line of observer.stanza.split(`
+`)) {
+      if (line.length > 0)
+        emit({ type: "step-log", step: "observer", line });
+    }
+    emit({
+      type: "step-done",
+      step: "observer",
+      detail: `endpoint ${observer.endpoint} — see the ACTION REQUIRED lines above`
+    });
+  } else {
+    emit({
+      type: "step-done",
+      step: "observer",
+      detail: "bundled node — the observer is pre-configured, nothing to paste"
+    });
+  }
+  let bootstrapped = false;
+  if (config.skipBootstrap) {
+    emit({ type: "step-skip", step: "bootstrap", reason: "--skip-bootstrap" });
+  } else if (config.against) {
+    emit({ type: "step-start", step: "bootstrap" });
+    const databaseUrl = await preflightBootstrapDatabase(config, secrets, emit);
+    if (databaseUrl === null) {
+      return { ok: false, config, secrets, files, observer };
+    }
+    const res = await runBootstrap(config, config.against, files, (line) => emit({ type: "step-log", step: "bootstrap", line }));
+    if (res.code === 0) {
+      bootstrapped = true;
+      emit({ type: "step-done", step: "bootstrap" });
+    } else {
+      emit({
+        type: "step-error",
+        step: "bootstrap",
+        message: `secondlayer bootstrap exited ${res.code}.`
+      });
+    }
+  }
+  if (config.skipVerify) {
+    emit({ type: "step-skip", step: "verify", reason: "--skip-verify" });
+  } else if (!config.against) {
+    emit({
+      type: "step-skip",
+      step: "verify",
+      reason: "no manifest to verify against"
+    });
+  } else if (!bootstrapped) {
+    emit({
+      type: "step-skip",
+      step: "verify",
+      reason: "bootstrap did not run — nothing restored yet to verify"
+    });
+  } else {
+    emit({ type: "step-start", step: "verify" });
+    const res = await runVerify(config, config.against, files, (line) => emit({ type: "step-log", step: "verify", line }));
+    if (res.code === 0) {
+      emit({ type: "step-done", step: "verify" });
+    } else {
+      emit({
+        type: "step-error",
+        step: "verify",
+        message: `secondlayer verify exited ${res.code}.`
+      });
+    }
+  }
+  const summary = buildSuccessSummary(config, secrets);
+  emit({ type: "step-start", step: "summary" });
+  emit({ type: "step-done", step: "summary", detail: summary });
+  return { ok: true, config, secrets, files, observer, summary };
+}
+
+// src/lib/setup-prompts.ts
 class SetupCancelledError extends Error {
   constructor() {
     super("Setup cancelled — nothing was changed.");
@@ -209546,7 +208915,6 @@ async function promptSetupConfig(flags) {
 }
 
 // src/commands/setup.ts
-init_setup_wizard();
 function renderProgress(event) {
   switch (event.type) {
     case "step-start":
@@ -209616,18 +208984,19 @@ async function runPromptedInteractive(flags) {
   await executeAndRender(config);
 }
 function registerSetupCommand(program) {
-  program.command("setup").description("Guided self-host onboarding: secrets, config, docker, bootstrap, verify — one command").option("--node-mode <mode>", "external, stacks, or full (required)").option("--api-port <spec>", "API publish spec", "127.0.0.1:3800").option("--dir <path>", "Target directory for compose + .env", ".").option("--against <manifest>", `Archive manifest to bootstrap from (suggested default: ${DEFAULT_ARCHIVE_MANIFEST})`).option("--skip-bootstrap", "Skip the archive restore; index only what your node sends from now on").option("--skip-verify", "Skip the post-bootstrap verify pass").option("--yes", "Non-interactive: skip the TUI, require flags, never prompt").option("--force", "Regenerate secrets even if a .env already exists in --dir").option("--owner <owner>", "ghcr image owner (namespace) to pull from").option("--image-tag <tag>", "Published image tag to run").addHelpText("after", `
+  program.command("setup").description("Guided self-host onboarding: secrets, config, docker, bootstrap, verify — one command").option("--node-mode <mode>", "external, stacks, or full (required)").option("--api-port <spec>", "API publish spec", "127.0.0.1:3800").option("--dir <path>", "Target directory for compose + .env", ".").option("--against <manifest>", `Archive manifest to bootstrap from (default: ${DEFAULT_ARCHIVE_MANIFEST})`).option("--skip-bootstrap", "Skip the archive restore; index only what your node sends from now on").option("--skip-verify", "Skip the post-bootstrap verify pass").option("--yes", "Non-interactive: skip the prompts, require flags, never ask").option("--force", "Regenerate secrets even if a .env already exists in --dir").option("--owner <owner>", "ghcr image owner (namespace) to pull from").option("--image-tag <tag>", "Published image tag to run").addHelpText("after", `
 --network <mainnet|testnet|devnet> is the top-level global flag (see
 \`secondlayer --help\`) — required here too, just parsed one level up.
 
 Examples:
   $ secondlayer setup
-  $ secondlayer setup --yes --network mainnet --node-mode external --against ${DEFAULT_ARCHIVE_MANIFEST}
+  $ secondlayer setup --yes --network mainnet --node-mode external
   $ secondlayer setup --yes --network testnet --node-mode external --skip-bootstrap --skip-verify
 
-Without a TTY (piped, CI, an agent), or with --yes, the TUI is skipped: every
-decision with no safe default (--network, --node-mode, and --against unless
---skip-bootstrap) must come from a flag or the command fails fast naming it.
+Without a TTY (piped, CI, an agent), or with --yes, the prompts are skipped:
+every decision with no safe default (--network, --node-mode) must come from a
+flag or the command fails fast naming it. --against defaults to the official
+archive (${DEFAULT_ARCHIVE_MANIFEST}) unless --skip-bootstrap is set.
 `).action(async (opts) => {
     assertInstanceUrl();
     const flags = {
@@ -209639,17 +209008,7 @@ decision with no safe default (--network, --node-mode, and --against unless
       await runNonInteractive(flags);
       return;
     }
-    if (!isBunRuntime()) {
-      await runPromptedInteractive(flags);
-      return;
-    }
-    try {
-      await Promise.resolve().then(() => init_setup_tui());
-      await runSetupTui(flags);
-    } catch (err) {
-      warn(`Interactive TUI unavailable (${err instanceof Error ? err.message : String(err)}) — falling back to guided prompts.`);
-      await runPromptedInteractive(flags);
-    }
+    await runPromptedInteractive(flags);
   });
 }
 // src/cli.ts
@@ -209710,5 +209069,5 @@ registerCreditsCommand(program);
 registerArchiveCommand(program);
 program.parse();
 
-//# debugId=29D0F1BFB142444864756E2164756E21
+//# debugId=92A36ED6CC78319F64756E2164756E21
 //# sourceMappingURL=cli.js.map