@secondlayer/cli 20.1.1 → 21.0.0

package/dist/cli.js

@@ -29423,7 +29423,7 @@ var init_git_status = () => {};
 
 // ../../node_modules/typescript/lib/typescript.js
 var require_typescript = __commonJS(function(exports, module) {
-  var __dirname = "/Users/ryan/projects/secondlayer/node_modules/typescript/lib", __filename = "/Users/ryan/projects/secondlayer/node_modules/typescript/lib/typescript.js";
+  var __dirname = "/Users/ryan/projects/secondlayer-release/node_modules/typescript/lib", __filename = "/Users/ryan/projects/secondlayer-release/node_modules/typescript/lib/typescript.js";
   /*! *****************************************************************************
   Copyright (c) Microsoft Corporation. All rights reserved.
   Licensed under the Apache License, Version 2.0 (the "License"); you may not use
@@ -202646,7 +202646,7 @@ var {
 // package.json
 var package_default = {
   name: "@secondlayer/cli",
-  version: "20.1.1",
+  version: "21.0.0",
   description: "Run a Stacks index on your own hardware — set it up, restore verified history, and keep it current.",
   repository: {
     type: "git",
@@ -202685,11 +202685,11 @@ var package_default = {
     "@inquirer/prompts": "^8.2.0",
     "@secondlayer/bundler": "^0.7.1",
     "@secondlayer/scaffold": "^1.6.2",
-    "@secondlayer/sdk": "^15.0.1",
-    "@secondlayer/shared": "^12.1.1",
-    "@secondlayer/stacks": "^6.2.1",
-    "@secondlayer/subgraphs": "^7.0.2",
-    "@secondlayer/verify": "^0.5.3",
+    "@secondlayer/sdk": "^15.0.3",
+    "@secondlayer/shared": "^13.0.0",
+    "@secondlayer/stacks": "^6.2.2",
+    "@secondlayer/subgraphs": "^7.0.4",
+    "@secondlayer/verify": "^0.5.4",
     esbuild: "^0.28.2",
     "smol-toml": "^1.9.1",
     zod: "^4.3.6"
@@ -207809,268 +207809,19 @@ async function runLogout(opts = {}) {
 function registerLogoutCommand(program) {
   program.command("logout").description("Log out and revoke the local session").option("--credits", "Log out of the archive credits account used by bootstrap, repair, and credits").action((opts) => runLogout({ credits: opts.credits }));
 }
-// src/commands/uninstall.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
-import { existsSync as existsSync9, readFileSync as readFileSync8 } from "node:fs";
-import { join as join14, resolve as resolve10 } from "node:path";
-import { planUninstall, uninstallCommand } from "@secondlayer/shared/runtime";
-
-// src/lib/instance-init.ts
-init_output();
-import { randomBytes as randomBytes3 } from "node:crypto";
-import { existsSync as existsSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "node:fs";
-import { resolve as resolve9 } from "node:path";
-import { ARCHIVE_ROOT_PUBLIC_KEY_PEM } from "@secondlayer/shared/archive/root-key";
-import { generateEd25519KeyPair } from "@secondlayer/shared/crypto/ed25519";
-import { INSTANCE_NETWORKS } from "@secondlayer/shared/db/queries/instance";
-var INSTANCE_ENV_FILE = ".env.local";
-function isHostedAccountKey(value) {
-  return value.startsWith("sk-sl_") || value.startsWith("ss-sl_");
-}
-function parseInstanceNetwork(value) {
-  const network = value.trim().toLowerCase();
-  if (INSTANCE_NETWORKS.includes(network)) {
-    return network;
-  }
-  throw new Error(`network must be mainnet, testnet, or devnet (got ${value})`);
-}
-function instanceNetworkFromEnv(fallback = "mainnet") {
-  const raw = process.env.STACKS_NETWORK ?? fallback;
-  try {
-    return parseInstanceNetwork(raw);
-  } catch (err) {
-    printError(err instanceof Error ? err.message : String(err), {
-      hint: "Pass --network mainnet, --network testnet, or --network devnet."
-    });
-    process.exit(1);
-  }
-}
-function generateInstanceToken() {
-  return randomBytes3(32).toString("hex");
-}
-function generateSecretsKey() {
-  return randomBytes3(32).toString("hex");
-}
-function generateSigningPrivateKey() {
-  return generateEd25519KeyPair().privateKeyPem;
-}
-function escapeEnvValue(value) {
-  if (!/[\s#"']/.test(value) && !value.includes("\\"))
-    return value;
-  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n")}"`;
-}
-function unescapeEnvValue(raw) {
-  let value = raw.trim();
-  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
-    value = value.slice(1, -1);
-  }
-  return value.replace(/\\n/g, `
-`).replace(/\\"/g, '"').replace(/\\\\/g, "\\");
-}
-function readEnvValue(envPath, key) {
-  if (!existsSync8(envPath))
-    return null;
-  const match = readFileSync7(envPath, "utf8").match(new RegExp(`^${key}=(.*)$`, "m"));
-  return match ? unescapeEnvValue(match[1]) : null;
-}
-function buildInstanceEnv(input) {
-  const token = input.existing?.INSTANCE_TOKEN || generateInstanceToken();
-  const secrets = input.existing?.SECONDLAYER_SECRETS_KEY || generateSecretsKey();
-  const signing = input.existing?.STREAMS_SIGNING_PRIVATE_KEY || input.existing?.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY || generateSigningPrivateKey();
-  const apiUrl = input.existing?.SECONDLAYER_API_URL || input.apiUrl || "http://127.0.0.1:3800";
-  const archiveKey = input.existing?.ARCHIVE_SIGNING_PUBLIC_KEY || input.archivePublicKeyPem || ARCHIVE_ROOT_PUBLIC_KEY_PEM;
-  const hostedCandidate = input.existing?.SECONDLAYER_API_KEY || undefined;
-  const hostedKey = hostedCandidate && isHostedAccountKey(hostedCandidate) ? hostedCandidate : undefined;
-  return {
-    INSTANCE_MODE: "oss",
-    STACKS_NETWORK: input.network,
-    INSTANCE_TOKEN: token,
-    SECONDLAYER_SECRETS_KEY: secrets,
-    STREAMS_SIGNING_PRIVATE_KEY: signing,
-    SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY: signing,
-    ALLOW_UNSIGNED_WEBHOOKS: "false",
-    SECONDLAYER_API_URL: apiUrl,
-    ...hostedKey ? { SECONDLAYER_API_KEY: hostedKey } : {},
-    ARCHIVE_SIGNING_PUBLIC_KEY: archiveKey
-  };
-}
-function renderInstanceEnv(env) {
-  const lines = [
-    "# Generated by secondlayer init. Do not commit.",
-    `INSTANCE_MODE=${env.INSTANCE_MODE}`,
-    `STACKS_NETWORK=${env.STACKS_NETWORK}`,
-    "# The instance credential. The API validates bearer tokens against it,",
-    "# and the CLI/SDK/MCP read it first when authenticating.",
-    `INSTANCE_TOKEN=${env.INSTANCE_TOKEN}`,
-    `SECONDLAYER_SECRETS_KEY=${env.SECONDLAYER_SECRETS_KEY}`,
-    `STREAMS_SIGNING_PRIVATE_KEY=${escapeEnvValue(env.STREAMS_SIGNING_PRIVATE_KEY)}`,
-    `SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY=${escapeEnvValue(env.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY)}`,
-    `ALLOW_UNSIGNED_WEBHOOKS=${env.ALLOW_UNSIGNED_WEBHOOKS}`,
-    `SECONDLAYER_API_URL=${env.SECONDLAYER_API_URL}`
-  ];
-  if (env.SECONDLAYER_API_KEY) {
-    lines.push("# Hosted account key for archive credits (sk-sl_*).", `SECONDLAYER_API_KEY=${env.SECONDLAYER_API_KEY}`);
-  }
-  lines.push("# Archive trust root: bootstrap, verify, and repair check manifests", "# against this key. Replace it to pin a different archive.", `ARCHIVE_SIGNING_PUBLIC_KEY=${escapeEnvValue(env.ARCHIVE_SIGNING_PUBLIC_KEY)}`, "");
-  return lines.join(`
-`);
-}
-function writeInstanceEnv(cwd, env, file = INSTANCE_ENV_FILE) {
-  const path = resolve9(cwd, file);
-  writeFileSync6(path, renderInstanceEnv(env), { mode: 384 });
-  return path;
-}
-function loadExistingInstanceEnv(cwd, file = INSTANCE_ENV_FILE) {
-  const path = resolve9(cwd, file);
-  return {
-    INSTANCE_TOKEN: readEnvValue(path, "INSTANCE_TOKEN"),
-    SECONDLAYER_SECRETS_KEY: readEnvValue(path, "SECONDLAYER_SECRETS_KEY"),
-    STREAMS_SIGNING_PRIVATE_KEY: readEnvValue(path, "STREAMS_SIGNING_PRIVATE_KEY"),
-    SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY: readEnvValue(path, "SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY"),
-    SECONDLAYER_API_URL: readEnvValue(path, "SECONDLAYER_API_URL"),
-    SECONDLAYER_API_KEY: readEnvValue(path, "SECONDLAYER_API_KEY"),
-    ARCHIVE_SIGNING_PUBLIC_KEY: readEnvValue(path, "ARCHIVE_SIGNING_PUBLIC_KEY")
-  };
-}
-
-// src/commands/uninstall.ts
-init_output();
-init_resolve_auth();
-var UNINSTALL_EXIT = { OK: 0, FAILED: 1, REFUSED: 2 };
-var REPO_COMPOSE = "docker/oss/docker-compose.yml";
-function bundleHasKeys(bundleDir) {
-  const manifest = join14(bundleDir, "manifest.json");
-  if (!existsSync9(manifest))
-    return false;
-  try {
-    const parsed = JSON.parse(readFileSync8(manifest, "utf8"));
-    return parsed.secrets != null;
-  } catch {
-    return false;
-  }
-}
-function resolveUninstallLayout(dir, composeOverride) {
-  const setupCompose = resolve10(dir, "docker-compose.yml");
-  const setupEnv = resolve10(dir, ".env");
-  const initEnv = resolve10(dir, ".env.local");
-  const secretsFile = [setupEnv, initEnv].find((file) => readEnvValue(file, "SECONDLAYER_SECRETS_KEY") !== null) ?? [setupEnv, initEnv].find((file) => existsSync9(file));
-  if (composeOverride) {
-    const composeFile = resolve10(dir, composeOverride);
-    const sibling = resolve10(composeFile, "..", ".env");
-    return {
-      composeFile,
-      envFile: existsSync9(sibling) ? sibling : undefined,
-      secretsFile
-    };
-  }
-  if (existsSync9(setupCompose)) {
-    return {
-      composeFile: setupCompose,
-      envFile: existsSync9(setupEnv) ? setupEnv : undefined,
-      secretsFile
-    };
-  }
-  return { composeFile: resolve10(dir, REPO_COMPOSE), secretsFile };
-}
-function composeDownArgs(plan, layout) {
-  const base = uninstallCommand(plan, layout.composeFile);
-  if (!layout.envFile)
-    return base;
-  const fileFlagEnd = base.indexOf("-f") + 2;
-  return [
-    ...base.slice(0, fileFlagEnd),
-    "--env-file",
-    layout.envFile,
-    ...base.slice(fileFlagEnd)
-  ];
-}
-function registerUninstallCommand(program) {
-  program.command("uninstall").description("Stop the stack; the index, chainstate, and keys survive").option("--compose <file>", `compose file to tear down (default: ./docker-compose.yml from setup, else ${REPO_COMPOSE})`).option("--purge", "also destroy the volumes (wipes the index)").option("--yes", "confirm a purge").option("--backup <dir>", "a bundle proving the keys exist elsewhere (required to purge)").option("--apply", "actually run it (default is a dry run)").option("--json", "Output as JSON").action(async (opts) => {
-    assertInstanceUrl();
-    const dataDir = process.env.DATA_DIR ?? "./data";
-    const layout = resolveUninstallLayout(process.cwd(), opts.compose);
-    const secretsPresent = !!process.env.SECONDLAYER_SECRETS_KEY || !!layout.secretsFile;
-    const keysBackedUp = opts.backup ? bundleHasKeys(resolve10(opts.backup)) : false;
-    const decision = planUninstall({
-      purge: opts.purge === true,
-      confirmed: opts.yes === true,
-      keysBackedUp,
-      secretsPresent,
-      dataDir
-    });
-    if (!decision.ok) {
-      printError(decision.reason, {
-        hint: layout.secretsFile ? `keys found in ${layout.secretsFile}` : undefined
-      });
-      process.exit(UNINSTALL_EXIT.REFUSED);
-    }
-    const cmd = composeDownArgs(decision.plan, layout);
-    if (!opts.apply) {
-      output({
-        json: opts.json,
-        data: {
-          dryRun: true,
-          plan: decision.plan,
-          command: cmd,
-          composeFile: layout.composeFile,
-          envFile: layout.envFile ?? null,
-          secretsFile: layout.secretsFile ?? null
-        },
-        human: () => {
-          note("dry run — nothing removed. Pass --apply to proceed.");
-          note(`compose: ${layout.composeFile}`);
-          if (layout.envFile)
-            note(`env: ${layout.envFile}`);
-          if (layout.secretsFile)
-            note(`keys: ${layout.secretsFile}`);
-          note(`would run: docker ${cmd.join(" ")}`);
-          for (const p of decision.plan.preserves) {
-            note(`preserved · ${p.what}: ${p.detail}`);
-          }
-          for (const d of decision.plan.destroys) {
-            warn(`DESTROYED · volume ${d}`);
-          }
-        }
-      });
-      return;
-    }
-    const res = spawnSync4("docker", cmd, { stdio: "inherit" });
-    if ((res.status ?? 1) !== 0) {
-      printError(`docker ${cmd.join(" ")} exited ${res.status}`);
-      process.exit(UNINSTALL_EXIT.FAILED);
-    }
-    output({
-      json: opts.json,
-      data: {
-        removed: true,
-        plan: decision.plan,
-        composeFile: layout.composeFile,
-        envFile: layout.envFile ?? null
-      },
-      human: () => {
-        success("stack removed");
-        for (const w of decision.warnings)
-          warn(w);
-        for (const p of decision.plan.preserves) {
-          note(`preserved · ${p.what}: ${p.detail}`);
-        }
-      }
-    });
-  });
-}
 // src/commands/backup.ts
 init_fs();
 init_output();
 init_resolve_auth();
 import {
   chmodSync,
-  existsSync as existsSync10,
+  existsSync as existsSync8,
   mkdirSync as mkdirSync4,
-  readFileSync as readFileSync9,
+  readFileSync as readFileSync7,
   statSync as statSync2,
-  writeFileSync as writeFileSync7
+  writeFileSync as writeFileSync6
 } from "node:fs";
-import { join as join15, resolve as resolve11 } from "node:path";
+import { join as join14, resolve as resolve9 } from "node:path";
 import { closeDb, getDb as getDb4, sql as sql2 } from "@secondlayer/shared/db";
 import {
   decryptBundle,
@@ -208219,10 +207970,10 @@ async function runBackup(opts) {
     printError(plan.reason);
     process.exit(BACKUP_EXIT.REFUSED);
   }
-  const outDir = resolve11(opts.out);
+  const outDir = resolve9(opts.out);
   mkdirSync4(outDir, { recursive: true });
   console.error("dumping database…");
-  const dumpPath = join15(outDir, DB_FILE);
+  const dumpPath = join14(outDir, DB_FILE);
   const dumpCmd = pgDumpInvocation(databaseUrl, dumpPath);
   const dump = await runProcess(dumpCmd.cmd, "pg_dump", dumpCmd.env);
   if (!dump.ok) {
@@ -208242,8 +207993,8 @@ async function runBackup(opts) {
     const lines = SECRET_ENV_KEYS.filter((k) => process.env[k]).map((k) => `${k}=${process.env[k]}`);
     const sealed = encryptBundle(lines.join(`
 `), passphrase);
-    const secretsPath = join15(outDir, SECRETS_FILE);
-    writeFileSync7(secretsPath, sealed);
+    const secretsPath = join14(outDir, SECRETS_FILE);
+    writeFileSync6(secretsPath, sealed);
     chmodSync(secretsPath, 384);
     manifest.secrets = {
       file: SECRETS_FILE,
@@ -208251,7 +208002,7 @@ async function runBackup(opts) {
       canary: sealKeyCanary(secretsKey)
     };
   }
-  writeFileSync7(join15(outDir, MANIFEST_FILE), `${JSON.stringify(manifest, null, 2)}
+  writeFileSync6(join14(outDir, MANIFEST_FILE), `${JSON.stringify(manifest, null, 2)}
 `);
   output({
     json: opts.json,
@@ -208280,14 +208031,14 @@ function attachRestoreCommand(cmd) {
 }
 async function runRestore(opts) {
   const databaseUrl = requireDatabaseUrl();
-  const dir = resolve11(opts.from);
-  const manifestPath = join15(dir, MANIFEST_FILE);
-  if (!existsSync10(manifestPath)) {
+  const dir = resolve9(opts.from);
+  const manifestPath = join14(dir, MANIFEST_FILE);
+  if (!existsSync8(manifestPath)) {
     printError(`no ${MANIFEST_FILE} in ${dir}`);
     process.exit(BACKUP_EXIT.REFUSED);
   }
-  const manifest = JSON.parse(readFileSync9(manifestPath, "utf8"));
-  const dumpPath = join15(dir, manifest.db?.file ?? DB_FILE);
+  const manifest = JSON.parse(readFileSync7(manifestPath, "utf8"));
+  const dumpPath = join14(dir, manifest.db?.file ?? DB_FILE);
   if (manifest.db && await sha256File(dumpPath) !== manifest.db.sha256) {
     printError("the database dump does not match the digest in the manifest; this bundle is corrupt or truncated");
     process.exit(BACKUP_EXIT.REFUSED);
@@ -208301,7 +208052,7 @@ async function runRestore(opts) {
       process.exit(BACKUP_EXIT.REFUSED);
     }
     try {
-      const env = decryptBundle(readFileSync9(join15(dir, manifest.secrets.file)), passphrase);
+      const env = decryptBundle(readFileSync7(join14(dir, manifest.secrets.file)), passphrase);
       bundleKey = env.split(`
 `).find((l) => l.startsWith("SECONDLAYER_SECRETS_KEY="))?.slice("SECONDLAYER_SECRETS_KEY=".length).trim();
     } catch {
@@ -208376,6 +208127,124 @@ function registerBackupCommand(program) {
 function registerRestoreCommand(program) {
   attachRestoreCommand(program.command("restore").description("Restore an instance from a backup bundle").hook("preAction", () => assertInstanceUrl()));
 }
+// src/lib/instance-init.ts
+init_output();
+import { randomBytes as randomBytes3 } from "node:crypto";
+import { existsSync as existsSync9, readFileSync as readFileSync8, writeFileSync as writeFileSync7 } from "node:fs";
+import { resolve as resolve10 } from "node:path";
+import { ARCHIVE_ROOT_PUBLIC_KEY_PEM } from "@secondlayer/shared/archive/root-key";
+import { generateEd25519KeyPair } from "@secondlayer/shared/crypto/ed25519";
+import { INSTANCE_NETWORKS } from "@secondlayer/shared/db/queries/instance";
+var INSTANCE_ENV_FILE = ".env.local";
+function isHostedAccountKey(value) {
+  return value.startsWith("sk-sl_") || value.startsWith("ss-sl_");
+}
+function parseInstanceNetwork(value) {
+  const network = value.trim().toLowerCase();
+  if (INSTANCE_NETWORKS.includes(network)) {
+    return network;
+  }
+  throw new Error(`network must be mainnet, testnet, or devnet (got ${value})`);
+}
+function instanceNetworkFromEnv(fallback = "mainnet") {
+  const raw = process.env.STACKS_NETWORK ?? fallback;
+  try {
+    return parseInstanceNetwork(raw);
+  } catch (err) {
+    printError(err instanceof Error ? err.message : String(err), {
+      hint: "Pass --network mainnet, --network testnet, or --network devnet."
+    });
+    process.exit(1);
+  }
+}
+function generateInstanceToken() {
+  return randomBytes3(32).toString("hex");
+}
+function generateSecretsKey() {
+  return randomBytes3(32).toString("hex");
+}
+function generateSigningPrivateKey() {
+  return generateEd25519KeyPair().privateKeyPem;
+}
+function escapeEnvValue(value) {
+  if (!/[\s#"']/.test(value) && !value.includes("\\"))
+    return value;
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n")}"`;
+}
+function unescapeEnvValue(raw) {
+  let value = raw.trim();
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    value = value.slice(1, -1);
+  }
+  return value.replace(/\\n/g, `
+`).replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+}
+function readEnvValue(envPath, key) {
+  if (!existsSync9(envPath))
+    return null;
+  const match = readFileSync8(envPath, "utf8").match(new RegExp(`^${key}=(.*)$`, "m"));
+  return match ? unescapeEnvValue(match[1]) : null;
+}
+function buildInstanceEnv(input) {
+  const token = input.existing?.INSTANCE_TOKEN || generateInstanceToken();
+  const secrets = input.existing?.SECONDLAYER_SECRETS_KEY || generateSecretsKey();
+  const signing = input.existing?.STREAMS_SIGNING_PRIVATE_KEY || input.existing?.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY || generateSigningPrivateKey();
+  const apiUrl = input.existing?.SECONDLAYER_API_URL || input.apiUrl || "http://127.0.0.1:3800";
+  const archiveKey = input.existing?.ARCHIVE_SIGNING_PUBLIC_KEY || input.archivePublicKeyPem || ARCHIVE_ROOT_PUBLIC_KEY_PEM;
+  const hostedCandidate = input.existing?.SECONDLAYER_API_KEY || undefined;
+  const hostedKey = hostedCandidate && isHostedAccountKey(hostedCandidate) ? hostedCandidate : undefined;
+  return {
+    INSTANCE_MODE: "oss",
+    STACKS_NETWORK: input.network,
+    INSTANCE_TOKEN: token,
+    SECONDLAYER_SECRETS_KEY: secrets,
+    STREAMS_SIGNING_PRIVATE_KEY: signing,
+    SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY: signing,
+    ALLOW_UNSIGNED_WEBHOOKS: "false",
+    SECONDLAYER_API_URL: apiUrl,
+    ...hostedKey ? { SECONDLAYER_API_KEY: hostedKey } : {},
+    ARCHIVE_SIGNING_PUBLIC_KEY: archiveKey
+  };
+}
+function renderInstanceEnv(env) {
+  const lines = [
+    "# Generated by secondlayer init. Do not commit.",
+    `INSTANCE_MODE=${env.INSTANCE_MODE}`,
+    `STACKS_NETWORK=${env.STACKS_NETWORK}`,
+    "# The instance credential. The API validates bearer tokens against it,",
+    "# and the CLI/SDK/MCP read it first when authenticating.",
+    `INSTANCE_TOKEN=${env.INSTANCE_TOKEN}`,
+    `SECONDLAYER_SECRETS_KEY=${env.SECONDLAYER_SECRETS_KEY}`,
+    `STREAMS_SIGNING_PRIVATE_KEY=${escapeEnvValue(env.STREAMS_SIGNING_PRIVATE_KEY)}`,
+    `SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY=${escapeEnvValue(env.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY)}`,
+    `ALLOW_UNSIGNED_WEBHOOKS=${env.ALLOW_UNSIGNED_WEBHOOKS}`,
+    `SECONDLAYER_API_URL=${env.SECONDLAYER_API_URL}`
+  ];
+  if (env.SECONDLAYER_API_KEY) {
+    lines.push("# Hosted account key for archive credits (sk-sl_*).", `SECONDLAYER_API_KEY=${env.SECONDLAYER_API_KEY}`);
+  }
+  lines.push("# Archive trust root: bootstrap, verify, and repair check manifests", "# against this key. Replace it to pin a different archive.", `ARCHIVE_SIGNING_PUBLIC_KEY=${escapeEnvValue(env.ARCHIVE_SIGNING_PUBLIC_KEY)}`, "");
+  return lines.join(`
+`);
+}
+function writeInstanceEnv(cwd, env, file = INSTANCE_ENV_FILE) {
+  const path = resolve10(cwd, file);
+  writeFileSync7(path, renderInstanceEnv(env), { mode: 384 });
+  return path;
+}
+function loadExistingInstanceEnv(cwd, file = INSTANCE_ENV_FILE) {
+  const path = resolve10(cwd, file);
+  return {
+    INSTANCE_TOKEN: readEnvValue(path, "INSTANCE_TOKEN"),
+    SECONDLAYER_SECRETS_KEY: readEnvValue(path, "SECONDLAYER_SECRETS_KEY"),
+    STREAMS_SIGNING_PRIVATE_KEY: readEnvValue(path, "STREAMS_SIGNING_PRIVATE_KEY"),
+    SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY: readEnvValue(path, "SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY"),
+    SECONDLAYER_API_URL: readEnvValue(path, "SECONDLAYER_API_URL"),
+    SECONDLAYER_API_KEY: readEnvValue(path, "SECONDLAYER_API_KEY"),
+    ARCHIVE_SIGNING_PUBLIC_KEY: readEnvValue(path, "ARCHIVE_SIGNING_PUBLIC_KEY")
+  };
+}
+
 // src/commands/init.ts
 init_output();
 init_resolve_auth();
@@ -208485,968 +208354,6 @@ function registerObserverCommand(program) {
     writeData(renderObserverStanza({ mode, endpoint, network }));
   });
 }
-// src/commands/setup.ts
-init_output();
-init_resolve_auth();
-
-// src/lib/setup-prompts.ts
-import { resolve as resolvePath3 } from "node:path";
-import { confirm as confirm4, input as input2, select as select3 } from "@inquirer/prompts";
-
-// src/lib/oss-compose.ts
-function buildOssCompose(opts = {}) {
-  const owner = opts.owner ?? DEFAULT_IMAGE_OWNER;
-  const tag = opts.imageTag ?? DEFAULT_IMAGE_TAG;
-  const runtimeImage = `ghcr.io/${owner}/secondlayer-runtime:${tag}`;
-  return `# Generated by \`secondlayer setup\` — do not edit by hand.
-# Mirrors docker/oss/docker-compose.yml; see that file for the source of truth
-# on env vars, profiles, and third-party digest pins. \`secondlayer\` is
-# swapped from a repo build to the published OSS image (no checkout here).
-name: secondlayer
-
-services:
-  postgres:
-    image: postgres:17-alpine@sha256:d4bb0a8c1b7bb2e29f976d099e7bfb9a5d8858cffe9e46b35cd302cd1f1f8168
-    environment:
-      POSTGRES_USER: \${POSTGRES_USER:-secondlayer}
-      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:-secondlayer}
-      POSTGRES_DB: \${POSTGRES_DB:-secondlayer}
-    # Postgres ships with a 128 MB cache, too small for a full-chain sync:
-    # inserts stall on index reads from disk. ~25% of RAM is the usual size.
-    command: ["postgres", "-c", "shared_buffers=\${POSTGRES_SHARED_BUFFERS:-1GB}"]
-    volumes:
-      - postgres_data:/var/lib/postgresql/data
-    ports:
-      - "\${POSTGRES_PORT:-127.0.0.1:5432}:5432"
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U \${POSTGRES_USER:-secondlayer}"]
-      interval: 10s
-      timeout: 5s
-      retries: 5
-    restart: unless-stopped
-
-  secondlayer:
-    image: ${runtimeImage}
-    environment:
-      INSTANCE_MODE: oss
-      NETWORK: \${NETWORK:-\${STACKS_NETWORK:-mainnet}}
-      STACKS_NETWORK: \${STACKS_NETWORK:-mainnet}
-      NODE_MODE: \${NODE_MODE:-external}
-      SECONDLAYER_ALLOW_UNDERSIZED: \${SECONDLAYER_ALLOW_UNDERSIZED:-false}
-      DATABASE_URL: postgres://\${POSTGRES_USER:-secondlayer}:\${POSTGRES_PASSWORD:-secondlayer}@postgres:5432/\${POSTGRES_DB:-secondlayer}
-      DATA_DIR: /data
-      API_PORT: "3800"
-      INDEXER_PORT: "3700"
-      # See docker/oss/docker-compose.yml: API_PORT above is the *container*
-      # port; \${API_PORT} in ports:/here is the *publish spec* from .env.
-      LISTEN_HOST: "0.0.0.0"
-      API_PUBLISH_ADDR: \${API_PORT:-127.0.0.1:3800}
-      INSTANCE_TOKEN: \${INSTANCE_TOKEN:-}
-      SECONDLAYER_SECRETS_KEY: \${SECONDLAYER_SECRETS_KEY:-}
-      STREAMS_SIGNING_PRIVATE_KEY: \${STREAMS_SIGNING_PRIVATE_KEY:-}
-      SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY: \${SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY:-}
-      ALLOW_UNSIGNED_WEBHOOKS: \${ALLOW_UNSIGNED_WEBHOOKS:-false}
-      LOG_LEVEL: \${LOG_LEVEL:-info}
-      NODE_ENV: production
-      STACKS_NODE_RPC_URL: \${STACKS_NODE_RPC_URL:-}
-      OBSERVER_JOURNAL_ENABLED: \${OBSERVER_JOURNAL_ENABLED:-true}
-      STREAMS_API_URL: http://127.0.0.1:3800
-      STREAMS_INTERNAL_API_KEY: \${STREAMS_INTERNAL_API_KEY:-}
-      SBTC_DECODER_ENABLED: \${SBTC_DECODER_ENABLED:-true}
-      POX4_DECODER_ENABLED: \${POX4_DECODER_ENABLED:-true}
-      BNS_DECODER_ENABLED: \${BNS_DECODER_ENABLED:-false}
-      SUBGRAPH_SOURCE: \${SUBGRAPH_SOURCE:-streams-index}
-      SUBGRAPH_INDEX_API_URL: http://127.0.0.1:3800
-      BITCOIN_RPC_PASSWORD: \${BITCOIN_RPC_PASSWORD:-}
-    ports:
-      - "\${API_PORT:-127.0.0.1:3800}:3800"
-      - "\${INDEXER_PORT:-127.0.0.1:3700}:3700"
-    # \`secondlayer observer\`'s default endpoint is \`indexer:3700\` — this
-    # alias is what makes that default actually resolve on this network,
-    # without renaming the service. Mirrors docker/oss/docker-compose.yml.
-    networks:
-      default:
-        aliases:
-          - indexer
-    volumes:
-      - subgraphs_data:/data/subgraphs
-    depends_on:
-      postgres:
-        condition: service_healthy
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:3800/health"]
-      interval: 30s
-      timeout: 5s
-      start_period: 40s
-      retries: 3
-    restart: unless-stopped
-
-  bitcoind:
-    # Digest = kylemanna/bitcoind:latest as published 2026-07-20 — see
-    # docker/oss/docker-compose.yml for why the digest is the real pin here.
-    image: kylemanna/bitcoind:latest@sha256:86bbcaa99bf3bf3d5df7fd6d9217b3a41194db4c4e34385064f2cfc9fa7bdf91
-    volumes:
-      - \${BITCOIN_DATA_DIR:-./data/bitcoin}:/bitcoin/.bitcoin
-    ports:
-      - "127.0.0.1:8332:8332"
-      - "8333:8333"
-    healthcheck:
-      test: ["CMD-SHELL", "bitcoin-cli -rpcuser=\${BITCOIN_RPC_USER:-stacks} -rpcpassword=\${BITCOIN_RPC_PASSWORD:-changeme} getblockchaininfo | grep -q '\\"blocks\\"' && [ $$(bitcoin-cli -rpcuser=\${BITCOIN_RPC_USER:-stacks} -rpcpassword=\${BITCOIN_RPC_PASSWORD:-changeme} getblockcount) -gt 666050 ]"]
-      interval: 60s
-      timeout: 15s
-      start_period: 120s
-      retries: 3
-    restart: unless-stopped
-    deploy:
-      resources:
-        limits:
-          memory: 32G
-    profiles: ["full-node"]
-
-  stacks-node:
-    # Consensus-critical — digest-pinned to 4.0.5. See docker/oss/docker-compose.yml.
-    image: ghcr.io/stacks-network/stacks-core:4.0.5@sha256:51aa7bf6f990b99fa010ebb23abe78653cf1f1d129ab8e7d88b1fe11a403c97d
-    volumes:
-      - \${STACKS_DATA_DIR:-./data/stacks}:/stacks-blockchain/data
-      - ./Config.toml:/stacks-blockchain/Config.toml:ro
-    ports:
-      - "20443:20443"
-      - "20444:20444"
-    restart: unless-stopped
-    command: ["stacks-node", "start", "--config", "/stacks-blockchain/Config.toml"]
-    # full-node only — see docker/oss/docker-compose.yml. No standalone
-    # "stacks-node, public Bitcoin" profile: nothing here wires the node at
-    # a real public Bitcoin RPC, so that combination never actually synced.
-    profiles: ["full-node"]
-
-volumes:
-  postgres_data:
-  subgraphs_data:
-`;
-}
-function buildOssStacksConfigToml(opts) {
-  const mode = opts.network === "mainnet" ? "mainnet" : "testnet";
-  return `[node]
-working_dir = "/stacks-blockchain/data"
-rpc_bind = "0.0.0.0:20443"
-p2p_bind = "0.0.0.0:20444"
-seed = ""
-marf_compress = true
-bootstrap_node = "02196f005965cebe6ddc3901b7b1cc1aa7a88f305bb8c5893456b8f9a605923893@seed.mainnet.hiro.so:20444,02539449ad94e6e6392d8c1deb2b4e61f80ae2a18964349bc14336d8b903c46a8c@cet.stacksnodes.org:20444,02ececc8ce79b8adf813f13a0255f8ae58d4357309ba0cedd523d9f1a306fcfb79@sgt.stacksnodes.org:20444,0303144ba518fe7a0fb56a8a7d488f950307a4330f146e1e1458fc63fb33defe96@est.stacksnodes.org:20444"
-
-# Event observer points directly at the bundled indexer service, same docker
-# network. Retries off / low timeout: a stuck indexer must never starve a
-# co-located signer of block_proposal events. See docker/oss/Config.toml.
-[[events_observer]]
-endpoint = "secondlayer:3700"
-events_keys = ["*"]
-timeout_ms = 500
-disable_retries = true
-
-[burnchain]
-chain = "bitcoin"
-mode = "${mode}"
-peer_host = "bitcoind"
-username = "stacks"
-password = "${opts.bitcoinRpcPassword}"
-rpc_port = 8332
-peer_port = 8333
-`;
-}
-function buildOssBitcoinConf(opts) {
-  return `server=1
-txindex=1
-rpcallowip=0.0.0.0/0
-rpcbind=0.0.0.0
-rpcuser=stacks
-rpcpassword=${opts.rpcPassword}
-# Prune: 0 = archive (required for Stacks); set to 550+ only for pruned chains.
-prune=0
-dbcache=4096
-`;
-}
-
-// src/lib/setup-wizard.ts
-import { spawn as spawn3, spawnSync as spawnSync5 } from "node:child_process";
-import { randomBytes as randomBytes4 } from "node:crypto";
-import { existsSync as existsSync11 } from "node:fs";
-import { writeFile as writeFile6 } from "node:fs/promises";
-import { createServer } from "node:net";
-import { join as join16, resolve as resolvePath2 } from "node:path";
-import { closeDb as closeDb2, getRawClientFor } from "@secondlayer/shared/db";
-import { FLOORS, diskFloorGb } from "@secondlayer/shared/runtime";
-init_resolve_auth();
-var SETUP_NODE_MODES = ["external", "stacks", "full"];
-var DEFAULT_ARCHIVE_MANIFEST = "https://archive.secondlayer.tools/latest.json";
-class MissingSetupFlagError extends Error {
-  flag;
-  constructor(flag, message) {
-    super(message);
-    this.name = "MissingSetupFlagError";
-    this.flag = flag;
-  }
-}
-function parseSetupNodeMode(value) {
-  const mode = value.trim().toLowerCase();
-  if (SETUP_NODE_MODES.includes(mode)) {
-    return mode;
-  }
-  throw new Error(`node mode must be external, stacks, or full (got ${value})`);
-}
-function resolveNonInteractiveConfig(flags) {
-  if (!flags.network) {
-    throw new MissingSetupFlagError("--network", "Missing --network <mainnet|testnet|devnet>. Non-interactive setup requires it explicitly — there is no safe default.");
-  }
-  if (!flags.nodeMode) {
-    throw new MissingSetupFlagError("--node-mode", "Missing --node-mode <external|stacks|full>. Non-interactive setup requires it explicitly — there is no safe default.");
-  }
-  const network = parseInstanceNetwork(flags.network);
-  const nodeMode = parseSetupNodeMode(flags.nodeMode);
-  const dir = resolvePath2(flags.dir ?? process.cwd());
-  const skipBootstrap = !!flags.skipBootstrap;
-  return {
-    network,
-    nodeMode,
-    apiPort: flags.apiPort ?? "127.0.0.1:3800",
-    indexerPort: "127.0.0.1:3700",
-    postgresPort: "127.0.0.1:5432",
-    dir,
-    against: skipBootstrap ? undefined : flags.against ?? DEFAULT_ARCHIVE_MANIFEST,
-    skipBootstrap,
-    skipVerify: !!flags.skipVerify,
-    yes: !!flags.yes,
-    force: !!flags.force,
-    owner: flags.owner ?? DEFAULT_IMAGE_OWNER,
-    imageTag: flags.imageTag ?? DEFAULT_IMAGE_TAG
-  };
-}
-function guardrailPreview(nodeMode, network) {
-  return {
-    ramFloorMb: nodeMode === "full" ? FLOORS.fullRamMb : FLOORS.appRamMb,
-    diskFloorGb: diskFloorGb(nodeMode, network)
-  };
-}
-async function checkDocker() {
-  const probe = spawnSync5("docker", ["info"], { stdio: "ignore" });
-  return !probe.error && probe.status === 0;
-}
-function isPortFree(host, port) {
-  return new Promise((resolvePromise) => {
-    const srv = createServer();
-    srv.once("error", () => resolvePromise(false));
-    srv.once("listening", () => srv.close(() => resolvePromise(true)));
-    srv.listen(port, host);
-  });
-}
-function parsePublishSpec(spec) {
-  const idx = spec.lastIndexOf(":");
-  if (idx === -1)
-    return { host: "127.0.0.1", port: Number(spec) };
-  return { host: spec.slice(0, idx), port: Number(spec.slice(idx + 1)) };
-}
-function dockerPublishedHostPorts() {
-  const probe = spawnSync5("docker", ["ps", "--format", "{{.Ports}}"], {
-    encoding: "utf8"
-  });
-  const ports = new Set;
-  if (probe.error || probe.status !== 0 || !probe.stdout)
-    return ports;
-  for (const match of probe.stdout.matchAll(/:(\d+)->/g)) {
-    ports.add(Number(match[1]));
-  }
-  return ports;
-}
-async function resolveAvailablePublishSpec(spec, claimedByDocker = new Set, maxAttempts = 20) {
-  const { host, port } = parsePublishSpec(spec);
-  for (let attempt = 0;attempt < maxAttempts; attempt++) {
-    const candidate = port + attempt;
-    if (claimedByDocker.has(candidate))
-      continue;
-    if (await isPortFree(host, candidate)) {
-      return { spec: `${host}:${candidate}`, remapped: attempt > 0 };
-    }
-  }
-  return { spec, remapped: false };
-}
-function randomHex(bytes) {
-  return randomBytes4(bytes).toString("hex");
-}
-function resolveSecrets(config) {
-  const envPath = join16(config.dir, ".env");
-  const existing = config.force || !existsSync11(envPath) ? {} : readEnvFile(config.dir, envPath);
-  const instance = buildInstanceEnv({
-    network: config.network,
-    existing: {
-      INSTANCE_TOKEN: existing.INSTANCE_TOKEN,
-      SECONDLAYER_SECRETS_KEY: existing.SECONDLAYER_SECRETS_KEY,
-      STREAMS_SIGNING_PRIVATE_KEY: existing.STREAMS_SIGNING_PRIVATE_KEY,
-      SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY: existing.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY,
-      SECONDLAYER_API_URL: existing.SECONDLAYER_API_URL,
-      SECONDLAYER_API_KEY: existing.SECONDLAYER_API_KEY,
-      ARCHIVE_SIGNING_PUBLIC_KEY: existing.ARCHIVE_SIGNING_PUBLIC_KEY
-    },
-    apiUrl: `http://${normalizeLoopbackHost(config.apiPort)}`,
-    archivePublicKeyPem: config.archivePublicKeyPem
-  });
-  return {
-    instance,
-    postgresPassword: existing.POSTGRES_PASSWORD || randomHex(24),
-    bitcoinRpcPassword: existing.BITCOIN_RPC_PASSWORD || randomHex(24),
-    databaseUrl: operatorEditedDatabaseUrl(existing)
-  };
-}
-function operatorEditedDatabaseUrl(existing) {
-  const url = existing.DATABASE_URL;
-  if (!url)
-    return;
-  if (existing.POSTGRES_PORT && existing.POSTGRES_PASSWORD) {
-    const generated = setupDatabaseUrl({ postgresPort: existing.POSTGRES_PORT }, { postgresPassword: existing.POSTGRES_PASSWORD });
-    if (url === generated)
-      return;
-  }
-  return url;
-}
-var SETUP_POSTGRES_USER = "secondlayer";
-var SETUP_POSTGRES_DB = "secondlayer";
-function setupDatabaseUrl(config, secrets) {
-  if (secrets.databaseUrl)
-    return secrets.databaseUrl;
-  const password = encodeURIComponent(secrets.postgresPassword);
-  return `postgres://${SETUP_POSTGRES_USER}:${password}@${normalizeLoopbackHost(config.postgresPort)}/${SETUP_POSTGRES_DB}`;
-}
-function normalizeLoopbackHost(apiPort) {
-  return apiPort.includes(":") ? apiPort : `127.0.0.1:${apiPort}`;
-}
-function readEnvFile(dir, envPath) {
-  const shared = loadExistingInstanceEnv(dir, ".env");
-  return {
-    ...shared,
-    POSTGRES_PASSWORD: readEnvValue(envPath, "POSTGRES_PASSWORD"),
-    POSTGRES_PORT: readEnvValue(envPath, "POSTGRES_PORT"),
-    BITCOIN_RPC_PASSWORD: readEnvValue(envPath, "BITCOIN_RPC_PASSWORD"),
-    DATABASE_URL: readEnvValue(envPath, "DATABASE_URL")
-  };
-}
-function renderSetupEnv(config, secrets) {
-  const i = secrets.instance;
-  const lines = [
-    "# Generated by `secondlayer setup`. Do not commit.",
-    `NETWORK=${config.network}`,
-    `STACKS_NETWORK=${config.network}`,
-    `NODE_MODE=${config.nodeMode}`,
-    `API_PORT=${config.apiPort}`,
-    `INDEXER_PORT=${config.indexerPort}`,
-    `POSTGRES_USER=${SETUP_POSTGRES_USER}`,
-    `POSTGRES_PASSWORD=${secrets.postgresPassword}`,
-    `POSTGRES_DB=${SETUP_POSTGRES_DB}`,
-    `POSTGRES_PORT=${config.postgresPort}`,
-    "# Where bootstrap, verify, repair, and backup connect from this directory:",
-    "# the compose Postgres above, published on the host. Point it elsewhere",
-    "# only if you moved the index.",
-    `DATABASE_URL=${escapeEnvValue(setupDatabaseUrl(config, secrets))}`,
-    "# The instance credential. The API validates bearer tokens against it,",
-    "# and the CLI/SDK/MCP read it first when authenticating.",
-    `INSTANCE_TOKEN=${i.INSTANCE_TOKEN}`,
-    `SECONDLAYER_SECRETS_KEY=${i.SECONDLAYER_SECRETS_KEY}`,
-    `STREAMS_SIGNING_PRIVATE_KEY=${escapeEnvValue(i.STREAMS_SIGNING_PRIVATE_KEY)}`,
-    `SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY=${escapeEnvValue(i.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY)}`,
-    `ALLOW_UNSIGNED_WEBHOOKS=${i.ALLOW_UNSIGNED_WEBHOOKS}`,
-    `SECONDLAYER_API_URL=${i.SECONDLAYER_API_URL}`
-  ];
-  if (i.SECONDLAYER_API_KEY) {
-    lines.push("# Hosted account key for archive credits (sk-sl_*).", `SECONDLAYER_API_KEY=${i.SECONDLAYER_API_KEY}`);
-  }
-  lines.push("# Archive trust root: bootstrap, verify, and repair check manifests", "# against this key. Replace it to pin a different archive.", `ARCHIVE_SIGNING_PUBLIC_KEY=${escapeEnvValue(i.ARCHIVE_SIGNING_PUBLIC_KEY)}`);
-  if (config.nodeMode === "full") {
-    lines.push("BITCOIN_RPC_USER=stacks", `BITCOIN_RPC_PASSWORD=${secrets.bitcoinRpcPassword}`);
-  }
-  lines.push("");
-  return lines.join(`
-`);
-}
-async function writeSetupFiles(config, secrets) {
-  const composePath = join16(config.dir, "docker-compose.yml");
-  const envPath = join16(config.dir, ".env");
-  await writeFile6(composePath, buildOssCompose({ owner: config.owner, imageTag: config.imageTag }));
-  await writeFile6(envPath, renderSetupEnv(config, secrets), { mode: 384 });
-  const result = { composePath, envPath };
-  if (config.nodeMode === "full") {
-    const configTomlPath = join16(config.dir, "Config.toml");
-    await writeFile6(configTomlPath, buildOssStacksConfigToml({
-      network: config.network,
-      bitcoinRpcPassword: secrets.bitcoinRpcPassword ?? ""
-    }));
-    result.configTomlPath = configTomlPath;
-  }
-  if (config.nodeMode === "full") {
-    const bitcoinConfPath = join16(config.dir, "bitcoin.conf");
-    await writeFile6(bitcoinConfPath, buildOssBitcoinConf({ rpcPassword: secrets.bitcoinRpcPassword ?? "" }));
-    result.bitcoinConfPath = bitcoinConfPath;
-  }
-  return result;
-}
-function composeProfileArgs(nodeMode) {
-  if (nodeMode === "full")
-    return ["--profile", "full-node"];
-  return [];
-}
-function runStreaming(command, args, opts) {
-  return new Promise((resolvePromise, reject) => {
-    const child = spawn3(command, args, {
-      cwd: opts.cwd,
-      env: opts.env ?? process.env,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
-    let stdout = "";
-    let stderr = "";
-    const pump = (stream) => (chunk) => {
-      const text = chunk.toString("utf8");
-      if (stream === "stdout")
-        stdout += text;
-      else
-        stderr += text;
-      if (opts.onLine) {
-        for (const line of text.split(`
-`)) {
-          if (line.length > 0)
-            opts.onLine(line, stream);
-        }
-      }
-    };
-    child.stdout?.on("data", pump("stdout"));
-    child.stderr?.on("data", pump("stderr"));
-    child.once("error", reject);
-    child.once("close", (code) => {
-      resolvePromise({ code: code ?? 1, stdout, stderr });
-    });
-  });
-}
-async function dockerComposeUp(config, files, onLine) {
-  const args = [
-    "compose",
-    "-f",
-    files.composePath,
-    "--env-file",
-    files.envPath,
-    ...composeProfileArgs(config.nodeMode),
-    "up",
-    "-d"
-  ];
-  return runStreaming("docker", args, { cwd: config.dir, onLine });
-}
-async function pollHealth(config, opts = {}) {
-  const timeoutMs = opts.timeoutMs ?? 120000;
-  const intervalMs = opts.intervalMs ?? 2000;
-  const url = `http://${normalizeLoopbackHost(config.apiPort)}/health`;
-  const deadline = Date.now() + timeoutMs;
-  for (;; ) {
-    try {
-      const res = await fetch(url, { signal: AbortSignal.timeout(3000) });
-      if (res.ok)
-        return true;
-    } catch {}
-    opts.onTick?.();
-    if (Date.now() >= deadline)
-      return false;
-    await new Promise((r) => setTimeout(r, intervalMs));
-  }
-}
-function getObserverInfo(config) {
-  if (config.nodeMode !== "external") {
-    return { applicable: false };
-  }
-  const endpoint = defaultObserverEndpoint(config.network);
-  const stanza = renderObserverStanza({
-    mode: "indexer",
-    endpoint,
-    network: config.network
-  });
-  return { applicable: true, stanza, endpoint };
-}
-function cliEntry() {
-  const entry = process.argv[1];
-  if (!entry) {
-    throw new Error("Could not resolve the secondlayer CLI entry to shell out to.");
-  }
-  return [process.execPath, entry];
-}
-var CHILD_ENV_KEYS = [
-  "DATABASE_URL",
-  "ARCHIVE_SIGNING_PUBLIC_KEY",
-  "SECONDLAYER_API_URL",
-  "INSTANCE_TOKEN"
-];
-function buildChildEnv(envPath, base = process.env) {
-  const env = { ...base };
-  for (const key of CHILD_ENV_KEYS) {
-    const value = readEnvValue(envPath, key);
-    if (value)
-      env[key] = value;
-  }
-  return env;
-}
-async function checkDatabaseReachable(databaseUrl) {
-  try {
-    const client = getRawClientFor(databaseUrl);
-    await client`SELECT 1`;
-    return { ok: true };
-  } catch (err) {
-    return {
-      ok: false,
-      error: err instanceof Error ? err.message : String(err)
-    };
-  } finally {
-    await closeDb2().catch(() => {});
-  }
-}
-async function preflightBootstrapDatabase(config, secrets, emit) {
-  const databaseUrl = setupDatabaseUrl(config, secrets);
-  const reachable = await checkDatabaseReachable(databaseUrl);
-  if (!reachable.ok) {
-    emit({
-      type: "step-error",
-      step: "bootstrap",
-      message: `Postgres at ${redactUrl(databaseUrl)} did not answer SELECT 1: ${reachable.error}. Check \`docker compose logs postgres\`, then re-run setup to resume.`
-    });
-    return null;
-  }
-  emit({
-    type: "step-log",
-    step: "bootstrap",
-    line: `database ${redactUrl(databaseUrl)}`
-  });
-  return databaseUrl;
-}
-async function runBootstrap(config, against, files, onLine) {
-  const [command, ...prefix] = cliEntry();
-  const args = [...prefix, "bootstrap", "--against", against, "--yes"];
-  return runStreaming(command, args, {
-    cwd: config.dir,
-    env: buildChildEnv(files.envPath),
-    onLine
-  });
-}
-async function runVerify(config, against, files, onLine) {
-  const [command, ...prefix] = cliEntry();
-  const args = [...prefix, "verify", "all", "--against", against];
-  return runStreaming(command, args, {
-    cwd: config.dir,
-    env: buildChildEnv(files.envPath),
-    onLine
-  });
-}
-function redactUrl(url) {
-  try {
-    const u = new URL(url);
-    if (u.password)
-      u.password = "***";
-    return u.toString();
-  } catch {
-    return url;
-  }
-}
-function buildSuccessSummary(config, secrets) {
-  const apiUrl = `http://${normalizeLoopbackHost(config.apiPort)}`;
-  const lines = [
-    "Secondlayer is up.",
-    "",
-    `  api        ${apiUrl}`,
-    `  network    ${config.network}`,
-    `  node mode  ${config.nodeMode}`,
-    `  dir        ${config.dir}`,
-    "",
-    "Export the instance token for writes (reads on loopback need no credential):",
-    `  export INSTANCE_TOKEN=${secrets.instance.INSTANCE_TOKEN}`,
-    "",
-    "Try it:",
-    "  secondlayer subgraphs create my-balances --from-contract SP....my-contract",
-    "  secondlayer subgraphs deploy subgraphs/my-balances.ts",
-    `  curl ${apiUrl}/v1/subgraphs/my-balances/balances`,
-    "",
-    "Docs: https://secondlayer.tools/docs/self-host"
-  ];
-  return lines.join(`
-`);
-}
-async function runSetup(initialConfig, emit) {
-  let config = initialConfig;
-  emit({ type: "step-start", step: "preflight" });
-  if (!await checkDocker()) {
-    emit({
-      type: "step-error",
-      step: "preflight",
-      message: "Docker isn't reachable. Start Docker Desktop/OrbStack, or install Docker, then re-run."
-    });
-    return { ok: false, config };
-  }
-  const claimedByDocker = dockerPublishedHostPorts();
-  const ports = {
-    api: await resolveAvailablePublishSpec(config.apiPort, claimedByDocker),
-    indexer: await resolveAvailablePublishSpec(config.indexerPort, claimedByDocker),
-    postgres: await resolveAvailablePublishSpec(config.postgresPort, claimedByDocker)
-  };
-  config = {
-    ...config,
-    apiPort: ports.api.spec,
-    indexerPort: ports.indexer.spec,
-    postgresPort: ports.postgres.spec
-  };
-  for (const [label, result] of [
-    ["api", ports.api],
-    ["indexer", ports.indexer],
-    ["postgres", ports.postgres]
-  ]) {
-    if (result.remapped) {
-      emit({
-        type: "step-log",
-        step: "preflight",
-        line: `${label} port was already in use locally, using ${result.spec} instead`
-      });
-    }
-  }
-  const floors = guardrailPreview(config.nodeMode, config.network);
-  emit({
-    type: "step-done",
-    step: "preflight",
-    detail: `NODE_MODE=${config.nodeMode} on ${config.network} needs at least ${floors.ramFloorMb}MB RAM and ${floors.diskFloorGb}GB disk.`
-  });
-  emit({ type: "step-start", step: "secrets" });
-  const secrets = resolveSecrets({
-    dir: config.dir,
-    network: config.network,
-    apiPort: config.apiPort,
-    force: config.force,
-    archivePublicKeyPem: await resolveArchivePublicKey({
-      envPem: process.env.ARCHIVE_SIGNING_PUBLIC_KEY ?? process.env.STREAMS_SIGNING_PUBLIC_KEY,
-      allowHostedApi: !isOssMode()
-    })
-  });
-  emit({ type: "step-done", step: "secrets" });
-  emit({ type: "step-start", step: "config" });
-  const files = await writeSetupFiles(config, secrets);
-  emit({
-    type: "step-done",
-    step: "config",
-    detail: `${files.composePath}, ${files.envPath}`
-  });
-  emit({ type: "step-start", step: "docker-up" });
-  const up = await dockerComposeUp(config, files, (line) => emit({ type: "step-log", step: "docker-up", line }));
-  if (up.code !== 0) {
-    emit({
-      type: "step-error",
-      step: "docker-up",
-      message: `docker compose up failed (exit ${up.code}).
-${up.stderr || up.stdout}`
-    });
-    return { ok: false, config, secrets, files };
-  }
-  const healthy = await pollHealth(config, {
-    onTick: () => emit({
-      type: "step-log",
-      step: "docker-up",
-      line: "waiting for /health…"
-    })
-  });
-  if (!healthy) {
-    emit({
-      type: "step-error",
-      step: "docker-up",
-      message: "Containers started but /health never came up. Check `docker compose logs`."
-    });
-    return { ok: false, config, secrets, files };
-  }
-  emit({ type: "step-done", step: "docker-up" });
-  emit({ type: "step-start", step: "observer" });
-  const observer = getObserverInfo(config);
-  if (observer.applicable && observer.stanza) {
-    emit({
-      type: "step-log",
-      step: "observer",
-      line: "ACTION REQUIRED — paste this into your Stacks node's Config.toml:"
-    });
-    for (const line of observer.stanza.split(`
-`)) {
-      if (line.length > 0)
-        emit({ type: "step-log", step: "observer", line });
-    }
-    emit({
-      type: "step-done",
-      step: "observer",
-      detail: `endpoint ${observer.endpoint} — see the ACTION REQUIRED lines above`
-    });
-  } else {
-    emit({
-      type: "step-done",
-      step: "observer",
-      detail: "bundled node — the observer is pre-configured, nothing to paste"
-    });
-  }
-  let bootstrapped = false;
-  if (config.skipBootstrap) {
-    emit({ type: "step-skip", step: "bootstrap", reason: "--skip-bootstrap" });
-  } else if (config.against) {
-    emit({ type: "step-start", step: "bootstrap" });
-    const databaseUrl = await preflightBootstrapDatabase(config, secrets, emit);
-    if (databaseUrl === null) {
-      return { ok: false, config, secrets, files, observer };
-    }
-    const res = await runBootstrap(config, config.against, files, (line) => emit({ type: "step-log", step: "bootstrap", line }));
-    if (res.code === 0) {
-      bootstrapped = true;
-      emit({ type: "step-done", step: "bootstrap" });
-    } else {
-      emit({
-        type: "step-error",
-        step: "bootstrap",
-        message: `secondlayer bootstrap exited ${res.code}.`
-      });
-    }
-  }
-  if (config.skipVerify) {
-    emit({ type: "step-skip", step: "verify", reason: "--skip-verify" });
-  } else if (!config.against) {
-    emit({
-      type: "step-skip",
-      step: "verify",
-      reason: "no manifest to verify against"
-    });
-  } else if (!bootstrapped) {
-    emit({
-      type: "step-skip",
-      step: "verify",
-      reason: "bootstrap did not run — nothing restored yet to verify"
-    });
-  } else {
-    emit({ type: "step-start", step: "verify" });
-    const res = await runVerify(config, config.against, files, (line) => emit({ type: "step-log", step: "verify", line }));
-    if (res.code === 0) {
-      emit({ type: "step-done", step: "verify" });
-    } else {
-      emit({
-        type: "step-error",
-        step: "verify",
-        message: `secondlayer verify exited ${res.code}.`
-      });
-    }
-  }
-  const summary = buildSuccessSummary(config, secrets);
-  emit({ type: "step-start", step: "summary" });
-  emit({ type: "step-done", step: "summary", detail: summary });
-  return { ok: true, config, secrets, files, observer, summary };
-}
-
-// src/lib/setup-prompts.ts
-class SetupCancelledError extends Error {
-  constructor() {
-    super("Setup cancelled — nothing was changed.");
-    this.name = "SetupCancelledError";
-  }
-}
-function safeParse(value, parse) {
-  if (!value)
-    return;
-  try {
-    return parse(value);
-  } catch {
-    return;
-  }
-}
-var NODE_MODE_DESCRIPTIONS = {
-  external: "You run the Stacks node; paste an observer stanza into its Config.toml.",
-  stacks: "You run the Stacks node yourself, no bundled bitcoind (same as external).",
-  full: "Bundled Stacks node + bitcoind."
-};
-async function promptSetupConfig(flags) {
-  const network = safeParse(flags.network, parseInstanceNetwork) ?? await select3({
-    message: "Network",
-    choices: [
-      {
-        name: "mainnet",
-        value: "mainnet",
-        description: "Production Stacks chain. Large: plan for hundreds of GB."
-      },
-      {
-        name: "testnet",
-        value: "testnet",
-        description: "Stacks testnet. Small history."
-      },
-      {
-        name: "devnet",
-        value: "devnet",
-        description: "Local Clarinet devnet."
-      }
-    ]
-  });
-  const nodeMode = safeParse(flags.nodeMode, parseSetupNodeMode) ?? await select3({
-    message: "Node mode",
-    choices: SETUP_NODE_MODES.map((mode) => {
-      const floor = guardrailPreview(mode, network);
-      return {
-        name: mode,
-        value: mode,
-        description: `${NODE_MODE_DESCRIPTIONS[mode]} needs ≥ ${(floor.ramFloorMb / 1024).toFixed(0)}GB RAM, ≥ ${floor.diskFloorGb}GB disk.`
-      };
-    })
-  });
-  let against = flags.against;
-  let skipBootstrap = !!flags.skipBootstrap;
-  if (!skipBootstrap && !against) {
-    const choice = await select3({
-      message: "Bootstrap from",
-      choices: [
-        {
-          name: "Hosted archive (recommended)",
-          value: "hosted",
-          description: DEFAULT_ARCHIVE_MANIFEST
-        },
-        {
-          name: "Custom manifest URL or path",
-          value: "custom",
-          description: "Enter your own"
-        },
-        {
-          name: "Skip the archive",
-          value: "skip",
-          description: "Index only what your node sends from now on"
-        }
-      ]
-    });
-    if (choice === "hosted") {
-      against = DEFAULT_ARCHIVE_MANIFEST;
-    } else if (choice === "skip") {
-      skipBootstrap = true;
-    } else {
-      against = (await input2({
-        message: "Manifest URL or local path",
-        default: DEFAULT_ARCHIVE_MANIFEST
-      })).trim();
-    }
-  }
-  const config = {
-    network,
-    nodeMode,
-    apiPort: flags.apiPort ?? "127.0.0.1:3800",
-    indexerPort: "127.0.0.1:3700",
-    postgresPort: "127.0.0.1:5432",
-    dir: resolvePath3(flags.dir ?? process.cwd()),
-    against: skipBootstrap ? undefined : against,
-    skipBootstrap,
-    skipVerify: !!flags.skipVerify,
-    yes: false,
-    force: !!flags.force,
-    owner: flags.owner ?? DEFAULT_IMAGE_OWNER,
-    imageTag: flags.imageTag ?? DEFAULT_IMAGE_TAG
-  };
-  console.error("");
-  console.error(`  network      ${config.network}`);
-  console.error(`  node mode    ${config.nodeMode}`);
-  console.error(`  dir          ${config.dir}`);
-  console.error(`  api port     ${config.apiPort}`);
-  console.error(`  bootstrap    ${config.skipBootstrap ? "skip (from the node's tip)" : config.against}`);
-  console.error("");
-  const proceed = await confirm4({ message: "Start setup?", default: true });
-  if (!proceed)
-    throw new SetupCancelledError;
-  return config;
-}
-
-// src/commands/setup.ts
-function renderProgress(event) {
-  switch (event.type) {
-    case "step-start":
-      note(`→ ${event.step}`);
-      return;
-    case "step-log":
-      note(`  ${event.line}`);
-      return;
-    case "step-done":
-      success(event.step + (event.detail ? `: ${event.detail}` : ""));
-      return;
-    case "step-skip":
-      note(`  skipped ${event.step} (${event.reason})`);
-      return;
-    case "step-error":
-      printError(`${event.step} failed: ${event.message}`);
-      return;
-  }
-}
-async function executeAndRender(config) {
-  console.error(bold("Secondlayer setup"));
-  console.error(dim(`  network=${config.network} node-mode=${config.nodeMode} dir=${config.dir}`));
-  console.error("");
-  let failed = false;
-  const result = await runSetup(config, (event) => {
-    if (event.type === "step-error")
-      failed = true;
-    renderProgress(event);
-  });
-  if (!result.ok) {
-    process.exit(1);
-  }
-  if (failed) {
-    warn("Setup finished with at least one step reporting an error above.");
-  }
-  console.error("");
-  if (result.summary)
-    console.log(result.summary);
-  process.exit(failed ? 1 : 0);
-}
-async function runNonInteractive(flags) {
-  let config;
-  try {
-    config = resolveNonInteractiveConfig(flags);
-  } catch (err) {
-    if (err instanceof MissingSetupFlagError) {
-      printError(err.message, { hint: `Pass ${err.flag} and re-run.` });
-    } else {
-      printError(err instanceof Error ? err.message : String(err));
-    }
-    process.exit(1);
-  }
-  await executeAndRender(config);
-}
-async function runPromptedInteractive(flags) {
-  let config;
-  try {
-    config = await promptSetupConfig(flags);
-  } catch (err) {
-    if (err instanceof SetupCancelledError) {
-      note(err.message);
-      process.exit(0);
-    }
-    printError(err instanceof Error ? err.message : String(err));
-    process.exit(1);
-  }
-  await executeAndRender(config);
-}
-function registerSetupCommand(program) {
-  program.command("setup").description("Guided self-host onboarding: secrets, config, docker, bootstrap, verify — one command").option("--node-mode <mode>", "external, stacks, or full (required)").option("--api-port <spec>", "API publish spec", "127.0.0.1:3800").option("--dir <path>", "Target directory for compose + .env", ".").option("--against <manifest>", `Archive manifest to bootstrap from (default: ${DEFAULT_ARCHIVE_MANIFEST})`).option("--skip-bootstrap", "Skip the archive restore; index only what your node sends from now on").option("--skip-verify", "Skip the post-bootstrap verify pass").option("--yes", "Non-interactive: skip the prompts, require flags, never ask").option("--force", "Regenerate secrets even if a .env already exists in --dir").option("--owner <owner>", "ghcr image owner (namespace) to pull from").option("--image-tag <tag>", "Published image tag to run").addHelpText("after", `
---network <mainnet|testnet|devnet> is the top-level global flag (see
-\`secondlayer --help\`) — required here too, just parsed one level up.
-
-Examples:
-  $ secondlayer setup
-  $ secondlayer setup --yes --network mainnet --node-mode external
-  $ secondlayer setup --yes --network testnet --node-mode external --skip-bootstrap --skip-verify
-
-Without a TTY (piped, CI, an agent), or with --yes, the prompts are skipped:
-every decision with no safe default (--network, --node-mode) must come from a
-flag or the command fails fast naming it. --against defaults to the official
-archive (${DEFAULT_ARCHIVE_MANIFEST}) unless --skip-bootstrap is set.
-`).action(async (opts) => {
-    assertInstanceUrl();
-    const flags = {
-      ...opts,
-      network: opts.network ?? process.env.STACKS_NETWORK
-    };
-    const interactive = process.stdout.isTTY && !flags.yes;
-    if (!interactive) {
-      await runNonInteractive(flags);
-      return;
-    }
-    await runPromptedInteractive(flags);
-  });
-}
 // src/cli.ts
 init_resolve_auth();
 var { version } = package_default;
@@ -209463,17 +208370,16 @@ program.hook("preAction", (thisCommand) => {
 });
 program.addHelpText("after", `
 Quickstart:
-  $ secondlayer setup
   $ secondlayer subgraphs create my-watcher --from-contract SP....my-contract
   $ git add subgraphs/my-watcher.ts
   $ secondlayer subgraphs deploy subgraphs/my-watcher.ts   # or --allow-uncommitted
 
-Manual / scripted setup, one step at a time:
+Self-host, from docker/oss in a checkout:
   $ secondlayer init --network mainnet
+  $ docker compose up -d
   $ secondlayer bootstrap --against <manifest>
 `);
 program.commandsGroup("Getting started:");
-registerSetupCommand(program);
 registerInitCommand(program);
 registerBootstrapCommand(program);
 registerObserverCommand(program);
@@ -209498,11 +208404,10 @@ registerVerifyCommand(program);
 registerRepairCommand(program);
 registerBackupCommand(program);
 registerRestoreCommand(program);
-registerUninstallCommand(program);
 program.commandsGroup("Archive:");
 registerCreditsCommand(program);
 registerArchiveCommand(program);
 program.parse();
 
-//# debugId=E9EB99B555C4CFDB64756E2164756E21
+//# debugId=C5F366E55CEA893F64756E2164756E21
 //# sourceMappingURL=cli.js.map