@secondlayer/cli 9.10.0 → 10.1.0

package/dist/cli.js

@@ -2481,6 +2481,25 @@ var require_commander = __commonJS((exports) => {
   exports.InvalidOptionArgumentError = InvalidArgumentError;
 });
 
+// ../../node_modules/commander/esm.mjs
+var import__, program, createCommand, createArgument, createOption, CommanderError, InvalidArgumentError, InvalidOptionArgumentError, Command, Argument, Option, Help;
+var init_esm = __esm(() => {
+  import__ = __toESM(require_commander(), 1);
+  ({
+    program,
+    createCommand,
+    createArgument,
+    createOption,
+    CommanderError,
+    InvalidArgumentError,
+    InvalidOptionArgumentError,
+    Command,
+    Argument,
+    Option,
+    Help
+  } = import__.default);
+});
+
 // src/lib/session.ts
 import {
   chmod,
@@ -2543,6 +2562,9 @@ async function resolveAuth() {
   if (envKey) {
     return { apiUrl, ephemeralKey: envKey, fromEnv: true };
   }
+  if (isOssMode()) {
+    return { apiUrl, ephemeralKey: "", fromEnv: true };
+  }
   const session = await readSession();
   if (!session) {
     const err = new Error("Not logged in — run `sl login`");
@@ -2551,6 +2573,9 @@ async function resolveAuth() {
   }
   return { apiUrl, ephemeralKey: session.token, fromEnv: false };
 }
+function isOssMode() {
+  return !!process.env.SL_API_URL;
+}
 var DEFAULT_API_URL = "https://api.secondlayer.tools";
 var init_resolve_auth = __esm(() => {
   init_session();
@@ -2590,7 +2615,7 @@ async function httpPlatform(path2, opts = {}) {
   try {
     auth = await resolveAuth();
   } catch {
-    throw new CliHttpError(401, "SESSION_EXPIRED", { error: "Not logged in" }, "Not logged in — run `sl login`");
+    throw new CliHttpError(401, "SESSION_EXPIRED", { error: "Not logged in" }, isOssMode() ? "Not authenticated — set SL_API_KEY from `sl init`" : "Not logged in — run `sl login`");
   }
   return request(`${auth.apiUrl}${path2}`, {
     ...opts,
@@ -2745,7 +2770,7 @@ function handleApiError(err, action) {
   const status = err instanceof ApiError || err instanceof CliHttpError ? err.status : undefined;
   if (err instanceof CliHttpError && err.code === "SESSION_EXPIRED" || status === 401) {
     printError("Authentication required.", {
-      hint: "Run `sl login` to re-authenticate."
+      hint: isOssMode() ? "Set SL_API_KEY / INSTANCE_TOKEN from `sl init`." : "Run `sl login` to re-authenticate."
     });
     process.exit(1);
   }
@@ -28826,7 +28851,7 @@ async function runLoginFlow(options3 = {}) {
   }
 }
 function registerLoginCommand(program2) {
-  program2.command("login").description("Log in to Secondlayer (magic-link email)").option("--force", "Skip the already-logged-in check and re-run the flow").option("--with-token", "Read an API key from stdin (non-interactive)").addHelpText("after", `
+  program2.command("login", { hidden: true }).description("Log in to Secondlayer (magic-link email)").option("--force", "Skip the already-logged-in check and re-run the flow").option("--with-token", "Read an API key from stdin (non-interactive)").addHelpText("after", `
 Examples:
   $ sl login
   $ echo "$SL_API_KEY" | sl login --with-token`).action((opts) => opts.withToken ? runTokenLogin() : runLoginFlow({ force: opts.force }));
@@ -28839,6 +28864,8 @@ var init_login = __esm(() => {
 
 // src/lib/require-auth.ts
 async function requireAuth() {
+  if (isOssMode())
+    return;
   const session = await readSession();
   if (session)
     return;
@@ -28848,6 +28875,7 @@ async function requireAuth() {
 var init_require_auth = __esm(() => {
   init_login();
   init_output();
+  init_resolve_auth();
   init_session();
 });
 
@@ -30104,7 +30132,7 @@ Stopped watching.`);
     });
     await new Promise(() => {});
   });
-  subgraphs.command("deploy <file>").alias("update").description("Deploy a subgraph definition file (alias: update — deploy is create-or-update)").option("--start-block <n>", "Override the subgraph definition startBlock for this deploy").option("--tip-first", "Go live at chain tip immediately; history backfills in the background (requires order-tolerant handlers — commutative or insert-only writes)").option("--dry-run", "Validate and preview deploy without writing changes").option("-y, --yes", "Skip the reindex confirmation prompt").option("--database-url <url>", "BYO data plane: write the subgraph's schema/rows to your own Postgres. With --dry-run, prints the DDL + grant script and verifies the connection.").option("--strict", "Run `tsc --noEmit` against the handler before deploy (slower; catches TS type errors)").option("--visibility <visibility>", "Read visibility: public (anon /v1 reads, global name claim) or private (your key only). Defaults: managed → public, BYO → private.").option("--allow-uncommitted", "Deploy even though the source file is not committed to git (the deployed definition will exist only in the database)").action(async (file, options3) => {
+  subgraphs.command("deploy <file>").alias("update").description("Deploy a subgraph definition file (alias: update — deploy is create-or-update)").option("--start-block <n>", "Override the subgraph definition startBlock for this deploy").option("--tip-first", "Go live at chain tip immediately; history backfills in the background (requires order-tolerant handlers — commutative or insert-only writes)").option("--dry-run", "Validate and preview deploy without writing changes").option("-y, --yes", "Skip the reindex confirmation prompt").option("--database-url <url>", "BYO data plane: write the subgraph's schema/rows to your own Postgres. With --dry-run, prints the DDL + grant script and verifies the connection.").option("--strict", "Run `tsc --noEmit` against the handler before deploy (slower; catches TS type errors)").addOption(new Option("--visibility <visibility>", "Hosted only. Public/private namespace.").hideHelp()).option("--allow-uncommitted", "Deploy even though the source file is not committed to git (the deployed definition will exist only in the database)").action(async (file, options3) => {
     try {
       const absPath = resolve3(file);
       if (!options3.dryRun) {
@@ -30132,7 +30160,7 @@ Stopped watching.`);
         }
       }
       const config = await loadConfig2();
-      if (config.network !== "local") {
+      if (config.network !== "local" && !isOssMode()) {
         await requireAuth();
       }
       const dryRun = options3.dryRun;
@@ -30666,7 +30694,7 @@ ${rows.length} row(s)`));
       handleApiError(err, "delete subgraph");
     }
   });
-  subgraphs.command("publish <name>").description("Make a subgraph publicly readable on /v1/subgraphs/<name> (claims the name globally, no key needed to read)").action(async (name) => {
+  subgraphs.command("publish <name>", { hidden: true }).description("Make a subgraph publicly readable on /v1/subgraphs/<name> (claims the name globally, no key needed to read)").action(async (name) => {
     try {
       await requireAuth();
       const result = await publishSubgraphApi(name);
@@ -30684,7 +30712,7 @@ ${rows.length} row(s)`));
       handleApiError(err, "publish subgraph");
     }
   });
-  subgraphs.command("unpublish <name>").description("Make a subgraph private again — reads require your API key, the public name claim is released").action(async (name) => {
+  subgraphs.command("unpublish <name>", { hidden: true }).description("Make a subgraph private again — reads require your API key, the public name claim is released").action(async (name) => {
     try {
       await requireAuth();
       await unpublishSubgraphApi(name);
@@ -30839,6 +30867,7 @@ async function runSubgraphSchemaCodegen(file, options3, optionSource, defaultTar
 }
 var ORM_ONLY_CODEGEN_FLAGS;
 var init_subgraphs2 = __esm(() => {
+  init_esm();
   init_subgraph_scaffold();
   init_subgraphs();
   init_api_client();
@@ -30850,6 +30879,7 @@ var init_subgraphs2 = __esm(() => {
   init_output();
   init_require_auth();
   init_resolve_auth();
+  init_resolve_auth();
   init_clarity();
   init_subgraph();
   init_api();
@@ -34749,75 +34779,12 @@ var init_node_impl = __esm(() => {
   init_output();
 });
 
-// src/commands/init.ts
-var exports_init = {};
-__export(exports_init, {
-  init: () => init2
-});
-import { promises as fs7 } from "node:fs";
-import path11 from "node:path";
-async function init2() {
-  const configPath = path11.join(process.cwd(), "secondlayer.config.ts");
-  try {
-    await fs7.access(configPath);
-    console.log(source_default.yellow("⚠ secondlayer.config.ts already exists"));
-    return;
-  } catch {}
-  const hasClarinetProject = await fileExists2("./Clarinet.toml");
-  let config;
-  if (hasClarinetProject) {
-    config = `import { defineConfig } from '@secondlayer/cli';
-import { clarinet } from '@secondlayer/cli/plugins';
-
-export default defineConfig({
-  out: './src/generated/contracts.ts',
-  plugins: [
-    clarinet() // Found Clarinet.toml in current directory
-  ]
-});`;
-  } else {
-    config = `import { defineConfig } from '@secondlayer/cli';
-
-export default defineConfig({
-  out: './src/generated/contracts.ts',
-  plugins: [],
-});`;
-  }
-  await fs7.writeFile(configPath, config);
-  console.log(source_default.green("✓ Created `secondlayer.config.ts`"));
-  console.log("\nRun `secondlayer generate` to generate type-safe interfaces, functions, and hooks!");
-}
-async function fileExists2(filePath) {
-  try {
-    await fs7.access(filePath);
-    return true;
-  } catch {
-    return false;
-  }
-}
-var init_init = __esm(() => {
-  init_source();
-});
-
-// ../../node_modules/commander/esm.mjs
-var import__ = __toESM(require_commander(), 1);
-var {
-  program,
-  createCommand,
-  createArgument,
-  createOption,
-  CommanderError,
-  InvalidArgumentError,
-  InvalidOptionArgumentError,
-  Command,
-  Argument,
-  Option,
-  Help
-} = import__.default;
+// src/cli.ts
+init_esm();
 // package.json
 var package_default = {
   name: "@secondlayer/cli",
-  version: "9.10.0",
+  version: "10.1.0",
   repository: {
     type: "git",
     url: "git+https://github.com/ryanwaits/secondlayer.git",
@@ -34858,10 +34825,10 @@ var package_default = {
     "@biomejs/wasm-nodejs": "^1.9.0",
     "@dsnp/parquetjs": "^1.8.8",
     "@inquirer/prompts": "^8.2.0",
-    "@secondlayer/bundler": "^0.4.1",
+    "@secondlayer/bundler": "^0.5.0",
     "@secondlayer/scaffold": "^1.5.1",
     "@secondlayer/sdk": "^6.51.0",
-    "@secondlayer/shared": "^7.8.0",
+    "@secondlayer/shared": "^7.10.0",
     "@secondlayer/stacks": "^3.3.1",
     "@secondlayer/subgraphs": "^3.26.4",
     esbuild: "^0.27.4",
@@ -35003,7 +34970,7 @@ async function applyProfileUpdate(options, getOptionValueSource) {
   });
 }
 function registerAccountCommand(program2) {
-  const account = program2.command("account").description("Manage your account profile");
+  const account = program2.command("account", { hidden: true }).description("Manage your account profile");
   addBillingCommand(account);
   account.command("get").description("Show your account profile").option("--json", "Output as JSON").action(withErrorHandling(async (options) => showProfile(options.json), { action: "show profile" }));
   account.command("update").description("Update your public profile").option("--name <name>", "Set display name").option("--bio <bio>", "Set bio").option("--slug <slug>", "Set public URL slug").option("--notify-reindex-complete", "Email me when a subgraph reindex finishes").option("--no-notify-reindex-complete", "Don't email me when a subgraph reindex finishes").option("--json", "Output as JSON").action(withErrorHandling(async (options, command) => applyProfileUpdate(options, (key) => command.getOptionValueSource(key)), {
@@ -36536,6 +36503,7 @@ function buildDevnetCompose(opts = {}) {
   const indexerImage = `ghcr.io/${owner}/secondlayer-indexer:${tag}`;
   const dbUrl = "postgres://secondlayer:secondlayer@postgres:5432/secondlayer";
   const DEV_SECRETS_KEY = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef";
+  const DEV_INSTANCE_TOKEN = "dev-instance-token";
   return `# Generated by \`sl devnet connect\` — do not edit by hand.
 # Secondlayer app services for local clarinet devnet development.
 name: secondlayer-devnet
@@ -36572,6 +36540,8 @@ services:
       INSTANCE_MODE: oss
       DATABASE_URL: ${dbUrl}
       PORT: 3800
+      LISTEN_HOST: "0.0.0.0"
+      INSTANCE_TOKEN: ${DEV_INSTANCE_TOKEN}
       NODE_ENV: production
       DATA_DIR: /data
       # Shared across api + subgraph-processor so the secret the api encrypts
@@ -37317,7 +37287,7 @@ init_resolve_auth();
 import { SecondLayer as SecondLayer4 } from "@secondlayer/sdk";
 var DEFAULT_BASE_URL4 = "https://api.secondlayer.tools";
 function registerKeysCommand(program2) {
-  const keys = program2.command("keys").description("Manage API keys");
+  const keys = program2.command("keys", { hidden: true }).description("Manage API keys");
   keys.command("create").description("Mint a scoped streams/index read key (requires an account-level key)").option("--product <product>", "Key scope: streams or index", "streams").option("--name <name>", "Optional label for the key").option("--json", "Print the full response as JSON").action(async (o3) => {
     if (o3.product && o3.product !== "streams" && o3.product !== "index") {
       error("--product must be 'streams' or 'index'");
@@ -38607,7 +38577,7 @@ async function writeActiveProject(slug, cwd) {
 // src/commands/whoami.ts
 init_resolve_auth();
 function registerWhoamiCommand(program2) {
-  program2.command("whoami").description("Show the active account, credential source, and project").option("--json", "Output as JSON").action(async (options3) => {
+  program2.command("whoami", { hidden: true }).description("Show the active account, credential source, and project").option("--json", "Output as JSON").action(async (options3) => {
     let auth;
     try {
       auth = await resolveAuth();
@@ -38663,7 +38633,7 @@ init_http();
 init_output();
 init_session();
 function registerLogoutCommand(program2) {
-  program2.command("logout").description("Log out and revoke the local session").action(async () => {
+  program2.command("logout", { hidden: true }).description("Log out and revoke the local session").action(async () => {
     const session = await readSession();
     if (!session) {
       info("Not logged in.");
@@ -38685,7 +38655,7 @@ init_config2();
 init_http();
 init_output();
 function registerProjectCommand(program2) {
-  const project = program2.command("projects").alias("project").description("Manage your Secondlayer project");
+  const project = program2.command("projects", { hidden: true }).alias("project").description("Manage your Secondlayer project");
   project.command("list").alias("ls").description("List projects in your account").option("--json", "Output as JSON").action(async (options3) => {
     try {
       const res = await httpPlatform("/api/projects");
@@ -38764,6 +38734,15 @@ import {
   compareRangeDigests,
   computeRangeDigest
 } from "@secondlayer/shared/archive/range-digest";
+import {
+  comparePartitionSemanticDigests,
+  computePartitionSemanticDigest
+} from "@secondlayer/shared/archive/semantic-digest-builder";
+import {
+  datasetMatchesTarget,
+  parseVerifyTarget,
+  reportVerify
+} from "@secondlayer/shared/coverage";
 import { getDb as getDb2 } from "@secondlayer/shared/db";
 
 // src/lib/archive-reference.ts
@@ -38840,6 +38819,7 @@ function checkSignature(manifest, publicKeyPem, insecure) {
     };
   }
 }
+var HOSTED_API = "https://api.secondlayer.tools";
 async function resolvePublicKey(explicitPem, apiUrl) {
   if (explicitPem)
     return explicitPem;
@@ -38853,6 +38833,16 @@ async function resolvePublicKey(explicitPem, apiUrl) {
     return;
   }
 }
+async function resolveArchivePublicKey(input4) {
+  if (input4.explicitPem)
+    return input4.explicitPem;
+  if (input4.envPem)
+    return input4.envPem;
+  if (input4.allowHostedApi) {
+    return resolvePublicKey(undefined, HOSTED_API);
+  }
+  return;
+}
 async function fetchVerifiedPartition(reference, partition) {
   let bytes;
   if (reference.isRemote) {
@@ -38896,17 +38886,21 @@ function statusLabel(status2) {
   return yellow("missing");
 }
 function registerVerifyCommand(program2) {
-  program2.command("verify").description("Compare local chain data against a signed archive (read-only; nothing is uploaded)").requiredOption("--against <manifest>", "archive manifest: an https URL or a local file path").option("--from-block <n>", "first height to check").option("--to-block <n>", "last height to check").option("--counts", "also compare transaction/event row counts (slower)").option("--public-key <pem>", "pin the signing key instead of fetching it").option("--insecure", "skip the manifest signature check (not recommended)").option("--json", "Output as JSON").addHelpText("after", `
+  program2.command("verify").description("Compare local chain data against a signed archive (read-only; nothing is uploaded)").argument("[target]", "all | raw | decode:<name> | subgraph:<name>", "raw").option("--quick", "coverage/identity only (default)").option("--deep", "include semantic / scratch replay where available").option("--anchor", "require a verified archive signature").requiredOption("--against <manifest>", "archive manifest: an https URL or a local file path").option("--from-block <n>", "first height to check").option("--to-block <n>", "last height to check").option("--counts", "also compare transaction/event row counts (slower)").option("--semantic", "also recompute per-partition semantic digests locally and compare (slow: full re-stream)").option("--public-key <pem>", "pin the signing key instead of fetching it").option("--insecure", "skip the manifest signature check (not recommended)").option("--json", "Output as JSON").addHelpText("after", `
 Examples:
   $ sl verify --against https://archive.secondlayer.tools/.../snapshots/<digest>.json
-  $ sl verify --against ./snapshot.json --from-block 8000000 --to-block 8499999
-  $ sl verify --against ./snapshot.json --counts --json
+  $ sl verify raw --against ./snapshot.json --from-block 8000000 --to-block 8499999
+  $ sl verify all --against ./snapshot.json --json
+  $ sl verify decode:ft_transfer --against ./snapshot.json --quick
+  $ sl verify subgraph:sbtc --against ./snapshot.json --deep
 
 Exit codes:
   0  local data matches the archive
   1  divergence found (divergent ranges are listed)
-  2  unanchored — reference unavailable or unverifiable`).action(async (opts) => {
+  2  unanchored — reference unavailable or unverifiable`).action(async (targetArg, opts) => {
     try {
+      const target = parseVerifyTarget(targetArg);
+      const mode = opts.deep ? "deep" : opts.anchor ? "anchor" : "quick";
       const fromBlock = opts.fromBlock === undefined ? undefined : parseHeight2(opts.fromBlock, "--from-block");
       const toBlock = opts.toBlock === undefined ? undefined : parseHeight2(opts.toBlock, "--to-block");
       if (fromBlock !== undefined && toBlock !== undefined && toBlock < fromBlock) {
@@ -38922,6 +38916,12 @@ Exit codes:
         output({
           json: opts.json,
           data: {
+            ...reportVerify({
+              target,
+              mode,
+              anchored: false,
+              detail: signature.reason
+            }),
             status: "unanchored",
             reference: origin,
             reason: signature.reason
@@ -38931,6 +38931,8 @@ Exit codes:
         process.exit(VERIFY_EXIT.UNANCHORED);
       }
       const reference = (manifest.range_digests ?? []).filter((d2) => {
+        if (!datasetMatchesTarget(d2.dataset, target))
+          return false;
         if (fromBlock !== undefined && d2.to_block < fromBlock)
           return false;
         if (toBlock !== undefined && d2.from_block > toBlock)
@@ -38976,13 +38978,60 @@ Exit codes:
           });
         }
       }
-      const all2 = [...comparisons, ...countChecks];
+      const semanticChecks = [];
+      const referenceSemantic = (manifest.partition_semantic_digests ?? []).filter((d2) => {
+        if (!datasetMatchesTarget(d2.dataset, target))
+          return false;
+        if (fromBlock !== undefined && d2.to_block < fromBlock)
+          return false;
+        if (toBlock !== undefined && d2.from_block > toBlock)
+          return false;
+        return true;
+      });
+      if (opts.semantic || opts.deep) {
+        if (referenceSemantic.length === 0) {
+          warn("Reference publishes no semantic digests; --semantic had nothing to compare.");
+        } else {
+          note(`Recomputing ${referenceSemantic.length} partition semantic digests (this is the slow pass).`);
+          const localSemantic = [];
+          let semanticDone = 0;
+          for (const partition of referenceSemantic) {
+            localSemantic.push(await computePartitionSemanticDigest(db, partition.dataset, partition.from_block, partition.to_block));
+            semanticDone++;
+            if (semanticDone % 5 === 0 || semanticDone === referenceSemantic.length) {
+              note(`  checked ${semanticDone}/${referenceSemantic.length} partitions`);
+            }
+          }
+          semanticChecks.push(...comparePartitionSemanticDigests(localSemantic, referenceSemantic));
+        }
+      }
+      const all2 = [
+        ...comparisons,
+        ...countChecks,
+        ...semanticChecks.map((s2) => ({
+          dataset: s2.dataset,
+          from_block: s2.from_block,
+          to_block: s2.to_block,
+          status: s2.status,
+          expected_digest: s2.expected_digest,
+          actual_digest: s2.actual_digest,
+          expected_rows: s2.expected_rows,
+          actual_rows: s2.actual_rows
+        }))
+      ];
       const diverged = all2.filter((c4) => c4.status !== "match");
+      const verdict = reportVerify({
+        target,
+        mode,
+        diverged: diverged.length > 0
+      });
       const report = {
-        status: diverged.length === 0 ? "clean" : "diverged",
+        ...verdict,
+        status: verdict.status,
         reference: origin,
         signature_verified: signature.verified,
         ranges_checked: all2.length,
+        semantic_checks: semanticChecks.length,
         divergent_ranges: diverged
       };
       output({
@@ -39281,7 +39330,35 @@ import {
 } from "@secondlayer/shared/archive/copy-loader";
 import { computeRangeDigest as computeRangeDigest3 } from "@secondlayer/shared/archive/range-digest";
 import { getDb as getDb4, getRawClient, sql as sql3 } from "@secondlayer/shared/db";
+
+// src/lib/bootstrap-resume.ts
+function planTornImport(input4) {
+  if (input4.hasIndexProgress) {
+    return {
+      action: "refuse",
+      reason: "This database already holds a completed bootstrap."
+    };
+  }
+  if (input4.maxBlockHeight === null || input4.maxBlockHeight <= 0) {
+    return { action: "fresh" };
+  }
+  const blockPartitions = input4.partitions.filter((p2) => p2.dataset === "blocks").sort((a4, b3) => a4.from_block - b3.from_block);
+  const sealed = blockPartitions.filter((p2) => p2.to_block <= (input4.maxBlockHeight ?? 0));
+  const skipThrough = sealed.length > 0 ? Math.max(...sealed.map((p2) => p2.to_block)) : 0;
+  const torn = blockPartitions.find((p2) => p2.from_block <= (input4.maxBlockHeight ?? 0) && p2.to_block > (input4.maxBlockHeight ?? 0));
+  return {
+    action: "resume",
+    truncateFrom: torn ? torn.from_block : null,
+    skipThrough
+  };
+}
+function partitionIsLoaded(partition, skipThrough) {
+  return partition.to_block <= skipThrough;
+}
+
+// src/commands/bootstrap.ts
 init_output();
+init_resolve_auth();
 var BOOTSTRAP_EXIT = {
   OK: 0,
   INCOMPLETE: 1,
@@ -39342,8 +39419,8 @@ async function loadPartition(reference, partition, rawClient) {
   }
   return written;
 }
-function registerBootstrapCommand(program2) {
-  program2.command("bootstrap").description("Restore chain history from a verified archive instead of syncing from genesis").requiredOption("--against <manifest>", "archive manifest: an https URL or a local file path").option("--to-block <n>", "stop at this height instead of the archive tip").option("--public-key <pem>", "pin the signing key instead of fetching it").option("-y, --yes", "skip the confirmation prompt").option("--json", "Output as JSON").addHelpText("after", `
+function attachBootstrapCommand(cmd) {
+  return cmd.requiredOption("--against <manifest>", "archive manifest: an https URL or a local file path").option("--to-block <n>", "stop at this height instead of the archive tip").option("--public-key <pem>", "pin the signing key instead of fetching it").option("-y, --yes", "skip the confirmation prompt").option("--json", "Output as JSON").addHelpText("after", `
 Examples:
   $ sl bootstrap --against https://archive.secondlayer.tools/.../snapshots/<digest>.json
   $ sl bootstrap --against ./snapshot.json --to-block 4000000 --yes
@@ -39354,7 +39431,11 @@ Exit codes:
   2  refused (non-empty target, or an untrusted reference)`).action(async (opts) => {
     try {
       const reference = await loadReference(opts.against);
-      const publicKey = await resolvePublicKey(opts.publicKey, process.env.SL_API_URL ?? "https://api.secondlayer.tools");
+      const publicKey = await resolveArchivePublicKey({
+        explicitPem: opts.publicKey,
+        envPem: process.env.ARCHIVE_SIGNING_PUBLIC_KEY ?? process.env.STREAMS_SIGNING_PUBLIC_KEY,
+        allowHostedApi: !isOssMode()
+      });
       const signature = checkSignature(reference.manifest, publicKey, false);
       if (!signature.verified) {
         printError(`Refusing to bootstrap from an untrusted archive: ${signature.reason}.`, {
@@ -39363,15 +39444,31 @@ Exit codes:
         process.exit(BOOTSTRAP_EXIT.REFUSED);
       }
       const db = getDb4();
-      const existing = await db.selectFrom("blocks").select(({ fn }) => fn.countAll().as("count")).executeTakeFirst();
-      if (Number(existing?.count ?? 0) > 0) {
-        printError("This database already holds blocks.", {
+      const progress = await db.selectFrom("index_progress").select("network").executeTakeFirst();
+      const maxHeightRow = await db.selectFrom("blocks").select(({ fn }) => fn.max("height").as("max")).executeTakeFirst();
+      const maxBlockHeight = maxHeightRow?.max === null || maxHeightRow?.max === undefined ? null : Number(maxHeightRow.max);
+      const toBlock = opts.toBlock === undefined ? undefined : Number(opts.toBlock);
+      const declared = (reference.manifest.partitions ?? []).filter((p2) => toBlock === undefined || p2.to_block <= toBlock);
+      const resume = planTornImport({
+        hasIndexProgress: !!progress,
+        maxBlockHeight,
+        partitions: declared
+      });
+      if (resume.action === "refuse") {
+        printError(resume.reason, {
           hint: "Bootstrap is for a fresh instance. To fix an existing one, use `sl repair`."
         });
         process.exit(BOOTSTRAP_EXIT.REFUSED);
       }
-      const toBlock = opts.toBlock === undefined ? undefined : Number(opts.toBlock);
-      const partitions = (reference.manifest.partitions ?? []).filter((p2) => toBlock === undefined || p2.to_block <= toBlock);
+      if (resume.action === "resume" && resume.truncateFrom !== null) {
+        await sql3`DELETE FROM events WHERE block_height >= ${resume.truncateFrom}`.execute(db);
+        await sql3`DELETE FROM transactions WHERE block_height >= ${resume.truncateFrom}`.execute(db);
+        await sql3`DELETE FROM blocks WHERE height >= ${resume.truncateFrom}`.execute(db);
+        note(`Resuming torn import: truncated from height ${resume.truncateFrom}.`);
+      } else if (resume.action === "resume") {
+        note(`Resuming import after sealed height ${resume.skipThrough.toLocaleString()}.`);
+      }
+      const partitions = declared.filter((p2) => resume.action === "fresh" || !partitionIsLoaded(p2, resume.skipThrough));
       if (partitions.length === 0) {
         printError("The archive has no partitions for that range.", {
           hint: "Check --to-block against the manifest's coverage."
@@ -39496,9 +39593,217 @@ Exit codes:
     }
   });
 }
+function registerBootstrapCommand(program2) {
+  attachBootstrapCommand(program2.command("bootstrap").description("Restore chain history from a verified archive instead of syncing from genesis"));
+}
+// src/lib/instance-init.ts
+import { randomBytes as randomBytes3 } from "node:crypto";
+import { existsSync as existsSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "node:fs";
+import { resolve as resolve13 } from "node:path";
+import { generateEd25519KeyPair } from "@secondlayer/shared/crypto/ed25519";
+import { INSTANCE_NETWORKS } from "@secondlayer/shared/db/queries/instance";
+var INSTANCE_ENV_FILE = ".env.local";
+function parseInstanceNetwork(value) {
+  const network = value.trim().toLowerCase();
+  if (INSTANCE_NETWORKS.includes(network)) {
+    return network;
+  }
+  throw new Error(`network must be mainnet, testnet, or devnet (got ${value})`);
+}
+function generateInstanceToken() {
+  return randomBytes3(32).toString("hex");
+}
+function generateSecretsKey() {
+  return randomBytes3(32).toString("hex");
+}
+function generateSigningPrivateKey() {
+  return generateEd25519KeyPair().privateKeyPem;
+}
+function escapeEnvValue(value) {
+  if (!/[\s#"']/.test(value) && !value.includes("\\"))
+    return value;
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n")}"`;
+}
+function unescapeEnvValue(raw) {
+  let value = raw.trim();
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    value = value.slice(1, -1);
+  }
+  return value.replace(/\\n/g, `
+`).replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+}
+function readEnvValue(envPath, key) {
+  if (!existsSync8(envPath))
+    return null;
+  const match = readFileSync7(envPath, "utf8").match(new RegExp(`^${key}=(.*)$`, "m"));
+  return match ? unescapeEnvValue(match[1]) : null;
+}
+function buildInstanceEnv(input4) {
+  const token = input4.existing?.INSTANCE_TOKEN || input4.existing?.SL_API_KEY || generateInstanceToken();
+  const secrets = input4.existing?.SECONDLAYER_SECRETS_KEY || generateSecretsKey();
+  const signing = input4.existing?.STREAMS_SIGNING_PRIVATE_KEY || input4.existing?.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY || generateSigningPrivateKey();
+  const apiUrl = input4.apiUrl ?? "http://127.0.0.1:3800";
+  const archiveKey = input4.existing?.ARCHIVE_SIGNING_PUBLIC_KEY;
+  return {
+    INSTANCE_MODE: "oss",
+    STACKS_NETWORK: input4.network,
+    INSTANCE_TOKEN: token,
+    SECONDLAYER_SECRETS_KEY: secrets,
+    STREAMS_SIGNING_PRIVATE_KEY: signing,
+    SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY: signing,
+    ALLOW_UNSIGNED_WEBHOOKS: "false",
+    SL_API_URL: input4.existing?.SL_API_URL || apiUrl,
+    SL_API_KEY: token,
+    ...archiveKey ? { ARCHIVE_SIGNING_PUBLIC_KEY: archiveKey } : {}
+  };
+}
+function renderInstanceEnv(env2) {
+  const lines2 = [
+    "# Generated by sl init. Do not commit.",
+    `INSTANCE_MODE=${env2.INSTANCE_MODE}`,
+    `STACKS_NETWORK=${env2.STACKS_NETWORK}`,
+    `INSTANCE_TOKEN=${env2.INSTANCE_TOKEN}`,
+    `SECONDLAYER_SECRETS_KEY=${env2.SECONDLAYER_SECRETS_KEY}`,
+    `STREAMS_SIGNING_PRIVATE_KEY=${escapeEnvValue(env2.STREAMS_SIGNING_PRIVATE_KEY)}`,
+    `SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY=${escapeEnvValue(env2.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY)}`,
+    `ALLOW_UNSIGNED_WEBHOOKS=${env2.ALLOW_UNSIGNED_WEBHOOKS}`,
+    `SL_API_URL=${env2.SL_API_URL}`,
+    `SL_API_KEY=${env2.SL_API_KEY}`
+  ];
+  if (env2.ARCHIVE_SIGNING_PUBLIC_KEY) {
+    lines2.push(`ARCHIVE_SIGNING_PUBLIC_KEY=${escapeEnvValue(env2.ARCHIVE_SIGNING_PUBLIC_KEY)}`);
+  }
+  lines2.push("");
+  return lines2.join(`
+`);
+}
+function writeInstanceEnv(cwd, env2, file = INSTANCE_ENV_FILE) {
+  const path11 = resolve13(cwd, file);
+  writeFileSync7(path11, renderInstanceEnv(env2), { mode: 384 });
+  return path11;
+}
+function loadExistingInstanceEnv(cwd, file = INSTANCE_ENV_FILE) {
+  const path11 = resolve13(cwd, file);
+  return {
+    INSTANCE_TOKEN: readEnvValue(path11, "INSTANCE_TOKEN"),
+    SECONDLAYER_SECRETS_KEY: readEnvValue(path11, "SECONDLAYER_SECRETS_KEY"),
+    STREAMS_SIGNING_PRIVATE_KEY: readEnvValue(path11, "STREAMS_SIGNING_PRIVATE_KEY"),
+    SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY: readEnvValue(path11, "SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY"),
+    SL_API_URL: readEnvValue(path11, "SL_API_URL"),
+    SL_API_KEY: readEnvValue(path11, "SL_API_KEY"),
+    ARCHIVE_SIGNING_PUBLIC_KEY: readEnvValue(path11, "ARCHIVE_SIGNING_PUBLIC_KEY")
+  };
+}
+
+// src/commands/init.ts
+init_output();
+function registerInitCommand(program2) {
+  program2.command("init").description("Write local env (token, secrets key, webhook signing key). Idempotent.").option("--network <network>", "mainnet, testnet, or devnet", process.env.STACKS_NETWORK ?? "mainnet").option("--api-url <url>", "Local API URL", "http://127.0.0.1:3800").option("--force", "Overwrite generated values even if .env.local exists").action((opts) => {
+    const network = parseInstanceNetwork(opts.network);
+    const existing = opts.force ? {} : loadExistingInstanceEnv(process.cwd());
+    const env2 = buildInstanceEnv({
+      network,
+      existing,
+      apiUrl: opts.apiUrl
+    });
+    const path11 = writeInstanceEnv(process.cwd(), env2);
+    success(`Wrote ${INSTANCE_ENV_FILE}`);
+    note(formatKeyValue([
+      ["network", env2.STACKS_NETWORK],
+      ["api", env2.SL_API_URL],
+      ["env", path11]
+    ]));
+    note("Export these or pass --env-file to compose. Do not commit the file.");
+  });
+}
+// src/lib/observer-stanza.ts
+var OBSERVER_MODES = ["indexer", "signer-shared"];
+var RECOVERY_SOURCES = ["journal", "archive"];
+
+class UnsupportedObserverError extends Error {
+  name = "UnsupportedObserverError";
+}
+function parseObserverMode(value) {
+  const mode = value.trim().toLowerCase();
+  if (OBSERVER_MODES.includes(mode)) {
+    return mode;
+  }
+  throw new UnsupportedObserverError(`observer mode must be indexer or signer-shared (got ${value})`);
+}
+function parseRecoverySource(value) {
+  const source = value.trim().toLowerCase();
+  if (RECOVERY_SOURCES.includes(source)) {
+    return source;
+  }
+  throw new UnsupportedObserverError(`recovery source must be journal or archive (got ${value})`);
+}
+function parseObserverEndpoint(value) {
+  const trimmed = value.trim();
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed) || trimmed.startsWith("unix:")) {
+    throw new UnsupportedObserverError(`observer endpoint must be host:port, not a URL (${value})`);
+  }
+  const match = trimmed.match(/^([a-zA-Z0-9._-]+):(\d+)$/);
+  if (!match) {
+    throw new UnsupportedObserverError(`observer endpoint must be host:port (got ${value})`);
+  }
+  const port = Number(match[2]);
+  if (port < 1 || port > 65535) {
+    throw new UnsupportedObserverError(`observer port out of range (${port})`);
+  }
+  return trimmed;
+}
+var LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "::1"]);
+function validateObserverStanza(input4) {
+  const endpoint = parseObserverEndpoint(input4.endpoint);
+  const host = endpoint.slice(0, endpoint.lastIndexOf(":"));
+  if (input4.network !== "devnet" && LOOPBACK_HOSTS.has(host.toLowerCase())) {
+    throw new UnsupportedObserverError(`loopback observer endpoint is not container-visible on ${input4.network}; use a docker DNS name such as indexer:3700`);
+  }
+  if (input4.mode === "signer-shared" && !input4.recovery) {
+    throw new UnsupportedObserverError("signer-shared mode requires --recovery journal or --recovery archive");
+  }
+  return { endpoint };
+}
+function renderObserverStanza(input4) {
+  const { endpoint } = validateObserverStanza(input4);
+  const indexer = input4.mode === "indexer";
+  const timeoutMs = indexer ? 2000 : 500;
+  const disableRetries = !indexer;
+  const comment = indexer ? "# Pure indexer: retry delivery. A slow observer can stall the node." : "# Signer-shared: do not retry. Missed blocks refill from the journal/archive.";
+  return [
+    comment,
+    "[[events_observer]]",
+    `endpoint = "${endpoint}"`,
+    'events_keys = ["*"]',
+    `timeout_ms = ${timeoutMs}`,
+    `disable_retries = ${disableRetries}`,
+    ""
+  ].join(`
+`);
+}
+function defaultObserverEndpoint(network) {
+  if (network === "devnet")
+    return "127.0.0.1:3700";
+  return "indexer:3700";
+}
+
+// src/commands/observer.ts
+init_output();
+function registerObserverCommand(program2) {
+  program2.command("observer").description("Print the Stacks events_observer stanza for this node mode").option("--mode <mode>", "indexer (retry) or signer-shared (no retry)", "indexer").option("--endpoint <host:port>", "Observer callback the node will POST to").option("--recovery <source>", "Required for signer-shared: journal or archive").option("--network <network>", "mainnet, testnet, or devnet", process.env.STACKS_NETWORK ?? "mainnet").action((opts) => {
+    const mode = parseObserverMode(opts.mode);
+    const network = parseInstanceNetwork(opts.network);
+    const endpoint = opts.endpoint ?? defaultObserverEndpoint(network);
+    const recovery = opts.recovery ? parseRecoverySource(opts.recovery) : undefined;
+    if (mode === "signer-shared") {
+      note("Signer-shared nodes skip observer retries. Pair with a journal or archive for completeness.");
+    }
+    writeData(renderObserverStanza({ mode, endpoint, network, recovery }));
+  });
+}
 // src/cli.ts
 var { version } = package_default;
-program.name("secondlayer").alias("sl").description("SecondLayer CLI — dedicated Stacks indexing + real-time subgraphs").version(version).option("--network <network>", "Override network (local, testnet, mainnet)").option("--api-key <key>", "API credential (overrides SL_API_KEY)").option("--api-url <url>", "API endpoint (overrides SL_API_URL)").showSuggestionAfterError(true).showHelpAfterError("(run `sl --help` to see available commands)");
+program.name("secondlayer").alias("sl").description("Secondlayer CLI — self-hosted Stacks data runtime").version(version).option("--network <network>", "Override network (local, testnet, mainnet)").option("--api-key <key>", "API credential (overrides SL_API_KEY)").option("--api-url <url>", "API endpoint (overrides SL_API_URL)").showSuggestionAfterError(true).showHelpAfterError("(run `sl --help` to see available commands)");
 program.hook("preAction", (thisCommand) => {
   const { network, apiKey, apiUrl } = thisCommand.opts();
   if (network)
@@ -39510,16 +39815,15 @@ program.hook("preAction", (thisCommand) => {
 });
 program.addHelpText("after", `
 Quickstart:
-  $ sl login                        # Authenticate (magic-link email)
+  $ sl init --network mainnet
+  $ sl bootstrap --against <manifest>
   $ sl subgraphs create my-watcher --template sip-010-balances
   $ sl subgraphs deploy subgraphs/my-watcher.ts
-  $ sl subgraphs status my-watcher
 `);
 program.commandsGroup("Getting started:");
-program.command("init").description("Initialize a new secondlayer.config.ts file").action(async () => {
-  const { init: init3 } = await Promise.resolve().then(() => (init_init(), exports_init));
-  await init3();
-});
+registerInitCommand(program);
+registerBootstrapCommand(program);
+registerObserverCommand(program);
 registerLoginCommand(program);
 registerLogoutCommand(program);
 registerWhoamiCommand(program);
@@ -39552,7 +39856,6 @@ registerStatusCommand(program);
 registerDoctorCommand(program);
 registerConfigCommand(program);
 registerContextCommand(program);
-registerBootstrapCommand(program);
 registerVerifyCommand(program);
 registerRepairCommand(program);
 program.commandsGroup("Account:");
@@ -39560,5 +39863,5 @@ registerAccountCommand(program);
 registerKeysCommand(program);
 program.parse();
 
-//# debugId=D839AA90F21AC3D964756E2164756E21
+//# debugId=43937D51F562F20264756E2164756E21
 //# sourceMappingURL=cli.js.map