@secondlayer/cli 9.7.0 → 9.8.0

package/dist/cli.js

@@ -2785,8 +2785,8 @@ async function getSubgraphAgentSchema(name, options) {
 async function getSubgraphMarkdown(name, options) {
   return (await getPlatformClient()).subgraphs.markdown(name, options);
 }
-async function reindexSubgraphApi(name, options) {
-  return (await getPlatformClient()).subgraphs.reindex(name, options);
+async function reindexSubgraphApi(name) {
+  return (await getPlatformClient()).subgraphs.reindex(name);
 }
 async function backfillSubgraphApi(name, options) {
   return (await getPlatformClient()).subgraphs.backfill(name, options);
@@ -34817,7 +34817,7 @@ var {
 // package.json
 var package_default = {
   name: "@secondlayer/cli",
-  version: "9.7.0",
+  version: "9.8.0",
   repository: {
     type: "git",
     url: "git+https://github.com/ryanwaits/secondlayer.git",
@@ -34854,15 +34854,16 @@ var package_default = {
   author: "",
   license: "MIT",
   dependencies: {
+    "@biomejs/js-api": "^0.7.0",
+    "@biomejs/wasm-nodejs": "^1.9.0",
+    "@dsnp/parquetjs": "^1.8.8",
     "@inquirer/prompts": "^8.2.0",
     "@secondlayer/bundler": "^0.4.1",
     "@secondlayer/scaffold": "^1.5.1",
     "@secondlayer/sdk": "^6.51.0",
-    "@secondlayer/shared": "^7.4.0",
+    "@secondlayer/shared": "^7.7.0",
     "@secondlayer/stacks": "^3.2.0",
-    "@secondlayer/subgraphs": "^3.26.0",
-    "@biomejs/js-api": "^0.7.0",
-    "@biomejs/wasm-nodejs": "^1.9.0",
+    "@secondlayer/subgraphs": "^3.26.4",
     esbuild: "^0.27.4",
     "smol-toml": "^1.6.1",
     zod: "^4.3.6"
@@ -38626,6 +38627,696 @@ function handleProjectError(err) {
   error(err instanceof Error ? err.message : String(err));
   process.exit(1);
 }
+// src/commands/verify.ts
+import {
+  compareRangeDigests,
+  computeRangeDigest
+} from "@secondlayer/shared/archive/range-digest";
+import { getDb as getDb2 } from "@secondlayer/shared/db";
+
+// src/lib/archive-reference.ts
+import { createHash as createHash2 } from "node:crypto";
+import { readFile as readFile4 } from "node:fs/promises";
+import { dirname as dirname16, join as join13, resolve as resolve12 } from "node:path";
+import { verifyStreamsBulkManifestSignature } from "@secondlayer/shared/streams-bulk-manifest";
+function isLatestPointer(value) {
+  const pointer = value;
+  return typeof pointer.snapshot_path === "string" && (value.partitions === undefined || value.partitions.length === 0);
+}
+async function fetchJson(url) {
+  const response2 = await fetch(url, { signal: AbortSignal.timeout(30000) });
+  if (!response2.ok) {
+    throw new Error(`could not fetch manifest (${response2.status} ${response2.statusText})`);
+  }
+  return response2.json();
+}
+async function loadReference(source) {
+  const isRemote = /^https?:\/\//.test(source);
+  let manifest;
+  let root;
+  if (isRemote) {
+    manifest = await fetchJson(source);
+    const url = new URL(source);
+    url.pathname = url.pathname.replace(/\/snapshots\/[^/]+$/, "").replace(/\/[^/]+\.json$/, "");
+    root = url.toString();
+  } else {
+    const path11 = resolve12(source);
+    manifest = JSON.parse(await readFile4(path11, "utf8"));
+    root = isLatestPointer(manifest) ? dirname16(path11) : dirname16(dirname16(path11));
+  }
+  if (!isLatestPointer(manifest)) {
+    return { manifest, origin: source, root, isRemote };
+  }
+  const pointer = manifest;
+  const snapshotPath = pointer.snapshot_path;
+  const resolved = isRemote ? await fetchJson(`${root.replace(/\/$/, "")}/${snapshotPath}`) : JSON.parse(await readFile4(join13(root, snapshotPath), "utf8"));
+  if (pointer.snapshot_digest) {
+    const digest = createHash2("sha256").update(JSON.stringify((({ signature: _s, key_id: _k, ...rest }) => rest)(resolved))).digest("hex");
+    if (digest !== pointer.snapshot_digest) {
+      throw new Error(`pointer/snapshot mismatch: latest.json names ${pointer.snapshot_digest}, resolved manifest hashes to ${digest}`);
+    }
+  }
+  return { manifest: resolved, origin: source, root, isRemote };
+}
+function checkSignature(manifest, publicKeyPem, insecure) {
+  if (insecure)
+    return { verified: false, reason: "signature check skipped" };
+  if (!manifest.signature) {
+    return { verified: false, reason: "manifest carries no signature" };
+  }
+  if (!publicKeyPem) {
+    return {
+      verified: false,
+      reason: "no public key available to verify with"
+    };
+  }
+  try {
+    const verified = verifyStreamsBulkManifestSignature(manifest, publicKeyPem);
+    return {
+      verified,
+      reason: verified ? undefined : "signature did not verify"
+    };
+  } catch (err) {
+    return {
+      verified: false,
+      reason: err instanceof Error ? err.message : "signature check failed"
+    };
+  }
+}
+async function resolvePublicKey(explicitPem, apiUrl) {
+  if (explicitPem)
+    return explicitPem;
+  try {
+    const response2 = await fetch(`${apiUrl.replace(/\/$/, "")}/public/streams/signing-key`, { signal: AbortSignal.timeout(1e4) });
+    if (!response2.ok)
+      return;
+    const body = await response2.json();
+    return body.public_key_pem;
+  } catch {
+    return;
+  }
+}
+async function fetchVerifiedPartition(reference, partition) {
+  let bytes;
+  if (reference.isRemote) {
+    const url = `${reference.root.replace(/\/$/, "")}/${partition.path}`;
+    const response2 = await fetch(url, { signal: AbortSignal.timeout(300000) });
+    if (!response2.ok) {
+      throw new Error(`could not fetch ${partition.path} (${response2.status} ${response2.statusText})`);
+    }
+    bytes = Buffer.from(await response2.arrayBuffer());
+  } else {
+    bytes = await readFile4(join13(reference.root, partition.path));
+  }
+  const digest = createHash2("sha256").update(bytes).digest("hex");
+  if (digest !== partition.sha256) {
+    throw new Error(`${partition.path} failed verification: expected ${partition.sha256}, got ${digest}`);
+  }
+  return bytes;
+}
+
+// src/commands/verify.ts
+init_output();
+var VERIFY_EXIT = {
+  CLEAN: 0,
+  DIVERGED: 1,
+  UNANCHORED: 2
+};
+function parseHeight2(value, flag) {
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < 0) {
+    throw new Error(`${flag} must be a non-negative integer, got "${value}"`);
+  }
+  return parsed;
+}
+function statusLabel(status2) {
+  if (status2 === "match")
+    return green("ok");
+  if (status2 === "count-mismatch")
+    return red("rows differ");
+  if (status2 === "digest-mismatch")
+    return red("data differs");
+  return yellow("missing");
+}
+function registerVerifyCommand(program2) {
+  program2.command("verify").description("Compare local chain data against a signed archive (read-only; nothing is uploaded)").requiredOption("--against <manifest>", "archive manifest: an https URL or a local file path").option("--from-block <n>", "first height to check").option("--to-block <n>", "last height to check").option("--counts", "also compare transaction/event row counts (slower)").option("--public-key <pem>", "pin the signing key instead of fetching it").option("--insecure", "skip the manifest signature check (not recommended)").option("--json", "Output as JSON").addHelpText("after", `
+Examples:
+  $ sl verify --against https://archive.secondlayer.tools/.../snapshots/<digest>.json
+  $ sl verify --against ./snapshot.json --from-block 8000000 --to-block 8499999
+  $ sl verify --against ./snapshot.json --counts --json
+
+Exit codes:
+  0  local data matches the archive
+  1  divergence found (divergent ranges are listed)
+  2  unanchored — reference unavailable or unverifiable`).action(async (opts) => {
+    try {
+      const fromBlock = opts.fromBlock === undefined ? undefined : parseHeight2(opts.fromBlock, "--from-block");
+      const toBlock = opts.toBlock === undefined ? undefined : parseHeight2(opts.toBlock, "--to-block");
+      if (fromBlock !== undefined && toBlock !== undefined && toBlock < fromBlock) {
+        throw new Error("--to-block must be >= --from-block");
+      }
+      const { manifest, origin } = await loadReference(opts.against);
+      const publicKey = await resolvePublicKey(opts.publicKey, process.env.SL_API_URL ?? "https://api.secondlayer.tools");
+      const signature = checkSignature(manifest, publicKey, !!opts.insecure);
+      if (!signature.verified && !opts.insecure) {
+        printError(`Cannot trust the reference: ${signature.reason}.`, {
+          hint: "Pass --public-key <pem> to pin a key, or --insecure to compare anyway (result is unverified)."
+        });
+        output({
+          json: opts.json,
+          data: {
+            status: "unanchored",
+            reference: origin,
+            reason: signature.reason
+          },
+          human: () => {}
+        });
+        process.exit(VERIFY_EXIT.UNANCHORED);
+      }
+      const reference = (manifest.range_digests ?? []).filter((d2) => {
+        if (fromBlock !== undefined && d2.to_block < fromBlock)
+          return false;
+        if (toBlock !== undefined && d2.from_block > toBlock)
+          return false;
+        return true;
+      });
+      if (reference.length === 0) {
+        printError("The reference publishes no digests for that range.", {
+          hint: "Check --from-block/--to-block against the manifest's coverage."
+        });
+        process.exit(VERIFY_EXIT.UNANCHORED);
+      }
+      const db = getDb2();
+      const local = [];
+      let checked = 0;
+      for (const range of reference) {
+        local.push(await computeRangeDigest(db, range.dataset, range.from_block, range.to_block));
+        checked++;
+        if (checked % 25 === 0 || checked === reference.length) {
+          note(`  checked ${checked}/${reference.length} ranges`);
+        }
+      }
+      const comparisons = compareRangeDigests(local, reference);
+      const countChecks = [];
+      if (opts.counts && manifest.partitions) {
+        for (const partition of manifest.partitions) {
+          if (partition.dataset === "blocks")
+            continue;
+          if (fromBlock !== undefined && partition.to_block < fromBlock)
+            continue;
+          if (toBlock !== undefined && partition.from_block > toBlock)
+            continue;
+          const actual = await computeRangeDigest(db, partition.dataset, partition.from_block, partition.to_block);
+          countChecks.push({
+            dataset: partition.dataset,
+            from_block: partition.from_block,
+            to_block: partition.to_block,
+            status: actual.row_count === partition.row_count ? "match" : "count-mismatch",
+            expected_digest: null,
+            actual_digest: null,
+            expected_rows: partition.row_count,
+            actual_rows: actual.row_count
+          });
+        }
+      }
+      const all2 = [...comparisons, ...countChecks];
+      const diverged = all2.filter((c4) => c4.status !== "match");
+      const report = {
+        status: diverged.length === 0 ? "clean" : "diverged",
+        reference: origin,
+        signature_verified: signature.verified,
+        ranges_checked: all2.length,
+        divergent_ranges: diverged
+      };
+      output({
+        json: opts.json,
+        data: report,
+        human: () => {
+          if (diverged.length === 0) {
+            success(`Local data matches the archive across ${all2.length} ranges.`);
+            note(signature.verified ? "  reference signature verified" : "  reference signature NOT verified (--insecure)");
+            return;
+          }
+          warn(`${diverged.length} of ${all2.length} ranges diverge from the archive.`);
+          console.error("");
+          console.error(formatTable(["RANGE", "DATASET", "STATUS", "EXPECTED", "LOCAL"], diverged.map((d2) => [
+            `${d2.from_block}-${d2.to_block}`,
+            d2.dataset,
+            statusLabel(d2.status),
+            String(d2.expected_rows),
+            String(d2.actual_rows)
+          ])));
+          console.error("");
+          console.error(dim("These ranges hold different data than the signed archive. Repair with:"));
+          const first = diverged[0];
+          if (first) {
+            console.error(dim(`  sl repair --from-block ${first.from_block} --to-block ${first.to_block}`));
+          }
+        }
+      });
+      process.exit(diverged.length === 0 ? VERIFY_EXIT.CLEAN : VERIFY_EXIT.DIVERGED);
+    } catch (err) {
+      printError(err instanceof Error ? err.message : String(err), {
+        hint: "Set DATABASE_URL to the instance you want to verify."
+      });
+      process.exit(VERIFY_EXIT.UNANCHORED);
+    }
+  });
+}
+// src/commands/repair.ts
+import { unlink as unlink2, writeFile as writeFile5 } from "node:fs/promises";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join14 } from "node:path";
+import { ParquetReader } from "@dsnp/parquetjs";
+import {
+  compareRangeDigests as compareRangeDigests2,
+  computeRangeDigest as computeRangeDigest2
+} from "@secondlayer/shared/archive/range-digest";
+import { getDb as getDb3, sql as sql2 } from "@secondlayer/shared/db";
+init_output();
+var REPAIR_EXIT = {
+  OK: 0,
+  DIVERGENCE_REMAINS: 1,
+  UNANCHORED: 2
+};
+function asNumber(value) {
+  return typeof value === "bigint" ? Number(value) : Number(value);
+}
+function asText(value) {
+  return Buffer.isBuffer(value) ? value.toString("utf8") : String(value);
+}
+function asOptionalText(value) {
+  return value === null || value === undefined ? null : asText(value);
+}
+async function readBlocksPartition(bytes, label) {
+  const path11 = join14(tmpdir2(), `sl-repair-${label}-${process.pid}.parquet`);
+  await writeFile5(path11, bytes);
+  try {
+    const reader = await ParquetReader.openFile(path11);
+    const rows = [];
+    try {
+      const cursor = reader.getCursor();
+      for (let row = await cursor.next();row; row = await cursor.next()) {
+        rows.push({
+          height: asNumber(row.height),
+          hash: asText(row.hash),
+          parent_hash: asText(row.parent_hash),
+          burn_block_height: asNumber(row.burn_block_height),
+          burn_block_hash: asOptionalText(row.burn_block_hash),
+          index_block_hash: asOptionalText(row.index_block_hash),
+          timestamp: asNumber(row.timestamp)
+        });
+      }
+    } finally {
+      await reader.close();
+    }
+    return rows;
+  } finally {
+    await unlink2(path11).catch(() => {});
+  }
+}
+function parseHeight3(value, flag) {
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < 0) {
+    throw new Error(`${flag} must be a non-negative integer, got "${value}"`);
+  }
+  return parsed;
+}
+async function planRange(db, reference, partition) {
+  const bytes = await fetchVerifiedPartition(reference, partition);
+  const archiveBlocks = await readBlocksPartition(bytes, `${partition.from_block}-${partition.to_block}`);
+  const localRows = await db.selectFrom("blocks").select(["height", "hash"]).where("canonical", "=", true).where("height", ">=", partition.from_block).where("height", "<=", partition.to_block).execute();
+  const localByHeight = new Map(localRows.map((r2) => [Number(r2.height), r2.hash]));
+  const fixes = [];
+  for (const block of archiveBlocks) {
+    const localHash = localByHeight.get(block.height);
+    if (localHash === undefined) {
+      fixes.push({
+        height: block.height,
+        kind: "insert",
+        local_hash: null,
+        archive_hash: block.hash
+      });
+    } else if (localHash !== block.hash) {
+      fixes.push({
+        height: block.height,
+        kind: "replace",
+        local_hash: localHash,
+        archive_hash: block.hash
+      });
+    }
+    localByHeight.delete(block.height);
+  }
+  const extraHeights = [...localByHeight.keys()].sort((a4, b3) => a4 - b3);
+  return { fixes, extraHeights };
+}
+async function applyFixes(db, reference, partition, fixes) {
+  if (fixes.length === 0)
+    return 0;
+  const bytes = await fetchVerifiedPartition(reference, partition);
+  const archiveBlocks = await readBlocksPartition(bytes, `apply-${partition.from_block}`);
+  const byHeight = new Map(archiveBlocks.map((b3) => [b3.height, b3]));
+  const targets = fixes.map((fix) => byHeight.get(fix.height)).filter((b3) => b3 !== undefined);
+  await db.transaction().execute(async (tx) => {
+    for (const block of targets) {
+      await sql2`
+				INSERT INTO blocks (
+					height, hash, parent_hash, burn_block_height,
+					burn_block_hash, index_block_hash, timestamp, canonical
+				) VALUES (
+					${block.height}, ${block.hash}, ${block.parent_hash},
+					${block.burn_block_height}, ${block.burn_block_hash},
+					${block.index_block_hash}, ${block.timestamp}, true
+				)
+				ON CONFLICT (height) DO UPDATE SET
+					hash = EXCLUDED.hash,
+					parent_hash = EXCLUDED.parent_hash,
+					burn_block_height = EXCLUDED.burn_block_height,
+					burn_block_hash = EXCLUDED.burn_block_hash,
+					index_block_hash = EXCLUDED.index_block_hash,
+					timestamp = EXCLUDED.timestamp,
+					canonical = true
+			`.execute(tx);
+    }
+  });
+  return targets.length;
+}
+function registerRepairCommand(program2) {
+  program2.command("repair").description("Replace local chain data that diverges from a signed archive (dry-run by default)").requiredOption("--against <manifest>", "archive manifest: an https URL or a local file path").option("--from-block <n>", "first height to consider").option("--to-block <n>", "last height to consider").option("--apply", "write the repair (default is a dry-run plan)").option("--public-key <pem>", "pin the signing key instead of fetching it").option("--json", "Output as JSON").addHelpText("after", `
+Examples:
+  $ sl repair --against ./snapshot.json                      # plan only
+  $ sl repair --against ./snapshot.json --apply              # write the fix
+  $ sl repair --against ./snapshot.json --from-block 8500000 --to-block 8549999
+
+Exit codes:
+  0  nothing to repair, or the repair completed and re-verified clean
+  1  divergence remains (dry-run, or repair did not fully resolve it)
+  2  unanchored — reference unavailable or unverifiable`).action(async (opts) => {
+    try {
+      const fromBlock = opts.fromBlock === undefined ? undefined : parseHeight3(opts.fromBlock, "--from-block");
+      const toBlock = opts.toBlock === undefined ? undefined : parseHeight3(opts.toBlock, "--to-block");
+      const reference = await loadReference(opts.against);
+      const publicKey = await resolvePublicKey(opts.publicKey, process.env.SL_API_URL ?? "https://api.secondlayer.tools");
+      const signature = checkSignature(reference.manifest, publicKey, false);
+      if (!signature.verified) {
+        printError(`Refusing to repair from an untrusted reference: ${signature.reason}.`, {
+          hint: "Pass --public-key <pem> to pin the archive's signing key."
+        });
+        process.exit(REPAIR_EXIT.UNANCHORED);
+      }
+      const db = getDb3();
+      const inRange = (from, to) => !(fromBlock !== undefined && to < fromBlock || toBlock !== undefined && from > toBlock);
+      const referenceDigests = (reference.manifest.range_digests ?? []).filter((d2) => d2.dataset === "blocks" && inRange(d2.from_block, d2.to_block));
+      if (referenceDigests.length === 0) {
+        printError("The reference publishes no block digests for that range.", {
+          hint: "Check --from-block/--to-block against the manifest's coverage."
+        });
+        process.exit(REPAIR_EXIT.UNANCHORED);
+      }
+      const local = [];
+      for (const range of referenceDigests) {
+        local.push(await computeRangeDigest2(db, "blocks", range.from_block, range.to_block));
+      }
+      const divergent = compareRangeDigests2(local, referenceDigests).filter((c4) => c4.status !== "match");
+      if (divergent.length === 0) {
+        success("Nothing to repair — local blocks match the archive.");
+        output({
+          json: opts.json,
+          data: { status: "clean", fixes: [] },
+          human: () => {}
+        });
+        process.exit(REPAIR_EXIT.OK);
+      }
+      const partitions = (reference.manifest.partitions ?? []).filter((p2) => p2.dataset === "blocks" && divergent.some((d2) => d2.from_block === p2.from_block && d2.to_block === p2.to_block));
+      const allFixes = [];
+      const allExtra = [];
+      const planned = [];
+      for (const partition of partitions) {
+        note(`  reading ${partition.dataset} ${partition.from_block}-${partition.to_block}`);
+        const { fixes, extraHeights } = await planRange(db, reference, partition);
+        planned.push({ partition, fixes });
+        allFixes.push(...fixes);
+        allExtra.push(...extraHeights);
+      }
+      let applied = 0;
+      if (opts.apply) {
+        for (const { partition, fixes } of planned) {
+          applied += await applyFixes(db, reference, partition, fixes);
+        }
+      }
+      let remaining = divergent.length;
+      if (opts.apply) {
+        const after = [];
+        for (const range of referenceDigests) {
+          after.push(await computeRangeDigest2(db, "blocks", range.from_block, range.to_block));
+        }
+        remaining = compareRangeDigests2(after, referenceDigests).filter((c4) => c4.status !== "match").length;
+      }
+      const report = {
+        status: opts.apply ? remaining === 0 ? "repaired" : "incomplete" : "plan",
+        reference: reference.origin,
+        divergent_ranges: divergent.length,
+        blocks_to_replace: allFixes.filter((f2) => f2.kind === "replace").length,
+        blocks_to_insert: allFixes.filter((f2) => f2.kind === "insert").length,
+        local_only_heights: allExtra,
+        applied,
+        fixes: allFixes
+      };
+      output({
+        json: opts.json,
+        data: report,
+        human: () => {
+          const replace = report.blocks_to_replace;
+          const insert = report.blocks_to_insert;
+          if (opts.apply) {
+            if (remaining === 0) {
+              success(`Repaired ${applied} blocks across ${divergent.length} ranges; re-verified clean.`);
+            } else {
+              warn(`Applied ${applied} blocks but ${remaining} ranges still diverge.`);
+            }
+          } else {
+            warn(`${divergent.length} ranges diverge — ${replace} blocks to replace, ${insert} to insert.`);
+          }
+          if (allFixes.length > 0) {
+            console.error("");
+            console.error(formatTable(["HEIGHT", "ACTION", "LOCAL", "ARCHIVE"], allFixes.slice(0, 20).map((f2) => [
+              String(f2.height),
+              f2.kind,
+              (f2.local_hash ?? "—").slice(0, 18),
+              f2.archive_hash.slice(0, 18)
+            ])));
+            if (allFixes.length > 20) {
+              console.error(dim(`  … and ${allFixes.length - 20} more`));
+            }
+          }
+          if (allExtra.length > 0) {
+            console.error("");
+            warn(`${allExtra.length} local heights are absent from the archive (e.g. ${allExtra.slice(0, 5).join(", ")}).`);
+            console.error(dim("  These are NOT removed — transactions and events reference them."));
+          }
+          if (!opts.apply) {
+            console.error("");
+            console.error(dim("(dry-run — pass --apply to write the repair)"));
+          } else {
+            console.error("");
+            console.error(dim("Decoded rows for repaired heights are not rebuilt here — re-run your decoders for these ranges."));
+          }
+        }
+      });
+      process.exit(opts.apply && remaining === 0 ? REPAIR_EXIT.OK : REPAIR_EXIT.DIVERGENCE_REMAINS);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      const hint = /failed verification/.test(message) ? "The archive object does not match its signed digest — re-download it, and report this if it persists." : /could not fetch/.test(message) ? "Check the archive URL and your network connection." : "Set DATABASE_URL to the instance you want to repair.";
+      printError(message, { hint });
+      process.exit(REPAIR_EXIT.UNANCHORED);
+    }
+  });
+}
+// src/commands/bootstrap.ts
+import { unlink as unlink3, writeFile as writeFile6 } from "node:fs/promises";
+import { tmpdir as tmpdir3 } from "node:os";
+import { join as join15 } from "node:path";
+import { ParquetReader as ParquetReader2 } from "@dsnp/parquetjs";
+import { confirm as confirm7 } from "@inquirer/prompts";
+import {
+  copyStatement,
+  writeRowsToCopyStream
+} from "@secondlayer/shared/archive/copy-loader";
+import { computeRangeDigest as computeRangeDigest3 } from "@secondlayer/shared/archive/range-digest";
+import { getDb as getDb4, getRawClient } from "@secondlayer/shared/db";
+init_output();
+var BOOTSTRAP_EXIT = {
+  OK: 0,
+  INCOMPLETE: 1,
+  REFUSED: 2
+};
+var BLOCKS_PER_DAY_ESTIMATE = 5400;
+var RESTORE_ROWS_PER_SECOND = 30000;
+function formatDuration2(seconds2) {
+  if (seconds2 < 90)
+    return `${Math.round(seconds2)}s`;
+  if (seconds2 < 5400)
+    return `${Math.round(seconds2 / 60)} min`;
+  if (seconds2 < 172800)
+    return `${(seconds2 / 3600).toFixed(1)} hours`;
+  return `${(seconds2 / 86400).toFixed(1)} days`;
+}
+async function* readPartitionRows(bytes, label) {
+  const path11 = join15(tmpdir3(), `sl-bootstrap-${label}-${process.pid}.parquet`);
+  await writeFile6(path11, bytes);
+  try {
+    const reader = await ParquetReader2.openFile(path11);
+    try {
+      const cursor = reader.getCursor();
+      for (let row = await cursor.next();row; row = await cursor.next()) {
+        yield row;
+      }
+    } finally {
+      await reader.close();
+    }
+  } finally {
+    await unlink3(path11).catch(() => {});
+  }
+}
+async function loadPartition(reference, partition, rawClient) {
+  const bytes = await fetchVerifiedPartition(reference, partition);
+  const writable2 = await rawClient.unsafe(copyStatement(partition.dataset)).writable();
+  const written = await writeRowsToCopyStream({
+    writable: writable2,
+    dataset: partition.dataset,
+    rows: readPartitionRows(bytes, `${partition.dataset}-${partition.from_block}`)
+  });
+  if (written !== partition.row_count) {
+    throw new Error(`${partition.path}: loaded ${written} rows, manifest declares ${partition.row_count}`);
+  }
+  return written;
+}
+function registerBootstrapCommand(program2) {
+  program2.command("bootstrap").description("Restore chain history from a verified archive instead of syncing from genesis").requiredOption("--against <manifest>", "archive manifest: an https URL or a local file path").option("--to-block <n>", "stop at this height instead of the archive tip").option("--public-key <pem>", "pin the signing key instead of fetching it").option("-y, --yes", "skip the confirmation prompt").option("--json", "Output as JSON").addHelpText("after", `
+Examples:
+  $ sl bootstrap --against https://archive.secondlayer.tools/.../snapshots/<digest>.json
+  $ sl bootstrap --against ./snapshot.json --to-block 4000000 --yes
+
+Exit codes:
+  0  restored and verified
+  1  restore completed but verification found divergence
+  2  refused (non-empty target, or an untrusted reference)`).action(async (opts) => {
+    try {
+      const reference = await loadReference(opts.against);
+      const publicKey = await resolvePublicKey(opts.publicKey, process.env.SL_API_URL ?? "https://api.secondlayer.tools");
+      const signature = checkSignature(reference.manifest, publicKey, false);
+      if (!signature.verified) {
+        printError(`Refusing to bootstrap from an untrusted archive: ${signature.reason}.`, {
+          hint: "Pass --public-key <pem> to pin the archive's signing key."
+        });
+        process.exit(BOOTSTRAP_EXIT.REFUSED);
+      }
+      const db = getDb4();
+      const existing = await db.selectFrom("blocks").select(({ fn }) => fn.countAll().as("count")).executeTakeFirst();
+      if (Number(existing?.count ?? 0) > 0) {
+        printError("This database already holds blocks.", {
+          hint: "Bootstrap is for a fresh instance. To fix an existing one, use `sl repair`."
+        });
+        process.exit(BOOTSTRAP_EXIT.REFUSED);
+      }
+      const toBlock = opts.toBlock === undefined ? undefined : Number(opts.toBlock);
+      const partitions = (reference.manifest.partitions ?? []).filter((p2) => toBlock === undefined || p2.to_block <= toBlock);
+      if (partitions.length === 0) {
+        printError("The archive has no partitions for that range.", {
+          hint: "Check --to-block against the manifest's coverage."
+        });
+        process.exit(BOOTSTRAP_EXIT.REFUSED);
+      }
+      const totalRows = partitions.reduce((sum, p2) => sum + p2.row_count, 0);
+      const totalBytes = partitions.reduce((sum, p2) => sum + p2.byte_size, 0);
+      const tipHeight = Math.max(...partitions.map((p2) => p2.to_block));
+      const restoreSeconds = totalRows / RESTORE_ROWS_PER_SECOND;
+      const genesisSeconds = tipHeight / BLOCKS_PER_DAY_ESTIMATE * 86400;
+      if (!opts.json) {
+        console.error("");
+        console.error(formatKeyValue([
+          ["archive", reference.origin],
+          ["coverage", `genesis → ${tipHeight.toLocaleString()}`],
+          ["rows", totalRows.toLocaleString()],
+          ["download", `${(totalBytes / 1e9).toFixed(1)} GB`],
+          ["signature", "verified"]
+        ]));
+        console.error("");
+        console.error(`  sync from genesis   ${bold(`~${formatDuration2(genesisSeconds)}`)} ${dim("(estimate)")}`);
+        console.error(`  restore from archive ${bold(`~${formatDuration2(restoreSeconds)}`)}`);
+        console.error("");
+      }
+      if (!opts.yes && !opts.json) {
+        const proceed = await confirm7({
+          message: "Restore from the verified archive?",
+          default: true
+        });
+        if (!proceed) {
+          note("Nothing was written.");
+          process.exit(BOOTSTRAP_EXIT.REFUSED);
+        }
+      }
+      const order = ["blocks", "transactions", "events"];
+      const rawClient = getRawClient("source");
+      const loaded = { blocks: 0, transactions: 0, events: 0 };
+      const startedAt = Date.now();
+      for (const dataset of order) {
+        const datasetPartitions = partitions.filter((p2) => p2.dataset === dataset).sort((a4, b3) => a4.from_block - b3.from_block);
+        for (const [index, partition] of datasetPartitions.entries()) {
+          loaded[dataset] += await loadPartition(reference, partition, rawClient);
+          const done = index + 1;
+          if (done % 10 === 0 || done === datasetPartitions.length) {
+            const elapsed2 = (Date.now() - startedAt) / 1000;
+            note(`  ${dataset}: ${done}/${datasetPartitions.length} partitions · ${loaded[dataset].toLocaleString()} rows · ${formatDuration2(elapsed2)} elapsed`);
+          }
+        }
+      }
+      const referenceDigests = (reference.manifest.range_digests ?? []).filter((d2) => d2.dataset === "blocks" && d2.to_block <= tipHeight);
+      let divergent = 0;
+      for (const range of referenceDigests) {
+        const actual = await computeRangeDigest3(db, "blocks", range.from_block, range.to_block);
+        if (actual.digest !== range.digest || actual.row_count !== range.row_count) {
+          divergent++;
+        }
+      }
+      const elapsed = (Date.now() - startedAt) / 1000;
+      const report = {
+        status: divergent === 0 ? "restored" : "divergent",
+        archive: reference.origin,
+        tip_height: tipHeight,
+        rows: loaded,
+        ranges_verified: referenceDigests.length,
+        divergent_ranges: divergent,
+        elapsed_seconds: Math.round(elapsed)
+      };
+      output({
+        json: opts.json,
+        data: report,
+        human: () => {
+          if (divergent === 0) {
+            success(`Restored ${loaded.blocks.toLocaleString()} blocks, ${loaded.transactions.toLocaleString()} transactions, ${loaded.events.toLocaleString()} events in ${formatDuration2(elapsed)}.`);
+            if (referenceDigests.length > 0) {
+              note(`  verified ${referenceDigests.length} ranges against the archive`);
+            } else {
+              warn("  archive published no block digests — restore is unverified");
+            }
+            console.error("");
+            console.error(dim(`Your instance holds history through ${tipHeight.toLocaleString()}. Start the indexer to continue from there.`));
+          } else {
+            warn(`Restored ${loaded.blocks.toLocaleString()} blocks but ${divergent} ranges do not match the archive.`);
+            console.error(dim("  Investigate with: sl verify --against <manifest>"));
+          }
+        }
+      });
+      process.exit(divergent === 0 ? BOOTSTRAP_EXIT.OK : BOOTSTRAP_EXIT.INCOMPLETE);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      const hint = /failed verification/.test(message) ? "An archive object does not match its signed digest — re-download and retry." : /could not fetch/.test(message) ? "Check the archive URL and your network connection." : "Set DATABASE_URL to the (empty) instance you want to bootstrap.";
+      printError(message, { hint });
+      process.exit(BOOTSTRAP_EXIT.REFUSED);
+    }
+  });
+}
 // src/cli.ts
 var { version } = package_default;
 program.name("secondlayer").alias("sl").description("SecondLayer CLI — dedicated Stacks indexing + real-time subgraphs").version(version).option("--network <network>", "Override network (local, testnet, mainnet)").option("--api-key <key>", "API credential (overrides SL_API_KEY)").option("--api-url <url>", "API endpoint (overrides SL_API_URL)").showSuggestionAfterError(true).showHelpAfterError("(run `sl --help` to see available commands)");
@@ -38682,10 +39373,13 @@ registerStatusCommand(program);
 registerDoctorCommand(program);
 registerConfigCommand(program);
 registerContextCommand(program);
+registerBootstrapCommand(program);
+registerVerifyCommand(program);
+registerRepairCommand(program);
 program.commandsGroup("Account:");
 registerAccountCommand(program);
 registerKeysCommand(program);
 program.parse();
 
-//# debugId=C3BB2E9E464137CA64756E2164756E21
+//# debugId=C0418C213027DA8564756E2164756E21
 //# sourceMappingURL=cli.js.map