@secondlayer/cli 9.9.0 → 10.0.0

package/dist/cli.js

@@ -2481,6 +2481,25 @@ var require_commander = __commonJS((exports) => {
   exports.InvalidOptionArgumentError = InvalidArgumentError;
 });
 
+// ../../node_modules/commander/esm.mjs
+var import__, program, createCommand, createArgument, createOption, CommanderError, InvalidArgumentError, InvalidOptionArgumentError, Command, Argument, Option, Help;
+var init_esm = __esm(() => {
+  import__ = __toESM(require_commander(), 1);
+  ({
+    program,
+    createCommand,
+    createArgument,
+    createOption,
+    CommanderError,
+    InvalidArgumentError,
+    InvalidOptionArgumentError,
+    Command,
+    Argument,
+    Option,
+    Help
+  } = import__.default);
+});
+
 // src/lib/session.ts
 import {
   chmod,
@@ -2543,6 +2562,9 @@ async function resolveAuth() {
   if (envKey) {
     return { apiUrl, ephemeralKey: envKey, fromEnv: true };
   }
+  if (isOssMode()) {
+    return { apiUrl, ephemeralKey: "", fromEnv: true };
+  }
   const session = await readSession();
   if (!session) {
     const err = new Error("Not logged in — run `sl login`");
@@ -2551,6 +2573,9 @@ async function resolveAuth() {
   }
   return { apiUrl, ephemeralKey: session.token, fromEnv: false };
 }
+function isOssMode() {
+  return !!process.env.SL_API_URL;
+}
 var DEFAULT_API_URL = "https://api.secondlayer.tools";
 var init_resolve_auth = __esm(() => {
   init_session();
@@ -2590,7 +2615,7 @@ async function httpPlatform(path2, opts = {}) {
   try {
     auth = await resolveAuth();
   } catch {
-    throw new CliHttpError(401, "SESSION_EXPIRED", { error: "Not logged in" }, "Not logged in — run `sl login`");
+    throw new CliHttpError(401, "SESSION_EXPIRED", { error: "Not logged in" }, isOssMode() ? "Not authenticated — set SL_API_KEY from `sl init`" : "Not logged in — run `sl login`");
   }
   return request(`${auth.apiUrl}${path2}`, {
     ...opts,
@@ -2745,7 +2770,7 @@ function handleApiError(err, action) {
   const status = err instanceof ApiError || err instanceof CliHttpError ? err.status : undefined;
   if (err instanceof CliHttpError && err.code === "SESSION_EXPIRED" || status === 401) {
     printError("Authentication required.", {
-      hint: "Run `sl login` to re-authenticate."
+      hint: isOssMode() ? "Set SL_API_KEY / INSTANCE_TOKEN from `sl init`." : "Run `sl login` to re-authenticate."
     });
     process.exit(1);
   }
@@ -28826,7 +28851,7 @@ async function runLoginFlow(options3 = {}) {
   }
 }
 function registerLoginCommand(program2) {
-  program2.command("login").description("Log in to Secondlayer (magic-link email)").option("--force", "Skip the already-logged-in check and re-run the flow").option("--with-token", "Read an API key from stdin (non-interactive)").addHelpText("after", `
+  program2.command("login", { hidden: true }).description("Log in to Secondlayer (magic-link email)").option("--force", "Skip the already-logged-in check and re-run the flow").option("--with-token", "Read an API key from stdin (non-interactive)").addHelpText("after", `
 Examples:
   $ sl login
   $ echo "$SL_API_KEY" | sl login --with-token`).action((opts) => opts.withToken ? runTokenLogin() : runLoginFlow({ force: opts.force }));
@@ -28839,6 +28864,8 @@ var init_login = __esm(() => {
 
 // src/lib/require-auth.ts
 async function requireAuth() {
+  if (isOssMode())
+    return;
   const session = await readSession();
   if (session)
     return;
@@ -28848,6 +28875,7 @@ async function requireAuth() {
 var init_require_auth = __esm(() => {
   init_login();
   init_output();
+  init_resolve_auth();
   init_session();
 });
 
@@ -30104,7 +30132,7 @@ Stopped watching.`);
     });
     await new Promise(() => {});
   });
-  subgraphs.command("deploy <file>").alias("update").description("Deploy a subgraph definition file (alias: update — deploy is create-or-update)").option("--start-block <n>", "Override the subgraph definition startBlock for this deploy").option("--tip-first", "Go live at chain tip immediately; history backfills in the background (requires order-tolerant handlers — commutative or insert-only writes)").option("--dry-run", "Validate and preview deploy without writing changes").option("-y, --yes", "Skip the reindex confirmation prompt").option("--database-url <url>", "BYO data plane: write the subgraph's schema/rows to your own Postgres. With --dry-run, prints the DDL + grant script and verifies the connection.").option("--strict", "Run `tsc --noEmit` against the handler before deploy (slower; catches TS type errors)").option("--visibility <visibility>", "Read visibility: public (anon /v1 reads, global name claim) or private (your key only). Defaults: managed → public, BYO → private.").option("--allow-uncommitted", "Deploy even though the source file is not committed to git (the deployed definition will exist only in the database)").action(async (file, options3) => {
+  subgraphs.command("deploy <file>").alias("update").description("Deploy a subgraph definition file (alias: update — deploy is create-or-update)").option("--start-block <n>", "Override the subgraph definition startBlock for this deploy").option("--tip-first", "Go live at chain tip immediately; history backfills in the background (requires order-tolerant handlers — commutative or insert-only writes)").option("--dry-run", "Validate and preview deploy without writing changes").option("-y, --yes", "Skip the reindex confirmation prompt").option("--database-url <url>", "BYO data plane: write the subgraph's schema/rows to your own Postgres. With --dry-run, prints the DDL + grant script and verifies the connection.").option("--strict", "Run `tsc --noEmit` against the handler before deploy (slower; catches TS type errors)").addOption(new Option("--visibility <visibility>", "Hosted only. Public/private namespace.").hideHelp()).option("--allow-uncommitted", "Deploy even though the source file is not committed to git (the deployed definition will exist only in the database)").action(async (file, options3) => {
     try {
       const absPath = resolve3(file);
       if (!options3.dryRun) {
@@ -30132,7 +30160,7 @@ Stopped watching.`);
         }
       }
       const config = await loadConfig2();
-      if (config.network !== "local") {
+      if (config.network !== "local" && !isOssMode()) {
         await requireAuth();
       }
       const dryRun = options3.dryRun;
@@ -30666,7 +30694,7 @@ ${rows.length} row(s)`));
       handleApiError(err, "delete subgraph");
     }
   });
-  subgraphs.command("publish <name>").description("Make a subgraph publicly readable on /v1/subgraphs/<name> (claims the name globally, no key needed to read)").action(async (name) => {
+  subgraphs.command("publish <name>", { hidden: true }).description("Make a subgraph publicly readable on /v1/subgraphs/<name> (claims the name globally, no key needed to read)").action(async (name) => {
     try {
       await requireAuth();
       const result = await publishSubgraphApi(name);
@@ -30684,7 +30712,7 @@ ${rows.length} row(s)`));
       handleApiError(err, "publish subgraph");
     }
   });
-  subgraphs.command("unpublish <name>").description("Make a subgraph private again — reads require your API key, the public name claim is released").action(async (name) => {
+  subgraphs.command("unpublish <name>", { hidden: true }).description("Make a subgraph private again — reads require your API key, the public name claim is released").action(async (name) => {
     try {
       await requireAuth();
       await unpublishSubgraphApi(name);
@@ -30839,6 +30867,7 @@ async function runSubgraphSchemaCodegen(file, options3, optionSource, defaultTar
 }
 var ORM_ONLY_CODEGEN_FLAGS;
 var init_subgraphs2 = __esm(() => {
+  init_esm();
   init_subgraph_scaffold();
   init_subgraphs();
   init_api_client();
@@ -30850,6 +30879,7 @@ var init_subgraphs2 = __esm(() => {
   init_output();
   init_require_auth();
   init_resolve_auth();
+  init_resolve_auth();
   init_clarity();
   init_subgraph();
   init_api();
@@ -33160,12 +33190,12 @@ __export(exports_dev_state, {
   clearDevState: () => clearDevState
 });
 import { homedir as homedir4 } from "node:os";
-import { join as join10 } from "node:path";
+import { join as join11 } from "node:path";
 function getLogsDir() {
   return LOGS_DIR;
 }
 function getLogFile(service) {
-  return join10(LOGS_DIR, `${service}.log`);
+  return join11(LOGS_DIR, `${service}.log`);
 }
 async function ensureDirs() {
   await Bun.$`mkdir -p ${STATE_DIR}`.quiet();
@@ -33222,9 +33252,9 @@ async function isDevRunning() {
 }
 var STATE_DIR, DEV_STATE_PATH, LOGS_DIR;
 var init_dev_state = __esm(() => {
-  STATE_DIR = join10(homedir4(), ".secondlayer");
-  DEV_STATE_PATH = join10(STATE_DIR, "dev.json");
-  LOGS_DIR = join10(STATE_DIR, "logs");
+  STATE_DIR = join11(homedir4(), ".secondlayer");
+  DEV_STATE_PATH = join11(STATE_DIR, "dev.json");
+  LOGS_DIR = join11(STATE_DIR, "logs");
 });
 
 // src/lib/network.ts
@@ -33708,7 +33738,7 @@ __export(exports_dev_impl, {
   isDevAlreadyRunning: () => isDevAlreadyRunning
 });
 import { mkdirSync as mkdirSync5 } from "node:fs";
-import { dirname as dirname14, join as join11, resolve as resolve10 } from "node:path";
+import { dirname as dirname14, join as join12, resolve as resolve10 } from "node:path";
 async function isDevAlreadyRunning() {
   if (await isDevRunning()) {
     const running = await getRunningServices();
@@ -34317,7 +34347,7 @@ async function ensureDevPostgres(dataDir) {
   if (check.stdout.toString().trim()) {
     return false;
   }
-  const pgDataDir = join11(dataDir, "postgres");
+  const pgDataDir = join12(dataDir, "postgres");
   mkdirSync5(pgDataDir, { recursive: true });
   const stopped = await Bun.$`docker ps -aq -f name=secondlayer-dev-postgres`.quiet().nothrow();
   if (stopped.stdout.toString().trim()) {
@@ -34749,75 +34779,12 @@ var init_node_impl = __esm(() => {
   init_output();
 });
 
-// src/commands/init.ts
-var exports_init = {};
-__export(exports_init, {
-  init: () => init2
-});
-import { promises as fs7 } from "node:fs";
-import path11 from "node:path";
-async function init2() {
-  const configPath = path11.join(process.cwd(), "secondlayer.config.ts");
-  try {
-    await fs7.access(configPath);
-    console.log(source_default.yellow("⚠ secondlayer.config.ts already exists"));
-    return;
-  } catch {}
-  const hasClarinetProject = await fileExists2("./Clarinet.toml");
-  let config;
-  if (hasClarinetProject) {
-    config = `import { defineConfig } from '@secondlayer/cli';
-import { clarinet } from '@secondlayer/cli/plugins';
-
-export default defineConfig({
-  out: './src/generated/contracts.ts',
-  plugins: [
-    clarinet() // Found Clarinet.toml in current directory
-  ]
-});`;
-  } else {
-    config = `import { defineConfig } from '@secondlayer/cli';
-
-export default defineConfig({
-  out: './src/generated/contracts.ts',
-  plugins: [],
-});`;
-  }
-  await fs7.writeFile(configPath, config);
-  console.log(source_default.green("✓ Created `secondlayer.config.ts`"));
-  console.log("\nRun `secondlayer generate` to generate type-safe interfaces, functions, and hooks!");
-}
-async function fileExists2(filePath) {
-  try {
-    await fs7.access(filePath);
-    return true;
-  } catch {
-    return false;
-  }
-}
-var init_init = __esm(() => {
-  init_source();
-});
-
-// ../../node_modules/commander/esm.mjs
-var import__ = __toESM(require_commander(), 1);
-var {
-  program,
-  createCommand,
-  createArgument,
-  createOption,
-  CommanderError,
-  InvalidArgumentError,
-  InvalidOptionArgumentError,
-  Command,
-  Argument,
-  Option,
-  Help
-} = import__.default;
+// src/cli.ts
+init_esm();
 // package.json
 var package_default = {
   name: "@secondlayer/cli",
-  version: "9.9.0",
+  version: "10.0.0",
   repository: {
     type: "git",
     url: "git+https://github.com/ryanwaits/secondlayer.git",
@@ -34861,7 +34828,7 @@ var package_default = {
     "@secondlayer/bundler": "^0.4.1",
     "@secondlayer/scaffold": "^1.5.1",
     "@secondlayer/sdk": "^6.51.0",
-    "@secondlayer/shared": "^7.8.0",
+    "@secondlayer/shared": "^7.9.0",
     "@secondlayer/stacks": "^3.3.1",
     "@secondlayer/subgraphs": "^3.26.4",
     esbuild: "^0.27.4",
@@ -35003,7 +34970,7 @@ async function applyProfileUpdate(options, getOptionValueSource) {
   });
 }
 function registerAccountCommand(program2) {
-  const account = program2.command("account").description("Manage your account profile");
+  const account = program2.command("account", { hidden: true }).description("Manage your account profile");
   addBillingCommand(account);
   account.command("get").description("Show your account profile").option("--json", "Output as JSON").action(withErrorHandling(async (options) => showProfile(options.json), { action: "show profile" }));
   account.command("update").description("Update your public profile").option("--name <name>", "Set display name").option("--bio <bio>", "Set bio").option("--slug <slug>", "Set public URL slug").option("--notify-reindex-complete", "Email me when a subgraph reindex finishes").option("--no-notify-reindex-complete", "Don't email me when a subgraph reindex finishes").option("--json", "Output as JSON").action(withErrorHandling(async (options, command) => applyProfileUpdate(options, (key) => command.getOptionValueSource(key)), {
@@ -36522,7 +36489,7 @@ POST result (client-side, not logged):`));
 // src/commands/devnet.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
 import { existsSync as existsSync6, mkdirSync as mkdirSync4, writeFileSync as writeFileSync6 } from "node:fs";
-import { dirname as dirname8, join as join8 } from "node:path";
+import { dirname as dirname8, join as join9 } from "node:path";
 
 // src/lib/devnet-compose.ts
 var DEFAULT_IMAGE_OWNER = "ryanwaits";
@@ -36536,6 +36503,7 @@ function buildDevnetCompose(opts = {}) {
   const indexerImage = `ghcr.io/${owner}/secondlayer-indexer:${tag}`;
   const dbUrl = "postgres://secondlayer:secondlayer@postgres:5432/secondlayer";
   const DEV_SECRETS_KEY = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef";
+  const DEV_INSTANCE_TOKEN = "dev-instance-token";
   return `# Generated by \`sl devnet connect\` — do not edit by hand.
 # Secondlayer app services for local clarinet devnet development.
 name: secondlayer-devnet
@@ -36572,6 +36540,8 @@ services:
       INSTANCE_MODE: oss
       DATABASE_URL: ${dbUrl}
       PORT: 3800
+      LISTEN_HOST: "0.0.0.0"
+      INSTANCE_TOKEN: ${DEV_INSTANCE_TOKEN}
       NODE_ENV: production
       DATA_DIR: /data
       # Shared across api + subgraph-processor so the secret the api encrypts
@@ -36719,7 +36689,138 @@ stacks_node_events_observers = [${entry}]
 
 // src/commands/devnet.ts
 init_output();
-var COMPOSE_REL = join8(".secondlayer", "docker-compose.yml");
+
+// src/commands/faucet.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { readFile as readFile3 } from "node:fs/promises";
+import { join as join8 } from "node:path";
+import { http as http3, createWalletClient } from "@secondlayer/stacks";
+import { mnemonicToAccount } from "@secondlayer/stacks/accounts";
+import { devnet } from "@secondlayer/stacks/chains";
+import { Cl } from "@secondlayer/stacks/clarity";
+import { parse as parseToml2 } from "smol-toml";
+init_output();
+var DUST_LIMIT_SATS = 546n;
+var DEFAULT_AMOUNT_SATS = 1000000n;
+async function readDeployerMnemonic(projectDir) {
+  const path11 = join8(projectDir, "settings", "Devnet.toml");
+  let raw;
+  try {
+    raw = await readFile3(path11, "utf8");
+  } catch {
+    throw new Error(`could not read ${path11}`);
+  }
+  const parsed = parseToml2(raw);
+  const mnemonic = parsed.accounts?.deployer?.mnemonic;
+  if (!mnemonic) {
+    throw new Error(`no accounts.deployer.mnemonic in ${path11}`);
+  }
+  return mnemonic;
+}
+async function readBurnAnchor(rpcUrl) {
+  const info2 = await (await fetch(`${rpcUrl.replace(/\/$/, "")}/v2/info`, {
+    signal: AbortSignal.timeout(1e4)
+  })).json();
+  const height = info2.burn_block_height;
+  if (typeof height !== "number") {
+    throw new Error("node did not report a burn block height");
+  }
+  const burn = await (await fetch(`${rpcUrl.replace(/\/$/, "")}/extended/v2/burn-blocks/${height}`, { signal: AbortSignal.timeout(1e4) })).json();
+  if (!burn.burn_block_hash) {
+    throw new Error(`node did not report a hash for burn block ${height}`);
+  }
+  return { height, hash: burn.burn_block_hash.replace(/^0x/, "") };
+}
+function parseAmount(value) {
+  if (value === undefined)
+    return DEFAULT_AMOUNT_SATS;
+  const parsed = BigInt(value);
+  if (parsed < DUST_LIMIT_SATS) {
+    throw new Error(`--amount must be at least ${DUST_LIMIT_SATS} sats (the protocol dust limit), got ${parsed}`);
+  }
+  return parsed;
+}
+function registerFaucetCommand(devnetCommand) {
+  devnetCommand.command("faucet").description("Mint mock sBTC to an address on your devnet").requiredOption("--to <address>", "recipient Stacks address").option("--amount <sats>", `amount in sats (default ${DEFAULT_AMOUNT_SATS}, minimum ${DUST_LIMIT_SATS})`).option("--contract <id>", "sBTC deposit contract (default: <deployer>.sbtc-deposit)").option("--rpc-url <url>", "devnet node RPC (default http://localhost:3999)").option("--json", "Output as JSON").addHelpText("after", `
+Examples:
+  $ sl devnet faucet --to ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM
+  $ sl devnet faucet --to ST2... --amount 5000000
+
+Requires a devnet running with the sBTC contract set deployed by your
+Clarinet deployer — that deployer is the signer set on your own chain, which
+is what makes minting possible without Bitcoin.`).action(async (opts) => {
+    try {
+      const network = process.env.STACKS_NETWORK ?? "devnet";
+      if (network !== "devnet" && network !== "local") {
+        printError(`sl devnet faucet only works on devnet, not ${network}.`, {
+          hint: "Mock sBTC is mintable because you deployed the contracts. On testnet or mainnet the signer set is not yours."
+        });
+        process.exit(2);
+      }
+      const rpcUrl = opts.rpcUrl ?? "http://localhost:3999";
+      const amount = parseAmount(opts.amount);
+      const projectDir = findClarinetProject(process.cwd());
+      if (!projectDir) {
+        printError("No Clarinet project found.", {
+          hint: "Run this from a project containing Clarinet.toml, or pass --contract explicitly."
+        });
+        process.exit(2);
+      }
+      const mnemonic = await readDeployerMnemonic(projectDir);
+      const account = mnemonicToAccount(mnemonic, {
+        addressVersion: devnet.addressVersion.singleSig
+      });
+      const contract = opts.contract ?? `${account.address}.sbtc-deposit`;
+      const anchor = await readBurnAnchor(rpcUrl);
+      const client2 = createWalletClient({
+        account,
+        chain: devnet,
+        transport: http3(rpcUrl)
+      });
+      const depositTxid = randomBytes2(32).toString("hex");
+      const sweepTxid = randomBytes2(32).toString("hex");
+      note(`  minting ${amount} sats to ${opts.to}`);
+      note(`  via ${contract} as signer ${account.address}`);
+      const txid = await client2.callContract({
+        contract,
+        functionName: "complete-deposit-wrapper",
+        functionArgs: [
+          Cl.bufferFromHex(depositTxid),
+          Cl.uint(0),
+          Cl.uint(amount),
+          Cl.principal(opts.to),
+          Cl.bufferFromHex(anchor.hash),
+          Cl.uint(anchor.height),
+          Cl.bufferFromHex(sweepTxid)
+        ],
+        postConditionMode: "allow"
+      });
+      output({
+        json: opts.json,
+        data: {
+          txid,
+          recipient: opts.to,
+          amount_sats: amount.toString(),
+          contract,
+          burn_height: anchor.height
+        },
+        human: () => {
+          success(`Minted ${amount} sats of mock sBTC to ${opts.to}.`);
+          note(`  tx ${txid}`);
+          console.error(dim("  Mock sBTC on your devnet — not the canonical asset."));
+        }
+      });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      const hint = /ECONNREFUSED|fetch failed/.test(message) ? "Is your devnet running? Start it with `clarinet devnet start`." : /NoSuchContract|does not exist/.test(message) ? "Deploy the sBTC contract set to your devnet first, or pass --contract." : "Check that your Clarinet deployer matches the sBTC contract deployer.";
+      printError(message, { hint });
+      process.exit(1);
+    }
+  });
+}
+
+// src/commands/devnet.ts
+var COMPOSE_REL = join9(".secondlayer", "docker-compose.yml");
 function ensureDocker() {
   const probe = spawnSync2("docker", ["info"], { stdio: "ignore" });
   if (probe.error || probe.status !== 0) {
@@ -36747,23 +36848,24 @@ var SERVICES = [
   "migrate"
 ];
 function registerDevnetCommand(program2) {
-  const devnet = program2.command("devnet").description("Run Secondlayer services against a local Clarinet devnet");
-  devnet.command("connect").description("Point your clarinet project's devnet at a local Secondlayer stack and start it").option("--project <dir>", "Clarinet project directory (defaults to the nearest Clarinet.toml)").option("--image-tag <tag>", "Published image tag to run", DEFAULT_IMAGE_TAG).option("--owner <owner>", "ghcr image owner (namespace) to pull from").option("--no-up", "Patch config + write compose without starting docker").action(async (options3) => {
+  const devnet2 = program2.command("devnet").description("Run Secondlayer services against a local Clarinet devnet");
+  registerFaucetCommand(devnet2);
+  devnet2.command("connect").description("Point your clarinet project's devnet at a local Secondlayer stack and start it").option("--project <dir>", "Clarinet project directory (defaults to the nearest Clarinet.toml)").option("--image-tag <tag>", "Published image tag to run", DEFAULT_IMAGE_TAG).option("--owner <owner>", "ghcr image owner (namespace) to pull from").option("--no-up", "Patch config + write compose without starting docker").action(async (options3) => {
     await connect(options3);
   });
-  devnet.command("down").description("Stop the local Secondlayer stack started by `sl devnet connect`").option("--project <dir>", "Clarinet project directory").option("--purge", "Also remove volumes (wipes the local index)").action(async (options3) => {
+  devnet2.command("down").description("Stop the local Secondlayer stack started by `sl devnet connect`").option("--project <dir>", "Clarinet project directory").option("--purge", "Also remove volumes (wipes the local index)").action(async (options3) => {
     await down(options3);
   });
-  devnet.command("status").description("Snapshot of the local stack: ingest, subgraphs, and recent activity").option("-w, --watch", "Refresh every 2s until Ctrl-C").option("--limit <n>", "Recent activity rows to show", "12").action(async (options3) => {
+  devnet2.command("status").description("Snapshot of the local stack: ingest, subgraphs, and recent activity").option("-w, --watch", "Refresh every 2s until Ctrl-C").option("--limit <n>", "Recent activity rows to show", "12").action(async (options3) => {
     await status(options3);
   });
-  devnet.command("logs [service]").description("Tail stack logs — all services, or one of: indexer, api, subgraph-processor, postgres").option("--project <dir>", "Clarinet project directory").option("-f, --follow", "Follow log output").option("-n, --lines <n>", "Lines to show from the end of each log").action(async (service, options3) => {
+  devnet2.command("logs [service]").description("Tail stack logs — all services, or one of: indexer, api, subgraph-processor, postgres").option("--project <dir>", "Clarinet project directory").option("-f, --follow", "Follow log output").option("-n, --lines <n>", "Lines to show from the end of each log").action(async (service, options3) => {
     await logs(service, options3);
   });
 }
 function resolveProject(explicit) {
   if (explicit) {
-    if (!existsSync6(join8(explicit, "Clarinet.toml"))) {
+    if (!existsSync6(join9(explicit, "Clarinet.toml"))) {
       error(`No Clarinet.toml in ${explicit}`);
       process.exit(1);
     }
@@ -36779,7 +36881,7 @@ function resolveProject(explicit) {
 }
 async function connect(options3) {
   const project = resolveProject(options3.project);
-  const devnetToml = join8(project, "settings", "Devnet.toml");
+  const devnetToml = join9(project, "settings", "Devnet.toml");
   mkdirSync4(dirname8(devnetToml), { recursive: true });
   const result = ensureEventObserver(devnetToml, DEFAULT_INDEXER_OBSERVER);
   console.log(`${green("✓")} found Clarinet.toml`);
@@ -36789,7 +36891,7 @@ async function connect(options3) {
     console.log(`${green("✓")} ${result.status === "created" ? "created" : "patched"} settings/Devnet.toml`);
     console.log(dim(`    + stacks_node_events_observers = ["${DEFAULT_INDEXER_OBSERVER}"]`));
   }
-  const composePath = join8(project, COMPOSE_REL);
+  const composePath = join9(project, COMPOSE_REL);
   mkdirSync4(dirname8(composePath), { recursive: true });
   writeFileSync6(composePath, buildDevnetCompose({ owner: options3.owner, imageTag: options3.imageTag }));
   console.log(`${green("✓")} wrote ${COMPOSE_REL}`);
@@ -36819,7 +36921,7 @@ Stop with: sl devnet down`));
 }
 async function down(options3) {
   const project = resolveProject(options3.project);
-  const composePath = join8(project, COMPOSE_REL);
+  const composePath = join9(project, COMPOSE_REL);
   if (!existsSync6(composePath)) {
     error(`No ${COMPOSE_REL} in ${project} — nothing to stop. Run \`sl devnet connect\` first.`);
     process.exit(1);
@@ -36834,7 +36936,7 @@ async function down(options3) {
 }
 async function logs(service, options3) {
   const project = resolveProject(options3.project);
-  const composePath = join8(project, COMPOSE_REL);
+  const composePath = join9(project, COMPOSE_REL);
   if (!existsSync6(composePath)) {
     error(`No ${COMPOSE_REL} in ${project} — run \`sl devnet connect\` first.`);
     process.exit(1);
@@ -36960,7 +37062,7 @@ init_subgraphs2();
 init_output();
 init_resolve_auth();
 import { mkdir as mkdir3, writeFile as writeFile3 } from "node:fs/promises";
-import { dirname as dirname9, join as join9 } from "node:path";
+import { dirname as dirname9, join as join10 } from "node:path";
 import { createStreamsClient } from "@secondlayer/sdk";
 import { STREAMS_EVENT_TYPES } from "@secondlayer/shared";
 var DEFAULT_BASE_URL3 = "https://api.secondlayer.tools";
@@ -37136,7 +37238,7 @@ Examples:
       note(`# downloading ${files.length} file(s) to ${options3.to}`);
       for (const file of files) {
         const bytes = await dumps.download(file);
-        const dest = join9(options3.to, file.path);
+        const dest = join10(options3.to, file.path);
         await mkdir3(dirname9(dest), { recursive: true });
         await writeFile3(dest, bytes);
         process.stderr.write(`# ${file.path} (${file.row_count} rows, ${bytes.byteLength} bytes)
@@ -37185,7 +37287,7 @@ init_resolve_auth();
 import { SecondLayer as SecondLayer4 } from "@secondlayer/sdk";
 var DEFAULT_BASE_URL4 = "https://api.secondlayer.tools";
 function registerKeysCommand(program2) {
-  const keys = program2.command("keys").description("Manage API keys");
+  const keys = program2.command("keys", { hidden: true }).description("Manage API keys");
   keys.command("create").description("Mint a scoped streams/index read key (requires an account-level key)").option("--product <product>", "Key scope: streams or index", "streams").option("--name <name>", "Optional label for the key").option("--json", "Print the full response as JSON").action(async (o3) => {
     if (o3.product && o3.product !== "streams" && o3.product !== "index") {
       error("--product must be 'streams' or 'index'");
@@ -38424,9 +38526,9 @@ init_output();
 
 // src/lib/project-file.ts
 import { existsSync as existsSync7 } from "node:fs";
-import { mkdir as mkdir4, readFile as readFile3, writeFile as writeFile4 } from "node:fs/promises";
+import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
-import { dirname as dirname15, join as join12, parse as parsePath2, resolve as resolve11 } from "node:path";
+import { dirname as dirname15, join as join13, parse as parsePath2, resolve as resolve11 } from "node:path";
 import { z as z4 } from "zod";
 var ProjectFileSchema = z4.object({
   slug: z4.string().min(1)
@@ -38438,15 +38540,15 @@ async function readActiveProject(cwd, globalDefault) {
   const home2 = resolve11(homedir5());
   const fsRoot = parsePath2(dir).root;
   while (true) {
-    const candidate = join12(dir, DIRNAME, FILENAME);
+    const candidate = join13(dir, DIRNAME, FILENAME);
     if (existsSync7(candidate)) {
       try {
-        const raw = await readFile3(candidate, "utf8");
+        const raw = await readFile4(candidate, "utf8");
         const parsed = ProjectFileSchema.parse(JSON.parse(raw));
         return { slug: parsed.slug, resolvedFrom: candidate };
       } catch {}
     }
-    if (existsSync7(join12(dir, ".git")))
+    if (existsSync7(join13(dir, ".git")))
       break;
     if (dir === home2 || dir === fsRoot)
       break;
@@ -38458,15 +38560,15 @@ async function readActiveProject(cwd, globalDefault) {
   if (globalDefault) {
     return {
       slug: globalDefault,
-      resolvedFrom: join12(homedir5(), ".secondlayer", "config.json")
+      resolvedFrom: join13(homedir5(), ".secondlayer", "config.json")
     };
   }
   return null;
 }
 async function writeActiveProject(slug, cwd) {
-  const dir = join12(resolve11(cwd), DIRNAME);
+  const dir = join13(resolve11(cwd), DIRNAME);
   await mkdir4(dir, { recursive: true });
-  const file = join12(dir, FILENAME);
+  const file = join13(dir, FILENAME);
   await writeFile4(file, `${JSON.stringify({ slug }, null, 2)}
 `, "utf8");
   return file;
@@ -38475,7 +38577,7 @@ async function writeActiveProject(slug, cwd) {
 // src/commands/whoami.ts
 init_resolve_auth();
 function registerWhoamiCommand(program2) {
-  program2.command("whoami").description("Show the active account, credential source, and project").option("--json", "Output as JSON").action(async (options3) => {
+  program2.command("whoami", { hidden: true }).description("Show the active account, credential source, and project").option("--json", "Output as JSON").action(async (options3) => {
     let auth;
     try {
       auth = await resolveAuth();
@@ -38531,7 +38633,7 @@ init_http();
 init_output();
 init_session();
 function registerLogoutCommand(program2) {
-  program2.command("logout").description("Log out and revoke the local session").action(async () => {
+  program2.command("logout", { hidden: true }).description("Log out and revoke the local session").action(async () => {
     const session = await readSession();
     if (!session) {
       info("Not logged in.");
@@ -38553,7 +38655,7 @@ init_config2();
 init_http();
 init_output();
 function registerProjectCommand(program2) {
-  const project = program2.command("projects").alias("project").description("Manage your Secondlayer project");
+  const project = program2.command("projects", { hidden: true }).alias("project").description("Manage your Secondlayer project");
   project.command("list").alias("ls").description("List projects in your account").option("--json", "Output as JSON").action(async (options3) => {
     try {
       const res = await httpPlatform("/api/projects");
@@ -38632,12 +38734,16 @@ import {
   compareRangeDigests,
   computeRangeDigest
 } from "@secondlayer/shared/archive/range-digest";
+import {
+  comparePartitionSemanticDigests,
+  computePartitionSemanticDigest
+} from "@secondlayer/shared/archive/semantic-digest-builder";
 import { getDb as getDb2 } from "@secondlayer/shared/db";
 
 // src/lib/archive-reference.ts
 import { createHash as createHash2 } from "node:crypto";
-import { readFile as readFile4 } from "node:fs/promises";
-import { dirname as dirname16, join as join13, resolve as resolve12 } from "node:path";
+import { readFile as readFile5 } from "node:fs/promises";
+import { dirname as dirname16, join as join14, resolve as resolve12 } from "node:path";
 import {
   checkKeyTrust,
   publicKeyFor,
@@ -38666,7 +38772,7 @@ async function loadReference(source) {
     root = url.toString();
   } else {
     const path11 = resolve12(source);
-    manifest = JSON.parse(await readFile4(path11, "utf8"));
+    manifest = JSON.parse(await readFile5(path11, "utf8"));
     root = isLatestPointer(manifest) ? dirname16(path11) : dirname16(dirname16(path11));
   }
   if (!isLatestPointer(manifest)) {
@@ -38674,7 +38780,7 @@ async function loadReference(source) {
   }
   const pointer = manifest;
   const snapshotPath = pointer.snapshot_path;
-  const resolved = isRemote ? await fetchJson(`${root.replace(/\/$/, "")}/${snapshotPath}`) : JSON.parse(await readFile4(join13(root, snapshotPath), "utf8"));
+  const resolved = isRemote ? await fetchJson(`${root.replace(/\/$/, "")}/${snapshotPath}`) : JSON.parse(await readFile5(join14(root, snapshotPath), "utf8"));
   if (pointer.snapshot_digest) {
     const digest = createHash2("sha256").update(JSON.stringify((({ signature: _s, key_id: _k, ...rest }) => rest)(resolved))).digest("hex");
     if (digest !== pointer.snapshot_digest) {
@@ -38708,6 +38814,7 @@ function checkSignature(manifest, publicKeyPem, insecure) {
     };
   }
 }
+var HOSTED_API = "https://api.secondlayer.tools";
 async function resolvePublicKey(explicitPem, apiUrl) {
   if (explicitPem)
     return explicitPem;
@@ -38721,6 +38828,16 @@ async function resolvePublicKey(explicitPem, apiUrl) {
     return;
   }
 }
+async function resolveArchivePublicKey(input4) {
+  if (input4.explicitPem)
+    return input4.explicitPem;
+  if (input4.envPem)
+    return input4.envPem;
+  if (input4.allowHostedApi) {
+    return resolvePublicKey(undefined, HOSTED_API);
+  }
+  return;
+}
 async function fetchVerifiedPartition(reference, partition) {
   let bytes;
   if (reference.isRemote) {
@@ -38731,7 +38848,7 @@ async function fetchVerifiedPartition(reference, partition) {
     }
     bytes = Buffer.from(await response2.arrayBuffer());
   } else {
-    bytes = await readFile4(join13(reference.root, partition.path));
+    bytes = await readFile5(join14(reference.root, partition.path));
   }
   const digest = createHash2("sha256").update(bytes).digest("hex");
   if (digest !== partition.sha256) {
@@ -38764,7 +38881,7 @@ function statusLabel(status2) {
   return yellow("missing");
 }
 function registerVerifyCommand(program2) {
-  program2.command("verify").description("Compare local chain data against a signed archive (read-only; nothing is uploaded)").requiredOption("--against <manifest>", "archive manifest: an https URL or a local file path").option("--from-block <n>", "first height to check").option("--to-block <n>", "last height to check").option("--counts", "also compare transaction/event row counts (slower)").option("--public-key <pem>", "pin the signing key instead of fetching it").option("--insecure", "skip the manifest signature check (not recommended)").option("--json", "Output as JSON").addHelpText("after", `
+  program2.command("verify").description("Compare local chain data against a signed archive (read-only; nothing is uploaded)").requiredOption("--against <manifest>", "archive manifest: an https URL or a local file path").option("--from-block <n>", "first height to check").option("--to-block <n>", "last height to check").option("--counts", "also compare transaction/event row counts (slower)").option("--semantic", "also recompute per-partition semantic digests locally and compare (slow: full re-stream)").option("--public-key <pem>", "pin the signing key instead of fetching it").option("--insecure", "skip the manifest signature check (not recommended)").option("--json", "Output as JSON").addHelpText("after", `
 Examples:
   $ sl verify --against https://archive.secondlayer.tools/.../snapshots/<digest>.json
   $ sl verify --against ./snapshot.json --from-block 8000000 --to-block 8499999
@@ -38844,13 +38961,52 @@ Exit codes:
           });
         }
       }
-      const all2 = [...comparisons, ...countChecks];
+      const semanticChecks = [];
+      const referenceSemantic = (manifest.partition_semantic_digests ?? []).filter((d2) => {
+        if (fromBlock !== undefined && d2.to_block < fromBlock)
+          return false;
+        if (toBlock !== undefined && d2.from_block > toBlock)
+          return false;
+        return true;
+      });
+      if (opts.semantic) {
+        if (referenceSemantic.length === 0) {
+          warn("Reference publishes no semantic digests; --semantic had nothing to compare.");
+        } else {
+          note(`Recomputing ${referenceSemantic.length} partition semantic digests (this is the slow pass).`);
+          const localSemantic = [];
+          let semanticDone = 0;
+          for (const partition of referenceSemantic) {
+            localSemantic.push(await computePartitionSemanticDigest(db, partition.dataset, partition.from_block, partition.to_block));
+            semanticDone++;
+            if (semanticDone % 5 === 0 || semanticDone === referenceSemantic.length) {
+              note(`  checked ${semanticDone}/${referenceSemantic.length} partitions`);
+            }
+          }
+          semanticChecks.push(...comparePartitionSemanticDigests(localSemantic, referenceSemantic));
+        }
+      }
+      const all2 = [
+        ...comparisons,
+        ...countChecks,
+        ...semanticChecks.map((s2) => ({
+          dataset: s2.dataset,
+          from_block: s2.from_block,
+          to_block: s2.to_block,
+          status: s2.status,
+          expected_digest: s2.expected_digest,
+          actual_digest: s2.actual_digest,
+          expected_rows: s2.expected_rows,
+          actual_rows: s2.actual_rows
+        }))
+      ];
       const diverged = all2.filter((c4) => c4.status !== "match");
       const report = {
         status: diverged.length === 0 ? "clean" : "diverged",
         reference: origin,
         signature_verified: signature.verified,
         ranges_checked: all2.length,
+        semantic_checks: semanticChecks.length,
         divergent_ranges: diverged
       };
       output({
@@ -38891,7 +39047,7 @@ Exit codes:
 // src/commands/repair.ts
 import { unlink as unlink2, writeFile as writeFile5 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
-import { join as join14 } from "node:path";
+import { join as join15 } from "node:path";
 import { ParquetReader } from "@dsnp/parquetjs";
 import {
   compareRangeDigests as compareRangeDigests2,
@@ -38914,7 +39070,7 @@ function asOptionalText(value) {
   return value === null || value === undefined ? null : asText(value);
 }
 async function readBlocksPartition(bytes, label) {
-  const path11 = join14(tmpdir2(), `sl-repair-${label}-${process.pid}.parquet`);
+  const path11 = join15(tmpdir2(), `sl-repair-${label}-${process.pid}.parquet`);
   await writeFile5(path11, bytes);
   try {
     const reader = await ParquetReader.openFile(path11);
@@ -39140,7 +39296,7 @@ Exit codes:
 // src/commands/bootstrap.ts
 import { unlink as unlink3, writeFile as writeFile6 } from "node:fs/promises";
 import { tmpdir as tmpdir3 } from "node:os";
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 import { ParquetReader as ParquetReader2 } from "@dsnp/parquetjs";
 import { confirm as confirm7 } from "@inquirer/prompts";
 import {
@@ -39149,7 +39305,35 @@ import {
 } from "@secondlayer/shared/archive/copy-loader";
 import { computeRangeDigest as computeRangeDigest3 } from "@secondlayer/shared/archive/range-digest";
 import { getDb as getDb4, getRawClient, sql as sql3 } from "@secondlayer/shared/db";
+
+// src/lib/bootstrap-resume.ts
+function planTornImport(input4) {
+  if (input4.hasIndexProgress) {
+    return {
+      action: "refuse",
+      reason: "This database already holds a completed bootstrap."
+    };
+  }
+  if (input4.maxBlockHeight === null || input4.maxBlockHeight <= 0) {
+    return { action: "fresh" };
+  }
+  const blockPartitions = input4.partitions.filter((p2) => p2.dataset === "blocks").sort((a4, b3) => a4.from_block - b3.from_block);
+  const sealed = blockPartitions.filter((p2) => p2.to_block <= (input4.maxBlockHeight ?? 0));
+  const skipThrough = sealed.length > 0 ? Math.max(...sealed.map((p2) => p2.to_block)) : 0;
+  const torn = blockPartitions.find((p2) => p2.from_block <= (input4.maxBlockHeight ?? 0) && p2.to_block > (input4.maxBlockHeight ?? 0));
+  return {
+    action: "resume",
+    truncateFrom: torn ? torn.from_block : null,
+    skipThrough
+  };
+}
+function partitionIsLoaded(partition, skipThrough) {
+  return partition.to_block <= skipThrough;
+}
+
+// src/commands/bootstrap.ts
 init_output();
+init_resolve_auth();
 var BOOTSTRAP_EXIT = {
   OK: 0,
   INCOMPLETE: 1,
@@ -39181,7 +39365,7 @@ function formatDuration2(seconds2) {
   return `${(seconds2 / 86400).toFixed(1)} days`;
 }
 async function* readPartitionRows(bytes, label) {
-  const path11 = join15(tmpdir3(), `sl-bootstrap-${label}-${process.pid}.parquet`);
+  const path11 = join16(tmpdir3(), `sl-bootstrap-${label}-${process.pid}.parquet`);
   await writeFile6(path11, bytes);
   try {
     const reader = await ParquetReader2.openFile(path11);
@@ -39210,8 +39394,8 @@ async function loadPartition(reference, partition, rawClient) {
   }
   return written;
 }
-function registerBootstrapCommand(program2) {
-  program2.command("bootstrap").description("Restore chain history from a verified archive instead of syncing from genesis").requiredOption("--against <manifest>", "archive manifest: an https URL or a local file path").option("--to-block <n>", "stop at this height instead of the archive tip").option("--public-key <pem>", "pin the signing key instead of fetching it").option("-y, --yes", "skip the confirmation prompt").option("--json", "Output as JSON").addHelpText("after", `
+function attachBootstrapCommand(cmd) {
+  return cmd.requiredOption("--against <manifest>", "archive manifest: an https URL or a local file path").option("--to-block <n>", "stop at this height instead of the archive tip").option("--public-key <pem>", "pin the signing key instead of fetching it").option("-y, --yes", "skip the confirmation prompt").option("--json", "Output as JSON").addHelpText("after", `
 Examples:
   $ sl bootstrap --against https://archive.secondlayer.tools/.../snapshots/<digest>.json
   $ sl bootstrap --against ./snapshot.json --to-block 4000000 --yes
@@ -39222,7 +39406,11 @@ Exit codes:
   2  refused (non-empty target, or an untrusted reference)`).action(async (opts) => {
     try {
       const reference = await loadReference(opts.against);
-      const publicKey = await resolvePublicKey(opts.publicKey, process.env.SL_API_URL ?? "https://api.secondlayer.tools");
+      const publicKey = await resolveArchivePublicKey({
+        explicitPem: opts.publicKey,
+        envPem: process.env.ARCHIVE_SIGNING_PUBLIC_KEY ?? process.env.STREAMS_SIGNING_PUBLIC_KEY,
+        allowHostedApi: !isOssMode()
+      });
       const signature = checkSignature(reference.manifest, publicKey, false);
       if (!signature.verified) {
         printError(`Refusing to bootstrap from an untrusted archive: ${signature.reason}.`, {
@@ -39231,15 +39419,31 @@ Exit codes:
         process.exit(BOOTSTRAP_EXIT.REFUSED);
       }
       const db = getDb4();
-      const existing = await db.selectFrom("blocks").select(({ fn }) => fn.countAll().as("count")).executeTakeFirst();
-      if (Number(existing?.count ?? 0) > 0) {
-        printError("This database already holds blocks.", {
+      const progress = await db.selectFrom("index_progress").select("network").executeTakeFirst();
+      const maxHeightRow = await db.selectFrom("blocks").select(({ fn }) => fn.max("height").as("max")).executeTakeFirst();
+      const maxBlockHeight = maxHeightRow?.max === null || maxHeightRow?.max === undefined ? null : Number(maxHeightRow.max);
+      const toBlock = opts.toBlock === undefined ? undefined : Number(opts.toBlock);
+      const declared = (reference.manifest.partitions ?? []).filter((p2) => toBlock === undefined || p2.to_block <= toBlock);
+      const resume = planTornImport({
+        hasIndexProgress: !!progress,
+        maxBlockHeight,
+        partitions: declared
+      });
+      if (resume.action === "refuse") {
+        printError(resume.reason, {
           hint: "Bootstrap is for a fresh instance. To fix an existing one, use `sl repair`."
         });
         process.exit(BOOTSTRAP_EXIT.REFUSED);
       }
-      const toBlock = opts.toBlock === undefined ? undefined : Number(opts.toBlock);
-      const partitions = (reference.manifest.partitions ?? []).filter((p2) => toBlock === undefined || p2.to_block <= toBlock);
+      if (resume.action === "resume" && resume.truncateFrom !== null) {
+        await sql3`DELETE FROM events WHERE block_height >= ${resume.truncateFrom}`.execute(db);
+        await sql3`DELETE FROM transactions WHERE block_height >= ${resume.truncateFrom}`.execute(db);
+        await sql3`DELETE FROM blocks WHERE height >= ${resume.truncateFrom}`.execute(db);
+        note(`Resuming torn import: truncated from height ${resume.truncateFrom}.`);
+      } else if (resume.action === "resume") {
+        note(`Resuming import after sealed height ${resume.skipThrough.toLocaleString()}.`);
+      }
+      const partitions = declared.filter((p2) => resume.action === "fresh" || !partitionIsLoaded(p2, resume.skipThrough));
       if (partitions.length === 0) {
         printError("The archive has no partitions for that range.", {
           hint: "Check --to-block against the manifest's coverage."
@@ -39364,138 +39568,217 @@ Exit codes:
     }
   });
 }
-// src/commands/faucet.ts
-import { randomBytes as randomBytes2 } from "node:crypto";
-import { readFile as readFile5 } from "node:fs/promises";
-import { join as join16 } from "node:path";
-import { http as http3, createWalletClient } from "@secondlayer/stacks";
-import { mnemonicToAccount } from "@secondlayer/stacks/accounts";
-import { devnet } from "@secondlayer/stacks/chains";
-import { Cl } from "@secondlayer/stacks/clarity";
-import { parse as parseToml2 } from "smol-toml";
+function registerBootstrapCommand(program2) {
+  attachBootstrapCommand(program2.command("bootstrap").description("Restore chain history from a verified archive instead of syncing from genesis"));
+}
+// src/lib/instance-init.ts
+import { randomBytes as randomBytes3 } from "node:crypto";
+import { existsSync as existsSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "node:fs";
+import { resolve as resolve13 } from "node:path";
+import { generateEd25519KeyPair } from "@secondlayer/shared/crypto/ed25519";
+import { INSTANCE_NETWORKS } from "@secondlayer/shared/db/queries/instance";
+var INSTANCE_ENV_FILE = ".env.local";
+function parseInstanceNetwork(value) {
+  const network = value.trim().toLowerCase();
+  if (INSTANCE_NETWORKS.includes(network)) {
+    return network;
+  }
+  throw new Error(`network must be mainnet, testnet, or devnet (got ${value})`);
+}
+function generateInstanceToken() {
+  return randomBytes3(32).toString("hex");
+}
+function generateSecretsKey() {
+  return randomBytes3(32).toString("hex");
+}
+function generateSigningPrivateKey() {
+  return generateEd25519KeyPair().privateKeyPem;
+}
+function escapeEnvValue(value) {
+  if (!/[\s#"']/.test(value) && !value.includes("\\"))
+    return value;
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n")}"`;
+}
+function unescapeEnvValue(raw) {
+  let value = raw.trim();
+  if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+    value = value.slice(1, -1);
+  }
+  return value.replace(/\\n/g, `
+`).replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+}
+function readEnvValue(envPath, key) {
+  if (!existsSync8(envPath))
+    return null;
+  const match = readFileSync7(envPath, "utf8").match(new RegExp(`^${key}=(.*)$`, "m"));
+  return match ? unescapeEnvValue(match[1]) : null;
+}
+function buildInstanceEnv(input4) {
+  const token = input4.existing?.INSTANCE_TOKEN || input4.existing?.SL_API_KEY || generateInstanceToken();
+  const secrets = input4.existing?.SECONDLAYER_SECRETS_KEY || generateSecretsKey();
+  const signing = input4.existing?.STREAMS_SIGNING_PRIVATE_KEY || input4.existing?.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY || generateSigningPrivateKey();
+  const apiUrl = input4.apiUrl ?? "http://127.0.0.1:3800";
+  const archiveKey = input4.existing?.ARCHIVE_SIGNING_PUBLIC_KEY;
+  return {
+    INSTANCE_MODE: "oss",
+    STACKS_NETWORK: input4.network,
+    INSTANCE_TOKEN: token,
+    SECONDLAYER_SECRETS_KEY: secrets,
+    STREAMS_SIGNING_PRIVATE_KEY: signing,
+    SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY: signing,
+    ALLOW_UNSIGNED_WEBHOOKS: "false",
+    SL_API_URL: input4.existing?.SL_API_URL || apiUrl,
+    SL_API_KEY: token,
+    ...archiveKey ? { ARCHIVE_SIGNING_PUBLIC_KEY: archiveKey } : {}
+  };
+}
+function renderInstanceEnv(env2) {
+  const lines2 = [
+    "# Generated by sl init. Do not commit.",
+    `INSTANCE_MODE=${env2.INSTANCE_MODE}`,
+    `STACKS_NETWORK=${env2.STACKS_NETWORK}`,
+    `INSTANCE_TOKEN=${env2.INSTANCE_TOKEN}`,
+    `SECONDLAYER_SECRETS_KEY=${env2.SECONDLAYER_SECRETS_KEY}`,
+    `STREAMS_SIGNING_PRIVATE_KEY=${escapeEnvValue(env2.STREAMS_SIGNING_PRIVATE_KEY)}`,
+    `SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY=${escapeEnvValue(env2.SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY)}`,
+    `ALLOW_UNSIGNED_WEBHOOKS=${env2.ALLOW_UNSIGNED_WEBHOOKS}`,
+    `SL_API_URL=${env2.SL_API_URL}`,
+    `SL_API_KEY=${env2.SL_API_KEY}`
+  ];
+  if (env2.ARCHIVE_SIGNING_PUBLIC_KEY) {
+    lines2.push(`ARCHIVE_SIGNING_PUBLIC_KEY=${escapeEnvValue(env2.ARCHIVE_SIGNING_PUBLIC_KEY)}`);
+  }
+  lines2.push("");
+  return lines2.join(`
+`);
+}
+function writeInstanceEnv(cwd, env2, file = INSTANCE_ENV_FILE) {
+  const path11 = resolve13(cwd, file);
+  writeFileSync7(path11, renderInstanceEnv(env2), { mode: 384 });
+  return path11;
+}
+function loadExistingInstanceEnv(cwd, file = INSTANCE_ENV_FILE) {
+  const path11 = resolve13(cwd, file);
+  return {
+    INSTANCE_TOKEN: readEnvValue(path11, "INSTANCE_TOKEN"),
+    SECONDLAYER_SECRETS_KEY: readEnvValue(path11, "SECONDLAYER_SECRETS_KEY"),
+    STREAMS_SIGNING_PRIVATE_KEY: readEnvValue(path11, "STREAMS_SIGNING_PRIVATE_KEY"),
+    SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY: readEnvValue(path11, "SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY"),
+    SL_API_URL: readEnvValue(path11, "SL_API_URL"),
+    SL_API_KEY: readEnvValue(path11, "SL_API_KEY"),
+    ARCHIVE_SIGNING_PUBLIC_KEY: readEnvValue(path11, "ARCHIVE_SIGNING_PUBLIC_KEY")
+  };
+}
+
+// src/commands/init.ts
 init_output();
-var DUST_LIMIT_SATS = 546n;
-var DEFAULT_AMOUNT_SATS = 1000000n;
-async function readDeployerMnemonic(projectDir) {
-  const path11 = join16(projectDir, "settings", "Devnet.toml");
-  let raw;
-  try {
-    raw = await readFile5(path11, "utf8");
-  } catch {
-    throw new Error(`could not read ${path11}`);
+function registerInitCommand(program2) {
+  program2.command("init").description("Write local env (token, secrets key, webhook signing key). Idempotent.").option("--network <network>", "mainnet, testnet, or devnet", process.env.STACKS_NETWORK ?? "mainnet").option("--api-url <url>", "Local API URL", "http://127.0.0.1:3800").option("--force", "Overwrite generated values even if .env.local exists").action((opts) => {
+    const network = parseInstanceNetwork(opts.network);
+    const existing = opts.force ? {} : loadExistingInstanceEnv(process.cwd());
+    const env2 = buildInstanceEnv({
+      network,
+      existing,
+      apiUrl: opts.apiUrl
+    });
+    const path11 = writeInstanceEnv(process.cwd(), env2);
+    success(`Wrote ${INSTANCE_ENV_FILE}`);
+    note(formatKeyValue([
+      ["network", env2.STACKS_NETWORK],
+      ["api", env2.SL_API_URL],
+      ["env", path11]
+    ]));
+    note("Export these or pass --env-file to compose. Do not commit the file.");
+  });
+}
+// src/lib/observer-stanza.ts
+var OBSERVER_MODES = ["indexer", "signer-shared"];
+var RECOVERY_SOURCES = ["journal", "archive"];
+
+class UnsupportedObserverError extends Error {
+  name = "UnsupportedObserverError";
+}
+function parseObserverMode(value) {
+  const mode = value.trim().toLowerCase();
+  if (OBSERVER_MODES.includes(mode)) {
+    return mode;
   }
-  const parsed = parseToml2(raw);
-  const mnemonic = parsed.accounts?.deployer?.mnemonic;
-  if (!mnemonic) {
-    throw new Error(`no accounts.deployer.mnemonic in ${path11}`);
+  throw new UnsupportedObserverError(`observer mode must be indexer or signer-shared (got ${value})`);
+}
+function parseRecoverySource(value) {
+  const source = value.trim().toLowerCase();
+  if (RECOVERY_SOURCES.includes(source)) {
+    return source;
   }
-  return mnemonic;
+  throw new UnsupportedObserverError(`recovery source must be journal or archive (got ${value})`);
 }
-async function readBurnAnchor(rpcUrl) {
-  const info2 = await (await fetch(`${rpcUrl.replace(/\/$/, "")}/v2/info`, {
-    signal: AbortSignal.timeout(1e4)
-  })).json();
-  const height = info2.burn_block_height;
-  if (typeof height !== "number") {
-    throw new Error("node did not report a burn block height");
+function parseObserverEndpoint(value) {
+  const trimmed = value.trim();
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(trimmed) || trimmed.startsWith("unix:")) {
+    throw new UnsupportedObserverError(`observer endpoint must be host:port, not a URL (${value})`);
   }
-  const burn = await (await fetch(`${rpcUrl.replace(/\/$/, "")}/extended/v2/burn-blocks/${height}`, { signal: AbortSignal.timeout(1e4) })).json();
-  if (!burn.burn_block_hash) {
-    throw new Error(`node did not report a hash for burn block ${height}`);
+  const match = trimmed.match(/^([a-zA-Z0-9._-]+):(\d+)$/);
+  if (!match) {
+    throw new UnsupportedObserverError(`observer endpoint must be host:port (got ${value})`);
   }
-  return { height, hash: burn.burn_block_hash.replace(/^0x/, "") };
+  const port = Number(match[2]);
+  if (port < 1 || port > 65535) {
+    throw new UnsupportedObserverError(`observer port out of range (${port})`);
+  }
+  return trimmed;
 }
-function parseAmount(value) {
-  if (value === undefined)
-    return DEFAULT_AMOUNT_SATS;
-  const parsed = BigInt(value);
-  if (parsed < DUST_LIMIT_SATS) {
-    throw new Error(`--amount must be at least ${DUST_LIMIT_SATS} sats (the protocol dust limit), got ${parsed}`);
+var LOOPBACK_HOSTS = new Set(["127.0.0.1", "localhost", "::1"]);
+function validateObserverStanza(input4) {
+  const endpoint = parseObserverEndpoint(input4.endpoint);
+  const host = endpoint.slice(0, endpoint.lastIndexOf(":"));
+  if (input4.network !== "devnet" && LOOPBACK_HOSTS.has(host.toLowerCase())) {
+    throw new UnsupportedObserverError(`loopback observer endpoint is not container-visible on ${input4.network}; use a docker DNS name such as indexer:3700`);
   }
-  return parsed;
+  if (input4.mode === "signer-shared" && !input4.recovery) {
+    throw new UnsupportedObserverError("signer-shared mode requires --recovery journal or --recovery archive");
+  }
+  return { endpoint };
+}
+function renderObserverStanza(input4) {
+  const { endpoint } = validateObserverStanza(input4);
+  const indexer = input4.mode === "indexer";
+  const timeoutMs = indexer ? 2000 : 500;
+  const disableRetries = !indexer;
+  const comment = indexer ? "# Pure indexer: retry delivery. A slow observer can stall the node." : "# Signer-shared: do not retry. Missed blocks refill from the journal/archive.";
+  return [
+    comment,
+    "[[events_observer]]",
+    `endpoint = "${endpoint}"`,
+    'events_keys = ["*"]',
+    `timeout_ms = ${timeoutMs}`,
+    `disable_retries = ${disableRetries}`,
+    ""
+  ].join(`
+`);
+}
+function defaultObserverEndpoint(network) {
+  if (network === "devnet")
+    return "127.0.0.1:3700";
+  return "indexer:3700";
 }
-function registerFaucetCommand(program2) {
-  const faucet = program2.command("faucet").description("Mint test assets on a local devnet");
-  faucet.command("sbtc").description("Mint mock sBTC to an address on your local devnet").requiredOption("--to <address>", "recipient Stacks address").option("--amount <sats>", `amount in sats (default ${DEFAULT_AMOUNT_SATS}, minimum ${DUST_LIMIT_SATS})`).option("--contract <id>", "sBTC deposit contract (default: <deployer>.sbtc-deposit)").option("--rpc-url <url>", "devnet node RPC (default http://localhost:3999)").option("--json", "Output as JSON").addHelpText("after", `
-Examples:
-  $ sl faucet sbtc --to ST1PQHQKV0RJXZFY1DGX8MNSNYVE3VGZJSRTPGZGM
-  $ sl faucet sbtc --to ST2... --amount 5000000
 
-Requires a devnet running with the sBTC contract set deployed by your
-Clarinet deployer — that deployer is the signer set on your own chain, which
-is what makes minting possible without Bitcoin.`).action(async (opts) => {
-    try {
-      const network = process.env.STACKS_NETWORK ?? "devnet";
-      if (network !== "devnet" && network !== "local") {
-        printError(`sl faucet only works on devnet, not ${network}.`, {
-          hint: "Mock sBTC is mintable because you deployed the contracts. On testnet or mainnet the signer set is not yours."
-        });
-        process.exit(2);
-      }
-      const rpcUrl = opts.rpcUrl ?? "http://localhost:3999";
-      const amount = parseAmount(opts.amount);
-      const projectDir = findClarinetProject(process.cwd());
-      if (!projectDir) {
-        printError("No Clarinet project found.", {
-          hint: "Run this from a project containing Clarinet.toml, or pass --contract explicitly."
-        });
-        process.exit(2);
-      }
-      const mnemonic = await readDeployerMnemonic(projectDir);
-      const account = mnemonicToAccount(mnemonic, {
-        addressVersion: devnet.addressVersion.singleSig
-      });
-      const contract = opts.contract ?? `${account.address}.sbtc-deposit`;
-      const anchor = await readBurnAnchor(rpcUrl);
-      const client3 = createWalletClient({
-        account,
-        chain: devnet,
-        transport: http3(rpcUrl)
-      });
-      const depositTxid = randomBytes2(32).toString("hex");
-      const sweepTxid = randomBytes2(32).toString("hex");
-      note(`  minting ${amount} sats to ${opts.to}`);
-      note(`  via ${contract} as signer ${account.address}`);
-      const txid = await client3.callContract({
-        contract,
-        functionName: "complete-deposit-wrapper",
-        functionArgs: [
-          Cl.bufferFromHex(depositTxid),
-          Cl.uint(0),
-          Cl.uint(amount),
-          Cl.principal(opts.to),
-          Cl.bufferFromHex(anchor.hash),
-          Cl.uint(anchor.height),
-          Cl.bufferFromHex(sweepTxid)
-        ],
-        postConditionMode: "allow"
-      });
-      output({
-        json: opts.json,
-        data: {
-          txid,
-          recipient: opts.to,
-          amount_sats: amount.toString(),
-          contract,
-          burn_height: anchor.height
-        },
-        human: () => {
-          success(`Minted ${amount} sats of mock sBTC to ${opts.to}.`);
-          note(`  tx ${txid}`);
-          console.error(dim("  Mock sBTC on your devnet — not the canonical asset."));
-        }
-      });
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      const hint = /ECONNREFUSED|fetch failed/.test(message) ? "Is your devnet running? Start it with `clarinet devnet start`." : /NoSuchContract|does not exist/.test(message) ? "Deploy the sBTC contract set to your devnet first, or pass --contract." : "Check that your Clarinet deployer matches the sBTC contract deployer.";
-      printError(message, { hint });
-      process.exit(1);
+// src/commands/observer.ts
+init_output();
+function registerObserverCommand(program2) {
+  program2.command("observer").description("Print the Stacks events_observer stanza for this node mode").option("--mode <mode>", "indexer (retry) or signer-shared (no retry)", "indexer").option("--endpoint <host:port>", "Observer callback the node will POST to").option("--recovery <source>", "Required for signer-shared: journal or archive").option("--network <network>", "mainnet, testnet, or devnet", process.env.STACKS_NETWORK ?? "mainnet").action((opts) => {
+    const mode = parseObserverMode(opts.mode);
+    const network = parseInstanceNetwork(opts.network);
+    const endpoint = opts.endpoint ?? defaultObserverEndpoint(network);
+    const recovery = opts.recovery ? parseRecoverySource(opts.recovery) : undefined;
+    if (mode === "signer-shared") {
+      note("Signer-shared nodes skip observer retries. Pair with a journal or archive for completeness.");
     }
+    writeData(renderObserverStanza({ mode, endpoint, network, recovery }));
   });
 }
 // src/cli.ts
 var { version } = package_default;
-program.name("secondlayer").alias("sl").description("SecondLayer CLI — dedicated Stacks indexing + real-time subgraphs").version(version).option("--network <network>", "Override network (local, testnet, mainnet)").option("--api-key <key>", "API credential (overrides SL_API_KEY)").option("--api-url <url>", "API endpoint (overrides SL_API_URL)").showSuggestionAfterError(true).showHelpAfterError("(run `sl --help` to see available commands)");
+program.name("secondlayer").alias("sl").description("Secondlayer CLI — self-hosted Stacks data runtime").version(version).option("--network <network>", "Override network (local, testnet, mainnet)").option("--api-key <key>", "API credential (overrides SL_API_KEY)").option("--api-url <url>", "API endpoint (overrides SL_API_URL)").showSuggestionAfterError(true).showHelpAfterError("(run `sl --help` to see available commands)");
 program.hook("preAction", (thisCommand) => {
   const { network, apiKey, apiUrl } = thisCommand.opts();
   if (network)
@@ -39507,16 +39790,15 @@ program.hook("preAction", (thisCommand) => {
 });
 program.addHelpText("after", `
 Quickstart:
-  $ sl login                        # Authenticate (magic-link email)
+  $ sl init --network mainnet
+  $ sl bootstrap --against <manifest>
   $ sl subgraphs create my-watcher --template sip-010-balances
   $ sl subgraphs deploy subgraphs/my-watcher.ts
-  $ sl subgraphs status my-watcher
 `);
 program.commandsGroup("Getting started:");
-program.command("init").description("Initialize a new secondlayer.config.ts file").action(async () => {
-  const { init: init3 } = await Promise.resolve().then(() => (init_init(), exports_init));
-  await init3();
-});
+registerInitCommand(program);
+registerBootstrapCommand(program);
+registerObserverCommand(program);
 registerLoginCommand(program);
 registerLogoutCommand(program);
 registerWhoamiCommand(program);
@@ -39544,13 +39826,11 @@ Examples:
 program.commandsGroup("Local development:");
 registerLocalCommand(program);
 registerDevnetCommand(program);
-registerFaucetCommand(program);
 program.commandsGroup("Diagnostics:");
 registerStatusCommand(program);
 registerDoctorCommand(program);
 registerConfigCommand(program);
 registerContextCommand(program);
-registerBootstrapCommand(program);
 registerVerifyCommand(program);
 registerRepairCommand(program);
 program.commandsGroup("Account:");
@@ -39558,5 +39838,5 @@ registerAccountCommand(program);
 registerKeysCommand(program);
 program.parse();
 
-//# debugId=F913417C10273C0264756E2164756E21
+//# debugId=8F8395688EA7983464756E2164756E21
 //# sourceMappingURL=cli.js.map