@secondlayer/cli 19.1.3 → 19.2.1

package/README.md

@@ -99,6 +99,7 @@ No account. Writes `.env.local`, restores history, prints the Stacks observer st
 | `secondlayer bootstrap --against <manifest> [--from-block <n>] [--to-block <n>] [--verify all\|blocks] [--public-key <pem>] [-y] [--json]` | Restore chain history from a verified archive into an empty database. A run that died mid-way resumes per dataset on re-run. After the load, digests for blocks, transactions, and events are checked over the restored range (`--verify blocks` skips the child datasets and the minutes they cost). Partition fetches retry three times with backoff on resets, timeouts, 429 (honoring `Retry-After`) and 5xx; a link that stays down exits `1` with a re-run hint, and the re-run resumes. Exit `0` restored, `1` diverged or interrupted, `2` refused |
 | `secondlayer observer [--mode indexer\|signer-shared] [--endpoint host:port] [--network …]` | Print the `[[events_observer]]` stanza. Signer-shared skips retries; a missed block stays a gap until `repair` |
 | `secondlayer verify [all\|raw\|decode:<name>\|subgraph:<name>] --against <manifest> [--quick\|--deep\|--anchor]` | Compare local data to a signed archive. Default target `raw`. Exit `0` clean, `1` diverged, `2` unanchored |
+| `secondlayer verify block <height\|index_block_hash> [--node <url>] [--checkpoint <file>] [--rows] [--json]` | Prove one Stacks block from the checkpoint built into this release: Bitcoin headers, burn block, signer set, signatures, state root, state diff, and with `--rows` the indexed rows. Nothing else is trusted; proofs come from the API, or a node with `--node`. Exit `0` proven, `1` a link is broken, `2` could not check |
 | `secondlayer repair --against <archive> [--apply] [-y]` | Plan (default) or apply an archive repair. A fixed block is rewritten with its transactions and events from the archive; when the reference has no child partition for a height, the block is rewritten alone, the height is named with a `bootstrap --from-block H --to-block H` remedy, and the exit is `1`. Partition fetches retry like `bootstrap`; a link that stays down exits `1` with a re-run hint, and heights already repaired are kept |
 
 Bootstrap and repair against the official hosted archive (`archive.secondlayer.tools`)

package/dist/cli.js

@@ -16630,7 +16630,7 @@ var init_dist3 = __esm(() => {
 // ../../node_modules/tinyexec/dist/main.js
 import { createRequire as e } from "module";
 import { spawn as t } from "node:child_process";
-import { delimiter as n, dirname as r, normalize as i, resolve as a2 } from "node:path";
+import { delimiter as n2, dirname as r, normalize as i, resolve as a2 } from "node:path";
 import { cwd as o } from "node:process";
 import { PassThrough as s } from "node:stream";
 import c from "node:readline";
@@ -16649,7 +16649,7 @@ function x(e) {
   return b;
 }
 function S(e, t) {
-  const i = t.value.split(n);
+  const i = t.value.split(n2);
   let o = e;
   let s;
   do {
@@ -16659,7 +16659,7 @@ function S(e, t) {
   } while (o !== s);
   return {
     key: t.key,
-    value: i.join(n)
+    value: i.join(n2)
   };
 }
 function C(e, t) {
@@ -23945,19 +23945,19 @@ class c2 {
   }
 }
 function i2() {
-  return this[n2].next();
+  return this[n3].next();
 }
 function o2(r) {
-  return this[n2].return(r);
+  return this[n3].return(r);
 }
 function h2({ preventCancel: r = false } = {}) {
   const e = this.getReader(), t = new c2(e, r), s = Object.create(u2);
-  return s[n2] = t, s;
+  return s[n3] = t, s;
 }
-var a3, n2, u2;
+var a3, n3, u2;
 var init_asyncIterator = __esm(() => {
   a3 = Object.getPrototypeOf(Object.getPrototypeOf(async function* () {}).prototype);
-  n2 = Symbol();
+  n3 = Symbol();
   Object.defineProperty(i2, "name", { value: "next" });
   Object.defineProperty(o2, "name", { value: "return" });
   u2 = Object.create(a3, {
@@ -29053,13 +29053,13 @@ import { createHash as createHash3 } from "node:crypto";
 import {
   mkdir as mkdir2,
   open,
-  readFile as readFile3,
+  readFile as readFile4,
   stat,
   unlink as unlink3,
   writeFile as writeFile4
 } from "node:fs/promises";
 async function readJsonFile(path) {
-  const text = await readFile3(path, "utf-8");
+  const text = await readFile4(path, "utf-8");
   return JSON.parse(text);
 }
 async function writeTextFile(path, content) {
@@ -29440,7 +29440,7 @@ var init_git_status = () => {};
 
 // ../../node_modules/typescript/lib/typescript.js
 var require_typescript = __commonJS(function(exports, module) {
-  var __dirname = "/Users/ryan/projects/secondlayer/node_modules/typescript/lib", __filename = "/Users/ryan/projects/secondlayer/node_modules/typescript/lib/typescript.js";
+  var __dirname = "/Users/ryan/projects/secondlayer/.claude/worktrees/agent-adcb760acc54b4c28/node_modules/typescript/lib", __filename = "/Users/ryan/projects/secondlayer/.claude/worktrees/agent-adcb760acc54b4c28/node_modules/typescript/lib/typescript.js";
   /*! *****************************************************************************
   Copyright (c) Microsoft Corporation. All rights reserved.
   Licensed under the Apache License, Version 2.0 (the "License"); you may not use
@@ -202526,7 +202526,7 @@ var {
 // package.json
 var package_default = {
   name: "@secondlayer/cli",
-  version: "19.1.3",
+  version: "19.2.1",
   description: "Run a Stacks index on your own hardware — set it up, restore verified history, and keep it current.",
   repository: {
     type: "git",
@@ -202565,10 +202565,11 @@ var package_default = {
     "@inquirer/prompts": "^8.2.0",
     "@secondlayer/bundler": "^0.6.1",
     "@secondlayer/scaffold": "^1.6.1",
-    "@secondlayer/sdk": "^14.2.0",
-    "@secondlayer/shared": "^11.19.3",
+    "@secondlayer/sdk": "^14.3.0",
+    "@secondlayer/shared": "^11.20.0",
     "@secondlayer/stacks": "^6.1.1",
     "@secondlayer/subgraphs": "^6.3.6",
+    "@secondlayer/verify": "^0.1.0",
     esbuild: "^0.28.2",
     "smol-toml": "^1.8.0",
     zod: "^4.3.6"
@@ -204000,6 +204001,197 @@ import {
 import { getDb as getDb3 } from "@secondlayer/shared/db";
 init_output();
 init_resolve_auth();
+
+// src/commands/verify-block.ts
+init_output();
+init_resolve_auth();
+import { readFile as readFile3 } from "node:fs/promises";
+import {
+  BlockVerifier,
+  MAINNET_CHECKPOINT,
+  NodeRpcProofSource,
+  SecondlayerProofSource,
+  parseNakamotoHeader,
+  unhex
+} from "@secondlayer/verify";
+var LINKS = [
+  { step: "block", label: "block" },
+  { step: "bitcoin", label: "bitcoin" },
+  { step: "burn", label: "burn" },
+  { step: "signer-set", label: "cycle" },
+  { step: "signatures", label: "signatures" },
+  { step: "witness", label: "state root" },
+  { step: "names", label: "diff" },
+  { step: "rows", label: "rows" }
+];
+var LABEL_WIDTH = Math.max(...LINKS.map((l) => l.label.length));
+var n = (v) => v.toLocaleString("en-US");
+function parseBlockRef(raw) {
+  if (/^\d+$/.test(raw)) {
+    const height = Number(raw);
+    if (Number.isSafeInteger(height))
+      return height;
+  }
+  const hash = raw.replace(/^0x/i, "").toLowerCase();
+  if (/^[0-9a-f]{64}$/.test(hash))
+    return hash;
+  throw new Error(`expected a block height or a 64-hex index block hash, got "${raw}"`);
+}
+async function readCheckpoint(path) {
+  const cp = JSON.parse(await readFile3(path, "utf8"));
+  const ok = typeof cp?.stacks?.header === "string" && Number.isSafeInteger(cp.stacks.cycle) && typeof cp.stacks.signerSet === "string" && Number.isSafeInteger(cp.bitcoin?.height) && typeof cp.bitcoin?.header === "string";
+  if (!ok)
+    throw new Error(`${path}: a checkpoint needs stacks.{header, cycle, signerSet} and bitcoin.{height, header}`);
+  return cp;
+}
+function defaultSource(node) {
+  const api = new SecondlayerProofSource({
+    baseUrl: resolveApiUrl(),
+    apiKey: resolveDataPlaneKey() ?? ""
+  });
+  return node ? { ...api, ...new NodeRpcProofSource({ nodeUrl: node }) } : api;
+}
+function prepareSource(src) {
+  const out = {
+    getBlock: (ref) => src.getBlock(ref),
+    getMarfProof: (path, tip) => src.getMarfProof(path, tip),
+    getBurnPreimage: (ch) => src.getBurnPreimage(ch),
+    getWitness: (id) => {
+      note(`  fetching state witness ${id}`);
+      return src.getWitness(id);
+    },
+    getBitcoinHeaders: (from, count) => {
+      note(`  syncing Bitcoin headers ${n(from)}..${n(from + count - 1)}`);
+      return src.getBitcoinHeaders(from, count);
+    }
+  };
+  const { getStateWrites, getVmEvents } = src;
+  if (getStateWrites)
+    out.getStateWrites = (height) => getStateWrites.call(src, height);
+  if (getVmEvents)
+    out.getVmEvents = (height) => {
+      note(`  fetching indexed rows for ${n(height)}`);
+      return getVmEvents.call(src, height);
+    };
+  return out;
+}
+function linkDetail(step, r, cp, rows) {
+  switch (step) {
+    case "block":
+      return `${n(r.height ?? 0)}  ${r.blockId}`;
+    case "bitcoin":
+      return `headers ${n(cp.bitcoin.height)}..${n(r.burnHeight ?? 0)}, proof-of-work and retargets checked`;
+    case "burn":
+      return `height ${n(r.burnHeight ?? 0)}  ${r.bitcoinBlockHash}`;
+    case "signer-set":
+      return r.cycle === cp.stacks.cycle ? `${r.cycle}, the checkpoint's own signer set` : `${r.cycle}, signer set proven forward from checkpoint cycle ${cp.stacks.cycle}`;
+    case "signatures":
+      return `${n(r.signerWeight ?? 0n)} / ${n(r.totalWeight ?? 0n)} weight signed, threshold ${n(r.threshold ?? 0n)}`;
+    case "witness":
+      return `${r.stateRoot} matches the witness`;
+    case "names": {
+      const d = r.diff;
+      if (!d)
+        return "";
+      const named = d.writes.filter((w) => w.named).length;
+      const written = named ? `${d.writes.length} written (${named} named, ${d.writes.length - named} unnamed)` : `${d.writes.length} written (unnamed${rows ? "" : "; --rows names them"})`;
+      return `${written}, ${d.carried.length} carried, ${d.internal.length} internal`;
+    }
+    case "rows":
+      return `${n(r.rowsChecked ?? 0)} vm_events rows match the diff`;
+  }
+}
+function report(r, cp, rows) {
+  const first = r.failures[0];
+  const broken = first ? LINKS.findIndex((l) => l.step === first.step) : LINKS.length;
+  for (const [i, link] of LINKS.entries()) {
+    const label = link.label.padEnd(LABEL_WIDTH);
+    const failure = r.failures.find((f) => f.step === link.step);
+    if (failure)
+      writeData(`${red("✗")} ${label}  ${failure.message}`);
+    else if (link.step === "rows" && !rows)
+      writeData(dim(`· ${label}  not checked (pass --rows)`));
+    else if (i > broken)
+      writeData(dim(`· ${label}  not checked: an earlier link is broken`));
+    else if (link.step === "rows" && r.rowsChecked === undefined)
+      writeData(dim(`· ${label}  not checked: the source serves no indexed rows`));
+    else
+      writeData(`${green("✓")} ${label}  ${linkDetail(link.step, r, cp, rows)}`);
+  }
+  for (const line of r.notes)
+    if (rows || !line.includes("state_writes"))
+      note(`  note: ${line}`);
+  if (!first) {
+    const from = n(parseNakamotoHeader(unhex(cp.stacks.header)).chainLength);
+    writeData(green(`✓ Block ${n(r.height ?? 0)} is proven. Trusted: only the checkpoint (Stacks ${from}, Bitcoin ${n(cp.bitcoin.height)}).`));
+    return;
+  }
+  const label = LINKS[broken]?.label ?? first.step;
+  writeData(red(first.code === "unavailable" ? `✗ Could not check the ${label} link: the source could not serve it.` : `✗ Not proven: the ${label} link is broken.`));
+}
+function verificationJson(r) {
+  return JSON.stringify(r, (_k, v) => typeof v === "bigint" ? v.toString() : v, 2);
+}
+function exitCodeOf(r) {
+  if (r.ok)
+    return VERIFY_EXIT.CLEAN;
+  return r.failures[0]?.code === "unavailable" ? VERIFY_EXIT.UNANCHORED : VERIFY_EXIT.DIVERGED;
+}
+async function runVerifyBlock(ref, opts, deps = {}) {
+  let checkpoint;
+  let verifier;
+  let target;
+  try {
+    target = parseBlockRef(ref);
+    checkpoint = opts.checkpoint ? await readCheckpoint(opts.checkpoint) : MAINNET_CHECKPOINT;
+    const source = prepareSource(deps.source ?? defaultSource(opts.node));
+    verifier = new BlockVerifier({ source, checkpoint, rows: !!opts.rows });
+  } catch (err) {
+    printError(err instanceof Error ? err.message : String(err));
+    return VERIFY_EXIT.UNANCHORED;
+  }
+  note(`Verifying block ${typeof target === "number" ? n(target) : target}`);
+  const result = await verifier.verify(target);
+  if (opts.json)
+    writeData(verificationJson(result));
+  else
+    report(result, checkpoint, !!opts.rows);
+  return exitCodeOf(result);
+}
+function attachVerifyBlockCommand(verify) {
+  return verify.command("block").description("Prove one Stacks block from the checkpoint built into this release, trusting nothing else").argument("<ref>", "block height or index block hash").option("--node <url>", "read blocks and MARF proofs from this Stacks node RPC instead of the API").option("--checkpoint <file>", "trust this checkpoint JSON instead of the one built into this release").option("--rows", "also prove the indexer's rows for the block (state_writes, vm_events) against its state diff").addHelpText("after", `
+What is proven, link by link:
+  bitcoin     headers from the checkpoint to the block's burn block: proof-of-work and retargets
+  burn        the block's consensus hash commits to that Bitcoin block
+  cycle       the reward cycle's signer set, proven forward from the checkpoint's set
+  signatures  signers holding at least 70% of the weight signed the block header
+  state root  the state witness hashes to the root in the signed header
+  diff        every leaf the block wrote, carried, or kept as bookkeeping
+  rows        with --rows: the Index API's rows match that diff
+
+Nothing is trusted except the checkpoint. Proofs come from the API
+(SECONDLAYER_API_URL, or --api-url) with your account key, or from a node
+with --node; a source that lies can fail a link but never pass one.
+
+Examples:
+  $ secondlayer verify block 9137005
+  $ secondlayer verify block 0x2e5962b00b8f243e1a4b5a1b7ff3076618ce5e737e30c019bc61e461c92f57ff
+  $ secondlayer verify block 9137005 --node http://127.0.0.1:20443 --rows
+  $ secondlayer verify block 9137005 --json
+
+Output: one line per link on stdout, progress on stderr. --json prints the
+full verification result instead (signer weights as decimal strings).
+
+Exit codes:
+  0  every link holds
+  1  a link is broken (the first is named)
+  2  could not check: the source could not serve a link, or bad input`).action(async (ref, opts, cmd) => {
+    const json = cmd.optsWithGlobals().json === true;
+    process.exit(await runVerifyBlock(ref, { ...opts, json }));
+  });
+}
+
+// src/commands/verify.ts
 var VERIFY_EXIT = {
   CLEAN: 0,
   DIVERGED: 1,
@@ -204022,7 +204214,7 @@ function statusLabel(status) {
   return yellow("missing");
 }
 function attachVerifyCommand(cmd) {
-  return cmd.argument("[target]", "all | raw | decode:<name> | subgraph:<name>", "raw").option("--quick", "coverage/identity only (default)").option("--deep", "include semantic / scratch replay where available").option("--anchor", "require a verified archive signature").requiredOption("--against <manifest>", "archive manifest: an https URL or a local file path").option("--from-block <n>", "first height to check").option("--to-block <n>", "last height to check").option("--counts", "also compare transaction/event row counts (slower)").option("--semantic", "also recompute per-partition semantic digests locally and compare (slow: full re-stream)").option("--public-key <pem>", "pin a signing key; default is the archive key built into this release").option("--insecure", "skip the manifest signature check (not recommended)").option("--json", "Output as JSON").addHelpText("after", `
+  return cmd.argument("[target]", "all | raw | decode:<name> | subgraph:<name>", "raw").option("--quick", "coverage/identity only (default)").option("--deep", "include semantic / scratch replay where available").option("--anchor", "require a verified archive signature").option("--against <manifest>", "archive manifest: an https URL or a local file path (required)").option("--from-block <n>", "first height to check").option("--to-block <n>", "last height to check").option("--counts", "also compare transaction/event row counts (slower)").option("--semantic", "also recompute per-partition semantic digests locally and compare (slow: full re-stream)").option("--public-key <pem>", "pin a signing key; default is the archive key built into this release").option("--insecure", "skip the manifest signature check (not recommended)").option("--json", "Output as JSON").addHelpText("after", `
 Examples:
   $ secondlayer verify --against https://archive.secondlayer.tools/.../snapshots/<digest>.json
   $ secondlayer verify raw --against ./snapshot.json --from-block 8000000 --to-block 8499999
@@ -204033,7 +204225,11 @@ Examples:
 Exit codes:
   0  local data matches the archive
   1  divergence found (divergent ranges are listed)
-  2  unanchored — reference unavailable or unverifiable`).action(async (targetArg, opts) => {
+  2  unanchored — reference unavailable or unverifiable`).action(async (targetArg, opts, command) => {
+    if (opts.against === undefined)
+      command.error("error: required option '--against <manifest>' not specified", {
+        code: "commander.missingMandatoryOptionValue"
+      });
     try {
       const target = parseVerifyTarget(targetArg);
       const mode = opts.deep ? "deep" : opts.anchor ? "anchor" : "quick";
@@ -204212,7 +204408,8 @@ Exit codes:
   });
 }
 function registerVerifyCommand(program) {
-  attachVerifyCommand(program.command("verify").description("Compare local chain data against a signed archive (read-only; nothing is uploaded)"));
+  const verify = attachVerifyCommand(program.command("verify").description("Compare local chain data against a signed archive, or prove one block with `verify block` (read-only)"));
+  attachVerifyBlockCommand(verify);
 }
 
 // src/commands/archive.ts
@@ -206262,7 +206459,7 @@ init_resolve_auth();
 
 // src/commands/faucet.ts
 import { randomBytes as randomBytes2 } from "node:crypto";
-import { readFile as readFile4 } from "node:fs/promises";
+import { readFile as readFile5 } from "node:fs/promises";
 import { join as join11 } from "node:path";
 import { http as http3, createWalletClient } from "@secondlayer/stacks";
 import { mnemonicToAccount } from "@secondlayer/stacks/accounts";
@@ -206276,7 +206473,7 @@ async function readDeployerMnemonic(projectDir) {
   const path = join11(projectDir, "settings", "Devnet.toml");
   let raw;
   try {
-    raw = await readFile4(path, "utf8");
+    raw = await readFile5(path, "utf8");
   } catch {
     throw new Error(`could not read ${path}`);
   }
@@ -207366,7 +207563,7 @@ import { resolveApiKey as resolveApiKey4 } from "@secondlayer/sdk";
 
 // src/lib/project-file.ts
 import { existsSync as existsSync8 } from "node:fs";
-import { mkdir as mkdir4, readFile as readFile5, writeFile as writeFile5 } from "node:fs/promises";
+import { mkdir as mkdir4, readFile as readFile6, writeFile as writeFile5 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
 import { dirname as dirname10, join as join14, parse as parsePath2, resolve as resolve9 } from "node:path";
 import { z as z4 } from "zod";
@@ -207383,7 +207580,7 @@ async function readActiveProject(cwd, globalDefault) {
     const candidate = join14(dir, DIRNAME, FILENAME);
     if (existsSync8(candidate)) {
       try {
-        const raw = await readFile5(candidate, "utf8");
+        const raw = await readFile6(candidate, "utf8");
         const parsed = ProjectFileSchema.parse(JSON.parse(raw));
         return { slug: parsed.slug, resolvedFrom: candidate };
       } catch {}
@@ -209308,5 +209505,5 @@ registerCreditsCommand(program);
 registerArchiveCommand(program);
 program.parse();
 
-//# debugId=14D458833783D3C664756E2164756E21
+//# debugId=063D7FC6388E8ABC64756E2164756E21
 //# sourceMappingURL=cli.js.map