@secondlayer/cli 19.2.1 → 19.3.0

package/README.md

@@ -99,7 +99,7 @@ No account. Writes `.env.local`, restores history, prints the Stacks observer st
 | `secondlayer bootstrap --against <manifest> [--from-block <n>] [--to-block <n>] [--verify all\|blocks] [--public-key <pem>] [-y] [--json]` | Restore chain history from a verified archive into an empty database. A run that died mid-way resumes per dataset on re-run. After the load, digests for blocks, transactions, and events are checked over the restored range (`--verify blocks` skips the child datasets and the minutes they cost). Partition fetches retry three times with backoff on resets, timeouts, 429 (honoring `Retry-After`) and 5xx; a link that stays down exits `1` with a re-run hint, and the re-run resumes. Exit `0` restored, `1` diverged or interrupted, `2` refused |
 | `secondlayer observer [--mode indexer\|signer-shared] [--endpoint host:port] [--network …]` | Print the `[[events_observer]]` stanza. Signer-shared skips retries; a missed block stays a gap until `repair` |
 | `secondlayer verify [all\|raw\|decode:<name>\|subgraph:<name>] --against <manifest> [--quick\|--deep\|--anchor]` | Compare local data to a signed archive. Default target `raw`. Exit `0` clean, `1` diverged, `2` unanchored |
-| `secondlayer verify block <height\|index_block_hash> [--node <url>] [--checkpoint <file>] [--rows] [--json]` | Prove one Stacks block from the checkpoint built into this release: Bitcoin headers, burn block, signer set, signatures, state root, state diff, and with `--rows` the indexed rows. Nothing else is trusted; proofs come from the API, or a node with `--node`. Exit `0` proven, `1` a link is broken, `2` could not check |
+| `secondlayer verify block <height\|index_block_hash> [--node <url>] [--checkpoint <file>] [--rows] [--json]` | Prove one Stacks block from the checkpoint built into this release: Bitcoin headers, burn block, signer set, signatures, state root, state diff, and with `--rows` the indexed rows. Blocks below the checkpoint are tied to it by hash (parent links or one MARF proof) instead of signatures. Nothing else is trusted; proofs come from the API, or a node with `--node`. Exit `0` proven, `1` a link is broken, `2` could not check |
 | `secondlayer repair --against <archive> [--apply] [-y]` | Plan (default) or apply an archive repair. A fixed block is rewritten with its transactions and events from the archive; when the reference has no child partition for a height, the block is rewritten alone, the height is named with a `bootstrap --from-block H --to-block H` remedy, and the exit is `1`. Partition fetches retry like `bootstrap`; a link that stays down exits `1` with a re-run hint, and heights already repaired are kept |
 
 Bootstrap and repair against the official hosted archive (`archive.secondlayer.tools`)

package/dist/cli.js

@@ -29440,7 +29440,7 @@ var init_git_status = () => {};
 
 // ../../node_modules/typescript/lib/typescript.js
 var require_typescript = __commonJS(function(exports, module) {
-  var __dirname = "/Users/ryan/projects/secondlayer/.claude/worktrees/agent-adcb760acc54b4c28/node_modules/typescript/lib", __filename = "/Users/ryan/projects/secondlayer/.claude/worktrees/agent-adcb760acc54b4c28/node_modules/typescript/lib/typescript.js";
+  var __dirname = "/Users/ryan/projects/secondlayer/.claude/worktrees/agent-a5aea7deee5fef330/node_modules/typescript/lib", __filename = "/Users/ryan/projects/secondlayer/.claude/worktrees/agent-a5aea7deee5fef330/node_modules/typescript/lib/typescript.js";
   /*! *****************************************************************************
   Copyright (c) Microsoft Corporation. All rights reserved.
   Licensed under the Apache License, Version 2.0 (the "License"); you may not use
@@ -198790,7 +198790,7 @@ import {
   watch,
   writeFileSync as writeFileSync3
 } from "node:fs";
-import { basename, dirname as dirname5, extname, join as join7, resolve as resolve5 } from "node:path";
+import { basename, dirname as dirname5, extname, join as join7, relative, resolve as resolve5 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { confirm as confirm2 } from "@inquirer/prompts";
 import {
@@ -198802,6 +198802,10 @@ import {
   billingPausedCode
 } from "@secondlayer/shared/schemas";
 import { TRAIT_STANDARDS } from "@secondlayer/stacks/clarity";
+import {
+  deriveVerification,
+  isDeterminismViolation
+} from "@secondlayer/subgraphs/verification";
 function webhookHint(apiUrl, name, firstTable) {
   if (!firstTable || isMerchantUrl(apiUrl))
     return null;
@@ -199121,6 +199125,36 @@ function createSubgraphDeployPreview(def, options = {}) {
     ...options.bundleBytes !== undefined ? { bundleSize: `${options.bundleBytes} bytes` } : {}
   };
 }
+function formatVerificationLines(verification, pin) {
+  if (!verification)
+    return [];
+  const head = [
+    verification.level,
+    ...pin ? [`pin ${pin.slice(0, 4)}…${pin.slice(-4)}`] : [],
+    ...verification.reasons
+  ].join(" · ");
+  return [
+    `verification  ${head}`,
+    ...verification.unproven.map((u) => `unproven      ${u}`)
+  ];
+}
+function formatVerificationStatus(verification) {
+  if (!verification)
+    return "unknown (deployed before levels were derived)";
+  const head = [verification.level, ...verification.reasons].join(" · ");
+  return verification.unproven.length > 0 ? `${head} (unproven: ${verification.unproven.join("; ")})` : head;
+}
+function checkDeterminism(def, findings) {
+  const verification = deriveVerification(def, findings);
+  if (isDeterminismViolation(verification)) {
+    error("Nondeterministic handler. This subgraph's sources are provable, so its handlers must give the same rows on every run:");
+    for (const r of verification.reasons)
+      error(`  ✗ ${r}`);
+    info("Derive values from event, ctx.block and ctx.tx only (no Date, Math.random, fetch, timers or locale formatting).");
+    process.exit(1);
+  }
+  return verification;
+}
 function printSubgraphDeployPreview(preview, context) {
   success("Subgraph deploy dry run passed");
   const pairs = [
@@ -199493,8 +199527,11 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
         info(`${dryRun ? "Bundling for remote deploy dry run" : "Bundling for remote deploy"} (${config.network})...`);
         const source = derived?.source ?? await readFile(absPath, "utf8");
         const { bundleSubgraphCode } = await import("@secondlayer/bundler");
-        const bundled = await bundleSubgraphCode(source);
+        const bundled = await bundleSubgraphCode(source, {
+          fileName: relative(process.cwd(), absPath)
+        });
         const handlerCode = bundled.handlerCode;
+        const localVerification = checkDeterminism(effectiveDef, bundled.findings);
         if (dryRun) {
           printSubgraphDeployPreview(createSubgraphDeployPreview(validated, {
             bundleBytes: Buffer.byteLength(handlerCode, "utf8")
@@ -199503,6 +199540,9 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
             file: absPath,
             bundled: true
           });
+          for (const line of formatVerificationLines(localVerification)) {
+            info(`  ${line}`);
+          }
           return;
         }
         const deployStartBlock = startBlock ?? effectiveDef.startBlock;
@@ -199544,6 +199584,11 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
         });
         for (const w of result.warnings ?? [])
           warn(w);
+        const printVerification = () => {
+          for (const line of formatVerificationLines(result.verification ?? localVerification, result.pin)) {
+            info(`  ${line}`);
+          }
+        };
         const printDeployFooter = async () => {
           try {
             const { apiUrl } = await resolveAuth();
@@ -199563,10 +199608,13 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
         };
         if (result.action === "unchanged") {
           info(`Subgraph "${effectiveDef.name}" is up to date (v${result.version} — no changes)`);
+          printVerification();
         } else if (result.action === "handler_updated") {
           success(`Subgraph "${effectiveDef.name}" handler updated (v${result.version} — schema unchanged, no reindex needed)`);
+          printVerification();
         } else if (result.action === "created") {
           success(`Subgraph "${effectiveDef.name}" created → v${result.version}`);
+          printVerification();
           await printDeployFooter();
         } else if (result.action === "reindexed") {
           if (result.diff) {
@@ -199583,6 +199631,7 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
             }
           }
           success(`Subgraph "${effectiveDef.name}" updated → v${result.version} (reindexing)`);
+          printVerification();
           await printDeployFooter();
         } else {
           if (result.diff) {
@@ -199594,22 +199643,37 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
             }
           }
           success(`Subgraph "${effectiveDef.name}" updated → v${result.version}`);
+          printVerification();
           await printDeployFooter();
         }
       } else {
+        let findings;
+        try {
+          const { bundleSubgraphCode } = await import("@secondlayer/bundler");
+          findings = (await bundleSubgraphCode(await readFile(absPath, "utf8"), {
+            fileName: relative(process.cwd(), absPath)
+          })).findings;
+        } catch {
+          findings = undefined;
+        }
+        const verification = findings ? checkDeterminism(effectiveDef, findings) : undefined;
         if (dryRun) {
           printSubgraphDeployPreview(createSubgraphDeployPreview(validated), {
             network: config.network,
             file: absPath,
             bundled: false
           });
+          for (const line of formatVerificationLines(verification)) {
+            info(`  ${line}`);
+          }
           return;
         }
         const { deploySchema } = await import("@secondlayer/subgraphs");
         const { getDb, closeDb } = await import("@secondlayer/shared/db");
         const db = getDb();
         const result = await deploySchema(db, effectiveDef, absPath, {
-          forceReindex: startBlock !== undefined
+          forceReindex: startBlock !== undefined,
+          verification
         });
         if (result.action === "unchanged") {
           info(`Subgraph "${effectiveDef.name}" is up to date (v${result.version} — no changes)`);
@@ -199622,6 +199686,9 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
         } else {
           success(`Subgraph "${effectiveDef.name}" updated → v${result.version}`);
         }
+        for (const line of formatVerificationLines(verification)) {
+          info(`  ${line}`);
+        }
         await closeDb();
       }
     } catch (err) {
@@ -199675,6 +199742,8 @@ ${data.length} subgraph(s) total`));
       console.log(formatKeyValue([
         ["Name", subgraph.name],
         ["Version", subgraph.version],
+        ["Pin", subgraph.pin ?? "none (deployed before pins)"],
+        ["Verification", formatVerificationStatus(subgraph.verification)],
         [
           "Status",
           formatSubgraphStatus(subgraph.status, subgraph.health.lastError)
@@ -202526,7 +202595,7 @@ var {
 // package.json
 var package_default = {
   name: "@secondlayer/cli",
-  version: "19.2.1",
+  version: "19.3.0",
   description: "Run a Stacks index on your own hardware — set it up, restore verified history, and keep it current.",
   repository: {
     type: "git",
@@ -202563,13 +202632,13 @@ var package_default = {
     "@biomejs/wasm-nodejs": "^1.9.0",
     "@dsnp/parquetjs": "~1.8.8",
     "@inquirer/prompts": "^8.2.0",
-    "@secondlayer/bundler": "^0.6.1",
+    "@secondlayer/bundler": "^0.7.0",
     "@secondlayer/scaffold": "^1.6.1",
     "@secondlayer/sdk": "^14.3.0",
-    "@secondlayer/shared": "^11.20.0",
+    "@secondlayer/shared": "^11.22.0",
     "@secondlayer/stacks": "^6.1.1",
-    "@secondlayer/subgraphs": "^6.3.6",
-    "@secondlayer/verify": "^0.1.0",
+    "@secondlayer/subgraphs": "^6.4.0",
+    "@secondlayer/verify": "^0.2.0",
     esbuild: "^0.28.2",
     "smol-toml": "^1.8.0",
     zod: "^4.3.6"
@@ -204015,6 +204084,7 @@ import {
   unhex
 } from "@secondlayer/verify";
 var LINKS = [
+  { step: "ancestry", label: "ancestry" },
   { step: "block", label: "block" },
   { step: "bitcoin", label: "bitcoin" },
   { step: "burn", label: "burn" },
@@ -204065,7 +204135,9 @@ function prepareSource(src) {
       return src.getBitcoinHeaders(from, count);
     }
   };
-  const { getStateWrites, getVmEvents } = src;
+  const { getEpoch2Header, getStateWrites, getVmEvents } = src;
+  if (getEpoch2Header)
+    out.getEpoch2Header = (id) => getEpoch2Header.call(src, id);
   if (getStateWrites)
     out.getStateWrites = (height) => getStateWrites.call(src, height);
   if (getVmEvents)
@@ -204077,6 +204149,14 @@ function prepareSource(src) {
 }
 function linkDetail(step, r, cp, rows) {
   switch (step) {
+    case "ancestry": {
+      const a = r.ancestry;
+      if (!a)
+        return "";
+      const checkpoint = parseNakamotoHeader(unhex(cp.stacks.header));
+      const start = a.fromHeight === Number(checkpoint.chainLength) ? `the checkpoint ${n(a.fromHeight)}` : `block ${n(a.fromHeight)}`;
+      return a.via === "marf" ? `${n(r.height ?? 0)} proven in the state of ${start} (one MARF proof)` : `${n(r.height ?? 0)} reached from ${start} by parent links`;
+    }
     case "block":
       return `${n(r.height ?? 0)}  ${r.blockId}`;
     case "bitcoin":
@@ -204101,18 +204181,29 @@ function linkDetail(step, r, cp, rows) {
       return `${n(r.rowsChecked ?? 0)} vm_events rows match the diff`;
   }
 }
+function notNeeded(step, r) {
+  if (!r.ancestry)
+    return false;
+  if (step === "bitcoin" || step === "burn")
+    return r.burnHeight === undefined;
+  return step === "signer-set" || step === "signatures";
+}
 function report(r, cp, rows) {
   const first = r.failures[0];
   const broken = first ? LINKS.findIndex((l) => l.step === first.step) : LINKS.length;
   for (const [i, link] of LINKS.entries()) {
     const label = link.label.padEnd(LABEL_WIDTH);
     const failure = r.failures.find((f) => f.step === link.step);
+    if (link.step === "ancestry" && !failure && !r.ancestry)
+      continue;
     if (failure)
       writeData(`${red("✗")} ${label}  ${failure.message}`);
     else if (link.step === "rows" && !rows)
       writeData(dim(`· ${label}  not checked (pass --rows)`));
     else if (i > broken)
       writeData(dim(`· ${label}  not checked: an earlier link is broken`));
+    else if (notNeeded(link.step, r))
+      writeData(dim(`· ${label}  not needed: the block is hash-chained to the checkpoint`));
     else if (link.step === "rows" && r.rowsChecked === undefined)
       writeData(dim(`· ${label}  not checked: the source serves no indexed rows`));
     else
@@ -204161,6 +204252,8 @@ async function runVerifyBlock(ref, opts, deps = {}) {
 function attachVerifyBlockCommand(verify) {
   return verify.command("block").description("Prove one Stacks block from the checkpoint built into this release, trusting nothing else").argument("<ref>", "block height or index block hash").option("--node <url>", "read blocks and MARF proofs from this Stacks node RPC instead of the API").option("--checkpoint <file>", "trust this checkpoint JSON instead of the one built into this release").option("--rows", "also prove the indexer's rows for the block (state_writes, vm_events) against its state diff").addHelpText("after", `
 What is proven, link by link:
+  ancestry    below the checkpoint only: the block's id, from the checkpoint by
+              parent links or one MARF proof (signer links are then not needed)
   bitcoin     headers from the checkpoint to the block's burn block: proof-of-work and retargets
   burn        the block's consensus hash commits to that Bitcoin block
   cycle       the reward cycle's signer set, proven forward from the checkpoint's set
@@ -205277,7 +205370,7 @@ import {
   statSync as statSync2,
   writeFileSync as writeFileSync4
 } from "node:fs";
-import { dirname as dirname6, join as join9, relative, resolve as resolve7 } from "node:path";
+import { dirname as dirname6, join as join9, relative as relative2, resolve as resolve7 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { input, select as select3 } from "@inquirer/prompts";
 import { SecondLayer as SecondLayer4 } from "@secondlayer/sdk";
@@ -205459,7 +205552,7 @@ async function createWebhook(name, opts) {
   const targetDir = resolve7(process.cwd(), name);
   if (opts.scaffold !== false) {
     if (existsSync5(targetDir)) {
-      error(`Directory already exists: ${relative(process.cwd(), targetDir)}`);
+      error(`Directory already exists: ${relative2(process.cwd(), targetDir)}`);
       process.exit(1);
     }
     const tplRoot = templatesRoot();
@@ -205506,7 +205599,7 @@ async function createWebhook(name, opts) {
   }
   if (signingSecret && opts.scaffold !== false) {
     const envTarget = writeSigningSecretEnv(targetDir, signingSecret);
-    success(`Signing secret written to ${relative(process.cwd(), envTarget)}`);
+    success(`Signing secret written to ${relative2(process.cwd(), envTarget)}`);
   } else if (signingSecret && opts.scaffold === false) {
     info(`Signing secret (store securely): ${signingSecret}`);
   }
@@ -209505,5 +209598,5 @@ registerCreditsCommand(program);
 registerArchiveCommand(program);
 program.parse();
 
-//# debugId=063D7FC6388E8ABC64756E2164756E21
+//# debugId=ECF90476FCFF9CB564756E2164756E21
 //# sourceMappingURL=cli.js.map