@secondlayer/cli 19.2.2 → 19.3.0

package/dist/cli.js

@@ -29440,7 +29440,7 @@ var init_git_status = () => {};
 
 // ../../node_modules/typescript/lib/typescript.js
 var require_typescript = __commonJS(function(exports, module) {
-  var __dirname = "/Users/ryan/projects/secondlayer/.claude/worktrees/agent-a6ba56a9f98cf6ff7/node_modules/typescript/lib", __filename = "/Users/ryan/projects/secondlayer/.claude/worktrees/agent-a6ba56a9f98cf6ff7/node_modules/typescript/lib/typescript.js";
+  var __dirname = "/Users/ryan/projects/secondlayer/.claude/worktrees/agent-a5aea7deee5fef330/node_modules/typescript/lib", __filename = "/Users/ryan/projects/secondlayer/.claude/worktrees/agent-a5aea7deee5fef330/node_modules/typescript/lib/typescript.js";
   /*! *****************************************************************************
   Copyright (c) Microsoft Corporation. All rights reserved.
   Licensed under the Apache License, Version 2.0 (the "License"); you may not use
@@ -198790,7 +198790,7 @@ import {
   watch,
   writeFileSync as writeFileSync3
 } from "node:fs";
-import { basename, dirname as dirname5, extname, join as join7, resolve as resolve5 } from "node:path";
+import { basename, dirname as dirname5, extname, join as join7, relative, resolve as resolve5 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { confirm as confirm2 } from "@inquirer/prompts";
 import {
@@ -198802,6 +198802,10 @@ import {
   billingPausedCode
 } from "@secondlayer/shared/schemas";
 import { TRAIT_STANDARDS } from "@secondlayer/stacks/clarity";
+import {
+  deriveVerification,
+  isDeterminismViolation
+} from "@secondlayer/subgraphs/verification";
 function webhookHint(apiUrl, name, firstTable) {
   if (!firstTable || isMerchantUrl(apiUrl))
     return null;
@@ -199121,6 +199125,36 @@ function createSubgraphDeployPreview(def, options = {}) {
     ...options.bundleBytes !== undefined ? { bundleSize: `${options.bundleBytes} bytes` } : {}
   };
 }
+function formatVerificationLines(verification, pin) {
+  if (!verification)
+    return [];
+  const head = [
+    verification.level,
+    ...pin ? [`pin ${pin.slice(0, 4)}…${pin.slice(-4)}`] : [],
+    ...verification.reasons
+  ].join(" · ");
+  return [
+    `verification  ${head}`,
+    ...verification.unproven.map((u) => `unproven      ${u}`)
+  ];
+}
+function formatVerificationStatus(verification) {
+  if (!verification)
+    return "unknown (deployed before levels were derived)";
+  const head = [verification.level, ...verification.reasons].join(" · ");
+  return verification.unproven.length > 0 ? `${head} (unproven: ${verification.unproven.join("; ")})` : head;
+}
+function checkDeterminism(def, findings) {
+  const verification = deriveVerification(def, findings);
+  if (isDeterminismViolation(verification)) {
+    error("Nondeterministic handler. This subgraph's sources are provable, so its handlers must give the same rows on every run:");
+    for (const r of verification.reasons)
+      error(`  ✗ ${r}`);
+    info("Derive values from event, ctx.block and ctx.tx only (no Date, Math.random, fetch, timers or locale formatting).");
+    process.exit(1);
+  }
+  return verification;
+}
 function printSubgraphDeployPreview(preview, context) {
   success("Subgraph deploy dry run passed");
   const pairs = [
@@ -199493,8 +199527,11 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
         info(`${dryRun ? "Bundling for remote deploy dry run" : "Bundling for remote deploy"} (${config.network})...`);
         const source = derived?.source ?? await readFile(absPath, "utf8");
         const { bundleSubgraphCode } = await import("@secondlayer/bundler");
-        const bundled = await bundleSubgraphCode(source);
+        const bundled = await bundleSubgraphCode(source, {
+          fileName: relative(process.cwd(), absPath)
+        });
         const handlerCode = bundled.handlerCode;
+        const localVerification = checkDeterminism(effectiveDef, bundled.findings);
         if (dryRun) {
           printSubgraphDeployPreview(createSubgraphDeployPreview(validated, {
             bundleBytes: Buffer.byteLength(handlerCode, "utf8")
@@ -199503,6 +199540,9 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
             file: absPath,
             bundled: true
           });
+          for (const line of formatVerificationLines(localVerification)) {
+            info(`  ${line}`);
+          }
           return;
         }
         const deployStartBlock = startBlock ?? effectiveDef.startBlock;
@@ -199544,6 +199584,11 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
         });
         for (const w of result.warnings ?? [])
           warn(w);
+        const printVerification = () => {
+          for (const line of formatVerificationLines(result.verification ?? localVerification, result.pin)) {
+            info(`  ${line}`);
+          }
+        };
         const printDeployFooter = async () => {
           try {
             const { apiUrl } = await resolveAuth();
@@ -199563,10 +199608,13 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
         };
         if (result.action === "unchanged") {
           info(`Subgraph "${effectiveDef.name}" is up to date (v${result.version} — no changes)`);
+          printVerification();
         } else if (result.action === "handler_updated") {
           success(`Subgraph "${effectiveDef.name}" handler updated (v${result.version} — schema unchanged, no reindex needed)`);
+          printVerification();
         } else if (result.action === "created") {
           success(`Subgraph "${effectiveDef.name}" created → v${result.version}`);
+          printVerification();
           await printDeployFooter();
         } else if (result.action === "reindexed") {
           if (result.diff) {
@@ -199583,6 +199631,7 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
             }
           }
           success(`Subgraph "${effectiveDef.name}" updated → v${result.version} (reindexing)`);
+          printVerification();
           await printDeployFooter();
         } else {
           if (result.diff) {
@@ -199594,22 +199643,37 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
             }
           }
           success(`Subgraph "${effectiveDef.name}" updated → v${result.version}`);
+          printVerification();
           await printDeployFooter();
         }
       } else {
+        let findings;
+        try {
+          const { bundleSubgraphCode } = await import("@secondlayer/bundler");
+          findings = (await bundleSubgraphCode(await readFile(absPath, "utf8"), {
+            fileName: relative(process.cwd(), absPath)
+          })).findings;
+        } catch {
+          findings = undefined;
+        }
+        const verification = findings ? checkDeterminism(effectiveDef, findings) : undefined;
         if (dryRun) {
           printSubgraphDeployPreview(createSubgraphDeployPreview(validated), {
             network: config.network,
             file: absPath,
             bundled: false
           });
+          for (const line of formatVerificationLines(verification)) {
+            info(`  ${line}`);
+          }
           return;
         }
         const { deploySchema } = await import("@secondlayer/subgraphs");
         const { getDb, closeDb } = await import("@secondlayer/shared/db");
         const db = getDb();
         const result = await deploySchema(db, effectiveDef, absPath, {
-          forceReindex: startBlock !== undefined
+          forceReindex: startBlock !== undefined,
+          verification
         });
         if (result.action === "unchanged") {
           info(`Subgraph "${effectiveDef.name}" is up to date (v${result.version} — no changes)`);
@@ -199622,6 +199686,9 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
         } else {
           success(`Subgraph "${effectiveDef.name}" updated → v${result.version}`);
         }
+        for (const line of formatVerificationLines(verification)) {
+          info(`  ${line}`);
+        }
         await closeDb();
       }
     } catch (err) {
@@ -199675,6 +199742,8 @@ ${data.length} subgraph(s) total`));
       console.log(formatKeyValue([
         ["Name", subgraph.name],
         ["Version", subgraph.version],
+        ["Pin", subgraph.pin ?? "none (deployed before pins)"],
+        ["Verification", formatVerificationStatus(subgraph.verification)],
         [
           "Status",
           formatSubgraphStatus(subgraph.status, subgraph.health.lastError)
@@ -202526,7 +202595,7 @@ var {
 // package.json
 var package_default = {
   name: "@secondlayer/cli",
-  version: "19.2.2",
+  version: "19.3.0",
   description: "Run a Stacks index on your own hardware — set it up, restore verified history, and keep it current.",
   repository: {
     type: "git",
@@ -202563,12 +202632,12 @@ var package_default = {
     "@biomejs/wasm-nodejs": "^1.9.0",
     "@dsnp/parquetjs": "~1.8.8",
     "@inquirer/prompts": "^8.2.0",
-    "@secondlayer/bundler": "^0.6.1",
+    "@secondlayer/bundler": "^0.7.0",
     "@secondlayer/scaffold": "^1.6.1",
     "@secondlayer/sdk": "^14.3.0",
-    "@secondlayer/shared": "^11.20.0",
+    "@secondlayer/shared": "^11.22.0",
     "@secondlayer/stacks": "^6.1.1",
-    "@secondlayer/subgraphs": "^6.3.6",
+    "@secondlayer/subgraphs": "^6.4.0",
     "@secondlayer/verify": "^0.2.0",
     esbuild: "^0.28.2",
     "smol-toml": "^1.8.0",
@@ -205301,7 +205370,7 @@ import {
   statSync as statSync2,
   writeFileSync as writeFileSync4
 } from "node:fs";
-import { dirname as dirname6, join as join9, relative, resolve as resolve7 } from "node:path";
+import { dirname as dirname6, join as join9, relative as relative2, resolve as resolve7 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { input, select as select3 } from "@inquirer/prompts";
 import { SecondLayer as SecondLayer4 } from "@secondlayer/sdk";
@@ -205483,7 +205552,7 @@ async function createWebhook(name, opts) {
   const targetDir = resolve7(process.cwd(), name);
   if (opts.scaffold !== false) {
     if (existsSync5(targetDir)) {
-      error(`Directory already exists: ${relative(process.cwd(), targetDir)}`);
+      error(`Directory already exists: ${relative2(process.cwd(), targetDir)}`);
       process.exit(1);
     }
     const tplRoot = templatesRoot();
@@ -205530,7 +205599,7 @@ async function createWebhook(name, opts) {
   }
   if (signingSecret && opts.scaffold !== false) {
     const envTarget = writeSigningSecretEnv(targetDir, signingSecret);
-    success(`Signing secret written to ${relative(process.cwd(), envTarget)}`);
+    success(`Signing secret written to ${relative2(process.cwd(), envTarget)}`);
   } else if (signingSecret && opts.scaffold === false) {
     info(`Signing secret (store securely): ${signingSecret}`);
   }
@@ -209529,5 +209598,5 @@ registerCreditsCommand(program);
 registerArchiveCommand(program);
 program.parse();
 
-//# debugId=92924A7AE61FB1AF64756E2164756E21
+//# debugId=ECF90476FCFF9CB564756E2164756E21
 //# sourceMappingURL=cli.js.map