@secondlayer/cli 19.2.2 → 19.4.0

package/dist/cli.js

@@ -2550,6 +2550,118 @@ var init_output = __esm(() => {
   ANSI_ESCAPE_PATTERN = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, "g");
 });
 
+// src/lib/api-client.ts
+import { ApiError, SecondLayer } from "@secondlayer/sdk";
+function nextStepHint(status) {
+  if (status === undefined)
+    return;
+  if (status === 403)
+    return "You may not have access — check your active project with `secondlayer whoami`.";
+  if (status === 404)
+    return "Check the name/slug — run the matching `list` command to see what exists.";
+  if (status === 400 || status === 422)
+    return "Check the command arguments and flags — see `--help` for the expected format.";
+  if (status === 429)
+    return "Rate limited — wait a moment and retry.";
+  if (status >= 500)
+    return "Server error — retry shortly, or check `secondlayer status`.";
+  return;
+}
+function handleApiError(err, action) {
+  const status = err instanceof ApiError || err instanceof CliHttpError ? err.status : undefined;
+  if (err instanceof CliHttpError && err.code === "SESSION_EXPIRED" || status === 401) {
+    printError("Authentication required.", {
+      hint: isOssMode() ? "Set INSTANCE_TOKEN from `secondlayer init`." : "Run `secondlayer login` to re-authenticate."
+    });
+    process.exit(1);
+  }
+  const detail = err instanceof Error ? err.message : String(err);
+  printError(`Failed to ${action}: ${detail}`, { hint: nextStepHint(status) });
+  process.exit(1);
+}
+function withErrorHandling(fn, options) {
+  return async (...args) => {
+    try {
+      await fn(...args);
+    } catch (err) {
+      if (options?.onError) {
+        options.onError(err);
+      } else {
+        handleApiError(err, options?.action ?? "execute command");
+      }
+    }
+  };
+}
+async function getPlatformClient() {
+  const { apiUrl, ephemeralKey } = await resolveHostedAuth();
+  return new SecondLayer({ baseUrl: apiUrl, apiKey: ephemeralKey });
+}
+async function listSubgraphsApi() {
+  return (await getPlatformClient()).subgraphs.list();
+}
+async function getSubgraphApi(name) {
+  return (await getPlatformClient()).subgraphs.status(name);
+}
+async function getSubgraphOpenApi(name, options) {
+  return (await getPlatformClient()).subgraphs.openapi(name, options);
+}
+async function getSubgraphAgentSchema(name, options) {
+  return (await getPlatformClient()).subgraphs.schema(name, options);
+}
+async function getSubgraphMarkdown(name, options) {
+  return (await getPlatformClient()).subgraphs.markdown(name, options);
+}
+async function reindexSubgraphApi(name) {
+  return (await getPlatformClient()).subgraphs.reindex(name);
+}
+async function backfillSubgraphApi(name, options) {
+  return (await getPlatformClient()).subgraphs.backfill(name, options);
+}
+async function stopSubgraphApi(name) {
+  return (await getPlatformClient()).subgraphs.stop(name);
+}
+async function deleteSubgraphApi(name, options) {
+  return (await getPlatformClient()).subgraphs.delete(name, options);
+}
+async function deploySubgraphApi(data) {
+  return (await getPlatformClient()).subgraphs.deploy(data);
+}
+async function querySubgraphTableRows(name, table, params = {}) {
+  return (await getPlatformClient()).subgraphs.rows(name, table, params);
+}
+async function querySubgraphTableCount(name, table, params = {}) {
+  return (await getPlatformClient()).subgraphs.count(name, table, params);
+}
+async function getSubgraphGaps(name, opts) {
+  return (await getPlatformClient()).subgraphs.gaps(name, opts);
+}
+async function listSubgraphOperationsApi(name) {
+  return (await getPlatformClient()).subgraphs.operations(name);
+}
+async function getSubgraphOperationApi(name, operationId) {
+  return (await getPlatformClient()).subgraphs.getOperation(name, operationId);
+}
+async function getSubgraphSourceApi(name) {
+  return (await getPlatformClient()).subgraphs.getSource(name);
+}
+async function getSubgraphRowsApi(name, table, opts = {}) {
+  return (await getPlatformClient()).subgraphs.rows(name, table, opts);
+}
+async function getContractPrintSchema(contractId) {
+  let client;
+  try {
+    client = await getPlatformClient();
+  } catch {
+    client = new SecondLayer({ baseUrl: resolveApiUrl() });
+  }
+  return client.index.printSchema(contractId);
+}
+var init_api_client = __esm(() => {
+  init_http();
+  init_output();
+  init_resolve_auth();
+});
+
 // ../../node_modules/fast-glob/out/utils/array.js
 var require_array = __commonJS(function(exports) {
   Object.defineProperty(exports, "__esModule", { value: true });
@@ -16630,7 +16742,7 @@ var init_dist3 = __esm(() => {
 // ../../node_modules/tinyexec/dist/main.js
 import { createRequire as e } from "module";
 import { spawn as t } from "node:child_process";
-import { delimiter as n2, dirname as r, normalize as i, resolve as a2 } from "node:path";
+import { delimiter as n3, dirname as r, normalize as i, resolve as a2 } from "node:path";
 import { cwd as o } from "node:process";
 import { PassThrough as s } from "node:stream";
 import c from "node:readline";
@@ -16649,7 +16761,7 @@ function x(e) {
   return b;
 }
 function S(e, t) {
-  const i = t.value.split(n2);
+  const i = t.value.split(n3);
   let o = e;
   let s;
   do {
@@ -16659,7 +16771,7 @@ function S(e, t) {
   } while (o !== s);
   return {
     key: t.key,
-    value: i.join(n2)
+    value: i.join(n3)
   };
 }
 function C(e, t) {
@@ -23945,19 +24057,19 @@ class c2 {
   }
 }
 function i2() {
-  return this[n3].next();
+  return this[n4].next();
 }
 function o2(r) {
-  return this[n3].return(r);
+  return this[n4].return(r);
 }
 function h2({ preventCancel: r = false } = {}) {
   const e = this.getReader(), t = new c2(e, r), s = Object.create(u2);
-  return s[n3] = t, s;
+  return s[n4] = t, s;
 }
-var a3, n3, u2;
+var a3, n4, u2;
 var init_asyncIterator = __esm(() => {
   a3 = Object.getPrototypeOf(Object.getPrototypeOf(async function* () {}).prototype);
-  n3 = Symbol();
+  n4 = Symbol();
   Object.defineProperty(i2, "name", { value: "next" });
   Object.defineProperty(o2, "name", { value: "return" });
   u2 = Object.create(a3, {
@@ -28890,115 +29002,6 @@ var init_subgraphs = __esm(() => {
   init_format();
 });
 
-// src/lib/api-client.ts
-import { ApiError, SecondLayer as SecondLayer2 } from "@secondlayer/sdk";
-function nextStepHint(status) {
-  if (status === undefined)
-    return;
-  if (status === 403)
-    return "You may not have access — check your active project with `secondlayer whoami`.";
-  if (status === 404)
-    return "Check the name/slug — run the matching `list` command to see what exists.";
-  if (status === 400 || status === 422)
-    return "Check the command arguments and flags — see `--help` for the expected format.";
-  if (status === 429)
-    return "Rate limited — wait a moment and retry.";
-  if (status >= 500)
-    return "Server error — retry shortly, or check `secondlayer status`.";
-  return;
-}
-function handleApiError(err, action) {
-  const status = err instanceof ApiError || err instanceof CliHttpError ? err.status : undefined;
-  if (err instanceof CliHttpError && err.code === "SESSION_EXPIRED" || status === 401) {
-    printError("Authentication required.", {
-      hint: isOssMode() ? "Set INSTANCE_TOKEN from `secondlayer init`." : "Run `secondlayer login` to re-authenticate."
-    });
-    process.exit(1);
-  }
-  const detail = err instanceof Error ? err.message : String(err);
-  printError(`Failed to ${action}: ${detail}`, { hint: nextStepHint(status) });
-  process.exit(1);
-}
-function withErrorHandling(fn, options) {
-  return async (...args) => {
-    try {
-      await fn(...args);
-    } catch (err) {
-      if (options?.onError) {
-        options.onError(err);
-      } else {
-        handleApiError(err, options?.action ?? "execute command");
-      }
-    }
-  };
-}
-async function getPlatformClient() {
-  const { apiUrl, ephemeralKey } = await resolveHostedAuth();
-  return new SecondLayer2({ baseUrl: apiUrl, apiKey: ephemeralKey });
-}
-async function listSubgraphsApi() {
-  return (await getPlatformClient()).subgraphs.list();
-}
-async function getSubgraphApi(name) {
-  return (await getPlatformClient()).subgraphs.status(name);
-}
-async function getSubgraphOpenApi(name, options) {
-  return (await getPlatformClient()).subgraphs.openapi(name, options);
-}
-async function getSubgraphAgentSchema(name, options) {
-  return (await getPlatformClient()).subgraphs.schema(name, options);
-}
-async function getSubgraphMarkdown(name, options) {
-  return (await getPlatformClient()).subgraphs.markdown(name, options);
-}
-async function reindexSubgraphApi(name) {
-  return (await getPlatformClient()).subgraphs.reindex(name);
-}
-async function backfillSubgraphApi(name, options) {
-  return (await getPlatformClient()).subgraphs.backfill(name, options);
-}
-async function stopSubgraphApi(name) {
-  return (await getPlatformClient()).subgraphs.stop(name);
-}
-async function deleteSubgraphApi(name, options) {
-  return (await getPlatformClient()).subgraphs.delete(name, options);
-}
-async function deploySubgraphApi(data) {
-  return (await getPlatformClient()).subgraphs.deploy(data);
-}
-async function querySubgraphTableRows(name, table, params = {}) {
-  return (await getPlatformClient()).subgraphs.rows(name, table, params);
-}
-async function querySubgraphTableCount(name, table, params = {}) {
-  return (await getPlatformClient()).subgraphs.count(name, table, params);
-}
-async function getSubgraphGaps(name, opts) {
-  return (await getPlatformClient()).subgraphs.gaps(name, opts);
-}
-async function listSubgraphOperationsApi(name) {
-  return (await getPlatformClient()).subgraphs.operations(name);
-}
-async function getSubgraphOperationApi(name, operationId) {
-  return (await getPlatformClient()).subgraphs.getOperation(name, operationId);
-}
-async function getSubgraphSourceApi(name) {
-  return (await getPlatformClient()).subgraphs.getSource(name);
-}
-async function getContractPrintSchema(contractId) {
-  let client;
-  try {
-    client = await getPlatformClient();
-  } catch {
-    client = new SecondLayer2({ baseUrl: resolveApiUrl() });
-  }
-  return client.index.printSchema(contractId);
-}
-var init_api_client = __esm(() => {
-  init_http();
-  init_output();
-  init_resolve_auth();
-});
-
 // src/lib/derive-abi.ts
 import {
   extractSubgraphDefinition,
@@ -29440,7 +29443,7 @@ var init_git_status = () => {};
 
 // ../../node_modules/typescript/lib/typescript.js
 var require_typescript = __commonJS(function(exports, module) {
-  var __dirname = "/Users/ryan/projects/secondlayer/.claude/worktrees/agent-a6ba56a9f98cf6ff7/node_modules/typescript/lib", __filename = "/Users/ryan/projects/secondlayer/.claude/worktrees/agent-a6ba56a9f98cf6ff7/node_modules/typescript/lib/typescript.js";
+  var __dirname = "/Users/ryan/projects/secondlayer/.claude/worktrees/agent-a9a35af4d4343442c/node_modules/typescript/lib", __filename = "/Users/ryan/projects/secondlayer/.claude/worktrees/agent-a9a35af4d4343442c/node_modules/typescript/lib/typescript.js";
   /*! *****************************************************************************
   Copyright (c) Microsoft Corporation. All rights reserved.
   Licensed under the Apache License, Version 2.0 (the "License"); you may not use
@@ -198790,7 +198793,7 @@ import {
   watch,
   writeFileSync as writeFileSync3
 } from "node:fs";
-import { basename, dirname as dirname5, extname, join as join7, resolve as resolve5 } from "node:path";
+import { basename, dirname as dirname5, extname, join as join7, relative, resolve as resolve5 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { confirm as confirm2 } from "@inquirer/prompts";
 import {
@@ -198802,6 +198805,10 @@ import {
   billingPausedCode
 } from "@secondlayer/shared/schemas";
 import { TRAIT_STANDARDS } from "@secondlayer/stacks/clarity";
+import {
+  deriveVerification as deriveVerification2,
+  isDeterminismViolation
+} from "@secondlayer/subgraphs/verification";
 function webhookHint(apiUrl, name, firstTable) {
   if (!firstTable || isMerchantUrl(apiUrl))
     return null;
@@ -199121,6 +199128,36 @@ function createSubgraphDeployPreview(def, options = {}) {
     ...options.bundleBytes !== undefined ? { bundleSize: `${options.bundleBytes} bytes` } : {}
   };
 }
+function formatVerificationLines(verification, pin) {
+  if (!verification)
+    return [];
+  const head = [
+    verification.level,
+    ...pin ? [`pin ${pin.slice(0, 4)}…${pin.slice(-4)}`] : [],
+    ...verification.reasons
+  ].join(" · ");
+  return [
+    `verification  ${head}`,
+    ...verification.unproven.map((u) => `unproven      ${u}`)
+  ];
+}
+function formatVerificationStatus(verification) {
+  if (!verification)
+    return "unknown (deployed before levels were derived)";
+  const head = [verification.level, ...verification.reasons].join(" · ");
+  return verification.unproven.length > 0 ? `${head} (unproven: ${verification.unproven.join("; ")})` : head;
+}
+function checkDeterminism(def, findings) {
+  const verification = deriveVerification2(def, findings);
+  if (isDeterminismViolation(verification)) {
+    error("Nondeterministic handler. This subgraph's sources are provable, so its handlers must give the same rows on every run:");
+    for (const r of verification.reasons)
+      error(`  ✗ ${r}`);
+    info("Derive values from event, ctx.block and ctx.tx only (no Date, Math.random, fetch, timers or locale formatting).");
+    process.exit(1);
+  }
+  return verification;
+}
 function printSubgraphDeployPreview(preview, context) {
   success("Subgraph deploy dry run passed");
   const pairs = [
@@ -199493,8 +199530,11 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
         info(`${dryRun ? "Bundling for remote deploy dry run" : "Bundling for remote deploy"} (${config.network})...`);
         const source = derived?.source ?? await readFile(absPath, "utf8");
         const { bundleSubgraphCode } = await import("@secondlayer/bundler");
-        const bundled = await bundleSubgraphCode(source);
+        const bundled = await bundleSubgraphCode(source, {
+          fileName: relative(process.cwd(), absPath)
+        });
         const handlerCode = bundled.handlerCode;
+        const localVerification = checkDeterminism(effectiveDef, bundled.findings);
         if (dryRun) {
           printSubgraphDeployPreview(createSubgraphDeployPreview(validated, {
             bundleBytes: Buffer.byteLength(handlerCode, "utf8")
@@ -199503,6 +199543,9 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
             file: absPath,
             bundled: true
           });
+          for (const line of formatVerificationLines(localVerification)) {
+            info(`  ${line}`);
+          }
           return;
         }
         const deployStartBlock = startBlock ?? effectiveDef.startBlock;
@@ -199544,6 +199587,11 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
         });
         for (const w of result.warnings ?? [])
           warn(w);
+        const printVerification = () => {
+          for (const line of formatVerificationLines(result.verification ?? localVerification, result.pin)) {
+            info(`  ${line}`);
+          }
+        };
         const printDeployFooter = async () => {
           try {
             const { apiUrl } = await resolveAuth();
@@ -199563,10 +199611,13 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
         };
         if (result.action === "unchanged") {
           info(`Subgraph "${effectiveDef.name}" is up to date (v${result.version} — no changes)`);
+          printVerification();
         } else if (result.action === "handler_updated") {
           success(`Subgraph "${effectiveDef.name}" handler updated (v${result.version} — schema unchanged, no reindex needed)`);
+          printVerification();
         } else if (result.action === "created") {
           success(`Subgraph "${effectiveDef.name}" created → v${result.version}`);
+          printVerification();
           await printDeployFooter();
         } else if (result.action === "reindexed") {
           if (result.diff) {
@@ -199583,6 +199634,7 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
             }
           }
           success(`Subgraph "${effectiveDef.name}" updated → v${result.version} (reindexing)`);
+          printVerification();
           await printDeployFooter();
         } else {
           if (result.diff) {
@@ -199594,22 +199646,37 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
             }
           }
           success(`Subgraph "${effectiveDef.name}" updated → v${result.version}`);
+          printVerification();
           await printDeployFooter();
         }
       } else {
+        let findings;
+        try {
+          const { bundleSubgraphCode } = await import("@secondlayer/bundler");
+          findings = (await bundleSubgraphCode(await readFile(absPath, "utf8"), {
+            fileName: relative(process.cwd(), absPath)
+          })).findings;
+        } catch {
+          findings = undefined;
+        }
+        const verification = findings ? checkDeterminism(effectiveDef, findings) : undefined;
         if (dryRun) {
           printSubgraphDeployPreview(createSubgraphDeployPreview(validated), {
             network: config.network,
             file: absPath,
             bundled: false
           });
+          for (const line of formatVerificationLines(verification)) {
+            info(`  ${line}`);
+          }
           return;
         }
         const { deploySchema } = await import("@secondlayer/subgraphs");
         const { getDb, closeDb } = await import("@secondlayer/shared/db");
         const db = getDb();
         const result = await deploySchema(db, effectiveDef, absPath, {
-          forceReindex: startBlock !== undefined
+          forceReindex: startBlock !== undefined,
+          verification
         });
         if (result.action === "unchanged") {
           info(`Subgraph "${effectiveDef.name}" is up to date (v${result.version} — no changes)`);
@@ -199622,6 +199689,9 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
         } else {
           success(`Subgraph "${effectiveDef.name}" updated → v${result.version}`);
         }
+        for (const line of formatVerificationLines(verification)) {
+          info(`  ${line}`);
+        }
         await closeDb();
       }
     } catch (err) {
@@ -199675,6 +199745,8 @@ ${data.length} subgraph(s) total`));
       console.log(formatKeyValue([
         ["Name", subgraph.name],
         ["Version", subgraph.version],
+        ["Pin", subgraph.pin ?? "none (deployed before pins)"],
+        ["Verification", formatVerificationStatus(subgraph.verification)],
         [
           "Status",
           formatSubgraphStatus(subgraph.status, subgraph.health.lastError)
@@ -202526,7 +202598,7 @@ var {
 // package.json
 var package_default = {
   name: "@secondlayer/cli",
-  version: "19.2.2",
+  version: "19.4.0",
   description: "Run a Stacks index on your own hardware — set it up, restore verified history, and keep it current.",
   repository: {
     type: "git",
@@ -202563,13 +202635,13 @@ var package_default = {
     "@biomejs/wasm-nodejs": "^1.9.0",
     "@dsnp/parquetjs": "~1.8.8",
     "@inquirer/prompts": "^8.2.0",
-    "@secondlayer/bundler": "^0.6.1",
+    "@secondlayer/bundler": "^0.7.0",
     "@secondlayer/scaffold": "^1.6.1",
-    "@secondlayer/sdk": "^14.3.0",
-    "@secondlayer/shared": "^11.20.0",
-    "@secondlayer/stacks": "^6.1.1",
-    "@secondlayer/subgraphs": "^6.3.6",
-    "@secondlayer/verify": "^0.2.0",
+    "@secondlayer/sdk": "^14.5.0",
+    "@secondlayer/shared": "^11.23.0",
+    "@secondlayer/stacks": "^6.2.0",
+    "@secondlayer/subgraphs": "^6.5.0",
+    "@secondlayer/verify": "^0.3.0",
     esbuild: "^0.28.2",
     "smol-toml": "^1.8.0",
     zod: "^4.3.6"
@@ -202596,7 +202668,7 @@ var package_default = {
 
 // src/commands/archive.ts
 import {
-  SecondLayer,
+  SecondLayer as SecondLayer2,
   resolveAccountKey as resolveAccountKey3
 } from "@secondlayer/sdk";
 
@@ -204021,6 +204093,7 @@ var LINKS = [
   { step: "burn", label: "burn" },
   { step: "signer-set", label: "cycle" },
   { step: "signatures", label: "signatures" },
+  { step: "txs", label: "txs" },
   { step: "witness", label: "state root" },
   { step: "names", label: "diff" },
   { step: "rows", label: "rows" }
@@ -204078,7 +204151,7 @@ function prepareSource(src) {
     };
   return out;
 }
-function linkDetail(step, r, cp, rows) {
+function linkDetail(step, r, cp) {
   switch (step) {
     case "ancestry": {
       const a = r.ancestry;
@@ -204098,6 +204171,8 @@ function linkDetail(step, r, cp, rows) {
       return r.cycle === cp.stacks.cycle ? `${r.cycle}, the checkpoint's own signer set` : `${r.cycle}, signer set proven forward from checkpoint cycle ${cp.stacks.cycle}`;
     case "signatures":
       return `${n(r.signerWeight ?? 0n)} / ${n(r.totalWeight ?? 0n)} weight signed, threshold ${n(r.threshold ?? 0n)}`;
+    case "txs":
+      return `${n(r.transactions?.length ?? 0)} transactions match the tx merkle root`;
     case "witness":
       return `${r.stateRoot} matches the witness`;
     case "names": {
@@ -204105,7 +204180,7 @@ function linkDetail(step, r, cp, rows) {
       if (!d)
         return "";
       const named = d.writes.filter((w) => w.named).length;
-      const written = named ? `${d.writes.length} written (${named} named, ${d.writes.length - named} unnamed)` : `${d.writes.length} written (unnamed${rows ? "" : "; --rows names them"})`;
+      const written = named ? `${d.writes.length} written (${named} named, ${d.writes.length - named} unnamed)` : `${d.writes.length} written (unnamed)`;
       return `${written}, ${d.carried.length} carried, ${d.internal.length} internal`;
     }
     case "rows":
@@ -204137,12 +204212,13 @@ function report(r, cp, rows) {
       writeData(dim(`· ${label}  not needed: the block is hash-chained to the checkpoint`));
     else if (link.step === "rows" && r.rowsChecked === undefined)
       writeData(dim(`· ${label}  not checked: the source serves no indexed rows`));
+    else if (link.step === "txs" && r.transactions === undefined)
+      writeData(dim(`· ${label}  not checked: no transaction bytes (epoch 2.x, or the source served the header only)`));
     else
-      writeData(`${green("✓")} ${label}  ${linkDetail(link.step, r, cp, rows)}`);
+      writeData(`${green("✓")} ${label}  ${linkDetail(link.step, r, cp)}`);
   }
   for (const line of r.notes)
-    if (rows || !line.includes("state_writes"))
-      note(`  note: ${line}`);
+    note(`  note: ${line}`);
   if (!first) {
     const from = n(parseNakamotoHeader(unhex(cp.stacks.header)).chainLength);
     writeData(green(`✓ Block ${n(r.height ?? 0)} is proven. Trusted: only the checkpoint (Stacks ${from}, Bitcoin ${n(cp.bitcoin.height)}).`));
@@ -204152,7 +204228,8 @@ function report(r, cp, rows) {
   writeData(red(first.code === "unavailable" ? `✗ Could not check the ${label} link: the source could not serve it.` : `✗ Not proven: the ${label} link is broken.`));
 }
 function verificationJson(r) {
-  return JSON.stringify(r, (_k, v) => typeof v === "bigint" ? v.toString() : v, 2);
+  const { transactions, ...rest } = r;
+  return JSON.stringify(transactions ? { ...rest, transactions: transactions.map((t) => t.txid) } : rest, (_k, v) => typeof v === "bigint" ? v.toString() : v, 2);
 }
 function exitCodeOf(r) {
   if (r.ok)
@@ -204181,7 +204258,7 @@ async function runVerifyBlock(ref, opts, deps = {}) {
   return exitCodeOf(result);
 }
 function attachVerifyBlockCommand(verify) {
-  return verify.command("block").description("Prove one Stacks block from the checkpoint built into this release, trusting nothing else").argument("<ref>", "block height or index block hash").option("--node <url>", "read blocks and MARF proofs from this Stacks node RPC instead of the API").option("--checkpoint <file>", "trust this checkpoint JSON instead of the one built into this release").option("--rows", "also prove the indexer's rows for the block (state_writes, vm_events) against its state diff").addHelpText("after", `
+  return verify.command("block").description("Prove one Stacks block from the checkpoint built into this release, trusting nothing else").argument("<ref>", "block height or index block hash").option("--node <url>", "read blocks and MARF proofs from this Stacks node RPC instead of the API").option("--checkpoint <file>", "trust this checkpoint JSON instead of the one built into this release").option("--rows", "also prove the Index API's vm_events rows for the block against its state diff (billed as Index rows)").addHelpText("after", `
 What is proven, link by link:
   ancestry    below the checkpoint only: the block's id, from the checkpoint by
               parent links or one MARF proof (signer links are then not needed)
@@ -204189,9 +204266,13 @@ What is proven, link by link:
   burn        the block's consensus hash commits to that Bitcoin block
   cycle       the reward cycle's signer set, proven forward from the checkpoint's set
   signatures  signers holding at least 70% of the weight signed the block header
+  txs         the block's transactions hash to the tx merkle root in its header
   state root  the state witness hashes to the root in the signed header
-  diff        every leaf the block wrote, carried, or kept as bookkeeping
-  rows        with --rows: the Index API's rows match that diff
+  diff        every leaf the block wrote, carried, or kept as bookkeeping; writes
+              are named from the block's state_writes (free, /v1/proofs/writes)
+              when the source has them, else listed as unnamed with a note
+  rows        with --rows: the Index API's vm_events rows match that diff
+              (billed as Index rows; everything else is free)
 
 Nothing is trusted except the checkpoint. Proofs come from the API
 (SECONDLAYER_API_URL, or --api-url) with your account key, or from a node
@@ -204215,13 +204296,242 @@ Exit codes:
   });
 }
 
+// src/commands/verify-subgraph.ts
+init_api_client();
+init_output();
+import { deriveVerification } from "@secondlayer/subgraphs/verification";
+import {
+  checkPin,
+  compareRows,
+  loadDeterministicDefinition,
+  replayContracts,
+  replaySubgraph
+} from "@secondlayer/subgraphs/verify";
+import {
+  MAINNET_CHECKPOINT as MAINNET_CHECKPOINT2,
+  parseNakamotoHeader as parseNakamotoHeader2,
+  unhex as unhex2
+} from "@secondlayer/verify";
+var LINKS2 = [
+  { step: "pin", label: "pin" },
+  { step: "blocks", label: "blocks" },
+  { step: "txs", label: "txs" },
+  { step: "inputs", label: "inputs" },
+  { step: "handlers", label: "handlers" },
+  { step: "rows", label: "rows" }
+];
+var LABEL_WIDTH2 = Math.max(...LINKS2.map((l) => l.label.length));
+var PROGRESS_EVERY = 100;
+var PAGE = 1000;
+var n2 = (v) => v.toLocaleString("en-US");
+var short = (h) => `${h.slice(0, 4)}…${h.slice(-4)}`;
+
+class InputError extends Error {
+}
+function parseHeight2(raw, flag) {
+  if (raw === undefined)
+    return;
+  if (!/^\d+$/.test(raw) || !Number.isSafeInteger(Number(raw)))
+    throw new InputError(`${flag} must be a block height, got "${raw}"`);
+  return Number(raw);
+}
+async function readTable(fetchRows, name, table) {
+  const out = [];
+  let cursor;
+  for (;; ) {
+    const page = await fetchRows(name, table, cursor);
+    out.push(...page.rows);
+    if (!page.next_cursor || page.rows.length === 0)
+      return out;
+    cursor = page.next_cursor;
+  }
+}
+function linkLine(step, r) {
+  const res = r.result;
+  switch (step) {
+    case "pin":
+      return `${short(r.pinValue ?? "")}  handler, schema and startBlock match the deploy`;
+    case "blocks":
+      return `${n2(res.blocks)} proven from the checkpoint${res.marfProofs ? ` (${n2(res.marfProofs)} MARF proof${res.marfProofs === 1 ? "" : "s"}, then parent links)` : ""}`;
+    case "txs":
+      return `${n2(res.txs)} transactions match their blocks' tx merkle roots`;
+    case "inputs":
+      return `${n2(res.blocks)} diffs fully named; ${n2(res.writes)} writes to ${r.contracts.map((c) => c.split(".")[1] ?? c).join(", ")}`;
+    case "handlers":
+      return `${n2(res.events)} events, ${n2(res.handlerErrors)} handler errors, deterministic realm`;
+    case "rows":
+      return (r.comparison?.tables ?? []).map((t) => `${t.table}: ${n2(t.equal)} equal${t.superseded ? `, ${n2(t.superseded)} superseded after ${n2(res.to)}` : ""}  digest ${short(t.digest)}`).join(`
+${" ".repeat(LABEL_WIDTH2 + 4)}`);
+  }
+}
+function firstFailure(r) {
+  if (r.pin.status === "failed")
+    return r.pin.failure;
+  return r.result?.failures[0] ?? r.comparison?.failures[0];
+}
+function report2(r, from, to) {
+  const first = firstFailure(r);
+  const broken = first ? LINKS2.findIndex((l) => l.step === first.step) : LINKS2.length;
+  const inconclusive = !first ? r.result?.inconclusive : undefined;
+  for (const [i, link] of LINKS2.entries()) {
+    const label = link.label.padEnd(LABEL_WIDTH2);
+    if (first && i === broken)
+      writeData(`${red("✗")} ${label}  ${first.message}`);
+    else if (i > broken)
+      writeData(dim(`· ${label}  not checked: an earlier link is broken`));
+    else if (link.step === "pin" && r.pin.status === "unchecked")
+      writeData(dim(`· ${label}  not checked: deployed before pin inputs were stored (redeploy)`));
+    else if (link.step === "rows" && inconclusive)
+      writeData(dim(`· ${label}  not checked: ${inconclusive}`));
+    else
+      writeData(`${green("✓")} ${label}  ${linkLine(link.step, r)}`);
+  }
+  for (const line of [...r.pin.notes, ...r.result?.notes ?? []])
+    note(`  note: ${line}`);
+  if (first) {
+    const label = LINKS2[broken]?.label ?? first.step;
+    writeData(red(first.unavailable ? `✗ Could not check the ${label} link: the source could not serve it.` : `✗ Not proven: the ${label} link is broken.`));
+    return first.unavailable ? VERIFY_EXIT.UNANCHORED : VERIFY_EXIT.DIVERGED;
+  }
+  if (inconclusive) {
+    writeData(dim(`· Inconclusive: ${inconclusive}. Rows were not compared.`));
+    return VERIFY_EXIT.UNANCHORED;
+  }
+  const cp = MAINNET_CHECKPOINT2;
+  const stacks = n2(Number(parseNakamotoHeader2(unhex2(cp.stacks.header)).chainLength));
+  writeData(green(`✓ ${r.name} ${n2(from)}..${n2(to)} recomputed from proven inputs. Trusted: only the checkpoint (Stacks ${stacks}, Bitcoin ${n2(cp.bitcoin.height)}).`));
+  writeData(dim(`  unproven, so not compared: ${[...r.unproven, "rows compare declared columns and _block_height only"].join("; ")}`));
+  return VERIFY_EXIT.CLEAN;
+}
+function reportJson(r) {
+  const { tables, ...result } = r.result ?? {};
+  return JSON.stringify({
+    pin: r.pin,
+    replay: r.result ? {
+      ...result,
+      tables: Object.fromEntries([...tables ?? new Map].map(([t, rows]) => [t, rows.length]))
+    } : null,
+    comparison: r.comparison ?? null
+  }, (_k, v) => typeof v === "bigint" ? v.toString() : v, 2);
+}
+async function runVerifySubgraph(name, opts, deps = {}) {
+  const fetchSubgraph = deps.fetchSubgraph ?? getSubgraphApi;
+  const fetchSource = deps.fetchSource ?? getSubgraphSourceApi;
+  const fetchRows = deps.fetchRows ?? ((n, t, cursor) => getSubgraphRowsApi(n, t, { cursor, limit: PAGE }));
+  try {
+    if (!opts.replay)
+      throw new InputError("pass --replay: the only check today re-runs the handlers over proven blocks");
+    const fromFlag = parseHeight2(opts.from, "--from");
+    const toFlag = parseHeight2(opts.to, "--to");
+    const detail = await fetchSubgraph(name);
+    const level = detail.verification;
+    if (level?.level !== "state")
+      throw new InputError(level ? `${name} is level ${level.level}, not state: ${level.reasons.join("; ")}` : `${name} has no verification level: deployed before levels were derived (redeploy)`);
+    const served = await fetchSource(name);
+    if (!served.handlerCode)
+      throw new InputError(`${name} has no stored handler bundle to replay (a local deploy)`);
+    const def = await loadDeterministicDefinition(served.handlerCode);
+    const pin = checkPin({
+      pin: served.pin ?? null,
+      pinPreimage: served.pinPreimage ?? null,
+      handlerCode: served.handlerCode
+    }, def);
+    const startBlock = typeof detail.definition?.startBlock === "number" ? detail.definition.startBlock : def.startBlock ?? 0;
+    const contracts = replayContracts(def);
+    const tables = Object.keys(def.schema);
+    const first = tables[0] ? await fetchRows(name, tables[0]) : { tip: { subgraph_height: startBlock } };
+    const tip = first.tip.subgraph_height;
+    const from = fromFlag ?? startBlock;
+    const to = toFlag ?? tip;
+    if (to > tip)
+      throw new InputError(`--to ${n2(to)} is past the served subgraph: it is at ${n2(tip)}`);
+    if (from > to)
+      throw new InputError(`--from ${n2(from)} is after --to ${n2(to)}`);
+    const r = {
+      name,
+      pin,
+      pinValue: served.pin ?? null,
+      contracts: Array.isArray(contracts) ? contracts : [],
+      unproven: deriveVerification(def).unproven
+    };
+    if (pin.status !== "failed") {
+      const servedRows = new Map;
+      for (const table of tables)
+        servedRows.set(table, await readTable(fetchRows, name, table));
+      note(`Replaying ${name} ${n2(from)}..${n2(to)} (${n2(to - from + 1)} blocks)`);
+      r.result = await (deps.replay ?? replaySubgraph)({
+        source: deps.source ?? defaultSource(opts.node),
+        handlerCode: served.handlerCode,
+        from,
+        to,
+        startBlock,
+        onProgress: (h) => {
+          const done = h - from + 1;
+          if (done % PROGRESS_EVERY === 0)
+            note(`  replayed ${n2(done)} / ${n2(to - from + 1)} blocks`);
+        }
+      });
+      if (r.result.failures.length === 0 && !r.result.inconclusive)
+        r.comparison = compareRows(def.schema, r.result, servedRows);
+    }
+    if (opts.json) {
+      writeData(reportJson(r));
+      const f = firstFailure(r);
+      if (f)
+        return f.unavailable ? VERIFY_EXIT.UNANCHORED : VERIFY_EXIT.DIVERGED;
+      return r.result?.inconclusive ? VERIFY_EXIT.UNANCHORED : VERIFY_EXIT.CLEAN;
+    }
+    return report2(r, from, to);
+  } catch (err) {
+    printError(err instanceof Error ? err.message : String(err));
+    return VERIFY_EXIT.UNANCHORED;
+  }
+}
+function attachVerifySubgraphCommand(verify) {
+  return verify.command("subgraph").description("Recompute a state-level subgraph from proven blocks and check its served rows").argument("<name>", "deployed subgraph name").option("--replay", "re-run the handlers over blocks proven from the checkpoint").option("--from <height>", "first block to replay (default: the subgraph's startBlock)").option("--to <height>", "last block to replay (default: the served subgraph's height)").option("--node <url>", "read blocks and MARF proofs from this Stacks node RPC instead of the API").addHelpText("after", `
+What is proven, link by link:
+  pin       the served pin is the sha256 of its preimage, which names the served
+            handler bundle, its schema and startBlock
+  blocks    every block in the range, from the checkpoint (signatures above it,
+            parent links and MARF proofs below it)
+  txs       each block's transactions hash to its header's tx merkle root
+  inputs    each block's writes are named, nothing hidden (state_writes vs witness)
+  handlers  the bundle runs in the deterministic realm over those writes
+  rows      the served rows equal the recomputed ones (keyed by the first
+            unique key, else as a multiset), with a digest per table
+
+Starting after startBlock (--from) is inconclusive once a handler reads or
+merges rows written before the range (findOne, increment, a partial upsert).
+Not proven, so not compared: which transaction made a write (event.tx,
+_tx_id) and writes overwritten within one block. Rows compare on their
+declared columns and _block_height.
+
+Reads are free: proofs and each block's state writes from /v1/proofs (rate
+limited; witnesses 2 per second, so 1,000 blocks take 8 minutes or more) and
+the subgraph's rows from /v1/subgraphs. Nothing bills as Index rows.
+
+Examples:
+  $ secondlayer verify subgraph pool-reserves --replay
+  $ secondlayer verify subgraph pool-reserves --replay --from 1230000 --to 1231000
+  $ secondlayer verify subgraph pool-reserves --replay --json
+
+Exit codes:
+  0  every link holds
+  1  a link is broken (the first is named)
+  2  could not check: the source could not serve a link, the replay is
+     inconclusive, the subgraph is not state-level, or bad input`).action(async (name, opts, cmd) => {
+    const json = cmd.optsWithGlobals().json === true;
+    process.exit(await runVerifySubgraph(name, { ...opts, json }));
+  });
+}
+
 // src/commands/verify.ts
 var VERIFY_EXIT = {
   CLEAN: 0,
   DIVERGED: 1,
   UNANCHORED: 2
 };
-function parseHeight2(value, flag) {
+function parseHeight3(value, flag) {
   const parsed = Number(value);
   if (!Number.isSafeInteger(parsed) || parsed < 0) {
     throw new Error(`${flag} must be a non-negative integer, got "${value}"`);
@@ -204257,8 +204567,8 @@ Exit codes:
     try {
       const target = parseVerifyTarget(targetArg);
       const mode = opts.deep ? "deep" : opts.anchor ? "anchor" : "quick";
-      const fromBlock = opts.fromBlock === undefined ? undefined : parseHeight2(opts.fromBlock, "--from-block");
-      const toBlock = opts.toBlock === undefined ? undefined : parseHeight2(opts.toBlock, "--to-block");
+      const fromBlock = opts.fromBlock === undefined ? undefined : parseHeight3(opts.fromBlock, "--from-block");
+      const toBlock = opts.toBlock === undefined ? undefined : parseHeight3(opts.toBlock, "--to-block");
       if (fromBlock !== undefined && toBlock !== undefined && toBlock < fromBlock) {
         throw new Error("--to-block must be >= --from-block");
       }
@@ -204432,13 +204742,14 @@ Exit codes:
   });
 }
 function registerVerifyCommand(program) {
-  const verify = attachVerifyCommand(program.command("verify").description("Compare local chain data against a signed archive, or prove one block with `verify block` (read-only)"));
+  const verify = attachVerifyCommand(program.command("verify").description("Compare local chain data against a signed archive, prove one block with `verify block`, or recompute a subgraph with `verify subgraph --replay` (read-only)"));
   attachVerifyBlockCommand(verify);
+  attachVerifySubgraphCommand(verify);
 }
 
 // src/commands/archive.ts
 var ARCHIVE_KEY_HINT = "set SECONDLAYER_API_KEY (sk-sl_*) for archive latest/quote; INSTANCE_TOKEN is the instance";
-function parseHeight3(value, flag) {
+function parseHeight4(value, flag) {
   const parsed = Number(value);
   if (!Number.isSafeInteger(parsed) || parsed < 0) {
     throw new Error(`${flag} must be a non-negative integer, got "${value}"`);
@@ -204459,7 +204770,7 @@ function requireAccountKey(resolve = resolveAccountKey3) {
   return accountKey;
 }
 function defaultArchive(accountKey) {
-  return new SecondLayer({
+  return new SecondLayer2({
     accountKey,
     archiveOpsUrl: resolveArchiveOpsUrl()
   }).archive;
@@ -204500,8 +204811,8 @@ async function runLatest(opts, deps = {}) {
 async function runQuote(opts, deps = {}) {
   const accountKey = requireAccountKey(deps.resolveAccountKey);
   const flow = parseFlow(opts.flow);
-  const fromBlock = opts.fromBlock === undefined ? undefined : parseHeight3(opts.fromBlock, "--from-block");
-  const toBlock = opts.toBlock === undefined ? undefined : parseHeight3(opts.toBlock, "--to-block");
+  const fromBlock = opts.fromBlock === undefined ? undefined : parseHeight4(opts.fromBlock, "--from-block");
+  const toBlock = opts.toBlock === undefined ? undefined : parseHeight4(opts.toBlock, "--to-block");
   if (fromBlock !== undefined && toBlock !== undefined && toBlock < fromBlock) {
     printError("--to-block must be >= --from-block");
     process.exit(1);
@@ -205301,7 +205612,7 @@ import {
   statSync as statSync2,
   writeFileSync as writeFileSync4
 } from "node:fs";
-import { dirname as dirname6, join as join9, relative, resolve as resolve7 } from "node:path";
+import { dirname as dirname6, join as join9, relative as relative2, resolve as resolve7 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { input, select as select3 } from "@inquirer/prompts";
 import { SecondLayer as SecondLayer4 } from "@secondlayer/sdk";
@@ -205483,7 +205794,7 @@ async function createWebhook(name, opts) {
   const targetDir = resolve7(process.cwd(), name);
   if (opts.scaffold !== false) {
     if (existsSync5(targetDir)) {
-      error(`Directory already exists: ${relative(process.cwd(), targetDir)}`);
+      error(`Directory already exists: ${relative2(process.cwd(), targetDir)}`);
       process.exit(1);
     }
     const tplRoot = templatesRoot();
@@ -205530,7 +205841,7 @@ async function createWebhook(name, opts) {
   }
   if (signingSecret && opts.scaffold !== false) {
     const envTarget = writeSigningSecretEnv(targetDir, signingSecret);
-    success(`Signing secret written to ${relative(process.cwd(), envTarget)}`);
+    success(`Signing secret written to ${relative2(process.cwd(), envTarget)}`);
   } else if (signingSecret && opts.scaffold === false) {
     info(`Signing secret (store securely): ${signingSecret}`);
   }
@@ -206978,7 +207289,7 @@ function consumeHandlers(io) {
     }
   };
 }
-function parseHeight4(value, name) {
+function parseHeight5(value, name) {
   if (value === undefined)
     return;
   const n = Number.parseInt(value, 10);
@@ -207012,8 +207323,8 @@ Examples:
         sender: parseList(options.sender),
         recipient: parseList(options.recipient),
         cursor: options.cursor,
-        fromHeight: parseHeight4(options.fromBlock, "--from-block"),
-        toHeight: parseHeight4(options.toBlock, "--to-block"),
+        fromHeight: parseHeight5(options.fromBlock, "--from-block"),
+        toHeight: parseHeight5(options.toBlock, "--to-block"),
         limit: parseLimit(options.limit)
       });
       writeData(JSON.stringify(envelope, null, 2));
@@ -207077,8 +207388,8 @@ Examples:
   });
   const runDumps = async (options) => {
     try {
-      const fromBlock = parseHeight4(options.fromBlock, "--from-block");
-      const toBlock = parseHeight4(options.toBlock, "--to-block");
+      const fromBlock = parseHeight5(options.fromBlock, "--from-block");
+      const toBlock = parseHeight5(options.toBlock, "--to-block");
       const dumps = dumpsClient(options.dumpsUrl).dumps;
       const manifest = await dumps.list();
       const files = manifest.files.filter((f) => (fromBlock === undefined || f.to_block >= fromBlock) && (toBlock === undefined || f.from_block <= toBlock));
@@ -207109,7 +207420,7 @@ Examples:
   $ secondlayer streams dumps --to ./dump --from-block 150000 --to-block 200000`).action(runDumps);
   streams.command("canonical <height>").description("Canonical block metadata at a given height").option("--json", "Output as JSON (streams always emits JSON)").action(async (heightArg) => {
     try {
-      const height = parseHeight4(heightArg, "<height>");
+      const height = parseHeight5(heightArg, "<height>");
       if (height === undefined)
         throw new Error("<height> is required");
       const block = await client2().canonical(height);
@@ -209529,5 +209840,5 @@ registerCreditsCommand(program);
 registerArchiveCommand(program);
 program.parse();
 
-//# debugId=92924A7AE61FB1AF64756E2164756E21
+//# debugId=F270856631D97EA764756E2164756E21
 //# sourceMappingURL=cli.js.map