@secondlayer/cli 19.4.3 → 20.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@secondlayer/cli",
-	"version": "19.4.3",
+	"version": "20.0.1",
 	"description": "Run a Stacks index on your own hardware — set it up, restore verified history, and keep it current.",
 	"repository": {
 		"type": "git",
@@ -21,7 +21,7 @@
 			"import": "./dist/index.js"
 		}
 	},
-	"files": ["dist", "templates", "README.md"],
+	"files": ["dist", "README.md"],
 	"scripts": {
 		"build": "bunup",
 		"dev": "bunup --watch",
@@ -37,15 +37,15 @@
 		"@biomejs/wasm-nodejs": "^1.9.0",
 		"@dsnp/parquetjs": "~1.8.8",
 		"@inquirer/prompts": "^8.2.0",
-		"@secondlayer/bundler": "^0.7.0",
-		"@secondlayer/scaffold": "^1.6.1",
-		"@secondlayer/sdk": "^14.5.1",
-		"@secondlayer/shared": "^11.24.1",
+		"@secondlayer/bundler": "^0.7.1",
+		"@secondlayer/scaffold": "^1.6.2",
+		"@secondlayer/sdk": "^15.0.0",
+		"@secondlayer/shared": "^12.0.0",
 		"@secondlayer/stacks": "^6.2.0",
-		"@secondlayer/subgraphs": "^6.6.2",
-		"@secondlayer/verify": "^0.4.0",
+		"@secondlayer/subgraphs": "^7.0.1",
+		"@secondlayer/verify": "^0.5.0",
 		"esbuild": "^0.28.2",
-		"smol-toml": "^1.8.0",
+		"smol-toml": "^1.9.1",
 		"zod": "^4.3.6"
 	},
 	"peerDependencies": {

package/templates/webhooks/cloudflare/.env.example

@@ -1 +0,0 @@
-SIGNING_SECRET=

package/templates/webhooks/cloudflare/README.md

@@ -1,44 +0,0 @@
-# {{NAME}} — Cloudflare subscription receiver
-
-A [Cloudflare Workflows](https://developers.cloudflare.com/workflows/)
-instance triggered by a Secondlayer subscription via Cloudflare's
-`workflows/instances` REST API. "Workflows" here refers to Cloudflare's
-durable-execution product; it's separate from anything Secondlayer runs.
-
-## Run
-
-```bash
-bun install
-bunx wrangler login
-bunx wrangler dev
-```
-
-`wrangler dev` spins up a local runtime. Your subscription URL should
-point at Cloudflare's API:
-
-```
-https://api.cloudflare.com/client/v4/accounts/{ACCOUNT_ID}/workflows/{{NAME}}/instances
-```
-
-Provision the subscription with bearer auth:
-
-```bash
-secondlayer webhooks create {{NAME}} --runtime cloudflare --auth-token <CF_API_TOKEN>
-```
-
-You can also patch an existing subscription with
-`secondlayer webhooks update {{NAME}} --auth-token <CF_API_TOKEN>`.
-
-The token must have `Workflows: Edit` scope.
-
-## Signature verification
-
-Cloudflare authenticates the API call with the bearer token. Inside the
-Workflows entrypoint, `event.payload.params._outboxId` is a stable dedup
-key if you want idempotent replay handling.
-
-## Deploy
-
-```bash
-bunx wrangler deploy
-```

package/templates/webhooks/cloudflare/package.json

@@ -1,15 +0,0 @@
-{
-	"name": "{{NAME}}",
-	"version": "0.1.0",
-	"private": true,
-	"scripts": {
-		"dev": "wrangler dev",
-		"deploy": "wrangler deploy",
-		"types": "wrangler types"
-	},
-	"devDependencies": {
-		"@cloudflare/workers-types": "^4.20250101.0",
-		"typescript": "^5",
-		"wrangler": "^4.0.0"
-	}
-}

package/templates/webhooks/cloudflare/src/index.ts

@@ -1,34 +0,0 @@
-import {
-	WorkflowEntrypoint,
-	type WorkflowEvent,
-	type WorkflowStep,
-} from "cloudflare:workers";
-
-interface Params {
-	_type: string;
-	_outboxId: string;
-	[k: string]: unknown;
-}
-
-export class OnSubgraphEvent extends WorkflowEntrypoint<Env, Params> {
-	async run(event: WorkflowEvent<Params>, step: WorkflowStep): Promise<void> {
-		const params = event.payload;
-		await step.do("handle", async () => {
-			console.log("[subgraph event]", params._type, params);
-			// TODO: plug in your business logic.
-			return { ok: true };
-		});
-	}
-}
-
-interface Env {
-	MY_WORKFLOW: Workflow<Params>;
-}
-
-export default {
-	async fetch(_req: Request): Promise<Response> {
-		return new Response(
-			"Cloudflare Workflows receiver — trigger via the `workflows/instances` API.",
-		);
-	},
-};

package/templates/webhooks/cloudflare/tsconfig.json

@@ -1,10 +0,0 @@
-{
-	"compilerOptions": {
-		"target": "ES2022",
-		"module": "ESNext",
-		"moduleResolution": "bundler",
-		"strict": true,
-		"skipLibCheck": true,
-		"types": ["@cloudflare/workers-types"]
-	}
-}

package/templates/webhooks/cloudflare/wrangler.toml

@@ -1,8 +0,0 @@
-name = "{{NAME}}"
-main = "src/index.ts"
-compatibility_date = "2025-01-01"
-
-[[workflows]]
-name = "{{NAME}}"
-binding = "MY_WORKFLOW"
-class_name = "OnSubgraphEvent"

package/templates/webhooks/inngest/.env.example

@@ -1,2 +0,0 @@
-SIGNING_SECRET=
-PORT=3000

package/templates/webhooks/inngest/README.md

@@ -1,29 +0,0 @@
-# {{NAME}} — Inngest subscription receiver
-
-Inngest Dev Server with a function wired to `{{EVENT_NAME}}`. Events come
-from your Secondlayer subscription — Inngest handles retries, concurrency,
-and step-level state.
-
-## Run
-
-```bash
-bun install
-bun run dev
-```
-
-This starts the Inngest dev UI at `http://localhost:8288`. Point your
-subscription URL at the Inngest event endpoint shown in the dev UI
-(typically `http://localhost:8288/e/{eventKey}` for local, or the hosted
-`https://inn.gs/e/{eventKey}` endpoint for cloud).
-
-## Signature verification
-
-Inngest uses its own event key auth — there's no HMAC to verify. The event
-key in the URL IS the auth token. For self-hosted Inngest add an ingress
-allowlist so only the Secondlayer emitter can post.
-
-## Deploy
-
-- **Inngest Cloud**: create an app at https://inngest.com, copy the event
-  key, and set it in the subscription URL: `https://inn.gs/e/{EVENT_KEY}`.
-- **Self-host**: see https://www.inngest.com/docs/self-hosting

package/templates/webhooks/inngest/package.json

@@ -1,18 +0,0 @@
-{
-	"name": "{{NAME}}",
-	"version": "0.1.0",
-	"private": true,
-	"type": "module",
-	"scripts": {
-		"dev": "bunx inngest-cli@latest dev",
-		"start": "bun --hot src/server.ts"
-	},
-	"dependencies": {
-		"hono": "^4.6.0",
-		"inngest": "^3.27.0"
-	},
-	"devDependencies": {
-		"@types/bun": "latest",
-		"typescript": "^5"
-	}
-}

package/templates/webhooks/inngest/src/inngest.ts

@@ -1,19 +0,0 @@
-import { Inngest } from "inngest";
-
-export const inngest = new Inngest({
-	id: "{{NAME}}",
-});
-
-export const onSubgraphEvent = inngest.createFunction(
-	{ id: "on-subgraph-event", name: "On Subgraph Event" },
-	{ event: "{{EVENT_NAME}}" },
-	async ({ event, step }) => {
-		// `event.data` is the row payload delivered by Secondlayer.
-		const row = event.data as Record<string, unknown>;
-		await step.run("handle", async () => {
-			console.log("[subgraph event]", event.name, row);
-			// TODO: plug in your business logic — AI SDK, HTTP, DB writes, etc.
-			return { ok: true };
-		});
-	},
-);

package/templates/webhooks/inngest/src/server.ts

@@ -1,14 +0,0 @@
-import { Hono } from "hono";
-import { serve } from "inngest/hono";
-import { inngest, onSubgraphEvent } from "./inngest.ts";
-
-const app = new Hono();
-app.on(
-	["GET", "POST", "PUT"],
-	"/api/inngest",
-	serve({ client: inngest, functions: [onSubgraphEvent] }),
-);
-
-const PORT = Number.parseInt(process.env.PORT ?? "3000", 10);
-Bun.serve({ port: PORT, fetch: app.fetch });
-console.log(`{{NAME}} (Inngest host) listening on :${PORT}`);

package/templates/webhooks/inngest/tsconfig.json

@@ -1,11 +0,0 @@
-{
-	"compilerOptions": {
-		"target": "ES2022",
-		"module": "ESNext",
-		"moduleResolution": "bundler",
-		"strict": true,
-		"esModuleInterop": true,
-		"skipLibCheck": true,
-		"types": ["bun-types"]
-	}
-}

package/templates/webhooks/node/.env.example

@@ -1,2 +0,0 @@
-SIGNING_SECRET=
-PORT=3000

package/templates/webhooks/node/README.md

@@ -1,36 +0,0 @@
-# {{NAME}} — Node.js subscription receiver
-
-Hono HTTP server that verifies Standard Webhooks signatures and routes events
-to your business logic. No framework lock-in.
-
-## Run
-
-`.env` is written for you at `secondlayer webhooks create` time with the signing
-secret already populated. Lost it: `secondlayer webhooks rotate-secret {{NAME}}`.
-
-```bash
-bun install
-bun run dev
-```
-
-The server listens on `:3000`. Your subscription's URL should point at
-`http://<host>:3000/webhook`.
-
-## Signature verification
-
-Every request is verified before your handler runs. Forged requests return
-`401`. The logic lives in `src/index.ts`; swap `@secondlayer/shared` for the
-[Svix verify library](https://docs.standardwebhooks.com/libraries) if you
-want to decouple from `@secondlayer/shared`:
-
-```ts
-import { Webhook } from "standardwebhooks";
-const wh = new Webhook(process.env.SIGNING_SECRET!);
-const event = wh.verify(body, headers);
-```
-
-## Deploy
-
-Fly.io, Render, Railway, your own VM — anywhere that can run `bun` works.
-Expose port 3000, set `SIGNING_SECRET`, point the subscription URL at the
-public hostname.

package/templates/webhooks/node/package.json

@@ -1,18 +0,0 @@
-{
-	"name": "{{NAME}}",
-	"version": "0.1.0",
-	"private": true,
-	"type": "module",
-	"scripts": {
-		"dev": "bun --hot src/index.ts",
-		"start": "bun src/index.ts"
-	},
-	"dependencies": {
-		"@secondlayer/shared": "^4.2.0",
-		"hono": "^4.6.0"
-	},
-	"devDependencies": {
-		"@types/bun": "latest",
-		"typescript": "^5"
-	}
-}

package/templates/webhooks/node/src/index.ts

@@ -1,53 +0,0 @@
-import { verify } from "@secondlayer/shared/crypto/standard-webhooks";
-import { Hono } from "hono";
-
-/**
- * Minimal Standard Webhooks receiver.
- *
- * The signing secret was shown ONCE when you ran `secondlayer webhooks create`.
- * If you lost it: secondlayer webhooks rotate-secret {{NAME}}
- */
-
-const SIGNING_SECRET = process.env.SIGNING_SECRET;
-if (!SIGNING_SECRET) {
-	console.error(
-		"SIGNING_SECRET not set. Copy .env.example → .env and fill it in.",
-	);
-	process.exit(1);
-}
-
-const app = new Hono();
-
-interface SubgraphEvent {
-	type: string;
-	timestamp: string;
-	data: Record<string, unknown>;
-}
-
-app.post("/webhook", async (c) => {
-	const body = await c.req.text();
-	const headers: Record<string, string> = {};
-	c.req.raw.headers.forEach((v, k) => {
-		headers[k.toLowerCase()] = v;
-	});
-
-	if (!verify(body, headers, SIGNING_SECRET)) {
-		console.warn("signature verification failed");
-		return c.text("unauthorized", 401);
-	}
-
-	const event = JSON.parse(body) as SubgraphEvent;
-	await onEvent(event);
-	return c.text("ok", 200);
-});
-
-async function onEvent(event: SubgraphEvent): Promise<void> {
-	// TODO: plug in your business logic. `event.type` is
-	// `<subgraph>.<table>.<created|updated|deleted>` (the verb reflects the row
-	// op); `event.data` is the row payload.
-	console.log("[event]", event.type, event.data);
-}
-
-const PORT = Number.parseInt(process.env.PORT ?? "3000", 10);
-Bun.serve({ port: PORT, fetch: app.fetch });
-console.log(`{{NAME}} listening on :${PORT}`);

package/templates/webhooks/node/tsconfig.json

@@ -1,11 +0,0 @@
-{
-	"compilerOptions": {
-		"target": "ES2022",
-		"module": "ESNext",
-		"moduleResolution": "bundler",
-		"strict": true,
-		"esModuleInterop": true,
-		"skipLibCheck": true,
-		"types": ["bun-types"]
-	}
-}

package/templates/webhooks/trigger/.env.example

@@ -1,2 +0,0 @@
-SIGNING_SECRET=
-TRIGGER_SECRET_KEY=

package/templates/webhooks/trigger/README.md

@@ -1,38 +0,0 @@
-# {{NAME}} — Trigger.dev subscription receiver
-
-A Trigger.dev v3 task that receives subgraph events via the
-`{task}/trigger` HTTP API.
-
-## Run
-
-```bash
-bun install
-bunx trigger.dev@latest init     # follow prompts
-bun run dev
-```
-
-The Trigger CLI provisions a project and shows the task endpoint URL. Your
-Secondlayer subscription URL should point at:
-
-```
-https://api.trigger.dev/api/v1/tasks/{{TASK_ID}}/trigger
-```
-
-Provision the subscription with bearer auth:
-
-```bash
-secondlayer webhooks create {{NAME}} --runtime trigger --auth-token tr_secret_abc...
-```
-
-You can also patch an existing subscription with
-`secondlayer webhooks update {{NAME}} --auth-token tr_secret_abc...`.
-
-## Signature verification
-
-Trigger authenticates requests with the bearer token — there's no separate
-HMAC. Your secret IS the auth. Rotate via the Trigger dashboard when
-needed.
-
-## Deploy
-
-Run `bunx trigger.dev@latest deploy` to push to Trigger Cloud.

package/templates/webhooks/trigger/package.json

@@ -1,17 +0,0 @@
-{
-	"name": "{{NAME}}",
-	"version": "0.1.0",
-	"private": true,
-	"type": "module",
-	"scripts": {
-		"dev": "npx trigger.dev@latest dev",
-		"deploy": "npx trigger.dev@latest deploy"
-	},
-	"dependencies": {
-		"@trigger.dev/sdk": "^3.3.0"
-	},
-	"devDependencies": {
-		"@types/bun": "latest",
-		"typescript": "^5"
-	}
-}

package/templates/webhooks/trigger/src/tasks/subgraph-event.ts

@@ -1,15 +0,0 @@
-import { task } from "@trigger.dev/sdk/v3";
-
-/**
- * Task triggered by a Secondlayer subscription. The Secondlayer emitter
- * POSTs to this task's HTTP endpoint; Trigger.dev handles durable
- * execution, retries, and concurrency.
- */
-export const onSubgraphEvent = task({
-	id: "{{TASK_ID}}",
-	run: async (payload: Record<string, unknown>, { ctx: _ctx }) => {
-		console.log("[subgraph event]", payload);
-		// TODO: your business logic — AI SDK, HTTP, DB, chain broadcasts.
-		return { ok: true };
-	},
-});

package/templates/webhooks/trigger/trigger.config.ts

@@ -1,6 +0,0 @@
-import { defineConfig } from "@trigger.dev/sdk/v3";
-
-export default defineConfig({
-	project: "{{NAME}}",
-	dirs: ["./src/tasks"],
-});

package/templates/webhooks/trigger/tsconfig.json

@@ -1,10 +0,0 @@
-{
-	"compilerOptions": {
-		"target": "ES2022",
-		"module": "ESNext",
-		"moduleResolution": "bundler",
-		"strict": true,
-		"esModuleInterop": true,
-		"skipLibCheck": true
-	}
-}