@secondlayer/cli 23.2.1 → 23.4.0

package/dist/cli.js

@@ -29357,6 +29357,12 @@ function inspectSourceGitState(absPath) {
   }
   return { kind: "clean" };
 }
+function uncommittedSourceWarning(state, file) {
+  if (state.kind !== "untracked" && state.kind !== "modified")
+    return;
+  const reason = state.kind === "untracked" ? "not tracked by git" : "modified with uncommitted changes";
+  return `${file} is ${reason}, so this deploy's only copy is the database row. Commit it to keep a copy.`;
+}
 var init_git_status = () => {};
 
 // src/lib/merge-print-subgraph.ts
@@ -29990,7 +29996,6 @@ import {
 } from "node:fs";
 import { basename, dirname as dirname5, extname, join as join7, relative, resolve as resolve5 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
-import { confirm as confirm2 } from "@inquirer/prompts";
 import {
   generatePrintPayloadTypes,
   generatePrintSchemaSubgraph as generatePrintSchemaSubgraph2,
@@ -30004,31 +30009,11 @@ import {
   deriveVerification as deriveVerification2,
   isDeterminismViolation
 } from "@secondlayer/subgraphs/verification";
-async function loadSubgraphWithDepCheck(absPath) {
-  try {
-    return await import(absPath);
-  } catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    const code = err?.code;
-    const missingSdk = (code === "ERR_MODULE_NOT_FOUND" || msg.includes("ERR_MODULE_NOT_FOUND")) && msg.includes("@secondlayer/subgraphs");
-    if (!missingSdk)
-      throw err;
-    warn("Missing dependency: @secondlayer/subgraphs");
-    const install = await confirm2({
-      message: "Install with `bun add @secondlayer/subgraphs`?",
-      default: true
-    });
-    if (!install)
-      throw err;
-    await new Promise((res, rej) => {
-      const child = spawn2("bun", ["add", "@secondlayer/subgraphs"], {
-        stdio: "inherit"
-      });
-      child.on("error", rej);
-      child.on("exit", (c) => c === 0 ? res() : rej(new Error(`bun add exit ${c}`)));
-    });
-    return await import(absPath);
-  }
+async function loadSubgraphDefinition(source, fileName) {
+  const { bundleSubgraphCode } = await import("@secondlayer/bundler");
+  const bundled = await bundleSubgraphCode(source, { fileName });
+  const url = `data:text/javascript;base64,${Buffer.from(bundled.handlerCode, "utf8").toString("base64")}`;
+  return { mod: await import(url), bundled };
 }
 async function typecheckHandler(absPath) {
   await new Promise((res, rej) => {
@@ -30542,8 +30527,7 @@ Try --trait sip-010 or \`subgraphs scaffold ${opts.fromContract}\` for ABI calls
     if (opts.fromContract) {
       info(`Schema inferred from ${opts.fromContract} print events (${opts.tablePerTopic ? "table per topic" : "single wide table"})`);
     }
-    info(`Next: git add subgraphs/${name}.ts && secondlayer subgraphs deploy subgraphs/${name}.ts`);
-    note("  deploy refuses an unstaged file unless you pass --allow-uncommitted: a staged copy is the one git can recover.");
+    info(`Next: secondlayer subgraphs deploy subgraphs/${name}.ts`);
   });
   subgraphs.command("add <file>").description("Merge another contract's observed print sources into an existing subgraph file").requiredOption("--from-contract <contractId>", "Contract whose print schema to merge (requires network)").option("--table-per-topic", "One table per print topic instead of a single wide table for the added contract").addHelpText("after", `
 Adds sources/schema/handlers for a second (or Nth) contract into an existing
@@ -30650,10 +30634,10 @@ Stopped watching.`);
     });
     await new Promise(() => {});
   });
-  subgraphs.command("deploy <file>").alias("update").description("Deploy a subgraph definition file (alias: update — deploy is create-or-update)").option("--start-block <n>", "Override the subgraph definition startBlock for this deploy").option("--tip-first", "Go live at chain tip immediately; history backfills in the background (handlers may only insert, upsert and delete; update, increment and row reads are refused)").option("--dry-run", "Validate and preview deploy without writing changes").option("-y, --yes", "Skip the reindex confirmation prompt").option("--strict", "Run `tsc --noEmit` against the handler before deploy (slower; catches TS type errors)").option("--allow-uncommitted", "Deploy even though the source file is not staged or committed in git (the deployed definition will exist only in the database)").addHelpText("after", `
-By default the source file must be staged or committed in git (\`git add <file>\`),
-otherwise the deployed definition's only copy is the row in the database. Pass
---allow-uncommitted to deploy anyway.
+  subgraphs.command("deploy <file>").alias("update").description("Deploy a subgraph definition file (alias: update — deploy is create-or-update)").option("--start-block <n>", "Override the subgraph definition startBlock for this deploy").option("--tip-first", "Go live at chain tip immediately; history backfills in the background (handlers may only insert, upsert and delete; update, increment and row reads are refused)").option("--dry-run", "Validate and preview deploy without writing changes").option("-y, --yes", "Skip the reindex confirmation prompt").option("--strict", "Run `tsc --noEmit` against the handler before deploy (slower; catches TS type errors)").option("--allow-uncommitted", "Don't warn when the source file isn't committed in git").addHelpText("after", `
+If the source file isn't committed in git, deploy warns that the deployed
+definition's only copy is the row in the database. It never blocks; pass
+--allow-uncommitted to silence the warning.
 
 Hosted: set SECONDLAYER_API_KEY and SECONDLAYER_API_URL=https://api.secondlayer.tools.
 Hostable sources are event filters and contract_call/contract_deploy; anything else
@@ -30662,28 +30646,10 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
     try {
       const absPath = resolve5(file);
       if (!options.dryRun) {
-        if (options.allowUncommitted) {
-          info("--allow-uncommitted: skipping the git commit check for the source file.");
-        } else {
-          const gitState = inspectSourceGitState(absPath);
-          if (gitState.kind === "untracked" || gitState.kind === "modified") {
-            const reason = gitState.kind === "untracked" ? "not tracked by git" : "modified with uncommitted changes";
-            const message = `${file} is ${reason}. Deploy it and the only copy of this definition is a row in the database.`;
-            if (process.stdin.isTTY) {
-              warn(message);
-              const confirmed = await confirm2({
-                message: "Deploy anyway?",
-                default: false
-              });
-              if (!confirmed) {
-                info("Nothing was deployed.");
-                process.exit(0);
-              }
-            } else {
-              error(`${message} Stage it with \`git add ${file}\`, or pass --allow-uncommitted.`);
-              process.exit(1);
-            }
-          }
+        if (!options.allowUncommitted) {
+          const advice = uncommittedSourceWarning(inspectSourceGitState(absPath), file);
+          if (advice)
+            warn(advice);
         }
       }
       const config = await loadConfig2();
@@ -30697,18 +30663,28 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
         await typecheckHandler(absPath);
       }
       info(`Loading subgraph from ${absPath}`);
-      const mod = await loadSubgraphWithDepCheck(absPath);
-      const def = mod.default ?? mod;
-      const effectiveDef = {
-        ...startBlock === undefined ? def : { ...def, startBlock },
-        ...options.tipFirst ? { backfillMode: "concurrent" } : {}
-      };
       const { validateSubgraphDefinition } = await import("@secondlayer/subgraphs/validate");
       const { readFile } = await import("node:fs/promises");
       const derived = config.network !== "local" ? await withDerivedAbis(await readFile(absPath, "utf8")) : undefined;
       for (const name of Object.keys(derived?.abis ?? {})) {
         info(`Using the deployed contract's abi for source "${name}"`);
       }
+      const source = derived?.source ?? await readFile(absPath, "utf8");
+      const { mod, bundled } = await loadSubgraphDefinition(source, relative(process.cwd(), absPath));
+      const def = mod.default ?? mod;
+      const authored = {
+        ...def,
+        sources: Object.fromEntries(Object.entries(def.sources ?? {}).map(([k, v]) => {
+          if (!derived?.abis[k])
+            return [k, v];
+          const { abi: _abi, ...rest } = v;
+          return [k, rest];
+        }))
+      };
+      const effectiveDef = {
+        ...startBlock === undefined ? authored : { ...authored, startBlock },
+        ...options.tipFirst ? { backfillMode: "concurrent" } : {}
+      };
       const validated = validateSubgraphDefinition(derived && Object.keys(derived.abis).length > 0 ? {
         ...effectiveDef,
         sources: Object.fromEntries(Object.entries(effectiveDef.sources).map(([k, v]) => [
@@ -30721,11 +30697,6 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
       }
       if (config.network !== "local") {
         info(`${dryRun ? "Bundling for remote deploy dry run" : "Bundling for remote deploy"} (${config.network})...`);
-        const source = derived?.source ?? await readFile(absPath, "utf8");
-        const { bundleSubgraphCode } = await import("@secondlayer/bundler");
-        const bundled = await bundleSubgraphCode(source, {
-          fileName: relative(process.cwd(), absPath)
-        });
         const handlerCode = bundled.handlerCode;
         const localVerification = checkDeterminism(effectiveDef, bundled.findings);
         if (dryRun) {
@@ -30840,16 +30811,7 @@ deploy does not backfill from genesis.`).action(async (file, options) => {
           await printDeployFooter();
         }
       } else {
-        let findings;
-        try {
-          const { bundleSubgraphCode } = await import("@secondlayer/bundler");
-          findings = (await bundleSubgraphCode(await readFile(absPath, "utf8"), {
-            fileName: relative(process.cwd(), absPath)
-          })).findings;
-        } catch {
-          findings = undefined;
-        }
-        const verification = findings ? checkDeterminism(effectiveDef, findings) : undefined;
+        const verification = checkDeterminism(effectiveDef, bundled.findings);
         if (dryRun) {
           printSubgraphDeployPreview(createSubgraphDeployPreview(validated), {
             network: config.network,
@@ -31892,7 +31854,7 @@ var {
 // package.json
 var package_default = {
   name: "@secondlayer/cli",
-  version: "23.2.1",
+  version: "23.4.0",
   description: "Run a Stacks index on your own hardware — set it up, restore verified history, and keep it current.",
   repository: {
     type: "git",
@@ -31918,7 +31880,7 @@ var package_default = {
     build: "bunup",
     dev: "bunup --watch",
     test: "bun test",
-    typecheck: "tsc --noEmit",
+    typecheck: "bun check",
     prepublishOnly: "bun run build"
   },
   keywords: [
@@ -31942,8 +31904,8 @@ var package_default = {
     "@secondlayer/bundler": "^0.7.3",
     "@secondlayer/scaffold": "^1.6.3",
     "@secondlayer/sdk": "^16.2.0",
-    "@secondlayer/shared": "^15.0.0",
-    "@secondlayer/stacks": "^6.5.3",
+    "@secondlayer/shared": "^15.0.1",
+    "@secondlayer/stacks": "^6.6.0",
     "@secondlayer/subgraphs": "^8.0.1",
     "@secondlayer/verify": "^0.6.1",
     esbuild: "^0.28.2",
@@ -35611,14 +35573,14 @@ import { dirname as dirname7, join as join10 } from "node:path";
 var DEFAULT_IMAGE_OWNER = "ryanwaits";
 var DEFAULT_IMAGE_TAG = "latest";
 var DEV_INSTANCE_TOKEN = "dev-instance-token";
+var DEV_WEBHOOK_SIGNING_KEY = "-----BEGIN PRIVATE KEY-----\\nMC4CAQAwBQYDK2VwBCIEIIczaKV9CBblFKXjqGwrA3A1FOJxY2HiST7++XGea/jX\\n-----END PRIVATE KEY-----";
 function buildDevnetCompose(opts = {}) {
   const owner = opts.owner ?? DEFAULT_IMAGE_OWNER;
   const tag = opts.imageTag ?? DEFAULT_IMAGE_TAG;
   const apiPort = opts.apiPort ?? 3800;
   const indexerPort = opts.indexerPort ?? 3700;
   const apiPublish = `127.0.0.1:${apiPort}`;
-  const apiImage = `ghcr.io/${owner}/secondlayer-api:${tag}`;
-  const indexerImage = `ghcr.io/${owner}/secondlayer-indexer:${tag}`;
+  const runtimeImage = `ghcr.io/${owner}/secondlayer-runtime:${tag}`;
   const dbUrl = "postgres://secondlayer:secondlayer@postgres:5432/secondlayer";
   const DEV_SECRETS_KEY = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef";
   return `# Generated by \`secondlayer devnet connect\` — do not edit by hand.
@@ -35641,22 +35603,24 @@ services:
       retries: 10
     restart: unless-stopped
 
-  migrate:
-    image: ${apiImage}
-    command: ["bun", "run", "packages/shared/src/db/migrate.ts"]
-    environment:
-      DATABASE_URL: ${dbUrl}
-    depends_on:
-      postgres:
-        condition: service_healthy
-    restart: "no"
-
-  api:
-    image: ${apiImage}
+  secondlayer:
+    image: ${runtimeImage}
     environment:
       INSTANCE_MODE: oss
+      # Keep every network key aligned: the indexer writes index_progress under
+      # STACKS_NETWORK, the subgraph processor reads it under NETWORK. If they
+      # differ, catch-up finds no progress row and subgraphs never advance.
+      NETWORKS: testnet
+      STACKS_NETWORK: testnet
+      NETWORK: testnet
+      NODE_MODE: external
+      # A devnet index is tiny; the runtime's RAM/disk floors target real
+      # networks and a laptop's Docker VM often has less than 80 GB free.
+      SECONDLAYER_ALLOW_UNDERSIZED: "true"
       DATABASE_URL: ${dbUrl}
-      PORT: 3800
+      DATA_DIR: /data
+      API_PORT: "3800"
+      INDEXER_PORT: "3700"
       # 0.0.0.0 is forced: a container process that binds loopback is
       # unreachable through a published port. The real reach is the publish
       # spec below, handed over verbatim so /v1 reads stay keyless on devnet.
@@ -35665,93 +35629,48 @@ services:
       # Boot guard reads LISTEN_HOST, so a token is required to start at all.
       # It gates writes only — reads are open on this loopback publish.
       INSTANCE_TOKEN: ${DEV_INSTANCE_TOKEN}
-      NODE_ENV: production
-      DATA_DIR: /data
-      # Shared across api + subgraph-processor so the secret the api encrypts
-      # (e.g. a webhook's signing secret) can be decrypted by the emitter.
-      # OSS auto-generates a per-process key when unset — that splits them.
-      # Local-dev fixed value; not a production secret.
+      # Fixed so the secret the api encrypts (e.g. a webhook's signing secret)
+      # can be decrypted by the emitter across restarts. Not a production secret.
       SECONDLAYER_SECRETS_KEY: ${DEV_SECRETS_KEY}
-    ports:
-      - "${apiPublish}:3800"
-    volumes:
-      - subgraphs_data:/data/subgraphs
-    depends_on:
-      migrate:
-        condition: service_completed_successfully
-      postgres:
-        condition: service_healthy
-    healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:3800/health"]
-      interval: 10s
-      timeout: 3s
-      start_period: 10s
-      retries: 5
-    restart: unless-stopped
-
-  indexer:
-    image: ${indexerImage}
-    environment:
-      DATABASE_URL: ${dbUrl}
-      PORT: 3700
-      NODE_ENV: production
-      # Keep every network key aligned: the indexer writes index_progress under
-      # STACKS_NETWORK, the subgraph processor reads it under NETWORK. If they
-      # differ, catch-up finds no progress row and subgraphs never advance.
-      NETWORKS: testnet
-      STACKS_NETWORK: testnet
-      NETWORK: testnet
+      # Signed deliveries, so receivers can test verification. Publicly known.
+      SECONDLAYER_WEBHOOK_SIGNING_PRIVATE_KEY: "${DEV_WEBHOOK_SIGNING_KEY}"
+      # The emitter blocks webhook delivery to private/loopback IPs by default.
+      # On a local devnet you deliver to your own localhost receiver, so allow it.
+      SECONDLAYER_ALLOW_PRIVATE_EGRESS: "true"
+      # An OSS indexer with no index_progress spools observer blocks until an
+      # archive import finishes. A devnet has no archive, so ingest live.
+      INGEST_MODE: live
       # Fed by the devnet node's event observer — never reach out to Hiro mainnet.
       AUTO_BACKFILL_ENABLED: "false"
       TIP_FOLLOWER_ENABLED: "false"
-    # Deliberately published on every interface, unlike the api: the devnet's
-    # stacks-node runs in its own container and POSTs events to
-    # host.docker.internal:3700, which resolves to the host gateway address,
-    # not 127.0.0.1. A loopback publish here would drop every block.
+      # clarinet publishes the devnet node RPC on the host's 20443.
+      STACKS_NODE_RPC_URL: http://host.docker.internal:20443
+      STREAMS_API_URL: http://127.0.0.1:3800
+      SUBGRAPH_SOURCE: streams-index
+      SUBGRAPH_INDEX_API_URL: http://127.0.0.1:3800
+      NODE_ENV: production
+    # The api is loopback-only; the indexer is deliberately published on every
+    # interface: the devnet's stacks-node runs in its own container and POSTs
+    # events to host.docker.internal:3700, which resolves to the host gateway
+    # address, not 127.0.0.1. A loopback publish would drop every block.
     ports:
+      - "${apiPublish}:3800"
       - "${indexerPort}:3700"
     extra_hosts:
       - "host.docker.internal:host-gateway"
+    volumes:
+      - subgraphs_data:/data/subgraphs
     depends_on:
-      migrate:
-        condition: service_completed_successfully
       postgres:
         condition: service_healthy
     healthcheck:
-      test: ["CMD", "curl", "-f", "http://localhost:3700/health"]
+      test: ["CMD", "curl", "-f", "http://localhost:3800/health"]
       interval: 10s
       timeout: 3s
-      start_period: 10s
+      start_period: 40s
       retries: 5
     restart: unless-stopped
 
-  subgraph-processor:
-    image: ${apiImage}
-    command: ["bun", "run", "packages/subgraphs/src/service.ts"]
-    environment:
-      DATABASE_URL: ${dbUrl}
-      NODE_ENV: production
-      DATA_DIR: /data
-      # Must match the indexer's network key (see indexer note) — catch-up reads
-      # index_progress under NETWORK.
-      NETWORK: testnet
-      STACKS_NETWORK: testnet
-      # The emitter blocks webhook delivery to private/loopback IPs by default.
-      # On a local devnet you deliver to your own localhost receiver, so allow it.
-      SECONDLAYER_ALLOW_PRIVATE_EGRESS: "true"
-      # Must match the api's key so the emitter can decrypt signing secrets.
-      SECONDLAYER_SECRETS_KEY: ${DEV_SECRETS_KEY}
-    volumes:
-      - subgraphs_data:/data/subgraphs
-    depends_on:
-      migrate:
-        condition: service_completed_successfully
-      postgres:
-        condition: service_healthy
-    healthcheck:
-      disable: true
-    restart: unless-stopped
-
 volumes:
   postgres_data:
   subgraphs_data:
@@ -35910,7 +35829,7 @@ is what makes minting possible without Bitcoin.`).action(async (opts) => {
       const txid = await client.callContract({
         contract,
         functionName: "complete-deposit-wrapper",
-        functionArgs: [
+        args: [
           Cl.bufferFromHex(depositTxid),
           Cl.uint(0),
           Cl.uint(amount),
@@ -35966,13 +35885,7 @@ function dockerCompose(composePath, args) {
 }
 var API_URL = (process.env.SECONDLAYER_API_URL || LOCAL_API_URL).replace(/\/+$/, "");
 var INDEXER_URL = process.env.INDEXER_URL ?? "http://localhost:3700";
-var SERVICES = [
-  "indexer",
-  "api",
-  "subgraph-processor",
-  "postgres",
-  "migrate"
-];
+var SERVICES = ["secondlayer", "postgres"];
 function registerDevnetCommand(program) {
   const devnet = program.command("devnet").description("Run Secondlayer services against a local Clarinet devnet");
   registerFaucetCommand(devnet);
@@ -35985,7 +35898,7 @@ function registerDevnetCommand(program) {
   devnet.command("status").description("Snapshot of the local stack: ingest, subgraphs, and recent activity").option("-w, --watch", "Refresh every 2s until Ctrl-C").option("--limit <n>", "Recent activity rows to show", "12").action(async (options) => {
     await status(options);
   });
-  devnet.command("logs [service]").description("Tail stack logs — all services, or one of: indexer, api, subgraph-processor, postgres").option("--project <dir>", "Clarinet project directory").option("-f, --follow", "Follow log output").option("-n, --lines <n>", "Lines to show from the end of each log").action(async (service, options) => {
+  devnet.command("logs [service]").description("Tail stack logs — all services, or one of: secondlayer, postgres").option("--project <dir>", "Clarinet project directory").option("-f, --follow", "Follow log output").option("-n, --lines <n>", "Lines to show from the end of each log").action(async (service, options) => {
     await logs(service, options);
   });
 }
@@ -36029,6 +35942,11 @@ Skipped docker. Start it with:
   }
   ensureDocker();
   console.log(dim(`
+Pulling latest images…`));
+  if (dockerCompose(composePath, ["pull"]) !== 0) {
+    console.log(yellow("couldn't pull the latest images — starting with what's cached"));
+  }
+  console.log(dim(`
 Starting Secondlayer stack (docker compose up -d)…`));
   if (dockerCompose(composePath, ["up", "-d"]) !== 0) {
     error("docker compose up failed — see output above.");
@@ -36105,7 +36023,7 @@ var SYS_COLS = new Set([
   "tx_id"
 ]);
 function shortVal(v) {
-  const s = String(v);
+  const s = typeof v === "object" && v !== null ? JSON.stringify(v) : String(v);
   return s.length > 18 ? `${s.slice(0, 6)}…${s.slice(-4)}` : s;
 }
 async function renderStatus(limit) {
@@ -36912,7 +36830,7 @@ init_api_url();
 init_http();
 import { hostname } from "node:os";
 import { createInterface } from "node:readline";
-import { confirm as confirm3, input } from "@inquirer/prompts";
+import { confirm as confirm2, input } from "@inquirer/prompts";
 
 // src/lib/open-browser.ts
 import { spawn as spawn3 } from "node:child_process";
@@ -36995,7 +36913,7 @@ async function shouldContinueLogin(target, options, deps = defaultLoginCheckDeps
     return false;
   }
   try {
-    const proceed = await confirm3({
+    const proceed = await confirm2({
       message: "Log in as a different user?",
       default: false
     });
@@ -37742,8 +37660,7 @@ program.hook("preAction", (thisCommand) => {
 program.addHelpText("after", `
 Quickstart:
   $ secondlayer subgraphs create my-watcher --from-contract SP....my-contract
-  $ git add subgraphs/my-watcher.ts
-  $ secondlayer subgraphs deploy subgraphs/my-watcher.ts   # or --allow-uncommitted
+  $ secondlayer subgraphs deploy subgraphs/my-watcher.ts
 
 Self-host, from docker/oss in a checkout:
   $ secondlayer init --network mainnet
@@ -37781,5 +37698,5 @@ registerCreditsCommand(program);
 registerArchiveCommand(program);
 program.parse();
 
-//# debugId=F92A663889BDE04D64756E2164756E21
+//# debugId=C1922C0758B86D1064756E2164756E21
 //# sourceMappingURL=cli.js.map