@secondlayer/sdk 9.0.1 → 10.0.0

package/dist/subgraphs/index.js

@@ -85,8 +85,8 @@ class ApiError extends SecondLayerError {
 
 class AuthError extends ApiError {
   status = 401;
-  constructor(message = "API key invalid or expired.") {
-    super(401, message);
+  constructor(message = "API key invalid or expired.", body, code) {
+    super(401, message, body, code);
     this.name = "AuthError";
   }
 }
@@ -94,8 +94,8 @@ class AuthError extends ApiError {
 class RateLimitError extends ApiError {
   retryAfter;
   status = 429;
-  constructor(message = "Rate limited. Try again later.", retryAfter) {
-    super(429, message, undefined, undefined, {
+  constructor(message = "Rate limited. Try again later.", retryAfter, body, code) {
+    super(429, message, body, code, {
       retryable: true,
       retryAfterSeconds: parseRetryAfter(retryAfter)
     });
@@ -105,8 +105,8 @@ class RateLimitError extends ApiError {
 }
 
 class ValidationError extends ApiError {
-  constructor(message, status, body) {
-    super(status, message, body, undefined, { retryable: false });
+  constructor(message, status, body, code) {
+    super(status, message, body, code, { retryable: false });
     this.name = "ValidationError";
   }
 }
@@ -122,18 +122,22 @@ function parseRetryAfter(value) {
   return;
 }
 
-class VersionConflictError extends ApiError {
-  currentVersion;
-  expectedVersion;
-  constructor(currentVersion, expectedVersion, message = `Version conflict: expected ${expectedVersion}, current ${currentVersion}`) {
-    super(409, message, { currentVersion, expectedVersion });
-    this.currentVersion = currentVersion;
-    this.expectedVersion = expectedVersion;
-    this.name = "VersionConflictError";
-  }
-}
-
 // src/base.ts
+var DEFAULT_REQUEST_TIMEOUT_MS = 30000;
+function abortError() {
+  return new DOMException("This operation was aborted", "AbortError");
+}
+function raceAbort(promise, signal) {
+  if (signal.aborted)
+    return Promise.reject(signal.reason ?? abortError());
+  return new Promise((resolve, reject) => {
+    const onAbort = () => reject(signal.reason ?? abortError());
+    signal.addEventListener("abort", onAbort, { once: true });
+    promise.then(resolve, reject).finally(() => {
+      signal.removeEventListener("abort", onAbort);
+    });
+  });
+}
 var LOCAL_API_URL = "http://127.0.0.1:3800";
 function resolveBaseUrl(explicit) {
   if (explicit && explicit.length > 0)
@@ -163,6 +167,9 @@ function resolveApiKey(apiKey) {
   }
   return instanceToken ?? legacyKey;
 }
+function seg(value) {
+  return encodeURIComponent(String(value));
+}
 function buildQuery(params) {
   const search = new URLSearchParams;
   for (const [name, value] of Object.entries(params)) {
@@ -176,16 +183,39 @@ function buildQuery(params) {
   const query = search.toString();
   return query ? `?${query}` : "";
 }
+function parseErrorEnvelope(text) {
+  if (text.length === 0)
+    return { body: undefined };
+  try {
+    const json = JSON.parse(text);
+    let message;
+    let code;
+    if (json && typeof json === "object") {
+      const err = json.error ?? json.message;
+      if (typeof err === "string" && err.length > 0)
+        message = err;
+      else if (err && typeof err === "object")
+        message = JSON.stringify(err);
+      if (typeof json.code === "string")
+        code = json.code;
+    }
+    return { message, code, body: json };
+  } catch {
+    return { message: text, body: text };
+  }
+}
 
 class BaseClient {
   baseUrl;
   apiKey;
   origin;
   fetchImpl;
+  requestTimeoutMs;
   constructor(options = {}) {
     this.baseUrl = resolveBaseUrl(options.baseUrl);
     this.apiKey = resolveApiKey(options.apiKey);
     this.origin = options.origin ?? "cli";
+    this.requestTimeoutMs = options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
     this.fetchImpl = options.fetchImpl ?? ((...args) => fetch(...args));
   }
   static authHeaders(apiKey) {
@@ -197,27 +227,56 @@ class BaseClient {
     }
     return headers;
   }
-  async request(method, path, body) {
-    const response = await this.fetchResponse(method, path, body);
-    if (response.status === 204) {
-      return;
-    }
-    return response.json();
+  async request(method, path, body, opts = {}) {
+    return this.withRequestBudget(opts.signal, async (signal) => {
+      const response = await this.fetchResponse(method, path, body, signal);
+      if (response.status === 204) {
+        return;
+      }
+      return await raceAbort(response.json(), signal);
+    });
   }
-  async requestOrNull(method, path, body) {
+  async requestOrNull(method, path, body, opts = {}) {
     try {
-      return await this.request(method, path, body);
+      return await this.request(method, path, body, opts);
     } catch (err) {
       if (err instanceof ApiError && err.status === 404)
         return null;
       throw err;
     }
   }
-  async requestText(method, path, body) {
-    const response = await this.fetchResponse(method, path, body);
-    return response.text();
+  async requestText(method, path, body, opts = {}) {
+    return this.withRequestBudget(opts.signal, async (signal) => {
+      const response = await this.fetchResponse(method, path, body, signal);
+      return raceAbort(response.text(), signal);
+    });
+  }
+  async withRequestBudget(callerSignal, run) {
+    const controller = new AbortController;
+    let timedOut = false;
+    const forward = () => controller.abort(callerSignal?.reason ?? abortError());
+    if (callerSignal?.aborted)
+      forward();
+    else
+      callerSignal?.addEventListener("abort", forward, { once: true });
+    const timer = this.requestTimeoutMs > 0 ? setTimeout(() => {
+      timedOut = true;
+      controller.abort(abortError());
+    }, this.requestTimeoutMs) : undefined;
+    try {
+      return await run(controller.signal);
+    } catch (err) {
+      if (timedOut && !callerSignal?.aborted) {
+        throw new ApiError(0, `No response from ${this.baseUrl} within ${this.requestTimeoutMs}ms. Retryable. Raise requestTimeoutMs for slow filtered reads.`, undefined, "REQUEST_TIMEOUT", { retryable: true, cause: err instanceof Error ? err : undefined });
+      }
+      throw err;
+    } finally {
+      if (timer !== undefined)
+        clearTimeout(timer);
+      callerSignal?.removeEventListener("abort", forward);
+    }
   }
-  async fetchResponse(method, path, body) {
+  async fetchResponse(method, path, body, signal) {
     const url = `${this.baseUrl}${path}`;
     const headers = BaseClient.authHeaders(this.apiKey);
     headers["x-sl-origin"] = this.origin;
@@ -232,50 +291,254 @@ class BaseClient {
     }
     let response;
     try {
-      response = await this.fetchImpl(url, {
+      const pending = this.fetchImpl(url, {
         method,
         headers,
-        body: serializedBody
+        body: serializedBody,
+        signal
       });
+      response = signal ? await raceAbort(pending, signal) : await pending;
     } catch (err) {
+      if (signal?.aborted)
+        throw err;
       throw new ApiError(0, `Cannot reach API at ${this.baseUrl}. Check your connection or try again.`, undefined, undefined, { retryable: true, cause: err instanceof Error ? err : undefined });
     }
     if (!response.ok) {
+      const errorBody = signal ? await raceAbort(response.text(), signal) : await response.text();
+      const envelope = parseErrorEnvelope(errorBody);
+      const retryAfter = response.headers.get("Retry-After") ?? undefined;
       if (response.status === 401) {
-        throw new AuthError;
+        throw new AuthError(envelope.message ?? "API key invalid or expired.", envelope.body, envelope.code);
       }
       if (response.status === 429) {
-        const retryAfter = response.headers.get("Retry-After");
-        const msg = retryAfter ? `Rate limited. Wait ${retryAfter} seconds.` : "Rate limited. Try again later.";
-        throw new RateLimitError(msg, retryAfter ?? undefined);
+        const fallback = retryAfter ? `Rate limited. Wait ${retryAfter} seconds.` : "Rate limited. Try again later.";
+        throw new RateLimitError(envelope.message ?? fallback, retryAfter, envelope.body, envelope.code);
       }
       if (response.status >= 500) {
-        throw new ApiError(response.status, `Server error. Try again or check status at ${this.baseUrl}/health`);
+        const retryAfterSeconds = parseRetryAfter(retryAfter);
+        throw new ApiError(response.status, envelope.message ?? `Server error. Try again or check status at ${this.baseUrl}/health`, envelope.body, envelope.code, retryAfterSeconds !== undefined ? { retryAfterSeconds } : {});
       }
-      const errorBody = await response.text();
-      let message = `HTTP ${response.status}`;
-      let parsedBody = errorBody;
-      let code;
+      throw new ApiError(response.status, envelope.message ?? `HTTP ${response.status}`, envelope.body, envelope.code);
+    }
+    return response;
+  }
+}
+
+// src/streams/subscribe.ts
+import { ed25519 } from "@secondlayer/shared";
+
+// src/streams/errors.ts
+class StreamsServerError extends ApiError {
+  constructor(message, status, body, code) {
+    super(status, message, body, code, { retryable: true });
+    this.name = "StreamsServerError";
+  }
+}
+
+class StreamsSignatureError extends SecondLayerError {
+  constructor(message = "Streams response signature verification failed.") {
+    super(message);
+    this.name = "StreamsSignatureError";
+  }
+}
+async function mapStreamsError(response) {
+  const { message, code, body } = parseErrorEnvelope(await response.text());
+  if (response.status === 401) {
+    throw new AuthError(message ?? "API key invalid or expired.", body, code);
+  }
+  if (response.status === 429) {
+    const retryAfter = response.headers.get("Retry-After") ?? undefined;
+    throw new RateLimitError(message ?? "Rate limited. Try again later.", retryAfter, body, code);
+  }
+  if (response.status >= 500) {
+    throw new StreamsServerError(message ?? `Streams server returned ${response.status}.`, response.status, body, code);
+  }
+  throw new ValidationError(message ?? `Streams request returned ${response.status}.`, response.status, body, code);
+}
+
+// src/streams/subscribe.ts
+var SUBSCRIBE_MAX_RECONNECT_DELAY_MS = 30000;
+var SUBSCRIBE_DEFAULT_STALE_AFTER_MS = 60000;
+function reconnectDelay(attempt, baseMs, retryAfterSeconds, random = Math.random) {
+  const capped = Math.min(baseMs * 2 ** Math.max(0, attempt), SUBSCRIBE_MAX_RECONNECT_DELAY_MS);
+  const jittered = capped * (0.5 + random() * 0.5);
+  const floor = (retryAfterSeconds ?? 0) * 1000;
+  return Math.max(jittered, floor);
+}
+function isTerminal(err) {
+  if (err instanceof StreamsSignatureError)
+    return true;
+  return err?.retryable === false;
+}
+function subscribeStreamsEvents(opts) {
+  const { params } = opts;
+  const controller = new AbortController;
+  const external = params.signal;
+  if (external) {
+    if (external.aborted)
+      controller.abort();
+    else
+      external.addEventListener("abort", () => controller.abort(), {
+        once: true
+      });
+  }
+  let cursor = params.fromCursor ?? null;
+  const baseDelayMs = opts.reconnectDelayMs ?? params.reconnectDelayMs ?? 1000;
+  const staleAfterMs = opts.staleAfterMs ?? params.staleAfterMs ?? SUBSCRIBE_DEFAULT_STALE_AFTER_MS;
+  let attempt = 0;
+  const run = async () => {
+    while (!controller.signal.aborted) {
       try {
-        const json = JSON.parse(errorBody);
-        parsedBody = json;
-        const err = json.error ?? json.message;
-        if (typeof err === "string") {
-          message = err;
-        } else if (err && typeof err === "object") {
-          message = JSON.stringify(err);
-        }
-        if (typeof json.code === "string") {
-          code = json.code;
-        }
-      } catch {
-        if (errorBody)
-          message = errorBody;
+        const url = `${opts.baseUrl}/v1/streams/events/stream${buildQuery({
+          from_cursor: cursor ?? undefined,
+          types: params.types,
+          not_types: params.notTypes,
+          contract_id: params.contractId,
+          sender: params.sender,
+          recipient: params.recipient,
+          asset_identifier: params.assetIdentifier,
+          filters: params.filters ? JSON.stringify(params.filters) : undefined
+        })}`;
+        await readSse({
+          url,
+          headers: opts.headers ?? {},
+          signal: controller.signal,
+          fetchImpl: opts.fetchImpl,
+          staleAfterMs,
+          mapError: mapStreamsError,
+          onFrame: async (frame) => {
+            attempt = 0;
+            if (frame.event === "ping" || !frame.data)
+              return;
+            let parsed;
+            try {
+              parsed = JSON.parse(frame.data);
+            } catch {
+              return;
+            }
+            if (!parsed.event)
+              return;
+            if (opts.verify !== "off") {
+              if (!parsed.sig) {
+                if (opts.verify === "strict") {
+                  throw new StreamsSignatureError("Streams SSE frame signature is missing.");
+                }
+              } else {
+                const key = await opts.loadKey(parsed.key_id);
+                if (!ed25519.verifyEd25519(JSON.stringify(parsed.event), parsed.sig, key.publicKey)) {
+                  throw new StreamsSignatureError("Streams SSE frame signature is invalid.");
+                }
+              }
+            }
+            await params.onEvent(parsed.event);
+            cursor = parsed.event.cursor ?? cursor;
+          }
+        });
+        await sleep(reconnectDelay(attempt, baseDelayMs, undefined, opts.random), controller.signal);
+        attempt += 1;
+      } catch (err) {
+        if (controller.signal.aborted)
+          return;
+        params.onError?.(err);
+        if (isTerminal(err))
+          throw err;
+        const retryAfterSeconds = err.retryAfterSeconds;
+        await sleep(reconnectDelay(attempt, baseDelayMs, retryAfterSeconds, opts.random), controller.signal);
+        attempt += 1;
       }
-      throw new ApiError(response.status, message, parsedBody, code);
     }
-    return response;
+  };
+  const done = run();
+  done.catch(() => {});
+  const unsubscribe = () => controller.abort();
+  return Object.assign(unsubscribe, { done });
+}
+async function readSse(opts) {
+  const res = await opts.fetchImpl(opts.url, {
+    headers: { ...opts.headers ?? {}, Accept: "text/event-stream" },
+    signal: opts.signal
+  });
+  if (!res.ok) {
+    if (opts.mapError)
+      await opts.mapError(res);
+    throw new StreamsServerError(`Streams SSE returned ${res.status}.`, res.status);
+  }
+  if (!res.body) {
+    throw new StreamsServerError("Streams SSE response has no body.", 0);
   }
+  for await (const frame of parseSseFrames(res.body, opts.signal, opts.staleAfterMs)) {
+    await opts.onFrame(frame);
+  }
+}
+function sleep(ms, signal) {
+  return new Promise((resolve) => {
+    if (signal.aborted)
+      return resolve();
+    const onAbort = () => {
+      clearTimeout(timer);
+      resolve();
+    };
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
+async function readWithStaleTimer(reader, staleAfterMs) {
+  if (staleAfterMs === undefined || !Number.isFinite(staleAfterMs)) {
+    return reader.read();
+  }
+  let timer;
+  const stale = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new StreamsServerError(`Streams SSE went quiet for ${staleAfterMs} ms; reconnecting.`, 0, undefined, "STREAM_STALE")), staleAfterMs);
+  });
+  try {
+    return await Promise.race([reader.read(), stale]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function* parseSseFrames(body, signal, staleAfterMs) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder;
+  let buffer = "";
+  try {
+    while (!signal.aborted) {
+      const { value, done } = await readWithStaleTimer(reader, staleAfterMs);
+      if (done)
+        break;
+      buffer += decoder.decode(value, { stream: true });
+      let sep = buffer.indexOf(`
+
+`);
+      while (sep !== -1) {
+        yield parseFrame(buffer.slice(0, sep));
+        buffer = buffer.slice(sep + 2);
+        sep = buffer.indexOf(`
+
+`);
+      }
+    }
+  } finally {
+    try {
+      await reader.cancel();
+    } catch {}
+  }
+}
+function parseFrame(raw) {
+  let event;
+  const data = [];
+  for (const line of raw.split(`
+`)) {
+    if (line.startsWith("data:")) {
+      data.push(line.slice(line.startsWith("data: ") ? 6 : 5));
+    } else if (line.startsWith("event:")) {
+      event = line.slice(line.startsWith("event: ") ? 7 : 6).trim();
+    }
+  }
+  return { event, data: data.length > 0 ? data.join(`
+`) : undefined };
 }
 
 // src/subgraphs/serialize.ts
@@ -283,21 +546,28 @@ var SYSTEM_COLUMN_MAP = {
   _blockHeight: "_block_height",
   _txId: "_tx_id",
   _createdAt: "_created_at",
-  _id: "_id",
+  _id: "_id"
+};
+var SYSTEM_COLUMN_ALIASES = {
   blockHeight: "_block_height",
   txId: "_tx_id",
   createdAt: "_created_at",
   id: "_id"
 };
-function resolveColumn(col) {
-  return SYSTEM_COLUMN_MAP[col] ?? col;
+function resolveColumn(col, columns) {
+  const canonical = SYSTEM_COLUMN_MAP[col];
+  if (canonical)
+    return canonical;
+  if (columns?.has(col))
+    return col;
+  return SYSTEM_COLUMN_ALIASES[col] ?? col;
 }
-function serializeWhere(where) {
+function serializeWhere(where, columns) {
   const filters = {};
   for (const [column, value] of Object.entries(where)) {
     if (value === null || value === undefined)
       continue;
-    const col = resolveColumn(column);
+    const col = resolveColumn(column, columns);
     if (typeof value === "object" && !Array.isArray(value)) {
       const ops = value;
       for (const [op, opValue] of Object.entries(ops)) {
@@ -318,11 +588,43 @@ function serializeWhere(where) {
   }
   return filters;
 }
-function resolveOrderByColumn(col) {
-  return resolveColumn(col);
+function resolveOrderByColumn(col, columns) {
+  return resolveColumn(col, columns);
 }
 
 // src/subgraphs/client.ts
+var SUBSCRIBE_RECONNECT_DELAY_MS = 1000;
+function declaredColumns(table) {
+  if (!table || typeof table !== "object")
+    return;
+  const columns = table.columns;
+  if (!columns || typeof columns !== "object")
+    return;
+  return new Set(Object.keys(columns));
+}
+function rowBlockHeight(row) {
+  const r = row;
+  const raw = r._block_height ?? r._blockHeight;
+  if (typeof raw !== "number" && typeof raw !== "string")
+    return;
+  const height = Number(raw);
+  return Number.isFinite(height) ? height : undefined;
+}
+function sleep2(ms, signal) {
+  return new Promise((resolve) => {
+    if (signal.aborted)
+      return resolve();
+    const onAbort = () => {
+      clearTimeout(timer);
+      resolve();
+    };
+    const timer = setTimeout(() => {
+      signal.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal.addEventListener("abort", onAbort, { once: true });
+  });
+}
 function buildSubgraphQueryString(params) {
   return buildQuery({
     _sort: params.sort,
@@ -352,25 +654,25 @@ class Subgraphs extends BaseClient {
     return this.request("GET", "/api/subgraphs");
   }
   async status(name) {
-    return this.request("GET", `/api/subgraphs/${name}`);
+    return this.request("GET", `/api/subgraphs/${seg(name)}`);
   }
   async openapi(name, options) {
-    return this.request("GET", `/api/subgraphs/${name}/openapi.json${buildSpecQueryString(options)}`);
+    return this.request("GET", `/api/subgraphs/${seg(name)}/openapi.json${buildSpecQueryString(options)}`);
   }
   async schema(name, options) {
-    return this.request("GET", `/api/subgraphs/${name}/schema.json${buildSpecQueryString(options)}`);
+    return this.request("GET", `/api/subgraphs/${seg(name)}/schema.json${buildSpecQueryString(options)}`);
   }
   async markdown(name, options) {
-    return this.requestText("GET", `/api/subgraphs/${name}/docs.md${buildSpecQueryString(options)}`);
+    return this.requestText("GET", `/api/subgraphs/${seg(name)}/docs.md${buildSpecQueryString(options)}`);
   }
   async reindex(name) {
-    return this.request("POST", `/api/subgraphs/${name}/reindex`);
+    return this.request("POST", `/api/subgraphs/${seg(name)}/reindex`);
   }
   async stop(name) {
-    return this.request("POST", `/api/subgraphs/${name}/stop`);
+    return this.request("POST", `/api/subgraphs/${seg(name)}/stop`);
   }
   async backfill(name, options) {
-    return this.request("POST", `/api/subgraphs/${name}/backfill`, options);
+    return this.request("POST", `/api/subgraphs/${seg(name)}/backfill`, options);
   }
   async gaps(name, opts) {
     const qs = buildQuery({
@@ -378,62 +680,62 @@ class Subgraphs extends BaseClient {
       _offset: opts?.offset,
       resolved: opts?.resolved
     });
-    return this.request("GET", `/api/subgraphs/${name}/gaps${qs}`);
+    return this.request("GET", `/api/subgraphs/${seg(name)}/gaps${qs}`);
   }
   async delete(name, options) {
     const qs = buildQuery({ force: options?.force ? true : undefined });
-    return this.request("DELETE", `/api/subgraphs/${name}${qs}`);
+    return this.request("DELETE", `/api/subgraphs/${seg(name)}${qs}`);
   }
   async rows(name, table, params = {}) {
     const { cursor, ...rest } = params;
     const qs = buildSubgraphQueryString(rest);
     const sep = qs ? "&" : "?";
     const cursorQs = cursor ? `${sep}cursor=${encodeURIComponent(cursor)}` : "";
-    return this.request("GET", `/v1/subgraphs/${name}/${table}${qs}${cursorQs}`);
+    return this.request("GET", `/v1/subgraphs/${seg(name)}/${seg(table)}${qs}${cursorQs}`);
   }
   async operations(name) {
-    return this.request("GET", `/api/subgraphs/${name}/operations`);
+    return this.request("GET", `/api/subgraphs/${seg(name)}/operations`);
   }
   async getOperation(name, operationId) {
-    return this.request("GET", `/api/subgraphs/${name}/operations/${operationId}`);
+    return this.request("GET", `/api/subgraphs/${seg(name)}/operations/${seg(operationId)}`);
   }
   async deploy(data) {
     return this.request("POST", "/api/subgraphs", data);
   }
   async getSource(name) {
-    return this.request("GET", `/api/subgraphs/${name}/source`);
+    return this.request("GET", `/api/subgraphs/${seg(name)}/source`);
   }
   async bundle(data) {
     return this.request("POST", "/api/subgraphs/bundle", data);
   }
   async queryTable(name, table, params = {}) {
-    const result = await this.request("GET", `/api/subgraphs/${name}/${table}${buildSubgraphQueryString(params)}`);
+    const result = await this.request("GET", `/api/subgraphs/${seg(name)}/${seg(table)}${buildSubgraphQueryString(params)}`);
     return Array.isArray(result) ? result : result.data;
   }
   async queryTableCount(name, table, params = {}) {
-    return this.request("GET", `/api/subgraphs/${name}/${table}/count${buildSubgraphQueryString(params)}`);
+    return this.request("GET", `/api/subgraphs/${seg(name)}/${seg(table)}/count${buildSubgraphQueryString(params)}`);
   }
   async queryTableAggregate(name, table, params = {}) {
-    return this.request("GET", `/api/subgraphs/${name}/${table}/aggregate${buildAggregateQueryString(params)}`);
+    return this.request("GET", `/api/subgraphs/${seg(name)}/${seg(table)}/aggregate${buildAggregateQueryString(params)}`);
   }
   typed(def) {
     const result = {};
-    for (const tableName of Object.keys(def.schema)) {
-      result[tableName] = this.createTableClient(def.name, tableName);
+    for (const [tableName, table] of Object.entries(def.schema)) {
+      result[tableName] = this.createTableClient(def.name, tableName, declaredColumns(table));
     }
     return result;
   }
-  createTableClient(subgraphName, tableName) {
+  createTableClient(subgraphName, tableName, columns) {
     const self = this;
     return {
       async findMany(options = {}) {
-        const filters = options.where ? serializeWhere(options.where) : undefined;
+        const filters = options.where ? serializeWhere(options.where, columns) : undefined;
         let sort;
         let order;
         if (options.orderBy) {
           const entries = Array.isArray(options.orderBy) ? options.orderBy : Object.entries(options.orderBy);
           if (entries.length > 0) {
-            sort = entries.map(([col]) => resolveOrderByColumn(col)).join(",");
+            sort = entries.map(([col]) => resolveOrderByColumn(col, columns)).join(",");
             order = entries.map(([, dir]) => dir ?? "asc").join(",");
           }
         }
@@ -448,14 +750,14 @@ class Subgraphs extends BaseClient {
         return self.queryTable(subgraphName, tableName, params);
       },
       async count(where) {
-        const filters = where ? serializeWhere(where) : undefined;
+        const filters = where ? serializeWhere(where, columns) : undefined;
         const result = await self.queryTableCount(subgraphName, tableName, {
           filters
         });
         return result.count;
       },
       async aggregate(spec) {
-        const filters = spec.where ? serializeWhere(spec.where) : undefined;
+        const filters = spec.where ? serializeWhere(spec.where, columns) : undefined;
         const result = await self.queryTableAggregate(subgraphName, tableName, {
           filters,
           count: spec.count,
@@ -467,27 +769,47 @@ class Subgraphs extends BaseClient {
         return result;
       },
       subscribe(onRow, options = {}) {
-        const filters = options.where ? serializeWhere(options.where) : {};
-        const qs = buildQuery({
-          ...filters,
-          since: options.since ?? undefined
-        });
-        const url = `${self.baseUrl}/api/subgraphs/${subgraphName}/${tableName}/stream${qs}`;
-        const ES = globalThis.EventSource;
-        if (!ES) {
-          throw new Error("subscribe() needs a global EventSource (available in browsers and Node >= 22).");
-        }
-        const es = new ES(url);
-        es.onmessage = (ev) => {
-          try {
-            onRow(JSON.parse(ev.data));
-          } catch {}
+        const filters = options.where ? serializeWhere(options.where, columns) : {};
+        const controller = new AbortController;
+        let since = options.since ?? undefined;
+        const run = async () => {
+          while (!controller.signal.aborted) {
+            try {
+              const qs = buildQuery({ ...filters, since });
+              await readSse({
+                url: `${self.baseUrl}/v1/subgraphs/${seg(subgraphName)}/${seg(tableName)}/stream${qs}`,
+                headers: {
+                  ...BaseClient.authHeaders(self.apiKey),
+                  "x-sl-origin": self.origin
+                },
+                signal: controller.signal,
+                fetchImpl: self.fetchImpl,
+                onFrame: (frame) => {
+                  if (frame.event === "ping" || !frame.data)
+                    return;
+                  let row;
+                  try {
+                    row = JSON.parse(frame.data);
+                  } catch {
+                    return;
+                  }
+                  const height = rowBlockHeight(row);
+                  if (height !== undefined)
+                    since = height;
+                  onRow(row);
+                }
+              });
+              await sleep2(SUBSCRIBE_RECONNECT_DELAY_MS, controller.signal);
+            } catch (err) {
+              if (controller.signal.aborted)
+                return;
+              options.onError?.(err);
+              await sleep2(SUBSCRIBE_RECONNECT_DELAY_MS, controller.signal);
+            }
+          }
         };
-        if (options.onError) {
-          const handler = options.onError;
-          es.onerror = (ev) => handler(ev);
-        }
-        return () => es.close();
+        run();
+        return () => controller.abort();
       }
     };
   }
@@ -512,37 +834,28 @@ class Contracts extends BaseClient {
   }
 }
 
-// src/streams/errors.ts
-class StreamsServerError extends ApiError {
-  constructor(message, status, body) {
-    super(status, message, body, undefined, { retryable: true });
-    this.name = "StreamsServerError";
-  }
-}
-
-class StreamsSignatureError extends SecondLayerError {
-  constructor(message = "Streams response signature verification failed.") {
-    super(message);
-    this.name = "StreamsSignatureError";
-  }
-}
-
 // src/streams/cursor.ts
-var REWIND_FOOT_INDEX_SENTINEL = 2147483647;
+import {
+  blockEndCursor,
+  decodeStreamsCursor,
+  encodeStreamsCursor
+} from "@secondlayer/shared";
 var Cursor = {
   atHeight(height) {
     if (height <= 0)
-      return "0:0";
-    return `${height - 1}:${REWIND_FOOT_INDEX_SENTINEL}`;
+      return null;
+    return encodeStreamsCursor(blockEndCursor(height - 1));
   },
   parse(cursor) {
-    const parts = cursor.split(":");
-    const blockHeight = Number(parts[0]);
-    const eventIndex = Number(parts[1]);
-    if (parts.length !== 2 || !Number.isInteger(blockHeight) || !Number.isInteger(eventIndex)) {
+    try {
+      const decoded = decodeStreamsCursor(cursor);
+      return {
+        blockHeight: decoded.block_height,
+        eventIndex: decoded.event_index
+      };
+    } catch {
       throw new ValidationError(`Invalid stream cursor "${cursor}"; expected "<block>:<index>" (e.g. "951475:3").`, 400);
     }
-    return { blockHeight, eventIndex };
   }
 };
 
@@ -550,6 +863,39 @@ var Cursor = {
 function reorgKey(reorg) {
   return `${reorg.detected_at}|${reorg.fork_point_height}|${reorg.new_canonical_tip}`;
 }
+var DEFAULT_MAX_ROLLBACK_DEPTH = 1000;
+async function applyReorgs(opts) {
+  const fresh = opts.reorgs.filter((reorg) => !opts.handled.has(opts.keyOf(reorg)));
+  if (fresh.length === 0)
+    return null;
+  for (const reorg of fresh) {
+    const fork = reorg.fork_point_height;
+    if (!Number.isSafeInteger(fork) || fork < 0) {
+      throw new ValidationError(`Reorg fork_point_height ${String(fork)} is not a non-negative integer. Rollback deletes every row at or above the fork from every declared table, so a malformed fork point is refused before the sink runs.`, 400);
+    }
+  }
+  const position = resumeHeight(opts.cursor);
+  const applicable = fresh.filter((reorg) => position !== null && reorg.fork_point_height <= position).sort((a, b) => a.fork_point_height - b.fork_point_height);
+  for (const reorg of fresh) {
+    if (!applicable.includes(reorg))
+      opts.handled.add(opts.keyOf(reorg));
+  }
+  if (applicable.length === 0 || position === null)
+    return null;
+  const forkPoint = applicable[0]?.fork_point_height ?? position;
+  const depth = position - forkPoint;
+  const maxDepth = opts.maxRollbackDepth ?? DEFAULT_MAX_ROLLBACK_DEPTH;
+  if (depth > maxDepth) {
+    throw new ValidationError(`Reorg at fork ${forkPoint} rewinds ${depth} blocks below the checkpoint at height ${position}, past maxRollbackDepth (${maxDepth}). A rollback this deep deletes every row at or above the fork from every declared table. Confirm the source is trusted, then pass maxRollbackDepth: ${depth} or higher to allow it.`, 400);
+  }
+  const rewind = Cursor.atHeight(forkPoint);
+  for (const reorg of applicable) {
+    await opts.sink?.rollback(reorg.fork_point_height, rewind);
+    await opts.onReorg?.(reorg, { cursor: rewind });
+    opts.handled.add(opts.keyOf(reorg));
+  }
+  return { forkPoint, cursor: rewind };
+}
 function assertFinalizedCheckpoint(returned, checkpoint) {
   if (returned === null || returned === undefined)
     return;
@@ -629,17 +975,19 @@ async function defaultSleep(ms, signal) {
   if (signal?.aborted)
     return;
   await new Promise((resolve) => {
-    const timeout = setTimeout(resolve, ms);
-    if (!signal)
-      return;
-    signal.addEventListener("abort", () => {
+    const onAbort = () => {
       clearTimeout(timeout);
       resolve();
-    }, { once: true });
+    };
+    const timeout = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
   });
 }
 async function consumeStreamsEvents(opts) {
-  const sleep = opts.sleep ?? defaultSleep;
+  const sleep3 = opts.sleep ?? defaultSleep;
   const mode = opts.mode ?? "tail";
   const finalizedOnly = opts.finalizedOnly ?? false;
   const emptyBackoffMs = opts.emptyBackoffMs ?? 500;
@@ -649,6 +997,7 @@ async function consumeStreamsEvents(opts) {
   const committedCursor = await opts.sink?.loadCursor() ?? null;
   let cursor = opts.fromCursor ?? committedCursor;
   const handledReorgs = new Set;
+  let reorgSince = null;
   let pages = 0;
   let emptyPolls = 0;
   let height = resumeHeight(cursor);
@@ -668,27 +1017,61 @@ async function consumeStreamsEvents(opts) {
       retryCount: opts.retryCount,
       retryDelay: opts.retryDelay,
       onError: opts.onError,
-      sleep,
+      sleep: sleep3,
       signal: opts.signal
     });
     pages++;
-    if (!finalizedOnly && (opts.onReorg || opts.sink)) {
-      const fresh = envelope.reorgs.filter((reorg) => !handledReorgs.has(reorgKey(reorg))).sort((a, b) => a.fork_point_height - b.fork_point_height);
-      if (fresh.length > 0) {
-        const forkPoint = Math.min(...fresh.map((reorg) => reorg.fork_point_height));
-        const rewind = Cursor.atHeight(forkPoint);
-        for (const reorg of fresh) {
-          await opts.sink?.rollback(reorg.fork_point_height, rewind);
-          await opts.onReorg?.(reorg, { cursor: rewind });
-          handledReorgs.add(reorgKey(reorg));
-        }
-        cursor = rewind;
-        height = forkPoint > 0 ? forkPoint - 1 : null;
+    const reorgsOn = !finalizedOnly && Boolean(opts.onReorg || opts.sink);
+    if (reorgsOn) {
+      const rewound = await applyReorgs({
+        reorgs: envelope.reorgs,
+        cursor,
+        handled: handledReorgs,
+        keyOf: reorgKey,
+        sink: opts.sink,
+        onReorg: opts.onReorg,
+        maxRollbackDepth: opts.maxRollbackDepth
+      });
+      if (rewound) {
+        cursor = rewound.cursor;
+        height = rewound.forkPoint > 0 ? rewound.forkPoint - 1 : null;
         scanned = height;
         emptyPolls = 0;
         continue;
       }
     }
+    if (reorgsOn && opts.fetchReorgs && envelope.events.length === 0) {
+      reorgSince ??= cursor;
+      if (reorgSince !== null) {
+        const since = reorgSince;
+        const fetchReorgs = opts.fetchReorgs;
+        const listed = await fetchPageWithRetry(() => fetchReorgs({ since }), {
+          retryCount: opts.retryCount,
+          retryDelay: opts.retryDelay,
+          onError: opts.onError,
+          sleep: sleep3,
+          signal: opts.signal
+        });
+        if (listed.next_since !== null)
+          reorgSince = listed.next_since;
+        const rewound = await applyReorgs({
+          reorgs: listed.reorgs,
+          cursor,
+          handled: handledReorgs,
+          keyOf: reorgKey,
+          sink: opts.sink,
+          onReorg: opts.onReorg,
+          maxRollbackDepth: opts.maxRollbackDepth
+        });
+        if (rewound) {
+          cursor = rewound.cursor;
+          height = rewound.forkPoint > 0 ? rewound.forkPoint - 1 : null;
+          scanned = height;
+          emptyPolls = 0;
+          continue;
+        }
+      }
+    }
     const emitted = finalizedOnly ? envelope.events.filter((event) => event.finalized) : envelope.events;
     const checkpoint = finalizedOnly ? emitted.at(-1)?.cursor ?? cursor : envelope.next_cursor;
     height = emitted.at(-1)?.block_height ?? height;
@@ -729,7 +1112,7 @@ async function consumeStreamsEvents(opts) {
       if (mode === "bounded") {
         return { cursor, pages, emptyPolls };
       }
-      await sleep(emptyBackoffMs, opts.signal);
+      await sleep3(emptyBackoffMs, opts.signal);
       continue;
     }
     return { cursor, pages, emptyPolls };
@@ -737,7 +1120,7 @@ async function consumeStreamsEvents(opts) {
   return { cursor, pages, emptyPolls };
 }
 async function* iterateStreamsBatches(opts) {
-  const sleep = opts.sleep ?? defaultSleep;
+  const sleep3 = opts.sleep ?? defaultSleep;
   let cursor = opts.fromCursor ?? null;
   while (!opts.signal?.aborted) {
     const envelope = await opts.fetchEvents({
@@ -765,12 +1148,12 @@ async function* iterateStreamsBatches(opts) {
     if (!advanced && envelope.events.length === 0) {
       if (opts.signal?.aborted)
         return;
-      await sleep(opts.intervalMs, opts.signal);
+      await sleep3(opts.intervalMs, opts.signal);
     }
   }
 }
 async function* streamStreamsEvents(opts) {
-  const sleep = opts.sleep ?? defaultSleep;
+  const sleep3 = opts.sleep ?? defaultSleep;
   const emptyBackoffMs = opts.emptyBackoffMs ?? 500;
   const maxPages = opts.maxPages ?? Number.POSITIVE_INFINITY;
   const maxEmptyPolls = opts.maxEmptyPolls ?? Number.POSITIVE_INFINITY;
@@ -805,7 +1188,7 @@ async function* streamStreamsEvents(opts) {
       emptyPolls++;
       if (emptyPolls >= maxEmptyPolls || pages >= maxPages)
         return;
-      await sleep(emptyBackoffMs, opts.signal);
+      await sleep3(emptyBackoffMs, opts.signal);
       continue;
     }
     return;
@@ -814,7 +1197,7 @@ async function* streamStreamsEvents(opts) {
 
 // src/index-api/consumer.ts
 async function consumeIndexFeed(opts) {
-  const sleep = opts.sleep ?? defaultSleep;
+  const sleep3 = opts.sleep ?? defaultSleep;
   const mode = opts.mode ?? "tail";
   const finalizedOnly = opts.finalizedOnly ?? false;
   const batchSize = opts.batchSize ?? 200;
@@ -838,22 +1221,23 @@ async function consumeIndexFeed(opts) {
       retryCount: opts.retryCount,
       retryDelay: opts.retryDelay,
       onError: opts.onError,
-      sleep,
+      sleep: sleep3,
       signal: opts.signal
     });
     pages++;
     if (!finalizedOnly && (opts.onReorg || opts.sink)) {
-      const fresh = envelope.reorgs.filter((reorg) => !handledReorgs.has(reorg.id)).sort((a, b) => a.fork_point_height - b.fork_point_height);
-      if (fresh.length > 0) {
-        const forkPoint = Math.min(...fresh.map((reorg) => reorg.fork_point_height));
-        const rewind = Cursor.atHeight(forkPoint);
-        for (const reorg of fresh) {
-          await opts.sink?.rollback(reorg.fork_point_height, rewind);
-          await opts.onReorg?.(reorg, { cursor: rewind });
-          handledReorgs.add(reorg.id);
-        }
-        cursor = rewind;
-        height = forkPoint > 0 ? forkPoint - 1 : null;
+      const rewound = await applyReorgs({
+        reorgs: envelope.reorgs,
+        cursor,
+        handled: handledReorgs,
+        keyOf: (reorg) => reorg.id,
+        sink: opts.sink,
+        onReorg: opts.onReorg,
+        maxRollbackDepth: opts.maxRollbackDepth
+      });
+      if (rewound) {
+        cursor = rewound.cursor;
+        height = rewound.forkPoint > 0 ? rewound.forkPoint - 1 : null;
         scanned = height;
         emptyPolls = 0;
         continue;
@@ -900,7 +1284,7 @@ async function consumeIndexFeed(opts) {
       if (mode === "bounded") {
         return { cursor, pages, emptyPolls };
       }
-      await sleep(emptyBackoffMs, opts.signal);
+      await sleep3(emptyBackoffMs, opts.signal);
       continue;
     }
     return { cursor, pages, emptyPolls };
@@ -909,6 +1293,7 @@ async function consumeIndexFeed(opts) {
 }
 
 // src/index-api/client.ts
+var INDEX_MAX_PAGE_SIZE = 1000;
 function feedFilters(params) {
   const { fromCursor: _checkpoint, ...filters } = params;
   return filters;
@@ -958,7 +1343,8 @@ class Index extends BaseClient {
         ...feedFilters(params),
         cursor,
         fromHeight,
-        limit
+        limit,
+        signal: params.signal
       }),
       itemsOf: (envelope) => envelope.events
     })
@@ -972,7 +1358,8 @@ class Index extends BaseClient {
         ...feedFilters(params),
         cursor,
         fromHeight,
-        limit
+        limit,
+        signal: params.signal
       }),
       itemsOf: (envelope) => envelope.contract_calls
     })
@@ -1011,7 +1398,8 @@ class Index extends BaseClient {
           ...feedFilters(params),
           cursor,
           fromHeight,
-          limit
+          limit,
+          signal: params.signal
         }),
         itemsOf: (envelope) => envelope.deposits
       }),
@@ -1031,7 +1419,8 @@ class Index extends BaseClient {
           ...feedFilters(params),
           cursor,
           fromHeight,
-          limit
+          limit,
+          signal: params.signal
         }),
         itemsOf: (envelope) => envelope.events
       })
@@ -1058,7 +1447,7 @@ class Index extends BaseClient {
       asset_identifier: params.assetIdentifier,
       sender: params.sender,
       recipient: params.recipient
-    })}`);
+    })}`, undefined, { signal: params.signal });
   }
   async listNftTransfers(params = {}) {
     return this.request("GET", `/v1/index/nft-transfers${buildQuery({
@@ -1067,29 +1456,45 @@ class Index extends BaseClient {
       asset_identifier: params.assetIdentifier,
       sender: params.sender,
       recipient: params.recipient
-    })}`);
+    })}`, undefined, { signal: params.signal });
   }
   async* keysetWalk(params, list, itemsOf) {
     const batchSize = params.batchSize ?? 200;
+    if (!Number.isInteger(batchSize) || batchSize < 1 || batchSize > INDEX_MAX_PAGE_SIZE) {
+      throw new ValidationError(`walk batchSize must be an integer from 1 to ${INDEX_MAX_PAGE_SIZE} (the largest page the Index serves); got ${batchSize}.`, 400);
+    }
     let cursor = params.cursor ?? params.fromCursor ?? null;
     let firstPage = true;
-    while (!params.signal?.aborted) {
-      const envelope = await list({
+    const throwIfAborted = () => {
+      if (params.signal?.aborted)
+        throw params.signal.reason ?? abortError();
+    };
+    for (;; ) {
+      throwIfAborted();
+      const page = {
         limit: batchSize,
         cursor: firstPage ? params.cursor : cursor,
         fromCursor: firstPage ? params.fromCursor : undefined,
-        fromHeight: firstPage ? firstWalkFromHeight(params) : undefined
+        fromHeight: firstPage ? firstWalkFromHeight(params) : undefined,
+        signal: params.signal
+      };
+      const envelope = await fetchPageWithRetry(() => list(page), {
+        retryCount: params.retryCount,
+        retryDelay: params.retryDelay,
+        onError: params.onError,
+        sleep: defaultSleep,
+        signal: params.signal
       });
       const items = itemsOf(envelope);
       for (const item of items) {
-        if (params.signal?.aborted)
-          return;
+        throwIfAborted();
         yield item;
       }
       const nextCursor = envelope.next_cursor;
-      if (!nextCursor || nextCursor === cursor || items.length < batchSize) {
+      if (nextCursor === null || nextCursor === undefined)
+        return;
+      if (nextCursor === cursor)
         return;
-      }
       cursor = nextCursor;
       firstPage = false;
     }
@@ -1110,7 +1515,7 @@ class Index extends BaseClient {
       recipient: params.recipient,
       trait: params.trait,
       tx_context: params.txContext ? "true" : undefined
-    })}`);
+    })}`, undefined, { signal: params.signal });
   }
   walkEvents(params) {
     return this.keysetWalk(params, (page) => this.listEvents({ ...params, ...page }), (e) => e.events);
@@ -1122,19 +1527,19 @@ class Index extends BaseClient {
       function_name: params.functionName,
       sender: params.sender,
       trait: params.trait
-    })}`);
+    })}`, undefined, { signal: params.signal });
   }
   walkContractCalls(params = {}) {
     return this.keysetWalk(params, (page) => this.listContractCalls({ ...params, ...page }), (e) => e.contract_calls);
   }
   async listCanonical(params = {}) {
-    return this.request("GET", `/v1/index/canonical${buildQuery(indexPageQuery(params))}`);
+    return this.request("GET", `/v1/index/canonical${buildQuery(indexPageQuery(params))}`, undefined, { signal: params.signal });
   }
   walkCanonical(params = {}) {
     return this.keysetWalk(params, (page) => this.listCanonical({ ...params, ...page }), (e) => e.canonical);
   }
   async listBlocks(params = {}) {
-    return this.request("GET", `/v1/index/blocks${buildQuery(indexPageQuery(params))}`);
+    return this.request("GET", `/v1/index/blocks${buildQuery(indexPageQuery(params))}`, undefined, { signal: params.signal });
   }
   async getBlock(ref) {
     return this.requestOrNull("GET", `/v1/index/blocks/${encodeURIComponent(String(ref))}`);
@@ -1148,7 +1553,7 @@ class Index extends BaseClient {
       type: params.type,
       sender: params.sender,
       contract_id: params.contractId
-    })}`);
+    })}`, undefined, { signal: params.signal });
   }
   async getTransaction(txId) {
     return this.requestOrNull("GET", `/v1/index/transactions/${encodeURIComponent(txId)}`);
@@ -1165,7 +1570,7 @@ class Index extends BaseClient {
       function_name: params.functionName,
       stacker: params.stacker,
       caller: params.caller
-    })}`);
+    })}`, undefined, { signal: params.signal });
   }
   walkStacking(params = {}) {
     return this.keysetWalk(params, (page) => this.listStacking({ ...params, ...page }), (e) => e.stacking);
@@ -1177,7 +1582,7 @@ class Index extends BaseClient {
       type: params.type,
       contract_id: params.contractId,
       function_name: params.functionName
-    })}`);
+    })}`, undefined, { signal: params.signal });
   }
   async getMempoolTx(txId) {
     return this.requestOrNull("GET", `/v1/index/mempool/${encodeURIComponent(txId)}`);
@@ -1191,7 +1596,7 @@ class Index extends BaseClient {
       confirmed: params.confirmed,
       sender: params.sender,
       bitcoin_txid: params.bitcoinTxid
-    })}`);
+    })}`, undefined, { signal: params.signal });
   }
   walkSbtcDeposits(params = {}) {
     return this.keysetWalk(params, (page) => this.listSbtcDeposits({ ...params, ...page }), (e) => e.deposits);
@@ -1207,7 +1612,7 @@ class Index extends BaseClient {
       sender: params.sender,
       request_id: params.requestId,
       settlement_confirmed: params.settlementConfirmed
-    })}`);
+    })}`, undefined, { signal: params.signal });
   }
   walkSbtcWithdrawals(params = {}) {
     return this.keysetWalk(params, (page) => this.listSbtcWithdrawals({ ...params, ...page }), (e) => e.withdrawals);
@@ -1223,7 +1628,7 @@ class Index extends BaseClient {
       sender: params.sender,
       request_id: params.requestId,
       bitcoin_txid: params.bitcoinTxid
-    })}`);
+    })}`, undefined, { signal: params.signal });
   }
   walkSbtcEvents(params = {}) {
     return this.keysetWalk(params, (page) => this.listSbtcEvents({ ...params, ...page }), (e) => e.events);
@@ -1241,7 +1646,7 @@ class Index extends BaseClient {
       signer_manager: params.signerManager,
       bond_index: params.bondIndex,
       reward_cycle: params.rewardCycle
-    })}`);
+    })}`, undefined, { signal: params.signal });
   }
   walkPox5Events(params = {}) {
     return this.keysetWalk(params, (page) => this.listPox5Events({ ...params, ...page }), (e) => e.events);
@@ -1250,24 +1655,14 @@ class Index extends BaseClient {
     return this.request("GET", `/v1/index/pox/cycles${buildQuery({
       cursor: params.cursor,
       limit: params.limit
-    })}`);
+    })}`, undefined, { signal: params.signal });
   }
-  async* walkPoxCycles(params = {}) {
-    const batchSize = params.batchSize ?? 100;
-    let cursor = params.cursor ?? null;
-    while (!params.signal?.aborted) {
-      const envelope = await this.listPoxCycles({ cursor, limit: batchSize });
-      for (const cycle of envelope.cycles) {
-        if (params.signal?.aborted)
-          return;
-        yield cycle;
-      }
-      const nextCursor = envelope.next_cursor;
-      if (nextCursor === null || nextCursor === cursor || envelope.cycles.length < batchSize) {
-        return;
-      }
-      cursor = nextCursor;
-    }
+  walkPoxCycles(params = {}) {
+    return this.keysetWalk(params, (page) => this.listPoxCycles({
+      cursor: page.cursor,
+      limit: page.limit,
+      signal: page.signal
+    }), (e) => e.cycles);
   }
   async getPoxCycle(rewardCycle) {
     return this.requestOrNull("GET", `/v1/index/pox/cycles/${rewardCycle}`);
@@ -1431,166 +1826,57 @@ function createStreamsDumps(opts) {
     return manifest;
   }
   async function download(file) {
+    return fetchPageWithRetry(() => downloadOnce(file), {
+      sleep: defaultSleep
+    });
+  }
+  async function downloadOnce(file) {
     const res = await opts.fetchImpl(fileUrl(file));
     if (!res.ok) {
       throw new StreamsServerError(`Could not download dump ${file.path} (${res.status}).`, res.status);
     }
-    const bytes = new Uint8Array(await res.arrayBuffer());
-    const digest = createHash("sha256").update(bytes).digest("hex");
-    if (digest !== file.sha256) {
-      throw new StreamsSignatureError(`Dump ${file.path} sha256 mismatch (expected ${file.sha256}, got ${digest}).`);
+    if (!res.body) {
+      throw new StreamsServerError(`Dump ${file.path} response has no body.`, 0);
     }
-    return bytes;
-  }
-  return { list, fileUrl, download };
-}
-
-// src/streams/subscribe.ts
-import { ed25519 } from "@secondlayer/shared";
-function subscribeStreamsEvents(opts) {
-  const { params } = opts;
-  const controller = new AbortController;
-  const external = params.signal;
-  if (external) {
-    if (external.aborted)
-      controller.abort();
-    else
-      external.addEventListener("abort", () => controller.abort(), {
-        once: true
-      });
-  }
-  let cursor = params.fromCursor ?? null;
-  const reconnectDelayMs = opts.reconnectDelayMs ?? 1000;
-  const run = async () => {
-    while (!controller.signal.aborted) {
-      try {
-        const url = `${opts.baseUrl}/v1/streams/events/stream${buildQuery({
-          from_cursor: cursor ?? undefined,
-          types: params.types,
-          not_types: params.notTypes,
-          contract_id: params.contractId,
-          sender: params.sender,
-          recipient: params.recipient,
-          asset_identifier: params.assetIdentifier,
-          filters: params.filters ? JSON.stringify(params.filters) : undefined
-        })}`;
-        const res = await opts.fetchImpl(url, {
-          headers: {
-            ...opts.apiKey ? { Authorization: `Bearer ${opts.apiKey}` } : {},
-            Accept: "text/event-stream"
-          },
-          signal: controller.signal
-        });
-        if (!res.ok) {
-          throw new StreamsServerError(`Streams SSE returned ${res.status}.`, res.status);
-        }
-        if (!res.body) {
-          throw new StreamsServerError("Streams SSE response has no body.", 0);
-        }
-        for await (const frame of parseSseFrames(res.body, controller.signal)) {
-          if (frame.event === "ping" || !frame.data)
-            continue;
-          let parsed;
-          try {
-            parsed = JSON.parse(frame.data);
-          } catch {
-            continue;
-          }
-          if (!parsed.event)
-            continue;
-          if (opts.verify !== "off") {
-            if (!parsed.sig) {
-              if (opts.verify === "strict") {
-                throw new StreamsSignatureError("Streams SSE frame signature is missing.");
-              }
-            } else {
-              const key = await opts.loadKey();
-              if (!ed25519.verifyEd25519(JSON.stringify(parsed.event), parsed.sig, key.publicKey)) {
-                throw new StreamsSignatureError("Streams SSE frame signature is invalid.");
-              }
-            }
-          }
-          cursor = parsed.event.cursor ?? cursor;
-          await params.onEvent(parsed.event);
-        }
-      } catch (err) {
-        if (controller.signal.aborted)
-          return;
-        params.onError?.(err);
-        await sleep(reconnectDelayMs, controller.signal);
+    const hash = createHash("sha256");
+    const chunks = [];
+    let total = 0;
+    const reader = res.body.getReader();
+    try {
+      while (true) {
+        const { value, done } = await reader.read();
+        if (done)
+          break;
+        hash.update(value);
+        chunks.push(value);
+        total += value.byteLength;
       }
+    } catch {
+      throw new StreamsServerError(`Download of dump ${file.path} was interrupted after ${total} bytes.`, 0);
     }
-  };
-  run();
-  return () => controller.abort();
-}
-function sleep(ms, signal) {
-  return new Promise((resolve) => {
-    if (signal.aborted)
-      return resolve();
-    const onAbort = () => {
-      clearTimeout(timer);
-      resolve();
-    };
-    const timer = setTimeout(() => {
-      signal.removeEventListener("abort", onAbort);
-      resolve();
-    }, ms);
-    signal.addEventListener("abort", onAbort, { once: true });
-  });
-}
-async function* parseSseFrames(body, signal) {
-  const reader = body.getReader();
-  const decoder = new TextDecoder;
-  let buffer = "";
-  try {
-    while (!signal.aborted) {
-      const { value, done } = await reader.read();
-      if (done)
-        break;
-      buffer += decoder.decode(value, { stream: true });
-      let sep = buffer.indexOf(`
-
-`);
-      while (sep !== -1) {
-        yield parseFrame(buffer.slice(0, sep));
-        buffer = buffer.slice(sep + 2);
-        sep = buffer.indexOf(`
-
-`);
-      }
+    const digest = hash.digest("hex");
+    if (digest !== file.sha256) {
+      throw new StreamsSignatureError(`Dump ${file.path} sha256 mismatch (expected ${file.sha256}, got ${digest}).`);
     }
-  } finally {
-    try {
-      await reader.cancel();
-    } catch {}
-  }
-}
-function parseFrame(raw) {
-  let event;
-  const data = [];
-  for (const line of raw.split(`
-`)) {
-    if (line.startsWith("data:")) {
-      data.push(line.slice(line.startsWith("data: ") ? 6 : 5));
-    } else if (line.startsWith("event:")) {
-      event = line.slice(line.startsWith("event: ") ? 7 : 6).trim();
+    if (chunks.length === 1 && chunks[0])
+      return chunks[0];
+    const bytes = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.byteLength;
     }
+    return bytes;
   }
-  return { event, data: data.length > 0 ? data.join(`
-`) : undefined };
+  return { list, fileUrl, download };
 }
 
 // src/streams/client.ts
 function cursorTuple(cursor) {
   if (!cursor)
     return [-1, -1];
-  const parts = cursor.split(":");
-  const [block, index] = parts.map(Number);
-  if (parts.length !== 2 || !Number.isInteger(block) || !Number.isInteger(index)) {
-    throw new ValidationError(`Invalid stream cursor "${cursor}"; expected "<block>:<index>" (e.g. "951475:3").`, 400);
-  }
-  return [block, index];
+  const { blockHeight, eventIndex } = Cursor.parse(cursor);
+  return [blockHeight, eventIndex];
 }
 function maxCursor(a, b) {
   const [ah, ai] = cursorTuple(a);
@@ -1611,51 +1897,33 @@ function streamsFilters(params) {
 function normalizeBaseUrl(baseUrl) {
   return baseUrl.replace(/\/+$/, "");
 }
-async function responseBody(response) {
-  const text = await response.text();
-  if (text.length === 0)
-    return;
+function isLoopbackUrl(baseUrl) {
   try {
-    return JSON.parse(text);
+    const { hostname } = new URL(baseUrl);
+    return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]" || hostname.startsWith("127.");
   } catch {
-    return text;
-  }
-}
-function errorMessage(body, fallback) {
-  if (body && typeof body === "object") {
-    const record = body;
-    const message = record.error ?? record.message;
-    if (typeof message === "string" && message.length > 0)
-      return message;
-  }
-  if (typeof body === "string" && body.length > 0)
-    return body;
-  return fallback;
-}
-async function mapStreamsError(response) {
-  const body = await responseBody(response);
-  if (response.status === 401) {
-    throw new AuthError(errorMessage(body, "API key invalid or expired."));
-  }
-  if (response.status === 429) {
-    const retryAfter = response.headers.get("Retry-After") ?? undefined;
-    throw new RateLimitError(errorMessage(body, "Rate limited. Try again later."), retryAfter);
-  }
-  if (response.status >= 500) {
-    throw new StreamsServerError(errorMessage(body, `Streams server returned ${response.status}.`), response.status, body);
+    return false;
   }
-  throw new ValidationError(errorMessage(body, `Streams request returned ${response.status}.`), response.status, body);
 }
 function createStreamsClient(options) {
   const baseUrl = normalizeBaseUrl(resolveBaseUrl(options.baseUrl));
+  const apiKey = resolveApiKey(options.apiKey);
+  const origin = options.origin ?? "cli";
+  const authHeaders = () => ({
+    "x-sl-origin": origin,
+    ...apiKey ? { Authorization: `Bearer ${apiKey}` } : {}
+  });
   const fetchImpl = options.fetchImpl ?? ((input, init) => fetch(input, init));
   const verify = options.verify;
   const verifyMode = verify === false ? "off" : verify === undefined ? "lenient" : "strict";
+  if (verify === true && baseUrl.startsWith("http:") && !isLoopbackUrl(baseUrl)) {
+    throw new ValidationError(`verify: true over plain http to ${baseUrl} fetches the signing key from the same unprotected path it verifies. Pin the key with verify: { publicKey } (see GET /public/streams/signing-key), or use https.`, 400);
+  }
   let keyPromise = null;
   function loadKey() {
     if (keyPromise)
       return keyPromise;
-    keyPromise = (async () => {
+    const pending = (async () => {
       if (typeof verify === "object") {
         return {
           keyId: ed255192.ed25519KeyId(verify.publicKey),
@@ -1663,8 +1931,16 @@ function createStreamsClient(options) {
           publicKey: ed255192.loadEd25519PublicKey(verify.publicKey)
         };
       }
-      const res = await fetchImpl(`${baseUrl}/public/streams/signing-key`);
+      let res;
+      try {
+        res = await fetchImpl(`${baseUrl}/public/streams/signing-key`);
+      } catch {
+        throw new StreamsServerError(`Could not reach the signing key at ${baseUrl}/public/streams/signing-key. Retryable.`, 0, undefined, "SIGNING_KEY_UNAVAILABLE");
+      }
       if (!res.ok) {
+        if (res.status >= 500 || res.status === 429) {
+          throw new StreamsServerError(`Could not fetch signing key (${res.status}). Retryable.`, res.status, undefined, "SIGNING_KEY_UNAVAILABLE");
+        }
         throw new StreamsSignatureError(`Could not fetch signing key (${res.status}).`);
       }
       const body = await res.json();
@@ -1677,7 +1953,26 @@ function createStreamsClient(options) {
         publicKey: ed255192.loadEd25519PublicKey(body.public_key_pem)
       };
     })();
-    return keyPromise;
+    keyPromise = pending;
+    pending.catch(() => {
+      if (keyPromise === pending)
+        keyPromise = null;
+    });
+    return pending;
+  }
+  async function loadKeyFor(responseKeyId) {
+    let key = await loadKey();
+    if (!responseKeyId || responseKeyId === key.keyId)
+      return key;
+    if (typeof verify === "object") {
+      throw new StreamsSignatureError(`Response signed with key '${responseKeyId}', expected pinned key '${key.keyId}'.`);
+    }
+    keyPromise = null;
+    key = await loadKey();
+    if (responseKeyId !== key.keyId) {
+      throw new StreamsSignatureError(`Response signed with key '${responseKeyId}' not served by the signing-key endpoint.`);
+    }
+    return key;
   }
   const dumps = createStreamsDumps({
     baseUrl: options.dumpsBaseUrl,
@@ -1687,7 +1982,7 @@ function createStreamsClient(options) {
   });
   async function request(path) {
     const response = await fetchImpl(`${baseUrl}${path}`, {
-      headers: options.apiKey ? { Authorization: `Bearer ${options.apiKey}` } : {}
+      headers: authHeaders()
     });
     if (!response.ok)
       await mapStreamsError(response);
@@ -1699,18 +1994,7 @@ function createStreamsClient(options) {
           throw new StreamsSignatureError("Response is missing X-Signature.");
         }
       } else {
-        const responseKeyId = response.headers.get("X-Signature-KeyId");
-        let key = await loadKey();
-        if (responseKeyId && responseKeyId !== key.keyId) {
-          if (typeof verify === "object") {
-            throw new StreamsSignatureError(`Response signed with key '${responseKeyId}', expected pinned key '${key.keyId}'.`);
-          }
-          keyPromise = null;
-          key = await loadKey();
-          if (responseKeyId !== key.keyId) {
-            throw new StreamsSignatureError(`Response signed with key '${responseKeyId}' not served by the signing-key endpoint.`);
-          }
-        }
+        const key = await loadKeyFor(response.headers.get("X-Signature-KeyId"));
         if (!ed255192.verifyEd25519(text, signature, key.publicKey)) {
           throw new StreamsSignatureError;
         }
@@ -1719,6 +2003,13 @@ function createStreamsClient(options) {
     return JSON.parse(text);
   }
   const fetchEvents = listEvents;
+  function listReorgs(params) {
+    return request(`/v1/streams/reorgs${buildQuery({
+      since: params.since,
+      limit: params.limit
+    })}`);
+  }
+  const fetchReorgs = (params) => listReorgs(params);
   function encodeFilters(filters) {
     return filters ? JSON.stringify(filters) : undefined;
   }
@@ -1766,8 +2057,10 @@ function createStreamsClient(options) {
       ...streamsFilters(params),
       batchSize: params.batchSize ?? 100,
       fetchEvents,
+      fetchReorgs,
       onBatch,
       onReorg: params.onReorg,
+      maxRollbackDepth: params.maxRollbackDepth,
       emptyBackoffMs: params.emptyBackoffMs,
       maxPages: params.maxPages,
       maxEmptyPolls: params.maxEmptyPolls,
@@ -1809,10 +2102,12 @@ function createStreamsClient(options) {
       subscribe(params) {
         return subscribeStreamsEvents({
           baseUrl,
-          apiKey: options.apiKey,
+          headers: authHeaders(),
           fetchImpl,
           verify: verifyMode,
-          loadKey,
+          loadKey: loadKeyFor,
+          reconnectDelayMs: params.reconnectDelayMs,
+          staleAfterMs: params.staleAfterMs,
           params
         });
       },
@@ -1820,11 +2115,11 @@ function createStreamsClient(options) {
         const fromCursor = params.from === "genesis" ? null : params.from ?? null;
         const fromBlock = fromCursor ? cursorTuple(fromCursor)[0] : 0;
         const manifest = await dumps.list();
-        const files = manifest.files.filter((file) => file.to_block >= fromBlock).sort((a, b) => a.from_block - b.from_block || a.to_block - b.to_block);
+        const files = manifest.files.filter((file) => file.to_block >= fromBlock).filter((file) => fromCursor === null || file.max_cursor === null || maxCursor(fromCursor, file.max_cursor) !== fromCursor).sort((a, b) => a.from_block - b.from_block || a.to_block - b.to_block);
         for (const file of files) {
           if (params.signal?.aborted)
             break;
-          await params.onDumpFile(file);
+          await params.onDumpFile(file, { from: fromCursor });
         }
         const seam = maxCursor(fromCursor, manifest.latest_finalized_cursor);
         return consumeStreamsEvents({
@@ -1849,14 +2144,7 @@ function createStreamsClient(options) {
         return request(`/v1/streams/blocks/${encodeURIComponent(String(heightOrHash))}/events`);
       }
     },
-    reorgs: {
-      list(params) {
-        return request(`/v1/streams/reorgs${buildQuery({
-          since: params.since,
-          limit: params.limit
-        })}`);
-      }
-    },
+    reorgs: { list: listReorgs },
     dumps,
     canonical(height) {
       return request(`/v1/streams/canonical/${height}`);
@@ -1875,44 +2163,69 @@ class Subscriptions extends BaseClient {
     return this.request("GET", "/api/subscriptions");
   }
   async get(id) {
-    return this.request("GET", `/api/subscriptions/${id}`);
+    return this.request("GET", `/api/subscriptions/${seg(id)}`);
   }
   async create(input) {
     return this.request("POST", "/api/subscriptions", input);
   }
   async update(id, patch) {
-    return this.request("PATCH", `/api/subscriptions/${id}`, patch);
+    return this.request("PATCH", `/api/subscriptions/${seg(id)}`, patch);
   }
   async pause(id) {
-    return this.request("POST", `/api/subscriptions/${id}/pause`);
+    return this.request("POST", `/api/subscriptions/${seg(id)}/pause`);
   }
   async resume(id) {
-    return this.request("POST", `/api/subscriptions/${id}/resume`);
+    return this.request("POST", `/api/subscriptions/${seg(id)}/resume`);
   }
   async delete(id) {
-    return this.request("DELETE", `/api/subscriptions/${id}`);
+    return this.request("DELETE", `/api/subscriptions/${seg(id)}`);
   }
   async rotateSecret(id) {
-    return this.request("POST", `/api/subscriptions/${id}/rotate-secret`);
+    return this.request("POST", `/api/subscriptions/${seg(id)}/rotate-secret`);
   }
   async test(id) {
-    return this.request("POST", `/api/subscriptions/${id}/test`);
+    return this.request("POST", `/api/subscriptions/${seg(id)}/test`);
   }
   async deliveries(id) {
-    return this.request("GET", `/api/subscriptions/${id}/deliveries`);
+    return this.request("GET", `/api/subscriptions/${seg(id)}/deliveries`);
   }
   async replay(id, range) {
-    return this.request("POST", `/api/subscriptions/${id}/replay`, range);
+    return this.request("POST", `/api/subscriptions/${seg(id)}/replay`, range);
   }
   async dead(id) {
-    return this.request("GET", `/api/subscriptions/${id}/dead`);
+    return this.request("GET", `/api/subscriptions/${seg(id)}/dead`);
   }
   async requeue(id, outboxId) {
-    return this.request("POST", `/api/subscriptions/${id}/dead/${outboxId}/requeue`);
+    return this.request("POST", `/api/subscriptions/${seg(id)}/dead/${seg(outboxId)}/requeue`);
   }
 }
 
 // src/client.ts
+async function contextField(read) {
+  try {
+    return { value: await read };
+  } catch (err) {
+    return { value: null, error: describeContextError(err) };
+  }
+}
+function describeContextError(err) {
+  if (err instanceof SecondLayerError) {
+    return {
+      message: err.shortMessage,
+      ...err.code !== undefined ? { code: err.code } : {},
+      ...err instanceof ApiError ? { status: err.status } : {},
+      retryable: err.retryable
+    };
+  }
+  if (err instanceof TypeError) {
+    return { message: err.message, status: 0, retryable: true };
+  }
+  return {
+    message: err instanceof Error ? err.message : String(err),
+    retryable: false
+  };
+}
+
 class SecondLayer extends BaseClient {
   streams;
   index;
@@ -1922,10 +2235,13 @@ class SecondLayer extends BaseClient {
   constructor(options = {}) {
     super(options);
     this.streams = createStreamsClient({
-      apiKey: resolveApiKey(options.apiKey),
+      apiKey: this.apiKey,
+      origin: this.origin,
       baseUrl: options.baseUrl,
       fetchImpl: options.fetchImpl,
-      dumpsBaseUrl: options.dumpsBaseUrl
+      dumpsBaseUrl: options.dumpsBaseUrl,
+      verify: options.verify,
+      verifyDumpsManifest: options.verifyDumpsManifest
     });
     this.index = new Index(options);
     this.contracts = new Contracts(options);
@@ -1936,28 +2252,42 @@ class SecondLayer extends BaseClient {
     return this.request("POST", "/v1/batch", { requests });
   }
   async context() {
-    const safe = (p) => p.then((v) => v).catch(() => null);
     const [account, streamsTip, indexEnv, subgraphsRes, subscriptionsRes] = await Promise.all([
-      safe(this.request("GET", "/api/accounts/me")),
-      safe(this.streams.tip()),
-      safe(this.index.canonical.list({ limit: 1 })),
-      safe(this.subgraphs.list()),
-      safe(this.subscriptions.list())
+      contextField(this.request("GET", "/api/accounts/me")),
+      contextField(this.streams.tip()),
+      contextField(this.index.canonical.list({ limit: 1 })),
+      contextField(this.subgraphs.list()),
+      contextField(this.subscriptions.list())
     ]);
-    const subgraphs = subgraphsRes?.data ?? null;
-    let subscriptions = null;
-    if (subscriptionsRes) {
+    const subgraphs = {
+      value: subgraphsRes.value?.data ?? null,
+      ...subgraphsRes.error ? { error: subgraphsRes.error } : {}
+    };
+    const subscriptions = {
+      value: null,
+      ...subscriptionsRes.error ? { error: subscriptionsRes.error } : {}
+    };
+    if (subscriptionsRes.value) {
       const byStatus = {};
-      for (const s of subscriptionsRes.data) {
+      for (const s of subscriptionsRes.value.data) {
         byStatus[s.status] = (byStatus[s.status] ?? 0) + 1;
       }
-      subscriptions = { count: subscriptionsRes.data.length, byStatus };
+      subscriptions.value = {
+        count: subscriptionsRes.value.data.length,
+        byStatus
+      };
     }
-    let activeOperations = null;
-    if (subgraphs) {
-      const probed = await Promise.all(subgraphs.filter((s) => s.status === "reindexing").map(async (s) => {
-        const res = await safe(this.subgraphs.operations(s.name));
-        const op = res?.operations.find((o) => o.status === "queued" || o.status === "running");
+    let activeOperations = {
+      value: null,
+      error: {
+        message: "Not probed: in-flight operations are read per subgraph, and the subgraph list did not resolve.",
+        retryable: subgraphs.error?.retryable ?? false
+      }
+    };
+    if (subgraphs.value) {
+      const probed = await Promise.all(subgraphs.value.filter((s) => s.status === "reindexing").map(async (s) => {
+        const res = await contextField(this.subgraphs.operations(s.name));
+        const op = res.value?.operations.find((o) => o.status === "queued" || o.status === "running");
         return op ? {
           subgraph: s.name,
           operationId: op.id,
@@ -1966,12 +2296,17 @@ class SecondLayer extends BaseClient {
           progress: op.progress
         } : null;
       }));
-      activeOperations = probed.filter((o) => o !== null);
+      activeOperations = {
+        value: probed.filter((o) => o !== null)
+      };
     }
     return {
       account,
       streamsTip,
-      indexTip: indexEnv?.tip ?? null,
+      indexTip: {
+        value: indexEnv.value?.tip ?? null,
+        ...indexEnv.error ? { error: indexEnv.error } : {}
+      },
       subgraphs,
       subscriptions,
       activeOperations
@@ -1994,5 +2329,5 @@ export {
   Subgraphs
 };
 
-//# debugId=9E199310A6B6CFB264756E2164756E21
+//# debugId=10070F0E5755447564756E2164756E21
 //# sourceMappingURL=index.js.map