@secondlayer/subgraphs 6.3.6 → 6.4.0

package/dist/schema/index.d.ts

@@ -366,6 +366,7 @@ interface GeneratedSQL {
 declare function generateSubgraphSQL(def: SubgraphDefinition, schemaNameOverride?: string): GeneratedSQL;
 import { Database as Database2 } from "@secondlayer/shared/db";
 import { Kysely as Kysely2 } from "kysely";
+import { SubgraphVerification } from "@secondlayer/shared/schemas/subgraphs";
 type AnyDb = Kysely2<Database2>;
 interface TableDiff {
 	/** Tables added to the schema */
@@ -428,10 +429,16 @@ declare function deploySchema(db: AnyDb, def: SubgraphDefinition, handlerPath: s
 	schemaName?: string
 	handlerCode?: string
 	sourceCode?: string
+	/** Derived level to store (see `deriveVerification`). */
+	verification?: SubgraphVerification
+	/** Network baked into the pin. Defaults to `NETWORK`, then mainnet. */
+	network?: string
 }): Promise<{
 	action: "created" | "unchanged" | "handler_updated" | "updated" | "reindexed"
 	subgraphId: string
 	version: string
+	/** Present when the deploy carried a bundled handler. */
+	pin?: string
 	diff?: DeployDiff
 	/** Non-fatal caveats the caller should surface (e.g. handler grafts at tip). */
 	warnings?: string[]

package/dist/schema/index.js

@@ -461,6 +461,265 @@ function filterFieldsByType() {
   return out;
 }
 
+// src/verification.ts
+import { createHash as createHash2 } from "node:crypto";
+// package.json
+var package_default = {
+  name: "@secondlayer/subgraphs",
+  version: "6.4.0",
+  description: "Describe the Stacks data you want as one TypeScript file; it fills itself and survives reorgs.",
+  license: "MIT",
+  repository: {
+    type: "git",
+    url: "git+https://github.com/ryanwaits/secondlayer.git",
+    directory: "packages/subgraphs"
+  },
+  homepage: "https://github.com/ryanwaits/secondlayer/tree/main/packages/subgraphs#readme",
+  type: "module",
+  main: "./dist/index.js",
+  types: "./dist/index.d.ts",
+  exports: {
+    ".": {
+      types: "./dist/index.d.ts",
+      import: "./dist/index.js"
+    },
+    "./types": {
+      types: "./dist/types.d.ts",
+      import: "./dist/types.js"
+    },
+    "./schema": {
+      types: "./dist/schema/index.d.ts",
+      import: "./dist/schema/index.js"
+    },
+    "./validate": {
+      types: "./dist/validate.d.ts",
+      import: "./dist/validate.js"
+    },
+    "./verification": {
+      types: "./dist/verification.d.ts",
+      import: "./dist/verification.js"
+    },
+    "./runtime/replay": {
+      types: "./dist/runtime/replay.d.ts",
+      import: "./dist/runtime/replay.js"
+    },
+    "./runtime/emitter": {
+      types: "./dist/runtime/emitter.d.ts",
+      import: "./dist/runtime/emitter.js"
+    },
+    "./testing": {
+      types: "./dist/testing/index.d.ts",
+      import: "./dist/testing/index.js"
+    }
+  },
+  files: ["dist"],
+  scripts: {
+    build: "bunup",
+    dev: "bunup --watch",
+    test: "bun test",
+    typecheck: "tsc --noEmit",
+    prepublishOnly: "bun run build"
+  },
+  dependencies: {
+    "@secondlayer/shared": "^11.22.0",
+    "@secondlayer/stacks": "^6.1.0",
+    esbuild: "^0.28.2",
+    kysely: "0.28.17",
+    zod: "^4.3.6"
+  },
+  devDependencies: {
+    "@types/bun": "latest",
+    typescript: "^5"
+  },
+  publishConfig: {
+    access: "public"
+  }
+};
+
+// src/verification.ts
+var SUBGRAPHS_RUNTIME = `@secondlayer/subgraphs@${package_default.version}`;
+var FORBIDDEN_GLOBALS = {
+  Date: "wall-clock time differs per run",
+  performance: "timers differ per run",
+  process: "host environment differs per run",
+  fetch: "network reads are not chain inputs",
+  crypto: "randomness differs per run",
+  setTimeout: "scheduling order differs per run",
+  setInterval: "scheduling order differs per run",
+  setImmediate: "scheduling order differs per run",
+  clearTimeout: "scheduling order differs per run",
+  clearInterval: "scheduling order differs per run",
+  queueMicrotask: "scheduling order differs per run",
+  WeakRef: "garbage collection timing differs per run",
+  FinalizationRegistry: "garbage collection timing differs per run",
+  Atomics: "shared memory is not single-threaded",
+  SharedArrayBuffer: "shared memory is not single-threaded",
+  Intl: "locale and time zone data differ per host",
+  Temporal: "locale and time zone data differ per host",
+  eval: "generated code hides inputs from the scan",
+  WebAssembly: "compiled code hides inputs from the scan",
+  ShadowRealm: "a nested realm escapes the allow-list",
+  require: "imports must be bundled into the handler"
+};
+var ALLOWED_GLOBALS = [
+  "undefined",
+  "NaN",
+  "Infinity",
+  "globalThis",
+  "isNaN",
+  "isFinite",
+  "parseInt",
+  "parseFloat",
+  "decodeURI",
+  "decodeURIComponent",
+  "encodeURI",
+  "encodeURIComponent",
+  "escape",
+  "unescape",
+  "Object",
+  "Function",
+  "Array",
+  "Number",
+  "Boolean",
+  "String",
+  "Symbol",
+  "BigInt",
+  "Math",
+  "JSON",
+  "Reflect",
+  "Proxy",
+  "Promise",
+  "Map",
+  "Set",
+  "WeakMap",
+  "WeakSet",
+  "RegExp",
+  "Iterator",
+  "DisposableStack",
+  "AsyncDisposableStack",
+  "Error",
+  "AggregateError",
+  "SuppressedError",
+  "EvalError",
+  "RangeError",
+  "ReferenceError",
+  "SyntaxError",
+  "TypeError",
+  "URIError",
+  "ArrayBuffer",
+  "DataView",
+  "Int8Array",
+  "Uint8Array",
+  "Uint8ClampedArray",
+  "Int16Array",
+  "Uint16Array",
+  "Int32Array",
+  "Uint32Array",
+  "Float16Array",
+  "Float32Array",
+  "Float64Array",
+  "BigInt64Array",
+  "BigUint64Array",
+  "TextEncoder",
+  "TextDecoder",
+  "atob",
+  "btoa",
+  "console"
+];
+var ALLOWED_MATH = [
+  "abs",
+  "min",
+  "max",
+  "floor",
+  "ceil",
+  "trunc",
+  "sign",
+  "round",
+  "E",
+  "LN10",
+  "LN2",
+  "LOG10E",
+  "LOG2E",
+  "PI",
+  "SQRT1_2",
+  "SQRT2"
+];
+var LOCALE_METHODS = [
+  "toLocaleString",
+  "toLocaleDateString",
+  "toLocaleTimeString",
+  "toLocaleUpperCase",
+  "toLocaleLowerCase",
+  "localeCompare"
+];
+function formatFinding(f) {
+  return `${f.file}:${f.line}:${f.column} ${f.name}: ${f.reason}`;
+}
+var STATE_SOURCE_TYPES = new Set([
+  "var_set",
+  "map_set",
+  "map_insert",
+  "map_delete"
+]);
+var LEVEL_RANK = { state: 0, events: 1, none: 2 };
+var MAX_LISTED_FINDINGS = 10;
+function deriveVerification(def, findings = []) {
+  let level = "state";
+  const raise = (to) => {
+    if (LEVEL_RANK[to] > LEVEL_RANK[level])
+      level = to;
+  };
+  const reasons = [];
+  for (const [name, source] of Object.entries(def.sources ?? {})) {
+    const filter = source;
+    if (filter.trait) {
+      raise("none");
+      reasons.push(`source "${name}": trait scope needs a proven contract registry`);
+    } else if (!STATE_SOURCE_TYPES.has(filter.type)) {
+      raise("events");
+      reasons.push(`${filter.type} source "${name}" needs event proofs`);
+    }
+  }
+  if (def.backfillMode === "concurrent") {
+    raise("none");
+    reasons.push("backfillMode concurrent: tip-first order is not chain order");
+  }
+  if (findings.some((f) => f.kind === "needs-events"))
+    raise("events");
+  for (const f of findings.slice(0, MAX_LISTED_FINDINGS)) {
+    reasons.push(f.kind === "needs-events" ? `${formatFinding(f)} (needs event proofs)` : formatFinding(f));
+  }
+  if (findings.length > MAX_LISTED_FINDINGS) {
+    reasons.push(`…and ${findings.length - MAX_LISTED_FINDINGS} more handler findings`);
+  }
+  const writesMapInsert = Object.values(def.sources ?? {}).some((s) => s.type === "map_insert");
+  return {
+    level,
+    reasons,
+    unproven: reasons.length === 0 ? [
+      "tx attribution of writes: event.tx, _tx_id (needs event proofs)",
+      "intermediate writes within a block (needs event proofs)",
+      ...writesMapInsert ? ["map_insert vs map_set (needs event proofs)"] : []
+    ] : []
+  };
+}
+function isDeterminismViolation(v) {
+  return v.level === "state" && v.reasons.length > 0;
+}
+function sha256(input) {
+  return createHash2("sha256").update(input).digest("hex");
+}
+function computePin(input) {
+  const canonical = JSON.stringify({
+    handlerHash: sha256(input.handlerCode),
+    network: input.network,
+    runtime: input.runtime ?? SUBGRAPHS_RUNTIME,
+    schemaHash: input.schemaHash,
+    startBlock: input.startBlock ?? null
+  });
+  return sha256(canonical);
+}
+
 // src/schema/deployer.ts
 function toJsonSafe(obj) {
   return JSON.parse(JSON.stringify(obj, (_key, value) => typeof value === "bigint" ? value.toString() : value));
@@ -558,6 +817,13 @@ function renderDeployPlan(def, schemaName) {
 async function deploySchema(db, def, handlerPath, opts) {
   validateSubgraphDefinition(def);
   const { statements, hash } = generateSubgraphSQL(def, opts?.schemaName);
+  const pin = opts?.handlerCode != null ? computePin({
+    schemaHash: hash,
+    handlerCode: opts.handlerCode,
+    startBlock: def.startBlock,
+    network: opts.network ?? process.env.NETWORK ?? "mainnet"
+  }) : null;
+  const identity = pin ? { pin } : {};
   const { getSubgraph, registerSubgraph } = await import("@secondlayer/shared/db/queries/subgraphs");
   const ddlDb = db;
   const existing = await getSubgraph(db, def.name, opts?.accountId);
@@ -580,7 +846,9 @@ async function deploySchema(db, def, handlerPath, opts) {
     handlerCode: opts?.handlerCode,
     sourceCode: opts?.sourceCode,
     schemaName,
-    startBlock: def.startBlock
+    startBlock: def.startBlock,
+    pin,
+    verification: opts?.verification ?? null
   };
   if (existing) {
     const schemaExists = await sql`
@@ -594,19 +862,27 @@ async function deploySchema(db, def, handlerPath, opts) {
         await sql.raw(stmt).execute(ddlDb);
       }
       const sg = await registerSubgraph(db, regData);
-      return { action: "reindexed", subgraphId: sg.id, version: newVersion };
+      return {
+        action: "reindexed",
+        subgraphId: sg.id,
+        version: newVersion,
+        ...identity
+      };
     }
     if (existing.schema_hash === hash && !opts?.forceReindex) {
       const handlerChanged = opts?.handlerCode != null && opts.handlerCode !== existing.handler_code;
       const { updateSubgraphHandlerPath } = await import("@secondlayer/shared/db/queries/subgraphs");
       await updateSubgraphHandlerPath(db, def.name, handlerPath, {
         handlerCode: opts?.handlerCode,
-        sourceCode: opts?.sourceCode
+        sourceCode: opts?.sourceCode,
+        pin,
+        verification: opts?.verification ?? null
       });
       return {
         action: handlerChanged ? "handler_updated" : "unchanged",
         subgraphId: existing.id,
         version: existing.version,
+        ...identity,
         ...handlerChanged ? {
           warnings: [
             "handler changed but schema did not: new logic applies from the current tip only. Rows already indexed were computed by the previous handler. To recompute history, redeploy with --reindex (or backfill a range)."
@@ -620,7 +896,12 @@ async function deploySchema(db, def, handlerPath, opts) {
         await sql.raw(stmt).execute(ddlDb);
       }
       const sg = await registerSubgraph(db, regData);
-      return { action: "reindexed", subgraphId: sg.id, version: newVersion };
+      return {
+        action: "reindexed",
+        subgraphId: sg.id,
+        version: newVersion,
+        ...identity
+      };
     }
     if (existing.definition.schema) {
       const diff = diffSchema(existing.definition.schema, def.schema);
@@ -636,6 +917,7 @@ async function deploySchema(db, def, handlerPath, opts) {
           action: "reindexed",
           subgraphId: sg.id,
           version: newVersion,
+          ...identity,
           diff: deployDiff
         };
       }
@@ -755,6 +1037,7 @@ async function deploySchema(db, def, handlerPath, opts) {
         action: "updated",
         subgraphId: sg.id,
         version: newVersion,
+        ...identity,
         diff: deployDiff
       };
     }
@@ -763,7 +1046,12 @@ async function deploySchema(db, def, handlerPath, opts) {
     await sql.raw(stmt).execute(ddlDb);
   }
   const sg = await registerSubgraph(db, regData);
-  return { action: "created", subgraphId: sg.id, version: newVersion };
+  return {
+    action: "created",
+    subgraphId: sg.id,
+    version: newVersion,
+    ...identity
+  };
 }
 function getDefault(type) {
   switch (type) {
@@ -790,5 +1078,5 @@ export {
   generateSubgraphSQL
 };
 
-//# debugId=054E6A0FD91586DA64756E2164756E21
+//# debugId=437B69A70A1DC76C64756E2164756E21
 //# sourceMappingURL=index.js.map