Post indexing payments audit

package.json

@@ -22,7 +22,7 @@
     "lint:sol": "pnpm -r run lint:sol; prettier -w --cache --log-level warn 'packages/**/*.sol'; pnpm todo",
     "lint:forge": "pnpm -r run lint:forge",
     "lint:md": "markdownlint --fix --ignore-path .gitignore 'packages/**/*.md' 'docs/**/*.md' '*.md'; prettier -w --cache --log-level warn 'packages/**/*.md' 'docs/**/*.md' '*.md'",
-    "lint:json": "prettier -w --cache --log-level warn 'packages/**/*.json' '.changeset/**/*.json' '*.json'",
+    "lint:json": "prettier -w --cache --log-level warn 'packages/**/*.{json,json5}' '.changeset/**/*.json' '*.{json,json5}'",
     "lint:yaml": "npx yaml-lint .github/**/*.{yml,yaml} packages/contracts/task/config/*.yml; prettier -w --cache --log-level warn 'packages/**/*.{yml,yaml}' '.github/**/*.{yml,yaml}'",
     "test": "pnpm build && pnpm -r run test:self",
     "test:prod": "FOUNDRY_PROFILE=prod pnpm test",
@@ -56,8 +56,17 @@
     "overrides": {
       "@types/node": "^20.17.50"
     },
+    "packageExtensions": {
+      "@nomiclabs/hardhat-waffle@*": {
+        "dependencies": {
+          "@ethereum-waffle/chai": "*",
+          "@ethereum-waffle/provider": "*"
+        }
+      }
+    },
     "patchedDependencies": {
-      "typechain@8.3.2": "patches/typechain@8.3.2.patch"
+      "typechain@8.3.2": "patches/typechain@8.3.2.patch",
+      "rocketh@0.17.13": "patches/rocketh@0.17.13.patch"
     }
   },
   "lint-staged": {
@@ -73,7 +82,7 @@
       "markdownlint --fix",
       "prettier -w --cache --log-level warn"
     ],
-    "*.json": "prettier -w --cache --log-level warn",
+    "*.{json,json5}": "prettier -w --cache --log-level warn",
     "*.{yml,yaml}": [
       "npx yamllint",
       "prettier -w --cache --log-level warn"

packages/address-book/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @graphprotocol/address-book
 
+## 1.2.0
+
+### Minor Changes
+
+- Upgraded Rewards Manager and Subgraph Service with Rewards Eligibility Oracle and rewards reclaiming.
+
 ## 1.1.0
 
 ### Minor Changes

packages/address-book/docs/PublishingGuide.md

@@ -0,0 +1,108 @@
+# Publishing @graphprotocol/address-book
+
+Step-by-step guide for releasing a new version of the address-book package and deploying it to the network monitor.
+
+## Prerequisites
+
+- npm publish access for the `@graphprotocol` scope
+- Write access to the [network-monitor](https://github.com/edgeandnode/network-monitor) repo
+- Ability to trigger GitHub Actions workflows in both repos
+
+## Step 1: Update Address Files
+
+Update the source address files in the contracts monorepo. These live in:
+
+- `packages/horizon/addresses.json`
+- `packages/subgraph-service/addresses.json`
+- `packages/issuance/addresses.json`
+
+The address-book package symlinks to these files during development, so changes here are automatically reflected locally.
+
+## Step 2: Create a Changeset
+
+From the monorepo root:
+
+```bash
+pnpm changeset
+```
+
+- Select `@graphprotocol/address-book`
+- Choose the bump type (patch/minor/major)
+- Describe what changed (e.g., "update arbitrumSepolia addresses after deployment")
+
+## Step 3: Version the Package
+
+```bash
+pnpm changeset version
+```
+
+This consumes the changeset, bumps the version in `packages/address-book/package.json`, and updates `CHANGELOG.md`.
+
+## Step 4: Commit and Push
+
+```bash
+git add .
+git commit -m "chore: release @graphprotocol/address-book vX.Y.Z"
+git push
+```
+
+## Step 5: Publish to npm
+
+1. Go to the contracts monorepo → Actions → "Publish package to NPM"
+2. Select `address-book` as the package
+3. Set tag to `latest` (or a pre-release tag)
+4. Run workflow
+
+The workflow automatically:
+
+- Publishes to npm (symlinks are converted to real files via `prepublishOnly`)
+- Creates and pushes a git tag (`@graphprotocol/address-book@X.Y.Z`)
+
+## Step 6: Verify on npm
+
+```bash
+npm view @graphprotocol/address-book version
+```
+
+Confirm the new version is live.
+
+## Step 7: Update the Network Monitor
+
+In the [network-monitor](https://github.com/edgeandnode/network-monitor) repo:
+
+1. Update `package.json` to reference the new version:
+
+   ```json
+   "@graphprotocol/address-book": "X.Y.Z",
+   ```
+
+2. Run `yarn` to update the lockfile
+3. Commit and push
+
+The network monitor imports addresses from:
+
+- `@graphprotocol/address-book/horizon/addresses.json` (in `src/env.ts`)
+- `@graphprotocol/address-book/subgraph-service/addresses.json` (in `src/env.ts`, `src/tests/contracts.ts`)
+
+## Step 8: Deploy the Network Monitor
+
+1. Go to the network-monitor repo → Actions → "Deployment"
+2. Choose the target cluster:
+   - **`network`** → production (mainnet)
+   - **`testnet`** → testnet
+3. Run workflow
+
+This builds a Docker image, pushes it to `ghcr.io/edgeandnode/network-monitor`, and restarts the StatefulSet on GKE.
+
+## Quick Reference
+
+| Step | Action                          | Where                         |
+| ---- | ------------------------------- | ----------------------------- |
+| 1    | Update address files            | contracts monorepo            |
+| 2    | `pnpm changeset`                | contracts monorepo            |
+| 3    | `pnpm changeset version`        | contracts monorepo            |
+| 4    | Commit + push                   | contracts monorepo            |
+| 5    | Publish to npm (auto-tags)      | contracts monorepo GH Actions |
+| 6    | Verify on npm                   | npmjs.com                     |
+| 7    | Bump version in network-monitor | network-monitor repo          |
+| 8    | Deploy network monitor          | network-monitor GH Actions    |

packages/address-book/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@graphprotocol/address-book",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "publishConfig": {
     "access": "public"
   },
@@ -13,9 +13,7 @@
     "directory": "packages/address-book"
   },
   "exports": {
-    "./horizon/addresses.json": "./src/horizon/addresses.json",
-    "./issuance/addresses.json": "./src/issuance/addresses.json",
-    "./subgraph-service/addresses.json": "./src/subgraph-service/addresses.json"
+    "./*/addresses.json": "./src/*/addresses.json"
   },
   "files": [
     "src/**/*.json",

packages/address-book/scripts/copy-addresses-for-publish.js

@@ -3,67 +3,52 @@
 /**
  * Copy Addresses for Publishing
  *
- * This script copies the actual addresses.json files from horizon and subgraph-service
- * packages to replace the symlinks before npm publish.
- *
- * Why we need this:
- * - Development uses symlinks (committed to git) for convenience
- * - npm publish doesn't include symlinks in the published package
- * - We need actual files in the published package for consumers
- *
- * The postpublish script will restore the symlinks after publishing.
+ * Replaces the dev-time symlinks under src/<name>/addresses.json with real
+ * file copies before npm publish — npm does not include symlinks in the
+ * published tarball. restore-symlinks.js puts the symlinks back afterwards.
  */
 
 const fs = require('fs')
 const path = require('path')
+const SOURCES = require('./sources')
 
-const FILES_TO_COPY = [
-  {
-    source: '../../../horizon/addresses.json',
-    target: 'src/horizon/addresses.json',
-  },
-  {
-    source: '../../../issuance/addresses.json',
-    target: 'src/issuance/addresses.json',
-  },
-  {
-    source: '../../../subgraph-service/addresses.json',
-    target: 'src/subgraph-service/addresses.json',
-  },
-]
+const ROOT = path.resolve(__dirname, '..')
+const SRC = path.join(ROOT, 'src')
 
-function copyFileForPublish(source, target) {
-  const targetPath = path.resolve(__dirname, '..', target)
-  const sourcePath = path.resolve(path.dirname(targetPath), source)
+function copyOne(name) {
+  const sourcePath = path.resolve(ROOT, '..', name, 'addresses.json')
+  const targetDir = path.join(SRC, name)
+  const targetPath = path.join(targetDir, 'addresses.json')
 
-  // Ensure source exists
   if (!fs.existsSync(sourcePath)) {
     console.error(`❌ Source file ${sourcePath} does not exist`)
     process.exit(1)
   }
 
-  // Remove existing symlink
-  if (fs.existsSync(targetPath)) {
-    fs.unlinkSync(targetPath)
-  }
+  fs.mkdirSync(targetDir, { recursive: true })
+  fs.rmSync(targetPath, { force: true })
+  fs.copyFileSync(sourcePath, targetPath)
+  console.log(`✅ Copied for publish: src/${name}/addresses.json`)
+}
 
-  // Copy actual file
-  try {
-    fs.copyFileSync(sourcePath, targetPath)
-    console.log(`✅ Copied for publish: ${target} <- ${source}`)
-  } catch (error) {
-    console.error(`❌ Failed to copy ${source} to ${target}:`, error.message)
+function checkDrift() {
+  const dirs = fs
+    .readdirSync(SRC)
+    .filter((d) => fs.statSync(path.join(SRC, d)).isDirectory())
+    .sort()
+  const expected = [...SOURCES].sort()
+  if (JSON.stringify(dirs) !== JSON.stringify(expected)) {
+    console.error(`❌ Drift between SOURCES and src/`)
+    console.error(`   SOURCES: [${expected.join(', ')}]`)
+    console.error(`   src/   : [${dirs.join(', ')}]`)
     process.exit(1)
   }
 }
 
 function main() {
   console.log('📦 Copying address files for npm publish...')
-
-  for (const { source, target } of FILES_TO_COPY) {
-    copyFileForPublish(source, target)
-  }
-
+  for (const name of SOURCES) copyOne(name)
+  checkDrift()
   console.log('✅ Address files copied for publish!')
 }
 

packages/address-book/scripts/restore-symlinks.js

@@ -3,54 +3,32 @@
 /**
  * Restore Symlinks After Publishing
  *
- * This script restores the symlinks after npm publish completes.
- * The prepublishOnly script replaces symlinks with actual files for publishing,
- * and this script puts the symlinks back for development.
+ * Restores the dev-time symlinks under src/<name>/addresses.json after
+ * npm publish. copy-addresses-for-publish.js replaces them with real files
+ * for the publish step; this puts them back.
  */
 
 const fs = require('fs')
 const path = require('path')
+const SOURCES = require('./sources')
 
-const SYMLINKS_TO_RESTORE = [
-  {
-    target: '../../../horizon/addresses.json',
-    link: 'src/horizon/addresses.json',
-  },
-  {
-    target: '../../../issuance/addresses.json',
-    link: 'src/issuance/addresses.json',
-  },
-  {
-    target: '../../../subgraph-service/addresses.json',
-    link: 'src/subgraph-service/addresses.json',
-  },
-]
+const ROOT = path.resolve(__dirname, '..')
+const SRC = path.join(ROOT, 'src')
 
-function restoreSymlink(target, link) {
-  const linkPath = path.resolve(__dirname, '..', link)
+function restoreOne(name) {
+  const linkTarget = `../../../${name}/addresses.json`
+  const linkDir = path.join(SRC, name)
+  const linkPath = path.join(linkDir, 'addresses.json')
 
-  // Remove the copied file
-  if (fs.existsSync(linkPath)) {
-    fs.unlinkSync(linkPath)
-  }
-
-  // Restore symlink
-  try {
-    fs.symlinkSync(target, linkPath)
-    console.log(`✅ Restored symlink: ${link} -> ${target}`)
-  } catch (error) {
-    console.error(`❌ Failed to restore symlink ${link}:`, error.message)
-    process.exit(1)
-  }
+  fs.mkdirSync(linkDir, { recursive: true })
+  fs.rmSync(linkPath, { force: true })
+  fs.symlinkSync(linkTarget, linkPath)
+  console.log(`✅ Restored symlink: src/${name}/addresses.json -> ${linkTarget}`)
 }
 
 function main() {
   console.log('🔗 Restoring symlinks after publish...')
-
-  for (const { target, link } of SYMLINKS_TO_RESTORE) {
-    restoreSymlink(target, link)
-  }
-
+  for (const name of SOURCES) restoreOne(name)
   console.log('✅ Symlinks restored!')
 }
 

packages/address-book/scripts/sources.js

@@ -0,0 +1,4 @@
+// Source packages exported from @graphprotocol/address-book.
+// Each name corresponds to packages/<name>/addresses.json (source of truth)
+// and packages/address-book/src/<name>/addresses.json (publish symlink).
+module.exports = ['horizon', 'issuance', 'subgraph-service']

packages/address-book/src/issuance/addresses.json

@@ -0,0 +1 @@
+../../../issuance/addresses.json

packages/contracts/.solhint.json

@@ -1,3 +1,3 @@
 {
-  "extends": ["solhint:recommended", "./../../.solhint.json"]
+  "extends": "./../../.solhint.json"
 }

packages/contracts/hardhat.config.ts

@@ -60,7 +60,8 @@ const config: HardhatUserConfig = {
   etherscan: {
     // Use ARBISCAN_API_KEY for Arbitrum networks
     // For mainnet Ethereum, use ETHERSCAN_API_KEY
-    apiKey: vars.has('ARBISCAN_API_KEY') ? vars.get('ARBISCAN_API_KEY') : '',
+    // Check both keystore (vars) and environment variable
+    apiKey: vars.has('ARBISCAN_API_KEY') ? vars.get('ARBISCAN_API_KEY') : (process.env.ARBISCAN_API_KEY ?? ''),
   },
   sourcify: {
     enabled: false,

packages/data-edge/.solhint.json

@@ -1,3 +1,3 @@
 {
-  "extends": ["solhint:recommended", "./../../.solhint.json"]
+  "extends": "./../../.solhint.json"
 }