feat(legacy): add address book and historical audits

.changeset/legacy-address-book.md

@@ -0,0 +1,5 @@
+---
+'@graphprotocol/address-book': minor
+---
+
+Add the L1 deployment addresses (`@graphprotocol/address-book/legacy/addresses.json`) for Ethereum mainnet and Sepolia.

packages/address-book/README.md

@@ -4,7 +4,7 @@ Contract addresses for The Graph Protocol. This package provides JSON files cont
 
 ## Features
 
-- Contract addresses for Horizon, Subgraph Service, Issuance and DataEdge
+- Contract addresses for Horizon, Subgraph Service, Issuance, DataEdge and Legacy (the L1 deployment record)
 - Network-specific deployment addresses
 - Zero dependencies
 
@@ -26,12 +26,14 @@ const horizonAddresses = require('@graphprotocol/address-book/horizon/addresses.
 const subgraphServiceAddresses = require('@graphprotocol/address-book/subgraph-service/addresses.json')
 const issuanceAddresses = require('@graphprotocol/address-book/issuance/addresses.json')
 const dataEdgeAddresses = require('@graphprotocol/address-book/data-edge/addresses.json')
+const legacyAddresses = require('@graphprotocol/address-book/legacy/addresses.json')
 
 // ES Modules
 import horizonAddresses from '@graphprotocol/address-book/horizon/addresses.json'
 import subgraphServiceAddresses from '@graphprotocol/address-book/subgraph-service/addresses.json'
 import issuanceAddresses from '@graphprotocol/address-book/issuance/addresses.json'
 import dataEdgeAddresses from '@graphprotocol/address-book/data-edge/addresses.json'
+import legacyAddresses from '@graphprotocol/address-book/legacy/addresses.json'
 ```
 
 ### Address format
@@ -53,41 +55,42 @@ The addresses are organized by chain ID and contract name:
 
 ## Development
 
-This package uses symlinks to stay in sync with the source address files. On first install, symlinks are automatically created.
+The files under `src/<name>/addresses.json` are tracked as regular copies of each package's `addresses.json`. Update the copy whenever its source changes.
 
 ## npm Publishing
 
 This package uses a special workflow to ensure address files are included in the published package:
 
 ### How It Works
 
-**Development**: The package uses symlinks to stay in sync with source address files:
+**Development**: `src/<name>/addresses.json` is a tracked regular file, a copy of the source address file:
 
-- `src/horizon/addresses.json` → symlink to `../../../horizon/addresses.json`
-- `src/subgraph-service/addresses.json` → symlink to `../../../subgraph-service/addresses.json`
-- `src/issuance/addresses.json` → symlink to `../../../issuance/addresses.json`
-- `src/data-edge/addresses.json` → symlink to `../../../data-edge/addresses.json`
+- `src/horizon/addresses.json` ← `packages/horizon/addresses.json`
+- `src/subgraph-service/addresses.json` ← `packages/subgraph-service/addresses.json`
+- `src/issuance/addresses.json` ← `packages/issuance/addresses.json`
+- `src/data-edge/addresses.json` ← `packages/data-edge/addresses.json`
+- `src/legacy/addresses.json` ← `packages/legacy/addresses.json`
 
 The list of exported packages lives in `scripts/sources.js`.
 
-**Publishing**: npm doesn't include symlinks in packages, so we automatically handle this:
+**Publishing**: `prepublishOnly` copies the source files over the tracked files. `postpublish` then turns the files into symlinks, so after a publish they are symlinks until you restore the regular files with `git checkout`:
 
 ```bash
 npm publish
 ```
 
 **Automatic execution**:
 
-1. **`prepublishOnly`** - Copies actual files to replace symlinks
+1. **`prepublishOnly`** - Copies the source files over `src/<name>/addresses.json`
 2. **npm pack & publish** - Includes real address files in published package
-3. **`postpublish`** - Restores symlinks for development
+3. **`postpublish`** - Runs `restore-symlinks`, which turns the files into symlinks
 
 ### Troubleshooting
 
-If publishing fails, the `postpublish` script may not run, leaving copied files instead of symlinks. To restore symlinks manually:
+If publishing fails, `postpublish` may not run. That leaves the copied files, which are the tracked state, so there is nothing to fix.
+
+After a successful publish, `src/<name>/addresses.json` are symlinks and show as changes in git. To restore the tracked files, run this from `packages/address-book`:
 
 ```bash
-pnpm restore-symlinks
+git checkout -- src
 ```
-
-All symlink management is handled automatically during successful publishes.

packages/address-book/docs/PublishingGuide.md

@@ -16,8 +16,9 @@ Update the source address files in the contracts monorepo. These live in:
 - `packages/subgraph-service/addresses.json`
 - `packages/issuance/addresses.json`
 - `packages/data-edge/addresses.json`
+- `packages/legacy/addresses.json`
 
-The address-book package symlinks to these files during development, so changes here are automatically reflected locally.
+The address-book package tracks a regular copy of each file at `src/<name>/addresses.json`. Update the copy whenever its source changes.
 
 ## Step 2: Create a Changeset
 
@@ -56,7 +57,7 @@ git push
 
 The workflow automatically:
 
-- Publishes to npm (symlinks are converted to real files via `prepublishOnly`)
+- Publishes to npm (`prepublishOnly` copies the source files over `src/<name>/addresses.json`, and `postpublish` then turns them into symlinks, which `git checkout -- src` restores)
 - Creates and pushes a git tag (`@graphprotocol/address-book@X.Y.Z`)
 
 ## Step 6: Verify on npm

packages/address-book/scripts/copy-addresses-for-publish.js

@@ -3,9 +3,10 @@
 /**
  * Copy Addresses for Publishing
  *
- * Replaces the dev-time symlinks under src/<name>/addresses.json with real
- * file copies before npm publish — npm does not include symlinks in the
- * published tarball. restore-symlinks.js puts the symlinks back afterwards.
+ * Copies each package's addresses.json over the tracked regular file at
+ * src/<name>/addresses.json before npm publish, so the published tarball has
+ * the current addresses. restore-symlinks.js then turns these files into
+ * symlinks, which `git checkout -- src` restores.
  */
 
 const fs = require('fs')

packages/address-book/scripts/restore-symlinks.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 
 /**
- * Restore Symlinks After Publishing
+ * Create Symlinks After Publishing
  *
- * Restores the dev-time symlinks under src/<name>/addresses.json after
- * npm publish. copy-addresses-for-publish.js replaces them with real files
- * for the publish step; this puts them back.
+ * Turns src/<name>/addresses.json into symlinks to each package's
+ * addresses.json after npm publish. The tracked files are regular files, so
+ * the symlinks show as changes in git until `git checkout -- src` restores them.
  */
 
 const fs = require('fs')

packages/address-book/scripts/sources.js

@@ -1,4 +1,4 @@
 // Source packages exported from @graphprotocol/address-book.
 // Each name corresponds to packages/<name>/addresses.json (source of truth)
-// and packages/address-book/src/<name>/addresses.json (publish symlink).
-module.exports = ['data-edge', 'horizon', 'issuance', 'subgraph-service']
+// and packages/address-book/src/<name>/addresses.json (a tracked copy).
+module.exports = ['data-edge', 'horizon', 'issuance', 'legacy', 'subgraph-service']