Arkiv SQL Indexer mirrors Arkiv entities into Parquet snapshots. Your browser loads them into DuckDB WASM for joins, grouping and window functions, follows new blocks from the public RPC, and drops each row once its expiry block passes.
Open source (MIT), built 9 to 18 October 2026 for the Open Source and Security tracks. Runs on Tiramisu with Arkiv SDK 0.8.1.
SELECT creator, count(*) AS count
FROM entities
GROUP BY creator
ORDER BY count DESC, creator
LIMIT 10arkiv_query filters and pages entities; it has no GROUP BY, JOIN or ORDER BY on attributes.A dApp or analyst that filters Arkiv data by a user written attribute, such as project or type.
Attributes are written by whoever creates the entity. Anyone can create an entity with project = arkiv-sql-indexer-demo, so a dashboard that trusts that attribute counts forged rows as its own. User attributes alone are not an identity boundary.
The usual answer is a hosted indexer or a subgraph, which asks every user to trust whoever runs it, and which typically keeps rows after the data was meant to expire.
README.md, SPECS.mdINDEX_EXPRESSION to $creator = addr(…) and only that wallet's entities are indexed, including tickets later handed to another owner. Startup refuses to reuse a store built for a different expression.README.md, packages/core/src/query.ts, apps/indexer/src/store.tsThe data contract is two SQL views, entities and attributes, documented column by column in arkiv/schema.md. Snapshots are plain Parquet files listed in /data/manifest.json, readable by any Parquet tool. The code is MIT licensed, and the whole stack deploys with Docker Compose.
A self hosted indexer prepares the files. Everything you query runs in your browser, which also talks to Arkiv directly.
The project depends on properties that only hold when the data lives on Arkiv.
Whoever runs the database can edit any row, and readers have no independent source to check it against. Expiry becomes a job you hope keeps running.
Content is addressed by hash and cannot change in place. There is no owner, no attribute query and no expiry beyond whoever stops pinning.
It needs a contract that emits events and a hosted indexer that users have to trust. Nothing in it removes rows when the source data should be gone.
Users trust your server twice: for the data, and for the claim of who wrote it.
$creator and $owner are system fields. The chain sets them, so the creator scope cannot be forged with an attribute.expiresAt block. The index enforces it instead of inventing its own retention.$creator, $key and atBlock with cursor pagination.arkiv_query returns at most 200 results per page with boolean filters only, so joins, grouping and window functions run in DuckDB.Each feature below is in the code. For each: what it does, why it was chosen, and what you see.
priority as u64, assignee as addr; comments point at their ticket with a key attribute. Decoding keeps exact integers as text and a numeric num column.($creator = addr(…)) AND ($key = key(…) OR …) with the SDK query builder, at most 50 keys per call.atBlock with cursor pagination, and a fill page answered at a different block is rejected.ExpirationTime.fromSeconds of 600 for heartbeats, 86400 for comments and 604800 for tickets.extendEntity on its ticket for another 7 days. Tickets are created with permissionlessExtension so renewal still works after a transfer.expires_at moves forward. Verify reports extended when the chain holds a newer update with a later expiry than your row.predictEntityKeys yields the ticket key, then executeBatch creates the ticket and a comment that already references it.assignee, then changeOwnership hands it to an agent wallet.$owner changes but $creator does not, so an index scoped by creator keeps the ticket.eth_getLogs; no arkiv_query runs per event. By default no request carries an API key.Three demo entity types with different lifetimes, and three places where expired rows are removed.
Heartbeats disappear through expiry without any event. Comments live a day. Tickets live a week, and every new comment renews the lease.
The snapshot build skips rows with expires_at <= head. The indexer sweeps expired rows and keeps two snapshot versions. The browser filters every query against live_head, read directly from the RPC.
An older snapshot file can still hold a row until it is pruned, but SQL hides it at expiry. Someone who copied data while it was live keeps their copy; this is not a promise to erase third party copies.
apps/demo-writer/src/plan.ts, apps/indexer/src/snapshot.ts, apps/indexer/src/store.ts, packages/core/src/views.ts, README.mdObserved on Tiramisu on 18 October 2026 with SDK 0.8.1. Full reproduction steps are in arkiv/friction.md.
A broad $expiresAt > u64(0) query with limit 5 used the whole anonymous budget. Later calls returned HTTP 429 with a plain object, not a JSON RPC error envelope. The client handles both shapes and waits for Retry-After.
An OR of 50 keys (about 4,100 characters) worked; 100 keys (about 8,200) failed with -32004 query is too long, and the failure still cost units. Lookups are chunked at 50.
One key, 50 keys, a full 200 row page and a failing call all showed the same cost. Batching keys is the only lever, so every lookup carries up to 50.
Headers expose quota used as a percent, so remaining calls cannot be computed. Together with the measured change rate, this is why the indexer runs without an API key by default.
Five minutes in a browser. No wallet, no API key.
arkiv_query cannot express.| Role | Address |
|---|---|
| Demo wallet (creator) | 0x1f61c3cac1612C020f64739B128C5f198939C8Cd |
| Agent one | 0xb0B87EdDB0bc777Eb663c7a11703ba5ED4849A28 |
| Agent two | 0xF1BC753cF42d0157Ac34E28DBf06108F66aDB3B3 |