@secondlayer/subgraphs 3.24.1 → 3.24.3

package/dist/src/runtime/block-processor.d.ts

@@ -366,7 +366,25 @@ type EventRecord = {
 };
 import { Database as Database2 } from "@secondlayer/shared/db";
 import { Kysely as Kysely2, Transaction } from "kysely";
-/** Drop a subgraph's cached route — call on redeploy/delete (conn may change). */
+/** f072: thrown by `resolveRoute` when a BYO subgraph needs its user-DB
+*  connection decrypted but this process holds no `SECONDLAYER_SECRETS_KEY`
+*  — the subgraph processor deliberately does not hold the master key (it
+*  runs untrusted handler code in-process, every block; see f049 site 3 /
+*  the sandbox spike doc's D3). Deny by default, fail loud: this must NEVER
+*  be caught and silently rerouted to the managed target DB, since that
+*  would write a tenant's rows into ours — far worse than halting the
+*  block. */
+declare class ByoKeyUnavailableError extends Error {
+	constructor(subgraphName: string);
+}
+/** Drop a subgraph's cached route — call on redeploy/delete (conn may
+*  change). Also evicts any warm sandbox subprocess for this subgraph
+*  (f071 Stage A `host.ts`) on the same edge: a redeploy can change
+*  `handler_code`/`version`/the BYO connection together, and a stale warm
+*  subprocess must not survive past this invalidation any more than the
+*  cached route does. A no-op today since nothing sets `sandbox_workers`,
+*  but keeps the pool's documented invalidation contract honest for when it
+*  is. */
 declare function invalidateSubgraphRoute(subgraphName: string): void;
 /**
 * Resolve each distinct trait used by a subgraph's sources to its conforming
@@ -473,4 +491,4 @@ declare const BLOCK_RETRY_DELAYS_MS: number[];
 */
 declare function processBlockWithRetry(subgraph: SubgraphDefinition, subgraphName: string, blockHeight: number, opts?: ProcessBlockOptions, retryDelaysMs?: number[]): Promise<ProcessBlockResult>;
 declare function processBlock(subgraph: SubgraphDefinition, subgraphName: string, blockHeight: number, opts?: ProcessBlockOptions): Promise<ProcessBlockResult>;
-export { resolveFactoryContracts, processBlockWithRetry, processBlock, invalidateSubgraphRoute, ProcessBlockTiming, ProcessBlockResult, ProcessBlockOptions, PreloadedBlockData, BLOCK_RETRY_DELAYS_MS };
+export { resolveFactoryContracts, processBlockWithRetry, processBlock, invalidateSubgraphRoute, ProcessBlockTiming, ProcessBlockResult, ProcessBlockOptions, PreloadedBlockData, ByoKeyUnavailableError, BLOCK_RETRY_DELAYS_MS };

package/dist/src/runtime/block-processor.js

@@ -1627,6 +1627,7 @@ function matchSources(sources, transactions, events, traitContracts = new Map, f
 }
 
 // src/runtime/block-processor.ts
+import { secretsKeyAvailable } from "@secondlayer/shared/crypto/secrets";
 import { getTargetDb } from "@secondlayer/shared/db";
 import { resolveTraitContractIds } from "@secondlayer/shared/db/queries/contracts";
 import { advanceOperationCursor } from "@secondlayer/shared/db/queries/subgraph-operations";
@@ -1639,7 +1640,7 @@ import {
   rewindLiveProgress,
   updateSubgraphStatus
 } from "@secondlayer/shared/db/queries/subgraphs";
-import { logger as logger6 } from "@secondlayer/shared/logger";
+import { logger as logger7 } from "@secondlayer/shared/logger";
 import { sql as sql3 } from "kysely";
 
 // src/runtime/block-source.ts
@@ -2080,6 +2081,315 @@ async function emitSubscriptionOutbox(tx, subgraphName, manifest, matcher, block
   return rows.length;
 }
 
+// src/runtime/sandbox/flag.ts
+function sandboxWorkersGloballyEnabled() {
+  return process.env.SUBGRAPH_SANDBOX_WORKERS === "1";
+}
+function sandboxEnabled(subgraph) {
+  return sandboxWorkersGloballyEnabled() && subgraph.sandbox_workers === true;
+}
+
+// src/runtime/sandbox/host.ts
+import { tmpdir } from "node:os";
+import { fileURLToPath } from "node:url";
+import { logger as logger6 } from "@secondlayer/shared/logger";
+
+// src/runtime/sandbox/bundle.ts
+import esbuild from "esbuild";
+var ALLOWED_BARE_SPECIFIERS = new Set;
+var SUBGRAPHS_PACKAGE_SPECIFIER = "@secondlayer/subgraphs";
+var SUBGRAPHS_STUB_SOURCE = `export function defineSubgraph(def) { return def; }
+`;
+function resolverLockdownPlugin() {
+  return {
+    name: "f071-sandbox-resolver-lockdown",
+    setup(build) {
+      build.onResolve({ filter: /^@secondlayer\/subgraphs$/ }, (args) => ({
+        path: args.path,
+        namespace: "f071-sandbox-subgraphs-stub"
+      }));
+      build.onLoad({ filter: /.*/, namespace: "f071-sandbox-subgraphs-stub" }, () => ({ contents: SUBGRAPHS_STUB_SOURCE, loader: "js" }));
+      build.onResolve({ filter: /^(node:|bun:)/ }, (args) => ({
+        path: args.path,
+        namespace: "f071-sandbox-blocked"
+      }));
+      build.onResolve({ filter: /^[^./]/ }, (args) => {
+        if (args.path === SUBGRAPHS_PACKAGE_SPECIFIER)
+          return;
+        if (ALLOWED_BARE_SPECIFIERS.has(args.path))
+          return;
+        return { path: args.path, namespace: "f071-sandbox-blocked" };
+      });
+      build.onLoad({ filter: /.*/, namespace: "f071-sandbox-blocked" }, (args) => ({
+        contents: `throw new Error(${JSON.stringify(`subgraph sandbox: import of "${args.path}" is blocked in sandboxed handler code — handlers must use the injected \`ctx\` for all I/O`)});`,
+        loader: "js"
+      }));
+    }
+  };
+}
+async function bundleHandlerCode(handlerCode) {
+  const result = await esbuild.build({
+    stdin: {
+      contents: handlerCode,
+      loader: "ts",
+      resolveDir: process.cwd()
+    },
+    bundle: true,
+    platform: "neutral",
+    format: "esm",
+    write: false,
+    logLevel: "silent",
+    plugins: [resolverLockdownPlugin()]
+  });
+  const out = result.outputFiles?.[0];
+  if (!out)
+    throw new Error("esbuild produced no output for handler_code bundle");
+  return new TextDecoder().decode(out.contents);
+}
+
+// src/runtime/sandbox/host.ts
+var BLOCK_TIMEOUT_MS = Number.parseInt(process.env.SUBGRAPH_SANDBOX_BLOCK_TIMEOUT_MS ?? "60000");
+var SUBPROCESS_ENTRY_PATH = fileURLToPath(new URL("./subprocess-entry.ts", import.meta.url));
+function spawnSandboxProcess() {
+  let onMessage = null;
+  const proc = Bun.spawn({
+    cmd: [process.execPath, "--no-env-file", SUBPROCESS_ENTRY_PATH],
+    env: { PATH: process.env.PATH ?? "" },
+    cwd: tmpdir(),
+    stdio: ["ignore", "ignore", "pipe"],
+    serialization: "advanced",
+    ipc(message) {
+      onMessage?.(message);
+    }
+  });
+  (async () => {
+    const reader = proc.stderr.getReader();
+    const decoder = new TextDecoder;
+    try {
+      while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+          break;
+        const text = decoder.decode(value, { stream: true });
+        if (text.trim()) {
+          logger6.warn("Sandbox subprocess stderr", { stderr: text.trim() });
+        }
+      }
+    } catch {}
+  })();
+  return {
+    send: (msg) => proc.send(msg),
+    kill: () => proc.kill(),
+    exited: proc.exited,
+    setOnMessage: (handler) => {
+      onMessage = handler;
+    }
+  };
+}
+var pool = new Map;
+
+class SandboxWorkerCrash extends Error {
+  constructor(subgraphName, cause) {
+    super(`sandbox subprocess for "${subgraphName}" failed: ${cause}`);
+    this.name = "SandboxWorkerCrash";
+  }
+}
+async function initSandboxProcess(proc, subgraphName, version, handlerCode) {
+  const bundledCode = await bundleHandlerCode(handlerCode);
+  let settled = false;
+  const ready = new Promise((resolve, reject) => {
+    proc.setOnMessage((msg) => {
+      if (msg.type === "ready" && msg.version === version) {
+        settled = true;
+        proc.setOnMessage(null);
+        resolve();
+      } else if (msg.type === "error") {
+        settled = true;
+        proc.setOnMessage(null);
+        reject(new SandboxWorkerCrash(subgraphName, msg.message));
+      }
+    });
+    const init = { type: "init", bundledCode, version };
+    proc.send(init);
+  });
+  const crashed = proc.exited.then((code) => {
+    if (settled)
+      return;
+    throw new SandboxWorkerCrash(subgraphName, `subprocess exited (code ${code}) during init`);
+  });
+  await Promise.race([ready, crashed]);
+}
+async function ensureSandboxProcess(subgraphName, version, handlerCode) {
+  if (handlerCode == null) {
+    throw new SandboxWorkerCrash(subgraphName, "subgraph has no handler_code; cannot bundle for the sandbox path");
+  }
+  const existing = pool.get(subgraphName);
+  if (existing && existing.version === version)
+    return existing;
+  if (existing) {
+    try {
+      await initSandboxProcess(existing.proc, subgraphName, version, handlerCode);
+      existing.version = version;
+      logger6.info("Sandbox subprocess handler reloaded", {
+        subgraph: subgraphName,
+        version
+      });
+      return existing;
+    } catch (err) {
+      existing.proc.kill();
+      pool.delete(subgraphName);
+      logger6.warn("Sandbox subprocess re-init failed; respawning", {
+        subgraph: subgraphName,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  const proc = spawnSandboxProcess();
+  try {
+    await initSandboxProcess(proc, subgraphName, version, handlerCode);
+  } catch (err) {
+    proc.kill();
+    throw err;
+  }
+  const entry = { proc, version, chain: Promise.resolve() };
+  pool.set(subgraphName, entry);
+  return entry;
+}
+function evictSandboxWorker(subgraphName) {
+  const entry = pool.get(subgraphName);
+  if (!entry)
+    return;
+  entry.proc.kill();
+  pool.delete(subgraphName);
+}
+async function runHandlersSandboxed(params) {
+  const { subgraphName, version, handlerCode, hostCtx, block, matched } = params;
+  const entry = await ensureSandboxProcess(subgraphName, version, handlerCode);
+  const run = entry.chain.then(() => runBlockThroughProcess(entry, subgraphName, hostCtx, block, matched));
+  entry.chain = run.catch(() => {
+    return;
+  });
+  return run;
+}
+async function runBlockThroughProcess(entry, subgraphName, hostCtx, block, matched) {
+  const { proc } = entry;
+  let timeoutHandle;
+  let settled = false;
+  try {
+    const done = new Promise((resolve, reject) => {
+      proc.setOnMessage((msg) => {
+        if (msg.type === "readRequest") {
+          answerRead(hostCtx, msg).then((reply) => {
+            proc.send({ type: "readResponse", id: msg.id, reply });
+          }).catch((err) => {
+            settled = true;
+            reject(new SandboxWorkerCrash(subgraphName, `host read failed: ${err instanceof Error ? err.message : String(err)}`));
+          });
+          return;
+        }
+        if (msg.type === "blockDone") {
+          settled = true;
+          resolve({
+            ops: msg.ops,
+            result: { processed: msg.processed, errors: msg.errors }
+          });
+          return;
+        }
+        if (msg.type === "error") {
+          settled = true;
+          reject(new SandboxWorkerCrash(subgraphName, msg.message));
+        }
+      });
+      proc.send({ type: "runBlock", block, matched });
+    });
+    const crashed = proc.exited.then((code) => {
+      if (settled)
+        return;
+      throw new SandboxWorkerCrash(subgraphName, `subprocess exited unexpectedly (code ${code}) mid-block`);
+    });
+    const deadline = new Promise((_, reject) => {
+      timeoutHandle = setTimeout(() => {
+        settled = true;
+        reject(new SandboxWorkerCrash(subgraphName, `block ${block.height} exceeded ${BLOCK_TIMEOUT_MS}ms deadline`));
+      }, BLOCK_TIMEOUT_MS);
+    });
+    const { ops, result } = await Promise.race([done, crashed, deadline]);
+    for (const op of ops) {
+      hostCtx.setTx(op.tx);
+      replayOp(hostCtx, op);
+    }
+    return result;
+  } catch (err) {
+    evictSandboxWorker(subgraphName);
+    logger6.warn("Sandbox subprocess run failed; subprocess evicted", {
+      subgraph: subgraphName,
+      blockHeight: block.height,
+      error: err instanceof Error ? err.message : String(err)
+    });
+    throw err;
+  } finally {
+    if (timeoutHandle !== undefined)
+      clearTimeout(timeoutHandle);
+    proc.setOnMessage(null);
+  }
+}
+function replayOp(hostCtx, op) {
+  switch (op.method) {
+    case "insert":
+      hostCtx.insert(op.table, op.args[0]);
+      return;
+    case "upsert":
+      hostCtx.upsert(op.table, op.args[0], op.args[1]);
+      return;
+    case "increment":
+      hostCtx.increment(op.table, op.args[0], op.args[1]);
+      return;
+    case "update":
+      hostCtx.update(op.table, op.args[0], op.args[1]);
+      return;
+    case "delete":
+      hostCtx.delete(op.table, op.args[0]);
+      return;
+  }
+}
+async function answerRead(hostCtx, msg) {
+  const { method, table, where, column } = msg;
+  switch (method) {
+    case "findOne":
+      return { kind: "row", row: await hostCtx.findOne(table, where) };
+    case "findMany":
+      return { kind: "rows", rows: await hostCtx.findMany(table, where) };
+    case "count":
+      return { kind: "count", count: await hostCtx.count(table, where) };
+    case "countDistinct": {
+      if (!column)
+        throw new Error("countDistinct read missing column");
+      return {
+        kind: "count",
+        count: await hostCtx.countDistinct(table, column, where)
+      };
+    }
+    case "sum": {
+      if (!column)
+        throw new Error("sum read missing column");
+      const v = await hostCtx.sum(table, column, where);
+      return { kind: "amount", amount: v.toString() };
+    }
+    case "min": {
+      if (!column)
+        throw new Error("min read missing column");
+      const v = await hostCtx.min(table, column, where);
+      return { kind: "amount", amount: v == null ? null : v.toString() };
+    }
+    case "max": {
+      if (!column)
+        throw new Error("max read missing column");
+      const v = await hostCtx.max(table, column, where);
+      return { kind: "amount", amount: v == null ? null : v.toString() };
+    }
+  }
+}
+
 // src/runtime/subscription-state.ts
 import { listSubscriptions } from "@secondlayer/shared/db/queries/subscriptions";
 import { sql as sql2 } from "kysely";
@@ -2255,22 +2565,36 @@ async function refreshMatcher(db) {
 
 // src/runtime/block-processor.ts
 var routeCache = new Map;
+
+class ByoKeyUnavailableError extends Error {
+  constructor(subgraphName) {
+    super(`subgraph ${subgraphName} is BYO (database_url_enc set) but this process has no SECONDLAYER_SECRETS_KEY — the subgraph processor deliberately does not hold it (f072). Route BYO subgraphs to a process that does, or unset BYO.`);
+    this.name = "ByoKeyUnavailableError";
+  }
+}
 async function resolveRoute(subgraphName, targetDb) {
   const cached = routeCache.get(subgraphName);
   if (cached)
     return cached;
   const row = await targetDb.selectFrom("subgraphs").selectAll().where("name", "=", subgraphName).executeTakeFirst();
   const byo = row ? isByoSubgraph(row) : false;
+  if (row && byo && !secretsKeyAvailable()) {
+    throw new ByoKeyUnavailableError(subgraphName);
+  }
   const route = {
     schemaName: row?.schema_name ?? pgSchemaName(subgraphName),
     dataDb: row && byo ? resolveSubgraphDb(row) : targetDb,
-    byo
+    byo,
+    sandboxWorkers: row?.sandbox_workers === true,
+    handlerCode: row?.handler_code ?? null,
+    version: row?.version ?? ""
   };
   routeCache.set(subgraphName, route);
   return route;
 }
 function invalidateSubgraphRoute(subgraphName) {
   routeCache.delete(subgraphName);
+  evictSandboxWorker(subgraphName);
 }
 async function resolveFactoryContracts(subgraph, blockHeight, schemaName, db, txs, evts) {
   const factories = new Map;
@@ -2376,7 +2700,7 @@ async function processBlockWithRetry(subgraph, subgraphName, blockHeight, opts,
       const delay = retryDelaysMs[attempt];
       if (delay === undefined)
         break;
-      logger6.warn("Block processing failed, retrying", {
+      logger7.warn("Block processing failed, retrying", {
         subgraph: subgraphName,
         blockHeight,
         attempt: attempt + 1,
@@ -2408,7 +2732,7 @@ async function processBlock(subgraph, subgraphName, blockHeight, opts) {
   } else {
     const data = (await resolveBlockSource(subgraph).loadBlockRange(blockHeight, blockHeight)).get(blockHeight);
     if (!data) {
-      logger6.debug("Block not found or non-canonical for subgraph processing", {
+      logger7.debug("Block not found or non-canonical for subgraph processing", {
         subgraph: subgraphName,
         blockHeight
       });
@@ -2544,7 +2868,16 @@ async function processBlock(subgraph, subgraphName, blockHeight, opts) {
         }
         const ctx = new SubgraphContext(tx, schemaName, subgraph.schema, blockMeta, initialTx, false, journalEnabled(opts));
         const handlerStart = performance.now();
-        const runResult = await runHandlers(subgraph, matched, ctx);
+        const runResult = sandboxEnabled({
+          sandbox_workers: route.sandboxWorkers
+        }) ? await runHandlersSandboxed({
+          subgraphName,
+          version: route.version,
+          handlerCode: route.handlerCode,
+          hostCtx: ctx,
+          block: blockMeta,
+          matched
+        }) : await runHandlers(subgraph, matched, ctx);
         handlerMs = performance.now() - handlerStart;
         result.processed = runResult.processed;
         result.errors = runResult.errors;
@@ -2570,7 +2903,7 @@ async function processBlock(subgraph, subgraphName, blockHeight, opts) {
       });
     } catch (err) {
       if (err instanceof CursorRaceLostError || err instanceof LiveCursorRaceLostError) {
-        logger6.warn("cursor race lost — block already covered", {
+        logger7.warn("cursor race lost — block already covered", {
           subgraph: subgraphName,
           blockHeight,
           error: err.message
@@ -2596,7 +2929,7 @@ async function processBlock(subgraph, subgraphName, blockHeight, opts) {
         const { rows } = await sql3.raw(`SELECT n_live_tup AS count FROM pg_stat_user_tables WHERE schemaname = '${schemaName}' AND relname = '${table}'`).execute(route.dataDb);
         const count = Number(rows[0]?.count ?? 0);
         if (count >= 1e7) {
-          logger6.warn("Subgraph table exceeds 10M rows (estimate)", {
+          logger7.warn("Subgraph table exceeds 10M rows (estimate)", {
             subgraph: subgraphName,
             table,
             count
@@ -2604,7 +2937,7 @@ async function processBlock(subgraph, subgraphName, blockHeight, opts) {
         }
       }
     } catch (err) {
-      logger6.debug("Row count sample failed", {
+      logger7.debug("Row count sample failed", {
         subgraph: subgraphName,
         error: err instanceof Error ? err.message : String(err)
       });
@@ -2620,8 +2953,9 @@ export {
   processBlockWithRetry,
   processBlock,
   invalidateSubgraphRoute,
+  ByoKeyUnavailableError,
   BLOCK_RETRY_DELAYS_MS
 };
 
-//# debugId=339F2648E4EA97C964756E2164756E21
+//# debugId=B97EC9302707D2CA64756E2164756E21
 //# sourceMappingURL=block-processor.js.map