@secondlayer/subgraphs 3.24.2 → 3.24.3

package/dist/src/runtime/reorg.js

@@ -1627,6 +1627,7 @@ function matchSources(sources, transactions, events, traitContracts = new Map, f
 }
 
 // src/runtime/block-processor.ts
+import { secretsKeyAvailable } from "@secondlayer/shared/crypto/secrets";
 import { getTargetDb } from "@secondlayer/shared/db";
 import { resolveTraitContractIds } from "@secondlayer/shared/db/queries/contracts";
 import { advanceOperationCursor } from "@secondlayer/shared/db/queries/subgraph-operations";
@@ -2564,12 +2565,22 @@ async function refreshMatcher(db) {
 
 // src/runtime/block-processor.ts
 var routeCache = new Map;
+
+class ByoKeyUnavailableError extends Error {
+  constructor(subgraphName) {
+    super(`subgraph ${subgraphName} is BYO (database_url_enc set) but this process has no SECONDLAYER_SECRETS_KEY — the subgraph processor deliberately does not hold it (f072). Route BYO subgraphs to a process that does, or unset BYO.`);
+    this.name = "ByoKeyUnavailableError";
+  }
+}
 async function resolveRoute(subgraphName, targetDb) {
   const cached = routeCache.get(subgraphName);
   if (cached)
     return cached;
   const row = await targetDb.selectFrom("subgraphs").selectAll().where("name", "=", subgraphName).executeTakeFirst();
   const byo = row ? isByoSubgraph(row) : false;
+  if (row && byo && !secretsKeyAvailable()) {
+    throw new ByoKeyUnavailableError(subgraphName);
+  }
   const route = {
     schemaName: row?.schema_name ?? pgSchemaName(subgraphName),
     dataDb: row && byo ? resolveSubgraphDb(row) : targetDb,
@@ -3398,5 +3409,5 @@ export {
   handleSubgraphReorg
 };
 
-//# debugId=8717C174F5E08EB264756E2164756E21
+//# debugId=E41A1A11273A69DD64756E2164756E21
 //# sourceMappingURL=reorg.js.map