@secondlayer/subgraphs 3.24.2 → 3.24.3

package/dist/src/runtime/block-processor.d.ts

@@ -366,6 +366,17 @@ type EventRecord = {
 };
 import { Database as Database2 } from "@secondlayer/shared/db";
 import { Kysely as Kysely2, Transaction } from "kysely";
+/** f072: thrown by `resolveRoute` when a BYO subgraph needs its user-DB
+*  connection decrypted but this process holds no `SECONDLAYER_SECRETS_KEY`
+*  — the subgraph processor deliberately does not hold the master key (it
+*  runs untrusted handler code in-process, every block; see f049 site 3 /
+*  the sandbox spike doc's D3). Deny by default, fail loud: this must NEVER
+*  be caught and silently rerouted to the managed target DB, since that
+*  would write a tenant's rows into ours — far worse than halting the
+*  block. */
+declare class ByoKeyUnavailableError extends Error {
+	constructor(subgraphName: string);
+}
 /** Drop a subgraph's cached route — call on redeploy/delete (conn may
 *  change). Also evicts any warm sandbox subprocess for this subgraph
 *  (f071 Stage A `host.ts`) on the same edge: a redeploy can change
@@ -480,4 +491,4 @@ declare const BLOCK_RETRY_DELAYS_MS: number[];
 */
 declare function processBlockWithRetry(subgraph: SubgraphDefinition, subgraphName: string, blockHeight: number, opts?: ProcessBlockOptions, retryDelaysMs?: number[]): Promise<ProcessBlockResult>;
 declare function processBlock(subgraph: SubgraphDefinition, subgraphName: string, blockHeight: number, opts?: ProcessBlockOptions): Promise<ProcessBlockResult>;
-export { resolveFactoryContracts, processBlockWithRetry, processBlock, invalidateSubgraphRoute, ProcessBlockTiming, ProcessBlockResult, ProcessBlockOptions, PreloadedBlockData, BLOCK_RETRY_DELAYS_MS };
+export { resolveFactoryContracts, processBlockWithRetry, processBlock, invalidateSubgraphRoute, ProcessBlockTiming, ProcessBlockResult, ProcessBlockOptions, PreloadedBlockData, ByoKeyUnavailableError, BLOCK_RETRY_DELAYS_MS };

package/dist/src/runtime/block-processor.js

@@ -1627,6 +1627,7 @@ function matchSources(sources, transactions, events, traitContracts = new Map, f
 }
 
 // src/runtime/block-processor.ts
+import { secretsKeyAvailable } from "@secondlayer/shared/crypto/secrets";
 import { getTargetDb } from "@secondlayer/shared/db";
 import { resolveTraitContractIds } from "@secondlayer/shared/db/queries/contracts";
 import { advanceOperationCursor } from "@secondlayer/shared/db/queries/subgraph-operations";
@@ -2564,12 +2565,22 @@ async function refreshMatcher(db) {
 
 // src/runtime/block-processor.ts
 var routeCache = new Map;
+
+class ByoKeyUnavailableError extends Error {
+  constructor(subgraphName) {
+    super(`subgraph ${subgraphName} is BYO (database_url_enc set) but this process has no SECONDLAYER_SECRETS_KEY — the subgraph processor deliberately does not hold it (f072). Route BYO subgraphs to a process that does, or unset BYO.`);
+    this.name = "ByoKeyUnavailableError";
+  }
+}
 async function resolveRoute(subgraphName, targetDb) {
   const cached = routeCache.get(subgraphName);
   if (cached)
     return cached;
   const row = await targetDb.selectFrom("subgraphs").selectAll().where("name", "=", subgraphName).executeTakeFirst();
   const byo = row ? isByoSubgraph(row) : false;
+  if (row && byo && !secretsKeyAvailable()) {
+    throw new ByoKeyUnavailableError(subgraphName);
+  }
   const route = {
     schemaName: row?.schema_name ?? pgSchemaName(subgraphName),
     dataDb: row && byo ? resolveSubgraphDb(row) : targetDb,
@@ -2942,8 +2953,9 @@ export {
   processBlockWithRetry,
   processBlock,
   invalidateSubgraphRoute,
+  ByoKeyUnavailableError,
   BLOCK_RETRY_DELAYS_MS
 };
 
-//# debugId=7DCA5B46BE5FE59C64756E2164756E21
+//# debugId=B97EC9302707D2CA64756E2164756E21
 //# sourceMappingURL=block-processor.js.map