@secondlayer/subgraphs 3.24.2 → 3.25.0

package/dist/src/runtime/block-processor.d.ts

@@ -366,6 +366,17 @@ type EventRecord = {
 };
 import { Database as Database2 } from "@secondlayer/shared/db";
 import { Kysely as Kysely2, Transaction } from "kysely";
+/** f072: thrown by `resolveRoute` when a BYO subgraph needs its user-DB
+*  connection decrypted but this process holds no `SECONDLAYER_SECRETS_KEY`
+*  — the subgraph processor deliberately does not hold the master key (it
+*  runs untrusted handler code in-process, every block; see f049 site 3 /
+*  the sandbox spike doc's D3). Deny by default, fail loud: this must NEVER
+*  be caught and silently rerouted to the managed target DB, since that
+*  would write a tenant's rows into ours — far worse than halting the
+*  block. */
+declare class ByoKeyUnavailableError extends Error {
+	constructor(subgraphName: string);
+}
 /** Drop a subgraph's cached route — call on redeploy/delete (conn may
 *  change). Also evicts any warm sandbox subprocess for this subgraph
 *  (f071 Stage A `host.ts`) on the same edge: a redeploy can change
@@ -480,4 +491,4 @@ declare const BLOCK_RETRY_DELAYS_MS: number[];
 */
 declare function processBlockWithRetry(subgraph: SubgraphDefinition, subgraphName: string, blockHeight: number, opts?: ProcessBlockOptions, retryDelaysMs?: number[]): Promise<ProcessBlockResult>;
 declare function processBlock(subgraph: SubgraphDefinition, subgraphName: string, blockHeight: number, opts?: ProcessBlockOptions): Promise<ProcessBlockResult>;
-export { resolveFactoryContracts, processBlockWithRetry, processBlock, invalidateSubgraphRoute, ProcessBlockTiming, ProcessBlockResult, ProcessBlockOptions, PreloadedBlockData, BLOCK_RETRY_DELAYS_MS };
+export { resolveFactoryContracts, processBlockWithRetry, processBlock, invalidateSubgraphRoute, ProcessBlockTiming, ProcessBlockResult, ProcessBlockOptions, PreloadedBlockData, ByoKeyUnavailableError, BLOCK_RETRY_DELAYS_MS };

package/dist/src/runtime/block-processor.js

@@ -27,6 +27,13 @@ var TYPE_MAP = {
   timestamp: "TIMESTAMPTZ",
   jsonb: "JSONB"
 };
+var MAX_IDENT_BYTES = 63;
+function safeIndexName(name) {
+  if (name.length <= MAX_IDENT_BYTES)
+    return name;
+  const hash = createHash("sha256").update(name).digest("hex").slice(0, 8);
+  return `${name.slice(0, MAX_IDENT_BYTES - hash.length - 1)}_${hash}`;
+}
 function escapeLiteralDefault(value) {
   if (value === null || value === undefined)
     return "NULL";
@@ -69,6 +76,7 @@ function emitTableDDL(schemaName, tableName, tableDef) {
   for (const [colName, col] of Object.entries(tableDef.columns)) {
     if (col.indexed) {
       statements.push(`CREATE INDEX IF NOT EXISTS ${quotePgIdent(`idx_${schemaName}_${tableName}_${colName}`)} ON ${qualifiedName} (${quotePgIdent(colName)})`);
+      statements.push(`CREATE INDEX IF NOT EXISTS ${quotePgIdent(safeIndexName(`idx_${schemaName}_${tableName}_${colName}_id`))} ON ${qualifiedName} (${quotePgIdent(colName)}, ${quotePgIdent("_id")})`);
     }
   }
   for (const [colName, col] of Object.entries(tableDef.columns)) {
@@ -1627,6 +1635,7 @@ function matchSources(sources, transactions, events, traitContracts = new Map, f
 }
 
 // src/runtime/block-processor.ts
+import { secretsKeyAvailable } from "@secondlayer/shared/crypto/secrets";
 import { getTargetDb } from "@secondlayer/shared/db";
 import { resolveTraitContractIds } from "@secondlayer/shared/db/queries/contracts";
 import { advanceOperationCursor } from "@secondlayer/shared/db/queries/subgraph-operations";
@@ -2564,12 +2573,22 @@ async function refreshMatcher(db) {
 
 // src/runtime/block-processor.ts
 var routeCache = new Map;
+
+class ByoKeyUnavailableError extends Error {
+  constructor(subgraphName) {
+    super(`subgraph ${subgraphName} is BYO (database_url_enc set) but this process has no SECONDLAYER_SECRETS_KEY — the subgraph processor deliberately does not hold it (f072). Route BYO subgraphs to a process that does, or unset BYO.`);
+    this.name = "ByoKeyUnavailableError";
+  }
+}
 async function resolveRoute(subgraphName, targetDb) {
   const cached = routeCache.get(subgraphName);
   if (cached)
     return cached;
   const row = await targetDb.selectFrom("subgraphs").selectAll().where("name", "=", subgraphName).executeTakeFirst();
   const byo = row ? isByoSubgraph(row) : false;
+  if (row && byo && !secretsKeyAvailable()) {
+    throw new ByoKeyUnavailableError(subgraphName);
+  }
   const route = {
     schemaName: row?.schema_name ?? pgSchemaName(subgraphName),
     dataDb: row && byo ? resolveSubgraphDb(row) : targetDb,
@@ -2942,8 +2961,9 @@ export {
   processBlockWithRetry,
   processBlock,
   invalidateSubgraphRoute,
+  ByoKeyUnavailableError,
   BLOCK_RETRY_DELAYS_MS
 };
 
-//# debugId=7DCA5B46BE5FE59C64756E2164756E21
+//# debugId=A128B38411DC574B64756E2164756E21
 //# sourceMappingURL=block-processor.js.map