@mj-biz-apps/common-activity-sync 5.42.0 → 5.44.0

package/dist/ActivitySyncEngine.d.ts

@@ -9,8 +9,11 @@ import { type IMetadataProvider, type UserInfo } from '@memberjunction/core';
 import { BaseActivitySyncProvider } from './BaseActivitySyncProvider.js';
 import { type ExtensionStamp } from './extensions.js';
 import { IdentityResolver } from './identity.js';
+import { type ActivityFileSink } from './attachments.js';
 import { type IQualificationStage, type QualificationPolicy } from './qualification.js';
 import { type SyncRunOptions } from './run.js';
+import { type ActivityContentCipher } from './content-capture.js';
+import type { ActivitySourceKind } from './types.js';
 import { ActivityWriter } from './writer.js';
 export interface SyncEngineResult {
     Success: boolean;
@@ -47,7 +50,10 @@ interface ConnectionRow {
     EndAt: Date | string | null;
     LastSyncAt: Date | string | null;
     ActivitySyncProviderTypeID: string | null;
+    /** Overrides the provider type's default. Null means "use the type's". */
     SkippedContentPolicy: string | null;
+    /** Overrides the provider type's default key. Null means "use the type's". */
+    EncryptionKeyID: string | null;
     Settings: string | null;
 }
 interface ProviderTypeRow {
@@ -63,6 +69,14 @@ interface ProviderTypeRow {
      * runtime and any check against it quietly never fires.
      */
     IsActive: boolean;
+    /**
+     * Audit retention for messages this connector declines to ingest, and the key that protects it.
+     *
+     * Both are the TYPE-level default; a connection overrides either. Neither had a reader before
+     * this change, so "Overridable per connection" described a fallback chain that did not exist.
+     */
+    DefaultSkippedContentPolicy: string | null;
+    DefaultEncryptionKeyID: string | null;
 }
 interface RunSurfaceOptions {
     /** Injected provider (tests). When omitted, resolved from the type row. */
@@ -80,6 +94,12 @@ interface RunSurfaceOptions {
 /**
  * LastError must name the failure, not whatever happened to be Issues[0].
  * Mapping warnings ("Event X had no usable start time") sort ahead of the actual miss.
+ *
+ * NOT TRUNCATED. This used to end `.slice(0, 4000)`, the same inherited habit removed from the run's
+ * issue list: `ActivitySyncConnection.LastError` is NVARCHAR(MAX), and none of the columns this app
+ * writes free text to is 4000 wide. It flattens the issues of EVERY failed surface, so it grows with
+ * the number of failures — a run that fails broadly truncates its own diagnosis, which is the one
+ * occasion the text is worth reading in full.
  */
 export declare function healthErrorFromResults(results: readonly SyncEngineResult[]): string | null;
 /**
@@ -90,11 +110,69 @@ export declare function healthErrorFromResults(results: readonly SyncEngineResul
  * is clean for that row writes null.
  */
 export declare function collapseExtensionStamps(stamps: readonly ExtensionStamp[]): ExtensionStamp[];
+/**
+ * The driver class of the SURFACE being run, which is not always the connection's.
+ *
+ * `RunConnections` drives a second, calendar surface from the same connection and the same type row,
+ * passing the calendar plugin as `source`. Handing `typeRow.DriverClass` to both told a host factory
+ * "Microsoft365" on the calendar pass too, so a factory serving both surfaces could not tell them
+ * apart: it built a MAIL transport for the calendar, fed Graph message payloads to the event mapper,
+ * and every one was dropped for having no start time. That reads as an empty calendar, not as a
+ * wiring fault — which is why it survived until a calendar fixture ran end to end.
+ *
+ * Pure and exported so the mapping can be pinned without standing up a fleet run.
+ */
+export declare function SurfaceDriverClass(kind: ActivitySourceKind, typeRow: {
+    DriverClass?: string | null;
+    CalendarDriverClass?: string | null;
+} | null | undefined, fallback: string): string;
 export declare class ActivitySyncEngine {
     private readonly resolver;
     private readonly writer;
     private readonly stages;
-    constructor(resolver?: IdentityResolver, writer?: ActivityWriter, stages?: IQualificationStage[]);
+    /**
+     * Where attachment BYTES go, when a rule asks for them.
+     *
+     * Optional and injected rather than imported: storing a file needs MJ's FileStorageEngine and
+     * a configured FileStorageAccount, and a host that syncs only metadata should not have to
+     * have either. Absent, an item whose rule wants attachments is reported rather than quietly
+     * filed without them — the distinction this package exists to keep.
+     *
+     * DEFAULTS TO THE HOST REGISTRY, because the only production construction of this class is
+     * `new ActivitySyncEngine()` inside an Action, where nothing can pass one. Without that
+     * default a host could implement the interface and still never be called.
+     */
+    private readonly fileSink;
+    /**
+     * How captured content is protected, when a policy says to keep any.
+     *
+     * Same shape and same reason as `fileSink`: this package implements no crypto, and the only
+     * production construction of this class passes no arguments, so the default has to come from
+     * the host registry or the seam is unreachable. `common-server` fills it at bootstrap.
+     */
+    private readonly cipher;
+    constructor(resolver?: IdentityResolver, writer?: ActivityWriter, stages?: IQualificationStage[], 
+    /**
+     * Where attachment BYTES go, when a rule asks for them.
+     *
+     * Optional and injected rather than imported: storing a file needs MJ's FileStorageEngine and
+     * a configured FileStorageAccount, and a host that syncs only metadata should not have to
+     * have either. Absent, an item whose rule wants attachments is reported rather than quietly
+     * filed without them — the distinction this package exists to keep.
+     *
+     * DEFAULTS TO THE HOST REGISTRY, because the only production construction of this class is
+     * `new ActivitySyncEngine()` inside an Action, where nothing can pass one. Without that
+     * default a host could implement the interface and still never be called.
+     */
+    fileSink?: ActivityFileSink | null, 
+    /**
+     * How captured content is protected, when a policy says to keep any.
+     *
+     * Same shape and same reason as `fileSink`: this package implements no crypto, and the only
+     * production construction of this class passes no arguments, so the default has to come from
+     * the host registry or the seam is unreachable. `common-server` fills it at bootstrap.
+     */
+    cipher?: ActivityContentCipher | null);
     Run(connectionID: string, options: SyncRunOptions, provider: IMetadataProvider, contextUser: UserInfo, source?: BaseActivitySyncProvider, surface?: RunSurfaceOptions): Promise<SyncEngineResult>;
     /**
      * Every Active-or-Error connection, once per surface. This is what a scheduled
@@ -116,6 +194,20 @@ export declare class ActivitySyncEngine {
     private loadRunnableConnections;
     private loadProviderType;
     private loadBoundSetIds;
+    /**
+     * The domains this deployment calls INTERNAL, merged across every rule set bound to the
+     * connection.
+     *
+     * WHY THIS EXISTS. `ActivitySyncRuleSet.InternalDomains` describes itself as "Required for any
+     * rule using ParticipantScope", `participants.ts` names it as where the list lives, and the
+     * engine passed a hard-coded `[]` — so nothing ever read the column. Same shape as the
+     * `CredentialsRef` gap: a column that documents its own purpose, with no reader.
+     *
+     * MALFORMED IS NOT EMPTY. A list that fails to parse fails the run rather than degrading to
+     * `[]`, because `[]` silently inverts every participant rule (see the caller). Parsing itself
+     * lives in {@link ParseInternalDomains} so it is testable without standing up a RunView.
+     */
+    private loadInternalDomains;
     private loadExclusions;
     private loadRules;
     private stampSurfaceWatermark;

package/dist/ActivitySyncEngine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ActivitySyncEngine.d.ts","sourceRoot":"","sources":["../src/ActivitySyncEngine.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAGH,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EAChB,MAAM,sBAAsB,CAAC;AAU9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,OAAO,EAIH,KAAK,cAAc,EACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAUjD,OAAO,EAGH,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAIH,KAAK,cAAc,EACtB,MAAM,UAAU,CAAC;AAWlB,OAAO,EAAE,cAAc,EAAyB,MAAM,aAAa,CAAC;AAEpE,MAAM,WAAW,gBAAgB;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,mBAAmB,EAAE,IAAI,GAAG,IAAI,CAAC;IACjC,MAAM,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,OAAO,EAAE,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;IACpF,MAAM,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,sHAAsH;AACtH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C,UAAU,aAAa;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,+FAA+F;IAC/F,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IACjC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,UAAU,eAAe;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,0BAA0B,EAAE,mBAAmB,CAAC;IAChD,mFAAmF;IACnF,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAC;CACrB;AAED,UAAU,iBAAiB;IACvB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC;;;OAGG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,6DAA6D;IAC7D,OAAO,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;CACpC;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,GAAG,MAAM,GAAG,IAAI,CAK1F;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,GAAG,cAAc,EAAE,CAW3F;AAiBD,qBAAa,kBAAkB;IAEvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,QAAQ,GAAE,gBAAyC,EACnD,MAAM,GAAE,cAAqC,EAC7C,MAAM,GAAE,mBAAmB,EAAiC;IAGpE,GAAG,CACZ,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,QAAQ,EACrB,MAAM,CAAC,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,iBAAiB,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IA2U5B;;;;;;;;OAQG;IACU,cAAc,CACvB,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,QAAQ,GACtB,OAAO,CAAC,cAAc,CAAC;IA6F1B,OAAO,CAAC,aAAa;YAgBP,UAAU;IAoBxB,OAAO,CAAC,gBAAgB;YAaV,cAAc;YAkBd,eAAe;YAsBf,qBAAqB;YA0BrB,cAAc;YAcd,uBAAuB;YAcvB,gBAAgB;YAehB,eAAe;YAmBf,cAAc;YAad,SAAS;YAiBT,qBAAqB;YAoBrB,UAAU;CAuE3B;AAED,wBAAgB,sBAAsB,IAAI,IAAI,CAM7C"}
+{"version":3,"file":"ActivitySyncEngine.d.ts","sourceRoot":"","sources":["../src/ActivitySyncEngine.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAGH,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EAChB,MAAM,sBAAsB,CAAC;AAU9B,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,OAAO,EAIH,KAAK,cAAc,EACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,OAAO,EAA6C,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAUpG,OAAO,EAGH,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EAC3B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAOH,KAAK,cAAc,EACtB,MAAM,UAAU,CAAC;AAClB,OAAO,EAGH,KAAK,qBAAqB,EAC7B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,kBAAkB,EAAkB,MAAM,YAAY,CAAC;AASrE,OAAO,EAAE,cAAc,EAAyB,MAAM,aAAa,CAAC;AAEpE,MAAM,WAAW,gBAAgB;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,mBAAmB,EAAE,IAAI,GAAG,IAAI,CAAC;IACjC,MAAM,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,cAAc;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,OAAO,EAAE,KAAK,CAAC;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;IACpF,MAAM,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,sHAAsH;AACtH,eAAO,MAAM,wBAAwB,MAAM,CAAC;AAE5C,UAAU,aAAa;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,+FAA+F;IAC/F,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,OAAO,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IAC9B,KAAK,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IACjC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,0EAA0E;IAC1E,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,8EAA8E;IAC9E,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,UAAU,eAAe;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,0BAA0B,EAAE,mBAAmB,CAAC;IAChD,mFAAmF;IACnF,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,2BAA2B,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;CACzC;AAED,UAAU,iBAAiB;IACvB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC;;;OAGG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B,6DAA6D;IAC7D,OAAO,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;CACpC;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,SAAS,gBAAgB,EAAE,GAAG,MAAM,GAAG,IAAI,CAK1F;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,cAAc,EAAE,GAAG,cAAc,EAAE,CAW3F;AAkBD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAC9B,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,EAChG,QAAQ,EAAE,MAAM,GACjB,MAAM,CAKR;AAED,qBAAa,kBAAkB;IAEvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAvBN,QAAQ,GAAE,gBAAyC,EACnD,MAAM,GAAE,cAAqC,EAC7C,MAAM,GAAE,mBAAmB,EAAiC;IAC7E;;;;;;;;;;;OAWG;IACc,QAAQ,GAAE,gBAAgB,GAAG,IAA6B;IAC3E;;;;;;OAMG;IACc,MAAM,GAAE,qBAAqB,GAAG,IAAkC;IAG1E,GAAG,CACZ,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,QAAQ,EACrB,MAAM,CAAC,EAAE,wBAAwB,EACjC,OAAO,CAAC,EAAE,iBAAiB,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IA+b5B;;;;;;;;OAQG;IACU,cAAc,CACvB,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,QAAQ,GACtB,OAAO,CAAC,cAAc,CAAC;IAiG1B,OAAO,CAAC,aAAa;YAgBP,UAAU;IAyBxB,OAAO,CAAC,gBAAgB;YAaV,cAAc;YAkBd,eAAe;YAsBf,qBAAqB;YA6BrB,cAAc;YAcd,uBAAuB;YAcvB,gBAAgB;YA6BhB,eAAe;IAmB7B;;;;;;;;;;;;OAYG;YACW,mBAAmB;YA6BnB,cAAc;YAad,SAAS;YAiBT,qBAAqB;YAoBrB,UAAU;CA+J3B;AAED,wBAAgB,sBAAsB,IAAI,IAAI,CAM7C"}

package/dist/ActivitySyncEngine.js

@@ -12,13 +12,16 @@ import { BaseActivitySyncProvider } from './BaseActivitySyncProvider.js';
 import { ACTIVITY_SYNC_ENTITIES } from './entity-names.js';
 import { ExtensionsExtraFilter, RunRegisteredExtensions, } from './extensions.js';
 import { IdentityResolver } from './identity.js';
+import { ParseInternalDomains, ParticipantScopeWarning } from './participants.js';
+import { AttachmentPolicyFor, HostActivityFileSink } from './attachments.js';
 import { DefaultDeterministicStages, } from './stages.js';
 import { FixtureActivitySyncProvider } from './providers/FixtureActivitySyncProvider.js';
 import { MSGraphActivitySyncProvider } from './providers/MSGraphActivitySyncProvider.js';
 import { MSGraphCalendarSyncProvider } from './providers/MSGraphCalendarSyncProvider.js';
 import { DefaultPolicyFromProviderType, RunQualificationCascade, } from './qualification.js';
-import { AsDryRunDecision, IsConnectionActive, } from './run.js';
-import { RequireUUID } from './sql.js';
+import { AsDryRunDecision, IsConnectionActive, ResolveCapturePlan, ResolvePolicy, } from './run.js';
+import { ContentToCapture, HostActivityContentCipher, } from './content-capture.js';
+import { RequireUUID, UuidInList } from './sql.js';
 import { CanAdvanceWatermark, MergeCalendarWatermark, NextWatermark, SurfaceWatermark, } from './watermark.js';
 import { ExclusionsExtraFilter, FromRunView, RulesExtraFilter } from './load.js';
 import { ActivityWriter, StoreBodyFromSettings } from './writer.js';
@@ -27,13 +30,19 @@ export const MAX_RUNNABLE_CONNECTIONS = 500;
 /**
  * LastError must name the failure, not whatever happened to be Issues[0].
  * Mapping warnings ("Event X had no usable start time") sort ahead of the actual miss.
+ *
+ * NOT TRUNCATED. This used to end `.slice(0, 4000)`, the same inherited habit removed from the run's
+ * issue list: `ActivitySyncConnection.LastError` is NVARCHAR(MAX), and none of the columns this app
+ * writes free text to is 4000 wide. It flattens the issues of EVERY failed surface, so it grows with
+ * the number of failures — a run that fails broadly truncates its own diagnosis, which is the one
+ * occasion the text is worth reading in full.
  */
 export function healthErrorFromResults(results) {
     const failed = results.filter((r) => !r.Success);
     if (failed.length === 0)
         return null;
     const issues = failed.flatMap((r) => r.Issues).filter((m) => m.trim().length > 0);
-    return (issues.join(' | ') || 'Activity sync run failed.').slice(0, 4000);
+    return issues.join(' | ') || 'Activity sync run failed.';
 }
 /**
  * One Load+Save per extension row after the batch — not N items × M extensions.
@@ -69,11 +78,52 @@ function failedSurfaceResult(issues) {
         Issues: [...issues],
     };
 }
+/**
+ * The driver class of the SURFACE being run, which is not always the connection's.
+ *
+ * `RunConnections` drives a second, calendar surface from the same connection and the same type row,
+ * passing the calendar plugin as `source`. Handing `typeRow.DriverClass` to both told a host factory
+ * "Microsoft365" on the calendar pass too, so a factory serving both surfaces could not tell them
+ * apart: it built a MAIL transport for the calendar, fed Graph message payloads to the event mapper,
+ * and every one was dropped for having no start time. That reads as an empty calendar, not as a
+ * wiring fault — which is why it survived until a calendar fixture ran end to end.
+ *
+ * Pure and exported so the mapping can be pinned without standing up a fleet run.
+ */
+export function SurfaceDriverClass(kind, typeRow, fallback) {
+    const declared = kind === 'Calendar' ? typeRow?.CalendarDriverClass : typeRow?.DriverClass;
+    // A blank column is not a driver. Falling through to the plugin's own code keeps a
+    // half-configured provider type working as it did rather than serving an empty string.
+    return declared?.trim() ? declared.trim() : fallback;
+}
 export class ActivitySyncEngine {
-    constructor(resolver = new IdentityResolver(), writer = new ActivityWriter(), stages = DefaultDeterministicStages()) {
+    constructor(resolver = new IdentityResolver(), writer = new ActivityWriter(), stages = DefaultDeterministicStages(), 
+    /**
+     * Where attachment BYTES go, when a rule asks for them.
+     *
+     * Optional and injected rather than imported: storing a file needs MJ's FileStorageEngine and
+     * a configured FileStorageAccount, and a host that syncs only metadata should not have to
+     * have either. Absent, an item whose rule wants attachments is reported rather than quietly
+     * filed without them — the distinction this package exists to keep.
+     *
+     * DEFAULTS TO THE HOST REGISTRY, because the only production construction of this class is
+     * `new ActivitySyncEngine()` inside an Action, where nothing can pass one. Without that
+     * default a host could implement the interface and still never be called.
+     */
+    fileSink = HostActivityFileSink(), 
+    /**
+     * How captured content is protected, when a policy says to keep any.
+     *
+     * Same shape and same reason as `fileSink`: this package implements no crypto, and the only
+     * production construction of this class passes no arguments, so the default has to come from
+     * the host registry or the seam is unreachable. `common-server` fills it at bootstrap.
+     */
+    cipher = HostActivityContentCipher()) {
         this.resolver = resolver;
         this.writer = writer;
         this.stages = stages;
+        this.fileSink = fileSink;
+        this.cipher = cipher;
     }
     async Run(connectionID, options, provider, contextUser, source, surface) {
         const stampHealth = surface?.stampHealth ?? true;
@@ -127,6 +177,36 @@ export class ActivitySyncEngine {
             result.Issues.push(`Provider type '${typeRow.Code}' is not active.`);
             return result;
         }
+        /**
+         * AUDIT RETENTION IS SETTLED BEFORE ANYTHING IS READ, not at persist time.
+         *
+         * `ResolveCapturePlan` refuses a policy above `None` with no key, and refusing AFTER a
+         * mailbox has been read is the wrong order: it costs a fetch, and the run then has content it
+         * has been told it may not keep. Deciding here means a misconfigured connection stops before
+         * it touches anyone's mail.
+         *
+         * Failing the run rather than reporting and carrying on is what the policy asks for. An
+         * operator who set this asked for the record to exist; producing runs that look successful
+         * while retaining nothing is the failure this subsystem is written against, and it is exactly
+         * what happened before this was wired at all.
+         */
+        let capture;
+        try {
+            capture = ResolveCapturePlan(ResolvePolicy(typeRow?.DefaultSkippedContentPolicy ?? 'None', connection.SkippedContentPolicy), connection.EncryptionKeyID ?? typeRow?.DefaultEncryptionKeyID ?? null);
+        }
+        catch (err) {
+            result.Issues.push(String(err instanceof Error ? err.message : err));
+            return result;
+        }
+        if (capture.Capture !== 'None' && !this.cipher) {
+            // The ActivityFileSink lesson, applied. A host that asked for retention and cannot
+            // encrypt must not quietly proceed: plaintext is forbidden outright, and writing nothing
+            // would leave the operator believing an audit trail exists.
+            result.Issues.push(`SkippedContentPolicy is "${capture.Capture === 'Subject' ? 'SubjectEncrypted' : 'FullEncrypted'}" ` +
+                'but this host registered no content cipher, so captured content could not be encrypted. ' +
+                'Call RegisterActivityContentCipher() at bootstrap, or set the policy to "None".');
+            return result;
+        }
         // Missing type row: the cascade still needs a default, and that default is
         // Exclude — never `?? 'Include'`.
         const defaultPolicy = DefaultPolicyFromProviderType(typeRow?.DefaultQualificationPolicy);
@@ -140,10 +220,21 @@ export class ActivitySyncEngine {
         // Tell the plugin which connection this run is for BEFORE it fetches. This is the only
         // moment it can learn which credential the connection named: ClassFactory builds plugins
         // with no arguments, so nothing is injectable at construction.
+        // THE DRIVER CLASS OF THE SURFACE BEING RUN, not of the connection.
+        //
+        // `RunConnections` drives a second, CALENDAR surface from the same connection and the same
+        // type row, passing the calendar plugin as `source`. Handing `typeRow.DriverClass` to both
+        // told a host factory "Microsoft365" for the calendar pass as well, so a factory serving both
+        // surfaces could not tell them apart and built a MAIL transport for the calendar — which then
+        // fed Graph message payloads to the event mapper, and every one was dropped for having no
+        // start time. It read as an empty calendar rather than as a wiring fault.
+        //
+        // The plugin already knows which surface it is; that is what `Kind` is for.
+        const surfaceDriver = SurfaceDriverClass(plugin.Kind, typeRow, plugin.ProviderTypeCode);
         plugin.Configure({
             CredentialsRef: connection.CredentialsRef ?? null,
             Mailbox: connection.Mailbox ?? null,
-            DriverClass: typeRow?.DriverClass ?? plugin.ProviderTypeCode,
+            DriverClass: surfaceDriver,
             ContextUser: contextUser,
         });
         const sourceSystem = typeRow?.Code ?? plugin.ProviderTypeCode;
@@ -174,13 +265,27 @@ export class ActivitySyncEngine {
         if (rules.Failed) {
             return this.failClosed(connection, options, result, since, provider, contextUser, rules.Issue, stampHealth);
         }
+        const internalDomains = await this.loadInternalDomains(bound.Rows, contextUser);
+        if (internalDomains.Failed) {
+            return this.failClosed(connection, options, result, since, provider, contextUser, internalDomains.Issue, stampHealth);
+        }
+        // A rule that tests participants against NO domain list does not filter — it INVERTS.
+        // `ClassifyParticipants` counts an address as Internal only when its domain is in the list,
+        // so an empty list makes every participant External: `HasExternal` matches everything,
+        // including the purely internal chatter it exists to keep out, and `AllInternal` matches
+        // nothing. That reads as a working filter and is the opposite of one, so it is reported
+        // rather than left to look like a quiet pass.
+        const scopeWarning = ParticipantScopeWarning(rules.Rows, internalDomains.Rows);
+        if (scopeWarning) {
+            result.Issues.push(scopeWarning);
+        }
         const allParticipants = batch.Items.flatMap((i) => i.Participants);
         const extensionStamps = [];
         const identities = await this.resolver.Resolve(allParticipants, contextUser);
         if (identities.LookupFailed) {
             result.Failed += batch.Items.length;
             result.Issues.push('ContactMethod lookup failed — watermark will not advance.');
-            await this.persistRun(connection, options, result, since, null, provider, contextUser, []);
+            await this.persistRun(connection, options, result, since, null, provider, contextUser, capture, []);
             if (!options.DryRun && stampHealth) {
                 await this.stampConnectionHealth(connection.ID, false, 'ContactMethod lookup failed — watermark will not advance.', contextUser, provider);
             }
@@ -193,7 +298,7 @@ export class ActivitySyncEngine {
                 ProviderTypeCode: sourceSystem,
                 Exclusions: exclusions.Rows,
                 Rules: rules.Rows,
-                InternalDomains: [],
+                InternalDomains: internalDomains.Rows,
                 KnownAddresses: identities.Known,
             };
             let verdict;
@@ -255,6 +360,35 @@ export class ActivitySyncEngine {
                 });
                 continue;
             }
+            // ATTACHMENTS, decided from the rule that actually decided this item.
+            //
+            // `ActivitySyncRule.IncludeAttachments` and `MaxAttachmentBytes` had no reader at all:
+            // a rule that asked for attachments got none and said nothing. The decision is made
+            // here, where both the winning rule and the item are in scope for the first time.
+            //
+            // The BYTES are not moved yet — that needs a file sink, and this host has no
+            // FileStorageAccount configured, so there is nowhere to put them. What changed is that
+            // the request is now honoured or REPORTED, instead of silently discarded.
+            const decidingRule = verdict.ActivitySyncRuleID
+                ? rules.Rows.find((r) => r.ID === verdict.ActivitySyncRuleID)
+                : null;
+            const attachmentPolicy = AttachmentPolicyFor(decidingRule, item);
+            if (attachmentPolicy.Fetch && !this.fileSink) {
+                result.Issues.push(`Item ${item.ExternalID}: its rule asks for attachments, but no ActivityFile sink is ` +
+                    'registered in this host, so none were stored. Register one at bootstrap, or turn ' +
+                    'IncludeAttachments off so the rule stops claiming something that is not happening.');
+            }
+            else if (attachmentPolicy.Fetch) {
+                // A sink IS registered, and `ActivityFileSink.Store` still has no caller: selection and
+                // transfer are written (`SelectAttachments`, `AttachmentSkipReport`) but not yet wired to
+                // it. Saying so is the entire point of the branch above — leaving this case silent would
+                // reward a host for filling the seam correctly with exactly the quiet nothing that the
+                // rest of this work exists to remove, and it is the more misleading of the two, because
+                // everything on the host's side is right.
+                result.Issues.push(`Item ${item.ExternalID}: its rule asks for attachments and a sink is registered, but ` +
+                    'attachment transfer is not implemented yet, so none were stored. This is a gap in ' +
+                    'Activity Sync, not in the host configuration.');
+            }
             const sourceValue = plugin.IsLive ? 'Integration' : 'System';
             const written = await this.writer.Write({
                 Item: item,
@@ -326,7 +460,7 @@ export class ActivitySyncEngine {
                 result.Issues.push('Failed to persist the surface watermark — it will not advance.');
             }
         }
-        await this.persistRun(connection, options, result, since, options.DryRun ? null : result.WatermarkAdvancedTo, provider, contextUser, details);
+        await this.persistRun(connection, options, result, since, options.DryRun ? null : result.WatermarkAdvancedTo, provider, contextUser, capture, details);
         result.Success = result.Failed === 0;
         if (!options.DryRun && stampHealth) {
             await this.stampConnectionHealth(connectionID, result.Success, healthErrorFromResults([result]), contextUser, provider);
@@ -382,9 +516,12 @@ export class ActivitySyncEngine {
                 typeRow,
             });
             fleet.Results.push({ ConnectionID: connection.ID, Surface: 'primary', Result: primary });
+            // Issues travel whether or not the surface succeeded; only `Success` keys on failure. The
+            // previous shape meant a caller inspecting `fleet.Issues` saw nothing from a run that
+            // completed with warnings, which is most of what this engine has to say.
+            fleet.Issues.push(...primary.Issues);
             if (!primary.Success) {
                 fleet.Success = false;
-                fleet.Issues.push(...primary.Issues);
             }
             const surfaces = [primary];
             const calendarDriver = typeRow?.CalendarDriverClass?.trim();
@@ -407,9 +544,10 @@ export class ActivitySyncEngine {
                         source: calendarPlugin,
                     });
                     fleet.Results.push({ ConnectionID: connection.ID, Surface: 'Calendar', Result: calendar });
+                    // Same as the primary surface above: issues travel regardless of success.
+                    fleet.Issues.push(...calendar.Issues);
                     if (!calendar.Success) {
                         fleet.Success = false;
-                        fleet.Issues.push(...calendar.Issues);
                     }
                     surfaces.push(calendar);
                 }
@@ -440,7 +578,12 @@ export class ActivitySyncEngine {
         result.Failed += result.Fetched;
         if (result.Failed < 1)
             result.Failed = 1;
-        await this.persistRun(connection, options, result, since, null, provider, contextUser, []);
+        // No capture plan, and none needed: this path writes ZERO run details, so there is no row for
+        // content to land on. Reaching for the connection's real policy here would be a decision
+        // dressed up as caution — this method exists to record a run that never got as far as
+        // deciding anything about a message.
+        const noCapture = { Capture: 'None', EncryptionKeyID: null };
+        await this.persistRun(connection, options, result, since, null, provider, contextUser, noCapture, []);
         if (!options.DryRun && stampHealth) {
             await this.stampConnectionHealth(connection.ID, false, issue, contextUser, provider);
         }
@@ -495,7 +638,10 @@ export class ActivitySyncEngine {
             }
             else {
                 row.Status = 'Error';
-                row.LastError = (error ?? 'Activity sync run failed.').slice(0, 4000);
+                // Not truncated here either. Removing the cap from `healthErrorFromResults` and
+                // leaving it on the only write site would have changed nothing an operator can
+                // see — the column is NVARCHAR(MAX), and this is where the text lands.
+                row.LastError = error ?? 'Activity sync run failed.';
             }
             await row.Save();
         }
@@ -528,7 +674,21 @@ export class ActivitySyncEngine {
         const res = await rv.RunView({
             EntityName: ACTIVITY_SYNC_ENTITIES.ProviderTypes,
             ExtraFilter: `ID = '${RequireUUID(id, 'ActivitySyncProviderTypeID')}'`,
-            Fields: ['ID', 'Code', 'DriverClass', 'DefaultQualificationPolicy', 'CalendarDriverClass', 'IsActive'],
+            // Every name here must match ProviderTypeRow exactly, both ways round. The docblock
+            // there is not decoration: a field declared and not listed reads `undefined`, and a
+            // capture policy that reads undefined silently means "None". A test pins the two
+            // lists against each other, and it parses this array literally -- keep comments out
+            // of it.
+            Fields: [
+                'ID',
+                'Code',
+                'DriverClass',
+                'DefaultQualificationPolicy',
+                'CalendarDriverClass',
+                'IsActive',
+                'DefaultSkippedContentPolicy',
+                'DefaultEncryptionKeyID',
+            ],
             MaxRows: 1,
             ResultType: 'simple',
         }, user);
@@ -549,6 +709,44 @@ export class ActivitySyncEngine {
             Rows: (bound.Results ?? []).map((r) => r.ActivitySyncRuleSetID),
         };
     }
+    /**
+     * The domains this deployment calls INTERNAL, merged across every rule set bound to the
+     * connection.
+     *
+     * WHY THIS EXISTS. `ActivitySyncRuleSet.InternalDomains` describes itself as "Required for any
+     * rule using ParticipantScope", `participants.ts` names it as where the list lives, and the
+     * engine passed a hard-coded `[]` — so nothing ever read the column. Same shape as the
+     * `CredentialsRef` gap: a column that documents its own purpose, with no reader.
+     *
+     * MALFORMED IS NOT EMPTY. A list that fails to parse fails the run rather than degrading to
+     * `[]`, because `[]` silently inverts every participant rule (see the caller). Parsing itself
+     * lives in {@link ParseInternalDomains} so it is testable without standing up a RunView.
+     */
+    async loadInternalDomains(setIds, user) {
+        if (setIds.length === 0) {
+            return { Failed: false, Rows: [] };
+        }
+        const rv = new RunView();
+        const res = await rv.RunView({
+            EntityName: ACTIVITY_SYNC_ENTITIES.RuleSets,
+            ExtraFilter: `ID IN (${UuidInList(setIds, 'ActivitySyncRuleSetID')})`,
+            Fields: ['ID', 'Name', 'InternalDomains'],
+            ResultType: 'simple',
+        }, user);
+        if (!res.Success) {
+            return { Failed: true, Issue: 'ActivitySyncRuleSet lookup failed.' };
+        }
+        const domains = new Set();
+        for (const row of res.Results ?? []) {
+            const parsed = ParseInternalDomains(row.InternalDomains, row.Name);
+            if (!parsed.Ok) {
+                return { Failed: true, Issue: parsed.Issue };
+            }
+            for (const d of parsed.Domains)
+                domains.add(d);
+        }
+        return { Failed: false, Rows: [...domains] };
+    }
     async loadExclusions(setIds, user) {
         const rv = new RunView();
         const res = await rv.RunView({
@@ -579,7 +777,7 @@ export class ActivitySyncEngine {
         }
         return row.Save();
     }
-    async persistRun(connection, options, result, watermarkBefore, watermarkAfter, provider, user, details) {
+    async persistRun(connection, options, result, watermarkBefore, watermarkAfter, provider, user, capture, details) {
         try {
             const run = await provider.GetEntityObject(ACTIVITY_SYNC_ENTITIES.Runs, user);
             run.NewRecord();
@@ -597,6 +795,31 @@ export class ActivitySyncEngine {
             run.StartedAt = new Date();
             run.EndedAt = new Date();
             run.Status = result.Failed > 0 ? 'Failed' : 'Completed';
+            /**
+             * EVERY ISSUE IS RECORDED, INCLUDING ON A RUN THAT SUCCEEDED.
+             *
+             * This row used to keep none of them. `healthErrorFromResults` filters to `!r.Success` and
+             * the fleet collected issues only from failed surfaces, so a warning raised by a run that
+             * completed existed in an in-memory array and nowhere else. That silently discarded the
+             * ENTIRE delivery mechanism for several deliberate reports: the attachment gap a rule asked
+             * for and no sink could fill, the participant-scope warning, the capped-read notice, and the
+             * calendar's first-run lookback bound. Each was written to be seen, and none could be.
+             *
+             * The column is named ErrorMessage and these are not all errors. Recording them here is
+             * still right: it is the run's only free-text column, it is NVARCHAR(MAX), and a warning
+             * nobody can read is worth less than one filed under an imperfect name. Connection HEALTH
+             * stays keyed on failure — a warned run must not make a working connection look broken.
+             *
+             * NOT TRUNCATED, and neither is anything else this engine writes any more. Three writes
+             * capped free text against MAX columns — this one and `LastError` at 4000, the run detail's
+             * `Reason` at 500 — an inherited habit rather than a constraint, since none of the columns is
+             * that wide. It cost nothing while each held a single failure message. This one is the first
+             * that GROWS WITH THE ITEM COUNT: the attachment gap is reported once per item at roughly
+             * 250-320 characters, so a fifty-item run would lose most of its tail, in the field this
+             * commit added so those warnings could be read at all. The other two came off with it, and
+             * each has a mutant putting it back.
+             */
+            run.ErrorMessage = result.Issues.length > 0 ? result.Issues.join(' | ') : null;
             if (!(await run.Save())) {
                 result.Issues.push(run.LatestResult?.CompleteMessage ?? 'ActivitySyncRun.Save failed.');
                 return;
@@ -611,10 +834,67 @@ export class ActivitySyncEngine {
                 row.OccurredAt = detail.Item.StartedAt;
                 row.Decision = options.DryRun ? AsDryRunDecision(detail.Decision) : detail.Decision;
                 row.DecidedByStage = detail.Stage;
-                row.Reason = detail.Reason.slice(0, 500);
+                /**
+                 * The third cap, and the same finding as the other two: `Reason` is NVARCHAR(MAX) and
+                 * this sliced it at 500. It matters most for the decision this feature is about — a
+                 * `Failed` detail's Reason is the writer's issues joined, and it sits beside
+                 * `CapturedContent` as the explanation of why the message was not filed. Losing the tail
+                 * of that leaves an audit row holding content and no usable account of the failure.
+                 */
+                row.Reason = detail.Reason;
                 row.ActivitySyncRuleID = detail.RuleID ?? null;
                 row.ActivitySyncExclusionID = detail.ExclusionID ?? null;
                 row.ActivityID = detail.Decision === 'Included' ? (detail.ActivityID ?? null) : null;
+                /**
+                 * CAPTURED CONTENT, for messages this run declined to file.
+                 *
+                 * Only on a real skip. `Included` has an Activity carrying the content already, and a
+                 * DRY RUN decided nothing — `WouldExclude` is a preview, and writing ciphertext for a
+                 * message the engine has not actually declined would put real content behind a
+                 * retention policy on the strength of a rehearsal.
+                 *
+                 * `Failed` is deliberately included: a message that could not be written is exactly
+                 * the one an auditor asks about, and it is the case where nothing else holds a copy.
+                 *
+                 * ── `Duplicate` IS EXCLUDED, FOR THE SAME REASON AS `Included` ────────────────────
+                 *
+                 * A duplicate is filed. The writer reports `AlreadyPresent` and the detail carries
+                 * `ActivityID`, so the content is already retrievable from the Activity holding it —
+                 * which is precisely the argument that keeps `Included` out. Capturing it puts an
+                 * encrypted second copy of ordinary filed mail in a column meant for messages that were
+                 * NOT filed, and `row.ActivityID` is nulled for every non-`Included` decision, so that
+                 * copy would not even link back to the Activity holding the same text.
+                 *
+                 * The cost is not theoretical. The calendar window ignores `Since` and is always
+                 * `[now - 30d, now + 30d]`, so every run re-reads the whole window and every event
+                 * already filed comes back a duplicate. A meeting sits in that window across roughly
+                 * sixty daily runs: one files it, the rest would re-encrypt its subject and body onto a
+                 * fresh run-detail row each time. Under `FullEncrypted` that is about sixty encrypted
+                 * copies of every meeting.
+                 *
+                 * It was captured until golive#116's follow-up review asked whether that was deliberate.
+                 * It was not.
+                 *
+                 * Ciphertext and key are written together or not at all, mirroring
+                 * CK_ActivitySyncRunDetail_ContentKey. Encryption failing is reported and the row is
+                 * still saved without content: losing the whole run record because one message could
+                 * not be encrypted would be a worse trade than an audit gap that says so.
+                 */
+                const skipped = detail.Decision === 'Excluded' || detail.Decision === 'Failed';
+                if (capture.Capture !== 'None' && skipped && !options.DryRun && this.cipher && capture.EncryptionKeyID) {
+                    const plaintext = ContentToCapture(capture.Capture, detail.Item);
+                    if (plaintext !== null) {
+                        try {
+                            row.CapturedContent = await this.cipher.Encrypt(plaintext, capture.EncryptionKeyID, user);
+                            row.EncryptionKeyID = capture.EncryptionKeyID;
+                        }
+                        catch (err) {
+                            result.Issues.push(`Could not encrypt captured content for ${detail.Item.ExternalID}: ` +
+                                `${err instanceof Error ? err.message : String(err)}. The decision was recorded; ` +
+                                'the content was not.');
+                        }
+                    }
+                }
                 if (!(await row.Save())) {
                     result.Issues.push(row.LatestResult?.CompleteMessage ??
                         `ActivitySyncRunDetail.Save failed for ${detail.Item.ExternalID}.`);