@rotorsoft/act-sqlite 1.4.0 → 1.4.2

package/dist/index.js

@@ -3,6 +3,8 @@ import { createClient } from "@libsql/client";
 var DEFAULT_CONFIG = {
   url: "file::memory:"
 };
+var parse_pii = (raw) => raw == null ? null : JSON.parse(raw);
+var stringify_pii = (pii) => pii == null ? null : JSON.stringify(pii);
 function streamPatternToLike(input) {
   let s = input;
   const start = s.startsWith("^");
@@ -33,9 +35,14 @@ var SqliteStore = class {
         data TEXT NOT NULL,
         meta TEXT NOT NULL,
         created TEXT NOT NULL,
+        pii TEXT,
         UNIQUE(stream, version)
       )
     `);
+    try {
+      await this.client.execute("ALTER TABLE events ADD COLUMN pii TEXT");
+    } catch {
+    }
     await this.client.execute(
       "CREATE INDEX IF NOT EXISTS idx_events_stream ON events(stream)"
     );
@@ -87,33 +94,34 @@ var SqliteStore = class {
   async commit(stream, msgs, meta, expectedVersion) {
     const tx = await this.client.transaction("write");
     try {
-      const versionRow = await tx.execute({
+      const version_row = await tx.execute({
         sql: "SELECT COALESCE(MAX(version), -1) as v FROM events WHERE stream = ?",
         args: [stream]
       });
-      const currentVersion = Number(versionRow.rows[0].v);
-      if (typeof expectedVersion === "number" && currentVersion !== expectedVersion) {
+      const current_version = Number(version_row.rows[0].v);
+      if (typeof expectedVersion === "number" && current_version !== expectedVersion) {
         const { ConcurrencyError } = await import("@rotorsoft/act");
         throw new ConcurrencyError(
           stream,
-          currentVersion,
+          current_version,
           msgs,
           expectedVersion
         );
       }
       const now = (/* @__PURE__ */ new Date()).toISOString();
       const committed = [];
-      let version = currentVersion + 1;
-      for (const { name, data } of msgs) {
+      let version = current_version + 1;
+      for (const { name, data, pii } of msgs) {
         const result = await tx.execute({
-          sql: "INSERT INTO events (stream, version, name, data, meta, created) VALUES (?, ?, ?, ?, ?, ?)",
+          sql: "INSERT INTO events (stream, version, name, data, meta, created, pii) VALUES (?, ?, ?, ?, ?, ?, ?)",
           args: [
             stream,
             version,
             name,
             JSON.stringify(data),
             JSON.stringify(meta),
-            now
+            now,
+            stringify_pii(pii)
           ]
         });
         committed.push({
@@ -123,7 +131,8 @@ var SqliteStore = class {
           created: new Date(now),
           name,
           data,
-          meta
+          meta,
+          ...pii == null ? {} : { pii }
         });
         version++;
       }
@@ -190,7 +199,8 @@ var SqliteStore = class {
           created: new Date(row.created),
           name: row.name,
           data: JSON.parse(row.data),
-          meta: JSON.parse(row.meta)
+          meta: JSON.parse(row.meta),
+          pii: parse_pii(row.pii)
         })
       );
       count++;
@@ -246,10 +256,10 @@ var SqliteStore = class {
     const tx = await this.client.transaction("write");
     try {
       const now = (/* @__PURE__ */ new Date()).toISOString();
-      const laneClause = lane !== void 0 ? " AND lane = ?" : "";
+      const lane_clause = lane !== void 0 ? " AND lane = ?" : "";
       const result = await tx.execute({
         sql: `SELECT stream, source, at, priority, lane FROM streams
-              WHERE blocked = 0 AND (leased_until IS NULL OR leased_until <= ?)${laneClause}
+              WHERE blocked = 0 AND (leased_until IS NULL OR leased_until <= ?)${lane_clause}
               ORDER BY priority DESC, at ASC`,
         args: lane !== void 0 ? [now, lane] : [now]
       });
@@ -258,21 +268,21 @@ var SqliteStore = class {
         const stream = row.stream;
         const source = row.source;
         const at = Number(row.at);
-        let hasEvents;
+        let has_events;
         if (source) {
           const check = await tx.execute({
             sql: `SELECT 1 FROM events WHERE id > ? AND name != '__snapshot__' AND stream LIKE ? LIMIT 1`,
             args: [at, streamPatternToLike(source)]
           });
-          hasEvents = check.rows.length > 0;
+          has_events = check.rows.length > 0;
         } else {
           const check = await tx.execute({
             sql: `SELECT 1 FROM events WHERE id > ? AND name != '__snapshot__' LIMIT 1`,
             args: [at]
           });
-          hasEvents = check.rows.length > 0;
+          has_events = check.rows.length > 0;
         }
-        if (hasEvents) {
+        if (has_events) {
           candidates.push({
             stream,
             source: source ?? void 0,
@@ -359,7 +369,7 @@ var SqliteStore = class {
    * plus positional args. Returns `"1"` (always true) when empty so
    * callers can compose it unconditionally.
    */
-  _filterClause(filter) {
+  _filter_clause(filter) {
     const conditions = [];
     const args = [];
     if (filter.stream !== void 0) {
@@ -393,7 +403,7 @@ var SqliteStore = class {
   }
   // --- reset: transactional, accepts names or filter ---
   async reset(input) {
-    const setClause = `SET at = -1, retry = 0, blocked = 0, error = '',
+    const set_clause = `SET at = -1, retry = 0, blocked = 0, error = '',
                           leased_by = NULL, leased_until = NULL`;
     const tx = await this.client.transaction("write");
     try {
@@ -401,15 +411,15 @@ var SqliteStore = class {
       if (Array.isArray(input)) {
         for (const stream of input) {
           const r = await tx.execute({
-            sql: `UPDATE streams ${setClause} WHERE stream = ?`,
+            sql: `UPDATE streams ${set_clause} WHERE stream = ?`,
             args: [stream]
           });
           count += r.rowsAffected;
         }
       } else {
-        const { clause, args } = this._filterClause(input);
+        const { clause, args } = this._filter_clause(input);
         const r = await tx.execute({
-          sql: `UPDATE streams ${setClause} WHERE ${clause}`,
+          sql: `UPDATE streams ${set_clause} WHERE ${clause}`,
           args
         });
         count = r.rowsAffected;
@@ -425,7 +435,7 @@ var SqliteStore = class {
   // `retry = -1` so claim's post-bump returns retry=0 (first attempt),
   // matching the InMemoryStore convention.
   async unblock(input) {
-    const setClause = `SET retry = -1, blocked = 0, error = '',
+    const set_clause = `SET retry = -1, blocked = 0, error = '',
                           leased_by = NULL, leased_until = NULL`;
     const tx = await this.client.transaction("write");
     try {
@@ -433,19 +443,19 @@ var SqliteStore = class {
       if (Array.isArray(input)) {
         for (const stream of input) {
           const r = await tx.execute({
-            sql: `UPDATE streams ${setClause}
+            sql: `UPDATE streams ${set_clause}
                   WHERE stream = ? AND blocked = 1`,
             args: [stream]
           });
           count += r.rowsAffected;
         }
       } else {
-        const { clause, args } = this._filterClause({
+        const { clause, args } = this._filter_clause({
           ...input,
           blocked: true
         });
         const r = await tx.execute({
-          sql: `UPDATE streams ${setClause} WHERE ${clause}`,
+          sql: `UPDATE streams ${set_clause} WHERE ${clause}`,
           args
         });
         count = r.rowsAffected;
@@ -544,11 +554,11 @@ var SqliteStore = class {
    */
   async query_stats(input, options) {
     const exclude = options?.exclude ?? [];
-    const wantTail = options?.tail ?? false;
-    const wantCount = options?.count ?? false;
-    const wantNames = options?.names ?? false;
+    const want_tail = options?.tail ?? false;
+    const want_count = options?.count ?? false;
+    const want_names = options?.names ?? false;
     const before = options?.before;
-    const fullScan = wantCount || wantNames;
+    const full_scan = want_count || want_names;
     if (Array.isArray(input) && input.length === 0) {
       return /* @__PURE__ */ new Map();
     }
@@ -576,55 +586,61 @@ var SqliteStore = class {
       where.push(`e.id < ?`);
       args.push(before);
     }
-    const fromClause = `events e`;
-    const whereClause = `WHERE ${where.length ? where.join(" AND ") : "1=1"}`;
-    return fullScan ? this._queryStatsFullScan(
-      fromClause,
-      whereClause,
+    const from_clause = `events e`;
+    const where_clause = `WHERE ${where.length ? where.join(" AND ") : "1=1"}`;
+    return full_scan ? this._query_stats_full_scan(
+      from_clause,
+      where_clause,
       args,
-      wantTail,
-      wantCount,
-      wantNames
-    ) : this._queryStatsHeadsOnly(fromClause, whereClause, args, wantTail);
+      want_tail,
+      want_count,
+      want_names
+    ) : this._query_stats_heads_only(
+      from_clause,
+      where_clause,
+      args,
+      want_tail
+    );
   }
   /**
    * Cheap path — head (and optional tail) via ROW_NUMBER() over the
    * `(stream, version)` unique index. Parallel queries when tail set.
    */
-  async _queryStatsHeadsOnly(fromClause, whereClause, args, wantTail) {
-    const cols = `e.id, e.stream, e.version, e.name, e.data, e.created, e.meta`;
-    const headSql = `SELECT * FROM (
+  async _query_stats_heads_only(from_clause, where_clause, args, want_tail) {
+    const cols = `e.id, e.stream, e.version, e.name, e.data, e.created, e.meta, e.pii`;
+    const head_sql = `SELECT * FROM (
       SELECT ${cols}, ROW_NUMBER() OVER (PARTITION BY e.stream ORDER BY e.version DESC) AS rn
-      FROM ${fromClause}
-      ${whereClause}
+      FROM ${from_clause}
+      ${where_clause}
     ) WHERE rn = 1`;
-    const tailSql = wantTail ? `SELECT * FROM (
+    const tail_sql = want_tail ? `SELECT * FROM (
           SELECT ${cols}, ROW_NUMBER() OVER (PARTITION BY e.stream ORDER BY e.version ASC) AS rn
-          FROM ${fromClause}
-          ${whereClause}
+          FROM ${from_clause}
+          ${where_clause}
         ) WHERE rn = 1` : null;
     const [headRes, tailRes] = await Promise.all([
-      this.client.execute({ sql: headSql, args }),
-      tailSql ? this.client.execute({ sql: tailSql, args }) : null
+      this.client.execute({ sql: head_sql, args }),
+      tail_sql ? this.client.execute({ sql: tail_sql, args }) : null
     ]);
-    const toCommitted = (row) => ({
+    const to_committed = (row) => ({
       id: Number(row.id),
       stream: row.stream,
       version: Number(row.version),
       name: row.name,
       data: JSON.parse(row.data),
       meta: JSON.parse(row.meta),
-      created: new Date(row.created)
+      created: new Date(row.created),
+      pii: parse_pii(row.pii)
     });
     const out = /* @__PURE__ */ new Map();
     for (const row of headRes.rows) {
       out.set(row.stream, {
-        head: toCommitted(row)
+        head: to_committed(row)
       });
     }
     if (tailRes) {
       for (const row of tailRes.rows) {
-        out.get(row.stream).tail = toCommitted(row);
+        out.get(row.stream).tail = to_committed(row);
       }
     }
     return out;
@@ -634,20 +650,20 @@ var SqliteStore = class {
    * `json_group_object(name, n)`. Heads (and optional tails) ride free
    * on the same scan.
    */
-  async _queryStatsFullScan(fromClause, whereClause, args, wantTail, wantCount, wantNames) {
-    const tailCte = wantTail ? `, tails AS (
+  async _query_stats_full_scan(from_clause, where_clause, args, want_tail, want_count, want_names) {
+    const tail_cte = want_tail ? `, tails AS (
           SELECT * FROM (
             SELECT *, ROW_NUMBER() OVER (PARTITION BY stream ORDER BY version ASC) AS rn FROM ef
           ) WHERE rn = 1
         )` : "";
-    const tailJoin = wantTail ? `LEFT JOIN tails t ON t.stream = h.stream` : "";
-    const tailCols = wantTail ? `, t.id AS t_id, t.stream AS t_stream, t.version AS t_version,
-           t.name AS t_name, t.data AS t_data, t.created AS t_created, t.meta AS t_meta` : "";
+    const tail_join = want_tail ? `LEFT JOIN tails t ON t.stream = h.stream` : "";
+    const tail_cols = want_tail ? `, t.id AS t_id, t.stream AS t_stream, t.version AS t_version,
+           t.name AS t_name, t.data AS t_data, t.created AS t_created, t.meta AS t_meta, t.pii AS t_pii` : "";
     const sql = `
       WITH ef AS (
-        SELECT e.id, e.stream, e.version, e.name, e.data, e.created, e.meta
-        FROM ${fromClause}
-        ${whereClause}
+        SELECT e.id, e.stream, e.version, e.name, e.data, e.created, e.meta, e.pii
+        FROM ${from_clause}
+        ${where_clause}
       ),
       agg AS (
         SELECT stream,
@@ -665,60 +681,63 @@ var SqliteStore = class {
           SELECT *, ROW_NUMBER() OVER (PARTITION BY stream ORDER BY version DESC) AS rn FROM ef
         ) WHERE rn = 1
       )
-      ${tailCte}
+      ${tail_cte}
       SELECT
-        h.id, h.stream, h.version, h.name, h.data, h.created, h.meta,
+        h.id, h.stream, h.version, h.name, h.data, h.created, h.meta, h.pii,
         a.cnt AS agg_count,
         a.names AS agg_names
-        ${tailCols}
+        ${tail_cols}
       FROM heads h
       LEFT JOIN agg a ON a.stream = h.stream
-      ${tailJoin}
+      ${tail_join}
     `;
     const res = await this.client.execute({ sql, args });
-    const toCommitted = (id, stream, version, name, data, meta, created) => ({
+    const to_committed = (id, stream, version, name, data, meta, created, pii) => ({
       id: Number(id),
       stream,
       version: Number(version),
       name,
       data: JSON.parse(data),
       meta: JSON.parse(meta),
-      created: new Date(created)
+      created: new Date(created),
+      pii: parse_pii(pii)
     });
     const out = /* @__PURE__ */ new Map();
     for (const row of res.rows) {
       const r = row;
       const stats = {
-        head: toCommitted(
+        head: to_committed(
           r.id,
           r.stream,
           r.version,
           r.name,
           r.data,
           r.meta,
-          r.created
+          r.created,
+          r.pii
         )
       };
-      if (wantTail && r.t_id !== null && r.t_id !== void 0) {
-        stats.tail = toCommitted(
+      if (want_tail && r.t_id !== null && r.t_id !== void 0) {
+        stats.tail = to_committed(
           r.t_id,
           r.t_stream,
           r.t_version,
           r.t_name,
           r.t_data,
           r.t_meta,
-          r.t_created
+          r.t_created,
+          r.t_pii
         );
       }
-      if (wantCount) stats.count = Number(r.agg_count);
-      if (wantNames) stats.names = JSON.parse(r.agg_names);
+      if (want_count) stats.count = Number(r.agg_count);
+      if (want_names) stats.names = JSON.parse(r.agg_names);
       out.set(r.stream, stats);
     }
     return out;
   }
   // --- prioritize: bulk priority update with filter (ACT-102) ---
   async prioritize(filter, priority) {
-    const { clause, args: filterArgs } = this._filterClause(filter);
+    const { clause, args: filterArgs } = this._filter_clause(filter);
     const sql = `UPDATE streams SET priority = ?
                  WHERE priority <> ? AND ${clause}`;
     const result = await this.client.execute({
@@ -733,11 +752,11 @@ var SqliteStore = class {
     const tx = await this.client.transaction("write");
     try {
       for (const { stream, snapshot, meta } of targets) {
-        const countRow = await tx.execute({
+        const count_row = await tx.execute({
           sql: "SELECT COUNT(*) as c FROM events WHERE stream = ?",
           args: [stream]
         });
-        const deleted = Number(countRow.rows[0].c);
+        const deleted = Number(count_row.rows[0].c);
         await tx.execute({
           sql: "DELETE FROM events WHERE stream = ?",
           args: [stream]
@@ -746,16 +765,16 @@ var SqliteStore = class {
           sql: "DELETE FROM streams WHERE stream = ?",
           args: [stream]
         });
-        const eventName = snapshot !== void 0 ? "__snapshot__" : "__tombstone__";
-        const eventMeta = meta ?? { correlation: "", causation: {} };
+        const event_name = snapshot !== void 0 ? "__snapshot__" : "__tombstone__";
+        const event_meta = meta ?? { correlation: "", causation: {} };
         const now = (/* @__PURE__ */ new Date()).toISOString();
         const ins = await tx.execute({
           sql: "INSERT INTO events (stream, version, name, data, meta, created) VALUES (?, 0, ?, ?, ?, ?)",
           args: [
             stream,
-            eventName,
+            event_name,
             JSON.stringify(snapshot ?? {}),
-            JSON.stringify(eventMeta),
+            JSON.stringify(event_meta),
             now
           ]
         });
@@ -766,9 +785,9 @@ var SqliteStore = class {
             stream,
             version: 0,
             created: new Date(now),
-            name: eventName,
+            name: event_name,
             data: snapshot ?? {},
-            meta: eventMeta
+            meta: event_meta
           }
         });
       }
@@ -798,14 +817,15 @@ var SqliteStore = class {
       await tx.execute("DELETE FROM sqlite_sequence WHERE name = 'events'");
       await driver(async (event) => {
         const ins = await tx.execute({
-          sql: "INSERT INTO events (stream, version, name, data, meta, created) VALUES (?, ?, ?, ?, ?, ?)",
+          sql: "INSERT INTO events (stream, version, name, data, meta, created, pii) VALUES (?, ?, ?, ?, ?, ?, ?)",
           args: [
             event.stream,
             event.version,
             event.name,
             JSON.stringify(event.data),
             JSON.stringify(event.meta),
-            event.created.toISOString()
+            event.created.toISOString(),
+            stringify_pii(event.pii)
           ]
         });
         return Number(ins.lastInsertRowid);
@@ -816,6 +836,30 @@ var SqliteStore = class {
       throw error;
     }
   }
+  /**
+   * Wipe the sensitive-data payload for every event on the stream — the
+   * physical-erasure side of the sensitive-data epic (#566). Sets
+   * `events.pii` to `NULL` for the stream's events; `events.data` and
+   * the rest of the row are never touched.
+   *
+   * Single `UPDATE` under SQLite's writer lock, bounded by events-per-
+   * stream. Idempotent — the `pii IS NOT NULL` predicate filters out
+   * already-wiped rows so a second call returns `0`.
+   *
+   * SQLite doesn't auto-reclaim space; freed pages stay in the file
+   * until an operator-scheduled `PRAGMA incremental_vacuum` or a full
+   * `VACUUM`. The production checklist documents the cadence.
+   *
+   * @param stream Target stream
+   * @returns Count of events whose `pii` was set to `NULL`
+   */
+  async forget_pii(stream) {
+    const r = await this.client.execute({
+      sql: "UPDATE events SET pii = NULL WHERE stream = ? AND pii IS NOT NULL",
+      args: [stream]
+    });
+    return r.rowsAffected ?? 0;
+  }
 };
 export {
   SqliteStore,