@rotorsoft/act 1.20.0 → 1.21.0

package/dist/index.cjs

@@ -803,6 +803,10 @@ var InMemoryStream = class {
 var InMemoryStore = class {
   // stored events
   _events = [];
+  // next event id — monotonic, never reused. Deletions (truncate, windowed
+  // prune) punch holes in the id sequence, so ids are NOT array indexes and
+  // NOT `_events.length`; they only stay sorted ascending in `_events`.
+  _next_id = 0;
   // stored stream positions and other metadata
   _streams = /* @__PURE__ */ new Map();
   // last committed version per stream — O(1) replacement for filter-on-commit
@@ -820,11 +824,26 @@ var InMemoryStore = class {
   _pii = /* @__PURE__ */ new Map();
   _reset_indexes() {
     this._events.length = 0;
+    this._next_id = 0;
     this._stream_versions.clear();
     this._max_event_id_by_stream.clear();
     this._max_non_snap_event_id = -1;
     this._pii.clear();
   }
+  // First index whose event id is greater than `after`. `_events` stays
+  // sorted ascending by id (append-only commits; deletions preserve
+  // order), so id-bounded scans binary-search their start instead of
+  // assuming id === index — an invariant that truncation breaks.
+  _first_index_after(after) {
+    let lo = 0;
+    let hi = this._events.length;
+    while (lo < hi) {
+      const mid = lo + hi >>> 1;
+      if (this._events[mid].id > after) hi = mid;
+      else lo = mid + 1;
+    }
+    return lo;
+  }
   // Attach the isolated PII payload (or null) to an event before handing it to
   // a caller. Allocation-free for events without PII — by far the common case.
   _with_pii(e) {
@@ -877,7 +896,7 @@ var InMemoryStore = class {
     await sleep();
     let count = 0;
     if (query?.backward) {
-      let i = (query?.before || this._events.length) - 1;
+      let i = (query?.before !== void 0 ? this._first_index_after(query.before - 1) : this._events.length) - 1;
       while (i >= 0) {
         const e = this._events[i--];
         if (query && !this.in_query(query, e)) continue;
@@ -892,7 +911,7 @@ var InMemoryStore = class {
         if (query?.limit && count >= query.limit) break;
       }
     } else {
-      let i = (query?.after ?? -1) + 1;
+      let i = this._first_index_after(query?.after ?? -1);
       if (query?.with_snaps && query.stream_exact && query.stream !== void 0 && query.after === void 0) {
         for (let j = this._events.length - 1; j >= 0; j--) {
           const e = this._events[j];
@@ -941,7 +960,7 @@ var InMemoryStore = class {
     let last_non_snap_id = -1;
     const committed = msgs.map(({ name, data, pii }) => {
       const c = {
-        id: this._events.length,
+        id: this._next_id++,
         stream,
         version,
         created: /* @__PURE__ */ new Date(),
@@ -1282,7 +1301,7 @@ var InMemoryStore = class {
       count++;
       if (count >= limit) break;
     }
-    return { maxEventId: this._events.length - 1, count };
+    return { maxEventId: this._events.at(-1)?.id ?? -1, count };
   }
   /**
    * Per-stream aggregated stats — see {@link Store.query_stats}.
@@ -1363,13 +1382,41 @@ var InMemoryStore = class {
   }
   /**
    * Atomically truncates streams and seeds each with a snapshot or tombstone.
-   * @param targets - Streams to truncate with optional snapshot state and meta.
+   * Windowed targets (`before` set) prune the prefix below the closest safe
+   * `__snapshot__` instead — no seed, subscriptions untouched, no-op when no
+   * snapshot qualifies.
+   * @param targets - Streams to truncate with optional snapshot state and meta,
+   *   or a `before`/`max_id` boundary for a windowed prefix delete.
    * @returns Map keyed by stream name, each entry with `deleted` count and `committed` event.
    */
   async truncate(targets) {
     await sleep();
+    const result = /* @__PURE__ */ new Map();
+    const windowed = targets.filter((t) => t.before !== void 0);
+    if (windowed.length) {
+      const drop = /* @__PURE__ */ new Set();
+      for (const { stream, before, max_id } of windowed) {
+        let boundary;
+        for (const e of this._events) {
+          if (e.stream === stream && e.name === SNAP_EVENT && e.created < before && (max_id === void 0 || e.id <= max_id) && (!boundary || e.id > boundary.id))
+            boundary = e;
+        }
+        if (!boundary) continue;
+        let deleted = 0;
+        for (const e of this._events) {
+          if (e.stream === stream && e.id < boundary.id) {
+            drop.add(e.id);
+            this._pii.get(stream)?.delete(e.id);
+            deleted++;
+          }
+        }
+        result.set(stream, { deleted, committed: boundary, before });
+      }
+      if (drop.size) this._events = this._events.filter((e) => !drop.has(e.id));
+    }
+    const full = targets.filter((t) => t.before === void 0);
     const deleted_counts = /* @__PURE__ */ new Map();
-    const stream_set = new Set(targets.map((t) => t.stream));
+    const stream_set = new Set(full.map((t) => t.stream));
     for (const e of this._events) {
       if (stream_set.has(e.stream)) {
         deleted_counts.set(e.stream, (deleted_counts.get(e.stream) ?? 0) + 1);
@@ -1380,11 +1427,11 @@ var InMemoryStore = class {
       this._streams.delete(stream);
       this._stream_versions.delete(stream);
       this._max_event_id_by_stream.delete(stream);
+      this._pii.delete(stream);
     }
-    const result = /* @__PURE__ */ new Map();
-    for (const { stream, snapshot, meta } of targets) {
+    for (const { stream, snapshot, meta } of full) {
       const event = {
-        id: this._events.length,
+        id: this._next_id++,
         stream,
         version: 0,
         created: /* @__PURE__ */ new Date(),
@@ -1416,25 +1463,27 @@ var InMemoryStore = class {
    * throw inside the driver restores the snapshot, leaving the store
    * byte-for-byte unchanged from the operator's perspective.
    *
-   * `id`s are reassigned `0..N-1` as events arrive (matching the
-   * adapter's commit-id convention — InMemory uses `_events.length`).
-   * `created` is preserved verbatim from the source.
+   * `id`s are reassigned `0..N-1` as events arrive (dense — the
+   * monotonic id counter restarts at 0 for the rebuild). `created` is
+   * preserved verbatim from the source.
    */
   async restore(driver) {
     await sleep();
     const prev_events = this._events;
+    const prev_next_id = this._next_id;
     const prev_streams = this._streams;
     const prev_stream_versions = this._stream_versions;
     const prev_max_event_id_by_stream = this._max_event_id_by_stream;
     const prev_max_non_snap_event_id = this._max_non_snap_event_id;
     this._events = [];
+    this._next_id = 0;
     this._streams = /* @__PURE__ */ new Map();
     this._stream_versions = /* @__PURE__ */ new Map();
     this._max_event_id_by_stream = /* @__PURE__ */ new Map();
     this._max_non_snap_event_id = -1;
     try {
       await driver(async (event) => {
-        const id = this._events.length;
+        const id = this._next_id++;
         const committed = { ...event, id };
         this._events.push(committed);
         this._stream_versions.set(event.stream, event.version);
@@ -1446,6 +1495,7 @@ var InMemoryStore = class {
       });
     } catch (err) {
       this._events = prev_events;
+      this._next_id = prev_next_id;
       this._streams = prev_streams;
       this._stream_versions = prev_stream_versions;
       this._max_event_id_by_stream = prev_max_event_id_by_stream;
@@ -2009,12 +2059,22 @@ function in_autoclose_window(window, now) {
 
 // src/internal/autoclose-policy.ts
 var import_zod6 = require("zod");
-var MIN_AFTER_MS = 6e4;
-var AfterSchema = import_zod6.z.object({
-  days: import_zod6.z.number({ message: "autocloses: after.days must be a number" }).positive("autocloses: after.days must be > 0")
-}).refine((o) => o.days * 864e5 >= MIN_AFTER_MS, {
-  message: `autocloses: after resolves to < ${MIN_AFTER_MS}ms (one minute), which is too short to be a meaningful retention window`
+var DAY_MS = 864e5;
+var MIN_AFTER_DAYS = 1 / 1440;
+var MIN_KEEP_DAYS = 1;
+function days_after(date, days) {
+  return new Date(date.getTime() + days * DAY_MS);
+}
+function days_before_now(days) {
+  return new Date(Date.now() - days * DAY_MS);
+}
+var window_schema = (field, min_days, floor) => import_zod6.z.object({
+  days: import_zod6.z.number({ message: `autocloses: ${field}.days must be a number` }).positive(`autocloses: ${field}.days must be > 0`)
+}).refine((o) => o.days >= min_days, {
+  message: `autocloses: ${field} resolves to < ${floor}, which is too short to be a meaningful retention window`
 });
+var AfterSchema = window_schema("after", MIN_AFTER_DAYS, "one minute");
+var KeepSchema = window_schema("keep", MIN_KEEP_DAYS, "one day");
 var IsSchema = import_zod6.z.union([
   import_zod6.z.string().min(1, "autocloses: is must be a non-empty event name"),
   import_zod6.z.array(
@@ -2036,16 +2096,16 @@ var AutoclosePolicySchema = import_zod6.z.object({
   after: AfterSchema.optional(),
   is: IsSchema.optional(),
   reaches: ReachesSchema.optional(),
-  or: OrBlockSchema.optional()
+  or: OrBlockSchema.optional(),
+  keep: KeepSchema.optional()
 }).strict().refine(
-  (o) => o.after !== void 0 || o.is !== void 0 || o.reaches !== void 0 || o.or !== void 0,
+  (o) => o.after !== void 0 || o.is !== void 0 || o.reaches !== void 0 || o.or !== void 0 || o.keep !== void 0,
   {
-    message: "autocloses: at least one of after / is / reaches / or must be specified \u2014 empty `{}` is a misconfiguration"
+    message: "autocloses: at least one of after / is / reaches / or / keep must be specified \u2014 empty `{}` is a misconfiguration"
   }
 );
 function compile_after(after) {
-  const after_ms = after.days * 864e5;
-  return (_stream, head) => Date.now() - head.created.getTime() >= after_ms;
+  return (_stream, head) => days_after(head.created, after.days) <= /* @__PURE__ */ new Date();
 }
 function compile_is(is) {
   const set = new Set(typeof is === "string" ? [is] : is);
@@ -2054,13 +2114,17 @@ function compile_is(is) {
 function compile_reaches(reaches) {
   return (_stream, _head, count) => count >= reaches;
 }
-function policy_min_after_ms(options) {
+function policy_min_after_days(options) {
   const parsed = AutoclosePolicySchema.parse(options);
   const windows = [];
-  if (parsed.after) windows.push(parsed.after.days * 864e5);
-  if (parsed.or?.after) windows.push(parsed.or.after.days * 864e5);
+  if (parsed.after) windows.push(parsed.after.days);
+  if (parsed.or?.after) windows.push(parsed.or.after.days);
   return windows.length ? Math.min(...windows) : void 0;
 }
+function policy_keep_days(options) {
+  const parsed = AutoclosePolicySchema.parse(options);
+  return parsed.keep?.days;
+}
 function compile_autoclose_policy(options) {
   const parsed = AutoclosePolicySchema.parse(options);
   const and_preds = [];
@@ -2103,12 +2167,20 @@ var CloseSignal = class extends Error {
    * event id when omitted.
    */
   at;
+  /**
+   * Windowed close (#1011): prune events older than this cutoff behind
+   * the closest safe snapshot instead of retiring the stream. Thrown by
+   * the autoclose reaction of a `.autocloses({ keep })` state; flows
+   * into {@link CloseTarget.before}. Omitted → a full close.
+   */
+  before;
   constructor(opts) {
     super("reaction requested close");
     this.name = "CloseSignal";
     this.stream = opts?.stream;
     this.archive = opts?.archive;
     this.at = opts?.at;
+    this.before = opts?.before;
   }
 };
 
@@ -2132,7 +2204,8 @@ function synthesize_autoclose_reactions(registry, states, config2) {
   for (const st of states.values()) {
     const predicate = st.autoclose;
     if (!predicate) continue;
-    const after_ms = st.autoclose_after_ms;
+    const after_days = st.autoclose_after_days;
+    const keep_days = st.autoclose_keep_days;
     const archiver = st.archive;
     const reaction = {
       // Run on a SYNTHETIC stream — `source` is the aggregate, `target` is a
@@ -2156,7 +2229,8 @@ function synthesize_autoclose_reactions(registry, states, config2) {
           });
         const stats = await store2().query_stats([aggregate], {
           count: true,
-          exclude: [TOMBSTONE_EVENT]
+          tail: keep_days !== void 0 ? true : void 0,
+          exclude: keep_days !== void 0 ? [TOMBSTONE_EVENT, SNAP_EVENT] : [TOMBSTONE_EVENT]
         });
         const entry = stats.get(aggregate);
         if (!entry) return;
@@ -2170,9 +2244,24 @@ function synthesize_autoclose_reactions(registry, states, config2) {
             // aggregate) sees it caught up instead of blocking its own close.
             at: head.id
           });
-        if (after_ms !== void 0)
+        if (keep_days !== void 0) {
+          const cutoff = days_before_now(keep_days);
+          if (entry.tail.created < cutoff)
+            throw new CloseSignal({
+              stream: aggregate,
+              before: cutoff,
+              archive: archiver ? () => archiver(aggregate, head, cutoff) : void 0,
+              at: head.id
+            });
+        }
+        const dues = [];
+        if (after_days !== void 0)
+          dues.push(days_after(head.created, after_days));
+        if (keep_days !== void 0)
+          dues.push(days_after(entry.tail.created, keep_days));
+        if (dues.length)
           throw new DeferSignal({
-            at: new Date(head.created.getTime() + after_ms)
+            at: new Date(Math.min(...dues.map((d) => d.getTime())))
           });
       }
     };
@@ -2559,8 +2648,20 @@ var CircuitBreaker = class {
 var SAFETY_PROBE_PAGE_SIZE = 1e3;
 async function run_close_cycle(targets, deps) {
   const target_map = new Map(targets.map((t) => [t.stream, t]));
-  const streams = [...target_map.keys()];
+  for (const t of target_map.values()) {
+    if (t.before !== void 0 && t.restart)
+      throw new Error(
+        `close: \`before\` and \`restart\` are mutually exclusive (stream "${t.stream}") \u2014 a windowed close keeps the stream live behind a real snapshot; restart reseeds it`
+      );
+  }
+  const windowed = [...target_map.values()].filter(
+    (t) => t.before !== void 0
+  );
+  const full = [...target_map.values()].filter((t) => t.before === void 0);
   const skipped = [];
+  const windowed_result = windowed.length ? await run_windowed_closes(windowed, deps, skipped) : /* @__PURE__ */ new Map();
+  if (!full.length) return { truncated: windowed_result, skipped };
+  const streams = full.map((t) => t.stream);
   const stream_info = await scan_stream_heads(streams);
   const safe = await partition_by_safety(
     stream_info,
@@ -2568,7 +2669,7 @@ async function run_close_cycle(targets, deps) {
     skipped,
     deps.probe_page_size ?? SAFETY_PROBE_PAGE_SIZE
   );
-  if (!safe.length) return { truncated: /* @__PURE__ */ new Map(), skipped };
+  if (!safe.length) return { truncated: windowed_result, skipped };
   const { guarded, guard_events } = await guard_with_tombstones(
     safe,
     stream_info,
@@ -2576,7 +2677,7 @@ async function run_close_cycle(targets, deps) {
     deps.tombstone,
     skipped
   );
-  if (!guarded.length) return { truncated: /* @__PURE__ */ new Map(), skipped };
+  if (!guarded.length) return { truncated: windowed_result, skipped };
   const seed_states = await load_restart_seeds(
     guarded,
     target_map,
@@ -2592,8 +2693,62 @@ async function run_close_cycle(targets, deps) {
     guard_events,
     deps.correlation
   );
+  for (const [stream, entry] of windowed_result) truncated.set(stream, entry);
   return { truncated, skipped };
 }
+async function run_windowed_closes(windowed, deps, skipped) {
+  const min_at = deps.reactive_events_size > 0 ? await probe_min_watermarks(
+    windowed.map((t) => t.stream),
+    deps.probe_page_size ?? SAFETY_PROBE_PAGE_SIZE
+  ) : /* @__PURE__ */ new Map();
+  for (const t of windowed) {
+    if (t.archive) await t.archive();
+  }
+  const truncated = await store2().truncate(
+    windowed.map((t) => ({
+      stream: t.stream,
+      before: t.before,
+      max_id: min_at.get(t.stream)
+    }))
+  );
+  for (const t of windowed) {
+    if (!truncated.has(t.stream)) skipped.push(t.stream);
+  }
+  return truncated;
+}
+async function probe_min_watermarks(streams, page_size) {
+  const min_at = /* @__PURE__ */ new Map();
+  const source_regex = /* @__PURE__ */ new Map();
+  const get_regex = (source) => {
+    let re = source_regex.get(source);
+    if (!re) {
+      re = new RegExp(source);
+      source_regex.set(source, re);
+    }
+    return re;
+  };
+  let after;
+  for (; ; ) {
+    let last;
+    const { count } = await store2().query_streams(
+      (position) => {
+        last = position.stream;
+        const source_re = position.source ? get_regex(position.source) : void 0;
+        for (const stream of streams) {
+          if (!source_re || source_re.test(stream)) {
+            const prev = min_at.get(stream);
+            if (prev === void 0 || position.at < prev)
+              min_at.set(stream, position.at);
+          }
+        }
+      },
+      { after, limit: page_size, source_matches: streams }
+    );
+    if (count < page_size) break;
+    after = last;
+  }
+  return min_at;
+}
 async function scan_stream_heads(streams) {
   const stats = await store2().query_stats(streams, {
     exclude: [SNAP_EVENT]
@@ -3794,8 +3949,13 @@ function build_handle(deps) {
             acked_at: error.at ?? event.id,
             // Close the signalled stream (the autoclose reaction's aggregate,
             // which differs from its synthetic lease stream); a self-closing
-            // user reaction omits it and closes its own lease stream.
-            close: { stream: error.stream ?? stream, archive: error.archive }
+            // user reaction omits it and closes its own lease stream. A
+            // carried `before` makes it a windowed close (prune, not retire).
+            close: {
+              stream: error.stream ?? stream,
+              archive: error.archive,
+              before: error.before
+            }
           };
         return finalize(
           lease,
@@ -5098,7 +5258,19 @@ var Act = class {
    * 7. **Cache** — invalidate (tombstoned) or warm (restarted)
    * 8. **Emit "closed"** — lifecycle event with results
    *
-   * @param targets - Per-stream close options (stream, restart?, archive?)
+   * Targets carrying `before` take the **windowed** branch instead —
+   * close the books on a rolling window: probe the min consumer
+   * watermark (so the boundary never rises past a lagging reaction),
+   * run the archive callback against the cutoff, then prune the prefix
+   * below the closest safe `__snapshot__`. No tombstone guard (the
+   * pre-cutoff prefix is immutable), no seed, cache untouched — the
+   * stream stays live and keeps accepting actions. Requires the state
+   * to snapshot via `.snap(...)`; no qualifying snapshot ⇒ the stream
+   * lands in `skipped` (retry after the next snapshot). Windowed
+   * entries in the result echo `before` and carry the surviving
+   * boundary snapshot as `committed`.
+   *
+   * @param targets - Per-stream close options (stream, restart?, archive?, before?)
    * @returns `{ truncated: TruncateResult, skipped: string[] }`
    *
    * @example Archive and close
@@ -5116,6 +5288,19 @@ var Act = class {
    *   { stream: "counter-2" },  // tombstoned
    * ]);
    * ```
+   *
+   * @example Windowed close — keep the last 180 days of real events
+   * ```typescript
+   * const cutoff = new Date();
+   * cutoff.setDate(cutoff.getDate() - 180);
+   * await app.close([
+   *   {
+   *     stream: "ledger-acme",
+   *     before: cutoff,
+   *     archive: async () => { await archiveToS3("ledger-acme", cutoff); },
+   *   },
+   * ]);
+   * ```
    */
   async close(targets) {
     if (!targets.length) return { truncated: /* @__PURE__ */ new Map(), skipped: [] };
@@ -5648,10 +5833,16 @@ function action_builder(state2) {
           ".autocloses(...) requires a policy object; got " + typeof policy
         );
       }
+      if (policy.keep && !internal.snap) {
+        throw new Error(
+          ".autocloses({ keep }) requires .snap(...) earlier in the chain \u2014 a rolling window prunes behind a real snapshot, so a state that never snapshots has nothing to prune behind."
+        );
+      }
       internal.autoclose = compile_autoclose_policy(
         policy
       );
-      internal.autoclose_after_ms = policy_min_after_ms(policy);
+      internal.autoclose_after_days = policy_min_after_days(policy);
+      internal.autoclose_keep_days = policy_keep_days(policy);
       return builder;
     },
     archives(archive) {