@rotorsoft/act 1.31.28 → 1.32.0

package/dist/index.cjs

@@ -524,6 +524,7 @@ var QuerySchema = import_zod2.z.object({
   backward: import_zod2.z.boolean().optional(),
   correlation: import_zod2.z.string().optional(),
   with_snaps: import_zod2.z.boolean().optional(),
+  with_pii: import_zod2.z.boolean().optional(),
   stream_exact: import_zod2.z.boolean().optional()
 }).readonly();
 
@@ -881,7 +882,8 @@ var InMemoryStore = class {
   }
   // Attach the isolated PII payload (or null) to an event before handing it to
   // a caller. Allocation-free for events without PII — by far the common case.
-  _with_pii(e) {
+  _with_pii(e, wanted = true) {
+    if (!wanted) return e;
     const pii = this._pii.get(e.stream)?.get(e.id);
     return pii ? { ...e, pii } : e;
   }
@@ -952,7 +954,12 @@ var InMemoryStore = class {
         if (floor_id >= 0 && e.id < floor_id) break;
         if (query.created_after && e.created <= query.created_after) continue;
         await Promise.resolve(
-          callback(this._with_pii(e))
+          callback(
+            this._with_pii(
+              e,
+              query?.with_pii !== false
+            )
+          )
         );
         count++;
         if (query?.limit && count >= query.limit) break;
@@ -967,7 +974,12 @@ var InMemoryStore = class {
         if (query?.created_before && e.created >= query.created_before)
           continue;
         await Promise.resolve(
-          callback(this._with_pii(e))
+          callback(
+            this._with_pii(
+              e,
+              query?.with_pii !== false
+            )
+          )
         );
         count++;
         if (query?.limit && count >= query.limit) break;
@@ -1858,7 +1870,8 @@ var ALL_CATEGORIES = [
   "snapshot-drift",
   "routing-health",
   "correlation-gaps",
-  "clock-anomalies"
+  "clock-anomalies",
+  "unreadable-events"
 ];
 async function* audit(deps, categories, options = {}) {
   const requested = new Set(categories ?? [...ALL_CATEGORIES]);
@@ -1868,7 +1881,9 @@ async function* audit(deps, categories, options = {}) {
   );
   const need_stats = passes.some((p) => p.on_stat !== void 0);
   const need_streams = passes.some((p) => p.on_stream !== void 0);
-  const need_events = passes.some((p) => p.on_event !== void 0);
+  const need_events = passes.some(
+    (p) => p.on_event !== void 0 || p.on_unreadable !== void 0
+  );
   if (need_stats) {
     const stats = await deps.store().query_stats(
       {},
@@ -1884,15 +1899,57 @@ async function* audit(deps, categories, options = {}) {
     });
   }
   if (need_events) {
-    await deps.store().query((event) => {
-      for (const p of passes) p.on_event?.(event);
-    }, options.query);
+    await scan_events_resiliently(
+      deps,
+      options.query,
+      (event) => {
+        for (const p of passes) p.on_event?.(event);
+      },
+      (row) => {
+        for (const p of passes) p.on_unreadable?.(row);
+      }
+    );
   }
   for (const p of passes) await p.finalize?.(deps);
   for (const p of passes) {
     for (const f of p.drain()) yield f;
   }
 }
+async function scan_events_resiliently(deps, query, on_event, on_unreadable) {
+  let cursor = query?.after;
+  let remaining = query?.limit;
+  for (; ; ) {
+    let seen = 0;
+    try {
+      await deps.store().query(
+        (event) => {
+          seen++;
+          cursor = event.id;
+          on_event(event);
+        },
+        {
+          ...query,
+          after: cursor,
+          ...remaining !== void 0 && { limit: remaining }
+        }
+      );
+      return;
+    } catch (error) {
+      if (query?.backward) throw error;
+      let row;
+      await deps.store().query(
+        (e) => {
+          row = { stream: e.stream, event_id: e.id, error };
+        },
+        { ...query, after: cursor, limit: 1, with_pii: false }
+      );
+      if (!row) throw error;
+      on_unreadable(row);
+      if (remaining !== void 0) remaining -= seen;
+      cursor = row.event_id;
+    }
+  }
+}
 var make_schema_pass = (deps) => {
   const findings = [];
   return {
@@ -2257,6 +2314,22 @@ function restart_is_supported(deps, head_event_name) {
   const state2 = deps.event_to_state.get(head_event_name);
   return state2?.snap !== void 0;
 }
+function make_unreadable_events_pass() {
+  const findings = [];
+  return {
+    category: "unreadable-events",
+    on_unreadable({ stream, event_id, error }) {
+      findings.push({
+        category: "unreadable-events",
+        stream,
+        event_id,
+        reason: "pii_decrypt_failed",
+        error
+      });
+    },
+    drain: () => findings
+  };
+}
 var PASS_FACTORIES = {
   schema: make_schema_pass,
   "deprecated-load": make_deprecated_load_pass,
@@ -2266,7 +2339,8 @@ var PASS_FACTORIES = {
   "snapshot-drift": make_snapshot_drift_pass,
   "routing-health": make_routing_health_pass,
   "correlation-gaps": make_correlation_gaps_pass,
-  "clock-anomalies": make_clock_anomalies_pass
+  "clock-anomalies": make_clock_anomalies_pass,
+  "unreadable-events": make_unreadable_events_pass
 };
 
 // src/internal/autoclose-policy.ts
@@ -3397,7 +3471,19 @@ var CorrelateCycle = class {
           }
         }
       },
-      { ...query, after }
+      // Decline the sensitive payload: this scan reads `name`/`stream`/`id`
+      // to resolve reaction targets and throws the rest away. Asking for a
+      // payload it discards made one unreadable row stop EVERY stream's
+      // reactions — correlate is the sole producer of the work mark, so a
+      // decrypt failure here strands the whole app with nothing blocked and
+      // nothing naming the row (#1675).
+      //
+      // A dynamic `.to(event => …)` resolver therefore sees `pii: null`.
+      // That is deliberate and is itself a fix: correlate runs actor-less,
+      // so handing a resolver decrypted plaintext is un-gated disclosure —
+      // the defect #1673 corrected on the drain return and #1277 before it.
+      // `data` already carries no sensitive keys; nothing merges them here.
+      { ...query, after, with_pii: false }
     );
     const streams = [];
     for (const [stream, entry] of correlated) {
@@ -3739,12 +3825,23 @@ async function fetch(leased, eventLimit) {
     leased.map(async ({ stream, source, at, lagging }) => {
       const events = [];
       const stream_exact = source !== void 0 && is_literal_source(source) ? true : void 0;
-      await store2().query((e) => events.push(e), {
-        stream: source,
-        stream_exact,
-        after: at,
-        limit: eventLimit
-      });
+      try {
+        await store2().query((e) => events.push(e), {
+          stream: source,
+          stream_exact,
+          after: at,
+          limit: eventLimit
+        });
+      } catch (error) {
+        return {
+          stream,
+          source,
+          at,
+          lagging,
+          events: [],
+          error: error?.message ?? String(error)
+        };
+      }
       return { stream, source, at, lagging, events };
     })
   );
@@ -4399,6 +4496,17 @@ async function run_drain_cycle(ops, registry, batch_handlers, misrouted, store_f
   const handled = await Promise.all(
     leased.map((lease) => {
       const entry = fetch_map.get(lease.stream);
+      if (entry.fetch.error !== void 0) {
+        const error = `Fetch failed for ${lease.stream}: ${entry.fetch.error}`;
+        log().error(error);
+        const failed = {
+          lease,
+          handled: 0,
+          acked_at: lease.at,
+          error
+        };
+        return Promise.resolve(failed);
+      }
       const at = entry.fetch.events.at(-1)?.id || fetch_window_at;
       const { payloads } = entry;
       const exhausted = budget_exhausted(