@rotorsoft/act 1.31.29 → 1.32.0

package/dist/index.js

@@ -26,7 +26,7 @@ import {
   sleep,
   store,
   validate
-} from "./chunk-34WL4DPW.js";
+} from "./chunk-5NFBMYTY.js";
 import {
   ActorSchema,
   CausationEventSchema,
@@ -53,7 +53,7 @@ import {
   pii_split,
   pii_strip,
   sensitive
-} from "./chunk-7IBF4FTQ.js";
+} from "./chunk-BI3UNNVA.js";
 
 // src/signals.ts
 process.once("SIGINT", async (arg) => {
@@ -213,7 +213,8 @@ var ALL_CATEGORIES = [
   "snapshot-drift",
   "routing-health",
   "correlation-gaps",
-  "clock-anomalies"
+  "clock-anomalies",
+  "unreadable-events"
 ];
 async function* audit(deps, categories, options = {}) {
   const requested = new Set(categories ?? [...ALL_CATEGORIES]);
@@ -223,7 +224,9 @@ async function* audit(deps, categories, options = {}) {
   );
   const need_stats = passes.some((p) => p.on_stat !== void 0);
   const need_streams = passes.some((p) => p.on_stream !== void 0);
-  const need_events = passes.some((p) => p.on_event !== void 0);
+  const need_events = passes.some(
+    (p) => p.on_event !== void 0 || p.on_unreadable !== void 0
+  );
   if (need_stats) {
     const stats = await deps.store().query_stats(
       {},
@@ -239,15 +242,57 @@ async function* audit(deps, categories, options = {}) {
     });
   }
   if (need_events) {
-    await deps.store().query((event) => {
-      for (const p of passes) p.on_event?.(event);
-    }, options.query);
+    await scan_events_resiliently(
+      deps,
+      options.query,
+      (event) => {
+        for (const p of passes) p.on_event?.(event);
+      },
+      (row) => {
+        for (const p of passes) p.on_unreadable?.(row);
+      }
+    );
   }
   for (const p of passes) await p.finalize?.(deps);
   for (const p of passes) {
     for (const f of p.drain()) yield f;
   }
 }
+async function scan_events_resiliently(deps, query, on_event, on_unreadable) {
+  let cursor = query?.after;
+  let remaining = query?.limit;
+  for (; ; ) {
+    let seen = 0;
+    try {
+      await deps.store().query(
+        (event) => {
+          seen++;
+          cursor = event.id;
+          on_event(event);
+        },
+        {
+          ...query,
+          after: cursor,
+          ...remaining !== void 0 && { limit: remaining }
+        }
+      );
+      return;
+    } catch (error) {
+      if (query?.backward) throw error;
+      let row;
+      await deps.store().query(
+        (e) => {
+          row = { stream: e.stream, event_id: e.id, error };
+        },
+        { ...query, after: cursor, limit: 1, with_pii: false }
+      );
+      if (!row) throw error;
+      on_unreadable(row);
+      if (remaining !== void 0) remaining -= seen;
+      cursor = row.event_id;
+    }
+  }
+}
 var make_schema_pass = (deps) => {
   const findings = [];
   return {
@@ -612,6 +657,22 @@ function restart_is_supported(deps, head_event_name) {
   const state2 = deps.event_to_state.get(head_event_name);
   return state2?.snap !== void 0;
 }
+function make_unreadable_events_pass() {
+  const findings = [];
+  return {
+    category: "unreadable-events",
+    on_unreadable({ stream, event_id, error }) {
+      findings.push({
+        category: "unreadable-events",
+        stream,
+        event_id,
+        reason: "pii_decrypt_failed",
+        error
+      });
+    },
+    drain: () => findings
+  };
+}
 var PASS_FACTORIES = {
   schema: make_schema_pass,
   "deprecated-load": make_deprecated_load_pass,
@@ -621,7 +682,8 @@ var PASS_FACTORIES = {
   "snapshot-drift": make_snapshot_drift_pass,
   "routing-health": make_routing_health_pass,
   "correlation-gaps": make_correlation_gaps_pass,
-  "clock-anomalies": make_clock_anomalies_pass
+  "clock-anomalies": make_clock_anomalies_pass,
+  "unreadable-events": make_unreadable_events_pass
 };
 
 // src/internal/autoclose-policy.ts
@@ -1752,7 +1814,19 @@ var CorrelateCycle = class {
           }
         }
       },
-      { ...query, after }
+      // Decline the sensitive payload: this scan reads `name`/`stream`/`id`
+      // to resolve reaction targets and throws the rest away. Asking for a
+      // payload it discards made one unreadable row stop EVERY stream's
+      // reactions — correlate is the sole producer of the work mark, so a
+      // decrypt failure here strands the whole app with nothing blocked and
+      // nothing naming the row (#1675).
+      //
+      // A dynamic `.to(event => …)` resolver therefore sees `pii: null`.
+      // That is deliberate and is itself a fix: correlate runs actor-less,
+      // so handing a resolver decrypted plaintext is un-gated disclosure —
+      // the defect #1673 corrected on the drain return and #1277 before it.
+      // `data` already carries no sensitive keys; nothing merges them here.
+      { ...query, after, with_pii: false }
     );
     const streams = [];
     for (const [stream, entry] of correlated) {
@@ -2094,12 +2168,23 @@ async function fetch(leased, eventLimit) {
     leased.map(async ({ stream, source, at, lagging }) => {
       const events = [];
       const stream_exact = source !== void 0 && is_literal_source(source) ? true : void 0;
-      await store().query((e) => events.push(e), {
-        stream: source,
-        stream_exact,
-        after: at,
-        limit: eventLimit
-      });
+      try {
+        await store().query((e) => events.push(e), {
+          stream: source,
+          stream_exact,
+          after: at,
+          limit: eventLimit
+        });
+      } catch (error) {
+        return {
+          stream,
+          source,
+          at,
+          lagging,
+          events: [],
+          error: error?.message ?? String(error)
+        };
+      }
       return { stream, source, at, lagging, events };
     })
   );
@@ -2754,6 +2839,17 @@ async function run_drain_cycle(ops, registry, batch_handlers, misrouted, store_f
   const handled = await Promise.all(
     leased.map((lease) => {
       const entry = fetch_map.get(lease.stream);
+      if (entry.fetch.error !== void 0) {
+        const error = `Fetch failed for ${lease.stream}: ${entry.fetch.error}`;
+        log().error(error);
+        const failed = {
+          lease,
+          handled: 0,
+          acked_at: lease.at,
+          error
+        };
+        return Promise.resolve(failed);
+      }
       const at = entry.fetch.events.at(-1)?.id || fetch_window_at;
       const { payloads } = entry;
       const exhausted = budget_exhausted(