@rotorsoft/act 1.9.0 → 1.10.0

package/dist/index.js

@@ -19,7 +19,7 @@ import {
   sleep,
   store,
   validate
-} from "./chunk-F4S2JOPN.js";
+} from "./chunk-3ZTFNAY7.js";
 import {
   ActorSchema,
   CausationEventSchema,
@@ -32,11 +32,19 @@ import {
   LogLevels,
   NonRetryableError,
   QuerySchema,
+  REDACTED,
+  SHREDDED,
   StreamClosedError,
   TargetSchema,
   ValidationError,
-  ZodEmpty
-} from "./chunk-PMAZTOSO.js";
+  ZodEmpty,
+  pii_fields,
+  pii_gate,
+  pii_merge,
+  pii_split,
+  pii_strip,
+  sensitive
+} from "./chunk-XSBT63QX.js";
 import "./chunk-5WRI5ZAA.js";
 
 // src/signals.ts
@@ -1044,7 +1052,7 @@ async function scan(source, opts = {}, callback) {
     }
   };
 }
-async function load(me, stream, callback, asOf) {
+async function load(me, stream, callback, asOf, actor) {
   const timeTravel = !!asOf && Object.values(asOf).some((v) => v !== void 0);
   const cached = timeTravel ? void 0 : await cache().get(stream);
   const cache_hit = !!cached;
@@ -1056,15 +1064,16 @@ async function load(me, stream, callback, asOf) {
   let event;
   await store().query(
     (e) => {
-      event = e;
       version = e.version;
+      const typed = e;
+      event = me.view(typed, actor);
       if (e.name === SNAP_EVENT) {
         state2 = e.data;
         snaps++;
         patches = 0;
         replayed++;
       } else if (me.patch[e.name]) {
-        state2 = patch(state2, me.patch[e.name](event, state2));
+        state2 = patch(state2, me.patch[e.name](typed, state2));
         patches++;
         replayed++;
       } else if (e.name !== TOMBSTONE_EVENT) {
@@ -1107,7 +1116,13 @@ async function action(me, action2, target, payload, reactingTo, skipValidation =
   const maxRetries = opts?.maxRetries ?? 0;
   for (let attempt = 0; ; attempt++) {
     try {
-      const snapshot = await load(me, stream);
+      const snapshot = await load(
+        me,
+        stream,
+        void 0,
+        void 0,
+        target.actor
+      );
       if (snapshot.event?.name === TOMBSTONE_EVENT)
         throw new StreamClosedError(stream);
       const expected = expectedVersion ?? snapshot.event?.version;
@@ -1144,10 +1159,10 @@ async function action(me, action2, target, payload, reactingTo, skipValidation =
           }
         }
       }
-      const emitted = tuples.map(([name, data]) => ({
-        name,
-        data: skipValidation ? data : validate(name, data, me.events[name])
-      }));
+      const emitted = tuples.map(([name, data]) => {
+        const validated2 = skipValidation ? data : validate(name, data, me.events[name]);
+        return me.message({ name, data: validated2 });
+      });
       const meta = {
         correlation: reactingTo?.meta.correlation || correlator({
           action: action2,
@@ -1159,8 +1174,8 @@ async function action(me, action2, target, payload, reactingTo, skipValidation =
           action: {
             name: action2,
             ...target
-            // payload intentionally omitted: it can be large or contain PII,
-            // and callers correlate via the correlation id when they need it.
+            // payload intentionally omitted from causation metadata —
+            // callers correlate via the correlation id when they need it.
           },
           event: reactingTo ? {
             id: reactingTo.id,
@@ -1193,7 +1208,7 @@ async function action(me, action2, target, payload, reactingTo, skipValidation =
         state2 = patch(state2, p);
         patches++;
         return {
-          event,
+          event: me.view(event, target.actor),
           state: state2,
           version: event.version,
           patches,
@@ -1278,7 +1293,7 @@ var traced = (inner, exit, entry) => (async (...args) => {
   return result;
 });
 function buildEs(logger, correlator = defaultCorrelator) {
-  const boundAction = (me, actionName, target, payload, reactingTo, skipValidation = false) => action(
+  const bound_action = (me, actionName, target, payload, reactingTo, skipValidation = false) => action(
     me,
     actionName,
     target,
@@ -1291,7 +1306,7 @@ function buildEs(logger, correlator = defaultCorrelator) {
     return {
       snap,
       load,
-      action: boundAction,
+      action: bound_action,
       tombstone
     };
   }
@@ -1321,7 +1336,7 @@ function buildEs(logger, correlator = defaultCorrelator) {
       );
     }),
     action: traced(
-      boundAction,
+      bound_action,
       (snapshots, _me, _action, target) => {
         const committed = snapshots.filter((s) => s.event);
         if (committed.length) {
@@ -1778,7 +1793,14 @@ function finalize(lease, handled, at, error, options, logger, failed_at) {
   };
 }
 function buildHandle(deps) {
-  const { logger, boundDo, boundLoad, boundQuery, boundQueryArray } = deps;
+  const {
+    logger,
+    bound_do,
+    bound_load,
+    bound_query,
+    bound_query_array,
+    bound_forget
+  } = deps;
   return async (lease, payloads) => {
     if (payloads.length === 0) return { lease, handled: 0, acked_at: lease.at };
     const stream = lease.stream;
@@ -1787,14 +1809,15 @@ function buildHandle(deps) {
     if (lease.retry > 0)
       logger.warn(`Retrying ${stream}@${at} (${lease.retry}).`);
     const scopedApp = {
-      do: boundDo,
-      load: boundLoad,
-      query: boundQuery,
-      query_array: boundQueryArray
+      do: bound_do,
+      load: bound_load,
+      query: bound_query,
+      query_array: bound_query_array,
+      forget: bound_forget
     };
     for (const payload of payloads) {
       const { event, handler } = payload;
-      scopedApp.do = (action2, target, actionPayload, reactingTo, skipValidation) => boundDo(
+      scopedApp.do = (action2, target, actionPayload, reactingTo, skipValidation) => bound_do(
         action2,
         target,
         actionPayload,
@@ -1823,7 +1846,9 @@ function buildHandle(deps) {
 function buildHandleBatch(logger) {
   return async (lease, payloads, batchHandler) => {
     const stream = lease.stream;
-    const events = payloads.map((p) => p.event);
+    const events = payloads.map(
+      (p) => p.event
+    );
     const options = payloads[0].options;
     if (lease.retry > 0)
       logger.warn(`Retrying batch ${stream}@${events[0].id} (${lease.retry}).`);
@@ -2006,6 +2031,7 @@ var Act = class {
   _bound_load = this.load.bind(this);
   _bound_query = this.query.bind(this);
   _bound_query_array = this.query_array.bind(this);
+  _bound_forget = this.forget.bind(this);
   /** Reaction dispatchers built once and handed to runDrainCycle each cycle. */
   _handle;
   _handle_batch;
@@ -2051,10 +2077,11 @@ var Act = class {
     this._cd = buildDrain(this._logger);
     this._handle = buildHandle({
       logger: this._logger,
-      boundDo: this._bound_do,
-      boundLoad: this._bound_load,
-      boundQuery: this._bound_query,
-      boundQueryArray: this._bound_query_array
+      bound_do: this._bound_do,
+      bound_load: this._bound_load,
+      bound_query: this._bound_query,
+      bound_query_array: this._bound_query_array,
+      bound_forget: this._bound_forget
     });
     this._handle_batch = buildHandleBatch(this._logger);
     const {
@@ -2286,7 +2313,7 @@ var Act = class {
       return snapshots;
     });
   }
-  async load(stateOrName, stream, callback, asOf) {
+  async load(stateOrName, stream, callback, asOf, actor) {
     return this._scoped(async () => {
       let merged;
       if (typeof stateOrName === "string") {
@@ -2296,7 +2323,7 @@ var Act = class {
       } else {
         merged = this._states.get(stateOrName.name) || stateOrName;
       }
-      return await this._es.load(merged, stream, callback, asOf);
+      return await this._es.load(merged, stream, callback, asOf, actor);
     });
   }
   /**
@@ -2390,6 +2417,34 @@ var Act = class {
       return events;
     });
   }
+  /**
+   * Wipe the sensitive-data payload for every event on the stream — see
+   * {@link IAct.forget}. Application-level half of #566.
+   *
+   * Throws on adapters without `Store.forget_pii`, invalidates the cache
+   * entry for the stream, emits the `forgotten` lifecycle event with the
+   * row count. Idempotent: a second call returns `{eventCount: 0}` and
+   * does NOT re-emit.
+   *
+   * @param stream - Target stream.
+   * @returns `{eventCount}` — number of events whose PII column was wiped.
+   */
+  async forget(stream) {
+    return this._scoped(async () => {
+      const s = store();
+      if (!s.forget_pii) {
+        throw new Error(
+          `Store does not implement forget_pii \u2014 adapter cannot comply with sensitive-data erasure. Use an adapter that declares pii_isolation: true (e.g. @rotorsoft/act on the in-memory store).`
+        );
+      }
+      const eventCount = await s.forget_pii(stream);
+      await cache().invalidate(stream);
+      if (eventCount > 0) {
+        this.emit("forgotten", { stream, at: /* @__PURE__ */ new Date(), eventCount });
+      }
+      return { eventCount };
+    });
+  }
   /**
    * Processes pending reactions by draining uncommitted events from the event store.
    *
@@ -2990,9 +3045,13 @@ function validateLaneReferences(registry, lanes) {
 }
 function act() {
   const states = /* @__PURE__ */ new Map();
+  const _sf = /* @__PURE__ */ new Map();
+  const _dp = /* @__PURE__ */ new Map();
   const registry = {
     actions: {},
-    events: {}
+    events: {},
+    sensitive_fields: (eventName) => _sf.get(eventName) ?? [],
+    disclosure_predicate: (stateName) => _dp.get(stateName) ?? null
   };
   const pendingProjections = [];
   const batchHandlers = /* @__PURE__ */ new Map();
@@ -3103,6 +3162,58 @@ function act() {
         }
         finalizeDeprecations();
         validateLaneReferences(registry, lanes);
+        for (const [eventName, reg] of Object.entries(
+          registry.events
+        )) {
+          const fields = pii_fields(reg.schema);
+          if (fields.length === 0) continue;
+          _sf.set(eventName, fields);
+          for (const [name, reaction] of reg.reactions) {
+            const inner = reaction.handler;
+            const wrapped = (event, stream, app) => inner(pii_strip(event, fields), stream, app);
+            Object.defineProperty(wrapped, "name", { value: inner.name });
+            reaction.handler = wrapped;
+            reg.reactions.set(name, reaction);
+          }
+        }
+        for (const state2 of states.values()) {
+          if (state2.disclose) _dp.set(state2.name, state2.disclose);
+          const fields_by_event = /* @__PURE__ */ new Map();
+          for (const eventName of Object.keys(state2.events)) {
+            const fields = _sf.get(eventName);
+            if (fields) fields_by_event.set(eventName, fields);
+          }
+          if (fields_by_event.size === 0) continue;
+          if (state2.snap) {
+            const offending = [...fields_by_event.keys()];
+            throw new Error(
+              `State "${state2.name}" cannot snapshot \u2014 events {${offending.join(", ")}} carry sensitive fields. Snapshots write derived state into __snapshot__.data, which forget_pii cannot reach. Remove .snap() or remove sensitive(...) markers.`
+            );
+          }
+          const disclose = state2.disclose ?? null;
+          state2.view = (event, actor) => {
+            const fields = fields_by_event.get(event.name);
+            return fields ? pii_gate(event, fields, disclose, actor) : event;
+          };
+          state2.message = (validated) => {
+            const fields = fields_by_event.get(validated.name);
+            return fields ? pii_split(validated, fields) : validated;
+          };
+          for (const [eventName, fields] of fields_by_event) {
+            const original = state2.patch[eventName];
+            state2.patch[eventName] = (event, s) => original(pii_merge(event, fields), s);
+          }
+        }
+        for (const [target, original] of batchHandlers) {
+          const wrapped = async (events, stream) => {
+            const stripped = events.map((e) => {
+              const f = _sf.get(e.name);
+              return f ? pii_strip(e, f) : e;
+            });
+            return original(stripped, stream);
+          };
+          batchHandlers.set(target, wrapped);
+        }
         _built = true;
       }
       return new Act(
@@ -3270,7 +3381,12 @@ function state(entry) {
             name,
             init,
             patch: defaultPatch,
-            on: {}
+            on: {},
+            // Step delegates initialized as identity. `act().build()`
+            // overrides on states with `sensitive(...)` events to bake in
+            // the gate / split.
+            view: (event) => event,
+            message: (validated) => validated
           };
           const builder = action_builder(internal);
           return Object.assign(builder, {
@@ -3322,6 +3438,10 @@ function action_builder(state2) {
       internal.snap = snap2;
       return builder;
     },
+    discloses(disclose) {
+      internal.disclose = disclose;
+      return builder;
+    },
     build() {
       return internal;
     }
@@ -3511,6 +3631,8 @@ export {
   NonRetryableError,
   PackageSchema,
   QuerySchema,
+  REDACTED,
+  SHREDDED,
   SNAP_EVENT,
   StreamClosedError,
   TOMBSTONE_EVENT,
@@ -3527,6 +3649,7 @@ export {
   port,
   projection,
   scoped,
+  sensitive,
   sleep,
   slice,
   state,