
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@rotorsoft/act-pg
Advanced tools
PostgreSQL event store adapter for @rotorsoft/act. Provides persistent, production-ready event storage with ACID guarantees, connection pooling, and distributed stream processing.
npm install @rotorsoft/act @rotorsoft/act-pg
# or
pnpm add @rotorsoft/act @rotorsoft/act-pg
Requirements: Node.js >= 22.18.0, PostgreSQL >= 14
import { act, state, store } from "@rotorsoft/act";
import { PostgresStore } from "@rotorsoft/act-pg";
import { z } from "zod";
// Inject the PostgreSQL store before building your app
store(new PostgresStore({
host: "localhost",
port: 5432,
database: "myapp",
user: "postgres",
password: "secret",
}));
// Initialize tables (creates schema, events table, streams table, and indexes)
await store().seed();
// Build and use your app as normal
const Counter = state({ Counter: z.object({ count: z.number() }) })
.init(() => ({ count: 0 }))
.emits({ Incremented: z.object({ amount: z.number() }) })
.patch({ Incremented: ({ data }, s) => ({ count: s.count + data.amount }) }) // optional — only for custom reducers
.on({ increment: z.object({ by: z.number() }) })
.emit((action) => ["Incremented", { amount: action.by }])
.build();
const app = act().withState(Counter).build();
await app.do("increment", { stream: "counter1", actor: { id: "1", name: "User" } }, { by: 1 });
All configuration fields are optional and have sensible defaults:
| Option | Default | Description |
|---|---|---|
host | localhost | PostgreSQL host |
port | 5432 | PostgreSQL port |
database | postgres | Database name |
user | postgres | Database user |
password | postgres | Database password |
schema | public | Schema for event tables |
table | events | Base name for event tables |
const pgStore = new PostgresStore({
host: "db.example.com",
database: "production",
user: "app_user",
password: process.env.DB_PASSWORD,
schema: "events", // custom schema
table: "act_events", // creates act_events and act_events_streams tables
});
if (process.env.NODE_ENV === "production") {
store(new PostgresStore({
host: process.env.DB_HOST,
port: parseInt(process.env.DB_PORT || "5432"),
database: process.env.DB_NAME,
user: process.env.DB_USER,
password: process.env.DB_PASSWORD,
}));
}
// In development, the default InMemoryStore is used
FOR UPDATE SKIP LOCKEDseed() creates all required tables, indexes, and schemaCalling seed() creates two tables:
Events table ({schema}.{table}) - stores all committed events:
id (serial) - global event sequencename - event type namedata (jsonb) - event payloadstream - stream identifierversion - per-stream sequence numbercreated (timestamptz) - event timestampmeta (jsonb) - correlation, causation, and actor metadataStreams table ({schema}.{table}_streams) - tracks stream processing state for reactions:
stream - stream identifierat - last processed event positionleased_by / leased_until - distributed processing claim infoblocked / error - error tracking for failed streamsThe PostgreSQL adapter uses FOR UPDATE SKIP LOCKED for atomic stream claiming — the idiomatic PostgreSQL competing consumer pattern. The claim() method discovers streams with pending events and locks them in a single query:
This replaces the previous two-step poll/lease approach, eliminating contention and simplifying the drain cycle.
FAQs
act pg adapters
We found that @rotorsoft/act-pg demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.