bug(core): Promise.all in collectionItemsResult — one failing sanitizeItem rejects the entire collection #275

Summary

In packages/core/src/sources.ts, the collection source resolves all items through sanitizeItem in a single Promise.all. If any single item's sanitizer rejects, the entire collection resolve fails — no items are returned, and the source emits an error instead of a partial result.

Root cause

const serialized = options.sanitizeItem
  ? await Promise.all(capped.map((item) => options.sanitizeItem!(item, request)))
  : [...capped];

A single rejected promise in the array causes Promise.all to reject immediately, discarding all other successfully sanitized items.

Expected behaviour

Depending on the configured sourceErrorMode, a failing item should either:

• Be omitted from results (leaving the rest intact)
• Be replaced with an error placeholder
• Reject the whole collection only if sourceErrorMode: 'throw'

Fix

Use Promise.allSettled and filter/handle rejections:

const results = await Promise.allSettled(
  capped.map((item) => options.sanitizeItem!(item, request))
);
const serialized = results
  .filter((r): r is PromiseFulfilledResult<unknown> => r.status === 'fulfilled')
  .map((r) => r.value);

Impact

Any app using sanitizeItem to redact/transform items where one item could fail (e.g. async fetch for enrichment) will silently lose the entire collection rather than a graceful partial result.