@framers/agentos-ext-account-sources 0.7.3 → 0.9.0

package/dist/sync/SqlAccountSourceSyncStore.js

@@ -6,8 +6,21 @@
  */
 import { createHash, randomUUID } from 'node:crypto';
 import { SqlSourceDerivationStore, createSourceDerivation, } from '@framers/agentos/cognition/library';
-import { createSourceSyncState, transitionSourceSync, sourceSyncDue, openSourceSyncCycle, advanceSourceSyncPage, committableSourceCursor, assertSourceSyncPolicy, SourceSyncFault, } from './state.js';
+import { createSourceSyncState, transitionSourceSync, sourceSyncDue, openSourceSyncCycle, advanceSourceSyncPage, committableSourceCursor, assertSourceSyncPolicy, SourceSyncFault, SOURCE_SYNC_OPERATING_BOUNDS, sourceSyncContentChanges, SourceSyncPolicyTuneError, } from './state.js';
 import { sourceSyncTables } from './schema.js';
+/**
+ * Thrown by `expire` when it fails after removing at least one source. Each removal committed in a transaction of its
+ * own, so `partial` counts them in `removed`, with the failure itself in `failed`; `cause` holds the failure, whose
+ * message this error carries.
+ */
+export class SourceSyncExpiryError extends Error {
+    partial;
+    constructor(removed, cause) {
+        super(cause instanceof Error ? cause.message : String(cause), { cause });
+        this.name = 'SourceSyncExpiryError';
+        this.partial = { removed, failed: 1 };
+    }
+}
 class StaleSync extends Error {
     constructor() { super('stale_source_sync'); }
 }
@@ -34,6 +47,14 @@ const sameText = (stored, read) => (stored.textHash !== undefined ? stored.textH
     && stored.characters === read.characters && stored.activityAt === read.activityAt
     && stored.messages.length === read.messages.length
     && stored.messages.every((message, index) => sameSpan(message, read.messages[index]));
+/**
+ * Whether a read begins with a retained copy's text, by the hash the store keeps of it, and holds every message of
+ * the copy at the same span, as a thread's read does after a reply: everything the read adds follows the copy's
+ * text. A copy an earlier release wrote, which has no text hash, never qualifies.
+ */
+const beginsWith = (stored, read, text) => stored.textHash !== undefined && stored.characters <= read.characters
+    && stored.textHash === textHashOf(text.slice(0, stored.characters))
+    && stored.messages.every((message) => read.messages.some((span) => sameSpan(message, span)));
 /**
  * Whether a read holds exactly the retained copy: its text (`sameText`) at the same version and content hash. Only the
  * expiry and the message windows, which each read decides afresh, may differ.
@@ -45,9 +66,9 @@ const sameCopy = (stored, read) => sameText(stored, read) && stored.dependency.v
  * that owner's fence (`fence`), and a change made with a handle checks its lease, generation and host liveness in
  * the same transaction. Applying a changed source purges its old copy and every derived result that depends on it
  * before the replacement is written. A read that repeats the text of a copy the store holds is never charged again,
- * and with the host's `refresh` binding a read of that very copy keeps it in place. Provider reads, embedding and model
- * calls stay outside the store. The constructor runs no DDL: the host's migration runs `sourceSyncSchema` and core's
- * `sourceDerivationSchema` first.
+ * one that begins with that text is charged only for what follows it, and with the host's `refresh` binding a read
+ * of that very copy keeps it in place. Provider reads, embedding and model calls stay outside the store. The
+ * constructor runs no DDL: the host's migration runs `sourceSyncSchema` and core's `sourceDerivationSchema` first.
  *
  * @typeParam Prepared - The host's in-memory value for one document, passed through to its `write` binding.
  */
@@ -495,17 +516,19 @@ export class SqlAccountSourceSyncStore {
     }
     /**
      * Applies one read result for a work item taken in this cycle, under a live lease and the owner fence. A retry
-     * keeps the work unresolved. A document is weighed first: excluded, outside the retained limits or, unless it
-     * repeats the text of a copy the store still holds, over the indexing allowance, it is recorded as a skip with its
-     * reason. A document that fits replaces the source's old copy in the same transaction (host write, indexing charge
-     * and provenance), after the old copy and every result derived from it are purged, evicting this connection's older
-     * sources the limits no longer admit. A read that repeats the text and message spans of a copy the store still holds,
-     * within its expiry and window, adds nothing to index and is never charged. When it also repeats the copy's version
-     * and content hash, the host's `refresh` binding keeps the copy, with every result derived from it, and gives it the
-     * read's expiry and message windows; otherwise the copy is written again from a fresh preparation. A skip and every
-     * other result purge the old copy, except an `indexing_limit` skip that finds the copy still held, still admitted as
-     * it is by the retained limits and the read beginning with its text, every message of it at the same span: that
-     * copy, admitted and charged under an earlier read, stays with the shorter of its own and the read's expiry.
+     * keeps the work unresolved. A document is weighed first: excluded, outside the retained limits or over the
+     * indexing allowance with the characters it adds to index, it is recorded as a skip with its reason. A document
+     * that fits replaces the source's old copy in the same transaction (host write, indexing charge and provenance),
+     * after the old copy and every result derived from it are purged, evicting this connection's older sources the
+     * limits no longer admit. A read that repeats the text and message spans of a copy the store still holds, within
+     * its expiry and window, adds nothing to index and is never charged; one that begins with that copy's text, every
+     * message of the copy at the same span, adds only the text that follows and is charged that alone. When a
+     * repeating read also repeats the copy's version and content hash, the host's `refresh` binding keeps the copy,
+     * with every result derived from it, and gives it the read's expiry and message windows; otherwise the copy is
+     * written again from a fresh preparation. A skip and every other result purge the old copy, except an
+     * `indexing_limit` skip that finds the copy still held, still admitted as it is by the retained limits and the
+     * read beginning with its text, every message of it at the same span: that copy, admitted and charged under an
+     * earlier read, stays with the shorter of its own and the read's expiry.
      *
      * @param prepared - The host's prepared value for a document result; null for any other result, and for a document
      *   weighed before its preparation.
@@ -540,11 +563,11 @@ export class SqlAccountSourceSyncStore {
                     : { kind: 'pending' };
             let victims = [];
             // The old copy stays when the read is that copy and the host refreshes it in place (`refreshed`), or when an
-            // indexing skip keeps it (`kept`, with `shortened` its provenance); a read that repeats its text is written again
-            // without a charge (`charge`).
+            // indexing skip keeps it (`kept`, with `shortened` its provenance); a written read is charged the characters it
+            // adds to index (`charge`).
             let refreshed = false;
             let kept = false;
-            let charge = true;
+            let charge = 0;
             let shortened = null;
             const excluded = await tx.get(`SELECT 1 FROM ${this.t.exclusions}
         WHERE tenant_id=$1 AND owner_id=$2 AND connection_id=$3 AND source_id=$4`, [...params(s), work.sourceId]);
@@ -560,23 +583,26 @@ export class SqlAccountSourceSyncStore {
                 const now = this.now();
                 const selected = this.choose([...all.filter((d) => d !== old), read], row.policy, maximumDocuments, maximumCharacters, now);
                 // A copy still within its expiry and window was charged when it was admitted: a read that repeats its text
-                // adds nothing to index, and one that also repeats its version and content hash is that copy. A copy past its
-                // expiry or window is no longer held, whether or not `expire` has removed it yet.
+                // adds nothing to index, and one that also repeats its version and content hash is that copy. A read that
+                // begins with its text adds only what follows it, so a reply to a long thread is charged once, not with the
+                // whole thread again. A copy past its expiry or window is no longer held, whether or not `expire` has removed
+                // it yet.
                 const holding = old !== undefined && retainable(old, row.policy, now) ? old : undefined;
                 const repeats = holding !== undefined && sameText(holding, read);
+                const text = result.document.read.content.text;
+                const appends = holding !== undefined && !repeats && beginsWith(holding, read, text);
+                const indexed = repeats ? 0 : appends ? read.characters - holding.characters : read.characters;
                 if (!selected.includes(read)) {
                     const reason = selected.length >= Math.min(row.policy.maxRetainedDocuments, maximumDocuments)
                         ? 'document_limit' : 'held_limit';
                     disposition = { kind: 'skipped', reason };
                 }
-                else if (!repeats && read.characters > Math.min(row.policy.maxIndexedCharacters, allowance.additionalIndexedCharacters)) {
+                else if (indexed > Math.min(row.policy.maxIndexedCharacters, allowance.additionalIndexedCharacters)) {
                     disposition = { kind: 'skipped', reason: 'indexing_limit' };
                     // The copy stays where the read begins with its text and the retained limits still admit it as it is, so an
                     // edit of a message it holds, or a lowered ceiling, removes it.
                     kept = holding !== undefined && holding.dependency.generation === read.dependency.generation
-                        && holding.textHash !== undefined
-                        && holding.textHash === textHashOf(result.document.read.content.text.slice(0, holding.characters))
-                        && holding.messages.every((message) => read.messages.some((span) => sameSpan(message, span)))
+                        && beginsWith(holding, read, text)
                         && this.choose(all, row.policy, maximumDocuments, maximumCharacters, now).includes(holding);
                     if (kept && holding !== undefined) {
                         // The kept copy takes the shorter of its own and the read's expiry and message windows, never a longer one.
@@ -596,7 +622,7 @@ export class SqlAccountSourceSyncStore {
                         return { handle: h, disposition: pending };
                     }
                     normalized = read;
-                    charge = !repeats;
+                    charge = indexed;
                     victims = all.filter((d) => d !== old && !selected.includes(d)).map((d) => d.dependency.sourceId);
                     disposition = { kind: 'applied', version: read.dependency.version };
                 }
@@ -623,8 +649,8 @@ export class SqlAccountSourceSyncStore {
             }
             else if (normalized && result.kind === 'document' && prepared !== null) {
                 await this.options.bindings.write(tx, s, normalized.dependency, result.document, prepared);
-                if (charge)
-                    await this.options.bindings.chargeIndexed(tx, s, normalized.characters);
+                if (charge > 0)
+                    await this.options.bindings.chargeIndexed(tx, s, charge);
                 await tx.run(`INSERT INTO ${this.t.documents}(tenant_id,owner_id,connection_id,source_id,document,expires_at)
           VALUES($1,$2,$3,$4,$5::jsonb,$6)`, [...params(s), work.sourceId,
                     JSON.stringify(normalized), normalized.dependency.expiresAt]);
@@ -871,15 +897,34 @@ export class SqlAccountSourceSyncStore {
      * the new policy, prunes retained sources to it and shortens their expiry to its window; the other controls rebind
      * content to the new generation without changing its version or expiry.
      *
-     * @returns The snapshot after the barrier is complete.
-     * @throws {Error} `source_policy_control_required` unless a policy comes exactly with `policy_changed`, and
-     *   `stale_source_sync` when the host's `active` binding refuses anything but disconnecting or a barrier is still set.
+     * A tune (`policy_tuned`), which takes the new policy too, does none of that. It stores a policy that differs from the
+     * stored one only in `SOURCE_SYNC_OPERATING_BOUNDS`, in one transaction under the owner fence's row lock and the
+     * connection's: no barrier is recorded and neither the generation nor the owner's epoch moves, so every fence ticket
+     * and derived result stays valid, and the cursor, revalidation, progress, schedule and retained sources stay, in any
+     * state. The new bounds apply from the next lease. While a lease is live a tune that would change the policy changes
+     * nothing and answers null, so no sync sees its policy change; a lease past its time by this store's clock ends with
+     * the tune, as a claim would replace it. A cycle left open between leases goes on under the new bounds, except that
+     * its scan ends there, as a bounded scan ends, when it has already reached a lower `maxScanPages` or `maxCandidates`,
+     * or when the new `scanPageSize` is below the size its next page token was read under (the checkpoint's
+     * `pageTokenSize`). A tune stores the whole policy it is given, so of two tunes made from one snapshot the later one's
+     * policy stands. A tune to the stored policy answers the snapshot and changes nothing, under a live lease too.
+     *
+     * @returns The snapshot after the barrier is complete or the tune is stored; null for a tune that would change the
+     *   policy while a lease is live.
+     * @throws {SourceSyncPolicyTuneError} for a tune whose policy differs from the stored one outside the operating
+     *   bounds; nothing changes.
+     * @throws {Error} `source_policy_control_required` unless a policy comes exactly with `policy_changed` or
+     *   `policy_tuned`, and `stale_source_sync` when the host's `active` binding refuses anything but disconnecting, a
+     *   barrier is still set (a tune completes none) or the connection does not exist.
      */
     async control(scope, event, policy) {
         if (policy)
             assertSourceSyncPolicy(policy);
-        if ((event.type === 'policy_changed') !== (policy !== undefined))
+        const takesPolicy = event.type === 'policy_changed' || event.type === 'policy_tuned';
+        if (takesPolicy !== (policy !== undefined))
             throw new Error('source_policy_control_required');
+        if (event.type === 'policy_tuned')
+            return this.tune(scope, policy);
         await this.recoverControl(scope);
         await this.fence.blockOwner(scope, async (tx) => {
             if (!await this.options.bindings.active(tx, scope) && event.type !== 'disconnect')
@@ -901,6 +946,63 @@ export class SqlAccountSourceSyncStore {
         await this.recoverControl(scope);
         return this.snapshot(scope);
     }
+    /**
+     * Stores a tuned policy as `control` describes for `policy_tuned`.
+     *
+     * @returns The snapshot, or null when the policy would change while a lease is live.
+     */
+    async tune(scope, policy) {
+        const stored = await this.db.transaction(async (tx) => {
+            // The owner fence's row lock first, as every store transaction takes it; an authorization that answers false
+            // changes nothing, so the owner's epoch, and every ticket and handle captured at it, stays.
+            await this.fenceOn(tx).activateOwner(scope, async () => false);
+            if (!await this.options.bindings.active(tx, scope))
+                throw new StaleSync();
+            const row = await this.row(tx, scope);
+            if (row.barrier)
+                throw new StaleSync();
+            const changed = sourceSyncContentChanges(row.policy, policy);
+            if (changed.length > 0)
+                throw new SourceSyncPolicyTuneError(changed);
+            if (SOURCE_SYNC_OPERATING_BOUNDS.every((bound) => row.policy[bound] === policy[bound]))
+                return true;
+            const now = this.now();
+            // A sync runs under the policy it claimed its lease with; a provider may check its requests against the stored one.
+            if (row.lease_until !== null && Number(row.lease_until) > now)
+                return false;
+            const previous = row.policy;
+            row.state = transitionSourceSync(row.state, { type: 'policy_tuned' }, now);
+            row.policy = policy;
+            // A lease past its time by this store's clock ends here, as a claim would replace it: a worker whose clock runs
+            // behind then holds a handle no later call accepts. Its next call, and the end of a request it already has in
+            // flight, are refused, so neither can be handed on as a lost grant once a provider sees the new policy.
+            row.lease_token = null;
+            row.lease_until = null;
+            const cp = row.checkpoint;
+            // The page size the open scan's next token was read under; a checkpoint an earlier release wrote does not keep
+            // it, and its token came from the stored policy's size.
+            const issued = cp?.pageTokenSize ?? previous.scanPageSize;
+            if (cp?.phase === 'scan' && (cp.scanPages >= policy.maxScanPages || cp.candidates >= policy.maxCandidates
+                || (cp.nextPageToken !== null && policy.scanPageSize < issued))) {
+                // The open scan has already reached a lower bound, whose next scan page the new bounds would refuse, or holds a
+                // page token read under a larger page size, which a provider may answer at that size: it ends as a bounded
+                // scan ends, and its next page is history.
+                if (!validNumber(cp.revision + 1))
+                    throw new Error('source_sync_counter_exhausted');
+                row.checkpoint = { ...cp, revision: cp.revision + 1, phase: 'history', nextPageToken: null,
+                    pageTokenSize: undefined, targetCursor: null, bounded: true };
+                row.last_page = null;
+            }
+            else if (cp?.phase === 'scan' && cp.nextPageToken !== null && cp.pageTokenSize === undefined) {
+                // The scan stays open on a token whose size its checkpoint does not keep: it keeps that size now, so a later
+                // tune compares with it rather than with the policy this tune stores.
+                row.checkpoint = { ...cp, pageTokenSize: issued };
+            }
+            await this.save(tx, scope, row);
+            return true;
+        });
+        return stored ? this.snapshot(scope) : null;
+    }
     async rebind(tx, scope, generation) {
         await this.options.bindings.rebind(tx, scope, generation);
         for (const doc of await this.documentRows(tx, scope)) {
@@ -1020,12 +1122,15 @@ export class SqlAccountSourceSyncStore {
     }
     /**
      * Removes retained sources whose expiry has passed, with every result derived from them, also while the connection
-     * is paused, then expires the owner's derived results. Sources are removed only while the owner's fence is active;
-     * reads refuse an expired source regardless.
+     * is paused or the owner's fence is inactive, then expires the owner's derived results. An inactive owner, such as a
+     * suspended account or one a control's barrier holds, stays inactive; reads refuse an expired source regardless.
+     * Each source goes in a transaction of its own, so a later failure leaves the removals before it in place.
      *
      * @param limit - At most this many sources, an integer from 1 to 1,000.
      * @returns How many sources were removed.
-     * @throws {Error} `invalid_sync_batch` for another limit.
+     * @throws {Error} `invalid_sync_batch` for another limit, and the failure itself when a removal or the results'
+     *   expiry fails: once a source was removed, a `SourceSyncExpiryError` with the failure's message, the failure as its
+     *   `cause` and the removals made before it in `partial`.
      */
     async expire(scope, limit = 100) {
         if (!Number.isInteger(limit) || limit < 1 || limit > 1000)
@@ -1034,29 +1139,145 @@ export class SqlAccountSourceSyncStore {
       WHERE tenant_id=$1 AND owner_id=$2 AND connection_id=$3 AND expires_at <= $4
       ORDER BY expires_at,source_id LIMIT $5`, [...params(scope), this.now(), limit]);
         let removed = 0;
-        for (const row of rows) {
-            const ticket = await this.fence.capture(scope);
-            if (!ticket)
+        try {
+            for (const row of rows)
+                if (await this.expireSource(scope, row.source_id))
+                    removed++;
+            await this.fence.expireResults(scope, limit);
+        }
+        catch (error) {
+            // The removals before the failure have committed, so their count goes to the caller with it.
+            throw removed > 0 ? new SourceSyncExpiryError(removed, error) : error;
+        }
+        return removed;
+    }
+    /**
+     * Removes one retained source whose expiry has passed, with every result derived from it, under its owner's row
+     * lock, whether or not the owner's fence is active: the fence's invalidation advances the owner's epoch, so no handle
+     * from before it applies anything, and leaves an inactive owner inactive.
+     *
+     * @returns Whether it was removed: false when it is gone or its expiry has not passed, as after a later read moved it.
+     */
+    async expireSource(scope, sourceId) {
+        return this.db.transaction(async (tx) => {
+            const fence = this.fenceOn(tx);
+            // The owner fence's row lock first, as every store transaction takes it; an answer of false changes nothing.
+            await fence.activateOwner(scope, async () => false);
+            const current = await tx.get(`SELECT expires_at FROM ${this.t.documents}
+        WHERE tenant_id=$1 AND owner_id=$2 AND connection_id=$3 AND source_id=$4`, [...params(scope), sourceId]);
+            if (!current || Number(current.expires_at) > this.now())
+                return false;
+            await fence.invalidate(scope, { kind: 'source', connectionId: scope.connectionId, sourceId }, async () => { });
+            return true;
+        });
+    }
+    /**
+     * Removes retained sources whose expiry has passed from every connection, or from `owner`'s alone, the earliest
+     * expiry first, each with every result derived from it as `expire` does for one connection, however far a
+     * maintenance walk is from them and whether or not their owner's fence is active; then expires the derived results
+     * of each owner it removed a source of. The store's own expiry decides, which a policy change's prune and an
+     * indexing skip that keeps a copy may have shortened. An owner whose removal fails, as when its host purge keeps
+     * failing, is counted and left out of the call's later reads, so a call with up to `limit` such owners never holds
+     * back another owner's copies. An owner whose derived results then fail to expire is counted too, once; the call
+     * still answers every source it removed, and the other owners' results still expire.
+     *
+     * @param limit - At most this many sources, an integer from 1 to 1,000.
+     * @param owner - The owner whose sources alone are swept, or null for every owner.
+     * @returns The sources removed, and the owners whose removal or whose derived results' expiry failed.
+     * @throws {Error} `invalid_sync_batch` for another limit.
+     */
+    async sweepExpired(limit = 100, owner = null) {
+        if (!Number.isInteger(limit) || limit < 1 || limit > 1000)
+            throw new Error('invalid_sync_batch');
+        let removed = 0;
+        let failed = 0;
+        const swept = new Map();
+        // The owners whose removal failed, which each later read leaves out.
+        const passed = new Set();
+        const passedTenants = [];
+        const passedOwners = [];
+        // Each read after the first follows a newly failed owner, and the call ends once more than `limit` owners have
+        // failed, so at most `limit` + 2 reads run.
+        for (;;) {
+            const rows = await this.db.all(`SELECT d.tenant_id,d.owner_id,d.connection_id,d.source_id FROM ${this.t.documents} d
+          WHERE d.expires_at <= $1 AND ($2::text IS NULL OR (d.tenant_id=$2 AND d.owner_id=$3))
+          AND NOT EXISTS(SELECT 1 FROM unnest($5::text[],$6::text[]) AS p(tenant_id,owner_id)
+            WHERE p.tenant_id=d.tenant_id AND p.owner_id=d.owner_id)
+          ORDER BY d.expires_at,d.tenant_id,d.owner_id,d.connection_id,d.source_id LIMIT $4`, [this.now(), owner?.tenantId ?? null, owner?.ownerId ?? null, limit - removed, passedTenants, passedOwners]);
+            let passedNow = false;
+            for (const row of rows) {
+                const ownerKey = JSON.stringify([row.tenant_id, row.owner_id]);
+                if (passed.has(ownerKey))
+                    continue;
+                try {
+                    if (await this.expireSource({ tenantId: row.tenant_id, ownerId: row.owner_id, connectionId: row.connection_id }, row.source_id)) {
+                        removed++;
+                        swept.set(ownerKey, { tenantId: row.tenant_id, ownerId: row.owner_id });
+                    }
+                }
+                catch {
+                    failed++;
+                    passed.add(ownerKey);
+                    passedTenants.push(row.tenant_id);
+                    passedOwners.push(row.owner_id);
+                    passedNow = true;
+                }
+            }
+            if (!passedNow || removed >= limit || passed.size > limit)
                 break;
+        }
+        // An owner whose derived results cannot be expired counts once, as a failed removal does; the copies already
+        // removed stay counted, and every other owner's results still expire.
+        for (const [ownerKey, sweptOwner] of swept) {
             try {
-                const result = await this.fence.apply(ticket, async (tx) => {
-                    const current = await tx.get(`SELECT expires_at FROM ${this.t.documents}
-            WHERE tenant_id=$1 AND owner_id=$2 AND connection_id=$3 AND source_id=$4`, [...params(scope), row.source_id]);
-                    if (!current || Number(current.expires_at) > this.now())
-                        return false;
-                    await this.fenceOn(tx).invalidate(scope, { kind: 'source', connectionId: scope.connectionId, sourceId: row.source_id }, async () => { }, { expected: ticket });
-                    return true;
-                });
-                if (result.kind === 'applied' && result.value)
-                    removed++;
+                await this.fence.expireResults(sweptOwner, limit);
             }
-            catch (error) {
-                if (!(error instanceof StaleSync))
-                    throw error;
+            catch {
+                if (!passed.has(ownerKey))
+                    failed++;
             }
         }
-        await this.fence.expireResults(scope, limit);
-        return removed;
+        return { removed, failed };
+    }
+    /**
+     * Removes a stopped owner's rows from the store in one transaction: every connection of the owner, with its work
+     * rows, retained-source provenance and exclusions, once each connection is disconnected with no barrier, lease, work
+     * or retained source. `remove` runs first in the same transaction, after the owner fence's row lock and the
+     * connections' row locks, for a lifecycle's own rows; `SourceRevocations.removeOwner` passes its own. The core
+     * fence's owner row and its deletion records stay: they hold no content, keep the owner's epoch ahead of any old
+     * handle, and a restore replays the deletion from them.
+     *
+     * @param remove - The lifecycle's removal in the same transaction; answering false rolls the whole call back.
+     * @returns Whether the owner's rows were removed: false, changing nothing, while a connection of the owner has not
+     *   stopped or when `remove` answers false.
+     */
+    async removeOwner(owner, remove = async () => true) {
+        const where = [owner.tenantId, owner.ownerId];
+        try {
+            await this.db.transaction(async (tx) => {
+                // The owner fence's row lock first, as every store transaction takes it; an answer of false changes nothing.
+                await this.fenceOn(tx).activateOwner(owner, async () => false);
+                const rows = await tx.all(`SELECT * FROM ${this.t.connections}
+          WHERE tenant_id=$1 AND owner_id=$2 ORDER BY connection_id FOR UPDATE`, where);
+                if (rows.some((row) => row.barrier !== null || row.lease_token !== null
+                    || row.state.status !== 'disconnected'))
+                    throw new StaleSync();
+                if (await tx.get(`SELECT 1 FROM ${this.t.documents} WHERE tenant_id=$1 AND owner_id=$2 LIMIT 1`, where)
+                    || await tx.get(`SELECT 1 FROM ${this.t.work} WHERE tenant_id=$1 AND owner_id=$2 LIMIT 1`, where)) {
+                    throw new StaleSync();
+                }
+                if (!await remove(tx))
+                    throw new StaleSync();
+                // The work rows, provenance and exclusions go with their connection (ON DELETE CASCADE).
+                await tx.run(`DELETE FROM ${this.t.connections} WHERE tenant_id=$1 AND owner_id=$2`, where);
+            });
+            return true;
+        }
+        catch (error) {
+            if (error instanceof StaleSync)
+                return false;
+            throw error;
+        }
     }
 }
 //# sourceMappingURL=SqlAccountSourceSyncStore.js.map