@volter/teams 0.2.26 → 0.2.27

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.2.26",
+  "version": "0.2.27",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",

package/server/apps.mjs

@@ -397,12 +397,10 @@ export async function deliverAppWebhooks(api) {
     const state = delivered ? 'delivered' : row.attempts >= 8 ? 'failed' : 'pending';
     await api.store.transaction([statement("UPDATE app_webhook_deliveries SET state=?,last_status=?,lease_until=NULL,next_at=? WHERE id=? AND lease_until=? AND state='pending'", state, status, api.clock.nowMs() + Math.min(3600000, 1000 * 2 ** row.attempts), id, lease)]);
   }
-  // Week-old settled deliveries go from the front (oldest rowid first), a bounded batch per run, stopping at the first
-  // delivery younger than a week or still pending (it settles within its eight attempts). Expired install codes go
-  // with maintain's other expiries (t_6c01c966).
-  const front = await api.store.query('SELECT rowid AS id,state,created_at FROM app_webhook_deliveries ORDER BY rowid LIMIT 500', []);
-  let through = null; for (const row of front) { if (row.state === 'pending' || row.created_at >= api.clock.nowMs() - 7 * 86400000) break; through = row.id; }
-  if (through != null) await api.store.transaction([statement('DELETE FROM app_webhook_deliveries WHERE rowid<=? AND state<>\'pending\'', through)]);
-  if (through != null && front.length >= 500 && front.at(-1).id === through) return true;
+  // Week-old settled deliveries go through their queue (migration 024: queued when they settled), oldest first, a
+  // bounded batch per run; a pending delivery is never in it, so none stands in front of them (t_6c01c966).
+  const cut = api.clock.nowMs() - 7 * 86400000;
+  await api.store.transaction([statement("DELETE FROM app_webhook_deliveries WHERE id IN (SELECT id FROM delivery_settled WHERE created_at<? ORDER BY created_at LIMIT 500) AND state<>'pending'", cut)]);
+  if (await api.store.one('SELECT 1 AS more FROM delivery_settled WHERE created_at<? LIMIT 1', [cut])) return true;
   return due.length >= 10;
 }

package/server/core.mjs

@@ -73,7 +73,8 @@ export async function maintain(api,{budgetMs=MAINTAIN_BUDGET_MS}={}){const now=a
     for(const [table,column,cut] of [['idempotency','expires_at',now],['global_idempotency','expires_at',now],['journal','created_at',now-86400000],['app_install_codes','expires_at',now]]){
       const front=await q(`SELECT rowid AS id,${column} AS at FROM ${table} ORDER BY rowid LIMIT ${EXPIRY_BATCH}`);
       let through=null;for(const row of front){if(row.at>cut)break;through=row.id;}
-      if(through!=null){await tx([{sql:`DELETE FROM ${table} WHERE rowid<=?`,params:[through]}]);count(`expired ${table}`,front.findIndex(row=>row.id===through)+1);}
+      // fenced by its own expiry too: a row written since the read that took a reused rowid is never removed
+      if(through!=null){await tx([{sql:`DELETE FROM ${table} WHERE rowid<=? AND ${column}<=?`,params:[through,cut]}]);count(`expired ${table}`,front.findIndex(row=>row.id===through)+1);}
       if(through!=null&&front.length>=EXPIRY_BATCH&&front.at(-1).id===through)more=true;
     }
     // cursors expire through their expiry index
@@ -135,8 +136,11 @@ export async function maintain(api,{budgetMs=MAINTAIN_BUDGET_MS}={}){const now=a
   // session's current version, the newest version from each of its sources, the newest one from each source that a
   // capture's artifact names (the next capture and a correlation read those), and every version a live cursor pins.
   await step('versions',async()=>{
-    if(!await walked(api,['version_sources','cursor_pins'])){more=true;return;}
+    // every cursor made since migration 023 pins through its trigger; one made before it is waited out (cursors live
+    // 15 minutes), never unpacked
+    if(!await walked(api,['version_sources'])||!await cursorsBeforePinsGone(api,now)){more=true;return;}
     const due=await q(`SELECT team_id,session_id,generation FROM version_prune_queue WHERE due_at<=? ORDER BY due_at LIMIT ${VERSION_SESSION_BATCH}`,[now]);
+    let messageBudget=MESSAGE_BUDGET;
     for(const {team_id,session_id,generation} of due){
       if(!left()){more=true;break;}
       const session=await one('SELECT revision FROM sessions WHERE team_id=? AND id=?',[team_id,session_id]);
@@ -162,11 +166,27 @@ export async function maintain(api,{budgetMs=MAINTAIN_BUDGET_MS}={}){const now=a
           ORDER BY vs.revision LIMIT ${budget}`,[team_id,session_id,source,newest,session.revision,now,capture]);
         // A message row lives from the version that wrote it until one that changed it (schema 9), so a row a later
         // version still holds moves to the next version that holds it before its own goes; the rest go with the version.
-        for(const {revision} of free)await tx([
-          {sql:'UPDATE messages SET revision=(SELECT MIN(k.revision) FROM session_versions k WHERE k.team_id=messages.team_id AND k.session_id=messages.session_id AND k.revision>messages.revision AND k.revision<COALESCE(messages.until_revision,messages.revision+1)) WHERE team_id=? AND session_id=? AND revision=? AND EXISTS (SELECT 1 FROM session_versions k WHERE k.team_id=messages.team_id AND k.session_id=messages.session_id AND k.revision>messages.revision AND k.revision<COALESCE(messages.until_revision,messages.revision+1))',params:[team_id,session_id,revision]},
-          ...['messages','session_artifacts','session_versions'].map(table=>({sql:`DELETE FROM ${table} WHERE team_id=? AND session_id=? AND revision=?`,params:[team_id,session_id,revision]})),
-        ]);
-        count('versions',free.length);budget-=free.length;if(budget<=0)full=true;
+        // A long session's version holds many rows: they are worked a bounded chunk at a time (by ordinal, on the key),
+        // and the version goes once none is left; one not finished keeps its session due.
+        let removed=0;
+        for(const {revision} of free){
+          for(;;){
+            if(messageBudget<=0||!left()){full=true;break;}
+            const edge=await one(`SELECT ordinal FROM messages WHERE team_id=? AND session_id=? AND revision=? ORDER BY ordinal LIMIT 1 OFFSET ${MESSAGE_CHUNK-1}`,[team_id,session_id,revision]);
+            const upTo=edge?.ordinal??Number.MAX_SAFE_INTEGER;
+            await tx([
+              {sql:'UPDATE messages SET revision=(SELECT MIN(k.revision) FROM session_versions k WHERE k.team_id=messages.team_id AND k.session_id=messages.session_id AND k.revision>messages.revision AND k.revision<COALESCE(messages.until_revision,messages.revision+1)) WHERE team_id=? AND session_id=? AND revision=? AND ordinal<=? AND EXISTS (SELECT 1 FROM session_versions k WHERE k.team_id=messages.team_id AND k.session_id=messages.session_id AND k.revision>messages.revision AND k.revision<COALESCE(messages.until_revision,messages.revision+1))',params:[team_id,session_id,revision,upTo]},
+              {sql:'DELETE FROM messages WHERE team_id=? AND session_id=? AND revision=? AND ordinal<=?',params:[team_id,session_id,revision,upTo]},
+            ]);
+            messageBudget-=MESSAGE_CHUNK;
+            if(!edge)break;
+          }
+          if(await one('SELECT 1 AS left FROM messages WHERE team_id=? AND session_id=? AND revision=? LIMIT 1',[team_id,session_id,revision]))break;
+          await tx(['session_artifacts','session_versions'].map(table=>({sql:`DELETE FROM ${table} WHERE team_id=? AND session_id=? AND revision=?`,params:[team_id,session_id,revision]})));
+          removed++;
+        }
+        count('versions',removed);budget-=free.length;if(budget<=0)full=true;
+        if(full)break;
       }
       // more of this session: due now; else due when its first live pin expires (what it pins may then go); else done
       const pin=full?null:await one('SELECT MIN(expires_at) AS at FROM cursor_pins WHERE team_id=? AND session_id=? AND expires_at>?',[team_id,session_id,now]);
@@ -209,6 +229,17 @@ export async function maintain(api,{budgetMs=MAINTAIN_BUDGET_MS}={}){const now=a
   if(Object.keys(counts).length)console.log(`maintain: removed ${Object.entries(counts).map(([name,n])=>`${n} ${name}`).join(', ')}${more?' (backlog)':''}`);
   return result;}
 
+/** Whether every cursor made before migration 023 (whose versions it pins are not pin rows) has expired: the latest
+ *  expiry among the cursors there when this was first asked, kept, then waited out (cursors live 15 minutes). */
+async function cursorsBeforePinsGone(api,now){
+  let row=await api.store.one("SELECT after_rowid AS until FROM maintain_backfill WHERE name='cursors_before_pins'");
+  if(!row){
+    const latest=await api.store.one('SELECT expires_at FROM cursors ORDER BY expires_at DESC LIMIT 1');
+    row={until:latest?.expires_at??0};
+    await api.store.transaction([{sql:"INSERT OR IGNORE INTO maintain_backfill(name,after_rowid,done) VALUES ('cursors_before_pins',?,1)",params:[row.until]}]);
+  }
+  return now>row.until;
+}
 /** Whether each named walk of migration 023's backfill is done. */
 async function walked(api,names){
   for(const name of names){const row=await api.store.one('SELECT done FROM maintain_backfill WHERE name=?',[name]);if(!row?.done)return false;}
@@ -220,9 +251,6 @@ const BACKFILLS=[
   ['version_sources','session_versions',[
     "INSERT OR IGNORE INTO version_sources SELECT team_id,session_id,COALESCE(json_extract(source_projection_json,'$.source_id'),''),revision FROM session_versions WHERE rowid>? AND rowid<=?",
     'INSERT INTO version_prune_queue(team_id,session_id,due_at,generation) SELECT DISTINCT team_id,session_id,0,1 FROM session_versions WHERE rowid>? AND rowid<=? ON CONFLICT(team_id,session_id) DO UPDATE SET due_at=0,generation=generation+1']],
-  ['cursor_pins','cursors',[
-    "INSERT INTO cursor_pins SELECT c.id,c.team_id,json_extract(j.value,'$[0]'),json_extract(j.value,'$[1]'),c.expires_at FROM cursors c, json_each(c.snapshot_json) j WHERE c.rowid>? AND c.rowid<=? AND c.expires_at>NOWMS AND c.kind IN ('list','search') AND c.snapshot_json IS NOT NULL AND json_extract(j.value,'$[0]') IS NOT NULL AND json_extract(j.value,'$[1]') IS NOT NULL AND NOT EXISTS (SELECT 1 FROM cursor_pins p WHERE p.cursor_id=c.id)",
-    "INSERT INTO cursor_pins SELECT c.id,c.team_id,json_extract(c.snapshot_json,'$.session_id'),json_extract(c.snapshot_json,'$.revision'),c.expires_at FROM cursors c WHERE c.rowid>? AND c.rowid<=? AND c.expires_at>NOWMS AND c.kind='history' AND json_extract(c.snapshot_json,'$.session_id') IS NOT NULL AND json_extract(c.snapshot_json,'$.revision') IS NOT NULL AND NOT EXISTS (SELECT 1 FROM cursor_pins p WHERE p.cursor_id=c.id)"]],
   ['artifact_refs','session_artifacts',[
     "INSERT OR IGNORE INTO upload_refs SELECT team_id,upload_id,'a:'||session_id||':'||revision||':'||bundle_id FROM session_artifacts WHERE rowid>? AND rowid<=?"]],
   ['continuation_refs','continuations',[
@@ -234,6 +262,8 @@ const BACKFILLS=[
   ['uploads','uploads',[
     'INSERT INTO upload_prune_queue SELECT team_id,id,1 FROM uploads WHERE rowid>? AND rowid<=? AND committed=1 ON CONFLICT(team_id,upload_id) DO UPDATE SET generation=generation+1',
     'INSERT OR IGNORE INTO pending_uploads SELECT team_id,id,source_id,created_at FROM uploads WHERE rowid>? AND rowid<=? AND committed=0']],
+  ['deliveries','app_webhook_deliveries',[
+    "INSERT OR IGNORE INTO delivery_settled SELECT id,created_at FROM app_webhook_deliveries WHERE rowid>? AND rowid<=? AND state<>'pending'"]],
   ['blobs','artifact_blobs',[
     'INSERT INTO blob_prune_queue SELECT team_id,sha256,1 FROM artifact_blobs WHERE rowid>? AND rowid<=? ON CONFLICT(team_id,sha256) DO UPDATE SET generation=generation+1']],
 ];
@@ -270,6 +300,8 @@ const MAINTAIN_MS=60_000,MAINTAIN_BUDGET_MS=250;
 /** Sessions whose versions a run reads, and versions it removes from each; how far it walks down a source to find the
  *  newest version a capture names. */
 const VERSION_SESSION_BATCH=10,VERSION_PRUNE_BATCH=20,CAPTURE_WALK=500;
+/** Message rows a run moves or removes in all (a long session's version is worked across runs), and per statement. */
+const MESSAGE_BUDGET=2000,MESSAGE_CHUNK=500;
 /** Committed captures whose parts a run removes, and parts per capture per run. */
 const PARTS_CAPTURE_BATCH=20,PART_PRUNE_BATCH=50;
 /** Rows of one expiry a run removes; captures and uploads in flight a run expires. */

package/server/migrations/024.mjs

@@ -0,0 +1,14 @@
+// A delivery that settled (delivered, failed, cancelled) is queued with its age, so retention removes week-old
+// settled deliveries through that queue: a pending delivery never stands in front of them (t_6c01c966, #1120 review
+// DO7). Constant cost at activation: a table, its index and two triggers; rows from before it are walked into the
+// queue by `maintain` (its `deliveries` walk).
+export default `
+CREATE TABLE delivery_settled (id TEXT PRIMARY KEY, created_at INTEGER NOT NULL) STRICT;
+CREATE INDEX delivery_settled_created ON delivery_settled(created_at);
+CREATE TRIGGER delivery_settled_on_state AFTER UPDATE OF state ON app_webhook_deliveries WHEN NEW.state<>'pending' BEGIN
+  INSERT OR IGNORE INTO delivery_settled VALUES (NEW.id, NEW.created_at);
+END;
+CREATE TRIGGER delivery_settled_on_delete AFTER DELETE ON app_webhook_deliveries BEGIN
+  DELETE FROM delivery_settled WHERE id=OLD.id;
+END;
+`;

package/server/migrations/index.mjs

@@ -22,7 +22,8 @@ import m020 from './020.mjs';
 import m021 from './021.mjs';
 import m022 from './022.mjs';
 import m023 from './023.mjs';
-export const MIGRATIONS = [m001, m002, m003, m004, m005, m006, m007, m008, m009, m010, m011, m012, m013, m014, m015, m016, m017, m018, m019, m020, m021, m022, m023];
+import m024 from './024.mjs';
+export const MIGRATIONS = [m001, m002, m003, m004, m005, m006, m007, m008, m009, m010, m011, m012, m013, m014, m015, m016, m017, m018, m019, m020, m021, m022, m023, m024];
 /** A message row's `until_revision` while its session's current version still holds it (schema 9). */
 export const OPEN_REVISION = Number.MAX_SAFE_INTEGER;
 /** SQL: message row `m` belongs to the version at revision ?1 (bind the revision twice). */