@volter/teams 0.2.55 → 0.2.57

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.2.55",
+  "version": "0.2.57",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",

package/server/core.mjs

@@ -1,5 +1,6 @@
 import { deliverAppWebhooks } from './apps.mjs';
 import { reconcileMachinePresence, LINK_GRACE_MS } from './machine-events.mjs';
+import { releaseRevokedSources } from './session-release.mjs';
 // The Teams server, independent of its host. `createTeamsApi` builds the API
 // object every route and door reads; a host attaches a store (`api.attach`),
 // bootstraps the server identity once, serves requests through http.mjs's
@@ -233,6 +234,12 @@ export async function maintain(api,{budgetMs=MAINTAIN_BUDGET_MS}={}){const now=a
   await step('webhooks',async()=>{if(await deliverAppWebhooks(api))more=true;});
   // Last, with what the budget leaves: the walks of rows written before migration 023 into its tables.
   await step('backfill',async()=>{if(!await backfill(api,{now,left}))more=true;});
+  // A team that says so has what its revoked sources left released (session-release.mjs); no team does by default.
+  // Last: it takes what the run's budget has left, after everything the server itself needs.
+  await step('revoked sources',async()=>{
+    if(!await walked(api,['version_sources'])){more=true;return;}
+    if(await releaseRevokedSources(api,{now,left,count}))more=true;
+  });
   const result={counts,failed,backlog:more};
   if(Object.keys(counts).length)console.log(`maintain: removed ${Object.entries(counts).map(([name,n])=>`${n} ${name}`).join(', ')}${more?' (backlog)':''}`);
   return result;}

package/server/http.mjs

@@ -1,5 +1,6 @@
 import { appRoute, appPreAuth, appAuthentication, enforceAppScope, appAuthGuards, installedIssuer, identityIssuers } from './apps.mjs';
 import { machineEventStream } from './machine-events.mjs';
+import { releasePreview, releaseSetting, RELEASE_GRACE_DAYS } from './session-release.mjs';
 import { publishedEventRoute, OWN_SOURCE, sourceMachine } from './published-events.mjs';
 import { identityRecordRoute, identityAuthority } from './identity-record.mjs';
 import { AGENT_ACTIVE } from './agent-authority.mjs';
@@ -102,7 +103,7 @@ export function createHttpHandler(api){return async(req,res)=>{const requestId=a
   if(req.method==='POST'&&sub==='/invitations')return await createInvitation(api,req,res,auth,requestId);
   if(req.method==='POST'&&sub==='/credentials')return await createCredential(api,req,res,auth,requestId);
   if(req.method==='DELETE'&&(m=/^\/credentials\/([^/]+)$/.exec(sub)))return await revokeCredential(api,req,res,auth,m[1],requestId);
-  if((req.method==='GET'||req.method==='PATCH')&&sub==='/settings')return await teamSettings(api,req,res,auth,requestId);
+  if((req.method==='GET'||req.method==='PATCH')&&sub==='/settings')return await teamSettings(api,req,res,auth,url,requestId);
   if(req.method==='GET'&&sub==='/members')return await listMembers(api,res,auth,url,requestId);
   if(req.method==='PATCH'&&(m=/^\/members\/([^/]+)$/.exec(sub)))return await updateMember(api,req,res,auth,m[1],requestId);
   if(req.method==='DELETE'&&(m=/^\/members\/([^/]+)$/.exec(sub)))return await removeMember(api,req,res,auth,m[1],requestId);
@@ -335,13 +336,24 @@ async function collectionPage(api,auth,url,name,items){
 }
 async function listMembers(api,res,auth,url,requestId){const rows=auth.role==='viewer'?await api.store.query('SELECT m.*,p.kind,p.display_name FROM memberships m JOIN principals p ON p.id=m.principal_id WHERE m.team_id=? AND m.principal_id=? AND m.active=1',[auth.team_id,auth.principal_id]):await api.store.query('SELECT m.*,p.kind,p.display_name FROM memberships m JOIN principals p ON p.id=m.principal_id WHERE m.team_id=? AND m.active=1 ORDER BY p.display_name,m.principal_id',[auth.team_id]);send(res,200,await collectionPage(api,auth,url,'members',rows.map(membershipJson)),requestId);}
 // The team's own settings. native_capture: whether machines upload each session's native transcript (see migration 025).
-async function teamSettings(api,req,res,auth,requestId){
-  const read=async()=>{const t=await api.store.one('SELECT native_capture FROM teams WHERE id=?',[auth.team_id]);return{native_capture:t.native_capture===1};};
-  if(req.method==='GET')return send(res,200,result(api,auth,await read()),requestId);
+// release_revoked_sources: whether retention releases what revoked sources left (migration 028), with the moment it
+// was turned on (its cutoff) and the grace. An administrator's `?release_revoked_sources=preview` says what turning it
+// on now would release, or what the standing cutoff releases, source by source.
+async function teamSettings(api,req,res,auth,url,requestId){
+  const read=async()=>{const t=await api.store.one('SELECT native_capture,release_revoked_before FROM teams WHERE id=?',[auth.team_id]);return{native_capture:t.native_capture===1,release_revoked_sources:t.release_revoked_before!=null,release_revoked_sources_since:t.release_revoked_before,release_revoked_sources_grace_days:RELEASE_GRACE_DAYS};};
+  if(req.method==='GET'){
+    const settings=await read(),preview=url.searchParams.get('release_revoked_sources');
+    if(preview===null)return send(res,200,result(api,auth,settings),requestId);
+    if(preview!=='preview')fail(400,'invalid_request','release_revoked_sources reads only as preview');
+    if(!isAdmin(auth))fail(403,'forbidden','forbidden');
+    return send(res,200,result(api,auth,{...settings,release_preview:await releasePreview(api,auth.team_id,settings.release_revoked_sources_since??api.clock.nowMs())}),requestId);
+  }
   if(!isAdmin(auth))fail(403,'forbidden','forbidden');
-  const body=await parseJson(req);exact(body,['native_capture']);if(typeof body.native_capture!=='boolean')fail(400,'invalid_request','native_capture must be a boolean');
-  const now=api.clock.nowMs(),response=result(api,auth,{native_capture:body.native_capture});
-  await guardedMutation(api,res,auth,authGuards(auth,now),[{sql:'UPDATE teams SET native_capture=? WHERE id=?',params:[body.native_capture?1:0,auth.team_id]}],{status:200,body:response,targetId:auth.team_id});
+  const body=await parseJson(req);exact(body,['native_capture','release_revoked_sources']);const set=['native_capture','release_revoked_sources'].filter(name=>body[name]!==undefined);if(!set.length)fail(400,'invalid_request','name a setting');for(const name of set)if(typeof body[name]!=='boolean')fail(400,'invalid_request',`${name} must be a boolean`);
+  const now=api.clock.nowMs(),response=result(api,auth,{...Object.fromEntries(set.map(name=>[name,body[name]])),...(body.release_revoked_sources!==undefined?{release_revoked_sources_since:body.release_revoked_sources?now:null}:{})});
+  // the record of the change says which setting and to what
+  res._auditRecord.operation+=` ${set.map(name=>`${name}=${body[name]}`).join(' ')}`;
+  await guardedMutation(api,res,auth,authGuards(auth,now),set.flatMap(name=>name==='release_revoked_sources'?releaseSetting(auth.team_id,body[name],now):[{sql:'UPDATE teams SET native_capture=? WHERE id=?',params:[body[name]?1:0,auth.team_id]}]),{status:200,body:response,targetId:auth.team_id});
   send(res,200,response,requestId);
 }
 async function updateMember(api,req,res,auth,principalId,requestId){await requireUnlinked(api,auth.team_id);

package/server/migrations/028.mjs

@@ -0,0 +1,15 @@
+// A team may have retention release what its revoked sources left: the sessions only they wrote, and those sources'
+// message ids and capture records (session-release.mjs). `release_revoked_before` is the moment the team turned it on,
+// its cutoff; NULL, the default, is off: a retired machine's sessions are often the only copy of their transcripts, and
+// nothing of them is deleted until the team says so. A source records when it was revoked, and forgets it when it is
+// made active again, by the write that changes its state. Constant cost: two columns and two triggers, no row written.
+export default `
+ALTER TABLE teams ADD COLUMN release_revoked_before INTEGER;
+ALTER TABLE sources ADD COLUMN revoked_at INTEGER;
+CREATE TRIGGER source_revoked AFTER UPDATE OF state ON sources WHEN NEW.state='revoked' AND OLD.state<>'revoked' BEGIN
+  UPDATE sources SET revoked_at=CAST(strftime('%s','now') AS INTEGER)*1000 WHERE team_id=NEW.team_id AND id=NEW.id;
+END;
+CREATE TRIGGER source_unrevoked AFTER UPDATE OF state ON sources WHEN NEW.state<>'revoked' AND OLD.state='revoked' BEGIN
+  UPDATE sources SET revoked_at=NULL WHERE team_id=NEW.team_id AND id=NEW.id;
+END;
+`;

package/server/migrations/index.mjs

@@ -26,7 +26,8 @@ import m024 from './024.mjs';
 import m025 from './025.mjs';
 import m026 from './026.mjs';
 import m027 from './027.mjs';
-export const MIGRATIONS = [m001, m002, m003, m004, m005, m006, m007, m008, m009, m010, m011, m012, m013, m014, m015, m016, m017, m018, m019, m020, m021, m022, m023, m024, m025, m026, m027];
+import m028 from './028.mjs';
+export const MIGRATIONS = [m001, m002, m003, m004, m005, m006, m007, m008, m009, m010, m011, m012, m013, m014, m015, m016, m017, m018, m019, m020, m021, m022, m023, m024, m025, m026, m027, m028];
 /** A message row's `until_revision` while its session's current version still holds it (schema 9). */
 export const OPEN_REVISION = Number.MAX_SAFE_INTEGER;
 /** SQL: message row `m` belongs to the version at revision ?1 (bind the revision twice). */

package/server/published-events.mjs

@@ -12,6 +12,16 @@ const stmt = (sql, ...params) => ({sql, params});
 const batches = (list, size = 90) => Array.from({length: Math.ceil(list.length / size)}, (_, at) => list.slice(at * size, (at + 1) * size));
 const holes = list => list.map(() => '?').join(',');
 const EVENT_REPLAY_BATCH = 32;
+// A publication is written about four times: the event, its resource's snapshot, its idempotent answer, and a
+// webhook delivery. Past the host's maximum a write does not fail, it resets the server under every machine's link:
+// an event that would not fit under the limit beside a mebibyte kept for retention is refused, and writes nothing.
+const EVENT_COPIES = 4, EVENT_RESERVE = 1024 * 1024;
+async function eventHeadroomSpent(api, res, bytes) {
+  const usage = await api.storageUsage?.();
+  if (!usage || usage.used + bytes * EVENT_COPIES + EVENT_RESERVE < usage.limit) return false;
+  res._auditRecord = null; res._idempotencyRecord = null;
+  return true;
+}
 const fail = (status,code,message) => {throw Object.assign(new Error(message),{status,code});};
 const text = (value,label) => {if(typeof value!=='string'||!value||value.length>256||/[\x00-\x1f]/.test(value))fail(400,'invalid_request',`${label} must be a nonempty string of at most 256 characters`);return value;};
 const eventOf = row => ({id:row.id,org:row.team_id,at:row.created_at,actor:JSON.parse(row.actor_json),kind:row.kind,resource:{kind:row.resource_kind,id:row.resource_id},data:JSON.parse(row.data_json)});
@@ -93,8 +103,10 @@ export async function publishedEventRoute(ctx) {
     if(body.actor!=null){exact(body.actor,['session']);if(body.actor.session!=null){text(body.actor.session,'actor.session');if(!body.actor.session.startsWith('session:'))fail(400,'invalid_request','actor.session must name a session');actor.session=body.actor.session;}}
     const source=await api.store.one(OWN_SOURCE,[auth.team_id,publication[1],auth.principal_id,sourceMachine(auth)]);
     if(!source)fail(404,'not_found','event source not found');
+    const spent=await eventHeadroomSpent(api,res,Buffer.byteLength(JSON.stringify(body.data)));
     const old=await api.store.one('SELECT * FROM org_events WHERE id=?',[body.id]);
     if(old){if(old.team_id!==auth.team_id||old.source_id!==publication[1]||old.kind!==body.kind||old.resource_id!==body.resource.id||old.source_revision!==body.revision||canonicalJson(JSON.parse(old.data_json))!==canonicalJson(body.data)||canonicalJson(JSON.parse(old.actor_json))!==canonicalJson(actor))fail(409,'idempotency_conflict','event id already names another event');send(res,200,result(api,auth,eventOf(old)),requestId);return true;}
+    if(spent){res.setHeader('Retry-After','60');throw Object.assign(new Error('event deferred while Teams storage is full'),{status:507,code:'storage_full',retryable:true});}
     const now=api.clock.nowMs(),guards=[...authorityGuards(auth,now),{sql:OWN_SOURCE,params:[auth.team_id,publication[1],auth.principal_id,sourceMachine(auth)],status:403,code:'forbidden',message:'event source authority changed'},
       {sql:'SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM event_resources WHERE team_id=? AND source_id=? AND resource_kind=? AND resource_id=? AND source_revision>=?)',params:[auth.team_id,publication[1],body.resource.kind,body.resource.id,body.revision],status:409,code:'revision_mismatch',message:'resource publication is older than its current snapshot'}];
     const event={id:body.id,org:auth.team_id,at:now,actor,kind:body.kind,resource:body.resource,data:body.data},response=result(api,auth,event);

package/server/session-release.mjs

@@ -0,0 +1,145 @@
+// Releasing what a revoked source left: a team that turns `release_revoked_sources` on (migration 028) has every
+// session only such sources wrote deleted, as a person's delete of it would, and then what a delete leaves behind for
+// that source removed too (its message ids and capture records). Off, nothing here runs: a retired machine's sessions
+// are often the only copy of their transcripts, so only the team's own word releases them.
+//
+// Which sources: those revoked at least the grace before the moment the setting was turned on (its cutoff). Revoking
+// is how a machine is disconnected to be linked again, and connecting it again makes the same source active: a source
+// revoked after the turning-on, or within the grace before it, is not released by it (that takes turning it on
+// again), and a source made active again stops being released at once. The grace is a week: a machine taken off to be
+// re-linked or rebuilt is back within days, and a week is what the server keeps of everything else it ages out.
+
+export const RELEASE_GRACE_DAYS = 7;
+const GRACE_MS = RELEASE_GRACE_DAYS * 86_400_000;
+/** Origin rows a run examines; rows it deletes; rows one delete removes, of messages and message ids, and of captures
+ *  (each cascades to its parts). */
+const ORIGIN_BUDGET = 1000, ORIGIN_WALK = 200, ROW_BUDGET = 4000, ROW_CHUNK = 500, CAPTURE_CHUNK = 50;
+const WALK = 'release_revoked_sources';
+
+// When source `s` was revoked: its own record, or its machine's for a source revoked before sources recorded it.
+const REVOKED_AT = 'COALESCE(s.revoked_at,(SELECT m.revoked_at FROM machines m WHERE m.team_id=s.team_id AND m.id=s.machine_id))';
+/** SQL and parameters: source `s` is released under `cutoff`. */
+const eligible = cutoff => ({ sql: `(s.state='revoked' AND ${REVOKED_AT}<=?)`, params: [cutoff - GRACE_MS] });
+/** SQL and parameters: why session `se` is left whole under `cutoff` (`merged`: it is, or is named by, a correlation;
+ *  `shared`: a version of it came from a source that is not released), or NULL when it is released. */
+const kept = (team, cutoff) => {
+  const source = eligible(cutoff);
+  return { sql: `CASE WHEN se.canonical_id IS NOT NULL OR se.id IN (SELECT left_session_id FROM correlations WHERE team_id=? UNION SELECT right_session_id FROM correlations WHERE team_id=? UNION SELECT canonical_id FROM correlations WHERE team_id=?) THEN 'merged'
+    WHEN EXISTS (SELECT 1 FROM version_sources v WHERE v.team_id=se.team_id AND v.session_id=se.id AND v.source_id<>'' AND NOT EXISTS (SELECT 1 FROM sources s WHERE s.team_id=v.team_id AND s.id=v.source_id AND ${source.sql})) THEN 'shared' END`,
+    params: [team, team, team, ...source.params] };
+};
+
+/**
+ * What turning the setting on at `cutoff` releases, by revoked source: whether the source is released, and of its
+ * sessions how many are released, how many are left whole and why, and the capture records that go with the released.
+ * The same tests the release applies. It reads each revoked source's sessions through the origins' key, each session's
+ * row and its retained versions' sources, and counts captures through their key; it reads no message.
+ */
+export async function releasePreview(api, teamId, cutoff) {
+  const source = eligible(cutoff), whole = kept(teamId, cutoff);
+  const rows = await api.store.query(`SELECT id,name,revoked_at,eligible,COUNT(session_id) sessions,COALESCE(SUM(kept='merged'),0) merged,COALESCE(SUM(kept='shared'),0) shared,
+      COALESCE(SUM(CASE WHEN session_id IS NOT NULL AND eligible AND kept IS NULL THEN (SELECT COUNT(*) FROM captures c WHERE c.team_id=h.team_id AND c.source_id=h.id AND c.harness=h.harness AND c.native_id=h.native_id) END),0) captures
+    FROM (SELECT s.team_id,s.id,s.name,${REVOKED_AT} revoked_at,${source.sql} eligible,o.harness,o.native_id,se.id session_id,
+        CASE WHEN se.id IS NOT NULL AND ${source.sql} THEN ${whole.sql} END kept
+      FROM sources s LEFT JOIN origins o ON o.team_id=s.team_id AND o.source_id=s.id AND o.deleted_at IS NULL
+        LEFT JOIN sessions se ON se.team_id=o.team_id AND se.id=o.session_id AND se.deleted_at IS NULL
+      WHERE s.team_id=? AND s.state='revoked') h GROUP BY id ORDER BY name,id`, [...source.params, ...source.params, ...whole.params, teamId]);
+  const sources = rows.map(row => ({ id: row.id, name: row.name, revoked_at: row.revoked_at, released: row.eligible === 1,
+    ...(row.eligible === 1 ? {} : { not_released: row.revoked_at == null ? 'no revocation time is recorded' : `revoked less than ${RELEASE_GRACE_DAYS} days before the cutoff` }),
+    sessions: { released: row.eligible === 1 ? row.sessions - row.merged - row.shared : 0, left_whole: row.eligible === 1 ? { merged: row.merged, shared: row.shared } : { source_not_released: row.sessions } },
+    captures_released: row.captures }));
+  return { cutoff, grace_days: RELEASE_GRACE_DAYS, sources,
+    totals: { sources_released: sources.filter(item => item.released).length, sessions_released: sources.reduce((sum, item) => sum + item.sessions.released, 0), captures_released: sources.reduce((sum, item) => sum + item.captures_released, 0) } };
+}
+
+/** The statements that turn a team's setting on (its cutoff is now) or off; either starts the walk over. */
+export const releaseSetting = (teamId, on, now) => [
+  { sql: 'UPDATE teams SET release_revoked_before=? WHERE id=?', params: [on ? now : null, teamId] },
+  { sql: 'DELETE FROM maintain_backfill WHERE name=?', params: [WALK] },
+];
+
+/**
+ * One run of the release, inside `maintain`'s budget (`left`). It walks the origins once by rowid, its place kept in
+ * `maintain_backfill` so a restart resumes there; a change of any team's setting starts it over. An origin is passed
+ * when nothing of it is left to do. A session is whole or deleted, never between: the transaction that deletes it
+ * tests, as it writes, that its source is still released and the session still stands alone, and only a deleted
+ * session's rows are removed, in bounded deletes found through a key and safe to repeat. Answers whether more is left.
+ */
+export async function releaseRevokedSources(api, { now, left, count }) {
+  const one = (sql, params = []) => api.store.one(sql, params);
+  const cutoffs = new Map((await api.store.query('SELECT id,release_revoked_before cutoff FROM teams WHERE release_revoked_before IS NOT NULL')).map(row => [row.id, row.cutoff]));
+  if (!cutoffs.size) return false;
+  const walk = await one('SELECT after_rowid,done FROM maintain_backfill WHERE name=?', [WALK]);
+  if (walk?.done) return false;
+  const run = { now, one, count, cutoffs, released: new Map(), rows: ROW_BUDGET, left: () => run.rows > 0 && left(), deleted: false };
+  let after = walk?.after_rowid ?? 0, origins = ORIGIN_BUDGET, finished = false, stopped = false;
+  while (!stopped) {
+    const rows = await api.store.query(`SELECT rowid id,team_id,source_id,harness,native_id,session_id,deleted_at FROM origins WHERE rowid>? ORDER BY rowid LIMIT ${ORIGIN_WALK}`, [after]);
+    if (!rows.length) { finished = true; break; }
+    for (const origin of rows) {
+      if (origins-- <= 0 || !run.left()) { stopped = true; break; }
+      if (cutoffs.has(origin.team_id) && !await releaseOrigin(api, origin, run)) { stopped = true; break; }
+      after = origin.id;
+    }
+  }
+  if (run.deleted) await api.scheduleCapturePrefixWork?.();
+  await api.store.transaction([{ sql: 'INSERT INTO maintain_backfill(name,after_rowid,done) VALUES (?,?,?) ON CONFLICT(name) DO UPDATE SET after_rowid=excluded.after_rowid,done=excluded.done', params: [WALK, after, finished ? 1 : 0] }]);
+  return !finished;
+}
+
+/** Whether all of one origin is done (released, or left as it is); false when the run's budget ended first. */
+async function releaseOrigin(api, origin, run) {
+  const { team_id: team, source_id: source, harness, native_id: native, session_id: session } = origin, { one, now } = run;
+  const cutoff = run.cutoffs.get(team), released = `${team}\0${source}`;
+  if (!run.released.has(released)) { const test = eligible(cutoff); run.released.set(released, Boolean(await one(`SELECT 1 ok FROM sources s WHERE s.team_id=? AND s.id=? AND ${test.sql}`, [team, source, ...test.params]))); }
+  const sourceReleased = run.released.get(released);
+  // An origin still standing matters only under a released source; a deleted one may be a deletion of ours to finish.
+  if (origin.deleted_at == null && !sourceReleased) return true;
+  let deleted = (await one('SELECT deleted_at FROM sessions WHERE team_id=? AND id=?', [team, session]))?.deleted_at != null;
+  if (!deleted) {
+    if (origin.deleted_at != null) return true;
+    // What a person's delete of the session writes (harness-routes mutateSession), but for the team's authorization
+    // epoch: every read already passes over a deleted session, and the epoch would end every open stream of the team.
+    const test = eligible(cutoff), whole = kept(team, cutoff), revision = { $journalRevision: true };
+    const guard = { sql: `SELECT 1 ok FROM sessions se JOIN origins o ON o.team_id=se.team_id AND o.session_id=se.id JOIN sources s ON s.team_id=o.team_id AND s.id=o.source_id
+      WHERE se.team_id=? AND se.id=? AND se.deleted_at IS NULL AND o.source_id=? AND o.harness=? AND o.native_id=? AND o.deleted_at IS NULL AND ${test.sql} AND ${whole.sql} IS NULL`,
+      params: [team, session, source, harness, native, ...test.params, ...whole.params], code: 'left_whole' };
+    if (!await one(guard.sql, guard.params)) return true;
+    let at;
+    try {
+      ({ revision: at } = await api.store.journalTransaction(team, [guard], [
+        { sql: 'UPDATE sessions SET deleted_at=?,revision=? WHERE team_id=? AND id=?', params: [now, revision, team, session] },
+        { sql: 'UPDATE origins SET deleted_at=? WHERE team_id=? AND session_id=? AND source_id=? AND harness=? AND native_id=?', params: [now, team, session, source, harness, native] },
+        { sql: 'INSERT OR IGNORE INTO capture_prefix_garbage SELECT team_id,session_id,source_id,generation FROM capture_prefix_state WHERE team_id=? AND session_id=?', params: [team, session] },
+        { sql: 'DELETE FROM capture_prefix_state WHERE team_id=? AND session_id=?', params: [team, session] },
+        { sql: 'DELETE FROM capture_prefix_warm_queue WHERE team_id=? AND session_id=?', params: [team, session] },
+        { sql: 'UPDATE teams SET journal_revision=? WHERE id=?', params: [revision, team] },
+        { sql: 'INSERT INTO journal(team_id,revision,session_id,kind,created_at) VALUES (?,?,?,?,?)', params: [team, revision, session, 'delete', now] },
+      ]));
+    } catch (error) { if (error?.code === 'left_whole') return true; throw error; }
+    api.events.publish(team, { type: 'session_deleted', cursor: String(at), revision: at, session_id: session });
+    run.count('revoked-source sessions', 1); run.deleted = true; deleted = true;
+  }
+  // A deleted session's versions are the mark of a deletion of ours not yet finished: they go last.
+  const unfinished = Boolean(await one('SELECT 1 held FROM session_versions WHERE team_id=? AND session_id=? LIMIT 1', [team, session]));
+  if (!unfinished && !sourceReleased) return true;
+  const key = [team, source, harness, native];
+  const drain = async (sql, params, chunk, name) => {
+    for (;;) {
+      if (!run.left()) return false;
+      const { changes } = await api.store.exec(sql, params);
+      run.count(name, changes); run.rows -= changes;
+      if (changes < chunk) return true;
+    }
+  };
+  if (!await drain(`DELETE FROM message_ids WHERE rowid IN (SELECT rowid FROM message_ids WHERE team_id=? AND source_id=? AND harness=? AND native_id=? LIMIT ${ROW_CHUNK})`, key, ROW_CHUNK, 'revoked-source message ids')) return false;
+  if (!await drain(`DELETE FROM captures WHERE rowid IN (SELECT rowid FROM captures WHERE team_id=? AND source_id=? AND harness=? AND native_id=? LIMIT ${CAPTURE_CHUNK})`, key, CAPTURE_CHUNK, 'revoked-source captures')) return false;
+  if (!unfinished) return true;
+  if (!await drain(`DELETE FROM messages WHERE rowid IN (SELECT rowid FROM messages WHERE team_id=? AND session_id=? LIMIT ${ROW_CHUNK})`, [team, session], ROW_CHUNK, 'revoked-source messages')) return false;
+  await api.store.transaction([
+    { sql: 'DELETE FROM session_versions WHERE team_id=? AND session_id=?', params: [team, session] },
+    { sql: 'DELETE FROM version_prune_queue WHERE team_id=? AND session_id=?', params: [team, session] },
+    { sql: 'DELETE FROM session_activity WHERE team_id=? AND source_id=? AND harness=? AND native_id=?', params: key },
+  ]);
+  return true;
+}