@volter/teams 0.2.56 → 0.2.58

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/teams",
-  "version": "0.2.56",
+  "version": "0.2.58",
   "type": "module",
   "description": "Volter Teams, the neutral team plane: machine identity and daemon core, the local door and server link, admission from machine grants, product doors, and the Teams server's neutral routes (company RFC 0008).",
   "license": "MIT",

package/server/core.mjs

@@ -1,5 +1,6 @@
 import { deliverAppWebhooks } from './apps.mjs';
 import { reconcileMachinePresence, LINK_GRACE_MS } from './machine-events.mjs';
+import { releaseRevokedSources } from './session-release.mjs';
 // The Teams server, independent of its host. `createTeamsApi` builds the API
 // object every route and door reads; a host attaches a store (`api.attach`),
 // bootstraps the server identity once, serves requests through http.mjs's
@@ -83,6 +84,23 @@ export async function maintain(api,{budgetMs=MAINTAIN_BUDGET_MS}={}){const now=a
       if(await one(`SELECT 1 AS more FROM ${table} WHERE expires_at<=? LIMIT 1`,[now]))more=true;
     }
   });
+  // A publication's replay record written with the whole event in it gives that copy up (a repeat is answered from
+  // the event, http.mjs): the records are walked once by rowid, a bounded window a run, the key, digest and status
+  // kept. The route and the answer's length are read from the row's own page; only an emptied row's overflow pages are
+  // touched, as they are freed.
+  await step('publication replays',async()=>{
+    const walk=await one("SELECT after_rowid,done FROM maintain_backfill WHERE name='publication_replays'");
+    if(walk?.done)return;
+    const after=walk?.after_rowid??0,held=`route GLOB 'POST /api/v1/teams/*/event-sources/*/events' AND octet_length(response_json)>4`;
+    const window=await q(`SELECT rowid AS id,(${held}) AS held FROM idempotency WHERE rowid>? ORDER BY rowid LIMIT ${REPLAY_BATCH}`,[after]);
+    const through=window.at(-1)?.id??after,finished=window.length<REPLAY_BATCH;
+    // the rows are emptied before the walk's place is written: on a full database the write takes a page they freed
+    await tx([
+      {sql:`UPDATE idempotency SET response_json='null' WHERE rowid>? AND rowid<=? AND ${held}`,params:[after,through]},
+      {sql:"INSERT INTO maintain_backfill(name,after_rowid,done) VALUES ('publication_replays',?,?) ON CONFLICT(name) DO UPDATE SET after_rowid=excluded.after_rowid,done=excluded.done",params:[through,finished?1:0]},
+    ]);
+    count('publication replay copies',window.filter(row=>row.held).length);if(!finished)more=true;
+  });
   // A capture or an upload never committed within a day expires, recorded as expired (they are few: only those in flight).
   await step('in flight',async()=>{
     for(const [kept,table] of [['staging_captures','captures'],['pending_uploads','uploads']]){
@@ -233,6 +251,12 @@ export async function maintain(api,{budgetMs=MAINTAIN_BUDGET_MS}={}){const now=a
   await step('webhooks',async()=>{if(await deliverAppWebhooks(api))more=true;});
   // Last, with what the budget leaves: the walks of rows written before migration 023 into its tables.
   await step('backfill',async()=>{if(!await backfill(api,{now,left}))more=true;});
+  // A team that says so has what its revoked sources left released (session-release.mjs); no team does by default.
+  // Last: it takes what the run's budget has left, after everything the server itself needs.
+  await step('revoked sources',async()=>{
+    if(!await walked(api,['version_sources'])){more=true;return;}
+    if(await releaseRevokedSources(api,{now,left,count}))more=true;
+  });
   const result={counts,failed,backlog:more};
   if(Object.keys(counts).length)console.log(`maintain: removed ${Object.entries(counts).map(([name,n])=>`${n} ${name}`).join(', ')}${more?' (backlog)':''}`);
   return result;}
@@ -312,8 +336,8 @@ const VERSION_SESSION_BATCH=10,VERSION_PRUNE_BATCH=20,CAPTURE_WALK=500;
 const MESSAGE_BUDGET=2000,MESSAGE_CHUNK=500;
 /** Committed captures whose parts a run removes, and parts per capture per run. */
 const PARTS_CAPTURE_BATCH=20,PART_PRUNE_BATCH=50;
-/** Rows of one expiry a run removes; captures and uploads in flight a run expires. */
-const EXPIRY_BATCH=500,IN_FLIGHT_BATCH=50;
+/** Rows of one expiry a run removes; captures and uploads in flight a run expires; replay records a run walks. */
+const EXPIRY_BATCH=500,IN_FLIGHT_BATCH=50,REPLAY_BATCH=200;
 /** Queued uploads and blobs a run decides. */
 const UPLOAD_PRUNE_BATCH=20,BLOB_PRUNE_BATCH=50;
 /** Events per team retention walks per run; rows per backfill batch. */

package/server/http.mjs

@@ -1,6 +1,7 @@
 import { appRoute, appPreAuth, appAuthentication, enforceAppScope, appAuthGuards, installedIssuer, identityIssuers } from './apps.mjs';
 import { machineEventStream } from './machine-events.mjs';
-import { publishedEventRoute, OWN_SOURCE, sourceMachine } from './published-events.mjs';
+import { releasePreview, releaseSetting, RELEASE_GRACE_DAYS } from './session-release.mjs';
+import { publishedEventRoute } from './published-events.mjs';
 import { identityRecordRoute, identityAuthority } from './identity-record.mjs';
 import { AGENT_ACTIVE } from './agent-authority.mjs';
 import { APP_LINEAGE_REVOKED } from './auth.mjs';
@@ -21,7 +22,7 @@ class HttpError extends Error { constructor(status,code,message,details=null){su
 const fail=(status,code,message,details)=>{throw new HttpError(status,code,message,details)};
 const parseJson=req=>parseRequestJson(req,fail);
 const result=(api,auth,data)=>({version:1,context:{server_id:api.serverId,team_id:auth.team_id,principal_id:auth.principal_id},data});
-function sideEffectStatements(api,res,status,body,now,targetId=null,journal=false){const statements=[];if(status<400&&res._idempotencyRecord){const record=res._idempotencyRecord,safe=redactSecretReplay(record.path,body);statements.push({sql:'INSERT INTO idempotency(team_id,principal_id,route,key,request_digest,response_status,response_json,expires_at) VALUES (?,?,?,?,?,?,?,?)',params:[record.teamId,record.principalId,record.route,record.key,record.requestDigest,status,journal?{$journalJsonValue:safe}:JSON.stringify(safe),now+86400000]});}if(res._auditRecord){const record=res._auditRecord;statements.push({sql:'INSERT INTO audit(team_id,id,actor_id,operation,target_id,outcome,revision,created_at,actor_json) VALUES (?,?,?,?,?,?,?,?,?)',params:[record.teamId,api.ids.next('audit'),record.actorId,record.operation,targetId,status<400?'allowed':'denied',journal?{$journalRevision:true}:null,now,JSON.stringify(record.act??[])]});}return statements;}
+function sideEffectStatements(api,res,status,body,now,targetId=null,journal=false){const statements=[];if(status<400&&res._idempotencyRecord){const record=res._idempotencyRecord,safe=record.fromEvent?null:redactSecretReplay(record.path,body);statements.push({sql:'INSERT INTO idempotency(team_id,principal_id,route,key,request_digest,response_status,response_json,expires_at) VALUES (?,?,?,?,?,?,?,?)',params:[record.teamId,record.principalId,record.route,record.key,record.requestDigest,status,journal?{$journalJsonValue:safe}:JSON.stringify(safe),now+86400000]});}if(res._auditRecord){const record=res._auditRecord;statements.push({sql:'INSERT INTO audit(team_id,id,actor_id,operation,target_id,outcome,revision,created_at,actor_json) VALUES (?,?,?,?,?,?,?,?,?)',params:[record.teamId,api.ids.next('audit'),record.actorId,record.operation,targetId,status<400?'allowed':'denied',journal?{$journalRevision:true}:null,now,JSON.stringify(record.act??[])]});}return statements;}
 async function persistSideEffects(api,res,status,body){const statements=sideEffectStatements(api,res,status,body,api.clock.nowMs());if(statements.length)await api.store.transaction(statements);}
 function send(res,status,body,requestId,headers={}){
   const deliver=(actualStatus=status,actualBody=body,actualHeaders=headers)=>{
@@ -90,7 +91,10 @@ export function createHttpHandler(api){return async(req,res)=>{const requestId=a
   }
   let m;if(api.harnessRoutes&&await api.harnessRoutes.beforeIdempotency({api,req,res,auth,url,path,sub,requestId}))return;
   const intrinsicPart=req.method==='PUT'&&(/\/captures\/[^/]+\/parts\/\d+$/.test(sub)||/\/uploads\/[^/]+\/chunks\/\d+$/.test(sub)),intrinsicReplay=intrinsicPart||(req.method==='POST'&&(/^\/sources\/[^/]+\/captures$/.test(sub)||/\/captures\/[^/]+\/commit$/.test(sub)||/\/effects\/[^/]+\/(?:claim|result)$/.test(sub)));
-  if(['POST','PATCH','DELETE'].includes(req.method)&&!intrinsicPart){const key=req.headers['idempotency-key'];if(typeof key!=='string'||key.length<16||key.length>128||!/^[\x20-\x7e]+$/.test(key))fail(400,'invalid_request','Idempotency-Key must be 16..128 printable ASCII characters');if(!intrinsicReplay){const body=req.method==='DELETE'?null:await parseJson(req),route=`${req.method} ${path}`,requestDigest=sha256(canonicalJson({method:req.method,path,if_match:req.headers['if-match']??null,body})),old=await api.store.one('SELECT * FROM idempotency WHERE team_id=? AND principal_id=? AND route=? AND key=? AND expires_at>?',[auth.team_id,auth.principal_id,route,key,api.clock.nowMs()]);if(old){if(old.request_digest!==requestDigest)fail(409,'idempotency_conflict','idempotency key was reused with a different request');await authorizeReplay(api,auth,req.method,sub,body);return send(res,old.response_status,JSON.parse(old.response_json),requestId);}res._idempotencyRecord={teamId:auth.team_id,principalId:auth.principal_id,route,key,requestDigest,path};}}
+  // A publication's replay is answered from its event (published-events.mjs): its record keeps the key, the request
+  // digest and the status, and no second copy of the event.
+  const fromEvent=req.method==='POST'&&/^\/event-sources\/[^/]+\/events$/.test(sub);
+  if(['POST','PATCH','DELETE'].includes(req.method)&&!intrinsicPart){const key=req.headers['idempotency-key'];if(typeof key!=='string'||key.length<16||key.length>128||!/^[\x20-\x7e]+$/.test(key))fail(400,'invalid_request','Idempotency-Key must be 16..128 printable ASCII characters');if(!intrinsicReplay){const body=req.method==='DELETE'?null:await parseJson(req),route=`${req.method} ${path}`,requestDigest=sha256(canonicalJson({method:req.method,path,if_match:req.headers['if-match']??null,body})),old=await api.store.one('SELECT * FROM idempotency WHERE team_id=? AND principal_id=? AND route=? AND key=? AND expires_at>?',[auth.team_id,auth.principal_id,route,key,api.clock.nowMs()]);if(old){if(old.request_digest!==requestDigest)fail(409,'idempotency_conflict','idempotency key was reused with a different request');if(fromEvent)res._replayStatus=old.response_status;else{await authorizeReplay(api,auth,req.method,sub,body);return send(res,old.response_status,JSON.parse(old.response_json),requestId);}}else res._idempotencyRecord={teamId:auth.team_id,principalId:auth.principal_id,route,key,requestDigest,path,fromEvent};}}
   if(await appRoute({api,req,res,auth,sub,requestId,parseJson,send,result,guardedMutation}))return;
   if(await publishedEventRoute({api,req,res,auth,sub,url,requestId,parseJson,send,result,guardedMutation}))return;
   if(await agentSessionRoute({api,req,res,auth,sub,url,requestId,parseJson,send,result,guardedMutation}))return;
@@ -102,7 +106,7 @@ export function createHttpHandler(api){return async(req,res)=>{const requestId=a
   if(req.method==='POST'&&sub==='/invitations')return await createInvitation(api,req,res,auth,requestId);
   if(req.method==='POST'&&sub==='/credentials')return await createCredential(api,req,res,auth,requestId);
   if(req.method==='DELETE'&&(m=/^\/credentials\/([^/]+)$/.exec(sub)))return await revokeCredential(api,req,res,auth,m[1],requestId);
-  if((req.method==='GET'||req.method==='PATCH')&&sub==='/settings')return await teamSettings(api,req,res,auth,requestId);
+  if((req.method==='GET'||req.method==='PATCH')&&sub==='/settings')return await teamSettings(api,req,res,auth,url,requestId);
   if(req.method==='GET'&&sub==='/members')return await listMembers(api,res,auth,url,requestId);
   if(req.method==='PATCH'&&(m=/^\/members\/([^/]+)$/.exec(sub)))return await updateMember(api,req,res,auth,m[1],requestId);
   if(req.method==='DELETE'&&(m=/^\/members\/([^/]+)$/.exec(sub)))return await removeMember(api,req,res,auth,m[1],requestId);
@@ -165,7 +169,6 @@ async function authorizeReplay(api,auth,method,sub,body){
     return;
   }
   if(sub==='/event-sources'){if(auth.kind!=='machine'&&!isAdmin(auth)&&!(auth.installation_id&&auth.app_actions.includes('events.publish')))fail(403,'forbidden','event source authorization changed');return;}
-  if((match=/^\/event-sources\/([^/]+)\/events$/.exec(sub))){if(!await api.store.one(OWN_SOURCE,[auth.team_id,match[1],auth.principal_id,sourceMachine(auth)]))fail(404,'not_found','event source not found');return;}
   if(sub.startsWith('/apps')||sub.startsWith('/app-installations')){if(auth.installation_id&&sub===`/app-installations/${auth.installation_id}/delegations`&&method==='POST')return;if(!isAdmin(auth)||auth.installation_id)fail(403,'forbidden','application admin authorization changed');return;}
   if((match=/^\/sources\/([^/]+)\/captures$/.exec(sub))){const source=await api.store.one('SELECT state,machine_id,visibility FROM sources WHERE team_id=? AND id=?',[auth.team_id,match[1]]);if(!source||source.state!=='active'||auth.source_id!==match[1])fail(403,'forbidden','source authorization changed');if(auth.kind==='machine'){const rule=await api.store.one("SELECT 1 ok FROM machines m JOIN sync_rules r ON r.team_id=m.team_id AND r.machine_id=m.id WHERE m.team_id=? AND m.id=? AND m.revoked_at IS NULL AND r.id=? AND r.source_id=? AND r.state='active' AND r.revision=? AND r.visibility=?",[auth.team_id,auth.machine_id,body?.rule_id,match[1],body?.rule_revision,body?.visibility]);if(!rule)fail(403,'forbidden','sync rule authorization changed');}else if(auth.kind!=='ingest'||body?.visibility!==source.visibility)fail(403,'forbidden','source policy changed');return;}
   if((match=/^\/machines\/([^/]+)\/heartbeat$/.exec(sub))&&auth.kind==='machine'){const machine=await api.store.one('SELECT 1 ok FROM machines WHERE team_id=? AND id=? AND revoked_at IS NULL',[auth.team_id,match[1]]);if(!machine||auth.machine_id!==match[1])fail(403,'forbidden','machine authorization changed');return;}
@@ -335,13 +338,24 @@ async function collectionPage(api,auth,url,name,items){
 }
 async function listMembers(api,res,auth,url,requestId){const rows=auth.role==='viewer'?await api.store.query('SELECT m.*,p.kind,p.display_name FROM memberships m JOIN principals p ON p.id=m.principal_id WHERE m.team_id=? AND m.principal_id=? AND m.active=1',[auth.team_id,auth.principal_id]):await api.store.query('SELECT m.*,p.kind,p.display_name FROM memberships m JOIN principals p ON p.id=m.principal_id WHERE m.team_id=? AND m.active=1 ORDER BY p.display_name,m.principal_id',[auth.team_id]);send(res,200,await collectionPage(api,auth,url,'members',rows.map(membershipJson)),requestId);}
 // The team's own settings. native_capture: whether machines upload each session's native transcript (see migration 025).
-async function teamSettings(api,req,res,auth,requestId){
-  const read=async()=>{const t=await api.store.one('SELECT native_capture FROM teams WHERE id=?',[auth.team_id]);return{native_capture:t.native_capture===1};};
-  if(req.method==='GET')return send(res,200,result(api,auth,await read()),requestId);
+// release_revoked_sources: whether retention releases what revoked sources left (migration 028), with the moment it
+// was turned on (its cutoff) and the grace. An administrator's `?release_revoked_sources=preview` says what turning it
+// on now would release, or what the standing cutoff releases, source by source.
+async function teamSettings(api,req,res,auth,url,requestId){
+  const read=async()=>{const t=await api.store.one('SELECT native_capture,release_revoked_before FROM teams WHERE id=?',[auth.team_id]);return{native_capture:t.native_capture===1,release_revoked_sources:t.release_revoked_before!=null,release_revoked_sources_since:t.release_revoked_before,release_revoked_sources_grace_days:RELEASE_GRACE_DAYS};};
+  if(req.method==='GET'){
+    const settings=await read(),preview=url.searchParams.get('release_revoked_sources');
+    if(preview===null)return send(res,200,result(api,auth,settings),requestId);
+    if(preview!=='preview')fail(400,'invalid_request','release_revoked_sources reads only as preview');
+    if(!isAdmin(auth))fail(403,'forbidden','forbidden');
+    return send(res,200,result(api,auth,{...settings,release_preview:await releasePreview(api,auth.team_id,settings.release_revoked_sources_since??api.clock.nowMs())}),requestId);
+  }
   if(!isAdmin(auth))fail(403,'forbidden','forbidden');
-  const body=await parseJson(req);exact(body,['native_capture']);if(typeof body.native_capture!=='boolean')fail(400,'invalid_request','native_capture must be a boolean');
-  const now=api.clock.nowMs(),response=result(api,auth,{native_capture:body.native_capture});
-  await guardedMutation(api,res,auth,authGuards(auth,now),[{sql:'UPDATE teams SET native_capture=? WHERE id=?',params:[body.native_capture?1:0,auth.team_id]}],{status:200,body:response,targetId:auth.team_id});
+  const body=await parseJson(req);exact(body,['native_capture','release_revoked_sources']);const set=['native_capture','release_revoked_sources'].filter(name=>body[name]!==undefined);if(!set.length)fail(400,'invalid_request','name a setting');for(const name of set)if(typeof body[name]!=='boolean')fail(400,'invalid_request',`${name} must be a boolean`);
+  const now=api.clock.nowMs(),response=result(api,auth,{...Object.fromEntries(set.map(name=>[name,body[name]])),...(body.release_revoked_sources!==undefined?{release_revoked_sources_since:body.release_revoked_sources?now:null}:{})});
+  // the record of the change says which setting and to what
+  res._auditRecord.operation+=` ${set.map(name=>`${name}=${body[name]}`).join(' ')}`;
+  await guardedMutation(api,res,auth,authGuards(auth,now),set.flatMap(name=>name==='release_revoked_sources'?releaseSetting(auth.team_id,body[name],now):[{sql:'UPDATE teams SET native_capture=? WHERE id=?',params:[body[name]?1:0,auth.team_id]}]),{status:200,body:response,targetId:auth.team_id});
   send(res,200,response,requestId);
 }
 async function updateMember(api,req,res,auth,principalId,requestId){await requireUnlinked(api,auth.team_id);

package/server/migrations/028.mjs

@@ -0,0 +1,15 @@
+// A team may have retention release what its revoked sources left: the sessions only they wrote, and those sources'
+// message ids and capture records (session-release.mjs). `release_revoked_before` is the moment the team turned it on,
+// its cutoff; NULL, the default, is off: a retired machine's sessions are often the only copy of their transcripts, and
+// nothing of them is deleted until the team says so. A source records when it was revoked, and forgets it when it is
+// made active again, by the write that changes its state. Constant cost: two columns and two triggers, no row written.
+export default `
+ALTER TABLE teams ADD COLUMN release_revoked_before INTEGER;
+ALTER TABLE sources ADD COLUMN revoked_at INTEGER;
+CREATE TRIGGER source_revoked AFTER UPDATE OF state ON sources WHEN NEW.state='revoked' AND OLD.state<>'revoked' BEGIN
+  UPDATE sources SET revoked_at=CAST(strftime('%s','now') AS INTEGER)*1000 WHERE team_id=NEW.team_id AND id=NEW.id;
+END;
+CREATE TRIGGER source_unrevoked AFTER UPDATE OF state ON sources WHEN NEW.state<>'revoked' AND OLD.state='revoked' BEGIN
+  UPDATE sources SET revoked_at=NULL WHERE team_id=NEW.team_id AND id=NEW.id;
+END;
+`;

package/server/migrations/index.mjs

@@ -26,7 +26,8 @@ import m024 from './024.mjs';
 import m025 from './025.mjs';
 import m026 from './026.mjs';
 import m027 from './027.mjs';
-export const MIGRATIONS = [m001, m002, m003, m004, m005, m006, m007, m008, m009, m010, m011, m012, m013, m014, m015, m016, m017, m018, m019, m020, m021, m022, m023, m024, m025, m026, m027];
+import m028 from './028.mjs';
+export const MIGRATIONS = [m001, m002, m003, m004, m005, m006, m007, m008, m009, m010, m011, m012, m013, m014, m015, m016, m017, m018, m019, m020, m021, m022, m023, m024, m025, m026, m027, m028];
 /** A message row's `until_revision` while its session's current version still holds it (schema 9). */
 export const OPEN_REVISION = Number.MAX_SAFE_INTEGER;
 /** SQL: message row `m` belongs to the version at revision ?1 (bind the revision twice). */

package/server/published-events.mjs

@@ -12,10 +12,10 @@ const stmt = (sql, ...params) => ({sql, params});
 const batches = (list, size = 90) => Array.from({length: Math.ceil(list.length / size)}, (_, at) => list.slice(at * size, (at + 1) * size));
 const holes = list => list.map(() => '?').join(',');
 const EVENT_REPLAY_BATCH = 32;
-// A publication is written about four times: the event, its resource's snapshot, its idempotent answer, and a
-// webhook delivery. Past the host's maximum a write does not fail, it resets the server under every machine's link:
+// A publication is written about three times: the event, its resource's snapshot, and a webhook delivery (its replay
+// record holds no copy: a repeat is answered from the event). Past the host's maximum a write does not fail, it resets the server under every machine's link:
 // an event that would not fit under the limit beside a mebibyte kept for retention is refused, and writes nothing.
-const EVENT_COPIES = 4, EVENT_RESERVE = 1024 * 1024;
+const EVENT_COPIES = 3, EVENT_RESERVE = 1024 * 1024;
 async function eventHeadroomSpent(api, res, bytes) {
   const usage = await api.storageUsage?.();
   if (!usage || usage.used + bytes * EVENT_COPIES + EVENT_RESERVE < usage.limit) return false;
@@ -105,7 +105,9 @@ export async function publishedEventRoute(ctx) {
     if(!source)fail(404,'not_found','event source not found');
     const spent=await eventHeadroomSpent(api,res,Buffer.byteLength(JSON.stringify(body.data)));
     const old=await api.store.one('SELECT * FROM org_events WHERE id=?',[body.id]);
-    if(old){if(old.team_id!==auth.team_id||old.source_id!==publication[1]||old.kind!==body.kind||old.resource_id!==body.resource.id||old.source_revision!==body.revision||canonicalJson(JSON.parse(old.data_json))!==canonicalJson(body.data)||canonicalJson(JSON.parse(old.actor_json))!==canonicalJson(actor))fail(409,'idempotency_conflict','event id already names another event');send(res,200,result(api,auth,eventOf(old)),requestId);return true;}
+    if(old){if(old.team_id!==auth.team_id||old.source_id!==publication[1]||old.kind!==body.kind||old.resource_id!==body.resource.id||old.source_revision!==body.revision||canonicalJson(JSON.parse(old.data_json))!==canonicalJson(body.data)||canonicalJson(JSON.parse(old.actor_json))!==canonicalJson(actor))fail(409,'idempotency_conflict','event id already names another event');
+      // a repeat under the key that published it answers as the publication did; under another key, as found
+      send(res,res._replayStatus??200,result(api,auth,eventOf(old)),requestId);return true;}
     if(spent){res.setHeader('Retry-After','60');throw Object.assign(new Error('event deferred while Teams storage is full'),{status:507,code:'storage_full',retryable:true});}
     const now=api.clock.nowMs(),guards=[...authorityGuards(auth,now),{sql:OWN_SOURCE,params:[auth.team_id,publication[1],auth.principal_id,sourceMachine(auth)],status:403,code:'forbidden',message:'event source authority changed'},
       {sql:'SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM event_resources WHERE team_id=? AND source_id=? AND resource_kind=? AND resource_id=? AND source_revision>=?)',params:[auth.team_id,publication[1],body.resource.kind,body.resource.id,body.revision],status:409,code:'revision_mismatch',message:'resource publication is older than its current snapshot'}];

package/server/session-release.mjs

@@ -0,0 +1,145 @@
+// Releasing what a revoked source left: a team that turns `release_revoked_sources` on (migration 028) has every
+// session only such sources wrote deleted, as a person's delete of it would, and then what a delete leaves behind for
+// that source removed too (its message ids and capture records). Off, nothing here runs: a retired machine's sessions
+// are often the only copy of their transcripts, so only the team's own word releases them.
+//
+// Which sources: those revoked at least the grace before the moment the setting was turned on (its cutoff). Revoking
+// is how a machine is disconnected to be linked again, and connecting it again makes the same source active: a source
+// revoked after the turning-on, or within the grace before it, is not released by it (that takes turning it on
+// again), and a source made active again stops being released at once. The grace is a week: a machine taken off to be
+// re-linked or rebuilt is back within days, and a week is what the server keeps of everything else it ages out.
+
+export const RELEASE_GRACE_DAYS = 7;
+const GRACE_MS = RELEASE_GRACE_DAYS * 86_400_000;
+/** Origin rows a run examines; rows it deletes; rows one delete removes, of messages and message ids, and of captures
+ *  (each cascades to its parts). */
+const ORIGIN_BUDGET = 1000, ORIGIN_WALK = 200, ROW_BUDGET = 4000, ROW_CHUNK = 500, CAPTURE_CHUNK = 50;
+const WALK = 'release_revoked_sources';
+
+// When source `s` was revoked: its own record, or its machine's for a source revoked before sources recorded it.
+const REVOKED_AT = 'COALESCE(s.revoked_at,(SELECT m.revoked_at FROM machines m WHERE m.team_id=s.team_id AND m.id=s.machine_id))';
+/** SQL and parameters: source `s` is released under `cutoff`. */
+const eligible = cutoff => ({ sql: `(s.state='revoked' AND ${REVOKED_AT}<=?)`, params: [cutoff - GRACE_MS] });
+/** SQL and parameters: why session `se` is left whole under `cutoff` (`merged`: it is, or is named by, a correlation;
+ *  `shared`: a version of it came from a source that is not released), or NULL when it is released. */
+const kept = (team, cutoff) => {
+  const source = eligible(cutoff);
+  return { sql: `CASE WHEN se.canonical_id IS NOT NULL OR se.id IN (SELECT left_session_id FROM correlations WHERE team_id=? UNION SELECT right_session_id FROM correlations WHERE team_id=? UNION SELECT canonical_id FROM correlations WHERE team_id=?) THEN 'merged'
+    WHEN EXISTS (SELECT 1 FROM version_sources v WHERE v.team_id=se.team_id AND v.session_id=se.id AND v.source_id<>'' AND NOT EXISTS (SELECT 1 FROM sources s WHERE s.team_id=v.team_id AND s.id=v.source_id AND ${source.sql})) THEN 'shared' END`,
+    params: [team, team, team, ...source.params] };
+};
+
+/**
+ * What turning the setting on at `cutoff` releases, by revoked source: whether the source is released, and of its
+ * sessions how many are released, how many are left whole and why, and the capture records that go with the released.
+ * The same tests the release applies. It reads each revoked source's sessions through the origins' key, each session's
+ * row and its retained versions' sources, and counts captures through their key; it reads no message.
+ */
+export async function releasePreview(api, teamId, cutoff) {
+  const source = eligible(cutoff), whole = kept(teamId, cutoff);
+  const rows = await api.store.query(`SELECT id,name,revoked_at,eligible,COUNT(session_id) sessions,COALESCE(SUM(kept='merged'),0) merged,COALESCE(SUM(kept='shared'),0) shared,
+      COALESCE(SUM(CASE WHEN session_id IS NOT NULL AND eligible AND kept IS NULL THEN (SELECT COUNT(*) FROM captures c WHERE c.team_id=h.team_id AND c.source_id=h.id AND c.harness=h.harness AND c.native_id=h.native_id) END),0) captures
+    FROM (SELECT s.team_id,s.id,s.name,${REVOKED_AT} revoked_at,${source.sql} eligible,o.harness,o.native_id,se.id session_id,
+        CASE WHEN se.id IS NOT NULL AND ${source.sql} THEN ${whole.sql} END kept
+      FROM sources s LEFT JOIN origins o ON o.team_id=s.team_id AND o.source_id=s.id AND o.deleted_at IS NULL
+        LEFT JOIN sessions se ON se.team_id=o.team_id AND se.id=o.session_id AND se.deleted_at IS NULL
+      WHERE s.team_id=? AND s.state='revoked') h GROUP BY id ORDER BY name,id`, [...source.params, ...source.params, ...whole.params, teamId]);
+  const sources = rows.map(row => ({ id: row.id, name: row.name, revoked_at: row.revoked_at, released: row.eligible === 1,
+    ...(row.eligible === 1 ? {} : { not_released: row.revoked_at == null ? 'no revocation time is recorded' : `revoked less than ${RELEASE_GRACE_DAYS} days before the cutoff` }),
+    sessions: { released: row.eligible === 1 ? row.sessions - row.merged - row.shared : 0, left_whole: row.eligible === 1 ? { merged: row.merged, shared: row.shared } : { source_not_released: row.sessions } },
+    captures_released: row.captures }));
+  return { cutoff, grace_days: RELEASE_GRACE_DAYS, sources,
+    totals: { sources_released: sources.filter(item => item.released).length, sessions_released: sources.reduce((sum, item) => sum + item.sessions.released, 0), captures_released: sources.reduce((sum, item) => sum + item.captures_released, 0) } };
+}
+
+/** The statements that turn a team's setting on (its cutoff is now) or off; either starts the walk over. */
+export const releaseSetting = (teamId, on, now) => [
+  { sql: 'UPDATE teams SET release_revoked_before=? WHERE id=?', params: [on ? now : null, teamId] },
+  { sql: 'DELETE FROM maintain_backfill WHERE name=?', params: [WALK] },
+];
+
+/**
+ * One run of the release, inside `maintain`'s budget (`left`). It walks the origins once by rowid, its place kept in
+ * `maintain_backfill` so a restart resumes there; a change of any team's setting starts it over. An origin is passed
+ * when nothing of it is left to do. A session is whole or deleted, never between: the transaction that deletes it
+ * tests, as it writes, that its source is still released and the session still stands alone, and only a deleted
+ * session's rows are removed, in bounded deletes found through a key and safe to repeat. Answers whether more is left.
+ */
+export async function releaseRevokedSources(api, { now, left, count }) {
+  const one = (sql, params = []) => api.store.one(sql, params);
+  const cutoffs = new Map((await api.store.query('SELECT id,release_revoked_before cutoff FROM teams WHERE release_revoked_before IS NOT NULL')).map(row => [row.id, row.cutoff]));
+  if (!cutoffs.size) return false;
+  const walk = await one('SELECT after_rowid,done FROM maintain_backfill WHERE name=?', [WALK]);
+  if (walk?.done) return false;
+  const run = { now, one, count, cutoffs, released: new Map(), rows: ROW_BUDGET, left: () => run.rows > 0 && left(), deleted: false };
+  let after = walk?.after_rowid ?? 0, origins = ORIGIN_BUDGET, finished = false, stopped = false;
+  while (!stopped) {
+    const rows = await api.store.query(`SELECT rowid id,team_id,source_id,harness,native_id,session_id,deleted_at FROM origins WHERE rowid>? ORDER BY rowid LIMIT ${ORIGIN_WALK}`, [after]);
+    if (!rows.length) { finished = true; break; }
+    for (const origin of rows) {
+      if (origins-- <= 0 || !run.left()) { stopped = true; break; }
+      if (cutoffs.has(origin.team_id) && !await releaseOrigin(api, origin, run)) { stopped = true; break; }
+      after = origin.id;
+    }
+  }
+  if (run.deleted) await api.scheduleCapturePrefixWork?.();
+  await api.store.transaction([{ sql: 'INSERT INTO maintain_backfill(name,after_rowid,done) VALUES (?,?,?) ON CONFLICT(name) DO UPDATE SET after_rowid=excluded.after_rowid,done=excluded.done', params: [WALK, after, finished ? 1 : 0] }]);
+  return !finished;
+}
+
+/** Whether all of one origin is done (released, or left as it is); false when the run's budget ended first. */
+async function releaseOrigin(api, origin, run) {
+  const { team_id: team, source_id: source, harness, native_id: native, session_id: session } = origin, { one, now } = run;
+  const cutoff = run.cutoffs.get(team), released = `${team}\0${source}`;
+  if (!run.released.has(released)) { const test = eligible(cutoff); run.released.set(released, Boolean(await one(`SELECT 1 ok FROM sources s WHERE s.team_id=? AND s.id=? AND ${test.sql}`, [team, source, ...test.params]))); }
+  const sourceReleased = run.released.get(released);
+  // An origin still standing matters only under a released source; a deleted one may be a deletion of ours to finish.
+  if (origin.deleted_at == null && !sourceReleased) return true;
+  let deleted = (await one('SELECT deleted_at FROM sessions WHERE team_id=? AND id=?', [team, session]))?.deleted_at != null;
+  if (!deleted) {
+    if (origin.deleted_at != null) return true;
+    // What a person's delete of the session writes (harness-routes mutateSession), but for the team's authorization
+    // epoch: every read already passes over a deleted session, and the epoch would end every open stream of the team.
+    const test = eligible(cutoff), whole = kept(team, cutoff), revision = { $journalRevision: true };
+    const guard = { sql: `SELECT 1 ok FROM sessions se JOIN origins o ON o.team_id=se.team_id AND o.session_id=se.id JOIN sources s ON s.team_id=o.team_id AND s.id=o.source_id
+      WHERE se.team_id=? AND se.id=? AND se.deleted_at IS NULL AND o.source_id=? AND o.harness=? AND o.native_id=? AND o.deleted_at IS NULL AND ${test.sql} AND ${whole.sql} IS NULL`,
+      params: [team, session, source, harness, native, ...test.params, ...whole.params], code: 'left_whole' };
+    if (!await one(guard.sql, guard.params)) return true;
+    let at;
+    try {
+      ({ revision: at } = await api.store.journalTransaction(team, [guard], [
+        { sql: 'UPDATE sessions SET deleted_at=?,revision=? WHERE team_id=? AND id=?', params: [now, revision, team, session] },
+        { sql: 'UPDATE origins SET deleted_at=? WHERE team_id=? AND session_id=? AND source_id=? AND harness=? AND native_id=?', params: [now, team, session, source, harness, native] },
+        { sql: 'INSERT OR IGNORE INTO capture_prefix_garbage SELECT team_id,session_id,source_id,generation FROM capture_prefix_state WHERE team_id=? AND session_id=?', params: [team, session] },
+        { sql: 'DELETE FROM capture_prefix_state WHERE team_id=? AND session_id=?', params: [team, session] },
+        { sql: 'DELETE FROM capture_prefix_warm_queue WHERE team_id=? AND session_id=?', params: [team, session] },
+        { sql: 'UPDATE teams SET journal_revision=? WHERE id=?', params: [revision, team] },
+        { sql: 'INSERT INTO journal(team_id,revision,session_id,kind,created_at) VALUES (?,?,?,?,?)', params: [team, revision, session, 'delete', now] },
+      ]));
+    } catch (error) { if (error?.code === 'left_whole') return true; throw error; }
+    api.events.publish(team, { type: 'session_deleted', cursor: String(at), revision: at, session_id: session });
+    run.count('revoked-source sessions', 1); run.deleted = true; deleted = true;
+  }
+  // A deleted session's versions are the mark of a deletion of ours not yet finished: they go last.
+  const unfinished = Boolean(await one('SELECT 1 held FROM session_versions WHERE team_id=? AND session_id=? LIMIT 1', [team, session]));
+  if (!unfinished && !sourceReleased) return true;
+  const key = [team, source, harness, native];
+  const drain = async (sql, params, chunk, name) => {
+    for (;;) {
+      if (!run.left()) return false;
+      const { changes } = await api.store.exec(sql, params);
+      run.count(name, changes); run.rows -= changes;
+      if (changes < chunk) return true;
+    }
+  };
+  if (!await drain(`DELETE FROM message_ids WHERE rowid IN (SELECT rowid FROM message_ids WHERE team_id=? AND source_id=? AND harness=? AND native_id=? LIMIT ${ROW_CHUNK})`, key, ROW_CHUNK, 'revoked-source message ids')) return false;
+  if (!await drain(`DELETE FROM captures WHERE rowid IN (SELECT rowid FROM captures WHERE team_id=? AND source_id=? AND harness=? AND native_id=? LIMIT ${CAPTURE_CHUNK})`, key, CAPTURE_CHUNK, 'revoked-source captures')) return false;
+  if (!unfinished) return true;
+  if (!await drain(`DELETE FROM messages WHERE rowid IN (SELECT rowid FROM messages WHERE team_id=? AND session_id=? LIMIT ${ROW_CHUNK})`, [team, session], ROW_CHUNK, 'revoked-source messages')) return false;
+  await api.store.transaction([
+    { sql: 'DELETE FROM session_versions WHERE team_id=? AND session_id=?', params: [team, session] },
+    { sql: 'DELETE FROM version_prune_queue WHERE team_id=? AND session_id=?', params: [team, session] },
+    { sql: 'DELETE FROM session_activity WHERE team_id=? AND source_id=? AND harness=? AND native_id=?', params: key },
+  ]);
+  return true;
+}