collavre 0.24.0 → 0.25.0

data/app/services/collavre/topics/message_page.rb

@@ -0,0 +1,380 @@
+# frozen_string_literal: true
+
+module Collavre
+  module Topics
+    # One newest-first window of a topic's messages.
+    #
+    # Newest-first is the ordering the window is *selected* in: offset 0 is the
+    # latest message. A conversation's recent end is the part worth reading when
+    # you can only afford part of it, and it is the part whose position does not
+    # change as the topic grows — an oldest-first offset would point somewhere
+    # different every time a message arrived.
+    class MessagePage
+      include Collavre::PublicAssetsHelper
+
+      DEFAULT_LIMIT = 50
+      MAX_LIMIT = 200
+
+      # Rendered oldest-first inside the window by default. The window is chosen
+      # from the newest end; how it reads once chosen is a separate question,
+      # and a summary written from a backwards transcript inverts cause and
+      # effect. Callers wanting the raw newest-first order pass order: "desc".
+      ORDERS = %w[asc desc].freeze
+      DEFAULT_ORDER = "asc"
+
+      Page = Struct.new(
+        :topic, :total_count, :total_chars, :offset, :limit,
+        :messages, :newest_message_id, :budget_exhausted, :budget,
+        :content_offset, :order, :next_cursor,
+        keyword_init: true
+      ) do
+        def returned_count = messages.size
+
+        # What the caller reads.
+        def returned_chars = messages.sum { |m| m[:content].to_s.length }
+
+        # What the caller is charged: what emitting these messages in the
+        # requested format costs, which is not what their prose measures.
+        def billed_chars = messages.sum { |m| budget.cost(m) }
+
+        def clipped_count = messages.count { |m| m[:clipped] }
+
+        def next_content_offset
+          messages.filter_map { |message| message[:next_content_offset] }.first ||
+            (content_offset if messages.empty? && next_cursor.present?)
+        end
+
+        # A clipped row is not consumed. The next call stays on the same row
+        # and advances inside its content; only a complete row advances offset.
+        def has_more? = next_cursor.present?
+
+        def next_offset
+          return offset if next_content_offset.present? || (messages.empty? && has_more?)
+
+          has_more? ? offset + returned_count : nil
+        end
+      end
+
+      # budget carries both the cap and the format it is counted in — see
+      # CharBudget for why those cannot be separate arguments.
+      def initialize(topic:, user:, **options)
+        options.assert_valid_keys(
+          :offset, :limit, :order, :include_system, :max_message_id, :content_offset, :cursor, :budget
+        )
+        @topic = topic
+        @user = user
+        @offset = [ options.fetch(:offset, 0).to_i, 0 ].max
+        @limit = clamp_limit(options.fetch(:limit, DEFAULT_LIMIT))
+        @order = normalized_order(options.fetch(:order, DEFAULT_ORDER))
+        @include_system = options.fetch(:include_system, false)
+        @max_message_id = options[:max_message_id]
+        @content_offset = [ options.fetch(:content_offset, 0).to_i, 0 ].max
+        @cursor = decode_cursor(options[:cursor])
+        @topic_assigned_before = @cursor&.fetch(:topic_assigned_before)
+        @budget = options.fetch(:budget, CharBudget.new)
+      end
+
+      def call
+        # CommentMoveService takes the destination topic lock before changing a
+        # comment's membership. Holding the same lock through the anchor and
+        # reads makes the assignment timestamp a commit-order boundary: a move
+        # is either wholly before this snapshot or wholly after it.
+        Topic.transaction do
+          lock_authorized_topic
+          build_page
+        end
+      end
+
+      private
+
+      def build_page
+        anchor!
+        stat = MessageStats.for(
+          [ @topic ], user: @user, include_system: @include_system,
+          max_message_id: @max_message_id, topic_assigned_before: @topic_assigned_before
+        ).fetch(@topic.id)
+        window = fetch_window
+        content_offset = content_offset_for(window.first)
+        messages = within_budget(serialize_window(window.first(@limit), content_offset: content_offset))
+        next_cursor = encode_cursor(next_candidate(window, messages))
+
+        Page.new(
+          topic: @topic,
+          total_count: stat.count,
+          total_chars: stat.chars,
+          offset: @offset,
+          limit: @limit,
+          messages: @order == "asc" ? messages.reverse : messages,
+          newest_message_id: @max_message_id,
+          budget_exhausted: budget_exhausted?(messages, next_cursor),
+          content_offset: content_offset,
+          order: @order,
+          next_cursor: next_cursor,
+          budget: @budget
+        )
+      end
+
+      # Do not reload @topic here: TopicSelection already authorized its
+      # creative. If a concurrent TopicMove changed that creative, the exact
+      # authorized pair no longer locks or reads anything and fails closed.
+      def lock_authorized_topic
+        Topic.where(id: @topic.id, creative_id: @topic.creative_id).lock.pick(:id)
+      end
+
+      # An unanchored call picks its own anchor before it reads anything else,
+      # so the totals, the window and the advertised newest_message_id all
+      # describe one snapshot. Reading the anchor last instead lets a message
+      # that arrives mid-call land in the totals but not the window, or be
+      # named as newest without having been returned — and the caller then
+      # pages with an anchor that shifts every offset under it, repeating one
+      # message and skipping another.
+      #
+      # An empty topic anchors at 0 rather than nil, because nil is how this
+      # scope spells "unbounded": leaving it there would let a message arriving
+      # between the anchor and the totals query into both, and then advertise
+      # no anchor for the caller to pin the next page with. Zero is below every
+      # id, so it names the empty snapshot exactly, and Ruby's 0 is truthy —
+      # a caller passing it back gets the same bound rather than a fresh anchor.
+      def anchor!
+        @topic_assigned_before ||= Time.current
+        @max_message_id ||= MessageScope.for(
+          @topic, user: @user, include_system: @include_system,
+          topic_assigned_before: @topic_assigned_before
+        ).maximum(:id) || 0
+      end
+
+      def scope
+        @scope ||= MessageScope.for(
+          @topic, user: @user, include_system: @include_system,
+          max_message_id: @max_message_id, topic_assigned_before: @topic_assigned_before
+        )
+      end
+
+      # id is the tiebreak, not decoration: comments posted inside the same
+      # clock tick would otherwise order arbitrarily, and an unstable sort makes
+      # offset pagination drop and repeat rows across pages.
+      def fetch_window
+        relation = scope.includes(:user, images_attachments: :blob)
+                        .order(created_at: :desc, id: :desc)
+        relation = after_cursor(relation) if @cursor
+        relation = relation.offset(@offset) unless @cursor
+        relation.limit(@limit + 1).to_a
+      end
+
+      def serialize_window(comments, content_offset:)
+        comments.map.with_index do |comment, index|
+          serialize(comment, content_offset: index.zero? ? content_offset : 0)
+        end
+      end
+
+      # A content offset belongs to the row named by the cursor. If that row
+      # leaves the topic, the inclusive keyset boundary correctly selects the
+      # next surviving row, but its content must start at zero.
+      def content_offset_for(first_comment)
+        return @content_offset unless @cursor
+        return @content_offset if cursor_row_unchanged?(first_comment)
+
+        0
+      end
+
+      def cursor_row_unchanged?(comment)
+        comment&.id == @cursor.fetch(:id) &&
+          timestamp_micros(comment.updated_at) == @cursor.fetch(:updated_at_micros)
+      end
+
+      # The cursor names the first row not yet consumed, inclusively. This is
+      # what makes it survive that row itself being deleted or moved: the same
+      # ordered boundary still selects every older surviving row. During a
+      # clipped-row continuation it names the current row instead.
+      def next_candidate(window, messages)
+        return window.first if messages.empty? || messages.first[:clipped]
+
+        window[messages.length]
+      end
+
+      def after_cursor(relation)
+        relation.where(
+          "comments.created_at < :created_at OR " \
+            "(comments.created_at = :created_at AND comments.id <= :id)",
+          created_at: @cursor.fetch(:created_at), id: @cursor.fetch(:id)
+        )
+      end
+
+      def encode_cursor(comment)
+        return unless comment
+
+        [
+          timestamp_micros(comment.created_at), comment.id,
+          timestamp_micros(comment.updated_at), timestamp_micros(@topic_assigned_before)
+        ].join(":")
+      end
+
+      def decode_cursor(value)
+        return if value.blank?
+
+        match = /\A(\d{1,20}):(\d{1,20}):(\d{1,20}):(\d{1,20})\z/.match(value.to_s)
+        raise ArgumentError, "cursor is invalid" unless match
+
+        micros = Integer(match[1], 10)
+        id = Integer(match[2], 10)
+        updated_at_micros = Integer(match[3], 10)
+        topic_assigned_before_micros = Integer(match[4], 10)
+        unless [ micros, id, updated_at_micros, topic_assigned_before_micros ].all?(&:positive?)
+          raise ArgumentError, "cursor is invalid"
+        end
+
+        {
+          created_at: Time.at(micros / 1_000_000, micros % 1_000_000, :microsecond).utc,
+          id: id,
+          updated_at_micros: updated_at_micros,
+          topic_assigned_before: Time.at(
+            topic_assigned_before_micros / 1_000_000,
+            topic_assigned_before_micros % 1_000_000,
+            :microsecond
+          ).utc
+        }
+      rescue RangeError
+        raise ArgumentError, "cursor is invalid"
+      end
+
+      def timestamp_micros(time)
+        (time.to_r * 1_000_000).to_i
+      end
+
+      # Trims the newest-first window to the character budget. A message that
+      # does not fit ends the window rather than being cut in half — except for
+      # the first one, where stopping short would return zero rows at an offset
+      # that does have rows and leave the caller paging against it forever.
+      # That one is clipped to what the budget can pay for and exposes a content
+      # continuation. The row offset stays put until all of its prose is read.
+      def within_budget(messages)
+        return messages if @budget.unlimited?
+
+        spent = 0
+        kept = []
+        messages.each do |message|
+          cost = @budget.cost(message)
+          if @budget.fits?(cost, spent: spent)
+            kept << message
+            spent += cost
+            next
+          end
+
+          clipped = kept.empty? ? clip(message) : nil
+          kept << clipped if clipped
+          break
+        end
+        kept
+      end
+
+      # Returns nil when the budget cannot pay even for the envelope and the
+      # notice — there is no honest way to emit a fragment that small, and the
+      # empty page carries budget_limited to say so.
+      def clip(message)
+        content = message[:content].to_s
+        room = widest_prefix(message, content)
+        return nil if room <= 0
+
+        clipped(message, content, room)
+      end
+
+      # The longest prefix of the prose whose rendered cost still fits.
+      # Subtraction would do for markdown, where a character of content costs a
+      # character of output, but json escapes the prose while serializing it, so
+      # a slice can emit wider than it reads and arithmetic only gives an upper
+      # bound. Cost rises monotonically with the prefix, so the exact answer is
+      # a bisection — eighteen serializations at the largest cap, and only on
+      # the clip path, which is one message per call at most.
+      def widest_prefix(message, content)
+        low = 0
+        high = content.length
+        while low < high
+          mid = (low + high + 1) / 2
+          if @budget.fits?(@budget.cost(clipped(message, content, mid)))
+            low = mid
+          else
+            high = mid - 1
+          end
+        end
+        low
+      end
+
+      def clipped(message, content, take)
+        start = message[:content_offset].to_i
+        finish = start + take
+        total = message[:content_total_chars] || content.length
+
+        message.merge(
+          content: content[0, take],
+          content_offset: start,
+          content_end_offset: finish,
+          content_total_chars: total,
+          next_content_offset: finish,
+          clip_notice: clip_notice(finish, total),
+          clipped: true
+        )
+      end
+
+      # Counted against the budget like any other content, and phrased for the
+      # reader of the transcript: the caller sees the clip where the words stop,
+      # not only in a flag on the payload it may have rendered away.
+      def clip_notice(next_offset, total)
+        "…[clipped at #{next_offset} of #{total} chars — continue with content_offset: #{next_offset}]"
+      end
+
+      def serialize(comment, content_offset:)
+        content = serialized_content(comment)
+        start = [ content_offset, content.length ].min
+        message = {
+          id: comment.id,
+          author: comment.user&.display_name || "system",
+          author_id: comment.user_id,
+          agent: comment.user&.ai_user? || false,
+          created_at: comment.created_at&.iso8601,
+          content: content[start..] || ""
+        }
+        return message if start.zero?
+
+        message.merge(
+          content_offset: start,
+          content_end_offset: content.length,
+          content_total_chars: content.length
+        )
+      end
+
+      # Image metadata lives inside the pageable content rather than beside it.
+      # That keeps image-only comments meaningful while letting max_chars and
+      # content_offset bound and continue an arbitrarily large attachment list
+      # through the same contract as the message prose.
+      def serialized_content(comment)
+        text = Collavre::HtmlText.plain(comment.content).strip
+        [ text.presence, image_markers(comment).presence ].compact.join("\n\n")
+      end
+
+      def image_markers(comment)
+        comment.images.map.with_index(1) do |image, index|
+          "[Image attachment #{index}: #{image.filename.sanitized} " \
+            "(#{image.content_type}, #{image.byte_size} bytes) — #{public_asset_url(image.blob)}]"
+        end.join("\n")
+      end
+
+      def budget_exhausted?(messages, next_cursor)
+        return false if @budget.unlimited?
+
+        messages.any? { |message| message[:clipped] } ||
+          (messages.size < @limit && next_cursor.present?)
+      end
+
+      def clamp_limit(limit)
+        limit = limit.to_i
+        return DEFAULT_LIMIT if limit <= 0
+
+        [ limit, MAX_LIMIT ].min
+      end
+
+      def normalized_order(order)
+        ORDERS.include?(order.to_s) ? order.to_s : DEFAULT_ORDER
+      end
+    end
+  end
+end

data/app/services/collavre/topics/message_page_markdown.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+module Collavre
+  module Topics
+    # Renders the topic_messages payload as markdown.
+    #
+    # Renders the *payload*, not the records, so the markdown and json formats
+    # of the same call cannot disagree about what was returned — the json branch
+    # returns the identical hash this reads.
+    #
+    # Markdown is the default format because the content is prose. Wrapping
+    # conversation in JSON escaping costs a large fraction of the character
+    # budget the paging exists to protect, and buys nothing: the caller is going
+    # to read the words, not index into them.
+    module MessagePageMarkdown
+      module_function
+
+      def call(payload)
+        sections = payload[:topics].map { |topic| render_topic(topic) }
+        sections << truncation_notice if payload[:truncated]
+        sections.join("\n")
+      end
+
+      def render_topic(entry)
+        return render_error(entry) if entry[:error]
+        return "#{title(entry)}\n#{skipped_notice(entry)}\n" if entry[:skipped_reason]
+
+        [ header(entry), *continuation(entry), "", *body(entry) ].join("\n")
+      end
+
+      def render_error(entry)
+        "## [topic #{entry[:topic_id]}] unavailable\n#{entry[:error]}\n"
+      end
+
+      def title(entry)
+        "## [topic #{entry[:topic_id]}] #{entry[:topic_name]} (creative #{entry[:creative_id]})"
+      end
+
+      def header(entry)
+        "#{title(entry)}\n" \
+          "#{entry[:total_count]} messages, ~#{entry[:total_chars]} raw chars — " \
+          "showing #{shown_range(entry)} of #{entry[:total_count]}, newest-first window"
+      end
+
+      def shown_range(entry)
+        return "none" if entry[:returned_count].to_i.zero?
+
+        "#{entry[:offset]}-#{entry[:offset] + entry[:returned_count] - 1}"
+      end
+
+      # The next call is spelled out rather than left as a next_offset field to
+      # decode. max_message_id is repeated into it because that is the whole
+      # point of the anchor — a caller that drops it silently re-reads messages
+      # as the topic grows underneath the pagination.
+      #
+      # include_system is repeated for the same reason, and it matters more:
+      # the anchor shifts rows, but a narrower scope renumbers them. Paging
+      # into a set that no longer contains the system rows the first page
+      # counted lands the offset past messages that were never returned.
+      def continuation(entry)
+        return [] unless entry[:has_more]
+
+        [ "More: topic_messages(topic_ids: #{entry[:topic_id]}, offset: #{entry[:next_offset]}, " \
+          "cursor: \"#{entry[:next_cursor]}\", " \
+          "max_message_id: #{entry[:newest_message_id]}, limit: #{entry[:limit]}, " \
+          "max_chars: #{entry[:max_chars]}#{content_option(entry)}" \
+          "#{order_option(entry)}#{scope_option(entry)})" ]
+      end
+
+      def content_option(entry)
+        entry[:next_content_offset] ? ", content_offset: #{entry[:next_content_offset]}" : ""
+      end
+
+      def order_option(entry)
+        entry[:order] == "desc" ? ', order: "desc"' : ""
+      end
+
+      def scope_option(entry)
+        entry[:include_system] ? ", include_system: true" : ""
+      end
+
+      def skipped_notice(entry)
+        "Not fetched: #{entry[:skipped_reason]}. Re-request this topic alone, or raise max_chars."
+      end
+
+      # Oldest-to-newest within the window by default, so the transcript reads
+      # forwards even though the window was chosen from the newest end.
+      def body(entry)
+        entry[:messages].map do |message|
+          rendered = "[#{message[:id]}] #{message[:created_at]} #{message[:author]}" \
+            "#{message[:agent] ? ' (agent)' : ''}\n#{message[:content]}\n"
+          message[:clip_notice] ? "#{rendered}#{message[:clip_notice]}\n" : rendered
+        end
+      end
+
+      def truncation_notice
+        "> Output hit max_chars. Topics above may be partial — see each topic's " \
+          "\"More:\" line, or request fewer topics per call.\n"
+      end
+    end
+  end
+end

data/app/services/collavre/topics/message_scope.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+module Collavre
+  module Topics
+    # The one definition of "the messages of a topic" that the read tools share,
+    # so a count reported by topic_list and a page returned by topic_messages
+    # can never describe different sets.
+    module MessageScope
+      module_function
+
+      # include_system: false is the default because the caller is almost always
+      # summarizing a conversation, and authorless rows are the timeline's
+      # furniture — "⏳" concurrency notices, channel announcements. Leaving
+      # them in would spend the caller's character budget on text nobody wrote.
+      #
+      # without_approval_action is NOT part of that switch. Approval-surface
+      # rows are excluded unconditionally, because Comment.without_approval_action
+      # carries an invariant these tools do not get to opt out of: an approval
+      # prompt must never reach an agent as history or trigger context. Every
+      # other agent-context query in the engine applies it the same way, and a
+      # read tool is exactly the back door that invariant exists to close.
+      #
+      # visible_to is applied unconditionally for the same reason: a private
+      # comment belongs to its author and approver, and a tool must not be the
+      # way around that.
+      #
+      # max_message_id excludes rows created after the first page. The topic
+      # assignment anchor excludes older rows moved in after that page, while
+      # MessagePage's keyset cursor lets rows leave without shifting unread
+      # survivors ahead of a numeric offset.
+      def for(topic, user:, include_system: false, max_message_id: nil, topic_assigned_before: nil)
+        for_topics(
+          [ topic ], user: user, include_system: include_system,
+          max_message_id: max_message_id, topic_assigned_before: topic_assigned_before
+        )
+      end
+
+      # Pair every topic id with the creative that was authorized. TopicMove
+      # preserves the topic id while relocating all of its comments, so an
+      # id-only query could read the destination creative after the permission
+      # check. The exact pair also avoids cross-topic matches in batch totals.
+      def for_topics(topics, user:, include_system: false, max_message_id: nil, topic_assigned_before: nil)
+        membership = topic_membership(topics)
+        return Comment.none unless membership
+
+        scope = Comment.where(membership).visible_to(user).without_approval_action
+        scope = scope.where.not(user_id: nil) unless include_system
+        scope = scope.where("comments.id <= ?", max_message_id) if max_message_id
+        scope = scope.where("comments.topic_assigned_at <= ?", topic_assigned_before) if topic_assigned_before
+        scope
+      end
+
+      def topic_membership(topics)
+        table = Comment.arel_table
+        Array(topics).map do |topic|
+          table[:topic_id].eq(topic.id).and(table[:creative_id].eq(topic.creative_id))
+        end.reduce { |combined, pair| combined.or(pair) }
+      end
+    end
+  end
+end

data/app/services/collavre/topics/message_stats.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+module Collavre
+  module Topics
+    # Per-topic message totals for a set of topics, in grouped aggregate queries.
+    #
+    # This is the call that makes fan-out planning possible: before an agent
+    # spends its context on message bodies it asks how much there is, and
+    # decides how to chunk. Counting by loading is exactly what that is meant to
+    # avoid, so nothing here instantiates a Comment.
+    module MessageStats
+      Stat = Struct.new(:count, :chars, :last_at, keyword_init: true)
+
+      # Marker prose, attachment index, byte-size digits, separators and the
+      # signed-id path are bounded conservatively here. Filename is charged
+      # twice because it appears in both the label and URL; content type and a
+      # configured public-assets host are charged at their actual lengths.
+      ATTACHMENT_MARKER_OVERHEAD_CHARS = 300
+
+      EMPTY = Stat.new(count: 0, chars: 0, last_at: nil).freeze
+
+      module_function
+
+      # Returns { topic_id => Stat }, with EMPTY for topics that have no
+      # visible messages (a grouped query returns no row for them at all).
+      #
+      # `chars` combines LENGTH over the stored HTML with a conservative image
+      # marker estimate. It remains a planning estimate rather than an exact
+      # rendered size: exact text requires stripping every body, which is the
+      # load this query exists to avoid.
+      # max_message_id must reach the totals as well as the window. has_more? is
+      # (offset + returned) < total, so a total counting past the anchor would
+      # keep claiming there is another page after the snapshot has been fully
+      # read — the caller pages forever against rows its anchor excludes.
+      def for(topics, user:, include_system: false, max_message_id: nil, topic_assigned_before: nil)
+        topics = Array(topics)
+        return {} if topics.empty?
+
+        scope = MessageScope.for_topics(
+          topics, user: user, include_system: include_system,
+          max_message_id: max_message_id, topic_assigned_before: topic_assigned_before
+        )
+        rows = grouped_rows(scope)
+        attachment_chars = attachment_chars_by_topic(scope)
+        totals = rows.to_h do |topic_id, count, chars, last_at|
+          total_chars = chars.to_i + attachment_chars.fetch(topic_id, 0)
+          [ topic_id, Stat.new(count: count.to_i, chars: total_chars, last_at: as_time(last_at)) ]
+        end
+
+        topics.to_h { |topic| [ topic.id, totals[topic.id] || EMPTY ] }
+      end
+
+      # An aggregate selected through Arel.sql carries no column type, so the
+      # adapter hands MAX(created_at) back as the raw driver value — a String on
+      # Postgres. Callers expect a Time they can format, so normalize here
+      # rather than at each of them.
+      def as_time(value)
+        return value if value.nil? || value.is_a?(Time)
+
+        Time.zone.parse(value.to_s)
+      end
+
+      def grouped_rows(scope)
+        scope.group(:topic_id).pluck(
+          :topic_id,
+          Arel.sql("COUNT(*)"),
+          Arel.sql("COALESCE(SUM(LENGTH(comments.content)), 0)"),
+          Arel.sql("MAX(comments.created_at)")
+        )
+      end
+
+      def attachment_chars_by_topic(scope)
+        host_chars = Collavre::IntegrationSettings.fetch(:public_assets_host).to_s.length
+
+        attachment_rows(scope).to_h do |topic_id, count, filename_chars, content_type_chars|
+          estimate = count.to_i * (ATTACHMENT_MARKER_OVERHEAD_CHARS + host_chars) +
+            filename_chars.to_i * 2 + content_type_chars.to_i
+          [ topic_id, estimate ]
+        end
+      end
+
+      def attachment_rows(scope)
+        scope.joins(images_attachments: :blob).group(:topic_id).pluck(
+          :topic_id,
+          Arel.sql("COUNT(active_storage_attachments.id)"),
+          Arel.sql("COALESCE(SUM(LENGTH(active_storage_blobs.filename)), 0)"),
+          Arel.sql("COALESCE(SUM(LENGTH(active_storage_blobs.content_type)), 0)")
+        )
+      end
+    end
+  end
+end

data/app/services/collavre/topics/move_blocker.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module Collavre
+  module Topics
+    class MoveBlocker
+      class MoveBlockedError < StandardError; end
+      class ActiveTaskError < MoveBlockedError; end
+      class PendingDeliveryError < MoveBlockedError; end
+      class RecurringTaskError < MoveBlockedError; end
+      class TriggerLoopError < MoveBlockedError; end
+
+      def initialize(topic)
+        @topic = topic
+      end
+
+      def call
+        if Task.where(topic_id: topic.id, status: Task::ACTIVE_STATUSES).exists?
+          raise ActiveTaskError, I18n.t("collavre.topics.move.active_tasks")
+        end
+        if pending_delivery_restoration?
+          raise PendingDeliveryError, I18n.t("collavre.topics.move.pending_deliveries")
+        end
+        if trigger_loop_topic?
+          raise TriggerLoopError, I18n.t("collavre.topics.move.trigger_loop")
+        end
+        return unless Crons::RecurringTopicTasks.new(topic.id).any?
+
+        raise RecurringTaskError, I18n.t("collavre.topics.move.recurring_tasks")
+      end
+
+      private
+
+      attr_reader :topic
+
+      def pending_delivery_restoration?
+        Task.where(topic_id: topic.id).where.not(status: Task::ACTIVE_STATUSES).find_each.any? do |task|
+          Orchestration::DeliveryRecord.pending_restoration?(task)
+        end
+      end
+
+      def trigger_loop_topic?
+        creative_data = Creative.where(id: topic.creative_id).pick(:data)
+        creative_data&.dig("trigger", "loop", "trigger_topic_id").to_i == topic.id
+      end
+    end
+  end
+end