@3sln/trove 0.0.2

package/packages/web/src/bl/index.js

@@ -0,0 +1,70 @@
+// Assemble the ngin engine and the reactive services into one `app` context,
+// register commands and built-in openers, and expose everything the UI needs.
+// The engine holds a single `app` singleton provider so Actions can reach the
+// platform and services; the app object also carries the engine so Actions can
+// dispatch follow-up Actions (the choreographer pattern).
+
+import { Engine, Provider } from '@3sln/ngin';
+import { effect } from '../runtime.js';
+import { ExplorerService, SearchClientService, TransfersService } from './services.js';
+import { SocialService } from './social.js';
+import { OfflineService } from './offline.js';
+import { ActivityService } from './activity.js';
+import { registerCommands } from './commands.js';
+import { NavigateAction, LoadCollectionsAction, OpenInitialCollectionAction } from './actions.js';
+
+export function createApp(platform) {
+  const explorer = new ExplorerService(platform.settings);
+  const search = new SearchClientService();
+  // One place for "what's running" and "what's stuck", covering both sides of the wire.
+  const activity = new ActivityService(platform);
+  const transfers = new TransfersService(activity);
+  const social = new SocialService(platform);
+  const offline = new OfflineService(platform);
+  social.offline = offline; // social queues sidecar ops through offline when disconnected
+
+  const app = { platform, explorer, search, transfers, social, offline, activity, engine: null };
+
+  const engine = new Engine({
+    providers: { app: Provider.fromSingleton(app) },
+  });
+  app.engine = engine;
+
+  registerCommands(app);
+
+  // Wire the plugin panel opener hook to the workbench.
+  platform.openPluginPanel = (pluginId) => platform.workbench.openPluginPanel(pluginId);
+
+  // Project explorer state → context keys in ONE place. These drive when-clauses
+  // (e.g. the Delete keybinding needs `explorer.hasSelection`), and previously only
+  // NavigateAction set them — so selecting a file never flipped hasSelection true and
+  // Delete silently did nothing. Deriving them from the observable keeps them honest.
+  platform.context.setMany({ 'explorer.collectionId': 'default', 'explorer.hasSelection': false });
+  effect(explorer.observe(), (ex) => {
+    platform.context.setMany({
+      'explorer.collectionId': ex.collectionId || 'default',
+      'explorer.hasSelection': (ex.selection?.length || 0) > 0,
+    });
+  });
+
+  // Load a file's conversation/tags whenever the active viewer panel changes (the
+  // panel stack lives in the navigation sub-service now).
+  let lastTab = null;
+  effect(platform.workbench.observeNav(), (nav) => {
+    if (nav.activeTabId !== lastTab) {
+      lastTab = nav.activeTabId;
+      // Clear the sidecar when no file is active (last tab closed) so a stale
+      // conversation from the previous file doesn't linger.
+      social.loadSidecar(nav.activeFile ? nav.activeFile.id : null);
+    }
+  });
+
+  social.init();
+  offline.init();
+  activity.init();
+  engine.dispatch(new LoadCollectionsAction());
+
+  return { engine, app };
+}
+
+export { NavigateAction };

package/packages/web/src/bl/links.js

@@ -0,0 +1,54 @@
+// Following a `trove:` link from a document.
+//
+// Resolution is deliberately lazy — at click time, not at render time. A document can
+// hold dozens of links; resolving them all on every render would be a request per link,
+// and the answer can change between renders anyway (the target may be created, renamed,
+// or deleted while the document is open). So a link is rendered from its text alone, and
+// only what the user actually follows costs a round trip.
+//
+// A broken link is a normal, expected state — names are the legible way to write a link,
+// and renaming breaks them. It has to say so clearly, and say WHY, because "nothing
+// happened" is the worst possible response to a click.
+
+import { parseTroveUri } from '@3sln/trove/core/links.js';
+import { OpenFileAction } from './actions.js';
+
+/**
+ * Open what a `trove:` URI points at.
+ * @param {object} ui       the workbench ui helper
+ * @param {string} uri      the link as written in the document
+ * @param {{from?: object}} [opts]  the item the link was followed FROM, for messages
+ */
+export async function openTroveLink(ui, uri, { from } = {}) {
+  const ref = parseTroveUri(uri);
+  const notify = ui.platform.notifications;
+  if (!ref) {
+    notify.warn(`"${uri}" isn’t a valid Trove link.`);
+    return null;
+  }
+  try {
+    const res = await ui.platform.api.stat(uri);
+    if (!res?.node) throw new Error('not found');
+    ui.go(new OpenFileAction(res.node));
+    return res.node;
+  } catch (err) {
+    notify.warn(describeBrokenLink(ref, err, from));
+    return null;
+  }
+}
+
+/**
+ * Why a link didn't open, in terms of the link the user is looking at. A 403 is a
+ * different situation from a 404 and must not be reported as one: "no such item" when
+ * the item exists but isn't yours is both wrong and a small information leak in reverse.
+ */
+function describeBrokenLink(ref, err, from) {
+  const where = from?.name ? ` (linked from "${from.name}")` : '';
+  if (err?.status === 403 || err?.code === 'forbidden') {
+    return `You don’t have access to that item in "${ref.collection}"${where}.`;
+  }
+  if (ref.by === 'name') {
+    return `Nothing named "${ref.value}" in "${ref.collection}"${where} — it may have been renamed or deleted.`;
+  }
+  return `That item no longer exists in "${ref.collection}"${where}.`;
+}

package/packages/web/src/bl/offline.js

@@ -0,0 +1,268 @@
+// OfflineService — a limited but real offline mode.
+//   • Pin ("make available offline"): file bytes go into the SW's trove-files
+//     cache (so every opener reads them with no network), and — for text — the
+//     content is chunked, embedded with the same LocalHash model the server can
+//     use, and stored in IndexedDB for offline search.
+//   • Offline search: lexical (names/tags/content) blended with local
+//     semantic (cosine over the cached chunk vectors) — the same hybrid shape as
+//     the server, just over what you took offline.
+//   • Sidecar op queue: while offline, comment/tag mutations are queued and
+//     replayed on reconnect. Because the sidecar is a CRDT, replay merges cleanly
+//     with whatever changed server-side meanwhile.
+// Reactive: the workbench watches `online`, the pinned set, and the queue depth.
+
+import { cell } from '../runtime.js';
+import { LocalHashEmbedding } from '@3sln/trove/core/search/embeddings.js';
+// Chunking and tokenizing must MATCH the server's — offline results are compared
+// against embeddings the server produced, so a local variant would quietly skew them.
+import { chunkText } from '@3sln/trove/core/indexers/registry.js';
+import { tokenize } from '@3sln/trove/core/search/keywordStore.js';
+import { isTexty } from './fileType.js';
+
+const DB = 'trove-offline';
+const FILES_CACHE = 'trove-files-v1';
+const embed = new LocalHashEmbedding({ dimensions: 256 });
+
+export class OfflineService {
+  constructor(platform) {
+    this.platform = platform;
+    this.api = platform.api;
+    this.db = null;
+    this.state = { online: navigator.onLine, pins: [], queued: 0, syncing: false };
+    this.cell = cell(this.state);
+  }
+  observe() {
+    return this.cell;
+  }
+  #set(patch) {
+    this.state = { ...this.state, ...patch };
+    this.cell.setValue(this.state);
+  }
+
+  async init() {
+    this.db = await openDb();
+    await this.#refreshPins();
+    await this.#refreshQueue();
+    window.addEventListener('online', () => this.#onOnline());
+    window.addEventListener('offline', () => this.#onOffline());
+    // `navigator.onLine` only reflects that an interface is up — on a captive portal or
+    // dead uplink it's `true` while the server is unreachable, which would leave us
+    // falsely "online" with every request silently failing. Confirm real reachability.
+    if (this.state.online && !(await this.api.reachable())) this.#set({ online: false });
+    // Tell the plugin host our initial connectivity so it can probe plugins.
+    this.platform.plugins?.setOnline?.(this.state.online);
+    if (this.state.online) this.flushQueue();
+  }
+
+  async #onOnline() {
+    // The interface came up, but verify the server is actually reachable before
+    // declaring online — a captive portal fires 'online' with no real connectivity.
+    if (!(await this.api.reachable())) { this.#set({ online: false }); await this.platform.plugins?.setOnline?.(false); return; }
+    this.#set({ online: true });
+    // Plugins re-announce what works now that we're back online.
+    await this.platform.plugins?.setOnline?.(true);
+    await this.flushQueue();
+  }
+  async #onOffline() {
+    this.#set({ online: false });
+    // Plugins re-announce; network-only features become unavailable.
+    await this.platform.plugins?.setOnline?.(false);
+  }
+
+  isPinned(id) {
+    return this.state.pins.some((p) => p.id === id);
+  }
+
+  // --- pinning ---------------------------------------------------------------
+
+  async pin(node) {
+    if (!node?.id) return;
+    try {
+      // Two URLs, deliberately. The KEY is the plain route URL — stable, so `unpin` and
+      // the service worker's cache-first lookup both find what `pin` stored. The FETCH
+      // may need a minted one, because `cache.add` sends no Authorization header and
+      // would 401 on a token-authenticated deployment. Keying on the minted URL instead
+      // would have worked exactly once: it carries a signature, so the next session's
+      // `unpin` looks for a string that was never there and the bytes are never reclaimed.
+      if ('caches' in window) {
+        const cache = await caches.open(FILES_CACHE);
+        const urls = this.platform.mediaUrls;
+        const key = urls.cacheKey(node.id);
+        const { url } = await urls.url(node.id, { op: 'download' });
+        const res = await fetch(url);
+        if (!res.ok) throw new Error(`Couldn't fetch the file (${res.status})`);
+        await cache.put(new Request(key), res);
+      }
+      // Index text content for offline search.
+      let chunks = [];
+      let text = '';
+      if (isTexty(node)) {
+        try {
+          text = await this.api.readText(node.id);
+          const parts = chunkText(text, 1000, 150);
+          const vectors = await embed.embed(parts.length ? parts : [node.name]);
+          chunks = (parts.length ? parts : [node.name]).map((t, i) => ({ text: t, vector: vectors[i] }));
+        } catch { /* keep name-only */ }
+      }
+      const nameVec = (await embed.embed([node.name]))[0];
+      await idbPut(this.db, 'pins', node.id, { node, text, chunks, nameVec, pinnedAt: Date.now() });
+      await this.#refreshPins();
+      this.platform.notifications.success(`“${node.name}” is available offline`);
+    } catch (err) {
+      this.platform.notifications.error(`Couldn't make available offline: ${err.message}`);
+    }
+  }
+
+  async unpin(id) {
+    const pin = this.state.pins.find((p) => p.id === id);
+    if (pin && 'caches' in window) {
+      const cache = await caches.open(FILES_CACHE);
+      // The same stable key `pin` stored under — never a freshly minted URL.
+      await cache.delete(this.platform.mediaUrls.cacheKey(id), { ignoreVary: true }).catch(() => {});
+    }
+    await idbDelete(this.db, 'pins', id);
+    await this.#refreshPins();
+  }
+
+  async #refreshPins() {
+    const all = await idbAll(this.db, 'pins');
+    this.#set({ pins: all.map((r) => ({ id: r.node.id, name: r.node.name, contentType: r.node.contentType, collectionId: r.node.collectionId, pinnedAt: r.pinnedAt })) });
+  }
+
+  // --- offline search --------------------------------------------------------
+
+  async searchOffline(query, { limit = 40 } = {}) {
+    const rows = await idbAll(this.db, 'pins');
+    if (!rows.length) return [];
+    const qTokens = tokenize(query);
+    const qv = (await embed.embed([query]))[0];
+    const results = [];
+    for (const r of rows) {
+      const hay = tokenize(`${r.node.name} ${r.text || ''}`);
+      const lex = lexicalScore(qTokens, new Set(hay));
+      let dense = cosine(qv, r.nameVec);
+      for (const c of r.chunks || []) dense = Math.max(dense, cosine(qv, c.vector));
+      const score = 0.6 * dense + 0.4 * lex;
+      if (score > 0.02) results.push({ nodeId: r.node.id, node: r.node, score, snippet: snippet(r.text, qTokens), indexerId: 'offline' });
+    }
+    return results.sort((a, b) => b.score - a.score).slice(0, limit);
+  }
+
+  // --- offline sidecar op queue ---------------------------------------------
+
+  async queueOp(op) {
+    await idbAdd(this.db, 'queue', { ...op, at: Date.now() });
+    await this.#refreshQueue();
+  }
+
+  async #refreshQueue() {
+    const q = await idbAll(this.db, 'queue');
+    this.#set({ queued: q.length });
+  }
+
+  async flushQueue() {
+    if (!this.state.online || this.state.syncing) return;
+    // Claim the sync BEFORE any await — two 'online' events (or init + an event) can
+    // fire concurrently, and a check-then-act guard after an await let both pass and
+    // replay the queue twice (double-posting). Setting syncing synchronously here makes
+    // the second caller bail at the guard above.
+    this.#set({ syncing: true });
+    let synced = 0;
+    let dropped = 0;
+    try {
+      const q = await idbAllWithKeys(this.db, 'queue');
+      for (const { key, value } of q) {
+        try {
+          await this.api.request(value.method, value.path, { body: value.body });
+          await idbDelete(this.db, 'queue', key);
+          synced++;
+        } catch (err) {
+          // Anything that could succeed later stays queued. `unauthorized` is the case
+          // that mattered: a session expiring while offline is not a permanent failure,
+          // and dropping the entry destroyed a comment the user had written and told
+          // them it "couldn't be applied" — when signing in again would have applied it.
+          if (['transient', 'timeout', 'unauthorized', 'quota'].includes(err.code)) break;
+          // A permanent failure (e.g. the file was deleted) — drop it so we don't loop,
+          // but don't pretend it synced.
+          await idbDelete(this.db, 'queue', key);
+          dropped++;
+        }
+      }
+    } finally {
+      await this.#refreshQueue();
+      this.#set({ syncing: false });
+      // Be honest: only claim success for what actually applied, and surface drops.
+      if (dropped) this.platform.notifications.warn(`${dropped} offline change${dropped > 1 ? 's' : ''} couldn't be applied and ${dropped > 1 ? 'were' : 'was'} discarded.`);
+      if (synced && this.state.queued === 0) this.platform.notifications.info(`${synced} offline change${synced > 1 ? 's' : ''} synced.`);
+    }
+  }
+}
+
+// --- IndexedDB helpers ------------------------------------------------------
+
+function openDb() {
+  return new Promise((resolve, reject) => {
+    const req = indexedDB.open(DB, 1);
+    req.onupgradeneeded = () => {
+      const db = req.result;
+      if (!db.objectStoreNames.contains('pins')) db.createObjectStore('pins');
+      if (!db.objectStoreNames.contains('queue')) db.createObjectStore('queue', { autoIncrement: true });
+    };
+    req.onsuccess = () => resolve(req.result);
+    req.onerror = () => reject(req.error);
+  });
+}
+function tx(db, store, mode, fn) {
+  return new Promise((resolve, reject) => {
+    const t = db.transaction(store, mode);
+    const s = t.objectStore(store);
+    let out;
+    Promise.resolve(fn(s)).then((r) => (out = r));
+    t.oncomplete = () => resolve(out);
+    t.onerror = () => reject(t.error);
+  });
+}
+const reqP = (r) => new Promise((res, rej) => { r.onsuccess = () => res(r.result); r.onerror = () => rej(r.error); });
+const idbPut = (db, store, key, val) => tx(db, store, 'readwrite', (s) => s.put(val, key));
+const idbAdd = (db, store, val) => tx(db, store, 'readwrite', (s) => s.add(val));
+const idbDelete = (db, store, key) => tx(db, store, 'readwrite', (s) => s.delete(key));
+const idbAll = (db, store) => tx(db, store, 'readonly', (s) => reqP(s.getAll()));
+function idbAllWithKeys(db, store) {
+  return tx(db, store, 'readonly', (s) =>
+    new Promise((resolve, reject) => {
+      const out = [];
+      const req = s.openCursor();
+      req.onsuccess = () => {
+        const cur = req.result;
+        if (!cur) return resolve(out);
+        out.push({ key: cur.key, value: cur.value });
+        cur.continue();
+      };
+      req.onerror = () => reject(req.error);
+    }),
+  );
+}
+
+// --- search math (mirrors the server's LocalHash hybrid) --------------------
+
+function lexicalScore(q, docTokens) {
+  if (!q.length || !docTokens.size) return 0;
+  let hit = 0;
+  for (const t of q) if (docTokens.has(t)) hit++;
+  return hit / q.length;
+}
+function cosine(a, b) {
+  if (!a || !b) return 0;
+  let s = 0;
+  for (let i = 0; i < a.length; i++) s += a[i] * b[i];
+  return s; // both L2-normalised
+}
+function snippet(text, qTokens) {
+  if (!text) return null;
+  const lower = text.toLowerCase();
+  let at = -1;
+  for (const t of qTokens) { const i = lower.indexOf(t); if (i >= 0) { at = i; break; } }
+  if (at < 0) return text.slice(0, 160).trim();
+  const start = Math.max(0, at - 60);
+  return (start > 0 ? '…' : '') + text.slice(start, start + 200).trim() + '…';
+}

package/packages/web/src/bl/openers.js

@@ -0,0 +1,71 @@
+// Opener choice: which viewer opens a file when several can. Built-in and plugin
+// openers register the same way (a selector + priority), so a file can match more
+// than one — e.g. a plugin PDF viewer alongside a built-in, or a rich player vs the
+// plain audio player for an .m4a. When that happens and the user hasn't expressed a
+// preference, we ask; their choice can be remembered per file type.
+//
+// Preferences live in settings under `openers.associations`: a map from a *type key*
+// (an extension like ".pdf", an exact mime, or a "type/*" wildcard) to an opener id.
+
+import { extOf } from './fileType.js';
+
+const ASSOC_KEY = 'openers.associations';
+
+export { extOf };
+
+/** The canonical type key we remember a choice under: prefer extension, else mime. */
+export function typeKeyFor(node) {
+  return extOf(node) || node?.contentType || '';
+}
+
+/** A human label for the type, for "Always use … for {label}". */
+export function typeLabelFor(node) {
+  const ext = extOf(node);
+  if (ext) return `${ext} files`;
+  const mime = node?.contentType || '';
+  return mime ? `${mime} files` : 'this file type';
+}
+
+/** All openers that can handle this node right now (selector + when + availability),
+ *  best (highest priority) first. */
+export function availableOpeners(platform, node) {
+  const evaluate = (w) => platform.context.evaluate(w);
+  const isAvailable = (o) => platform.plugins.isAvailable(o);
+  return platform.contributions
+    .openersFor(node)
+    .filter((o) => (!o.when || evaluate(o.when)) && isAvailable(o))
+    .sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+}
+
+/** The remembered opener id for a node's type (ext → exact mime → type/* ), or null. */
+export function rememberedOpenerId(platform, node) {
+  const assoc = platform.settings.get(ASSOC_KEY) || {};
+  const ext = extOf(node);
+  const mime = node?.contentType || '';
+  const wild = mime.includes('/') ? `${mime.slice(0, mime.indexOf('/') + 1)}*` : '';
+  return (ext && assoc[ext]) || (mime && assoc[mime]) || (wild && assoc[wild]) || null;
+}
+
+/** Remember (or, with a null openerId, forget) the opener for a type key. */
+export function rememberOpener(platform, typeKey, openerId) {
+  if (!typeKey) return;
+  const assoc = { ...(platform.settings.get(ASSOC_KEY) || {}) };
+  if (openerId) assoc[typeKey] = openerId;
+  else delete assoc[typeKey];
+  platform.settings.set(ASSOC_KEY, assoc);
+}
+
+/** The saved associations as a list, for the Settings UI. */
+export function listAssociations(platform) {
+  const assoc = platform.settings.get(ASSOC_KEY) || {};
+  return Object.entries(assoc).map(([typeKey, openerId]) => {
+    const opener = platform.contributions.get(openerId);
+    return { typeKey, openerId, openerTitle: opener?.title || openerId, missing: !opener };
+  });
+}
+
+/** A short source label for an opener ("Built-in" or the plugin's name). */
+export function openerSource(platform, opener) {
+  if (!opener?.pluginId) return 'Built-in';
+  return platform.plugins.plugins.get(opener.pluginId)?.manifest?.displayName || opener.pluginId;
+}

package/packages/web/src/bl/pluginInstall.js

@@ -0,0 +1,59 @@
+// Install flow: turn an uploaded .zip or a URL into a parsed package, assess its
+// trust (signature + domain verification), and present the pre-install review so
+// the user can make an informed decision before any plugin code runs.
+
+import { parsePackage, fetchPackage, reviewSummary, displayName } from '../platform/pluginPackage.js';
+import { pluginId } from '@3sln/trove/core/plugins/identity.js';
+
+export async function beginInstallFromFile(app, file) {
+  try {
+    const bytes = new Uint8Array(await file.arrayBuffer());
+    await review(app, parsePackage(bytes));
+  } catch (err) {
+    app.platform.notifications.error(`Couldn't read the plugin: ${err.message}`);
+  }
+}
+
+export async function beginInstallFromUrl(app, url) {
+  try {
+    const pkg = await fetchPackage(url, (u, o) => fetch(u, o));
+    await review(app, pkg);
+  } catch (err) {
+    app.platform.notifications.error(`Couldn't fetch the plugin: ${err.message}`);
+  }
+}
+
+async function review(app, pkg) {
+  const label = displayName(pkg.manifest);
+  if (app.platform.plugins.plugins.has(pluginId(pkg.manifest))) {
+    app.platform.notifications.warn(`“${label}” is already installed.`);
+    return;
+  }
+  // Trust assessment can hit the network (domain assetlinks); do it before review.
+  let trust = { status: 'unverified' };
+  try {
+    trust = await app.platform.plugins.assessTrust(pkg);
+  } catch { /* offline / unreachable */ }
+  const summary = reviewSummary(pkg, trust);
+  app.platform.workbench.showDialog({
+    kind: 'plugin-review',
+    summary,
+    isAdmin: !!app.social.state.admin,
+    onInstall: async (grants) => {
+      app.platform.workbench.closeDialog();
+      // Account installs upload the package + run a handshake that can take a while —
+      // switch to the plugins view (which shows the plugin's loading state) and hold a
+      // sticky "Installing…" toast so the user isn't left staring at nothing.
+      app.platform.workbench.setActivity('plugins');
+      const pending = app.platform.notifications.info(`Installing “${label}”…`, { sticky: true });
+      try {
+        await app.platform.plugins.install(pkg, { grants, trust });
+        app.platform.notifications.dismiss(pending);
+        app.platform.notifications.success(`Installed “${label}”`);
+      } catch (err) {
+        app.platform.notifications.dismiss(pending);
+        app.platform.notifications.error(`Install failed: ${err.message}`);
+      }
+    },
+  });
+}

package/packages/web/src/bl/services.js

@@ -0,0 +1,143 @@
+// Reactive data services the workbench renders from. These hold *data* state
+// (the current collection's items, search results, in-flight transfers) as
+// opposed to the shell's UI state (WorkbenchService). ngin Actions mutate them;
+// the UI `watch`es them. Each is a plain cell wrapper so the render layer stays
+// declarative.
+
+import { cell } from '../runtime.js';
+
+export class ExplorerService {
+  constructor(settings) {
+    this.settings = settings;
+    this.state = {
+      items: [], loading: false, error: null,
+      selection: [], sort: settings.get('explorer.sort'), order: settings.get('explorer.sortOrder'),
+      collectionId: 'default', collections: [], canCreateCollection: false,
+      // `stats` is the whole collection; `items` is the page on screen. Keeping both
+      // is what lets the UI say "500 of 3,006" instead of quietly claiming 500.
+      stats: null, usage: null, nextCursor: null, loadingMore: false, trash: null,
+    };
+    this.cell = cell(this.state);
+  }
+  observe() {
+    return this.cell;
+  }
+  set(patch) {
+    this.state = { ...this.state, ...patch };
+    this.cell.setValue(this.state);
+  }
+  /**
+   * @param {string[]} ids
+   * @param {{additive?: boolean, nodes?: object[]}} [opts] `nodes` is the caller's own
+   *   copy of what it selected — pass it whenever you have it (see selectedNodes).
+   */
+  select(ids, { additive = false, nodes = null } = {}) {
+    const next = additive ? Array.from(new Set([...this.state.selection, ...ids])) : ids;
+    // Selecting what is already selected must not emit. The launcher syncs the
+    // highlighted row into here on every mouseenter, and a state push per mouse move
+    // would re-render the list under the pointer.
+    const same = next.length === this.state.selection.length
+      && next.every((id, i) => id === this.state.selection[i]);
+    if (same) return;
+    this.set({ selection: next, selectionNodes: nodes && !additive ? nodes : null });
+  }
+  /**
+   * The nodes the selection refers to.
+   *
+   * Resolving ids against `items` only finds rows on the LOADED PAGE of the CURRENT
+   * collection — and the launcher's rows come from search (which the server scopes to
+   * every readable collection) and from recents (which survive a collection switch).
+   * So every row reached by searching resolved to nothing, and rename / move-to-trash /
+   * copy-link returned silently while `explorer.hasSelection` said there was a
+   * selection. Preferring the nodes the selecting caller already held fixes the whole
+   * class; the `items` lookup stays for callers that only have ids.
+   */
+  selectedNodes() {
+    const held = this.state.selectionNodes;
+    if (held?.length) return held.filter((n) => this.state.selection.includes(n.id));
+    return this.state.items.filter((i) => this.state.selection.includes(i.id));
+  }
+}
+
+export class SearchClientService {
+  constructor() {
+    this.state = { query: '', mode: 'hybrid', results: [], loading: false, error: null, ran: false, paletteFiles: [], paletteQuery: '', paletteLoading: false, paletteError: null };
+    this.cell = cell(this.state);
+  }
+  observe() {
+    return this.cell;
+  }
+  set(patch) {
+    this.state = { ...this.state, ...patch };
+    this.cell.setValue(this.state);
+  }
+}
+
+/**
+ * Uploads in flight.
+ *
+ * This owns the DETAIL an upload needs and a generic task doesn't — bytes moved, an
+ * AbortController, per-file retry. It also projects each transfer into ActivityService
+ * so the drive has ONE list of "what is happening", covering work on both sides of the
+ * wire: an upload running in this browser and a reindex running on the server show up
+ * together, because a user doesn't care which machine is busy.
+ *
+ * The projection is one-way and this stays the owner. Two writable copies of the same
+ * fact is how they drift.
+ */
+export class TransfersService {
+  /** @param {import('./activity.js').ActivityService} [activity] */
+  constructor(activity = null) {
+    this.state = { items: [] }; // { id, name, direction, ratio, loaded, total, status, error }
+    this.cell = cell(this.state);
+    this._controllers = new Map();
+    this.activity = activity;
+    this._tasks = new Map(); // transfer id -> activity task handle
+  }
+  observe() {
+    return this.cell;
+  }
+  #emit() {
+    this.cell.setValue(this.state);
+  }
+  start(id, name, total, controller) {
+    this._controllers.set(id, controller);
+    this.state = { items: [...this.state.items, { id, name, direction: 'up', ratio: 0, loaded: 0, total, status: 'active', error: null }] };
+    this.#emit();
+    const task = this.activity?.start({
+      kind: 'transfer', title: `Uploading ${name}`, total: total || null, unit: 'bytes',
+      onCancel: () => this.cancel(id),
+    });
+    if (task) this._tasks.set(id, task);
+  }
+  progress(id, { loaded, total, ratio }) {
+    this.state = { items: this.state.items.map((t) => (t.id === id ? { ...t, loaded, total, ratio } : t)) };
+    this.#emit();
+    this._tasks.get(id)?.progress({ done: loaded, total: total || null });
+  }
+  finish(id, status = 'done', error = null) {
+    this.state = { items: this.state.items.map((t) => (t.id === id ? { ...t, status, error, ratio: status === 'done' ? 1 : t.ratio } : t)) };
+    this._controllers.delete(id);
+    this.#emit();
+    const task = this._tasks.get(id);
+    if (task) {
+      if (status === 'done') task.succeed();
+      else if (status === 'cancelled') task.cancel();
+      else task.fail(error || new Error('Upload failed'));
+      this._tasks.delete(id);
+    }
+    if (status === 'done') setTimeout(() => this.dismiss(id), 4000);
+  }
+  cancel(id) {
+    this._controllers.get(id)?.abort();
+    this.finish(id, 'cancelled');
+  }
+  dismiss(id) {
+    this.state = { items: this.state.items.filter((t) => t.id !== id) };
+    this.#emit();
+  }
+  clearDone() {
+    this.state = { items: this.state.items.filter((t) => t.status === 'active') };
+    this.#emit();
+  }
+}