@onpeek/nuvio 1.0.0

package/dist/nuvio/client.js

@@ -0,0 +1,149 @@
+import { callCache } from './call-context.js';
+import { errorFromResponse, NuvioError } from './errors.js';
+/** Transient statuses worth retrying (reads, and writes that opted into idempotency). */
+const RETRY_STATUSES = new Set([408, 429, 500, 502, 503, 504]);
+const MAX_RETRIES = 5;
+const BASE_RETRY_DELAY_MS = 400;
+const MAX_RETRY_DELAY_MS = 10_000;
+const MAX_RETRY_AFTER_MS = 60_000;
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/**
+ * Pure retry-delay calculation (exported for tests).
+ * `Retry-After` always wins; otherwise equal jitter: half the exponential cap
+ * plus a bounded random half, so the delay stays within `[cap/2, cap]`.
+ */
+export function computeRetryDelayMs(res, attempt, rng = Math.random) {
+    const header = res?.headers.get('retry-after');
+    if (header) {
+        const seconds = Number(header);
+        if (Number.isFinite(seconds) && seconds >= 0)
+            return Math.min(seconds * 1000, MAX_RETRY_AFTER_MS);
+        const date = Date.parse(header);
+        if (!Number.isNaN(date))
+            return Math.min(Math.max(date - Date.now(), 0), MAX_RETRY_AFTER_MS);
+    }
+    const cap = Math.min(BASE_RETRY_DELAY_MS * 2 ** attempt, MAX_RETRY_DELAY_MS);
+    const half = cap / 2;
+    return Math.floor(half + rng() * half);
+}
+function backoffMs(attempt) {
+    return computeRetryDelayMs(null, attempt);
+}
+/**
+ * Thin, typed wrapper over the Nuvio backend (Supabase: PostgREST + GoTrue).
+ *
+ * Retry policy:
+ * - reads (and explicitly idempotent requests): retry network errors, 408, 429,
+ *   500, 502, 503, 504 with exponential backoff + Retry-After;
+ * - non-idempotent writes: never retried automatically (a lost response must not
+ *   silently double-apply a mutation);
+ * - 401: a single transparent token refresh, then one retry.
+ */
+export class NuvioClient {
+    cfg;
+    auth;
+    constructor(cfg, auth) {
+        this.cfg = cfg;
+        this.auth = auth;
+    }
+    async send(path, options, token) {
+        const url = `${this.cfg.backendUrl}${path}${options.query ? `?${options.query}` : ''}`;
+        const headers = {
+            apikey: this.cfg.publishableKey,
+            Authorization: `Bearer ${token}`,
+        };
+        if (options.body !== undefined)
+            headers['Content-Type'] = 'application/json';
+        if (options.requestId)
+            headers['Idempotency-Key'] = options.requestId;
+        return fetch(url, {
+            method: options.method ?? 'GET',
+            headers,
+            body: options.body === undefined ? undefined : JSON.stringify(options.body),
+            signal: AbortSignal.timeout(this.cfg.backendTimeoutMs),
+        });
+    }
+    async sendWithRetry(path, options, token) {
+        const method = options.method ?? 'GET';
+        // Retry is driven purely by the operation's intrinsic idempotency. An
+        // Idempotency-Key is never sufficient on its own: the backend does not dedupe.
+        const idempotent = options.idempotent ?? method === 'GET';
+        let attempt = 0;
+        for (;;) {
+            let res;
+            try {
+                res = await this.send(path, options, token);
+            }
+            catch (error) {
+                if (idempotent && !options.noRetry && attempt < MAX_RETRIES) {
+                    await sleep(backoffMs(attempt));
+                    attempt += 1;
+                    continue;
+                }
+                throw error;
+            }
+            if (idempotent && !options.noRetry && RETRY_STATUSES.has(res.status) && attempt < MAX_RETRIES) {
+                await sleep(computeRetryDelayMs(res, attempt));
+                attempt += 1;
+                continue;
+            }
+            return res;
+        }
+    }
+    async request(path, options = {}) {
+        if (!options.cache)
+            return this.execute(path, options);
+        const method = options.method ?? 'GET';
+        const key = `${method} ${path}${options.query ? `?${options.query}` : ''}` +
+            `${options.body === undefined ? '' : ` ${JSON.stringify(options.body)}`}`;
+        return callCache(key, () => this.execute(path, options));
+    }
+    async execute(path, options) {
+        let token = await this.auth.getAccessToken();
+        let res = await this.sendWithRetry(path, options, token);
+        if (res.status === 401 && !options.noRetry) {
+            await this.auth.forceRefresh();
+            token = await this.auth.getAccessToken();
+            res = await this.sendWithRetry(path, options, token);
+        }
+        if (res.status === 204)
+            return undefined;
+        const text = await res.text();
+        const json = text ? safeJson(text) : null;
+        if (!res.ok)
+            throw errorFromResponse(res.status, json ?? text);
+        return json;
+    }
+    /** Call a PostgREST RPC function (a write unless the caller opts into read semantics). */
+    async rpc(name, args = {}, options = {}) {
+        return this.request(`/rest/v1/rpc/${name}`, { method: 'POST', body: args, ...options });
+    }
+    /** A read-only RPC: cached per call and retried safely when transient. */
+    async readRpc(name, args = {}) {
+        return this.rpc(name, args, { cache: true, idempotent: true });
+    }
+    /** Query a PostgREST table. Reads are cached and retried by default. */
+    async select(table, params = 'select=*') {
+        return this.request(`/rest/v1/${table}`, { query: params, cache: true, idempotent: true });
+    }
+    get backendUrl() {
+        return this.cfg.backendUrl;
+    }
+    get currentUserId() {
+        return this.auth.userId;
+    }
+    get currentEmail() {
+        return this.auth.email;
+    }
+}
+function safeJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+export { NuvioError };

package/dist/nuvio/errors.js

@@ -0,0 +1,43 @@
+/** Error thrown for any non-2xx response from the Nuvio / Supabase API. */
+export class NuvioError extends Error {
+    status;
+    code;
+    details;
+    hint;
+    constructor(message, options = {}) {
+        super(message);
+        this.name = 'NuvioError';
+        this.status = options.status;
+        this.code = options.code;
+        this.details = options.details;
+        this.hint = options.hint;
+    }
+    toHuman() {
+        const parts = [this.message];
+        if (this.code)
+            parts.push(`(code: ${this.code})`);
+        if (this.status)
+            parts.push(`[http ${this.status}]`);
+        if (this.hint)
+            parts.push(`hint: ${this.hint}`);
+        return parts.join(' ');
+    }
+}
+/** Parse an error body from PostgREST / GoTrue. */
+export function errorFromResponse(status, body) {
+    if (body && typeof body === 'object') {
+        const b = body;
+        const message = (typeof b.message === 'string' && b.message) ||
+            (typeof b.msg === 'string' && b.msg) ||
+            (typeof b.error_description === 'string' && b.error_description) ||
+            (typeof b.error === 'string' && b.error) ||
+            `Request failed with status ${status}`;
+        return new NuvioError(message, {
+            status,
+            code: typeof b.code === 'string' ? b.code : typeof b.error === 'string' ? b.error : undefined,
+            details: b.details,
+            hint: typeof b.hint === 'string' ? b.hint : null,
+        });
+    }
+    return new NuvioError(`Request failed with status ${status}`, { status });
+}

package/dist/nuvio/keys.js

@@ -0,0 +1,23 @@
+/**
+ * Single source of truth for resource keys. Direct ops, plan planners and
+ * snapshots must all agree, otherwise undo/redo would target different records.
+ */
+/** e.g. `tt1` for a movie, `tt1_s2e5` for an episode (episode defaults to 0). */
+export function progressKeyOf(entry) {
+    return entry.season != null
+        ? `${entry.content_id}_s${entry.season}e${entry.episode ?? 0}`
+        : entry.content_id;
+}
+/** e.g. `tt1|2|5`; missing season/episode are encoded as -1. */
+export function historyKeyOf(item) {
+    return `${item.content_id}|${item.season ?? -1}|${item.episode ?? -1}`;
+}
+export function libraryKeyOf(item) {
+    return `${item.content_type}:${item.content_id}`;
+}
+/** The stored progress key when the backend provides one, else the derived key. */
+export function storedProgressKey(item) {
+    if (typeof item.progress_key === 'string' && item.progress_key)
+        return item.progress_key;
+    return progressKeyOf(item);
+}

package/dist/nuvio/ops/account.js

@@ -0,0 +1,91 @@
+export async function getAccount(client) {
+    return client.request('/auth/v1/user');
+}
+export async function getSyncOverview(client) {
+    return client.readRpc('get_sync_overview', {});
+}
+export async function listAvatars(client) {
+    return client.readRpc('get_avatar_catalog', {});
+}
+const BACKUP_METADATA_KEYS = new Set(['version', 'exported_at', 'exportedAt', 'generated_at']);
+/**
+ * Best-effort check that the backend actually narrowed the export. Verification
+ * is positive-only: the response must contain at least one requested section and
+ * nothing outside it, and selected profiles/platforms must be a subset. Anything
+ * that cannot be confirmed counts as unverified (so we never assume a scoped
+ * export when the backend may have ignored the arguments).
+ */
+function verifyScopeApplied(backup, options) {
+    if (!backup || typeof backup !== 'object' || Array.isArray(backup))
+        return false;
+    const record = backup;
+    const keys = Object.keys(record).filter((k) => !BACKUP_METADATA_KEYS.has(k));
+    if (options.scope?.length) {
+        const allowed = new Set(options.scope);
+        const requested = keys.filter((k) => allowed.has(k));
+        const foreign = keys.filter((k) => !allowed.has(k));
+        if (requested.length === 0 || foreign.length > 0)
+            return false;
+    }
+    if (options.profile_ids?.length) {
+        const profiles = record.profiles;
+        if (!Array.isArray(profiles))
+            return false;
+        const wanted = new Set(options.profile_ids);
+        const ids = profiles.map((p) => p.profile_index ??
+            p.profile_id);
+        if (ids.some((id) => typeof id !== 'number' || !wanted.has(id)))
+            return false;
+    }
+    if (options.platforms?.length) {
+        const settings = record.settings;
+        if (!settings || typeof settings !== 'object' || Array.isArray(settings))
+            return false;
+        const wanted = new Set(options.platforms);
+        if (Object.keys(settings).some((p) => !wanted.has(p)))
+            return false;
+    }
+    return true;
+}
+/**
+ * Export an account backup. With no scope this is a full backup; passing scope
+ * entries, profile ids or platforms asks the backend to narrow the export.
+ *
+ * If scope was requested but the response cannot positively confirm it, the
+ * result carries `scope_verified: false` and an explicit warning — there is no
+ * silent fallback to treating an unscoped backup as scoped.
+ */
+export async function exportBackup(client, options = {}) {
+    const requested = Boolean(options.scope?.length || options.profile_ids?.length || options.platforms?.length);
+    // Backup export is a read: use the cached, retry-safe read path.
+    if (!requested)
+        return client.readRpc('sync_export_account_backup', {});
+    const args = {};
+    if (options.scope?.length)
+        args.p_scope = options.scope;
+    if (options.profile_ids?.length)
+        args.p_profile_ids = options.profile_ids;
+    if (options.platforms?.length)
+        args.p_platforms = options.platforms;
+    const backup = await client.readRpc('sync_export_account_backup', args);
+    if (verifyScopeApplied(backup, options)) {
+        return { backup, scope_requested: options, scope_verified: true };
+    }
+    return {
+        backup,
+        scope_requested: options,
+        scope_verified: false,
+        warning: 'The backend did not confirm scope/profile_ids/platforms for this export. The returned data may be a ' +
+            'FULL backup — do not treat it as scoped. Verify backend support before relying on it.',
+    };
+}
+export async function health(client) {
+    return client.readRpc('health_ping', {});
+}
+export async function restoreBackup(client, backup, apply) {
+    const diff = ['~ restore account backup (replace mode) — this overwrites profiles/addons/library/settings'];
+    if (apply) {
+        await client.rpc('sync_restore_account_backup', { p_backup: backup, p_mode: 'replace' });
+    }
+    return { applied: apply, changed: true, before: {}, after: {}, diff };
+}

package/dist/nuvio/ops/addons.js

@@ -0,0 +1,126 @@
+import { NuvioError } from '../errors.js';
+export async function listAddons(client, profileId) {
+    return client.select('addons', `select=id,user_id,profile_id,url,name,enabled,sort_order,created_at,updated_at` +
+        `&profile_id=eq.${profileId}&order=sort_order.asc,created_at.asc`);
+}
+export function toPushShape(addons) {
+    return addons.map((a) => ({
+        url: a.url,
+        name: a.name,
+        enabled: a.enabled,
+        sort_order: a.sort_order,
+    }));
+}
+function assertHttpUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new NuvioError(`Invalid addon URL: ${url}`);
+    }
+    if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+        throw new NuvioError(`Addon URL must be http(s): ${url}`);
+    }
+}
+function diffAddons(before, after) {
+    const diff = [];
+    const beforeByUrl = new Map(before.map((a) => [a.url, a]));
+    const afterByUrl = new Map(after.map((a) => [a.url, a]));
+    for (const [url, a] of afterByUrl) {
+        const prev = beforeByUrl.get(url);
+        if (!prev)
+            diff.push(`+ add ${url} (enabled=${a.enabled}, order=${a.sort_order})`);
+        else {
+            if (prev.enabled !== a.enabled)
+                diff.push(`~ ${url} enabled ${prev.enabled} -> ${a.enabled}`);
+            if (prev.name !== a.name)
+                diff.push(`~ ${url} name ${prev.name ?? 'null'} -> ${a.name ?? 'null'}`);
+            if (prev.sort_order !== a.sort_order)
+                diff.push(`~ ${url} order ${prev.sort_order} -> ${a.sort_order}`);
+        }
+    }
+    for (const url of beforeByUrl.keys()) {
+        if (!afterByUrl.has(url))
+            diff.push(`- remove ${url}`);
+    }
+    return diff.sort();
+}
+function nextSort(before) {
+    return before.reduce((max, a) => Math.max(max, a.sort_order + 1), 0);
+}
+async function commit(client, profileId, originId, before, after, apply) {
+    const diff = diffAddons(before, after);
+    const changed = diff.length > 0;
+    if (apply && changed) {
+        await client.rpc('sync_push_addons', {
+            p_profile_id: profileId,
+            p_addons: after,
+            p_origin_client_id: originId,
+        });
+    }
+    return { applied: apply && changed, changed, before, after, diff };
+}
+export async function addAddon(client, profileId, input, originId, apply) {
+    assertHttpUrl(input.url);
+    const before = toPushShape(await listAddons(client, profileId));
+    if (before.some((a) => a.url === input.url)) {
+        throw new NuvioError(`This addon is already installed on profile ${profileId}: ${input.url}`);
+    }
+    const after = [
+        ...before,
+        {
+            url: input.url,
+            name: input.name ?? null,
+            enabled: input.enabled ?? true,
+            sort_order: input.sort_order ?? nextSort(before),
+        },
+    ];
+    // Invariant: exactly one new item, nothing else removed or altered.
+    if (after.length !== before.length + 1)
+        throw new NuvioError('Internal invariant failed (addon add)');
+    return commit(client, profileId, originId, before, after, apply);
+}
+export async function updateAddon(client, profileId, match, changes, originId, apply) {
+    const rows = await listAddons(client, profileId);
+    const target = rows.find((a) => (match.url ? a.url === match.url : a.id === match.id));
+    if (!target)
+        throw new NuvioError(`Addon not found on profile ${profileId}`);
+    const before = toPushShape(rows);
+    const after = before.map((a) => a.url === target.url
+        ? {
+            url: a.url,
+            name: changes.name !== undefined ? changes.name : a.name,
+            enabled: changes.enabled !== undefined ? changes.enabled : a.enabled,
+            sort_order: changes.sort_order !== undefined ? changes.sort_order : a.sort_order,
+        }
+        : a);
+    return commit(client, profileId, originId, before, after, apply);
+}
+export async function removeAddon(client, profileId, match, originId, apply) {
+    const rows = await listAddons(client, profileId);
+    const target = rows.find((a) => (match.url ? a.url === match.url : a.id === match.id));
+    if (!target)
+        throw new NuvioError(`Addon not found on profile ${profileId}`);
+    const before = toPushShape(rows);
+    const after = before.filter((a) => a.url !== target.url);
+    if (after.length !== before.length - 1)
+        throw new NuvioError('Internal invariant failed (addon remove)');
+    return commit(client, profileId, originId, before, after, apply);
+}
+export async function reorderAddons(client, profileId, orderedUrls, originId, apply) {
+    const rows = await listAddons(client, profileId);
+    const before = toPushShape(rows);
+    const beforeUrls = before.map((a) => a.url).sort();
+    const wanted = [...orderedUrls].sort();
+    if (beforeUrls.length !== wanted.length || beforeUrls.some((u, i) => u !== wanted[i])) {
+        throw new NuvioError('Reorder must list every installed addon exactly once (use list_addons to get the current set).');
+    }
+    const after = orderedUrls.map((url, index) => {
+        const base = before.find((a) => a.url === url);
+        return { ...base, sort_order: index };
+    });
+    if (after.length !== before.length)
+        throw new NuvioError('Internal invariant failed (addon reorder)');
+    return commit(client, profileId, originId, before, after, apply);
+}

package/dist/nuvio/ops/collections.js

@@ -0,0 +1,158 @@
+import { NuvioError } from '../errors.js';
+export async function getCollections(client, profileId) {
+    const rows = await client.readRpc('sync_pull_collections', { p_profile_id: profileId });
+    return rows[0]?.collections_json ?? [];
+}
+function assertUniqueIds(collections) {
+    const ids = new Set();
+    for (const c of collections) {
+        if (!c.id)
+            throw new NuvioError('Every collection needs an id');
+        if (ids.has(c.id))
+            throw new NuvioError(`Duplicate collection id: ${c.id}`);
+        ids.add(c.id);
+    }
+}
+function canonical(value) {
+    if (Array.isArray(value))
+        return value.map(canonical);
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const key of Object.keys(value).sort()) {
+            out[key] = canonical(value[key]);
+        }
+        return out;
+    }
+    return value;
+}
+function diffCollections(before, after) {
+    const b = new Map(before.map((c) => [c.id, c]));
+    const a = new Map(after.map((c) => [c.id, c]));
+    const diff = [];
+    for (const [id, c] of a) {
+        const prev = b.get(id);
+        if (!prev)
+            diff.push(`+ collection "${c.title}" (${id})`);
+        else if (JSON.stringify(canonical(prev)) !== JSON.stringify(canonical(c))) {
+            diff.push(`~ collection ${id} updated`);
+        }
+    }
+    for (const id of b.keys())
+        if (!a.has(id))
+            diff.push(`- collection ${id}`);
+    if (before.map((c) => c.id).join('|') !== after.map((c) => c.id).join('|')) {
+        diff.push('~ collection order changed');
+    }
+    return diff.sort();
+}
+async function commit(client, profileId, originId, before, after, apply) {
+    const diff = diffCollections(before, after);
+    if (apply && diff.length > 0) {
+        await client.rpc('sync_push_collections', {
+            p_profile_id: profileId,
+            p_collections_json: after,
+            p_origin_client_id: originId,
+        });
+    }
+    return { applied: apply && diff.length > 0, changed: diff.length > 0, before, after, diff };
+}
+export async function createCollection(client, profileId, collection, originId, apply) {
+    const before = await getCollections(client, profileId);
+    if (before.some((c) => c.id === collection.id)) {
+        throw new NuvioError(`A collection with id "${collection.id}" already exists`);
+    }
+    const after = [...before, collection];
+    assertUniqueIds(after);
+    return commit(client, profileId, originId, before, after, apply);
+}
+export async function updateCollection(client, profileId, collectionId, changes, originId, apply) {
+    const before = await getCollections(client, profileId);
+    const target = before.find((c) => c.id === collectionId);
+    if (!target)
+        throw new NuvioError(`Collection "${collectionId}" not found`);
+    const after = before.map((c) => (c.id === collectionId ? { ...c, ...changes } : c));
+    assertUniqueIds(after);
+    return commit(client, profileId, originId, before, after, apply);
+}
+export async function deleteCollection(client, profileId, collectionId, originId, apply) {
+    const before = await getCollections(client, profileId);
+    if (!before.some((c) => c.id === collectionId))
+        throw new NuvioError(`Collection "${collectionId}" not found`);
+    const after = before.filter((c) => c.id !== collectionId);
+    if (after.length !== before.length - 1)
+        throw new NuvioError('Internal invariant failed (collection delete)');
+    return commit(client, profileId, originId, before, after, apply);
+}
+export async function addFolder(client, profileId, collectionId, folder, originId, apply) {
+    const before = await getCollections(client, profileId);
+    const target = before.find((c) => c.id === collectionId);
+    if (!target)
+        throw new NuvioError(`Collection "${collectionId}" not found`);
+    if (target.folders.some((f) => f.id === folder.id))
+        throw new NuvioError(`Folder "${folder.id}" already exists in collection "${collectionId}"`);
+    const after = before.map((c) => (c.id === collectionId ? { ...c, folders: [...c.folders, folder] } : c));
+    return commit(client, profileId, originId, before, after, apply);
+}
+export async function updateFolder(client, profileId, collectionId, folderId, changes, originId, apply) {
+    const before = await getCollections(client, profileId);
+    const target = before.find((c) => c.id === collectionId);
+    if (!target)
+        throw new NuvioError(`Collection "${collectionId}" not found`);
+    if (!target.folders.some((f) => f.id === folderId))
+        throw new NuvioError(`Folder "${folderId}" not found in collection "${collectionId}"`);
+    const after = before.map((c) => c.id === collectionId
+        ? { ...c, folders: c.folders.map((f) => (f.id === folderId ? { ...f, ...changes } : f)) }
+        : c);
+    return commit(client, profileId, originId, before, after, apply);
+}
+export async function removeFolder(client, profileId, collectionId, folderId, originId, apply) {
+    const before = await getCollections(client, profileId);
+    const target = before.find((c) => c.id === collectionId);
+    if (!target)
+        throw new NuvioError(`Collection "${collectionId}" not found`);
+    const nextFolders = target.folders.filter((f) => f.id !== folderId);
+    if (nextFolders.length !== target.folders.length - 1)
+        throw new NuvioError(`Folder "${folderId}" not found in collection "${collectionId}"`);
+    const after = before.map((c) => (c.id === collectionId ? { ...c, folders: nextFolders } : c));
+    return commit(client, profileId, originId, before, after, apply);
+}
+export async function reorderCollections(client, profileId, orderedIds, originId, apply) {
+    const before = await getCollections(client, profileId);
+    const current = before.map((c) => c.id).sort();
+    const wanted = [...orderedIds].sort();
+    if (current.length !== wanted.length || current.some((id, i) => id !== wanted[i])) {
+        throw new NuvioError('Reorder must list every collection id exactly once.');
+    }
+    const after = orderedIds.map((id) => before.find((c) => c.id === id));
+    return commit(client, profileId, originId, before, after, apply);
+}
+export async function duplicateCollection(client, profileId, collectionId, newId, newTitle, originId, apply) {
+    const before = await getCollections(client, profileId);
+    const source = before.find((c) => c.id === collectionId);
+    if (!source)
+        throw new NuvioError(`Collection "${collectionId}" not found`);
+    if (before.some((c) => c.id === newId))
+        throw new NuvioError(`Collection "${newId}" already exists`);
+    const copy = structuredClone(source);
+    copy.id = newId;
+    copy.title = newTitle ?? `${source.title} (copy)`;
+    copy.folders = copy.folders.map((f) => ({ ...f, id: `${newId}-${f.id}` }));
+    const index = before.findIndex((c) => c.id === collectionId);
+    const after = [...before.slice(0, index + 1), copy, ...before.slice(index + 1)];
+    return commit(client, profileId, originId, before, after, apply);
+}
+export async function reorderCollectionFolders(client, profileId, collectionId, orderedFolderIds, originId, apply) {
+    const before = await getCollections(client, profileId);
+    const target = before.find((c) => c.id === collectionId);
+    if (!target)
+        throw new NuvioError(`Collection "${collectionId}" not found`);
+    const current = target.folders.map((f) => f.id).sort();
+    const wanted = [...orderedFolderIds].sort();
+    if (current.length !== wanted.length || current.some((id, i) => id !== wanted[i])) {
+        throw new NuvioError('Reorder must list every folder id exactly once.');
+    }
+    const after = before.map((c) => c.id === collectionId
+        ? { ...c, folders: orderedFolderIds.map((id) => target.folders.find((f) => f.id === id)) }
+        : c);
+    return commit(client, profileId, originId, before, after, apply);
+}