@tearleads/client-sdk 0.0.0-stage → 0.1.13

package/workflows/container-contents/documentLinks.js

@@ -0,0 +1,262 @@
+import { assertDocumentWriterProjectionConsistent, readLinkedContainerIdsFromDocumentManifest, } from "../../data/documents/shared/projection.js";
+import { persistedDocumentCreateStateFromWriterProjection } from "../../data/documents/shared/responses.js";
+import { errorMessage } from "../../data/errorMessage.js";
+import { reportAndRethrowKeyingVerificationError } from "../../data/keyingProjectionVerification/error.js";
+import { sqlDocumentContainerProjectionPersistence } from "../../data/persistence/containers/documentContainerProjectionPersistence.js";
+import { isDatabaseUnavailableError } from "../../data/sync/databaseUnavailable.js";
+import { relinkRemoteDocument, resolveDocumentCreateAuthor, } from "../documents/index.js";
+import { createRuntimePrincipalPolicyWarmer } from "../principals/runtimePolicyWarmer.js";
+import { resolveContainerDocumentMoveUnlinkIds } from "./documentMoveUnlinkIds.js";
+// A cold-cache denial must keep its HTTP status: collapsing a 403 to null
+// would leave an access-denied move routinely retriable instead of parking
+// it for the access-restored signal (row 7).
+async function fetchMoveWriterProjection(input) {
+    const { apiClient } = input.runtime;
+    const result = await apiClient.getDocumentWriterProjectionResult(input.documentId, { reportErrors: false });
+    if (result.ok) {
+        return result.data;
+    }
+    result.report();
+    input.onFailure?.({ message: result.message, status: result.status });
+    return null;
+}
+export async function initializeDocumentLinksSchema(execSql) {
+    await sqlDocumentContainerProjectionPersistence.ensureSchema(execSql);
+}
+export async function listDocumentLinkedContainerIds(execSql, documentId) {
+    return sqlDocumentContainerProjectionPersistence.listLinkedContainerIds(execSql, documentId);
+}
+export async function replaceDocumentLinks(execSql, documentId, containerIds) {
+    await sqlDocumentContainerProjectionPersistence.replaceDocumentLinks(execSql, documentId, containerIds);
+}
+function resolveActiveDocumentContainerId(linkedContainerIds, preferredContainerId) {
+    if (linkedContainerIds.includes(preferredContainerId)) {
+        return preferredContainerId;
+    }
+    return linkedContainerIds[0] ?? null;
+}
+function containerDocumentMoveResult(input) {
+    return {
+        accessEpoch: input.document.plan.state.epoch,
+        accessStateHash: input.document.response.accessManifest.manifestHash,
+        linkedContainerIds: input.document.linkedContainerIds,
+        nextContainerId: input.nextContainerId,
+        remoteState: input.document.persistedState,
+        status: input.status,
+    };
+}
+async function containerDocumentAlreadyMovedResult(input) {
+    const verified = {};
+    await assertDocumentWriterProjectionConsistent(input.writerProjection, {
+        execSql: input.runtime.infra.execSql,
+        resolveProjectionUserKey: input.resolveProjectionUserKey,
+        stillCurrent: input.isCurrent,
+        warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(input.runtime),
+        onVerifiedAuthorization: (authorization) => {
+            verified.head = authorization.documentManifestByHash.get(input.writerProjection.documentManifest.manifestHash);
+        },
+    });
+    if (!verified.head)
+        throw new Error("Move replay lacks a verified document head");
+    return {
+        accessEpoch: verified.head.state.epoch,
+        accessStateHash: verified.head.manifestHash,
+        linkedContainerIds: input.linkedContainerIds,
+        nextContainerId: input.nextContainerId,
+        remoteState: persistedDocumentCreateStateFromWriterProjection(input.writerProjection),
+        status: input.status,
+    };
+}
+/**
+ * Hand a link/unlink/move/purge failure to host diagnostics as a real `Error`.
+ * The caller's string-only log line stays the fallback for a host without
+ * `logError`, so this never logs a second copy of the same failure.
+ */
+function reportDocumentLinkMutationFailure(util, error) {
+    // `ApiClient` returns `RequestFailure` objects instead of throwing, so
+    // offline and 403/404/409 already left through the `!result` branch: a status
+    // filter here would be dead code. Only a database lost mid-flight stays quiet.
+    if (!util.logError || isDatabaseUnavailableError(error))
+        return;
+    try {
+        // A host logger that throws or rejects must not replace the null result or
+        // skip the failure handler below.
+        void Promise.resolve(util.logError("Container contents: document link mutation failed", error)).catch(() => undefined);
+    }
+    catch {
+        // Hosts may throw synchronously or return a rejected promise.
+    }
+}
+export async function relinkRemoteContainerDocument(input) {
+    const { documentId, noteId, operation, resolveProjectionUserKey, runtime, targetContainerId, } = input;
+    const author = resolveDocumentCreateAuthor(runtime);
+    const targetSecretKey = runtime.crypto.encapsulationKeyPair?.secretKey;
+    const execSql = runtime.infra.execSql;
+    if (input.isCurrent?.() === false)
+        return null;
+    if (!author || !targetSecretKey) {
+        runtime.util.log("Container contents: document mutation skipped because the local key context is unavailable");
+        input.onFailure?.({
+            message: "the local key context is unavailable",
+            status: null,
+        });
+        return null;
+    }
+    try {
+        const result = await relinkRemoteDocument({
+            apiClient: runtime.apiClient,
+            author,
+            documentId,
+            execSql,
+            onFailure: input.onFailure,
+            operation,
+            resolveProjectionUserKey,
+            rotationSnapshot: input.rotationSnapshot,
+            stillCurrent: input.isCurrent,
+            targetContainerId,
+            targetSecretKey,
+            warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(runtime),
+        });
+        if (!result) {
+            runtime.util.log(`Container contents: failed to ${operation} note ${noteId} ${operation === "link" ? "to" : "from"} container ${targetContainerId}`);
+            return null;
+        }
+        if (input.isCurrent?.() === false)
+            return null;
+        await sqlDocumentContainerProjectionPersistence.replaceDocumentLinks(execSql, documentId, result.linkedContainerIds, { stillCurrent: input.isCurrent });
+        return result;
+    }
+    catch (error) {
+        await reportAndRethrowKeyingVerificationError(error, runtime.util.reportSecurityIncident, {
+            objectId: documentId,
+            objectKind: "document",
+            operation: `document.${operation}`,
+        });
+        const message = errorMessage(error);
+        runtime.util.log(`Container contents: failed to ${operation} note ${noteId} ${operation === "link" ? "to" : "from"} container ${targetContainerId}: ${message}`);
+        // After the keying rethrow above, so a verification failure keeps its
+        // security incident instead of being reported twice, and before the failure
+        // handler, so a throwing caller callback cannot swallow the report.
+        reportDocumentLinkMutationFailure(runtime.util, error);
+        input.onFailure?.({ message, status: null });
+        return null;
+    }
+}
+async function linkRemoteContainerDocument(input) {
+    return relinkRemoteContainerDocument({
+        ...input,
+        operation: "link",
+    });
+}
+export async function unlinkRemoteContainerDocument(input) {
+    return relinkRemoteContainerDocument({
+        ...input,
+        operation: "unlink",
+    });
+}
+export async function moveRemoteContainerDocument(input) {
+    const { documentId, noteId, resolveProjectionUserKey, runtime, targetContainerId, } = input;
+    if (input.isCurrent?.() === false)
+        return null;
+    const writerProjection = await fetchMoveWriterProjection({
+        documentId,
+        onFailure: input.onFailure,
+        runtime,
+    });
+    if (!writerProjection || input.isCurrent?.() === false) {
+        return null;
+    }
+    if (writerProjection.documentId !== documentId)
+        throw new Error("Move replay document id mismatch");
+    const initialLinkedContainerIds = readLinkedContainerIdsFromDocumentManifest(writerProjection);
+    let latestLinkedContainerIds = initialLinkedContainerIds;
+    let latestDocument = null;
+    for (const linkTarget of new Set([
+        ...(input.linkOnly ? [] : [targetContainerId]),
+        ...(input.additionalLinkContainerIds ?? []),
+    ])) {
+        if (latestLinkedContainerIds.includes(linkTarget))
+            continue;
+        const linkedDocument = await linkRemoteContainerDocument({
+            documentId,
+            isCurrent: input.isCurrent,
+            noteId,
+            onFailure: input.onFailure,
+            resolveProjectionUserKey,
+            runtime,
+            targetContainerId: linkTarget,
+        });
+        if (!linkedDocument || input.isCurrent?.() === false) {
+            return null;
+        }
+        latestDocument = linkedDocument;
+        latestLinkedContainerIds = linkedDocument.linkedContainerIds;
+    }
+    const unlinkContainerIds = resolveContainerDocumentMoveUnlinkIds({
+        ...input,
+        linkedContainerIds: latestLinkedContainerIds,
+    });
+    const unlinked = await unlinkMovedDocumentSources({
+        ...input,
+        latestDocument,
+        latestLinkedContainerIds,
+        unlinkContainerIds,
+    });
+    if (!unlinked)
+        return null;
+    latestDocument = unlinked.latestDocument;
+    latestLinkedContainerIds = unlinked.latestLinkedContainerIds;
+    const nextContainerId = resolveActiveDocumentContainerId(latestLinkedContainerIds, targetContainerId);
+    if (!nextContainerId) {
+        return null;
+    }
+    const status = unlinked.failedUnlinkContainerIds.length > 0 ? "partial" : "complete";
+    return latestDocument
+        ? containerDocumentMoveResult({
+            document: latestDocument,
+            nextContainerId,
+            status,
+        })
+        : containerDocumentAlreadyMovedResult({
+            writerProjection,
+            resolveProjectionUserKey,
+            runtime,
+            isCurrent: input.isCurrent,
+            linkedContainerIds: latestLinkedContainerIds,
+            nextContainerId,
+            status,
+        });
+}
+// The unlink half of a move: every source is attempted even when an earlier
+// one fails, so one dead source cannot strand the others; a failed unlink
+// leaves the move "partial" for the queue to retry.
+async function unlinkMovedDocumentSources(input) {
+    const { noteId, runtime, targetContainerId } = input;
+    let { latestDocument, latestLinkedContainerIds } = input;
+    const failedUnlinkContainerIds = [];
+    for (const unlinkContainerId of input.unlinkContainerIds) {
+        if (input.isCurrent?.() === false)
+            return null;
+        const unlinkedDocument = await unlinkRemoteContainerDocument({
+            documentId: input.documentId,
+            isCurrent: input.isCurrent,
+            noteId,
+            onFailure: input.onFailure,
+            resolveProjectionUserKey: input.resolveProjectionUserKey,
+            rotationSnapshot: input.rotationSnapshot,
+            runtime,
+            targetContainerId: unlinkContainerId,
+        });
+        if (input.isCurrent?.() === false)
+            return null;
+        if (!unlinkedDocument) {
+            failedUnlinkContainerIds.push(unlinkContainerId);
+            runtime.util.log(`Container contents: note ${noteId} was linked to ${targetContainerId} but failed to unlink from ${unlinkContainerId}`);
+            continue;
+        }
+        latestDocument = unlinkedDocument;
+        latestLinkedContainerIds = unlinkedDocument.linkedContainerIds;
+    }
+    return { failedUnlinkContainerIds, latestDocument, latestLinkedContainerIds };
+}
+//# sourceMappingURL=documentLinks.js.map

package/workflows/container-contents/documentLinks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentLinks.js","sourceRoot":"","sources":["documentLinks.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,wCAAwC,EACxC,0CAA0C,GAC3C,MAAM,wCAAwC,CAAC;AAChD,OAAO,EAAE,gDAAgD,EAAE,MAAM,uCAAuC,CAAC;AACzG,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEvD,OAAO,EAAE,uCAAuC,EAAE,MAAM,+CAA+C,CAAC;AACxG,OAAO,EAAE,yCAAyC,EAAE,MAAM,0EAA0E,CAAC;AAErI,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAGL,oBAAoB,EACpB,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAC;AACvF,OAAO,EAAE,qCAAqC,EAAE,MAAM,yBAAyB,CAAC;AAYhF,0EAA0E;AAC1E,2EAA2E;AAC3E,6CAA6C;AAC7C,KAAK,UAAU,yBAAyB,CAAC,KAIxC;IAGC,MAAM,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,iCAAiC,CAC9D,KAAK,CAAC,UAAU,EAChB,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;IACF,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,MAAM,CAAC,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,OAAO,IAAI,CAAC;AACd,CAAC;AAgCD,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAgB;IAEhB,MAAM,yCAAyC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,OAAgB,EAChB,UAAkB;IAElB,OAAO,yCAAyC,CAAC,sBAAsB,CACrE,OAAO,EACP,UAAU,CACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAgB,EAChB,UAAkB,EAClB,YAAmC;IAEnC,MAAM,yCAAyC,CAAC,oBAAoB,CAClE,OAAO,EACP,UAAU,EACV,YAAY,CACb,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,kBAAyC,EACzC,oBAA4B;IAE5B,IAAI,kBAAkB,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACtD,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,OAAO,kBAAkB,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACvC,CAAC;AAED,SAAS,2BAA2B,CAAC,KAIpC;IACC,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK;QAC5C,eAAe,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,YAAY;QACpE,kBAAkB,EAAE,KAAK,CAAC,QAAQ,CAAC,kBAAkB;QACrD,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc;QAC1C,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mCAAmC,CAAC,KAQlD;IACC,MAAM,QAAQ,GAA2D,EAAE,CAAC;IAC5E,MAAM,wCAAwC,CAAC,KAAK,CAAC,gBAAgB,EAAE;QACrE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACpC,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;QACxD,YAAY,EAAE,KAAK,CAAC,SAAS;QAC7B,+BAA+B,EAAE,kCAAkC,CACjE,KAAK,CAAC,OAAO,CACd;QACD,uBAAuB,EAAE,CAAC,aAAa,EAAE,EAAE;YACzC,QAAQ,CAAC,IAAI,GAAG,aAAa,CAAC,sBAAsB,CAAC,GAAG,CACtD,KAAK,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,YAAY,CACrD,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,IAAI;QAChB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,OAAO;QACL,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK;QACtC,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY;QAC3C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;QAC5C,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,WAAW,EAAE,gDAAgD,CAC3D,KAAK,CAAC,gBAAgB,CACvB;QACD,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,iCAAiC,CACxC,IAA0C,EAC1C,KAAc;IAEd,uEAAuE;IACvE,8EAA8E;IAC9E,+EAA+E;IAC/E,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,0BAA0B,CAAC,KAAK,CAAC;QAAE,OAAO;IAChE,IAAI,CAAC;QACH,2EAA2E;QAC3E,kCAAkC;QAClC,KAAK,OAAO,CAAC,OAAO,CAClB,IAAI,CAAC,QAAQ,CAAC,mDAAmD,EAAE,KAAK,CAAC,CAC1E,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KAUnD;IACC,MAAM,EACJ,UAAU,EACV,MAAM,EACN,SAAS,EACT,wBAAwB,EACxB,OAAO,EACP,iBAAiB,GAClB,GAAG,KAAK,CAAC;IACV,MAAM,MAAM,GAAG,2BAA2B,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,oBAAoB,EAAE,SAAS,CAAC;IACvE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IACtC,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,4FAA4F,CAC7F,CAAC;QACF,KAAK,CAAC,SAAS,EAAE,CAAC;YAChB,OAAO,EAAE,sCAAsC;YAC/C,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;YACxC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM;YACN,UAAU;YACV,OAAO;YACP,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS;YACT,wBAAwB;YACxB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,YAAY,EAAE,KAAK,CAAC,SAAS;YAC7B,iBAAiB;YACjB,eAAe;YACf,+BAA+B,EAC7B,kCAAkC,CAAC,OAAO,CAAC;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,iCAAiC,SAAS,SAAS,MAAM,IAAI,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,cAAc,iBAAiB,EAAE,CACnI,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAE/C,MAAM,yCAAyC,CAAC,oBAAoB,CAClE,OAAO,EACP,UAAU,EACV,MAAM,CAAC,kBAAkB,EACzB,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,EAAE,CAClC,CAAC;QAEF,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,uCAAuC,CAC3C,KAAK,EACL,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACnC;YACE,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,UAAU;YACtB,SAAS,EAAE,YAAY,SAAS,EAAE;SACnC,CACF,CAAC;QACF,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,iCAAiC,SAAS,SAAS,MAAM,IAAI,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,cAAc,iBAAiB,KAAK,OAAO,EAAE,CAC/I,CAAC;QACF,sEAAsE;QACtE,4EAA4E;QAC5E,oEAAoE;QACpE,iCAAiC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvD,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAQ1C;IACC,OAAO,6BAA6B,CAAC;QACnC,GAAG,KAAK;QACR,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,KASnD;IACC,OAAO,6BAA6B,CAAC;QACnC,GAAG,KAAK;QACR,SAAS,EAAE,QAAQ;KACpB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAcjD;IACC,MAAM,EACJ,UAAU,EACV,MAAM,EACN,wBAAwB,EACxB,OAAO,EACP,iBAAiB,GAClB,GAAG,KAAK,CAAC;IACV,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,gBAAgB,GAAG,MAAM,yBAAyB,CAAC;QACvD,UAAU;QACV,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO;KACR,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,gBAAgB,CAAC,UAAU,KAAK,UAAU;QAC5C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,MAAM,yBAAyB,GAC7B,0CAA0C,CAAC,gBAAgB,CAAC,CAAC;IAE/D,IAAI,wBAAwB,GAAsB,yBAAyB,CAAC;IAC5E,IAAI,cAAc,GAAsC,IAAI,CAAC;IAC7D,KAAK,MAAM,UAAU,IAAI,IAAI,GAAG,CAAC;QAC/B,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;QAC9C,GAAG,CAAC,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC;KAC5C,CAAC,EAAE,CAAC;QACH,IAAI,wBAAwB,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,SAAS;QAC5D,MAAM,cAAc,GAAG,MAAM,2BAA2B,CAAC;YACvD,UAAU;YACV,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM;YACN,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,wBAAwB;YACxB,OAAO;YACP,iBAAiB,EAAE,UAAU;SAC9B,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,cAAc,GAAG,cAAc,CAAC;QAChC,wBAAwB,GAAG,cAAc,CAAC,kBAAkB,CAAC;IAC/D,CAAC;IAED,MAAM,kBAAkB,GAAG,qCAAqC,CAAC;QAC/D,GAAG,KAAK;QACR,kBAAkB,EAAE,wBAAwB;KAC7C,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAAC;QAChD,GAAG,KAAK;QACR,cAAc;QACd,wBAAwB;QACxB,kBAAkB;KACnB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,cAAc,GAAG,QAAQ,CAAC,cAAc,CAAC;IACzC,wBAAwB,GAAG,QAAQ,CAAC,wBAAwB,CAAC;IAE7D,MAAM,eAAe,GAAG,gCAAgC,CACtD,wBAAwB,EACxB,iBAAiB,CAClB,CAAC;IACF,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GACV,QAAQ,CAAC,wBAAwB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;IACxE,OAAO,cAAc;QACnB,CAAC,CAAC,2BAA2B,CAAC;YAC1B,QAAQ,EAAE,cAAc;YACxB,eAAe;YACf,MAAM;SACP,CAAC;QACJ,CAAC,CAAC,mCAAmC,CAAC;YAClC,gBAAgB;YAChB,wBAAwB;YACxB,OAAO;YACP,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,kBAAkB,EAAE,wBAAwB;YAC5C,eAAe;YACf,MAAM;SACP,CAAC,CAAC;AACT,CAAC;AAED,4EAA4E;AAC5E,0EAA0E;AAC1E,oDAAoD;AACpD,KAAK,UAAU,0BAA0B,CAAC,KAYzC;IAKC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,GAAG,KAAK,CAAC;IACrD,IAAI,EAAE,cAAc,EAAE,wBAAwB,EAAE,GAAG,KAAK,CAAC;IACzD,MAAM,wBAAwB,GAAa,EAAE,CAAC;IAC9C,KAAK,MAAM,iBAAiB,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QACzD,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,gBAAgB,GAAG,MAAM,6BAA6B,CAAC;YAC3D,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,MAAM;YACN,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,wBAAwB,EAAE,KAAK,CAAC,wBAAwB;YACxD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,OAAO;YACP,iBAAiB,EAAE,iBAAiB;SACrC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,SAAS,EAAE,EAAE,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAC/C,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,wBAAwB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,4BAA4B,MAAM,kBAAkB,iBAAiB,8BAA8B,iBAAiB,EAAE,CACvH,CAAC;YACF,SAAS;QACX,CAAC;QAED,cAAc,GAAG,gBAAgB,CAAC;QAClC,wBAAwB,GAAG,gBAAgB,CAAC,kBAAkB,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,wBAAwB,EAAE,CAAC;AAChF,CAAC","sourcesContent":["import type { VerifiedDocumentLinkSetManifest } from \"@tearleads/crypto\";\nimport type { DocumentWriterProjectionResponse } from \"@tearleads/validators/response\";\nimport {\n  assertDocumentWriterProjectionConsistent,\n  readLinkedContainerIdsFromDocumentManifest,\n} from \"../../data/documents/shared/projection\";\nimport { persistedDocumentCreateStateFromWriterProjection } from \"../../data/documents/shared/responses\";\nimport { errorMessage } from \"../../data/errorMessage\";\nimport type { ProjectionUserKeyResolver } from \"../../data/keyingProjectionVerification\";\nimport { reportAndRethrowKeyingVerificationError } from \"../../data/keyingProjectionVerification/error\";\nimport { sqlDocumentContainerProjectionPersistence } from \"../../data/persistence/containers/documentContainerProjectionPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport { isDatabaseUnavailableError } from \"../../data/sync/databaseUnavailable\";\nimport {\n  type DocumentLinkSetFailureHandler,\n  type RelinkRemoteDocumentResult,\n  relinkRemoteDocument,\n  resolveDocumentCreateAuthor,\n} from \"../documents\";\nimport { createRuntimePrincipalPolicyWarmer } from \"../principals/runtimePolicyWarmer\";\nimport { resolveContainerDocumentMoveUnlinkIds } from \"./documentMoveUnlinkIds\";\nimport type { ContainerContentsWorkflowRuntime } from \"./runtime\";\n\ntype ContainerDocumentLinkApi = Parameters<\n  typeof relinkRemoteDocument\n>[0][\"apiClient\"];\ntype ContainerDocumentLinkOperation = Parameters<\n  typeof relinkRemoteDocument\n>[0][\"operation\"];\ntype RemoteDocumentPersistedState =\n  RelinkRemoteDocumentResult[\"persistedState\"];\n\n// A cold-cache denial must keep its HTTP status: collapsing a 403 to null\n// would leave an access-denied move routinely retriable instead of parking\n// it for the access-restored signal (row 7).\nasync function fetchMoveWriterProjection(input: {\n  documentId: string;\n  onFailure?: DocumentLinkSetFailureHandler | undefined;\n  runtime: ContainerDocumentLinkRuntime;\n}): Promise<Awaited<\n  ReturnType<ContainerDocumentLinkApi[\"getDocumentWriterProjection\"]>\n> | null> {\n  const { apiClient } = input.runtime;\n  const result = await apiClient.getDocumentWriterProjectionResult(\n    input.documentId,\n    { reportErrors: false },\n  );\n  if (result.ok) {\n    return result.data;\n  }\n  result.report();\n  input.onFailure?.({ message: result.message, status: result.status });\n  return null;\n}\n\ninterface ContainerDocumentLinkRuntime\n  extends Pick<\n    ContainerContentsWorkflowRuntime,\n    | \"auth\"\n    | \"crypto\"\n    | \"infra\"\n    | \"resolveTrustedUserIdentity\"\n    | \"state\"\n    | \"util\"\n  > {\n  apiClient: ContainerDocumentLinkApi &\n    Pick<\n      ContainerContentsWorkflowRuntime[\"apiClient\"],\n      \"getCurrentPrincipalPolicy\"\n    >;\n}\n\ntype MoveRemoteContainerDocumentStatus = \"complete\" | \"partial\";\n\ninterface MoveRemoteContainerDocumentResult {\n  accessEpoch: number | null;\n  accessStateHash: string | null;\n  linkedContainerIds: readonly string[];\n  nextContainerId: string;\n  remoteState: RemoteDocumentPersistedState | null;\n  status: MoveRemoteContainerDocumentStatus;\n}\n\nexport type { RemoteDocumentPersistedState };\n\nexport async function initializeDocumentLinksSchema(\n  execSql: ExecSql,\n): Promise<void> {\n  await sqlDocumentContainerProjectionPersistence.ensureSchema(execSql);\n}\n\nexport async function listDocumentLinkedContainerIds(\n  execSql: ExecSql,\n  documentId: string,\n): Promise<ReadonlyArray<string>> {\n  return sqlDocumentContainerProjectionPersistence.listLinkedContainerIds(\n    execSql,\n    documentId,\n  );\n}\n\nexport async function replaceDocumentLinks(\n  execSql: ExecSql,\n  documentId: string,\n  containerIds: ReadonlyArray<string>,\n): Promise<void> {\n  await sqlDocumentContainerProjectionPersistence.replaceDocumentLinks(\n    execSql,\n    documentId,\n    containerIds,\n  );\n}\n\nfunction resolveActiveDocumentContainerId(\n  linkedContainerIds: ReadonlyArray<string>,\n  preferredContainerId: string,\n): string | null {\n  if (linkedContainerIds.includes(preferredContainerId)) {\n    return preferredContainerId;\n  }\n\n  return linkedContainerIds[0] ?? null;\n}\n\nfunction containerDocumentMoveResult(input: {\n  document: RelinkRemoteDocumentResult;\n  nextContainerId: string;\n  status: MoveRemoteContainerDocumentStatus;\n}): MoveRemoteContainerDocumentResult {\n  return {\n    accessEpoch: input.document.plan.state.epoch,\n    accessStateHash: input.document.response.accessManifest.manifestHash,\n    linkedContainerIds: input.document.linkedContainerIds,\n    nextContainerId: input.nextContainerId,\n    remoteState: input.document.persistedState,\n    status: input.status,\n  };\n}\n\nasync function containerDocumentAlreadyMovedResult(input: {\n  writerProjection: DocumentWriterProjectionResponse;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerDocumentLinkRuntime;\n  isCurrent?: (() => boolean) | undefined;\n  linkedContainerIds: readonly string[];\n  nextContainerId: string;\n  status: MoveRemoteContainerDocumentStatus;\n}): Promise<MoveRemoteContainerDocumentResult> {\n  const verified: { head?: VerifiedDocumentLinkSetManifest | undefined } = {};\n  await assertDocumentWriterProjectionConsistent(input.writerProjection, {\n    execSql: input.runtime.infra.execSql,\n    resolveProjectionUserKey: input.resolveProjectionUserKey,\n    stillCurrent: input.isCurrent,\n    warmReferencedPrincipalPolicies: createRuntimePrincipalPolicyWarmer(\n      input.runtime,\n    ),\n    onVerifiedAuthorization: (authorization) => {\n      verified.head = authorization.documentManifestByHash.get(\n        input.writerProjection.documentManifest.manifestHash,\n      );\n    },\n  });\n  if (!verified.head)\n    throw new Error(\"Move replay lacks a verified document head\");\n  return {\n    accessEpoch: verified.head.state.epoch,\n    accessStateHash: verified.head.manifestHash,\n    linkedContainerIds: input.linkedContainerIds,\n    nextContainerId: input.nextContainerId,\n    remoteState: persistedDocumentCreateStateFromWriterProjection(\n      input.writerProjection,\n    ),\n    status: input.status,\n  };\n}\n\n/**\n * Hand a link/unlink/move/purge failure to host diagnostics as a real `Error`.\n * The caller's string-only log line stays the fallback for a host without\n * `logError`, so this never logs a second copy of the same failure.\n */\nfunction reportDocumentLinkMutationFailure(\n  util: ContainerDocumentLinkRuntime[\"util\"],\n  error: unknown,\n): void {\n  // `ApiClient` returns `RequestFailure` objects instead of throwing, so\n  // offline and 403/404/409 already left through the `!result` branch: a status\n  // filter here would be dead code. Only a database lost mid-flight stays quiet.\n  if (!util.logError || isDatabaseUnavailableError(error)) return;\n  try {\n    // A host logger that throws or rejects must not replace the null result or\n    // skip the failure handler below.\n    void Promise.resolve(\n      util.logError(\"Container contents: document link mutation failed\", error),\n    ).catch(() => undefined);\n  } catch {\n    // Hosts may throw synchronously or return a rejected promise.\n  }\n}\n\nexport async function relinkRemoteContainerDocument(input: {\n  documentId: string;\n  isCurrent?: (() => boolean) | undefined;\n  noteId: string;\n  onFailure?: DocumentLinkSetFailureHandler | undefined;\n  operation: ContainerDocumentLinkOperation;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  rotationSnapshot?: Uint8Array | undefined;\n  runtime: ContainerDocumentLinkRuntime;\n  targetContainerId: string;\n}): Promise<RelinkRemoteDocumentResult | null> {\n  const {\n    documentId,\n    noteId,\n    operation,\n    resolveProjectionUserKey,\n    runtime,\n    targetContainerId,\n  } = input;\n  const author = resolveDocumentCreateAuthor(runtime);\n  const targetSecretKey = runtime.crypto.encapsulationKeyPair?.secretKey;\n  const execSql = runtime.infra.execSql;\n  if (input.isCurrent?.() === false) return null;\n  if (!author || !targetSecretKey) {\n    runtime.util.log(\n      \"Container contents: document mutation skipped because the local key context is unavailable\",\n    );\n    input.onFailure?.({\n      message: \"the local key context is unavailable\",\n      status: null,\n    });\n    return null;\n  }\n\n  try {\n    const result = await relinkRemoteDocument({\n      apiClient: runtime.apiClient,\n      author,\n      documentId,\n      execSql,\n      onFailure: input.onFailure,\n      operation,\n      resolveProjectionUserKey,\n      rotationSnapshot: input.rotationSnapshot,\n      stillCurrent: input.isCurrent,\n      targetContainerId,\n      targetSecretKey,\n      warmReferencedPrincipalPolicies:\n        createRuntimePrincipalPolicyWarmer(runtime),\n    });\n    if (!result) {\n      runtime.util.log(\n        `Container contents: failed to ${operation} note ${noteId} ${operation === \"link\" ? \"to\" : \"from\"} container ${targetContainerId}`,\n      );\n      return null;\n    }\n    if (input.isCurrent?.() === false) return null;\n\n    await sqlDocumentContainerProjectionPersistence.replaceDocumentLinks(\n      execSql,\n      documentId,\n      result.linkedContainerIds,\n      { stillCurrent: input.isCurrent },\n    );\n\n    return result;\n  } catch (error) {\n    await reportAndRethrowKeyingVerificationError(\n      error,\n      runtime.util.reportSecurityIncident,\n      {\n        objectId: documentId,\n        objectKind: \"document\",\n        operation: `document.${operation}`,\n      },\n    );\n    const message = errorMessage(error);\n    runtime.util.log(\n      `Container contents: failed to ${operation} note ${noteId} ${operation === \"link\" ? \"to\" : \"from\"} container ${targetContainerId}: ${message}`,\n    );\n    // After the keying rethrow above, so a verification failure keeps its\n    // security incident instead of being reported twice, and before the failure\n    // handler, so a throwing caller callback cannot swallow the report.\n    reportDocumentLinkMutationFailure(runtime.util, error);\n    input.onFailure?.({ message, status: null });\n    return null;\n  }\n}\n\nasync function linkRemoteContainerDocument(input: {\n  documentId: string;\n  isCurrent?: (() => boolean) | undefined;\n  noteId: string;\n  onFailure?: DocumentLinkSetFailureHandler | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  runtime: ContainerDocumentLinkRuntime;\n  targetContainerId: string;\n}): Promise<RelinkRemoteDocumentResult | null> {\n  return relinkRemoteContainerDocument({\n    ...input,\n    operation: \"link\",\n  });\n}\n\nexport async function unlinkRemoteContainerDocument(input: {\n  documentId: string;\n  isCurrent?: (() => boolean) | undefined;\n  noteId: string;\n  onFailure?: DocumentLinkSetFailureHandler | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  rotationSnapshot: Uint8Array;\n  runtime: ContainerDocumentLinkRuntime;\n  targetContainerId: string;\n}): Promise<RelinkRemoteDocumentResult | null> {\n  return relinkRemoteContainerDocument({\n    ...input,\n    operation: \"unlink\",\n  });\n}\n\nexport async function moveRemoteContainerDocument(input: {\n  linkOnly?: boolean | undefined;\n  additionalLinkContainerIds?: readonly string[] | undefined;\n  removedLinkContainerIds?: readonly string[] | undefined;\n  currentContainerId: string;\n  documentId: string;\n  isCurrent?: (() => boolean) | undefined;\n  noteId: string;\n  onFailure?: DocumentLinkSetFailureHandler | undefined;\n  replaceLinkedContainers?: boolean | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  rotationSnapshot: Uint8Array;\n  runtime: ContainerDocumentLinkRuntime;\n  targetContainerId: string;\n}): Promise<MoveRemoteContainerDocumentResult | null> {\n  const {\n    documentId,\n    noteId,\n    resolveProjectionUserKey,\n    runtime,\n    targetContainerId,\n  } = input;\n  if (input.isCurrent?.() === false) return null;\n  const writerProjection = await fetchMoveWriterProjection({\n    documentId,\n    onFailure: input.onFailure,\n    runtime,\n  });\n  if (!writerProjection || input.isCurrent?.() === false) {\n    return null;\n  }\n  if (writerProjection.documentId !== documentId)\n    throw new Error(\"Move replay document id mismatch\");\n  const initialLinkedContainerIds =\n    readLinkedContainerIdsFromDocumentManifest(writerProjection);\n\n  let latestLinkedContainerIds: readonly string[] = initialLinkedContainerIds;\n  let latestDocument: RelinkRemoteDocumentResult | null = null;\n  for (const linkTarget of new Set([\n    ...(input.linkOnly ? [] : [targetContainerId]),\n    ...(input.additionalLinkContainerIds ?? []),\n  ])) {\n    if (latestLinkedContainerIds.includes(linkTarget)) continue;\n    const linkedDocument = await linkRemoteContainerDocument({\n      documentId,\n      isCurrent: input.isCurrent,\n      noteId,\n      onFailure: input.onFailure,\n      resolveProjectionUserKey,\n      runtime,\n      targetContainerId: linkTarget,\n    });\n    if (!linkedDocument || input.isCurrent?.() === false) {\n      return null;\n    }\n\n    latestDocument = linkedDocument;\n    latestLinkedContainerIds = linkedDocument.linkedContainerIds;\n  }\n\n  const unlinkContainerIds = resolveContainerDocumentMoveUnlinkIds({\n    ...input,\n    linkedContainerIds: latestLinkedContainerIds,\n  });\n\n  const unlinked = await unlinkMovedDocumentSources({\n    ...input,\n    latestDocument,\n    latestLinkedContainerIds,\n    unlinkContainerIds,\n  });\n  if (!unlinked) return null;\n  latestDocument = unlinked.latestDocument;\n  latestLinkedContainerIds = unlinked.latestLinkedContainerIds;\n\n  const nextContainerId = resolveActiveDocumentContainerId(\n    latestLinkedContainerIds,\n    targetContainerId,\n  );\n  if (!nextContainerId) {\n    return null;\n  }\n\n  const status =\n    unlinked.failedUnlinkContainerIds.length > 0 ? \"partial\" : \"complete\";\n  return latestDocument\n    ? containerDocumentMoveResult({\n        document: latestDocument,\n        nextContainerId,\n        status,\n      })\n    : containerDocumentAlreadyMovedResult({\n        writerProjection,\n        resolveProjectionUserKey,\n        runtime,\n        isCurrent: input.isCurrent,\n        linkedContainerIds: latestLinkedContainerIds,\n        nextContainerId,\n        status,\n      });\n}\n\n// The unlink half of a move: every source is attempted even when an earlier\n// one fails, so one dead source cannot strand the others; a failed unlink\n// leaves the move \"partial\" for the queue to retry.\nasync function unlinkMovedDocumentSources(input: {\n  documentId: string;\n  isCurrent?: (() => boolean) | undefined;\n  latestDocument: RelinkRemoteDocumentResult | null;\n  latestLinkedContainerIds: readonly string[];\n  noteId: string;\n  onFailure?: DocumentLinkSetFailureHandler | undefined;\n  resolveProjectionUserKey: ProjectionUserKeyResolver;\n  rotationSnapshot: Uint8Array;\n  runtime: ContainerDocumentLinkRuntime;\n  targetContainerId: string;\n  unlinkContainerIds: readonly string[];\n}): Promise<{\n  failedUnlinkContainerIds: readonly string[];\n  latestDocument: RelinkRemoteDocumentResult | null;\n  latestLinkedContainerIds: readonly string[];\n} | null> {\n  const { noteId, runtime, targetContainerId } = input;\n  let { latestDocument, latestLinkedContainerIds } = input;\n  const failedUnlinkContainerIds: string[] = [];\n  for (const unlinkContainerId of input.unlinkContainerIds) {\n    if (input.isCurrent?.() === false) return null;\n    const unlinkedDocument = await unlinkRemoteContainerDocument({\n      documentId: input.documentId,\n      isCurrent: input.isCurrent,\n      noteId,\n      onFailure: input.onFailure,\n      resolveProjectionUserKey: input.resolveProjectionUserKey,\n      rotationSnapshot: input.rotationSnapshot,\n      runtime,\n      targetContainerId: unlinkContainerId,\n    });\n    if (input.isCurrent?.() === false) return null;\n    if (!unlinkedDocument) {\n      failedUnlinkContainerIds.push(unlinkContainerId);\n      runtime.util.log(\n        `Container contents: note ${noteId} was linked to ${targetContainerId} but failed to unlink from ${unlinkContainerId}`,\n      );\n      continue;\n    }\n\n    latestDocument = unlinkedDocument;\n    latestLinkedContainerIds = unlinkedDocument.linkedContainerIds;\n  }\n  return { failedUnlinkContainerIds, latestDocument, latestLinkedContainerIds };\n}\n"]}

package/workflows/container-contents/documentLocalRelink.js

@@ -0,0 +1,23 @@
+export async function relinkContainerDocumentLocally(params) {
+    const { accessEpoch, accessStateHash, currentDocumentStore, host, note, remoteState, requestSync, runtime, targetContainerId, } = params;
+    const relinkedNote = await currentDocumentStore.relink({
+        accessEpoch,
+        ...(accessStateHash === undefined ? {} : { accessStateHash }),
+        containerId: targetContainerId,
+        commitSideEffect: params.commitSideEffect,
+        ...remoteState,
+        documentId: note.documentId,
+        localId: note.id,
+    });
+    if (!relinkedNote) {
+        runtime.util.log(`Container contents: note ${note.id} could not be relinked after a structural mutation`);
+        return null;
+    }
+    host.mergeDocumentSummary(relinkedNote);
+    currentDocumentStore.updateRuntime(host.documentWorkflowRuntime(targetContainerId));
+    if (requestSync) {
+        currentDocumentStore.requestSync();
+    }
+    return relinkedNote;
+}
+//# sourceMappingURL=documentLocalRelink.js.map

package/workflows/container-contents/documentLocalRelink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentLocalRelink.js","sourceRoot":"","sources":["documentLocalRelink.ts"],"names":[],"mappings":"AASA,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAW,MAW9D;IACC,MAAM,EACJ,WAAW,EACX,eAAe,EACf,oBAAoB,EACpB,IAAI,EACJ,IAAI,EACJ,WAAW,EACX,WAAW,EACX,OAAO,EACP,iBAAiB,GAClB,GAAG,MAAM,CAAC;IAEX,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC;QACrD,WAAW;QACX,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;QAC7D,WAAW,EAAE,iBAAiB;QAC9B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,GAAG,WAAW;QACd,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,OAAO,EAAE,IAAI,CAAC,EAAE;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,4BAA4B,IAAI,CAAC,EAAE,oDAAoD,CACxF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAC;IACxC,oBAAoB,CAAC,aAAa,CAChC,IAAI,CAAC,uBAAuB,CAAC,iBAAiB,CAAC,CAChD,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,oBAAoB,CAAC,WAAW,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC","sourcesContent":["import type { DocumentSummary } from \"../../data/documents/documentSummary\";\nimport type { RemoteDocumentPersistedState } from \"./documentLinks\";\nimport type {\n  DocumentStructuralMutationHost,\n  DocumentStructuralMutationLocalStore,\n  DocumentStructuralMutationRelinkInput,\n  DocumentStructuralMutationRuntime,\n} from \"./documentStructureTypes\";\n\nexport async function relinkContainerDocumentLocally<TRuntime>(params: {\n  accessEpoch: number;\n  commitSideEffect?: DocumentStructuralMutationRelinkInput[\"commitSideEffect\"];\n  accessStateHash?: string | null | undefined;\n  currentDocumentStore: DocumentStructuralMutationLocalStore<TRuntime>;\n  host: DocumentStructuralMutationHost<TRuntime>;\n  note: DocumentSummary;\n  remoteState?: RemoteDocumentPersistedState | undefined;\n  requestSync: boolean;\n  runtime: DocumentStructuralMutationRuntime;\n  targetContainerId: string;\n}) {\n  const {\n    accessEpoch,\n    accessStateHash,\n    currentDocumentStore,\n    host,\n    note,\n    remoteState,\n    requestSync,\n    runtime,\n    targetContainerId,\n  } = params;\n\n  const relinkedNote = await currentDocumentStore.relink({\n    accessEpoch,\n    ...(accessStateHash === undefined ? {} : { accessStateHash }),\n    containerId: targetContainerId,\n    commitSideEffect: params.commitSideEffect,\n    ...remoteState,\n    documentId: note.documentId,\n    localId: note.id,\n  });\n  if (!relinkedNote) {\n    runtime.util.log(\n      `Container contents: note ${note.id} could not be relinked after a structural mutation`,\n    );\n    return null;\n  }\n\n  host.mergeDocumentSummary(relinkedNote);\n  currentDocumentStore.updateRuntime(\n    host.documentWorkflowRuntime(targetContainerId),\n  );\n  if (requestSync) {\n    currentDocumentStore.requestSync();\n  }\n  return relinkedNote;\n}\n"]}

package/workflows/container-contents/documentMoveDeniedReplay.js

@@ -0,0 +1,20 @@
+// One replay per store/database generation: parked denied intents flip back to
+// pending ahead of its first scan (row 7). A restart loses the in-memory
+// access-restored edge, and replacing the executor or lifecycle can expose a
+// different durable queue. Running inside the scan keeps ordering trivially
+// correct: replayed intents are attempted by this same pass, not stranded until
+// an unrelated trigger. Marked complete only after the reset lands, so a
+// transient failure retries on the next pass.
+const deniedReplayGenerationByState = new WeakMap();
+export function deniedReplayMatchesGeneration(state, execSql) {
+    const completed = deniedReplayGenerationByState.get(state);
+    return (completed?.execSql === execSql &&
+        completed.lifecycleGeneration === state.lifecycleGeneration);
+}
+export function markDeniedReplayGeneration(state, execSql) {
+    deniedReplayGenerationByState.set(state, {
+        execSql,
+        lifecycleGeneration: state.lifecycleGeneration,
+    });
+}
+//# sourceMappingURL=documentMoveDeniedReplay.js.map

package/workflows/container-contents/documentMoveDeniedReplay.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentMoveDeniedReplay.js","sourceRoot":"","sources":["documentMoveDeniedReplay.ts"],"names":[],"mappings":"AAaA,+EAA+E;AAC/E,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,gFAAgF;AAChF,yEAAyE;AACzE,8CAA8C;AAC9C,MAAM,6BAA6B,GAAG,IAAI,OAAO,EAG9C,CAAC;AAEJ,MAAM,UAAU,6BAA6B,CAC3C,KAA4B,EAC5B,OAAgB;IAEhB,MAAM,SAAS,GAAG,6BAA6B,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3D,OAAO,CACL,SAAS,EAAE,OAAO,KAAK,OAAO;QAC9B,SAAS,CAAC,mBAAmB,KAAK,KAAK,CAAC,mBAAmB,CAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,KAA4B,EAC5B,OAAgB;IAEhB,6BAA6B,CAAC,GAAG,CAAC,KAAK,EAAE;QACvC,OAAO;QACP,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;KAC/C,CAAC,CAAC;AACL,CAAC","sourcesContent":["import type { ContainerContentsWorkflowRuntime } from \"./runtime\";\n\ntype ExecSql = ContainerContentsWorkflowRuntime[\"infra\"][\"execSql\"];\n\ninterface DeniedReplayLifecycle {\n  readonly lifecycleGeneration?: number | undefined;\n}\n\ninterface DeniedReplayGeneration {\n  execSql: ExecSql;\n  lifecycleGeneration: number | undefined;\n}\n\n// One replay per store/database generation: parked denied intents flip back to\n// pending ahead of its first scan (row 7). A restart loses the in-memory\n// access-restored edge, and replacing the executor or lifecycle can expose a\n// different durable queue. Running inside the scan keeps ordering trivially\n// correct: replayed intents are attempted by this same pass, not stranded until\n// an unrelated trigger. Marked complete only after the reset lands, so a\n// transient failure retries on the next pass.\nconst deniedReplayGenerationByState = new WeakMap<\n  DeniedReplayLifecycle,\n  DeniedReplayGeneration\n>();\n\nexport function deniedReplayMatchesGeneration(\n  state: DeniedReplayLifecycle,\n  execSql: ExecSql,\n): boolean {\n  const completed = deniedReplayGenerationByState.get(state);\n  return (\n    completed?.execSql === execSql &&\n    completed.lifecycleGeneration === state.lifecycleGeneration\n  );\n}\n\nexport function markDeniedReplayGeneration(\n  state: DeniedReplayLifecycle,\n  execSql: ExecSql,\n): void {\n  deniedReplayGenerationByState.set(state, {\n    execSql,\n    lifecycleGeneration: state.lifecycleGeneration,\n  });\n}\n"]}

package/workflows/container-contents/documentMoveFailure.js

@@ -0,0 +1,35 @@
+import { isVanishedContainerFailure } from "../../data/containers/shared/mutationFailures.js";
+export function createDocumentMoveFailureState() {
+    return {
+        current: null,
+        sawPermissionDenial: false,
+        sawVanishedContainer: false,
+    };
+}
+export function recordDocumentMoveFailure(state, failure) {
+    state.current = failure;
+    state.sawPermissionDenial =
+        state.sawPermissionDenial || failure.status === 403;
+    state.sawVanishedContainer =
+        state.sawVanishedContainer || isVanishedContainerFailure(failure);
+}
+/**
+ * The queue-facing description of a failed remote move. The stable prefixes
+ * are kept so existing consumers keep matching; the captured detail appends
+ * the HTTP status when one was seen, so a revoked permission (403) reads
+ * differently from an offline blip.
+ */
+export function describeRejectedDocumentMove(state) {
+    const prefix = state.sawVanishedContainer
+        ? "Remote document move cites a container deleted on the server"
+        : "Remote document move was rejected or unavailable";
+    const failure = state.current;
+    if (!failure) {
+        return prefix;
+    }
+    const detail = failure.status === null
+        ? failure.message
+        : `${failure.message} (${failure.status})`;
+    return `${prefix}: ${detail}`;
+}
+//# sourceMappingURL=documentMoveFailure.js.map

package/workflows/container-contents/documentMoveFailure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentMoveFailure.js","sourceRoot":"","sources":["documentMoveFailure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAsB3F,MAAM,UAAU,8BAA8B;IAC5C,OAAO;QACL,OAAO,EAAE,IAAI;QACb,mBAAmB,EAAE,KAAK;QAC1B,oBAAoB,EAAE,KAAK;KAC5B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAA+B,EAC/B,OAAuC;IAEvC,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,KAAK,CAAC,mBAAmB;QACvB,KAAK,CAAC,mBAAmB,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC;IACtD,KAAK,CAAC,oBAAoB;QACxB,KAAK,CAAC,oBAAoB,IAAI,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACtE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,KAA+B;IAE/B,MAAM,MAAM,GAAG,KAAK,CAAC,oBAAoB;QACvC,CAAC,CAAC,8DAA8D;QAChE,CAAC,CAAC,kDAAkD,CAAC;IACvD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,MAAM,GACV,OAAO,CAAC,MAAM,KAAK,IAAI;QACrB,CAAC,CAAC,OAAO,CAAC,OAAO;QACjB,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC;IAC/C,OAAO,GAAG,MAAM,KAAK,MAAM,EAAE,CAAC;AAChC,CAAC","sourcesContent":["import { isVanishedContainerFailure } from \"../../data/containers/shared/mutationFailures\";\nimport type { DocumentLinkSetMutationFailure } from \"../documents\";\n\n/**\n * What a queued document move learned from its remote link/unlink attempts.\n * Every failure handed to the move's `onFailure` folds into this state; the\n * verdict (`pending`, `blocked`, `denied`) is read off it afterwards.\n */\nexport interface DocumentMoveFailureState {\n  current: DocumentLinkSetMutationFailure | null;\n  /** A 403 anywhere in the pass parks the intent as denied (row 7). */\n  sawPermissionDenial: boolean;\n  /**\n   * The server proved a cited container no longer exists (coded projection\n   * 404 or coded commit 409 `container_unavailable`). Retrying the SAME\n   * request can never succeed — but the cited container may be a stale\n   * ancestor in a cached path, so the verdict triggers a projection refresh\n   * (documentMoveVanishedRefresh) before the intent parks terminally.\n   */\n  sawVanishedContainer: boolean;\n}\n\nexport function createDocumentMoveFailureState(): DocumentMoveFailureState {\n  return {\n    current: null,\n    sawPermissionDenial: false,\n    sawVanishedContainer: false,\n  };\n}\n\nexport function recordDocumentMoveFailure(\n  state: DocumentMoveFailureState,\n  failure: DocumentLinkSetMutationFailure,\n): void {\n  state.current = failure;\n  state.sawPermissionDenial =\n    state.sawPermissionDenial || failure.status === 403;\n  state.sawVanishedContainer =\n    state.sawVanishedContainer || isVanishedContainerFailure(failure);\n}\n\n/**\n * The queue-facing description of a failed remote move. The stable prefixes\n * are kept so existing consumers keep matching; the captured detail appends\n * the HTTP status when one was seen, so a revoked permission (403) reads\n * differently from an offline blip.\n */\nexport function describeRejectedDocumentMove(\n  state: DocumentMoveFailureState,\n): string {\n  const prefix = state.sawVanishedContainer\n    ? \"Remote document move cites a container deleted on the server\"\n    : \"Remote document move was rejected or unavailable\";\n  const failure = state.current;\n  if (!failure) {\n    return prefix;\n  }\n  const detail =\n    failure.status === null\n      ? failure.message\n      : `${failure.message} (${failure.status})`;\n  return `${prefix}: ${detail}`;\n}\n"]}

package/workflows/container-contents/documentMoveIntent.js

@@ -0,0 +1,77 @@
+import { DEFAULT_DOCUMENT_ACCESS_EPOCH } from "../../data/documents/documentConstants.js";
+import { uniqueSortedStrings } from "../../data/documents/shared/readers.js";
+import { sqlDocumentMoveIntentPersistence } from "../../data/persistence/container-contents/documentMoveIntentPersistence.js";
+import { sqlDocumentContainerProjectionPersistence } from "../../data/persistence/containers/documentContainerProjectionPersistence.js";
+import { defaultDocumentsPersistence } from "../documents/index.js";
+import { listDocumentLinkedContainerIds } from "./documentLinks.js";
+import { relinkContainerDocumentLocally } from "./documentLocalRelink.js";
+async function resolveOptimisticDocumentMoveLinks(input) {
+    if (input.replaceLinkedContainers) {
+        return [input.targetContainerId];
+    }
+    const currentLinkedContainerIds = await listDocumentLinkedContainerIds(input.runtime.infra.execSql, input.documentId);
+    const linkedContainerIds = currentLinkedContainerIds.length > 0
+        ? currentLinkedContainerIds
+        : input.currentContainerId
+            ? [input.currentContainerId]
+            : [];
+    return uniqueSortedStrings([
+        ...linkedContainerIds.filter((containerId) => containerId !== input.currentContainerId),
+        input.targetContainerId,
+    ]);
+}
+async function resolveLocalMoveAccessEpoch(input) {
+    const existingDocument = await defaultDocumentsPersistence.loadDocument(input.runtime.infra.execSql, input.localId);
+    // The local relink must keep the document's current key epoch. Falling back
+    // is only for partially seeded local state; downgrading synced documents
+    // would make offline edits use stale access material.
+    return existingDocument?.accessEpoch ?? DEFAULT_DOCUMENT_ACCESS_EPOCH;
+}
+export async function moveRemoteDocumentLinkLocally(params) {
+    const { currentDocumentStore, expandNode, host, note, replaceLinkedContainers, runtime, scheduleSync, setLinkedContainerIdsForDocument, targetContainerId, } = params;
+    const linkedContainerIds = await resolveOptimisticDocumentMoveLinks({
+        currentContainerId: note.containerId,
+        documentId: note.documentId,
+        replaceLinkedContainers,
+        runtime,
+        targetContainerId,
+    });
+    // Apply the user's chosen placement locally now, then replay the signed
+    // link-set mutation from this durable intent when auth/network/key context is
+    // back. This mirrors container move intents: UI state should not wait on the
+    // server, but the remote contract still converges through the normal writer
+    // projection path.
+    const intentId = crypto.randomUUID();
+    const movedNote = await relinkContainerDocumentLocally({
+        accessEpoch: await resolveLocalMoveAccessEpoch({
+            localId: note.id,
+            runtime,
+        }),
+        currentDocumentStore,
+        host,
+        note,
+        commitSideEffect: async (execSql) => {
+            await sqlDocumentMoveIntentPersistence.enqueueMoveIntent(execSql, {
+                id: intentId,
+                documentId: note.documentId,
+                localId: note.id,
+                replaceLinkedContainers,
+                sourceContainerId: note.containerId,
+                targetContainerId,
+            });
+            await sqlDocumentContainerProjectionPersistence.replaceDocumentLinks(execSql, note.documentId, linkedContainerIds, { moveIntentId: intentId });
+        },
+        requestSync: false,
+        runtime,
+        targetContainerId,
+    });
+    if (!movedNote) {
+        return { linksChanged: false, note: null };
+    }
+    setLinkedContainerIdsForDocument(note.documentId, linkedContainerIds);
+    expandNode(targetContainerId);
+    scheduleSync?.();
+    runtime.util.log(`Container contents: queued note ${movedNote.id} move to ${targetContainerId}`);
+    return { linksChanged: true, note: movedNote };
+}
+//# sourceMappingURL=documentMoveIntent.js.map

package/workflows/container-contents/documentMoveIntent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentMoveIntent.js","sourceRoot":"","sources":["documentMoveIntent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AAEvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,gCAAgC,EAAE,MAAM,yEAAyE,CAAC;AAC3H,OAAO,EAAE,yCAAyC,EAAE,MAAM,0EAA0E,CAAC;AACrI,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,8BAA8B,EAAE,MAAM,uBAAuB,CAAC;AAQvE,KAAK,UAAU,kCAAkC,CAAC,KAMjD;IACC,IAAI,KAAK,CAAC,uBAAuB,EAAE,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,yBAAyB,GAAG,MAAM,8BAA8B,CACpE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC3B,KAAK,CAAC,UAAU,CACjB,CAAC;IACF,MAAM,kBAAkB,GACtB,yBAAyB,CAAC,MAAM,GAAG,CAAC;QAClC,CAAC,CAAC,yBAAyB;QAC3B,CAAC,CAAC,KAAK,CAAC,kBAAkB;YACxB,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAC5B,CAAC,CAAC,EAAE,CAAC;IAEX,OAAO,mBAAmB,CAAC;QACzB,GAAG,kBAAkB,CAAC,MAAM,CAC1B,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,KAAK,KAAK,CAAC,kBAAkB,CAC1D;QACD,KAAK,CAAC,iBAAiB;KACxB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,KAG1C;IACC,MAAM,gBAAgB,GAAG,MAAM,2BAA2B,CAAC,YAAY,CACrE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC3B,KAAK,CAAC,OAAO,CACd,CAAC;IACF,4EAA4E;IAC5E,yEAAyE;IACzE,sDAAsD;IACtD,OAAO,gBAAgB,EAAE,WAAW,IAAI,6BAA6B,CAAC;AACxE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAW,MAU7D;IACC,MAAM,EACJ,oBAAoB,EACpB,UAAU,EACV,IAAI,EACJ,IAAI,EACJ,uBAAuB,EACvB,OAAO,EACP,YAAY,EACZ,gCAAgC,EAChC,iBAAiB,GAClB,GAAG,MAAM,CAAC;IACX,MAAM,kBAAkB,GAAG,MAAM,kCAAkC,CAAC;QAClE,kBAAkB,EAAE,IAAI,CAAC,WAAW;QACpC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,uBAAuB;QACvB,OAAO;QACP,iBAAiB;KAClB,CAAC,CAAC;IAEH,wEAAwE;IACxE,8EAA8E;IAC9E,6EAA6E;IAC7E,4EAA4E;IAC5E,mBAAmB;IACnB,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAErC,MAAM,SAAS,GAAG,MAAM,8BAA8B,CAAC;QACrD,WAAW,EAAE,MAAM,2BAA2B,CAAC;YAC7C,OAAO,EAAE,IAAI,CAAC,EAAE;YAChB,OAAO;SACR,CAAC;QACF,oBAAoB;QACpB,IAAI;QACJ,IAAI;QACJ,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAClC,MAAM,gCAAgC,CAAC,iBAAiB,CAAC,OAAO,EAAE;gBAChE,EAAE,EAAE,QAAQ;gBACZ,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,uBAAuB;gBACvB,iBAAiB,EAAE,IAAI,CAAC,WAAW;gBACnC,iBAAiB;aAClB,CAAC,CAAC;YACH,MAAM,yCAAyC,CAAC,oBAAoB,CAClE,OAAO,EACP,IAAI,CAAC,UAAU,EACf,kBAAkB,EAClB,EAAE,YAAY,EAAE,QAAQ,EAAE,CAC3B,CAAC;QACJ,CAAC;QACD,WAAW,EAAE,KAAK;QAClB,OAAO;QACP,iBAAiB;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC7C,CAAC;IAED,gCAAgC,CAAC,IAAI,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;IACtE,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC9B,YAAY,EAAE,EAAE,CAAC;IACjB,OAAO,CAAC,IAAI,CAAC,GAAG,CACd,mCAAmC,SAAS,CAAC,EAAE,YAAY,iBAAiB,EAAE,CAC/E,CAAC;IACF,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACjD,CAAC","sourcesContent":["import { DEFAULT_DOCUMENT_ACCESS_EPOCH } from \"../../data/documents/documentConstants\";\nimport type { DocumentSummary } from \"../../data/documents/documentSummary\";\nimport { uniqueSortedStrings } from \"../../data/documents/shared/readers\";\nimport { sqlDocumentMoveIntentPersistence } from \"../../data/persistence/container-contents/documentMoveIntentPersistence\";\nimport { sqlDocumentContainerProjectionPersistence } from \"../../data/persistence/containers/documentContainerProjectionPersistence\";\nimport { defaultDocumentsPersistence } from \"../documents\";\nimport { listDocumentLinkedContainerIds } from \"./documentLinks\";\nimport { relinkContainerDocumentLocally } from \"./documentLocalRelink\";\nimport type {\n  DocumentStructuralMutationHost,\n  DocumentStructuralMutationLocalStore,\n  DocumentStructuralMutationRuntime,\n  SetLinkedContainerIdsForDocument,\n} from \"./documentStructureTypes\";\n\nasync function resolveOptimisticDocumentMoveLinks(input: {\n  currentContainerId: string | null;\n  documentId: string;\n  replaceLinkedContainers?: boolean | undefined;\n  runtime: DocumentStructuralMutationRuntime;\n  targetContainerId: string;\n}): Promise<string[]> {\n  if (input.replaceLinkedContainers) {\n    return [input.targetContainerId];\n  }\n\n  const currentLinkedContainerIds = await listDocumentLinkedContainerIds(\n    input.runtime.infra.execSql,\n    input.documentId,\n  );\n  const linkedContainerIds =\n    currentLinkedContainerIds.length > 0\n      ? currentLinkedContainerIds\n      : input.currentContainerId\n        ? [input.currentContainerId]\n        : [];\n\n  return uniqueSortedStrings([\n    ...linkedContainerIds.filter(\n      (containerId) => containerId !== input.currentContainerId,\n    ),\n    input.targetContainerId,\n  ]);\n}\n\nasync function resolveLocalMoveAccessEpoch(input: {\n  localId: string;\n  runtime: DocumentStructuralMutationRuntime;\n}): Promise<number> {\n  const existingDocument = await defaultDocumentsPersistence.loadDocument(\n    input.runtime.infra.execSql,\n    input.localId,\n  );\n  // The local relink must keep the document's current key epoch. Falling back\n  // is only for partially seeded local state; downgrading synced documents\n  // would make offline edits use stale access material.\n  return existingDocument?.accessEpoch ?? DEFAULT_DOCUMENT_ACCESS_EPOCH;\n}\n\nexport async function moveRemoteDocumentLinkLocally<TRuntime>(params: {\n  currentDocumentStore: DocumentStructuralMutationLocalStore<TRuntime>;\n  expandNode: (nodeId: string) => void;\n  host: DocumentStructuralMutationHost<TRuntime>;\n  note: DocumentSummary & { documentId: string };\n  replaceLinkedContainers?: boolean | undefined;\n  runtime: DocumentStructuralMutationRuntime;\n  scheduleSync?: (() => void) | undefined;\n  setLinkedContainerIdsForDocument: SetLinkedContainerIdsForDocument;\n  targetContainerId: string;\n}): Promise<{ linksChanged: boolean; note: DocumentSummary | null }> {\n  const {\n    currentDocumentStore,\n    expandNode,\n    host,\n    note,\n    replaceLinkedContainers,\n    runtime,\n    scheduleSync,\n    setLinkedContainerIdsForDocument,\n    targetContainerId,\n  } = params;\n  const linkedContainerIds = await resolveOptimisticDocumentMoveLinks({\n    currentContainerId: note.containerId,\n    documentId: note.documentId,\n    replaceLinkedContainers,\n    runtime,\n    targetContainerId,\n  });\n\n  // Apply the user's chosen placement locally now, then replay the signed\n  // link-set mutation from this durable intent when auth/network/key context is\n  // back. This mirrors container move intents: UI state should not wait on the\n  // server, but the remote contract still converges through the normal writer\n  // projection path.\n  const intentId = crypto.randomUUID();\n\n  const movedNote = await relinkContainerDocumentLocally({\n    accessEpoch: await resolveLocalMoveAccessEpoch({\n      localId: note.id,\n      runtime,\n    }),\n    currentDocumentStore,\n    host,\n    note,\n    commitSideEffect: async (execSql) => {\n      await sqlDocumentMoveIntentPersistence.enqueueMoveIntent(execSql, {\n        id: intentId,\n        documentId: note.documentId,\n        localId: note.id,\n        replaceLinkedContainers,\n        sourceContainerId: note.containerId,\n        targetContainerId,\n      });\n      await sqlDocumentContainerProjectionPersistence.replaceDocumentLinks(\n        execSql,\n        note.documentId,\n        linkedContainerIds,\n        { moveIntentId: intentId },\n      );\n    },\n    requestSync: false,\n    runtime,\n    targetContainerId,\n  });\n  if (!movedNote) {\n    return { linksChanged: false, note: null };\n  }\n\n  setLinkedContainerIdsForDocument(note.documentId, linkedContainerIds);\n  expandNode(targetContainerId);\n  scheduleSync?.();\n  runtime.util.log(\n    `Container contents: queued note ${movedNote.id} move to ${targetContainerId}`,\n  );\n  return { linksChanged: true, note: movedNote };\n}\n"]}

package/workflows/container-contents/documentMoveIntentErrors.js

@@ -0,0 +1,17 @@
+import { sqlDocumentMoveIntentPersistence } from "../../data/persistence/container-contents/documentMoveIntentPersistence.js";
+export async function recordPendingDocumentMoveIntentError(input) {
+    if (!input.isCurrent())
+        return false;
+    await sqlDocumentMoveIntentPersistence.recordMoveIntentError(input.state.runtime.infra.execSql, {
+        blocked: input.blocked,
+        denied: input.denied,
+        documentId: input.documentId,
+        expectedIntentId: input.expectedIntentId,
+        expectedUpdatedAt: input.expectedUpdatedAt,
+        message: input.message,
+        stillCurrent: input.isCurrent,
+        unavailable: input.unavailable,
+    });
+    return input.isCurrent();
+}
+//# sourceMappingURL=documentMoveIntentErrors.js.map

package/workflows/container-contents/documentMoveIntentErrors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentMoveIntentErrors.js","sourceRoot":"","sources":["documentMoveIntentErrors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,yEAAyE,CAAC;AAG3H,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAU1D;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,gCAAgC,CAAC,qBAAqB,CAC1D,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EACjC;QACE,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,YAAY,EAAE,KAAK,CAAC,SAAS;QAC7B,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CACF,CAAC;IACF,OAAO,KAAK,CAAC,SAAS,EAAE,CAAC;AAC3B,CAAC","sourcesContent":["import { sqlDocumentMoveIntentPersistence } from \"../../data/persistence/container-contents/documentMoveIntentPersistence\";\nimport type { ContainerContentsWorkflowRuntime } from \"./runtime\";\n\nexport async function recordPendingDocumentMoveIntentError(input: {\n  blocked?: boolean | undefined;\n  denied?: boolean | undefined;\n  documentId: string;\n  expectedIntentId?: string | undefined;\n  expectedUpdatedAt?: string | undefined;\n  isCurrent: () => boolean;\n  message: string;\n  state: { runtime: ContainerContentsWorkflowRuntime };\n  unavailable?: boolean | undefined;\n}): Promise<boolean> {\n  if (!input.isCurrent()) return false;\n  await sqlDocumentMoveIntentPersistence.recordMoveIntentError(\n    input.state.runtime.infra.execSql,\n    {\n      blocked: input.blocked,\n      denied: input.denied,\n      documentId: input.documentId,\n      expectedIntentId: input.expectedIntentId,\n      expectedUpdatedAt: input.expectedUpdatedAt,\n      message: input.message,\n      stillCurrent: input.isCurrent,\n      unavailable: input.unavailable,\n    },\n  );\n  return input.isCurrent();\n}\n"]}

package/workflows/container-contents/documentMoveIntentSettlement.js

@@ -0,0 +1,25 @@
+import { sqlDocumentMoveIntentPersistence, } from "../../data/persistence/container-contents/documentMoveIntentPersistence.js";
+import { sqlDocumentContainerProjectionPersistence } from "../../data/persistence/containers/documentContainerProjectionPersistence.js";
+import { loadDocumentMovePlacement } from "../../data/persistence/containers/documentPlacement.js";
+import { getClientSQLitePersistenceRuntime } from "../../data/sqlite/sqlitePersistenceRuntime.js";
+export async function settleDocumentMoveIntent(input) {
+    if (!input.isCurrent()) {
+        throw new Error("Document move generation changed before local settlement");
+    }
+    if (input.partial) {
+        const intent = await loadDocumentMovePlacement(getClientSQLitePersistenceRuntime(input.execSql).db, input.intent.documentId);
+        if (intent?.id !== input.intent.id)
+            throw new Error("Document move intent was superseded before local settlement");
+        return;
+    }
+    const settled = await sqlDocumentMoveIntentPersistence.markMoveIntentSynced(input.execSql, {
+        documentId: input.intent.documentId,
+        expectedIntentId: input.intent.id,
+        expectedUpdatedAt: input.intent.updatedAt,
+    });
+    if (!settled || !input.isCurrent()) {
+        throw new Error("Document move intent was superseded before local settlement");
+    }
+    await sqlDocumentContainerProjectionPersistence.replaceDocumentLinks(input.execSql, input.intent.documentId, input.linkedContainerIds);
+}
+//# sourceMappingURL=documentMoveIntentSettlement.js.map

package/workflows/container-contents/documentMoveIntentSettlement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentMoveIntentSettlement.js","sourceRoot":"","sources":["documentMoveIntentSettlement.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,gCAAgC,GACjC,MAAM,yEAAyE,CAAC;AACjF,OAAO,EAAE,yCAAyC,EAAE,MAAM,0EAA0E,CAAC;AACrI,OAAO,EAAE,yBAAyB,EAAE,MAAM,qDAAqD,CAAC;AAChG,OAAO,EAAE,iCAAiC,EAAE,MAAM,4CAA4C,CAAC;AAG/F,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAM9C;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C,iCAAiC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EACnD,KAAK,CAAC,MAAM,CAAC,UAAU,CACxB,CAAC;QACF,IAAI,MAAM,EAAE,EAAE,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE;YAChC,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;QACJ,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,gCAAgC,CAAC,oBAAoB,CACzE,KAAK,CAAC,OAAO,EACb;QACE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;QACnC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;QACjC,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;KAC1C,CACF,CAAC;IACF,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,yCAAyC,CAAC,oBAAoB,CAClE,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,MAAM,CAAC,UAAU,EACvB,KAAK,CAAC,kBAAkB,CACzB,CAAC;AACJ,CAAC","sourcesContent":["import {\n  type DocumentMoveIntentRecord,\n  sqlDocumentMoveIntentPersistence,\n} from \"../../data/persistence/container-contents/documentMoveIntentPersistence\";\nimport { sqlDocumentContainerProjectionPersistence } from \"../../data/persistence/containers/documentContainerProjectionPersistence\";\nimport { loadDocumentMovePlacement } from \"../../data/persistence/containers/documentPlacement\";\nimport { getClientSQLitePersistenceRuntime } from \"../../data/sqlite/sqlitePersistenceRuntime\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\n\nexport async function settleDocumentMoveIntent(input: {\n  execSql: ExecSql;\n  intent: DocumentMoveIntentRecord;\n  isCurrent: () => boolean;\n  linkedContainerIds: readonly string[];\n  partial: boolean;\n}): Promise<void> {\n  if (!input.isCurrent()) {\n    throw new Error(\"Document move generation changed before local settlement\");\n  }\n  if (input.partial) {\n    const intent = await loadDocumentMovePlacement(\n      getClientSQLitePersistenceRuntime(input.execSql).db,\n      input.intent.documentId,\n    );\n    if (intent?.id !== input.intent.id)\n      throw new Error(\n        \"Document move intent was superseded before local settlement\",\n      );\n    return;\n  }\n  const settled = await sqlDocumentMoveIntentPersistence.markMoveIntentSynced(\n    input.execSql,\n    {\n      documentId: input.intent.documentId,\n      expectedIntentId: input.intent.id,\n      expectedUpdatedAt: input.intent.updatedAt,\n    },\n  );\n  if (!settled || !input.isCurrent()) {\n    throw new Error(\n      \"Document move intent was superseded before local settlement\",\n    );\n  }\n  await sqlDocumentContainerProjectionPersistence.replaceDocumentLinks(\n    input.execSql,\n    input.intent.documentId,\n    input.linkedContainerIds,\n  );\n}\n"]}