@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/container-contents/documentMove/documentMoveIntentSync.js

@@ -0,0 +1,346 @@
+import { reportAndRethrowKeyingVerificationError } from "../../../data/keyingProjectionVerification/error.js";
+import { DOCUMENT_LINK_INTENT_TYPE, sqlDocumentMoveIntentPersistence, } from "../../../data/persistence/container-contents/documentMoveIntentPersistence.js";
+import { errorMessage } from "../../../data/shared/errorMessage.js";
+import { defaultDocumentsPersistence, } from "../../documents/index.js";
+import { moveRemoteContainerDocument } from "../documentLinks/index.js";
+import { availableDocumentLinkIntent } from "../documentLinks/availableDocumentLinkIntent.js";
+import { hasRemoteContainerMetadataState } from "../remoteHydration/reconciliation.js";
+import { deniedReplayMatchesGeneration, markDeniedReplayGeneration, } from "./documentMoveDeniedReplay.js";
+import { describeRejectedDocumentMove, } from "./documentMoveFailure.js";
+import { recordPendingDocumentMoveIntentError } from "./documentMoveIntentErrors.js";
+import { settleDocumentMoveIntent } from "./documentMoveIntentSettlement.js";
+import { moveWithVanishedContainerRefresh } from "./documentMoveVanishedRefresh.js";
+async function relinkMovedDocumentStore(input) {
+    if (!input.isCurrent())
+        return false;
+    const documentStore = input.host.openDocumentStore({
+        containerId: input.targetContainerId,
+        documentId: input.intent.documentId,
+        localId: input.intent.localId,
+    });
+    if (!(await documentStore.ensureInitialized()) || !input.isCurrent()) {
+        return false;
+    }
+    const relinked = await documentStore.relink({
+        ...input.relinkInput,
+        stillCurrent: input.isCurrent,
+    });
+    if (!relinked || !input.isCurrent()) {
+        return false;
+    }
+    documentStore.updateRuntime(input.host.documentWorkflowRuntime(input.targetContainerId));
+    return input.isCurrent();
+}
+async function persistMovedDocumentReplay(input) {
+    const { host, intent, moved, state } = input;
+    const existingDocument = await defaultDocumentsPersistence.loadDocument(state.runtime.infra.execSql, intent.localId);
+    if (!input.isCurrent() || !existingDocument) {
+        return false;
+    }
+    const targetContainerId = intent.intentType === DOCUMENT_LINK_INTENT_TYPE &&
+        existingDocument.containerId &&
+        moved.linkedContainerIds.includes(existingDocument.containerId)
+        ? existingDocument.containerId
+        : moved.nextContainerId;
+    const relinkInput = {
+        accessEpoch: moved.accessEpoch ?? existingDocument.accessEpoch,
+        ...(moved.accessStateHash === null
+            ? {}
+            : { accessStateHash: moved.accessStateHash }),
+        containerId: targetContainerId,
+        documentId: intent.documentId,
+        localId: intent.localId,
+        ...(moved.remoteState ?? {}),
+        commitSideEffect: (transactionExecSql) => settleDocumentMoveIntent({
+            execSql: transactionExecSql,
+            intent,
+            isCurrent: input.isCurrent,
+            linkedContainerIds: moved.linkedContainerIds,
+            partial: moved.status === "partial",
+        }),
+    };
+    return relinkMovedDocumentStore({
+        host,
+        isCurrent: input.isCurrent,
+        intent,
+        relinkInput,
+        targetContainerId,
+    });
+}
+async function assertMoveIntentRotationPreflight(input) {
+    if (!input.isCurrent())
+        return null;
+    const preflightStore = input.host.openDocumentStore({
+        // The optimistic move already changed local placement. Use that scope so
+        // opening the destination view cannot invalidate this shared store's proof.
+        // Remote link-set authorization still uses the intent's source below.
+        containerId: input.existingContainerId ?? input.intent.targetContainerId,
+        documentId: input.intent.documentId,
+        localId: input.intent.localId,
+    });
+    if (!(await preflightStore.ensureInitialized())) {
+        throw new Error("Document rotation preflight could not load the document");
+    }
+    if (!input.isCurrent())
+        return null;
+    const rotationSnapshot = await preflightStore.assertCanRotateContentKey();
+    return input.isCurrent() ? rotationSnapshot : null;
+}
+async function movePendingDocumentIntent(input) {
+    // Adding links keeps the content key and needs no full-history rotation proof.
+    const linkOnly = input.intent.intentType === DOCUMENT_LINK_INTENT_TYPE;
+    const rotationSnapshot = linkOnly && !input.intent.removedLinkContainerIds?.length
+        ? new Uint8Array()
+        : await assertMoveIntentRotationPreflight(input);
+    if (!rotationSnapshot || !input.isCurrent())
+        return "abandoned";
+    return moveRemoteContainerDocument({
+        linkOnly,
+        additionalLinkContainerIds: input.intent.additionalLinkContainerIds,
+        removedLinkContainerIds: input.intent.removedLinkContainerIds,
+        currentContainerId: input.intent.sourceContainerId ??
+            input.existingContainerId ??
+            input.intent.targetContainerId,
+        documentId: input.intent.documentId,
+        isCurrent: input.isCurrent,
+        noteId: input.intent.localId,
+        onFailure: input.onFailure,
+        replaceLinkedContainers: input.intent.replaceLinkedContainers,
+        resolveProjectionUserKey: input.state.resolveProjectionUserKey,
+        rotationSnapshot,
+        runtime: input.state.runtime,
+        targetContainerId: input.intent.targetContainerId,
+    });
+}
+async function resolveMoveIntentPreflight(input) {
+    const { intent, state } = input;
+    const execSql = state.runtime.infra.execSql;
+    const existingDocument = await defaultDocumentsPersistence.loadDocument(execSql, intent.localId);
+    if (!input.isCurrent())
+        return { result: "abandoned" };
+    if (!existingDocument || existingDocument.documentId !== intent.documentId) {
+        await recordPendingDocumentMoveIntentError({
+            blocked: true,
+            documentId: intent.documentId,
+            expectedIntentId: intent.id,
+            expectedUpdatedAt: intent.updatedAt,
+            isCurrent: input.isCurrent,
+            message: "Document move intent references a missing local document",
+            state,
+        });
+        return { result: "blocked" };
+    }
+    for (const targetId of new Set([
+        intent.targetContainerId,
+        ...(intent.additionalLinkContainerIds ?? []),
+    ])) {
+        const targetState = state.containersById.get(targetId);
+        if (!targetState) {
+            await recordPendingDocumentMoveIntentError({
+                blocked: true,
+                documentId: intent.documentId,
+                expectedIntentId: intent.id,
+                expectedUpdatedAt: intent.updatedAt,
+                isCurrent: input.isCurrent,
+                message: "Document move intent references a missing destination container",
+                state,
+            });
+            return { result: "blocked" };
+        }
+        if (input.isRemoteSyncBlocked(targetState.container.organizationId)) {
+            return { result: "blocked" };
+        }
+        if (!hasRemoteContainerMetadataState(targetState) ||
+            input.isCreatePending(targetId)) {
+            await recordPendingDocumentMoveIntentError({
+                documentId: intent.documentId,
+                expectedIntentId: intent.id,
+                expectedUpdatedAt: intent.updatedAt,
+                isCurrent: input.isCurrent,
+                message: "Document move destination container is not synced yet",
+                state,
+            });
+            return { result: "failed" };
+        }
+    }
+    return { existingDocument };
+}
+async function recordRejectedDocumentMove(input) {
+    await recordPendingDocumentMoveIntentError({
+        // A permission denial parks the intent for the access-restored signal
+        // instead of replaying on every structural pass (row 7).
+        denied: input.failure.sawPermissionDenial,
+        documentId: input.intent.documentId,
+        expectedIntentId: input.intent.id,
+        expectedUpdatedAt: input.intent.updatedAt,
+        isCurrent: input.isCurrent,
+        message: describeRejectedDocumentMove(input.failure),
+        state: input.state,
+        // Terminal only after the vanished-container refresh proved the
+        // destination itself gone: the intent can never commit as written and
+        // nothing on this device can heal it, so it leaves the replay set instead
+        // of re-issuing doomed requests every pass. The tombstone cascade
+        // retargets it once hydration tears the deleted container down locally.
+        // Every other vanished verdict stays pending for the next pass.
+        unavailable: input.unavailable,
+    });
+}
+function logSyncedDocumentMove(intent, state) {
+    state.runtime.util.log(`Container contents: synced queued document move ${intent.documentId}`);
+}
+async function settleMovedDocumentIntent(input) {
+    const { intent, moved, state } = input;
+    if (!(await persistMovedDocumentReplay({
+        host: input.host,
+        intent,
+        isCurrent: input.isCurrent,
+        moved,
+        state,
+    }))) {
+        if (!input.isCurrent())
+            return "abandoned";
+        await recordPendingDocumentMoveIntentError({
+            documentId: intent.documentId,
+            expectedIntentId: intent.id,
+            expectedUpdatedAt: intent.updatedAt,
+            isCurrent: input.isCurrent,
+            message: "Document move replay could not relink the local document",
+            state,
+        });
+        return "failed";
+    }
+    if (moved.status === "partial") {
+        await recordPendingDocumentMoveIntentError({
+            // An unlink refused for permissions parks like any other denied
+            // move (row 7); other partials keep row 15's replay.
+            denied: input.failure.sawPermissionDenial,
+            documentId: intent.documentId,
+            expectedIntentId: intent.id,
+            expectedUpdatedAt: intent.updatedAt,
+            isCurrent: input.isCurrent,
+            message: "Remote document move partially applied; retry required",
+            state,
+            // Terminal only when the refresh proved the destination itself gone
+            // after the link had already landed; a vanished unlink alone stays
+            // pending with its live link for the next pass to revoke.
+            unavailable: input.unavailable,
+        });
+        return "partial";
+    }
+    logSyncedDocumentMove(intent, state);
+    return "moved";
+}
+async function trySyncPendingDocumentMoveIntent(input) {
+    const { host, intent, state } = input;
+    const available = availableDocumentLinkIntent(intent, (id) => state.containersById.has(id));
+    const preflight = await resolveMoveIntentPreflight({
+        ...input,
+        intent: available.intent,
+    });
+    if (preflight.result !== undefined) {
+        return preflight.result;
+    }
+    const { existingDocument } = preflight;
+    try {
+        const outcome = await moveWithVanishedContainerRefresh({
+            apiClient: state.runtime.apiClient,
+            attempt: (onFailure) => movePendingDocumentIntent({
+                existingContainerId: existingDocument.containerId,
+                host,
+                isCurrent: input.isCurrent,
+                intent: available.intent,
+                onFailure,
+                state,
+            }),
+            execSql: state.runtime.infra.execSql,
+            existingContainerId: existingDocument.containerId,
+            intent: available.intent,
+            isCurrent: input.isCurrent,
+        });
+        if (outcome === "abandoned" || !input.isCurrent())
+            return "abandoned";
+        if (!outcome.moved) {
+            await recordRejectedDocumentMove({
+                failure: outcome.failure,
+                intent,
+                isCurrent: input.isCurrent,
+                state,
+                unavailable: outcome.unavailable,
+            });
+            return "failed";
+        }
+        return await settleMovedDocumentIntent({
+            failure: outcome.failure,
+            host,
+            intent,
+            isCurrent: input.isCurrent,
+            moved: available.deferred
+                ? { ...outcome.moved, status: "partial" }
+                : outcome.moved,
+            state,
+            unavailable: outcome.unavailable,
+        });
+    }
+    catch (error) {
+        if (!input.isCurrent())
+            return "abandoned";
+        await reportAndRethrowKeyingVerificationError(error, state.runtime.util.reportSecurityIncident, {
+            objectId: intent.documentId,
+            objectKind: "document",
+            operation: "document.move.replay",
+        });
+        if (!input.isCurrent())
+            return "abandoned";
+        const message = errorMessage(error);
+        await recordPendingDocumentMoveIntentError({
+            documentId: intent.documentId,
+            expectedIntentId: intent.id,
+            expectedUpdatedAt: intent.updatedAt,
+            isCurrent: input.isCurrent,
+            message: `Failed to sync document move: ${message}`,
+            state,
+        });
+        return "failed";
+    }
+}
+export async function syncPendingDocumentMoveIntents(input) {
+    if (!input.isCurrent())
+        return 0;
+    const lifecycleState = input.state;
+    const state = { ...lifecycleState };
+    const execSql = state.runtime.infra.execSql;
+    if (!deniedReplayMatchesGeneration(lifecycleState, execSql)) {
+        await sqlDocumentMoveIntentPersistence.resetDeniedMoveIntents(execSql);
+        if (!input.isCurrent())
+            return 0;
+        markDeniedReplayGeneration(lifecycleState, execSql);
+    }
+    const pendingIntents = await sqlDocumentMoveIntentPersistence.listPendingMoveIntents(execSql);
+    if (!input.isCurrent())
+        return 0;
+    let movedCount = 0;
+    for (const intent of pendingIntents) {
+        if (!input.isCurrent())
+            return movedCount;
+        const result = await trySyncPendingDocumentMoveIntent({
+            host: input.host,
+            isCreatePending: input.isCreatePending,
+            isCurrent: input.isCurrent,
+            isRemoteSyncBlocked: input.isRemoteSyncBlocked,
+            intent,
+            state,
+        });
+        if (result === "abandoned")
+            return movedCount;
+        // A "partial" result (link applied, unlink still pending) must not count:
+        // the caller re-arms this same structural lane whenever the count is
+        // positive, so a deterministically failing unlink hot-looped the pump
+        // (issue #1744). The intent row stays pending; event-driven, manual, and
+        // startup lane requests retry it.
+        if (result === "moved") {
+            movedCount += 1;
+        }
+    }
+    return movedCount;
+}
+//# sourceMappingURL=documentMoveIntentSync.js.map

package/workflows/container-contents/documentMove/documentMoveIntentSync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentMoveIntentSync.js","sourceRoot":"","sources":["documentMoveIntentSync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,kDAAkD,CAAC;AAC3G,OAAO,EACL,yBAAyB,EAEzB,gCAAgC,GACjC,MAAM,4EAA4E,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAGL,2BAA2B,GAC5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,2BAA2B,EAAE,MAAM,8CAA8C,CAAC;AAO3F,OAAO,EAAE,+BAA+B,EAAE,MAAM,mCAAmC,CAAC;AAEpF,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAEL,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AAyBjF,KAAK,UAAU,wBAAwB,CAAW,KAMjD;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC;QACjD,WAAW,EAAE,KAAK,CAAC,iBAAiB;QACpC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;QACnC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;QACrE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC;QAC1C,GAAG,KAAK,CAAC,WAAW;QACpB,YAAY,EAAE,KAAK,CAAC,SAAS;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,aAAa,CAAC,aAAa,CACzB,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAC5D,CAAC;IACF,OAAO,KAAK,CAAC,SAAS,EAAE,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAW,KAMnD;IACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC7C,MAAM,gBAAgB,GAAG,MAAM,2BAA2B,CAAC,YAAY,CACrE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC3B,MAAM,CAAC,OAAO,CACf,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,iBAAiB,GACrB,MAAM,CAAC,UAAU,KAAK,yBAAyB;QAC/C,gBAAgB,CAAC,WAAW;QAC5B,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,WAAW,CAAC;QAC7D,CAAC,CAAC,gBAAgB,CAAC,WAAW;QAC9B,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAE5B,MAAM,WAAW,GAA0C;QACzD,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,gBAAgB,CAAC,WAAW;QAC9D,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,IAAI;YAChC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;QAC/C,WAAW,EAAE,iBAAiB;QAC9B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;QAC5B,gBAAgB,EAAE,CAAC,kBAAkB,EAAE,EAAE,CACvC,wBAAwB,CAAC;YACvB,OAAO,EAAE,kBAAkB;YAC3B,MAAM;YACN,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,OAAO,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS;SACpC,CAAC;KACL,CAAC;IAEF,OAAO,wBAAwB,CAAC;QAC9B,IAAI;QACJ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM;QACN,WAAW;QACX,iBAAiB;KAClB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iCAAiC,CAAW,KAK1D;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAClD,yEAAyE;QACzE,4EAA4E;QAC5E,sEAAsE;QACtE,WAAW,EAAE,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,MAAM,CAAC,iBAAiB;QACxE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;QACnC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,yBAAyB,EAAE,CAAC;IAC1E,OAAO,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAW,KAOlD;IACC,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,KAAK,yBAAyB,CAAC;IACvE,MAAM,gBAAgB,GACpB,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM;QACvD,CAAC,CAAC,IAAI,UAAU,EAAE;QAClB,CAAC,CAAC,MAAM,iCAAiC,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,WAAoB,CAAC;IACzE,OAAO,2BAA2B,CAAC;QACjC,QAAQ;QACR,0BAA0B,EAAE,KAAK,CAAC,MAAM,CAAC,0BAA0B;QACnE,uBAAuB,EAAE,KAAK,CAAC,MAAM,CAAC,uBAAuB;QAC7D,kBAAkB,EAChB,KAAK,CAAC,MAAM,CAAC,iBAAiB;YAC9B,KAAK,CAAC,mBAAmB;YACzB,KAAK,CAAC,MAAM,CAAC,iBAAiB;QAChC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;QACnC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,uBAAuB,EAAE,KAAK,CAAC,MAAM,CAAC,uBAAuB;QAC7D,wBAAwB,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB;QAC9D,gBAAgB;QAChB,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;QAC5B,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,iBAAiB;KAClD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAMzC;IAIC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5C,MAAM,gBAAgB,GAAG,MAAM,2BAA2B,CAAC,YAAY,CACrE,OAAO,EACP,MAAM,CAAC,OAAO,CACf,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACvD,IAAI,CAAC,gBAAgB,IAAI,gBAAgB,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;QAC3E,MAAM,oCAAoC,CAAC;YACzC,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,gBAAgB,EAAE,MAAM,CAAC,EAAE;YAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;YACnC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,0DAA0D;YACnE,KAAK;SACN,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,IAAI,GAAG,CAAC;QAC7B,MAAM,CAAC,iBAAiB;QACxB,GAAG,CAAC,MAAM,CAAC,0BAA0B,IAAI,EAAE,CAAC;KAC7C,CAAC,EAAE,CAAC;QACH,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,oCAAoC,CAAC;gBACzC,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,gBAAgB,EAAE,MAAM,CAAC,EAAE;gBAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;gBACnC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EACL,iEAAiE;gBACnE,KAAK;aACN,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,KAAK,CAAC,mBAAmB,CAAC,WAAW,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC;YACpE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;QACD,IACE,CAAC,+BAA+B,CAAC,WAAW,CAAC;YAC7C,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,EAC/B,CAAC;YACD,MAAM,oCAAoC,CAAC;gBACzC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,gBAAgB,EAAE,MAAM,CAAC,EAAE;gBAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;gBACnC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,uDAAuD;gBAChE,KAAK;aACN,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAMzC;IACC,MAAM,oCAAoC,CAAC;QACzC,sEAAsE;QACtE,yDAAyD;QACzD,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB;QACzC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;QACnC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;QACjC,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;QACzC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC;QACpD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,gEAAgE;QAChE,sEAAsE;QACtE,0EAA0E;QAC1E,kEAAkE;QAClE,wEAAwE;QACxE,gEAAgE;QAChE,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAAgC,EAChC,KAAkC;IAElC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,mDAAmD,MAAM,CAAC,UAAU,EAAE,CACvE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAW,KAQlD;IACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACvC,IACE,CAAC,CAAC,MAAM,0BAA0B,CAAC;QACjC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM;QACN,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK;QACL,KAAK;KACN,CAAC,CAAC,EACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;YAAE,OAAO,WAAW,CAAC;QAC3C,MAAM,oCAAoC,CAAC;YACzC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,gBAAgB,EAAE,MAAM,CAAC,EAAE;YAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;YACnC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,0DAA0D;YACnE,KAAK;SACN,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,oCAAoC,CAAC;YACzC,gEAAgE;YAChE,qDAAqD;YACrD,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB;YACzC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,gBAAgB,EAAE,MAAM,CAAC,EAAE;YAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;YACnC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,wDAAwD;YACjE,KAAK;YACL,oEAAoE;YACpE,mEAAmE;YACnE,0DAA0D;YAC1D,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAW,KAOzD;IACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACtC,MAAM,SAAS,GAAG,2BAA2B,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAC3D,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAC7B,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC;QACjD,GAAG,KAAK;QACR,MAAM,EAAE,SAAS,CAAC,MAAM;KACzB,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC,MAAM,CAAC;IAC1B,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,GAAG,SAAS,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,gCAAgC,CAAC;YACrD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CACrB,yBAAyB,CAAC;gBACxB,mBAAmB,EAAE,gBAAgB,CAAC,WAAW;gBACjD,IAAI;gBACJ,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,SAAS;gBACT,KAAK;aACN,CAAC;YACJ,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,mBAAmB,EAAE,gBAAgB,CAAC,WAAW;YACjD,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,IAAI,OAAO,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;YAAE,OAAO,WAAW,CAAC;QACtE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,0BAA0B,CAAC;gBAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM;gBACN,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,KAAK;gBACL,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,MAAM,yBAAyB,CAAC;YACrC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI;YACJ,MAAM;YACN,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,SAAS,CAAC,QAAQ;gBACvB,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE;gBACzC,CAAC,CAAC,OAAO,CAAC,KAAK;YACjB,KAAK;YACL,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;YAAE,OAAO,WAAW,CAAC;QAC3C,MAAM,uCAAuC,CAC3C,KAAK,EACL,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;YACE,QAAQ,EAAE,MAAM,CAAC,UAAU;YAC3B,UAAU,EAAE,UAAU;YACtB,SAAS,EAAE,sBAAsB;SAClC,CACF,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;YAAE,OAAO,WAAW,CAAC;QAC3C,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,oCAAoC,CAAC;YACzC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,gBAAgB,EAAE,MAAM,CAAC,EAAE;YAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;YACnC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,iCAAiC,OAAO,EAAE;YACnD,KAAK;SACN,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAW,KAO9D;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,CAAC,CAAC;IACjC,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC;IACnC,MAAM,KAAK,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5C,IAAI,CAAC,6BAA6B,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,CAAC;QAC5D,MAAM,gCAAgC,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;YAAE,OAAO,CAAC,CAAC;QACjC,0BAA0B,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,cAAc,GAClB,MAAM,gCAAgC,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,CAAC,CAAC;IACjC,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;YAAE,OAAO,UAAU,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,gCAAgC,CAAC;YACpD,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,MAAM;YACN,KAAK;SACN,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,WAAW;YAAE,OAAO,UAAU,CAAC;QAC9C,0EAA0E;QAC1E,qEAAqE;QACrE,sEAAsE;QACtE,yEAAyE;QACzE,kCAAkC;QAClC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,UAAU,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import { reportAndRethrowKeyingVerificationError } from \"../../../data/keyingProjectionVerification/error\";\nimport {\n  DOCUMENT_LINK_INTENT_TYPE,\n  type DocumentMoveIntentRecord,\n  sqlDocumentMoveIntentPersistence,\n} from \"../../../data/persistence/container-contents/documentMoveIntentPersistence\";\nimport { errorMessage } from \"../../../data/shared/errorMessage\";\nimport {\n  type DocumentLinkSetFailureHandler,\n  type DocumentRecord,\n  defaultDocumentsPersistence,\n} from \"../../documents\";\nimport { moveRemoteContainerDocument } from \"../documentLinks\";\nimport { availableDocumentLinkIntent } from \"../documentLinks/availableDocumentLinkIntent\";\nimport type {\n  DocumentStructuralMutationLocalStore,\n  DocumentStructuralMutationRelinkInput,\n} from \"../documentQueries/documentStructureTypes\";\nimport type { ContainerContentsProjectionUserKeyResolver } from \"../projectionKeys\";\nimport type { ContainerState } from \"../remoteHydration\";\nimport { hasRemoteContainerMetadataState } from \"../remoteHydration/reconciliation\";\nimport type { ContainerContentsWorkflowRuntime } from \"../runtime\";\nimport {\n  deniedReplayMatchesGeneration,\n  markDeniedReplayGeneration,\n} from \"./documentMoveDeniedReplay\";\nimport {\n  type DocumentMoveFailureState,\n  describeRejectedDocumentMove,\n} from \"./documentMoveFailure\";\nimport { recordPendingDocumentMoveIntentError } from \"./documentMoveIntentErrors\";\nimport { settleDocumentMoveIntent } from \"./documentMoveIntentSettlement\";\nimport { moveWithVanishedContainerRefresh } from \"./documentMoveVanishedRefresh\";\n\ntype DocumentMoveIntentReplayResult =\n  | \"abandoned\"\n  | \"moved\"\n  | \"partial\"\n  | \"blocked\"\n  | \"failed\";\n\nexport interface DocumentMoveIntentSyncHost<TRuntime> {\n  documentWorkflowRuntime: (containerId: string) => TRuntime;\n  openDocumentStore: (input: {\n    containerId: string;\n    documentId: string | null;\n    localId: string;\n  }) => DocumentStructuralMutationLocalStore<TRuntime>;\n}\n\ninterface DocumentMoveIntentSyncState {\n  containersById: ReadonlyMap<string, ContainerState>;\n  lifecycleGeneration?: number | undefined;\n  resolveProjectionUserKey: ContainerContentsProjectionUserKeyResolver;\n  runtime: ContainerContentsWorkflowRuntime;\n}\n\nasync function relinkMovedDocumentStore<TRuntime>(input: {\n  host: DocumentMoveIntentSyncHost<TRuntime>;\n  isCurrent: () => boolean;\n  intent: DocumentMoveIntentRecord;\n  relinkInput: DocumentStructuralMutationRelinkInput;\n  targetContainerId: string;\n}): Promise<boolean> {\n  if (!input.isCurrent()) return false;\n  const documentStore = input.host.openDocumentStore({\n    containerId: input.targetContainerId,\n    documentId: input.intent.documentId,\n    localId: input.intent.localId,\n  });\n  if (!(await documentStore.ensureInitialized()) || !input.isCurrent()) {\n    return false;\n  }\n\n  const relinked = await documentStore.relink({\n    ...input.relinkInput,\n    stillCurrent: input.isCurrent,\n  });\n  if (!relinked || !input.isCurrent()) {\n    return false;\n  }\n\n  documentStore.updateRuntime(\n    input.host.documentWorkflowRuntime(input.targetContainerId),\n  );\n  return input.isCurrent();\n}\n\nasync function persistMovedDocumentReplay<TRuntime>(input: {\n  host: DocumentMoveIntentSyncHost<TRuntime>;\n  intent: DocumentMoveIntentRecord;\n  isCurrent: () => boolean;\n  moved: NonNullable<Awaited<ReturnType<typeof moveRemoteContainerDocument>>>;\n  state: DocumentMoveIntentSyncState;\n}): Promise<boolean> {\n  const { host, intent, moved, state } = input;\n  const existingDocument = await defaultDocumentsPersistence.loadDocument(\n    state.runtime.infra.execSql,\n    intent.localId,\n  );\n  if (!input.isCurrent() || !existingDocument) {\n    return false;\n  }\n\n  const targetContainerId =\n    intent.intentType === DOCUMENT_LINK_INTENT_TYPE &&\n    existingDocument.containerId &&\n    moved.linkedContainerIds.includes(existingDocument.containerId)\n      ? existingDocument.containerId\n      : moved.nextContainerId;\n\n  const relinkInput: DocumentStructuralMutationRelinkInput = {\n    accessEpoch: moved.accessEpoch ?? existingDocument.accessEpoch,\n    ...(moved.accessStateHash === null\n      ? {}\n      : { accessStateHash: moved.accessStateHash }),\n    containerId: targetContainerId,\n    documentId: intent.documentId,\n    localId: intent.localId,\n    ...(moved.remoteState ?? {}),\n    commitSideEffect: (transactionExecSql) =>\n      settleDocumentMoveIntent({\n        execSql: transactionExecSql,\n        intent,\n        isCurrent: input.isCurrent,\n        linkedContainerIds: moved.linkedContainerIds,\n        partial: moved.status === \"partial\",\n      }),\n  };\n\n  return relinkMovedDocumentStore({\n    host,\n    isCurrent: input.isCurrent,\n    intent,\n    relinkInput,\n    targetContainerId,\n  });\n}\n\nasync function assertMoveIntentRotationPreflight<TRuntime>(input: {\n  existingContainerId: string | null | undefined;\n  host: DocumentMoveIntentSyncHost<TRuntime>;\n  isCurrent: () => boolean;\n  intent: DocumentMoveIntentRecord;\n}): Promise<Uint8Array | null> {\n  if (!input.isCurrent()) return null;\n  const preflightStore = input.host.openDocumentStore({\n    // The optimistic move already changed local placement. Use that scope so\n    // opening the destination view cannot invalidate this shared store's proof.\n    // Remote link-set authorization still uses the intent's source below.\n    containerId: input.existingContainerId ?? input.intent.targetContainerId,\n    documentId: input.intent.documentId,\n    localId: input.intent.localId,\n  });\n  if (!(await preflightStore.ensureInitialized())) {\n    throw new Error(\"Document rotation preflight could not load the document\");\n  }\n  if (!input.isCurrent()) return null;\n  const rotationSnapshot = await preflightStore.assertCanRotateContentKey();\n  return input.isCurrent() ? rotationSnapshot : null;\n}\n\nasync function movePendingDocumentIntent<TRuntime>(input: {\n  existingContainerId: string | null | undefined;\n  host: DocumentMoveIntentSyncHost<TRuntime>;\n  isCurrent: () => boolean;\n  intent: DocumentMoveIntentRecord;\n  onFailure: DocumentLinkSetFailureHandler;\n  state: DocumentMoveIntentSyncState;\n}) {\n  // Adding links keeps the content key and needs no full-history rotation proof.\n  const linkOnly = input.intent.intentType === DOCUMENT_LINK_INTENT_TYPE;\n  const rotationSnapshot =\n    linkOnly && !input.intent.removedLinkContainerIds?.length\n      ? new Uint8Array()\n      : await assertMoveIntentRotationPreflight(input);\n  if (!rotationSnapshot || !input.isCurrent()) return \"abandoned\" as const;\n  return moveRemoteContainerDocument({\n    linkOnly,\n    additionalLinkContainerIds: input.intent.additionalLinkContainerIds,\n    removedLinkContainerIds: input.intent.removedLinkContainerIds,\n    currentContainerId:\n      input.intent.sourceContainerId ??\n      input.existingContainerId ??\n      input.intent.targetContainerId,\n    documentId: input.intent.documentId,\n    isCurrent: input.isCurrent,\n    noteId: input.intent.localId,\n    onFailure: input.onFailure,\n    replaceLinkedContainers: input.intent.replaceLinkedContainers,\n    resolveProjectionUserKey: input.state.resolveProjectionUserKey,\n    rotationSnapshot,\n    runtime: input.state.runtime,\n    targetContainerId: input.intent.targetContainerId,\n  });\n}\n\nasync function resolveMoveIntentPreflight(input: {\n  isCreatePending: (containerId: string) => boolean;\n  isRemoteSyncBlocked: (organizationId: string) => boolean;\n  isCurrent: () => boolean;\n  intent: DocumentMoveIntentRecord;\n  state: DocumentMoveIntentSyncState;\n}): Promise<\n  | { existingDocument: DocumentRecord; result?: undefined }\n  | { existingDocument?: undefined; result: DocumentMoveIntentReplayResult }\n> {\n  const { intent, state } = input;\n  const execSql = state.runtime.infra.execSql;\n  const existingDocument = await defaultDocumentsPersistence.loadDocument(\n    execSql,\n    intent.localId,\n  );\n  if (!input.isCurrent()) return { result: \"abandoned\" };\n  if (!existingDocument || existingDocument.documentId !== intent.documentId) {\n    await recordPendingDocumentMoveIntentError({\n      blocked: true,\n      documentId: intent.documentId,\n      expectedIntentId: intent.id,\n      expectedUpdatedAt: intent.updatedAt,\n      isCurrent: input.isCurrent,\n      message: \"Document move intent references a missing local document\",\n      state,\n    });\n    return { result: \"blocked\" };\n  }\n\n  for (const targetId of new Set([\n    intent.targetContainerId,\n    ...(intent.additionalLinkContainerIds ?? []),\n  ])) {\n    const targetState = state.containersById.get(targetId);\n    if (!targetState) {\n      await recordPendingDocumentMoveIntentError({\n        blocked: true,\n        documentId: intent.documentId,\n        expectedIntentId: intent.id,\n        expectedUpdatedAt: intent.updatedAt,\n        isCurrent: input.isCurrent,\n        message:\n          \"Document move intent references a missing destination container\",\n        state,\n      });\n      return { result: \"blocked\" };\n    }\n    if (input.isRemoteSyncBlocked(targetState.container.organizationId)) {\n      return { result: \"blocked\" };\n    }\n    if (\n      !hasRemoteContainerMetadataState(targetState) ||\n      input.isCreatePending(targetId)\n    ) {\n      await recordPendingDocumentMoveIntentError({\n        documentId: intent.documentId,\n        expectedIntentId: intent.id,\n        expectedUpdatedAt: intent.updatedAt,\n        isCurrent: input.isCurrent,\n        message: \"Document move destination container is not synced yet\",\n        state,\n      });\n      return { result: \"failed\" };\n    }\n  }\n  return { existingDocument };\n}\n\nasync function recordRejectedDocumentMove(input: {\n  failure: DocumentMoveFailureState;\n  intent: DocumentMoveIntentRecord;\n  isCurrent: () => boolean;\n  state: DocumentMoveIntentSyncState;\n  unavailable: boolean;\n}): Promise<void> {\n  await recordPendingDocumentMoveIntentError({\n    // A permission denial parks the intent for the access-restored signal\n    // instead of replaying on every structural pass (row 7).\n    denied: input.failure.sawPermissionDenial,\n    documentId: input.intent.documentId,\n    expectedIntentId: input.intent.id,\n    expectedUpdatedAt: input.intent.updatedAt,\n    isCurrent: input.isCurrent,\n    message: describeRejectedDocumentMove(input.failure),\n    state: input.state,\n    // Terminal only after the vanished-container refresh proved the\n    // destination itself gone: the intent can never commit as written and\n    // nothing on this device can heal it, so it leaves the replay set instead\n    // of re-issuing doomed requests every pass. The tombstone cascade\n    // retargets it once hydration tears the deleted container down locally.\n    // Every other vanished verdict stays pending for the next pass.\n    unavailable: input.unavailable,\n  });\n}\n\nfunction logSyncedDocumentMove(\n  intent: DocumentMoveIntentRecord,\n  state: DocumentMoveIntentSyncState,\n): void {\n  state.runtime.util.log(\n    `Container contents: synced queued document move ${intent.documentId}`,\n  );\n}\n\nasync function settleMovedDocumentIntent<TRuntime>(input: {\n  failure: DocumentMoveFailureState;\n  host: DocumentMoveIntentSyncHost<TRuntime>;\n  intent: DocumentMoveIntentRecord;\n  isCurrent: () => boolean;\n  moved: NonNullable<Awaited<ReturnType<typeof moveRemoteContainerDocument>>>;\n  state: DocumentMoveIntentSyncState;\n  unavailable: boolean;\n}): Promise<DocumentMoveIntentReplayResult> {\n  const { intent, moved, state } = input;\n  if (\n    !(await persistMovedDocumentReplay({\n      host: input.host,\n      intent,\n      isCurrent: input.isCurrent,\n      moved,\n      state,\n    }))\n  ) {\n    if (!input.isCurrent()) return \"abandoned\";\n    await recordPendingDocumentMoveIntentError({\n      documentId: intent.documentId,\n      expectedIntentId: intent.id,\n      expectedUpdatedAt: intent.updatedAt,\n      isCurrent: input.isCurrent,\n      message: \"Document move replay could not relink the local document\",\n      state,\n    });\n    return \"failed\";\n  }\n  if (moved.status === \"partial\") {\n    await recordPendingDocumentMoveIntentError({\n      // An unlink refused for permissions parks like any other denied\n      // move (row 7); other partials keep row 15's replay.\n      denied: input.failure.sawPermissionDenial,\n      documentId: intent.documentId,\n      expectedIntentId: intent.id,\n      expectedUpdatedAt: intent.updatedAt,\n      isCurrent: input.isCurrent,\n      message: \"Remote document move partially applied; retry required\",\n      state,\n      // Terminal only when the refresh proved the destination itself gone\n      // after the link had already landed; a vanished unlink alone stays\n      // pending with its live link for the next pass to revoke.\n      unavailable: input.unavailable,\n    });\n    return \"partial\";\n  }\n\n  logSyncedDocumentMove(intent, state);\n  return \"moved\";\n}\n\nasync function trySyncPendingDocumentMoveIntent<TRuntime>(input: {\n  host: DocumentMoveIntentSyncHost<TRuntime>;\n  isCreatePending: (containerId: string) => boolean;\n  isRemoteSyncBlocked: (organizationId: string) => boolean;\n  isCurrent: () => boolean;\n  intent: DocumentMoveIntentRecord;\n  state: DocumentMoveIntentSyncState;\n}): Promise<DocumentMoveIntentReplayResult> {\n  const { host, intent, state } = input;\n  const available = availableDocumentLinkIntent(intent, (id) =>\n    state.containersById.has(id),\n  );\n  const preflight = await resolveMoveIntentPreflight({\n    ...input,\n    intent: available.intent,\n  });\n  if (preflight.result !== undefined) {\n    return preflight.result;\n  }\n  const { existingDocument } = preflight;\n\n  try {\n    const outcome = await moveWithVanishedContainerRefresh({\n      apiClient: state.runtime.apiClient,\n      attempt: (onFailure) =>\n        movePendingDocumentIntent({\n          existingContainerId: existingDocument.containerId,\n          host,\n          isCurrent: input.isCurrent,\n          intent: available.intent,\n          onFailure,\n          state,\n        }),\n      execSql: state.runtime.infra.execSql,\n      existingContainerId: existingDocument.containerId,\n      intent: available.intent,\n      isCurrent: input.isCurrent,\n    });\n    if (outcome === \"abandoned\" || !input.isCurrent()) return \"abandoned\";\n    if (!outcome.moved) {\n      await recordRejectedDocumentMove({\n        failure: outcome.failure,\n        intent,\n        isCurrent: input.isCurrent,\n        state,\n        unavailable: outcome.unavailable,\n      });\n      return \"failed\";\n    }\n    return await settleMovedDocumentIntent({\n      failure: outcome.failure,\n      host,\n      intent,\n      isCurrent: input.isCurrent,\n      moved: available.deferred\n        ? { ...outcome.moved, status: \"partial\" }\n        : outcome.moved,\n      state,\n      unavailable: outcome.unavailable,\n    });\n  } catch (error: unknown) {\n    if (!input.isCurrent()) return \"abandoned\";\n    await reportAndRethrowKeyingVerificationError(\n      error,\n      state.runtime.util.reportSecurityIncident,\n      {\n        objectId: intent.documentId,\n        objectKind: \"document\",\n        operation: \"document.move.replay\",\n      },\n    );\n    if (!input.isCurrent()) return \"abandoned\";\n    const message = errorMessage(error);\n    await recordPendingDocumentMoveIntentError({\n      documentId: intent.documentId,\n      expectedIntentId: intent.id,\n      expectedUpdatedAt: intent.updatedAt,\n      isCurrent: input.isCurrent,\n      message: `Failed to sync document move: ${message}`,\n      state,\n    });\n    return \"failed\";\n  }\n}\n\nexport async function syncPendingDocumentMoveIntents<TRuntime>(input: {\n  host: DocumentMoveIntentSyncHost<TRuntime>;\n  /** A destination whose create has not settled takes no document yet. */\n  isCreatePending: (containerId: string) => boolean;\n  isCurrent: () => boolean;\n  isRemoteSyncBlocked: (organizationId: string) => boolean;\n  state: DocumentMoveIntentSyncState;\n}): Promise<number> {\n  if (!input.isCurrent()) return 0;\n  const lifecycleState = input.state;\n  const state = { ...lifecycleState };\n  const execSql = state.runtime.infra.execSql;\n  if (!deniedReplayMatchesGeneration(lifecycleState, execSql)) {\n    await sqlDocumentMoveIntentPersistence.resetDeniedMoveIntents(execSql);\n    if (!input.isCurrent()) return 0;\n    markDeniedReplayGeneration(lifecycleState, execSql);\n  }\n  const pendingIntents =\n    await sqlDocumentMoveIntentPersistence.listPendingMoveIntents(execSql);\n  if (!input.isCurrent()) return 0;\n  let movedCount = 0;\n\n  for (const intent of pendingIntents) {\n    if (!input.isCurrent()) return movedCount;\n    const result = await trySyncPendingDocumentMoveIntent({\n      host: input.host,\n      isCreatePending: input.isCreatePending,\n      isCurrent: input.isCurrent,\n      isRemoteSyncBlocked: input.isRemoteSyncBlocked,\n      intent,\n      state,\n    });\n    if (result === \"abandoned\") return movedCount;\n    // A \"partial\" result (link applied, unlink still pending) must not count:\n    // the caller re-arms this same structural lane whenever the count is\n    // positive, so a deterministically failing unlink hot-looped the pump\n    // (issue #1744). The intent row stays pending; event-driven, manual, and\n    // startup lane requests retry it.\n    if (result === \"moved\") {\n      movedCount += 1;\n    }\n  }\n\n  return movedCount;\n}\n"]}

package/workflows/container-contents/documentMove/documentMoveVanishedRefresh.js

@@ -0,0 +1,100 @@
+import { isContainerNotFoundFailure } from "../../../data/containers/shared/mutationFailures.js";
+import { readLinkedContainerIdsFromDocumentManifest } from "../../../data/documents/shared/projection.js";
+import { listDocumentLinkedContainerIds } from "../documentLinks/index.js";
+import { createDocumentMoveFailureState, recordDocumentMoveFailure, } from "./documentMoveFailure.js";
+/**
+ * Every container the unlink half of the move can cite. The unlink set is
+ * read off the REMOTE document manifest's link set, so that set — refetched
+ * after eviction so it is current — is the authority; the local link
+ * projection, the intent's source, and the document's local placement are
+ * unioned in so a source known only on one side still gets its cached path
+ * refreshed. A superset is harmless: an eviction only forces a refetch, and
+ * nothing here decides what gets unlinked.
+ */
+async function listMoveSourceContainerIds(input) {
+    const { documentId, targetContainerId } = input.intent;
+    const [remote, local] = await Promise.all([
+        input.apiClient.getDocumentWriterProjectionResult(documentId, {
+            reportErrors: false,
+        }),
+        listDocumentLinkedContainerIds(input.execSql, documentId),
+    ]);
+    const remoteLinkedContainerIds = remote.ok
+        ? readLinkedContainerIdsFromDocumentManifest(remote.data)
+        : [];
+    return Array.from(new Set([
+        ...remoteLinkedContainerIds,
+        ...local,
+        input.intent.sourceContainerId,
+        input.existingContainerId,
+    ]))
+        .filter((containerId) => typeof containerId === "string" && containerId !== targetContainerId)
+        .sort();
+}
+/**
+ * A vanished-container verdict (coded container 404 or `container_unavailable`
+ * 409) does not by itself doom a queued move. The deleted container may be a
+ * stale ANCESTOR in a cached path — the destination or a source was moved
+ * under a live parent before its former parent was deleted — and the local
+ * tombstone cascade cannot rescue that intent (it retargets only intents whose
+ * source or destination IS the tombstoned container). So refresh before
+ * declaring terminal: evict the cached destination, document, and source
+ * projections, probe the destination, and retry once with the fresh paths.
+ *
+ * Only the destination's fate is terminal, and only as proven by its own
+ * probe. Sources are evicted, never judged: the retry's unlink set comes from
+ * the verified manifest alone, so a server-asserted "source gone" can neither
+ * skip a revoke nor complete the move — a retry whose link landed but whose
+ * unlink still vanished stays partial (pending) with a live link the queue
+ * keeps trying to revoke. The retry's own vanished verdict, on either side, is
+ * likewise never terminal: with the destination live it can only name another
+ * ancestor deleted mid-pass, which the next pass's fresh paths outrun. The
+ * pass is bounded to one retry; a transient probe failure leaves the intent
+ * retriable (or denied on 403) for a later pass.
+ */
+export async function moveWithVanishedContainerRefresh(input) {
+    const { apiClient, intent } = input;
+    const firstFailure = createDocumentMoveFailureState();
+    const first = await input.attempt((failure) => recordDocumentMoveFailure(firstFailure, failure));
+    if (first === "abandoned" || !input.isCurrent())
+        return "abandoned";
+    if (!firstFailure.sawVanishedContainer) {
+        return { failure: firstFailure, moved: first, unavailable: false };
+    }
+    for (const targetContainerId of new Set([
+        intent.targetContainerId,
+        ...(intent.additionalLinkContainerIds ?? []),
+    ])) {
+        apiClient.evictContainerWriterProjection(targetContainerId);
+        const destination = await apiClient.getContainerWriterProjectionResult(targetContainerId, { reportErrors: false });
+        apiClient.evictDocumentWriterProjection(intent.documentId);
+        if (!input.isCurrent())
+            return "abandoned";
+        if (!destination.ok) {
+            destination.report();
+            recordDocumentMoveFailure(firstFailure, destination);
+            return {
+                failure: firstFailure,
+                moved: first,
+                unavailable: isContainerNotFoundFailure(destination),
+            };
+        }
+    }
+    for (const sourceContainerId of await listMoveSourceContainerIds(input)) {
+        apiClient.evictContainerWriterProjection(sourceContainerId);
+    }
+    if (!input.isCurrent())
+        return "abandoned";
+    const retryFailure = createDocumentMoveFailureState();
+    const retried = await input.attempt((failure) => recordDocumentMoveFailure(retryFailure, failure));
+    if (retried === "abandoned" || !input.isCurrent())
+        return "abandoned";
+    // The retry's own vanished verdict is never terminal. The destination was
+    // just proven live, so a second `container_unavailable` can only name
+    // another ancestor deleted during the refreshed attempt (or a source): the
+    // intent stays pending with its failure recorded and the next pass starts
+    // over with freshly evicted projections. One retry per pass keeps it
+    // bounded; nothing in the queue backs a pending intent off between passes.
+    return { failure: retryFailure, moved: retried, unavailable: false };
+}
+//# sourceMappingURL=documentMoveVanishedRefresh.js.map

package/workflows/container-contents/documentMove/documentMoveVanishedRefresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"documentMoveVanishedRefresh.js","sourceRoot":"","sources":["documentMoveVanishedRefresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,EAAE,0CAA0C,EAAE,MAAM,2CAA2C,CAAC;AAIvG,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAElE,OAAO,EACL,8BAA8B,EAE9B,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAa/B;;;;;;;;GAQG;AACH,KAAK,UAAU,0BAA0B,CAAC,KAKzC;IACC,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;IACvD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxC,KAAK,CAAC,SAAS,CAAC,iCAAiC,CAAC,UAAU,EAAE;YAC5D,YAAY,EAAE,KAAK;SACpB,CAAC;QACF,8BAA8B,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC;KAC1D,CAAC,CAAC;IACH,MAAM,wBAAwB,GAAG,MAAM,CAAC,EAAE;QACxC,CAAC,CAAC,0CAA0C,CAAC,MAAM,CAAC,IAAI,CAAC;QACzD,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,KAAK,CAAC,IAAI,CACf,IAAI,GAAG,CAAC;QACN,GAAG,wBAAwB;QAC3B,GAAG,KAAK;QACR,KAAK,CAAC,MAAM,CAAC,iBAAiB;QAC9B,KAAK,CAAC,mBAAmB;KAC1B,CAAC,CACH;SACE,MAAM,CACL,CAAC,WAAW,EAAyB,EAAE,CACrC,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,iBAAiB,CACvE;SACA,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAS,KAS9D;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACpC,MAAM,YAAY,GAAG,8BAA8B,EAAE,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5C,yBAAyB,CAAC,YAAY,EAAE,OAAO,CAAC,CACjD,CAAC;IACF,IAAI,KAAK,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,WAAW,CAAC;IACpE,IAAI,CAAC,YAAY,CAAC,oBAAoB,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,MAAM,iBAAiB,IAAI,IAAI,GAAG,CAAC;QACtC,MAAM,CAAC,iBAAiB;QACxB,GAAG,CAAC,MAAM,CAAC,0BAA0B,IAAI,EAAE,CAAC;KAC7C,CAAC,EAAE,CAAC;QACH,SAAS,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,kCAAkC,CACpE,iBAAiB,EACjB,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;QACF,SAAS,CAAC,6BAA6B,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;YAAE,OAAO,WAAW,CAAC;QAC3C,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,WAAW,CAAC,MAAM,EAAE,CAAC;YACrB,yBAAyB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YACrD,OAAO;gBACL,OAAO,EAAE,YAAY;gBACrB,KAAK,EAAE,KAAK;gBACZ,WAAW,EAAE,0BAA0B,CAAC,WAAW,CAAC;aACrD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,iBAAiB,IAAI,MAAM,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,SAAS,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,WAAW,CAAC;IAE3C,MAAM,YAAY,GAAG,8BAA8B,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC9C,yBAAyB,CAAC,YAAY,EAAE,OAAO,CAAC,CACjD,CAAC;IACF,IAAI,OAAO,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,WAAW,CAAC;IACtE,0EAA0E;IAC1E,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,qEAAqE;IACrE,2EAA2E;IAC3E,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AACvE,CAAC","sourcesContent":["import { isContainerNotFoundFailure } from \"../../../data/containers/shared/mutationFailures\";\nimport { readLinkedContainerIdsFromDocumentManifest } from \"../../../data/documents/shared/projection\";\nimport type { DocumentMoveIntentRecord } from \"../../../data/persistence/container-contents/documentMoveIntentPersistence\";\nimport type { ExecSql } from \"../../../data/sqlite/sqlSchema\";\nimport type { DocumentLinkSetFailureHandler } from \"../../documents\";\nimport { listDocumentLinkedContainerIds } from \"../documentLinks\";\nimport type { ContainerContentsWorkflowRuntime } from \"../runtime\";\nimport {\n  createDocumentMoveFailureState,\n  type DocumentMoveFailureState,\n  recordDocumentMoveFailure,\n} from \"./documentMoveFailure\";\n\nexport interface VanishedContainerRefreshOutcome<TMoved> {\n  readonly failure: DocumentMoveFailureState;\n  readonly moved: TMoved;\n  /**\n   * Park the intent terminally. True only when the destination itself is\n   * proven gone: a coded 404 on its projection probe after eviction. No\n   * mutation verdict — first attempt or retry — is ever terminal.\n   */\n  readonly unavailable: boolean;\n}\n\n/**\n * Every container the unlink half of the move can cite. The unlink set is\n * read off the REMOTE document manifest's link set, so that set — refetched\n * after eviction so it is current — is the authority; the local link\n * projection, the intent's source, and the document's local placement are\n * unioned in so a source known only on one side still gets its cached path\n * refreshed. A superset is harmless: an eviction only forces a refetch, and\n * nothing here decides what gets unlinked.\n */\nasync function listMoveSourceContainerIds(input: {\n  apiClient: ContainerContentsWorkflowRuntime[\"apiClient\"];\n  execSql: ExecSql;\n  existingContainerId: string | null | undefined;\n  intent: DocumentMoveIntentRecord;\n}): Promise<string[]> {\n  const { documentId, targetContainerId } = input.intent;\n  const [remote, local] = await Promise.all([\n    input.apiClient.getDocumentWriterProjectionResult(documentId, {\n      reportErrors: false,\n    }),\n    listDocumentLinkedContainerIds(input.execSql, documentId),\n  ]);\n  const remoteLinkedContainerIds = remote.ok\n    ? readLinkedContainerIdsFromDocumentManifest(remote.data)\n    : [];\n  return Array.from(\n    new Set([\n      ...remoteLinkedContainerIds,\n      ...local,\n      input.intent.sourceContainerId,\n      input.existingContainerId,\n    ]),\n  )\n    .filter(\n      (containerId): containerId is string =>\n        typeof containerId === \"string\" && containerId !== targetContainerId,\n    )\n    .sort();\n}\n\n/**\n * A vanished-container verdict (coded container 404 or `container_unavailable`\n * 409) does not by itself doom a queued move. The deleted container may be a\n * stale ANCESTOR in a cached path — the destination or a source was moved\n * under a live parent before its former parent was deleted — and the local\n * tombstone cascade cannot rescue that intent (it retargets only intents whose\n * source or destination IS the tombstoned container). So refresh before\n * declaring terminal: evict the cached destination, document, and source\n * projections, probe the destination, and retry once with the fresh paths.\n *\n * Only the destination's fate is terminal, and only as proven by its own\n * probe. Sources are evicted, never judged: the retry's unlink set comes from\n * the verified manifest alone, so a server-asserted \"source gone\" can neither\n * skip a revoke nor complete the move — a retry whose link landed but whose\n * unlink still vanished stays partial (pending) with a live link the queue\n * keeps trying to revoke. The retry's own vanished verdict, on either side, is\n * likewise never terminal: with the destination live it can only name another\n * ancestor deleted mid-pass, which the next pass's fresh paths outrun. The\n * pass is bounded to one retry; a transient probe failure leaves the intent\n * retriable (or denied on 403) for a later pass.\n */\nexport async function moveWithVanishedContainerRefresh<TMoved>(input: {\n  apiClient: ContainerContentsWorkflowRuntime[\"apiClient\"];\n  attempt: (\n    onFailure: DocumentLinkSetFailureHandler,\n  ) => Promise<TMoved | \"abandoned\">;\n  execSql: ExecSql;\n  existingContainerId: string | null | undefined;\n  intent: DocumentMoveIntentRecord;\n  isCurrent: () => boolean;\n}): Promise<VanishedContainerRefreshOutcome<TMoved> | \"abandoned\"> {\n  const { apiClient, intent } = input;\n  const firstFailure = createDocumentMoveFailureState();\n  const first = await input.attempt((failure) =>\n    recordDocumentMoveFailure(firstFailure, failure),\n  );\n  if (first === \"abandoned\" || !input.isCurrent()) return \"abandoned\";\n  if (!firstFailure.sawVanishedContainer) {\n    return { failure: firstFailure, moved: first, unavailable: false };\n  }\n\n  for (const targetContainerId of new Set([\n    intent.targetContainerId,\n    ...(intent.additionalLinkContainerIds ?? []),\n  ])) {\n    apiClient.evictContainerWriterProjection(targetContainerId);\n    const destination = await apiClient.getContainerWriterProjectionResult(\n      targetContainerId,\n      { reportErrors: false },\n    );\n    apiClient.evictDocumentWriterProjection(intent.documentId);\n    if (!input.isCurrent()) return \"abandoned\";\n    if (!destination.ok) {\n      destination.report();\n      recordDocumentMoveFailure(firstFailure, destination);\n      return {\n        failure: firstFailure,\n        moved: first,\n        unavailable: isContainerNotFoundFailure(destination),\n      };\n    }\n  }\n\n  for (const sourceContainerId of await listMoveSourceContainerIds(input)) {\n    apiClient.evictContainerWriterProjection(sourceContainerId);\n  }\n  if (!input.isCurrent()) return \"abandoned\";\n\n  const retryFailure = createDocumentMoveFailureState();\n  const retried = await input.attempt((failure) =>\n    recordDocumentMoveFailure(retryFailure, failure),\n  );\n  if (retried === \"abandoned\" || !input.isCurrent()) return \"abandoned\";\n  // The retry's own vanished verdict is never terminal. The destination was\n  // just proven live, so a second `container_unavailable` can only name\n  // another ancestor deleted during the refreshed attempt (or a source): the\n  // intent stays pending with its failure recorded and the next pass starts\n  // over with freshly evicted projections. One retry per pass keeps it\n  // bounded; nothing in the queue backs a pending intent off between passes.\n  return { failure: retryFailure, moved: retried, unavailable: false };\n}\n"]}