@tearleads/client-sdk 0.1.61 → 0.1.63

package/workflows/container-contents/documentMoveIntentSync.js

@@ -1,346 +0,0 @@
-import { reportAndRethrowKeyingVerificationError } from "../../data/keyingProjectionVerification/error.js";
-import { DOCUMENT_LINK_INTENT_TYPE, sqlDocumentMoveIntentPersistence, } from "../../data/persistence/container-contents/documentMoveIntentPersistence.js";
-import { errorMessage } from "../../data/shared/errorMessage.js";
-import { defaultDocumentsPersistence, } from "../documents/index.js";
-import { availableDocumentLinkIntent } from "./availableDocumentLinkIntent.js";
-import { moveRemoteContainerDocument } from "./documentLinks.js";
-import { deniedReplayMatchesGeneration, markDeniedReplayGeneration, } from "./documentMoveDeniedReplay.js";
-import { describeRejectedDocumentMove, } from "./documentMoveFailure.js";
-import { recordPendingDocumentMoveIntentError } from "./documentMoveIntentErrors.js";
-import { settleDocumentMoveIntent } from "./documentMoveIntentSettlement.js";
-import { moveWithVanishedContainerRefresh } from "./documentMoveVanishedRefresh.js";
-import { hasRemoteContainerMetadataState } from "./remoteHydration/reconciliation.js";
-async function relinkMovedDocumentStore(input) {
-    if (!input.isCurrent())
-        return false;
-    const documentStore = input.host.openDocumentStore({
-        containerId: input.targetContainerId,
-        documentId: input.intent.documentId,
-        localId: input.intent.localId,
-    });
-    if (!(await documentStore.ensureInitialized()) || !input.isCurrent()) {
-        return false;
-    }
-    const relinked = await documentStore.relink({
-        ...input.relinkInput,
-        stillCurrent: input.isCurrent,
-    });
-    if (!relinked || !input.isCurrent()) {
-        return false;
-    }
-    documentStore.updateRuntime(input.host.documentWorkflowRuntime(input.targetContainerId));
-    return input.isCurrent();
-}
-async function persistMovedDocumentReplay(input) {
-    const { host, intent, moved, state } = input;
-    const existingDocument = await defaultDocumentsPersistence.loadDocument(state.runtime.infra.execSql, intent.localId);
-    if (!input.isCurrent() || !existingDocument) {
-        return false;
-    }
-    const targetContainerId = intent.intentType === DOCUMENT_LINK_INTENT_TYPE &&
-        existingDocument.containerId &&
-        moved.linkedContainerIds.includes(existingDocument.containerId)
-        ? existingDocument.containerId
-        : moved.nextContainerId;
-    const relinkInput = {
-        accessEpoch: moved.accessEpoch ?? existingDocument.accessEpoch,
-        ...(moved.accessStateHash === null
-            ? {}
-            : { accessStateHash: moved.accessStateHash }),
-        containerId: targetContainerId,
-        documentId: intent.documentId,
-        localId: intent.localId,
-        ...(moved.remoteState ?? {}),
-        commitSideEffect: (transactionExecSql) => settleDocumentMoveIntent({
-            execSql: transactionExecSql,
-            intent,
-            isCurrent: input.isCurrent,
-            linkedContainerIds: moved.linkedContainerIds,
-            partial: moved.status === "partial",
-        }),
-    };
-    return relinkMovedDocumentStore({
-        host,
-        isCurrent: input.isCurrent,
-        intent,
-        relinkInput,
-        targetContainerId,
-    });
-}
-async function assertMoveIntentRotationPreflight(input) {
-    if (!input.isCurrent())
-        return null;
-    const preflightStore = input.host.openDocumentStore({
-        // The optimistic move already changed local placement. Use that scope so
-        // opening the destination view cannot invalidate this shared store's proof.
-        // Remote link-set authorization still uses the intent's source below.
-        containerId: input.existingContainerId ?? input.intent.targetContainerId,
-        documentId: input.intent.documentId,
-        localId: input.intent.localId,
-    });
-    if (!(await preflightStore.ensureInitialized())) {
-        throw new Error("Document rotation preflight could not load the document");
-    }
-    if (!input.isCurrent())
-        return null;
-    const rotationSnapshot = await preflightStore.assertCanRotateContentKey();
-    return input.isCurrent() ? rotationSnapshot : null;
-}
-async function movePendingDocumentIntent(input) {
-    // Adding links keeps the content key and needs no full-history rotation proof.
-    const linkOnly = input.intent.intentType === DOCUMENT_LINK_INTENT_TYPE;
-    const rotationSnapshot = linkOnly && !input.intent.removedLinkContainerIds?.length
-        ? new Uint8Array()
-        : await assertMoveIntentRotationPreflight(input);
-    if (!rotationSnapshot || !input.isCurrent())
-        return "abandoned";
-    return moveRemoteContainerDocument({
-        linkOnly,
-        additionalLinkContainerIds: input.intent.additionalLinkContainerIds,
-        removedLinkContainerIds: input.intent.removedLinkContainerIds,
-        currentContainerId: input.intent.sourceContainerId ??
-            input.existingContainerId ??
-            input.intent.targetContainerId,
-        documentId: input.intent.documentId,
-        isCurrent: input.isCurrent,
-        noteId: input.intent.localId,
-        onFailure: input.onFailure,
-        replaceLinkedContainers: input.intent.replaceLinkedContainers,
-        resolveProjectionUserKey: input.state.resolveProjectionUserKey,
-        rotationSnapshot,
-        runtime: input.state.runtime,
-        targetContainerId: input.intent.targetContainerId,
-    });
-}
-async function resolveMoveIntentPreflight(input) {
-    const { intent, state } = input;
-    const execSql = state.runtime.infra.execSql;
-    const existingDocument = await defaultDocumentsPersistence.loadDocument(execSql, intent.localId);
-    if (!input.isCurrent())
-        return { result: "abandoned" };
-    if (!existingDocument || existingDocument.documentId !== intent.documentId) {
-        await recordPendingDocumentMoveIntentError({
-            blocked: true,
-            documentId: intent.documentId,
-            expectedIntentId: intent.id,
-            expectedUpdatedAt: intent.updatedAt,
-            isCurrent: input.isCurrent,
-            message: "Document move intent references a missing local document",
-            state,
-        });
-        return { result: "blocked" };
-    }
-    for (const targetId of new Set([
-        intent.targetContainerId,
-        ...(intent.additionalLinkContainerIds ?? []),
-    ])) {
-        const targetState = state.containersById.get(targetId);
-        if (!targetState) {
-            await recordPendingDocumentMoveIntentError({
-                blocked: true,
-                documentId: intent.documentId,
-                expectedIntentId: intent.id,
-                expectedUpdatedAt: intent.updatedAt,
-                isCurrent: input.isCurrent,
-                message: "Document move intent references a missing destination container",
-                state,
-            });
-            return { result: "blocked" };
-        }
-        if (input.isRemoteSyncBlocked(targetState.container.organizationId)) {
-            return { result: "blocked" };
-        }
-        if (!hasRemoteContainerMetadataState(targetState) ||
-            input.isCreatePending(targetId)) {
-            await recordPendingDocumentMoveIntentError({
-                documentId: intent.documentId,
-                expectedIntentId: intent.id,
-                expectedUpdatedAt: intent.updatedAt,
-                isCurrent: input.isCurrent,
-                message: "Document move destination container is not synced yet",
-                state,
-            });
-            return { result: "failed" };
-        }
-    }
-    return { existingDocument };
-}
-async function recordRejectedDocumentMove(input) {
-    await recordPendingDocumentMoveIntentError({
-        // A permission denial parks the intent for the access-restored signal
-        // instead of replaying on every structural pass (row 7).
-        denied: input.failure.sawPermissionDenial,
-        documentId: input.intent.documentId,
-        expectedIntentId: input.intent.id,
-        expectedUpdatedAt: input.intent.updatedAt,
-        isCurrent: input.isCurrent,
-        message: describeRejectedDocumentMove(input.failure),
-        state: input.state,
-        // Terminal only after the vanished-container refresh proved the
-        // destination itself gone: the intent can never commit as written and
-        // nothing on this device can heal it, so it leaves the replay set instead
-        // of re-issuing doomed requests every pass. The tombstone cascade
-        // retargets it once hydration tears the deleted container down locally.
-        // Every other vanished verdict stays pending for the next pass.
-        unavailable: input.unavailable,
-    });
-}
-function logSyncedDocumentMove(intent, state) {
-    state.runtime.util.log(`Container contents: synced queued document move ${intent.documentId}`);
-}
-async function settleMovedDocumentIntent(input) {
-    const { intent, moved, state } = input;
-    if (!(await persistMovedDocumentReplay({
-        host: input.host,
-        intent,
-        isCurrent: input.isCurrent,
-        moved,
-        state,
-    }))) {
-        if (!input.isCurrent())
-            return "abandoned";
-        await recordPendingDocumentMoveIntentError({
-            documentId: intent.documentId,
-            expectedIntentId: intent.id,
-            expectedUpdatedAt: intent.updatedAt,
-            isCurrent: input.isCurrent,
-            message: "Document move replay could not relink the local document",
-            state,
-        });
-        return "failed";
-    }
-    if (moved.status === "partial") {
-        await recordPendingDocumentMoveIntentError({
-            // An unlink refused for permissions parks like any other denied
-            // move (row 7); other partials keep row 15's replay.
-            denied: input.failure.sawPermissionDenial,
-            documentId: intent.documentId,
-            expectedIntentId: intent.id,
-            expectedUpdatedAt: intent.updatedAt,
-            isCurrent: input.isCurrent,
-            message: "Remote document move partially applied; retry required",
-            state,
-            // Terminal only when the refresh proved the destination itself gone
-            // after the link had already landed; a vanished unlink alone stays
-            // pending with its live link for the next pass to revoke.
-            unavailable: input.unavailable,
-        });
-        return "partial";
-    }
-    logSyncedDocumentMove(intent, state);
-    return "moved";
-}
-async function trySyncPendingDocumentMoveIntent(input) {
-    const { host, intent, state } = input;
-    const available = availableDocumentLinkIntent(intent, (id) => state.containersById.has(id));
-    const preflight = await resolveMoveIntentPreflight({
-        ...input,
-        intent: available.intent,
-    });
-    if (preflight.result !== undefined) {
-        return preflight.result;
-    }
-    const { existingDocument } = preflight;
-    try {
-        const outcome = await moveWithVanishedContainerRefresh({
-            apiClient: state.runtime.apiClient,
-            attempt: (onFailure) => movePendingDocumentIntent({
-                existingContainerId: existingDocument.containerId,
-                host,
-                isCurrent: input.isCurrent,
-                intent: available.intent,
-                onFailure,
-                state,
-            }),
-            execSql: state.runtime.infra.execSql,
-            existingContainerId: existingDocument.containerId,
-            intent: available.intent,
-            isCurrent: input.isCurrent,
-        });
-        if (outcome === "abandoned" || !input.isCurrent())
-            return "abandoned";
-        if (!outcome.moved) {
-            await recordRejectedDocumentMove({
-                failure: outcome.failure,
-                intent,
-                isCurrent: input.isCurrent,
-                state,
-                unavailable: outcome.unavailable,
-            });
-            return "failed";
-        }
-        return await settleMovedDocumentIntent({
-            failure: outcome.failure,
-            host,
-            intent,
-            isCurrent: input.isCurrent,
-            moved: available.deferred
-                ? { ...outcome.moved, status: "partial" }
-                : outcome.moved,
-            state,
-            unavailable: outcome.unavailable,
-        });
-    }
-    catch (error) {
-        if (!input.isCurrent())
-            return "abandoned";
-        await reportAndRethrowKeyingVerificationError(error, state.runtime.util.reportSecurityIncident, {
-            objectId: intent.documentId,
-            objectKind: "document",
-            operation: "document.move.replay",
-        });
-        if (!input.isCurrent())
-            return "abandoned";
-        const message = errorMessage(error);
-        await recordPendingDocumentMoveIntentError({
-            documentId: intent.documentId,
-            expectedIntentId: intent.id,
-            expectedUpdatedAt: intent.updatedAt,
-            isCurrent: input.isCurrent,
-            message: `Failed to sync document move: ${message}`,
-            state,
-        });
-        return "failed";
-    }
-}
-export async function syncPendingDocumentMoveIntents(input) {
-    if (!input.isCurrent())
-        return 0;
-    const lifecycleState = input.state;
-    const state = { ...lifecycleState };
-    const execSql = state.runtime.infra.execSql;
-    if (!deniedReplayMatchesGeneration(lifecycleState, execSql)) {
-        await sqlDocumentMoveIntentPersistence.resetDeniedMoveIntents(execSql);
-        if (!input.isCurrent())
-            return 0;
-        markDeniedReplayGeneration(lifecycleState, execSql);
-    }
-    const pendingIntents = await sqlDocumentMoveIntentPersistence.listPendingMoveIntents(execSql);
-    if (!input.isCurrent())
-        return 0;
-    let movedCount = 0;
-    for (const intent of pendingIntents) {
-        if (!input.isCurrent())
-            return movedCount;
-        const result = await trySyncPendingDocumentMoveIntent({
-            host: input.host,
-            isCreatePending: input.isCreatePending,
-            isCurrent: input.isCurrent,
-            isRemoteSyncBlocked: input.isRemoteSyncBlocked,
-            intent,
-            state,
-        });
-        if (result === "abandoned")
-            return movedCount;
-        // A "partial" result (link applied, unlink still pending) must not count:
-        // the caller re-arms this same structural lane whenever the count is
-        // positive, so a deterministically failing unlink hot-looped the pump
-        // (issue #1744). The intent row stays pending; event-driven, manual, and
-        // startup lane requests retry it.
-        if (result === "moved") {
-            movedCount += 1;
-        }
-    }
-    return movedCount;
-}
-//# sourceMappingURL=documentMoveIntentSync.js.map

package/workflows/container-contents/documentMoveIntentSync.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"documentMoveIntentSync.js","sourceRoot":"","sources":["documentMoveIntentSync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uCAAuC,EAAE,MAAM,+CAA+C,CAAC;AACxG,OAAO,EACL,yBAAyB,EAEzB,gCAAgC,GACjC,MAAM,yEAAyE,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAGL,2BAA2B,GAC5B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAEL,4BAA4B,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,oCAAoC,EAAE,MAAM,4BAA4B,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,gCAAgC,EAAE,MAAM,+BAA+B,CAAC;AAOjF,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AA0BnF,KAAK,UAAU,wBAAwB,CAAW,KAMjD;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC;QACjD,WAAW,EAAE,KAAK,CAAC,iBAAiB;QACpC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;QACnC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;QACrE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC;QAC1C,GAAG,KAAK,CAAC,WAAW;QACpB,YAAY,EAAE,KAAK,CAAC,SAAS;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,aAAa,CAAC,aAAa,CACzB,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAC5D,CAAC;IACF,OAAO,KAAK,CAAC,SAAS,EAAE,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAW,KAMnD;IACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAC7C,MAAM,gBAAgB,GAAG,MAAM,2BAA2B,CAAC,YAAY,CACrE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAC3B,MAAM,CAAC,OAAO,CACf,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,iBAAiB,GACrB,MAAM,CAAC,UAAU,KAAK,yBAAyB;QAC/C,gBAAgB,CAAC,WAAW;QAC5B,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,gBAAgB,CAAC,WAAW,CAAC;QAC7D,CAAC,CAAC,gBAAgB,CAAC,WAAW;QAC9B,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IAE5B,MAAM,WAAW,GAA0C;QACzD,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,gBAAgB,CAAC,WAAW;QAC9D,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,IAAI;YAChC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC;QAC/C,WAAW,EAAE,iBAAiB;QAC9B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;QAC5B,gBAAgB,EAAE,CAAC,kBAAkB,EAAE,EAAE,CACvC,wBAAwB,CAAC;YACvB,OAAO,EAAE,kBAAkB;YAC3B,MAAM;YACN,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,OAAO,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS;SACpC,CAAC;KACL,CAAC;IAEF,OAAO,wBAAwB,CAAC;QAC9B,IAAI;QACJ,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM;QACN,WAAW;QACX,iBAAiB;KAClB,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iCAAiC,CAAW,KAK1D;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC;QAClD,yEAAyE;QACzE,4EAA4E;QAC5E,sEAAsE;QACtE,WAAW,EAAE,KAAK,CAAC,mBAAmB,IAAI,KAAK,CAAC,MAAM,CAAC,iBAAiB;QACxE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;QACnC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;KAC9B,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,gBAAgB,GAAG,MAAM,cAAc,CAAC,yBAAyB,EAAE,CAAC;IAC1E,OAAO,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAW,KAOlD;IACC,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,KAAK,yBAAyB,CAAC;IACvE,MAAM,gBAAgB,GACpB,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,EAAE,MAAM;QACvD,CAAC,CAAC,IAAI,UAAU,EAAE;QAClB,CAAC,CAAC,MAAM,iCAAiC,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,WAAoB,CAAC;IACzE,OAAO,2BAA2B,CAAC;QACjC,QAAQ;QACR,0BAA0B,EAAE,KAAK,CAAC,MAAM,CAAC,0BAA0B;QACnE,uBAAuB,EAAE,KAAK,CAAC,MAAM,CAAC,uBAAuB;QAC7D,kBAAkB,EAChB,KAAK,CAAC,MAAM,CAAC,iBAAiB;YAC9B,KAAK,CAAC,mBAAmB;YACzB,KAAK,CAAC,MAAM,CAAC,iBAAiB;QAChC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;QACnC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;QAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,uBAAuB,EAAE,KAAK,CAAC,MAAM,CAAC,uBAAuB;QAC7D,wBAAwB,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB;QAC9D,gBAAgB;QAChB,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO;QAC5B,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,iBAAiB;KAClD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAMzC;IAIC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5C,MAAM,gBAAgB,GAAG,MAAM,2BAA2B,CAAC,YAAY,CACrE,OAAO,EACP,MAAM,CAAC,OAAO,CACf,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACvD,IAAI,CAAC,gBAAgB,IAAI,gBAAgB,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;QAC3E,MAAM,oCAAoC,CAAC;YACzC,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,gBAAgB,EAAE,MAAM,CAAC,EAAE;YAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;YACnC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,0DAA0D;YACnE,KAAK;SACN,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,IAAI,GAAG,CAAC;QAC7B,MAAM,CAAC,iBAAiB;QACxB,GAAG,CAAC,MAAM,CAAC,0BAA0B,IAAI,EAAE,CAAC;KAC7C,CAAC,EAAE,CAAC;QACH,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,oCAAoC,CAAC;gBACzC,OAAO,EAAE,IAAI;gBACb,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,gBAAgB,EAAE,MAAM,CAAC,EAAE;gBAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;gBACnC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EACL,iEAAiE;gBACnE,KAAK;aACN,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,KAAK,CAAC,mBAAmB,CAAC,WAAW,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC;YACpE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;QACD,IACE,CAAC,+BAA+B,CAAC,WAAW,CAAC;YAC7C,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,EAC/B,CAAC;YACD,MAAM,oCAAoC,CAAC;gBACzC,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,gBAAgB,EAAE,MAAM,CAAC,EAAE;gBAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;gBACnC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,OAAO,EAAE,uDAAuD;gBAChE,KAAK;aACN,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAMzC;IACC,MAAM,oCAAoC,CAAC;QACzC,sEAAsE;QACtE,yDAAyD;QACzD,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB;QACzC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;QACnC,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE;QACjC,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;QACzC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC;QACpD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,gEAAgE;QAChE,sEAAsE;QACtE,0EAA0E;QAC1E,kEAAkE;QAClE,wEAAwE;QACxE,gEAAgE;QAChE,WAAW,EAAE,KAAK,CAAC,WAAW;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAAgC,EAChC,KAAkC;IAElC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CACpB,mDAAmD,MAAM,CAAC,UAAU,EAAE,CACvE,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAW,KAQlD;IACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACvC,IACE,CAAC,CAAC,MAAM,0BAA0B,CAAC;QACjC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM;QACN,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK;QACL,KAAK;KACN,CAAC,CAAC,EACH,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;YAAE,OAAO,WAAW,CAAC;QAC3C,MAAM,oCAAoC,CAAC;YACzC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,gBAAgB,EAAE,MAAM,CAAC,EAAE;YAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;YACnC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,0DAA0D;YACnE,KAAK;SACN,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,oCAAoC,CAAC;YACzC,gEAAgE;YAChE,qDAAqD;YACrD,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,mBAAmB;YACzC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,gBAAgB,EAAE,MAAM,CAAC,EAAE;YAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;YACnC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,wDAAwD;YACjE,KAAK;YACL,oEAAoE;YACpE,mEAAmE;YACnE,0DAA0D;YAC1D,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,gCAAgC,CAAW,KAOzD;IACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;IACtC,MAAM,SAAS,GAAG,2BAA2B,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,CAC3D,KAAK,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,CAC7B,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,0BAA0B,CAAC;QACjD,GAAG,KAAK;QACR,MAAM,EAAE,SAAS,CAAC,MAAM;KACzB,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC,MAAM,CAAC;IAC1B,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,GAAG,SAAS,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,gCAAgC,CAAC;YACrD,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS;YAClC,OAAO,EAAE,CAAC,SAAS,EAAE,EAAE,CACrB,yBAAyB,CAAC;gBACxB,mBAAmB,EAAE,gBAAgB,CAAC,WAAW;gBACjD,IAAI;gBACJ,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,SAAS;gBACT,KAAK;aACN,CAAC;YACJ,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;YACpC,mBAAmB,EAAE,gBAAgB,CAAC,WAAW;YACjD,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,IAAI,OAAO,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;YAAE,OAAO,WAAW,CAAC;QACtE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,0BAA0B,CAAC;gBAC/B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM;gBACN,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,KAAK;gBACL,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,MAAM,yBAAyB,CAAC;YACrC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI;YACJ,MAAM;YACN,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,SAAS,CAAC,QAAQ;gBACvB,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE;gBACzC,CAAC,CAAC,OAAO,CAAC,KAAK;YACjB,KAAK;YACL,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;YAAE,OAAO,WAAW,CAAC;QAC3C,MAAM,uCAAuC,CAC3C,KAAK,EACL,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EACzC;YACE,QAAQ,EAAE,MAAM,CAAC,UAAU;YAC3B,UAAU,EAAE,UAAU;YACtB,SAAS,EAAE,sBAAsB;SAClC,CACF,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;YAAE,OAAO,WAAW,CAAC;QAC3C,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,oCAAoC,CAAC;YACzC,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,gBAAgB,EAAE,MAAM,CAAC,EAAE;YAC3B,iBAAiB,EAAE,MAAM,CAAC,SAAS;YACnC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,iCAAiC,OAAO,EAAE;YACnD,KAAK;SACN,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAW,KAO9D;IACC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,CAAC,CAAC;IACjC,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC;IACnC,MAAM,KAAK,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;IAC5C,IAAI,CAAC,6BAA6B,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,CAAC;QAC5D,MAAM,gCAAgC,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;YAAE,OAAO,CAAC,CAAC;QACjC,0BAA0B,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,cAAc,GAClB,MAAM,gCAAgC,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,CAAC,CAAC;IACjC,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;YAAE,OAAO,UAAU,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,gCAAgC,CAAC;YACpD,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,MAAM;YACN,KAAK;SACN,CAAC,CAAC;QACH,IAAI,MAAM,KAAK,WAAW;YAAE,OAAO,UAAU,CAAC;QAC9C,0EAA0E;QAC1E,qEAAqE;QACrE,sEAAsE;QACtE,yEAAyE;QACzE,kCAAkC;QAClC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACvB,UAAU,IAAI,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC","sourcesContent":["import { reportAndRethrowKeyingVerificationError } from \"../../data/keyingProjectionVerification/error\";\nimport {\n  DOCUMENT_LINK_INTENT_TYPE,\n  type DocumentMoveIntentRecord,\n  sqlDocumentMoveIntentPersistence,\n} from \"../../data/persistence/container-contents/documentMoveIntentPersistence\";\nimport { errorMessage } from \"../../data/shared/errorMessage\";\nimport {\n  type DocumentLinkSetFailureHandler,\n  type DocumentRecord,\n  defaultDocumentsPersistence,\n} from \"../documents\";\nimport { availableDocumentLinkIntent } from \"./availableDocumentLinkIntent\";\nimport { moveRemoteContainerDocument } from \"./documentLinks\";\nimport {\n  deniedReplayMatchesGeneration,\n  markDeniedReplayGeneration,\n} from \"./documentMoveDeniedReplay\";\nimport {\n  type DocumentMoveFailureState,\n  describeRejectedDocumentMove,\n} from \"./documentMoveFailure\";\nimport { recordPendingDocumentMoveIntentError } from \"./documentMoveIntentErrors\";\nimport { settleDocumentMoveIntent } from \"./documentMoveIntentSettlement\";\nimport { moveWithVanishedContainerRefresh } from \"./documentMoveVanishedRefresh\";\nimport type {\n  DocumentStructuralMutationLocalStore,\n  DocumentStructuralMutationRelinkInput,\n} from \"./documentStructureTypes\";\nimport type { ContainerContentsProjectionUserKeyResolver } from \"./projectionKeys\";\nimport type { ContainerState } from \"./remoteHydration\";\nimport { hasRemoteContainerMetadataState } from \"./remoteHydration/reconciliation\";\nimport type { ContainerContentsWorkflowRuntime } from \"./runtime\";\n\ntype DocumentMoveIntentReplayResult =\n  | \"abandoned\"\n  | \"moved\"\n  | \"partial\"\n  | \"blocked\"\n  | \"failed\";\n\nexport interface DocumentMoveIntentSyncHost<TRuntime> {\n  documentWorkflowRuntime: (containerId: string) => TRuntime;\n  openDocumentStore: (input: {\n    containerId: string;\n    documentId: string | null;\n    localId: string;\n  }) => DocumentStructuralMutationLocalStore<TRuntime>;\n}\n\ninterface DocumentMoveIntentSyncState {\n  containersById: ReadonlyMap<string, ContainerState>;\n  lifecycleGeneration?: number | undefined;\n  resolveProjectionUserKey: ContainerContentsProjectionUserKeyResolver;\n  runtime: ContainerContentsWorkflowRuntime;\n}\n\nasync function relinkMovedDocumentStore<TRuntime>(input: {\n  host: DocumentMoveIntentSyncHost<TRuntime>;\n  isCurrent: () => boolean;\n  intent: DocumentMoveIntentRecord;\n  relinkInput: DocumentStructuralMutationRelinkInput;\n  targetContainerId: string;\n}): Promise<boolean> {\n  if (!input.isCurrent()) return false;\n  const documentStore = input.host.openDocumentStore({\n    containerId: input.targetContainerId,\n    documentId: input.intent.documentId,\n    localId: input.intent.localId,\n  });\n  if (!(await documentStore.ensureInitialized()) || !input.isCurrent()) {\n    return false;\n  }\n\n  const relinked = await documentStore.relink({\n    ...input.relinkInput,\n    stillCurrent: input.isCurrent,\n  });\n  if (!relinked || !input.isCurrent()) {\n    return false;\n  }\n\n  documentStore.updateRuntime(\n    input.host.documentWorkflowRuntime(input.targetContainerId),\n  );\n  return input.isCurrent();\n}\n\nasync function persistMovedDocumentReplay<TRuntime>(input: {\n  host: DocumentMoveIntentSyncHost<TRuntime>;\n  intent: DocumentMoveIntentRecord;\n  isCurrent: () => boolean;\n  moved: NonNullable<Awaited<ReturnType<typeof moveRemoteContainerDocument>>>;\n  state: DocumentMoveIntentSyncState;\n}): Promise<boolean> {\n  const { host, intent, moved, state } = input;\n  const existingDocument = await defaultDocumentsPersistence.loadDocument(\n    state.runtime.infra.execSql,\n    intent.localId,\n  );\n  if (!input.isCurrent() || !existingDocument) {\n    return false;\n  }\n\n  const targetContainerId =\n    intent.intentType === DOCUMENT_LINK_INTENT_TYPE &&\n    existingDocument.containerId &&\n    moved.linkedContainerIds.includes(existingDocument.containerId)\n      ? existingDocument.containerId\n      : moved.nextContainerId;\n\n  const relinkInput: DocumentStructuralMutationRelinkInput = {\n    accessEpoch: moved.accessEpoch ?? existingDocument.accessEpoch,\n    ...(moved.accessStateHash === null\n      ? {}\n      : { accessStateHash: moved.accessStateHash }),\n    containerId: targetContainerId,\n    documentId: intent.documentId,\n    localId: intent.localId,\n    ...(moved.remoteState ?? {}),\n    commitSideEffect: (transactionExecSql) =>\n      settleDocumentMoveIntent({\n        execSql: transactionExecSql,\n        intent,\n        isCurrent: input.isCurrent,\n        linkedContainerIds: moved.linkedContainerIds,\n        partial: moved.status === \"partial\",\n      }),\n  };\n\n  return relinkMovedDocumentStore({\n    host,\n    isCurrent: input.isCurrent,\n    intent,\n    relinkInput,\n    targetContainerId,\n  });\n}\n\nasync function assertMoveIntentRotationPreflight<TRuntime>(input: {\n  existingContainerId: string | null | undefined;\n  host: DocumentMoveIntentSyncHost<TRuntime>;\n  isCurrent: () => boolean;\n  intent: DocumentMoveIntentRecord;\n}): Promise<Uint8Array | null> {\n  if (!input.isCurrent()) return null;\n  const preflightStore = input.host.openDocumentStore({\n    // The optimistic move already changed local placement. Use that scope so\n    // opening the destination view cannot invalidate this shared store's proof.\n    // Remote link-set authorization still uses the intent's source below.\n    containerId: input.existingContainerId ?? input.intent.targetContainerId,\n    documentId: input.intent.documentId,\n    localId: input.intent.localId,\n  });\n  if (!(await preflightStore.ensureInitialized())) {\n    throw new Error(\"Document rotation preflight could not load the document\");\n  }\n  if (!input.isCurrent()) return null;\n  const rotationSnapshot = await preflightStore.assertCanRotateContentKey();\n  return input.isCurrent() ? rotationSnapshot : null;\n}\n\nasync function movePendingDocumentIntent<TRuntime>(input: {\n  existingContainerId: string | null | undefined;\n  host: DocumentMoveIntentSyncHost<TRuntime>;\n  isCurrent: () => boolean;\n  intent: DocumentMoveIntentRecord;\n  onFailure: DocumentLinkSetFailureHandler;\n  state: DocumentMoveIntentSyncState;\n}) {\n  // Adding links keeps the content key and needs no full-history rotation proof.\n  const linkOnly = input.intent.intentType === DOCUMENT_LINK_INTENT_TYPE;\n  const rotationSnapshot =\n    linkOnly && !input.intent.removedLinkContainerIds?.length\n      ? new Uint8Array()\n      : await assertMoveIntentRotationPreflight(input);\n  if (!rotationSnapshot || !input.isCurrent()) return \"abandoned\" as const;\n  return moveRemoteContainerDocument({\n    linkOnly,\n    additionalLinkContainerIds: input.intent.additionalLinkContainerIds,\n    removedLinkContainerIds: input.intent.removedLinkContainerIds,\n    currentContainerId:\n      input.intent.sourceContainerId ??\n      input.existingContainerId ??\n      input.intent.targetContainerId,\n    documentId: input.intent.documentId,\n    isCurrent: input.isCurrent,\n    noteId: input.intent.localId,\n    onFailure: input.onFailure,\n    replaceLinkedContainers: input.intent.replaceLinkedContainers,\n    resolveProjectionUserKey: input.state.resolveProjectionUserKey,\n    rotationSnapshot,\n    runtime: input.state.runtime,\n    targetContainerId: input.intent.targetContainerId,\n  });\n}\n\nasync function resolveMoveIntentPreflight(input: {\n  isCreatePending: (containerId: string) => boolean;\n  isRemoteSyncBlocked: (organizationId: string) => boolean;\n  isCurrent: () => boolean;\n  intent: DocumentMoveIntentRecord;\n  state: DocumentMoveIntentSyncState;\n}): Promise<\n  | { existingDocument: DocumentRecord; result?: undefined }\n  | { existingDocument?: undefined; result: DocumentMoveIntentReplayResult }\n> {\n  const { intent, state } = input;\n  const execSql = state.runtime.infra.execSql;\n  const existingDocument = await defaultDocumentsPersistence.loadDocument(\n    execSql,\n    intent.localId,\n  );\n  if (!input.isCurrent()) return { result: \"abandoned\" };\n  if (!existingDocument || existingDocument.documentId !== intent.documentId) {\n    await recordPendingDocumentMoveIntentError({\n      blocked: true,\n      documentId: intent.documentId,\n      expectedIntentId: intent.id,\n      expectedUpdatedAt: intent.updatedAt,\n      isCurrent: input.isCurrent,\n      message: \"Document move intent references a missing local document\",\n      state,\n    });\n    return { result: \"blocked\" };\n  }\n\n  for (const targetId of new Set([\n    intent.targetContainerId,\n    ...(intent.additionalLinkContainerIds ?? []),\n  ])) {\n    const targetState = state.containersById.get(targetId);\n    if (!targetState) {\n      await recordPendingDocumentMoveIntentError({\n        blocked: true,\n        documentId: intent.documentId,\n        expectedIntentId: intent.id,\n        expectedUpdatedAt: intent.updatedAt,\n        isCurrent: input.isCurrent,\n        message:\n          \"Document move intent references a missing destination container\",\n        state,\n      });\n      return { result: \"blocked\" };\n    }\n    if (input.isRemoteSyncBlocked(targetState.container.organizationId)) {\n      return { result: \"blocked\" };\n    }\n    if (\n      !hasRemoteContainerMetadataState(targetState) ||\n      input.isCreatePending(targetId)\n    ) {\n      await recordPendingDocumentMoveIntentError({\n        documentId: intent.documentId,\n        expectedIntentId: intent.id,\n        expectedUpdatedAt: intent.updatedAt,\n        isCurrent: input.isCurrent,\n        message: \"Document move destination container is not synced yet\",\n        state,\n      });\n      return { result: \"failed\" };\n    }\n  }\n  return { existingDocument };\n}\n\nasync function recordRejectedDocumentMove(input: {\n  failure: DocumentMoveFailureState;\n  intent: DocumentMoveIntentRecord;\n  isCurrent: () => boolean;\n  state: DocumentMoveIntentSyncState;\n  unavailable: boolean;\n}): Promise<void> {\n  await recordPendingDocumentMoveIntentError({\n    // A permission denial parks the intent for the access-restored signal\n    // instead of replaying on every structural pass (row 7).\n    denied: input.failure.sawPermissionDenial,\n    documentId: input.intent.documentId,\n    expectedIntentId: input.intent.id,\n    expectedUpdatedAt: input.intent.updatedAt,\n    isCurrent: input.isCurrent,\n    message: describeRejectedDocumentMove(input.failure),\n    state: input.state,\n    // Terminal only after the vanished-container refresh proved the\n    // destination itself gone: the intent can never commit as written and\n    // nothing on this device can heal it, so it leaves the replay set instead\n    // of re-issuing doomed requests every pass. The tombstone cascade\n    // retargets it once hydration tears the deleted container down locally.\n    // Every other vanished verdict stays pending for the next pass.\n    unavailable: input.unavailable,\n  });\n}\n\nfunction logSyncedDocumentMove(\n  intent: DocumentMoveIntentRecord,\n  state: DocumentMoveIntentSyncState,\n): void {\n  state.runtime.util.log(\n    `Container contents: synced queued document move ${intent.documentId}`,\n  );\n}\n\nasync function settleMovedDocumentIntent<TRuntime>(input: {\n  failure: DocumentMoveFailureState;\n  host: DocumentMoveIntentSyncHost<TRuntime>;\n  intent: DocumentMoveIntentRecord;\n  isCurrent: () => boolean;\n  moved: NonNullable<Awaited<ReturnType<typeof moveRemoteContainerDocument>>>;\n  state: DocumentMoveIntentSyncState;\n  unavailable: boolean;\n}): Promise<DocumentMoveIntentReplayResult> {\n  const { intent, moved, state } = input;\n  if (\n    !(await persistMovedDocumentReplay({\n      host: input.host,\n      intent,\n      isCurrent: input.isCurrent,\n      moved,\n      state,\n    }))\n  ) {\n    if (!input.isCurrent()) return \"abandoned\";\n    await recordPendingDocumentMoveIntentError({\n      documentId: intent.documentId,\n      expectedIntentId: intent.id,\n      expectedUpdatedAt: intent.updatedAt,\n      isCurrent: input.isCurrent,\n      message: \"Document move replay could not relink the local document\",\n      state,\n    });\n    return \"failed\";\n  }\n  if (moved.status === \"partial\") {\n    await recordPendingDocumentMoveIntentError({\n      // An unlink refused for permissions parks like any other denied\n      // move (row 7); other partials keep row 15's replay.\n      denied: input.failure.sawPermissionDenial,\n      documentId: intent.documentId,\n      expectedIntentId: intent.id,\n      expectedUpdatedAt: intent.updatedAt,\n      isCurrent: input.isCurrent,\n      message: \"Remote document move partially applied; retry required\",\n      state,\n      // Terminal only when the refresh proved the destination itself gone\n      // after the link had already landed; a vanished unlink alone stays\n      // pending with its live link for the next pass to revoke.\n      unavailable: input.unavailable,\n    });\n    return \"partial\";\n  }\n\n  logSyncedDocumentMove(intent, state);\n  return \"moved\";\n}\n\nasync function trySyncPendingDocumentMoveIntent<TRuntime>(input: {\n  host: DocumentMoveIntentSyncHost<TRuntime>;\n  isCreatePending: (containerId: string) => boolean;\n  isRemoteSyncBlocked: (organizationId: string) => boolean;\n  isCurrent: () => boolean;\n  intent: DocumentMoveIntentRecord;\n  state: DocumentMoveIntentSyncState;\n}): Promise<DocumentMoveIntentReplayResult> {\n  const { host, intent, state } = input;\n  const available = availableDocumentLinkIntent(intent, (id) =>\n    state.containersById.has(id),\n  );\n  const preflight = await resolveMoveIntentPreflight({\n    ...input,\n    intent: available.intent,\n  });\n  if (preflight.result !== undefined) {\n    return preflight.result;\n  }\n  const { existingDocument } = preflight;\n\n  try {\n    const outcome = await moveWithVanishedContainerRefresh({\n      apiClient: state.runtime.apiClient,\n      attempt: (onFailure) =>\n        movePendingDocumentIntent({\n          existingContainerId: existingDocument.containerId,\n          host,\n          isCurrent: input.isCurrent,\n          intent: available.intent,\n          onFailure,\n          state,\n        }),\n      execSql: state.runtime.infra.execSql,\n      existingContainerId: existingDocument.containerId,\n      intent: available.intent,\n      isCurrent: input.isCurrent,\n    });\n    if (outcome === \"abandoned\" || !input.isCurrent()) return \"abandoned\";\n    if (!outcome.moved) {\n      await recordRejectedDocumentMove({\n        failure: outcome.failure,\n        intent,\n        isCurrent: input.isCurrent,\n        state,\n        unavailable: outcome.unavailable,\n      });\n      return \"failed\";\n    }\n    return await settleMovedDocumentIntent({\n      failure: outcome.failure,\n      host,\n      intent,\n      isCurrent: input.isCurrent,\n      moved: available.deferred\n        ? { ...outcome.moved, status: \"partial\" }\n        : outcome.moved,\n      state,\n      unavailable: outcome.unavailable,\n    });\n  } catch (error: unknown) {\n    if (!input.isCurrent()) return \"abandoned\";\n    await reportAndRethrowKeyingVerificationError(\n      error,\n      state.runtime.util.reportSecurityIncident,\n      {\n        objectId: intent.documentId,\n        objectKind: \"document\",\n        operation: \"document.move.replay\",\n      },\n    );\n    if (!input.isCurrent()) return \"abandoned\";\n    const message = errorMessage(error);\n    await recordPendingDocumentMoveIntentError({\n      documentId: intent.documentId,\n      expectedIntentId: intent.id,\n      expectedUpdatedAt: intent.updatedAt,\n      isCurrent: input.isCurrent,\n      message: `Failed to sync document move: ${message}`,\n      state,\n    });\n    return \"failed\";\n  }\n}\n\nexport async function syncPendingDocumentMoveIntents<TRuntime>(input: {\n  host: DocumentMoveIntentSyncHost<TRuntime>;\n  /** A destination whose create has not settled takes no document yet. */\n  isCreatePending: (containerId: string) => boolean;\n  isCurrent: () => boolean;\n  isRemoteSyncBlocked: (organizationId: string) => boolean;\n  state: DocumentMoveIntentSyncState;\n}): Promise<number> {\n  if (!input.isCurrent()) return 0;\n  const lifecycleState = input.state;\n  const state = { ...lifecycleState };\n  const execSql = state.runtime.infra.execSql;\n  if (!deniedReplayMatchesGeneration(lifecycleState, execSql)) {\n    await sqlDocumentMoveIntentPersistence.resetDeniedMoveIntents(execSql);\n    if (!input.isCurrent()) return 0;\n    markDeniedReplayGeneration(lifecycleState, execSql);\n  }\n  const pendingIntents =\n    await sqlDocumentMoveIntentPersistence.listPendingMoveIntents(execSql);\n  if (!input.isCurrent()) return 0;\n  let movedCount = 0;\n\n  for (const intent of pendingIntents) {\n    if (!input.isCurrent()) return movedCount;\n    const result = await trySyncPendingDocumentMoveIntent({\n      host: input.host,\n      isCreatePending: input.isCreatePending,\n      isCurrent: input.isCurrent,\n      isRemoteSyncBlocked: input.isRemoteSyncBlocked,\n      intent,\n      state,\n    });\n    if (result === \"abandoned\") return movedCount;\n    // A \"partial\" result (link applied, unlink still pending) must not count:\n    // the caller re-arms this same structural lane whenever the count is\n    // positive, so a deterministically failing unlink hot-looped the pump\n    // (issue #1744). The intent row stays pending; event-driven, manual, and\n    // startup lane requests retry it.\n    if (result === \"moved\") {\n      movedCount += 1;\n    }\n  }\n\n  return movedCount;\n}\n"]}

package/workflows/container-contents/documentMoveVanishedRefresh.js

@@ -1,100 +0,0 @@
-import { isContainerNotFoundFailure } from "../../data/containers/shared/mutationFailures.js";
-import { readLinkedContainerIdsFromDocumentManifest } from "../../data/documents/shared/projection.js";
-import { listDocumentLinkedContainerIds } from "./documentLinks.js";
-import { createDocumentMoveFailureState, recordDocumentMoveFailure, } from "./documentMoveFailure.js";
-/**
- * Every container the unlink half of the move can cite. The unlink set is
- * read off the REMOTE document manifest's link set, so that set — refetched
- * after eviction so it is current — is the authority; the local link
- * projection, the intent's source, and the document's local placement are
- * unioned in so a source known only on one side still gets its cached path
- * refreshed. A superset is harmless: an eviction only forces a refetch, and
- * nothing here decides what gets unlinked.
- */
-async function listMoveSourceContainerIds(input) {
-    const { documentId, targetContainerId } = input.intent;
-    const [remote, local] = await Promise.all([
-        input.apiClient.getDocumentWriterProjectionResult(documentId, {
-            reportErrors: false,
-        }),
-        listDocumentLinkedContainerIds(input.execSql, documentId),
-    ]);
-    const remoteLinkedContainerIds = remote.ok
-        ? readLinkedContainerIdsFromDocumentManifest(remote.data)
-        : [];
-    return Array.from(new Set([
-        ...remoteLinkedContainerIds,
-        ...local,
-        input.intent.sourceContainerId,
-        input.existingContainerId,
-    ]))
-        .filter((containerId) => typeof containerId === "string" && containerId !== targetContainerId)
-        .sort();
-}
-/**
- * A vanished-container verdict (coded container 404 or `container_unavailable`
- * 409) does not by itself doom a queued move. The deleted container may be a
- * stale ANCESTOR in a cached path — the destination or a source was moved
- * under a live parent before its former parent was deleted — and the local
- * tombstone cascade cannot rescue that intent (it retargets only intents whose
- * source or destination IS the tombstoned container). So refresh before
- * declaring terminal: evict the cached destination, document, and source
- * projections, probe the destination, and retry once with the fresh paths.
- *
- * Only the destination's fate is terminal, and only as proven by its own
- * probe. Sources are evicted, never judged: the retry's unlink set comes from
- * the verified manifest alone, so a server-asserted "source gone" can neither
- * skip a revoke nor complete the move — a retry whose link landed but whose
- * unlink still vanished stays partial (pending) with a live link the queue
- * keeps trying to revoke. The retry's own vanished verdict, on either side, is
- * likewise never terminal: with the destination live it can only name another
- * ancestor deleted mid-pass, which the next pass's fresh paths outrun. The
- * pass is bounded to one retry; a transient probe failure leaves the intent
- * retriable (or denied on 403) for a later pass.
- */
-export async function moveWithVanishedContainerRefresh(input) {
-    const { apiClient, intent } = input;
-    const firstFailure = createDocumentMoveFailureState();
-    const first = await input.attempt((failure) => recordDocumentMoveFailure(firstFailure, failure));
-    if (first === "abandoned" || !input.isCurrent())
-        return "abandoned";
-    if (!firstFailure.sawVanishedContainer) {
-        return { failure: firstFailure, moved: first, unavailable: false };
-    }
-    for (const targetContainerId of new Set([
-        intent.targetContainerId,
-        ...(intent.additionalLinkContainerIds ?? []),
-    ])) {
-        apiClient.evictContainerWriterProjection(targetContainerId);
-        const destination = await apiClient.getContainerWriterProjectionResult(targetContainerId, { reportErrors: false });
-        apiClient.evictDocumentWriterProjection(intent.documentId);
-        if (!input.isCurrent())
-            return "abandoned";
-        if (!destination.ok) {
-            destination.report();
-            recordDocumentMoveFailure(firstFailure, destination);
-            return {
-                failure: firstFailure,
-                moved: first,
-                unavailable: isContainerNotFoundFailure(destination),
-            };
-        }
-    }
-    for (const sourceContainerId of await listMoveSourceContainerIds(input)) {
-        apiClient.evictContainerWriterProjection(sourceContainerId);
-    }
-    if (!input.isCurrent())
-        return "abandoned";
-    const retryFailure = createDocumentMoveFailureState();
-    const retried = await input.attempt((failure) => recordDocumentMoveFailure(retryFailure, failure));
-    if (retried === "abandoned" || !input.isCurrent())
-        return "abandoned";
-    // The retry's own vanished verdict is never terminal. The destination was
-    // just proven live, so a second `container_unavailable` can only name
-    // another ancestor deleted during the refreshed attempt (or a source): the
-    // intent stays pending with its failure recorded and the next pass starts
-    // over with freshly evicted projections. One retry per pass keeps it
-    // bounded; nothing in the queue backs a pending intent off between passes.
-    return { failure: retryFailure, moved: retried, unavailable: false };
-}
-//# sourceMappingURL=documentMoveVanishedRefresh.js.map

package/workflows/container-contents/documentMoveVanishedRefresh.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"documentMoveVanishedRefresh.js","sourceRoot":"","sources":["documentMoveVanishedRefresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,EAAE,0CAA0C,EAAE,MAAM,wCAAwC,CAAC;AAIpG,OAAO,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EACL,8BAA8B,EAE9B,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAc/B;;;;;;;;GAQG;AACH,KAAK,UAAU,0BAA0B,CAAC,KAKzC;IACC,MAAM,EAAE,UAAU,EAAE,iBAAiB,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;IACvD,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxC,KAAK,CAAC,SAAS,CAAC,iCAAiC,CAAC,UAAU,EAAE;YAC5D,YAAY,EAAE,KAAK;SACpB,CAAC;QACF,8BAA8B,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC;KAC1D,CAAC,CAAC;IACH,MAAM,wBAAwB,GAAG,MAAM,CAAC,EAAE;QACxC,CAAC,CAAC,0CAA0C,CAAC,MAAM,CAAC,IAAI,CAAC;QACzD,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,KAAK,CAAC,IAAI,CACf,IAAI,GAAG,CAAC;QACN,GAAG,wBAAwB;QAC3B,GAAG,KAAK;QACR,KAAK,CAAC,MAAM,CAAC,iBAAiB;QAC9B,KAAK,CAAC,mBAAmB;KAC1B,CAAC,CACH;SACE,MAAM,CACL,CAAC,WAAW,EAAyB,EAAE,CACrC,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,iBAAiB,CACvE;SACA,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAS,KAS9D;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACpC,MAAM,YAAY,GAAG,8BAA8B,EAAE,CAAC;IACtD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC5C,yBAAyB,CAAC,YAAY,EAAE,OAAO,CAAC,CACjD,CAAC;IACF,IAAI,KAAK,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,WAAW,CAAC;IACpE,IAAI,CAAC,YAAY,CAAC,oBAAoB,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,MAAM,iBAAiB,IAAI,IAAI,GAAG,CAAC;QACtC,MAAM,CAAC,iBAAiB;QACxB,GAAG,CAAC,MAAM,CAAC,0BAA0B,IAAI,EAAE,CAAC;KAC7C,CAAC,EAAE,CAAC;QACH,SAAS,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,kCAAkC,CACpE,iBAAiB,EACjB,EAAE,YAAY,EAAE,KAAK,EAAE,CACxB,CAAC;QACF,SAAS,CAAC,6BAA6B,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;YAAE,OAAO,WAAW,CAAC;QAC3C,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACpB,WAAW,CAAC,MAAM,EAAE,CAAC;YACrB,yBAAyB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YACrD,OAAO;gBACL,OAAO,EAAE,YAAY;gBACrB,KAAK,EAAE,KAAK;gBACZ,WAAW,EAAE,0BAA0B,CAAC,WAAW,CAAC;aACrD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,MAAM,iBAAiB,IAAI,MAAM,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,SAAS,CAAC,8BAA8B,CAAC,iBAAiB,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,WAAW,CAAC;IAE3C,MAAM,YAAY,GAAG,8BAA8B,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC9C,yBAAyB,CAAC,YAAY,EAAE,OAAO,CAAC,CACjD,CAAC;IACF,IAAI,OAAO,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;QAAE,OAAO,WAAW,CAAC;IACtE,0EAA0E;IAC1E,sEAAsE;IACtE,2EAA2E;IAC3E,0EAA0E;IAC1E,qEAAqE;IACrE,2EAA2E;IAC3E,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AACvE,CAAC","sourcesContent":["import { isContainerNotFoundFailure } from \"../../data/containers/shared/mutationFailures\";\nimport { readLinkedContainerIdsFromDocumentManifest } from \"../../data/documents/shared/projection\";\nimport type { DocumentMoveIntentRecord } from \"../../data/persistence/container-contents/documentMoveIntentPersistence\";\nimport type { ExecSql } from \"../../data/sqlite/sqlSchema\";\nimport type { DocumentLinkSetFailureHandler } from \"../documents\";\nimport { listDocumentLinkedContainerIds } from \"./documentLinks\";\nimport {\n  createDocumentMoveFailureState,\n  type DocumentMoveFailureState,\n  recordDocumentMoveFailure,\n} from \"./documentMoveFailure\";\nimport type { ContainerContentsWorkflowRuntime } from \"./runtime\";\n\nexport interface VanishedContainerRefreshOutcome<TMoved> {\n  readonly failure: DocumentMoveFailureState;\n  readonly moved: TMoved;\n  /**\n   * Park the intent terminally. True only when the destination itself is\n   * proven gone: a coded 404 on its projection probe after eviction. No\n   * mutation verdict — first attempt or retry — is ever terminal.\n   */\n  readonly unavailable: boolean;\n}\n\n/**\n * Every container the unlink half of the move can cite. The unlink set is\n * read off the REMOTE document manifest's link set, so that set — refetched\n * after eviction so it is current — is the authority; the local link\n * projection, the intent's source, and the document's local placement are\n * unioned in so a source known only on one side still gets its cached path\n * refreshed. A superset is harmless: an eviction only forces a refetch, and\n * nothing here decides what gets unlinked.\n */\nasync function listMoveSourceContainerIds(input: {\n  apiClient: ContainerContentsWorkflowRuntime[\"apiClient\"];\n  execSql: ExecSql;\n  existingContainerId: string | null | undefined;\n  intent: DocumentMoveIntentRecord;\n}): Promise<string[]> {\n  const { documentId, targetContainerId } = input.intent;\n  const [remote, local] = await Promise.all([\n    input.apiClient.getDocumentWriterProjectionResult(documentId, {\n      reportErrors: false,\n    }),\n    listDocumentLinkedContainerIds(input.execSql, documentId),\n  ]);\n  const remoteLinkedContainerIds = remote.ok\n    ? readLinkedContainerIdsFromDocumentManifest(remote.data)\n    : [];\n  return Array.from(\n    new Set([\n      ...remoteLinkedContainerIds,\n      ...local,\n      input.intent.sourceContainerId,\n      input.existingContainerId,\n    ]),\n  )\n    .filter(\n      (containerId): containerId is string =>\n        typeof containerId === \"string\" && containerId !== targetContainerId,\n    )\n    .sort();\n}\n\n/**\n * A vanished-container verdict (coded container 404 or `container_unavailable`\n * 409) does not by itself doom a queued move. The deleted container may be a\n * stale ANCESTOR in a cached path — the destination or a source was moved\n * under a live parent before its former parent was deleted — and the local\n * tombstone cascade cannot rescue that intent (it retargets only intents whose\n * source or destination IS the tombstoned container). So refresh before\n * declaring terminal: evict the cached destination, document, and source\n * projections, probe the destination, and retry once with the fresh paths.\n *\n * Only the destination's fate is terminal, and only as proven by its own\n * probe. Sources are evicted, never judged: the retry's unlink set comes from\n * the verified manifest alone, so a server-asserted \"source gone\" can neither\n * skip a revoke nor complete the move — a retry whose link landed but whose\n * unlink still vanished stays partial (pending) with a live link the queue\n * keeps trying to revoke. The retry's own vanished verdict, on either side, is\n * likewise never terminal: with the destination live it can only name another\n * ancestor deleted mid-pass, which the next pass's fresh paths outrun. The\n * pass is bounded to one retry; a transient probe failure leaves the intent\n * retriable (or denied on 403) for a later pass.\n */\nexport async function moveWithVanishedContainerRefresh<TMoved>(input: {\n  apiClient: ContainerContentsWorkflowRuntime[\"apiClient\"];\n  attempt: (\n    onFailure: DocumentLinkSetFailureHandler,\n  ) => Promise<TMoved | \"abandoned\">;\n  execSql: ExecSql;\n  existingContainerId: string | null | undefined;\n  intent: DocumentMoveIntentRecord;\n  isCurrent: () => boolean;\n}): Promise<VanishedContainerRefreshOutcome<TMoved> | \"abandoned\"> {\n  const { apiClient, intent } = input;\n  const firstFailure = createDocumentMoveFailureState();\n  const first = await input.attempt((failure) =>\n    recordDocumentMoveFailure(firstFailure, failure),\n  );\n  if (first === \"abandoned\" || !input.isCurrent()) return \"abandoned\";\n  if (!firstFailure.sawVanishedContainer) {\n    return { failure: firstFailure, moved: first, unavailable: false };\n  }\n\n  for (const targetContainerId of new Set([\n    intent.targetContainerId,\n    ...(intent.additionalLinkContainerIds ?? []),\n  ])) {\n    apiClient.evictContainerWriterProjection(targetContainerId);\n    const destination = await apiClient.getContainerWriterProjectionResult(\n      targetContainerId,\n      { reportErrors: false },\n    );\n    apiClient.evictDocumentWriterProjection(intent.documentId);\n    if (!input.isCurrent()) return \"abandoned\";\n    if (!destination.ok) {\n      destination.report();\n      recordDocumentMoveFailure(firstFailure, destination);\n      return {\n        failure: firstFailure,\n        moved: first,\n        unavailable: isContainerNotFoundFailure(destination),\n      };\n    }\n  }\n\n  for (const sourceContainerId of await listMoveSourceContainerIds(input)) {\n    apiClient.evictContainerWriterProjection(sourceContainerId);\n  }\n  if (!input.isCurrent()) return \"abandoned\";\n\n  const retryFailure = createDocumentMoveFailureState();\n  const retried = await input.attempt((failure) =>\n    recordDocumentMoveFailure(retryFailure, failure),\n  );\n  if (retried === \"abandoned\" || !input.isCurrent()) return \"abandoned\";\n  // The retry's own vanished verdict is never terminal. The destination was\n  // just proven live, so a second `container_unavailable` can only name\n  // another ancestor deleted during the refreshed attempt (or a source): the\n  // intent stays pending with its failure recorded and the next pass starts\n  // over with freshly evicted projections. One retry per pass keeps it\n  // bounded; nothing in the queue backs a pending intent off between passes.\n  return { failure: retryFailure, moved: retried, unavailable: false };\n}\n"]}