@milaboratories/pl-middle-layer 1.64.41 → 1.65.0

package/dist/middle_layer/middle_layer.js

@@ -1,10 +1,13 @@
 import { V2RegistryProvider } from "../block_registry/registry-v2-provider.js";
 import "../block_registry/index.js";
 import { ProjectMetaKey } from "../model/project_model.js";
-import { ProjectsField, ProjectsResourceType, createProjectList } from "./project_list.js";
+import { ProjectsField, ProjectsResourceType, createProjectList, ensureProjectListRid } from "./project_list.js";
+import { SharingOutboxField, SharingOutboxResourceType, SharingStateField, SharingStateResourceType, acceptanceFieldLogin, canGrantToEveryone, canImpersonate, decodeEnvelopeData, isAcceptanceField } from "../model/sharing_model.js";
 import { BlockPackPreparer } from "../mutator/block-pack/block_pack.js";
 import { getDebugFlags } from "../debug/index.js";
 import { createProject, duplicateProject, withProjectAuthored } from "../mutator/project.js";
+import { buildShareEnvelope, copyEnvelopeProjectsIntoList, envelopeProjectFieldUuid, isEnvelopeProjectField, resourceIdsToStrings, writeEnvelopeAcceptance, writeSharingDecision } from "../mutator/sharing.js";
+import { createLiveEnvelopesComputable, createOutgoingShares, createPendingSharesComputable, createPendingSharesTree, createSharingStateTree } from "./sharing_list.js";
 import { Project } from "./project.js";
 import { DefaultMiddleLayerOpsPaths, DefaultMiddleLayerOpsSettings } from "./ops.js";
 import { BlockUpdateWatcher } from "../block_registry/watcher.js";
@@ -13,8 +16,8 @@ import { createModelServiceRegistry } from "../service_factories.js";
 import { ProjectHelper } from "../model/project_helper.js";
 import { RuntimeCapabilities } from "@platforma-sdk/model";
 import { RetryAgent } from "undici";
-import { BlockEventDispatcher, HmacSha256Signer } from "@milaboratories/ts-helpers";
-import { field, isNotNullSignedResourceId, isNullSignedResourceId, resourceIdToString } from "@milaboratories/pl-client";
+import { BlockEventDispatcher, HmacSha256Signer, cachedDeserialize } from "@milaboratories/ts-helpers";
+import { GrantType, field, isEveryoneUserLogin, isNotNullSignedResourceId, isNullSignedResourceId, resourceIdToString } from "@milaboratories/pl-client";
 import { LRUCache } from "lru-cache";
 import { WatchableValue } from "@milaboratories/computable";
 import { randomUUID } from "node:crypto";
@@ -38,22 +41,38 @@ var MiddleLayer = class MiddleLayer {
 	driverKit;
 	signer;
 	projectListResourceId;
+	sharingOutboxResourceId;
+	sharingStateResourceId;
 	openedProjectsList;
 	projectListTree;
+	sharingOutboxTree;
+	sharingStateTree;
+	pendingSharesTree;
 	blockRegistryProvider;
-	pl;
-	/** Contains a reactive list of projects along with their meta information. */
 	projectList;
-	constructor(env, driverKit, signer, projectListResourceId, openedProjectsList, projectListTree, blockRegistryProvider, projectList) {
+	outgoingShares;
+	pendingShares;
+	liveEnvelopes;
+	pl;
+	constructor(env, driverKit, signer, projectListResourceId, sharingOutboxResourceId, sharingStateResourceId, openedProjectsList, projectListTree, sharingOutboxTree, sharingStateTree, pendingSharesTree, blockRegistryProvider, projectList, outgoingShares, pendingShares, liveEnvelopes) {
 		this.env = env;
 		this.driverKit = driverKit;
 		this.signer = signer;
 		this.projectListResourceId = projectListResourceId;
+		this.sharingOutboxResourceId = sharingOutboxResourceId;
+		this.sharingStateResourceId = sharingStateResourceId;
 		this.openedProjectsList = openedProjectsList;
 		this.projectListTree = projectListTree;
+		this.sharingOutboxTree = sharingOutboxTree;
+		this.sharingStateTree = sharingStateTree;
+		this.pendingSharesTree = pendingSharesTree;
 		this.blockRegistryProvider = blockRegistryProvider;
 		this.projectList = projectList;
+		this.outgoingShares = outgoingShares;
+		this.pendingShares = pendingShares;
+		this.liveEnvelopes = liveEnvelopes;
 		this.pl = this.env.pl;
+		this.startEnvelopeCleanup();
 	}
 	/**
 	* Get the OS where backend is running.
@@ -71,6 +90,52 @@ var MiddleLayer = class MiddleLayer {
 	get serverCapabilities() {
 		return this.pl.serverInfo.capabilities ?? [];
 	}
+	/**
+	* Login of the authenticated user, for the "Signed in as" UI. `null` when the
+	* backend has no auth (local/dev mode) — the UI hides the element.
+	*/
+	get currentUserLogin() {
+		return this.pl.userResources.authUser;
+	}
+	/**
+	* Whether the connected backend supports project sharing. Synthetic — computed
+	* in the middle layer from the backend capabilities the share flow needs (the
+	* cross-color field-reference relaxation the accept flow rests on). It can absorb
+	* additional required capabilities later without a UI change.
+	*/
+	get sharingSupported() {
+		return this.serverCapabilities.includes("crossTreeRefs:v1") && !this.impersonating;
+	}
+	/** True when this session is impersonating another user (an admin opened another user's root). */
+	get impersonating() {
+		return this.pl.conf.asUser !== void 0;
+	}
+	/**
+	* Role of the authenticated user, from the `GetSessionInfo` RPC surfaced through the
+	* pl-client. `null` in no-auth mode (when {@link currentUserLogin} is null).
+	*/
+	get currentUserRole() {
+		return this.pl.currentUserRole;
+	}
+	/**
+	* Whether the UI offers share-with-everybody — no role policy lives in the UI:
+	*   serverCapabilities.has("publicGrants:v1") && canGrantToEveryone(currentUserRole)
+	* Not a security boundary: a crafted call still hits the backend's role +
+	* permission-ceiling gate.
+	*/
+	get canShareWithEveryone() {
+		return !this.impersonating && this.serverCapabilities.includes("publicGrants:v1") && canGrantToEveryone(this.currentUserRole);
+	}
+	/**
+	* Whether the authenticated user may impersonate others (open another user's root). Mirrors
+	* the backend's `CanImpersonate` role gate — admin/controller only, never a regular user.
+	* Derived from the session role, which stays the authenticated admin's even while
+	* impersonating, so this stays true across a switch: the "return to my root" affordance must
+	* not vanish mid-impersonation. Not a security boundary; the backend re-checks on every call.
+	*/
+	get currentUserCanImpersonate() {
+		return canImpersonate(this.currentUserRole);
+	}
 	/** Adds a runtime capability to the middle layer. */
 	addRuntimeCapability(requirement, value = true) {
 		this.env.runtimeCapabilities.addSupportedRequirement(requirement, value);
@@ -170,6 +235,385 @@ var MiddleLayer = class MiddleLayer {
 		this.projectIdCache.set(newProjectId, signedRid);
 		return newProjectId;
 	}
+	/**
+	* Duplicates a project into another user's root, minted in the TARGET user's color so the target
+	* owns it. Sibling of {@link duplicateProject}, but writes into a different root. The source
+	* project (on the current client root) is referenced cross-color for its block data, kept alive
+	* by refcounting, exactly like accepting a shared project. Works both ways: pull (while
+	* impersonating a user, copy their project to yourself) and push (from your own root, copy a
+	* project to a user). Admin cross-root op; requires the crossTreeRefs:v1 backend capability.
+	*/
+	async duplicateProjectToUser(srcProjectId, targetLogin, rename) {
+		if (!this.serverCapabilities.includes("crossTreeRefs:v1")) throw new Error("duplicateProjectToUser requires the crossTreeRefs:v1 backend capability.");
+		const sourceRid = await this.resolveProjectId(srcProjectId);
+		const targetRoot = await this.pl.getUserRoot({
+			login: targetLogin,
+			createIfNotExists: true
+		});
+		await this.pl.withWriteTxOnRoot(targetRoot, "MLDuplicateProjectToUser", async (tx) => {
+			const targetProjectListRid = await ensureProjectListRid(tx);
+			const sourceMeta = await tx.getKValueJson(sourceRid, ProjectMetaKey);
+			const targetListData = await tx.getResourceData(targetProjectListRid, true);
+			const existingLabels = (await Promise.all(targetListData.fields.map((f) => f.value).filter(isNotNullSignedResourceId).map((rid) => tx.getKValueJson(rid, ProjectMetaKey)))).map((m) => m.label);
+			const newPrj = await duplicateProject(tx, sourceRid, { label: rename ? rename(sourceMeta.label, existingLabels) : sourceMeta.label });
+			tx.createField(field(targetProjectListRid, randomUUID()), "Dynamic", newPrj);
+			await tx.commit();
+		});
+	}
+	/**
+	* Shares the given projects (Copy & Share). Snapshots the projects, creates one envelope, and
+	* grants it — all in one atomic write transaction, so a failed grant rolls the whole thing back
+	* and the outbox is left as it was.
+	*
+	* Two variants (see {@link ShareProjectsOptions}):
+	* - `{ recipients }` — one writable grant per named recipient; the envelope expires after the
+	*   default TTL (`sharedAt + envelopeTtlMs`).
+	* - `{ everyone: true }` — one make-public grant (backend rewrites the target to the
+	*   everyone-user); the envelope's `expiresAt` is `null`, so it never expires.
+	*
+	* v1 always passes `mode: "copy"`.
+	*/
+	async shareProjects(projectIds, options) {
+		if (projectIds.length === 0) throw new Error("shareProjects: no projects given");
+		if ("everyone" in options && options.replace) {
+			const priorEveryone = (await this.findSupersedableEnvelopes(projectIds)).find((p) => p.everyone);
+			if (priorEveryone !== void 0) {
+				await this.changeShare(priorEveryone.shareId, { title: options.title });
+				return;
+			}
+		}
+		await this.createNewShare(projectIds, options);
+	}
+	/**
+	* Mints a fresh share: snapshots the projects into one new envelope (a fresh shareId),
+	* supersedes prior shares of the same project, and grants it — all in one atomic write
+	* transaction, so a failed grant rolls the whole thing back and the outbox is left as it was.
+	* The everyone-refresh path is the {@link changeShare} branch of {@link shareProjects}; this is
+	* the mint-a-new-envelope branch.
+	*/
+	async createNewShare(projectIds, options) {
+		const everyone = "everyone" in options;
+		const sources = await Promise.all(projectIds.map(async (id) => ({
+			kind: "fresh",
+			projectId: id,
+			sourceRid: await this.resolveProjectId(id)
+		})));
+		const sender = this.currentUserLogin ?? "";
+		const expiresAt = everyone ? null : Date.now() + this.env.ops.envelopeTtlMs;
+		const priors = await this.findSupersedableEnvelopes(projectIds);
+		await this.pl.withWriteTx("MLShareProjects", async (tx) => {
+			if (everyone) {
+				for (const prior of priors) if (prior.everyone) tx.removeField(field(this.sharingOutboxResourceId, prior.fieldName));
+			} else {
+				const newRecipients = new Set(options.recipients);
+				for (const prior of priors) {
+					if (prior.everyone) continue;
+					const toRemove = prior.recipients.filter((u) => newRecipients.has(u));
+					if (toRemove.length === 0) continue;
+					if (prior.recipients.filter((u) => !newRecipients.has(u)).length === 0) tx.removeField(field(this.sharingOutboxResourceId, prior.fieldName));
+					else for (const u of toRemove) tx.revokeAccess(prior.rid, u);
+				}
+			}
+			const { envelope } = await buildShareEnvelope(tx, this.sharingOutboxResourceId, sources, {
+				mode: options.mode,
+				sender,
+				title: options.title,
+				expiresAt
+			});
+			const envelopeGid = await envelope.globalId;
+			if (everyone) tx.grantAccess(envelopeGid, "", { writable: true }, GrantType.ANY_AUTHORISED);
+			else for (const recipient of options.recipients) tx.grantAccess(envelopeGid, recipient, { writable: true });
+			await tx.commit();
+		});
+		await this.sharingOutboxTree.refreshState();
+	}
+	/**
+	* Changes a share in place (same {@link ShareId}), in one write transaction: re-snapshots live
+	* source projects and carries deleted ones' snapshots forward; applies edited recipients/title;
+	* transfers already-decided recipients' accept/reject records (they keep their copy and aren't
+	* re-prompted); re-grants; drops the old envelope.
+	*
+	* `opts.recipients` is the full targeted set (decided users are always kept). `opts.title`
+	* replaces the title — omit keeps the current one. `opts.everyone` upgrades targeted ->
+	* everyone; the reverse is impossible and ignored.
+	*
+	* `opts.projectActions` is a per-source-project decision, keyed by projectId: `update`
+	* re-snapshots the live source (falls back to carry if the source is gone), `keep` carries the
+	* existing snapshot (and its timestamp), `remove` drops the project from the pack. A project not
+	* in the map defaults to `keep`. Omit the whole map for the legacy auto behavior (live sources
+	* updated, gone ones kept) — the everyone-refresh path relies on that.
+	*/
+	async changeShare(shareId, opts = {}) {
+		await this.pl.withWriteTx("MLChangeShare", async (tx) => {
+			const old = await this.resolveOutboxEnvelope(tx, shareId);
+			if (old === void 0) throw new Error(`changeShare: no live share with id ${shareId} in the outbox.`);
+			const self = this.currentUserLogin ?? "";
+			const grants = await tx.listGrants(old.rid);
+			const everyone = grants.some((g) => isEveryoneUserLogin(g.user)) || opts.everyone === true;
+			const oldRd = await tx.getResourceData(old.rid, true);
+			const snapshotByUuid = /* @__PURE__ */ new Map();
+			const acceptances = [];
+			for (const f of oldRd.fields) {
+				if (isNullSignedResourceId(f.value)) continue;
+				if (isEnvelopeProjectField(f.name)) snapshotByUuid.set(envelopeProjectFieldUuid(f.name), f.value);
+				else if (isAcceptanceField(f.name)) {
+					const raw = (await tx.getResourceData(f.value, false)).data;
+					if (raw === void 0) continue;
+					acceptances.push({
+						login: acceptanceFieldLogin(f.name),
+						acc: cachedDeserialize(raw)
+					});
+				}
+			}
+			const decidedLogins = acceptances.map((a) => a.login);
+			const priorRecipients = grants.filter((g) => !isEveryoneUserLogin(g.user) && g.user !== self).map((g) => g.user);
+			const recipients = everyone ? [] : Array.from(/* @__PURE__ */ new Set([...opts.recipients ?? priorRecipients, ...decidedLogins]));
+			const liveProjects = /* @__PURE__ */ new Map();
+			const projList = await tx.getResourceData(this.projectListResourceId, true);
+			for (const f of projList.fields) {
+				if (isNullSignedResourceId(f.value)) continue;
+				liveProjects.set(resourceIdToString(f.value), f.value);
+			}
+			const actions = opts.projectActions;
+			const sources = [];
+			for (const uuid of Object.keys(old.data.projects)) {
+				const { label, source, updatedAt } = old.data.projects[uuid];
+				const liveRid = liveProjects.get(source);
+				const action = actions ? actions[source] ?? "keep" : liveRid !== void 0 ? "update" : "keep";
+				if (action === "remove") continue;
+				if (action === "update" && liveRid !== void 0) sources.push({
+					kind: "fresh",
+					projectId: source,
+					sourceRid: liveRid
+				});
+				else {
+					const snapshotRid = snapshotByUuid.get(uuid);
+					if (snapshotRid !== void 0) sources.push({
+						kind: "carry",
+						projectId: source,
+						label,
+						snapshotRid,
+						updatedAt
+					});
+				}
+			}
+			const title = opts.title === void 0 ? old.data.title : opts.title.trim();
+			const expiresAt = everyone ? null : Date.now() + this.env.ops.envelopeTtlMs;
+			tx.removeField(field(this.sharingOutboxResourceId, old.fieldName));
+			const { envelope } = await buildShareEnvelope(tx, this.sharingOutboxResourceId, sources, {
+				mode: old.data.mode,
+				sender: self,
+				title,
+				expiresAt,
+				shareId
+			});
+			for (const { login, acc } of acceptances) {
+				if (!everyone && !recipients.includes(login)) continue;
+				writeEnvelopeAcceptance(tx, envelope, login, acc.action, acc.timestamp);
+			}
+			const gid = await envelope.globalId;
+			if (everyone) tx.grantAccess(gid, "", { writable: true }, GrantType.ANY_AUTHORISED);
+			else for (const r of recipients) tx.grantAccess(gid, r, { writable: true });
+			await tx.commit();
+		});
+		await this.sharingOutboxTree.refreshState();
+	}
+	/**
+	* Finds the donor's own outgoing envelopes built from any of the given source projects —
+	* the supersede candidates for a fresh share of the same project(s). Reads each envelope's
+	* recipient set via `ListGrants` so the caller can pull individual recipients or detect an
+	* everyone-share.
+	*/
+	async findSupersedableEnvelopes(projectIds) {
+		const wanted = new Set(projectIds);
+		const matched = await this.pl.withReadTx("MLFindSupersede", async (tx) => {
+			const outbox = await tx.getResourceData(this.sharingOutboxResourceId, true);
+			const out = [];
+			for (const f of outbox.fields) {
+				if (isNullSignedResourceId(f.value)) continue;
+				const rd = await tx.getResourceData(f.value, false);
+				if (rd.data === void 0) continue;
+				const data = decodeEnvelopeData(rd.data);
+				if (Object.values(data.projects).some((p) => wanted.has(p.source))) out.push({
+					fieldName: f.name,
+					rid: f.value,
+					shareId: data.shareId
+				});
+			}
+			return out;
+		});
+		return await Promise.all(matched.map(async ({ fieldName, rid, shareId }) => {
+			const grants = await this.pl.userResources.listGrants(rid);
+			return {
+				fieldName,
+				rid,
+				shareId,
+				everyone: grants.some((g) => isEveryoneUserLogin(g.user)),
+				recipients: grants.filter((g) => !isEveryoneUserLogin(g.user)).map((g) => g.user)
+			};
+		}));
+	}
+	/**
+	* Revokes and deletes an outgoing share for all recipients: detaches and deletes the envelope, and
+	* its grants are revoked along with it. Already-accepted copies are unaffected (ref-counting keeps
+	* the adopted resources alive). Idempotent — revoking a share that is already gone is a no-op.
+	*/
+	async revokeShare(shareId) {
+		await this.pl.withWriteTx("MLRevokeShare", async (tx) => {
+			const target = await this.resolveOutboxEnvelope(tx, shareId);
+			if (target === void 0) return;
+			tx.removeField(field(this.sharingOutboxResourceId, target.fieldName));
+			await tx.commit();
+		});
+		await this.sharingOutboxTree.refreshState();
+	}
+	/**
+	* Resolves a live envelope from the donor's own outbox by its logical `shareId`, returning the
+	* outbox field name (for detach), the signed envelope id, and its decoded {@link EnvelopeData}.
+	* The outbox is keyed by `{shareId}` directly, but a replaced/legacy share may have drifted, so
+	* we match on the decoded `shareId` rather than the field name alone.
+	*/
+	async resolveOutboxEnvelope(tx, shareId) {
+		const outboxData = await tx.getResourceData(this.sharingOutboxResourceId, true);
+		for (const f of outboxData.fields) {
+			if (isNullSignedResourceId(f.value)) continue;
+			const rd = await tx.getResourceData(f.value, false);
+			if (rd.data === void 0) continue;
+			const data = decodeEnvelopeData(rd.data);
+			if (data.shareId === shareId) return {
+				fieldName: f.name,
+				rid: f.value,
+				data
+			};
+		}
+	}
+	/**
+	* Resolves currently-shared envelopes (granted to this user) to their resource ids, keyed by
+	* the envelope's logical `shareId`.
+	*
+	* Reads the {@link liveEnvelopes} Computable — the same shared-resource discovery tree that
+	* feeds {@link pendingShares}. This is the single discovery mechanism: there is no separate
+	* `ListUserResources` re-stream on every accept/reject. `refreshState()` is awaited first so a
+	* just-granted envelope is observed (the tree's discovery poll may otherwise lag a freshly
+	* landed grant). The tree is gRPC-only, so this is empty on a REST-connected client.
+	*/
+	async resolveLiveEnvelopes() {
+		await this.pendingSharesTree.refreshState();
+		const live = await this.liveEnvelopes.getValue() ?? [];
+		const map = /* @__PURE__ */ new Map();
+		for (const e of live) map.set(e.data.shareId, e);
+		return map;
+	}
+	/**
+	* Accepts one or more pending shares: duplicates each share's projects into this user's
+	* project list, records the decision per share, and (read-write share) writes the donor-visible
+	* acceptance onto the envelope. Per-share failures (e.g. an expiry race) are collected, not
+	* short-circuited — the rest still get accepted. Accept-all = pass every current pending shareId.
+	*
+	* `rename` resolves label collisions (same callback contract as {@link duplicateProject}), but
+	* the source lives in the envelope tree, so accept calls the low-level mutator directly.
+	*/
+	async acceptShare(shareIds, rename) {
+		const live = await this.resolveLiveEnvelopes();
+		const login = this.currentUserLogin;
+		const accepted = [];
+		const failed = [];
+		for (const shareId of shareIds) {
+			const envelope = live.get(shareId);
+			if (envelope === void 0) {
+				failed.push({
+					shareId,
+					error: "Share is no longer available."
+				});
+				continue;
+			}
+			try {
+				const now = Date.now();
+				const createdRids = await this.pl.withWriteTx("MLAcceptShare", async (tx) => {
+					const created = await copyEnvelopeProjectsIntoList(tx, envelope.rid, this.projectListResourceId, rename);
+					writeSharingDecision(tx, this.sharingStateResourceId, shareId, {
+						decision: "accepted",
+						timestamp: now,
+						envelopeSharedAt: envelope.data.sharedAt,
+						acceptedProjects: resourceIdsToStrings(created)
+					});
+					if (login !== null && envelope.data.mode !== "read-only") writeEnvelopeAcceptance(tx, envelope.rid, login, "accepted", now);
+					await tx.commit();
+					return created;
+				});
+				for (const rid of createdRids) {
+					const projectId = resourceIdToString(rid);
+					this.projectIdCache.set(projectId, rid);
+					accepted.push(projectId);
+				}
+			} catch (e) {
+				failed.push({
+					shareId,
+					error: e instanceof Error ? e.message : String(e)
+				});
+			}
+		}
+		await Promise.all([this.projectListTree.refreshState(), this.sharingStateTree.refreshState()]);
+		return {
+			accepted,
+			failed
+		};
+	}
+	/** Records rejection of a pending share; it never surfaces again. */
+	async rejectShare(shareId) {
+		const envelope = (await this.resolveLiveEnvelopes()).get(shareId);
+		const login = this.currentUserLogin;
+		const now = Date.now();
+		await this.pl.withWriteTx("MLRejectShare", async (tx) => {
+			writeSharingDecision(tx, this.sharingStateResourceId, shareId, {
+				decision: "rejected",
+				timestamp: now,
+				envelopeSharedAt: envelope?.data.sharedAt ?? now,
+				acceptedProjects: []
+			});
+			if (envelope !== void 0 && login !== null && envelope.data.mode !== "read-only") writeEnvelopeAcceptance(tx, envelope.rid, login, "rejected", now);
+			await tx.commit();
+		});
+		await this.sharingStateTree.refreshState();
+	}
+	static EnvelopeCleanupIntervalMs = 6 * 3600 * 1e3;
+	envelopeCleanupTimer;
+	/** On ML start and every 6h, delete envelopes whose immutable `expiresAt` has passed. */
+	startEnvelopeCleanup() {
+		this.runEnvelopeCleanup();
+		this.envelopeCleanupTimer = setInterval(() => {
+			this.runEnvelopeCleanup();
+		}, MiddleLayer.EnvelopeCleanupIntervalMs);
+		this.envelopeCleanupTimer.unref?.();
+	}
+	/** Scans the donor's outbox and deletes expired envelopes (backend auto-revokes their grants).
+	*  Envelopes with `expiresAt: null` (share-with-everybody) are skipped. */
+	async runEnvelopeCleanup() {
+		try {
+			const now = Date.now();
+			const expired = await this.pl.withReadTx("MLEnvelopeCleanupScan", async (tx) => {
+				const data = await tx.getResourceData(this.sharingOutboxResourceId, true);
+				const toDelete = [];
+				for (const f of data.fields) {
+					if (isNullSignedResourceId(f.value)) continue;
+					const rd = await tx.getResourceData(f.value, false);
+					if (rd.data === void 0) continue;
+					const envData = decodeEnvelopeData(rd.data);
+					if (envData.expiresAt === null) continue;
+					if (envData.expiresAt <= now) toDelete.push({ fieldName: f.name });
+				}
+				return toDelete;
+			});
+			if (expired.length === 0) return;
+			await this.pl.withWriteTx("MLEnvelopeCleanup", async (tx) => {
+				for (const { fieldName } of expired) tx.removeField(field(this.sharingOutboxResourceId, fieldName));
+				await tx.commit();
+			});
+			await this.sharingOutboxTree.refreshState();
+		} catch (e) {
+			this.env.logger.warn(`envelope cleanup failed: ${e instanceof Error ? e.message : String(e)}`);
+		}
+	}
 	openedProjects = /* @__PURE__ */ new Map();
 	/** Opens a project, and starts corresponding project maintenance loop. */
 	async openProject(id) {
@@ -202,8 +646,14 @@ var MiddleLayer = class MiddleLayer {
 	* them.
 	*/
 	async close() {
+		if (this.envelopeCleanupTimer !== void 0) clearInterval(this.envelopeCleanupTimer);
 		await Promise.all([...this.openedProjects.values()].map((prj) => prj.destroy()));
-		await this.projectListTree.terminate();
+		await Promise.all([
+			this.projectListTree.terminate(),
+			this.sharingOutboxTree.terminate(),
+			this.sharingStateTree.terminate(),
+			this.pendingSharesTree.terminate()
+		]);
 		await this.env.dispose();
 		await this.pl.close();
 	}
@@ -230,17 +680,28 @@ var MiddleLayer = class MiddleLayer {
 		ops.defaultTreeOptions.logStat = getDebugFlags().logTreeStats;
 		ops.debugOps.dumpInitialTreeState = getDebugFlags().dumpInitialTreeState;
 		if (ops.defaultTreeOptions.traversalMode === void 0 && getDebugFlags().treeTraversalMode !== void 0) ops.defaultTreeOptions.traversalMode = getDebugFlags().treeTraversalMode;
-		const projects = await pl.withWriteTx("MLInitialization", async (tx) => {
-			const projectsField = field(tx.clientRoot, ProjectsField);
-			tx.createField(projectsField, "Dynamic");
-			const projectsFieldData = await tx.getField(projectsField);
-			if (isNullSignedResourceId(projectsFieldData.value)) {
-				const projects = tx.createEphemeral(ProjectsResourceType);
-				tx.lock(projects);
-				tx.setField(projectsField, projects);
-				await tx.commit();
-				return await projects.globalId;
-			} else return projectsFieldData.value;
+		const { projects, sharingOutbox, sharingState } = await pl.withWriteTx("MLInitialization", async (tx) => {
+			const lazyInit = async (fieldName, type) => {
+				const f = field(tx.clientRoot, fieldName);
+				tx.createField(f, "Dynamic");
+				const fData = await tx.getField(f);
+				if (isNullSignedResourceId(fData.value)) {
+					const ref = tx.createEphemeral(type);
+					tx.lock(ref);
+					tx.setField(f, ref);
+					return { ref };
+				}
+				return { existing: fData.value };
+			};
+			const projectsR = await lazyInit(ProjectsField, ProjectsResourceType);
+			const outboxR = await lazyInit(SharingOutboxField, SharingOutboxResourceType);
+			const stateR = await lazyInit(SharingStateField, SharingStateResourceType);
+			await tx.commit();
+			return {
+				projects: projectsR.existing ?? await projectsR.ref.globalId,
+				sharingState: stateR.existing ?? await stateR.ref.globalId,
+				sharingOutbox: outboxR.existing ?? await outboxR.ref.globalId
+			};
 		});
 		const logger = ops.logger;
 		const driverKit = await initDriverKit(pl, workdir, ops.frontendDownloadPath, ops);
@@ -283,7 +744,12 @@ var MiddleLayer = class MiddleLayer {
 		};
 		const openedProjects = new WatchableValue([]);
 		const projectListTC = await createProjectList(pl, projects, openedProjects, env);
-		return new MiddleLayer(env, driverKit, driverKit.signer, projects, openedProjects, projectListTC.tree, v2RegistryProvider, projectListTC.computable);
+		const outgoingTC = await createOutgoingShares(pl, sharingOutbox, env);
+		const sharingStateTree = await createSharingStateTree(pl, sharingState, env);
+		const pendingSharesTree = await createPendingSharesTree(pl, env);
+		const pendingShares = createPendingSharesComputable(pendingSharesTree, sharingStateTree, pl.userResources.authUser);
+		const liveEnvelopes = createLiveEnvelopesComputable(pendingSharesTree);
+		return new MiddleLayer(env, driverKit, driverKit.signer, projects, sharingOutbox, sharingState, openedProjects, projectListTC.tree, outgoingTC.tree, sharingStateTree, pendingSharesTree, v2RegistryProvider, projectListTC.computable, outgoingTC.computable, pendingShares, liveEnvelopes);
 	}
 };
 //#endregion