@milaboratories/pl-middle-layer 1.71.16 → 1.72.0

package/dist/middle_layer/middle_layer.d.ts

@@ -3,10 +3,11 @@ import { TemplateApplyReport } from "../model/template_apply.js";
 import { BlockPackProvider, TemplateResolveOutcome } from "../model/template_resolve.js";
 import "../block_registry/index.js";
 import { ProjectId as ProjectId$1, ProjectListEntry as ProjectListEntry$1 } from "../model/project_model.js";
-import { ProjectChangeAction, ShareId, ShareProjectsOptions, ShareTemplateOptions } from "../model/sharing_model.js";
-import { CreateProjectFromTemplateOutcome, SaveProjectAsTemplateOutcome, ShareTemplateOutcome, StoredTemplateData, TemplateId, TemplateListEntry } from "./template_list.js";
+import { CreateProjectFromTemplateOutcome, SaveProjectAsTemplateOutcome, StoredTemplateData, TemplateId as TemplateId$1, TemplateListEntry } from "./template_list.js";
+import { FoldersListing } from "./folders.js";
 import { ProjectTemplateExportOutcome } from "../model/template_serializer.js";
-import { OutgoingShare, PendingShare } from "./sharing_list.js";
+import { ShareFolderOptions, ShareId, ShareOutcome, ShareProjectsOptions, ShareTemplateOptions } from "../model/sharing_model.js";
+import { AvailableShare, OutgoingShare } from "./sharing_list.js";
 import "../model/index.js";
 import { BlockPackPreparer } from "../mutator/block-pack/block_pack.js";
 import { Project } from "./project.js";
@@ -16,7 +17,7 @@ import { MiddleLayerDriverKit } from "./driver_kit.js";
 import { ProjectHelper } from "../model/project_helper.js";
 import { TreeSnapshotStat, TreeSnapshotStore } from "./tree_snapshot_store.js";
 import { BlockCodeFeatureFlags, DriverKit, RuntimeCapabilities, SupportedRequirement } from "@platforma-sdk/model";
-import { AuthorMarker, BlockPlatform, ProjectMeta } from "@milaboratories/pl-model-middle-layer";
+import { AuthorMarker, BlockPlatform, FolderId, FoldersItem, FoldersMoveOutcome, FoldersMovePlan, FoldersMovePlanResult, FoldersRemoval, FoldersRemovalOutcome, FoldersRemovalPlanResult, ProjectMeta } from "@milaboratories/pl-model-middle-layer";
 import { Dispatcher } from "undici";
 import { BlockEventDispatcher, MiLogger, Signer } from "@milaboratories/ts-helpers";
 import { ModelServiceRegistry, ProjectTemplateV1 } from "@milaboratories/pl-model-common";
@@ -66,25 +67,29 @@ export declare class MiddleLayer {
   private readonly templateListResourceId;
   private readonly sharingOutboxResourceId;
   private readonly sharingStateResourceId;
+  private readonly foldersResourceId;
   private readonly openedProjectsList;
   private readonly projectListTree;
   private readonly templateListTree;
+  private readonly foldersTree;
   private readonly sharingOutboxTree;
   private readonly sharingStateTree;
-  private readonly pendingSharesTree;
+  private readonly availableSharesTree;
   readonly blockRegistryProvider: V2RegistryProvider;
   /** Contains a reactive list of projects along with their meta information. */
   readonly projectList: ComputableStableDefined<ProjectListEntry$1[]>;
   /** Contains a reactive list of stored templates along with their labels and provenance. */
   readonly templateList: ComputableStableDefined<TemplateListEntry[]>;
-  /** Reactive view of the donor's outbox — the shares this user has created.
-   *  v1: API only, no UI. */
+  /** The folder tree and the project list, already joined. The desktop reads this and never
+   *  the two halves, so it cannot render a list and a tree that are one refresh apart. */
+  readonly folders: ComputableStableDefined<FoldersListing>;
+  /** Reactive view of the donor's outbox — the shares this user has created. */
   outgoingShares: Computable<OutgoingShare[] | undefined>;
-  /** Envelopes granted to this user, not yet accepted or rejected. Fed by the
+  /** Shares granted to this user, hidden ones included and flagged as such. Fed by the
    *  shared-resource discovery tree. */
-  pendingShares: Computable<PendingShare[] | undefined>;
-  /** Internal: the acceptor's currently-live envelopes, read from the same shared-resource
-   *  discovery tree as {@link pendingShares}. The single source the accept/reject flow resolves
+  availableShares: Computable<AvailableShare[] | undefined>;
+  /** Internal: the recipient's currently-live envelopes, read from the same shared-resource
+   *  discovery tree as {@link availableShares}. The single source {@link copyShare} resolves
    *  live envelopes from — no second discovery path. */
   private readonly liveEnvelopes;
   readonly pl: PlClient;
@@ -109,7 +114,7 @@ export declare class MiddleLayer {
   /**
    * Whether the connected backend supports project sharing. Synthetic — computed
    * in the middle layer from the backend capabilities the share flow needs (the
-   * cross-color field-reference relaxation the accept flow rests on). It can absorb
+   * cross-color field-reference relaxation a copy out of a share rests on). It can absorb
    * additional required capabilities later without a UI change.
    */
   get sharingSupported(): boolean;
@@ -147,10 +152,84 @@ export declare class MiddleLayer {
   /** Resolves a ProjectId to a signed SignedResourceId.
    * Uses LRU cache with TX-scan fallback. */
   private resolveProjectId;
-  /** Creates a project with initial state and adds it to project list. */
-  createProject(meta: ProjectMeta): Promise<ProjectId$1>;
-  /** Updates project metadata */
-  setProjectMeta(id: ProjectId$1, meta: ProjectMeta, author?: AuthorMarker): Promise<void>;
+  /**
+   * Creates a project with initial state and adds it to project list.
+   *
+   * `folder` is where it lands, placed in the transaction that creates it so the project never
+   * shows up at the top level first. Left out, or naming a folder that is gone, it lands at the
+   * top level.
+   */
+  createProject(meta: ProjectMeta, folder?: FolderId): Promise<ProjectId$1>;
+  /**
+   * Updates the project metadata fields the caller names, leaving the others as they are.
+   *
+   * A patch rather than a replacement because the label and the description are edited from two
+   * different places: a rename that carried a stale description alongside the new name would
+   * undo a description edit that happened in between, and the reverse.
+   *
+   * The label is stored trimmed, and it goes into the namespace folders share, so a label
+   * already carried by something else inside the same folder is refused rather than written — a
+   * human typed it, and a name that silently becomes a different name is worse than one that is
+   * turned down. The check and the write share one transaction, so two renames racing for the
+   * same name cannot both win. Duplicates an account already holds are tolerated and never
+   * rewritten; see the name check of {@link openFoldersTx}.
+   */
+  setProjectMeta(id: ProjectId$1, meta: Partial<ProjectMeta>, author?: AuthorMarker): Promise<void>;
+  private get foldersRids();
+  /** Creates a folder inside `parent`, or at the top level, and returns its id. A name already
+   *  used there is rejected. */
+  createFolder(name: string, parent?: FolderId): Promise<FolderId>;
+  /** Renames a folder. A name already used beside it is rejected. */
+  renameFolder(folder: FolderId, name: string): Promise<void>;
+  /** Sets what a folder says about itself; blank clears it. Descriptions are in no namespace, so
+   *  nothing is refused here. */
+  setFolderDescription(folder: FolderId, description: string): Promise<void>;
+  /** The plan a move would produce — every item and the name it ends up with. Shown for
+   *  confirmation, then handed back to {@link moveFolderItems} unchanged. */
+  previewFoldersMove(items: readonly FoldersItem[], destination?: FolderId): Promise<FoldersMovePlanResult>;
+  /**
+   * Moves folders, projects and templates into one destination.
+   *
+   * The plan is recomputed inside the write transaction and the move commits only when it is
+   * identical to `confirmedPlan`; otherwise nothing is written and the fresh plan comes back to
+   * be confirmed again.
+   */
+  moveFolderItems(items: readonly FoldersItem[], destination: FolderId | undefined, confirmedPlan: FoldersMovePlan): Promise<FoldersMoveOutcome>;
+  /** What deleting a folder would destroy: the subtree of folders, and everything in it. */
+  previewFolderDeletion(folder: FolderId): Promise<FoldersRemovalPlanResult>;
+  /** Deletes a folder, every folder inside it, and every project and template held anywhere in
+   *  that subtree.
+   *  Refused as `needs-confirmation` until the removal it returns is passed back as
+   *  `confirmedRemoval`, and as `plan-changed` if the subtree has changed since. */
+  deleteFolder(folder: FolderId, confirmedRemoval?: FoldersRemoval): Promise<FoldersRemovalOutcome>;
+  /**
+   * Replaces a folder document this build cannot read — one written by a newer version, or one
+   * nothing here can parse — with an empty one. Every folder is gone afterwards; every project and
+   * template stays and shows at the top level. Refused while the document can be read.
+   */
+  resetFolders(): Promise<void>;
+  /**
+   * Duplicates a folder and everything under it: the folders inside, a duplicate of every project
+   * in them, and a copy of every template.
+   *
+   * The copy lands beside the source, so only its root needs a name of its own — `X (Copy)`.
+   * Nothing inside is renamed: names are compared among siblings, and a copied folder's children
+   * are only ever compared with each other, where they came in distinct already.
+   *
+   * The subtree is read first and rebuilt in one write transaction, so the folders and everything
+   * they hold appear together or not at all.
+   */
+  duplicateFolder(folder: FolderId): Promise<void>;
+  /**
+   * A folder subtree as a copy needs it: the folders under ids local to this read, the key the
+   * subtree's root goes by, the resource of every project in them, every template read whole, and
+   * the folder the source sits in — which is where a duplicate lands.
+   *
+   * Read in a transaction of its own, before the write that copies it: every template is a read,
+   * and none of it has to be atomic with the copying, because a project or a template that
+   * disappears meanwhile fails that write on its own.
+   */
+  private loadFolderSubtree;
   /**
    * Renders a project as a `template-v1` YAML document, or reports every reason it
    * cannot be — the backing call for an "Export Project as Template…" command.
@@ -240,23 +319,40 @@ export declare class MiddleLayer {
    * A block that cannot be expressed as a template entry stores nothing at all, and every
    * such block is reported — fixing an unexportable project takes one pass, not one per block.
    *
+   * The template lands beside its project, and is named by the rule everything there is named
+   * by: a label the caller chose is stored trimmed and refused if it is already used there, and
+   * without one the project's own label is taken — suffixed, since the project itself already
+   * answers to it.
+   *
+   * The template's description is the one the caller gives, stored trimmed; blank means none.
+   * Without one the template is stored undescribed, whatever the project's own description says.
+   *
    * @param projectId project to snapshot
-   * @param label label for the template; defaults to the project's own label
+   * @param label label for the template; defaults to the project's own label, made free
+   * @param description what the template is for; blank or absent stores none
+   */
+  saveProjectAsTemplate(projectId: ProjectId$1, label?: string, description?: string): Promise<SaveProjectAsTemplateOutcome>;
+  /**
+   * Changes a template's label. The stored document is immutable and stays untouched —
+   * improving a template means saving a new one.
+   *
+   * The label is stored trimmed. It is in the namespace folders, projects and templates share,
+   * so one already used beside the template is refused, in the transaction that writes it.
    */
-  saveProjectAsTemplate(projectId: ProjectId$1, label?: string): Promise<SaveProjectAsTemplateOutcome>;
-  /** Changes a template's label. The stored document is immutable and stays untouched —
-   *  improving a template means saving a new one. */
-  renameTemplate(id: TemplateId, label: string): Promise<void>;
+  renameTemplate(id: TemplateId$1, label: string): Promise<void>;
+  /** Sets what a stored template says about itself; blank clears it. The stored document is not
+   *  touched, so it stays byte-identical. */
+  setTemplateDescription(id: TemplateId$1, description: string): Promise<void>;
   /** Permanently deletes a template from the template list. */
-  deleteTemplate(id: TemplateId): Promise<void>;
+  deleteTemplate(id: TemplateId$1): Promise<void>;
   /** Reads a stored template: its document plus what was true when it was taken. */
-  getTemplateData(id: TemplateId): Promise<StoredTemplateData>;
+  getTemplateData(id: TemplateId$1): Promise<StoredTemplateData>;
   /**
    * Where each entry of a stored template would get its block from, and which entries have
    * nowhere to get one — resolution creates nothing, so this is the preview a UI shows before
    * offering Apply. {@link createProjectFromTemplate} runs the same stage itself.
    */
-  resolveTemplate(id: TemplateId, provider: BlockPackProvider, options?: {
+  resolveTemplate(id: TemplateId$1, provider: BlockPackProvider, options?: {
     allowUnstable?: boolean;
   }): Promise<TemplateResolveOutcome>;
   /**
@@ -269,11 +365,14 @@ export declare class MiddleLayer {
    * @param id template to apply
    * @param label label for the new project
    * @param provider where each entry's block comes from
-   * @param options `allowUnstable` widens resolution to pre-release implementations
+   * @param options `allowUnstable` widens resolution to pre-release implementations; `folder` is
+   *   where the new project lands
    */
-  createProjectFromTemplate(id: TemplateId, label: string, provider: BlockPackProvider, options?: {
+  createProjectFromTemplate(id: TemplateId$1, label: string, provider: BlockPackProvider, options?: {
     allowUnstable?: boolean;
     author?: AuthorMarker;
+    /** Where the project lands; the top level when left out. */
+    folder?: FolderId;
   }): Promise<CreateProjectFromTemplateOutcome>;
   /** Resolves a TemplateId to a signed SignedResourceId.
    * Uses LRU cache with TX-scan fallback. */
@@ -282,62 +381,39 @@ export declare class MiddleLayer {
    * destruction of all attached objects, like files, analysis results etc. */
   deleteProject(id: ProjectId$1): Promise<void>;
   /**
-   * Duplicates an existing project and adds the copy to this user's project list.
+   * Duplicates an existing project and adds the copy to this user's project list, beside the
+   * project it was copied from.
+   *
+   * Without `rename` the copy is named by the rule everything beside the source is named by: the
+   * source's own label, suffixed to be free there — `X (Copy)`. The name is chosen inside the
+   * transaction that creates the copy, against the tree that transaction reads.
    *
    * @param srcProjectId - project id of the project to duplicate
    * @param rename - optional function that receives the source label and all existing
-   *   project labels (read within the same transaction), and returns the label for the copy
+   *   project labels (read within the same transaction), and returns the label for the copy.
+   *   A label chosen this way is the caller's and is never suffixed: when it is already taken
+   *   beside the source, the copy lands at the top level instead.
    */
   duplicateProject(srcProjectId: ProjectId$1, rename?: (previousLabel: string, existingLabels: string[]) => string): Promise<ProjectId$1>;
   /**
    * Duplicates a project into another user's root, minted in the TARGET user's color so the target
    * owns it. Sibling of {@link duplicateProject}, but writes into a different root. The source
    * project (on the current client root) is referenced cross-color for its block data, kept alive
-   * by refcounting, exactly like accepting a shared project. Works both ways: pull (while
+   * by refcounting, exactly like a project copied out of a share. Works both ways: pull (while
    * impersonating a user, copy their project to yourself) and push (from your own root, copy a
    * project to a user). Admin cross-root op; requires the crossTreeRefs:v1 backend capability.
    */
   duplicateProjectToUser(srcProjectId: ProjectId$1, targetLogin: string, rename?: (previousLabel: string, existingLabels: string[]) => string): Promise<void>;
   /**
-   * Shares the given projects (Copy & Share). Snapshots the projects, creates one envelope, and
-   * grants it — all in one atomic write transaction, so a failed grant rolls the whole thing back
-   * and the outbox is left as it was.
-   *
-   * Two variants (see {@link ShareProjectsOptions}):
-   * - `{ recipients }` — one writable grant per named recipient; the envelope expires after the
-   *   default TTL (`sharedAt + envelopeTtlMs`).
-   * - `{ everyone: true }` — one make-public grant (backend rewrites the target to the
-   *   everyone-user); the envelope's `expiresAt` is `null`, so it never expires.
+   * Shares the given projects (Copy & Share): snapshots them into one envelope, in the transaction
+   * {@link shareEnvelope} describes.
    *
    * v1 always passes `mode: "copy"`.
    */
-  shareProjects(projectIds: ProjectId$1[], options: ShareProjectsOptions): Promise<void>;
-  /**
-   * Mints a fresh share: snapshots the projects into one new envelope (a fresh shareId),
-   * supersedes prior shares of the same project, and grants it — all in one atomic write
-   * transaction, so a failed grant rolls the whole thing back and the outbox is left as it was.
-   * The everyone-refresh path is the {@link changeShare} branch of {@link shareProjects}; this is
-   * the mint-a-new-envelope branch.
-   */
-  private createNewShare;
-  /**
-   * Grants one freshly built envelope inside the transaction that created it: a single make-public
-   * grant for an everyone-share (empty/ignored target, ANY_AUTHORISED — the backend rewrites the
-   * target to the everyone-user, gated by role + permission ceiling), or one grant per named
-   * recipient.
-   *
-   * `writable` is not a preference. A project pack needs a writable grant because accepting copies
-   * the snapshots out of the envelope, and the cross-color attach rule permits that only to a
-   * writable grant holder. A template share copies nothing — the document sits in the envelope's
-   * own immutable data — so it is granted read-only, and must be: a writable everyone-grant would
-   * hand every user on the server write access to the envelope.
-   */
-  private grantShareEnvelope;
+  shareProjects(projectIds: ProjectId$1[], options: ShareProjectsOptions): Promise<ShareOutcome>;
   /**
    * Shares one stored template. The envelope carries the document itself, so there is no project
    * snapshot and no resource for the recipient to copy out — which is why the grant is read-only.
-   * The cost of that is the donor's receipt: nobody can write an acceptance onto a read-only
-   * envelope, so a template share never reports who accepted it.
    *
    * Nothing about the document is checked: a stored template is shareable by virtue of existing.
    * An entry the recipient cannot resolve — a block installed from a folder on the sender's
@@ -347,49 +423,58 @@ export declare class MiddleLayer {
    * @param id template to share
    * @param options recipients XOR everyone, plus the title recipients see
    */
-  shareTemplate(id: TemplateId, options: ShareTemplateOptions): Promise<ShareTemplateOutcome>;
-  /** The document and the label of a template about to be shared. The label is what the
-   *  recipient's own list will show, so it travels with the document. */
-  private loadTemplateForShare;
-  /**
-   * Changes a share in place (same {@link ShareId}), in one write transaction: re-snapshots live
-   * source projects and carries deleted ones' snapshots forward; applies edited recipients/title;
-   * transfers already-decided recipients' accept/reject records (they keep their copy and aren't
-   * re-prompted); re-grants; drops the old envelope.
-   *
-   * `opts.recipients` is the full targeted set (decided users are always kept). `opts.title`
-   * replaces the title — omit keeps the current one. `opts.everyone` upgrades targeted ->
-   * everyone; the reverse is impossible and ignored.
-   *
-   * `opts.projectActions` is a per-source-project decision, keyed by projectId: `update`
-   * re-snapshots the live source (falls back to carry if the source is gone), `keep` carries the
-   * existing snapshot (and its timestamp), `remove` drops the project from the pack. A project not
-   * in the map defaults to `keep`. Omit the whole map for the legacy auto behavior (live sources
-   * updated, gone ones kept) — the everyone-refresh path relies on that.
-   *
-   * `opts.templateId` is required for, and only used by, a share that carries a template: a stored
-   * template is immutable, so an improved one is a different template and the share cannot re-read
-   * the one it started from — the caller names the new target. Every other option means the same
-   * thing for both kinds of share.
-   */
-  changeShare(shareId: ShareId, opts?: {
-    recipients?: string[];
-    everyone?: boolean;
-    title?: string;
-    projectActions?: Record<ProjectId$1, ProjectChangeAction>;
-    templateId?: TemplateId;
-  }): Promise<void>;
-  /**
-   * Finds the donor's own outgoing envelopes built from any of the given source projects —
-   * the supersede candidates for a fresh share of the same project(s). Reads each envelope's
-   * recipient set via `ListGrants` so the caller can pull individual recipients or detect an
-   * everyone-share.
-   */
-  private findSupersedableEnvelopes;
+  shareTemplate(id: TemplateId$1, options: ShareTemplateOptions): Promise<ShareOutcome>;
+  /**
+   * Shares one folder and everything under it: the subtree's folders, every project in them
+   * snapshotted, and every template carried whole.
+   *
+   * The grant is writable, because a folder holding projects is copied out of the envelope the
+   * way a project pack is. An everyone-share of a folder therefore hands every user on the server
+   * write access to the envelope — the same trade a project share already makes.
+   *
+   * Folder ids do not travel. What the recipient gets is the shape of the subtree, rebuilt under
+   * a folder of their own choosing with ids their own document mints.
+   *
+   * @param folder folder to share; everything beneath it goes with it
+   * @param options recipients XOR everyone, plus the title recipients see
+   */
+  shareFolder(folder: FolderId, options: ShareFolderOptions): Promise<ShareOutcome>;
+  /**
+   * The one transaction every share is made in: the shares named by `options.replace` are
+   * dropped, the envelope `build` makes is created, and it is granted — all at once, so a failed
+   * grant rolls the whole thing back and the outbox is left as it was.
+   *
+   * A share with named recipients grants each of them and expires after the default TTL
+   * (`sharedAt + envelopeTtlMs`). A share with everyone is one make-public grant, and its
+   * `expiresAt` is `null`, so it never expires.
+   */
+  private shareEnvelope;
+  /**
+   * Detaches the named shares from the donor's outbox inside the caller's transaction, so a
+   * replacement and the shares it supersedes land together or not at all.
+   *
+   * A share that no longer resolves is skipped rather than reported: the caller names shares the
+   * author saw a moment ago, and one revoked meanwhile is already in the wanted state.
+   */
+  private dropShares;
+  /**
+   * Grants one freshly built envelope inside the transaction that created it: a single make-public
+   * grant for an everyone-share (empty/ignored target, ANY_AUTHORISED — the backend rewrites the
+   * target to the everyone-user, gated by role + permission ceiling), or one grant per named
+   * recipient.
+   *
+   * `writable` is not a preference. A project pack needs a writable grant because a copy out of
+   * it takes the snapshots out of the envelope, and the cross-color attach rule permits that only
+   * to a writable grant holder. A template share copies nothing — the document sits in the
+   * envelope's own immutable data — so it is granted read-only, and must be: a writable
+   * everyone-grant would hand every user on the server write access to the envelope.
+   */
+  private grantShareEnvelope;
   /**
    * Revokes and deletes an outgoing share for all recipients: detaches and deletes the envelope, and
-   * its grants are revoked along with it. Already-accepted copies are unaffected (ref-counting keeps
-   * the adopted resources alive). Idempotent — revoking a share that is already gone is a no-op.
+   * its grants are revoked along with it. Copies recipients already took out of it are unaffected
+   * (ref-counting keeps the resources they point at alive). Idempotent — revoking a share that is
+   * already gone is a no-op.
    */
   revokeShare(shareId: ShareId): Promise<void>;
   /**
@@ -404,35 +489,43 @@ export declare class MiddleLayer {
    * the envelope's logical `shareId`.
    *
    * Reads the {@link liveEnvelopes} Computable — the same shared-resource discovery tree that
-   * feeds {@link pendingShares}. This is the single discovery mechanism: there is no separate
-   * `ListUserResources` re-stream on every accept/reject. `refreshState()` is awaited first so a
+   * feeds {@link availableShares}. This is the single discovery mechanism: there is no separate
+   * `ListUserResources` re-stream on every copy. `refreshState()` is awaited first so a
    * just-granted envelope is observed (the tree's discovery poll may otherwise lag a freshly
    * landed grant). The tree is gRPC-only, so this is empty on a REST-connected client.
    */
   private resolveLiveEnvelopes;
   /**
-   * Accepts one or more pending shares. What accepting does depends on what the share carries: a
-   * pack of projects is duplicated into this user's project list, while a template is added to this
-   * user's own template list and builds nothing — the recipient decides later whether to apply it.
-   * Either way the decision is recorded per share, and a read-write share also gets the
-   * donor-visible acceptance written onto its envelope. Per-share failures (e.g. an expiry race)
-   * are collected, not short-circuited — the rest still get accepted. Accept-all = pass every
-   * current pending shareId.
-   *
-   * `rename` resolves label collisions (same callback contract as {@link duplicateProject}), but
-   * the source lives in the envelope tree, so accept calls the low-level mutator directly. It does
-   * not apply to a template share, whose label is not required to be unique.
-   */
-  acceptShare(shareIds: ShareId[], rename?: (previousLabel: string, existingLabels: string[]) => string): Promise<{
-    accepted: ProjectId$1[];
-    acceptedTemplates: TemplateId[];
+   * Copies what one or more shares carry into this user's own tree, optionally into a folder.
+   *
+   * A share is a shelf, not an invitation: copying takes nothing off it and records no decision,
+   * so the same share can be copied from again, by this user or anyone else it was granted to.
+   * What a copy produces depends on the payload — a pack of projects lands in the project list,
+   * a template among their templates, building nothing until the recipient applies it, and a
+   * folder is rebuilt whole with everything it held.
+   *
+   * Names are chosen against the destination folder, since that is where the uniqueness rule
+   * applies, and a project and a template follow the same rule. A destination deleted meanwhile
+   * fails the copy rather than spilling it at the top level.
+   * Per-share failures (a revoked envelope, say) are collected rather than short-circuited, so
+   * one dead share does not cost the others.
+   */
+  copyShare(shareIds: ShareId[], destination?: FolderId): Promise<{
+    projects: ProjectId$1[];
+    templates: TemplateId$1[];
     failed: {
       shareId: ShareId;
       error: string;
     }[];
   }>;
-  /** Records rejection of a pending share; it never surfaces again. */
-  rejectShare(shareId: ShareId): Promise<void>;
+  /**
+   * Puts a share out of this user's sight. Private to them and reversible with
+   * {@link unhideShare}: nothing is deleted, the donor is not told, and what was already copied
+   * out of it is unaffected.
+   */
+  hideShare(shareId: ShareId): Promise<void>;
+  /** Brings a hidden share back into this user's list. */
+  unhideShare(shareId: ShareId): Promise<void>;
   private static readonly EnvelopeCleanupIntervalMs;
   private envelopeCleanupTimer;
   /** On ML start and every 6h, delete envelopes whose immutable `expiresAt` has passed. */

package/dist/middle_layer/middle_layer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middle_layer.d.ts","names":[],"sources":["../../src/middle_layer/middle_layer.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4IiB;EACf,WAAW;WACF,IAAI;WACJ,qBAAqB;WACrB,QAAQ;WACR,sBAAsB;WACtB,gBAAgB;WAChB,qBAAqB;WACrB,QAAQ;WACR,KAAK;WACL,YAAY;WACZ,wBAAwB;WACxB,oBAAoB;WACpB,SAAS;WACT,WAAW;WACX,iBAAiB;WACjB,eAAe;;;WAGf,gBAAgB;;;;;;;;;;;;;;qBAed;mBAIQ;WACD,WAAW;WACX,QAAQ;mBACP;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;WACD,uBAAuB;;WAEvB,aAAa,wBAAwB;;WAErC,cAAc,wBAAwB;;;EAG/C,gBAAgB,WAAW;;;EAG3B,eAAe,WAAW;;;;mBAIhB;WA9BH,IAAI;UAEb;;;;;MAsCI,kBAAkB;;;;;;;MAUlB;;;;;MAQA;;;;;;;MAUA;;MAQA;;;;;MAQA,mBAAmB;;;;;;;MAUnB;;;;;;;;MAeA;;EAKJ,qBACL,aAAa,sBACb;;EAMK,wBAAwB,cAAc;;MAKlC,qBAAqB;;MAKrB,mBAAmB;mBAQb;;;UAIH;;EAuBD,cAAc,MAAM,cAAc,QAAQ;;EAgB1C,eACX,IAAI,aACJ,MAAM,aACN,SAAS,eACR;;;;;;;;;;;;;;;;EA8BU,wBAAwB,IAAI,cAAY,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsDhD,uBACX,IAAI,aACJ,UAAU,mBACV,UAAU,mBACV;IAAW;IAAyB,SAAS;MAC5C,QAAQ;;;;;;;;;UAgBG;;;;;;;UAiFA;mBA0CG;;;;;;;;;;;;;EAcJ,sBACX,WAAW,aACX,iBACC,QAAQ;;;EAyBE,eAAe,IAAI,YAAY,gBAAgB;;EAU/C,eAAe,IAAI,aAAa;;EAUhC,gBAAgB,IAAI,aAAa,QAAQ;;;;;;EAczC,gBACX,IAAI,YACJ,UAAU,mBACV;IAAW;MACV,QAAQ;;;;;;;;;;;;;EAmBE,0BACX,IAAI,YACJ,eACA,UAAU,mBACV;IAAW;IAAyB,SAAS;MAC5C,QAAQ;;;UA2BG;;;EAoBD,cAAc,IAAI,cAAY;;;;;;;;EA0B9B,iBACX,cAAc,aACd,UAAU,uBAAuB,sCAChC,QAAQ;;;;;;;;;EAoDE,uBACX,cAAc,aACd,qBACA,UAAU,uBAAuB,sCAChC;;;;;;;;;;;;;;EAsDU,cACX,YAAY,eACZ,SAAS,uBACR;;;;;;;;UA0BW;;;;;;;;;;;;;UA2EA;;;;;;;;;;;;;;;EA0BD,cACX,IAAI,YACJ,SAAS,uBACR,QAAQ;;;UA6BG;;;;;;;;;;;;;;;;;;;;;;EAmCD,YACX,SAAS,SACT;IACE;IACA;IACA;IACA,iBAAiB,OAAO,aAAW;IACnC,aAAa;MAEd;;;;;;;UAwIW;;;;;;EA6CD,YAAY,SAAS,UAAU;;;;;;;UAiB9B;;;;;;;;;;;UA0BA;;;;;;;;;;;;;;EAsBD,YACX,UAAU,WACV,UAAU,uBAAuB,sCAChC;IACD,UAAU;IACV,mBAAmB;IACnB;MAAU,SAAS;MAAS;;;;EAyFjB,YAAY,SAAS,UAAU;0BA4BpB;UAChB;;UAGA;;;UAWM;mBAsCG;;;mBAIA;UAET;;;;;;;UAWM;;EAgBD,YAAY,IAAI,cAAY;;EAQ5B,aAAa,IAAI,cAAY;;EAmBnC,iBAAiB,IAAI,cAAY;;EAOjC,gBAAgB,IAAI;;;;MAOhB,qBAAqB,SAAS;;;;;;EAS5B,SAAK;;EAiBL,4BAAwB;;;SAMvB;;MAKH,wBAAwB;;SAKf,KAClB,IAAI,UACJ,iBACA,MAAM,4BACL,QAAQ"}
+{"version":3,"file":"middle_layer.d.ts","names":[],"sources":["../../src/middle_layer/middle_layer.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgLiB;EACf,WAAW;WACF,IAAI;WACJ,qBAAqB;WACrB,QAAQ;WACR,sBAAsB;WACtB,gBAAgB;WAChB,qBAAqB;WACrB,QAAQ;WACR,KAAK;WACL,YAAY;WACZ,wBAAwB;WACxB,oBAAoB;WACpB,SAAS;WACT,WAAW;WACX,iBAAiB;WACjB,eAAe;;;WAGf,gBAAgB;;;;;;;;;;;;;;qBAed;mBAIQ;WACD,WAAW;WACX,QAAQ;mBACP;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;mBACA;WACD,uBAAuB;;WAEvB,aAAa,wBAAwB;;WAErC,cAAc,wBAAwB;;;WAGtC,SAAS,wBAAwB;;EAE1C,gBAAgB,WAAW;;;EAG3B,iBAAiB,WAAW;;;;mBAIlB;WAlCH,IAAI;UAEb;;;;;MA0CI,kBAAkB;;;;;;;MAUlB;;;;;MAQA;;;;;;;MAUA;;MAQA;;;;;MAQA,mBAAmB;;;;;;;MAUnB;;;;;;;;MAeA;;EAKJ,qBACL,aAAa,sBACb;;EAMK,wBAAwB,cAAc;;MAKlC,qBAAqB;;MAKrB,mBAAmB;mBAQb;;;UAIH;;;;;;;;EA0BD,cAAc,MAAM,aAAa,SAAS,WAAW,QAAQ;;;;;;;;;;;;;;;EAqC7D,eACX,IAAI,aACJ,MAAM,QAAQ,cACd,SAAS,eACR;cAmBS;;;EAUC,aAAa,cAAc,SAAS,WAAW,QAAQ;;EAOvD,aAAa,QAAQ,UAAU,eAAe;;;EAO9C,qBAAqB,QAAQ,UAAU,sBAAsB;;;EAO7D,mBACX,gBAAgB,eAChB,cAAc,WACb,QAAQ;;;;;;;;EAWE,gBACX,gBAAgB,eAChB,aAAa,sBACb,eAAe,kBACd,QAAQ;;EAkBE,sBAAsB,QAAQ,WAAW,QAAQ;;;;;EAQjD,aACX,QAAQ,UACR,mBAAmB,iBAClB,QAAQ;;;;;;EAqBE,gBAAgB;;;;;;;;;;;;EAgBhB,gBAAgB,QAAQ,WAAW;;;;;;;;;;UAiElC;;;;;;;;;;;;;;;;EAuDD,wBAAwB,IAAI,cAAY,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsDhD,uBACX,IAAI,aACJ,UAAU,mBACV,UAAU,mBACV;IAAW;IAAyB,SAAS;MAC5C,QAAQ;;;;;;;;;UAgBG;;;;;;;UAiFA;mBA0CG;;;;;;;;;;;;;;;;;;;;;;EAuBJ,sBACX,WAAW,aACX,gBACA,uBACC,QAAQ;;;;;;;;EA+CE,eAAe,IAAI,cAAY,gBAAgB;;;EAa/C,uBAAuB,IAAI,cAAY,sBAAsB;;EAU7D,eAAe,IAAI,eAAa;;EAUhC,gBAAgB,IAAI,eAAa,QAAQ;;;;;;EAczC,gBACX,IAAI,cACJ,UAAU,mBACV;IAAW;MACV,QAAQ;;;;;;;;;;;;;;EAoBE,0BACX,IAAI,cACJ,eACA,UAAU,mBACV;IACE;IACA,SAAS;;IAET,SAAS;MAEV,QAAQ;;;UA2BG;;;EAiBD,cAAc,IAAI,cAAY;;;;;;;;;;;;;;;EAyB9B,iBACX,cAAc,aACd,UAAU,uBAAuB,sCAChC,QAAQ;;;;;;;;;EA6DE,uBACX,cAAc,aACd,qBACA,UAAU,uBAAuB,sCAChC;;;;;;;EAyCU,cACX,YAAY,eACZ,SAAS,uBACR,QAAQ;;;;;;;;;;;;;EAgCE,cAAc,IAAI,cAAY,SAAS,uBAAuB,QAAQ;;;;;;;;;;;;;;;EAmCtE,YAAY,QAAQ,UAAU,SAAS,qBAAqB,QAAQ;;;;;;;;;;UAgCnE;;;;;;;;UA2CA;;;;;;;;;;;;;UAoBA;;;;;;;EAkBD,YAAY,SAAS,UAAU;;;;;;;UAiB9B;;;;;;;;;;;UA0BA;;;;;;;;;;;;;;;;EAwBD,UACX,UAAU,WACV,cAAc,WACb;IACD,UAAU;IACV,WAAW;IACX;MAAU,SAAS;MAAS;;;;;;;;EA8JjB,UAAU,SAAS,UAAU;;EAW7B,YAAY,SAAS,UAAU;0BAapB;UAChB;;UAGA;;;UAWM;mBAsCG;;;mBAIA;UAET;;;;;;;UAWM;;EAgBD,YAAY,IAAI,cAAY;;EAQ5B,aAAa,IAAI,cAAY;;EAmBnC,iBAAiB,IAAI,cAAY;;EAOjC,gBAAgB,IAAI;;;;MAOhB,qBAAqB,SAAS;;;;;;EAS5B,SAAK;;EAkBL,4BAAwB;;;SAMvB;;MAKH,wBAAwB;;SAKf,KAClB,IAAI,UACJ,iBACA,MAAM,4BACL,QAAQ"}