@astrale-domains/shell 0.1.5 → 0.1.7

package/dist/domain.js

@@ -1,96 +1,105 @@
 import { defineDomain, defineFrontend, vite, requirements, } from '@astrale-os/sdk/domain';
-import { K, KernelRootFunctions } from '@astrale-os/sdk/schema';
+import { K } from '@astrale-os/sdk/schema';
 import { ShellSchema, S } from './schema/index.js';
+// Seam L-SHELL-7, L-SHELL-9, L-SHELL-11: the bindings legacy groups and callers still need.
+import { legacyRelease } from './legacy/index.js';
 import runtime, {} from './runtime.js';
 const frontend = defineFrontend({
     schema: ShellSchema,
     source: vite({ config: './frontend/vite.config.ts' }),
     routes: { application: { path: '/', handshake: 'shell' } },
 });
-const domainRequirements = requirements({
-    // Sujet implicite : le principal installé Shell, utilisé par kernel.self.
-    functions: KernelRootFunctions,
-    classes: [
-        { class: K.classes.extends_with, operations: ['create', 'read', 'traverse', 'delete'] },
-        // listEntrypoints reads every entrypoint View locator and its Domain as Shell.
-        { class: K.classes.Domain, operations: ['read'] },
-        { class: K.classes.of_domain, operations: ['read'] },
-        { class: K.classes.entrypoint, operations: ['traverse'] },
-        { class: K.classes.View, operations: ['traverse'] },
-    ],
-    authority: {
-        grant: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'revoke'],
-        revoke: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'grant'],
-    },
-    // Ces profils sont matérialisés par l'installeur, pas par un handler Shell.
-    core: [
+/**
+ * The Roles the Shell release binds: `admin` is the only granter of every Shell Role and of the
+ * grantable Kernel Roles (R2); compositions are release bindings, not Core Edges (AM1).
+ */
+const domainRequirements = requirements(legacyRelease({
+    roles: [
+        // Profiles, member ⊂ admin, and their atomic Roles (AM1); admin grants them all.
+        {
+            role: S.core.nodes['workspace.member'],
+            members: [S.core.nodes['workspace.admin']],
+            granters: [S.core.nodes['workspace.admin']],
+        },
+        { role: S.core.nodes['workspace.admin'], granters: [S.core.nodes['workspace.admin']] },
+        // A member reads profiles only (user-profile.reader, group-profile.reader); the accounts and
+        // groups themselves are read by administrators.
+        {
+            role: S.core.nodes['user.reader'],
+            members: [S.core.nodes['workspace.admin']],
+            granters: [S.core.nodes['workspace.admin']],
+        },
+        {
+            role: S.core.nodes['user.writer'],
+            members: [S.core.nodes['workspace.admin']],
+            granters: [S.core.nodes['workspace.admin']],
+        },
+        {
+            role: S.core.nodes['group.reader'],
+            members: [S.core.nodes['workspace.admin']],
+            granters: [S.core.nodes['workspace.admin']],
+        },
+        {
+            role: S.core.nodes['group.writer'],
+            members: [S.core.nodes['workspace.admin']],
+            granters: [S.core.nodes['workspace.admin']],
+        },
+        { role: S.core.nodes['directory.provisioner'], granters: [S.core.nodes['workspace.admin']] },
+        // A member reads every profile; it changes its own once an administrator allows it.
+        {
+            role: S.core.nodes['user-profile.reader'],
+            members: [S.core.nodes['workspace.member']],
+            granters: [S.core.nodes['workspace.admin']],
+        },
+        // Off by default: an administrator lets members change their own profile from the console
+        // (workspace.member → self-writer). Left out of the release so an installation keeps that
+        // choice.
+        {
+            role: S.core.nodes['user-profile.self-writer'],
+            granters: [S.core.nodes['workspace.admin']],
+        },
         {
-            subject: S.core.nodes.admin,
-            functions: [
-                ...KernelRootFunctions,
-                S.classes.User.static.methods.invite,
-                S.classes.User.methods.recordProfile,
-                S.classes.Group.static.methods.assignMember,
-                S.classes.Group.static.methods.unassignMember,
-                S.classes.Namespace.methods.link,
-                S.classes.Namespace.methods.unlink,
-                S.classes.Namespace.methods.rename,
-                // Core Edges cannot author Kernel extends_with, so administrators hold it directly.
-                S.functions.listEntrypoints,
-                S.functions.assignViews,
-            ],
-            classes: [
-                { class: S.classes.User, operations: ['create', 'read', 'traverse', 'update', 'delete'] },
-                {
-                    class: S.classes.Group,
-                    operations: ['create', 'read', 'traverse', 'update', 'delete'],
-                },
-                {
-                    class: S.classes.member_of_group,
-                    operations: ['create', 'read', 'traverse', 'update', 'delete'],
-                },
-                { class: S.classes.Namespace, operations: ['read', 'traverse'] },
-                { class: S.classes.alias, operations: ['create', 'read', 'traverse', 'update', 'delete'] },
-                // assignViews gives and withdraws Views; a Mutation may too. view_access carries no property.
-                { class: S.classes.view_access, operations: ['create', 'read', 'traverse', 'delete'] },
-                { class: K.classes.extends_with, operations: ['create', 'read', 'traverse', 'delete'] },
-            ],
-            authority: {
-                grant: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'revoke'],
-                revoke: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'grant'],
-            },
+            role: S.core.nodes['group-profile.reader'],
+            members: [S.core.nodes['workspace.member']],
+            granters: [S.core.nodes['workspace.admin']],
         },
+        // Each profile holds the Kernel profile of its rank; Kernel admin is granted by Root alone.
+        // Kernel reader is no profile's: admin grants it to whoever only opens the Views it is given
+        // (AM10).
+        { role: K.core.nodes.reader, granters: [S.core.nodes['workspace.admin']] },
         {
-            subject: S.core.nodes.member,
-            functions: [
-                // Download re-reads the holder Node with the caller's authority: no new data exposure.
-                K.functions.download,
-                // Upload exposes no data: its receipt binds to the caller, and attaching it still takes a
-                // Mutation under the caller's rights. The Kernel bounds it per blob and per Instance quota.
-                K.functions.upload,
-                K.functions.introspect,
-                K.functions.query,
-                K.functions.mutate,
-                K.classes.View.static.methods.resolve,
-                // The workspace opens only on this catalogue: an invited member must be able to read it.
-                S.functions.listEntrypoints,
-                // The GUI records the email and name each account signs in with; isSelf bounds it.
-                S.classes.User.methods.recordProfile,
-            ],
+            role: K.core.nodes.writer,
+            members: [S.core.nodes['workspace.member']],
+            granters: [S.core.nodes['workspace.admin']],
         },
+        { role: K.core.nodes.admin, members: [S.core.nodes['workspace.admin']] },
+        // Shell itself reads compositions (U4, U5, G3) and runs its own Queries and Mutations.
         {
-            // For Identities outside Members: Group.assignMember(identity, applications) composes it.
-            // `query` opens `/v/<name>`: the full page reads that Path with a Query under the visitor's
-            // own rights, so read rules still decide what it sees.
-            subject: S.core.nodes.applications,
-            functions: [
-                S.functions.listEntrypoints,
-                K.classes.View.static.methods.resolve,
-                K.functions.query,
-            ],
+            role: K.core.nodes['authority.reader'],
+            members: [requirements.domain],
+            granters: [S.core.nodes['workspace.admin']],
         },
+        {
+            role: K.core.nodes['graph.reader'],
+            members: [requirements.domain],
+            granters: [S.core.nodes['workspace.admin']],
+        },
+        {
+            role: K.core.nodes['graph.writer'],
+            members: [requirements.domain],
+            granters: [S.core.nodes['workspace.admin']],
+        },
+        // admin grants the other parts of reader and writer and the readers outside them (R2).
+        { role: K.core.nodes['graph.manager'], granters: [S.core.nodes['workspace.admin']] },
+        { role: K.core.nodes['blob.reader'], granters: [S.core.nodes['workspace.admin']] },
+        { role: K.core.nodes['blob.writer'], granters: [S.core.nodes['workspace.admin']] },
+        { role: K.core.nodes['blob.manager'], granters: [S.core.nodes['workspace.admin']] },
+        { role: K.core.nodes['view.reader'], granters: [S.core.nodes['workspace.admin']] },
+        { role: K.core.nodes['domain.reader'], granters: [S.core.nodes['workspace.admin']] },
+        { role: K.core.nodes['execution.reader'], granters: [S.core.nodes['workspace.admin']] },
+        { role: K.core.nodes['journal.reader'], granters: [S.core.nodes['workspace.admin']] },
     ],
-});
+}));
 export const domain = defineDomain({
     schema: ShellSchema,
     runtime,

package/dist/functions/application/index.js

@@ -1 +1,2 @@
-export { listEntrypoints } from './list-entrypoints.js';
+// Seam L-SHELL-11: the legacy handler the Runtime registers.
+export { legacyListEntrypoints } from './legacy/index.js';

package/dist/functions/application/legacy/index.js

@@ -0,0 +1 @@
+export { legacyListEntrypoints } from './list-entrypoints.js';

package/dist/functions/application/legacy/list-entrypoints.js

@@ -0,0 +1,8 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { legacyReadInstalledEntrypoints } from '../../../queries/application/legacy/index.js';
+/**
+ * @deprecated One graph read with Shell's authority: every Domain with an `entrypoint` Edge, its
+ * name and its entrypoint View (L-SHELL-11). Replaced by the visitor's own Query (V2). Removal:
+ * Shell major (delivery step 5) after 1Pact step 4.
+ */
+export const legacyListEntrypoints = defineAction()('listEntrypoints', async ({ query }) => ({ entrypoints: [...(await query(legacyReadInstalledEntrypoints, {}))] }));

package/dist/functions/authority/capabilities.js

@@ -0,0 +1 @@
+export {};

package/dist/functions/authority/composition.js

@@ -0,0 +1,47 @@
+import { readExtensions } from '../../queries/composition/index.js';
+/** A composition deeper than this is refused as a defect rather than walked further. */
+const MAXIMUM_DEPTH = 32;
+/** Identities one frontier Query starts from. */
+const FRONTIER = 256;
+/**
+ * Every Identity reached from `start` along Kernel `extends_with`, with its Class: `outgoing`, what
+ * `start` holds; `incoming`, who holds `start`. The Kernel refuses cycles, so the walk ends.
+ */
+export async function walkComposition({ query }, start, direction) {
+    const reached = new Map();
+    let frontier = [start];
+    for (let depth = 0; frontier.length > 0; depth += 1) {
+        if (depth === MAXIMUM_DEPTH)
+            throw new RangeError('The composition is deeper than Shell walks.');
+        const next = [];
+        for (let index = 0; index < frontier.length; index += FRONTIER) {
+            const [first, ...others] = frontier.slice(index, index + FRONTIER);
+            if (first === undefined)
+                continue;
+            const edges = await query(readExtensions, {
+                identities: [first, ...others],
+                direction,
+            });
+            for (const edge of edges) {
+                const [far, farClass] = direction === 'outgoing'
+                    ? [edge.target, edge.targetClass]
+                    : [edge.source, edge.sourceClass];
+                if (far === start || reached.has(far))
+                    continue;
+                reached.set(far, farClass);
+                next.push(far);
+            }
+        }
+        frontier = next;
+    }
+    return reached;
+}
+/** The `extends_with` Edges into one Identity: its direct members. */
+export async function readMembers({ query }, identity) {
+    return query(readExtensions, { identities: [identity], direction: 'incoming' });
+}
+/** The Identities one Identity extends directly. */
+export async function readExtensionTargets({ query }, identity) {
+    const edges = await query(readExtensions, { identities: [identity], direction: 'outgoing' });
+    return new Set(edges.map(({ target }) => target));
+}

package/dist/functions/authority/index.js

@@ -0,0 +1,2 @@
+export { authority } from './roles.js';
+export { readExtensionTargets, readMembers, walkComposition } from './composition.js';

package/dist/functions/authority/roles.js

@@ -0,0 +1,98 @@
+import { readRoleNodes } from '../../queries/composition/index.js';
+import { readIdentities } from '../../queries/identity/index.js';
+import { readRoleNode } from '../../queries/role/index.js';
+import { walkComposition } from './composition.js';
+/** Kernel reader and writer and their parts: every other Kernel Role administers (U4). */
+const KERNEL_ORDINARY = new Set([
+    'reader',
+    'writer',
+    'graph.reader',
+    'graph.writer',
+    'graph.manager',
+    'blob.reader',
+    'blob.writer',
+    'blob.manager',
+    'view.reader',
+    'domain.reader',
+]);
+const SHELL_ADMINISTRATIVE = new Set([
+    'workspace.admin',
+    'user.writer',
+    'group.writer',
+    'directory.provisioner',
+]);
+const keyOf = (ref) => `${ref.origin}:${ref.name}`;
+/** One handler's view of authority; each composition and the Role catalogue is read once. */
+export function authority(capabilities) {
+    const S = capabilities.domain;
+    const kernel = S.dependencies.kernel.origin;
+    let catalogue;
+    const roles = () => (catalogue ??= capabilities.query(readRoleNodes, {}));
+    const compositions = new Map();
+    const composition = (identity) => {
+        let walked = compositions.get(identity);
+        if (walked === undefined) {
+            walked = walkComposition(capabilities, identity, 'outgoing');
+            compositions.set(identity, walked);
+        }
+        return walked;
+    };
+    const administrative = async () => {
+        const { byKey } = await roles();
+        const ids = new Set();
+        for (const [key, id] of byKey) {
+            const [origin, name] = [key.slice(0, key.indexOf(':')), key.slice(key.indexOf(':') + 1)];
+            if (origin === S.origin && SHELL_ADMINISTRATIVE.has(name))
+                ids.add(id);
+            if (origin === kernel && !KERNEL_ORDINARY.has(name))
+                ids.add(id);
+        }
+        return ids;
+    };
+    return {
+        async roleNode(role) {
+            return (await roles()).byKey.get(keyOf(S.core.nodes[role].ref));
+        },
+        async callerHolds(role) {
+            const caller = capabilities.graph.caller;
+            if (caller === undefined)
+                return false;
+            return caller.query(readRoleNode, { role: S.core.nodes[role].ref });
+        },
+        async heldRole(identity) {
+            const { byKey } = await roles();
+            const reached = await composition(identity);
+            const held = [...byKey].filter(([, id]) => reached.has(id)).map(([key]) => key);
+            const admin = keyOf(S.core.nodes['workspace.admin'].ref);
+            const role = held.includes(admin) ? admin : held[0];
+            if (role === undefined)
+                return undefined;
+            return role.startsWith(`${S.origin}:`) ? role.slice(S.origin.length + 1) : role;
+        },
+        async holdsAdministration(identity) {
+            const ids = await administrative();
+            for (const reached of (await composition(identity)).keys())
+                if (ids.has(reached))
+                    return true;
+            return false;
+        },
+        async reaches(from, to) {
+            return from === to || (await composition(from)).has(to);
+        },
+        async activeAdministrators() {
+            const admin = (await roles()).byKey.get(keyOf(S.core.nodes['workspace.admin'].ref));
+            if (admin === undefined)
+                return [];
+            const holders = [...(await walkComposition(capabilities, admin, 'incoming')).keys()];
+            const [first, ...others] = holders;
+            if (first === undefined)
+                return [];
+            const accounts = await capabilities.query(readIdentities, {
+                kind: 'User',
+                ids: [first, ...others],
+            });
+            const frozen = S.classes.User.properties.frozen.key;
+            return accounts.filter(({ props }) => props[frozen] !== true).map(({ id }) => id);
+        },
+    };
+}

package/dist/functions/directory/disconnect-directory.js

@@ -0,0 +1,35 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { toGroup } from '../group/index.js';
+import { toAccount, userErrors, writeAccount } from '../user/index.js';
+import { updateGroup } from '../../mutations/identity/index.js';
+import { readIdentities } from '../../queries/identity/index.js';
+/**
+ * The directory is disconnected (`dsync.deleted`): its accounts and groups become local. Their
+ * `directory` and `externalId` are erased; an account the directory had frozen stays frozen. Replaying it changes nothing (A3).
+ */
+export const disconnectDirectory = defineAction()('disconnectDirectory', { errors: userErrors }, async (context) => {
+    const { directory } = context.input;
+    const [users, groups] = await Promise.all([
+        context.query(readIdentities, { kind: 'User', where: { directory } }),
+        context.query(readIdentities, { kind: 'Group', where: { directory } }),
+    ]);
+    for (const node of users) {
+        const account = toAccount(context.domain, node);
+        const written = await writeAccount(context, account, {
+            directory: null,
+            externalId: null,
+        });
+        if (written === 'DUPLICATE_KEY' || written === 'CHANGED') {
+            throw context.error('ACCOUNT_CHANGED', {});
+        }
+    }
+    for (const node of groups) {
+        const group = toGroup(context.domain, node);
+        await context.mutate(updateGroup, {
+            group: group.id,
+            set: {},
+            unset: ['directory', 'externalId'],
+        });
+    }
+    return { users: users.length, groups: groups.length };
+});

package/dist/functions/directory/index.js

@@ -0,0 +1 @@
+export { disconnectDirectory } from './disconnect-directory.js';

package/dist/functions/group/change-group-membership.js

@@ -1,31 +1,65 @@
 import { setGroupMembership } from '../../mutations/group/index.js';
-import { readGroupMembership, readGroupMembershipEndpoints, } from '../../queries/group/index.js';
+import { readGroupMembership, readGroupMembershipEndpoints } from '../../queries/group/index.js';
 import { canonicalNodeId } from '../../utils/canonical-node-path/index.js';
-const matches = (state, present) => state.membership === present && state.authority === present;
+import { readGroup } from './group.js';
+// Seam L-SHELL-8, L-SHELL-9: legacy groups also keep `member_of_group`; a Domain's own Group
+// subclass changes its members under that Domain's authority.
+import { legacyMembershipEdges, legacyChangeForeignMembership } from './legacy/index.js';
+import { membershipRefusal } from './membership-laws.js';
+/**
+ * Add or withdraw one direct member of a Shell group: Kernel `extends_with` from the member to the
+ * group (G1), under G2, G3 and acyclicity. The write converges what it observed, guarded by it;
+ * after an unknown outcome it observes again, and an unconfirmed outcome stays explicit.
+ */
 export async function changeGroupMembership(context, present) {
     const invalid = () => context.error('INVALID_GROUP_MEMBERSHIP_REFERENCE', {});
     const membership = {
         member: canonicalNodeId(context.input.member, invalid),
         group: canonicalNodeId(context.input.group, invalid),
     };
+    const endpoints = await context.step.run('observe-endpoints', () => context.query(readGroupMembershipEndpoints, membership));
+    if (!endpoints.visible)
+        throw context.error('GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE', {});
+    if (endpoints.groupClass !== context.domain.classes.Group.key) {
+        return legacyChangeForeignMembership(context, membership, present);
+    }
+    const refusal = await context.step.run('check-laws', async () => {
+        const group = await readGroup(context, membership.group);
+        if (group === undefined)
+            return { code: 'GROUP_NOT_FOUND' };
+        return (await membershipRefusal(context, group, membership.member, present)) ?? null;
+    });
+    if (refusal !== null) {
+        if (refusal.code === 'GROUP_ROLE_PROTECTED') {
+            throw context.error(refusal.code, { role: refusal.role });
+        }
+        throw context.error(refusal.code, {});
+    }
     const observe = async () => {
-        const endpoints = await context.query(readGroupMembershipEndpoints, membership);
-        if (!endpoints.visible)
+        const current = await context.query(readGroupMembershipEndpoints, membership);
+        if (!current.visible)
             throw context.error('GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE', {});
-        const current = await context.query(readGroupMembership, membership);
-        return { ...current, endpoints: endpoints.guard };
+        const authority = await context.query(readGroupMembership, membership);
+        const edges = [
+            { edge: 'authority', current: authority.present, present, guard: authority.guard },
+            ...(await legacyMembershipEdges(context, membership, present)),
+        ];
+        return { endpoints: current.guard, edges };
     };
+    const matches = (edges) => edges.every(({ current, present: wanted }) => current === wanted);
     const current = await context.step.run('observe-membership', observe);
-    if (matches(current, present))
+    if (matches(current.edges))
         return {};
-    const result = await context.step.run('mutate-membership', () => context.mutate(setGroupMembership, { ...membership, current, present }));
+    const result = await context.step.run('mutate-membership', () => context.mutate(setGroupMembership, { ...membership, ...current }));
     if (result.ok)
         return {};
     if (result.outcomeKnown) {
+        if (result.rule === 'cycle')
+            throw context.error('GROUP_MEMBERSHIP_CYCLE', {});
         throw context.error('GROUP_MEMBERSHIP_CONFLICT', { cause: result.code });
     }
     const recovered = await context.step.run('recover-membership', observe);
-    if (matches(recovered, present))
+    if (matches(recovered.edges))
         return {};
     throw context.error('GROUP_MEMBERSHIP_UNCONFIRMED', {
         cause: result.code,

package/dist/functions/group/create-group.js

@@ -0,0 +1,23 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { Path } from '@astrale-os/sdk/graph/path';
+import { createGroup } from '../../mutations/identity/index.js';
+import { MAX_ATTRIBUTES, boundedAttributes } from '../../utils/index.js';
+import { groupErrors } from './group-errors.js';
+/** Create a local group. An empty group holds nothing: creating one grants no right. */
+export const create = defineAction()('Group.create', { errors: groupErrors }, async ({ input, mutate, error }) => {
+    const attributes = input.attributes === undefined ? undefined : boundedAttributes(input.attributes);
+    if (input.attributes !== undefined && attributes === undefined) {
+        throw error('GROUP_ATTRIBUTES_TOO_MANY', { max: MAX_ATTRIBUTES });
+    }
+    const result = await mutate(createGroup, {
+        values: {
+            name: input.name,
+            ...(input.description === undefined ? {} : { description: input.description }),
+            ...(input.icon === undefined || input.icon === null ? {} : { icon: input.icon }),
+            ...(attributes === undefined ? {} : { attributes }),
+        },
+    });
+    if (!result.ok)
+        throw error('GROUP_CHANGED', {});
+    return { group: Path.id(result.group).raw };
+});

package/dist/functions/group/delete-group.js

@@ -0,0 +1,33 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { readMembers } from '../authority/index.js';
+import { deleteIdentity } from '../../mutations/identity/index.js';
+import { readProfile } from '../../queries/profile/index.js';
+import { groupErrors } from './group-errors.js';
+import { isProvidedGroup, readGroup } from './group.js';
+import { roleProtected } from './membership-laws.js';
+/**
+ * Withdraw a local group's memberships, incoming and outgoing, and delete it (G4). Only its directory
+ * deletes a provided group (G2); only an admin deletes a group that holds a Role (G3).
+ */
+export const remove = defineAction()('Group.delete', { errors: groupErrors }, async (context) => {
+    const { error, self } = context;
+    const group = await readGroup(context, self);
+    if (group === undefined)
+        throw error('GROUP_NOT_FOUND', {});
+    if (isProvidedGroup(group))
+        throw error('GROUP_DIRECTORY_MANAGED', {});
+    const role = await roleProtected(context, group);
+    if (role !== undefined)
+        throw error('GROUP_ROLE_PROTECTED', { role });
+    const members = await readMembers(context, self);
+    const profile = await context.query(readProfile, { kind: 'Group', node: self });
+    const result = await context.mutate(deleteIdentity, {
+        kind: 'Group',
+        node: self,
+        members,
+        ...(profile === undefined ? {} : { profile }),
+    });
+    if (!result.ok)
+        throw error('GROUP_CHANGED', {});
+    return {};
+});

package/dist/functions/group/deprovision-group.js

@@ -0,0 +1,27 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { readMembers } from '../authority/index.js';
+import { deleteIdentity } from '../../mutations/identity/index.js';
+import { readProfile } from '../../queries/profile/index.js';
+import { groupErrors } from './group-errors.js';
+import { findGroup } from './group.js';
+/**
+ * The directory deleted the group (`dsync.group.deleted`): its memberships leave and it is deleted
+ * (G4). A group the directory no longer has is left as it is (A3).
+ */
+export const deprovision = defineAction()('Group.deprovision', { errors: groupErrors }, async (context) => {
+    const { input, error } = context;
+    const group = await findGroup(context, input);
+    if (group === undefined)
+        return {};
+    const members = await readMembers(context, group.id);
+    const profile = await context.query(readProfile, { kind: 'Group', node: group.id });
+    const result = await context.mutate(deleteIdentity, {
+        kind: 'Group',
+        node: group.id,
+        members,
+        ...(profile === undefined ? {} : { profile }),
+    });
+    if (!result.ok)
+        throw error('GROUP_CHANGED', {});
+    return {};
+});

package/dist/functions/group/group-errors.js

@@ -0,0 +1,43 @@
+import { z } from 'zod';
+const none = z.strictObject({});
+/**
+ * The refusals of the group methods. The SDK declares no FORBIDDEN business family, so a law that
+ * forbids a change for the state of the group or its caller answers CONFLICT.
+ */
+export const groupErrors = {
+    GROUP_NOT_FOUND: {
+        family: 'NOT_FOUND',
+        message: 'No group is at this path.',
+        details: none,
+    },
+    GROUP_ATTRIBUTES_TOO_MANY: {
+        family: 'VALIDATION_ERROR',
+        message: 'A group carries at most 64 attributes.',
+        details: z.strictObject({ max: z.number() }),
+    },
+    GROUP_DIRECTORY_MANAGED: {
+        family: 'CONFLICT',
+        message: "This group is managed by your organization's directory. Change it in the directory.",
+        details: none,
+    },
+    GROUP_NOT_DIRECTORY_MANAGED: {
+        family: 'CONFLICT',
+        message: 'This group is local: only group.writer changes its members.',
+        details: none,
+    },
+    GROUP_ROLE_PROTECTED: {
+        family: 'CONFLICT',
+        message: 'This group grants a role. Only an administrator may change its members.',
+        details: z.strictObject({ role: z.string() }),
+    },
+    GROUP_MEMBERSHIP_CYCLE: {
+        family: 'CONFLICT',
+        message: 'This member already holds the group: the membership would close a cycle.',
+        details: none,
+    },
+    GROUP_CHANGED: {
+        family: 'CONFLICT',
+        message: 'The group changed concurrently; retry the operation.',
+        details: none,
+    },
+};

package/dist/functions/group/group-membership-errors.js

@@ -1,5 +1,7 @@
 import { z } from 'zod';
+import { groupErrors } from './group-errors.js';
 export const groupMembershipErrors = {
+    ...groupErrors,
     GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE: {
         family: 'CONFLICT',
         message: 'Shell must be able to traverse both membership endpoints before confirming membership.',