@astrale-domains/shell 0.1.5 → 0.1.7

package/dist/functions/user/invite-user.js

@@ -1,39 +1,47 @@
 import { defineWorkflow } from '@astrale-os/sdk/workflow';
-import { z } from 'zod';
-import { InvitationRequestFailure } from '../../integrations/user-invitation/index.js';
+import { authority, readExtensionTargets } from '../authority/index.js';
+import { grantRole } from '../../mutations/composition/index.js';
 import { canonicalNodeId } from '../../utils/canonical-node-path/index.js';
-export const invite = defineWorkflow()('User.invite', {
-    errors: {
-        INVALID_INVITATION_REFERENCE: {
-            family: 'VALIDATION_ERROR',
-            message: 'User must be an exact canonical @NodeId path.',
-            details: z.strictObject({}),
-        },
-        INVITATION_CONFLICT: {
-            family: 'CONFLICT',
-            message: 'The invitation conflicts with an existing request.',
-            details: z.strictObject({ requestId: z.string() }),
-        },
-        INVITATION_REJECTED: {
-            family: 'VALIDATION_ERROR',
-            message: 'Admin rejected the invitation request.',
-            details: z.strictObject({ requestId: z.string() }),
-        },
-    },
-}, async (context) => {
+import { inviteErrors } from './invite-errors.js';
+// Seam L-SHELL-6: the `{ user, email }` form of callers older than profiles.
+import { legacyInvite, legacyIsInvitation } from './legacy/index.js';
+import { readAccount } from './read-account.js';
+import { requestInvitation } from './request-invitation.js';
+import { userErrors } from './user-errors.js';
+const errors = { ...inviteErrors, ...userErrors };
+/**
+ * Grant the account its profile, `member` by default, then have Admin send the invitation to the
+ * account's own email. A deactivated account is not invited; only an admin grants `admin`.
+ *
+ * @deprecated The invitation before durable invitations (L-SHELL-18). Replaced by
+ * `Invitation.send` (`functions/invitation/send-invitation.ts`). Removal: Shell major (delivery
+ * step 5), once Admin (step 2) and 1Pact (step 4) call `Invitation.send`.
+ */
+export const invite = defineWorkflow()('User.invite', { errors }, async (context) => {
     const user = canonicalNodeId(context.input.user, () => context.error('INVALID_INVITATION_REFERENCE', {}));
-    const requestId = context.execution.idempotencyKey ?? crypto.randomUUID();
-    try {
-        return await context.step.run('request-invitation', () => context.integrations.enrollment.invite({
-            user,
-            email: context.input.email,
-            requestId,
-            requestedBy: context.caller.identity,
-        }));
-    }
-    catch (cause) {
-        if (cause instanceof InvitationRequestFailure)
-            throw context.error(cause.code, { requestId });
-        throw cause;
+    if (legacyIsInvitation(context.input))
+        return legacyInvite(context, user);
+    const profile = context.input.profile ?? 'member';
+    const role = `workspace.${profile}`;
+    const account = await context.step.run('read-account', () => readAccount(context, user));
+    if (account === undefined)
+        throw context.error('USER_NOT_FOUND', {});
+    if (account.frozen)
+        throw context.error('USER_SUSPENDED', {});
+    if (account.email === undefined)
+        throw context.error('USER_EMAIL_INVALID', {});
+    const email = account.email;
+    if (profile === 'admin') {
+        const admitted = await context.step.run('check-profile', () => authority(context).callerHolds('workspace.admin'));
+        if (!admitted)
+            throw context.error('PROFILE_NOT_HELD', {});
     }
+    await context.step.run('grant-profile', async () => {
+        const held = await readExtensionTargets(context, user);
+        const node = await authority(context).roleNode(role);
+        if (node !== undefined && held.has(node))
+            return;
+        await context.mutate(grantRole, { holder: user, role: context.domain.core.nodes[role].ref });
+    });
+    return requestInvitation(context, { user, email, profile });
 });

package/dist/functions/user/legacy/claimed-account.js

@@ -0,0 +1,11 @@
+import { readIdentities } from '../../../queries/identity/index.js';
+/**
+ * @deprecated The account that claimed an email before accounts had `email` (L-SHELL-13): Shell
+ * neither creates nor provides a second account for it (U1), and does not trust the claim enough to
+ * return that account; `legacyMigrateAccounts` makes it the email's account. Replaced by the
+ * `email` key alone. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export async function legacyClaimedAccount({ query }, email) {
+    const [claimed] = await query(readIdentities, { kind: 'User', where: { claimedEmail: email } });
+    return claimed?.id;
+}

package/dist/functions/user/legacy/index.js

@@ -0,0 +1,4 @@
+export { legacyClaimedAccount } from './claimed-account.js';
+export { legacyInvite, legacyIsInvitation } from './invite.js';
+export { legacyRecordProfile } from './record-profile.js';
+export { legacyMigrateAccounts } from './migrate-accounts.js';

package/dist/functions/user/legacy/invite.js

@@ -0,0 +1,20 @@
+import { requestInvitation } from '../request-invitation.js';
+/**
+ * @deprecated Whether an invitation names its email, the form before profiles (L-SHELL-6).
+ * Replaced by `User.invite({ user, profile })`. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export function legacyIsInvitation(input) {
+    return input.email !== undefined;
+}
+/**
+ * @deprecated The `{ user, email }` invitation of callers older than profiles (L-SHELL-6): Admin
+ * sends it to the email the caller gives and assigns the Core group itself; Shell grants nothing.
+ * Replaced by `User.invite({ user, profile })`. Removal: Shell major (delivery step 5) after 1Pact
+ * step 4.
+ */
+export function legacyInvite(context, user) {
+    const email = context.input.email;
+    if (email === undefined)
+        throw new TypeError('A legacy invitation names its email.');
+    return requestInvitation(context, { user, email });
+}

package/dist/functions/user/legacy/migrate-accounts.js

@@ -0,0 +1,98 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { toGroup } from '../../group/index.js';
+import { createProfile, groupProfileValues, newProfileValues } from '../../../mutations/identity/index.js';
+import { readIdentities } from '../../../queries/identity/index.js';
+import { readProfile } from '../../../queries/profile/index.js';
+import { nodeReference, normalizeEmail, toAccount } from '../account.js';
+import { readAccount } from '../read-account.js';
+import { writeAccount } from '../write-account.js';
+/**
+ * @deprecated (L-SHELL-14) The profile name the migration gives an account that has neither a name
+ * nor an email yet. Replaced by nothing: accounts are born with a name or an email. Removal: with
+ * `legacyMigrateAccounts`.
+ */
+export const LEGACY_UNNAMED_ACCOUNT = 'Compte sans nom';
+/**
+ * @deprecated Write `email` and `name` on the accounts created before them, from what
+ * each recorded about itself, and give every account and group stored before profiles its
+ * profile (L-SHELL-14). Idempotent: an account that has them is left as it is,
+ * and an email another account holds is reported, never taken. Replaced by nothing: accounts are
+ * born with them. Removal: Shell major (delivery step 5) after 1Pact step 4, once every instance
+ * has run it.
+ *
+ * A claimed email was recorded by the account itself at sign-in: an administrator runs this only
+ * where the GUI recorded the email its identity provider verified.
+ */
+export const legacyMigrateAccounts = defineAction()('legacyMigrateAccounts', async (context) => {
+    const properties = context.domain.classes.User.properties;
+    const nodes = await context.query(readIdentities, { kind: 'User', where: {} });
+    const accounts = nodes.map((node) => ({
+        account: toAccount(context.domain, node),
+        props: node.props,
+    }));
+    const taken = new Map();
+    for (const { account } of accounts)
+        if (account.email !== undefined)
+            taken.set(account.email, account.id);
+    let migrated = 0;
+    const conflicts = [];
+    for (const { account, props } of accounts) {
+        const claimedEmail = props[properties.claimedEmail.key];
+        const claimedName = props[properties.claimedName.key];
+        const email = account.email === undefined && typeof claimedEmail === 'string'
+            ? normalizeEmail(claimedEmail)
+            : undefined;
+        if (email !== undefined && taken.has(email) && taken.get(email) !== account.id) {
+            conflicts.push({ user: nodeReference(account.id), email });
+            continue;
+        }
+        const name = account.name === undefined && typeof claimedName === 'string'
+            ? claimedName.slice(0, 100)
+            : undefined;
+        const written = await writeAccount(context, account, {
+            ...(email === undefined ? {} : { email }),
+            ...(name === undefined ? {} : { name }),
+        });
+        if (written === 'written') {
+            migrated += 1;
+            if (email !== undefined)
+                taken.set(email, account.id);
+        }
+        else if (written !== 'unchanged' && email !== undefined) {
+            conflicts.push({ user: nodeReference(account.id), email });
+        }
+    }
+    // Every account and group stored before profiles gets its profile, from its values now.
+    let profiles = 0;
+    for (const { account } of accounts) {
+        if ((await context.query(readProfile, { kind: 'User', node: account.id })) !== undefined)
+            continue;
+        const current = (await readAccount(context, account.id)) ?? account;
+        // An account with no name nor email, such as the owner `instance create` makes, still gets
+        // one: named for now, renamed with the account once it has a name.
+        const values = newProfileValues(current) ?? { name: LEGACY_UNNAMED_ACCOUNT };
+        const result = await context.mutate(createProfile, {
+            kind: 'User',
+            owner: account.id,
+            values,
+        });
+        if (result.ok)
+            profiles += 1;
+    }
+    const groups = await context.query(readIdentities, { kind: 'Group', where: {} });
+    for (const node of groups) {
+        const group = toGroup(context.domain, node);
+        if (group.name === undefined)
+            continue;
+        if ((await context.query(readProfile, { kind: 'Group', node: group.id })) !== undefined)
+            continue;
+        const result = await context.mutate(createProfile, {
+            kind: 'Group',
+            owner: group.id,
+            values: groupProfileValues(group),
+        });
+        if (result.ok)
+            profiles += 1;
+    }
+    return { migrated, conflicts, profiles };
+});

package/dist/functions/user/legacy/record-profile.js

@@ -0,0 +1,19 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { legacyRecordUserProfile } from '../../../mutations/user/legacy/index.js';
+import { legacyReadUserProfile } from '../../../queries/user/legacy/index.js';
+/**
+ * @deprecated The email and display name the GUI records at each sign-in (L-SHELL-5): one read and,
+ * only when something changed, one write, with Shell's own authority; the email in lower case.
+ * Replaced by `User.updateProfile`. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export const legacyRecordProfile = defineAction()('User.recordProfile', async ({ input, self, query, mutate }) => {
+    const asked = {
+        ...(input.email === undefined ? {} : { email: input.email.trim().toLowerCase() }),
+        ...(input.displayName === undefined ? {} : { displayName: input.displayName }),
+    };
+    const current = await query(legacyReadUserProfile, { user: self });
+    const set = Object.fromEntries(Object.entries(asked).filter(([key, value]) => current[key] !== value));
+    if (Object.keys(set).length > 0)
+        await mutate(legacyRecordUserProfile, { user: self, set });
+    return {};
+});

package/dist/functions/user/protect-administrators.js

@@ -0,0 +1,16 @@
+import { authority } from '../authority/index.js';
+/**
+ * U4 and U5 for a change that takes an account away from its holder: only an admin changes an
+ * account that holds an administration Role, and the last active admin stays. Answers the refusal.
+ */
+export async function protectAdministrators(capabilities, user, options) {
+    const authorities = authority(capabilities);
+    if (!(await authorities.holdsAdministration(user)))
+        return undefined;
+    if (!(await authorities.callerHolds('workspace.admin')))
+        return 'USER_ADMINISTRATOR_PROTECTED';
+    if (!options.keepsLastAdministrator)
+        return undefined;
+    const active = await authorities.activeAdministrators();
+    return active.includes(user) && active.length <= 1 ? 'USER_LAST_ADMINISTRATOR' : undefined;
+}

package/dist/functions/user/provision-user.js

@@ -0,0 +1,70 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { createAccount } from '../../mutations/identity/index.js';
+import { nodeReference, normalizeEmail } from './account.js';
+// Seam L-SHELL-13: an email an account claimed before `email` existed is taken (U1).
+import { legacyClaimedAccount } from './legacy/index.js';
+import { findAccount } from './read-account.js';
+import { userErrors } from './user-errors.js';
+import { writeAccount } from './write-account.js';
+/** A2: an account a directory adopts, local, or of the same directory and frozen. */
+const adoptable = (account, directory) => account.directory === undefined || (account.directory === directory && account.frozen);
+/**
+ * Write the account a directory provides (`dsync.user.created`, `dsync.user.updated`). The account
+ * of its directory id is updated; else the account of its email is adopted (A2); else one is
+ * created. Replaying an event writes nothing (A3); a conflict refuses it whole and names the
+ * account it conflicts with (A4).
+ */
+export const provision = defineAction()('User.provision', { errors: userErrors }, async (context) => {
+    const { input, error } = context;
+    const email = normalizeEmail(input.email);
+    if (email === undefined)
+        throw error('USER_EMAIL_INVALID', {});
+    const { directory, externalId } = input;
+    const provided = {
+        email,
+        name: input.name,
+        givenName: input.givenName ?? null,
+        familyName: input.familyName ?? null,
+        frozen: !input.active,
+    };
+    const [byDirectory, byEmail] = await Promise.all([
+        findAccount(context, { directory, externalId }),
+        findAccount(context, { email }),
+    ]);
+    const conflict = (account) => error('DIRECTORY_CONFLICT', { user: nodeReference(account.id) });
+    let target = byDirectory;
+    let adopted = false;
+    if (byDirectory !== undefined) {
+        if (byEmail !== undefined && byEmail.id !== byDirectory.id)
+            throw conflict(byEmail);
+    }
+    else if (byEmail !== undefined) {
+        if (!adoptable(byEmail, directory))
+            throw conflict(byEmail);
+        target = byEmail;
+        adopted = true;
+    }
+    if (target === undefined) {
+        const claimed = await legacyClaimedAccount(context, email);
+        if (claimed !== undefined)
+            throw error('DIRECTORY_CONFLICT', { user: nodeReference(claimed) });
+        const result = await context.mutate(createAccount, {
+            values: {
+                email,
+                name: input.name,
+                ...(input.givenName === undefined ? {} : { givenName: input.givenName }),
+                ...(input.familyName === undefined ? {} : { familyName: input.familyName }),
+                directory,
+                externalId,
+                frozen: !input.active,
+            },
+        });
+        if (!result.ok)
+            throw error('ACCOUNT_CHANGED', {});
+        return { user: nodeReference(result.user), created: true, adopted: false };
+    }
+    const written = await writeAccount(context, target, { ...provided, directory, externalId });
+    if (written === 'DUPLICATE_KEY' || written === 'CHANGED')
+        throw error('ACCOUNT_CHANGED', {});
+    return { user: nodeReference(target.id), created: false, adopted };
+});

package/dist/functions/user/reactivate-user.js

@@ -0,0 +1,19 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { protectAdministrators } from './protect-administrators.js';
+import { readAccount } from './read-account.js';
+import { userErrors } from './user-errors.js';
+import { writeAccount } from './write-account.js';
+/** `frozen: false`: the account may sign in again (U4). */
+export const reactivate = defineAction()('User.reactivate', { errors: userErrors }, async (context) => {
+    const { error, self } = context;
+    const account = await readAccount(context, self);
+    if (account === undefined)
+        throw error('USER_NOT_FOUND', {});
+    const refusal = await protectAdministrators(context, self, { keepsLastAdministrator: false });
+    if (refusal !== undefined)
+        throw error(refusal, {});
+    const written = await writeAccount(context, account, { frozen: false });
+    if (written === 'CHANGED' || written === 'DUPLICATE_KEY')
+        throw error('ACCOUNT_CHANGED', {});
+    return {};
+});

package/dist/functions/user/read-account.js

@@ -0,0 +1,12 @@
+import { readIdentities } from '../../queries/identity/index.js';
+import { toAccount } from './account.js';
+/** The account at one Node, or undefined when there is none Shell reads. */
+export async function readAccount({ query, domain }, user) {
+    const [node] = await query(readIdentities, { kind: 'User', ids: [user] });
+    return node === undefined ? undefined : toAccount(domain, node);
+}
+/** The account holding these values: an email, or a directory and its id there. */
+export async function findAccount({ query, domain }, where) {
+    const [node] = await query(readIdentities, { kind: 'User', where });
+    return node === undefined ? undefined : toAccount(domain, node);
+}

package/dist/functions/user/request-invitation.js

@@ -0,0 +1,17 @@
+import { InvitationRequestFailure } from '../../integrations/user-invitation/index.js';
+/** Ask Admin to send the invitation, once per invocation key. */
+export async function requestInvitation(context, request) {
+    const requestId = context.execution.idempotencyKey ?? crypto.randomUUID();
+    try {
+        return await context.step.run('request-invitation', () => context.integrations.enrollment.invite({
+            ...request,
+            requestId,
+            requestedBy: context.caller.identity,
+        }));
+    }
+    catch (cause) {
+        if (cause instanceof InvitationRequestFailure)
+            throw context.error(cause.code, { requestId });
+        throw cause;
+    }
+}

package/dist/functions/user/update-profile.js

@@ -0,0 +1,22 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { isProvided } from './account.js';
+import { readAccount } from './read-account.js';
+import { userErrors } from './user-errors.js';
+import { writeAccount } from './write-account.js';
+/** The holder changes its own name or icon; a provided account's name is its directory's (U3). */
+export const updateProfile = defineAction()('User.updateProfile', { errors: userErrors }, async (context) => {
+    const { input, error, self } = context;
+    const account = await readAccount(context, self);
+    if (account === undefined)
+        throw error('USER_NOT_FOUND', {});
+    if (isProvided(account) && input.name !== undefined && input.name !== account.name) {
+        throw error('USER_DIRECTORY_MANAGED', {});
+    }
+    const written = await writeAccount(context, account, {
+        ...(input.name === undefined ? {} : { name: input.name }),
+        ...(input.icon === undefined ? {} : { icon: input.icon }),
+    });
+    if (written === 'CHANGED' || written === 'DUPLICATE_KEY')
+        throw error('ACCOUNT_CHANGED', {});
+    return {};
+});

package/dist/functions/user/update-user.js

@@ -0,0 +1,68 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { authority } from '../authority/index.js';
+import { MAX_ATTRIBUTES, boundedAttributes } from '../../utils/index.js';
+import { isProvided, nodeReference, normalizeEmail } from './account.js';
+import { findAccount, readAccount } from './read-account.js';
+import { userErrors } from './user-errors.js';
+import { writeAccount } from './write-account.js';
+/**
+ * Change an account's name, email, icon or attributes. Attributes are the instance's own, never
+ * the directory's (AM11). A provided account's name and email come from its
+ * directory (U3); an administrator's account changes only by an admin (U4); an email designates at
+ * most one account (U1).
+ */
+export const update = defineAction()('User.update', { errors: userErrors }, async (context) => {
+    const { input, error, self } = context;
+    const account = await readAccount(context, self);
+    if (account === undefined)
+        throw error('USER_NOT_FOUND', {});
+    const attributes = input.attributes === undefined || input.attributes === null
+        ? input.attributes
+        : boundedAttributes(input.attributes);
+    if (input.attributes !== undefined && input.attributes !== null && attributes === undefined) {
+        throw error('USER_ATTRIBUTES_TOO_MANY', { max: MAX_ATTRIBUTES });
+    }
+    let email;
+    if (input.email !== undefined) {
+        email = normalizeEmail(input.email);
+        if (email === undefined)
+            throw error('USER_EMAIL_INVALID', {});
+    }
+    const directoryOwned = {
+        name: input.name,
+        email,
+        givenName: input.givenName,
+        familyName: input.familyName,
+    };
+    if (isProvided(account) &&
+        Object.entries(directoryOwned).some(([key, value]) => value !== undefined && value !== account[key])) {
+        throw error('USER_DIRECTORY_MANAGED', {});
+    }
+    const authorities = authority(context);
+    if ((await authorities.holdsAdministration(account.id)) &&
+        !(await authorities.callerHolds('workspace.admin'))) {
+        throw error('USER_ADMINISTRATOR_PROTECTED', {});
+    }
+    if (email !== undefined && email !== account.email) {
+        const holder = await findAccount(context, { email });
+        if (holder !== undefined)
+            throw error('USER_EMAIL_TAKEN', { user: nodeReference(holder.id) });
+    }
+    const written = await writeAccount(context, account, {
+        ...(input.name === undefined ? {} : { name: input.name }),
+        ...(email === undefined ? {} : { email }),
+        ...(input.givenName === undefined ? {} : { givenName: input.givenName }),
+        ...(input.familyName === undefined ? {} : { familyName: input.familyName }),
+        ...(input.icon === undefined ? {} : { icon: input.icon }),
+        ...(attributes === undefined ? {} : { attributes }),
+    });
+    if (written === 'DUPLICATE_KEY') {
+        const holder = email === undefined ? undefined : await findAccount(context, { email });
+        throw error('USER_EMAIL_TAKEN', {
+            user: holder === undefined ? '' : nodeReference(holder.id),
+        });
+    }
+    if (written === 'CHANGED')
+        throw error('ACCOUNT_CHANGED', {});
+    return {};
+});

package/dist/functions/user/user-errors.js

@@ -0,0 +1,69 @@
+import { z } from 'zod';
+const none = z.strictObject({});
+const account = z.strictObject({ user: z.string() });
+/**
+ * The refusals of the account methods. The SDK declares no FORBIDDEN business family, so a law
+ * that forbids a change for the state of the account, its group or its caller answers CONFLICT.
+ */
+export const userErrors = {
+    USER_NOT_FOUND: {
+        family: 'NOT_FOUND',
+        message: 'No account is at this path.',
+        details: none,
+    },
+    USER_EMAIL_INVALID: {
+        family: 'VALIDATION_ERROR',
+        message: 'The email is not a valid address, or the account has none.',
+        details: none,
+    },
+    USER_ATTRIBUTES_TOO_MANY: {
+        family: 'VALIDATION_ERROR',
+        message: 'An account carries at most 64 attributes.',
+        details: z.strictObject({ max: z.number() }),
+    },
+    USER_EMAIL_TAKEN: {
+        family: 'CONFLICT',
+        message: 'Another account already has this email.',
+        details: account,
+    },
+    USER_DIRECTORY_MANAGED: {
+        family: 'CONFLICT',
+        message: "This account is managed by your organization's directory. Change it in the directory.",
+        details: none,
+    },
+    USER_ADMINISTRATOR_PROTECTED: {
+        family: 'CONFLICT',
+        message: "Only an administrator may change an administrator's account.",
+        details: none,
+    },
+    USER_LAST_ADMINISTRATOR: {
+        family: 'CONFLICT',
+        message: 'This account is the last active administrator of the workspace.',
+        details: none,
+    },
+    USER_ACTIVE: {
+        family: 'CONFLICT',
+        message: 'Deactivate this account before deleting it.',
+        details: none,
+    },
+    USER_SUSPENDED: {
+        family: 'CONFLICT',
+        message: 'This account is deactivated; reactivate it before inviting it.',
+        details: none,
+    },
+    PROFILE_NOT_HELD: {
+        family: 'CONFLICT',
+        message: 'Only an administrator may grant the admin profile.',
+        details: none,
+    },
+    DIRECTORY_CONFLICT: {
+        family: 'CONFLICT',
+        message: 'The directory event conflicts with an existing account; nothing changed.',
+        details: account,
+    },
+    ACCOUNT_CHANGED: {
+        family: 'CONFLICT',
+        message: 'The account changed concurrently; retry the operation.',
+        details: none,
+    },
+};

package/dist/functions/user/write-account.js

@@ -0,0 +1,57 @@
+import { PROFILE_PROPERTIES, newProfileValues, updateAccount, } from '../../mutations/identity/index.js';
+import { readProfile } from '../../queries/profile/index.js';
+import { sameJson } from '../../utils/index.js';
+/** The values of an account a write is decided on. */
+const DECIDED = [
+    'name',
+    'email',
+    'givenName',
+    'familyName',
+    'icon',
+    'directory',
+    'externalId',
+    'frozen',
+];
+/**
+ * Write what differs between an account and a change (`null` erases). `frozen` is written as is: it
+ * alone states whether the account may sign in. The write holds only on the values it was decided on. It answers whether
+ * anything changed, or the refusal: a key another account holds, or a concurrent change.
+ */
+export async function writeAccount({ mutate, query }, account, change) {
+    const set = {};
+    const unset = [];
+    for (const [key, value] of Object.entries(change)) {
+        const current = account[key];
+        if (value === null || value === undefined) {
+            if (value === null && current !== undefined)
+                unset.push(key);
+        }
+        else if (!sameJson(value, current))
+            set[key] = value;
+    }
+    if (Object.keys(set).length === 0 && unset.length === 0)
+        return 'unchanged';
+    const expected = Object.fromEntries(DECIDED.map((key) => [key, account[key]]));
+    // The profile carries the shared values; an account stored before profiles gets one now.
+    const shares = PROFILE_PROPERTIES.some((key) => key in set || unset.includes(key));
+    const profileNode = shares
+        ? await query(readProfile, { kind: 'User', node: account.id })
+        : undefined;
+    const merged = Object.fromEntries(Object.entries({ ...account, ...set }).filter(([key]) => !unset.includes(key)));
+    const created = profileNode === undefined ? newProfileValues(merged) : undefined;
+    const profile = !shares
+        ? undefined
+        : profileNode !== undefined
+            ? { id: profileNode }
+            : created === undefined
+                ? undefined
+                : { create: created };
+    const result = await mutate(updateAccount, {
+        user: account.id,
+        set: set,
+        unset,
+        expected,
+        ...(profile === undefined ? {} : { profile }),
+    });
+    return result.ok ? 'written' : result.refusal;
+}

package/dist/functions/view-access/index.js

@@ -1 +1,2 @@
-export { assignViews } from './assign-views.js';
+// Seam L-SHELL-12: the legacy handler the Runtime registers.
+export { legacyAssignViews } from './legacy/index.js';

package/dist/functions/view-access/{assign-views.js → legacy/assign-views.js}

@@ -1,17 +1,21 @@
 import { defineAction } from '@astrale-os/sdk/action';
 import { Path } from '@astrale-os/sdk/graph/path';
-import { setViewAccess } from '../../mutations/view-access/index.js';
-import { readViewAccess } from '../../queries/view-access/index.js';
-import { canonicalNodeId } from '../../utils/canonical-node-path/index.js';
-import { viewAccessErrors } from './view-access-errors.js';
+import { setViewAccess } from '../../../mutations/view-access/index.js';
+import { readViewAccess } from '../../../queries/view-access/index.js';
+import { canonicalNodeId } from '../../../utils/canonical-node-path/index.js';
+import { legacyViewAccessErrors } from './view-access-errors.js';
 /**
- * One read and at most one Mutation, both with Shell's own authority: holding `can_use` on this
- * Function is what admits the caller, Core admin by default. The write changes only what differs
+ * @deprecated Give and withdraw Views for each identity in one write (L-SHELL-12). Replaced by a
+ * Mutation on `view_access`, which `workspace.admin` holders write. Removal: Shell major (delivery
+ * step 5) after 1Pact step 4.
+ *
+ * One read and at most one Mutation, both with Shell's own authority: `workspace.admin` admits the
+ * caller. The write changes only what differs
  * from the Edges read, under their guard, so a View already given or already withdrawn costs
  * nothing and a concurrent change refuses the whole write. An identity listed twice gets both
  * lists; one listed with no View is not read.
  */
-export const assignViews = defineAction()('assignViews', { errors: viewAccessErrors }, async ({ error, input, query, mutate }) => {
+export const legacyAssignViews = defineAction()('assignViews', { errors: legacyViewAccessErrors }, async ({ error, input, query, mutate }) => {
     const nodeId = (reference) => {
         const invalid = () => error('INVALID_VIEW_ASSIGNMENT_REFERENCE', {});
         try {

package/dist/functions/view-access/legacy/index.js

@@ -0,0 +1 @@
+export { legacyAssignViews } from './assign-views.js';