@astrale-domains/shell 0.1.6 → 0.1.7

package/dist/functions/group/group.js

@@ -0,0 +1,51 @@
+import { GROUP_PROFILE_PROPERTIES, groupProfileValues, } from '../../mutations/identity/index.js';
+import { readIdentities } from '../../queries/identity/index.js';
+import { readProfile } from '../../queries/profile/index.js';
+import { toAttributes } from '../../utils/index.js';
+const text = (value) => (typeof value === 'string' ? value : undefined);
+/** One group Node as Shell's laws read it, by the Property keys of the resolved Domain. */
+export function toGroup(domain, node) {
+    const properties = domain.classes.Group.properties;
+    const value = (name) => node.props[properties[name].key];
+    const read = (name) => text(value(name));
+    const values = {
+        name: read('name'),
+        description: read('description'),
+        icon: read('icon'),
+        directory: read('directory'),
+        externalId: read('externalId'),
+        attributes: toAttributes(value('attributes')),
+    };
+    return {
+        id: node.id,
+        class: node.class,
+        ...Object.fromEntries(Object.entries(values).filter(([, value]) => value !== undefined)),
+    };
+}
+export async function readGroup({ query, domain }, group) {
+    const [node] = await query(readIdentities, { kind: 'Group', ids: [group] });
+    return node === undefined ? undefined : toGroup(domain, node);
+}
+export async function findGroup({ query, domain }, where) {
+    const [node] = await query(readIdentities, { kind: 'Group', where });
+    return node === undefined ? undefined : toGroup(domain, node);
+}
+/** A group is provided while it carries its directory (G2). */
+export const isProvidedGroup = (group) => group.directory !== undefined;
+/**
+ * The profile a group change writes: its profile Node when the change touches a shared value, or,
+ * for a group stored before profiles, the whole profile to create; undefined when nothing shared
+ * changes.
+ */
+export async function groupProfileTarget({ query }, group, set, unset) {
+    const shares = GROUP_PROFILE_PROPERTIES.some((key) => key in set || unset.includes(key));
+    if (!shares)
+        return undefined;
+    const profile = await query(readProfile, { kind: 'Group', node: group.id });
+    if (profile !== undefined)
+        return { id: profile };
+    const merged = { ...group, ...set };
+    for (const key of unset)
+        delete merged[key];
+    return { create: groupProfileValues(merged) };
+}

package/dist/functions/group/index.js

@@ -1,2 +1,8 @@
-export { assignMember } from './assign-member-to-group.js';
-export { unassignMember } from './unassign-member-from-group.js';
+export { create } from './create-group.js';
+export { update } from './update-group.js';
+export { remove } from './delete-group.js';
+export { assignMember } from './assign-member.js';
+export { unassignMember } from './unassign-member.js';
+export { provision } from './provision-group.js';
+export { deprovision } from './deprovision-group.js';
+export { toGroup } from './group.js';

package/dist/functions/group/legacy/index.js

@@ -0,0 +1 @@
+export { legacyChangeForeignMembership, legacyMembershipEdges } from './membership.js';

package/dist/functions/group/legacy/membership.js

@@ -0,0 +1,60 @@
+import { setGroupMembership } from '../../../mutations/group/index.js';
+import { readGroupMembership, readGroupMembershipEndpoints } from '../../../queries/group/index.js';
+import { legacyReadCoreGroups, legacyReadMemberOfGroup } from '../../../queries/group/legacy/index.js';
+/**
+ * @deprecated The legacy `member_of_group` Edge a change of a Shell group's members also converges
+ * (L-SHELL-8): joining one of the legacy Core groups writes it beside `extends_with`, for the readers
+ * that still check it; leaving any group removes it. Replaced by `extends_with` alone. Removal:
+ * Shell major (delivery step 5) after 1Pact step 4.
+ */
+export async function legacyMembershipEdges(context, membership, present) {
+    const observed = await context.query(legacyReadMemberOfGroup, membership);
+    let wanted = false;
+    if (present) {
+        const legacyGroups = Object.values(await context.query(legacyReadCoreGroups, {}));
+        wanted = observed.present || legacyGroups.includes(membership.group);
+    }
+    return [{ edge: 'legacy', current: observed.present, present: wanted, guard: observed.guard }];
+}
+/**
+ * @deprecated A Domain that extends Group changes the members of its own groups (L-SHELL-9): Shell
+ * writes both legacy Edges as before, but under that Domain's authority, since the release no
+ * longer grants Shell any grant authority over foreign Identities (AM5). Shell's group laws
+ * (G2, G3) do not apply to another Domain's Identity. Replaced by the Domain's own Identity and
+ * Roles (P5, P6). Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export async function legacyChangeForeignMembership(context, membership, present) {
+    const caller = context.graph.caller;
+    if (caller === undefined)
+        throw context.error('GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE', {});
+    const observe = async () => {
+        const endpoints = await caller.query(readGroupMembershipEndpoints, membership);
+        if (!endpoints.visible)
+            throw context.error('GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE', {});
+        const [authority, legacy] = await Promise.all([
+            caller.query(readGroupMembership, membership),
+            caller.query(legacyReadMemberOfGroup, membership),
+        ]);
+        const edges = [
+            { edge: 'authority', current: authority.present, present, guard: authority.guard },
+            { edge: 'legacy', current: legacy.present, present, guard: legacy.guard },
+        ];
+        return { endpoints: endpoints.guard, edges };
+    };
+    const matches = (edges) => edges.every(({ current, present: wanted }) => current === wanted);
+    const current = await context.step.run('observe-foreign-membership', observe);
+    if (matches(current.edges))
+        return {};
+    const result = await context.step.run('mutate-foreign-membership', () => caller.mutate(setGroupMembership, { ...membership, ...current }));
+    if (result.ok)
+        return {};
+    if (result.outcomeKnown) {
+        if (result.rule === 'cycle')
+            throw context.error('GROUP_MEMBERSHIP_CYCLE', {});
+        throw context.error('GROUP_MEMBERSHIP_CONFLICT', { cause: result.code });
+    }
+    const recovered = await context.step.run('recover-foreign-membership', observe);
+    if (matches(recovered.edges))
+        return {};
+    throw context.error('GROUP_MEMBERSHIP_UNCONFIRMED', { cause: result.code, outcomeKnown: false });
+}

package/dist/functions/group/membership-laws.js

@@ -0,0 +1,40 @@
+import { authority } from '../authority/index.js';
+import { isProvidedGroup } from './group.js';
+/**
+ * G2, G3 and acyclicity for one change of a Shell group's members. A provided group changes its
+ * members only through its directory, a local one through `group.writer`; a group that holds a
+ * Role, directly or through what it extends, only by an admin or its directory; and a member never
+ * joins a group it already holds.
+ */
+export async function membershipRefusal(capabilities, group, member, joining) {
+    const authorities = authority(capabilities);
+    const provided = isProvidedGroup(group);
+    if (provided) {
+        if (!(await authorities.callerHolds('directory.provisioner'))) {
+            return { code: 'GROUP_DIRECTORY_MANAGED' };
+        }
+    }
+    else if (!(await authorities.callerHolds('group.writer'))) {
+        return { code: 'GROUP_NOT_DIRECTORY_MANAGED' };
+    }
+    if (!provided) {
+        const role = await roleProtected(capabilities, group);
+        if (role !== undefined)
+            return { code: 'GROUP_ROLE_PROTECTED', role };
+    }
+    if (joining && (await authorities.reaches(group.id, member))) {
+        return { code: 'GROUP_MEMBERSHIP_CYCLE' };
+    }
+    return undefined;
+}
+/**
+ * G3: the Role a group holds, when the caller is no admin and so may not change who holds it,
+ * through its members or by deleting it.
+ */
+export async function roleProtected(capabilities, group) {
+    const authorities = authority(capabilities);
+    const role = await authorities.heldRole(group.id);
+    if (role === undefined || (await authorities.callerHolds('workspace.admin')))
+        return undefined;
+    return role;
+}

package/dist/functions/group/provision-group.js

@@ -0,0 +1,33 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { Path } from '@astrale-os/sdk/graph/path';
+import { createGroup, updateGroup } from '../../mutations/identity/index.js';
+import { groupErrors } from './group-errors.js';
+import { findGroup, groupProfileTarget } from './group.js';
+/**
+ * Create or rename the group a directory provides (`dsync.group.created`, `dsync.group.updated`).
+ * Replaying an event writes nothing (A3).
+ */
+export const provision = defineAction()('Group.provision', { errors: groupErrors }, async (context) => {
+    const { input, error } = context;
+    const { directory, externalId, name } = input;
+    const existing = await findGroup(context, { directory, externalId });
+    if (existing !== undefined) {
+        if (existing.name !== name) {
+            const profile = await groupProfileTarget(context, existing, { name }, []);
+            const result = await context.mutate(updateGroup, {
+                group: existing.id,
+                set: { name },
+                ...(profile === undefined ? {} : { profile }),
+            });
+            if (!result.ok)
+                throw error('GROUP_CHANGED', {});
+        }
+        return { group: Path.id(existing.id).raw, created: false };
+    }
+    const result = await context.mutate(createGroup, {
+        values: { name, directory, externalId },
+    });
+    if (!result.ok)
+        throw error('GROUP_CHANGED', {});
+    return { group: Path.id(result.group).raw, created: true };
+});

package/dist/functions/group/update-group.js

@@ -0,0 +1,55 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { updateGroup } from '../../mutations/identity/index.js';
+import { MAX_ATTRIBUTES, boundedAttributes } from '../../utils/index.js';
+import { sameJson } from '../../utils/index.js';
+import { groupErrors } from './group-errors.js';
+import { groupProfileTarget, isProvidedGroup, readGroup } from './group.js';
+/**
+ * Rename, describe, or change the icon or the attributes of a group; a provided group's name is
+ * its directory's (G2), its attributes the instance's own (AM11).
+ */
+export const update = defineAction()('Group.update', { errors: groupErrors }, async (context) => {
+    const { input, error, self } = context;
+    const group = await readGroup(context, self);
+    if (group === undefined)
+        throw error('GROUP_NOT_FOUND', {});
+    if (isProvidedGroup(group) && input.name !== undefined && input.name !== group.name) {
+        throw error('GROUP_DIRECTORY_MANAGED', {});
+    }
+    const set = {};
+    const unset = [];
+    for (const key of ['name', 'description', 'icon']) {
+        const value = input[key];
+        if (value === undefined)
+            continue;
+        if (value === null) {
+            if (group[key] !== undefined)
+                unset.push(key);
+        }
+        else if (value !== group[key])
+            set[key] = value;
+    }
+    if (input.attributes === null) {
+        if (group.attributes !== undefined)
+            unset.push('attributes');
+    }
+    else if (input.attributes !== undefined) {
+        const attributes = boundedAttributes(input.attributes);
+        if (attributes === undefined)
+            throw error('GROUP_ATTRIBUTES_TOO_MANY', { max: MAX_ATTRIBUTES });
+        if (!sameJson(attributes, group.attributes))
+            set.attributes = attributes;
+    }
+    if (Object.keys(set).length === 0 && unset.length === 0)
+        return {};
+    const profile = await groupProfileTarget(context, group, set, unset);
+    const result = await context.mutate(updateGroup, {
+        group: self,
+        set: set,
+        unset,
+        ...(profile === undefined ? {} : { profile }),
+    });
+    if (!result.ok)
+        throw error('GROUP_CHANGED', {});
+    return {};
+});

package/dist/functions/invitation/index.js

@@ -0,0 +1,2 @@
+export { send } from './send-invitation.js';
+export { accept, cancel, resend } from './invitation-methods.js';

package/dist/functions/invitation/invitation-errors.js

@@ -0,0 +1,13 @@
+import { z } from 'zod';
+export const invitationErrors = {
+    INVITATION_NOT_FOUND: {
+        family: 'NOT_FOUND',
+        message: 'No invitation the caller reads.',
+        details: z.strictObject({}),
+    },
+    INVITATION_NOT_PENDING: {
+        family: 'CONFLICT',
+        message: 'The invitation is no longer pending: invite the account again.',
+        details: z.strictObject({}),
+    },
+};

package/dist/functions/invitation/invitation-methods.js

@@ -0,0 +1,41 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { readInvitation } from '../../queries/invitation/index.js';
+import { invitationErrors } from './invitation-errors.js';
+import { invitationSignal } from './send-invitation.js';
+/** The pending invitation a method acts on, or its refusal. */
+function pending(invitation, error) {
+    if (invitation === undefined)
+        throw error('INVITATION_NOT_FOUND', {});
+    if (invitation.status !== 'pending')
+        throw error('INVITATION_NOT_PENDING', {});
+    return invitation;
+}
+/**
+ * Send the run of a pending invitation its next event. The Shell signals under its own Domain
+ * authority: the Kernel lets only the Domain that owns a run signal it.
+ */
+async function signal(kernel, invitation, value) {
+    await kernel.execution.signal(invitation.execution, {
+        name: invitationSignal(invitation.round),
+        value,
+    });
+}
+/** Send the email of a pending invitation again: same invitation, same run. */
+export const resend = defineAction()('Invitation.resend', { errors: invitationErrors }, async (context) => {
+    const invitation = pending(await context.query(readInvitation, { invitation: context.self }), context.error);
+    await signal(context.kernel, invitation, { kind: 'resend' });
+    return {};
+});
+/** Accept a pending invitation at the first sign-in: the run binds the account (U8). */
+export const accept = defineAction()('Invitation.accept', { errors: invitationErrors }, async (context) => {
+    const invitation = pending(await context.query(readInvitation, { invitation: context.self }), context.error);
+    const { iss, sub } = context.input;
+    await signal(context.kernel, invitation, { kind: 'accepted', iss, sub });
+    return {};
+});
+/** Cancel a pending invitation: its run marks it cancelled. */
+export const cancel = defineAction()('Invitation.cancel', { errors: invitationErrors }, async (context) => {
+    const invitation = pending(await context.query(readInvitation, { invitation: context.self }), context.error);
+    await context.kernel.execution.cancel(invitation.execution);
+    return {};
+});

package/dist/functions/invitation/send-invitation.js

@@ -0,0 +1,81 @@
+import { defineWorkflow } from '@astrale-os/sdk/workflow';
+import { inviteErrors, readAccount, userErrors } from '../user/index.js';
+import { InvitationRequestFailure } from '../../integrations/user-invitation/index.js';
+import { bindAccount, createInvitation, updateInvitation } from '../../mutations/invitation/index.js';
+import { canonicalNodeId } from '../../utils/canonical-node-path/index.js';
+const errors = { ...inviteErrors, ...userErrors };
+/** How long an invitation waits for its first sign-in. */
+export const INVITATION_TTL_MS = 7 * 24 * 3_600_000;
+/** The signal name of one round: a name is delivered once, so each event moves to the next. */
+export const invitationSignal = (round) => `event-${round}`;
+/**
+ * Invite an account and keep its invitation until it ends: record it, have Admin send the email,
+ * then wait for the first sign-in (`accept`), a resend, a cancel or the expiry. It grants nothing:
+ * the account holds what `User.create` or an admin gave it.
+ */
+export const send = defineWorkflow()('Invitation.send', { errors }, async (context) => {
+    const { step, execution, awaitSignal, cancelled, error } = context;
+    const user = canonicalNodeId(context.input.user, () => error('INVALID_INVITATION_REFERENCE', {}));
+    const account = await step.run('read-account', ({ query }) => readAccount({ query, domain: context.domain }, user));
+    if (account === undefined)
+        throw error('USER_NOT_FOUND', {});
+    if (account.frozen)
+        throw error('USER_SUSPENDED', {});
+    if (account.email === undefined)
+        throw error('USER_EMAIL_INVALID', {});
+    const email = account.email;
+    const startedAt = await step.run('clock', () => Date.now());
+    const expiresAt = startedAt + INVITATION_TTL_MS;
+    const { invitation } = await step.mutate('record-invitation', createInvitation, {
+        user,
+        execution: execution.id,
+        expiresAt: new Date(expiresAt).toISOString(),
+    });
+    const requestedBy = execution.initiator.caller ?? execution.initiator.principal;
+    const sendEmail = async (round) => {
+        try {
+            await step.run(`send-email-${round}`, ({ integrations: providers }) => providers.enrollment.invite({
+                requestId: `${execution.id}:${round}`,
+                user,
+                email,
+                requestedBy: String(requestedBy),
+            }));
+        }
+        catch (cause) {
+            if (cause instanceof InvitationRequestFailure) {
+                throw error(cause.code, { requestId: `${execution.id}:${round}` });
+            }
+            throw cause;
+        }
+    };
+    try {
+        await sendEmail(0);
+        for (let round = 0;; round += 1) {
+            const now = await step.run(`clock-${round}`, () => Date.now());
+            const event = await awaitSignal(invitationSignal(round), {
+                timeoutMs: Math.max(expiresAt - now, 1),
+            });
+            if (event.kind === 'timeout') {
+                await step.mutate('expire', updateInvitation, { invitation, status: 'expired' });
+                return { status: 'expired' };
+            }
+            if (event.value.kind === 'accepted') {
+                const { iss, sub } = event.value;
+                await step.mutate('bind-account', bindAccount, { user, iss, sub });
+                await step.mutate('accept', updateInvitation, { invitation, status: 'accepted' });
+                return { status: 'accepted' };
+            }
+            await sendEmail(round + 1);
+            await step.mutate(`next-round-${round + 1}`, updateInvitation, {
+                invitation,
+                round: round + 1,
+            });
+        }
+    }
+    catch (cause) {
+        if (!cancelled(cause))
+            throw cause;
+        await step.mutate('cancel', updateInvitation, { invitation, status: 'cancelled' });
+        return { status: 'cancelled' };
+    }
+});

package/dist/functions/user/account.js

@@ -0,0 +1,35 @@
+import { Path } from '@astrale-os/sdk/graph/path';
+import { toAttributes } from '../../utils/index.js';
+const text = (value) => (typeof value === 'string' ? value : undefined);
+/** One account Node as Shell's laws read it, by the Property keys of the resolved Domain. */
+export function toAccount(domain, node) {
+    const properties = domain.classes.User.properties;
+    const read = (name) => node.props[properties[name].key];
+    const values = {
+        name: text(read('name')),
+        email: text(read('email')),
+        givenName: text(read('givenName')),
+        familyName: text(read('familyName')),
+        icon: text(read('icon')),
+        directory: text(read('directory')),
+        externalId: text(read('externalId')),
+        attributes: toAttributes(read('attributes')),
+        frozen: typeof read('frozen') === 'boolean' ? read('frozen') : undefined,
+    };
+    return {
+        id: node.id,
+        class: node.class,
+        ...Object.fromEntries(Object.entries(values).filter(([, value]) => value !== undefined)),
+    };
+}
+/** An account is provided while it carries its directory (U3). */
+export const isProvided = (account) => account.directory !== undefined;
+/** An email in the form Shell keeps it, lower case; undefined when it is not one. */
+export function normalizeEmail(input) {
+    const email = input.trim().toLowerCase();
+    return email.length >= 3 && email.length <= 320 && /^[^\s@]+@[^\s@]+$/u.test(email)
+        ? email
+        : undefined;
+}
+/** A Node as a method returns it. */
+export const nodeReference = (id) => Path.id(id).raw;

package/dist/functions/user/create-user.js

@@ -0,0 +1,45 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { createAccount } from '../../mutations/identity/index.js';
+import { MAX_ATTRIBUTES, boundedAttributes } from '../../utils/index.js';
+import { nodeReference, normalizeEmail } from './account.js';
+// Seam L-SHELL-13: an email an account claimed before `email` existed is taken (U1).
+import { legacyClaimedAccount } from './legacy/index.js';
+import { findAccount } from './read-account.js';
+import { userErrors } from './user-errors.js';
+/**
+ * Idempotent on the email (U1): the account of the email comes back, `created: false`, whoever
+ * created it, invited or provided. A Domain needs no directory to know it (A5).
+ */
+export const create = defineAction()('User.create', { errors: userErrors }, async (context) => {
+    const { input, error } = context;
+    const email = normalizeEmail(input.email);
+    if (email === undefined)
+        throw error('USER_EMAIL_INVALID', {});
+    const attributes = input.attributes === undefined ? undefined : boundedAttributes(input.attributes);
+    if (input.attributes !== undefined && attributes === undefined) {
+        throw error('USER_ATTRIBUTES_TOO_MANY', { max: MAX_ATTRIBUTES });
+    }
+    const existing = await findAccount(context, { email });
+    if (existing !== undefined)
+        return { user: nodeReference(existing.id), created: false };
+    const claimed = await legacyClaimedAccount(context, email);
+    if (claimed !== undefined)
+        throw error('USER_EMAIL_TAKEN', { user: nodeReference(claimed) });
+    const result = await context.mutate(createAccount, {
+        values: {
+            email,
+            name: input.name,
+            ...(input.givenName === undefined ? {} : { givenName: input.givenName }),
+            ...(input.familyName === undefined ? {} : { familyName: input.familyName }),
+            ...(attributes === undefined ? {} : { attributes }),
+            frozen: false,
+        },
+    });
+    if (result.ok)
+        return { user: nodeReference(result.user), created: true };
+    // Another call created the account of this email meanwhile: it is the one.
+    const winner = await findAccount(context, { email });
+    if (winner !== undefined)
+        return { user: nodeReference(winner.id), created: false };
+    throw error('ACCOUNT_CHANGED', {});
+});

package/dist/functions/user/deactivate-user.js

@@ -0,0 +1,19 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { protectAdministrators } from './protect-administrators.js';
+import { readAccount } from './read-account.js';
+import { userErrors } from './user-errors.js';
+import { writeAccount } from './write-account.js';
+/** `frozen: true`: the Kernel refuses the account's next sign-in (U4, U5). */
+export const deactivate = defineAction()('User.deactivate', { errors: userErrors }, async (context) => {
+    const { error, self } = context;
+    const account = await readAccount(context, self);
+    if (account === undefined)
+        throw error('USER_NOT_FOUND', {});
+    const refusal = await protectAdministrators(context, self, { keepsLastAdministrator: true });
+    if (refusal !== undefined)
+        throw error(refusal, {});
+    const written = await writeAccount(context, account, { frozen: true });
+    if (written === 'CHANGED' || written === 'DUPLICATE_KEY')
+        throw error('ACCOUNT_CHANGED', {});
+    return {};
+});

package/dist/functions/user/delete-user.js

@@ -0,0 +1,34 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { readMembers } from '../authority/index.js';
+import { deleteIdentity } from '../../mutations/identity/index.js';
+import { readProfile } from '../../queries/profile/index.js';
+import { protectAdministrators } from './protect-administrators.js';
+import { readAccount } from './read-account.js';
+import { userErrors } from './user-errors.js';
+/**
+ * Delete a deactivated account (U6). Its memberships and Views leave with it; each Domain's own
+ * account Edge decides its business record's fate, `detach` keeping it without an account. Deleting
+ * the account frees its login (U8).
+ */
+export const remove = defineAction()('User.delete', { errors: userErrors }, async (context) => {
+    const { error, self } = context;
+    const account = await readAccount(context, self);
+    if (account === undefined)
+        throw error('USER_NOT_FOUND', {});
+    const refusal = await protectAdministrators(context, self, { keepsLastAdministrator: true });
+    if (refusal !== undefined)
+        throw error(refusal, {});
+    if (!account.frozen)
+        throw error('USER_ACTIVE', {});
+    const members = await readMembers(context, self);
+    const profile = await context.query(readProfile, { kind: 'User', node: self });
+    const result = await context.mutate(deleteIdentity, {
+        kind: 'User',
+        node: self,
+        members,
+        ...(profile === undefined ? {} : { profile }),
+    });
+    if (!result.ok)
+        throw error('ACCOUNT_CHANGED', {});
+    return {};
+});

package/dist/functions/user/deprovision-user.js

@@ -0,0 +1,21 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { findAccount } from './read-account.js';
+import { userErrors } from './user-errors.js';
+import { writeAccount } from './write-account.js';
+/**
+ * The directory deleted the account (`dsync.user.deleted`): it is frozen and kept with its
+ * history. An account the directory no longer has is left as it is.
+ */
+export const deprovision = defineAction()('User.deprovision', { errors: userErrors }, async (context) => {
+    const { input, error } = context;
+    const account = await findAccount(context, {
+        directory: input.directory,
+        externalId: input.externalId,
+    });
+    if (account === undefined)
+        return {};
+    const written = await writeAccount(context, account, { frozen: true });
+    if (written === 'DUPLICATE_KEY' || written === 'CHANGED')
+        throw error('ACCOUNT_CHANGED', {});
+    return {};
+});

package/dist/functions/user/index.js

@@ -1,2 +1,16 @@
+export { create } from './create-user.js';
 export { invite } from './invite-user.js';
-export { recordProfile } from './record-profile.js';
+export { update } from './update-user.js';
+export { updateProfile } from './update-profile.js';
+export { deactivate } from './deactivate-user.js';
+export { reactivate } from './reactivate-user.js';
+export { remove } from './delete-user.js';
+export { provision } from './provision-user.js';
+export { deprovision } from './deprovision-user.js';
+export { toAccount } from './account.js';
+export { userErrors } from './user-errors.js';
+export { inviteErrors } from './invite-errors.js';
+export { readAccount } from './read-account.js';
+export { writeAccount } from './write-account.js';
+// Seams L-SHELL-5, L-SHELL-14: the legacy handlers the Runtime registers.
+export { legacyMigrateAccounts, legacyRecordProfile } from './legacy/index.js';

package/dist/functions/user/invite-errors.js

@@ -0,0 +1,18 @@
+import { z } from 'zod';
+export const inviteErrors = {
+    INVALID_INVITATION_REFERENCE: {
+        family: 'VALIDATION_ERROR',
+        message: 'User must be an exact canonical @NodeId path.',
+        details: z.strictObject({}),
+    },
+    INVITATION_CONFLICT: {
+        family: 'CONFLICT',
+        message: 'The invitation conflicts with an existing request.',
+        details: z.strictObject({ requestId: z.string() }),
+    },
+    INVITATION_REJECTED: {
+        family: 'VALIDATION_ERROR',
+        message: 'Admin rejected the invitation request.',
+        details: z.strictObject({ requestId: z.string() }),
+    },
+};