@astrale-domains/shell 0.1.6 → 0.1.8

package/dist/domain.js

@@ -1,96 +1,117 @@
 import { defineDomain, defineFrontend, vite, requirements, } from '@astrale-os/sdk/domain';
-import { K, KernelRootFunctions } from '@astrale-os/sdk/schema';
+import { K } from '@astrale-os/sdk/schema';
 import { ShellSchema, S } from './schema/index.js';
+// Seam L-SHELL-7, L-SHELL-9, L-SHELL-11: the bindings legacy groups and callers still need.
+import { legacyRelease } from './legacy/index.js';
 import runtime, {} from './runtime.js';
 const frontend = defineFrontend({
     schema: ShellSchema,
     source: vite({ config: './frontend/vite.config.ts' }),
     routes: { application: { path: '/', handshake: 'shell' } },
 });
-const domainRequirements = requirements({
-    // Sujet implicite : le principal installé Shell, utilisé par kernel.self.
-    functions: KernelRootFunctions,
-    classes: [
-        { class: K.classes.extends_with, operations: ['create', 'read', 'traverse', 'delete'] },
-        // listEntrypoints reads every entrypoint View locator and its Domain as Shell.
-        { class: K.classes.Domain, operations: ['read'] },
-        { class: K.classes.of_domain, operations: ['read'] },
-        { class: K.classes.entrypoint, operations: ['traverse'] },
-        { class: K.classes.View, operations: ['traverse'] },
-    ],
-    authority: {
-        grant: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'revoke'],
-        revoke: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'grant'],
-    },
-    // Ces profils sont matérialisés par l'installeur, pas par un handler Shell.
-    core: [
+/**
+ * The Roles the Shell release binds: `admin` is the only granter of every Shell Role and of the
+ * grantable Kernel Roles (R2); compositions are release bindings, not Core Edges (AM1).
+ */
+const domainRequirements = requirements(legacyRelease({
+    roles: [
+        // Profiles, member ⊂ admin, and their atomic Roles (AM1); admin grants them all.
+        {
+            role: S.core.nodes['workspace.member'],
+            members: [S.core.nodes['workspace.admin']],
+            granters: [S.core.nodes['workspace.admin']],
+        },
+        { role: S.core.nodes['workspace.admin'], granters: [S.core.nodes['workspace.admin']] },
+        // A member reads profiles only (user-profile.reader, group-profile.reader); the accounts and
+        // groups themselves are read by administrators.
+        {
+            role: S.core.nodes['user.reader'],
+            members: [S.core.nodes['workspace.admin']],
+            granters: [S.core.nodes['workspace.admin']],
+        },
+        {
+            role: S.core.nodes['user.writer'],
+            members: [S.core.nodes['workspace.admin']],
+            granters: [S.core.nodes['workspace.admin']],
+        },
+        {
+            role: S.core.nodes['group.reader'],
+            members: [S.core.nodes['workspace.admin']],
+            granters: [S.core.nodes['workspace.admin']],
+        },
+        {
+            role: S.core.nodes['group.writer'],
+            members: [S.core.nodes['workspace.admin']],
+            granters: [S.core.nodes['workspace.admin']],
+        },
+        { role: S.core.nodes['directory.provisioner'], granters: [S.core.nodes['workspace.admin']] },
+        // A member reads every profile; it changes its own once an administrator allows it.
+        {
+            role: S.core.nodes['user-profile.reader'],
+            members: [S.core.nodes['workspace.member']],
+            granters: [S.core.nodes['workspace.admin']],
+        },
+        // Off by default: an administrator lets members change their own profile from the console
+        // (workspace.member → self-writer). Left out of the release so an installation keeps that
+        // choice.
+        {
+            role: S.core.nodes['user-profile.self-writer'],
+            granters: [S.core.nodes['workspace.admin']],
+        },
+        {
+            role: S.core.nodes['group-profile.reader'],
+            members: [S.core.nodes['workspace.member']],
+            granters: [S.core.nodes['workspace.admin']],
+        },
+        // Whoever holds it opens the OS view; a member holds it, and an administrator through member.
+        {
+            role: S.core.nodes['os.viewer'],
+            members: [S.core.nodes['workspace.member']],
+            granters: [S.core.nodes['workspace.admin']],
+        },
+        // Each profile holds the Kernel profile of its rank; Kernel admin is granted by Root alone.
+        // Kernel reader is no profile's: admin grants it to whoever only opens the Views it is given
+        // (AM10).
+        { role: K.core.nodes.reader, granters: [S.core.nodes['workspace.admin']] },
+        {
+            role: K.core.nodes.writer,
+            members: [S.core.nodes['workspace.member']],
+            granters: [S.core.nodes['workspace.admin']],
+        },
+        { role: K.core.nodes.admin, members: [S.core.nodes['workspace.admin']] },
+        // Shell itself reads compositions (U4, U5, G3) and runs its own Queries and Mutations.
         {
-            subject: S.core.nodes.admin,
-            functions: [
-                ...KernelRootFunctions,
-                S.classes.User.static.methods.invite,
-                S.classes.User.methods.recordProfile,
-                S.classes.Group.static.methods.assignMember,
-                S.classes.Group.static.methods.unassignMember,
-                S.classes.Namespace.methods.link,
-                S.classes.Namespace.methods.unlink,
-                S.classes.Namespace.methods.rename,
-                // Core Edges cannot author Kernel extends_with, so administrators hold it directly.
-                S.functions.listEntrypoints,
-                S.functions.assignViews,
-            ],
-            classes: [
-                { class: S.classes.User, operations: ['create', 'read', 'traverse', 'update', 'delete'] },
-                {
-                    class: S.classes.Group,
-                    operations: ['create', 'read', 'traverse', 'update', 'delete'],
-                },
-                {
-                    class: S.classes.member_of_group,
-                    operations: ['create', 'read', 'traverse', 'update', 'delete'],
-                },
-                { class: S.classes.Namespace, operations: ['read', 'traverse'] },
-                { class: S.classes.alias, operations: ['create', 'read', 'traverse', 'update', 'delete'] },
-                // assignViews gives and withdraws Views; a Mutation may too. view_access carries no property.
-                { class: S.classes.view_access, operations: ['create', 'read', 'traverse', 'delete'] },
-                { class: K.classes.extends_with, operations: ['create', 'read', 'traverse', 'delete'] },
-            ],
-            authority: {
-                grant: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'revoke'],
-                revoke: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'grant'],
-            },
+            role: K.core.nodes['authority.reader'],
+            members: [requirements.domain],
+            granters: [S.core.nodes['workspace.admin']],
         },
         {
-            subject: S.core.nodes.member,
-            functions: [
-                // Download re-reads the holder Node with the caller's authority: no new data exposure.
-                K.functions.download,
-                // Upload exposes no data: its receipt binds to the caller, and attaching it still takes a
-                // Mutation under the caller's rights. The Kernel bounds it per blob and per Instance quota.
-                K.functions.upload,
-                K.functions.introspect,
-                K.functions.query,
-                K.functions.mutate,
-                K.classes.View.static.methods.resolve,
-                // The workspace opens only on this catalogue: an invited member must be able to read it.
-                S.functions.listEntrypoints,
-                // The GUI records the email and name each account signs in with; isSelf bounds it.
-                S.classes.User.methods.recordProfile,
-            ],
+            role: K.core.nodes['graph.reader'],
+            members: [requirements.domain],
+            granters: [S.core.nodes['workspace.admin']],
         },
         {
-            // For Identities outside Members: Group.assignMember(identity, applications) composes it.
-            // `query` opens `/v/<name>`: the full page reads that Path with a Query under the visitor's
-            // own rights, so read rules still decide what it sees.
-            subject: S.core.nodes.applications,
-            functions: [
-                S.functions.listEntrypoints,
-                K.classes.View.static.methods.resolve,
-                K.functions.query,
-            ],
+            role: K.core.nodes['graph.writer'],
+            members: [requirements.domain],
+            granters: [S.core.nodes['workspace.admin']],
         },
+        // admin grants the other parts of reader and writer and the readers outside them (R2).
+        { role: K.core.nodes['graph.manager'], granters: [S.core.nodes['workspace.admin']] },
+        { role: K.core.nodes['blob.reader'], granters: [S.core.nodes['workspace.admin']] },
+        { role: K.core.nodes['blob.writer'], granters: [S.core.nodes['workspace.admin']] },
+        { role: K.core.nodes['blob.manager'], granters: [S.core.nodes['workspace.admin']] },
+        // A member reads every View, so the OS view lists every application; anyone else reads only
+        // the Views given to it by `view_access`. Independent of `os.viewer`, which only shows the OS.
+        {
+            role: K.core.nodes['view.reader'],
+            members: [S.core.nodes['workspace.member']],
+            granters: [S.core.nodes['workspace.admin']],
+        },
+        { role: K.core.nodes['domain.reader'], granters: [S.core.nodes['workspace.admin']] },
+        { role: K.core.nodes['execution.reader'], granters: [S.core.nodes['workspace.admin']] },
+        { role: K.core.nodes['journal.reader'], granters: [S.core.nodes['workspace.admin']] },
     ],
-});
+}));
 export const domain = defineDomain({
     schema: ShellSchema,
     runtime,

package/dist/functions/application/index.js

@@ -1 +1,2 @@
-export { listEntrypoints } from './list-entrypoints.js';
+// Seam L-SHELL-11: the legacy handler the Runtime registers.
+export { legacyListEntrypoints } from './legacy/index.js';

package/dist/functions/application/legacy/index.js

@@ -0,0 +1 @@
+export { legacyListEntrypoints } from './list-entrypoints.js';

package/dist/functions/application/legacy/list-entrypoints.js

@@ -0,0 +1,8 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { legacyReadInstalledEntrypoints } from '../../../queries/application/legacy/index.js';
+/**
+ * @deprecated One graph read with Shell's authority: every Domain with an `entrypoint` Edge, its
+ * name and its entrypoint View (L-SHELL-11). Replaced by the visitor's own Query (V2). Removal:
+ * Shell major (delivery step 5) after 1Pact step 4.
+ */
+export const legacyListEntrypoints = defineAction()('listEntrypoints', async ({ query }) => ({ entrypoints: [...(await query(legacyReadInstalledEntrypoints, {}))] }));

package/dist/functions/authority/capabilities.js

@@ -0,0 +1 @@
+export {};

package/dist/functions/authority/composition.js

@@ -0,0 +1,47 @@
+import { readExtensions } from '../../queries/composition/index.js';
+/** A composition deeper than this is refused as a defect rather than walked further. */
+const MAXIMUM_DEPTH = 32;
+/** Identities one frontier Query starts from. */
+const FRONTIER = 256;
+/**
+ * Every Identity reached from `start` along Kernel `extends_with`, with its Class: `outgoing`, what
+ * `start` holds; `incoming`, who holds `start`. The Kernel refuses cycles, so the walk ends.
+ */
+export async function walkComposition({ query }, start, direction) {
+    const reached = new Map();
+    let frontier = [start];
+    for (let depth = 0; frontier.length > 0; depth += 1) {
+        if (depth === MAXIMUM_DEPTH)
+            throw new RangeError('The composition is deeper than Shell walks.');
+        const next = [];
+        for (let index = 0; index < frontier.length; index += FRONTIER) {
+            const [first, ...others] = frontier.slice(index, index + FRONTIER);
+            if (first === undefined)
+                continue;
+            const edges = await query(readExtensions, {
+                identities: [first, ...others],
+                direction,
+            });
+            for (const edge of edges) {
+                const [far, farClass] = direction === 'outgoing'
+                    ? [edge.target, edge.targetClass]
+                    : [edge.source, edge.sourceClass];
+                if (far === start || reached.has(far))
+                    continue;
+                reached.set(far, farClass);
+                next.push(far);
+            }
+        }
+        frontier = next;
+    }
+    return reached;
+}
+/** The `extends_with` Edges into one Identity: its direct members. */
+export async function readMembers({ query }, identity) {
+    return query(readExtensions, { identities: [identity], direction: 'incoming' });
+}
+/** The Identities one Identity extends directly. */
+export async function readExtensionTargets({ query }, identity) {
+    const edges = await query(readExtensions, { identities: [identity], direction: 'outgoing' });
+    return new Set(edges.map(({ target }) => target));
+}

package/dist/functions/authority/index.js

@@ -0,0 +1,2 @@
+export { authority } from './roles.js';
+export { readExtensionTargets, readMembers, walkComposition } from './composition.js';

package/dist/functions/authority/roles.js

@@ -0,0 +1,113 @@
+import { readRoleKeys } from '../../queries/composition/index.js';
+import { readIdentities } from '../../queries/identity/index.js';
+import { readRoleId, readRoleNode } from '../../queries/role/index.js';
+import { walkComposition } from './composition.js';
+/** Kernel reader and writer and their parts: every other Kernel Role administers (U4). */
+const KERNEL_ORDINARY = new Set([
+    'reader',
+    'writer',
+    'graph.reader',
+    'graph.writer',
+    'graph.manager',
+    'blob.reader',
+    'blob.writer',
+    'blob.manager',
+    'view.reader',
+    'domain.reader',
+]);
+const SHELL_ADMINISTRATIVE = new Set([
+    'workspace.admin',
+    'user.writer',
+    'group.writer',
+    'directory.provisioner',
+]);
+const keyOf = (ref) => `${ref.origin}:${ref.name}`;
+/** Identities one Role read starts from. */
+const ROLE_STEP = 256;
+/**
+ * One handler's view of authority. Each composition, and the Roles it holds, is read once; only the
+ * Roles a composition reaches are read, never the catalogue of every installed Role.
+ */
+export function authority(capabilities) {
+    const S = capabilities.domain;
+    const kernel = S.dependencies.kernel.origin;
+    const compositions = new Map();
+    const composition = (identity) => {
+        let walked = compositions.get(identity);
+        if (walked === undefined) {
+            walked = walkComposition(capabilities, identity, 'outgoing');
+            compositions.set(identity, walked);
+        }
+        return walked;
+    };
+    const held = new Map();
+    /** The Core keys of the Roles an Identity holds, `<origin>:<key>`. */
+    const heldKeys = (identity) => {
+        let keys = held.get(identity);
+        if (keys === undefined) {
+            keys = (async () => {
+                const reached = [...(await composition(identity)).keys()];
+                const found = [];
+                for (let index = 0; index < reached.length; index += ROLE_STEP) {
+                    const [first, ...others] = reached.slice(index, index + ROLE_STEP);
+                    if (first === undefined)
+                        continue;
+                    const roles = await capabilities.query(readRoleKeys, { identities: [first, ...others] });
+                    found.push(...roles.values());
+                }
+                return found;
+            })();
+            held.set(identity, keys);
+        }
+        return keys;
+    };
+    const nodes = new Map();
+    const roleNode = (role) => {
+        let node = nodes.get(role);
+        if (node === undefined) {
+            node = capabilities.query(readRoleId, { role: S.core.nodes[role].ref });
+            nodes.set(role, node);
+        }
+        return node;
+    };
+    const administrative = (key) => {
+        const [origin, name] = [key.slice(0, key.indexOf(':')), key.slice(key.indexOf(':') + 1)];
+        return ((origin === S.origin && SHELL_ADMINISTRATIVE.has(name)) ||
+            (origin === kernel && !KERNEL_ORDINARY.has(name)));
+    };
+    return {
+        roleNode,
+        async callerHolds(role) {
+            const caller = capabilities.graph.caller;
+            if (caller === undefined)
+                return false;
+            return caller.query(readRoleNode, { role: S.core.nodes[role].ref });
+        },
+        async heldRole(identity) {
+            const held = await heldKeys(identity);
+            const admin = keyOf(S.core.nodes['workspace.admin'].ref);
+            const role = held.includes(admin) ? admin : held[0];
+            if (role === undefined)
+                return undefined;
+            return role.startsWith(`${S.origin}:`) ? role.slice(S.origin.length + 1) : role;
+        },
+        async holdsAdministration(identity) {
+            return (await heldKeys(identity)).some(administrative);
+        },
+        async activeAdministrators() {
+            const admin = await roleNode('workspace.admin');
+            if (admin === undefined)
+                return [];
+            const holders = [...(await walkComposition(capabilities, admin, 'incoming')).keys()];
+            const [first, ...others] = holders;
+            if (first === undefined)
+                return [];
+            const accounts = await capabilities.query(readIdentities, {
+                kind: 'User',
+                ids: [first, ...others],
+            });
+            const frozen = S.classes.User.properties.frozen.key;
+            return accounts.filter(({ props }) => props[frozen] !== true).map(({ id }) => id);
+        },
+    };
+}

package/dist/functions/directory/disconnect-directory.js

@@ -0,0 +1,35 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { toGroup } from '../group/index.js';
+import { toAccount, userErrors, writeAccount } from '../user/index.js';
+import { updateGroup } from '../../mutations/identity/index.js';
+import { readIdentities } from '../../queries/identity/index.js';
+/**
+ * The directory is disconnected (`dsync.deleted`): its accounts and groups become local. Their
+ * `directory` and `externalId` are erased; an account the directory had frozen stays frozen. Replaying it changes nothing (A3).
+ */
+export const disconnectDirectory = defineAction()('disconnectDirectory', { errors: userErrors }, async (context) => {
+    const { directory } = context.input;
+    const [users, groups] = await Promise.all([
+        context.query(readIdentities, { kind: 'User', where: { directory } }),
+        context.query(readIdentities, { kind: 'Group', where: { directory } }),
+    ]);
+    for (const node of users) {
+        const account = toAccount(context.domain, node);
+        const written = await writeAccount(context, account, {
+            directory: null,
+            externalId: null,
+        });
+        if (written === 'DUPLICATE_KEY' || written === 'CHANGED') {
+            throw context.error('ACCOUNT_CHANGED', {});
+        }
+    }
+    for (const node of groups) {
+        const group = toGroup(context.domain, node);
+        await context.mutate(updateGroup, {
+            group: group.id,
+            set: {},
+            unset: ['directory', 'externalId'],
+        });
+    }
+    return { users: users.length, groups: groups.length };
+});

package/dist/functions/directory/index.js

@@ -0,0 +1 @@
+export { disconnectDirectory } from './disconnect-directory.js';

package/dist/functions/group/assign-member.js

@@ -0,0 +1,7 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { changeGroupMembers, changeGroupMembership } from './change-group-membership.js';
+import { groupMembershipErrors } from './group-membership-errors.js';
+/** Make one account or group a member of a group, in one read and one write. */
+export const assignMember = defineAction()('Group.assignMember', { errors: groupMembershipErrors }, (context) => changeGroupMembership(context, true));
+/** Make several accounts or groups members of a group, in one commit. */
+export const assignMembers = defineAction()('Group.assignMembers', { errors: groupMembershipErrors }, (context) => changeGroupMembers(context, context.input, true));

package/dist/functions/group/change-group-membership.js

@@ -1,34 +1,115 @@
-import { setGroupMembership } from '../../mutations/group/index.js';
-import { readGroupMembership, readGroupMembershipEndpoints, } from '../../queries/group/index.js';
+import { setGroupMemberships } from '../../mutations/group/index.js';
+import { readGroupMembers, readGroupMembersEndpoints } from '../../queries/group/index.js';
+import { readIdentities } from '../../queries/identity/index.js';
 import { canonicalNodeId } from '../../utils/canonical-node-path/index.js';
-const matches = (state, present) => state.membership === present && state.authority === present;
-export async function changeGroupMembership(context, present) {
+import { readGroup } from './group.js';
+// Seam L-SHELL-8, L-SHELL-9: legacy groups also keep `member_of_group`; a Domain's own Group
+// subclass changes its members under that Domain's authority.
+import { legacyChangeForeignMembership, legacyMembersEdges } from './legacy/index.js';
+import { membershipRefusal } from './membership-laws.js';
+/**
+ * Add or withdraw direct members of one Shell group: Kernel `extends_with` from each member to the
+ * group (G1), under G2 and G3, checked once for the group. The Kernel refuses a cycle. All the
+ * members change in one commit, guarded by what was observed of them; a member already where it is
+ * asked to be changes nothing, so a retry is harmless. After an unknown outcome the change is
+ * observed again, and an unconfirmed outcome stays explicit.
+ */
+export async function changeGroupMembers(context, input, present, { checkMembers = true } = {}) {
     const invalid = () => context.error('INVALID_GROUP_MEMBERSHIP_REFERENCE', {});
-    const membership = {
-        member: canonicalNodeId(context.input.member, invalid),
-        group: canonicalNodeId(context.input.group, invalid),
-    };
-    const observe = async () => {
-        const endpoints = await context.query(readGroupMembershipEndpoints, membership);
-        if (!endpoints.visible)
-            throw context.error('GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE', {});
-        const current = await context.query(readGroupMembership, membership);
-        return { ...current, endpoints: endpoints.guard };
-    };
-    const current = await context.step.run('observe-membership', observe);
-    if (matches(current, present))
+    const group = canonicalNodeId(input.group, invalid);
+    const [first, ...others] = new Set(input.members.map((member) => canonicalNodeId(member, invalid)));
+    if (first === undefined)
+        throw invalid();
+    const members = [first, ...others];
+    // A fixed number of reads, whatever the number of members: one per kind, never one per member.
+    const [identities, observed, stored] = await Promise.all([
+        // A list of members is not a typed Path input: each must be an account or a group.
+        checkMembers ? identitiesOnly(context, members) : true,
+        observeMembers(context, { members, group }, present),
+        readGroup(context, group),
+    ]);
+    if (!identities)
+        throw invalid();
+    if (members.some((member) => !observed.visible.has(member)) || !observed.visible.has(group)) {
+        throw context.error('GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE', {});
+    }
+    if (observed.groupClass !== context.domain.classes.Group.key) {
+        for (const member of members) {
+            await legacyChangeForeignMembership(context, { member, group }, present);
+        }
+        return {};
+    }
+    if (stored === undefined)
+        throw context.error('GROUP_NOT_FOUND', {});
+    const refusal = await membershipRefusal(context, stored);
+    if (refusal !== undefined) {
+        if (refusal.code === 'GROUP_ROLE_PROTECTED') {
+            throw context.error(refusal.code, { role: refusal.role });
+        }
+        throw context.error(refusal.code, {});
+    }
+    if (observed.changes.length === 0)
         return {};
-    const result = await context.step.run('mutate-membership', () => context.mutate(setGroupMembership, { ...membership, current, present }));
+    const result = await context.mutate(setGroupMemberships, {
+        group,
+        guards: observed.guards,
+        changes: observed.changes,
+    });
     if (result.ok)
         return {};
     if (result.outcomeKnown) {
+        if (result.rule === 'cycle')
+            throw context.error('GROUP_MEMBERSHIP_CYCLE', {});
         throw context.error('GROUP_MEMBERSHIP_CONFLICT', { cause: result.code });
     }
-    const recovered = await context.step.run('recover-membership', observe);
-    if (matches(recovered, present))
+    const recovered = await observeMembers(context, { members, group }, present);
+    if (recovered.changes.length === 0)
         return {};
     throw context.error('GROUP_MEMBERSHIP_UNCONFIRMED', {
         cause: result.code,
         outcomeKnown: false,
     });
 }
+/** Add or withdraw one direct member of a Shell group. */
+export const changeGroupMembership = (context, present) => 
+// The member Path input already restricts its Class to an account or a group.
+changeGroupMembers(context, { group: context.input.group, members: [context.input.member] }, present, { checkMembers: false });
+/** Whether every member is an account or a group, a Domain's subclass included. */
+async function identitiesOnly(context, members) {
+    const [first, ...others] = members;
+    if (first === undefined)
+        return false;
+    const ids = [first, ...others];
+    const found = await Promise.all([
+        context.query(readIdentities, { kind: 'User', ids }),
+        context.query(readIdentities, { kind: 'Group', ids }),
+    ]);
+    const known = new Set(found.flat().map((node) => node.id));
+    return members.every((member) => known.has(member));
+}
+/**
+ * The members and their membership Edges to the group as they are, in three reads whatever their
+ * number, with the guards that keep them so and the Edges to change for the state asked for.
+ */
+async function observeMembers(context, selection, present) {
+    const [endpoints, authority, legacy] = await Promise.all([
+        context.query(readGroupMembersEndpoints, selection),
+        context.query(readGroupMembers, selection),
+        legacyMembersEdges(context, selection, present),
+    ]);
+    const changes = [];
+    for (const member of selection.members) {
+        if (authority.present.has(member) !== present) {
+            changes.push({ member, edge: 'authority', present });
+        }
+        const wanted = legacy.wanted(member);
+        if (legacy.present.has(member) !== wanted)
+            changes.push({ member, edge: 'legacy', present: wanted });
+    }
+    return {
+        visible: endpoints.visible,
+        ...(endpoints.groupClass === undefined ? {} : { groupClass: endpoints.groupClass }),
+        guards: [endpoints.guard, authority.guard, legacy.guard],
+        changes,
+    };
+}

package/dist/functions/group/create-group.js

@@ -0,0 +1,23 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { Path } from '@astrale-os/sdk/graph/path';
+import { createGroup } from '../../mutations/identity/index.js';
+import { MAX_ATTRIBUTES, boundedAttributes } from '../../utils/index.js';
+import { groupErrors } from './group-errors.js';
+/** Create a local group. An empty group holds nothing: creating one grants no right. */
+export const create = defineAction()('Group.create', { errors: groupErrors }, async ({ input, mutate, error }) => {
+    const attributes = input.attributes === undefined ? undefined : boundedAttributes(input.attributes);
+    if (input.attributes !== undefined && attributes === undefined) {
+        throw error('GROUP_ATTRIBUTES_TOO_MANY', { max: MAX_ATTRIBUTES });
+    }
+    const result = await mutate(createGroup, {
+        values: {
+            name: input.name,
+            ...(input.description === undefined ? {} : { description: input.description }),
+            ...(input.icon === undefined || input.icon === null ? {} : { icon: input.icon }),
+            ...(attributes === undefined ? {} : { attributes }),
+        },
+    });
+    if (!result.ok)
+        throw error('GROUP_CHANGED', {});
+    return { group: Path.id(result.group).raw };
+});

package/dist/functions/group/delete-group.js

@@ -0,0 +1,33 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { readMembers } from '../authority/index.js';
+import { deleteIdentity } from '../../mutations/identity/index.js';
+import { readProfile } from '../../queries/profile/index.js';
+import { groupErrors } from './group-errors.js';
+import { isProvidedGroup, readGroup } from './group.js';
+import { roleProtected } from './membership-laws.js';
+/**
+ * Withdraw a local group's memberships, incoming and outgoing, and delete it (G4). Only its directory
+ * deletes a provided group (G2); only an admin deletes a group that holds a Role (G3).
+ */
+export const remove = defineAction()('Group.delete', { errors: groupErrors }, async (context) => {
+    const { error, self } = context;
+    const group = await readGroup(context, self);
+    if (group === undefined)
+        throw error('GROUP_NOT_FOUND', {});
+    if (isProvidedGroup(group))
+        throw error('GROUP_DIRECTORY_MANAGED', {});
+    const role = await roleProtected(context, group);
+    if (role !== undefined)
+        throw error('GROUP_ROLE_PROTECTED', { role });
+    const members = await readMembers(context, self);
+    const profile = await context.query(readProfile, { kind: 'Group', node: self });
+    const result = await context.mutate(deleteIdentity, {
+        kind: 'Group',
+        node: self,
+        members,
+        ...(profile === undefined ? {} : { profile }),
+    });
+    if (!result.ok)
+        throw error('GROUP_CHANGED', {});
+    return {};
+});