@astrale-domains/shell 0.1.7 → 0.1.8

package/dist/domain.d.ts

@@ -326,6 +326,20 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
                 }, "authorized", true, false, undefined, undefined>>;
+                readonly assignMembers: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    members: string[];
+                    group: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", true, false, undefined, undefined>>;
+                readonly unassignMembers: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    members: string[];
+                    group: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", true, false, undefined, undefined>>;
                 readonly provision: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
                     directory: string;
                     externalId: string;
@@ -369,7 +383,7 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
                     readonly abstract: false;
                     readonly depth: 1;
                     readonly properties: "attributes" | "description" | "directory" | "externalId" | "frozen" | "icon" | "iss" | "name" | "sub";
-                    readonly methods: "assignMember" | "create" | "delete" | "deprovision" | "provision" | "unassignMember" | "update";
+                    readonly methods: "assignMember" | "assignMembers" | "create" | "delete" | "deprovision" | "provision" | "unassignMember" | "unassignMembers" | "update";
                 }[];
                 readonly outgoing: "0..1";
             };
@@ -427,6 +441,13 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
                     readonly description?: string;
                     readonly immutable?: import("@astrale-os/sdk/schema").PropertyImmutability;
                 }>;
+                email: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "string";
+                    readonly minLength: 3;
+                    readonly maxLength: 320;
+                }, {
+                    readonly required: false;
+                }>;
             };
             readonly policies: {
                 readonly read: ({ check, ref }: import("@astrale-os/sdk/schema").ClassRuleContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").ClassRuleObject>;
@@ -471,7 +492,7 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
                     readonly kind: 'node';
                     readonly abstract: false;
                     readonly depth: 0;
-                    readonly properties: "execution" | "expiresAt" | "round" | "status";
+                    readonly properties: "email" | "execution" | "expiresAt" | "round" | "status";
                     readonly methods: "accept" | "cancel" | "resend" | "send";
                 }[];
                 readonly outgoing: "0..1";
@@ -651,6 +672,7 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
             readonly 'user-profile.reader': import("@astrale-os/sdk/schema").CoreNode;
             readonly 'user-profile.self-writer': import("@astrale-os/sdk/schema").CoreNode;
             readonly 'group-profile.reader': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'os.viewer': import("@astrale-os/sdk/schema").CoreNode;
             readonly admin: import("@astrale-os/sdk/schema").CoreNode;
             readonly member: import("@astrale-os/sdk/schema").CoreNode;
             readonly applications: import("@astrale-os/sdk/schema").CoreNode;

package/dist/domain.js

@@ -63,6 +63,12 @@ const domainRequirements = requirements(legacyRelease({
             members: [S.core.nodes['workspace.member']],
             granters: [S.core.nodes['workspace.admin']],
         },
+        // Whoever holds it opens the OS view; a member holds it, and an administrator through member.
+        {
+            role: S.core.nodes['os.viewer'],
+            members: [S.core.nodes['workspace.member']],
+            granters: [S.core.nodes['workspace.admin']],
+        },
         // Each profile holds the Kernel profile of its rank; Kernel admin is granted by Root alone.
         // Kernel reader is no profile's: admin grants it to whoever only opens the Views it is given
         // (AM10).
@@ -94,7 +100,13 @@ const domainRequirements = requirements(legacyRelease({
         { role: K.core.nodes['blob.reader'], granters: [S.core.nodes['workspace.admin']] },
         { role: K.core.nodes['blob.writer'], granters: [S.core.nodes['workspace.admin']] },
         { role: K.core.nodes['blob.manager'], granters: [S.core.nodes['workspace.admin']] },
-        { role: K.core.nodes['view.reader'], granters: [S.core.nodes['workspace.admin']] },
+        // A member reads every View, so the OS view lists every application; anyone else reads only
+        // the Views given to it by `view_access`. Independent of `os.viewer`, which only shows the OS.
+        {
+            role: K.core.nodes['view.reader'],
+            members: [S.core.nodes['workspace.member']],
+            granters: [S.core.nodes['workspace.admin']],
+        },
         { role: K.core.nodes['domain.reader'], granters: [S.core.nodes['workspace.admin']] },
         { role: K.core.nodes['execution.reader'], granters: [S.core.nodes['workspace.admin']] },
         { role: K.core.nodes['journal.reader'], granters: [S.core.nodes['workspace.admin']] },

package/dist/functions/authority/roles.js

@@ -1,6 +1,6 @@
-import { readRoleNodes } from '../../queries/composition/index.js';
+import { readRoleKeys } from '../../queries/composition/index.js';
 import { readIdentities } from '../../queries/identity/index.js';
-import { readRoleNode } from '../../queries/role/index.js';
+import { readRoleId, readRoleNode } from '../../queries/role/index.js';
 import { walkComposition } from './composition.js';
 /** Kernel reader and writer and their parts: every other Kernel Role administers (U4). */
 const KERNEL_ORDINARY = new Set([
@@ -22,12 +22,15 @@ const SHELL_ADMINISTRATIVE = new Set([
     'directory.provisioner',
 ]);
 const keyOf = (ref) => `${ref.origin}:${ref.name}`;
-/** One handler's view of authority; each composition and the Role catalogue is read once. */
+/** Identities one Role read starts from. */
+const ROLE_STEP = 256;
+/**
+ * One handler's view of authority. Each composition, and the Roles it holds, is read once; only the
+ * Roles a composition reaches are read, never the catalogue of every installed Role.
+ */
 export function authority(capabilities) {
     const S = capabilities.domain;
     const kernel = S.dependencies.kernel.origin;
-    let catalogue;
-    const roles = () => (catalogue ??= capabilities.query(readRoleNodes, {}));
     const compositions = new Map();
     const composition = (identity) => {
         let walked = compositions.get(identity);
@@ -37,22 +40,43 @@ export function authority(capabilities) {
         }
         return walked;
     };
-    const administrative = async () => {
-        const { byKey } = await roles();
-        const ids = new Set();
-        for (const [key, id] of byKey) {
-            const [origin, name] = [key.slice(0, key.indexOf(':')), key.slice(key.indexOf(':') + 1)];
-            if (origin === S.origin && SHELL_ADMINISTRATIVE.has(name))
-                ids.add(id);
-            if (origin === kernel && !KERNEL_ORDINARY.has(name))
-                ids.add(id);
+    const held = new Map();
+    /** The Core keys of the Roles an Identity holds, `<origin>:<key>`. */
+    const heldKeys = (identity) => {
+        let keys = held.get(identity);
+        if (keys === undefined) {
+            keys = (async () => {
+                const reached = [...(await composition(identity)).keys()];
+                const found = [];
+                for (let index = 0; index < reached.length; index += ROLE_STEP) {
+                    const [first, ...others] = reached.slice(index, index + ROLE_STEP);
+                    if (first === undefined)
+                        continue;
+                    const roles = await capabilities.query(readRoleKeys, { identities: [first, ...others] });
+                    found.push(...roles.values());
+                }
+                return found;
+            })();
+            held.set(identity, keys);
         }
-        return ids;
+        return keys;
+    };
+    const nodes = new Map();
+    const roleNode = (role) => {
+        let node = nodes.get(role);
+        if (node === undefined) {
+            node = capabilities.query(readRoleId, { role: S.core.nodes[role].ref });
+            nodes.set(role, node);
+        }
+        return node;
+    };
+    const administrative = (key) => {
+        const [origin, name] = [key.slice(0, key.indexOf(':')), key.slice(key.indexOf(':') + 1)];
+        return ((origin === S.origin && SHELL_ADMINISTRATIVE.has(name)) ||
+            (origin === kernel && !KERNEL_ORDINARY.has(name)));
     };
     return {
-        async roleNode(role) {
-            return (await roles()).byKey.get(keyOf(S.core.nodes[role].ref));
-        },
+        roleNode,
         async callerHolds(role) {
             const caller = capabilities.graph.caller;
             if (caller === undefined)
@@ -60,9 +84,7 @@ export function authority(capabilities) {
             return caller.query(readRoleNode, { role: S.core.nodes[role].ref });
         },
         async heldRole(identity) {
-            const { byKey } = await roles();
-            const reached = await composition(identity);
-            const held = [...byKey].filter(([, id]) => reached.has(id)).map(([key]) => key);
+            const held = await heldKeys(identity);
             const admin = keyOf(S.core.nodes['workspace.admin'].ref);
             const role = held.includes(admin) ? admin : held[0];
             if (role === undefined)
@@ -70,17 +92,10 @@ export function authority(capabilities) {
             return role.startsWith(`${S.origin}:`) ? role.slice(S.origin.length + 1) : role;
         },
         async holdsAdministration(identity) {
-            const ids = await administrative();
-            for (const reached of (await composition(identity)).keys())
-                if (ids.has(reached))
-                    return true;
-            return false;
-        },
-        async reaches(from, to) {
-            return from === to || (await composition(from)).has(to);
+            return (await heldKeys(identity)).some(administrative);
         },
         async activeAdministrators() {
-            const admin = (await roles()).byKey.get(keyOf(S.core.nodes['workspace.admin'].ref));
+            const admin = await roleNode('workspace.admin');
             if (admin === undefined)
                 return [];
             const holders = [...(await walkComposition(capabilities, admin, 'incoming')).keys()];

package/dist/functions/group/assign-member.js

@@ -1,4 +1,7 @@
-import { defineWorkflow } from '@astrale-os/sdk/workflow';
-import { changeGroupMembership } from './change-group-membership.js';
+import { defineAction } from '@astrale-os/sdk/action';
+import { changeGroupMembers, changeGroupMembership } from './change-group-membership.js';
 import { groupMembershipErrors } from './group-membership-errors.js';
-export const assignMember = defineWorkflow()('Group.assignMember', { errors: groupMembershipErrors }, (context) => changeGroupMembership(context, true));
+/** Make one account or group a member of a group, in one read and one write. */
+export const assignMember = defineAction()('Group.assignMember', { errors: groupMembershipErrors }, (context) => changeGroupMembership(context, true));
+/** Make several accounts or groups members of a group, in one commit. */
+export const assignMembers = defineAction()('Group.assignMembers', { errors: groupMembershipErrors }, (context) => changeGroupMembers(context, context.input, true));

package/dist/functions/group/change-group-membership.js

@@ -1,56 +1,60 @@
-import { setGroupMembership } from '../../mutations/group/index.js';
-import { readGroupMembership, readGroupMembershipEndpoints } from '../../queries/group/index.js';
+import { setGroupMemberships } from '../../mutations/group/index.js';
+import { readGroupMembers, readGroupMembersEndpoints } from '../../queries/group/index.js';
+import { readIdentities } from '../../queries/identity/index.js';
 import { canonicalNodeId } from '../../utils/canonical-node-path/index.js';
 import { readGroup } from './group.js';
 // Seam L-SHELL-8, L-SHELL-9: legacy groups also keep `member_of_group`; a Domain's own Group
 // subclass changes its members under that Domain's authority.
-import { legacyMembershipEdges, legacyChangeForeignMembership } from './legacy/index.js';
+import { legacyChangeForeignMembership, legacyMembersEdges } from './legacy/index.js';
 import { membershipRefusal } from './membership-laws.js';
 /**
- * Add or withdraw one direct member of a Shell group: Kernel `extends_with` from the member to the
- * group (G1), under G2, G3 and acyclicity. The write converges what it observed, guarded by it;
- * after an unknown outcome it observes again, and an unconfirmed outcome stays explicit.
+ * Add or withdraw direct members of one Shell group: Kernel `extends_with` from each member to the
+ * group (G1), under G2 and G3, checked once for the group. The Kernel refuses a cycle. All the
+ * members change in one commit, guarded by what was observed of them; a member already where it is
+ * asked to be changes nothing, so a retry is harmless. After an unknown outcome the change is
+ * observed again, and an unconfirmed outcome stays explicit.
  */
-export async function changeGroupMembership(context, present) {
+export async function changeGroupMembers(context, input, present, { checkMembers = true } = {}) {
     const invalid = () => context.error('INVALID_GROUP_MEMBERSHIP_REFERENCE', {});
-    const membership = {
-        member: canonicalNodeId(context.input.member, invalid),
-        group: canonicalNodeId(context.input.group, invalid),
-    };
-    const endpoints = await context.step.run('observe-endpoints', () => context.query(readGroupMembershipEndpoints, membership));
-    if (!endpoints.visible)
+    const group = canonicalNodeId(input.group, invalid);
+    const [first, ...others] = new Set(input.members.map((member) => canonicalNodeId(member, invalid)));
+    if (first === undefined)
+        throw invalid();
+    const members = [first, ...others];
+    // A fixed number of reads, whatever the number of members: one per kind, never one per member.
+    const [identities, observed, stored] = await Promise.all([
+        // A list of members is not a typed Path input: each must be an account or a group.
+        checkMembers ? identitiesOnly(context, members) : true,
+        observeMembers(context, { members, group }, present),
+        readGroup(context, group),
+    ]);
+    if (!identities)
+        throw invalid();
+    if (members.some((member) => !observed.visible.has(member)) || !observed.visible.has(group)) {
         throw context.error('GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE', {});
-    if (endpoints.groupClass !== context.domain.classes.Group.key) {
-        return legacyChangeForeignMembership(context, membership, present);
     }
-    const refusal = await context.step.run('check-laws', async () => {
-        const group = await readGroup(context, membership.group);
-        if (group === undefined)
-            return { code: 'GROUP_NOT_FOUND' };
-        return (await membershipRefusal(context, group, membership.member, present)) ?? null;
-    });
-    if (refusal !== null) {
+    if (observed.groupClass !== context.domain.classes.Group.key) {
+        for (const member of members) {
+            await legacyChangeForeignMembership(context, { member, group }, present);
+        }
+        return {};
+    }
+    if (stored === undefined)
+        throw context.error('GROUP_NOT_FOUND', {});
+    const refusal = await membershipRefusal(context, stored);
+    if (refusal !== undefined) {
         if (refusal.code === 'GROUP_ROLE_PROTECTED') {
             throw context.error(refusal.code, { role: refusal.role });
         }
         throw context.error(refusal.code, {});
     }
-    const observe = async () => {
-        const current = await context.query(readGroupMembershipEndpoints, membership);
-        if (!current.visible)
-            throw context.error('GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE', {});
-        const authority = await context.query(readGroupMembership, membership);
-        const edges = [
-            { edge: 'authority', current: authority.present, present, guard: authority.guard },
-            ...(await legacyMembershipEdges(context, membership, present)),
-        ];
-        return { endpoints: current.guard, edges };
-    };
-    const matches = (edges) => edges.every(({ current, present: wanted }) => current === wanted);
-    const current = await context.step.run('observe-membership', observe);
-    if (matches(current.edges))
+    if (observed.changes.length === 0)
         return {};
-    const result = await context.step.run('mutate-membership', () => context.mutate(setGroupMembership, { ...membership, ...current }));
+    const result = await context.mutate(setGroupMemberships, {
+        group,
+        guards: observed.guards,
+        changes: observed.changes,
+    });
     if (result.ok)
         return {};
     if (result.outcomeKnown) {
@@ -58,11 +62,54 @@ export async function changeGroupMembership(context, present) {
             throw context.error('GROUP_MEMBERSHIP_CYCLE', {});
         throw context.error('GROUP_MEMBERSHIP_CONFLICT', { cause: result.code });
     }
-    const recovered = await context.step.run('recover-membership', observe);
-    if (matches(recovered.edges))
+    const recovered = await observeMembers(context, { members, group }, present);
+    if (recovered.changes.length === 0)
         return {};
     throw context.error('GROUP_MEMBERSHIP_UNCONFIRMED', {
         cause: result.code,
         outcomeKnown: false,
     });
 }
+/** Add or withdraw one direct member of a Shell group. */
+export const changeGroupMembership = (context, present) => 
+// The member Path input already restricts its Class to an account or a group.
+changeGroupMembers(context, { group: context.input.group, members: [context.input.member] }, present, { checkMembers: false });
+/** Whether every member is an account or a group, a Domain's subclass included. */
+async function identitiesOnly(context, members) {
+    const [first, ...others] = members;
+    if (first === undefined)
+        return false;
+    const ids = [first, ...others];
+    const found = await Promise.all([
+        context.query(readIdentities, { kind: 'User', ids }),
+        context.query(readIdentities, { kind: 'Group', ids }),
+    ]);
+    const known = new Set(found.flat().map((node) => node.id));
+    return members.every((member) => known.has(member));
+}
+/**
+ * The members and their membership Edges to the group as they are, in three reads whatever their
+ * number, with the guards that keep them so and the Edges to change for the state asked for.
+ */
+async function observeMembers(context, selection, present) {
+    const [endpoints, authority, legacy] = await Promise.all([
+        context.query(readGroupMembersEndpoints, selection),
+        context.query(readGroupMembers, selection),
+        legacyMembersEdges(context, selection, present),
+    ]);
+    const changes = [];
+    for (const member of selection.members) {
+        if (authority.present.has(member) !== present) {
+            changes.push({ member, edge: 'authority', present });
+        }
+        const wanted = legacy.wanted(member);
+        if (legacy.present.has(member) !== wanted)
+            changes.push({ member, edge: 'legacy', present: wanted });
+    }
+    return {
+        visible: endpoints.visible,
+        ...(endpoints.groupClass === undefined ? {} : { groupClass: endpoints.groupClass }),
+        guards: [endpoints.guard, authority.guard, legacy.guard],
+        changes,
+    };
+}

package/dist/functions/group/group-membership-errors.js

@@ -9,7 +9,7 @@ export const groupMembershipErrors = {
     },
     INVALID_GROUP_MEMBERSHIP_REFERENCE: {
         family: 'VALIDATION_ERROR',
-        message: 'Member and group must be exact canonical @NodeId paths.',
+        message: 'Members and group must be exact canonical @NodeId paths of accounts or groups.',
         details: z.strictObject({}),
     },
     GROUP_MEMBERSHIP_CONFLICT: {

package/dist/functions/group/index.js

@@ -1,8 +1,8 @@
 export { create } from './create-group.js';
 export { update } from './update-group.js';
 export { remove } from './delete-group.js';
-export { assignMember } from './assign-member.js';
-export { unassignMember } from './unassign-member.js';
+export { assignMember, assignMembers } from './assign-member.js';
+export { unassignMember, unassignMembers } from './unassign-member.js';
 export { provision } from './provision-group.js';
 export { deprovision } from './deprovision-group.js';
 export { toGroup } from './group.js';

package/dist/functions/group/legacy/index.js

@@ -1 +1 @@
-export { legacyChangeForeignMembership, legacyMembershipEdges } from './membership.js';
+export { legacyChangeForeignMembership, legacyMembersEdges } from './membership.js';

package/dist/functions/group/legacy/membership.js

@@ -1,20 +1,24 @@
 import { setGroupMembership } from '../../../mutations/group/index.js';
-import { readGroupMembership, readGroupMembershipEndpoints } from '../../../queries/group/index.js';
-import { legacyReadCoreGroups, legacyReadMemberOfGroup } from '../../../queries/group/legacy/index.js';
+import { readGroupMembership, readGroupMembershipEndpoints, } from '../../../queries/group/index.js';
+import { legacyReadCoreGroups, legacyReadMemberOfGroup, legacyReadMembersOfGroup, } from '../../../queries/group/legacy/index.js';
 /**
- * @deprecated The legacy `member_of_group` Edge a change of a Shell group's members also converges
- * (L-SHELL-8): joining one of the legacy Core groups writes it beside `extends_with`, for the readers
- * that still check it; leaving any group removes it. Replaced by `extends_with` alone. Removal:
- * Shell major (delivery step 5) after 1Pact step 4.
+ * @deprecated The legacy `member_of_group` Edges a change of a Shell group's members also converges
+ * (L-SHELL-8), read in one go for all the members: joining one of the legacy Core groups writes it
+ * beside `extends_with`, for the readers that still check it; leaving any group removes it.
+ * Replaced by `extends_with` alone. Removal: Shell major (delivery step 5) after 1Pact step 4.
  */
-export async function legacyMembershipEdges(context, membership, present) {
-    const observed = await context.query(legacyReadMemberOfGroup, membership);
-    let wanted = false;
-    if (present) {
-        const legacyGroups = Object.values(await context.query(legacyReadCoreGroups, {}));
-        wanted = observed.present || legacyGroups.includes(membership.group);
-    }
-    return [{ edge: 'legacy', current: observed.present, present: wanted, guard: observed.guard }];
+export async function legacyMembersEdges(context, selection, present) {
+    const [observed, legacyGroups] = await Promise.all([
+        context.query(legacyReadMembersOfGroup, selection),
+        present ? context.query(legacyReadCoreGroups, {}) : undefined,
+    ]);
+    const core = legacyGroups !== undefined && Object.values(legacyGroups).includes(selection.group);
+    return {
+        present: observed.present,
+        guard: observed.guard,
+        /** Whether a member is to keep `member_of_group`: never when it leaves the group. */
+        wanted: (member) => present && (core || observed.present.has(member)),
+    };
 }
 /**
  * @deprecated A Domain that extends Group changes the members of its own groups (L-SHELL-9): Shell
@@ -42,10 +46,10 @@ export async function legacyChangeForeignMembership(context, membership, present
         return { endpoints: endpoints.guard, edges };
     };
     const matches = (edges) => edges.every(({ current, present: wanted }) => current === wanted);
-    const current = await context.step.run('observe-foreign-membership', observe);
+    const current = await observe();
     if (matches(current.edges))
         return {};
-    const result = await context.step.run('mutate-foreign-membership', () => caller.mutate(setGroupMembership, { ...membership, ...current }));
+    const result = await caller.mutate(setGroupMembership, { ...membership, ...current });
     if (result.ok)
         return {};
     if (result.outcomeKnown) {
@@ -53,7 +57,7 @@ export async function legacyChangeForeignMembership(context, membership, present
             throw context.error('GROUP_MEMBERSHIP_CYCLE', {});
         throw context.error('GROUP_MEMBERSHIP_CONFLICT', { cause: result.code });
     }
-    const recovered = await context.step.run('recover-foreign-membership', observe);
+    const recovered = await observe();
     if (matches(recovered.edges))
         return {};
     throw context.error('GROUP_MEMBERSHIP_UNCONFIRMED', { cause: result.code, outcomeKnown: false });

package/dist/functions/group/membership-laws.js

@@ -1,12 +1,12 @@
 import { authority } from '../authority/index.js';
 import { isProvidedGroup } from './group.js';
 /**
- * G2, G3 and acyclicity for one change of a Shell group's members. A provided group changes its
- * members only through its directory, a local one through `group.writer`; a group that holds a
- * Role, directly or through what it extends, only by an admin or its directory; and a member never
- * joins a group it already holds.
+ * G2 and G3 for one change of a Shell group's members. A provided group changes its members only
+ * through its directory, a local one through `group.writer`; a group that holds a Role, directly or
+ * through what it extends, only by an admin or its directory. A member that would join a group it
+ * already holds is refused by the Kernel, which keeps `extends_with` acyclic.
  */
-export async function membershipRefusal(capabilities, group, member, joining) {
+export async function membershipRefusal(capabilities, group) {
     const authorities = authority(capabilities);
     const provided = isProvidedGroup(group);
     if (provided) {
@@ -22,9 +22,6 @@ export async function membershipRefusal(capabilities, group, member, joining) {
         if (role !== undefined)
             return { code: 'GROUP_ROLE_PROTECTED', role };
     }
-    if (joining && (await authorities.reaches(group.id, member))) {
-        return { code: 'GROUP_MEMBERSHIP_CYCLE' };
-    }
     return undefined;
 }
 /**

package/dist/functions/group/unassign-member.js

@@ -1,4 +1,7 @@
-import { defineWorkflow } from '@astrale-os/sdk/workflow';
-import { changeGroupMembership } from './change-group-membership.js';
+import { defineAction } from '@astrale-os/sdk/action';
+import { changeGroupMembers, changeGroupMembership } from './change-group-membership.js';
 import { groupMembershipErrors } from './group-membership-errors.js';
-export const unassignMember = defineWorkflow()('Group.unassignMember', { errors: groupMembershipErrors }, (context) => changeGroupMembership(context, false));
+/** Withdraw one account or group from a group, in one read and one write. */
+export const unassignMember = defineAction()('Group.unassignMember', { errors: groupMembershipErrors }, (context) => changeGroupMembership(context, false));
+/** Withdraw several accounts or groups from a group, in one commit. */
+export const unassignMembers = defineAction()('Group.unassignMembers', { errors: groupMembershipErrors }, (context) => changeGroupMembers(context, context.input, false));

package/dist/functions/invitation/send-invitation.js

@@ -2,6 +2,7 @@ import { defineWorkflow } from '@astrale-os/sdk/workflow';
 import { inviteErrors, readAccount, userErrors } from '../user/index.js';
 import { InvitationRequestFailure } from '../../integrations/user-invitation/index.js';
 import { bindAccount, createInvitation, updateInvitation } from '../../mutations/invitation/index.js';
+import { readInvitation, readPendingInvitations } from '../../queries/invitation/index.js';
 import { canonicalNodeId } from '../../utils/canonical-node-path/index.js';
 const errors = { ...inviteErrors, ...userErrors };
 /** How long an invitation waits for its first sign-in. */
@@ -12,6 +13,10 @@ export const invitationSignal = (round) => `event-${round}`;
  * Invite an account and keep its invitation until it ends: record it, have Admin send the email,
  * then wait for the first sign-in (`accept`), a resend, a cancel or the expiry. It grants nothing:
  * the account holds what `User.create` or an admin gave it.
+ *
+ * An account has at most one pending invitation. When one is pending for the same email, this run
+ * has it resent, with a full time to live again, and ends. For another email, it cancels it and
+ * records a new one; Admin replaces its own link when it receives the new request.
  */
 export const send = defineWorkflow()('Invitation.send', { errors }, async (context) => {
     const { step, execution, awaitSignal, cancelled, error } = context;
@@ -24,13 +29,57 @@ export const send = defineWorkflow()('Invitation.send', { errors }, async (conte
     if (account.email === undefined)
         throw error('USER_EMAIL_INVALID', {});
     const email = account.email;
+    // Stop the runs of replaced invitations: each finds its invitation closed and ends.
+    const stop = (runs) => step.run('stop-replaced', async ({ kernel }) => {
+        for (const { execution: ref } of runs) {
+            await kernel.execution.cancel(ref).catch(() => undefined);
+        }
+    });
+    const retire = async (invitations) => {
+        for (const [index, { id }] of invitations.entries()) {
+            await step.mutate(`retire-${index}`, updateInvitation, {
+                invitation: id,
+                status: 'cancelled',
+            });
+        }
+        await stop(invitations);
+    };
+    // Close the invitation, unless another run already closed it (a replacement).
+    const close = async (name, status) => {
+        const current = await step.run(`read-${name}`, ({ query }) => query(readInvitation, { invitation }));
+        if (current?.status !== 'pending')
+            return { status: 'cancelled' };
+        await step.mutate(name, updateInvitation, { invitation, status });
+        return { status };
+    };
+    const pending = await step.run('read-pending', ({ query }) => query(readPendingInvitations, { user }));
+    const same = pending.find((previous) => previous.email === email);
+    // Its run sends the email again and restarts the time to live. A run that no longer answers
+    // has its invitation replaced instead.
+    const resent = same !== undefined &&
+        (await step.run('resend-pending', ({ kernel }) => kernel.execution
+            .signal(same.execution, {
+            name: invitationSignal(same.round),
+            value: { kind: 'resend' },
+        })
+            .then(() => true, () => false)));
+    if (resent) {
+        const others = pending.filter((previous) => previous !== same);
+        if (others.length > 0)
+            await retire(others);
+        return { status: 'pending' };
+    }
     const startedAt = await step.run('clock', () => Date.now());
-    const expiresAt = startedAt + INVITATION_TTL_MS;
+    let expiresAt = startedAt + INVITATION_TTL_MS;
     const { invitation } = await step.mutate('record-invitation', createInvitation, {
         user,
         execution: execution.id,
         expiresAt: new Date(expiresAt).toISOString(),
+        email,
+        replaces: pending.map((previous) => previous.id),
     });
+    if (pending.length > 0)
+        await stop(pending);
     const requestedBy = execution.initiator.caller ?? execution.initiator.principal;
     const sendEmail = async (round) => {
         try {
@@ -55,27 +104,28 @@ export const send = defineWorkflow()('Invitation.send', { errors }, async (conte
             const event = await awaitSignal(invitationSignal(round), {
                 timeoutMs: Math.max(expiresAt - now, 1),
             });
-            if (event.kind === 'timeout') {
-                await step.mutate('expire', updateInvitation, { invitation, status: 'expired' });
-                return { status: 'expired' };
-            }
+            if (event.kind === 'timeout')
+                return await close('expire', 'expired');
             if (event.value.kind === 'accepted') {
                 const { iss, sub } = event.value;
                 await step.mutate('bind-account', bindAccount, { user, iss, sub });
                 await step.mutate('accept', updateInvitation, { invitation, status: 'accepted' });
                 return { status: 'accepted' };
             }
+            // A resend is a new link from Admin, with a full time to live again.
             await sendEmail(round + 1);
+            const resentAt = await step.run(`resent-at-${round + 1}`, () => Date.now());
+            expiresAt = resentAt + INVITATION_TTL_MS;
             await step.mutate(`next-round-${round + 1}`, updateInvitation, {
                 invitation,
                 round: round + 1,
+                expiresAt: new Date(expiresAt).toISOString(),
             });
         }
     }
     catch (cause) {
         if (!cancelled(cause))
             throw cause;
-        await step.mutate('cancel', updateInvitation, { invitation, status: 'cancelled' });
-        return { status: 'cancelled' };
+        return await close('cancel', 'cancelled');
     }
 });

package/dist/mutations/group/index.js

@@ -1 +1 @@
-export { setGroupMembership } from './set-group-membership.js';
+export { setGroupMembership, setGroupMemberships, } from './set-group-membership.js';