@astrale-domains/shell 0.1.7 → 0.1.9

package/dist/domain.d.ts

@@ -35,6 +35,28 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
             readonly constraints: Record<never, never>;
             readonly effectiveProperties: never;
         }>;
+        readonly view_access: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+            readonly depth: 0;
+            readonly abstract: false;
+            readonly extends: readonly [];
+            readonly properties: never;
+            readonly source: {
+                readonly as: "audience";
+                readonly accepts: readonly (import("@astrale-os/sdk/schema").ClassRef<"Identity"> & {
+                    readonly origin: "kernel.astrale.ai";
+                })[];
+                readonly outgoing: "0..*";
+            };
+            readonly target: {
+                readonly as: "view";
+                readonly accepts: readonly (import("@astrale-os/sdk/schema").ClassRef<"View"> & {
+                    readonly origin: "kernel.astrale.ai";
+                })[];
+                readonly incoming: "0..*";
+            };
+            readonly constraints: Record<never, never>;
+            readonly effectiveProperties: never;
+        }>;
         readonly User: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly inheritance: "open";
@@ -326,6 +348,20 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
                 }, "authorized", true, false, undefined, undefined>>;
+                readonly assignMembers: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    members: string[];
+                    group: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", true, false, undefined, undefined>>;
+                readonly unassignMembers: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    members: string[];
+                    group: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", true, false, undefined, undefined>>;
                 readonly provision: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
                     directory: string;
                     externalId: string;
@@ -369,7 +405,7 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
                     readonly abstract: false;
                     readonly depth: 1;
                     readonly properties: "attributes" | "description" | "directory" | "externalId" | "frozen" | "icon" | "iss" | "name" | "sub";
-                    readonly methods: "assignMember" | "create" | "delete" | "deprovision" | "provision" | "unassignMember" | "update";
+                    readonly methods: "assignMember" | "assignMembers" | "create" | "delete" | "deprovision" | "provision" | "unassignMember" | "unassignMembers" | "update";
                 }[];
                 readonly outgoing: "0..1";
             };
@@ -427,6 +463,13 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
                     readonly description?: string;
                     readonly immutable?: import("@astrale-os/sdk/schema").PropertyImmutability;
                 }>;
+                email: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "string";
+                    readonly minLength: 3;
+                    readonly maxLength: 320;
+                }, {
+                    readonly required: false;
+                }>;
             };
             readonly policies: {
                 readonly read: ({ check, ref }: import("@astrale-os/sdk/schema").ClassRuleContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").ClassRuleObject>;
@@ -471,7 +514,7 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
                     readonly kind: 'node';
                     readonly abstract: false;
                     readonly depth: 0;
-                    readonly properties: "execution" | "expiresAt" | "round" | "status";
+                    readonly properties: "email" | "execution" | "expiresAt" | "round" | "status";
                     readonly methods: "accept" | "cancel" | "resend" | "send";
                 }[];
                 readonly outgoing: "0..1";
@@ -557,28 +600,6 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
             readonly constraints: Record<never, never>;
             readonly effectiveProperties: never;
         }>;
-        readonly view_access: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
-            readonly depth: 0;
-            readonly abstract: false;
-            readonly extends: readonly [];
-            readonly properties: never;
-            readonly source: {
-                readonly as: "audience";
-                readonly accepts: readonly (import("@astrale-os/sdk/schema").ClassRef<"Identity"> & {
-                    readonly origin: "kernel.astrale.ai";
-                })[];
-                readonly outgoing: "0..*";
-            };
-            readonly target: {
-                readonly as: "view";
-                readonly accepts: readonly (import("@astrale-os/sdk/schema").ClassRef<"View"> & {
-                    readonly origin: "kernel.astrale.ai";
-                })[];
-                readonly incoming: "0..*";
-            };
-            readonly constraints: Record<never, never>;
-            readonly effectiveProperties: never;
-        }>;
     };
     readonly functions: {
         readonly listEntrypoints: import("@astrale-os/sdk/schema").Function<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
@@ -612,6 +633,13 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
                 profiles: number;
             };
         }, "authorized", false, false, undefined, undefined>>;
+        readonly legacyMigrateViewAccess: import("@astrale-os/sdk/schema").Function<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: {
+                copied: number;
+                removed: number;
+            };
+        }, "authorized", false, false, undefined, undefined>>;
         readonly disconnectDirectory: import("@astrale-os/sdk/schema").Function<import("@astrale-os/sdk/schema").CallableProjection<{
             directory: string;
         }, {
@@ -629,8 +657,8 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
         readonly usesFunction: import("@astrale-os/sdk/schema").Policy;
         readonly isSelf: import("@astrale-os/sdk/schema").Policy;
         readonly legacyOwnsMembershipGroup: import("@astrale-os/sdk/schema").Policy;
-        readonly hasRole: import("@astrale-os/sdk/schema").Policy;
         readonly holdsViewAccess: import("@astrale-os/sdk/schema").Policy;
+        readonly hasRole: import("@astrale-os/sdk/schema").Policy;
         readonly describesSubject: import("@astrale-os/sdk/schema").Policy;
         readonly isProfileSource: import("@astrale-os/sdk/schema").Policy;
         readonly describesGroupOfSubject: import("@astrale-os/sdk/schema").Policy;
@@ -651,6 +679,7 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
             readonly 'user-profile.reader': import("@astrale-os/sdk/schema").CoreNode;
             readonly 'user-profile.self-writer': import("@astrale-os/sdk/schema").CoreNode;
             readonly 'group-profile.reader': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'os.viewer': import("@astrale-os/sdk/schema").CoreNode;
             readonly admin: import("@astrale-os/sdk/schema").CoreNode;
             readonly member: import("@astrale-os/sdk/schema").CoreNode;
             readonly applications: import("@astrale-os/sdk/schema").CoreNode;

package/dist/domain.js

@@ -63,6 +63,12 @@ const domainRequirements = requirements(legacyRelease({
             members: [S.core.nodes['workspace.member']],
             granters: [S.core.nodes['workspace.admin']],
         },
+        // Whoever holds it opens the OS view; a member holds it, and an administrator through member.
+        {
+            role: S.core.nodes['os.viewer'],
+            members: [S.core.nodes['workspace.member']],
+            granters: [S.core.nodes['workspace.admin']],
+        },
         // Each profile holds the Kernel profile of its rank; Kernel admin is granted by Root alone.
         // Kernel reader is no profile's: admin grants it to whoever only opens the Views it is given
         // (AM10).
@@ -94,7 +100,21 @@ const domainRequirements = requirements(legacyRelease({
         { role: K.core.nodes['blob.reader'], granters: [S.core.nodes['workspace.admin']] },
         { role: K.core.nodes['blob.writer'], granters: [S.core.nodes['workspace.admin']] },
         { role: K.core.nodes['blob.manager'], granters: [S.core.nodes['workspace.admin']] },
-        { role: K.core.nodes['view.reader'], granters: [S.core.nodes['workspace.admin']] },
+        // A member reads every View, so the OS view lists every application; anyone else reads only
+        // the Views given to it by `view_access`. Independent of `os.viewer`, which only shows the OS.
+        {
+            role: K.core.nodes['view.reader'],
+            members: [S.core.nodes['workspace.member']],
+            granters: [S.core.nodes['workspace.admin']],
+        },
+        // Shell writes the Kernel's view_access for assignViews and its migration (L-SHELL-12,
+        // L-SHELL-20); an administrator writes it from the console through Kernel admin. Transition
+        // only: removed with those two Functions (step 5).
+        {
+            role: K.core.nodes['view.manager'],
+            members: [requirements.domain],
+            granters: [S.core.nodes['workspace.admin']],
+        },
         { role: K.core.nodes['domain.reader'], granters: [S.core.nodes['workspace.admin']] },
         { role: K.core.nodes['execution.reader'], granters: [S.core.nodes['workspace.admin']] },
         { role: K.core.nodes['journal.reader'], granters: [S.core.nodes['workspace.admin']] },

package/dist/functions/authority/roles.js

@@ -1,6 +1,6 @@
-import { readRoleNodes } from '../../queries/composition/index.js';
+import { readRoleKeys } from '../../queries/composition/index.js';
 import { readIdentities } from '../../queries/identity/index.js';
-import { readRoleNode } from '../../queries/role/index.js';
+import { readRoleId, readRoleNode } from '../../queries/role/index.js';
 import { walkComposition } from './composition.js';
 /** Kernel reader and writer and their parts: every other Kernel Role administers (U4). */
 const KERNEL_ORDINARY = new Set([
@@ -22,12 +22,16 @@ const SHELL_ADMINISTRATIVE = new Set([
     'directory.provisioner',
 ]);
 const keyOf = (ref) => `${ref.origin}:${ref.name}`;
-/** One handler's view of authority; each composition and the Role catalogue is read once. */
+/** Identities one Role read starts from. */
+const ROLE_STEP = 256;
+/**
+ * One handler's view of authority. Each composition, and the Roles it holds, is read once; only the
+ * Roles a composition reaches are read, never the catalogue of every installed Role. What the
+ * caller holds is asked once per Role too, so a handler may ask early and use the answer later.
+ */
 export function authority(capabilities) {
     const S = capabilities.domain;
     const kernel = S.dependencies.kernel.origin;
-    let catalogue;
-    const roles = () => (catalogue ??= capabilities.query(readRoleNodes, {}));
     const compositions = new Map();
     const composition = (identity) => {
         let walked = compositions.get(identity);
@@ -37,32 +41,58 @@ export function authority(capabilities) {
         }
         return walked;
     };
-    const administrative = async () => {
-        const { byKey } = await roles();
-        const ids = new Set();
-        for (const [key, id] of byKey) {
-            const [origin, name] = [key.slice(0, key.indexOf(':')), key.slice(key.indexOf(':') + 1)];
-            if (origin === S.origin && SHELL_ADMINISTRATIVE.has(name))
-                ids.add(id);
-            if (origin === kernel && !KERNEL_ORDINARY.has(name))
-                ids.add(id);
+    const held = new Map();
+    /** The Core keys of the Roles an Identity holds, `<origin>:<key>`. */
+    const heldKeys = (identity) => {
+        let keys = held.get(identity);
+        if (keys === undefined) {
+            keys = (async () => {
+                const reached = [...(await composition(identity)).keys()];
+                const found = [];
+                for (let index = 0; index < reached.length; index += ROLE_STEP) {
+                    const [first, ...others] = reached.slice(index, index + ROLE_STEP);
+                    if (first === undefined)
+                        continue;
+                    const roles = await capabilities.query(readRoleKeys, { identities: [first, ...others] });
+                    found.push(...roles.values());
+                }
+                return found;
+            })();
+            held.set(identity, keys);
         }
-        return ids;
+        return keys;
     };
+    const nodes = new Map();
+    const roleNode = (role) => {
+        let node = nodes.get(role);
+        if (node === undefined) {
+            node = capabilities.query(readRoleId, { role: S.core.nodes[role].ref });
+            nodes.set(role, node);
+        }
+        return node;
+    };
+    const administrative = (key) => {
+        const [origin, name] = [key.slice(0, key.indexOf(':')), key.slice(key.indexOf(':') + 1)];
+        return ((origin === S.origin && SHELL_ADMINISTRATIVE.has(name)) ||
+            (origin === kernel && !KERNEL_ORDINARY.has(name)));
+    };
+    const callerRoles = new Map();
     return {
-        async roleNode(role) {
-            return (await roles()).byKey.get(keyOf(S.core.nodes[role].ref));
-        },
-        async callerHolds(role) {
-            const caller = capabilities.graph.caller;
-            if (caller === undefined)
-                return false;
-            return caller.query(readRoleNode, { role: S.core.nodes[role].ref });
+        roleNode,
+        callerHolds(role) {
+            let holds = callerRoles.get(role);
+            if (holds === undefined) {
+                const caller = capabilities.graph.caller;
+                holds =
+                    caller === undefined
+                        ? Promise.resolve(false)
+                        : caller.query(readRoleNode, { role: S.core.nodes[role].ref });
+                callerRoles.set(role, holds);
+            }
+            return holds;
         },
         async heldRole(identity) {
-            const { byKey } = await roles();
-            const reached = await composition(identity);
-            const held = [...byKey].filter(([, id]) => reached.has(id)).map(([key]) => key);
+            const held = await heldKeys(identity);
             const admin = keyOf(S.core.nodes['workspace.admin'].ref);
             const role = held.includes(admin) ? admin : held[0];
             if (role === undefined)
@@ -70,17 +100,10 @@ export function authority(capabilities) {
             return role.startsWith(`${S.origin}:`) ? role.slice(S.origin.length + 1) : role;
         },
         async holdsAdministration(identity) {
-            const ids = await administrative();
-            for (const reached of (await composition(identity)).keys())
-                if (ids.has(reached))
-                    return true;
-            return false;
-        },
-        async reaches(from, to) {
-            return from === to || (await composition(from)).has(to);
+            return (await heldKeys(identity)).some(administrative);
         },
         async activeAdministrators() {
-            const admin = (await roles()).byKey.get(keyOf(S.core.nodes['workspace.admin'].ref));
+            const admin = await roleNode('workspace.admin');
             if (admin === undefined)
                 return [];
             const holders = [...(await walkComposition(capabilities, admin, 'incoming')).keys()];

package/dist/functions/group/assign-member.js

@@ -1,4 +1,7 @@
-import { defineWorkflow } from '@astrale-os/sdk/workflow';
-import { changeGroupMembership } from './change-group-membership.js';
+import { defineAction } from '@astrale-os/sdk/action';
+import { changeGroupMembers, changeGroupMembership } from './change-group-membership.js';
 import { groupMembershipErrors } from './group-membership-errors.js';
-export const assignMember = defineWorkflow()('Group.assignMember', { errors: groupMembershipErrors }, (context) => changeGroupMembership(context, true));
+/** Make one account or group a member of a group, in one read and one write. */
+export const assignMember = defineAction()('Group.assignMember', { errors: groupMembershipErrors }, (context) => changeGroupMembership(context, true));
+/** Make several accounts or groups members of a group, in one commit. */
+export const assignMembers = defineAction()('Group.assignMembers', { errors: groupMembershipErrors }, (context) => changeGroupMembers(context, context.input, true));

package/dist/functions/group/change-group-membership.js

@@ -1,56 +1,66 @@
-import { setGroupMembership } from '../../mutations/group/index.js';
-import { readGroupMembership, readGroupMembershipEndpoints } from '../../queries/group/index.js';
+import { authority } from '../authority/index.js';
+import { setGroupMemberships } from '../../mutations/group/index.js';
+import { readGroupMembers, readGroupMembersEndpoints } from '../../queries/group/index.js';
+import { readIdentities } from '../../queries/identity/index.js';
 import { canonicalNodeId } from '../../utils/canonical-node-path/index.js';
 import { readGroup } from './group.js';
 // Seam L-SHELL-8, L-SHELL-9: legacy groups also keep `member_of_group`; a Domain's own Group
 // subclass changes its members under that Domain's authority.
-import { legacyMembershipEdges, legacyChangeForeignMembership } from './legacy/index.js';
+import { legacyChangeForeignMembership, legacyMembersEdges } from './legacy/index.js';
 import { membershipRefusal } from './membership-laws.js';
 /**
- * Add or withdraw one direct member of a Shell group: Kernel `extends_with` from the member to the
- * group (G1), under G2, G3 and acyclicity. The write converges what it observed, guarded by it;
- * after an unknown outcome it observes again, and an unconfirmed outcome stays explicit.
+ * Add or withdraw direct members of one Shell group: Kernel `extends_with` from each member to the
+ * group (G1), under G2 and G3, checked once for the group. The Kernel refuses a cycle. All the
+ * members change in one commit, guarded by what was observed of them; a member already where it is
+ * asked to be changes nothing, so a retry is harmless. After an unknown outcome the change is
+ * observed again, and an unconfirmed outcome stays explicit.
  */
-export async function changeGroupMembership(context, present) {
+export async function changeGroupMembers(context, input, present, { checkMembers = true } = {}) {
     const invalid = () => context.error('INVALID_GROUP_MEMBERSHIP_REFERENCE', {});
-    const membership = {
-        member: canonicalNodeId(context.input.member, invalid),
-        group: canonicalNodeId(context.input.group, invalid),
-    };
-    const endpoints = await context.step.run('observe-endpoints', () => context.query(readGroupMembershipEndpoints, membership));
-    if (!endpoints.visible)
+    const group = canonicalNodeId(input.group, invalid);
+    const [first, ...others] = new Set(input.members.map((member) => canonicalNodeId(member, invalid)));
+    if (first === undefined)
+        throw invalid();
+    const members = [first, ...others];
+    const authorities = authority(context);
+    // A fixed number of reads, whatever the number of members: one per kind, never one per member.
+    // What the caller holds is asked with them, so G2 and G3 wait on no further round trip for it.
+    const [identities, observed, stored] = await Promise.all([
+        // A list of members is not a typed Path input: each must be an account or a group.
+        checkMembers ? identitiesOnly(context, members) : true,
+        observeMembers(context, { members, group }, present),
+        readGroup(context, group),
+        authorities.callerHolds('directory.provisioner'),
+        authorities.callerHolds('group.writer'),
+        authorities.callerHolds('workspace.admin'),
+    ]);
+    if (!identities)
+        throw invalid();
+    if (members.some((member) => !observed.visible.has(member)) || !observed.visible.has(group)) {
         throw context.error('GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE', {});
-    if (endpoints.groupClass !== context.domain.classes.Group.key) {
-        return legacyChangeForeignMembership(context, membership, present);
     }
-    const refusal = await context.step.run('check-laws', async () => {
-        const group = await readGroup(context, membership.group);
-        if (group === undefined)
-            return { code: 'GROUP_NOT_FOUND' };
-        return (await membershipRefusal(context, group, membership.member, present)) ?? null;
-    });
-    if (refusal !== null) {
+    if (observed.groupClass !== context.domain.classes.Group.key) {
+        for (const member of members) {
+            await legacyChangeForeignMembership(context, { member, group }, present);
+        }
+        return {};
+    }
+    if (stored === undefined)
+        throw context.error('GROUP_NOT_FOUND', {});
+    const refusal = await membershipRefusal(context, stored, authorities);
+    if (refusal !== undefined) {
         if (refusal.code === 'GROUP_ROLE_PROTECTED') {
             throw context.error(refusal.code, { role: refusal.role });
         }
         throw context.error(refusal.code, {});
     }
-    const observe = async () => {
-        const current = await context.query(readGroupMembershipEndpoints, membership);
-        if (!current.visible)
-            throw context.error('GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE', {});
-        const authority = await context.query(readGroupMembership, membership);
-        const edges = [
-            { edge: 'authority', current: authority.present, present, guard: authority.guard },
-            ...(await legacyMembershipEdges(context, membership, present)),
-        ];
-        return { endpoints: current.guard, edges };
-    };
-    const matches = (edges) => edges.every(({ current, present: wanted }) => current === wanted);
-    const current = await context.step.run('observe-membership', observe);
-    if (matches(current.edges))
+    if (observed.changes.length === 0)
         return {};
-    const result = await context.step.run('mutate-membership', () => context.mutate(setGroupMembership, { ...membership, ...current }));
+    const result = await context.mutate(setGroupMemberships, {
+        group,
+        guards: observed.guards,
+        changes: observed.changes,
+    });
     if (result.ok)
         return {};
     if (result.outcomeKnown) {
@@ -58,11 +68,54 @@ export async function changeGroupMembership(context, present) {
             throw context.error('GROUP_MEMBERSHIP_CYCLE', {});
         throw context.error('GROUP_MEMBERSHIP_CONFLICT', { cause: result.code });
     }
-    const recovered = await context.step.run('recover-membership', observe);
-    if (matches(recovered.edges))
+    const recovered = await observeMembers(context, { members, group }, present);
+    if (recovered.changes.length === 0)
         return {};
     throw context.error('GROUP_MEMBERSHIP_UNCONFIRMED', {
         cause: result.code,
         outcomeKnown: false,
     });
 }
+/** Add or withdraw one direct member of a Shell group. */
+export const changeGroupMembership = (context, present) => 
+// The member Path input already restricts its Class to an account or a group.
+changeGroupMembers(context, { group: context.input.group, members: [context.input.member] }, present, { checkMembers: false });
+/** Whether every member is an account or a group, a Domain's subclass included. */
+async function identitiesOnly(context, members) {
+    const [first, ...others] = members;
+    if (first === undefined)
+        return false;
+    const ids = [first, ...others];
+    const found = await Promise.all([
+        context.query(readIdentities, { kind: 'User', ids }),
+        context.query(readIdentities, { kind: 'Group', ids }),
+    ]);
+    const known = new Set(found.flat().map((node) => node.id));
+    return members.every((member) => known.has(member));
+}
+/**
+ * The members and their membership Edges to the group as they are, in three reads whatever their
+ * number, with the guards that keep them so and the Edges to change for the state asked for.
+ */
+async function observeMembers(context, selection, present) {
+    const [endpoints, authority, legacy] = await Promise.all([
+        context.query(readGroupMembersEndpoints, selection),
+        context.query(readGroupMembers, selection),
+        legacyMembersEdges(context, selection, present),
+    ]);
+    const changes = [];
+    for (const member of selection.members) {
+        if (authority.present.has(member) !== present) {
+            changes.push({ member, edge: 'authority', present });
+        }
+        const wanted = legacy.wanted(member);
+        if (legacy.present.has(member) !== wanted)
+            changes.push({ member, edge: 'legacy', present: wanted });
+    }
+    return {
+        visible: endpoints.visible,
+        ...(endpoints.groupClass === undefined ? {} : { groupClass: endpoints.groupClass }),
+        guards: [endpoints.guard, authority.guard, legacy.guard],
+        changes,
+    };
+}

package/dist/functions/group/group-membership-errors.js

@@ -9,7 +9,7 @@ export const groupMembershipErrors = {
     },
     INVALID_GROUP_MEMBERSHIP_REFERENCE: {
         family: 'VALIDATION_ERROR',
-        message: 'Member and group must be exact canonical @NodeId paths.',
+        message: 'Members and group must be exact canonical @NodeId paths of accounts or groups.',
         details: z.strictObject({}),
     },
     GROUP_MEMBERSHIP_CONFLICT: {

package/dist/functions/group/index.js

@@ -1,8 +1,8 @@
 export { create } from './create-group.js';
 export { update } from './update-group.js';
 export { remove } from './delete-group.js';
-export { assignMember } from './assign-member.js';
-export { unassignMember } from './unassign-member.js';
+export { assignMember, assignMembers } from './assign-member.js';
+export { unassignMember, unassignMembers } from './unassign-member.js';
 export { provision } from './provision-group.js';
 export { deprovision } from './deprovision-group.js';
 export { toGroup } from './group.js';

package/dist/functions/group/legacy/index.js

@@ -1 +1 @@
-export { legacyChangeForeignMembership, legacyMembershipEdges } from './membership.js';
+export { legacyChangeForeignMembership, legacyMembersEdges } from './membership.js';

package/dist/functions/group/legacy/membership.js

@@ -1,20 +1,24 @@
 import { setGroupMembership } from '../../../mutations/group/index.js';
-import { readGroupMembership, readGroupMembershipEndpoints } from '../../../queries/group/index.js';
-import { legacyReadCoreGroups, legacyReadMemberOfGroup } from '../../../queries/group/legacy/index.js';
+import { readGroupMembership, readGroupMembershipEndpoints, } from '../../../queries/group/index.js';
+import { legacyReadCoreGroups, legacyReadMemberOfGroup, legacyReadMembersOfGroup, } from '../../../queries/group/legacy/index.js';
 /**
- * @deprecated The legacy `member_of_group` Edge a change of a Shell group's members also converges
- * (L-SHELL-8): joining one of the legacy Core groups writes it beside `extends_with`, for the readers
- * that still check it; leaving any group removes it. Replaced by `extends_with` alone. Removal:
- * Shell major (delivery step 5) after 1Pact step 4.
+ * @deprecated The legacy `member_of_group` Edges a change of a Shell group's members also converges
+ * (L-SHELL-8), read in one go for all the members: joining one of the legacy Core groups writes it
+ * beside `extends_with`, for the readers that still check it; leaving any group removes it.
+ * Replaced by `extends_with` alone. Removal: Shell major (delivery step 5) after 1Pact step 4.
  */
-export async function legacyMembershipEdges(context, membership, present) {
-    const observed = await context.query(legacyReadMemberOfGroup, membership);
-    let wanted = false;
-    if (present) {
-        const legacyGroups = Object.values(await context.query(legacyReadCoreGroups, {}));
-        wanted = observed.present || legacyGroups.includes(membership.group);
-    }
-    return [{ edge: 'legacy', current: observed.present, present: wanted, guard: observed.guard }];
+export async function legacyMembersEdges(context, selection, present) {
+    const [observed, legacyGroups] = await Promise.all([
+        context.query(legacyReadMembersOfGroup, selection),
+        present ? context.query(legacyReadCoreGroups, {}) : undefined,
+    ]);
+    const core = legacyGroups !== undefined && Object.values(legacyGroups).includes(selection.group);
+    return {
+        present: observed.present,
+        guard: observed.guard,
+        /** Whether a member is to keep `member_of_group`: never when it leaves the group. */
+        wanted: (member) => present && (core || observed.present.has(member)),
+    };
 }
 /**
  * @deprecated A Domain that extends Group changes the members of its own groups (L-SHELL-9): Shell
@@ -42,10 +46,10 @@ export async function legacyChangeForeignMembership(context, membership, present
         return { endpoints: endpoints.guard, edges };
     };
     const matches = (edges) => edges.every(({ current, present: wanted }) => current === wanted);
-    const current = await context.step.run('observe-foreign-membership', observe);
+    const current = await observe();
     if (matches(current.edges))
         return {};
-    const result = await context.step.run('mutate-foreign-membership', () => caller.mutate(setGroupMembership, { ...membership, ...current }));
+    const result = await caller.mutate(setGroupMembership, { ...membership, ...current });
     if (result.ok)
         return {};
     if (result.outcomeKnown) {
@@ -53,7 +57,7 @@ export async function legacyChangeForeignMembership(context, membership, present
             throw context.error('GROUP_MEMBERSHIP_CYCLE', {});
         throw context.error('GROUP_MEMBERSHIP_CONFLICT', { cause: result.code });
     }
-    const recovered = await context.step.run('recover-foreign-membership', observe);
+    const recovered = await observe();
     if (matches(recovered.edges))
         return {};
     throw context.error('GROUP_MEMBERSHIP_UNCONFIRMED', { cause: result.code, outcomeKnown: false });

package/dist/functions/group/membership-laws.js

@@ -1,40 +1,35 @@
 import { authority } from '../authority/index.js';
 import { isProvidedGroup } from './group.js';
 /**
- * G2, G3 and acyclicity for one change of a Shell group's members. A provided group changes its
- * members only through its directory, a local one through `group.writer`; a group that holds a
- * Role, directly or through what it extends, only by an admin or its directory; and a member never
- * joins a group it already holds.
+ * G2 and G3 for one change of a Shell group's members. A provided group changes its members only
+ * through its directory, a local one through `group.writer`; a group that holds a Role, directly or
+ * through what it extends, only by an admin or its directory. A member that would join a group it
+ * already holds is refused by the Kernel, which keeps `extends_with` acyclic. What the caller holds
+ * is asked at once; the group's composition is walked only for a caller who is no admin.
  */
-export async function membershipRefusal(capabilities, group, member, joining) {
-    const authorities = authority(capabilities);
-    const provided = isProvidedGroup(group);
-    if (provided) {
-        if (!(await authorities.callerHolds('directory.provisioner'))) {
-            return { code: 'GROUP_DIRECTORY_MANAGED' };
-        }
+export async function membershipRefusal(capabilities, group, authorities = authority(capabilities)) {
+    if (isProvidedGroup(group)) {
+        return (await authorities.callerHolds('directory.provisioner'))
+            ? undefined
+            : { code: 'GROUP_DIRECTORY_MANAGED' };
     }
-    else if (!(await authorities.callerHolds('group.writer'))) {
+    const [writer, admin] = await Promise.all([
+        authorities.callerHolds('group.writer'),
+        authorities.callerHolds('workspace.admin'),
+    ]);
+    if (!writer)
         return { code: 'GROUP_NOT_DIRECTORY_MANAGED' };
-    }
-    if (!provided) {
-        const role = await roleProtected(capabilities, group);
-        if (role !== undefined)
-            return { code: 'GROUP_ROLE_PROTECTED', role };
-    }
-    if (joining && (await authorities.reaches(group.id, member))) {
-        return { code: 'GROUP_MEMBERSHIP_CYCLE' };
-    }
-    return undefined;
+    if (admin)
+        return undefined;
+    const role = await authorities.heldRole(group.id);
+    return role === undefined ? undefined : { code: 'GROUP_ROLE_PROTECTED', role };
 }
 /**
  * G3: the Role a group holds, when the caller is no admin and so may not change who holds it,
- * through its members or by deleting it.
+ * through its members or by deleting it. An admin is never refused, so its composition is not read.
  */
-export async function roleProtected(capabilities, group) {
-    const authorities = authority(capabilities);
-    const role = await authorities.heldRole(group.id);
-    if (role === undefined || (await authorities.callerHolds('workspace.admin')))
+export async function roleProtected(capabilities, group, authorities = authority(capabilities)) {
+    if (await authorities.callerHolds('workspace.admin'))
         return undefined;
-    return role;
+    return authorities.heldRole(group.id);
 }