@astrale-domains/shell 0.1.0-beta.10

package/README.md

@@ -0,0 +1,71 @@
+# Shell Domain
+
+Shell is the minimal Kernel-native application plane. Its durable model is one `User` interface,
+the concrete `User`, `Group`, `Space`, and `Application` Node Classes, eight relationships, five
+Policies, two Functions, seven Methods, five Kernel View declarations, and four deterministic Core
+nodes.
+
+The `ensureUser` Function is the Shell-owned identity genesis boundary. It idempotently provisions an
+externally identified `User`, their personal `Space`, and both ownership/default relationships under
+the installed Shell Domain's authority. `ensureAdministrator` idempotently assigns one existing User
+to Shell's administrator Group. Both keep product mutation under Shell authority while allowing an
+authenticated genesis operator to request the transition.
+
+The Methods are:
+
+- Group: `assignUser`, `unassignUser`;
+- Space: `addUser`, `removeUser`, `setDefault`; and
+- Application: `install`, `uninstall`.
+
+Installation authors the `admin`, `member`, `default-space`, and `shell` Core. An authenticated genesis
+operator may invoke `ensureUser`, but cannot mutate Shell Classes directly. The remote handler performs
+the atomic identity provisioning as Shell, then callers assign the User explicitly to a Group. Shell
+infers no authority from email, claims, path spelling, or creation order.
+
+## Source ownership
+
+- `schema/` owns the complete Domain contract, public Method values, Policies, relationships, DSL
+  Views, and Core graph;
+- `rules/` owns synchronous classifications, decisions, normalization, and result projection;
+- `queries/` owns canonical single and composite graph observations plus explicit bounded continuation
+  pagination when a business observation requires the complete set;
+- `mutations/` owns canonical atomic graph changes and their expected rejection evidence;
+- `workflows/` owns replay-shaped multi-step business journeys and unknown-outcome recovery;
+- `functions/` binds the Function and each Method to a rule, workflow, or direct operation;
+- `utils/` owns only the shared graph-endpoint and bounded-query mechanics used by independent
+  submodules; and
+- root `tests/` owns cross-layer and system evidence, while each semantic submodule owns focused
+  evidence in `__tests__/`.
+
+No current responsibility earns a `states/`, `capabilities/`, `integrations/`, `migrations/`,
+`views/`, `ui/`, or root `scripts/` source layer. DSL View declarations remain in Schema; a future
+frontend projection or UI must establish its own concrete responsibility before adding those layers.
+
+Shell never re-declares shared metadata properties. `Group` and `Space` currently name `K.Named`
+and `K.Descriptable` in their `implements` lists because the current DSL makes only `K.Node`
+intrinsic and Core-property admission otherwise rejects `name` and `description`. Removing those
+interface references awaits the recorded Kernel authoring-default decision; no timestamps are
+authored by Shell.
+
+## Execution and evidence
+
+`ShellDomain` is the complete remote product implementation. Its exact handler map proves that the
+genesis Functions and all seven Methods are served from the same immutable publication. The handlers use
+the SDK's canonical Auth, Query, Mutation, Result, Workflow, and Step contracts. `ensureUser` relies on
+the Kernel provision operation's stable idempotency key; the SDK's current inline Step runner does not
+claim process-restart replay on its own.
+
+The executable contract lives in Shell's semantic source, public facades, and tests. Product
+decisions, journeys, legacy disposition, dependency gates, and qualification evidence live in
+[`.history/`](.history/). Product Domains intentionally have no `.spec/` tree; Kernel authoring
+values come through semantic `@astrale-os/sdk/*` facades.
+
+Domain authors import the schema facade from `@astrale-domains/shell`. Worker deployments import the
+application descriptor from `@astrale-domains/shell/application` and the runtime entrypoint from
+`@astrale-domains/shell/runtime`, so bundling the remote runtime does not traverse the build-only
+schema facade.
+
+The source, deterministic Knowledge linter, TypeScript package, unit/cross-layer tests, and remote Shell
+contract are qualified locally. Installed-instance, released-package, browser, and live
+credential journeys are separate evidence levels and are not claimed here. Shell does not broker
+authentication tokens; standard Domain token exchange is owned by Protocol, Server, and SDK.

package/dist/actions/index.js

@@ -0,0 +1 @@
+export * from './user/index.js';

package/dist/actions/user/index.js

@@ -0,0 +1 @@
+export { resolveHomeAction } from './resolve-home.js';

package/dist/actions/user/resolve-home.js

@@ -0,0 +1,19 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { InvocationError } from '@astrale-os/sdk/execution';
+import { Path } from '@astrale-os/sdk/graph/path';
+import { observeHome } from '#queries/user';
+export const resolveHomeAction = defineAction()('User.resolveHome', async ({ domain, query, self }) => {
+    const observed = await query(observeHome, Path.id(self).raw);
+    if (observed.spaces.length > 1) {
+        throw new InvocationError('CONFLICT', 'The Shell User has more than one default Space.', {
+            reason: { code: 'MULTIPLE_DEFAULT_SPACES', details: {} },
+        });
+    }
+    const home = observed.spaces[0];
+    if (home !== undefined && home.class !== domain.classes.Space.key) {
+        throw new InvocationError('CONFLICT', 'The Shell User default target is not a Shell Space.', {
+            reason: { code: 'DEFAULT_SPACE_CLASS_CONFLICT', details: {} },
+        });
+    }
+    return Object.freeze({ userId: self, personalSpaceId: home?.id ?? null });
+});