@astrale-domains/shell 0.1.0-beta.12 → 0.1.0-beta.13

package/dist/schema/user/class.d.ts

@@ -1,278 +1,18 @@
-export declare const User: import("@astrale-os/sdk/schema").NodeClass<{
-    readonly depth: 1;
-    readonly abstract: false;
-    readonly extends: readonly [import("@astrale-os/sdk/schema").ClassProjection<"node", import("@astrale-os/sdk/schema").NodeClassDefinition & {
-        readonly ref: import("@astrale-os/sdk/schema").ClassRef<"Identity"> & {
-            readonly origin: "kernel.astrale.ai";
-        };
-        readonly kind: 'node';
-        readonly abstract: true;
-    }, import("@astrale-os/sdk/schema").ClassRef & import("@astrale-os/sdk/schema").ClassRef<"Identity"> & {
-        readonly origin: "kernel.astrale.ai";
-    }, "kernel.astrale.ai:class.Identity", readonly [import("@astrale-os/sdk/schema").ClassProjection<"node", import("@astrale-os/sdk/schema").NodeClassDefinition & {
-        readonly ref: import("@astrale-os/sdk/schema").ClassRef<"Node"> & {
-            readonly origin: "kernel.astrale.ai";
-        };
-        readonly kind: 'node';
-        readonly abstract: true;
-    }, import("@astrale-os/sdk/schema").ClassRef & import("@astrale-os/sdk/schema").ClassRef<"Node"> & {
-        readonly origin: "kernel.astrale.ai";
-    }, "kernel.astrale.ai:class.Node", readonly import("@astrale-os/sdk/schema").AnyResolvedClass[], never, never, never, never, never, never>, ...never[]], import("@astrale-os/sdk/schema").PropertyProjection<({
-        claim: string;
-        op: "contains";
-        value: unknown;
-    } | {
-        claim: string;
-        op: "eq";
-        value: unknown;
-    } | {
-        claim: string;
-        op: "exists";
-    })[], false, "requiredClaims", "kernel.astrale.ai:class.Identity.property.requiredClaims"> | import("@astrale-os/sdk/schema").PropertyProjection<string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null, false, "frozen", "kernel.astrale.ai:class.Identity.property.frozen"> | import("@astrale-os/sdk/schema").PropertyProjection<string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null, true, "iss", "kernel.astrale.ai:class.Identity.property.iss"> | import("@astrale-os/sdk/schema").PropertyProjection<string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null, true, "sub", "kernel.astrale.ai:class.Identity.property.sub">, import("@astrale-os/sdk/schema").MethodProjection<{
-        audience: string;
-        ttlSeconds: number;
-        attenuation: unknown;
-    }, {
-        readonly mode: 'value';
-        readonly value: string;
-    }, false, "default", "authenticated", "delegate", "kernel.astrale.ai:class.Identity.method.delegate">, import("@astrale-os/sdk/schema").MethodProjection<Record<string, never>, {
-        readonly mode: 'value';
-        readonly value: {
-            id: string;
-            issuer: string;
-            subject: string;
-            frozen: boolean;
-            requiredClaims: ({
-                claim: string;
-                op: "contains";
-                value: unknown;
-            } | {
-                claim: string;
-                op: "eq";
-                value: unknown;
-            } | {
-                claim: string;
-                op: "exists";
-            })[];
-        };
-    }, true, "default", "authenticated", "whoami", "kernel.astrale.ai:class.Identity.method.whoami"> | import("@astrale-os/sdk/schema").MethodProjection<{
-        policy: string;
-        object: string;
-    }, {
-        readonly mode: 'value';
-        readonly value: {
-            allowed: boolean;
-        };
-    }, true, "default", "authenticated", "can", "kernel.astrale.ai:class.Identity.method.can"> | import("@astrale-os/sdk/schema").MethodProjection<{
-        issuer: string;
-        subject: string;
-    }, {
-        readonly mode: 'value';
-        readonly value: {
-            id: string;
-            issuer: string;
-            subject: string;
-            frozen: boolean;
-            requiredClaims: ({
-                claim: string;
-                op: "contains";
-                value: unknown;
-            } | {
-                claim: string;
-                op: "eq";
-                value: unknown;
-            } | {
-                claim: string;
-                op: "exists";
-            })[];
-        } | null;
-    }, true, "default", "authorized", "whois", "kernel.astrale.ai:class.Identity.method.whois"> | import("@astrale-os/sdk/schema").MethodProjection<{
-        audience?: string | undefined;
-        ttlSeconds: number;
-        grant?: unknown;
-    }, {
-        readonly mode: 'value';
-        readonly value: string;
-    }, true, "default", "authorized", "mint", "kernel.astrale.ai:class.Identity.method.mint">, import("@astrale-os/sdk/schema").PropertyProjection<({
-        claim: string;
-        op: "contains";
-        value: unknown;
-    } | {
-        claim: string;
-        op: "eq";
-        value: unknown;
-    } | {
-        claim: string;
-        op: "exists";
-    })[], false, "requiredClaims", "kernel.astrale.ai:class.Identity.property.requiredClaims"> | import("@astrale-os/sdk/schema").PropertyProjection<string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null, false, "frozen", "kernel.astrale.ai:class.Identity.property.frozen"> | import("@astrale-os/sdk/schema").PropertyProjection<string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null, true, "iss", "kernel.astrale.ai:class.Identity.property.iss"> | import("@astrale-os/sdk/schema").PropertyProjection<string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null, true, "sub", "kernel.astrale.ai:class.Identity.property.sub">, import("@astrale-os/sdk/schema").MethodProjection<{
-        audience: string;
-        ttlSeconds: number;
-        attenuation: unknown;
-    }, {
-        readonly mode: 'value';
-        readonly value: string;
-    }, false, "default", "authenticated", "delegate", "kernel.astrale.ai:class.Identity.method.delegate">, import("@astrale-os/sdk/schema").MethodProjection<Record<string, never>, {
-        readonly mode: 'value';
-        readonly value: {
-            id: string;
-            issuer: string;
-            subject: string;
-            frozen: boolean;
-            requiredClaims: ({
-                claim: string;
-                op: "contains";
-                value: unknown;
-            } | {
-                claim: string;
-                op: "eq";
-                value: unknown;
-            } | {
-                claim: string;
-                op: "exists";
-            })[];
-        };
-    }, true, "default", "authenticated", "whoami", "kernel.astrale.ai:class.Identity.method.whoami"> | import("@astrale-os/sdk/schema").MethodProjection<{
-        policy: string;
-        object: string;
-    }, {
-        readonly mode: 'value';
-        readonly value: {
-            allowed: boolean;
-        };
-    }, true, "default", "authenticated", "can", "kernel.astrale.ai:class.Identity.method.can"> | import("@astrale-os/sdk/schema").MethodProjection<{
-        issuer: string;
-        subject: string;
-    }, {
-        readonly mode: 'value';
-        readonly value: {
-            id: string;
-            issuer: string;
-            subject: string;
-            frozen: boolean;
-            requiredClaims: ({
-                claim: string;
-                op: "contains";
-                value: unknown;
-            } | {
-                claim: string;
-                op: "eq";
-                value: unknown;
-            } | {
-                claim: string;
-                op: "exists";
-            })[];
-        } | null;
-    }, true, "default", "authorized", "whois", "kernel.astrale.ai:class.Identity.method.whois"> | import("@astrale-os/sdk/schema").MethodProjection<{
-        audience?: string | undefined;
-        ttlSeconds: number;
-        grant?: unknown;
-    }, {
-        readonly mode: 'value';
-        readonly value: string;
-    }, true, "default", "authorized", "mint", "kernel.astrale.ai:class.Identity.method.mint">>];
+import { nodeClass, type Kernel } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+import { resolveHome } from './methods.js';
+declare const displayName: import("@astrale-os/sdk/schema").Property<z.ZodString, {
+    readonly required: false;
+}>;
+export interface UserConfig {
+    readonly description: string;
+    readonly extends: readonly [Kernel['classes']['Identity']];
     readonly properties: {
-        readonly displayName: import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "displayName", "self">;
+        readonly displayName: typeof displayName;
     };
     readonly methods: {
-        readonly resolveHome: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
-            readonly mode: 'value';
-            readonly value: {
-                userId: string;
-                personalSpaceId: string | null;
-            };
-        }, "authenticated", false, "default">>;
+        readonly resolveHome: typeof resolveHome;
     };
-    readonly effectiveProperties: import("@astrale-os/sdk/schema").AuthoredPropertyProjection<string, string, false, "displayName", "self"> | (import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, false> & {
-        readonly name: "frozen";
-        readonly key: "kernel.astrale.ai:class.Identity.property.frozen";
-    }) | (import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
-        readonly name: "iss";
-        readonly key: "kernel.astrale.ai:class.Identity.property.iss";
-    }) | (import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
-        readonly name: "sub";
-        readonly key: "kernel.astrale.ai:class.Identity.property.sub";
-    });
-    readonly effectiveInstanceMethods: import("@astrale-os/sdk/schema").AuthoredMethodProjection<import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
-        readonly mode: 'value';
-        readonly value: {
-            userId: string;
-            personalSpaceId: string | null;
-        };
-    }, "authenticated", false, "default">>, "resolveHome", "self"> | (import("@astrale-os/sdk/schema").ResolvedMethod<{
-        audience: string;
-        ttlSeconds: number;
-        attenuation: unknown;
-    }, {
-        readonly mode: 'value';
-        readonly value: string;
-    }, false, "default", "authenticated", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.delegate"> & {
-        readonly name: "delegate";
-    });
-    readonly effectiveStaticMethods: (import("@astrale-os/sdk/schema").ResolvedMethod<Record<string, never>, {
-        readonly mode: 'value';
-        readonly value: {
-            id: string;
-            issuer: string;
-            subject: string;
-            frozen: boolean;
-            requiredClaims: ({
-                claim: string;
-                op: "contains";
-                value: unknown;
-            } | {
-                claim: string;
-                op: "eq";
-                value: unknown;
-            } | {
-                claim: string;
-                op: "exists";
-            })[];
-        };
-    }, true, "default", "authenticated", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.whoami"> & {
-        readonly name: "whoami";
-    }) | (import("@astrale-os/sdk/schema").ResolvedMethod<{
-        policy: string;
-        object: string;
-    }, {
-        readonly mode: 'value';
-        readonly value: {
-            allowed: boolean;
-        };
-    }, true, "default", "authenticated", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.can"> & {
-        readonly name: "can";
-    }) | (import("@astrale-os/sdk/schema").ResolvedMethod<{
-        issuer: string;
-        subject: string;
-    }, {
-        readonly mode: 'value';
-        readonly value: {
-            id: string;
-            issuer: string;
-            subject: string;
-            frozen: boolean;
-            requiredClaims: ({
-                claim: string;
-                op: "contains";
-                value: unknown;
-            } | {
-                claim: string;
-                op: "eq";
-                value: unknown;
-            } | {
-                claim: string;
-                op: "exists";
-            })[];
-        } | null;
-    }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.whois"> & {
-        readonly name: "whois";
-    }) | (import("@astrale-os/sdk/schema").ResolvedMethod<{
-        audience?: string | undefined;
-        ttlSeconds: number;
-        grant?: unknown;
-    }, {
-        readonly mode: 'value';
-        readonly value: string;
-    }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.mint"> & {
-        readonly name: "mint";
-    });
-}>;
+}
+export declare const User: ReturnType<typeof nodeClass<UserConfig>>;
+export {};

package/dist/schema/user/class.js

@@ -1,11 +1,11 @@
 import { K, nodeClass, property } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
 import { resolveHome } from './methods.js';
-export const User = nodeClass({
+const displayName = property(z.string().min(1).max(160), { required: false });
+const config = {
     description: 'One externally identified person using Shell.',
     extends: [K.classes.Identity],
-    properties: {
-        displayName: property(z.string().min(1).max(160), { required: false }),
-    },
+    properties: { displayName },
     methods: { resolveHome },
-});
+};
+export const User = nodeClass(config);

package/dist/workflows/group/assign.d.ts

@@ -0,0 +1,3 @@
+import { type WorkflowDefinition } from '@astrale-os/sdk/workflow';
+import type { ShellSchema } from '#schema';
+export declare const assignGroupUserWorkflow: WorkflowDefinition<typeof ShellSchema, 'Group.assignUser'>;

package/dist/workflows/group/assign.js

@@ -0,0 +1,3 @@
+import { defineWorkflow } from '@astrale-os/sdk/workflow';
+import { changeMembership } from './change.js';
+export const assignGroupUserWorkflow = defineWorkflow()('Group.assignUser', (context) => changeMembership(context, true));

package/dist/workflows/group/change.d.ts

@@ -0,0 +1,6 @@
+import type { WorkflowContext } from '@astrale-os/sdk/workflow';
+import type { S, Shell } from '#schema';
+type GroupCallable = typeof S.classes.Group.self.methods.assignUser | typeof S.classes.Group.self.methods.unassignUser;
+type GroupContext = WorkflowContext<GroupCallable, Shell>;
+export declare function changeMembership(context: GroupContext, present: boolean): Promise<Readonly<Record<never, never>>>;
+export {};

package/dist/workflows/group/change.js

@@ -0,0 +1,31 @@
+import { InvocationError } from '@astrale-os/sdk/execution';
+import { changeGroupMembership } from '#mutations/group';
+import { observeUserGroups } from '#queries/user';
+export async function changeMembership(context, present) {
+    const observed = await context.step.run('observe-membership', () => context.query(observeUserGroups, context.input.user));
+    const wasPresent = includes(observed.groups, context.self);
+    if (wasPresent === present)
+        return Object.freeze({});
+    const result = await context.step.run('change-membership', () => context.mutate(changeGroupMembership, {
+        user: context.input.user,
+        group: context.self,
+        present,
+        guard: observed.guard,
+    }));
+    if (result.ok)
+        return Object.freeze({});
+    if (result.outcomeKnown)
+        return membershipConflict(result.code);
+    const recovered = await context.step.run('recover-membership', () => context.query(observeUserGroups, context.input.user));
+    if (includes(recovered.groups, context.self) === present)
+        return Object.freeze({});
+    throw new InvocationError('BACKEND_UNAVAILABLE', 'Group membership outcome remains unknown after exact observation.', { reason: { code: result.code, details: {} } });
+}
+function includes(groups, group) {
+    return groups.some(({ id }) => id === group);
+}
+function membershipConflict(code) {
+    throw new InvocationError('CONFLICT', 'Group membership conflicted with concurrent graph state.', {
+        reason: { code, details: {} },
+    });
+}

package/dist/workflows/group/index.d.ts

@@ -0,0 +1,3 @@
+export { assignGroupUserWorkflow } from './assign.js';
+export { changeMembership } from './change.js';
+export { unassignGroupUserWorkflow } from './unassign.js';

package/dist/workflows/group/index.js

@@ -0,0 +1,3 @@
+export { assignGroupUserWorkflow } from './assign.js';
+export { changeMembership } from './change.js';
+export { unassignGroupUserWorkflow } from './unassign.js';

package/dist/workflows/group/unassign.d.ts

@@ -0,0 +1,3 @@
+import { type WorkflowDefinition } from '@astrale-os/sdk/workflow';
+import type { ShellSchema } from '#schema';
+export declare const unassignGroupUserWorkflow: WorkflowDefinition<typeof ShellSchema, 'Group.unassignUser'>;

package/dist/workflows/group/unassign.js

@@ -0,0 +1,3 @@
+import { defineWorkflow } from '@astrale-os/sdk/workflow';
+import { changeMembership } from './change.js';
+export const unassignGroupUserWorkflow = defineWorkflow()('Group.unassignUser', (context) => changeMembership(context, false));

package/dist/workflows/index.d.ts

@@ -0,0 +1,3 @@
+export * from '#workflows/group';
+export * from '#workflows/setup';
+export * from '#workflows/space';

package/dist/workflows/index.js

@@ -0,0 +1,3 @@
+export * from '#workflows/group';
+export * from '#workflows/setup';
+export * from '#workflows/space';

package/dist/workflows/setup/admin.d.ts

@@ -0,0 +1,3 @@
+import { type WorkflowDefinition } from '@astrale-os/sdk/workflow';
+import type { ShellSchema } from '#schema';
+export declare const setupAdminWorkflow: WorkflowDefinition<typeof ShellSchema, 'setupAdmin'>;

package/dist/workflows/setup/admin.js

@@ -0,0 +1,3 @@
+import { defineWorkflow } from '@astrale-os/sdk/workflow';
+import { runSetup } from './run.js';
+export const setupAdminWorkflow = defineWorkflow()('setupAdmin', (context) => runSetup(context, 'admin'));

package/dist/workflows/setup/index.d.ts

@@ -0,0 +1,5 @@
+export { setupAdminWorkflow } from './admin.js';
+export { setupMemberWorkflow } from './member.js';
+export { planUserSetup, type SetupConflictReason, type SetupPlan, type SetupRole } from './plan.js';
+export { provisioningRequest, provisioningResult } from './provision.js';
+export { runSetup } from './run.js';

package/dist/workflows/setup/index.js

@@ -0,0 +1,5 @@
+export { setupAdminWorkflow } from './admin.js';
+export { setupMemberWorkflow } from './member.js';
+export { planUserSetup } from './plan.js';
+export { provisioningRequest, provisioningResult } from './provision.js';
+export { runSetup } from './run.js';

package/dist/workflows/setup/member.d.ts

@@ -0,0 +1,3 @@
+import { type WorkflowDefinition } from '@astrale-os/sdk/workflow';
+import type { ShellSchema } from '#schema';
+export declare const setupMemberWorkflow: WorkflowDefinition<typeof ShellSchema, 'setupMember'>;

package/dist/workflows/setup/member.js

@@ -0,0 +1,3 @@
+import { defineWorkflow } from '@astrale-os/sdk/workflow';
+import { runSetup } from './run.js';
+export const setupMemberWorkflow = defineWorkflow()('setupMember', (context) => runSetup(context, 'member'));

package/dist/workflows/setup/plan.d.ts

@@ -0,0 +1,18 @@
+import type { Node } from '@astrale-os/sdk/graph/node';
+import type { UserRepair } from '#mutations/user';
+import type { UserSetupObservation } from '#queries/user';
+import type { SetupUserInput, Shell } from '#schema';
+export type SetupRole = 'member' | 'admin';
+export type SetupPlan = {
+    readonly kind: 'conflict';
+    readonly reason: SetupConflictReason;
+    readonly message: string;
+} | {
+    readonly kind: 'unchanged';
+    readonly personalSpaceId: Node['id'];
+} | {
+    readonly kind: 'repair';
+    readonly repair: UserRepair;
+};
+export type SetupConflictReason = 'IDENTITY_CLASS_CONFLICT' | 'IDENTITY_FACT_CONFLICT' | 'MULTIPLE_DEFAULT_SPACES' | 'DEFAULT_SPACE_CLASS_CONFLICT' | 'AMBIGUOUS_PERSONAL_SPACE';
+export declare function planUserSetup(domain: Shell, input: SetupUserInput, role: SetupRole, observation: UserSetupObservation): SetupPlan;

package/dist/workflows/setup/plan.js

@@ -0,0 +1,88 @@
+export function planUserSetup(domain, input, role, observation) {
+    const profile = observation.profile;
+    if (profile.class !== domain.classes.User.key) {
+        return conflict('IDENTITY_CLASS_CONFLICT', 'The asserted identity already belongs to a non-Shell User Class.');
+    }
+    const identityIssuer = profile.props[domain.classes.User.properties.iss.key];
+    const identitySubject = profile.props[domain.classes.User.properties.sub.key];
+    if (identityIssuer !== input.issuer || identitySubject !== input.subject) {
+        return conflict('IDENTITY_FACT_CONFLICT', 'The resolved Shell User does not retain the asserted issuer and subject.');
+    }
+    if (observation.home.spaces.length > 1) {
+        return conflict('MULTIPLE_DEFAULT_SPACES', 'The Shell User has more than one default personal Space.');
+    }
+    const currentHome = observation.home.spaces[0];
+    if (currentHome !== undefined && currentHome.class !== domain.classes.Space.key) {
+        return conflict('DEFAULT_SPACE_CLASS_CONFLICT', 'The Shell User default target is not a Shell Space.');
+    }
+    const candidates = currentHome === undefined
+        ? observation.ownedSpaces.spaces.filter((space) => space.class === domain.classes.Space.key &&
+            space.props[domain.classes.Space.properties.name.key] === input.personalSpaceName)
+        : [];
+    if (candidates.length > 1) {
+        return conflict('AMBIGUOUS_PERSONAL_SPACE', 'More than one owned Space matches the requested personal Space name.');
+    }
+    const home = currentHome ?? candidates[0];
+    const currentDisplayName = profile.props[domain.classes.User.properties.displayName.key];
+    if (currentDisplayName !== undefined && typeof currentDisplayName !== 'string') {
+        throw new TypeError('Shell User displayName is not a string.');
+    }
+    const member = hasGroup(domain, observation.groups.groups, 'core.member');
+    const admin = hasGroup(domain, observation.groups.groups, 'core.admin');
+    const ownsHome = home !== undefined && observation.ownedSpaces.spaces.some((space) => space.id === home.id);
+    let homeName;
+    if (home !== undefined) {
+        const value = home.props[domain.classes.Space.properties.name.key];
+        if (typeof value !== 'string') {
+            throw new TypeError('Shell personal Space name is not a string.');
+        }
+        homeName = value;
+    }
+    const displayName = currentDisplayName === input.displayName ? undefined : input.displayName;
+    const desiredHomeName = homeName === input.personalSpaceName ? undefined : input.personalSpaceName;
+    const addDefault = currentHome === undefined;
+    const addOwnership = home === undefined || !ownsHome;
+    const addMember = !member;
+    const addAdmin = role === 'admin' && !admin;
+    if (displayName === undefined &&
+        desiredHomeName === undefined &&
+        !addDefault &&
+        !addOwnership &&
+        !addMember &&
+        !addAdmin) {
+        return Object.freeze({ kind: 'unchanged', personalSpaceId: home.id });
+    }
+    return Object.freeze({
+        kind: 'repair',
+        repair: Object.freeze({
+            userId: profile.id,
+            ...(currentDisplayName === undefined ? {} : { currentDisplayName }),
+            ...(displayName === undefined ? {} : { displayName }),
+            home: home === undefined
+                ? Object.freeze({ kind: 'create', name: input.personalSpaceName })
+                : Object.freeze({
+                    kind: 'existing',
+                    id: home.id,
+                    currentName: homeName,
+                    ...(desiredHomeName === undefined ? {} : { name: desiredHomeName }),
+                }),
+            addDefault,
+            addOwnership,
+            addMember,
+            addAdmin,
+            guards: Object.freeze({
+                home: observation.home.guard,
+                ownedSpaces: observation.ownedSpaces.guard,
+                groups: observation.groups.guard,
+            }),
+        }),
+    });
+}
+function hasGroup(domain, groups, subject) {
+    return groups.some((group) => group.class === domain.classes.Group.key &&
+        group.props[domain.classes.Group.properties.iss.key] === domain.origin &&
+        group.props[domain.classes.Group.properties.sub.key] === subject);
+}
+function conflict(reason, message) {
+    return Object.freeze({ kind: 'conflict', reason, message });
+}

package/dist/workflows/setup/provision.d.ts

@@ -0,0 +1,5 @@
+import type { ProvisionRequest, ProvisionResult } from '@astrale-os/sdk/auth';
+import type { SetupUserInput, SetupUserResult, Shell } from '#schema';
+import type { SetupRole } from './plan.js';
+export declare function provisioningRequest(domain: Shell, input: SetupUserInput, role: SetupRole): ProvisionRequest;
+export declare function provisioningResult(result: ProvisionResult): SetupUserResult;

package/dist/workflows/setup/provision.js

@@ -0,0 +1,57 @@
+import { issuer } from '@astrale-os/sdk/auth';
+import { LocalBinding } from '@astrale-os/sdk/graph';
+import { Path } from '@astrale-os/sdk/graph/path';
+import { MutationAST } from '@astrale-os/sdk/mutation';
+const user = LocalBinding('user');
+const personalSpace = LocalBinding('personalSpace');
+export function provisioningRequest(domain, input, role) {
+    const mutation = MutationAST.build((change) => {
+        const createdUser = change.createNode({
+            as: user,
+            class: domain.classes.User.key,
+            props: domain.classes.User.properties.from({ displayName: input.displayName }),
+        });
+        const createdSpace = change.createNode({
+            as: personalSpace,
+            class: domain.classes.Space.key,
+            props: domain.classes.Space.properties.from({ name: input.personalSpaceName }),
+        });
+        change.createEdge({
+            class: domain.classes.owns_space.key,
+            source: createdUser,
+            target: createdSpace,
+        });
+        change.createEdge({
+            class: domain.classes.default_space.key,
+            source: createdUser,
+            target: createdSpace,
+        });
+        change.createEdge({
+            class: domain.classes.member_of_group.key,
+            source: createdUser,
+            target: Path.project(domain.core.nodes.member.ref),
+        });
+        if (role === 'admin') {
+            change.createEdge({
+                class: domain.classes.member_of_group.key,
+                source: createdUser,
+                target: Path.project(domain.core.nodes.admin.ref),
+            });
+        }
+    });
+    return Object.freeze({
+        idempotencyKey: input.operationId,
+        mutation,
+        identities: Object.freeze({
+            [user]: Object.freeze({ issuer: issuer.accept(input.issuer), subject: input.subject }),
+        }),
+    });
+}
+export function provisioningResult(result) {
+    const userId = result.createdNodes[user];
+    const personalSpaceId = result.createdNodes[personalSpace];
+    if (userId === undefined || personalSpaceId === undefined) {
+        throw new TypeError('Shell provisioning omitted its User or personal Space identity.');
+    }
+    return Object.freeze({ userId, personalSpaceId, changed: true });
+}

package/dist/workflows/setup/run.d.ts

@@ -0,0 +1,7 @@
+import type { WorkflowContext } from '@astrale-os/sdk/workflow';
+import type { S, SetupUserResult, Shell } from '#schema';
+import { type SetupRole } from './plan.js';
+type SetupCallable = typeof S.functions.setupAdmin | typeof S.functions.setupMember;
+type SetupContext = WorkflowContext<SetupCallable, Shell>;
+export declare function runSetup(context: SetupContext, role: SetupRole): Promise<SetupUserResult>;
+export {};