@astrale-domains/shell 0.1.0-beta.17 → 0.1.0-beta.19

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## [0.1.0-beta.19](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.18...shell-domain-v0.1.0-beta.19) (2026-08-31)
+
+
+### Bug Fixes
+
+* **domain:** preserve caller-owned Shell authority ([#143](https://github.com/astrale-os/shell/issues/143)) ([7150ce0](https://github.com/astrale-os/shell/commit/7150ce0890546b6c605f9192aa78177b95af3615))
+
+## [0.1.0-beta.18](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.17...shell-domain-v0.1.0-beta.18) (2026-08-30)
+
+
+### Features
+
+* grant trusted Shell exchange authority ([#140](https://github.com/astrale-os/shell/issues/140)) ([349c4b5](https://github.com/astrale-os/shell/commit/349c4b593b20245a8cb836f2370807b372faf23f))
+
+
+### Bug Fixes
+
+* **deps:** consume Zod-coherent SDK cohort ([#145](https://github.com/astrale-os/shell/issues/145)) ([2d2027c](https://github.com/astrale-os/shell/commit/2d2027c749f83c1e35a5b4a28696761b1f8e71e1))
+* **domain:** adopt function and authority requirements ([#144](https://github.com/astrale-os/shell/issues/144)) ([016e306](https://github.com/astrale-os/shell/commit/016e30603591c32a2c8cf0073fe75995c67ae004))
+
 ## [0.1.0-beta.17](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.16...shell-domain-v0.1.0-beta.17) (2026-08-30)
 
 

package/README.md

@@ -22,8 +22,9 @@ converge the first administrator, using the exact registered issuer and subject
 `setupAdmin` for subsequent registered Users. Both setup Functions are authorized by
 `maySetupUsers` against membership in the Core Administrators Group.
 They converge the User profile, personal Space, ownership/default facts, Members membership, and—only
-for `setupAdmin`—Administrators membership. They do not create credentials, grant humans dynamic
-`can_*` authority, infer identity from a local CLI name, or replace self-proven registration.
+for `setupAdmin`—Administrators membership. Every membership mutation also changes the matching
+Kernel `extends_with` composition edge atomically. They do not create credentials, author dynamic
+`can_*` edges, infer identity from a local CLI name, or replace self-proven registration.
 
 The Methods are:
 
@@ -33,6 +34,10 @@ The Methods are:
 
 Installation authors the `admin`, `member`, and `default-space` Core nodes. Shell infers no authority
 from email, claims, path spelling, creation order, or a successful handler-local boolean.
+The signed Publication declares installation-owned authority profiles: the Shell principal and
+Core `admin` receive the intended Kernel application-plane surface, excluding only the ability to
+grant `grant` or revoke `revoke`; Core `member` receives Query and View resolution. Kernel install,
+upgrade, introspection, and uninstall own those authority edges as one generation.
 
 ## Source ownership
 

package/dist/application.js

@@ -1,7 +1,12 @@
 import { defineApplication, defineFrontend, external, requirements, } from '@astrale-os/sdk/application';
-import { KernelRootFunctions } from '@astrale-os/sdk/schema';
+import { K, KernelRootFunctions } from '@astrale-os/sdk/schema';
 import runtime from './runtime.js';
-import { ShellSchema } from './schema/index.js';
+import { S, ShellSchema } from './schema/index.js';
+const classOperations = ['create', 'read', 'traverse', 'update', 'delete'];
+const authority = {
+    grant: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'revoke'],
+    revoke: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'grant'],
+};
 export const frontend = defineFrontend({
     schema: ShellSchema,
     source: external('https://app.astrale.ai'),
@@ -14,11 +19,32 @@ export const frontend = defineFrontend({
     entrypoint: 'home',
 });
 const trustedKernel = requirements({
-    callables: KernelRootFunctions,
-    administration: {
-        grant: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'revoke'],
-        revoke: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'grant'],
-    },
+    functions: KernelRootFunctions,
+    classes: [
+        {
+            class: K.classes.extends_with,
+            operations: ['create', 'read', 'traverse', 'delete'],
+        },
+    ],
+    authority,
+    profiles: [
+        {
+            subject: S.core.nodes.admin,
+            functions: KernelRootFunctions,
+            classes: [
+                ...Object.values(S.classes).map((value) => ({ class: value, operations: classOperations })),
+                {
+                    class: K.classes.extends_with,
+                    operations: ['create', 'read', 'traverse', 'delete'],
+                },
+            ],
+            authority,
+        },
+        {
+            subject: S.core.nodes.member,
+            functions: [K.classes.View.static.methods.resolve, K.functions.query],
+        },
+    ],
 });
 export const application = defineApplication({
     schema: ShellSchema,

package/dist/mutations/group/membership.d.ts

@@ -1,13 +1,17 @@
 import type { NodeId } from '@astrale-os/sdk/graph/node';
 import type { QueryPrecondition } from '@astrale-os/sdk/mutation';
-import type { QueryNodeAST } from '@astrale-os/sdk/query';
+import type { QueryEdgeAST } from '@astrale-os/sdk/query';
 import { type Mutation } from '@astrale-os/sdk/mutation';
 import type { Shell } from '#schema';
 export interface GroupMembershipChange {
     readonly user: string;
     readonly group: NodeId;
     readonly present: boolean;
-    readonly guard: QueryPrecondition<QueryNodeAST>;
+    readonly current: {
+        readonly membership: boolean;
+        readonly authority: boolean;
+    };
+    readonly guard: QueryPrecondition<QueryEdgeAST>;
 }
 export type GroupMembershipChangeResult = {
     readonly ok: true;

package/dist/mutations/group/membership.js

@@ -4,15 +4,28 @@ export const changeGroupMembership = defineMutation()((domain) => ({
     id: 'shell.group.membership',
     build(change, mutation) {
         mutation.expect.query(change.guard);
-        const edge = {
+        const membership = {
             class: domain.classes.member_of_group,
             source: Path.parse(change.user),
             target: Path.id(change.group),
         };
-        if (change.present)
-            mutation.createEdge(edge);
-        else
-            mutation.deleteEdge(edge);
+        const authority = {
+            class: domain.dependencies.kernel.classes.extends_with,
+            source: Path.parse(change.user),
+            target: Path.id(change.group),
+        };
+        if (change.current.membership !== change.present) {
+            if (change.present)
+                mutation.createEdge(membership);
+            else
+                mutation.deleteEdge(membership);
+        }
+        if (change.current.authority !== change.present) {
+            if (change.present)
+                mutation.createEdge(authority);
+            else
+                mutation.deleteEdge(authority);
+        }
     },
     project: () => Object.freeze({ ok: true }),
     reject: (failure) => Object.freeze({ ok: false, code: failure.code, outcomeKnown: failure.outcomeKnown }),

package/dist/mutations/user/repair.d.ts

@@ -1,6 +1,6 @@
 import type { NodeId } from '@astrale-os/sdk/graph/node';
 import type { QueryPrecondition } from '@astrale-os/sdk/mutation';
-import type { QueryNodeAST } from '@astrale-os/sdk/query';
+import type { QueryEdgeAST, QueryNodeAST } from '@astrale-os/sdk/query';
 import { type Mutation } from '@astrale-os/sdk/mutation';
 import type { Shell } from '#schema';
 export interface UserRepair {
@@ -19,11 +19,14 @@ export interface UserRepair {
     readonly addDefault: boolean;
     readonly addOwnership: boolean;
     readonly addMember: boolean;
+    readonly addMemberAuthority: boolean;
     readonly addAdmin: boolean;
+    readonly addAdminAuthority: boolean;
+    readonly removeAdminAuthority: boolean;
     readonly guards: {
         readonly home: QueryPrecondition<QueryNodeAST>;
         readonly ownedSpaces: QueryPrecondition<QueryNodeAST>;
-        readonly groups: QueryPrecondition<QueryNodeAST>;
+        readonly groups: QueryPrecondition<QueryEdgeAST>;
     };
 }
 export type UserRepairResult = {

package/dist/mutations/user/repair.js

@@ -62,6 +62,13 @@ export const repairUser = defineMutation()((domain) => ({
                 target: Path.project(domain.core.nodes.member.ref),
             });
         }
+        if (repair.addMemberAuthority) {
+            mutation.createEdge({
+                class: domain.dependencies.kernel.classes.extends_with,
+                source: Path.id(repair.userId),
+                target: Path.project(domain.core.nodes.member.ref),
+            });
+        }
         if (repair.addAdmin) {
             mutation.createEdge({
                 class: domain.classes.member_of_group,
@@ -69,6 +76,20 @@ export const repairUser = defineMutation()((domain) => ({
                 target: Path.project(domain.core.nodes.admin.ref),
             });
         }
+        if (repair.addAdminAuthority) {
+            mutation.createEdge({
+                class: domain.dependencies.kernel.classes.extends_with,
+                source: Path.id(repair.userId),
+                target: Path.project(domain.core.nodes.admin.ref),
+            });
+        }
+        if (repair.removeAdminAuthority) {
+            mutation.deleteEdge({
+                class: domain.dependencies.kernel.classes.extends_with,
+                source: Path.id(repair.userId),
+                target: Path.project(domain.core.nodes.admin.ref),
+            });
+        }
     },
     project(result, repair) {
         const personalSpaceId = repair.home.kind === 'existing' ? repair.home.id : result.createdNodes[personalSpace];

package/dist/queries/user/groups.d.ts

@@ -1,9 +1,10 @@
 import type { Node } from '@astrale-os/sdk/graph/node';
 import type { QueryPrecondition } from '@astrale-os/sdk/mutation';
-import type { QueryNodeAST, SingleQueryDefinition } from '@astrale-os/sdk/query';
+import type { QueryEdgeAST, SingleQueryDefinition } from '@astrale-os/sdk/query';
 import type { Shell } from '#schema';
 export interface UserGroupsObservation {
     readonly groups: readonly Node[];
-    readonly guard: QueryPrecondition<QueryNodeAST>;
+    readonly authorities: readonly Node[];
+    readonly guard: QueryPrecondition<QueryEdgeAST>;
 }
 export declare const observeUserGroups: SingleQueryDefinition<Shell, string, UserGroupsObservation>;

package/dist/queries/user/groups.js

@@ -4,13 +4,37 @@ export const observeUserGroups = defineQuery()((domain) => ({
     id: 'shell.user.groups',
     build(user) {
         const source = Query.from({ nodes: [Path.parse(user)] });
-        const groups = source.expand({ via: [domain.classes.member_of_group], direction: 'outgoing' });
-        return groups.select({ kind: 'nodes', binding: groups.node, projection: { kind: 'value' } });
+        const relations = source.expand({
+            via: [domain.classes.member_of_group, domain.dependencies.kernel.classes.extends_with],
+            direction: 'outgoing',
+        });
+        return relations.select({
+            kind: 'edges',
+            binding: relations.edge,
+            projection: { edge: 'value', source: 'reference', target: 'value' },
+        });
     },
     pagination: { maximumPages: 64 },
     project(pages, _user, { ast, complete }) {
+        const groups = [];
+        const authorities = [];
+        for (const item of pages.flatMap((page) => queryResult.edgeItems(page, 'Shell User Groups'))) {
+            if (item.edge.kind !== 'value' || item.target.kind !== 'value') {
+                throw new TypeError('Shell User Groups must project Edge and target values.');
+            }
+            if (item.edge.value.class === domain.classes.member_of_group.key) {
+                groups.push(item.target.value);
+            }
+            else if (item.edge.value.class === domain.dependencies.kernel.classes.extends_with.key) {
+                authorities.push(item.target.value);
+            }
+            else {
+                throw new TypeError('Shell User Groups returned an unexpected relationship Class.');
+            }
+        }
         return Object.freeze({
-            groups: queryResult.completeNodeValues(pages, 'Shell User Groups'),
+            groups: Object.freeze(groups),
+            authorities: Object.freeze(authorities),
             guard: Object.freeze({ query: ast, equals: complete }),
         });
     },

package/dist/schema/group/relationships.js

@@ -4,5 +4,5 @@ import { Group } from './class.js';
 export const member_of_group = edgeClass.directed({
     source: { as: 'user', accepts: [User], outgoing: '0..*' },
     target: { as: 'group', accepts: [() => Group], incoming: '0..*' },
-    description: 'Shell product membership.',
+    description: 'Shell role membership paired atomically with Kernel authority composition.',
 });

package/dist/workflows/group/change.js

@@ -2,25 +2,35 @@ import { InvocationError } from '@astrale-os/sdk/execution';
 import { changeGroupMembership } from '#mutations/group';
 import { observeUserGroups } from '#queries/user';
 export async function changeMembership(context, present) {
-    const observed = await context.step.run('observe-membership', () => context.query(observeUserGroups, context.input.user));
-    const wasPresent = includes(observed.groups, context.self);
-    if (wasPresent === present)
+    const observed = await context.step.run('observe-membership', () => context.graph.self.query(observeUserGroups, context.input.user));
+    const current = membershipState(observed, context.self);
+    if (matches(current, present))
         return Object.freeze({});
-    const result = await context.step.run('change-membership', () => context.mutate(changeGroupMembership, {
+    const result = await context.step.run('change-membership', () => context.graph.self.mutate(changeGroupMembership, {
         user: context.input.user,
         group: context.self,
         present,
+        current,
         guard: observed.guard,
     }));
     if (result.ok)
         return Object.freeze({});
     if (result.outcomeKnown)
         return membershipConflict(result.code);
-    const recovered = await context.step.run('recover-membership', () => context.query(observeUserGroups, context.input.user));
-    if (includes(recovered.groups, context.self) === present)
+    const recovered = await context.step.run('recover-membership', () => context.graph.self.query(observeUserGroups, context.input.user));
+    if (matches(membershipState(recovered, context.self), present))
         return Object.freeze({});
     throw new InvocationError('BACKEND_UNAVAILABLE', 'Group membership outcome remains unknown after exact observation.', { reason: { code: result.code, details: {} } });
 }
+function membershipState(observation, group) {
+    return Object.freeze({
+        membership: includes(observation.groups, group),
+        authority: includes(observation.authorities, group),
+    });
+}
+function matches(state, present) {
+    return state.membership === present && state.authority === present;
+}
 function includes(groups, group) {
     return groups.some(({ id }) => id === group);
 }

package/dist/workflows/setup/plan.js

@@ -28,7 +28,9 @@ export function planUserSetup(domain, input, role, observation) {
         throw new TypeError('Shell User displayName is not a string.');
     }
     const member = hasGroup(domain, observation.groups.groups, 'core.member');
+    const memberAuthority = hasGroup(domain, observation.groups.authorities, 'core.member');
     const admin = hasGroup(domain, observation.groups.groups, 'core.admin');
+    const adminAuthority = hasGroup(domain, observation.groups.authorities, 'core.admin');
     const ownsHome = home !== undefined && observation.ownedSpaces.spaces.some((space) => space.id === home.id);
     let homeName;
     if (home !== undefined) {
@@ -43,13 +45,20 @@ export function planUserSetup(domain, input, role, observation) {
     const addDefault = currentHome === undefined;
     const addOwnership = home === undefined || !ownsHome;
     const addMember = !member;
+    const addMemberAuthority = !memberAuthority;
     const addAdmin = role === 'admin' && !admin;
+    const preserveAdmin = role === 'admin' || admin;
+    const addAdminAuthority = preserveAdmin && !adminAuthority;
+    const removeAdminAuthority = !preserveAdmin && adminAuthority;
     if (displayName === undefined &&
         desiredHomeName === undefined &&
         !addDefault &&
         !addOwnership &&
         !addMember &&
-        !addAdmin) {
+        !addMemberAuthority &&
+        !addAdmin &&
+        !addAdminAuthority &&
+        !removeAdminAuthority) {
         return Object.freeze({ kind: 'unchanged', personalSpaceId: home.id });
     }
     return Object.freeze({
@@ -69,7 +78,10 @@ export function planUserSetup(domain, input, role, observation) {
             addDefault,
             addOwnership,
             addMember,
+            addMemberAuthority,
             addAdmin,
+            addAdminAuthority,
+            removeAdminAuthority,
             guards: Object.freeze({
                 home: observation.home.guard,
                 ownedSpaces: observation.ownedSpaces.guard,

package/dist/workflows/setup/provision.js

@@ -31,12 +31,22 @@ export function provisioningRequest(domain, input, role) {
             source: createdUser,
             target: Path.project(domain.core.nodes.member.ref),
         });
+        change.createEdge({
+            class: domain.dependencies.kernel.classes.extends_with.key,
+            source: createdUser,
+            target: Path.project(domain.core.nodes.member.ref),
+        });
         if (role === 'admin') {
             change.createEdge({
                 class: domain.classes.member_of_group.key,
                 source: createdUser,
                 target: Path.project(domain.core.nodes.admin.ref),
             });
+            change.createEdge({
+                class: domain.dependencies.kernel.classes.extends_with.key,
+                source: createdUser,
+                target: Path.project(domain.core.nodes.admin.ref),
+            });
         }
     });
     return Object.freeze({

package/dist/workflows/setup/run.js

@@ -7,7 +7,8 @@ import { observeUserSetup } from '#queries/user';
 import { planUserSetup } from './plan.js';
 import { provisioningRequest, provisioningResult } from './provision.js';
 export async function runSetup(context, role) {
-    const { client, input, step } = context;
+    const { input, step } = context;
+    const client = context.kernel.self;
     const identity = Object.freeze({
         iss: issuer.accept(input.issuer),
         sub: input.subject,
@@ -30,7 +31,7 @@ export async function runSetup(context, role) {
     return convergeExisting(context, role, existing.id, false);
 }
 async function convergeExisting(context, role, userId, changedBeforeObservation) {
-    const observed = await context.step.run('observe-user-setup', () => context.query(observeUserSetup, Path.id(userId).raw));
+    const observed = await context.step.run('observe-user-setup', () => context.graph.self.query(observeUserSetup, Path.id(userId).raw));
     const plan = planUserSetup(context.domain, context.input, role, observed);
     if (plan.kind === 'conflict')
         return setupConflict(plan);
@@ -41,7 +42,7 @@ async function convergeExisting(context, role, userId, changedBeforeObservation)
             changed: changedBeforeObservation,
         });
     }
-    const repaired = await context.step.run('repair-user-setup', () => context.mutate(repairUser, plan.repair));
+    const repaired = await context.step.run('repair-user-setup', () => context.graph.self.mutate(repairUser, plan.repair));
     if (repaired.ok) {
         return Object.freeze({ userId, personalSpaceId: repaired.personalSpaceId, changed: true });
     }
@@ -50,7 +51,7 @@ async function convergeExisting(context, role, userId, changedBeforeObservation)
             reason: { code: repaired.code, details: {} },
         });
     }
-    const recovered = await context.step.run('recover-user-repair', () => context.query(observeUserSetup, Path.id(userId).raw));
+    const recovered = await context.step.run('recover-user-repair', () => context.graph.self.query(observeUserSetup, Path.id(userId).raw));
     const recoveredPlan = planUserSetup(context.domain, context.input, role, recovered);
     if (recoveredPlan.kind === 'conflict')
         return setupConflict(recoveredPlan);

package/dist/workflows/space/access.js

@@ -2,11 +2,11 @@ import { InvocationError } from '@astrale-os/sdk/execution';
 import { changeSpaceAccess } from '#mutations/space';
 import { observeDirectSpaceAccess } from '#queries/space';
 export async function setUserAccess(context, desired) {
-    const observed = await context.step.run('observe-space-access', () => context.query(observeDirectSpaceAccess, context.input.user));
+    const observed = await context.step.run('observe-space-access', () => context.graph.self.query(observeDirectSpaceAccess, context.input.user));
     const current = state(observed, context.self);
     if (current === desired)
         return Object.freeze({});
-    const result = await context.step.run('change-space-access', () => context.mutate(changeSpaceAccess, {
+    const result = await context.step.run('change-space-access', () => context.graph.self.mutate(changeSpaceAccess, {
         user: context.input.user,
         space: context.self,
         addMember: desired === 'member' && current !== 'member',
@@ -19,7 +19,7 @@ export async function setUserAccess(context, desired) {
         return Object.freeze({});
     if (result.outcomeKnown)
         return accessConflict(result.code);
-    const recovered = await context.step.run('recover-space-access', () => context.query(observeDirectSpaceAccess, context.input.user));
+    const recovered = await context.step.run('recover-space-access', () => context.graph.self.query(observeDirectSpaceAccess, context.input.user));
     if (state(recovered, context.self) === desired)
         return Object.freeze({});
     throw new InvocationError('BACKEND_UNAVAILABLE', 'Space access outcome remains unknown after exact observation.', { reason: { code: result.code, details: {} } });

package/dist/workflows/space/default.js

@@ -5,7 +5,7 @@ import { changeDefaultSpace } from '#mutations/space';
 import { observeHome } from '#queries/user';
 async function setDefault(context) {
     const user = context.caller.principal;
-    const observed = await context.step.run('observe-default-space', () => context.query(observeHome, Path.id(user).raw));
+    const observed = await context.step.run('observe-default-space', () => context.graph.self.query(observeHome, Path.id(user).raw));
     if (observed.spaces.length > 1) {
         throw new InvocationError('CONFLICT', 'The Shell User has more than one default Space.', {
             reason: { code: 'MULTIPLE_DEFAULT_SPACES', details: {} },
@@ -13,7 +13,7 @@ async function setDefault(context) {
     }
     if (observed.spaces[0]?.id === context.self)
         return Object.freeze({});
-    const result = await context.step.run('change-default-space', () => context.mutate(changeDefaultSpace, {
+    const result = await context.step.run('change-default-space', () => context.graph.self.mutate(changeDefaultSpace, {
         user,
         ...(observed.spaces[0] === undefined ? {} : { previous: observed.spaces[0].id }),
         next: context.self,
@@ -23,7 +23,7 @@ async function setDefault(context) {
         return Object.freeze({});
     if (result.outcomeKnown)
         return defaultConflict(result.code);
-    const recovered = await context.step.run('recover-default-space', () => context.query(observeHome, Path.id(user).raw));
+    const recovered = await context.step.run('recover-default-space', () => context.graph.self.query(observeHome, Path.id(user).raw));
     if (recovered.spaces.length === 1 && recovered.spaces[0]?.id === context.self) {
         return Object.freeze({});
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-domains/shell",
-  "version": "0.1.0-beta.17",
+  "version": "0.1.0-beta.19",
   "description": "Astrale Shell Domain schema and remote product implementation",
   "license": "Apache-2.0",
   "repository": {
@@ -47,14 +47,14 @@
     "zod": "4.4.3"
   },
   "devDependencies": {
-    "@astrale-os/sdk": "0.5.0-beta.82",
+    "@astrale-os/sdk": "0.5.0-beta.96",
     "@astrale/typescript-config": "npm:@jsr/astrale__typescript-config@~1.1.3",
     "@types/node": "^22.0.0",
     "typescript": "7.0.2",
     "vitest": "4.1.10"
   },
   "peerDependencies": {
-    "@astrale-os/sdk": ">=0.5.0-beta.82 <1.0.0"
+    "@astrale-os/sdk": ">=0.5.0-beta.96 <1.0.0"
   },
   "devEngines": {
     "runtime": {