@astrale-domains/shell 0.1.0-beta.20 → 0.1.0-beta.22

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## [0.1.0-beta.22](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.21...shell-domain-v0.1.0-beta.22) (2026-09-03)
+
+
+### Features
+
+* **core:** declare required node class icons ([#163](https://github.com/astrale-os/shell/issues/163)) ([2114424](https://github.com/astrale-os/shell/commit/2114424dc1295d978e49536aea76ace897917987))
+
+
+### Bug Fixes
+
+* **domain:** authorize installed app discovery ([#164](https://github.com/astrale-os/shell/issues/164)) ([cbcb559](https://github.com/astrale-os/shell/commit/cbcb5594ffa9701ec979333f76f7c5dc3597401e))
+
+## [0.1.0-beta.21](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.20...shell-domain-v0.1.0-beta.21) (2026-09-01)
+
+
+### ⚠ BREAKING CHANGES
+
+* adopt unified Domain functions layer ([#157](https://github.com/astrale-os/shell/issues/157))
+
+### Features
+
+* adopt unified Domain functions layer ([#157](https://github.com/astrale-os/shell/issues/157)) ([ae73910](https://github.com/astrale-os/shell/commit/ae739107da4b3827ff06f09a1bf86958135a2a5a))
+
+
+### Bug Fixes
+
+* **domain:** stabilize executable declarations ([a12caa6](https://github.com/astrale-os/shell/commit/a12caa64cb42d8b7d623a53463ff2f1242d27052))
+
 ## [0.1.0-beta.20](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.19...shell-domain-v0.1.0-beta.20) (2026-08-31)
 
 

package/README.md

@@ -34,21 +34,24 @@ The Methods are:
 
 Installation authors the `admin`, `member`, and `default-space` Core nodes. Shell infers no authority
 from email, claims, path spelling, creation order, or a successful handler-local boolean.
-The signed Publication declares installation-owned authority profiles: the Shell principal and
-Core `admin` receive the intended Kernel application-plane surface, excluding only the ability to
-grant `grant` or revoke `revoke`; Core `member` receives Kernel Introspection, Query, Mutation, and
-View resolution. Kernel install, upgrade, introspection, and uninstall own those authority edges as
-one generation.
+The signed Publication declares installation-owned authority profiles: the Shell principal can
+read installed Kernel `Domain` metadata so managed sessions can list applications and resolve their
+domain Views, and the Shell principal plus Core `admin` receive the intended Kernel
+application-plane surface, excluding only the ability to grant `grant` or revoke `revoke`; Core
+`member` receives Kernel Introspection, Query, Mutation, and View resolution. Kernel install,
+upgrade, introspection, and uninstall own those authority edges as one generation.
 
 ## Source ownership
 
-- `schema/` owns the complete Domain contract, public Method values, Policies, relationships, DSL
-  Views, and Core graph;
+- `schema/schema.ts` composes the complete Domain contract, while
+  `schema/modules/{user,group,space,home}/` owns each declaration and its focused evidence;
+- every standalone Function and receiver-bound Method declaration has one file under its semantic
+  module's `functions/` directory; there is no separate code-kind `methods/` owner;
+- `rules/user/` owns the pure closed decision for User setup and exposes no graph effect;
 - `queries/` owns canonical graph observations through the invocation-bound Query executor;
 - `mutations/` owns canonical graph changes and exact preconditions;
-- `actions/` owns the single-operation `User.resolveHome` implementation;
-- `workflows/` owns setup, Group membership, and Space access/default journeys plus
-  unknown-outcome observation; and
+- `functions/` owns the single-operation `User.resolveHome` Action, setup Workflows, Group
+  membership, Space access/default journeys, and unknown-outcome observation; and
 - each semantic owner keeps focused evidence in its own `__tests__/` directory, while root tests
   remain reserved for cross-layer or physical evidence.
 
@@ -56,8 +59,8 @@ No current responsibility earns a `states/`, `capabilities/`, `integrations/`, `
 `views/`, or `ui/` source layer. DSL View declarations remain in Schema; a future frontend
 projection or UI must establish its own concrete responsibility before adding those layers.
 
-Shell never re-declares shared metadata properties. `Group` and `Space` name `K.Named` and
-`K.Descriptable` in their `implements` lists because those Kernel Classes own the admitted
+Shell never re-declares shared metadata properties. `Group` and `Space` extend `K.Named` and
+`K.Descriptable` because those Kernel Classes own the admitted
 `name` and `description` properties; no timestamps are authored by Shell.
 
 ## Execution and evidence
@@ -84,9 +87,10 @@ schema facade.
 Domain publication product. It publishes the remote Shell application and runtime needed by platform
 Worker deployments through the explicit `./application` and `./runtime` subpaths, while its root remains
 Schema-only. Its build therefore compiles the explicit roots in `tsconfig.package.json` and applies
-Shell-owned checks to the emitted platform closure. Tarball qualification then verifies the exact
-exports, isolated entrypoints, absence of source maps, and an install using only public npm
-dependencies.
+Shell-owned normalization and checks to the emitted platform closure. Source-only `#` aliases are
+rewritten to relative declaration references so consumer path mappings cannot capture private Shell
+types. Tarball qualification then verifies the exact exports, isolated subpaths, absence of source
+maps, and an install using only public npm dependencies.
 
 The generic `astrale-domain package` command remains Schema-only and exposes only the Domain root plus
 package metadata. This Shell exception must not be copied to ordinary product Domains or used to

package/dist/application.d.ts

@@ -1,6 +1,7 @@
 import { type Application, type Frontend, type Requirements } from '@astrale-os/sdk/application';
 import runtime from './runtime.js';
 import { ShellSchema } from './schema/index.js';
-export declare const frontend: Frontend<typeof ShellSchema>;
-export declare const application: Application<typeof ShellSchema, typeof runtime, typeof frontend, undefined, Requirements>;
+declare const frontend: Frontend<typeof ShellSchema>;
+declare const applicationRequirements: Requirements;
+export declare const application: Application<typeof ShellSchema, typeof runtime, typeof frontend, undefined, typeof applicationRequirements>;
 export default application;

package/dist/application.js

@@ -2,18 +2,7 @@ import { defineApplication, defineFrontend, external, requirements, } from '@ast
 import { K, KernelRootFunctions } from '@astrale-os/sdk/schema';
 import runtime from './runtime.js';
 import { S, ShellSchema } from './schema/index.js';
-const classOperations = ['create', 'read', 'traverse', 'update', 'delete'];
-const authority = {
-    grant: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'revoke'],
-    revoke: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'grant'],
-};
-const memberFunctions = [
-    K.classes.View.static.methods.resolve,
-    K.functions.introspect,
-    K.functions.mutate,
-    K.functions.query,
-];
-export const frontend = defineFrontend({
+const frontend = defineFrontend({
     schema: ShellSchema,
     source: external('https://app.astrale.ai'),
     routes: {
@@ -24,31 +13,77 @@ export const frontend = defineFrontend({
     },
     entrypoint: 'home',
 });
-const trustedKernel = requirements({
+const applicationRequirements = requirements({
     functions: KernelRootFunctions,
     classes: [
+        {
+            class: K.classes.Domain,
+            operations: ['read'],
+        },
         {
             class: K.classes.extends_with,
             operations: ['create', 'read', 'traverse', 'delete'],
         },
     ],
-    authority,
+    authority: {
+        grant: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'revoke'],
+        revoke: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'grant'],
+    },
     profiles: [
         {
             subject: S.core.nodes.admin,
             functions: KernelRootFunctions,
             classes: [
-                ...Object.values(S.classes).map((value) => ({ class: value, operations: classOperations })),
+                {
+                    class: S.classes.Group,
+                    operations: ['create', 'read', 'traverse', 'update', 'delete'],
+                },
+                {
+                    class: S.classes.Space,
+                    operations: ['create', 'read', 'traverse', 'update', 'delete'],
+                },
+                {
+                    class: S.classes.User,
+                    operations: ['create', 'read', 'traverse', 'update', 'delete'],
+                },
+                {
+                    class: S.classes.administers_space,
+                    operations: ['create', 'read', 'traverse', 'update', 'delete'],
+                },
+                {
+                    class: S.classes.default_space,
+                    operations: ['create', 'read', 'traverse', 'update', 'delete'],
+                },
+                {
+                    class: S.classes.member_of_group,
+                    operations: ['create', 'read', 'traverse', 'update', 'delete'],
+                },
+                {
+                    class: S.classes.member_of_space,
+                    operations: ['create', 'read', 'traverse', 'update', 'delete'],
+                },
+                {
+                    class: S.classes.owns_space,
+                    operations: ['create', 'read', 'traverse', 'update', 'delete'],
+                },
                 {
                     class: K.classes.extends_with,
                     operations: ['create', 'read', 'traverse', 'delete'],
                 },
             ],
-            authority,
+            authority: {
+                grant: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'revoke'],
+                revoke: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'grant'],
+            },
         },
         {
             subject: S.core.nodes.member,
-            functions: memberFunctions,
+            functions: [
+                K.classes.View.static.methods.resolve,
+                K.functions.introspect,
+                K.functions.mutate,
+                K.functions.query,
+            ],
         },
     ],
 });
@@ -56,6 +91,6 @@ export const application = defineApplication({
     schema: ShellSchema,
     runtime,
     frontend,
-    requirements: trustedKernel,
+    requirements: applicationRequirements,
 });
 export default application;

package/dist/{workflows → functions}/group/assign.d.ts

@@ -1,3 +1,3 @@
 import { type WorkflowDefinition } from '@astrale-os/sdk/workflow';
-import type { ShellSchema } from '#schema';
+import type { ShellSchema } from '../../schema/index.js';
 export declare const assignGroupUserWorkflow: WorkflowDefinition<typeof ShellSchema, 'Group.assignUser'>;

package/dist/{workflows → functions}/group/change.d.ts

@@ -1,5 +1,5 @@
 import type { WorkflowContext } from '@astrale-os/sdk/workflow';
-import type { S, Shell } from '#schema';
+import type { S, Shell } from '../../schema/index.js';
 type GroupCallable = typeof S.classes.Group.self.methods.assignUser | typeof S.classes.Group.self.methods.unassignUser;
 type GroupContext = WorkflowContext<GroupCallable, Shell>;
 export declare function changeMembership(context: GroupContext, present: boolean): Promise<Readonly<Record<never, never>>>;

package/dist/{workflows → functions}/group/unassign.d.ts

@@ -1,3 +1,3 @@
 import { type WorkflowDefinition } from '@astrale-os/sdk/workflow';
-import type { ShellSchema } from '#schema';
+import type { ShellSchema } from '../../schema/index.js';
 export declare const unassignGroupUserWorkflow: WorkflowDefinition<typeof ShellSchema, 'Group.unassignUser'>;

package/dist/functions/registry/index.d.ts

@@ -0,0 +1,12 @@
+import { assignGroupUserWorkflow, unassignGroupUserWorkflow } from '../group/index.js';
+import { setupAdminWorkflow, setupMemberWorkflow } from '../setup/index.js';
+import { addSpaceUserWorkflow, removeSpaceUserWorkflow, setDefaultSpaceWorkflow } from '../space/index.js';
+export declare const workflows: readonly [
+    typeof setupAdminWorkflow,
+    typeof setupMemberWorkflow,
+    typeof assignGroupUserWorkflow,
+    typeof unassignGroupUserWorkflow,
+    typeof addSpaceUserWorkflow,
+    typeof removeSpaceUserWorkflow,
+    typeof setDefaultSpaceWorkflow
+];

package/dist/functions/registry/index.js

@@ -0,0 +1,12 @@
+import { assignGroupUserWorkflow, unassignGroupUserWorkflow } from '#functions/group';
+import { setupAdminWorkflow, setupMemberWorkflow } from '#functions/setup';
+import { addSpaceUserWorkflow, removeSpaceUserWorkflow, setDefaultSpaceWorkflow, } from '#functions/space';
+export const workflows = [
+    setupAdminWorkflow,
+    setupMemberWorkflow,
+    assignGroupUserWorkflow,
+    unassignGroupUserWorkflow,
+    addSpaceUserWorkflow,
+    removeSpaceUserWorkflow,
+    setDefaultSpaceWorkflow,
+];

package/dist/{workflows → functions}/setup/admin.d.ts

@@ -1,3 +1,3 @@
 import { type WorkflowDefinition } from '@astrale-os/sdk/workflow';
-import type { ShellSchema } from '#schema';
+import type { ShellSchema } from '../../schema/index.js';
 export declare const setupAdminWorkflow: WorkflowDefinition<typeof ShellSchema, 'setupAdmin'>;

package/dist/{workflows → functions}/setup/index.d.ts

@@ -1,5 +1,4 @@
 export { setupAdminWorkflow } from './admin.js';
 export { setupMemberWorkflow } from './member.js';
-export { planUserSetup, type SetupConflictReason, type SetupPlan, type SetupRole } from './plan.js';
 export { provisioningRequest, provisioningResult } from './provision.js';
 export { runSetup } from './run.js';

package/dist/{workflows → functions}/setup/index.js

@@ -1,5 +1,4 @@
 export { setupAdminWorkflow } from './admin.js';
 export { setupMemberWorkflow } from './member.js';
-export { planUserSetup } from './plan.js';
 export { provisioningRequest, provisioningResult } from './provision.js';
 export { runSetup } from './run.js';

package/dist/{workflows → functions}/setup/member.d.ts

@@ -1,3 +1,3 @@
 import { type WorkflowDefinition } from '@astrale-os/sdk/workflow';
-import type { ShellSchema } from '#schema';
+import type { ShellSchema } from '../../schema/index.js';
 export declare const setupMemberWorkflow: WorkflowDefinition<typeof ShellSchema, 'setupMember'>;

package/dist/{workflows → functions}/setup/provision.d.ts

@@ -1,5 +1,5 @@
 import type { ProvisionRequest, ProvisionResult } from '@astrale-os/sdk/auth';
-import type { SetupUserInput, SetupUserResult, Shell } from '#schema';
-import type { SetupRole } from './plan.js';
+import type { SetupRole } from '../../rules/user/index.js';
+import type { SetupUserInput, SetupUserResult, Shell } from '../../schema/index.js';
 export declare function provisioningRequest(domain: Shell, input: SetupUserInput, role: SetupRole): ProvisionRequest;
 export declare function provisioningResult(result: ProvisionResult): SetupUserResult;

package/dist/{workflows → functions}/setup/run.d.ts

@@ -1,6 +1,6 @@
 import type { WorkflowContext } from '@astrale-os/sdk/workflow';
-import type { S, SetupUserResult, Shell } from '#schema';
-import { type SetupRole } from './plan.js';
+import type { S, SetupUserResult, Shell } from '../../schema/index.js';
+import { type SetupRole } from '../../rules/user/index.js';
 type SetupCallable = typeof S.functions.setupAdmin | typeof S.functions.setupMember;
 type SetupContext = WorkflowContext<SetupCallable, Shell>;
 export declare function runSetup(context: SetupContext, role: SetupRole): Promise<SetupUserResult>;

package/dist/{workflows → functions}/setup/run.js

@@ -4,7 +4,7 @@ import { InvocationError } from '@astrale-os/sdk/execution';
 import { Path } from '@astrale-os/sdk/graph/path';
 import { repairUser } from '#mutations/user';
 import { observeUserSetup } from '#queries/user';
-import { planUserSetup } from './plan.js';
+import { planUserSetup } from '#rules/user';
 import { provisioningRequest, provisioningResult } from './provision.js';
 export async function runSetup(context, role) {
     const { input, step } = context;
@@ -42,7 +42,14 @@ async function convergeExisting(context, role, userId, changedBeforeObservation)
             changed: changedBeforeObservation,
         });
     }
-    const repaired = await context.step.run('repair-user-setup', () => context.graph.self.mutate(repairUser, plan.repair));
+    const repaired = await context.step.run('repair-user-setup', () => context.graph.self.mutate(repairUser, {
+        ...plan.repair,
+        guards: {
+            home: observed.home.guard,
+            ownedSpaces: observed.ownedSpaces.guard,
+            groups: observed.groups.guard,
+        },
+    }));
     if (repaired.ok) {
         return Object.freeze({ userId, personalSpaceId: repaired.personalSpaceId, changed: true });
     }

package/dist/{workflows → functions}/space/access.d.ts

@@ -1,5 +1,5 @@
 import type { WorkflowContext } from '@astrale-os/sdk/workflow';
-import type { S, Shell } from '#schema';
+import type { S, Shell } from '../../schema/index.js';
 export type DesiredSpaceAccess = 'member' | 'admin' | null;
 type SpaceAccessCallable = typeof S.classes.Space.self.methods.addUser | typeof S.classes.Space.self.methods.removeUser;
 type SpaceAccessContext = WorkflowContext<SpaceAccessCallable, Shell>;

package/dist/{workflows → functions}/space/add.d.ts

@@ -1,3 +1,3 @@
 import { type WorkflowDefinition } from '@astrale-os/sdk/workflow';
-import type { ShellSchema } from '#schema';
+import type { ShellSchema } from '../../schema/index.js';
 export declare const addSpaceUserWorkflow: WorkflowDefinition<typeof ShellSchema, 'Space.addUser'>;

package/dist/{workflows → functions}/space/default.d.ts

@@ -1,3 +1,3 @@
 import { type WorkflowDefinition } from '@astrale-os/sdk/workflow';
-import type { ShellSchema } from '#schema';
+import type { ShellSchema } from '../../schema/index.js';
 export declare const setDefaultSpaceWorkflow: WorkflowDefinition<typeof ShellSchema, 'Space.setDefault'>;

package/dist/{workflows → functions}/space/remove.d.ts

@@ -1,3 +1,3 @@
 import { type WorkflowDefinition } from '@astrale-os/sdk/workflow';
-import type { ShellSchema } from '#schema';
+import type { ShellSchema } from '../../schema/index.js';
 export declare const removeSpaceUserWorkflow: WorkflowDefinition<typeof ShellSchema, 'Space.removeUser'>;

package/dist/functions/user/index.d.ts

@@ -0,0 +1,3 @@
+import { resolveHomeAction } from './resolve-home.js';
+export { resolveHomeAction };
+export declare const actions: readonly [typeof resolveHomeAction];

package/dist/functions/user/index.js

@@ -0,0 +1,3 @@
+import { resolveHomeAction } from './resolve-home.js';
+export { resolveHomeAction };
+export const actions = [resolveHomeAction];

package/dist/{actions → functions}/user/resolve-home.d.ts

@@ -1,3 +1,3 @@
 import { type ActionDefinition } from '@astrale-os/sdk/action';
-import type { ShellSchema } from '#schema';
+import type { ShellSchema } from '../../schema/index.js';
 export declare const resolveHomeAction: ActionDefinition<typeof ShellSchema, 'User.resolveHome'>;

package/dist/mutations/group/membership.d.ts

@@ -2,7 +2,7 @@ import type { NodeId } from '@astrale-os/sdk/graph/node';
 import type { QueryPrecondition } from '@astrale-os/sdk/mutation';
 import type { QueryEdgeAST } from '@astrale-os/sdk/query';
 import { type Mutation } from '@astrale-os/sdk/mutation';
-import type { Shell } from '#schema';
+import type { Shell } from '../../schema/index.js';
 export interface GroupMembershipChange {
     readonly user: string;
     readonly group: NodeId;

package/dist/mutations/space/access.d.ts

@@ -2,7 +2,7 @@ import type { NodeId } from '@astrale-os/sdk/graph/node';
 import type { QueryPrecondition } from '@astrale-os/sdk/mutation';
 import type { QueryNodeAST } from '@astrale-os/sdk/query';
 import { type Mutation } from '@astrale-os/sdk/mutation';
-import type { Shell } from '#schema';
+import type { Shell } from '../../schema/index.js';
 export interface SpaceAccessChange {
     readonly user: string;
     readonly space: NodeId;

package/dist/mutations/space/default.d.ts

@@ -2,7 +2,7 @@ import type { NodeId } from '@astrale-os/sdk/graph/node';
 import type { QueryPrecondition } from '@astrale-os/sdk/mutation';
 import type { QueryNodeAST } from '@astrale-os/sdk/query';
 import { type Mutation } from '@astrale-os/sdk/mutation';
-import type { Shell } from '#schema';
+import type { Shell } from '../../schema/index.js';
 export interface DefaultSpaceChange {
     readonly user: NodeId;
     readonly previous?: NodeId;

package/dist/mutations/user/repair.d.ts

@@ -2,27 +2,9 @@ import type { NodeId } from '@astrale-os/sdk/graph/node';
 import type { QueryPrecondition } from '@astrale-os/sdk/mutation';
 import type { QueryEdgeAST, QueryNodeAST } from '@astrale-os/sdk/query';
 import { type Mutation } from '@astrale-os/sdk/mutation';
-import type { Shell } from '#schema';
-export interface UserRepair {
-    readonly userId: NodeId;
-    readonly currentDisplayName?: string;
-    readonly displayName?: string;
-    readonly home: {
-        readonly kind: 'existing';
-        readonly id: NodeId;
-        readonly currentName: string;
-        readonly name?: string;
-    } | {
-        readonly kind: 'create';
-        readonly name: string;
-    };
-    readonly addDefault: boolean;
-    readonly addOwnership: boolean;
-    readonly addMember: boolean;
-    readonly addMemberAuthority: boolean;
-    readonly addAdmin: boolean;
-    readonly addAdminAuthority: boolean;
-    readonly removeAdminAuthority: boolean;
+import type { UserSetupRepair } from '../../rules/user/index.js';
+import type { Shell } from '../../schema/index.js';
+export interface UserRepair extends UserSetupRepair {
     readonly guards: {
         readonly home: QueryPrecondition<QueryNodeAST>;
         readonly ownedSpaces: QueryPrecondition<QueryNodeAST>;

package/dist/queries/space/access.d.ts

@@ -1,5 +1,5 @@
 import { type CompositeQueryDefinition } from '@astrale-os/sdk/query';
-import type { Shell } from '#schema';
+import type { Shell } from '../../schema/index.js';
 import { type AdminSpacesObservation } from './admin.js';
 import { type MemberSpacesObservation } from './member.js';
 export interface DirectSpaceAccessObservation {

package/dist/queries/space/admin.d.ts

@@ -1,7 +1,7 @@
 import type { Node } from '@astrale-os/sdk/graph/node';
 import type { QueryPrecondition } from '@astrale-os/sdk/mutation';
 import type { QueryNodeAST, SingleQueryDefinition } from '@astrale-os/sdk/query';
-import type { Shell } from '#schema';
+import type { Shell } from '../../schema/index.js';
 export interface AdminSpacesObservation {
     readonly spaces: readonly Node[];
     readonly guard: QueryPrecondition<QueryNodeAST>;

package/dist/queries/space/member.d.ts

@@ -1,7 +1,7 @@
 import type { Node } from '@astrale-os/sdk/graph/node';
 import type { QueryPrecondition } from '@astrale-os/sdk/mutation';
 import type { QueryNodeAST, SingleQueryDefinition } from '@astrale-os/sdk/query';
-import type { Shell } from '#schema';
+import type { Shell } from '../../schema/index.js';
 export interface MemberSpacesObservation {
     readonly spaces: readonly Node[];
     readonly guard: QueryPrecondition<QueryNodeAST>;

package/dist/queries/user/groups.d.ts

@@ -1,7 +1,7 @@
 import type { Node } from '@astrale-os/sdk/graph/node';
 import type { QueryPrecondition } from '@astrale-os/sdk/mutation';
 import type { QueryEdgeAST, SingleQueryDefinition } from '@astrale-os/sdk/query';
-import type { Shell } from '#schema';
+import type { Shell } from '../../schema/index.js';
 export interface UserGroupsObservation {
     readonly groups: readonly Node[];
     readonly authorities: readonly Node[];

package/dist/queries/user/home.d.ts

@@ -1,7 +1,7 @@
 import type { Node } from '@astrale-os/sdk/graph/node';
 import type { QueryPrecondition } from '@astrale-os/sdk/mutation';
 import type { QueryNodeAST, SingleQueryDefinition } from '@astrale-os/sdk/query';
-import type { Shell } from '#schema';
+import type { Shell } from '../../schema/index.js';
 export interface HomeObservation {
     readonly spaces: readonly Node[];
     readonly guard: QueryPrecondition<QueryNodeAST>;

package/dist/queries/user/owned-spaces.d.ts

@@ -1,7 +1,7 @@
 import type { Node } from '@astrale-os/sdk/graph/node';
 import type { QueryPrecondition } from '@astrale-os/sdk/mutation';
 import type { QueryNodeAST, SingleQueryDefinition } from '@astrale-os/sdk/query';
-import type { Shell } from '#schema';
+import type { Shell } from '../../schema/index.js';
 export interface OwnedSpacesObservation {
     readonly spaces: readonly Node[];
     readonly guard: QueryPrecondition<QueryNodeAST>;

package/dist/queries/user/profile.d.ts

@@ -1,4 +1,4 @@
 import type { Node } from '@astrale-os/sdk/graph/node';
 import { type SingleQueryDefinition } from '@astrale-os/sdk/query';
-import type { Shell } from '#schema';
+import type { Shell } from '../../schema/index.js';
 export declare const readUserProfile: SingleQueryDefinition<Shell, string, Node>;

package/dist/queries/user/setup.d.ts

@@ -1,6 +1,6 @@
 import type { Node } from '@astrale-os/sdk/graph/node';
 import { type CompositeQueryDefinition } from '@astrale-os/sdk/query';
-import type { Shell } from '#schema';
+import type { Shell } from '../../schema/index.js';
 import type { UserGroupsObservation } from './groups.js';
 import { type HomeObservation } from './home.js';
 import { type OwnedSpacesObservation } from './owned-spaces.js';

package/dist/rules/user/index.d.ts

@@ -0,0 +1 @@
+export { planUserSetup, type SetupConflictReason, type SetupPlan, type SetupRole, type UserSetupRepair, } from './setup.js';

package/dist/rules/user/index.js

@@ -0,0 +1 @@
+export { planUserSetup, } from './setup.js';

package/dist/rules/user/setup.d.ts

@@ -0,0 +1,38 @@
+import type { Node } from '@astrale-os/sdk/graph/node';
+import type { UserSetupObservation } from '../../queries/user/index.js';
+import type { SetupUserInput, Shell } from '../../schema/index.js';
+export type SetupRole = 'member' | 'admin';
+export type SetupPlan = {
+    readonly kind: 'conflict';
+    readonly reason: SetupConflictReason;
+    readonly message: string;
+} | {
+    readonly kind: 'unchanged';
+    readonly personalSpaceId: Node['id'];
+} | {
+    readonly kind: 'repair';
+    readonly repair: UserSetupRepair;
+};
+export interface UserSetupRepair {
+    readonly userId: Node['id'];
+    readonly currentDisplayName?: string;
+    readonly displayName?: string;
+    readonly home: {
+        readonly kind: 'existing';
+        readonly id: Node['id'];
+        readonly currentName: string;
+        readonly name?: string;
+    } | {
+        readonly kind: 'create';
+        readonly name: string;
+    };
+    readonly addDefault: boolean;
+    readonly addOwnership: boolean;
+    readonly addMember: boolean;
+    readonly addMemberAuthority: boolean;
+    readonly addAdmin: boolean;
+    readonly addAdminAuthority: boolean;
+    readonly removeAdminAuthority: boolean;
+}
+export type SetupConflictReason = 'IDENTITY_CLASS_CONFLICT' | 'IDENTITY_FACT_CONFLICT' | 'MULTIPLE_DEFAULT_SPACES' | 'DEFAULT_SPACE_CLASS_CONFLICT' | 'AMBIGUOUS_PERSONAL_SPACE';
+export declare function planUserSetup(domain: Shell, input: SetupUserInput, role: SetupRole, observation: UserSetupObservation): SetupPlan;

package/dist/{workflows/setup/plan.js → rules/user/setup.js}

@@ -82,11 +82,6 @@ export function planUserSetup(domain, input, role, observation) {
             addAdmin,
             addAdminAuthority,
             removeAdminAuthority,
-            guards: Object.freeze({
-                home: observation.home.guard,
-                ownedSpaces: observation.ownedSpaces.guard,
-                groups: observation.groups.guard,
-            }),
         }),
     });
 }

package/dist/runtime.d.ts

@@ -1,10 +1,13 @@
 import { type Runtime } from '@astrale-os/sdk/runtime';
+import { workflows } from './functions/registry/index.js';
+import { actions } from './functions/user/index.js';
 import type { ShellSchema } from './schema/index.js';
 declare const integrations: {};
 declare const initialize: () => {
     providers: {};
 };
-declare const actions: readonly [import("@astrale-os/sdk/action").ActionDefinition<import("@astrale-os/sdk/schema").DefinedSchema<"shell.astrale.ai", import("@astrale-os/sdk/schema").ResolvedDomainOfInput<"shell.astrale.ai", import("./schema/domain/index.js").ShellSchemaInput>>, "User.resolveHome", Readonly<Record<never, never>>>];
-declare const workflows: readonly [import("@astrale-os/sdk/workflow").WorkflowDefinition<import("@astrale-os/sdk/schema").DefinedSchema<"shell.astrale.ai", import("@astrale-os/sdk/schema").ResolvedDomainOfInput<"shell.astrale.ai", import("./schema/domain/index.js").ShellSchemaInput>>, "setupAdmin", Readonly<Record<never, never>>>, import("@astrale-os/sdk/workflow").WorkflowDefinition<import("@astrale-os/sdk/schema").DefinedSchema<"shell.astrale.ai", import("@astrale-os/sdk/schema").ResolvedDomainOfInput<"shell.astrale.ai", import("./schema/domain/index.js").ShellSchemaInput>>, "setupMember", Readonly<Record<never, never>>>, import("@astrale-os/sdk/workflow").WorkflowDefinition<import("@astrale-os/sdk/schema").DefinedSchema<"shell.astrale.ai", import("@astrale-os/sdk/schema").ResolvedDomainOfInput<"shell.astrale.ai", import("./schema/domain/index.js").ShellSchemaInput>>, "Group.assignUser", Readonly<Record<never, never>>>, import("@astrale-os/sdk/workflow").WorkflowDefinition<import("@astrale-os/sdk/schema").DefinedSchema<"shell.astrale.ai", import("@astrale-os/sdk/schema").ResolvedDomainOfInput<"shell.astrale.ai", import("./schema/domain/index.js").ShellSchemaInput>>, "Group.unassignUser", Readonly<Record<never, never>>>, import("@astrale-os/sdk/workflow").WorkflowDefinition<import("@astrale-os/sdk/schema").DefinedSchema<"shell.astrale.ai", import("@astrale-os/sdk/schema").ResolvedDomainOfInput<"shell.astrale.ai", import("./schema/domain/index.js").ShellSchemaInput>>, "Space.addUser", Readonly<Record<never, never>>>, import("@astrale-os/sdk/workflow").WorkflowDefinition<import("@astrale-os/sdk/schema").DefinedSchema<"shell.astrale.ai", import("@astrale-os/sdk/schema").ResolvedDomainOfInput<"shell.astrale.ai", import("./schema/domain/index.js").ShellSchemaInput>>, "Space.removeUser", Readonly<Record<never, never>>>, import("@astrale-os/sdk/workflow").WorkflowDefinition<import("@astrale-os/sdk/schema").DefinedSchema<"shell.astrale.ai", import("@astrale-os/sdk/schema").ResolvedDomainOfInput<"shell.astrale.ai", import("./schema/domain/index.js").ShellSchemaInput>>, "Space.setDefault", Readonly<Record<never, never>>>];
-declare const runtime: Runtime<typeof ShellSchema, typeof integrations, typeof initialize, typeof actions, typeof workflows>;
+declare const runtime: Runtime<typeof ShellSchema, typeof integrations, typeof initialize, [
+    ...typeof actions,
+    ...typeof workflows
+]>;
 export default runtime;