@astrale-domains/shell 0.1.0-beta.23 → 0.1.0-beta.24

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## [0.1.0-beta.24](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.23...shell-domain-v0.1.0-beta.24) (2026-09-07)
+
+
+### ⚠ BREAKING CHANGES
+
+* **runtime:** simplify Shell users, groups and invitations ([#187](https://github.com/astrale-os/shell/issues/187))
+
+### Features
+
+* **domain:** migrate Shell to project environments ([#183](https://github.com/astrale-os/shell/issues/183)) ([ec72b5d](https://github.com/astrale-os/shell/commit/ec72b5d11fea5ff3266d1fd0a823c4eff5cc6d3e))
+* **runtime:** simplify Shell users, groups and invitations ([#187](https://github.com/astrale-os/shell/issues/187)) ([7f00279](https://github.com/astrale-os/shell/commit/7f002791edae81944e6e80940834dee49212aa26))
+
 ## [0.1.0-beta.23](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.22...shell-domain-v0.1.0-beta.23) (2026-09-04)
 
 

package/README.md

@@ -1,85 +1,89 @@
 # Shell Domain
 
-Shell is the minimal Kernel-native application plane. Its durable model is the concrete `User`,
-`Group`, and `Space` Node Classes, five relationships, four Policies, two Functions, six Methods,
-four Kernel View declarations, and three deterministic Core nodes.
-
-Identity registration and Shell business setup are separate boundaries. A real external user first
-creates a local key and self-provisions that key as the exact Shell `User` Class. The CLI journey is:
-
-```sh
-astrale identity create alice
-astrale identity register alice \
-  --class /:shell.astrale.ai:class.User \
-  --props '{"shell.astrale.ai:class.User.property.displayName":"Alice"}' \
-  --as <root> -i <instance>
+Shell owns two concrete Identity classes, User and Group, the member_of_group relation,
+the admin/member Core groups, three static methods, and one application View. There is
+no Space, setup function, personal home, application catalogue, or public repair method.
+
+## Contracts
+
+| Static method | Input | Output |
+| --- | --- | --- |
+| User.invite | `{ user: UserPath, email: string }` | `{ invitationId, user, state }` |
+| Group.assignUser | `{ user: UserPath, group: GroupPath }` | `{}` |
+| Group.unassignUser | Same | `{}` |
+
+User extends Kernel.Identity and owns only optional creationKey correlation.
+Concrete business classes may declare their own displayName/email; Shell never reads or writes them.
+Group extends Kernel.Identity, Named and Descriptable. Authentication remains the
+Kernel-owned, write-once iss/sub binding. Invitation email is explicit input, not a User property.
+
+| Operation | Schema Policy alternatives, in addition to Kernel admission |
+| --- | --- |
+| invite | Core admin membership AND Shell-owned concrete User class; or ownership of the User's concrete class |
+| assignUser / unassignUser | Core admin membership AND Shell-owned concrete Group class; or ownership of the Group's concrete class |
+
+ownsClass follows instance_of → concrete class → of_domain → caller. It does not
+infer ownership from an email, a subclass name, or ownership of an ancestor class.
+A Domain cannot assign its Employee to Core member merely by owning Employee. Admin's invitation
+orchestration retains that responsibility. A Group's owner may manage any admitted User in that Group.
+administersShellClass connects Core admin membership and concrete ownership in one Policy pattern;
+it does not treat inheritance from Shell as ownership. These are callable restrictions, not an
+isolation boundary against Root/Manager or the existing broad administrator Kernel profile.
+With Kernel Host beta94 or newer, an external caller needs callable authority through its own
+identity composition AND a passing callable Policy. Declare exact foreign methods in the calling
+Domain's requirements; can_use no longer bypasses the Policy. Root and exact owner exceptions remain.
+
+## Flows
+
+```text
+Domain creates Employee extending User → unregistered, no group
+Direct credential-evidenced Register → same node authenticates, still no group
+User.invite → provider authentication → Admin ingress → WorkOS/login
+            → Admin Register on that same node → member assignment → completed
+Group.assignUser → member_of_group + Kernel.extends_with in one atomic mutation
+Group.unassignUser → remove both edges in one atomic mutation
 ```
 
-Under the current public contract, Root submits the self-proven registration for each Shell User;
-it does not author that User's Shell memberships or Space facts. Root calls `setupAdmin` only to
-converge the first administrator, using the exact registered issuer and subject returned by
-`identity register`. After that, an authenticated Shell administrator calls `setupMember` or
-`setupAdmin` for subsequent registered Users. Both setup Functions are authorized by
-`maySetupUsers` against membership in the Core Administrators Group.
-They converge the User profile, personal Space, ownership/default facts, Members membership, and—only
-for `setupAdmin`—Administrators membership. Every membership mutation also changes the matching
-Kernel `extends_with` composition edge atomically. They do not create credentials, author dynamic
-`can_*` edges, infer identity from a local CLI name, or replace self-proven registration.
-
-The Methods are:
-
-- User: `resolveHome`;
-- Group: `assignUser`, `unassignUser`; and
-- Space: `addUser`, `removeUser`, `setDefault`.
-
-Installation authors the `admin`, `member`, and `default-space` Core nodes. Shell infers no authority
-from email, claims, path spelling, creation order, or a successful handler-local boolean.
-The signed Publication declares installation-owned authority profiles: the Shell principal can
-read installed Kernel `Domain` metadata so managed sessions can list applications and resolve their
-domain Views, and the Shell principal plus Core `admin` receive the intended Kernel
-application-plane surface, excluding only the ability to grant `grant` or revoke `revoke`; Core
-`member` receives Kernel Introspection, Query, Mutation, and View resolution. Kernel install,
-upgrade, introspection, and uninstall own those authority edges as one generation.
-
-## Source ownership
-
-- `schema/schema.ts` composes the complete Domain contract, while
-  `schema/modules/{user,group,space,home}/` owns each declaration and its focused evidence;
-- every standalone Function and receiver-bound Method declaration has one file under its semantic
-  module's `functions/` directory; there is no separate code-kind `methods/` owner;
-- `rules/user/` owns the pure closed decision for User setup and exposes no graph effect;
-- `queries/` owns canonical graph observations through the invocation-bound Query executor;
-- `mutations/` owns canonical graph changes and exact preconditions;
-- `functions/` owns the single-operation `User.resolveHome` Action, setup Workflows, Group
-  membership, Space access/default journeys, and unknown-outcome observation; and
-- each semantic owner keeps focused evidence in its own `__tests__/` directory, while root tests
-  remain reserved for cross-layer or physical evidence.
-
-No current responsibility earns a `states/`, `capabilities/`, `integrations/`, `migrations/`,
-`views/`, or `ui/` source layer. DSL View declarations remain in Schema; a future frontend
-projection or UI must establish its own concrete responsibility before adding those layers.
-
-Shell never re-declares shared metadata properties. `Group` and `Space` extend `K.Named` and
-`K.Descriptable` because those Kernel Classes own the admitted
-`name` and `description` properties; no timestamps are authored by Shell.
-
-## Execution and evidence
-
-`application.ts` and `runtime.ts` form the complete remote product implementation. Runtime admission
-is exhaustive: `User.resolveHome` is one Action, and both setup Functions plus all five mutating
-Methods are Workflows. They use the SDK's canonical Auth, Query, Mutation, Result, Workflow, and Step
-contracts. Named Workflow steps describe semantic operations but do not claim process-restart
-durability, exactly-once execution, compensation, or crash recovery.
-
-The executable contract lives in Shell's semantic source, public facades, and tests. Product
-decisions, journeys, legacy disposition, dependency gates, and qualification evidence live in
-[`.history/`](.history/). Product Domains intentionally have no `.spec/` tree; Kernel authoring
-values come through semantic `@astrale-os/sdk/*` facades.
-
-Domain authors import the schema facade from `@astrale-domains/shell`. Worker deployments import the
-application descriptor from `@astrale-domains/shell/application` and the runtime entrypoint from
-`@astrale-domains/shell/runtime`, so bundling the remote runtime does not traverse the build-only
-schema facade.
+The invitation flow is coordinated by Admin, not by an Employee callback. Shell's Integration
+carries only user/email/requestId/requestedBy. Its Provider mints an invocation-bound Shell
+proof for its configured HTTPS ingress audience; target/sourceProof are not business inputs.
+A returned pending invitation does not prove email delivery or completed registration.
+
+Membership methods converge both edges, including an observed partial membership.
+After an uncertain mutation response they re-read the pair; an unconfirmed outcome remains
+explicitly unconfirmed. This is not a global repair scan or an exactly-once guarantee.
+
+A Team class extending Group can carry a business permission edge to Project. Membership
+composition lets an Employee's expanded grant include Team; the protected Project Policy is
+still evaluated by Kernel. Removing composition removes that authority path. Installed
+Kernel E2E evidence, not a handler test, qualifies this behavior.
+
+## Installation and View
+
+The Shell principal requests all Kernel root functions, the required extends_with operations,
+and the declared grant/revoke authority. Core admin receives the full declared Shell profile,
+including invite, assignUser and unassignUser so humans inheriting admin can call those methods.
+Core member receives Introspect, Query, Mutate and View.resolve, not blanket class-read grants.
+Application requirements, including requirements.core, are owned by application.ts and materialized by installation,
+never by invitation handlers.
+
+The sole application entrypoint uses the Vite frontend at /. It lists visible User/Group
+families under the caller's session, with loading/empty/error states and independent refresh.
+Users display their concrete class and Node ID, not a guessed foreign profile.
+It does not proxy privileged directory reads or enumerate installed applications.
+
+## Source and qualification
+
+Each declaration, Query and Mutation has its own semantic file. Layer roots are facades;
+functions own orchestration, integrations/providers own external effects, views/ui own the
+directory surface. Runtime has one default export and binds the three static Workflows.
+The Dataset is referenced lazily by the root astrale.config.ts.
+
+Domain authors import Schema from @astrale-domains/shell; platform workers use the explicit
+/application and /runtime exports. Creation/registration, installation authority, invitation
+delivery, runtime replay and browser rendering are separate qualification boundaries.
+The redesigned Admin composition, published Register cohort and real invitation/instance-create
+journeys remain release gates; this source README is not evidence that those gates passed.
 
 ### Publication boundary
 
@@ -88,7 +92,7 @@ Domain publication product. It publishes the remote Shell application and runtim
 Worker deployments through the explicit `./application` and `./runtime` subpaths, while its root remains
 Schema-only. Its build therefore compiles the explicit roots in `tsconfig.package.json` and applies
 Shell-owned normalization and checks to the emitted platform closure. Source-only `#` aliases are
-rewritten to relative declaration references so consumer path mappings cannot capture private Shell
+rewritten to relative JS and declaration references so consumer path mappings cannot capture private Shell
 types. Tarball qualification then verifies the exact exports, isolated subpaths, absence of source
 maps, and an install using only public npm dependencies.
 

package/dist/application.d.ts

@@ -1,7 +1,8 @@
-import { type Application, type Frontend, type Requirements } from '@astrale-os/sdk/application';
-import runtime from './runtime.js';
+import { type Application } from '@astrale-os/sdk/application';
 import { ShellSchema } from './schema/index.js';
-declare const frontend: Frontend<typeof ShellSchema>;
-declare const applicationRequirements: Requirements;
-export declare const application: Application<typeof ShellSchema, typeof runtime, typeof frontend, undefined, typeof applicationRequirements>;
+import { type ShellRuntime } from './runtime.js';
+declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale-os/sdk/schema").DefinedSchema<"shell.astrale.ai", import("@astrale-os/sdk/schema").ResolvedDomainOfInput<"shell.astrale.ai", import("./schema/index.js").ShellSchemaInput>>>;
+declare const applicationRequirements: import("@astrale-os/sdk/application").Requirements;
+export type ShellApplication = Application<typeof ShellSchema, ShellRuntime, typeof frontend, undefined, typeof applicationRequirements>;
+export declare const application: ShellApplication;
 export default application;

package/dist/application.js

@@ -1,75 +1,44 @@
-import { defineApplication, defineFrontend, external, requirements, } from '@astrale-os/sdk/application';
+import { defineApplication, defineFrontend, vite, requirements, } from '@astrale-os/sdk/application';
 import { K, KernelRootFunctions } from '@astrale-os/sdk/schema';
-import runtime from './runtime.js';
-import { S, ShellSchema } from './schema/index.js';
+import { ShellSchema, S } from './schema/index.js';
+import runtime, {} from './runtime.js';
 const frontend = defineFrontend({
     schema: ShellSchema,
-    source: external('https://app.astrale.ai'),
-    routes: {
-        group: '/groups',
-        home: '/',
-        space: '/spaces',
-        user: '/users',
-    },
-    entrypoint: 'home',
+    source: vite({ config: './frontend/vite.config.ts' }),
+    routes: { application: { path: '/', handshake: 'shell' } },
+    entrypoint: 'application',
 });
 const applicationRequirements = requirements({
+    // Sujet implicite : le principal installé Shell, utilisé par kernel.self.
     functions: KernelRootFunctions,
     classes: [
-        {
-            class: K.classes.Domain,
-            operations: ['read'],
-        },
-        {
-            class: K.classes.extends_with,
-            operations: ['create', 'read', 'traverse', 'delete'],
-        },
+        { class: K.classes.extends_with, operations: ['create', 'read', 'traverse', 'delete'] },
     ],
     authority: {
         grant: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'revoke'],
         revoke: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'grant'],
     },
-    profiles: [
+    // Ces profils sont matérialisés par l'installeur, pas par un handler Shell.
+    core: [
         {
             subject: S.core.nodes.admin,
-            functions: KernelRootFunctions,
+            functions: [
+                ...KernelRootFunctions,
+                S.classes.User.static.methods.invite,
+                S.classes.Group.static.methods.assignUser,
+                S.classes.Group.static.methods.unassignUser,
+            ],
             classes: [
+                { class: S.classes.User, operations: ['create', 'read', 'traverse', 'update', 'delete'] },
                 {
                     class: S.classes.Group,
                     operations: ['create', 'read', 'traverse', 'update', 'delete'],
                 },
-                {
-                    class: S.classes.Space,
-                    operations: ['create', 'read', 'traverse', 'update', 'delete'],
-                },
-                {
-                    class: S.classes.User,
-                    operations: ['create', 'read', 'traverse', 'update', 'delete'],
-                },
-                {
-                    class: S.classes.administers_space,
-                    operations: ['create', 'read', 'traverse', 'update', 'delete'],
-                },
-                {
-                    class: S.classes.default_space,
-                    operations: ['create', 'read', 'traverse', 'update', 'delete'],
-                },
                 {
                     class: S.classes.member_of_group,
                     operations: ['create', 'read', 'traverse', 'update', 'delete'],
                 },
-                {
-                    class: S.classes.member_of_space,
-                    operations: ['create', 'read', 'traverse', 'update', 'delete'],
-                },
-                {
-                    class: S.classes.owns_space,
-                    operations: ['create', 'read', 'traverse', 'update', 'delete'],
-                },
-                {
-                    class: K.classes.extends_with,
-                    operations: ['create', 'read', 'traverse', 'delete'],
-                },
+                { class: K.classes.extends_with, operations: ['create', 'read', 'traverse', 'delete'] },
             ],
             authority: {
                 grant: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'revoke'],
@@ -79,10 +48,10 @@ const applicationRequirements = requirements({
         {
             subject: S.core.nodes.member,
             functions: [
-                K.classes.View.static.methods.resolve,
                 K.functions.introspect,
-                K.functions.mutate,
                 K.functions.query,
+                K.functions.mutate,
+                K.classes.View.static.methods.resolve,
             ],
         },
     ],

package/dist/functions/group/assign-user-to-group.d.ts

@@ -0,0 +1,27 @@
+export declare const assignUser: import("@astrale-os/sdk/workflow").WorkflowDefinition<import("@astrale-os/sdk/schema").DefinedSchema<"shell.astrale.ai", import("@astrale-os/sdk/schema").ResolvedDomainOfInput<"shell.astrale.ai", import("../../schema/index.js").ShellSchemaInput>>, "Group.assignUser", Readonly<Record<never, never>>, {
+    readonly GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE: {
+        readonly family: 'CONFLICT';
+        readonly message: 'Shell must be able to traverse both membership endpoints before confirming membership.';
+        readonly details: import("zod").ZodObject<{}, import("zod/v4/core").$strict>;
+    };
+    readonly INVALID_GROUP_MEMBERSHIP_REFERENCE: {
+        readonly family: 'VALIDATION_ERROR';
+        readonly message: 'User and group must be exact canonical @NodeId paths.';
+        readonly details: import("zod").ZodObject<{}, import("zod/v4/core").$strict>;
+    };
+    readonly GROUP_MEMBERSHIP_CONFLICT: {
+        readonly family: 'CONFLICT';
+        readonly message: 'Membership changed concurrently; retry the operation.';
+        readonly details: import("zod").ZodObject<{
+            cause: import("zod").ZodString;
+        }, import("zod/v4/core").$strict>;
+    };
+    readonly GROUP_MEMBERSHIP_UNCONFIRMED: {
+        readonly family: 'CONFLICT';
+        readonly message: 'The requested membership could not be confirmed; retry the operation.';
+        readonly details: import("zod").ZodObject<{
+            cause: import("zod").ZodString;
+            outcomeKnown: import("zod").ZodLiteral<false>;
+        }, import("zod/v4/core").$strict>;
+    };
+}>;

package/dist/functions/group/assign-user-to-group.js

@@ -0,0 +1,4 @@
+import { defineWorkflow } from '@astrale-os/sdk/workflow';
+import { changeGroupMembership } from './change-user-group-membership.js';
+import { groupMembershipErrors } from './group-membership-errors.js';
+export const assignUser = defineWorkflow()('Group.assignUser', { errors: groupMembershipErrors }, (context) => changeGroupMembership(context, true));

package/dist/functions/group/change-user-group-membership.d.ts

@@ -0,0 +1,7 @@
+import type { WorkflowContext } from '@astrale-os/sdk/workflow';
+import type { S, Shell } from '../../schema/index.js';
+import type { groupMembershipErrors } from './group-membership-errors.js';
+type GroupCallable = typeof S.classes.Group.static.methods.assignUser | typeof S.classes.Group.static.methods.unassignUser;
+type Context = WorkflowContext<GroupCallable, Shell, Readonly<Record<never, never>>, typeof groupMembershipErrors>;
+export declare function changeGroupMembership(context: Context, present: boolean): Promise<{}>;
+export {};

package/dist/functions/group/change-user-group-membership.js

@@ -0,0 +1,34 @@
+import { setGroupMembership } from '../../mutations/group/index.js';
+import { readGroupMembership, readGroupMembershipEndpoints, } from '../../queries/group/index.js';
+import { canonicalNodeId } from '../../utils/canonical-node-path/index.js';
+const matches = (state, present) => state.membership === present && state.authority === present;
+export async function changeGroupMembership(context, present) {
+    const invalid = () => context.error('INVALID_GROUP_MEMBERSHIP_REFERENCE', {});
+    const membership = {
+        user: canonicalNodeId(context.input.user, invalid),
+        group: canonicalNodeId(context.input.group, invalid),
+    };
+    const observe = async () => {
+        const endpoints = await context.query(readGroupMembershipEndpoints, membership);
+        if (!endpoints.visible)
+            throw context.error('GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE', {});
+        const current = await context.query(readGroupMembership, membership);
+        return { ...current, endpoints: endpoints.guard };
+    };
+    const current = await context.step.run('observe-membership', observe);
+    if (matches(current, present))
+        return {};
+    const result = await context.step.run('mutate-membership', () => context.mutate(setGroupMembership, { ...membership, current, present }));
+    if (result.ok)
+        return {};
+    if (result.outcomeKnown) {
+        throw context.error('GROUP_MEMBERSHIP_CONFLICT', { cause: result.code });
+    }
+    const recovered = await context.step.run('recover-membership', observe);
+    if (matches(recovered, present))
+        return {};
+    throw context.error('GROUP_MEMBERSHIP_UNCONFIRMED', {
+        cause: result.code,
+        outcomeKnown: false,
+    });
+}

package/dist/functions/group/group-membership-errors.d.ts

@@ -0,0 +1,28 @@
+import { z } from 'zod';
+export declare const groupMembershipErrors: {
+    readonly GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE: {
+        readonly family: 'CONFLICT';
+        readonly message: 'Shell must be able to traverse both membership endpoints before confirming membership.';
+        readonly details: z.ZodObject<{}, z.core.$strict>;
+    };
+    readonly INVALID_GROUP_MEMBERSHIP_REFERENCE: {
+        readonly family: 'VALIDATION_ERROR';
+        readonly message: 'User and group must be exact canonical @NodeId paths.';
+        readonly details: z.ZodObject<{}, z.core.$strict>;
+    };
+    readonly GROUP_MEMBERSHIP_CONFLICT: {
+        readonly family: 'CONFLICT';
+        readonly message: 'Membership changed concurrently; retry the operation.';
+        readonly details: z.ZodObject<{
+            cause: z.ZodString;
+        }, z.core.$strict>;
+    };
+    readonly GROUP_MEMBERSHIP_UNCONFIRMED: {
+        readonly family: 'CONFLICT';
+        readonly message: 'The requested membership could not be confirmed; retry the operation.';
+        readonly details: z.ZodObject<{
+            cause: z.ZodString;
+            outcomeKnown: z.ZodLiteral<false>;
+        }, z.core.$strict>;
+    };
+};

package/dist/functions/group/group-membership-errors.js

@@ -0,0 +1,23 @@
+import { z } from 'zod';
+export const groupMembershipErrors = {
+    GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE: {
+        family: 'CONFLICT',
+        message: 'Shell must be able to traverse both membership endpoints before confirming membership.',
+        details: z.strictObject({}),
+    },
+    INVALID_GROUP_MEMBERSHIP_REFERENCE: {
+        family: 'VALIDATION_ERROR',
+        message: 'User and group must be exact canonical @NodeId paths.',
+        details: z.strictObject({}),
+    },
+    GROUP_MEMBERSHIP_CONFLICT: {
+        family: 'CONFLICT',
+        message: 'Membership changed concurrently; retry the operation.',
+        details: z.strictObject({ cause: z.string() }),
+    },
+    GROUP_MEMBERSHIP_UNCONFIRMED: {
+        family: 'CONFLICT',
+        message: 'The requested membership could not be confirmed; retry the operation.',
+        details: z.strictObject({ cause: z.string(), outcomeKnown: z.literal(false) }),
+    },
+};

package/dist/functions/group/index.d.ts

@@ -1,3 +1,2 @@
-export { assignGroupUserWorkflow } from './assign.js';
-export { changeMembership } from './change.js';
-export { unassignGroupUserWorkflow } from './unassign.js';
+export { assignUser } from './assign-user-to-group.js';
+export { unassignUser } from './unassign-user-from-group.js';

package/dist/functions/group/index.js

@@ -1,3 +1,2 @@
-export { assignGroupUserWorkflow } from './assign.js';
-export { changeMembership } from './change.js';
-export { unassignGroupUserWorkflow } from './unassign.js';
+export { assignUser } from './assign-user-to-group.js';
+export { unassignUser } from './unassign-user-from-group.js';

package/dist/functions/group/unassign-user-from-group.d.ts

@@ -0,0 +1,27 @@
+export declare const unassignUser: import("@astrale-os/sdk/workflow").WorkflowDefinition<import("@astrale-os/sdk/schema").DefinedSchema<"shell.astrale.ai", import("@astrale-os/sdk/schema").ResolvedDomainOfInput<"shell.astrale.ai", import("../../schema/index.js").ShellSchemaInput>>, "Group.unassignUser", Readonly<Record<never, never>>, {
+    readonly GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE: {
+        readonly family: 'CONFLICT';
+        readonly message: 'Shell must be able to traverse both membership endpoints before confirming membership.';
+        readonly details: import("zod").ZodObject<{}, import("zod/v4/core").$strict>;
+    };
+    readonly INVALID_GROUP_MEMBERSHIP_REFERENCE: {
+        readonly family: 'VALIDATION_ERROR';
+        readonly message: 'User and group must be exact canonical @NodeId paths.';
+        readonly details: import("zod").ZodObject<{}, import("zod/v4/core").$strict>;
+    };
+    readonly GROUP_MEMBERSHIP_CONFLICT: {
+        readonly family: 'CONFLICT';
+        readonly message: 'Membership changed concurrently; retry the operation.';
+        readonly details: import("zod").ZodObject<{
+            cause: import("zod").ZodString;
+        }, import("zod/v4/core").$strict>;
+    };
+    readonly GROUP_MEMBERSHIP_UNCONFIRMED: {
+        readonly family: 'CONFLICT';
+        readonly message: 'The requested membership could not be confirmed; retry the operation.';
+        readonly details: import("zod").ZodObject<{
+            cause: import("zod").ZodString;
+            outcomeKnown: import("zod").ZodLiteral<false>;
+        }, import("zod/v4/core").$strict>;
+    };
+}>;

package/dist/functions/group/unassign-user-from-group.js

@@ -0,0 +1,4 @@
+import { defineWorkflow } from '@astrale-os/sdk/workflow';
+import { changeGroupMembership } from './change-user-group-membership.js';
+import { groupMembershipErrors } from './group-membership-errors.js';
+export const unassignUser = defineWorkflow()('Group.unassignUser', { errors: groupMembershipErrors }, (context) => changeGroupMembership(context, false));

package/dist/functions/user/index.d.ts

@@ -1,3 +1 @@
-import { resolveHomeAction } from './resolve-home.js';
-export { resolveHomeAction };
-export declare const actions: readonly [typeof resolveHomeAction];
+export { invite } from './invite-user.js';

package/dist/functions/user/index.js

@@ -1,3 +1 @@
-import { resolveHomeAction } from './resolve-home.js';
-export { resolveHomeAction };
-export const actions = [resolveHomeAction];
+export { invite } from './invite-user.js';

package/dist/functions/user/invite-user.d.ts

@@ -0,0 +1,30 @@
+import { z } from 'zod';
+export declare const invite: import("@astrale-os/sdk/workflow").WorkflowDefinition<import("@astrale-os/sdk/schema").DefinedSchema<"shell.astrale.ai", import("@astrale-os/sdk/schema").ResolvedDomainOfInput<"shell.astrale.ai", import("../../schema/index.js").ShellSchemaInput>>, "User.invite", {
+    enrollment: import("@astrale-os/sdk/integration").IntegrationDefinition<"shell.enrollment", {
+        invite: import("@astrale-os/sdk/integration").IntegrationOperation<import("../../integrations/user-invitation/index.js").InviteRequest, {
+            invitationId: string;
+            user: string;
+            state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
+        }>;
+    }>;
+}, {
+    readonly INVALID_INVITATION_REFERENCE: {
+        readonly family: "VALIDATION_ERROR";
+        readonly message: "User must be an exact canonical @NodeId path.";
+        readonly details: z.ZodObject<{}, z.core.$strict>;
+    };
+    readonly INVITATION_CONFLICT: {
+        readonly family: "CONFLICT";
+        readonly message: "The invitation conflicts with an existing request.";
+        readonly details: z.ZodObject<{
+            requestId: z.ZodString;
+        }, z.core.$strict>;
+    };
+    readonly INVITATION_REJECTED: {
+        readonly family: "VALIDATION_ERROR";
+        readonly message: "Admin rejected the invitation request.";
+        readonly details: z.ZodObject<{
+            requestId: z.ZodString;
+        }, z.core.$strict>;
+    };
+}>;

package/dist/functions/user/invite-user.js

@@ -0,0 +1,39 @@
+import { defineWorkflow } from '@astrale-os/sdk/workflow';
+import { z } from 'zod';
+import { InvitationRequestFailure } from '../../integrations/user-invitation/index.js';
+import { canonicalNodeId } from '../../utils/canonical-node-path/index.js';
+export const invite = defineWorkflow()('User.invite', {
+    errors: {
+        INVALID_INVITATION_REFERENCE: {
+            family: 'VALIDATION_ERROR',
+            message: 'User must be an exact canonical @NodeId path.',
+            details: z.strictObject({}),
+        },
+        INVITATION_CONFLICT: {
+            family: 'CONFLICT',
+            message: 'The invitation conflicts with an existing request.',
+            details: z.strictObject({ requestId: z.string() }),
+        },
+        INVITATION_REJECTED: {
+            family: 'VALIDATION_ERROR',
+            message: 'Admin rejected the invitation request.',
+            details: z.strictObject({ requestId: z.string() }),
+        },
+    },
+}, async (context) => {
+    const user = canonicalNodeId(context.input.user, () => context.error('INVALID_INVITATION_REFERENCE', {}));
+    const requestId = context.execution.idempotencyKey ?? crypto.randomUUID();
+    try {
+        return await context.step.run('request-invitation', () => context.integrations.enrollment.invite({
+            user,
+            email: context.input.email,
+            requestId,
+            requestedBy: context.caller.principal,
+        }));
+    }
+    catch (cause) {
+        if (cause instanceof InvitationRequestFailure)
+            throw context.error(cause.code, { requestId });
+        throw cause;
+    }
+});

package/dist/index.d.ts

@@ -1 +1 @@
-export { Group, ORIGIN, S, ShellCore, ShellSchema, Space, User, adminGroup, administers_space, belongsToSpace, default_space, defaultSpace, groupAssignUser, groupCore, groupUnassignUser, groupView, homeView, mayAdministerSpace, maySetupUsers, memberGroup, member_of_group, member_of_space, owns_space, ownsSpace, resolveHome, setupAdmin, setupMember, spaceAddUser, spaceCore, spaceRemoveUser, spaceSetDefault, spaceView, userView, type GroupMembershipInput, type GroupMembershipResult, type ResolveHomeResult, type SetDefaultSpaceInput, type SetDefaultSpaceResult, type SetupUserInput, type SetupUserResult, type Shell, type SpaceUserAccess, type SpaceUserAccessInput, type SpaceUserAccessResult, type SpaceUserInput, type SpaceUserResult, } from './schema/index.js';
+export { ShellSchema, S, type Shell, type ShellClasses, type ShellSchemaInput, type InvitationSummary, User, Group, member_of_group, adminGroup, memberGroup, } from './schema/index.js';

package/dist/index.js

@@ -1 +1 @@
-export { Group, ORIGIN, S, ShellCore, ShellSchema, Space, User, adminGroup, administers_space, belongsToSpace, default_space, defaultSpace, groupAssignUser, groupCore, groupUnassignUser, groupView, homeView, mayAdministerSpace, maySetupUsers, memberGroup, member_of_group, member_of_space, owns_space, ownsSpace, resolveHome, setupAdmin, setupMember, spaceAddUser, spaceCore, spaceRemoveUser, spaceSetDefault, spaceView, userView, } from './schema/index.js';
+export { ShellSchema, S, User, Group, member_of_group, adminGroup, memberGroup, } from './schema/index.js';

package/dist/integrations/index.d.ts

@@ -0,0 +1 @@
+export { integrations } from './integrations.js';

package/dist/integrations/index.js

@@ -0,0 +1 @@
+export { integrations } from './integrations.js';

package/dist/integrations/integrations.d.ts

@@ -0,0 +1,9 @@
+export declare const integrations: {
+    enrollment: import("@astrale-os/sdk/integration").IntegrationDefinition<"shell.enrollment", {
+        invite: import("@astrale-os/sdk/integration").IntegrationOperation<import("./user-invitation/index.js").InviteRequest, {
+            invitationId: string;
+            user: string;
+            state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
+        }>;
+    }>;
+};

package/dist/integrations/integrations.js

@@ -0,0 +1,2 @@
+import { enrollment } from './user-invitation/index.js';
+export const integrations = { enrollment };