@astrale-domains/shell 0.1.0-beta.23 → 0.1.0-beta.25

package/dist/integrations/integrations.d.ts

@@ -0,0 +1,9 @@
+export declare const integrations: {
+    enrollment: import("@astrale-os/sdk/integration").IntegrationDefinition<"shell.enrollment", {
+        invite: import("@astrale-os/sdk/integration").IntegrationOperation<import("./user-invitation/index.js").InviteRequest, {
+            invitationId: string;
+            user: string;
+            state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
+        }>;
+    }>;
+};

package/dist/integrations/integrations.js

@@ -0,0 +1,2 @@
+import { enrollment } from './user-invitation/index.js';
+export const integrations = { enrollment };

package/dist/integrations/user-invitation/index.d.ts

@@ -0,0 +1,4 @@
+export { enrollment } from './request-user-invitation.js';
+export { InvitationRequestFailure } from './invitation-request-failure.js';
+export { type InviteRequest } from './invite-user-request.js';
+export type { InvitationSummary } from '../../schema/modules/user/index.js';

package/dist/integrations/user-invitation/index.js

@@ -0,0 +1,3 @@
+export { enrollment } from './request-user-invitation.js';
+export { InvitationRequestFailure } from './invitation-request-failure.js';
+export {} from './invite-user-request.js';

package/dist/integrations/user-invitation/invitation-request-failure.d.ts

@@ -0,0 +1,5 @@
+/** Expected business refusal from the invitation service, without its response body. */
+export declare class InvitationRequestFailure extends Error {
+    readonly code: 'INVITATION_CONFLICT' | 'INVITATION_REJECTED';
+    constructor(code: 'INVITATION_CONFLICT' | 'INVITATION_REJECTED');
+}

package/dist/integrations/user-invitation/invitation-request-failure.js

@@ -0,0 +1,9 @@
+/** Expected business refusal from the invitation service, without its response body. */
+export class InvitationRequestFailure extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = 'InvitationRequestFailure';
+    }
+}

package/dist/integrations/user-invitation/invite-user-request.d.ts

@@ -0,0 +1,6 @@
+export interface InviteRequest {
+    readonly requestId: string;
+    readonly user: string;
+    readonly email: string;
+    readonly requestedBy: string;
+}

package/dist/integrations/user-invitation/invite-user-request.js

@@ -0,0 +1 @@
+export {};

package/dist/integrations/user-invitation/request-user-invitation.d.ts

@@ -0,0 +1,8 @@
+import type { InviteRequest } from './invite-user-request.js';
+export declare const enrollment: import("@astrale-os/sdk/integration").IntegrationDefinition<"shell.enrollment", {
+    invite: import("@astrale-os/sdk/integration").IntegrationOperation<InviteRequest, {
+        invitationId: string;
+        user: string;
+        state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
+    }>;
+}>;

package/dist/integrations/user-invitation/request-user-invitation.js

@@ -0,0 +1,9 @@
+import { defineIntegration } from '@astrale-os/sdk/integration';
+export const enrollment = defineIntegration({
+    id: 'shell.enrollment',
+    operations: {
+        invite: defineIntegration.operation({
+            replay: ({ requestId }) => ({ kind: 'keyed', source: 'input', key: requestId }),
+        }),
+    },
+});

package/dist/mutations/group/index.d.ts

@@ -1 +1 @@
-export { changeGroupMembership, type GroupMembershipChange, type GroupMembershipChangeResult, } from './membership.js';
+export { setGroupMembership } from './set-user-group-membership.js';

package/dist/mutations/group/index.js

@@ -1 +1 @@
-export { changeGroupMembership, } from './membership.js';
+export { setGroupMembership } from './set-user-group-membership.js';

package/dist/mutations/group/set-user-group-membership.d.ts

@@ -0,0 +1,26 @@
+import type { NodeId } from '@astrale-os/sdk/graph/node';
+import type { QueryEdgeAST, QueryNodeAST } from '@astrale-os/sdk/query';
+import { type QueryPrecondition } from '@astrale-os/sdk/mutation';
+interface GroupMembership {
+    readonly user: NodeId;
+    readonly group: NodeId;
+}
+interface GroupMembershipObservation {
+    readonly membership: boolean;
+    readonly authority: boolean;
+    readonly guard: QueryPrecondition<QueryEdgeAST>;
+    readonly endpoints: QueryPrecondition<QueryNodeAST>;
+}
+interface Change extends GroupMembership {
+    readonly current: GroupMembershipObservation;
+    readonly present: boolean;
+}
+type ChangeResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly code: string;
+    readonly outcomeKnown: boolean;
+};
+export declare const setGroupMembership: import("@astrale-os/sdk/mutation").Mutation<import("@astrale-os/sdk/schema").ResolvedDomainOfInput<"shell.astrale.ai", import("../../schema/index.js").ShellSchemaInput>, Change, ChangeResult>;
+export {};

package/dist/mutations/group/set-user-group-membership.js

@@ -0,0 +1,29 @@
+import { defineMutation } from '@astrale-os/sdk/mutation';
+export const setGroupMembership = defineMutation()((domain) => ({
+    id: 'shell.group.membership.set',
+    build(input, mutation) {
+        mutation.expect.query(input.current.endpoints);
+        mutation.expect.query(input.current.guard);
+        const endpoints = { source: input.user, target: input.group };
+        const changes = [
+            { class: domain.classes.member_of_group, current: input.current.membership },
+            { class: domain.dependencies.kernel.classes.extends_with, current: input.current.authority },
+        ];
+        for (const edge of changes) {
+            if (edge.current === input.present)
+                continue;
+            if (input.present)
+                mutation.createEdge({ class: edge.class, ...endpoints });
+            else
+                mutation.deleteEdge({ class: edge.class, ...endpoints });
+        }
+    },
+    project: () => ({ ok: true }),
+    reject: (failure) => {
+        if (failure.outcomeKnown &&
+            failure.code !== 'MUTATION_PRECONDITION_FAILED' &&
+            failure.code !== 'MUTATION_CONFLICT')
+            throw failure;
+        return { ok: false, code: failure.code, outcomeKnown: failure.outcomeKnown };
+    },
+}));

package/dist/providers/admin-enrollment/create-admin-enrollment-provider.d.ts

@@ -0,0 +1,7 @@
+export declare function enrollmentProvider(environment: unknown): import("@astrale-os/sdk/integration").Provider<import("@astrale-os/sdk/integration").IntegrationDefinition<"shell.enrollment", {
+    invite: import("@astrale-os/sdk/integration").IntegrationOperation<import("../../integrations/user-invitation/index.js").InviteRequest, {
+        invitationId: string;
+        user: string;
+        state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
+    }>;
+}>>;

package/dist/providers/admin-enrollment/create-admin-enrollment-provider.js

@@ -0,0 +1,78 @@
+import { TransportError } from '@astrale-os/sdk/client';
+import { defineProvider } from '@astrale-os/sdk/integration';
+import { z } from 'zod';
+import { enrollment, InvitationRequestFailure } from '../../integrations/user-invitation/index.js';
+import { decodeAdminInvitationResponse } from './decode-admin-invitation-response.js';
+import { readReply } from './read-enrollment-response.js';
+// Environment is a representation boundary, unlike already-admitted handler input.
+const configuration = z.object({ ENROLLMENT_INGRESS_URL: z.string().url() });
+export function enrollmentProvider(environment) {
+    const input = configuration.parse(environment);
+    const endpoint = new URL(input.ENROLLMENT_INGRESS_URL);
+    if (endpoint.protocol !== 'https:' ||
+        endpoint.username ||
+        endpoint.password ||
+        endpoint.hash ||
+        endpoint.search) {
+        throw new TypeError('Enrollment ingress must be an HTTPS URL without credentials, query or hash.');
+    }
+    const audience = endpoint.href;
+    return defineProvider(enrollment, {
+        async invite(input, execution) {
+            if (execution.auth === undefined)
+                throw new Error('Authenticated Shell invocation required.');
+            // Mint per attempt, using only the current invocation's Domain-self identity.
+            const credential = await execution.auth.mint({ audience, ttlSeconds: 60 });
+            execution.signal.throwIfAborted();
+            const remaining = execution.deadline - Date.now();
+            if (remaining <= 0) {
+                throw TransportError.invocation('Enrollment deadline exceeded.', {
+                    phase: 'timeout',
+                    delivery: 'not-sent',
+                });
+            }
+            // No automatic HTTP retry. A timeout after send has an unknown effect.
+            const signal = AbortSignal.any([execution.signal, AbortSignal.timeout(remaining)]);
+            const response = await fetch(audience, {
+                method: 'POST',
+                // Workers reject redirect:error before sending. Manual preserves the refusal:
+                // every 3xx is rejected below, without forwarding the proof to its Location.
+                redirect: 'manual',
+                headers: {
+                    Authorization: `Bearer ${credential}`,
+                    'Content-Type': 'application/json',
+                    Accept: 'application/json',
+                    'Idempotency-Key': input.requestId,
+                },
+                body: JSON.stringify(input),
+                signal,
+            }).catch((cause) => {
+                if (!(cause instanceof TypeError) && !(cause instanceof DOMException))
+                    throw cause;
+                throw TransportError.invocation('Admin enrollment transport failed.', {
+                    phase: signal.aborted ? 'timeout' : 'unknown',
+                    delivery: 'unknown',
+                });
+            });
+            if (!response.ok) {
+                await response.body?.cancel();
+                if (response.status === 409)
+                    throw new InvitationRequestFailure('INVITATION_CONFLICT');
+                if (response.status === 400 || response.status === 422) {
+                    throw new InvitationRequestFailure('INVITATION_REJECTED');
+                }
+                // Shell admission already happened. A refused service credential is not a new
+                // authorization decision about the caller, and no upstream body is exposed.
+                throw TransportError.invocation('Admin enrollment request was not completed.', {
+                    phase: 'receive',
+                    delivery: 'unknown',
+                });
+            }
+            const result = decodeAdminInvitationResponse(await readReply(response));
+            if (result.requestId !== input.requestId || result.user !== input.user) {
+                throw new TypeError('Admin enrollment response does not match the request.');
+            }
+            return { invitationId: result.invitationId, user: result.user, state: result.state };
+        },
+    });
+}

package/dist/providers/admin-enrollment/decode-admin-invitation-response.d.ts

@@ -0,0 +1,7 @@
+export declare function decodeAdminInvitationResponse(value: unknown): {
+    invitationId: string;
+    user: string;
+    state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
+} & {
+    requestId: string;
+};

package/dist/providers/admin-enrollment/decode-admin-invitation-response.js

@@ -0,0 +1,20 @@
+import { z } from 'zod';
+// Codec du JSON HTTP entrant ; la valeur admise satisfait le contrat de l'Integration.
+const httpReply = z.object({
+    requestId: z.string().min(1),
+    invitationId: z.string().min(1),
+    user: z.string().min(1),
+    state: z.enum([
+        'pending',
+        'accepted',
+        'registering',
+        'registered',
+        'completed',
+        'cancelled',
+        'expired',
+        'failed',
+    ]),
+});
+export function decodeAdminInvitationResponse(value) {
+    return httpReply.parse(value);
+}

package/dist/providers/admin-enrollment/index.d.ts

@@ -0,0 +1 @@
+export { enrollmentProvider } from './create-admin-enrollment-provider.js';

package/dist/providers/admin-enrollment/index.js

@@ -0,0 +1 @@
+export { enrollmentProvider } from './create-admin-enrollment-provider.js';

package/dist/providers/admin-enrollment/read-enrollment-response.d.ts

@@ -0,0 +1 @@
+export declare function readReply(response: Response): Promise<unknown>;

package/dist/providers/admin-enrollment/read-enrollment-response.js

@@ -0,0 +1,34 @@
+export async function readReply(response) {
+    if (!response.headers.get('content-type')?.toLowerCase().startsWith('application/json')) {
+        await response.body?.cancel();
+        throw new TypeError('Expected a JSON enrollment response.');
+    }
+    const reader = response.body?.getReader();
+    if (!reader)
+        throw new TypeError('Missing enrollment response body.');
+    const chunks = [];
+    let size = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            size += value.byteLength;
+            if (size > 16384) {
+                await reader.cancel();
+                throw new TypeError('Enrollment response exceeds 16 KiB.');
+            }
+            chunks.push(value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+}

package/dist/queries/group/index.d.ts

@@ -0,0 +1,2 @@
+export { readGroupMembership, type GroupMembershipObservation, type GroupMembershipState, } from './read-user-group-membership.js';
+export { readGroupMembershipEndpoints } from './read-group-membership-endpoints.js';

package/dist/queries/group/index.js

@@ -0,0 +1,2 @@
+export { readGroupMembership, } from './read-user-group-membership.js';
+export { readGroupMembershipEndpoints } from './read-group-membership-endpoints.js';

package/dist/queries/group/read-group-membership-endpoints.d.ts

@@ -0,0 +1,13 @@
+import type { NodeId } from '@astrale-os/sdk/graph/node';
+import type { QueryPrecondition } from '@astrale-os/sdk/mutation';
+import { type QueryNodeAST } from '@astrale-os/sdk/query';
+interface Endpoints {
+    readonly user: NodeId;
+    readonly group: NodeId;
+}
+export interface GroupMembershipEndpoints {
+    readonly visible: boolean;
+    readonly guard: QueryPrecondition<QueryNodeAST>;
+}
+export declare const readGroupMembershipEndpoints: import("@astrale-os/sdk/query").SingleQueryDefinition<import("@astrale-os/sdk/schema").ResolvedDomainOfInput<"shell.astrale.ai", import("../../schema/index.js").ShellSchemaInput>, Endpoints, GroupMembershipEndpoints>;
+export {};

package/dist/queries/group/read-group-membership-endpoints.js

@@ -0,0 +1,18 @@
+import { Path } from '@astrale-os/sdk/graph/path';
+import { defineQuery, Query, queryResult, } from '@astrale-os/sdk/query';
+export const readGroupMembershipEndpoints = defineQuery()(() => ({
+    id: 'shell.group.membership.endpoints',
+    page: { size: 2 },
+    pagination: { maximumPages: 2 },
+    build: ({ user, group }) => Query.from({ nodes: [Path.id(user), Path.id(group)] }).select({
+        kind: 'nodes',
+        projection: { kind: 'reference' },
+    }),
+    project(pages, input, { ast, complete }) {
+        const ids = queryResult.completeNodeIds(pages, 'Shell membership endpoints');
+        return {
+            visible: ids.includes(input.user) && ids.includes(input.group),
+            guard: { query: ast, equals: complete },
+        };
+    },
+}));

package/dist/queries/group/read-user-group-membership.d.ts

@@ -0,0 +1,15 @@
+import type { NodeId } from '@astrale-os/sdk/graph/node';
+import type { QueryPrecondition } from '@astrale-os/sdk/mutation';
+import { type QueryEdgeAST } from '@astrale-os/sdk/query';
+export interface GroupMembership {
+    readonly user: NodeId;
+    readonly group: NodeId;
+}
+export interface GroupMembershipState {
+    readonly membership: boolean;
+    readonly authority: boolean;
+}
+export interface GroupMembershipObservation extends GroupMembershipState {
+    readonly guard: QueryPrecondition<QueryEdgeAST>;
+}
+export declare const readGroupMembership: import("@astrale-os/sdk/query").SingleQueryDefinition<import("@astrale-os/sdk/schema").ResolvedDomainOfInput<"shell.astrale.ai", import("../../schema/index.js").ShellSchemaInput>, GroupMembership, GroupMembershipObservation>;

package/dist/queries/group/read-user-group-membership.js

@@ -0,0 +1,35 @@
+import { Query, defineQuery, queryResult, } from '@astrale-os/sdk/query';
+export const readGroupMembership = defineQuery()((domain) => ({
+    id: 'shell.group.membership.read',
+    build({ user, group }) {
+        const edges = Query.from({
+            edges: [domain.classes.member_of_group, domain.dependencies.kernel.classes.extends_with],
+        });
+        return edges
+            .filter({ binding: edges.source, predicate: { kind: 'identity.equal', identity: user } })
+            .filter({ binding: edges.target, predicate: { kind: 'identity.equal', identity: group } })
+            .select({
+            kind: 'edges',
+            projection: { edge: 'value', source: 'reference', target: 'reference' },
+        });
+    },
+    pagination: { maximumPages: 4 },
+    project(pages, _input, { ast, complete }) {
+        let membership = false;
+        let authority = false;
+        for (const page of pages) {
+            for (const item of queryResult.edgeItems(page, 'Shell group membership')) {
+                if (item.edge.kind !== 'value')
+                    throw new TypeError('Expected an Edge value.');
+                if (item.edge.value.class === domain.classes.member_of_group.key)
+                    membership = true;
+                else if (item.edge.value.class === domain.dependencies.kernel.classes.extends_with.key) {
+                    authority = true;
+                }
+                else
+                    throw new TypeError('Unexpected Edge Class.');
+            }
+        }
+        return { membership, authority, guard: { query: ast, equals: complete } };
+    },
+}));

package/dist/runtime.d.ts

@@ -1,13 +1,98 @@
 import { type Runtime } from '@astrale-os/sdk/runtime';
-import { workflows } from './functions/registry/index.js';
-import { actions } from './functions/user/index.js';
 import type { ShellSchema } from './schema/index.js';
-declare const integrations: {};
-declare const initialize: () => {
-    providers: {};
+import { integrations } from './integrations/index.js';
+declare const initialize: (environment: unknown) => {
+    providers: {
+        enrollment: import("@astrale-os/sdk/integration").Provider<import("@astrale-os/sdk/integration").IntegrationDefinition<"shell.enrollment", {
+            invite: import("@astrale-os/sdk/integration").IntegrationOperation<import("./integrations/user-invitation/index.js").InviteRequest, {
+                invitationId: string;
+                user: string;
+                state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
+            }>;
+        }>>;
+    };
 };
-declare const runtime: Runtime<typeof ShellSchema, typeof integrations, typeof initialize, [
-    ...typeof actions,
-    ...typeof workflows
-]>;
+declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDefinition<import("@astrale-os/sdk/schema").DefinedSchema<"shell.astrale.ai", import("@astrale-os/sdk/schema").ResolvedDomainOfInput<"shell.astrale.ai", import("./schema/index.js").ShellSchemaInput>>, "User.invite", {
+    enrollment: import("@astrale-os/sdk/integration").IntegrationDefinition<"shell.enrollment", {
+        invite: import("@astrale-os/sdk/integration").IntegrationOperation<import("./integrations/user-invitation/index.js").InviteRequest, {
+            invitationId: string;
+            user: string;
+            state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
+        }>;
+    }>;
+}, {
+    readonly INVALID_INVITATION_REFERENCE: {
+        readonly family: "VALIDATION_ERROR";
+        readonly message: "User must be an exact canonical @NodeId path.";
+        readonly details: import("zod").ZodObject<{}, import("zod/v4/core").$strict>;
+    };
+    readonly INVITATION_CONFLICT: {
+        readonly family: "CONFLICT";
+        readonly message: "The invitation conflicts with an existing request.";
+        readonly details: import("zod").ZodObject<{
+            requestId: import("zod").ZodString;
+        }, import("zod/v4/core").$strict>;
+    };
+    readonly INVITATION_REJECTED: {
+        readonly family: "VALIDATION_ERROR";
+        readonly message: "Admin rejected the invitation request.";
+        readonly details: import("zod").ZodObject<{
+            requestId: import("zod").ZodString;
+        }, import("zod/v4/core").$strict>;
+    };
+}>, import("@astrale-os/sdk/workflow").WorkflowDefinition<import("@astrale-os/sdk/schema").DefinedSchema<"shell.astrale.ai", import("@astrale-os/sdk/schema").ResolvedDomainOfInput<"shell.astrale.ai", import("./schema/index.js").ShellSchemaInput>>, "Group.assignUser", Readonly<Record<never, never>>, {
+    readonly GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE: {
+        readonly family: 'CONFLICT';
+        readonly message: 'Shell must be able to traverse both membership endpoints before confirming membership.';
+        readonly details: import("zod").ZodObject<{}, import("zod/v4/core").$strict>;
+    };
+    readonly INVALID_GROUP_MEMBERSHIP_REFERENCE: {
+        readonly family: 'VALIDATION_ERROR';
+        readonly message: 'User and group must be exact canonical @NodeId paths.';
+        readonly details: import("zod").ZodObject<{}, import("zod/v4/core").$strict>;
+    };
+    readonly GROUP_MEMBERSHIP_CONFLICT: {
+        readonly family: 'CONFLICT';
+        readonly message: 'Membership changed concurrently; retry the operation.';
+        readonly details: import("zod").ZodObject<{
+            cause: import("zod").ZodString;
+        }, import("zod/v4/core").$strict>;
+    };
+    readonly GROUP_MEMBERSHIP_UNCONFIRMED: {
+        readonly family: 'CONFLICT';
+        readonly message: 'The requested membership could not be confirmed; retry the operation.';
+        readonly details: import("zod").ZodObject<{
+            cause: import("zod").ZodString;
+            outcomeKnown: import("zod").ZodLiteral<false>;
+        }, import("zod/v4/core").$strict>;
+    };
+}>, import("@astrale-os/sdk/workflow").WorkflowDefinition<import("@astrale-os/sdk/schema").DefinedSchema<"shell.astrale.ai", import("@astrale-os/sdk/schema").ResolvedDomainOfInput<"shell.astrale.ai", import("./schema/index.js").ShellSchemaInput>>, "Group.unassignUser", Readonly<Record<never, never>>, {
+    readonly GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE: {
+        readonly family: 'CONFLICT';
+        readonly message: 'Shell must be able to traverse both membership endpoints before confirming membership.';
+        readonly details: import("zod").ZodObject<{}, import("zod/v4/core").$strict>;
+    };
+    readonly INVALID_GROUP_MEMBERSHIP_REFERENCE: {
+        readonly family: 'VALIDATION_ERROR';
+        readonly message: 'User and group must be exact canonical @NodeId paths.';
+        readonly details: import("zod").ZodObject<{}, import("zod/v4/core").$strict>;
+    };
+    readonly GROUP_MEMBERSHIP_CONFLICT: {
+        readonly family: 'CONFLICT';
+        readonly message: 'Membership changed concurrently; retry the operation.';
+        readonly details: import("zod").ZodObject<{
+            cause: import("zod").ZodString;
+        }, import("zod/v4/core").$strict>;
+    };
+    readonly GROUP_MEMBERSHIP_UNCONFIRMED: {
+        readonly family: 'CONFLICT';
+        readonly message: 'The requested membership could not be confirmed; retry the operation.';
+        readonly details: import("zod").ZodObject<{
+            cause: import("zod").ZodString;
+            outcomeKnown: import("zod").ZodLiteral<false>;
+        }, import("zod/v4/core").$strict>;
+    };
+}>];
+export type ShellRuntime = Runtime<ShellSchema, typeof integrations, typeof initialize, typeof functions>;
+declare const runtime: ShellRuntime;
 export default runtime;

package/dist/runtime.js

@@ -1,11 +1,15 @@
 import { defineRuntime } from '@astrale-os/sdk/runtime';
-import { workflows } from '#functions/registry';
-import { actions } from '#functions/user';
-const integrations = {};
-const initialize = () => ({ providers: {} });
+import { assignUser, unassignUser } from './functions/group/index.js';
+import { invite } from './functions/user/index.js';
+import { integrations } from './integrations/index.js';
+import { enrollmentProvider } from './providers/admin-enrollment/index.js';
+const initialize = (environment) => ({
+    providers: { enrollment: enrollmentProvider(environment) },
+});
+const functions = [invite, assignUser, unassignUser];
 const runtime = defineRuntime()({
     integrations,
     initialize,
-    functions: [...actions, ...workflows],
+    functions,
 });
 export default runtime;

package/dist/schema/index.d.ts

@@ -1,4 +1,4 @@
-export { ORIGIN, S, ShellCore, ShellSchema, type GroupMembershipInput, type GroupMembershipResult, type ResolveHomeResult, type SetDefaultSpaceInput, type SetDefaultSpaceResult, type SetupUserInput, type SetupUserResult, type Shell, type SpaceUserAccess, type SpaceUserAccessInput, type SpaceUserAccessResult, type SpaceUserInput, type SpaceUserResult, } from './schema.js';
-export { Group, adminGroup, groupAssignUser, groupCore, groupUnassignUser, groupView, maySetupUsers, memberGroup, member_of_group, } from './modules/group/index.js';
-export { Space, administers_space, belongsToSpace, default_space, defaultSpace, mayAdministerSpace, member_of_space, owns_space, ownsSpace, spaceAddUser, spaceCore, spaceRemoveUser, spaceSetDefault, spaceView, } from './modules/space/index.js';
-export { User, homeView, resolveHome, setupAdmin, setupMember, userView, } from './modules/user/index.js';
+export { ShellSchema, S, type Shell, type ShellClasses, type ShellSchemaInput } from './schema.js';
+export { User } from './modules/user/index.js';
+export type { InvitationSummary } from './modules/user/index.js';
+export { Group, member_of_group, adminGroup, memberGroup } from './modules/group/index.js';

package/dist/schema/index.js

@@ -1,4 +1,3 @@
-export { ORIGIN, S, ShellCore, ShellSchema, } from './schema.js';
-export { Group, adminGroup, groupAssignUser, groupCore, groupUnassignUser, groupView, maySetupUsers, memberGroup, member_of_group, } from '#schema/modules/group';
-export { Space, administers_space, belongsToSpace, default_space, defaultSpace, mayAdministerSpace, member_of_space, owns_space, ownsSpace, spaceAddUser, spaceCore, spaceRemoveUser, spaceSetDefault, spaceView, } from '#schema/modules/space';
-export { User, homeView, resolveHome, setupAdmin, setupMember, userView, } from '#schema/modules/user';
+export { ShellSchema, S } from './schema.js';
+export { User } from './modules/user/index.js';
+export { Group, member_of_group, adminGroup, memberGroup } from './modules/group/index.js';

package/dist/schema/modules/group/classes/group.d.ts

@@ -1,17 +1,15 @@
 import { nodeClass, type ClassIcon, type Kernel } from '@astrale-os/sdk/schema';
-import { groupAssignUser } from '../functions/assign-user.js';
-import { groupUnassignUser } from '../functions/unassign-user.js';
+import { assignUser, unassignUser } from '../functions/index.js';
 export interface GroupConfig {
-    readonly description: string;
+    readonly icon: ClassIcon;
     readonly extends: readonly [
         Kernel['classes']['Identity'],
         Kernel['classes']['Named'],
         Kernel['classes']['Descriptable']
     ];
-    readonly icon: ClassIcon;
     readonly methods: {
-        readonly assignUser: typeof groupAssignUser;
-        readonly unassignUser: typeof groupUnassignUser;
+        readonly assignUser: typeof assignUser;
+        readonly unassignUser: typeof unassignUser;
     };
 }
 export declare const Group: ReturnType<typeof nodeClass<GroupConfig>>;

package/dist/schema/modules/group/classes/group.js

@@ -1,10 +1,8 @@
-import { classIcon, K, nodeClass } from '@astrale-os/sdk/schema';
+import { K, classIcon, nodeClass } from '@astrale-os/sdk/schema';
 import { UsersRound } from '@astrale-os/sdk/schema/icons';
-import { groupAssignUser } from '../functions/assign-user.js';
-import { groupUnassignUser } from '../functions/unassign-user.js';
+import { assignUser, unassignUser } from '../functions/index.js';
 export const Group = nodeClass({
-    description: 'A named compositional Shell Identity.',
-    extends: [K.classes.Identity, K.classes.Named, K.classes.Descriptable],
     icon: classIcon.lucide(UsersRound),
-    methods: { assignUser: groupAssignUser, unassignUser: groupUnassignUser },
+    extends: [K.classes.Identity, K.classes.Named, K.classes.Descriptable],
+    methods: { assignUser, unassignUser },
 });

package/dist/schema/modules/group/classes/index.d.ts

@@ -0,0 +1,2 @@
+export { Group } from './group.js';
+export { member_of_group } from './member-of-group.js';

package/dist/schema/modules/group/classes/index.js

@@ -0,0 +1,2 @@
+export { Group } from './group.js';
+export { member_of_group } from './member-of-group.js';

package/dist/schema/modules/group/classes/member-of-group.js

@@ -1,8 +1,7 @@
 import { edgeClass } from '@astrale-os/sdk/schema';
-import { User } from '#schema/modules/user';
+import { User } from '../../user/index.js';
 import { Group } from './group.js';
 export const member_of_group = edgeClass.directed({
-    source: { as: 'user', accepts: [User], outgoing: '0..*' },
+    source: { as: 'user', accepts: [() => User], outgoing: '0..*' },
     target: { as: 'group', accepts: [() => Group], incoming: '0..*' },
-    description: 'Shell role membership paired atomically with Kernel authority composition.',
 });

package/dist/schema/modules/group/core/administrators-group.js

@@ -0,0 +1,6 @@
+import { K, core } from '@astrale-os/sdk/schema';
+import { Group } from '../classes/group.js';
+export const adminGroup = core.node(() => Group, {
+    [K.classes.Named.properties.name.key]: 'Administrators',
+    [K.classes.Descriptable.properties.description.key]: 'Instance administrators.',
+});

package/dist/schema/modules/group/core/index.d.ts

@@ -0,0 +1,2 @@
+export { adminGroup } from './administrators-group.js';
+export { memberGroup } from './members-group.js';