@astrale-domains/shell 0.1.0-beta.26 → 0.1.0-beta.28

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## [0.1.0-beta.28](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.27...shell-domain-v0.1.0-beta.28) (2026-09-08)
+
+
+### ⚠ BREAKING CHANGES
+
+* **core:** support users and groups as Shell members ([#205](https://github.com/astrale-os/shell/issues/205))
+
+### Features
+
+* **core:** support users and groups as Shell members ([#205](https://github.com/astrale-os/shell/issues/205)) ([e9ce4f6](https://github.com/astrale-os/shell/commit/e9ce4f627a88c4d22efd2d84b1e0dafe73783875))
+
+## [0.1.0-beta.27](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.26...shell-domain-v0.1.0-beta.27) (2026-09-08)
+
+
+### Bug Fixes
+
+* **domain:** publish compact inferred Kernel references ([#203](https://github.com/astrale-os/shell/issues/203)) ([ab2d0d9](https://github.com/astrale-os/shell/commit/ab2d0d9170ba7cd688f30cae6ece94b140d29ffd))
+
 ## [0.1.0-beta.26](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.25...shell-domain-v0.1.0-beta.26) (2026-09-07)
 
 

package/README.md

@@ -9,8 +9,8 @@ no Space, setup function, personal home, application catalogue, or public repair
 | Static method | Input | Output |
 | --- | --- | --- |
 | User.invite | `{ user: UserPath, email: string }` | `{ invitationId, user, state }` |
-| Group.assignUser | `{ user: UserPath, group: GroupPath }` | `{}` |
-| Group.unassignUser | Same | `{}` |
+| Group.assignMember | `{ member: UserPath \| GroupPath, group: GroupPath }` | `{}` |
+| Group.unassignMember | Same | `{}` |
 
 User extends Kernel.Identity and owns only optional creationKey correlation.
 Concrete business classes may declare their own displayName/email; Shell never reads or writes them.
@@ -20,12 +20,12 @@ Kernel-owned, write-once iss/sub binding. Invitation email is explicit input, no
 | Operation | Schema Policy alternatives, in addition to Kernel admission |
 | --- | --- |
 | invite | Core admin membership AND Shell-owned concrete User class; or ownership of the User's concrete class |
-| assignUser / unassignUser | Core admin membership AND Shell-owned concrete Group class; or ownership of the Group's concrete class |
+| assignMember / unassignMember | Core admin membership AND Shell-owned concrete Group class; or ownership of the Group's concrete class |
 
 ownsClass follows instance_of → concrete class → of_domain → caller. It does not
 infer ownership from an email, a subclass name, or ownership of an ancestor class.
 A Domain cannot assign its Employee to Core member merely by owning Employee. Admin's invitation
-orchestration retains that responsibility. A Group's owner may manage any admitted User in that Group.
+orchestration retains that responsibility. A Group's owner may manage any admitted User or Group in that Group.
 administersShellClass connects Core admin membership and concrete ownership in one Policy pattern;
 it does not treat inheritance from Shell as ownership. These are callable restrictions, not an
 isolation boundary against Root/Manager or the existing broad administrator Kernel profile.
@@ -40,8 +40,8 @@ Domain creates Employee extending User → unregistered, no group
 Direct credential-evidenced Register → same node authenticates, still no group
 User.invite → provider authentication → Admin ingress → WorkOS/login
             → Admin Register on that same node → member assignment → completed
-Group.assignUser → member_of_group + Kernel.extends_with in one atomic mutation
-Group.unassignUser → remove both edges in one atomic mutation
+Group.assignMember → member_of_group + Kernel.extends_with in one atomic mutation
+Group.unassignMember → remove both edges in one atomic mutation
 ```
 
 The invitation flow is coordinated by Admin, not by an Employee callback. Shell's Integration
@@ -49,6 +49,16 @@ carries only user/email/requestId/requestedBy. Its Provider mints an invocation-
 proof for its configured HTTPS ingress audience; target/sourceProof are not business inputs.
 A returned pending invitation does not prove email delivery or completed registration.
 
+`assignMember({ member: A, group: B })` adds A to B. A and its current and future members inherit
+B's authority. Groups can have several parents; Kernel rejects self-membership and cycles in the
+same transaction as both membership edges. The target Group's manager authorizes this delegation;
+the child Group's managers can subsequently change the population that inherits it.
+
+`unassignMember` removes only that direct pair. Another membership path can preserve effective
+access. Queries of `member_of_group` continue to return direct facts; Grant evaluation expands
+identity composition for Policies. Shell must be able to traverse both concrete endpoint Classes,
+including a foreign Group used as the member.
+
 Membership methods converge both edges, including an observed partial membership.
 After an uncertain mutation response they re-read the pair; an unconfirmed outcome remains
 explicitly unconfirmed. This is not a global repair scan or an exactly-once guarantee.
@@ -62,7 +72,7 @@ Kernel E2E evidence, not a handler test, qualifies this behavior.
 
 The Shell principal requests all Kernel root functions, the required extends_with operations,
 and the declared grant/revoke authority. Core admin receives the full declared Shell profile,
-including invite, assignUser and unassignUser so humans inheriting admin can call those methods.
+including invite, assignMember and unassignMember so humans inheriting admin can call those methods.
 Core member receives Introspect, Query, Mutate and View.resolve, not blanket class-read grants.
 Application requirements, including Core Identity capabilities in requirements.core, are owned by application.ts and materialized by installation,
 never by invitation handlers.
@@ -104,3 +114,15 @@ schema import cannot traverse Shell's private application or runtime implementat
 Source, package, and deterministic test qualification remain distinct from installed-instance,
 released-package, browser, and live-credential evidence. Shell does not broker authentication
 tokens; standard Domain token exchange is owned by Protocol, Server, and SDK.
+
+### Breaking membership API migration
+
+`Group.assignMember` / `Group.unassignMember` replace `assignUser` / `unassignUser` without aliases.
+Callers must change `{ user, group }` to `{ member, group }` and declare the new exact callable
+requirements. The `member_of_group` Class key is preserved; its source role is now `member` and
+accepts User or Group families. Existing User memberships remain valid.
+
+Rebuild and install all affected Schema dependents as one coherent revision closure. Admin bootstrap
+and invitation completion must use the new API when this Shell revision is installed. A downgrade
+to the User-only contract requires handling any Group-to-Group facts first. Validate public admission,
+foreign endpoint traversal, and deployed revisions during the coordinated release.