@astrale-domains/shell 0.1.0-beta.27 → 0.1.0-beta.29

package/README.md

@@ -9,8 +9,8 @@ no Space, setup function, personal home, application catalogue, or public repair
 | Static method | Input | Output |
 | --- | --- | --- |
 | User.invite | `{ user: UserPath, email: string }` | `{ invitationId, user, state }` |
-| Group.assignUser | `{ user: UserPath, group: GroupPath }` | `{}` |
-| Group.unassignUser | Same | `{}` |
+| Group.assignMember | `{ member: UserPath \| GroupPath, group: GroupPath }` | `{}` |
+| Group.unassignMember | Same | `{}` |
 
 User extends Kernel.Identity and owns only optional creationKey correlation.
 Concrete business classes may declare their own displayName/email; Shell never reads or writes them.
@@ -20,12 +20,12 @@ Kernel-owned, write-once iss/sub binding. Invitation email is explicit input, no
 | Operation | Schema Policy alternatives, in addition to Kernel admission |
 | --- | --- |
 | invite | Core admin membership AND Shell-owned concrete User class; or ownership of the User's concrete class |
-| assignUser / unassignUser | Core admin membership AND Shell-owned concrete Group class; or ownership of the Group's concrete class |
+| assignMember / unassignMember | Core admin membership AND Shell-owned concrete Group class; or ownership of the Group's concrete class |
 
 ownsClass follows instance_of → concrete class → of_domain → caller. It does not
 infer ownership from an email, a subclass name, or ownership of an ancestor class.
 A Domain cannot assign its Employee to Core member merely by owning Employee. Admin's invitation
-orchestration retains that responsibility. A Group's owner may manage any admitted User in that Group.
+orchestration retains that responsibility. A Group's owner may manage any admitted User or Group in that Group.
 administersShellClass connects Core admin membership and concrete ownership in one Policy pattern;
 it does not treat inheritance from Shell as ownership. These are callable restrictions, not an
 isolation boundary against Root/Manager or the existing broad administrator Kernel profile.
@@ -40,8 +40,8 @@ Domain creates Employee extending User → unregistered, no group
 Direct credential-evidenced Register → same node authenticates, still no group
 User.invite → provider authentication → Admin ingress → WorkOS/login
             → Admin Register on that same node → member assignment → completed
-Group.assignUser → member_of_group + Kernel.extends_with in one atomic mutation
-Group.unassignUser → remove both edges in one atomic mutation
+Group.assignMember → member_of_group + Kernel.extends_with in one atomic mutation
+Group.unassignMember → remove both edges in one atomic mutation
 ```
 
 The invitation flow is coordinated by Admin, not by an Employee callback. Shell's Integration
@@ -49,6 +49,16 @@ carries only user/email/requestId/requestedBy. Its Provider mints an invocation-
 proof for its configured HTTPS ingress audience; target/sourceProof are not business inputs.
 A returned pending invitation does not prove email delivery or completed registration.
 
+`assignMember({ member: A, group: B })` adds A to B. A and its current and future members inherit
+B's authority. Groups can have several parents; Kernel rejects self-membership and cycles in the
+same transaction as both membership edges. The target Group's manager authorizes this delegation;
+the child Group's managers can subsequently change the population that inherits it.
+
+`unassignMember` removes only that direct pair. Another membership path can preserve effective
+access. Queries of `member_of_group` continue to return direct facts; Grant evaluation expands
+identity composition for Policies. Shell must be able to traverse both concrete endpoint Classes,
+including a foreign Group used as the member.
+
 Membership methods converge both edges, including an observed partial membership.
 After an uncertain mutation response they re-read the pair; an unconfirmed outcome remains
 explicitly unconfirmed. This is not a global repair scan or an exactly-once guarantee.
@@ -62,7 +72,7 @@ Kernel E2E evidence, not a handler test, qualifies this behavior.
 
 The Shell principal requests all Kernel root functions, the required extends_with operations,
 and the declared grant/revoke authority. Core admin receives the full declared Shell profile,
-including invite, assignUser and unassignUser so humans inheriting admin can call those methods.
+including invite, assignMember and unassignMember so humans inheriting admin can call those methods.
 Core member receives Introspect, Query, Mutate and View.resolve, not blanket class-read grants.
 Application requirements, including Core Identity capabilities in requirements.core, are owned by application.ts and materialized by installation,
 never by invitation handlers.
@@ -104,3 +114,15 @@ schema import cannot traverse Shell's private application or runtime implementat
 Source, package, and deterministic test qualification remain distinct from installed-instance,
 released-package, browser, and live-credential evidence. Shell does not broker authentication
 tokens; standard Domain token exchange is owned by Protocol, Server, and SDK.
+
+### Breaking membership API migration
+
+`Group.assignMember` / `Group.unassignMember` replace `assignUser` / `unassignUser` without aliases.
+Callers must change `{ user, group }` to `{ member, group }` and declare the new exact callable
+requirements. The `member_of_group` Class key is preserved; its source role is now `member` and
+accepts User or Group families. Existing User memberships remain valid.
+
+Rebuild and install all affected Schema dependents as one coherent revision closure. Admin bootstrap
+and invitation completion must use the new API when this Shell revision is installed. A downgrade
+to the User-only contract requires handling any Group-to-Group facts first. Validate public admission,
+foreign endpoint traversal, and deployed revisions during the coordinated release.

package/dist/application.d.ts

@@ -27,15 +27,15 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
             readonly methods: {
-                readonly assignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly assignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
                 }, "authorized", true, false>>;
-                readonly unassignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
@@ -49,7 +49,7 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
             readonly extends: readonly [];
             readonly properties: never;
             readonly source: {
-                readonly as: "user";
+                readonly as: "member";
                 readonly outgoing: "0..*";
             };
             readonly target: {

package/dist/application.js

@@ -25,8 +25,8 @@ const applicationRequirements = requirements({
             functions: [
                 ...KernelRootFunctions,
                 S.classes.User.static.methods.invite,
-                S.classes.Group.static.methods.assignUser,
-                S.classes.Group.static.methods.unassignUser,
+                S.classes.Group.static.methods.assignMember,
+                S.classes.Group.static.methods.unassignMember,
             ],
             classes: [
                 { class: S.classes.User, operations: ['create', 'read', 'traverse', 'update', 'delete'] },

package/dist/functions/group/{unassign-user-from-group.d.ts → assign-member-to-group.d.ts}

@@ -1,4 +1,4 @@
-export declare const unassignUser: import("@astrale-os/sdk/workflow").WorkflowDefinition<import("@astrale-os/sdk/schema").AuthoredSchema<"shell.astrale.ai", readonly ["kernel.astrale.ai", import("@astrale-os/sdk/schema").KernelSchema] | readonly ["shell.astrale.ai", {
+export declare const assignMember: import("@astrale-os/sdk/workflow").WorkflowDefinition<import("@astrale-os/sdk/schema").AuthoredSchema<"shell.astrale.ai", readonly ["kernel.astrale.ai", import("@astrale-os/sdk/schema").KernelSchema] | readonly ["shell.astrale.ai", {
     readonly classes: {
         readonly User: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
@@ -24,15 +24,15 @@ export declare const unassignUser: import("@astrale-os/sdk/workflow").WorkflowDe
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
             readonly methods: {
-                readonly assignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly assignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
                 }, "authorized", true, false>>;
-                readonly unassignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
@@ -46,7 +46,7 @@ export declare const unassignUser: import("@astrale-os/sdk/workflow").WorkflowDe
             readonly extends: readonly [];
             readonly properties: never;
             readonly source: {
-                readonly as: "user";
+                readonly as: "member";
                 readonly outgoing: "0..*";
             };
             readonly target: {
@@ -73,7 +73,7 @@ export declare const unassignUser: import("@astrale-os/sdk/workflow").WorkflowDe
     };
 }, {
     readonly kernel: "kernel.astrale.ai";
-}]>, "Group.unassignUser", Readonly<Record<never, never>>, {
+}]>, "Group.assignMember", Readonly<Record<never, never>>, {
     readonly GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE: {
         readonly family: 'CONFLICT';
         readonly message: 'Shell must be able to traverse both membership endpoints before confirming membership.';
@@ -81,7 +81,7 @@ export declare const unassignUser: import("@astrale-os/sdk/workflow").WorkflowDe
     };
     readonly INVALID_GROUP_MEMBERSHIP_REFERENCE: {
         readonly family: 'VALIDATION_ERROR';
-        readonly message: 'User and group must be exact canonical @NodeId paths.';
+        readonly message: 'Member and group must be exact canonical @NodeId paths.';
         readonly details: import("zod").ZodObject<{}, import("zod/v4/core").$strict>;
     };
     readonly GROUP_MEMBERSHIP_CONFLICT: {

package/dist/functions/group/{unassign-user-from-group.js → assign-member-to-group.js}

@@ -1,4 +1,4 @@
 import { defineWorkflow } from '@astrale-os/sdk/workflow';
-import { changeGroupMembership } from './change-user-group-membership.js';
+import { changeGroupMembership } from './change-group-membership.js';
 import { groupMembershipErrors } from './group-membership-errors.js';
-export const unassignUser = defineWorkflow()('Group.unassignUser', { errors: groupMembershipErrors }, (context) => changeGroupMembership(context, false));
+export const assignMember = defineWorkflow()('Group.assignMember', { errors: groupMembershipErrors }, (context) => changeGroupMembership(context, true));

package/dist/functions/group/{change-user-group-membership.d.ts → change-group-membership.d.ts}

@@ -1,7 +1,7 @@
 import type { WorkflowContext } from '@astrale-os/sdk/workflow';
 import type { S, Shell } from '../../schema/index.js';
 import type { groupMembershipErrors } from './group-membership-errors.js';
-type GroupCallable = typeof S.classes.Group.static.methods.assignUser | typeof S.classes.Group.static.methods.unassignUser;
+type GroupCallable = typeof S.classes.Group.static.methods.assignMember | typeof S.classes.Group.static.methods.unassignMember;
 type Context = WorkflowContext<GroupCallable, Shell, Readonly<Record<never, never>>, typeof groupMembershipErrors>;
 export declare function changeGroupMembership(context: Context, present: boolean): Promise<{}>;
 export {};

package/dist/functions/group/{change-user-group-membership.js → change-group-membership.js}

@@ -5,7 +5,7 @@ const matches = (state, present) => state.membership === present && state.author
 export async function changeGroupMembership(context, present) {
     const invalid = () => context.error('INVALID_GROUP_MEMBERSHIP_REFERENCE', {});
     const membership = {
-        user: canonicalNodeId(context.input.user, invalid),
+        member: canonicalNodeId(context.input.member, invalid),
         group: canonicalNodeId(context.input.group, invalid),
     };
     const observe = async () => {

package/dist/functions/group/group-membership-errors.d.ts

@@ -7,7 +7,7 @@ export declare const groupMembershipErrors: {
     };
     readonly INVALID_GROUP_MEMBERSHIP_REFERENCE: {
         readonly family: 'VALIDATION_ERROR';
-        readonly message: 'User and group must be exact canonical @NodeId paths.';
+        readonly message: 'Member and group must be exact canonical @NodeId paths.';
         readonly details: z.ZodObject<{}, z.core.$strict>;
     };
     readonly GROUP_MEMBERSHIP_CONFLICT: {

package/dist/functions/group/group-membership-errors.js

@@ -7,7 +7,7 @@ export const groupMembershipErrors = {
     },
     INVALID_GROUP_MEMBERSHIP_REFERENCE: {
         family: 'VALIDATION_ERROR',
-        message: 'User and group must be exact canonical @NodeId paths.',
+        message: 'Member and group must be exact canonical @NodeId paths.',
         details: z.strictObject({}),
     },
     GROUP_MEMBERSHIP_CONFLICT: {

package/dist/functions/group/index.d.ts

@@ -1,2 +1,2 @@
-export { assignUser } from './assign-user-to-group.js';
-export { unassignUser } from './unassign-user-from-group.js';
+export { assignMember } from './assign-member-to-group.js';
+export { unassignMember } from './unassign-member-from-group.js';

package/dist/functions/group/index.js

@@ -1,2 +1,2 @@
-export { assignUser } from './assign-user-to-group.js';
-export { unassignUser } from './unassign-user-from-group.js';
+export { assignMember } from './assign-member-to-group.js';
+export { unassignMember } from './unassign-member-from-group.js';

package/dist/functions/group/{assign-user-to-group.d.ts → unassign-member-from-group.d.ts}

@@ -1,4 +1,4 @@
-export declare const assignUser: import("@astrale-os/sdk/workflow").WorkflowDefinition<import("@astrale-os/sdk/schema").AuthoredSchema<"shell.astrale.ai", readonly ["kernel.astrale.ai", import("@astrale-os/sdk/schema").KernelSchema] | readonly ["shell.astrale.ai", {
+export declare const unassignMember: import("@astrale-os/sdk/workflow").WorkflowDefinition<import("@astrale-os/sdk/schema").AuthoredSchema<"shell.astrale.ai", readonly ["kernel.astrale.ai", import("@astrale-os/sdk/schema").KernelSchema] | readonly ["shell.astrale.ai", {
     readonly classes: {
         readonly User: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
@@ -24,15 +24,15 @@ export declare const assignUser: import("@astrale-os/sdk/workflow").WorkflowDefi
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
             readonly methods: {
-                readonly assignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly assignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
                 }, "authorized", true, false>>;
-                readonly unassignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
@@ -46,7 +46,7 @@ export declare const assignUser: import("@astrale-os/sdk/workflow").WorkflowDefi
             readonly extends: readonly [];
             readonly properties: never;
             readonly source: {
-                readonly as: "user";
+                readonly as: "member";
                 readonly outgoing: "0..*";
             };
             readonly target: {
@@ -73,7 +73,7 @@ export declare const assignUser: import("@astrale-os/sdk/workflow").WorkflowDefi
     };
 }, {
     readonly kernel: "kernel.astrale.ai";
-}]>, "Group.assignUser", Readonly<Record<never, never>>, {
+}]>, "Group.unassignMember", Readonly<Record<never, never>>, {
     readonly GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE: {
         readonly family: 'CONFLICT';
         readonly message: 'Shell must be able to traverse both membership endpoints before confirming membership.';
@@ -81,7 +81,7 @@ export declare const assignUser: import("@astrale-os/sdk/workflow").WorkflowDefi
     };
     readonly INVALID_GROUP_MEMBERSHIP_REFERENCE: {
         readonly family: 'VALIDATION_ERROR';
-        readonly message: 'User and group must be exact canonical @NodeId paths.';
+        readonly message: 'Member and group must be exact canonical @NodeId paths.';
         readonly details: import("zod").ZodObject<{}, import("zod/v4/core").$strict>;
     };
     readonly GROUP_MEMBERSHIP_CONFLICT: {

package/dist/functions/group/unassign-member-from-group.js

@@ -0,0 +1,4 @@
+import { defineWorkflow } from '@astrale-os/sdk/workflow';
+import { changeGroupMembership } from './change-group-membership.js';
+import { groupMembershipErrors } from './group-membership-errors.js';
+export const unassignMember = defineWorkflow()('Group.unassignMember', { errors: groupMembershipErrors }, (context) => changeGroupMembership(context, false));

package/dist/functions/user/invite-user.d.ts

@@ -25,15 +25,15 @@ export declare const invite: import("@astrale-os/sdk/workflow").WorkflowDefiniti
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
             readonly methods: {
-                readonly assignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly assignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
                 }, "authorized", true, false>>;
-                readonly unassignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
@@ -47,7 +47,7 @@ export declare const invite: import("@astrale-os/sdk/workflow").WorkflowDefiniti
             readonly extends: readonly [];
             readonly properties: never;
             readonly source: {
-                readonly as: "user";
+                readonly as: "member";
                 readonly outgoing: "0..*";
             };
             readonly target: {

package/dist/mutations/group/index.d.ts

@@ -1 +1 @@
-export { setGroupMembership } from './set-user-group-membership.js';
+export { setGroupMembership } from './set-group-membership.js';

package/dist/mutations/group/index.js

@@ -1 +1 @@
-export { setGroupMembership } from './set-user-group-membership.js';
+export { setGroupMembership } from './set-group-membership.js';

package/dist/mutations/group/{set-user-group-membership.d.ts → set-group-membership.d.ts}

@@ -2,7 +2,7 @@ import type { NodeId } from '@astrale-os/sdk/graph/node';
 import type { QueryEdgeAST, QueryNodeAST } from '@astrale-os/sdk/query';
 import { type QueryPrecondition } from '@astrale-os/sdk/mutation';
 interface GroupMembership {
-    readonly user: NodeId;
+    readonly member: NodeId;
     readonly group: NodeId;
 }
 interface GroupMembershipObservation {
@@ -48,15 +48,15 @@ export declare const setGroupMembership: import("@astrale-os/sdk/mutation").Muta
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
             readonly methods: {
-                readonly assignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly assignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
                 }, "authorized", true, false>>;
-                readonly unassignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
@@ -70,7 +70,7 @@ export declare const setGroupMembership: import("@astrale-os/sdk/mutation").Muta
             readonly extends: readonly [];
             readonly properties: never;
             readonly source: {
-                readonly as: "user";
+                readonly as: "member";
                 readonly outgoing: "0..*";
             };
             readonly target: {

package/dist/mutations/group/{set-user-group-membership.js → set-group-membership.js}

@@ -4,7 +4,7 @@ export const setGroupMembership = defineMutation()((domain) => ({
     build(input, mutation) {
         mutation.expect.query(input.current.endpoints);
         mutation.expect.query(input.current.guard);
-        const endpoints = { source: input.user, target: input.group };
+        const endpoints = { source: input.member, target: input.group };
         const changes = [
             { class: domain.classes.member_of_group, current: input.current.membership },
             { class: domain.dependencies.kernel.classes.extends_with, current: input.current.authority },

package/dist/queries/group/index.d.ts

@@ -1,2 +1,2 @@
-export { readGroupMembership, type GroupMembershipObservation, type GroupMembershipState, } from './read-user-group-membership.js';
+export { readGroupMembership, type GroupMembershipObservation, type GroupMembershipState, } from './read-group-membership.js';
 export { readGroupMembershipEndpoints } from './read-group-membership-endpoints.js';

package/dist/queries/group/index.js

@@ -1,2 +1,2 @@
-export { readGroupMembership, } from './read-user-group-membership.js';
+export { readGroupMembership, } from './read-group-membership.js';
 export { readGroupMembershipEndpoints } from './read-group-membership-endpoints.js';

package/dist/queries/group/read-group-membership-endpoints.d.ts

@@ -2,7 +2,7 @@ import type { NodeId } from '@astrale-os/sdk/graph/node';
 import type { QueryPrecondition } from '@astrale-os/sdk/mutation';
 import { type QueryNodeAST } from '@astrale-os/sdk/query';
 interface Endpoints {
-    readonly user: NodeId;
+    readonly member: NodeId;
     readonly group: NodeId;
 }
 export interface GroupMembershipEndpoints {
@@ -35,15 +35,15 @@ export declare const readGroupMembershipEndpoints: import("@astrale-os/sdk/query
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
             readonly methods: {
-                readonly assignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly assignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
                 }, "authorized", true, false>>;
-                readonly unassignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
@@ -57,7 +57,7 @@ export declare const readGroupMembershipEndpoints: import("@astrale-os/sdk/query
             readonly extends: readonly [];
             readonly properties: never;
             readonly source: {
-                readonly as: "user";
+                readonly as: "member";
                 readonly outgoing: "0..*";
             };
             readonly target: {

package/dist/queries/group/read-group-membership-endpoints.js

@@ -4,14 +4,14 @@ export const readGroupMembershipEndpoints = defineQuery()(() => ({
     id: 'shell.group.membership.endpoints',
     page: { size: 2 },
     pagination: { maximumPages: 2 },
-    build: ({ user, group }) => Query.from({ nodes: [Path.id(user), Path.id(group)] }).select({
+    build: ({ member, group }) => Query.from({ nodes: [Path.id(member), Path.id(group)] }).select({
         kind: 'nodes',
         projection: { kind: 'reference' },
     }),
     project(pages, input, { ast, complete }) {
         const ids = queryResult.completeNodeIds(pages, 'Shell membership endpoints');
         return {
-            visible: ids.includes(input.user) && ids.includes(input.group),
+            visible: ids.includes(input.member) && ids.includes(input.group),
             guard: { query: ast, equals: complete },
         };
     },

package/dist/queries/group/{read-user-group-membership.d.ts → read-group-membership.d.ts}

@@ -2,7 +2,7 @@ import type { NodeId } from '@astrale-os/sdk/graph/node';
 import type { QueryPrecondition } from '@astrale-os/sdk/mutation';
 import { type QueryEdgeAST } from '@astrale-os/sdk/query';
 export interface GroupMembership {
-    readonly user: NodeId;
+    readonly member: NodeId;
     readonly group: NodeId;
 }
 export interface GroupMembershipState {
@@ -38,15 +38,15 @@ export declare const readGroupMembership: import("@astrale-os/sdk/query").Single
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
             readonly methods: {
-                readonly assignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly assignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
                 }, "authorized", true, false>>;
-                readonly unassignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
@@ -60,7 +60,7 @@ export declare const readGroupMembership: import("@astrale-os/sdk/query").Single
             readonly extends: readonly [];
             readonly properties: never;
             readonly source: {
-                readonly as: "user";
+                readonly as: "member";
                 readonly outgoing: "0..*";
             };
             readonly target: {

package/dist/queries/group/{read-user-group-membership.js → read-group-membership.js}

@@ -1,12 +1,12 @@
 import { Query, defineQuery, queryResult, } from '@astrale-os/sdk/query';
 export const readGroupMembership = defineQuery()((domain) => ({
     id: 'shell.group.membership.read',
-    build({ user, group }) {
+    build({ member, group }) {
         const edges = Query.from({
             edges: [domain.classes.member_of_group, domain.dependencies.kernel.classes.extends_with],
         });
         return edges
-            .filter({ binding: edges.source, predicate: { kind: 'identity.equal', identity: user } })
+            .filter({ binding: edges.source, predicate: { kind: 'identity.equal', identity: member } })
             .filter({ binding: edges.target, predicate: { kind: 'identity.equal', identity: group } })
             .select({
             kind: 'edges',

package/dist/runtime.d.ts

@@ -38,15 +38,15 @@ declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDe
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
             readonly methods: {
-                readonly assignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly assignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
                 }, "authorized", true, false>>;
-                readonly unassignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
@@ -60,7 +60,7 @@ declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDe
             readonly extends: readonly [];
             readonly properties: never;
             readonly source: {
-                readonly as: "user";
+                readonly as: "member";
                 readonly outgoing: "0..*";
             };
             readonly target: {
@@ -141,15 +141,15 @@ declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDe
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
             readonly methods: {
-                readonly assignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly assignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
                 }, "authorized", true, false>>;
-                readonly unassignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
@@ -163,7 +163,7 @@ declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDe
             readonly extends: readonly [];
             readonly properties: never;
             readonly source: {
-                readonly as: "user";
+                readonly as: "member";
                 readonly outgoing: "0..*";
             };
             readonly target: {
@@ -190,7 +190,7 @@ declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDe
     };
 }, {
     readonly kernel: "kernel.astrale.ai";
-}]>, "Group.assignUser", Readonly<Record<never, never>>, {
+}]>, "Group.assignMember", Readonly<Record<never, never>>, {
     readonly GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE: {
         readonly family: 'CONFLICT';
         readonly message: 'Shell must be able to traverse both membership endpoints before confirming membership.';
@@ -198,7 +198,7 @@ declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDe
     };
     readonly INVALID_GROUP_MEMBERSHIP_REFERENCE: {
         readonly family: 'VALIDATION_ERROR';
-        readonly message: 'User and group must be exact canonical @NodeId paths.';
+        readonly message: 'Member and group must be exact canonical @NodeId paths.';
         readonly details: import("zod").ZodObject<{}, import("zod/v4/core").$strict>;
     };
     readonly GROUP_MEMBERSHIP_CONFLICT: {
@@ -242,15 +242,15 @@ declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDe
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
             readonly methods: {
-                readonly assignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly assignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
                 }, "authorized", true, false>>;
-                readonly unassignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
@@ -264,7 +264,7 @@ declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDe
             readonly extends: readonly [];
             readonly properties: never;
             readonly source: {
-                readonly as: "user";
+                readonly as: "member";
                 readonly outgoing: "0..*";
             };
             readonly target: {
@@ -291,7 +291,7 @@ declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDe
     };
 }, {
     readonly kernel: "kernel.astrale.ai";
-}]>, "Group.unassignUser", Readonly<Record<never, never>>, {
+}]>, "Group.unassignMember", Readonly<Record<never, never>>, {
     readonly GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE: {
         readonly family: 'CONFLICT';
         readonly message: 'Shell must be able to traverse both membership endpoints before confirming membership.';
@@ -299,7 +299,7 @@ declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDe
     };
     readonly INVALID_GROUP_MEMBERSHIP_REFERENCE: {
         readonly family: 'VALIDATION_ERROR';
-        readonly message: 'User and group must be exact canonical @NodeId paths.';
+        readonly message: 'Member and group must be exact canonical @NodeId paths.';
         readonly details: import("zod").ZodObject<{}, import("zod/v4/core").$strict>;
     };
     readonly GROUP_MEMBERSHIP_CONFLICT: {

package/dist/runtime.js

@@ -1,12 +1,12 @@
 import { defineRuntime } from '@astrale-os/sdk/runtime';
-import { assignUser, unassignUser } from './functions/group/index.js';
+import { assignMember, unassignMember } from './functions/group/index.js';
 import { invite } from './functions/user/index.js';
 import { integrations } from './integrations/index.js';
 import { enrollmentProvider } from './providers/admin-enrollment/index.js';
 const initialize = (environment) => ({
     providers: { enrollment: enrollmentProvider(environment) },
 });
-const functions = [invite, assignUser, unassignUser];
+const functions = [invite, assignMember, unassignMember];
 const runtime = defineRuntime()({
     integrations,
     initialize,

package/dist/schema/modules/group/classes/group.d.ts

@@ -2,15 +2,15 @@ export declare const Group: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
     readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
     readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
     readonly methods: {
-        readonly assignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-            user: string;
+        readonly assignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            member: string;
             group: string;
         }, {
             readonly mode: 'value';
             readonly value: Record<string, never>;
         }, "authorized", true, false>>;
-        readonly unassignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-            user: string;
+        readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            member: string;
             group: string;
         }, {
             readonly mode: 'value';

package/dist/schema/modules/group/classes/group.js

@@ -1,8 +1,8 @@
 import { K, classIcon, nodeClass } from '@astrale-os/sdk/schema';
 import { UsersRound } from '@astrale-os/sdk/schema/icons';
-import { assignUser, unassignUser } from '../functions/index.js';
+import { assignMember, unassignMember } from '../functions/index.js';
 export const Group = nodeClass({
     icon: classIcon.lucide(UsersRound),
     extends: [K.classes.Identity, K.classes.Named, K.classes.Descriptable],
-    methods: { assignUser, unassignUser },
+    methods: { assignMember, unassignMember },
 });

package/dist/schema/modules/group/classes/member-of-group.d.ts

@@ -4,7 +4,7 @@ export declare const member_of_group: import("@astrale-os/sdk/schema").DirectedE
     readonly extends: readonly [];
     readonly properties: never;
     readonly source: {
-        readonly as: "user";
+        readonly as: "member";
         readonly outgoing: "0..*";
     };
     readonly target: {

package/dist/schema/modules/group/classes/member-of-group.js

@@ -2,6 +2,10 @@ import { edgeClass } from '@astrale-os/sdk/schema';
 import { User } from '../../user/index.js';
 import { Group } from './group.js';
 export const member_of_group = edgeClass.directed({
-    source: { as: 'user', accepts: [() => User], outgoing: '0..*' },
+    source: {
+        as: 'member',
+        accepts: [() => User, () => Group],
+        outgoing: '0..*',
+    },
     target: { as: 'group', accepts: [() => Group], incoming: '0..*' },
 });

package/dist/schema/modules/group/functions/{unassign-user-from-group.d.ts → assign-member-to-group.d.ts}

@@ -1,5 +1,5 @@
-export declare const unassignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-    user: string;
+export declare const assignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+    member: string;
     group: string;
 }, {
     readonly mode: 'value';

package/dist/schema/modules/group/functions/{assign-user-to-group.js → assign-member-to-group.js}

@@ -2,7 +2,7 @@ import { method } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
 import { ownsClass, administersShellClass } from '../../../policies/index.js';
 import { groupMembershipInput } from '../types/index.js';
-export const assignUser = method({
+export const assignMember = method({
     static: true,
     auth: 'authorized',
     input: groupMembershipInput,

package/dist/schema/modules/group/functions/index.d.ts

@@ -1,2 +1,2 @@
-export { assignUser } from './assign-user-to-group.js';
-export { unassignUser } from './unassign-user-from-group.js';
+export { assignMember } from './assign-member-to-group.js';
+export { unassignMember } from './unassign-member-from-group.js';

package/dist/schema/modules/group/functions/index.js

@@ -1,2 +1,2 @@
-export { assignUser } from './assign-user-to-group.js';
-export { unassignUser } from './unassign-user-from-group.js';
+export { assignMember } from './assign-member-to-group.js';
+export { unassignMember } from './unassign-member-from-group.js';

package/dist/schema/modules/group/functions/unassign-member-from-group.d.ts

@@ -0,0 +1,7 @@
+export declare const unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+    member: string;
+    group: string;
+}, {
+    readonly mode: 'value';
+    readonly value: Record<string, never>;
+}, "authorized", true, false>>;

package/dist/schema/modules/group/functions/{unassign-user-from-group.js → unassign-member-from-group.js}

@@ -2,7 +2,7 @@ import { method } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
 import { ownsClass, administersShellClass } from '../../../policies/index.js';
 import { groupMembershipInput } from '../types/index.js';
-export const unassignUser = method({
+export const unassignMember = method({
     static: true,
     auth: 'authorized',
     input: groupMembershipInput,

package/dist/schema/modules/group/types/{group-user-reference.d.ts → group-membership-input.d.ts}

@@ -1,6 +1,6 @@
 import type { NodeClass } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
 export declare const groupMembershipInput: z.ZodObject<{
-    user: import("@astrale-os/sdk/schema").PathAuthoring<readonly [() => NodeClass]>;
+    member: import("@astrale-os/sdk/schema").PathAuthoring<readonly [() => NodeClass, () => NodeClass]>;
     group: import("@astrale-os/sdk/schema").PathAuthoring<readonly [() => NodeClass]>;
 }, z.core.$strip>;

package/dist/schema/modules/group/types/{group-user-reference.js → group-membership-input.js}

@@ -3,6 +3,6 @@ import { z } from 'zod';
 import { User } from '../../user/index.js';
 import { Group } from '../classes/group.js';
 export const groupMembershipInput = z.object({
-    user: path(() => User),
+    member: path(() => User, () => Group),
     group: path(() => Group),
 });

package/dist/schema/modules/group/types/index.d.ts

@@ -1 +1 @@
-export { groupMembershipInput } from './group-user-reference.js';
+export { groupMembershipInput } from './group-membership-input.js';

package/dist/schema/modules/group/types/index.js

@@ -1 +1 @@
-export { groupMembershipInput } from './group-user-reference.js';
+export { groupMembershipInput } from './group-membership-input.js';

package/dist/schema/schema.d.ts

@@ -25,15 +25,15 @@ declare const classes: {
         readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
         readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
         readonly methods: {
-            readonly assignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                user: string;
+            readonly assignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                member: string;
                 group: string;
             }, {
                 readonly mode: 'value';
                 readonly value: Record<string, never>;
             }, "authorized", true, false>>;
-            readonly unassignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                user: string;
+            readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                member: string;
                 group: string;
             }, {
                 readonly mode: 'value';
@@ -47,7 +47,7 @@ declare const classes: {
         readonly extends: readonly [];
         readonly properties: never;
         readonly source: {
-            readonly as: "user";
+            readonly as: "member";
             readonly outgoing: "0..*";
         };
         readonly target: {
@@ -88,15 +88,15 @@ declare const input: {
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
             readonly methods: {
-                readonly assignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly assignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
                 }, "authorized", true, false>>;
-                readonly unassignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
@@ -110,7 +110,7 @@ declare const input: {
             readonly extends: readonly [];
             readonly properties: never;
             readonly source: {
-                readonly as: "user";
+                readonly as: "member";
                 readonly outgoing: "0..*";
             };
             readonly target: {
@@ -163,15 +163,15 @@ export declare const ShellSchema: import("@astrale-os/sdk/schema").AuthoredSchem
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
             readonly methods: {
-                readonly assignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly assignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
                 }, "authorized", true, false>>;
-                readonly unassignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
@@ -185,7 +185,7 @@ export declare const ShellSchema: import("@astrale-os/sdk/schema").AuthoredSchem
             readonly extends: readonly [];
             readonly properties: never;
             readonly source: {
-                readonly as: "user";
+                readonly as: "member";
                 readonly outgoing: "0..*";
             };
             readonly target: {
@@ -240,15 +240,15 @@ export declare const S: schema.ResolvedDomainOf<import("@astrale-os/sdk/schema")
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
             readonly methods: {
-                readonly assignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly assignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
                 }, "authorized", true, false>>;
-                readonly unassignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-                    user: string;
+                readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
@@ -262,7 +262,7 @@ export declare const S: schema.ResolvedDomainOf<import("@astrale-os/sdk/schema")
             readonly extends: readonly [];
             readonly properties: never;
             readonly source: {
-                readonly as: "user";
+                readonly as: "member";
                 readonly outgoing: "0..*";
             };
             readonly target: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-domains/shell",
-  "version": "0.1.0-beta.27",
+  "version": "0.1.0-beta.29",
   "description": "Astrale Shell Domain schema and remote product implementation",
   "license": "Apache-2.0",
   "repository": {
@@ -58,7 +58,7 @@
   },
   "devDependencies": {
     "@astrale-os/ox": "0.1.4",
-    "@astrale-os/sdk": "0.5.0-beta.128",
+    "@astrale-os/sdk": "0.5.0-beta.131",
     "@astrale/typescript-config": "npm:@jsr/astrale__typescript-config@~1.1.3",
     "@types/node": "26.2.0",
     "happy-dom": "20.11.2",
@@ -67,7 +67,7 @@
     "vitest": "4.1.10"
   },
   "peerDependencies": {
-    "@astrale-os/sdk": ">=0.5.0-beta.128 <1.0.0"
+    "@astrale-os/sdk": ">=0.5.0-beta.131 <1.0.0"
   },
   "devEngines": {
     "runtime": {

package/CHANGELOG.md

@@ -1,233 +0,0 @@
-# Changelog
-
-## [0.1.0-beta.27](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.26...shell-domain-v0.1.0-beta.27) (2026-09-08)
-
-
-### Bug Fixes
-
-* **domain:** publish compact inferred Kernel references ([#203](https://github.com/astrale-os/shell/issues/203)) ([ab2d0d9](https://github.com/astrale-os/shell/commit/ab2d0d9170ba7cd688f30cae6ece94b140d29ffd))
-
-## [0.1.0-beta.26](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.25...shell-domain-v0.1.0-beta.26) (2026-09-07)
-
-
-### Bug Fixes
-
-* **domain:** infer public schema and class declarations ([#198](https://github.com/astrale-os/shell/issues/198)) ([d0741db](https://github.com/astrale-os/shell/commit/d0741db4c39c7144d2d93556edf253e277c6113b))
-
-## [0.1.0-beta.25](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.24...shell-domain-v0.1.0-beta.25) (2026-09-07)
-
-
-### ⚠ BREAKING CHANGES
-
-* **react:** preflight exact-class instance method targets ([#182](https://github.com/astrale-os/shell/issues/182))
-
-### Features
-
-* **react:** preflight exact-class instance method targets ([#182](https://github.com/astrale-os/shell/issues/182)) ([305e92f](https://github.com/astrale-os/shell/commit/305e92f0578309e5e94d8fd78d874f7c5a60ee46))
-
-
-### Bug Fixes
-
-* **runtime:** rename Core Identity requirements to core ([#192](https://github.com/astrale-os/shell/issues/192)) ([1c48e06](https://github.com/astrale-os/shell/commit/1c48e06e2db98ab758b2c5f952f2705090b52d43))
-
-## [0.1.0-beta.24](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.23...shell-domain-v0.1.0-beta.24) (2026-09-07)
-
-
-### ⚠ BREAKING CHANGES
-
-* **runtime:** simplify Shell users, groups and invitations ([#187](https://github.com/astrale-os/shell/issues/187))
-
-### Features
-
-* **domain:** migrate Shell to project environments ([#183](https://github.com/astrale-os/shell/issues/183)) ([ec72b5d](https://github.com/astrale-os/shell/commit/ec72b5d11fea5ff3266d1fd0a823c4eff5cc6d3e))
-* **runtime:** simplify Shell users, groups and invitations ([#187](https://github.com/astrale-os/shell/issues/187)) ([7f00279](https://github.com/astrale-os/shell/commit/7f002791edae81944e6e80940834dee49212aa26))
-
-## [0.1.0-beta.23](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.22...shell-domain-v0.1.0-beta.23) (2026-09-04)
-
-
-### Bug Fixes
-
-* **deps:** align SDK and Kernel release cohort ([#177](https://github.com/astrale-os/shell/issues/177)) ([294ec8f](https://github.com/astrale-os/shell/commit/294ec8f6f7a908afb608a1078e03a84ff2cc09ca))
-
-## [0.1.0-beta.22](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.21...shell-domain-v0.1.0-beta.22) (2026-09-03)
-
-
-### Features
-
-* **core:** declare required node class icons ([#163](https://github.com/astrale-os/shell/issues/163)) ([2114424](https://github.com/astrale-os/shell/commit/2114424dc1295d978e49536aea76ace897917987))
-
-
-### Bug Fixes
-
-* **domain:** authorize installed app discovery ([#164](https://github.com/astrale-os/shell/issues/164)) ([cbcb559](https://github.com/astrale-os/shell/commit/cbcb5594ffa9701ec979333f76f7c5dc3597401e))
-
-## [0.1.0-beta.21](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.20...shell-domain-v0.1.0-beta.21) (2026-09-01)
-
-
-### ⚠ BREAKING CHANGES
-
-* adopt unified Domain functions layer ([#157](https://github.com/astrale-os/shell/issues/157))
-
-### Features
-
-* adopt unified Domain functions layer ([#157](https://github.com/astrale-os/shell/issues/157)) ([ae73910](https://github.com/astrale-os/shell/commit/ae739107da4b3827ff06f09a1bf86958135a2a5a))
-
-
-### Bug Fixes
-
-* **domain:** stabilize executable declarations ([a12caa6](https://github.com/astrale-os/shell/commit/a12caa64cb42d8b7d623a53463ff2f1242d27052))
-
-## [0.1.0-beta.20](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.19...shell-domain-v0.1.0-beta.20) (2026-08-31)
-
-
-### Bug Fixes
-
-* **core:** complete member syscall profile ([#151](https://github.com/astrale-os/shell/issues/151)) ([961f4d6](https://github.com/astrale-os/shell/commit/961f4d6abc03b193d28a16d5bd21f43ea10c97d9))
-
-## [0.1.0-beta.19](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.18...shell-domain-v0.1.0-beta.19) (2026-08-31)
-
-
-### Bug Fixes
-
-* **domain:** preserve caller-owned Shell authority ([#143](https://github.com/astrale-os/shell/issues/143)) ([7150ce0](https://github.com/astrale-os/shell/commit/7150ce0890546b6c605f9192aa78177b95af3615))
-
-## [0.1.0-beta.18](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.17...shell-domain-v0.1.0-beta.18) (2026-08-30)
-
-
-### Features
-
-* grant trusted Shell exchange authority ([#140](https://github.com/astrale-os/shell/issues/140)) ([349c4b5](https://github.com/astrale-os/shell/commit/349c4b593b20245a8cb836f2370807b372faf23f))
-
-
-### Bug Fixes
-
-* **deps:** consume Zod-coherent SDK cohort ([#145](https://github.com/astrale-os/shell/issues/145)) ([2d2027c](https://github.com/astrale-os/shell/commit/2d2027c749f83c1e35a5b4a28696761b1f8e71e1))
-* **domain:** adopt function and authority requirements ([#144](https://github.com/astrale-os/shell/issues/144)) ([016e306](https://github.com/astrale-os/shell/commit/016e30603591c32a2c8cf0073fe75995c67ae004))
-
-## [0.1.0-beta.17](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.16...shell-domain-v0.1.0-beta.17) (2026-08-30)
-
-
-### Bug Fixes
-
-* **domain:** require the SDK beta.82 cohort ([#138](https://github.com/astrale-os/shell/issues/138)) ([b37c745](https://github.com/astrale-os/shell/commit/b37c745cdc7c124003b5adb9104b52ca7bd548c1))
-
-## [0.1.0-beta.16](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.15...shell-domain-v0.1.0-beta.16) (2026-08-29)
-
-
-### Bug Fixes
-
-* **domain:** match beta.49 Kernel dependency ([#133](https://github.com/astrale-os/shell/issues/133)) ([b78db28](https://github.com/astrale-os/shell/commit/b78db28a8eaa7e1dc32dda8de2dacf2c605529a1))
-* **domain:** trust Shell with Kernel authority ([#136](https://github.com/astrale-os/shell/issues/136)) ([fa08461](https://github.com/astrale-os/shell/commit/fa084614844995f4e2a0d5fde4d8dee600d48e0c))
-
-## [0.1.0-beta.15](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.14...shell-domain-v0.1.0-beta.15) (2026-08-29)
-
-
-### Features
-
-* **runtime:** enforce declared iframe requirements ([#129](https://github.com/astrale-os/shell/issues/129)) ([7b8d84a](https://github.com/astrale-os/shell/commit/7b8d84a1189e95c94c2de9f1759b6510a5467813))
-* **shell:** adopt flat identity authentication ([#114](https://github.com/astrale-os/shell/issues/114)) ([f267a79](https://github.com/astrale-os/shell/commit/f267a79cd8bd58c29379c4be91b481c5dd20f1cf))
-
-
-### Bug Fixes
-
-* **domain:** publish visibility-free Shell bundle ([#131](https://github.com/astrale-os/shell/issues/131)) ([61f48e5](https://github.com/astrale-os/shell/commit/61f48e56f9b18a0b83d395ce1bae648d2470140c))
-
-## [0.1.0-beta.14](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.13...shell-domain-v0.1.0-beta.14) (2026-08-27)
-
-
-### Bug Fixes
-
-* **domain:** align canonical SDK contracts ([#117](https://github.com/astrale-os/shell/issues/117)) ([78df43d](https://github.com/astrale-os/shell/commit/78df43df4b2878221c7bfc83b32944264b3835e8))
-
-## [0.1.0-beta.13](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.12...shell-domain-v0.1.0-beta.13) (2026-08-26)
-
-
-### Bug Fixes
-
-* **shell:** align the published Shell cohort ([#109](https://github.com/astrale-os/shell/issues/109)) ([6c79cb6](https://github.com/astrale-os/shell/commit/6c79cb6f0370aad84565dda27d2af1a5579c18ff))
-
-
-### Documentation
-
-* document current Shell user registration journey ([#107](https://github.com/astrale-os/shell/issues/107)) ([b1fee2a](https://github.com/astrale-os/shell/commit/b1fee2a023d0e4e5661d90f862a74b54a0613cf1))
-
-## [0.1.0-beta.12](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.11...shell-domain-v0.1.0-beta.12) (2026-08-26)
-
-
-### Bug Fixes
-
-* **deps:** release current Shell contracts ([#104](https://github.com/astrale-os/shell/issues/104)) ([1412891](https://github.com/astrale-os/shell/commit/141289136f83228be0c5f808f3024792749b203b))
-
-## [0.1.0-beta.11](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.10...shell-domain-v0.1.0-beta.11) (2026-08-25)
-
-
-### Bug Fixes
-
-* **deploy:** consume current SDK toolchain ([#96](https://github.com/astrale-os/shell/issues/96)) ([73956a0](https://github.com/astrale-os/shell/commit/73956a05a2c9e107afedfa7b1878716644074bc1))
-* **deps:** consume cloudflare adapter beta.44 ([#101](https://github.com/astrale-os/shell/issues/101)) ([7e9f214](https://github.com/astrale-os/shell/commit/7e9f214fe06979d5e1a7f4ca3b00cf431ab50944))
-* **domain:** isolate public schema declaration ([#102](https://github.com/astrale-os/shell/issues/102)) ([ccdd6f3](https://github.com/astrale-os/shell/commit/ccdd6f33c2af1da3372357d70af0bbb8066e6efe))
-* **domain:** narrow existing user profile queries ([6d5815a](https://github.com/astrale-os/shell/commit/6d5815ab6b3ef8e452f3f198167d7e78ed34c3f4))
-* **runtime:** converge existing Shell users ([596e3db](https://github.com/astrale-os/shell/commit/596e3dbbb871ae8986d92777521182ea8ffc5a7c))
-
-## [0.1.0-beta.10](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.9...shell-domain-v0.1.0-beta.10) (2026-08-25)
-
-
-### Bug Fixes
-
-* **domain:** expose isolated deployment entrypoints ([#91](https://github.com/astrale-os/shell/issues/91)) ([542a300](https://github.com/astrale-os/shell/commit/542a3001f58b84871017bfe20cd5c15b61647d11))
-
-## [0.1.0-beta.9](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.8...shell-domain-v0.1.0-beta.9) (2026-08-25)
-
-
-### Bug Fixes
-
-* **packages:** keep install guards private ([#71](https://github.com/astrale-os/shell/issues/71)) ([20a34ee](https://github.com/astrale-os/shell/commit/20a34eeafea868f31663b3076928c3528f4e1aec))
-
-## [0.1.0-beta.8](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.7...shell-domain-v0.1.0-beta.8) (2026-08-24)
-
-
-### Bug Fixes
-
-* **deps:** align Shell packages with SDK beta.22 ([#65](https://github.com/astrale-os/shell/issues/65)) ([18db939](https://github.com/astrale-os/shell/commit/18db93958e64678f9c000e258c12a97525fa95ef))
-
-## [0.1.0-beta.7](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.6...shell-domain-v0.1.0-beta.7) (2026-08-24)
-
-
-### Bug Fixes
-
-* **release:** preserve SDK dependency ownership ([#62](https://github.com/astrale-os/shell/issues/62)) ([5199f73](https://github.com/astrale-os/shell/commit/5199f7358a64cfb1163ebb6d13c94a8b8080bcc1))
-
-## [0.1.0-beta.6](https://github.com/astrale-os/shell/compare/shell-domain-v0.1.0-beta.5...shell-domain-v0.1.0-beta.6) (2026-08-24)
-
-
-### Features
-
-* adopt Kernel V2 at the Shell client boundary ([6654ef7](https://github.com/astrale-os/shell/commit/6654ef7989691664af777824be2c97a2906b4008))
-* **domain:** deploy shell through default adapter ([ea96d06](https://github.com/astrale-os/shell/commit/ea96d06180ba65b67dda24ad25c95da621796f17))
-* **domain:** deploy Shell through default adapter ([43bc418](https://github.com/astrale-os/shell/commit/43bc418952666d7aac26194134c2776b58c355e7))
-* **domain:** publish @astrale-domains/shell ([905488b](https://github.com/astrale-os/shell/commit/905488b647e73793eb18ec50e5b06f763b7630e8))
-* **domain:** publish semantic Shell package ([959560c](https://github.com/astrale-os/shell/commit/959560c26e9b86a402b0f252f0a4763d76fd1e8a))
-* **shell:** author graph operations with direct node targets ([a189028](https://github.com/astrale-os/shell/commit/a189028cee3d5f14678325c713b9439487c9e224))
-* **shell:** author graph operations with node targets ([97f0599](https://github.com/astrale-os/shell/commit/97f05997bb34e8935349dbb6f5b9e55a2432cca3))
-
-
-### Bug Fixes
-
-* adopt current Shell domain bindings ([121c7be](https://github.com/astrale-os/shell/commit/121c7bea57ad1bf4cedbab90ed8cba8f59955f06))
-* adopt source cohort domain bindings ([bf79155](https://github.com/astrale-os/shell/commit/bf7915555d7152b2e70127b54a1e8b4fdc269b04))
-* adopt the official kernel cohort ([#47](https://github.com/astrale-os/shell/issues/47)) ([c15a5b0](https://github.com/astrale-os/shell/commit/c15a5b0d8c9f4c3f6dd49bf122cfea09c4af42da))
-* align Shell with current Kernel cohort ([d1abeaf](https://github.com/astrale-os/shell/commit/d1abeaf2a418e7e6bf89ea85512cd0e8942d407b))
-* **ci:** publish semantic Shell on npm ([2ba1532](https://github.com/astrale-os/shell/commit/2ba1532f07d3b155d0456596c4b3d1e9bca31fdb))
-* **ci:** qualify Node 24 and standalone Domain ([873d70a](https://github.com/astrale-os/shell/commit/873d70aa71013de0096ec31c774ad33cc355800a))
-* **ci:** qualify Shell domain cohort ([a182141](https://github.com/astrale-os/shell/commit/a1821414552bd9fa5a7083086c7130b5ca27879b))
-* **ci:** use npmjs for standalone domain ([aafe1a7](https://github.com/astrale-os/shell/commit/aafe1a7dbb494c0acbb09282cc9162fe8bcbd767))
-* **deps:** require sdk runtime context ([91cf38d](https://github.com/astrale-os/shell/commit/91cf38d9d02aa92892a42e789d6f6393b7a318e1))
-* **domain:** align deployment with current SDK ([7a5fbae](https://github.com/astrale-os/shell/commit/7a5fbae7283aac0bb9f1aebd7b7bb0a753a1ba15))
-* **domain:** prove remote shell authority ([fad6dc5](https://github.com/astrale-os/shell/commit/fad6dc54e3686567282c8aee779a117bfbb7c6c5))
-* **domain:** publish the semantic Shell package ([c049a9d](https://github.com/astrale-os/shell/commit/c049a9dd581a569965907f549ef784bff03a37d3))
-* **domain:** refresh standalone dependency lock ([d4f09e0](https://github.com/astrale-os/shell/commit/d4f09e07f578763f079095bb05a268faf739aa1f))
-* **domain:** use the published SDK boundary ([2e494c6](https://github.com/astrale-os/shell/commit/2e494c6f8b4d3d25c71bbe51b37436fd35d6c42a))
-* preserve the shell domain package contract ([#49](https://github.com/astrale-os/shell/issues/49)) ([e187889](https://github.com/astrale-os/shell/commit/e18788936fa4f4cb15e4fbc7d0f28eaff0cbd543))
-* qualify the Shell release cohort ([8f837e1](https://github.com/astrale-os/shell/commit/8f837e1bf14600db18b96da6de7878f34321332c))
-* qualify the Shell release cohort ([efb23d7](https://github.com/astrale-os/shell/commit/efb23d71088a407209a01cec33e5571d86ecde51))
-* **release:** qualify published sdk runtime context ([b1411a0](https://github.com/astrale-os/shell/commit/b1411a01710bab785b31c02c81ea09bc902f4e42))

package/dist/functions/group/assign-user-to-group.js

@@ -1,4 +0,0 @@
-import { defineWorkflow } from '@astrale-os/sdk/workflow';
-import { changeGroupMembership } from './change-user-group-membership.js';
-import { groupMembershipErrors } from './group-membership-errors.js';
-export const assignUser = defineWorkflow()('Group.assignUser', { errors: groupMembershipErrors }, (context) => changeGroupMembership(context, true));

package/dist/schema/modules/group/functions/assign-user-to-group.d.ts

@@ -1,7 +0,0 @@
-export declare const assignUser: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
-    user: string;
-    group: string;
-}, {
-    readonly mode: 'value';
-    readonly value: Record<string, never>;
-}, "authorized", true, false>>;