@astrale-domains/shell 0.1.0-beta.4 → 0.1.0-beta.41

package/README.md

@@ -1,66 +1,145 @@
 # Shell Domain
 
-Shell is the minimal Kernel-native application plane. Its durable model is one `User` interface,
-the concrete `User`, `Group`, `Space`, and `Application` Node Classes, eight relationships, five
-Policies, two Functions, seven Methods, five Kernel View declarations, and four deterministic Core
-nodes.
-
-The `ensureUser` Function is the Shell-owned identity genesis boundary. It idempotently provisions an
-externally identified `User`, their personal `Space`, and both ownership/default relationships under
-the installed Shell Domain's authority. `ensureAdministrator` idempotently assigns one existing User
-to Shell's administrator Group. Both keep product mutation under Shell authority while allowing an
-authenticated genesis operator to request the transition.
-
-The Methods are:
-
-- Group: `assignUser`, `unassignUser`;
-- Space: `addUser`, `removeUser`, `setDefault`; and
-- Application: `install`, `uninstall`.
-
-Installation authors the `admin`, `member`, `default-space`, and `shell` Core. An authenticated genesis
-operator may invoke `ensureUser`, but cannot mutate Shell Classes directly. The remote handler performs
-the atomic identity provisioning as Shell, then callers assign the User explicitly to a Group. Shell
-infers no authority from email, claims, path spelling, or creation order.
-
-## Source ownership
-
-- `schema/` owns the complete Domain contract, public Method values, Policies, relationships, DSL
-  Views, and Core graph;
-- `rules/` owns synchronous classifications, decisions, normalization, and result projection;
-- `queries/` owns canonical single and composite graph observations plus explicit bounded continuation
-  pagination when a business observation requires the complete set;
-- `mutations/` owns canonical atomic graph changes and their expected rejection evidence;
-- `workflows/` owns replay-shaped multi-step business journeys and unknown-outcome recovery;
-- `functions/` binds the Function and each Method to a rule, workflow, or direct operation;
-- `utils/` owns only the shared graph-endpoint and bounded-query mechanics used by independent
-  submodules; and
-- root `tests/` owns cross-layer and system evidence, while each semantic submodule owns focused
-  evidence in `__tests__/`.
-
-No current responsibility earns a `states/`, `capabilities/`, `integrations/`, `migrations/`,
-`views/`, `ui/`, or root `scripts/` source layer. DSL View declarations remain in Schema; a future
-frontend projection or UI must establish its own concrete responsibility before adding those layers.
-
-Shell never re-declares shared metadata properties. `Group` and `Space` currently name `K.Named`
-and `K.Descriptable` in their `implements` lists because the current DSL makes only `K.Node`
-intrinsic and Core-property admission otherwise rejects `name` and `description`. Removing those
-interface references awaits the recorded Kernel authoring-default decision; no timestamps are
-authored by Shell.
-
-## Execution and evidence
-
-`ShellDomain` is the complete remote product implementation. Its exact handler map proves that the
-genesis Functions and all seven Methods are served from the same immutable publication. The handlers use
-the SDK's canonical Auth, Query, Mutation, Result, Workflow, and Step contracts. `ensureUser` relies on
-the Kernel provision operation's stable idempotency key; the SDK's current inline Step runner does not
-claim process-restart replay on its own.
-
-The executable contract lives in Shell's semantic source, public facades, and tests. Product
-decisions, journeys, legacy disposition, dependency gates, and qualification evidence live in
-[`.history/`](.history/). Product Domains intentionally have no `.spec/` tree; Kernel authoring
-values come through semantic `@astrale-os/sdk/*` facades.
-
-The source, deterministic Knowledge linter, TypeScript package, unit/cross-layer tests, and remote Shell
-contract are qualified locally. Installed-instance, released-package, browser, and live
-credential journeys are separate evidence levels and are not claimed here. Shell does not broker
-authentication tokens; standard Domain token exchange is owned by Protocol, Server, and SDK.
+Shell owns two concrete Identity classes, User and Group, the member_of_group relation,
+the admin/member/applications Core groups, three static methods, one Domain function, and one
+application View, which is its entrypoint. The Schema names the Domain `Shell`. There is no Space, setup function, personal home, or public repair method.
+
+## Contracts
+
+| Static method | Input | Output |
+| --- | --- | --- |
+| User.invite | `{ user: UserPath, email: string }` | `{ invitationId, user, state }` |
+| Group.assignMember | `{ member: UserPath \| GroupPath, group: GroupPath }` | `{}` |
+| Group.unassignMember | Same | `{}` |
+
+| Domain function | Input | Output |
+| --- | --- | --- |
+| listEntrypoints | `{}` | `{ entrypoints: { origin, name, view }[] }` |
+
+listEntrypoints reads, with Shell's own authority, every Kernel `of_domain` locator whose View has
+an outgoing `entrypoint` Edge, and returns one entry per Domain in origin order: its origin, the
+`name` of its Domain Node, and the key of its entrypoint View. A Domain without an entrypoint is
+not listed. Shell requires `read` on Kernel `Domain` and `of_domain`, and `traverse` on `entrypoint`
+and `View`. Its `usesFunction` Policy admits any caller whose composed profile holds `can_use`
+on the Function, so holding the capability is enough.
+
+The Core `applications` Group carries `can_use` on listEntrypoints and View.resolve. Administrators
+hold both directly (a Core Edge cannot author Kernel `extends_with`); members do not.
+Share them dynamically with `Group.assignMember({ member: user, group: applications })`, which
+composes the profile through `extends_with`; `unassignMember` withdraws it.
+
+User extends Kernel.Identity and owns only optional creationKey correlation.
+Concrete business classes may declare their own displayName/email; Shell never reads or writes them.
+Group extends Kernel.Identity, Named and Descriptable. Authentication remains the
+Kernel-owned, write-once iss/sub binding. Invitation email is explicit input, not a User property.
+
+| Operation | Schema Policy alternatives, in addition to Kernel admission |
+| --- | --- |
+| invite | Core admin membership AND Shell-owned concrete User class; or ownership of the User's concrete class |
+| assignMember / unassignMember | Core admin membership AND Shell-owned concrete Group class; or ownership of the Group's concrete class |
+
+ownsClass follows instance_of → concrete class → of_domain → caller. It does not
+infer ownership from an email, a subclass name, or ownership of an ancestor class.
+A Domain cannot assign its Employee to Core member merely by owning Employee. Admin's invitation
+orchestration retains that responsibility. A Group's owner may manage any admitted User or Group in that Group.
+administersShellClass connects Core admin membership and concrete ownership in one Policy pattern;
+it does not treat inheritance from Shell as ownership. These are callable restrictions, not an
+isolation boundary against Root/Manager or the existing broad administrator Kernel profile.
+With Kernel Host beta94 or newer, an external caller needs callable authority through its own
+identity composition AND a passing callable Policy. Declare exact foreign methods in the calling
+Domain's requirements; can_use no longer bypasses the Policy. Root and exact owner exceptions remain.
+
+## Flows
+
+```text
+Domain creates Employee extending User → unregistered, no group
+Direct credential-evidenced Register → same node authenticates, still no group
+User.invite → provider authentication → Admin ingress → WorkOS/login
+            → Admin Register on that same node → member assignment → completed
+Group.assignMember → member_of_group + Kernel.extends_with in one atomic mutation
+Group.unassignMember → remove both edges in one atomic mutation
+```
+
+The invitation flow is coordinated by Admin, not by an Employee callback. Shell's Integration
+carries only user/email/requestId/requestedBy. Its Provider mints an invocation-bound Shell
+proof for its configured HTTPS ingress audience; target/sourceProof are not business inputs.
+A returned pending invitation does not prove email delivery or completed registration.
+
+`assignMember({ member: A, group: B })` adds A to B. A and its current and future members inherit
+B's authority. Groups can have several parents; Kernel rejects self-membership and cycles in the
+same transaction as both membership edges. The target Group's manager authorizes this delegation;
+the child Group's managers can subsequently change the population that inherits it.
+
+`unassignMember` removes only that direct pair. Another membership path can preserve effective
+access. Queries of `member_of_group` continue to return direct facts; Grant evaluation expands
+identity composition for Policies. Shell must be able to traverse both concrete endpoint Classes,
+including a foreign Group used as the member.
+
+Membership methods converge both edges, including an observed partial membership.
+After an uncertain mutation response they re-read the pair; an unconfirmed outcome remains
+explicitly unconfirmed. This is not a global repair scan or an exactly-once guarantee.
+
+A Team class extending Group can carry a business permission edge to Project. Membership
+composition lets an Employee's expanded grant include Team; the protected Project Policy is
+still evaluated by Kernel. Removing composition removes that authority path. Installed
+Kernel E2E evidence, not a handler test, qualifies this behavior.
+
+## Installation and View
+
+The Shell principal requests all Kernel root functions, the required extends_with operations,
+and the declared grant/revoke authority. Core admin receives the full declared Shell profile,
+including invite, assignMember and unassignMember so humans inheriting admin can call those methods.
+Core member receives Introspect, Query, Mutate and View.resolve, not blanket class-read grants.
+The Domain definition's requirements, including Core Identity capabilities in requirements.core, are owned by domain.ts and materialized by installation,
+never by invitation handlers.
+
+The sole application entrypoint uses the Vite React frontend at /, composed with
+`@astrale-os/shell-react` and `@astrale-os/ui`. It lists visible User/Group families in two tabs
+under the caller's session, with loading/empty/error states and independent refresh.
+Users display their concrete class and Node ID, not a guessed foreign profile.
+It does not proxy privileged directory reads or enumerate installed applications.
+
+## Source and qualification
+
+Each declaration, Query and Mutation has its own semantic file. Layer roots are facades;
+functions own orchestration, integrations/providers own external effects, views/ui own the
+directory surface. Runtime has one default export and binds the three static Workflows.
+The Dataset is referenced lazily by the root astrale.config.ts.
+
+Domain authors import Schema from @astrale-domains/shell; platform workers use the explicit
+/domain and /runtime exports. Creation/registration, installation authority, invitation
+delivery, runtime replay and browser rendering are separate qualification boundaries.
+The redesigned Admin composition, published Register cohort and real invitation/instance-create
+journeys remain release gates; this source README is not evidence that those gates passed.
+
+### Publication boundary
+
+`@astrale-domains/shell` is an executable platform package and a deliberate exception to the normal
+Domain publication product. It publishes the remote Shell Domain definition and runtime needed by platform
+Worker deployments through the explicit `./domain` and `./runtime` subpaths, while its root remains
+Schema-only. Its build therefore compiles the explicit roots in `tsconfig.package.json` and applies
+Shell-owned normalization and checks to the emitted platform closure. Source-only `#` aliases are
+rewritten to relative JS and declaration references so consumer path mappings cannot capture private Shell
+types. Tarball qualification then verifies the exact exports, isolated subpaths, absence of source
+maps, and an install using only public npm dependencies.
+
+The generic `astrale-domain package` command remains Schema-only and exposes only the Domain root plus
+package metadata. This Shell exception must not be copied to ordinary product Domains or used to
+weaken that SDK contract. Deployment consumers must use the explicit executable subpaths so a linked
+schema import cannot traverse Shell's private application or runtime implementation.
+
+Source, package, and deterministic test qualification remain distinct from installed-instance,
+released-package, browser, and live-credential evidence. Shell does not broker authentication
+tokens; standard Domain token exchange is owned by Protocol, Server, and SDK.
+
+### Breaking membership API migration
+
+`Group.assignMember` / `Group.unassignMember` replace `assignUser` / `unassignUser` without aliases.
+Callers must change `{ user, group }` to `{ member, group }` and declare the new exact callable
+requirements. The `member_of_group` Class key is preserved; its source role is now `member` and
+accepts User or Group families. Existing User memberships remain valid.
+
+Rebuild and install all affected Schema dependents as one coherent revision closure. Admin bootstrap
+and invitation completion must use the new API when this Shell revision is installed. A downgrade
+to the User-only contract requires handling any Group-to-Group facts first. Validate public admission,
+foreign endpoint traversal, and deployed revisions during the coordinated release.

package/dist/domain.d.ts

@@ -0,0 +1,99 @@
+import { type DomainDefinition } from '@astrale-os/sdk/domain';
+import { ShellSchema } from './schema/index.js';
+import { type ShellRuntime } from './runtime.js';
+declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale-os/sdk/schema").AuthoredSchema<"shell.astrale.ai", readonly ["kernel.astrale.ai", import("@astrale-os/sdk/schema").KernelSchema] | readonly ["shell.astrale.ai", {
+    readonly name: 'Shell';
+    readonly entrypoint: 'application';
+    readonly classes: {
+        readonly User: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+            readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">];
+            readonly properties: {
+                readonly creationKey: import("zod").ZodOptional<import("zod").ZodString>;
+            };
+            readonly methods: {
+                readonly invite: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    user: string;
+                    email: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        invitationId: string;
+                        user: string;
+                        state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
+                    };
+                }, "authorized", true, false, undefined>>;
+            };
+        }>;
+        readonly Group: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+            readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
+            readonly methods: {
+                readonly assignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
+                    group: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", true, false, undefined>>;
+                readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
+                    group: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", true, false, undefined>>;
+            };
+        }>;
+        readonly member_of_group: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+            readonly depth: 0;
+            readonly abstract: false;
+            readonly extends: readonly [];
+            readonly properties: never;
+            readonly source: {
+                readonly as: "member";
+                readonly outgoing: "0..*";
+            };
+            readonly target: {
+                readonly as: "group";
+                readonly incoming: "0..*";
+            };
+            readonly constraints: Record<never, never>;
+            readonly effectiveProperties: never;
+        }>;
+    };
+    readonly functions: {
+        readonly listEntrypoints: import("@astrale-os/sdk/schema").Function<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: {
+                entrypoints: {
+                    origin: string;
+                    name: string;
+                    view: string;
+                }[];
+            };
+        }, "authorized", false, false, undefined>>;
+    };
+    readonly policies: {
+        readonly belongsToGroup: import("@astrale-os/sdk/schema").Policy;
+        readonly ownsClass: import("@astrale-os/sdk/schema").Policy;
+        readonly administersShellClass: import("@astrale-os/sdk/schema").Policy;
+        readonly usesFunction: import("@astrale-os/sdk/schema").Policy;
+    };
+    readonly views: {
+        readonly application: import("@astrale-os/sdk/schema").View;
+    };
+    readonly core: {
+        readonly nodes: {
+            readonly admin: import("@astrale-os/sdk/schema").CoreNode;
+            readonly applications: import("@astrale-os/sdk/schema").CoreNode;
+            readonly member: import("@astrale-os/sdk/schema").CoreNode;
+        };
+    };
+}, {
+    readonly kernel: "kernel.astrale.ai";
+}]>>;
+declare const domainRequirements: import("@astrale-os/sdk/domain").Requirements;
+export type ShellDomain = DomainDefinition<typeof ShellSchema, ShellRuntime, typeof frontend, undefined, typeof domainRequirements>;
+export declare const domain: ShellDomain;
+export {};

package/dist/domain.js

@@ -0,0 +1,77 @@
+import { defineDomain, defineFrontend, vite, requirements, } from '@astrale-os/sdk/domain';
+import { K, KernelRootFunctions } from '@astrale-os/sdk/schema';
+import { ShellSchema, S } from './schema/index.js';
+import runtime, {} from './runtime.js';
+const frontend = defineFrontend({
+    schema: ShellSchema,
+    source: vite({ config: './frontend/vite.config.ts' }),
+    routes: { application: { path: '/', handshake: 'shell' } },
+});
+const domainRequirements = requirements({
+    // Sujet implicite : le principal installé Shell, utilisé par kernel.self.
+    functions: KernelRootFunctions,
+    classes: [
+        { class: K.classes.extends_with, operations: ['create', 'read', 'traverse', 'delete'] },
+        // listEntrypoints reads every entrypoint View locator and its Domain as Shell.
+        { class: K.classes.Domain, operations: ['read'] },
+        { class: K.classes.of_domain, operations: ['read'] },
+        { class: K.classes.entrypoint, operations: ['traverse'] },
+        { class: K.classes.View, operations: ['traverse'] },
+    ],
+    authority: {
+        grant: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'revoke'],
+        revoke: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'grant'],
+    },
+    // Ces profils sont matérialisés par l'installeur, pas par un handler Shell.
+    core: [
+        {
+            subject: S.core.nodes.admin,
+            functions: [
+                ...KernelRootFunctions,
+                S.classes.User.static.methods.invite,
+                S.classes.Group.static.methods.assignMember,
+                S.classes.Group.static.methods.unassignMember,
+                // Core Edges cannot author Kernel extends_with, so administrators hold it directly.
+                S.functions.listEntrypoints,
+            ],
+            classes: [
+                { class: S.classes.User, operations: ['create', 'read', 'traverse', 'update', 'delete'] },
+                {
+                    class: S.classes.Group,
+                    operations: ['create', 'read', 'traverse', 'update', 'delete'],
+                },
+                {
+                    class: S.classes.member_of_group,
+                    operations: ['create', 'read', 'traverse', 'update', 'delete'],
+                },
+                { class: K.classes.extends_with, operations: ['create', 'read', 'traverse', 'delete'] },
+            ],
+            authority: {
+                grant: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'revoke'],
+                revoke: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'grant'],
+            },
+        },
+        {
+            subject: S.core.nodes.member,
+            functions: [
+                // Download re-reads the holder Node with the caller's authority: no new data exposure.
+                K.functions.download,
+                K.functions.introspect,
+                K.functions.query,
+                K.functions.mutate,
+                K.classes.View.static.methods.resolve,
+            ],
+        },
+        {
+            // Shared dynamically: Group.assignMember(user, applications) composes this profile.
+            subject: S.core.nodes.applications,
+            functions: [S.functions.listEntrypoints, K.classes.View.static.methods.resolve],
+        },
+    ],
+});
+export const domain = defineDomain({
+    schema: ShellSchema,
+    runtime,
+    frontend,
+    requirements: domainRequirements,
+});

package/dist/functions/application/index.js

@@ -1,3 +1 @@
-export { installApplication } from './install.js';
-export { uninstallApplication } from './uninstall.js';
-//# sourceMappingURL=index.js.map
+export { listEntrypoints } from './list-entrypoints.js';

package/dist/functions/application/list-entrypoints.js

@@ -0,0 +1,4 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { readInstalledEntrypoints } from '../../queries/application/index.js';
+/** One graph read: every Domain with an `entrypoint` Edge, its name and its entrypoint View. */
+export const listEntrypoints = defineAction()('listEntrypoints', async ({ query }) => ({ entrypoints: [...(await query(readInstalledEntrypoints, {}))] }));

package/dist/functions/group/assign-member-to-group.js

@@ -0,0 +1,4 @@
+import { defineWorkflow } from '@astrale-os/sdk/workflow';
+import { changeGroupMembership } from './change-group-membership.js';
+import { groupMembershipErrors } from './group-membership-errors.js';
+export const assignMember = defineWorkflow()('Group.assignMember', { errors: groupMembershipErrors }, (context) => changeGroupMembership(context, true));

package/dist/functions/group/change-group-membership.js

@@ -0,0 +1,34 @@
+import { setGroupMembership } from '../../mutations/group/index.js';
+import { readGroupMembership, readGroupMembershipEndpoints, } from '../../queries/group/index.js';
+import { canonicalNodeId } from '../../utils/canonical-node-path/index.js';
+const matches = (state, present) => state.membership === present && state.authority === present;
+export async function changeGroupMembership(context, present) {
+    const invalid = () => context.error('INVALID_GROUP_MEMBERSHIP_REFERENCE', {});
+    const membership = {
+        member: canonicalNodeId(context.input.member, invalid),
+        group: canonicalNodeId(context.input.group, invalid),
+    };
+    const observe = async () => {
+        const endpoints = await context.query(readGroupMembershipEndpoints, membership);
+        if (!endpoints.visible)
+            throw context.error('GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE', {});
+        const current = await context.query(readGroupMembership, membership);
+        return { ...current, endpoints: endpoints.guard };
+    };
+    const current = await context.step.run('observe-membership', observe);
+    if (matches(current, present))
+        return {};
+    const result = await context.step.run('mutate-membership', () => context.mutate(setGroupMembership, { ...membership, current, present }));
+    if (result.ok)
+        return {};
+    if (result.outcomeKnown) {
+        throw context.error('GROUP_MEMBERSHIP_CONFLICT', { cause: result.code });
+    }
+    const recovered = await context.step.run('recover-membership', observe);
+    if (matches(recovered, present))
+        return {};
+    throw context.error('GROUP_MEMBERSHIP_UNCONFIRMED', {
+        cause: result.code,
+        outcomeKnown: false,
+    });
+}

package/dist/functions/group/group-membership-errors.js

@@ -0,0 +1,23 @@
+import { z } from 'zod';
+export const groupMembershipErrors = {
+    GROUP_MEMBERSHIP_ENDPOINTS_UNAVAILABLE: {
+        family: 'CONFLICT',
+        message: 'Shell must be able to traverse both membership endpoints before confirming membership.',
+        details: z.strictObject({}),
+    },
+    INVALID_GROUP_MEMBERSHIP_REFERENCE: {
+        family: 'VALIDATION_ERROR',
+        message: 'Member and group must be exact canonical @NodeId paths.',
+        details: z.strictObject({}),
+    },
+    GROUP_MEMBERSHIP_CONFLICT: {
+        family: 'CONFLICT',
+        message: 'Membership changed concurrently; retry the operation.',
+        details: z.strictObject({ cause: z.string() }),
+    },
+    GROUP_MEMBERSHIP_UNCONFIRMED: {
+        family: 'CONFLICT',
+        message: 'The requested membership could not be confirmed; retry the operation.',
+        details: z.strictObject({ cause: z.string(), outcomeKnown: z.literal(false) }),
+    },
+};

package/dist/functions/group/index.js

@@ -1,3 +1,2 @@
-export { assignGroupUser } from './assign-user.js';
-export { unassignGroupUser } from './unassign-user.js';
-//# sourceMappingURL=index.js.map
+export { assignMember } from './assign-member-to-group.js';
+export { unassignMember } from './unassign-member-from-group.js';

package/dist/functions/group/unassign-member-from-group.js

@@ -0,0 +1,4 @@
+import { defineWorkflow } from '@astrale-os/sdk/workflow';
+import { changeGroupMembership } from './change-group-membership.js';
+import { groupMembershipErrors } from './group-membership-errors.js';
+export const unassignMember = defineWorkflow()('Group.unassignMember', { errors: groupMembershipErrors }, (context) => changeGroupMembership(context, false));

package/dist/functions/user/index.js

@@ -1,3 +1 @@
-export { ensureAdministrator } from './administrator.js';
-export { ensureShellUser, ensureUser, lookupShellUser, } from './ensure.js';
-//# sourceMappingURL=index.js.map
+export { invite } from './invite-user.js';

package/dist/functions/user/invite-user.js

@@ -0,0 +1,39 @@
+import { defineWorkflow } from '@astrale-os/sdk/workflow';
+import { z } from 'zod';
+import { InvitationRequestFailure } from '../../integrations/user-invitation/index.js';
+import { canonicalNodeId } from '../../utils/canonical-node-path/index.js';
+export const invite = defineWorkflow()('User.invite', {
+    errors: {
+        INVALID_INVITATION_REFERENCE: {
+            family: 'VALIDATION_ERROR',
+            message: 'User must be an exact canonical @NodeId path.',
+            details: z.strictObject({}),
+        },
+        INVITATION_CONFLICT: {
+            family: 'CONFLICT',
+            message: 'The invitation conflicts with an existing request.',
+            details: z.strictObject({ requestId: z.string() }),
+        },
+        INVITATION_REJECTED: {
+            family: 'VALIDATION_ERROR',
+            message: 'Admin rejected the invitation request.',
+            details: z.strictObject({ requestId: z.string() }),
+        },
+    },
+}, async (context) => {
+    const user = canonicalNodeId(context.input.user, () => context.error('INVALID_INVITATION_REFERENCE', {}));
+    const requestId = context.execution.idempotencyKey ?? crypto.randomUUID();
+    try {
+        return await context.step.run('request-invitation', () => context.integrations.enrollment.invite({
+            user,
+            email: context.input.email,
+            requestId,
+            requestedBy: context.caller.identity,
+        }));
+    }
+    catch (cause) {
+        if (cause instanceof InvitationRequestFailure)
+            throw context.error(cause.code, { requestId });
+        throw cause;
+    }
+});

package/dist/index.d.ts

@@ -1,4 +1 @@
-export { Application, Group, ORIGIN, S, ShellCore, ShellSchema, Space, User, adminGroup, administers_group, administers_space, applicationCore, applicationInstall, applicationUninstall, applicationView, application_of, belongsToSpace, default_space, defaultSpace, ensureAdministrator, ensureUser, groupAssignUser, groupCore, groupUnassignUser, groupView, homeView, iUser, installed_in, mayAdministerApplication, mayAdministerGroup, mayAdministerSpace, memberGroup, member_of_group, member_of_space, owns_space, ownsSpace, shellApplication, spaceAddUser, spaceCore, spaceRemoveUser, spaceSetDefault, spaceView, userView, type GroupMembershipInput, type GroupMembershipResult, type EnsureShellAdministratorInput, type EnsureShellAdministratorResult, type EnsureShellUserResult, type InstallApplicationInput, type InstallApplicationResult, type SetDefaultSpaceInput, type SetDefaultSpaceResult, type Shell, type ShellCoreName, type ShellDomainOperations, type ShellEdgeName, type ShellNodeName, type ShellSchemaInput, type SpaceUserAccess, type SpaceUserAccessInput, type SpaceUserAccessResult, type SpaceUserInput, type SpaceUserResult, type UninstallApplicationInput, type UninstallApplicationResult, } from '#schema';
-export { ShellDomain } from './public.js';
-export { buildShellUserProvisioning, projectShellUserProvisioning, type EnsureShellUserInput, type ShellUserProvisioning, } from './rules/user/index.js';
-//# sourceMappingURL=index.d.ts.map
+export { ShellSchema, S, type Shell, type ShellClasses, type ShellSchemaInput, type InvitationSummary, User, Group, member_of_group, adminGroup, memberGroup, } from './schema/index.js';

package/dist/index.js

@@ -1,4 +1 @@
-export { Application, Group, ORIGIN, S, ShellCore, ShellSchema, Space, User, adminGroup, administers_group, administers_space, applicationCore, applicationInstall, applicationUninstall, applicationView, application_of, belongsToSpace, default_space, defaultSpace, ensureAdministrator, ensureUser, groupAssignUser, groupCore, groupUnassignUser, groupView, homeView, iUser, installed_in, mayAdministerApplication, mayAdministerGroup, mayAdministerSpace, memberGroup, member_of_group, member_of_space, owns_space, ownsSpace, shellApplication, spaceAddUser, spaceCore, spaceRemoveUser, spaceSetDefault, spaceView, userView, } from '#schema';
-export { ShellDomain } from './public.js';
-export { buildShellUserProvisioning, projectShellUserProvisioning, } from './rules/user/index.js';
-//# sourceMappingURL=index.js.map
+export { ShellSchema, S, User, Group, member_of_group, adminGroup, memberGroup, } from './schema/index.js';

package/dist/integrations/index.d.ts

@@ -0,0 +1 @@
+export { integrations } from './integrations.js';

package/dist/integrations/index.js

@@ -0,0 +1 @@
+export { integrations } from './integrations.js';

package/dist/integrations/integrations.d.ts

@@ -0,0 +1,9 @@
+export declare const integrations: {
+    enrollment: import("@astrale-os/sdk/integration").IntegrationDefinition<"shell.enrollment", {
+        invite: import("@astrale-os/sdk/integration").IntegrationOperation<import("./user-invitation/index.js").InviteRequest, {
+            invitationId: string;
+            user: string;
+            state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
+        }>;
+    }>;
+};

package/dist/integrations/integrations.js

@@ -0,0 +1,2 @@
+import { enrollment } from './user-invitation/index.js';
+export const integrations = { enrollment };

package/dist/integrations/user-invitation/index.d.ts

@@ -0,0 +1,4 @@
+export { enrollment } from './request-user-invitation.js';
+export { InvitationRequestFailure } from './invitation-request-failure.js';
+export { type InviteRequest } from './invite-user-request.js';
+export type { InvitationSummary } from '../../schema/modules/user/index.js';

package/dist/integrations/user-invitation/index.js

@@ -0,0 +1,3 @@
+export { enrollment } from './request-user-invitation.js';
+export { InvitationRequestFailure } from './invitation-request-failure.js';
+export {} from './invite-user-request.js';

package/dist/integrations/user-invitation/invitation-request-failure.d.ts

@@ -0,0 +1,5 @@
+/** Expected business refusal from the invitation service, without its response body. */
+export declare class InvitationRequestFailure extends Error {
+    readonly code: 'INVITATION_CONFLICT' | 'INVITATION_REJECTED';
+    constructor(code: 'INVITATION_CONFLICT' | 'INVITATION_REJECTED');
+}

package/dist/integrations/user-invitation/invitation-request-failure.js

@@ -0,0 +1,9 @@
+/** Expected business refusal from the invitation service, without its response body. */
+export class InvitationRequestFailure extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = 'InvitationRequestFailure';
+    }
+}

package/dist/integrations/user-invitation/invite-user-request.d.ts

@@ -0,0 +1,6 @@
+export interface InviteRequest {
+    readonly requestId: string;
+    readonly user: string;
+    readonly email: string;
+    readonly requestedBy: string;
+}

package/dist/integrations/user-invitation/invite-user-request.js

@@ -0,0 +1 @@
+export {};