@astrale-domains/shell 0.1.0-beta.4 → 0.1.0-beta.7

package/dist/schema/group/methods.d.ts

@@ -5,16 +5,1022 @@ export interface GroupMembershipInput {
 }
 export interface GroupMembershipResult extends Readonly<Record<never, never>> {
 }
-export declare const groupAssignUser: import("@astrale-os/sdk/schema").Function<{
+export declare const groupAssignUser: import("@astrale-os/sdk/schema").Method<{
     readonly description: string;
     readonly input: z.ZodObject<{
-        user: import("@astrale-os/sdk/schema").Path<readonly [import("@astrale-os/sdk/schema").NodeInterface<{
-            readonly description: "A human-facing Shell principal.";
-            readonly extends: readonly [{
-                origin: "kernel.astrale.ai";
-                kind: 'interface';
-                name: "Identity";
+        user: import("@astrale-os/sdk/schema").PathAuthoring<readonly [import("@astrale-os/sdk/schema").NodeClass<{
+            readonly description: "One externally identified person using Shell.";
+            readonly extends: readonly [import("@astrale-os/sdk/schema").ResolvedClass<"node", Readonly<Readonly<{
+                frozen: import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, false> & {
+                    readonly name: "frozen";
+                    readonly key: "kernel.astrale.ai:class.Identity.property.frozen";
+                };
+                iss: import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                    readonly name: "iss";
+                    readonly key: "kernel.astrale.ai:class.Identity.property.iss";
+                };
+                requiredClaims: import("@astrale-os/sdk/schema").ResolvedProperty<({
+                    claim: string;
+                    op: "contains";
+                    value: unknown;
+                } | {
+                    claim: string;
+                    op: "eq";
+                    value: unknown;
+                } | {
+                    claim: string;
+                    op: "exists";
+                })[], false> & {
+                    readonly name: "requiredClaims";
+                    readonly key: "kernel.astrale.ai:class.Identity.property.requiredClaims";
+                };
+                sub: import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                    readonly name: "sub";
+                    readonly key: "kernel.astrale.ai:class.Identity.property.sub";
+                };
+            }>> & Iterable<(import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, false> & {
+                readonly name: "frozen";
+                readonly key: "kernel.astrale.ai:class.Identity.property.frozen";
+            }) | (import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                readonly name: "iss";
+                readonly key: "kernel.astrale.ai:class.Identity.property.iss";
+            }) | (import("@astrale-os/sdk/schema").ResolvedProperty<({
+                claim: string;
+                op: "contains";
+                value: unknown;
+            } | {
+                claim: string;
+                op: "eq";
+                value: unknown;
+            } | {
+                claim: string;
+                op: "exists";
+            })[], false> & {
+                readonly name: "requiredClaims";
+                readonly key: "kernel.astrale.ai:class.Identity.property.requiredClaims";
+            }) | (import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                readonly name: "sub";
+                readonly key: "kernel.astrale.ai:class.Identity.property.sub";
+            })> & {
+                readonly byKey: Readonly<{
+                    "kernel.astrale.ai:class.Identity.property.frozen": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, false> & {
+                        readonly name: "frozen";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.frozen";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.iss": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                        readonly name: "iss";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.iss";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.requiredClaims": import("@astrale-os/sdk/schema").ResolvedProperty<({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[], false> & {
+                        readonly name: "requiredClaims";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.requiredClaims";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.sub": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                        readonly name: "sub";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.sub";
+                    };
+                }>;
+                get<Key extends "kernel.astrale.ai:class.Identity.property.frozen" | "kernel.astrale.ai:class.Identity.property.iss" | "kernel.astrale.ai:class.Identity.property.requiredClaims" | "kernel.astrale.ai:class.Identity.property.sub">(key: Key): Readonly<{
+                    "kernel.astrale.ai:class.Identity.property.frozen": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, false> & {
+                        readonly name: "frozen";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.frozen";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.iss": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                        readonly name: "iss";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.iss";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.requiredClaims": import("@astrale-os/sdk/schema").ResolvedProperty<({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[], false> & {
+                        readonly name: "requiredClaims";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.requiredClaims";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.sub": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                        readonly name: "sub";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.sub";
+                    };
+                }>[Key];
+                get(key: import("@astrale-os/sdk/schema").PropertyKey): import("@astrale-os/sdk/schema").ResolvedProperty | undefined;
+                from(input: Readonly<{
+                    readonly "kernel.astrale.ai:class.Identity.property.frozen"?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                    readonly "kernel.astrale.ai:class.Identity.property.iss"?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                    readonly "kernel.astrale.ai:class.Identity.property.requiredClaims"?: ({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[] | undefined;
+                    readonly "kernel.astrale.ai:class.Identity.property.sub"?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                } & {
+                    readonly frozen?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                    readonly iss?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                    readonly requiredClaims?: ({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[] | undefined;
+                    readonly sub?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                }>): import("@astrale-os/sdk/schema").PropertyValues;
+            }, Readonly<Readonly<{
+                delegate: import("@astrale-os/sdk/schema").ResolvedMethod<{
+                    audience: string;
+                    ttlSeconds: number;
+                    attenuation: unknown;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: string;
+                }, false, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.delegate"> & {
+                    readonly name: "delegate";
+                };
+            }>> & Iterable<import("@astrale-os/sdk/schema").ResolvedMethod<{
+                audience: string;
+                ttlSeconds: number;
+                attenuation: unknown;
+            }, {
+                readonly mode: 'value';
+                readonly value: string;
+            }, false, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.delegate"> & {
+                readonly name: "delegate";
+            }> & {
+                readonly byKey: Readonly<{
+                    "kernel.astrale.ai:class.Identity.method.delegate": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        audience: string;
+                        ttlSeconds: number;
+                        attenuation: unknown;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: string;
+                    }, false, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.delegate"> & {
+                        readonly name: "delegate";
+                    };
+                }>;
+                get<Key extends "kernel.astrale.ai:class.Identity.method.delegate">(key: Key): Readonly<{
+                    "kernel.astrale.ai:class.Identity.method.delegate": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        audience: string;
+                        ttlSeconds: number;
+                        attenuation: unknown;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: string;
+                    }, false, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.delegate"> & {
+                        readonly name: "delegate";
+                    };
+                }>[Key];
+                get(key: import("@astrale-os/sdk/schema").MethodKey): import("@astrale-os/sdk/schema").ResolvedMethod | undefined;
+            }, Readonly<Readonly<{
+                can: import("@astrale-os/sdk/schema").ResolvedMethod<{
+                    policy: string;
+                    object: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        allowed: boolean;
+                    };
+                }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.can"> & {
+                    readonly name: "can";
+                };
+                mint: import("@astrale-os/sdk/schema").ResolvedMethod<{
+                    audience?: string | undefined;
+                    ttlSeconds: number;
+                    grant?: unknown;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: string;
+                }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.mint"> & {
+                    readonly name: "mint";
+                };
+                whoami: import("@astrale-os/sdk/schema").ResolvedMethod<Record<string, never>, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        id: string;
+                        issuer: string;
+                        subject: string;
+                        frozen: boolean;
+                        requiredClaims: ({
+                            claim: string;
+                            op: "contains";
+                            value: unknown;
+                        } | {
+                            claim: string;
+                            op: "eq";
+                            value: unknown;
+                        } | {
+                            claim: string;
+                            op: "exists";
+                        })[];
+                    };
+                }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.whoami"> & {
+                    readonly name: "whoami";
+                };
+                whois: import("@astrale-os/sdk/schema").ResolvedMethod<{
+                    issuer: string;
+                    subject: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        id: string;
+                        issuer: string;
+                        subject: string;
+                        frozen: boolean;
+                        requiredClaims: ({
+                            claim: string;
+                            op: "contains";
+                            value: unknown;
+                        } | {
+                            claim: string;
+                            op: "eq";
+                            value: unknown;
+                        } | {
+                            claim: string;
+                            op: "exists";
+                        })[];
+                    } | null;
+                }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.whois"> & {
+                    readonly name: "whois";
+                };
+            }>> & Iterable<(import("@astrale-os/sdk/schema").ResolvedMethod<{
+                policy: string;
+                object: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    allowed: boolean;
+                };
+            }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.can"> & {
+                readonly name: "can";
+            }) | (import("@astrale-os/sdk/schema").ResolvedMethod<Record<string, never>, {
+                readonly mode: 'value';
+                readonly value: {
+                    id: string;
+                    issuer: string;
+                    subject: string;
+                    frozen: boolean;
+                    requiredClaims: ({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[];
+                };
+            }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.whoami"> & {
+                readonly name: "whoami";
+            }) | (import("@astrale-os/sdk/schema").ResolvedMethod<{
+                issuer: string;
+                subject: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    id: string;
+                    issuer: string;
+                    subject: string;
+                    frozen: boolean;
+                    requiredClaims: ({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[];
+                } | null;
+            }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.whois"> & {
+                readonly name: "whois";
+            }) | (import("@astrale-os/sdk/schema").ResolvedMethod<{
+                audience?: string | undefined;
+                ttlSeconds: number;
+                grant?: unknown;
+            }, {
+                readonly mode: 'value';
+                readonly value: string;
+            }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.mint"> & {
+                readonly name: "mint";
+            })> & {
+                readonly byKey: Readonly<{
+                    "kernel.astrale.ai:class.Identity.method.can": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        policy: string;
+                        object: string;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            allowed: boolean;
+                        };
+                    }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.can"> & {
+                        readonly name: "can";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.mint": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        audience?: string | undefined;
+                        ttlSeconds: number;
+                        grant?: unknown;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: string;
+                    }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.mint"> & {
+                        readonly name: "mint";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.whoami": import("@astrale-os/sdk/schema").ResolvedMethod<Record<string, never>, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            id: string;
+                            issuer: string;
+                            subject: string;
+                            frozen: boolean;
+                            requiredClaims: ({
+                                claim: string;
+                                op: "contains";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "eq";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "exists";
+                            })[];
+                        };
+                    }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.whoami"> & {
+                        readonly name: "whoami";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.whois": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        issuer: string;
+                        subject: string;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            id: string;
+                            issuer: string;
+                            subject: string;
+                            frozen: boolean;
+                            requiredClaims: ({
+                                claim: string;
+                                op: "contains";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "eq";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "exists";
+                            })[];
+                        } | null;
+                    }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.whois"> & {
+                        readonly name: "whois";
+                    };
+                }>;
+                get<Key extends "kernel.astrale.ai:class.Identity.method.can" | "kernel.astrale.ai:class.Identity.method.mint" | "kernel.astrale.ai:class.Identity.method.whoami" | "kernel.astrale.ai:class.Identity.method.whois">(key: Key): Readonly<{
+                    "kernel.astrale.ai:class.Identity.method.can": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        policy: string;
+                        object: string;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            allowed: boolean;
+                        };
+                    }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.can"> & {
+                        readonly name: "can";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.mint": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        audience?: string | undefined;
+                        ttlSeconds: number;
+                        grant?: unknown;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: string;
+                    }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.mint"> & {
+                        readonly name: "mint";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.whoami": import("@astrale-os/sdk/schema").ResolvedMethod<Record<string, never>, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            id: string;
+                            issuer: string;
+                            subject: string;
+                            frozen: boolean;
+                            requiredClaims: ({
+                                claim: string;
+                                op: "contains";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "eq";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "exists";
+                            })[];
+                        };
+                    }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.whoami"> & {
+                        readonly name: "whoami";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.whois": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        issuer: string;
+                        subject: string;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            id: string;
+                            issuer: string;
+                            subject: string;
+                            frozen: boolean;
+                            requiredClaims: ({
+                                claim: string;
+                                op: "contains";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "eq";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "exists";
+                            })[];
+                        } | null;
+                    }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.whois"> & {
+                        readonly name: "whois";
+                    };
+                }>[Key];
+                get(key: import("@astrale-os/sdk/schema").MethodKey): import("@astrale-os/sdk/schema").ResolvedMethod | undefined;
+            }, Readonly<Readonly<{
+                frozen: import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, false> & {
+                    readonly name: "frozen";
+                    readonly key: "kernel.astrale.ai:class.Identity.property.frozen";
+                };
+                iss: import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                    readonly name: "iss";
+                    readonly key: "kernel.astrale.ai:class.Identity.property.iss";
+                };
+                requiredClaims: import("@astrale-os/sdk/schema").ResolvedProperty<({
+                    claim: string;
+                    op: "contains";
+                    value: unknown;
+                } | {
+                    claim: string;
+                    op: "eq";
+                    value: unknown;
+                } | {
+                    claim: string;
+                    op: "exists";
+                })[], false> & {
+                    readonly name: "requiredClaims";
+                    readonly key: "kernel.astrale.ai:class.Identity.property.requiredClaims";
+                };
+                sub: import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                    readonly name: "sub";
+                    readonly key: "kernel.astrale.ai:class.Identity.property.sub";
+                };
+            }>> & Iterable<(import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, false> & {
+                readonly name: "frozen";
+                readonly key: "kernel.astrale.ai:class.Identity.property.frozen";
+            }) | (import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                readonly name: "iss";
+                readonly key: "kernel.astrale.ai:class.Identity.property.iss";
+            }) | (import("@astrale-os/sdk/schema").ResolvedProperty<({
+                claim: string;
+                op: "contains";
+                value: unknown;
+            } | {
+                claim: string;
+                op: "eq";
+                value: unknown;
+            } | {
+                claim: string;
+                op: "exists";
+            })[], false> & {
+                readonly name: "requiredClaims";
+                readonly key: "kernel.astrale.ai:class.Identity.property.requiredClaims";
+            }) | (import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                readonly name: "sub";
+                readonly key: "kernel.astrale.ai:class.Identity.property.sub";
+            })> & {
+                readonly byKey: Readonly<{
+                    "kernel.astrale.ai:class.Identity.property.frozen": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, false> & {
+                        readonly name: "frozen";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.frozen";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.iss": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                        readonly name: "iss";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.iss";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.requiredClaims": import("@astrale-os/sdk/schema").ResolvedProperty<({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[], false> & {
+                        readonly name: "requiredClaims";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.requiredClaims";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.sub": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                        readonly name: "sub";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.sub";
+                    };
+                }>;
+                get<Key extends "kernel.astrale.ai:class.Identity.property.frozen" | "kernel.astrale.ai:class.Identity.property.iss" | "kernel.astrale.ai:class.Identity.property.requiredClaims" | "kernel.astrale.ai:class.Identity.property.sub">(key: Key): Readonly<{
+                    "kernel.astrale.ai:class.Identity.property.frozen": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, false> & {
+                        readonly name: "frozen";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.frozen";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.iss": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                        readonly name: "iss";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.iss";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.requiredClaims": import("@astrale-os/sdk/schema").ResolvedProperty<({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[], false> & {
+                        readonly name: "requiredClaims";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.requiredClaims";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.sub": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                        readonly name: "sub";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.sub";
+                    };
+                }>[Key];
+                get(key: import("@astrale-os/sdk/schema").PropertyKey): import("@astrale-os/sdk/schema").ResolvedProperty | undefined;
+                from(input: Readonly<{
+                    readonly "kernel.astrale.ai:class.Identity.property.frozen"?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                    readonly "kernel.astrale.ai:class.Identity.property.iss"?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                    readonly "kernel.astrale.ai:class.Identity.property.requiredClaims"?: ({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[] | undefined;
+                    readonly "kernel.astrale.ai:class.Identity.property.sub"?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                } & {
+                    readonly frozen?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                    readonly iss?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                    readonly requiredClaims?: ({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[] | undefined;
+                    readonly sub?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                }>): import("@astrale-os/sdk/schema").PropertyValues;
+            }, Readonly<Readonly<{
+                delegate: import("@astrale-os/sdk/schema").ResolvedMethod<{
+                    audience: string;
+                    ttlSeconds: number;
+                    attenuation: unknown;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: string;
+                }, false, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.delegate"> & {
+                    readonly name: "delegate";
+                };
+            }>> & Iterable<import("@astrale-os/sdk/schema").ResolvedMethod<{
+                audience: string;
+                ttlSeconds: number;
+                attenuation: unknown;
+            }, {
+                readonly mode: 'value';
+                readonly value: string;
+            }, false, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.delegate"> & {
+                readonly name: "delegate";
+            }> & {
+                readonly byKey: Readonly<{
+                    "kernel.astrale.ai:class.Identity.method.delegate": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        audience: string;
+                        ttlSeconds: number;
+                        attenuation: unknown;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: string;
+                    }, false, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.delegate"> & {
+                        readonly name: "delegate";
+                    };
+                }>;
+                get<Key extends "kernel.astrale.ai:class.Identity.method.delegate">(key: Key): Readonly<{
+                    "kernel.astrale.ai:class.Identity.method.delegate": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        audience: string;
+                        ttlSeconds: number;
+                        attenuation: unknown;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: string;
+                    }, false, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.delegate"> & {
+                        readonly name: "delegate";
+                    };
+                }>[Key];
+                get(key: import("@astrale-os/sdk/schema").MethodKey): import("@astrale-os/sdk/schema").ResolvedMethod | undefined;
+            }, Readonly<Readonly<{
+                can: import("@astrale-os/sdk/schema").ResolvedMethod<{
+                    policy: string;
+                    object: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        allowed: boolean;
+                    };
+                }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.can"> & {
+                    readonly name: "can";
+                };
+                mint: import("@astrale-os/sdk/schema").ResolvedMethod<{
+                    audience?: string | undefined;
+                    ttlSeconds: number;
+                    grant?: unknown;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: string;
+                }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.mint"> & {
+                    readonly name: "mint";
+                };
+                whoami: import("@astrale-os/sdk/schema").ResolvedMethod<Record<string, never>, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        id: string;
+                        issuer: string;
+                        subject: string;
+                        frozen: boolean;
+                        requiredClaims: ({
+                            claim: string;
+                            op: "contains";
+                            value: unknown;
+                        } | {
+                            claim: string;
+                            op: "eq";
+                            value: unknown;
+                        } | {
+                            claim: string;
+                            op: "exists";
+                        })[];
+                    };
+                }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.whoami"> & {
+                    readonly name: "whoami";
+                };
+                whois: import("@astrale-os/sdk/schema").ResolvedMethod<{
+                    issuer: string;
+                    subject: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        id: string;
+                        issuer: string;
+                        subject: string;
+                        frozen: boolean;
+                        requiredClaims: ({
+                            claim: string;
+                            op: "contains";
+                            value: unknown;
+                        } | {
+                            claim: string;
+                            op: "eq";
+                            value: unknown;
+                        } | {
+                            claim: string;
+                            op: "exists";
+                        })[];
+                    } | null;
+                }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.whois"> & {
+                    readonly name: "whois";
+                };
+            }>> & Iterable<(import("@astrale-os/sdk/schema").ResolvedMethod<{
+                policy: string;
+                object: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    allowed: boolean;
+                };
+            }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.can"> & {
+                readonly name: "can";
+            }) | (import("@astrale-os/sdk/schema").ResolvedMethod<Record<string, never>, {
+                readonly mode: 'value';
+                readonly value: {
+                    id: string;
+                    issuer: string;
+                    subject: string;
+                    frozen: boolean;
+                    requiredClaims: ({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[];
+                };
+            }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.whoami"> & {
+                readonly name: "whoami";
+            }) | (import("@astrale-os/sdk/schema").ResolvedMethod<{
+                issuer: string;
+                subject: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    id: string;
+                    issuer: string;
+                    subject: string;
+                    frozen: boolean;
+                    requiredClaims: ({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[];
+                } | null;
+            }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.whois"> & {
+                readonly name: "whois";
+            }) | (import("@astrale-os/sdk/schema").ResolvedMethod<{
+                audience?: string | undefined;
+                ttlSeconds: number;
+                grant?: unknown;
+            }, {
+                readonly mode: 'value';
+                readonly value: string;
+            }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.mint"> & {
+                readonly name: "mint";
+            })> & {
+                readonly byKey: Readonly<{
+                    "kernel.astrale.ai:class.Identity.method.can": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        policy: string;
+                        object: string;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            allowed: boolean;
+                        };
+                    }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.can"> & {
+                        readonly name: "can";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.mint": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        audience?: string | undefined;
+                        ttlSeconds: number;
+                        grant?: unknown;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: string;
+                    }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.mint"> & {
+                        readonly name: "mint";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.whoami": import("@astrale-os/sdk/schema").ResolvedMethod<Record<string, never>, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            id: string;
+                            issuer: string;
+                            subject: string;
+                            frozen: boolean;
+                            requiredClaims: ({
+                                claim: string;
+                                op: "contains";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "eq";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "exists";
+                            })[];
+                        };
+                    }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.whoami"> & {
+                        readonly name: "whoami";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.whois": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        issuer: string;
+                        subject: string;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            id: string;
+                            issuer: string;
+                            subject: string;
+                            frozen: boolean;
+                            requiredClaims: ({
+                                claim: string;
+                                op: "contains";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "eq";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "exists";
+                            })[];
+                        } | null;
+                    }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.whois"> & {
+                        readonly name: "whois";
+                    };
+                }>;
+                get<Key extends "kernel.astrale.ai:class.Identity.method.can" | "kernel.astrale.ai:class.Identity.method.mint" | "kernel.astrale.ai:class.Identity.method.whoami" | "kernel.astrale.ai:class.Identity.method.whois">(key: Key): Readonly<{
+                    "kernel.astrale.ai:class.Identity.method.can": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        policy: string;
+                        object: string;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            allowed: boolean;
+                        };
+                    }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.can"> & {
+                        readonly name: "can";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.mint": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        audience?: string | undefined;
+                        ttlSeconds: number;
+                        grant?: unknown;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: string;
+                    }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.mint"> & {
+                        readonly name: "mint";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.whoami": import("@astrale-os/sdk/schema").ResolvedMethod<Record<string, never>, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            id: string;
+                            issuer: string;
+                            subject: string;
+                            frozen: boolean;
+                            requiredClaims: ({
+                                claim: string;
+                                op: "contains";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "eq";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "exists";
+                            })[];
+                        };
+                    }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.whoami"> & {
+                        readonly name: "whoami";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.whois": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        issuer: string;
+                        subject: string;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            id: string;
+                            issuer: string;
+                            subject: string;
+                            frozen: boolean;
+                            requiredClaims: ({
+                                claim: string;
+                                op: "contains";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "eq";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "exists";
+                            })[];
+                        } | null;
+                    }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.whois"> & {
+                        readonly name: "whois";
+                    };
+                }>[Key];
+                get(key: import("@astrale-os/sdk/schema").MethodKey): import("@astrale-os/sdk/schema").ResolvedMethod | undefined;
+            }, import("@astrale-os/sdk/schema").NodeClassDefinition & {
+                readonly ref: import("@astrale-os/sdk/schema").ClassRef<"Identity"> & {
+                    readonly origin: "kernel.astrale.ai";
+                };
+                readonly kind: 'node';
+                readonly abstract: true;
+            }, readonly [import("@astrale-os/sdk/schema").ResolvedClass<"node", Readonly<Readonly<{}>> & Iterable<never> & {
+                readonly byKey: Readonly<{}>;
+                get<Key extends never>(key: Key): Readonly<{}>[Key];
+                get(key: import("@astrale-os/sdk/schema").PropertyKey): import("@astrale-os/sdk/schema").ResolvedProperty | undefined;
+                from(input: Readonly<{} & {}>): import("@astrale-os/sdk/schema").PropertyValues;
+            }, Readonly<Readonly<{}>> & Iterable<never> & {
+                readonly byKey: Readonly<{}>;
+                get<Key extends never>(key: Key): Readonly<{}>[Key];
+                get(key: import("@astrale-os/sdk/schema").MethodKey): import("@astrale-os/sdk/schema").ResolvedMethod | undefined;
+            }, Readonly<Readonly<{}>> & Iterable<never> & {
+                readonly byKey: Readonly<{}>;
+                get<Key extends never>(key: Key): Readonly<{}>[Key];
+                get(key: import("@astrale-os/sdk/schema").MethodKey): import("@astrale-os/sdk/schema").ResolvedMethod | undefined;
+            }, Readonly<Readonly<{}>> & Iterable<never> & {
+                readonly byKey: Readonly<{}>;
+                get<Key extends never>(key: Key): Readonly<{}>[Key];
+                get(key: import("@astrale-os/sdk/schema").PropertyKey): import("@astrale-os/sdk/schema").ResolvedProperty | undefined;
+                from(input: Readonly<{} & {}>): import("@astrale-os/sdk/schema").PropertyValues;
+            }, Readonly<Readonly<{}>> & Iterable<never> & {
+                readonly byKey: Readonly<{}>;
+                get<Key extends never>(key: Key): Readonly<{}>[Key];
+                get(key: import("@astrale-os/sdk/schema").MethodKey): import("@astrale-os/sdk/schema").ResolvedMethod | undefined;
+            }, Readonly<Readonly<{}>> & Iterable<never> & {
+                readonly byKey: Readonly<{}>;
+                get<Key extends never>(key: Key): Readonly<{}>[Key];
+                get(key: import("@astrale-os/sdk/schema").MethodKey): import("@astrale-os/sdk/schema").ResolvedMethod | undefined;
+            }, import("@astrale-os/sdk/schema").NodeClassDefinition & {
+                readonly ref: import("@astrale-os/sdk/schema").ClassRef<"Node"> & {
+                    readonly origin: "kernel.astrale.ai";
+                };
+                readonly kind: 'node';
+                readonly abstract: true;
+            }, readonly []> & {
+                readonly ref: import("@astrale-os/sdk/schema").ClassRef<"Node"> & {
+                    readonly origin: "kernel.astrale.ai";
+                };
+                readonly key: "kernel.astrale.ai:class.Node";
+            }]> & {
+                readonly ref: import("@astrale-os/sdk/schema").ClassRef<"Identity"> & {
+                    readonly origin: "kernel.astrale.ai";
+                };
+                readonly key: "kernel.astrale.ai:class.Identity";
             }];
+            readonly properties: {
+                displayName: import("@astrale-os/sdk/schema").Property<z.ZodString, {
+                    readonly required: false;
+                }>;
+            };
+            readonly methods: {
+                readonly resolveHome: import("@astrale-os/sdk/schema").Method<{
+                    readonly description: "Resolve this User and its canonical personal Space.";
+                    readonly auth: "authenticated";
+                    readonly input: z.ZodObject<{}, z.core.$strict>;
+                    readonly output: z.ZodObject<{
+                        userId: z.ZodString;
+                        personalSpaceId: z.ZodNullable<z.ZodString>;
+                    }, z.core.$strict>;
+                }>;
+            };
         }>]>;
     }, z.core.$strict>;
     readonly output: {
@@ -23,18 +1029,1024 @@ export declare const groupAssignUser: import("@astrale-os/sdk/schema").Function<
         additionalProperties: boolean;
     };
     readonly auth: "authorized";
-    readonly policy: ({ check, self }: import("@astrale-os/sdk/schema").CallablePolicyContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression;
+    readonly policy: ({ check, ref }: import("@astrale-os/sdk/schema").CallablePolicyContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression;
 }>;
-export declare const groupUnassignUser: import("@astrale-os/sdk/schema").Function<{
+export declare const groupUnassignUser: import("@astrale-os/sdk/schema").Method<{
     readonly description: string;
     readonly input: z.ZodObject<{
-        user: import("@astrale-os/sdk/schema").Path<readonly [import("@astrale-os/sdk/schema").NodeInterface<{
-            readonly description: "A human-facing Shell principal.";
-            readonly extends: readonly [{
-                origin: "kernel.astrale.ai";
-                kind: 'interface';
-                name: "Identity";
+        user: import("@astrale-os/sdk/schema").PathAuthoring<readonly [import("@astrale-os/sdk/schema").NodeClass<{
+            readonly description: "One externally identified person using Shell.";
+            readonly extends: readonly [import("@astrale-os/sdk/schema").ResolvedClass<"node", Readonly<Readonly<{
+                frozen: import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, false> & {
+                    readonly name: "frozen";
+                    readonly key: "kernel.astrale.ai:class.Identity.property.frozen";
+                };
+                iss: import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                    readonly name: "iss";
+                    readonly key: "kernel.astrale.ai:class.Identity.property.iss";
+                };
+                requiredClaims: import("@astrale-os/sdk/schema").ResolvedProperty<({
+                    claim: string;
+                    op: "contains";
+                    value: unknown;
+                } | {
+                    claim: string;
+                    op: "eq";
+                    value: unknown;
+                } | {
+                    claim: string;
+                    op: "exists";
+                })[], false> & {
+                    readonly name: "requiredClaims";
+                    readonly key: "kernel.astrale.ai:class.Identity.property.requiredClaims";
+                };
+                sub: import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                    readonly name: "sub";
+                    readonly key: "kernel.astrale.ai:class.Identity.property.sub";
+                };
+            }>> & Iterable<(import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, false> & {
+                readonly name: "frozen";
+                readonly key: "kernel.astrale.ai:class.Identity.property.frozen";
+            }) | (import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                readonly name: "iss";
+                readonly key: "kernel.astrale.ai:class.Identity.property.iss";
+            }) | (import("@astrale-os/sdk/schema").ResolvedProperty<({
+                claim: string;
+                op: "contains";
+                value: unknown;
+            } | {
+                claim: string;
+                op: "eq";
+                value: unknown;
+            } | {
+                claim: string;
+                op: "exists";
+            })[], false> & {
+                readonly name: "requiredClaims";
+                readonly key: "kernel.astrale.ai:class.Identity.property.requiredClaims";
+            }) | (import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                readonly name: "sub";
+                readonly key: "kernel.astrale.ai:class.Identity.property.sub";
+            })> & {
+                readonly byKey: Readonly<{
+                    "kernel.astrale.ai:class.Identity.property.frozen": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, false> & {
+                        readonly name: "frozen";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.frozen";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.iss": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                        readonly name: "iss";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.iss";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.requiredClaims": import("@astrale-os/sdk/schema").ResolvedProperty<({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[], false> & {
+                        readonly name: "requiredClaims";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.requiredClaims";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.sub": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                        readonly name: "sub";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.sub";
+                    };
+                }>;
+                get<Key extends "kernel.astrale.ai:class.Identity.property.frozen" | "kernel.astrale.ai:class.Identity.property.iss" | "kernel.astrale.ai:class.Identity.property.requiredClaims" | "kernel.astrale.ai:class.Identity.property.sub">(key: Key): Readonly<{
+                    "kernel.astrale.ai:class.Identity.property.frozen": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, false> & {
+                        readonly name: "frozen";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.frozen";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.iss": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                        readonly name: "iss";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.iss";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.requiredClaims": import("@astrale-os/sdk/schema").ResolvedProperty<({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[], false> & {
+                        readonly name: "requiredClaims";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.requiredClaims";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.sub": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                        readonly name: "sub";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.sub";
+                    };
+                }>[Key];
+                get(key: import("@astrale-os/sdk/schema").PropertyKey): import("@astrale-os/sdk/schema").ResolvedProperty | undefined;
+                from(input: Readonly<{
+                    readonly "kernel.astrale.ai:class.Identity.property.frozen"?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                    readonly "kernel.astrale.ai:class.Identity.property.iss"?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                    readonly "kernel.astrale.ai:class.Identity.property.requiredClaims"?: ({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[] | undefined;
+                    readonly "kernel.astrale.ai:class.Identity.property.sub"?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                } & {
+                    readonly frozen?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                    readonly iss?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                    readonly requiredClaims?: ({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[] | undefined;
+                    readonly sub?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                }>): import("@astrale-os/sdk/schema").PropertyValues;
+            }, Readonly<Readonly<{
+                delegate: import("@astrale-os/sdk/schema").ResolvedMethod<{
+                    audience: string;
+                    ttlSeconds: number;
+                    attenuation: unknown;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: string;
+                }, false, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.delegate"> & {
+                    readonly name: "delegate";
+                };
+            }>> & Iterable<import("@astrale-os/sdk/schema").ResolvedMethod<{
+                audience: string;
+                ttlSeconds: number;
+                attenuation: unknown;
+            }, {
+                readonly mode: 'value';
+                readonly value: string;
+            }, false, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.delegate"> & {
+                readonly name: "delegate";
+            }> & {
+                readonly byKey: Readonly<{
+                    "kernel.astrale.ai:class.Identity.method.delegate": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        audience: string;
+                        ttlSeconds: number;
+                        attenuation: unknown;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: string;
+                    }, false, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.delegate"> & {
+                        readonly name: "delegate";
+                    };
+                }>;
+                get<Key extends "kernel.astrale.ai:class.Identity.method.delegate">(key: Key): Readonly<{
+                    "kernel.astrale.ai:class.Identity.method.delegate": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        audience: string;
+                        ttlSeconds: number;
+                        attenuation: unknown;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: string;
+                    }, false, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.delegate"> & {
+                        readonly name: "delegate";
+                    };
+                }>[Key];
+                get(key: import("@astrale-os/sdk/schema").MethodKey): import("@astrale-os/sdk/schema").ResolvedMethod | undefined;
+            }, Readonly<Readonly<{
+                can: import("@astrale-os/sdk/schema").ResolvedMethod<{
+                    policy: string;
+                    object: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        allowed: boolean;
+                    };
+                }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.can"> & {
+                    readonly name: "can";
+                };
+                mint: import("@astrale-os/sdk/schema").ResolvedMethod<{
+                    audience?: string | undefined;
+                    ttlSeconds: number;
+                    grant?: unknown;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: string;
+                }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.mint"> & {
+                    readonly name: "mint";
+                };
+                whoami: import("@astrale-os/sdk/schema").ResolvedMethod<Record<string, never>, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        id: string;
+                        issuer: string;
+                        subject: string;
+                        frozen: boolean;
+                        requiredClaims: ({
+                            claim: string;
+                            op: "contains";
+                            value: unknown;
+                        } | {
+                            claim: string;
+                            op: "eq";
+                            value: unknown;
+                        } | {
+                            claim: string;
+                            op: "exists";
+                        })[];
+                    };
+                }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.whoami"> & {
+                    readonly name: "whoami";
+                };
+                whois: import("@astrale-os/sdk/schema").ResolvedMethod<{
+                    issuer: string;
+                    subject: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        id: string;
+                        issuer: string;
+                        subject: string;
+                        frozen: boolean;
+                        requiredClaims: ({
+                            claim: string;
+                            op: "contains";
+                            value: unknown;
+                        } | {
+                            claim: string;
+                            op: "eq";
+                            value: unknown;
+                        } | {
+                            claim: string;
+                            op: "exists";
+                        })[];
+                    } | null;
+                }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.whois"> & {
+                    readonly name: "whois";
+                };
+            }>> & Iterable<(import("@astrale-os/sdk/schema").ResolvedMethod<{
+                policy: string;
+                object: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    allowed: boolean;
+                };
+            }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.can"> & {
+                readonly name: "can";
+            }) | (import("@astrale-os/sdk/schema").ResolvedMethod<Record<string, never>, {
+                readonly mode: 'value';
+                readonly value: {
+                    id: string;
+                    issuer: string;
+                    subject: string;
+                    frozen: boolean;
+                    requiredClaims: ({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[];
+                };
+            }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.whoami"> & {
+                readonly name: "whoami";
+            }) | (import("@astrale-os/sdk/schema").ResolvedMethod<{
+                issuer: string;
+                subject: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    id: string;
+                    issuer: string;
+                    subject: string;
+                    frozen: boolean;
+                    requiredClaims: ({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[];
+                } | null;
+            }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.whois"> & {
+                readonly name: "whois";
+            }) | (import("@astrale-os/sdk/schema").ResolvedMethod<{
+                audience?: string | undefined;
+                ttlSeconds: number;
+                grant?: unknown;
+            }, {
+                readonly mode: 'value';
+                readonly value: string;
+            }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.mint"> & {
+                readonly name: "mint";
+            })> & {
+                readonly byKey: Readonly<{
+                    "kernel.astrale.ai:class.Identity.method.can": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        policy: string;
+                        object: string;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            allowed: boolean;
+                        };
+                    }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.can"> & {
+                        readonly name: "can";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.mint": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        audience?: string | undefined;
+                        ttlSeconds: number;
+                        grant?: unknown;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: string;
+                    }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.mint"> & {
+                        readonly name: "mint";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.whoami": import("@astrale-os/sdk/schema").ResolvedMethod<Record<string, never>, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            id: string;
+                            issuer: string;
+                            subject: string;
+                            frozen: boolean;
+                            requiredClaims: ({
+                                claim: string;
+                                op: "contains";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "eq";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "exists";
+                            })[];
+                        };
+                    }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.whoami"> & {
+                        readonly name: "whoami";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.whois": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        issuer: string;
+                        subject: string;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            id: string;
+                            issuer: string;
+                            subject: string;
+                            frozen: boolean;
+                            requiredClaims: ({
+                                claim: string;
+                                op: "contains";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "eq";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "exists";
+                            })[];
+                        } | null;
+                    }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.whois"> & {
+                        readonly name: "whois";
+                    };
+                }>;
+                get<Key extends "kernel.astrale.ai:class.Identity.method.can" | "kernel.astrale.ai:class.Identity.method.mint" | "kernel.astrale.ai:class.Identity.method.whoami" | "kernel.astrale.ai:class.Identity.method.whois">(key: Key): Readonly<{
+                    "kernel.astrale.ai:class.Identity.method.can": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        policy: string;
+                        object: string;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            allowed: boolean;
+                        };
+                    }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.can"> & {
+                        readonly name: "can";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.mint": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        audience?: string | undefined;
+                        ttlSeconds: number;
+                        grant?: unknown;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: string;
+                    }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.mint"> & {
+                        readonly name: "mint";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.whoami": import("@astrale-os/sdk/schema").ResolvedMethod<Record<string, never>, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            id: string;
+                            issuer: string;
+                            subject: string;
+                            frozen: boolean;
+                            requiredClaims: ({
+                                claim: string;
+                                op: "contains";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "eq";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "exists";
+                            })[];
+                        };
+                    }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.whoami"> & {
+                        readonly name: "whoami";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.whois": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        issuer: string;
+                        subject: string;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            id: string;
+                            issuer: string;
+                            subject: string;
+                            frozen: boolean;
+                            requiredClaims: ({
+                                claim: string;
+                                op: "contains";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "eq";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "exists";
+                            })[];
+                        } | null;
+                    }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.whois"> & {
+                        readonly name: "whois";
+                    };
+                }>[Key];
+                get(key: import("@astrale-os/sdk/schema").MethodKey): import("@astrale-os/sdk/schema").ResolvedMethod | undefined;
+            }, Readonly<Readonly<{
+                frozen: import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, false> & {
+                    readonly name: "frozen";
+                    readonly key: "kernel.astrale.ai:class.Identity.property.frozen";
+                };
+                iss: import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                    readonly name: "iss";
+                    readonly key: "kernel.astrale.ai:class.Identity.property.iss";
+                };
+                requiredClaims: import("@astrale-os/sdk/schema").ResolvedProperty<({
+                    claim: string;
+                    op: "contains";
+                    value: unknown;
+                } | {
+                    claim: string;
+                    op: "eq";
+                    value: unknown;
+                } | {
+                    claim: string;
+                    op: "exists";
+                })[], false> & {
+                    readonly name: "requiredClaims";
+                    readonly key: "kernel.astrale.ai:class.Identity.property.requiredClaims";
+                };
+                sub: import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                    readonly name: "sub";
+                    readonly key: "kernel.astrale.ai:class.Identity.property.sub";
+                };
+            }>> & Iterable<(import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, false> & {
+                readonly name: "frozen";
+                readonly key: "kernel.astrale.ai:class.Identity.property.frozen";
+            }) | (import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                readonly name: "iss";
+                readonly key: "kernel.astrale.ai:class.Identity.property.iss";
+            }) | (import("@astrale-os/sdk/schema").ResolvedProperty<({
+                claim: string;
+                op: "contains";
+                value: unknown;
+            } | {
+                claim: string;
+                op: "eq";
+                value: unknown;
+            } | {
+                claim: string;
+                op: "exists";
+            })[], false> & {
+                readonly name: "requiredClaims";
+                readonly key: "kernel.astrale.ai:class.Identity.property.requiredClaims";
+            }) | (import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                readonly name: "sub";
+                readonly key: "kernel.astrale.ai:class.Identity.property.sub";
+            })> & {
+                readonly byKey: Readonly<{
+                    "kernel.astrale.ai:class.Identity.property.frozen": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, false> & {
+                        readonly name: "frozen";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.frozen";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.iss": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                        readonly name: "iss";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.iss";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.requiredClaims": import("@astrale-os/sdk/schema").ResolvedProperty<({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[], false> & {
+                        readonly name: "requiredClaims";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.requiredClaims";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.sub": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                        readonly name: "sub";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.sub";
+                    };
+                }>;
+                get<Key extends "kernel.astrale.ai:class.Identity.property.frozen" | "kernel.astrale.ai:class.Identity.property.iss" | "kernel.astrale.ai:class.Identity.property.requiredClaims" | "kernel.astrale.ai:class.Identity.property.sub">(key: Key): Readonly<{
+                    "kernel.astrale.ai:class.Identity.property.frozen": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, false> & {
+                        readonly name: "frozen";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.frozen";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.iss": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                        readonly name: "iss";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.iss";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.requiredClaims": import("@astrale-os/sdk/schema").ResolvedProperty<({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[], false> & {
+                        readonly name: "requiredClaims";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.requiredClaims";
+                    };
+                    "kernel.astrale.ai:class.Identity.property.sub": import("@astrale-os/sdk/schema").ResolvedProperty<import("@astrale-os/sdk/schema").Value, true> & {
+                        readonly name: "sub";
+                        readonly key: "kernel.astrale.ai:class.Identity.property.sub";
+                    };
+                }>[Key];
+                get(key: import("@astrale-os/sdk/schema").PropertyKey): import("@astrale-os/sdk/schema").ResolvedProperty | undefined;
+                from(input: Readonly<{
+                    readonly "kernel.astrale.ai:class.Identity.property.frozen"?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                    readonly "kernel.astrale.ai:class.Identity.property.iss"?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                    readonly "kernel.astrale.ai:class.Identity.property.requiredClaims"?: ({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[] | undefined;
+                    readonly "kernel.astrale.ai:class.Identity.property.sub"?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                } & {
+                    readonly frozen?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                    readonly iss?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                    readonly requiredClaims?: ({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[] | undefined;
+                    readonly sub?: string | number | boolean | import("@astrale-os/sdk/schema").Array | import("@astrale-os/sdk/schema").Object | null | undefined;
+                }>): import("@astrale-os/sdk/schema").PropertyValues;
+            }, Readonly<Readonly<{
+                delegate: import("@astrale-os/sdk/schema").ResolvedMethod<{
+                    audience: string;
+                    ttlSeconds: number;
+                    attenuation: unknown;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: string;
+                }, false, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.delegate"> & {
+                    readonly name: "delegate";
+                };
+            }>> & Iterable<import("@astrale-os/sdk/schema").ResolvedMethod<{
+                audience: string;
+                ttlSeconds: number;
+                attenuation: unknown;
+            }, {
+                readonly mode: 'value';
+                readonly value: string;
+            }, false, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.delegate"> & {
+                readonly name: "delegate";
+            }> & {
+                readonly byKey: Readonly<{
+                    "kernel.astrale.ai:class.Identity.method.delegate": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        audience: string;
+                        ttlSeconds: number;
+                        attenuation: unknown;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: string;
+                    }, false, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.delegate"> & {
+                        readonly name: "delegate";
+                    };
+                }>;
+                get<Key extends "kernel.astrale.ai:class.Identity.method.delegate">(key: Key): Readonly<{
+                    "kernel.astrale.ai:class.Identity.method.delegate": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        audience: string;
+                        ttlSeconds: number;
+                        attenuation: unknown;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: string;
+                    }, false, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.delegate"> & {
+                        readonly name: "delegate";
+                    };
+                }>[Key];
+                get(key: import("@astrale-os/sdk/schema").MethodKey): import("@astrale-os/sdk/schema").ResolvedMethod | undefined;
+            }, Readonly<Readonly<{
+                can: import("@astrale-os/sdk/schema").ResolvedMethod<{
+                    policy: string;
+                    object: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        allowed: boolean;
+                    };
+                }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.can"> & {
+                    readonly name: "can";
+                };
+                mint: import("@astrale-os/sdk/schema").ResolvedMethod<{
+                    audience?: string | undefined;
+                    ttlSeconds: number;
+                    grant?: unknown;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: string;
+                }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.mint"> & {
+                    readonly name: "mint";
+                };
+                whoami: import("@astrale-os/sdk/schema").ResolvedMethod<Record<string, never>, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        id: string;
+                        issuer: string;
+                        subject: string;
+                        frozen: boolean;
+                        requiredClaims: ({
+                            claim: string;
+                            op: "contains";
+                            value: unknown;
+                        } | {
+                            claim: string;
+                            op: "eq";
+                            value: unknown;
+                        } | {
+                            claim: string;
+                            op: "exists";
+                        })[];
+                    };
+                }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.whoami"> & {
+                    readonly name: "whoami";
+                };
+                whois: import("@astrale-os/sdk/schema").ResolvedMethod<{
+                    issuer: string;
+                    subject: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        id: string;
+                        issuer: string;
+                        subject: string;
+                        frozen: boolean;
+                        requiredClaims: ({
+                            claim: string;
+                            op: "contains";
+                            value: unknown;
+                        } | {
+                            claim: string;
+                            op: "eq";
+                            value: unknown;
+                        } | {
+                            claim: string;
+                            op: "exists";
+                        })[];
+                    } | null;
+                }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.whois"> & {
+                    readonly name: "whois";
+                };
+            }>> & Iterable<(import("@astrale-os/sdk/schema").ResolvedMethod<{
+                policy: string;
+                object: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    allowed: boolean;
+                };
+            }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.can"> & {
+                readonly name: "can";
+            }) | (import("@astrale-os/sdk/schema").ResolvedMethod<Record<string, never>, {
+                readonly mode: 'value';
+                readonly value: {
+                    id: string;
+                    issuer: string;
+                    subject: string;
+                    frozen: boolean;
+                    requiredClaims: ({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[];
+                };
+            }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.whoami"> & {
+                readonly name: "whoami";
+            }) | (import("@astrale-os/sdk/schema").ResolvedMethod<{
+                issuer: string;
+                subject: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    id: string;
+                    issuer: string;
+                    subject: string;
+                    frozen: boolean;
+                    requiredClaims: ({
+                        claim: string;
+                        op: "contains";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "eq";
+                        value: unknown;
+                    } | {
+                        claim: string;
+                        op: "exists";
+                    })[];
+                } | null;
+            }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.whois"> & {
+                readonly name: "whois";
+            }) | (import("@astrale-os/sdk/schema").ResolvedMethod<{
+                audience?: string | undefined;
+                ttlSeconds: number;
+                grant?: unknown;
+            }, {
+                readonly mode: 'value';
+                readonly value: string;
+            }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.mint"> & {
+                readonly name: "mint";
+            })> & {
+                readonly byKey: Readonly<{
+                    "kernel.astrale.ai:class.Identity.method.can": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        policy: string;
+                        object: string;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            allowed: boolean;
+                        };
+                    }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.can"> & {
+                        readonly name: "can";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.mint": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        audience?: string | undefined;
+                        ttlSeconds: number;
+                        grant?: unknown;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: string;
+                    }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.mint"> & {
+                        readonly name: "mint";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.whoami": import("@astrale-os/sdk/schema").ResolvedMethod<Record<string, never>, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            id: string;
+                            issuer: string;
+                            subject: string;
+                            frozen: boolean;
+                            requiredClaims: ({
+                                claim: string;
+                                op: "contains";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "eq";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "exists";
+                            })[];
+                        };
+                    }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.whoami"> & {
+                        readonly name: "whoami";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.whois": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        issuer: string;
+                        subject: string;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            id: string;
+                            issuer: string;
+                            subject: string;
+                            frozen: boolean;
+                            requiredClaims: ({
+                                claim: string;
+                                op: "contains";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "eq";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "exists";
+                            })[];
+                        } | null;
+                    }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.whois"> & {
+                        readonly name: "whois";
+                    };
+                }>;
+                get<Key extends "kernel.astrale.ai:class.Identity.method.can" | "kernel.astrale.ai:class.Identity.method.mint" | "kernel.astrale.ai:class.Identity.method.whoami" | "kernel.astrale.ai:class.Identity.method.whois">(key: Key): Readonly<{
+                    "kernel.astrale.ai:class.Identity.method.can": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        policy: string;
+                        object: string;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            allowed: boolean;
+                        };
+                    }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.can"> & {
+                        readonly name: "can";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.mint": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        audience?: string | undefined;
+                        ttlSeconds: number;
+                        grant?: unknown;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: string;
+                    }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.mint"> & {
+                        readonly name: "mint";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.whoami": import("@astrale-os/sdk/schema").ResolvedMethod<Record<string, never>, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            id: string;
+                            issuer: string;
+                            subject: string;
+                            frozen: boolean;
+                            requiredClaims: ({
+                                claim: string;
+                                op: "contains";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "eq";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "exists";
+                            })[];
+                        };
+                    }, true, "default", "authenticated", never, "kernel.astrale.ai:class.Identity.method.whoami"> & {
+                        readonly name: "whoami";
+                    };
+                    "kernel.astrale.ai:class.Identity.method.whois": import("@astrale-os/sdk/schema").ResolvedMethod<{
+                        issuer: string;
+                        subject: string;
+                    }, {
+                        readonly mode: 'value';
+                        readonly value: {
+                            id: string;
+                            issuer: string;
+                            subject: string;
+                            frozen: boolean;
+                            requiredClaims: ({
+                                claim: string;
+                                op: "contains";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "eq";
+                                value: unknown;
+                            } | {
+                                claim: string;
+                                op: "exists";
+                            })[];
+                        } | null;
+                    }, true, "default", "authorized", import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>, "kernel.astrale.ai:class.Identity.method.whois"> & {
+                        readonly name: "whois";
+                    };
+                }>[Key];
+                get(key: import("@astrale-os/sdk/schema").MethodKey): import("@astrale-os/sdk/schema").ResolvedMethod | undefined;
+            }, import("@astrale-os/sdk/schema").NodeClassDefinition & {
+                readonly ref: import("@astrale-os/sdk/schema").ClassRef<"Identity"> & {
+                    readonly origin: "kernel.astrale.ai";
+                };
+                readonly kind: 'node';
+                readonly abstract: true;
+            }, readonly [import("@astrale-os/sdk/schema").ResolvedClass<"node", Readonly<Readonly<{}>> & Iterable<never> & {
+                readonly byKey: Readonly<{}>;
+                get<Key extends never>(key: Key): Readonly<{}>[Key];
+                get(key: import("@astrale-os/sdk/schema").PropertyKey): import("@astrale-os/sdk/schema").ResolvedProperty | undefined;
+                from(input: Readonly<{} & {}>): import("@astrale-os/sdk/schema").PropertyValues;
+            }, Readonly<Readonly<{}>> & Iterable<never> & {
+                readonly byKey: Readonly<{}>;
+                get<Key extends never>(key: Key): Readonly<{}>[Key];
+                get(key: import("@astrale-os/sdk/schema").MethodKey): import("@astrale-os/sdk/schema").ResolvedMethod | undefined;
+            }, Readonly<Readonly<{}>> & Iterable<never> & {
+                readonly byKey: Readonly<{}>;
+                get<Key extends never>(key: Key): Readonly<{}>[Key];
+                get(key: import("@astrale-os/sdk/schema").MethodKey): import("@astrale-os/sdk/schema").ResolvedMethod | undefined;
+            }, Readonly<Readonly<{}>> & Iterable<never> & {
+                readonly byKey: Readonly<{}>;
+                get<Key extends never>(key: Key): Readonly<{}>[Key];
+                get(key: import("@astrale-os/sdk/schema").PropertyKey): import("@astrale-os/sdk/schema").ResolvedProperty | undefined;
+                from(input: Readonly<{} & {}>): import("@astrale-os/sdk/schema").PropertyValues;
+            }, Readonly<Readonly<{}>> & Iterable<never> & {
+                readonly byKey: Readonly<{}>;
+                get<Key extends never>(key: Key): Readonly<{}>[Key];
+                get(key: import("@astrale-os/sdk/schema").MethodKey): import("@astrale-os/sdk/schema").ResolvedMethod | undefined;
+            }, Readonly<Readonly<{}>> & Iterable<never> & {
+                readonly byKey: Readonly<{}>;
+                get<Key extends never>(key: Key): Readonly<{}>[Key];
+                get(key: import("@astrale-os/sdk/schema").MethodKey): import("@astrale-os/sdk/schema").ResolvedMethod | undefined;
+            }, import("@astrale-os/sdk/schema").NodeClassDefinition & {
+                readonly ref: import("@astrale-os/sdk/schema").ClassRef<"Node"> & {
+                    readonly origin: "kernel.astrale.ai";
+                };
+                readonly kind: 'node';
+                readonly abstract: true;
+            }, readonly []> & {
+                readonly ref: import("@astrale-os/sdk/schema").ClassRef<"Node"> & {
+                    readonly origin: "kernel.astrale.ai";
+                };
+                readonly key: "kernel.astrale.ai:class.Node";
+            }]> & {
+                readonly ref: import("@astrale-os/sdk/schema").ClassRef<"Identity"> & {
+                    readonly origin: "kernel.astrale.ai";
+                };
+                readonly key: "kernel.astrale.ai:class.Identity";
             }];
+            readonly properties: {
+                displayName: import("@astrale-os/sdk/schema").Property<z.ZodString, {
+                    readonly required: false;
+                }>;
+            };
+            readonly methods: {
+                readonly resolveHome: import("@astrale-os/sdk/schema").Method<{
+                    readonly description: "Resolve this User and its canonical personal Space.";
+                    readonly auth: "authenticated";
+                    readonly input: z.ZodObject<{}, z.core.$strict>;
+                    readonly output: z.ZodObject<{
+                        userId: z.ZodString;
+                        personalSpaceId: z.ZodNullable<z.ZodString>;
+                    }, z.core.$strict>;
+                }>;
+            };
         }>]>;
     }, z.core.$strict>;
     readonly output: {
@@ -43,6 +2055,5 @@ export declare const groupUnassignUser: import("@astrale-os/sdk/schema").Functio
         additionalProperties: boolean;
     };
     readonly auth: "authorized";
-    readonly policy: ({ check, self }: import("@astrale-os/sdk/schema").CallablePolicyContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression;
+    readonly policy: ({ check, ref }: import("@astrale-os/sdk/schema").CallablePolicyContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression;
 }>;
-//# sourceMappingURL=methods.d.ts.map