@astrale-domains/shell 0.1.0-beta.4

package/README.md

@@ -0,0 +1,66 @@
+# Shell Domain
+
+Shell is the minimal Kernel-native application plane. Its durable model is one `User` interface,
+the concrete `User`, `Group`, `Space`, and `Application` Node Classes, eight relationships, five
+Policies, two Functions, seven Methods, five Kernel View declarations, and four deterministic Core
+nodes.
+
+The `ensureUser` Function is the Shell-owned identity genesis boundary. It idempotently provisions an
+externally identified `User`, their personal `Space`, and both ownership/default relationships under
+the installed Shell Domain's authority. `ensureAdministrator` idempotently assigns one existing User
+to Shell's administrator Group. Both keep product mutation under Shell authority while allowing an
+authenticated genesis operator to request the transition.
+
+The Methods are:
+
+- Group: `assignUser`, `unassignUser`;
+- Space: `addUser`, `removeUser`, `setDefault`; and
+- Application: `install`, `uninstall`.
+
+Installation authors the `admin`, `member`, `default-space`, and `shell` Core. An authenticated genesis
+operator may invoke `ensureUser`, but cannot mutate Shell Classes directly. The remote handler performs
+the atomic identity provisioning as Shell, then callers assign the User explicitly to a Group. Shell
+infers no authority from email, claims, path spelling, or creation order.
+
+## Source ownership
+
+- `schema/` owns the complete Domain contract, public Method values, Policies, relationships, DSL
+  Views, and Core graph;
+- `rules/` owns synchronous classifications, decisions, normalization, and result projection;
+- `queries/` owns canonical single and composite graph observations plus explicit bounded continuation
+  pagination when a business observation requires the complete set;
+- `mutations/` owns canonical atomic graph changes and their expected rejection evidence;
+- `workflows/` owns replay-shaped multi-step business journeys and unknown-outcome recovery;
+- `functions/` binds the Function and each Method to a rule, workflow, or direct operation;
+- `utils/` owns only the shared graph-endpoint and bounded-query mechanics used by independent
+  submodules; and
+- root `tests/` owns cross-layer and system evidence, while each semantic submodule owns focused
+  evidence in `__tests__/`.
+
+No current responsibility earns a `states/`, `capabilities/`, `integrations/`, `migrations/`,
+`views/`, `ui/`, or root `scripts/` source layer. DSL View declarations remain in Schema; a future
+frontend projection or UI must establish its own concrete responsibility before adding those layers.
+
+Shell never re-declares shared metadata properties. `Group` and `Space` currently name `K.Named`
+and `K.Descriptable` in their `implements` lists because the current DSL makes only `K.Node`
+intrinsic and Core-property admission otherwise rejects `name` and `description`. Removing those
+interface references awaits the recorded Kernel authoring-default decision; no timestamps are
+authored by Shell.
+
+## Execution and evidence
+
+`ShellDomain` is the complete remote product implementation. Its exact handler map proves that the
+genesis Functions and all seven Methods are served from the same immutable publication. The handlers use
+the SDK's canonical Auth, Query, Mutation, Result, Workflow, and Step contracts. `ensureUser` relies on
+the Kernel provision operation's stable idempotency key; the SDK's current inline Step runner does not
+claim process-restart replay on its own.
+
+The executable contract lives in Shell's semantic source, public facades, and tests. Product
+decisions, journeys, legacy disposition, dependency gates, and qualification evidence live in
+[`.history/`](.history/). Product Domains intentionally have no `.spec/` tree; Kernel authoring
+values come through semantic `@astrale-os/sdk/*` facades.
+
+The source, deterministic Knowledge linter, TypeScript package, unit/cross-layer tests, and remote Shell
+contract are qualified locally. Installed-instance, released-package, browser, and live
+credential journeys are separate evidence levels and are not claimed here. Shell does not broker
+authentication tokens; standard Domain token exchange is owned by Protocol, Server, and SDK.

package/dist/functions/application/index.d.ts

@@ -0,0 +1,3 @@
+export { installApplication } from './install.js';
+export { uninstallApplication } from './uninstall.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/functions/application/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../functions/application/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/functions/application/index.js

@@ -0,0 +1,3 @@
+export { installApplication } from './install.js';
+export { uninstallApplication } from './uninstall.js';
+//# sourceMappingURL=index.js.map

package/dist/functions/application/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../functions/application/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/functions/application/install.d.ts

@@ -0,0 +1,4 @@
+import type { ShellWorkflowExecution } from '#functions/execution';
+import type { InstallApplicationInput, InstallApplicationResult } from '#schema/application';
+export declare function installApplication(execution: ShellWorkflowExecution, input: InstallApplicationInput): Promise<InstallApplicationResult>;
+//# sourceMappingURL=install.d.ts.map

package/dist/functions/application/install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../../functions/application/install.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,KAAK,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AAI5F,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,sBAAsB,EACjC,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,wBAAwB,CAAC,CAQnC"}

package/dist/functions/application/install.js

@@ -0,0 +1,11 @@
+import { installApplicationWorkflow } from '#workflows/application';
+export function installApplication(execution, input) {
+    return execution.workflow.run(installApplicationWorkflow, {
+        input,
+        capabilities: {},
+        query: execution.query,
+        mutate: execution.mutate,
+        ...(execution.signal === undefined ? {} : { signal: execution.signal }),
+    });
+}
+//# sourceMappingURL=install.js.map

package/dist/functions/application/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../../../functions/application/install.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAA;AAEnE,MAAM,UAAU,kBAAkB,CAChC,SAAiC,EACjC,KAA8B;IAE9B,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,0BAA0B,EAAE;QACxD,KAAK;QACL,YAAY,EAAE,EAAE;QAChB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;KACxE,CAAC,CAAA;AACJ,CAAC"}

package/dist/functions/application/uninstall.d.ts

@@ -0,0 +1,5 @@
+import type { NodeId } from '@astrale-os/sdk/graph/node';
+import type { ShellWorkflowExecution } from '#functions/execution';
+import type { UninstallApplicationResult } from '#schema/application';
+export declare function uninstallApplication(execution: ShellWorkflowExecution, application: NodeId): Promise<UninstallApplicationResult>;
+//# sourceMappingURL=uninstall.d.ts.map

package/dist/functions/application/uninstall.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uninstall.d.ts","sourceRoot":"","sources":["../../../functions/application/uninstall.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AAExD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AAIrE,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,sBAAsB,EACjC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,0BAA0B,CAAC,CAQrC"}

package/dist/functions/application/uninstall.js

@@ -0,0 +1,11 @@
+import { uninstallApplicationWorkflow } from '#workflows/application';
+export function uninstallApplication(execution, application) {
+    return execution.workflow.run(uninstallApplicationWorkflow, {
+        input: application,
+        capabilities: {},
+        query: execution.query,
+        mutate: execution.mutate,
+        ...(execution.signal === undefined ? {} : { signal: execution.signal }),
+    });
+}
+//# sourceMappingURL=uninstall.js.map

package/dist/functions/application/uninstall.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uninstall.js","sourceRoot":"","sources":["../../../functions/application/uninstall.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,4BAA4B,EAAE,MAAM,wBAAwB,CAAA;AAErE,MAAM,UAAU,oBAAoB,CAClC,SAAiC,EACjC,WAAmB;IAEnB,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,4BAA4B,EAAE;QAC1D,KAAK,EAAE,WAAW;QAClB,YAAY,EAAE,EAAE;QAChB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;KACxE,CAAC,CAAA;AACJ,CAAC"}

package/dist/functions/execution/index.d.ts

@@ -0,0 +1,15 @@
+import type { MutationExecutor } from '@astrale-os/sdk/mutation';
+import type { QueryExecutor } from '@astrale-os/sdk/query';
+import type { WorkflowRunner } from '@astrale-os/sdk/workflow';
+import type { WorkflowStep } from '@astrale-os/sdk/workflow/step';
+export interface ShellWorkflowExecution {
+    readonly mutate: MutationExecutor;
+    readonly query: QueryExecutor;
+    readonly signal?: AbortSignal;
+    readonly workflow: WorkflowRunner;
+}
+export interface ShellDirectExecution {
+    readonly query: QueryExecutor;
+    readonly step: WorkflowStep;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/functions/execution/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../functions/execution/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAEjE,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAA;IACjC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;CAClC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;CAC5B"}

package/dist/functions/execution/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/dist/functions/execution/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../functions/execution/index.ts"],"names":[],"mappings":""}

package/dist/functions/group/assign-user.d.ts

@@ -0,0 +1,5 @@
+import type { NodeId } from '@astrale-os/sdk/graph/node';
+import type { ShellWorkflowExecution } from '#functions/execution';
+import type { GroupMembershipInput, GroupMembershipResult } from '#schema/group';
+export declare function assignGroupUser(execution: ShellWorkflowExecution, group: NodeId, input: GroupMembershipInput): Promise<GroupMembershipResult>;
+//# sourceMappingURL=assign-user.d.ts.map

package/dist/functions/group/assign-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assign-user.d.ts","sourceRoot":"","sources":["../../../functions/group/assign-user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AAExD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAIhF,wBAAgB,eAAe,CAC7B,SAAS,EAAE,sBAAsB,EACjC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,qBAAqB,CAAC,CAQhC"}

package/dist/functions/group/assign-user.js

@@ -0,0 +1,11 @@
+import { assignGroupUserWorkflow } from '#workflows/group';
+export function assignGroupUser(execution, group, input) {
+    return execution.workflow.run(assignGroupUserWorkflow, {
+        input: { group, input },
+        capabilities: {},
+        query: execution.query,
+        mutate: execution.mutate,
+        ...(execution.signal === undefined ? {} : { signal: execution.signal }),
+    });
+}
+//# sourceMappingURL=assign-user.js.map

package/dist/functions/group/assign-user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assign-user.js","sourceRoot":"","sources":["../../../functions/group/assign-user.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAE1D,MAAM,UAAU,eAAe,CAC7B,SAAiC,EACjC,KAAa,EACb,KAA2B;IAE3B,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,uBAAuB,EAAE;QACrD,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;QACvB,YAAY,EAAE,EAAE;QAChB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;KACxE,CAAC,CAAA;AACJ,CAAC"}

package/dist/functions/group/index.d.ts

@@ -0,0 +1,3 @@
+export { assignGroupUser } from './assign-user.js';
+export { unassignGroupUser } from './unassign-user.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/functions/group/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../functions/group/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA"}

package/dist/functions/group/index.js

@@ -0,0 +1,3 @@
+export { assignGroupUser } from './assign-user.js';
+export { unassignGroupUser } from './unassign-user.js';
+//# sourceMappingURL=index.js.map

package/dist/functions/group/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../functions/group/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA"}

package/dist/functions/group/unassign-user.d.ts

@@ -0,0 +1,5 @@
+import type { NodeId } from '@astrale-os/sdk/graph/node';
+import type { ShellWorkflowExecution } from '#functions/execution';
+import type { GroupMembershipInput, GroupMembershipResult } from '#schema/group';
+export declare function unassignGroupUser(execution: ShellWorkflowExecution, group: NodeId, input: GroupMembershipInput): Promise<GroupMembershipResult>;
+//# sourceMappingURL=unassign-user.d.ts.map

package/dist/functions/group/unassign-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unassign-user.d.ts","sourceRoot":"","sources":["../../../functions/group/unassign-user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AAExD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAIhF,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,sBAAsB,EACjC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,qBAAqB,CAAC,CAQhC"}

package/dist/functions/group/unassign-user.js

@@ -0,0 +1,11 @@
+import { unassignGroupUserWorkflow } from '#workflows/group';
+export function unassignGroupUser(execution, group, input) {
+    return execution.workflow.run(unassignGroupUserWorkflow, {
+        input: { group, input },
+        capabilities: {},
+        query: execution.query,
+        mutate: execution.mutate,
+        ...(execution.signal === undefined ? {} : { signal: execution.signal }),
+    });
+}
+//# sourceMappingURL=unassign-user.js.map

package/dist/functions/group/unassign-user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unassign-user.js","sourceRoot":"","sources":["../../../functions/group/unassign-user.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAA;AAE5D,MAAM,UAAU,iBAAiB,CAC/B,SAAiC,EACjC,KAAa,EACb,KAA2B;IAE3B,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,yBAAyB,EAAE;QACvD,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;QACvB,YAAY,EAAE,EAAE;QAChB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;KACxE,CAAC,CAAA;AACJ,CAAC"}

package/dist/functions/index.d.ts

@@ -0,0 +1,6 @@
+export { installApplication, uninstallApplication } from '#functions/application';
+export { type ShellDirectExecution, type ShellWorkflowExecution } from '#functions/execution';
+export { assignGroupUser, unassignGroupUser } from '#functions/group';
+export { addSpaceUser, removeSpaceUser, setDefaultSpace } from '#functions/space';
+export { ensureShellUser, ensureUser, lookupShellUser, type ShellUserProvisioner, } from '#functions/user';
+//# sourceMappingURL=index.d.ts.map

package/dist/functions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../functions/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AACjF,OAAO,EAAE,KAAK,oBAAoB,EAAE,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7F,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACjF,OAAO,EACL,eAAe,EACf,UAAU,EACV,eAAe,EACf,KAAK,oBAAoB,GAC1B,MAAM,iBAAiB,CAAA"}

package/dist/functions/index.js

@@ -0,0 +1,6 @@
+export { installApplication, uninstallApplication } from '#functions/application';
+export {} from '#functions/execution';
+export { assignGroupUser, unassignGroupUser } from '#functions/group';
+export { addSpaceUser, removeSpaceUser, setDefaultSpace } from '#functions/space';
+export { ensureShellUser, ensureUser, lookupShellUser, } from '#functions/user';
+//# sourceMappingURL=index.js.map

package/dist/functions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../functions/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AACjF,OAAO,EAA0D,MAAM,sBAAsB,CAAA;AAC7F,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACjF,OAAO,EACL,eAAe,EACf,UAAU,EACV,eAAe,GAEhB,MAAM,iBAAiB,CAAA"}

package/dist/functions/space/add-user.d.ts

@@ -0,0 +1,5 @@
+import type { NodeId } from '@astrale-os/sdk/graph/node';
+import type { ShellWorkflowExecution } from '#functions/execution';
+import type { SpaceUserAccessInput, SpaceUserAccessResult } from '#schema/space';
+export declare function addSpaceUser(execution: ShellWorkflowExecution, space: NodeId, input: SpaceUserAccessInput): Promise<SpaceUserAccessResult>;
+//# sourceMappingURL=add-user.d.ts.map

package/dist/functions/space/add-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-user.d.ts","sourceRoot":"","sources":["../../../functions/space/add-user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AAExD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,KAAK,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAIhF,wBAAgB,YAAY,CAC1B,SAAS,EAAE,sBAAsB,EACjC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,oBAAoB,GAC1B,OAAO,CAAC,qBAAqB,CAAC,CAQhC"}

package/dist/functions/space/add-user.js

@@ -0,0 +1,11 @@
+import { addSpaceUserWorkflow } from '#workflows/space';
+export function addSpaceUser(execution, space, input) {
+    return execution.workflow.run(addSpaceUserWorkflow, {
+        input: { space, input },
+        capabilities: {},
+        query: execution.query,
+        mutate: execution.mutate,
+        ...(execution.signal === undefined ? {} : { signal: execution.signal }),
+    });
+}
+//# sourceMappingURL=add-user.js.map

package/dist/functions/space/add-user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-user.js","sourceRoot":"","sources":["../../../functions/space/add-user.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAEvD,MAAM,UAAU,YAAY,CAC1B,SAAiC,EACjC,KAAa,EACb,KAA2B;IAE3B,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,oBAAoB,EAAE;QAClD,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;QACvB,YAAY,EAAE,EAAE;QAChB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;KACxE,CAAC,CAAA;AACJ,CAAC"}

package/dist/functions/space/index.d.ts

@@ -0,0 +1,4 @@
+export { addSpaceUser } from './add-user.js';
+export { removeSpaceUser } from './remove-user.js';
+export { setDefaultSpace } from './set-default.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/functions/space/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../functions/space/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/functions/space/index.js

@@ -0,0 +1,4 @@
+export { addSpaceUser } from './add-user.js';
+export { removeSpaceUser } from './remove-user.js';
+export { setDefaultSpace } from './set-default.js';
+//# sourceMappingURL=index.js.map

package/dist/functions/space/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../functions/space/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA"}

package/dist/functions/space/remove-user.d.ts

@@ -0,0 +1,5 @@
+import type { NodeId } from '@astrale-os/sdk/graph/node';
+import type { ShellWorkflowExecution } from '#functions/execution';
+import type { SpaceUserInput, SpaceUserResult } from '#schema/space';
+export declare function removeSpaceUser(execution: ShellWorkflowExecution, space: NodeId, input: SpaceUserInput): Promise<SpaceUserResult>;
+//# sourceMappingURL=remove-user.d.ts.map

package/dist/functions/space/remove-user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove-user.d.ts","sourceRoot":"","sources":["../../../functions/space/remove-user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AAExD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAIpE,wBAAgB,eAAe,CAC7B,SAAS,EAAE,sBAAsB,EACjC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,eAAe,CAAC,CAQ1B"}

package/dist/functions/space/remove-user.js

@@ -0,0 +1,11 @@
+import { removeSpaceUserWorkflow } from '#workflows/space';
+export function removeSpaceUser(execution, space, input) {
+    return execution.workflow.run(removeSpaceUserWorkflow, {
+        input: { space, input },
+        capabilities: {},
+        query: execution.query,
+        mutate: execution.mutate,
+        ...(execution.signal === undefined ? {} : { signal: execution.signal }),
+    });
+}
+//# sourceMappingURL=remove-user.js.map

package/dist/functions/space/remove-user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove-user.js","sourceRoot":"","sources":["../../../functions/space/remove-user.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAE1D,MAAM,UAAU,eAAe,CAC7B,SAAiC,EACjC,KAAa,EACb,KAAqB;IAErB,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,uBAAuB,EAAE;QACrD,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;QACvB,YAAY,EAAE,EAAE;QAChB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;KACxE,CAAC,CAAA;AACJ,CAAC"}

package/dist/functions/space/set-default.d.ts

@@ -0,0 +1,6 @@
+import type { Caller } from '@astrale-os/sdk/domain';
+import type { NodeId } from '@astrale-os/sdk/graph/node';
+import type { ShellWorkflowExecution } from '#functions/execution';
+import type { SetDefaultSpaceResult } from '#schema/space';
+export declare function setDefaultSpace(execution: ShellWorkflowExecution, actor: Caller, space: NodeId): Promise<SetDefaultSpaceResult>;
+//# sourceMappingURL=set-default.d.ts.map

package/dist/functions/space/set-default.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-default.d.ts","sourceRoot":"","sources":["../../../functions/space/set-default.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AAExD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAClE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAI1D,wBAAgB,eAAe,CAC7B,SAAS,EAAE,sBAAsB,EACjC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,qBAAqB,CAAC,CAQhC"}

package/dist/functions/space/set-default.js

@@ -0,0 +1,11 @@
+import { setDefaultSpaceWorkflow } from '#workflows/space';
+export function setDefaultSpace(execution, actor, space) {
+    return execution.workflow.run(setDefaultSpaceWorkflow, {
+        input: { actor, space },
+        capabilities: {},
+        query: execution.query,
+        mutate: execution.mutate,
+        ...(execution.signal === undefined ? {} : { signal: execution.signal }),
+    });
+}
+//# sourceMappingURL=set-default.js.map

package/dist/functions/space/set-default.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-default.js","sourceRoot":"","sources":["../../../functions/space/set-default.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAE1D,MAAM,UAAU,eAAe,CAC7B,SAAiC,EACjC,KAAa,EACb,KAAa;IAEb,OAAO,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,uBAAuB,EAAE;QACrD,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;QACvB,YAAY,EAAE,EAAE;QAChB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC;KACxE,CAAC,CAAA;AACJ,CAAC"}

package/dist/functions/user/administrator.d.ts

@@ -0,0 +1,4 @@
+import type { HandlerOf } from '@astrale-os/sdk';
+import { S } from '#schema';
+export declare const ensureAdministrator: HandlerOf<typeof S.ensureAdministrator>;
+//# sourceMappingURL=administrator.d.ts.map

package/dist/functions/user/administrator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"administrator.d.ts","sourceRoot":"","sources":["../../../functions/user/administrator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAIhD,OAAO,EAAE,CAAC,EAAE,MAAM,SAAS,CAAA;AAG3B,eAAO,MAAM,mBAAmB,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,mBAAmB,CAiCvE,CAAA"}

package/dist/functions/user/administrator.js

@@ -0,0 +1,39 @@
+import { Path } from '@astrale-os/sdk/graph/path';
+import { S } from '#schema';
+import { ensureAdministratorWorkflow } from '#workflows/group';
+export const ensureAdministrator = async (context) => {
+    try {
+        const result = await ensureAdministratorWorkflow.run({
+            activation: {
+                kind: 'call',
+                callable: S.ensureAdministrator.key,
+                principal: context.caller.principal,
+                authority: context.caller.authority,
+                ...(context.idempotencyKey === undefined
+                    ? {}
+                    : { idempotencyKey: context.idempotencyKey }),
+            },
+            execution: { deadline: context.deadline, signal: context.signal },
+            step: context.step,
+            query: context.query,
+            mutate: context.mutate,
+            capabilities: {},
+        }, Path.parse(context.input.user).raw);
+        // oxlint-disable-next-line no-console -- bounded beta genesis stage evidence.
+        console.info('Shell administrator membership converged.');
+        return result;
+    }
+    catch (cause) {
+        // oxlint-disable-next-line no-console -- bounded beta genesis failure evidence.
+        console.error('Shell administrator initialization failed.', {
+            type: cause instanceof Error ? cause.name : typeof cause,
+            message: cause instanceof Error ? cause.message : undefined,
+            code: field(cause, 'code'),
+        });
+        throw cause;
+    }
+};
+function field(value, name) {
+    return value !== null && typeof value === 'object' ? Reflect.get(value, name) : undefined;
+}
+//# sourceMappingURL=administrator.js.map

package/dist/functions/user/administrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"administrator.js","sourceRoot":"","sources":["../../../functions/user/administrator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAA;AAEjD,OAAO,EAAE,CAAC,EAAE,MAAM,SAAS,CAAA;AAC3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAA;AAE9D,MAAM,CAAC,MAAM,mBAAmB,GAA4C,KAAK,EAAE,OAAO,EAAE,EAAE;IAC5F,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,GAAG,CAClD;YACE,UAAU,EAAE;gBACV,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG;gBACnC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS;gBACnC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS;gBACnC,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS;oBACtC,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;aAChD;YACD,SAAS,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;YACjE,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,YAAY,EAAE,EAAE;SACjB,EACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CACnC,CAAA;QACD,8EAA8E;QAC9E,OAAO,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAA;QACzD,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,gFAAgF;QAChF,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE;YAC1D,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;YACxD,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YAC3D,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC;SAC3B,CAAC,CAAA;QACF,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,SAAS,KAAK,CAAC,KAAc,EAAE,IAAY;IACzC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAC3F,CAAC"}

package/dist/functions/user/ensure.d.ts

@@ -0,0 +1,18 @@
+import type { HandlerOf } from '@astrale-os/sdk';
+import type { ProvisionRequest, ProvisionResult } from '@astrale-os/sdk/auth';
+import type { Kernel } from '@astrale-os/sdk/domain';
+import type { EnsureShellUserResult } from '#schema/user';
+import { buildShellUserProvisioning } from '#rules/user';
+import { S } from '#schema';
+export interface ShellUserProvisioner {
+    provision(input: ProvisionRequest, options?: {
+        readonly signal?: AbortSignal;
+    }): Promise<ProvisionResult>;
+}
+/** Execute the reusable Shell-owned provisioning rule through an injected authority boundary. */
+export declare function ensureShellUser(input: Parameters<typeof buildShellUserProvisioning>[0], provisioner: ShellUserProvisioner, signal?: AbortSignal): Promise<EnsureShellUserResult>;
+/** Resolve a previously provisioned external identity through Shell-owned graph authority. */
+export declare function lookupShellUser(input: Parameters<typeof buildShellUserProvisioning>[0]['identity'], kernel: Kernel, signal?: AbortSignal): Promise<EnsureShellUserResult | null>;
+/** Manager-invokable adapter; all product mutation executes through Shell's Domain authority. */
+export declare const ensureUser: HandlerOf<typeof S.ensureUser>;
+//# sourceMappingURL=ensure.d.ts.map

package/dist/functions/user/ensure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure.d.ts","sourceRoot":"","sources":["../../../functions/user/ensure.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC7E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAMpD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAEzD,OAAO,EAAE,0BAA0B,EAAgC,MAAM,aAAa,CAAA;AACtF,OAAO,EAAE,CAAC,EAAE,MAAM,SAAS,CAAA;AAE3B,MAAM,WAAW,oBAAoB;IACnC,SAAS,CACP,KAAK,EAAE,gBAAgB,EACvB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAE,GAC1C,OAAO,CAAC,eAAe,CAAC,CAAA;CAC5B;AAED,iGAAiG;AACjG,wBAAsB,eAAe,CACnC,KAAK,EAAE,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC,CAAC,CAAC,EACvD,WAAW,EAAE,oBAAoB,EACjC,MAAM,CAAC,EAAE,WAAW,kCAKrB;AAED,8FAA8F;AAC9F,wBAAsB,eAAe,CACnC,KAAK,EAAE,UAAU,CAAC,OAAO,0BAA0B,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,EACnE,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAyBvC;AAED,iGAAiG;AACjG,eAAO,MAAM,UAAU,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,UAAU,CAmBrD,CAAA"}

package/dist/functions/user/ensure.js

@@ -0,0 +1,49 @@
+import { issuer } from '@astrale-os/sdk/auth';
+import { ClassPath } from '@astrale-os/sdk/graph';
+import { Path } from '@astrale-os/sdk/graph/path';
+import { buildShellUserProvisioning, projectShellUserProvisioning } from '#rules/user';
+import { S } from '#schema';
+/** Execute the reusable Shell-owned provisioning rule through an injected authority boundary. */
+export async function ensureShellUser(input, provisioner, signal) {
+    const provisioning = buildShellUserProvisioning(input);
+    const result = await provisioner.provision(provisioning.request, { signal });
+    return projectShellUserProvisioning(provisioning, result);
+}
+/** Resolve a previously provisioned external identity through Shell-owned graph authority. */
+export async function lookupShellUser(input, kernel, signal) {
+    const found = await kernel.auth.whois({ issuer: input.issuer, subject: input.subject }, { signal });
+    if (found === null)
+        return null;
+    const user = Path.id(found.id);
+    const node = await kernel.getOrThrow(user, { signal });
+    if (node.class !== ClassPath.from(S.$.class('User'))) {
+        throw new TypeError('External identity resolves to a non-Shell User.');
+    }
+    const spaces = await kernel.neighbors(user, S.$.class('default_space').schemaRef, {
+        signal,
+        direction: 'outgoing',
+        page: { size: 2 },
+    });
+    if (spaces.nodes.length !== 1 ||
+        spaces.cursor !== null ||
+        spaces.nodes[0].class !== ClassPath.from(S.$.class('Space'))) {
+        throw new TypeError('Shell User does not have exactly one personal default Space.');
+    }
+    return Object.freeze({ user: user.raw, personalSpace: Path.id(spaces.nodes[0].id).raw });
+}
+/** Manager-invokable adapter; all product mutation executes through Shell's Domain authority. */
+export const ensureUser = async ({ input, kernel, signal, step, }) => {
+    const admitted = {
+        operationId: input.operationId,
+        identity: {
+            issuer: issuer.accept(input.identity.issuer),
+            subject: input.identity.subject,
+        },
+        personalSpaceName: input.personalSpaceName,
+    };
+    const existing = await step.run('lookup-shell-user', () => lookupShellUser(admitted.identity, kernel, signal));
+    if (existing !== null)
+        return existing;
+    return step.run('provision-shell-user', () => ensureShellUser(admitted, kernel.auth, signal));
+};
+//# sourceMappingURL=ensure.js.map

package/dist/functions/user/ensure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ensure.js","sourceRoot":"","sources":["../../../functions/user/ensure.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAA;AAIjD,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AACtF,OAAO,EAAE,CAAC,EAAE,MAAM,SAAS,CAAA;AAS3B,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAuD,EACvD,WAAiC,EACjC,MAAoB;IAEpB,MAAM,YAAY,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAA;IACtD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IAC5E,OAAO,4BAA4B,CAAC,YAAY,EAAE,MAAM,CAAC,CAAA;AAC3D,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAmE,EACnE,MAAc,EACd,MAAoB;IAEpB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CACnC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAChD,EAAE,MAAM,EAAE,CACX,CAAA;IACD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAE/B,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC9B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;IACtD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAA;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,SAAS,EAAE;QAChF,MAAM;QACN,SAAS,EAAE,UAAU;QACrB,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE;KAClB,CAAC,CAAA;IACF,IACE,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QACzB,MAAM,CAAC,MAAM,KAAK,IAAI;QACtB,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAC7D,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,8DAA8D,CAAC,CAAA;IACrF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;AAC3F,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,MAAM,UAAU,GAAmC,KAAK,EAAE,EAC/D,KAAK,EACL,MAAM,EACN,MAAM,EACN,IAAI,GACL,EAAE,EAAE;IACH,MAAM,QAAQ,GAAG;QACf,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,QAAQ,EAAE;YACR,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC5C,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO;SAChC;QACD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAA;IACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,GAAG,EAAE,CACxD,eAAe,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CACnD,CAAA;IACD,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAA;IACtC,OAAO,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,GAAG,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;AAC/F,CAAC,CAAA"}

package/dist/functions/user/index.d.ts

@@ -0,0 +1,3 @@
+export { ensureAdministrator } from './administrator.js';
+export { ensureShellUser, ensureUser, lookupShellUser, type ShellUserProvisioner, } from './ensure.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/functions/user/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../functions/user/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EACL,eAAe,EACf,UAAU,EACV,eAAe,EACf,KAAK,oBAAoB,GAC1B,MAAM,aAAa,CAAA"}

package/dist/functions/user/index.js

@@ -0,0 +1,3 @@
+export { ensureAdministrator } from './administrator.js';
+export { ensureShellUser, ensureUser, lookupShellUser, } from './ensure.js';
+//# sourceMappingURL=index.js.map

package/dist/functions/user/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../functions/user/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EACL,eAAe,EACf,UAAU,EACV,eAAe,GAEhB,MAAM,aAAa,CAAA"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { Application, Group, ORIGIN, S, ShellCore, ShellSchema, Space, User, adminGroup, administers_group, administers_space, applicationCore, applicationInstall, applicationUninstall, applicationView, application_of, belongsToSpace, default_space, defaultSpace, ensureAdministrator, ensureUser, groupAssignUser, groupCore, groupUnassignUser, groupView, homeView, iUser, installed_in, mayAdministerApplication, mayAdministerGroup, mayAdministerSpace, memberGroup, member_of_group, member_of_space, owns_space, ownsSpace, shellApplication, spaceAddUser, spaceCore, spaceRemoveUser, spaceSetDefault, spaceView, userView, type GroupMembershipInput, type GroupMembershipResult, type EnsureShellAdministratorInput, type EnsureShellAdministratorResult, type EnsureShellUserResult, type InstallApplicationInput, type InstallApplicationResult, type SetDefaultSpaceInput, type SetDefaultSpaceResult, type Shell, type ShellCoreName, type ShellDomainOperations, type ShellEdgeName, type ShellNodeName, type ShellSchemaInput, type SpaceUserAccess, type SpaceUserAccessInput, type SpaceUserAccessResult, type SpaceUserInput, type SpaceUserResult, type UninstallApplicationInput, type UninstallApplicationResult, } from '#schema';
+export { ShellDomain } from './public.js';
+export { buildShellUserProvisioning, projectShellUserProvisioning, type EnsureShellUserInput, type ShellUserProvisioning, } from './rules/user/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,KAAK,EACL,MAAM,EACN,CAAC,EACD,SAAS,EACT,WAAW,EACX,KAAK,EACL,IAAI,EACJ,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,cAAc,EACd,cAAc,EACd,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,UAAU,EACV,eAAe,EACf,SAAS,EACT,iBAAiB,EACjB,SAAS,EACT,QAAQ,EACR,KAAK,EACL,YAAY,EACZ,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,eAAe,EACf,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,eAAe,EACf,eAAe,EACf,SAAS,EACT,QAAQ,EACR,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,qBAAqB,EAC1B,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,KAAK,EACV,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,GAChC,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,EAC5B,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAA"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export { Application, Group, ORIGIN, S, ShellCore, ShellSchema, Space, User, adminGroup, administers_group, administers_space, applicationCore, applicationInstall, applicationUninstall, applicationView, application_of, belongsToSpace, default_space, defaultSpace, ensureAdministrator, ensureUser, groupAssignUser, groupCore, groupUnassignUser, groupView, homeView, iUser, installed_in, mayAdministerApplication, mayAdministerGroup, mayAdministerSpace, memberGroup, member_of_group, member_of_space, owns_space, ownsSpace, shellApplication, spaceAddUser, spaceCore, spaceRemoveUser, spaceSetDefault, spaceView, userView, } from '#schema';
+export { ShellDomain } from './public.js';
+export { buildShellUserProvisioning, projectShellUserProvisioning, } from './rules/user/index.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,WAAW,EACX,KAAK,EACL,MAAM,EACN,CAAC,EACD,SAAS,EACT,WAAW,EACX,KAAK,EACL,IAAI,EACJ,UAAU,EACV,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,cAAc,EACd,cAAc,EACd,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,UAAU,EACV,eAAe,EACf,SAAS,EACT,iBAAiB,EACjB,SAAS,EACT,QAAQ,EACR,KAAK,EACL,YAAY,EACZ,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,eAAe,EACf,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,YAAY,EACZ,SAAS,EACT,eAAe,EACf,eAAe,EACf,SAAS,EACT,QAAQ,GAuBT,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EACL,0BAA0B,EAC1B,4BAA4B,GAG7B,MAAM,uBAAuB,CAAA"}

package/dist/mutations/application/association.d.ts

@@ -0,0 +1,14 @@
+import type { NodeId } from '@astrale-os/sdk/graph/node';
+import { type Result } from '@astrale-os/sdk/result';
+import type { InstallApplicationInput } from '#schema/application';
+import type { NodeQueryGuard } from '#utils/query-page';
+import type { ApplicationMutationFailure } from './errors.js';
+export type InstallApplicationMutationResult = Result<{
+    readonly application: NodeId;
+}, ApplicationMutationFailure>;
+export interface InstallApplicationAssociationChange {
+    readonly association: InstallApplicationInput;
+    readonly guard: NodeQueryGuard;
+}
+export declare const installApplicationAssociation: import("@astrale-os/sdk/mutation").ProjectedMutationDefinition<InstallApplicationAssociationChange, InstallApplicationMutationResult>;
+//# sourceMappingURL=association.d.ts.map

package/dist/mutations/application/association.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"association.d.ts","sourceRoot":"","sources":["../../../mutations/application/association.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AAMxD,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAG7D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAIvD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAA;AAE7D,MAAM,MAAM,gCAAgC,GAAG,MAAM,CACnD;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EAChC,0BAA0B,CAC3B,CAAA;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,WAAW,EAAE,uBAAuB,CAAA;IAC7C,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAA;CAC/B;AAKD,eAAO,MAAM,6BAA6B,uIAwCxC,CAAA"}