@astrale-domains/shell 0.1.0-beta.8 → 0.1.1

package/dist/schema/user/view.js

@@ -1,6 +0,0 @@
-import { view } from '@astrale-os/sdk/schema';
-import { User } from './class.js';
-export const userView = view({
-    description: 'Shell User profile and relationships.',
-    target: User,
-});

package/dist/workflows/group/assign.js

@@ -1,3 +0,0 @@
-import { defineWorkflow } from '@astrale-os/sdk/workflow';
-import { changeMembership } from './change.js';
-export const assignGroupUserWorkflow = defineWorkflow()('Group.assignUser', (context) => changeMembership(context, true));

package/dist/workflows/group/change.js

@@ -1,31 +0,0 @@
-import { InvocationError } from '@astrale-os/sdk/execution';
-import { changeGroupMembership } from '#mutations/group';
-import { observeUserGroups } from '#queries/user';
-export async function changeMembership(context, present) {
-    const observed = await context.step.run('observe-membership', () => context.query(observeUserGroups(context.domain), context.input.user));
-    const wasPresent = includes(observed.groups, context.self);
-    if (wasPresent === present)
-        return Object.freeze({});
-    const result = await context.step.run('change-membership', () => context.mutate(changeGroupMembership(context.domain), {
-        user: context.input.user,
-        group: context.self,
-        present,
-        guard: observed.guard,
-    }));
-    if (result.ok)
-        return Object.freeze({});
-    if (result.outcomeKnown)
-        return membershipConflict(result.code);
-    const recovered = await context.step.run('recover-membership', () => context.query(observeUserGroups(context.domain), context.input.user));
-    if (includes(recovered.groups, context.self) === present)
-        return Object.freeze({});
-    throw new InvocationError('BACKEND_UNAVAILABLE', 'Group membership outcome remains unknown after exact observation.', { reason: { code: result.code, details: {} } });
-}
-function includes(groups, group) {
-    return groups.some(({ id }) => id === group);
-}
-function membershipConflict(code) {
-    throw new InvocationError('CONFLICT', 'Group membership conflicted with concurrent graph state.', {
-        reason: { code, details: {} },
-    });
-}

package/dist/workflows/group/index.js

@@ -1,3 +0,0 @@
-export { assignGroupUserWorkflow } from './assign.js';
-export { changeMembership } from './change.js';
-export { unassignGroupUserWorkflow } from './unassign.js';

package/dist/workflows/group/unassign.js

@@ -1,3 +0,0 @@
-import { defineWorkflow } from '@astrale-os/sdk/workflow';
-import { changeMembership } from './change.js';
-export const unassignGroupUserWorkflow = defineWorkflow()('Group.unassignUser', (context) => changeMembership(context, false));

package/dist/workflows/index.js

@@ -1,3 +0,0 @@
-export * from '#workflows/group';
-export * from '#workflows/setup';
-export * from '#workflows/space';

package/dist/workflows/setup/admin.js

@@ -1,3 +0,0 @@
-import { defineWorkflow } from '@astrale-os/sdk/workflow';
-import { runSetup } from './run.js';
-export const setupAdminWorkflow = defineWorkflow()('setupAdmin', (context) => runSetup(context, 'admin'));

package/dist/workflows/setup/index.js

@@ -1,5 +0,0 @@
-export { setupAdminWorkflow } from './admin.js';
-export { setupMemberWorkflow } from './member.js';
-export { planUserSetup } from './plan.js';
-export { provisioningRequest, provisioningResult } from './provision.js';
-export { runSetup } from './run.js';

package/dist/workflows/setup/member.js

@@ -1,3 +0,0 @@
-import { defineWorkflow } from '@astrale-os/sdk/workflow';
-import { runSetup } from './run.js';
-export const setupMemberWorkflow = defineWorkflow()('setupMember', (context) => runSetup(context, 'member'));

package/dist/workflows/setup/plan.js

@@ -1,88 +0,0 @@
-export function planUserSetup(domain, input, role, observation) {
-    const profile = observation.profile;
-    if (profile.class !== domain.classes.User.key) {
-        return conflict('IDENTITY_CLASS_CONFLICT', 'The asserted identity already belongs to a non-Shell User Class.');
-    }
-    const identityIssuer = profile.props[domain.classes.User.properties.iss.key];
-    const identitySubject = profile.props[domain.classes.User.properties.sub.key];
-    if (identityIssuer !== input.issuer || identitySubject !== input.subject) {
-        return conflict('IDENTITY_FACT_CONFLICT', 'The resolved Shell User does not retain the asserted issuer and subject.');
-    }
-    if (observation.home.spaces.length > 1) {
-        return conflict('MULTIPLE_DEFAULT_SPACES', 'The Shell User has more than one default personal Space.');
-    }
-    const currentHome = observation.home.spaces[0];
-    if (currentHome !== undefined && currentHome.class !== domain.classes.Space.key) {
-        return conflict('DEFAULT_SPACE_CLASS_CONFLICT', 'The Shell User default target is not a Shell Space.');
-    }
-    const candidates = currentHome === undefined
-        ? observation.ownedSpaces.spaces.filter((space) => space.class === domain.classes.Space.key &&
-            space.props[domain.classes.Space.properties.name.key] === input.personalSpaceName)
-        : [];
-    if (candidates.length > 1) {
-        return conflict('AMBIGUOUS_PERSONAL_SPACE', 'More than one owned Space matches the requested personal Space name.');
-    }
-    const home = currentHome ?? candidates[0];
-    const currentDisplayName = profile.props[domain.classes.User.properties.displayName.key];
-    if (currentDisplayName !== undefined && typeof currentDisplayName !== 'string') {
-        throw new TypeError('Shell User displayName is not a string.');
-    }
-    const member = hasGroup(domain, observation.groups.groups, 'core.member');
-    const admin = hasGroup(domain, observation.groups.groups, 'core.admin');
-    const ownsHome = home !== undefined && observation.ownedSpaces.spaces.some((space) => space.id === home.id);
-    let homeName;
-    if (home !== undefined) {
-        const value = home.props[domain.classes.Space.properties.name.key];
-        if (typeof value !== 'string') {
-            throw new TypeError('Shell personal Space name is not a string.');
-        }
-        homeName = value;
-    }
-    const displayName = currentDisplayName === input.displayName ? undefined : input.displayName;
-    const desiredHomeName = homeName === input.personalSpaceName ? undefined : input.personalSpaceName;
-    const addDefault = currentHome === undefined;
-    const addOwnership = home === undefined || !ownsHome;
-    const addMember = !member;
-    const addAdmin = role === 'admin' && !admin;
-    if (displayName === undefined &&
-        desiredHomeName === undefined &&
-        !addDefault &&
-        !addOwnership &&
-        !addMember &&
-        !addAdmin) {
-        return Object.freeze({ kind: 'unchanged', personalSpaceId: home.id });
-    }
-    return Object.freeze({
-        kind: 'repair',
-        repair: Object.freeze({
-            userId: profile.id,
-            ...(currentDisplayName === undefined ? {} : { currentDisplayName }),
-            ...(displayName === undefined ? {} : { displayName }),
-            home: home === undefined
-                ? Object.freeze({ kind: 'create', name: input.personalSpaceName })
-                : Object.freeze({
-                    kind: 'existing',
-                    id: home.id,
-                    currentName: homeName,
-                    ...(desiredHomeName === undefined ? {} : { name: desiredHomeName }),
-                }),
-            addDefault,
-            addOwnership,
-            addMember,
-            addAdmin,
-            guards: Object.freeze({
-                home: observation.home.guard,
-                ownedSpaces: observation.ownedSpaces.guard,
-                groups: observation.groups.guard,
-            }),
-        }),
-    });
-}
-function hasGroup(domain, groups, subject) {
-    return groups.some((group) => group.class === domain.classes.Group.key &&
-        group.props[domain.classes.Group.properties.iss.key] === domain.origin &&
-        group.props[domain.classes.Group.properties.sub.key] === subject);
-}
-function conflict(reason, message) {
-    return Object.freeze({ kind: 'conflict', reason, message });
-}

package/dist/workflows/setup/provision.js

@@ -1,57 +0,0 @@
-import { issuer } from '@astrale-os/sdk/auth';
-import { LocalBinding } from '@astrale-os/sdk/graph';
-import { Path } from '@astrale-os/sdk/graph/path';
-import { MutationAST } from '@astrale-os/sdk/mutation';
-const user = LocalBinding('user');
-const personalSpace = LocalBinding('personalSpace');
-export function provisioningRequest(domain, input, role) {
-    const mutation = MutationAST.build((change) => {
-        const createdUser = change.createNode({
-            as: user,
-            class: domain.classes.User.key,
-            props: domain.classes.User.properties.from({ displayName: input.displayName }),
-        });
-        const createdSpace = change.createNode({
-            as: personalSpace,
-            class: domain.classes.Space.key,
-            props: domain.classes.Space.properties.from({ name: input.personalSpaceName }),
-        });
-        change.createEdge({
-            class: domain.classes.owns_space.key,
-            source: createdUser,
-            target: createdSpace,
-        });
-        change.createEdge({
-            class: domain.classes.default_space.key,
-            source: createdUser,
-            target: createdSpace,
-        });
-        change.createEdge({
-            class: domain.classes.member_of_group.key,
-            source: createdUser,
-            target: Path.project(domain.core.nodes.member.ref),
-        });
-        if (role === 'admin') {
-            change.createEdge({
-                class: domain.classes.member_of_group.key,
-                source: createdUser,
-                target: Path.project(domain.core.nodes.admin.ref),
-            });
-        }
-    });
-    return Object.freeze({
-        idempotencyKey: input.operationId,
-        mutation,
-        identities: Object.freeze({
-            [user]: Object.freeze({ issuer: issuer.accept(input.issuer), subject: input.subject }),
-        }),
-    });
-}
-export function provisioningResult(result) {
-    const userId = result.createdNodes[user];
-    const personalSpaceId = result.createdNodes[personalSpace];
-    if (userId === undefined || personalSpaceId === undefined) {
-        throw new TypeError('Shell provisioning omitted its User or personal Space identity.');
-    }
-    return Object.freeze({ userId, personalSpaceId, changed: true });
-}

package/dist/workflows/setup/run.js

@@ -1,74 +0,0 @@
-import { issuer } from '@astrale-os/sdk/auth';
-import { ResponseError, TransportError } from '@astrale-os/sdk/client';
-import { InvocationError } from '@astrale-os/sdk/execution';
-import { Path } from '@astrale-os/sdk/graph/path';
-import { repairUser } from '#mutations/user';
-import { observeUserSetup } from '#queries/user';
-import { planUserSetup } from './plan.js';
-import { provisioningRequest, provisioningResult } from './provision.js';
-export async function runSetup(context, role) {
-    const { client, input, step } = context;
-    const identity = Object.freeze({
-        issuer: issuer.accept(input.issuer),
-        subject: input.subject,
-    });
-    const existing = await step.run('resolve-identity', () => client.auth.whois(identity));
-    if (existing === null) {
-        try {
-            const provisioned = await step.run('provision-identity', () => client.auth.provision(provisioningRequest(context.domain, input, role)));
-            return provisioningResult(provisioned);
-        }
-        catch (cause) {
-            if (!recoverableProvisionFailure(cause))
-                throw cause;
-            const recovered = await step.run('recover-provisioned-identity', () => client.auth.whois(identity));
-            if (recovered === null)
-                throw cause;
-            return convergeExisting(context, role, recovered.id, true);
-        }
-    }
-    return convergeExisting(context, role, existing.id, false);
-}
-async function convergeExisting(context, role, userId, changedBeforeObservation) {
-    const observed = await context.step.run('observe-user-setup', () => context.query(observeUserSetup(context.domain), Path.id(userId).raw));
-    const plan = planUserSetup(context.domain, context.input, role, observed);
-    if (plan.kind === 'conflict')
-        return setupConflict(plan);
-    if (plan.kind === 'unchanged') {
-        return Object.freeze({
-            userId,
-            personalSpaceId: plan.personalSpaceId,
-            changed: changedBeforeObservation,
-        });
-    }
-    const repaired = await context.step.run('repair-user-setup', () => context.mutate(repairUser(context.domain), plan.repair));
-    if (repaired.ok) {
-        return Object.freeze({ userId, personalSpaceId: repaired.personalSpaceId, changed: true });
-    }
-    if (repaired.outcomeKnown) {
-        throw new InvocationError('CONFLICT', 'Shell User setup conflicted with concurrent graph state.', {
-            reason: { code: repaired.code, details: {} },
-        });
-    }
-    const recovered = await context.step.run('recover-user-repair', () => context.query(observeUserSetup(context.domain), Path.id(userId).raw));
-    const recoveredPlan = planUserSetup(context.domain, context.input, role, recovered);
-    if (recoveredPlan.kind === 'conflict')
-        return setupConflict(recoveredPlan);
-    if (recoveredPlan.kind === 'unchanged') {
-        return Object.freeze({ userId, personalSpaceId: recoveredPlan.personalSpaceId, changed: true });
-    }
-    throw new InvocationError('BACKEND_UNAVAILABLE', 'Shell User setup outcome remains unknown after exact state observation.', { reason: { code: repaired.code, details: {} } });
-}
-function setupConflict(plan) {
-    throw new InvocationError('CONFLICT', plan.message, {
-        reason: { code: plan.reason, details: {} },
-    });
-}
-function recoverableProvisionFailure(cause) {
-    if (cause instanceof TransportError) {
-        return cause.context.kind === 'invocation' && cause.context.delivery === 'unknown';
-    }
-    return (cause instanceof ResponseError &&
-        (cause.reason?.code === 'PROVISION_CONFLICT' ||
-            cause.reason?.code === 'PROVISION_PRECONDITION_FAILED'));
-}

package/dist/workflows/space/access.js

@@ -1,41 +0,0 @@
-import { InvocationError } from '@astrale-os/sdk/execution';
-import { changeSpaceAccess } from '#mutations/space';
-import { observeDirectSpaceAccess } from '#queries/space';
-export async function setUserAccess(context, desired) {
-    const observed = await context.step.run('observe-space-access', () => context.query(observeDirectSpaceAccess(context.domain), context.input.user));
-    const current = state(observed, context.self);
-    if (current === desired)
-        return Object.freeze({});
-    const result = await context.step.run('change-space-access', () => context.mutate(changeSpaceAccess(context.domain), {
-        user: context.input.user,
-        space: context.self,
-        addMember: desired === 'member' && current !== 'member',
-        removeMember: current === 'member' && desired !== 'member',
-        addAdmin: desired === 'admin' && current !== 'admin',
-        removeAdmin: current === 'admin' && desired !== 'admin',
-        guards: { member: observed.member.guard, admin: observed.admin.guard },
-    }));
-    if (result.ok)
-        return Object.freeze({});
-    if (result.outcomeKnown)
-        return accessConflict(result.code);
-    const recovered = await context.step.run('recover-space-access', () => context.query(observeDirectSpaceAccess(context.domain), context.input.user));
-    if (state(recovered, context.self) === desired)
-        return Object.freeze({});
-    throw new InvocationError('BACKEND_UNAVAILABLE', 'Space access outcome remains unknown after exact observation.', { reason: { code: result.code, details: {} } });
-}
-function state(observation, space) {
-    const member = observation.member.spaces.some(({ id }) => id === space);
-    const admin = observation.admin.spaces.some(({ id }) => id === space);
-    if (member && admin) {
-        throw new InvocationError('CONFLICT', 'The User has conflicting direct Space access edges.', {
-            reason: { code: 'SPACE_ACCESS_AMBIGUOUS', details: {} },
-        });
-    }
-    return admin ? 'admin' : member ? 'member' : null;
-}
-function accessConflict(code) {
-    throw new InvocationError('CONFLICT', 'Space access conflicted with concurrent graph state.', {
-        reason: { code, details: {} },
-    });
-}

package/dist/workflows/space/add.js

@@ -1,3 +0,0 @@
-import { defineWorkflow } from '@astrale-os/sdk/workflow';
-import { setUserAccess } from './access.js';
-export const addSpaceUserWorkflow = defineWorkflow()('Space.addUser', (context) => setUserAccess(context, context.input.access));

package/dist/workflows/space/default.js

@@ -1,37 +0,0 @@
-import { InvocationError } from '@astrale-os/sdk/execution';
-import { Path } from '@astrale-os/sdk/graph/path';
-import { defineWorkflow } from '@astrale-os/sdk/workflow';
-import { changeDefaultSpace } from '#mutations/space';
-import { observeHome } from '#queries/user';
-async function setDefault(context) {
-    const user = context.caller.principal;
-    const observed = await context.step.run('observe-default-space', () => context.query(observeHome(context.domain), Path.id(user).raw));
-    if (observed.spaces.length > 1) {
-        throw new InvocationError('CONFLICT', 'The Shell User has more than one default Space.', {
-            reason: { code: 'MULTIPLE_DEFAULT_SPACES', details: {} },
-        });
-    }
-    if (observed.spaces[0]?.id === context.self)
-        return Object.freeze({});
-    const result = await context.step.run('change-default-space', () => context.mutate(changeDefaultSpace(context.domain), {
-        user,
-        ...(observed.spaces[0] === undefined ? {} : { previous: observed.spaces[0].id }),
-        next: context.self,
-        guard: observed.guard,
-    }));
-    if (result.ok)
-        return Object.freeze({});
-    if (result.outcomeKnown)
-        return defaultConflict(result.code);
-    const recovered = await context.step.run('recover-default-space', () => context.query(observeHome(context.domain), Path.id(user).raw));
-    if (recovered.spaces.length === 1 && recovered.spaces[0]?.id === context.self) {
-        return Object.freeze({});
-    }
-    throw new InvocationError('BACKEND_UNAVAILABLE', 'Default Space outcome remains unknown after exact observation.', { reason: { code: result.code, details: {} } });
-}
-function defaultConflict(code) {
-    throw new InvocationError('CONFLICT', 'Default Space conflicted with concurrent graph state.', {
-        reason: { code, details: {} },
-    });
-}
-export const setDefaultSpaceWorkflow = defineWorkflow()('Space.setDefault', setDefault);

package/dist/workflows/space/index.js

@@ -1,4 +0,0 @@
-export { setUserAccess } from './access.js';
-export { addSpaceUserWorkflow } from './add.js';
-export { setDefaultSpaceWorkflow } from './default.js';
-export { removeSpaceUserWorkflow } from './remove.js';

package/dist/workflows/space/remove.js

@@ -1,3 +0,0 @@
-import { defineWorkflow } from '@astrale-os/sdk/workflow';
-import { setUserAccess } from './access.js';
-export const removeSpaceUserWorkflow = defineWorkflow()('Space.removeUser', (context) => setUserAccess(context, null));