@astrale-domains/shell 0.1.6 → 0.1.7

package/dist/schema/modules/user/legacy/account-properties.js

@@ -0,0 +1,24 @@
+import { z } from 'zod';
+/**
+ * @deprecated Correlation key of an Admin-reserved account, `email` and `name` of a self-recorded
+ * profile (L-SHELL-4). Replaced by `email` (unique) and `name`, which `legacyMigrateAccounts` copies.
+ * Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export const legacyAccountProperties = {
+    // Correlation for Admin-owned creation; never an authentication credential.
+    creationKey: z.string().min(1).max(512).optional(),
+    // Named apart from any profile a Domain extending User declares (`email`, `displayName`…).
+    claimedEmail: z.string().min(3).max(320).optional(),
+    claimedName: z.string().min(1).max(200).optional(),
+};
+/**
+ * @deprecated The account state before `frozen` was written directly (U2): `suspended` (local
+ * deactivation) and `directoryActive` (the directory's state). Shell no longer writes or reads them;
+ * they stay declared, optional, so stored accounts that hold them remain valid (L-SHELL-17).
+ * Replaced by `frozen` alone, which U2 already wrote beside them. Removal: Shell major (delivery
+ * step 5), in the Kernel repair session that erases them from stored accounts.
+ */
+export const legacyAccountStateProperties = {
+    suspended: z.boolean().optional(),
+    directoryActive: z.boolean().optional(),
+};

package/dist/schema/modules/user/legacy/functions/index.js

@@ -0,0 +1,2 @@
+export { legacyRecordProfile } from './record-profile.js';
+export { legacyMigrateAccounts } from './migrate-accounts.js';

package/dist/schema/modules/user/legacy/functions/migrate-accounts.js

@@ -0,0 +1,23 @@
+import { func } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+import { profileRoles } from '../../../role/index.js';
+import { hasRole } from '../../../../policies/index.js';
+/**
+ * @deprecated Copy each account's `claimedEmail` to `email` and `claimedName` to `name`, so the
+ * Shell major can require them, and give every account and group its profile; running it again
+ * changes nothing
+ * (L-SHELL-14). Replaced by nothing: accounts are born with them. Removal: Shell major (delivery
+ * step 5) after 1Pact step 4, once every instance has run it.
+ */
+export const legacyMigrateAccounts = func({
+    description: 'Write email, name and profiles on accounts and groups created before them.',
+    auth: 'authorized',
+    input: z.strictObject({}),
+    output: z.object({
+        migrated: z.number().int().min(0),
+        conflicts: z.array(z.object({ user: z.string(), email: z.string() })),
+        /** The profiles created for accounts and groups stored before profiles. */
+        profiles: z.number().int().min(0),
+    }),
+    policy: ({ check, ref }) => check(hasRole, ref(profileRoles['workspace.admin'])),
+});

package/dist/schema/modules/user/legacy/functions/record-profile.js

@@ -0,0 +1,18 @@
+import { method } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+import { legacyIsSelf } from '../../../../policies/legacy/index.js';
+/**
+ * @deprecated The email and display name an account records about itself at each sign-in
+ * (L-SHELL-5). Replaced by `User.updateProfile`, called by the holder from its profile. Removal:
+ * Shell major (delivery step 5) after 1Pact step 4.
+ */
+export const legacyRecordProfile = method({
+    description: 'Record the email and display name this account signs in with; only the account itself may.',
+    auth: 'authorized',
+    input: z.strictObject({
+        email: z.string().min(3).max(320).optional(),
+        displayName: z.string().min(1).max(200).optional(),
+    }),
+    output: z.object({}),
+    policy: ({ check, self }) => check(legacyIsSelf, self),
+});

package/dist/schema/modules/user/legacy/index.js

@@ -0,0 +1,5 @@
+// Relaxations first: User reads them while the rest of this folder may still be loading.
+export { LEGACY_ACCOUNT_PROPERTIES_OPTIONAL, LEGACY_USER_EXTENDS, LEGACY_USER_INHERITANCE, LEGACY_USER_READ, legacyUserName, } from './relaxations.js';
+export { legacyAccountProperties, legacyAccountStateProperties } from './account-properties.js';
+export { legacyInviteFields, legacyInviteOwnerAdmission } from './invite.js';
+export { legacyMigrateAccounts, legacyRecordProfile } from './functions/index.js';

package/dist/schema/modules/user/legacy/invite.js

@@ -0,0 +1,15 @@
+import { z } from 'zod';
+import { legacyOwnsClass } from '../../../policies/legacy/index.js';
+/**
+ * @deprecated The `{ user, email }` invitation of callers older than profiles: the email is the
+ * caller's, and no profile is granted (L-SHELL-6). Replaced by `User.invite({ user, profile })`,
+ * which reads the account's email. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export const legacyInviteFields = { email: z.string().min(3).max(320).optional() };
+/**
+ * @deprecated The owner of a User subclass invites its accounts (L-SHELL-9). Replaced by
+ * `user.writer` in the Domain's release. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export function legacyInviteOwnerAdmission(context, user) {
+    return context.check(legacyOwnsClass, user);
+}

package/dist/schema/modules/user/legacy/relaxations.js

@@ -0,0 +1,37 @@
+import { K, property } from '@astrale-os/sdk/schema';
+/**
+ * @deprecated Domains still extend User (L-SHELL-1). Replaced by `'final'`. Removal: Shell major
+ * (delivery step 5) after 1Pact step 4.
+ */
+export const LEGACY_USER_INHERITANCE = 'open';
+/**
+ * @deprecated User omits Kernel Named and Timestamped while stored accounts lack their required
+ * `name`, `createdAt` and `updatedAt`, which the Kernel refuses to add over existing data
+ * (DATA_MIGRATION_REQUIRED) (L-SHELL-2). Replaced by
+ * `[K.classes.Identity, K.classes.Named, K.classes.Iconable, K.classes.Timestamped]`. Removal: Shell
+ * major (delivery step 5) after 1Pact step 4, in the Kernel repair session that writes those values.
+ */
+export const LEGACY_USER_EXTENDS = [K.classes.Identity, K.classes.Iconable];
+/**
+ * @deprecated The account's name as a User Property, optional, until User extends Kernel Named
+ * (L-SHELL-2). Replaced by `K.classes.Named.properties.name`. Removal: Shell major (delivery step 5)
+ * after 1Pact step 4.
+ */
+export const legacyUserName = property({ type: 'string', minLength: 1, maxLength: 100 }, { required: false });
+/**
+ * @deprecated Properties the target requires stay optional until `legacyMigrateAccounts` has
+ * written them on every stored account (L-SHELL-3). Replaced by `{ required: true }`. Removal: Shell
+ * major (delivery step 5) after 1Pact step 4.
+ */
+export const LEGACY_ACCOUNT_PROPERTIES_OPTIONAL = { required: false };
+/**
+ * @deprecated User keeps the read rule and the absence of unique constraints of the Shell that
+ * released Domains embed (L-SHELL-19): the Kernel binds a Domain built against that Shell only
+ * while `/policies/read` and `/unique` of the Classes it extends stay as they were
+ * (SCHEMA_DEPENDENCY_INCOMPATIBLE otherwise). Every identity reads accounts; members read the same
+ * names and emails on profiles anyway. An email stays unique through `UserProfile.email` and the
+ * lookups of `User.create`, `User.update` and `User.provision`. Replaced by `read: anyOf(user.reader,
+ * self)` and `unique: [['email'], ['directory', 'externalId']]`. Removal: Shell major (delivery
+ * step 5), once immogrc, 1Pact and organization are rebuilt against this Shell.
+ */
+export const LEGACY_USER_READ = true;

package/dist/schema/modules/user/policies/describes-subject.d.ts

@@ -0,0 +1,2 @@
+/** The subject is the account this profile describes. */
+export declare const describesSubject: import("@astrale-os/sdk/schema").Policy;

package/dist/schema/modules/user/policies/describes-subject.js

@@ -0,0 +1,7 @@
+import { policy } from '@astrale-os/sdk/schema';
+import { user_profile } from '../classes/user-profile-link.js';
+/** The subject is the account this profile describes. */
+export const describesSubject = policy({
+    description: 'The caller is the account this profile describes.',
+    match: ({ edge, object, subject }) => edge({ source: subject, class: user_profile, target: object }),
+});

package/dist/schema/modules/user/policies/index.d.ts

@@ -0,0 +1,2 @@
+export { describesSubject } from './describes-subject.js';
+export { isProfileSource } from './is-profile-source.js';

package/dist/schema/modules/user/policies/index.js

@@ -0,0 +1,2 @@
+export { describesSubject } from './describes-subject.js';
+export { isProfileSource } from './is-profile-source.js';

package/dist/schema/modules/user/policies/is-profile-source.d.ts

@@ -0,0 +1,2 @@
+/** The subject is the account at the source of this Edge: a person finds its own profile. */
+export declare const isProfileSource: import("@astrale-os/sdk/schema").Policy;

package/dist/schema/modules/user/policies/is-profile-source.js

@@ -0,0 +1,6 @@
+import { policy } from '@astrale-os/sdk/schema';
+/** The subject is the account at the source of this Edge: a person finds its own profile. */
+export const isProfileSource = policy({
+    description: 'The caller is the account this Edge leaves.',
+    match: ({ sameNode, subject, source }) => sameNode(subject, source),
+});

package/dist/schema/modules/user/types/account.d.ts

@@ -0,0 +1,12 @@
+import { z } from 'zod';
+/** An email as a caller writes it; the method trims it, lower-cases it and checks its shape. */
+export declare const accountEmailInput: z.ZodString;
+/** A displayed name, a given name or a family name. */
+export declare const personName: z.ZodString;
+/** A Kernel Iconable icon; `null` removes it. */
+export declare const accountIcon: z.ZodNullable<z.ZodString>;
+/** The WorkOS id of a directory and the id of an account or a group in it. */
+export declare const directoryId: z.ZodString;
+export declare const externalId: z.ZodString;
+/** A Node as a method returns it: its canonical `@<NodeId>` path. */
+export declare const nodeReference: z.ZodString;

package/dist/schema/modules/user/types/account.js

@@ -0,0 +1,12 @@
+import { z } from 'zod';
+/** An email as a caller writes it; the method trims it, lower-cases it and checks its shape. */
+export const accountEmailInput = z.string().min(3).max(320);
+/** A displayed name, a given name or a family name. */
+export const personName = z.string().min(1).max(100);
+/** A Kernel Iconable icon; `null` removes it. */
+export const accountIcon = z.string().min(1).max(8_000).nullable();
+/** The WorkOS id of a directory and the id of an account or a group in it. */
+export const directoryId = z.string().min(1).max(200);
+export const externalId = z.string().min(1).max(200);
+/** A Node as a method returns it: its canonical `@<NodeId>` path. */
+export const nodeReference = z.string().min(2).max(512);

package/dist/schema/modules/user/types/index.d.ts

@@ -1,2 +1,2 @@
 export { invitationSummary, type InvitationSummary } from './invitation-summary.js';
-export { userEmail, userDisplayName } from './user-profile.js';
+export { accountEmailInput, accountIcon, directoryId, externalId, nodeReference, personName, } from './account.js';

package/dist/schema/modules/user/types/index.js

@@ -1,2 +1,2 @@
 export { invitationSummary } from './invitation-summary.js';
-export { userEmail, userDisplayName } from './user-profile.js';
+export { accountEmailInput, accountIcon, directoryId, externalId, nodeReference, personName, } from './account.js';

package/dist/schema/modules/view-access/classes/view-access.d.ts

@@ -1,8 +1,8 @@
 /**
- * One View given to an account or a group: the holder, and each member of a holding group, has this
- * View among the ones it opens. It decides navigation, never data: the View's own Domain still
- * guards everything it shows. Only instance administrators create or delete it. The target is a
- * Class Shell does not own, so the Edge detaches with its View.
+ * A View an Identity lands on without `member`: an account, a group or a Role, and each of their
+ * members. It decides navigation, never data: the View's own Domain still guards everything it
+ * shows (V1). Only an admin writes it; an admin or its holders read it. Each end detaches with its
+ * Node.
  */
 export declare const view_access: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
     readonly depth: 0;
@@ -10,13 +10,9 @@ export declare const view_access: import("@astrale-os/sdk/schema").DirectedEdgeC
     readonly extends: readonly [];
     readonly properties: never;
     readonly source: {
-        readonly as: "holder";
-        readonly accepts: readonly (() => {
-            readonly kind: 'node';
-            readonly abstract: never;
-            readonly depth: never;
-            readonly properties: never;
-            readonly methods: never;
+        readonly as: "audience";
+        readonly accepts: readonly (import("@astrale-os/sdk/schema").ClassRef<"Identity"> & {
+            readonly origin: "kernel.astrale.ai";
         })[];
         readonly outgoing: "0..*";
     };

package/dist/schema/modules/view-access/classes/view-access.js

@@ -1,18 +1,23 @@
 import { K, edgeClass } from '@astrale-os/sdk/schema';
-import { Group } from '../../group/index.js';
-import { User } from '../../user/index.js';
+import { profileRoles } from '../../role/index.js';
+import { hasRole } from '../../../policies/index.js';
+import { holdsViewAccess } from '../policies/index.js';
 /**
- * One View given to an account or a group: the holder, and each member of a holding group, has this
- * View among the ones it opens. It decides navigation, never data: the View's own Domain still
- * guards everything it shows. Only instance administrators create or delete it. The target is a
- * Class Shell does not own, so the Edge detaches with its View.
+ * A View an Identity lands on without `member`: an account, a group or a Role, and each of their
+ * members. It decides navigation, never data: the View's own Domain still guards everything it
+ * shows (V1). Only an admin writes it; an admin or its holders read it. Each end detaches with its
+ * Node.
  */
 export const view_access = edgeClass.directed({
-    policies: { read: true, traverse: true },
-    source: {
-        as: 'holder',
-        accepts: [() => User, () => Group],
-        outgoing: '0..*',
+    inheritance: 'final',
+    abstract: false,
+    description: 'A View this Identity lands on without member.',
+    source: { as: 'audience', accepts: [K.classes.Identity], outgoing: '0..*', onDelete: 'detach' },
+    target: { as: 'view', accepts: [K.classes.View], incoming: '0..*', onDelete: 'detach' },
+    policies: {
+        read: ({ anyOf, check, ref, self }) => anyOf(check(hasRole, ref(profileRoles['workspace.admin'])), check(holdsViewAccess, self)),
+        traverse: true,
+        create: ({ check, ref }) => check(hasRole, ref(profileRoles['workspace.admin'])),
+        delete: ({ check, ref }) => check(hasRole, ref(profileRoles['workspace.admin'])),
     },
-    target: { as: 'view', accepts: [K.classes.View], incoming: '0..*' },
 });

package/dist/schema/modules/view-access/index.d.ts

@@ -1,3 +1,2 @@
 export { view_access } from './classes/index.js';
-export { viewOnlyGroup } from './core/index.js';
-export { assignViews } from './functions/index.js';
+export { holdsViewAccess } from './policies/index.js';

package/dist/schema/modules/view-access/index.js

@@ -1,3 +1,2 @@
 export { view_access } from './classes/index.js';
-export { viewOnlyGroup } from './core/index.js';
-export { assignViews } from './functions/index.js';
+export { holdsViewAccess } from './policies/index.js';

package/dist/schema/modules/view-access/legacy/functions/assign-views.js

@@ -0,0 +1,22 @@
+import { func } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+import { profileRoles } from '../../../role/index.js';
+import { hasRole } from '../../../../policies/index.js';
+import { LEGACY_MAX_ASSIGNMENTS, legacyViewAssignment } from '../view-assignment.js';
+/**
+ * @deprecated Give and withdraw Views for each identity, in one write (L-SHELL-12). Replaced by a
+ * Mutation on `view_access`, which only `workspace.admin` holders may write. Removal: Shell major
+ * (delivery step 5) after 1Pact step 4.
+ *
+ * Its legacy `can_use` holders, the Administrators group, hold `workspace.admin` through the release
+ * (AM5), which now admits them.
+ */
+export const legacyAssignViews = func({
+    description: 'Give and withdraw Views for each identity, in one write.',
+    auth: 'authorized',
+    input: z.strictObject({
+        assignments: z.array(legacyViewAssignment).min(1).max(LEGACY_MAX_ASSIGNMENTS),
+    }),
+    output: z.object({}),
+    policy: ({ check, ref }) => check(hasRole, ref(profileRoles['workspace.admin'])),
+});

package/dist/schema/modules/view-access/legacy/functions/index.js

@@ -0,0 +1 @@
+export { legacyAssignViews } from './assign-views.js';

package/dist/schema/modules/view-access/legacy/index.js

@@ -0,0 +1,2 @@
+export { legacyAssignViews } from './functions/index.js';
+export { LEGACY_MAX_ASSIGNED_VIEWS, LEGACY_MAX_ASSIGNMENTS, legacyViewAssignment, } from './view-assignment.js';

package/dist/schema/modules/view-access/legacy/view-assignment.js

@@ -0,0 +1,24 @@
+import { z } from 'zod';
+/**
+ * @deprecated Bounds of one `assignViews` call within the Kernel's Mutation limits (L-SHELL-12).
+ * Replaced by a Mutation on `view_access`. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export const LEGACY_MAX_ASSIGNED_VIEWS = 20;
+/**
+ * @deprecated At most 40 identities in one `assignViews` call (L-SHELL-12). Replaced by a Mutation
+ * on `view_access`. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export const LEGACY_MAX_ASSIGNMENTS = 40;
+// A Path inside a list is not a callable Path input: each is an exact @NodeId the Action checks.
+const nodeId = z.string().min(2).max(512);
+const views = z.array(nodeId).max(LEGACY_MAX_ASSIGNED_VIEWS);
+/**
+ * @deprecated The Views given to one identity (`set`) and withdrawn from it (`unset`), by @NodeId
+ * (L-SHELL-12). Replaced by a Mutation on `view_access`. Removal: Shell major (delivery step 5)
+ * after 1Pact step 4.
+ */
+export const legacyViewAssignment = z.strictObject({
+    identity: nodeId,
+    set: views.optional(),
+    unset: views.optional(),
+});

package/dist/schema/modules/view-access/policies/holds-view-access.d.ts

@@ -0,0 +1,2 @@
+/** The subject is the Edge's audience, or extends it: a group's members hold its Views. */
+export declare const holdsViewAccess: import("@astrale-os/sdk/schema").Policy;

package/dist/schema/modules/view-access/policies/holds-view-access.js

@@ -0,0 +1,5 @@
+import { policy } from '@astrale-os/sdk/schema';
+/** The subject is the Edge's audience, or extends it: a group's members hold its Views. */
+export const holdsViewAccess = policy({
+    match: ({ sameNode, subject, source }) => sameNode(subject, source),
+});

package/dist/schema/modules/view-access/policies/index.d.ts

@@ -0,0 +1 @@
+export { holdsViewAccess } from './holds-view-access.js';

package/dist/schema/modules/view-access/policies/index.js

@@ -0,0 +1 @@
+export { holdsViewAccess } from './holds-view-access.js';

package/dist/schema/policies/has-role.d.ts

@@ -0,0 +1,6 @@
+/**
+ * The subject holds the object Role: it is that Role, or extends it through its live composition,
+ * at any depth. This is the Kernel `hasRole` meaning; a Domain checks only Policies it declares, so
+ * each Domain declares its own and tests a Role with `check(hasRole, ref(role))` (AM2).
+ */
+export declare const hasRole: import("@astrale-os/sdk/schema").Policy;

package/dist/schema/policies/has-role.js

@@ -0,0 +1,9 @@
+import { policy } from '@astrale-os/sdk/schema';
+/**
+ * The subject holds the object Role: it is that Role, or extends it through its live composition,
+ * at any depth. This is the Kernel `hasRole` meaning; a Domain checks only Policies it declares, so
+ * each Domain declares its own and tests a Role with `check(hasRole, ref(role))` (AM2).
+ */
+export const hasRole = policy({
+    match: ({ sameNode, subject, object }) => sameNode(subject, object),
+});

package/dist/schema/policies/index.d.ts

@@ -0,0 +1 @@
+export { hasRole } from './has-role.js';

package/dist/schema/policies/index.js

@@ -1,4 +1 @@
-export { ownsClass } from './owns-class.js';
-export { administersShellClass } from './administers-shell-class.js';
-export { usesFunction } from './uses-function.js';
-export { isSelf } from './is-self.js';
+export { hasRole } from './has-role.js';

package/dist/schema/policies/legacy/administers-shell-class.js

@@ -0,0 +1,21 @@
+import { K, policy } from '@astrale-os/sdk/schema';
+import { Group } from '../../modules/group/index.js';
+import { legacyAdministratorsGroup } from '../../modules/group/legacy/index.js';
+import { legacyMemberOfGroup } from '../../modules/group/legacy/index.js';
+/**
+ * @deprecated Membership of the legacy Administrators group on a Shell-owned concrete Class
+ * (L-SHELL-10). Replaced by `check(hasRole, ref(S.core.nodes['workspace.admin']))`. Removal: Shell
+ * major (delivery step 5) after 1Pact step 4.
+ */
+export const legacyAdministersShellClass = policy({
+    match: ({ exists, subject, object, ref, edge, allOf }) => exists(({ node }) => {
+        const concrete = node();
+        const owner = node(); // of_domain restricts this witness to a protected Domain endpoint.
+        const group = ref(() => Group);
+        return allOf(edge({
+            source: subject,
+            class: () => legacyMemberOfGroup,
+            target: ref(legacyAdministratorsGroup),
+        }), { source: ref(legacyAdministratorsGroup), class: K.classes.instance_of.ref, target: group }, { source: group, class: K.classes.of_domain.ref, target: owner }, { source: concrete, class: K.classes.of_domain.ref, target: owner }, { source: object, class: K.classes.instance_of.ref, target: concrete });
+    }),
+});

package/dist/schema/policies/legacy/index.js

@@ -0,0 +1,4 @@
+export { legacyOwnsClass } from './owns-class.js';
+export { legacyAdministersShellClass } from './administers-shell-class.js';
+export { legacyUsesFunction } from './uses-function.js';
+export { legacyIsSelf } from './is-self.js';

package/dist/schema/policies/legacy/is-self.js

@@ -0,0 +1,9 @@
+import { policy } from '@astrale-os/sdk/schema';
+/**
+ * @deprecated The subject is the object itself, the admission of `User.recordProfile`
+ * (L-SHELL-10). Replaced by `check(hasRole, self)`, which reads the same. Removal: Shell major
+ * (delivery step 5) after 1Pact step 4.
+ */
+export const legacyIsSelf = policy({
+    match: ({ sameNode, subject, object }) => sameNode(subject, object),
+});

package/dist/schema/policies/legacy/owns-class.js

@@ -0,0 +1,12 @@
+import { K, policy } from '@astrale-os/sdk/schema';
+/**
+ * @deprecated Ownership of the object's concrete Class, the admission of a Domain that extends
+ * Shell's User or Group (L-SHELL-10). Replaced by `hasRole` on the Shell Roles: User and Group become
+ * final. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export const legacyOwnsClass = policy({
+    match: ({ exists, subject, object, allOf }) => exists(({ node }) => {
+        const concrete = node(); // Bounded by the two protected Kernel Edges.
+        return allOf({ source: object, class: K.classes.instance_of.ref, target: concrete }, { source: concrete, class: K.classes.of_domain.ref, target: subject });
+    }),
+});

package/dist/schema/policies/legacy/uses-function.js

@@ -0,0 +1,9 @@
+import { K, policy } from '@astrale-os/sdk/schema';
+/**
+ * @deprecated The subject holds the legacy `can_use` capability on the object Function
+ * (L-SHELL-10). Replaced by `hasRole` on a Shell Role. Removal: Shell major (delivery step 5) after
+ * 1Pact step 4.
+ */
+export const legacyUsesFunction = policy({
+    match: ({ edge, subject, object }) => edge({ source: subject, class: () => K.classes.can_use, target: object }),
+});