@astrale-domains/shell 0.1.6 → 0.1.7

package/dist/schema/schema.js

@@ -1,25 +1,45 @@
 import { defineSchema, KernelSchema, schema } from '@astrale-os/sdk/schema';
-import { listEntrypoints } from './modules/application/index.js';
-import { Group, member_of_group, adminGroup, applicationsGroup, memberGroup, belongsToGroup, } from './modules/group/index.js';
+// Seam L-SHELL-7…14: the legacy declarations, under their stored names.
+import { legacyShellSchema } from './legacy/index.js';
+import { disconnectDirectory } from './modules/directory/index.js';
+import { Group, GroupProfile, describesGroupOfSubject, group_profile, isGroupProfileSource, } from './modules/group/index.js';
+import { Invitation, invitation_user } from './modules/invitation/index.js';
 import { Namespace, alias, viewsNamespace } from './modules/namespace/index.js';
-import { User } from './modules/user/index.js';
-import { assignViews, view_access, viewOnlyGroup } from './modules/view-access/index.js';
-import { ownsClass, administersShellClass, usesFunction, isSelf } from './policies/index.js';
+import { Role, shellRoles } from './modules/role/index.js';
+import { User, UserProfile, describesSubject, isProfileSource, user_profile, } from './modules/user/index.js';
+import { holdsViewAccess, view_access } from './modules/view-access/index.js';
+import { hasRole } from './policies/index.js';
 import { applicationView } from './views/index.js';
 export const ORIGIN = 'shell.astrale.ai';
 const dependencies = { kernel: KernelSchema };
-const classes = { User, Group, member_of_group, Namespace, alias, view_access };
-const functions = { listEntrypoints, assignViews };
-const policies = { belongsToGroup, ownsClass, administersShellClass, usesFunction, isSelf };
+const classes = {
+    User,
+    UserProfile,
+    user_profile,
+    Group,
+    GroupProfile,
+    group_profile,
+    Invitation,
+    invitation_user,
+    Role,
+    Namespace,
+    alias,
+    view_access,
+    ...legacyShellSchema.classes,
+};
+const functions = { disconnectDirectory, ...legacyShellSchema.functions };
+const policies = {
+    hasRole,
+    holdsViewAccess,
+    describesSubject,
+    isProfileSource,
+    describesGroupOfSubject,
+    isGroupProfileSource,
+    ...legacyShellSchema.policies,
+};
 const views = { application: applicationView };
 const core = {
-    nodes: {
-        admin: adminGroup,
-        applications: applicationsGroup,
-        member: memberGroup,
-        views: viewsNamespace,
-        'view-only': viewOnlyGroup,
-    },
+    nodes: { ...shellRoles, views: viewsNamespace, ...legacyShellSchema.core },
 };
 const input = {
     name: 'Shell',

package/dist/schema/types/attributes.js

@@ -0,0 +1,15 @@
+import { property } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+/**
+ * The stored `attributes` Property of an account or a group (AM11): whoever reads the Node reads
+ * them; Shell writes them only through `create` and `update`, whole, so a write replaces them all.
+ * The Kernel holds the bound, the same as `MAX_ATTRIBUTES` in `#utils`: Schema imports no Utils, so a
+ * test keeps the two equal.
+ */
+export const STORED_ATTRIBUTES_BOUND = 64;
+export const attributesProperty = () => property({ type: 'object', additionalProperties: true, maxProperties: STORED_ATTRIBUTES_BOUND }, { required: false });
+/**
+ * The attributes a method takes, each a JSON value by a non-empty name. The handler checks the
+ * count (`*_ATTRIBUTES_TOO_MANY`): a Zod check has no JSON Schema form.
+ */
+export const attributesInput = z.record(z.string().min(1).max(100), z.unknown());

package/dist/schema/types/index.js

@@ -0,0 +1 @@
+export { STORED_ATTRIBUTES_BOUND, attributesInput, attributesProperty } from './attributes.js';

package/dist/utils/attributes/attributes.js

@@ -0,0 +1,12 @@
+/** How many attributes one account or group carries at most (AM11). */
+export const MAX_ATTRIBUTES = 64;
+/** The attributes a stored value holds: an object, never an array or null. */
+export function toAttributes(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+/** The attributes a method was given, once their count is checked; undefined past the bound. */
+export function boundedAttributes(input) {
+    return Object.keys(input).length <= MAX_ATTRIBUTES ? input : undefined;
+}

package/dist/utils/attributes/index.js

@@ -0,0 +1 @@
+export { MAX_ATTRIBUTES, boundedAttributes, toAttributes, } from './attributes.js';

package/dist/utils/index.js

@@ -0,0 +1,3 @@
+export { canonicalNodeId } from './canonical-node-path/index.js';
+export { sameJson } from './same-json/index.js';
+export { MAX_ATTRIBUTES, boundedAttributes, toAttributes, } from './attributes/index.js';

package/dist/utils/same-json/index.js

@@ -0,0 +1 @@
+export { sameJson } from './same-json.js';

package/dist/utils/same-json/same-json.js

@@ -0,0 +1,9 @@
+/** Two JSON values are equal whatever the order of their object keys. */
+export function sameJson(a, b) {
+    return canonical(a) === canonical(b);
+}
+function canonical(value) {
+    return JSON.stringify(value, (_, item) => item !== null && typeof item === 'object' && !Array.isArray(item)
+        ? Object.fromEntries(Object.entries(item).sort(([a], [b]) => (a < b ? -1 : 1)))
+        : item);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-domains/shell",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Astrale Shell Domain schema and remote product implementation",
   "license": "Apache-2.0",
   "repository": {
@@ -58,7 +58,7 @@
   },
   "devDependencies": {
     "@astrale-os/ox": "0.1.4",
-    "@astrale-os/sdk": "0.6.0-beta.57",
+    "@astrale-os/sdk": "0.6.0-beta.60",
     "@astrale-os/shell-react": "0.6.0-beta.11",
     "@astrale-os/ui": "1.0.0-beta.37",
     "@astrale/typescript-config": "npm:@jsr/astrale__typescript-config@~2.0.0",
@@ -76,7 +76,7 @@
     "vitest": "5.0.5"
   },
   "peerDependencies": {
-    "@astrale-os/sdk": ">=0.6.0-beta.50 <1.0.0"
+    "@astrale-os/sdk": ">=0.6.0-beta.60 <1.0.0"
   },
   "devEngines": {
     "runtime": {

package/dist/functions/application/list-entrypoints.js

@@ -1,6 +0,0 @@
-import { defineAction } from '@astrale-os/sdk/action';
-import { readInstalledEntrypoints } from '../../queries/application/index.js';
-/** One graph read: every Domain with an `entrypoint` Edge, its name and its entrypoint View. */
-export const listEntrypoints = defineAction()('listEntrypoints', async ({ query }) => ({
-    entrypoints: [...(await query(readInstalledEntrypoints, undefined, { as: 'executor' }))],
-}));

package/dist/functions/user/record-profile.js

@@ -1,18 +0,0 @@
-import { defineAction } from '@astrale-os/sdk/action';
-import { recordUserProfile } from '../../mutations/user/index.js';
-import { readUserProfile } from '../../queries/user/index.js';
-/**
- * One read and, only when something changed, one write, with Shell's own authority: the policy
- * admits the account itself alone. An email is kept in lower case.
- */
-export const recordProfile = defineAction()('User.recordProfile', async ({ input, self, query, mutate }) => {
-    const asked = {
-        ...(input.email === undefined ? {} : { email: input.email.trim().toLowerCase() }),
-        ...(input.displayName === undefined ? {} : { displayName: input.displayName }),
-    };
-    const current = await query(readUserProfile, { user: self }, { as: 'executor' });
-    const set = Object.fromEntries(Object.entries(asked).filter(([key, value]) => current[key] !== value));
-    if (Object.keys(set).length > 0)
-        await mutate(recordUserProfile, { user: self, set });
-    return {};
-});

package/dist/mutations/user/index.js

@@ -1 +0,0 @@
-export { recordUserProfile } from './record-user-profile.js';

package/dist/queries/application/index.js

@@ -1 +0,0 @@
-export { readInstalledEntrypoints } from './read-installed-entrypoints.js';

package/dist/queries/application/read-installed-entrypoints.js

@@ -1,28 +0,0 @@
-import { defineQuery } from '@astrale-os/sdk/query';
-const VIEW_MEMBER = /^view\.([A-Za-z][A-Za-z0-9_]*)$/u;
-/**
- * Every installed Domain entrypoint this authority can read, in origin order: each View with an
- * outgoing `entrypoint` Edge, through its `of_domain` locator, which names the View
- * (`view.<name>`) and reaches its Domain, with the origin and the display name.
- */
-export const readInstalledEntrypoints = defineQuery()('shell.application.entrypoints', {
-    build: (_, { kernel: { View, entrypoint, of_domain } }) => View.where((view) => [
-        view.via(entrypoint, { direction: 'outgoing' }).exists(),
-        view.via(of_domain, { direction: 'outgoing' }).exists(),
-    ])
-        .with((view) => ({
-        locator: view.via(of_domain, { direction: 'outgoing' }).withEdge().get(),
-    }))
-        // Shell may only traverse Views: their own values would come back withheld.
-        .ref()
-        .all({ max: 10_000 }),
-    output: (rows) => rows
-        .map(({ locator }) => {
-        const member = VIEW_MEMBER.exec(locator.$edge.member);
-        if (member === null)
-            throw new TypeError('Installed entrypoint locator names no View.');
-        const { origin, name } = locator;
-        return { origin, name, view: `${origin}:view.${member[1]}` };
-    })
-        .sort((left, right) => left.origin.localeCompare(right.origin)),
-});

package/dist/queries/user/index.js

@@ -1 +0,0 @@
-export { readUserProfile } from './read-user-profile.js';

package/dist/queries/user/read-user-profile.js

@@ -1,9 +0,0 @@
-import { defineQuery } from '@astrale-os/sdk/query';
-/** The email and display name one account recorded; nothing for an account it cannot read. */
-export const readUserProfile = defineQuery()('shell.user.profile', {
-    build: ({ user }, { User }) => User.where((account) => account.id.eq(user)).first(),
-    output: (account) => ({
-        ...(account?.claimedEmail === undefined ? {} : { email: account.claimedEmail }),
-        ...(account?.claimedName === undefined ? {} : { displayName: account.claimedName }),
-    }),
-});

package/dist/schema/modules/application/functions/index.d.ts

@@ -1 +0,0 @@
-export { listEntrypoints } from './list-entrypoints.js';

package/dist/schema/modules/application/functions/index.js

@@ -1 +0,0 @@
-export { listEntrypoints } from './list-entrypoints.js';

package/dist/schema/modules/application/functions/list-entrypoints.d.ts

@@ -1,15 +0,0 @@
-import { type Function as SchemaFunction } from '@astrale-os/sdk/schema';
-/**
- * The entrypoint View of every installed Domain that declares one, with its Domain name. Shell
- * reads the Kernel `entrypoint` Edges with its own authority; a Domain without one is not listed.
- */
-export declare const listEntrypoints: SchemaFunction<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
-    readonly mode: 'value';
-    readonly value: {
-        entrypoints: {
-            origin: string;
-            name: string;
-            view: string;
-        }[];
-    };
-}, "authorized", false, false, undefined, undefined>>;

package/dist/schema/modules/application/functions/list-entrypoints.js

@@ -1,16 +0,0 @@
-import { func } from '@astrale-os/sdk/schema';
-import { z } from 'zod';
-import { usesFunction } from '../../../policies/index.js';
-import { entrypointEntry } from '../types/index.js';
-/**
- * The entrypoint View of every installed Domain that declares one, with its Domain name. Shell
- * reads the Kernel `entrypoint` Edges with its own authority; a Domain without one is not listed.
- */
-export const listEntrypoints = func({
-    description: 'List the entrypoint View and name of every installed Domain that declares one.',
-    auth: 'authorized',
-    input: z.strictObject({}),
-    output: z.object({ entrypoints: z.array(entrypointEntry) }),
-    // Holding can_use is enough: Core admin and member hold it; the Applications Group shares it.
-    policy: ({ check, ref }) => check(usesFunction, ref(() => listEntrypoints)),
-});

package/dist/schema/modules/application/index.d.ts

@@ -1,2 +0,0 @@
-export { listEntrypoints } from './functions/index.js';
-export { entrypointEntry, type EntrypointEntry } from './types/index.js';

package/dist/schema/modules/application/index.js

@@ -1,2 +0,0 @@
-export { listEntrypoints } from './functions/index.js';
-export { entrypointEntry } from './types/index.js';

package/dist/schema/modules/application/types/entrypoint-entry.d.ts

@@ -1,8 +0,0 @@
-import { z } from 'zod';
-/** One installed Domain entrypoint: the Domain origin, its display name, and its View key. */
-export declare const entrypointEntry: z.ZodObject<{
-    origin: z.ZodString;
-    name: z.ZodString;
-    view: z.ZodString;
-}, z.core.$strip>;
-export type EntrypointEntry = z.infer<typeof entrypointEntry>;

package/dist/schema/modules/application/types/entrypoint-entry.js

@@ -1,7 +0,0 @@
-import { z } from 'zod';
-/** One installed Domain entrypoint: the Domain origin, its display name, and its View key. */
-export const entrypointEntry = z.object({
-    origin: z.string().min(1),
-    name: z.string().min(1),
-    view: z.string().min(1),
-});

package/dist/schema/modules/application/types/index.d.ts

@@ -1 +0,0 @@
-export { entrypointEntry, type EntrypointEntry } from './entrypoint-entry.js';

package/dist/schema/modules/application/types/index.js

@@ -1 +0,0 @@
-export { entrypointEntry } from './entrypoint-entry.js';

package/dist/schema/modules/group/classes/member-of-group.js

@@ -1,12 +0,0 @@
-import { edgeClass } from '@astrale-os/sdk/schema';
-import { User } from '../../user/index.js';
-import { Group } from './group.js';
-export const member_of_group = edgeClass.directed({
-    policies: { read: true },
-    source: {
-        as: 'member',
-        accepts: [() => User, () => Group],
-        outgoing: '0..*',
-    },
-    target: { as: 'group', accepts: [() => Group], incoming: '0..*' },
-});

package/dist/schema/modules/group/core/administrators-group.d.ts

@@ -1 +0,0 @@
-export declare const adminGroup: import("@astrale-os/sdk/schema").CoreNode;

package/dist/schema/modules/group/core/administrators-group.js

@@ -1,6 +0,0 @@
-import { K, core } from '@astrale-os/sdk/schema';
-import { Group } from '../classes/group.js';
-export const adminGroup = core.node(() => Group, {
-    [K.classes.Named.properties.name.key]: 'Administrators',
-    [K.classes.Descriptable.properties.description.key]: 'Instance administrators.',
-});

package/dist/schema/modules/group/core/applications-group.d.ts

@@ -1 +0,0 @@
-export declare const applicationsGroup: import("@astrale-os/sdk/schema").CoreNode;

package/dist/schema/modules/group/core/applications-group.js

@@ -1,6 +0,0 @@
-import { K, core } from '@astrale-os/sdk/schema';
-import { Group } from '../classes/group.js';
-export const applicationsGroup = core.node(() => Group, {
-    [K.classes.Named.properties.name.key]: 'Applications',
-    [K.classes.Descriptable.properties.description.key]: 'May list the installed applications they can open.',
-});

package/dist/schema/modules/group/core/index.d.ts

@@ -1,3 +0,0 @@
-export { adminGroup } from './administrators-group.js';
-export { applicationsGroup } from './applications-group.js';
-export { memberGroup } from './members-group.js';

package/dist/schema/modules/group/core/index.js

@@ -1,3 +0,0 @@
-export { adminGroup } from './administrators-group.js';
-export { applicationsGroup } from './applications-group.js';
-export { memberGroup } from './members-group.js';

package/dist/schema/modules/group/core/members-group.d.ts

@@ -1 +0,0 @@
-export declare const memberGroup: import("@astrale-os/sdk/schema").CoreNode;

package/dist/schema/modules/group/core/members-group.js

@@ -1,6 +0,0 @@
-import { K, core } from '@astrale-os/sdk/schema';
-import { Group } from '../classes/group.js';
-export const memberGroup = core.node(() => Group, {
-    [K.classes.Named.properties.name.key]: 'Members',
-    [K.classes.Descriptable.properties.description.key]: 'Instance members.',
-});

package/dist/schema/modules/group/functions/assign-member-to-group.js

@@ -1,11 +0,0 @@
-import { method } from '@astrale-os/sdk/schema';
-import { z } from 'zod';
-import { ownsClass, administersShellClass } from '../../../policies/index.js';
-import { groupMembershipInput } from '../types/index.js';
-export const assignMember = method({
-    static: true,
-    auth: 'authorized',
-    input: groupMembershipInput,
-    output: z.object({}),
-    policy: ({ anyOf, check, input }) => anyOf(check(administersShellClass, input.group), check(ownsClass, input.group)),
-});

package/dist/schema/modules/group/functions/unassign-member-from-group.js

@@ -1,11 +0,0 @@
-import { method } from '@astrale-os/sdk/schema';
-import { z } from 'zod';
-import { ownsClass, administersShellClass } from '../../../policies/index.js';
-import { groupMembershipInput } from '../types/index.js';
-export const unassignMember = method({
-    static: true,
-    auth: 'authorized',
-    input: groupMembershipInput,
-    output: z.object({}),
-    policy: ({ anyOf, check, input }) => anyOf(check(administersShellClass, input.group), check(ownsClass, input.group)),
-});

package/dist/schema/modules/group/policies/belongs-to-group.d.ts

@@ -1 +0,0 @@
-export declare const belongsToGroup: import("@astrale-os/sdk/schema").Policy;

package/dist/schema/modules/group/policies/belongs-to-group.js

@@ -1,5 +0,0 @@
-import { policy } from '@astrale-os/sdk/schema';
-import { member_of_group } from '../classes/member-of-group.js';
-export const belongsToGroup = policy({
-    match: ({ edge, subject, object }) => edge({ source: subject, class: () => member_of_group, target: object }),
-});

package/dist/schema/modules/user/functions/record-profile.js

@@ -1,14 +0,0 @@
-import { method } from '@astrale-os/sdk/schema';
-import { z } from 'zod';
-import { isSelf } from '../../../policies/index.js';
-import { userDisplayName, userEmail } from '../types/index.js';
-export const recordProfile = method({
-    description: 'Record the email and display name this account signs in with; only the account itself may.',
-    auth: 'authorized',
-    input: z.strictObject({
-        email: userEmail.optional(),
-        displayName: userDisplayName.optional(),
-    }),
-    output: z.object({}),
-    policy: ({ check, self }) => check(isSelf, self),
-});

package/dist/schema/modules/user/types/user-profile.d.ts

@@ -1,7 +0,0 @@
-import { z } from 'zod';
-/**
- * What an account says about itself, to be recognised in the directory: its sign-in email and its
- * name. The account writes them, so they name it for display and decide nothing.
- */
-export declare const userEmail: z.ZodString;
-export declare const userDisplayName: z.ZodString;

package/dist/schema/modules/user/types/user-profile.js

@@ -1,7 +0,0 @@
-import { z } from 'zod';
-/**
- * What an account says about itself, to be recognised in the directory: its sign-in email and its
- * name. The account writes them, so they name it for display and decide nothing.
- */
-export const userEmail = z.string().min(3).max(320);
-export const userDisplayName = z.string().min(1).max(200);

package/dist/schema/modules/view-access/core/index.d.ts

@@ -1 +0,0 @@
-export { viewOnlyGroup } from './view-only-group.js';

package/dist/schema/modules/view-access/core/index.js

@@ -1 +0,0 @@
-export { viewOnlyGroup } from './view-only-group.js';

package/dist/schema/modules/view-access/core/view-only-group.d.ts

@@ -1,5 +0,0 @@
-/**
- * Its members open only the Views given to them, never the workspace. Administrators keep the
- * workspace even when they are members.
- */
-export declare const viewOnlyGroup: import("@astrale-os/sdk/schema").CoreNode;

package/dist/schema/modules/view-access/core/view-only-group.js

@@ -1,10 +0,0 @@
-import { K, core } from '@astrale-os/sdk/schema';
-import { Group } from '../../group/index.js';
-/**
- * Its members open only the Views given to them, never the workspace. Administrators keep the
- * workspace even when they are members.
- */
-export const viewOnlyGroup = core.node(() => Group, {
-    [K.classes.Named.properties.name.key]: 'View only',
-    [K.classes.Descriptable.properties.description.key]: 'Open only the Views given to them, never the workspace.',
-});

package/dist/schema/modules/view-access/functions/assign-views.d.ts

@@ -1,16 +0,0 @@
-import { type Function as SchemaFunction } from '@astrale-os/sdk/schema';
-/**
- * Give Views to identities and withdraw others, in one write. Each identity is a User or a Group;
- * a View already given, or already withdrawn, stays as it is. Whether an identity opens the
- * workspace is its `view-only` membership, which `Group.assignMember` changes.
- */
-export declare const assignViews: SchemaFunction<import("@astrale-os/sdk/schema").CallableProjection<{
-    assignments: {
-        identity: string;
-        set?: string[] | undefined;
-        unset?: string[] | undefined;
-    }[];
-}, {
-    readonly mode: 'value';
-    readonly value: Record<string, never>;
-}, "authorized", false, false, undefined, undefined>>;

package/dist/schema/modules/view-access/functions/assign-views.js

@@ -1,17 +0,0 @@
-import { func } from '@astrale-os/sdk/schema';
-import { z } from 'zod';
-import { usesFunction } from '../../../policies/index.js';
-import { MAX_ASSIGNMENTS, viewAssignment } from '../types/index.js';
-/**
- * Give Views to identities and withdraw others, in one write. Each identity is a User or a Group;
- * a View already given, or already withdrawn, stays as it is. Whether an identity opens the
- * workspace is its `view-only` membership, which `Group.assignMember` changes.
- */
-export const assignViews = func({
-    description: 'Give and withdraw Views for each identity, in one write.',
-    auth: 'authorized',
-    input: z.strictObject({ assignments: z.array(viewAssignment).min(1).max(MAX_ASSIGNMENTS) }),
-    output: z.object({}),
-    // Holding can_use is enough: Core admin holds it, and may share it.
-    policy: ({ check, ref }) => check(usesFunction, ref(() => assignViews)),
-});

package/dist/schema/modules/view-access/functions/index.d.ts

@@ -1 +0,0 @@
-export { assignViews } from './assign-views.js';

package/dist/schema/modules/view-access/functions/index.js

@@ -1 +0,0 @@
-export { assignViews } from './assign-views.js';

package/dist/schema/modules/view-access/types/index.js

@@ -1 +0,0 @@
-export { viewAssignment, MAX_ASSIGNED_VIEWS, MAX_ASSIGNMENTS } from './view-assignment.js';

package/dist/schema/modules/view-access/types/view-assignment.js

@@ -1,16 +0,0 @@
-import { z } from 'zod';
-/**
- * Bounds that keep one call within the Kernel's Mutation limits: at most 1,600 Edge operations
- * and 1,640 locators, under 2,048 each.
- */
-export const MAX_ASSIGNED_VIEWS = 20;
-export const MAX_ASSIGNMENTS = 40;
-// A Path inside a list is not a callable Path input: each is an exact @NodeId the Action checks.
-const nodeId = z.string().min(2).max(512);
-const views = z.array(nodeId).max(MAX_ASSIGNED_VIEWS);
-/** The Views given to one User or Group (`set`) and withdrawn from it (`unset`), by @NodeId. */
-export const viewAssignment = z.strictObject({
-    identity: nodeId,
-    set: views.optional(),
-    unset: views.optional(),
-});

package/dist/schema/policies/administers-shell-class.js

@@ -1,11 +0,0 @@
-import { K, policy } from '@astrale-os/sdk/schema';
-import { Group, member_of_group, adminGroup } from '../modules/group/index.js';
-/** Instance administration applies to Shell's concrete classes, not foreign descendants. */
-export const administersShellClass = policy({
-    match: ({ exists, subject, object, ref, edge, allOf }) => exists(({ node }) => {
-        const concrete = node();
-        const owner = node(); // of_domain restricts this witness to a protected Domain endpoint.
-        const group = ref(() => Group);
-        return allOf(edge({ source: subject, class: () => member_of_group, target: ref(adminGroup) }), { source: ref(adminGroup), class: K.classes.instance_of.ref, target: group }, { source: group, class: K.classes.of_domain.ref, target: owner }, { source: concrete, class: K.classes.of_domain.ref, target: owner }, { source: object, class: K.classes.instance_of.ref, target: concrete });
-    }),
-});

package/dist/schema/policies/is-self.js

@@ -1,5 +0,0 @@
-import { policy } from '@astrale-os/sdk/schema';
-/** The subject is the object itself: an account acting on its own Node. */
-export const isSelf = policy({
-    match: ({ sameNode, subject, object }) => sameNode(subject, object),
-});

package/dist/schema/policies/owns-class.js

@@ -1,7 +0,0 @@
-import { K, policy } from '@astrale-os/sdk/schema';
-export const ownsClass = policy({
-    match: ({ exists, subject, object, allOf }) => exists(({ node }) => {
-        const concrete = node(); // Périmètre défini par les deux edges kernel protégés.
-        return allOf({ source: object, class: K.classes.instance_of.ref, target: concrete }, { source: concrete, class: K.classes.of_domain.ref, target: subject });
-    }),
-});

package/dist/schema/policies/uses-function.js

@@ -1,5 +0,0 @@
-import { K, policy } from '@astrale-os/sdk/schema';
-/** The subject may use the object Function: its own or a composed Identity holds can_use on it. */
-export const usesFunction = policy({
-    match: ({ edge, subject, object }) => edge({ source: subject, class: () => K.classes.can_use, target: object }),
-});