@astrale-domains/shell 0.1.6 → 0.1.8

package/dist/schema/modules/group/functions/unassign-members.js

@@ -0,0 +1,17 @@
+import { method } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+import { atomicRoles } from '../../role/index.js';
+import { hasRole } from '../../../policies/index.js';
+import { legacyMembershipOwnerAdmission } from '../legacy/index.js';
+import { groupMembersInput } from '../types/index.js';
+/** Withdraw several direct members from a group in one call (G2, G3 checked once). */
+export const unassignMembers = method({
+    static: true,
+    description: 'Withdraw several accounts or groups from a group.',
+    auth: 'authorized',
+    input: groupMembersInput,
+    output: z.object({}),
+    policy: (context) => context.anyOf(context.check(hasRole, context.ref(atomicRoles['group.writer'])), context.check(hasRole, context.ref(atomicRoles['directory.provisioner'])), 
+    // Seam L-SHELL-9: a Domain that extends Group manages the members of its own groups.
+    legacyMembershipOwnerAdmission(context, context.input.group)),
+});

package/dist/schema/modules/group/functions/update-group.js

@@ -0,0 +1,20 @@
+import { method } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+import { atomicRoles } from '../../role/index.js';
+import { hasRole } from '../../../policies/index.js';
+import { attributesInput } from '../../../types/index.js';
+import { groupDescription, groupIcon, groupName } from '../types/index.js';
+/** Rename this group, describe it, or change its icon or its attributes (G2, AM11). */
+export const update = method({
+    description: 'Rename this group, describe it, or change its icon or its attributes.',
+    auth: 'authorized',
+    input: z.strictObject({
+        name: groupName.optional(),
+        description: groupDescription.nullable().optional(),
+        icon: groupIcon.optional(),
+        // Replaces them all; `null` erases them (AM11).
+        attributes: attributesInput.nullable().optional(),
+    }),
+    output: z.object({}),
+    policy: ({ check, ref }) => check(hasRole, ref(atomicRoles['group.writer'])),
+});

package/dist/schema/modules/group/index.d.ts

@@ -1,3 +1,3 @@
-export { Group, member_of_group } from './classes/index.js';
-export { adminGroup, applicationsGroup, memberGroup } from './core/index.js';
-export { belongsToGroup } from './policies/index.js';
+export { Group, GroupProfile, group_profile } from './classes/index.js';
+export { describesGroupOfSubject, isGroupProfileSource } from './policies/index.js';
+export { legacyAdministratorsGroup, legacyMemberOfGroup, legacyMembersGroup, } from './legacy/index.js';

package/dist/schema/modules/group/index.js

@@ -1,3 +1,4 @@
-export { Group, member_of_group } from './classes/index.js';
-export { adminGroup, applicationsGroup, memberGroup } from './core/index.js';
-export { belongsToGroup } from './policies/index.js';
+export { Group, GroupProfile, group_profile } from './classes/index.js';
+export { describesGroupOfSubject, isGroupProfileSource } from './policies/index.js';
+// Seam L-SHELL-16: the package root's former names, reached through this module's facade.
+export { legacyAdministratorsGroup, legacyMemberOfGroup, legacyMembersGroup, } from './legacy/index.js';

package/dist/schema/modules/group/legacy/admission.d.ts

@@ -0,0 +1,9 @@
+import type { CallablePolicyContext } from '@astrale-os/sdk/schema';
+type PolicyObject = CallablePolicyContext['input'][string];
+/**
+ * @deprecated The owner of a Group subclass changes the members of its own groups (L-SHELL-9).
+ * Replaced by `group.writer`, or by the Domain's own Identity and Roles (P5, P6). Removal: Shell
+ * major (delivery step 5) after 1Pact step 4.
+ */
+export declare function legacyMembershipOwnerAdmission(context: CallablePolicyContext, group: PolicyObject): import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").PolicyCheckObject>;
+export {};

package/dist/schema/modules/group/legacy/admission.js

@@ -0,0 +1,9 @@
+import { legacyOwnsClass } from '../../../policies/legacy/index.js';
+/**
+ * @deprecated The owner of a Group subclass changes the members of its own groups (L-SHELL-9).
+ * Replaced by `group.writer`, or by the Domain's own Identity and Roles (P5, P6). Removal: Shell
+ * major (delivery step 5) after 1Pact step 4.
+ */
+export function legacyMembershipOwnerAdmission(context, group) {
+    return context.check(legacyOwnsClass, group);
+}

package/dist/schema/modules/group/legacy/classes/index.d.ts

@@ -0,0 +1 @@
+export { legacyMemberOfGroup } from './member-of-group.js';

package/dist/schema/modules/group/legacy/classes/index.js

@@ -0,0 +1 @@
+export { legacyMemberOfGroup } from './member-of-group.js';

package/dist/schema/modules/group/{classes → legacy/classes}/member-of-group.d.ts

@@ -1,4 +1,13 @@
-export declare const member_of_group: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+/**
+ * @deprecated The direct membership fact legacy readers check beside Kernel `extends_with`
+ * (L-SHELL-8). Replaced by `extends_with`, the only composition. Removal: Shell major (delivery
+ * step 5) after 1Pact step 4.
+ *
+ * Shell writes it; the owner of a foreign Group subclass writes it too, under its own authority,
+ * when Shell acts for it (AM5). Each end detaches with its Node, so deleting an account or a group
+ * takes its legacy memberships with it.
+ */
+export declare const legacyMemberOfGroup: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
     readonly depth: 0;
     readonly abstract: false;
     readonly extends: readonly [];

package/dist/schema/modules/group/legacy/classes/member-of-group.js

@@ -0,0 +1,32 @@
+import { edgeClass } from '@astrale-os/sdk/schema';
+import { User } from '../../../user/index.js';
+import { Group } from '../../classes/group.js';
+import { legacyOwnsMembershipGroup } from '../policies/owns-membership-group.js';
+/**
+ * @deprecated The direct membership fact legacy readers check beside Kernel `extends_with`
+ * (L-SHELL-8). Replaced by `extends_with`, the only composition. Removal: Shell major (delivery
+ * step 5) after 1Pact step 4.
+ *
+ * Shell writes it; the owner of a foreign Group subclass writes it too, under its own authority,
+ * when Shell acts for it (AM5). Each end detaches with its Node, so deleting an account or a group
+ * takes its legacy memberships with it.
+ */
+export const legacyMemberOfGroup = edgeClass.directed({
+    policies: {
+        read: true,
+        create: () => legacyOwnsMembershipGroup,
+        delete: () => legacyOwnsMembershipGroup,
+    },
+    source: {
+        as: 'member',
+        accepts: [() => User, () => Group],
+        outgoing: '0..*',
+        onDelete: 'detach',
+    },
+    target: {
+        as: 'group',
+        accepts: [() => Group],
+        incoming: '0..*',
+        onDelete: 'detach',
+    },
+});

package/dist/schema/modules/group/legacy/core-groups.d.ts

@@ -0,0 +1,22 @@
+/**
+ * @deprecated Core group `admin` "Administrators" (L-SHELL-7); its Core key and properties stay so
+ * stored members keep it, and the release makes it a member of `workspace.admin` (AM3). Replaced by
+ * `S.core.nodes['workspace.admin']`. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export declare const legacyAdministratorsGroup: import("@astrale-os/sdk/schema").CoreNode;
+/**
+ * @deprecated Core group `member` "Members" (L-SHELL-7), member of `workspace.member` (AM3). Replaced
+ * by `S.core.nodes['workspace.member']`. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export declare const legacyMembersGroup: import("@astrale-os/sdk/schema").CoreNode;
+/**
+ * @deprecated Core group `applications` (L-SHELL-7), member of Kernel `reader` (AM3) and admitted by
+ * `listEntrypoints`. Replaced by the Roles each Domain's release grants. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export declare const legacyApplicationsGroup: import("@astrale-os/sdk/schema").CoreNode;
+/**
+ * @deprecated Core group `view-only` (L-SHELL-7), member of Kernel `reader` (AM3); its non-admin
+ * members keep landing on their Views only. Replaced by Kernel `reader` held directly and
+ * `view_access`. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export declare const legacyViewOnlyGroup: import("@astrale-os/sdk/schema").CoreNode;

package/dist/schema/modules/group/legacy/core-groups.js

@@ -0,0 +1,28 @@
+import { K, core } from '@astrale-os/sdk/schema';
+import { Group } from '../classes/group.js';
+const group = (name, description) => core.node(() => Group, {
+    [K.classes.Named.properties.name.key]: name,
+    [K.classes.Descriptable.properties.description.key]: description,
+});
+/**
+ * @deprecated Core group `admin` "Administrators" (L-SHELL-7); its Core key and properties stay so
+ * stored members keep it, and the release makes it a member of `workspace.admin` (AM3). Replaced by
+ * `S.core.nodes['workspace.admin']`. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export const legacyAdministratorsGroup = group('Administrators', 'Instance administrators.');
+/**
+ * @deprecated Core group `member` "Members" (L-SHELL-7), member of `workspace.member` (AM3). Replaced
+ * by `S.core.nodes['workspace.member']`. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export const legacyMembersGroup = group('Members', 'Instance members.');
+/**
+ * @deprecated Core group `applications` (L-SHELL-7), member of Kernel `reader` (AM3) and admitted by
+ * `listEntrypoints`. Replaced by the Roles each Domain's release grants. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export const legacyApplicationsGroup = group('Applications', 'May list the installed applications they can open.');
+/**
+ * @deprecated Core group `view-only` (L-SHELL-7), member of Kernel `reader` (AM3); its non-admin
+ * members keep landing on their Views only. Replaced by Kernel `reader` held directly and
+ * `view_access`. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export const legacyViewOnlyGroup = group('View only', 'Open only the Views given to them, never the workspace.');

package/dist/schema/modules/group/legacy/index.d.ts

@@ -0,0 +1,5 @@
+export { LEGACY_GROUP_EXTENDS, LEGACY_GROUP_INHERITANCE, LEGACY_GROUP_READ } from './relaxations.js';
+export { legacyMembershipOwnerAdmission } from './admission.js';
+export { legacyAdministratorsGroup, legacyApplicationsGroup, legacyMembersGroup, legacyViewOnlyGroup, } from './core-groups.js';
+export { legacyMemberOfGroup } from './classes/index.js';
+export { legacyBelongsToGroup, legacyOwnsMembershipGroup } from './policies/index.js';

package/dist/schema/modules/group/legacy/index.js

@@ -0,0 +1,6 @@
+// Relaxations first: Group reads them while the rest of this folder may still be loading.
+export { LEGACY_GROUP_EXTENDS, LEGACY_GROUP_INHERITANCE, LEGACY_GROUP_READ } from './relaxations.js';
+export { legacyMembershipOwnerAdmission } from './admission.js';
+export { legacyAdministratorsGroup, legacyApplicationsGroup, legacyMembersGroup, legacyViewOnlyGroup, } from './core-groups.js';
+export { legacyMemberOfGroup } from './classes/index.js';
+export { legacyBelongsToGroup, legacyOwnsMembershipGroup } from './policies/index.js';

package/dist/schema/modules/group/legacy/policies/belongs-to-group.d.ts

@@ -0,0 +1,5 @@
+/**
+ * @deprecated The subject is a direct legacy member of the object group (L-SHELL-10). Replaced by
+ * `check(hasRole, …)` on a Role. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export declare const legacyBelongsToGroup: import("@astrale-os/sdk/schema").Policy;

package/dist/schema/modules/group/legacy/policies/belongs-to-group.js

@@ -0,0 +1,9 @@
+import { policy } from '@astrale-os/sdk/schema';
+import { legacyMemberOfGroup } from '../classes/member-of-group.js';
+/**
+ * @deprecated The subject is a direct legacy member of the object group (L-SHELL-10). Replaced by
+ * `check(hasRole, …)` on a Role. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export const legacyBelongsToGroup = policy({
+    match: ({ edge, subject, object }) => edge({ source: subject, class: () => legacyMemberOfGroup, target: object }),
+});

package/dist/schema/modules/group/legacy/policies/index.d.ts

@@ -0,0 +1,2 @@
+export { legacyBelongsToGroup } from './belongs-to-group.js';
+export { legacyOwnsMembershipGroup } from './owns-membership-group.js';

package/dist/schema/modules/group/legacy/policies/index.js

@@ -0,0 +1,2 @@
+export { legacyBelongsToGroup } from './belongs-to-group.js';
+export { legacyOwnsMembershipGroup } from './owns-membership-group.js';

package/dist/schema/modules/group/legacy/policies/owns-membership-group.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @deprecated The subject owns the concrete Class of a legacy membership's group: the Domain that
+ * extends Group writes `member_of_group` into its own groups, under AM5 (L-SHELL-9). Replaced by
+ * `extends_with` alone. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export declare const legacyOwnsMembershipGroup: import("@astrale-os/sdk/schema").Policy;

package/dist/schema/modules/group/legacy/policies/owns-membership-group.js

@@ -0,0 +1,12 @@
+import { K, policy } from '@astrale-os/sdk/schema';
+/**
+ * @deprecated The subject owns the concrete Class of a legacy membership's group: the Domain that
+ * extends Group writes `member_of_group` into its own groups, under AM5 (L-SHELL-9). Replaced by
+ * `extends_with` alone. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export const legacyOwnsMembershipGroup = policy({
+    match: ({ exists, subject, target, allOf }) => exists(({ node }) => {
+        const concrete = node();
+        return allOf({ source: target, class: K.classes.instance_of.ref, target: concrete }, { source: concrete, class: K.classes.of_domain.ref, target: subject });
+    }),
+});

package/dist/schema/modules/group/legacy/relaxations.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @deprecated Domains still extend Group (L-SHELL-1). Replaced by `'final'`. Removal: Shell major
+ * (delivery step 5) after 1Pact step 4.
+ */
+export declare const LEGACY_GROUP_INHERITANCE: 'open';
+/**
+ * @deprecated Group omits Kernel Timestamped while stored groups lack its required `createdAt` and
+ * `updatedAt`, which the Kernel refuses to add over existing data (DATA_MIGRATION_REQUIRED)
+ * (L-SHELL-2). Replaced by `[K.classes.Identity, K.classes.Named, K.classes.Descriptable,
+ * K.classes.Iconable, K.classes.Timestamped]`. Removal: Shell major (delivery step 5) after 1Pact
+ * step 4, in the Kernel repair session that writes those values.
+ */
+export declare const LEGACY_GROUP_EXTENDS: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">, import("@astrale-os/sdk/schema").KernelClass<"Iconable">];
+/**
+ * @deprecated Group keeps the read rule and the absence of unique constraints of the Shell that
+ * released Domains embed (L-SHELL-19), as User does. A directory group stays unique through the
+ * lookup of `Group.provision`. Replaced by `read: anyOf(group.reader, self)` and
+ * `unique: [['directory', 'externalId']]`. Removal: Shell major (delivery step 5), once immogrc,
+ * 1Pact and organization are rebuilt against this Shell.
+ */
+export declare const LEGACY_GROUP_READ: true;

package/dist/schema/modules/group/legacy/relaxations.js

@@ -0,0 +1,27 @@
+import { K } from '@astrale-os/sdk/schema';
+/**
+ * @deprecated Domains still extend Group (L-SHELL-1). Replaced by `'final'`. Removal: Shell major
+ * (delivery step 5) after 1Pact step 4.
+ */
+export const LEGACY_GROUP_INHERITANCE = 'open';
+/**
+ * @deprecated Group omits Kernel Timestamped while stored groups lack its required `createdAt` and
+ * `updatedAt`, which the Kernel refuses to add over existing data (DATA_MIGRATION_REQUIRED)
+ * (L-SHELL-2). Replaced by `[K.classes.Identity, K.classes.Named, K.classes.Descriptable,
+ * K.classes.Iconable, K.classes.Timestamped]`. Removal: Shell major (delivery step 5) after 1Pact
+ * step 4, in the Kernel repair session that writes those values.
+ */
+export const LEGACY_GROUP_EXTENDS = [
+    K.classes.Identity,
+    K.classes.Named,
+    K.classes.Descriptable,
+    K.classes.Iconable,
+];
+/**
+ * @deprecated Group keeps the read rule and the absence of unique constraints of the Shell that
+ * released Domains embed (L-SHELL-19), as User does. A directory group stays unique through the
+ * lookup of `Group.provision`. Replaced by `read: anyOf(group.reader, self)` and
+ * `unique: [['directory', 'externalId']]`. Removal: Shell major (delivery step 5), once immogrc,
+ * 1Pact and organization are rebuilt against this Shell.
+ */
+export const LEGACY_GROUP_READ = true;

package/dist/schema/modules/group/policies/describes-group-of-subject.d.ts

@@ -0,0 +1,2 @@
+/** The subject is the group this profile describes, or one of its members (its composition). */
+export declare const describesGroupOfSubject: import("@astrale-os/sdk/schema").Policy;

package/dist/schema/modules/group/policies/describes-group-of-subject.js

@@ -0,0 +1,7 @@
+import { policy } from '@astrale-os/sdk/schema';
+import { group_profile } from '../classes/group-profile-link.js';
+/** The subject is the group this profile describes, or one of its members (its composition). */
+export const describesGroupOfSubject = policy({
+    description: 'The caller is the group this profile describes, or a member of it.',
+    match: ({ edge, object, subject }) => edge({ source: subject, class: group_profile, target: object }),
+});

package/dist/schema/modules/group/policies/index.d.ts

@@ -1 +1,2 @@
-export { belongsToGroup } from './belongs-to-group.js';
+export { describesGroupOfSubject } from './describes-group-of-subject.js';
+export { isGroupProfileSource } from './is-group-profile-source.js';

package/dist/schema/modules/group/policies/index.js

@@ -1 +1,2 @@
-export { belongsToGroup } from './belongs-to-group.js';
+export { describesGroupOfSubject } from './describes-group-of-subject.js';
+export { isGroupProfileSource } from './is-group-profile-source.js';

package/dist/schema/modules/group/policies/is-group-profile-source.d.ts

@@ -0,0 +1,2 @@
+/** The subject is the group at the source of this Edge, or one of its members. */
+export declare const isGroupProfileSource: import("@astrale-os/sdk/schema").Policy;

package/dist/schema/modules/group/policies/is-group-profile-source.js

@@ -0,0 +1,6 @@
+import { policy } from '@astrale-os/sdk/schema';
+/** The subject is the group at the source of this Edge, or one of its members. */
+export const isGroupProfileSource = policy({
+    description: 'The caller is the group this Edge leaves, or a member of it.',
+    match: ({ sameNode, subject, source }) => sameNode(subject, source),
+});

package/dist/schema/modules/group/types/group-membership-input.js

@@ -6,3 +6,11 @@ export const groupMembershipInput = z.object({
     member: path(() => User, () => Group),
     group: path(() => Group),
 });
+/**
+ * Several accounts or groups to add to or withdraw from one group, in one call. A Path is not
+ * allowed inside a list, so each member is an exact @NodeId the Action checks.
+ */
+export const groupMembersInput = z.object({
+    members: z.array(z.string().min(2).max(512)).min(1).max(100),
+    group: path(() => Group),
+});

package/dist/schema/modules/group/types/group.js

@@ -0,0 +1,10 @@
+import { z } from 'zod';
+/** A group's name and description, as Kernel Named and Descriptable bound them. */
+export const groupName = z.string().min(1).max(100);
+export const groupDescription = z.string().min(1).max(2_000);
+/** A Kernel Iconable icon; `null` removes it. */
+export const groupIcon = z.string().min(1).max(8_000).nullable();
+export const directoryId = z.string().min(1).max(200);
+export const externalId = z.string().min(1).max(200);
+/** A Node as a method returns it: its canonical `@<NodeId>` path. */
+export const nodeReference = z.string().min(2).max(512);

package/dist/schema/modules/group/types/index.js

@@ -1 +1,2 @@
-export { groupMembershipInput } from './group-membership-input.js';
+export { groupMembersInput, groupMembershipInput } from './group-membership-input.js';
+export { directoryId, externalId, groupDescription, groupIcon, groupName, nodeReference, } from './group.js';

package/dist/schema/modules/invitation/classes/index.js

@@ -0,0 +1,2 @@
+export { Invitation } from './invitation.js';
+export { invitation_user } from './invitation-user.js';

package/dist/schema/modules/invitation/classes/invitation-user.js

@@ -0,0 +1,17 @@
+import { edgeClass } from '@astrale-os/sdk/schema';
+import { atomicRoles } from '../../role/index.js';
+import { User } from '../../user/index.js';
+import { hasRole } from '../../../policies/index.js';
+import { Invitation } from './invitation.js';
+/** The account an invitation is for. */
+export const invitation_user = edgeClass.directed({
+    inheritance: 'final',
+    abstract: false,
+    description: 'The account this invitation is for.',
+    source: { as: 'invitation', accepts: [Invitation], outgoing: '0..1', onDelete: 'detach' },
+    target: { as: 'user', accepts: [User], incoming: '0..*', onDelete: 'detach' },
+    policies: {
+        read: ({ check, ref }) => check(hasRole, ref(atomicRoles['user.writer'])),
+        traverse: true,
+    },
+});

package/dist/schema/modules/invitation/classes/invitation.js

@@ -0,0 +1,32 @@
+import { classIcon, nodeClass, property } from '@astrale-os/sdk/schema';
+import { Mail } from '@astrale-os/sdk/schema/icons';
+import { atomicRoles } from '../../role/index.js';
+import { hasRole } from '../../../policies/index.js';
+import { accept, cancel, resend, send } from '../functions/index.js';
+import { INVITATION_STATUSES } from '../types/index.js';
+/**
+ * One invitation of an account, kept by the durable run of `Invitation.send` that it names. An
+ * account has at most one pending invitation. Only Shell writes it; `user.writer` reads it, so the pending
+ * invitations are one Query on `status`.
+ */
+export const Invitation = nodeClass({
+    icon: classIcon.lucide(Mail),
+    inheritance: 'final',
+    abstract: false,
+    description: 'One invitation of an account, until it is accepted, cancelled or expired.',
+    properties: {
+        status: property({ type: 'string', enum: [...INVITATION_STATUSES] }),
+        // ISO 8601 instant the invitation expires at.
+        expiresAt: property({ type: 'string', minLength: 20, maxLength: 40 }),
+        // The durable run that keeps it, and the number of events it has received (resends).
+        execution: property({ type: 'string', minLength: 1, maxLength: 200 }),
+        round: property({ type: 'integer', minimum: 0 }),
+        // The email it was sent to, in lower case: a new invitation to the same email resends this one.
+        email: property({ type: 'string', minLength: 3, maxLength: 320 }, { required: false }),
+    },
+    policies: {
+        read: ({ check, ref }) => check(hasRole, ref(atomicRoles['user.writer'])),
+        traverse: true,
+    },
+    methods: { send, resend, cancel, accept },
+});

package/dist/schema/modules/invitation/functions/accept.js

@@ -0,0 +1,16 @@
+import { method } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+import { atomicRoles } from '../../role/index.js';
+import { hasRole } from '../../../policies/index.js';
+/**
+ * The invited person signed in for the first time, with the email the invitation was sent to: the
+ * run binds the account to that sign-in (`iss`, `sub`) and accepts the invitation. Admin calls it
+ * once it checked the provider's verified email.
+ */
+export const accept = method({
+    description: 'Accept a pending invitation at the first sign-in.',
+    auth: 'authorized',
+    input: z.strictObject({ iss: z.string().min(1).max(512), sub: z.string().min(1).max(512) }),
+    output: z.object({}),
+    policy: ({ check, ref }) => check(hasRole, ref(atomicRoles['user.writer'])),
+});

package/dist/schema/modules/invitation/functions/cancel.js

@@ -0,0 +1,12 @@
+import { method } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+import { atomicRoles } from '../../role/index.js';
+import { hasRole } from '../../../policies/index.js';
+/** Cancel a pending invitation. */
+export const cancel = method({
+    description: 'Cancel a pending invitation.',
+    auth: 'authorized',
+    input: z.strictObject({}),
+    output: z.object({}),
+    policy: ({ check, ref }) => check(hasRole, ref(atomicRoles['user.writer'])),
+});

package/dist/schema/modules/invitation/functions/index.js

@@ -0,0 +1,4 @@
+export { accept } from './accept.js';
+export { cancel } from './cancel.js';
+export { resend } from './resend.js';
+export { send } from './send.js';

package/dist/schema/modules/invitation/functions/resend.js

@@ -0,0 +1,12 @@
+import { method } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+import { atomicRoles } from '../../role/index.js';
+import { hasRole } from '../../../policies/index.js';
+/** Send the email of a pending invitation again: same invitation, same link, same run. */
+export const resend = method({
+    description: 'Send the email of a pending invitation again.',
+    auth: 'authorized',
+    input: z.strictObject({}),
+    output: z.object({}),
+    policy: ({ check, ref }) => check(hasRole, ref(atomicRoles['user.writer'])),
+});

package/dist/schema/modules/invitation/functions/send.js

@@ -0,0 +1,20 @@
+import { method, path } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+import { atomicRoles } from '../../role/index.js';
+import { User } from '../../user/index.js';
+import { hasRole } from '../../../policies/index.js';
+import { invitationStatus } from '../types/index.js';
+/**
+ * Invite an account: a durable run that records the invitation, has Admin send the email, then
+ * waits for the first sign-in, a resend, a cancel or the expiry. It grants nothing. The caller
+ * follows the run; the invitation reads at once by its account.
+ */
+export const send = method({
+    static: true,
+    description: 'Invite an account and follow the invitation until it ends.',
+    auth: 'authorized',
+    execution: { durable: true },
+    input: z.strictObject({ user: path(() => User) }),
+    output: z.object({ status: invitationStatus }),
+    policy: ({ check, ref }) => check(hasRole, ref(atomicRoles['user.writer'])),
+});

package/dist/schema/modules/invitation/index.js

@@ -0,0 +1,2 @@
+export { Invitation, invitation_user } from './classes/index.js';
+export { INVITATION_STATUSES, invitationStatus } from './types/index.js';

package/dist/schema/modules/invitation/types/index.js

@@ -0,0 +1 @@
+export { INVITATION_STATUSES, invitationStatus } from './invitation-status.js';

package/dist/schema/modules/invitation/types/invitation-status.js

@@ -0,0 +1,5 @@
+import { z } from 'zod';
+/** The states of an invitation. */
+export const INVITATION_STATUSES = ['pending', 'accepted', 'cancelled', 'expired'];
+/** One state of an invitation. */
+export const invitationStatus = z.enum(INVITATION_STATUSES);

package/dist/schema/modules/namespace/classes/alias.d.ts

@@ -1,7 +1,8 @@
 /**
  * One name in a Namespace: the Edge slug is the name, the target any Node. The Kernel key keeps a
  * name to one Node for every author; Edge identity keeps a Node to one alias per Namespace. The
- * target accepts a Class Shell does not own, so the alias detaches with its Node.
+ * target accepts a Class Shell does not own, so the alias detaches with its Node. An admin names
+ * Nodes through the Namespace methods or a Mutation of its own.
  */
 export declare const alias: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
     readonly depth: 0;

package/dist/schema/modules/namespace/classes/alias.js

@@ -1,12 +1,21 @@
 import { K, edgeClass } from '@astrale-os/sdk/schema';
+import { profileRoles } from '../../role/index.js';
+import { hasRole } from '../../../policies/index.js';
 import { Namespace } from './namespace.js';
 /**
  * One name in a Namespace: the Edge slug is the name, the target any Node. The Kernel key keeps a
  * name to one Node for every author; Edge identity keeps a Node to one alias per Namespace. The
- * target accepts a Class Shell does not own, so the alias detaches with its Node.
+ * target accepts a Class Shell does not own, so the alias detaches with its Node. An admin names
+ * Nodes through the Namespace methods or a Mutation of its own.
  */
 export const alias = edgeClass.directed({
-    policies: { read: true, traverse: true },
+    policies: {
+        read: true,
+        traverse: true,
+        create: ({ check, ref }) => check(hasRole, ref(profileRoles['workspace.admin'])),
+        update: ({ check, ref }) => check(hasRole, ref(profileRoles['workspace.admin'])),
+        delete: ({ check, ref }) => check(hasRole, ref(profileRoles['workspace.admin'])),
+    },
     source: { as: 'namespace', accepts: [() => Namespace], outgoing: '0..*' },
     target: { as: 'node', accepts: [K.classes.Node], incoming: '0..*' },
     unique: [['source', 'slug']],

package/dist/schema/modules/namespace/functions/link.js

@@ -1,11 +1,12 @@
 import { K, method, path } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
-import { ownsClass, administersShellClass } from '../../../policies/index.js';
+import { profileRoles } from '../../role/index.js';
+import { hasRole } from '../../../policies/index.js';
 import { namespaceName } from '../types/index.js';
 export const link = method({
     description: 'Give one Node an alias in this Namespace.',
     auth: 'authorized',
     input: z.strictObject({ name: namespaceName, target: path(K.classes.Node) }),
     output: z.object({}),
-    policy: ({ anyOf, check, self }) => anyOf(check(administersShellClass, self), check(ownsClass, self)),
+    policy: ({ check, ref }) => check(hasRole, ref(profileRoles['workspace.admin'])),
 });

package/dist/schema/modules/namespace/functions/rename.js

@@ -1,11 +1,12 @@
 import { method } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
-import { ownsClass, administersShellClass } from '../../../policies/index.js';
+import { profileRoles } from '../../role/index.js';
+import { hasRole } from '../../../policies/index.js';
 import { namespaceName } from '../types/index.js';
 export const rename = method({
     description: 'Rename one alias of this Namespace; the Node it names stays the same.',
     auth: 'authorized',
     input: z.strictObject({ name: namespaceName, to: namespaceName }),
     output: z.object({}),
-    policy: ({ anyOf, check, self }) => anyOf(check(administersShellClass, self), check(ownsClass, self)),
+    policy: ({ check, ref }) => check(hasRole, ref(profileRoles['workspace.admin'])),
 });

package/dist/schema/modules/namespace/functions/unlink.js

@@ -1,11 +1,12 @@
 import { method } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
-import { ownsClass, administersShellClass } from '../../../policies/index.js';
+import { profileRoles } from '../../role/index.js';
+import { hasRole } from '../../../policies/index.js';
 import { namespaceName } from '../types/index.js';
 export const unlink = method({
     description: 'Remove one alias from this Namespace.',
     auth: 'authorized',
     input: z.strictObject({ name: namespaceName }),
     output: z.object({}),
-    policy: ({ anyOf, check, self }) => anyOf(check(administersShellClass, self), check(ownsClass, self)),
+    policy: ({ check, ref }) => check(hasRole, ref(profileRoles['workspace.admin'])),
 });

package/dist/schema/modules/role/classes/index.d.ts

@@ -0,0 +1 @@
+export { Role } from './role.js';

package/dist/schema/modules/role/classes/index.js

@@ -0,0 +1 @@
+export { Role } from './role.js';