@astrale-domains/shell 0.1.6 → 0.1.8

package/dist/schema/modules/role/classes/role.d.ts

@@ -0,0 +1,16 @@
+/**
+ * A Role the Shell declares: its members hold what it holds, at any depth (Kernel `extends_with`).
+ * Owning this final Class gives Shell the grant and withdrawal of its Roles; a Role reads by Kernel
+ * `authority.reader` and by its holders (R7), and any Path walks through it.
+ */
+export declare const Role: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+    readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+    readonly inheritance: "final";
+    readonly abstract: false;
+    readonly description: "A Role the Shell declares.";
+    readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Role">];
+    readonly policies: {
+        readonly read: ({ anyOf, check, ref, self }: import("@astrale-os/sdk/schema").ClassRuleContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").ClassRuleObject>;
+        readonly traverse: true;
+    };
+}>;

package/dist/schema/modules/role/classes/role.js

@@ -0,0 +1,19 @@
+import { K, classIcon, nodeClass } from '@astrale-os/sdk/schema';
+import { ShieldCheck } from '@astrale-os/sdk/schema/icons';
+import { hasRole } from '../../../policies/index.js';
+/**
+ * A Role the Shell declares: its members hold what it holds, at any depth (Kernel `extends_with`).
+ * Owning this final Class gives Shell the grant and withdrawal of its Roles; a Role reads by Kernel
+ * `authority.reader` and by its holders (R7), and any Path walks through it.
+ */
+export const Role = nodeClass({
+    icon: classIcon.lucide(ShieldCheck),
+    inheritance: 'final',
+    abstract: false,
+    description: 'A Role the Shell declares.',
+    extends: [K.classes.Role],
+    policies: {
+        read: ({ anyOf, check, ref, self }) => anyOf(check(hasRole, ref(K.core.nodes['authority.reader'].ref)), check(hasRole, self)),
+        traverse: true,
+    },
+});

package/dist/schema/modules/role/core/index.d.ts

@@ -0,0 +1 @@
+export { atomicRoles, profileRoles, shellRoles, PROFILE_NAMES, type ProfileName } from './roles.js';

package/dist/schema/modules/role/core/index.js

@@ -0,0 +1 @@
+export { atomicRoles, profileRoles, shellRoles, PROFILE_NAMES } from './roles.js';

package/dist/schema/modules/role/core/roles.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The two profiles a person is given. Their Core keys carry `workspace.` because the keys `admin` and
+ * `member` already name the legacy Administrators and Members groups, and the Kernel recreates a
+ * Core Node whose Class changes (AM3). Their bundle, member ⊂ admin, is a release binding (AM1): see
+ * `domain.ts`. There is no guest profile (AM10): whoever only opens the Views it is given holds
+ * Kernel `reader` and its `view_access`.
+ */
+export declare const profileRoles: {
+    readonly 'workspace.member': import("@astrale-os/sdk/schema").CoreNode;
+    readonly 'workspace.admin': import("@astrale-os/sdk/schema").CoreNode;
+};
+/** The atomic Shell Roles: what a Domain asks for in its release. */
+export declare const atomicRoles: {
+    readonly 'user.reader': import("@astrale-os/sdk/schema").CoreNode;
+    readonly 'user.writer': import("@astrale-os/sdk/schema").CoreNode;
+    readonly 'group.reader': import("@astrale-os/sdk/schema").CoreNode;
+    readonly 'group.writer': import("@astrale-os/sdk/schema").CoreNode;
+    readonly 'directory.provisioner': import("@astrale-os/sdk/schema").CoreNode;
+    readonly 'user-profile.reader': import("@astrale-os/sdk/schema").CoreNode;
+    readonly 'user-profile.self-writer': import("@astrale-os/sdk/schema").CoreNode;
+    readonly 'group-profile.reader': import("@astrale-os/sdk/schema").CoreNode;
+    readonly 'os.viewer': import("@astrale-os/sdk/schema").CoreNode;
+};
+export declare const shellRoles: {
+    readonly 'workspace.member': import("@astrale-os/sdk/schema").CoreNode;
+    readonly 'workspace.admin': import("@astrale-os/sdk/schema").CoreNode;
+    readonly 'user.reader': import("@astrale-os/sdk/schema").CoreNode;
+    readonly 'user.writer': import("@astrale-os/sdk/schema").CoreNode;
+    readonly 'group.reader': import("@astrale-os/sdk/schema").CoreNode;
+    readonly 'group.writer': import("@astrale-os/sdk/schema").CoreNode;
+    readonly 'directory.provisioner': import("@astrale-os/sdk/schema").CoreNode;
+    readonly 'user-profile.reader': import("@astrale-os/sdk/schema").CoreNode;
+    readonly 'user-profile.self-writer': import("@astrale-os/sdk/schema").CoreNode;
+    readonly 'group-profile.reader': import("@astrale-os/sdk/schema").CoreNode;
+    readonly 'os.viewer': import("@astrale-os/sdk/schema").CoreNode;
+};
+/** The profile a person is given, by its name. */
+export type ProfileName = 'member' | 'admin';
+export declare const PROFILE_NAMES: readonly ["member", "admin"];

package/dist/schema/modules/role/core/roles.js

@@ -0,0 +1,31 @@
+import { K, core } from '@astrale-os/sdk/schema';
+import { Role } from '../classes/role.js';
+const role = (name, description) => core.node(() => Role, {
+    [K.classes.Named.properties.name.key]: name,
+    [K.classes.Descriptable.properties.description.key]: description,
+});
+/**
+ * The two profiles a person is given. Their Core keys carry `workspace.` because the keys `admin` and
+ * `member` already name the legacy Administrators and Members groups, and the Kernel recreates a
+ * Core Node whose Class changes (AM3). Their bundle, member ⊂ admin, is a release binding (AM1): see
+ * `domain.ts`. There is no guest profile (AM10): whoever only opens the Views it is given holds
+ * Kernel `reader` and its `view_access`.
+ */
+export const profileRoles = {
+    'workspace.member': role('member', 'Opens the workspace and sees accounts and groups.'),
+    'workspace.admin': role('admin', 'A member that manages accounts, groups, roles and Domains.'),
+};
+/** The atomic Shell Roles: what a Domain asks for in its release. */
+export const atomicRoles = {
+    'user.reader': role('user.reader', 'May read every account.'),
+    'user.writer': role('user.writer', 'May create, invite, update, deactivate and delete accounts.'),
+    'group.reader': role('group.reader', 'May read every group.'),
+    'group.writer': role('group.writer', 'May create, update and delete groups and change their members.'),
+    'directory.provisioner': role('directory.provisioner', 'May write what a directory provides.'),
+    'user-profile.reader': role('user-profile.reader', 'May read the name, email and image of every person.'),
+    'user-profile.self-writer': role('user-profile.self-writer', 'May change its own name and image, never its email.'),
+    'group-profile.reader': role('group-profile.reader', 'May read the name, description and image of every group.'),
+    'os.viewer': role('os.viewer', 'Opens the OS view and lists its applications.'),
+};
+export const shellRoles = { ...profileRoles, ...atomicRoles };
+export const PROFILE_NAMES = ['member', 'admin'];

package/dist/schema/modules/role/index.d.ts

@@ -0,0 +1,2 @@
+export { Role } from './classes/index.js';
+export { atomicRoles, profileRoles, shellRoles, PROFILE_NAMES, type ProfileName, } from './core/index.js';

package/dist/schema/modules/role/index.js

@@ -0,0 +1,2 @@
+export { Role } from './classes/index.js';
+export { atomicRoles, profileRoles, shellRoles, PROFILE_NAMES, } from './core/index.js';

package/dist/schema/modules/user/classes/index.d.ts

@@ -1 +1,3 @@
 export { User } from './user.js';
+export { user_profile } from './user-profile-link.js';
+export { UserProfile } from './user-profile.js';

package/dist/schema/modules/user/classes/index.js

@@ -1 +1,4 @@
 export { User } from './user.js';
+// The link first: it loads the profile, whose read rule names a policy over the link.
+export { user_profile } from './user-profile-link.js';
+export { UserProfile } from './user-profile.js';

package/dist/schema/modules/user/classes/user-profile-link.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The profile of one account, one each way. `0..1` on both ends: the Kernel refuses `detach` on a
+ * required end, and accounts stored before profiles lack theirs (`legacyMigrateAccounts` creates
+ * them). Shell writes and deletes both together.
+ */
+export declare const user_profile: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+    readonly depth: 0;
+    readonly abstract: false;
+    readonly extends: readonly [];
+    readonly properties: never;
+    readonly source: {
+        readonly as: "user";
+        readonly accepts: readonly {
+            readonly kind: 'node';
+            readonly abstract: false;
+            readonly depth: 1;
+            readonly properties: "attributes" | "claimedEmail" | "claimedName" | "creationKey" | "directory" | "directoryActive" | "email" | "externalId" | "familyName" | "frozen" | "givenName" | "icon" | "iss" | "name" | "sub" | "suspended";
+            readonly methods: "create" | "deactivate" | "delete" | "deprovision" | "invite" | "provision" | "reactivate" | "recordProfile" | "update" | "updateProfile";
+        }[];
+        readonly outgoing: "0..1";
+    };
+    readonly target: {
+        readonly as: "profile";
+        readonly accepts: readonly {
+            readonly kind: 'node';
+            readonly abstract: false;
+            readonly depth: 1;
+            readonly properties: "email" | "familyName" | "givenName" | "name";
+            readonly methods: never;
+        }[];
+        readonly incoming: "0..1";
+    };
+    readonly constraints: Record<never, never>;
+    readonly effectiveProperties: never;
+}>;

package/dist/schema/modules/user/classes/user-profile-link.js

@@ -0,0 +1,22 @@
+import { edgeClass } from '@astrale-os/sdk/schema';
+import { atomicRoles } from '../../role/index.js';
+import { hasRole } from '../../../policies/index.js';
+import { isProfileSource } from '../policies/index.js';
+import { UserProfile } from './user-profile.js';
+import { User } from './user.js';
+/**
+ * The profile of one account, one each way. `0..1` on both ends: the Kernel refuses `detach` on a
+ * required end, and accounts stored before profiles lack theirs (`legacyMigrateAccounts` creates
+ * them). Shell writes and deletes both together.
+ */
+export const user_profile = edgeClass.directed({
+    inheritance: 'final',
+    abstract: false,
+    description: 'The profile of this account.',
+    source: { as: 'user', accepts: [User], outgoing: '0..1', onDelete: 'detach' },
+    target: { as: 'profile', accepts: [UserProfile], incoming: '0..1', onDelete: 'detach' },
+    policies: {
+        read: ({ anyOf, check, ref, self }) => anyOf(check(hasRole, ref(atomicRoles['user-profile.reader'])), check(hasRole, ref(atomicRoles['user.writer'])), check(isProfileSource, self)),
+        traverse: true,
+    },
+});

package/dist/schema/modules/user/classes/user-profile.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The shared part of an account: what others see of a person. Its image waits for the SDK to
+ * export the blob type (a blob property breaks the Domain's type declarations). Only Shell writes
+ * it, through its methods. It reads by `user-profile.reader`, `user.writer`, or the person whose
+ * account it describes.
+ */
+export declare const UserProfile: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+    readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+    readonly inheritance: "final";
+    readonly abstract: false;
+    readonly description: "What others see of a person: name and email.";
+    readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Named">];
+    readonly properties: {
+        givenName: import("@astrale-os/sdk/schema").AuthoredProperty<{
+            readonly type: 'string';
+            readonly minLength: 1;
+            readonly maxLength: number;
+        }, {
+            readonly required: false;
+        }>;
+        familyName: import("@astrale-os/sdk/schema").AuthoredProperty<{
+            readonly type: 'string';
+            readonly minLength: 1;
+            readonly maxLength: number;
+        }, {
+            readonly required: false;
+        }>;
+        email: import("@astrale-os/sdk/schema").AuthoredProperty<{
+            readonly type: "string";
+            readonly minLength: 3;
+            readonly maxLength: 100;
+        }, {
+            readonly required: false;
+        }>;
+    };
+    readonly unique: readonly [readonly ["email"]];
+    readonly policies: {
+        readonly read: ({ anyOf, check, ref, self }: import("@astrale-os/sdk/schema").ClassRuleContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").ClassRuleObject>;
+        readonly traverse: true;
+    };
+}>;

package/dist/schema/modules/user/classes/user-profile.js

@@ -0,0 +1,30 @@
+import { K, classIcon, nodeClass, property } from '@astrale-os/sdk/schema';
+import { UserRound } from '@astrale-os/sdk/schema/icons';
+import { atomicRoles } from '../../role/index.js';
+import { hasRole } from '../../../policies/index.js';
+import { describesSubject } from '../policies/index.js';
+const text = (maxLength) => ({ type: 'string', minLength: 1, maxLength });
+/**
+ * The shared part of an account: what others see of a person. Its image waits for the SDK to
+ * export the blob type (a blob property breaks the Domain's type declarations). Only Shell writes
+ * it, through its methods. It reads by `user-profile.reader`, `user.writer`, or the person whose
+ * account it describes.
+ */
+export const UserProfile = nodeClass({
+    icon: classIcon.lucide(UserRound),
+    inheritance: 'final',
+    abstract: false,
+    description: 'What others see of a person: name and email.',
+    extends: [K.classes.Named],
+    properties: {
+        givenName: property(text(100), { required: false }),
+        familyName: property(text(100), { required: false }),
+        // Lower case, unique; to be confirmed until the account has signed in once.
+        email: property({ type: 'string', minLength: 3, maxLength: 100 }, { required: false }),
+    },
+    unique: [['email']],
+    policies: {
+        read: ({ anyOf, check, ref, self }) => anyOf(check(hasRole, ref(atomicRoles['user-profile.reader'])), check(hasRole, ref(atomicRoles['user.writer'])), check(describesSubject, self)),
+        traverse: true,
+    },
+});

package/dist/schema/modules/user/classes/user.d.ts

@@ -1,20 +1,92 @@
-import { z } from 'zod';
+/**
+ * The account of one person in the workspace. Only Shell writes it, through its methods: the Class
+ * declares no write rule. An account reads by `user.reader` or by its holder (U7); every Path
+ * walks through it.
+ */
 export declare const User: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
     readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
     readonly inheritance: "open";
+    readonly abstract: false;
+    readonly description: "The account of one person in the workspace.";
+    readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Iconable">];
+    readonly properties: {
+        readonly creationKey: import("zod").ZodOptional<import("zod").ZodString>;
+        readonly claimedEmail: import("zod").ZodOptional<import("zod").ZodString>;
+        readonly claimedName: import("zod").ZodOptional<import("zod").ZodString>;
+        readonly suspended: import("zod").ZodOptional<import("zod").ZodBoolean>;
+        readonly directoryActive: import("zod").ZodOptional<import("zod").ZodBoolean>;
+        readonly name: import("@astrale-os/sdk/schema").AuthoredProperty<{
+            readonly type: "string";
+            readonly minLength: 1;
+            readonly maxLength: 100;
+        }, {
+            readonly required: false;
+        }>;
+        readonly email: import("@astrale-os/sdk/schema").AuthoredProperty<{
+            readonly type: "string";
+            readonly minLength: 3;
+            readonly maxLength: 320;
+        }, {
+            readonly required: false;
+        }>;
+        readonly givenName: import("@astrale-os/sdk/schema").AuthoredProperty<{
+            readonly type: 'string';
+            readonly minLength: 1;
+            readonly maxLength: number;
+        }, {
+            readonly required: false;
+        }>;
+        readonly familyName: import("@astrale-os/sdk/schema").AuthoredProperty<{
+            readonly type: 'string';
+            readonly minLength: 1;
+            readonly maxLength: number;
+        }, {
+            readonly required: false;
+        }>;
+        readonly directory: import("@astrale-os/sdk/schema").AuthoredProperty<{
+            readonly type: 'string';
+            readonly minLength: 1;
+            readonly maxLength: number;
+        }, {
+            readonly required: false;
+        }>;
+        readonly externalId: import("@astrale-os/sdk/schema").AuthoredProperty<{
+            readonly type: 'string';
+            readonly minLength: 1;
+            readonly maxLength: number;
+        }, {
+            readonly required: false;
+        }>;
+        readonly attributes: import("@astrale-os/sdk/schema").AuthoredProperty<{
+            readonly type: "object";
+            readonly additionalProperties: true;
+            readonly maxProperties: 64;
+        }, {
+            readonly required: false;
+        }>;
+    };
     readonly policies: {
         readonly read: true;
-    };
-    readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">];
-    readonly properties: {
-        readonly creationKey: z.ZodOptional<z.ZodString>;
-        readonly claimedEmail: z.ZodOptional<z.ZodString>;
-        readonly claimedName: z.ZodOptional<z.ZodString>;
+        readonly traverse: true;
     };
     readonly methods: {
+        readonly create: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            email: string;
+            name: string;
+            givenName?: string | undefined;
+            familyName?: string | undefined;
+            attributes?: Record<string, unknown> | undefined;
+        }, {
+            readonly mode: 'value';
+            readonly value: {
+                user: string;
+                created: boolean;
+            };
+        }, "authorized", true, false, undefined, undefined>>;
         readonly invite: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            email?: string | undefined;
             user: string;
-            email: string;
+            profile?: "admin" | "member" | undefined;
         }, {
             readonly mode: 'value';
             readonly value: {
@@ -23,6 +95,59 @@ export declare const User: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
                 state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
             };
         }, "authorized", true, false, undefined, undefined>>;
+        readonly update: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            name?: string | undefined;
+            email?: string | undefined;
+            givenName?: string | null | undefined;
+            familyName?: string | null | undefined;
+            icon?: string | null | undefined;
+            attributes?: Record<string, unknown> | null | undefined;
+        }, {
+            readonly mode: 'value';
+            readonly value: Record<string, never>;
+        }, "authorized", false, false, undefined, undefined>>;
+        readonly updateProfile: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            name?: string | undefined;
+            icon?: string | null | undefined;
+        }, {
+            readonly mode: 'value';
+            readonly value: Record<string, never>;
+        }, "authorized", false, false, undefined, undefined>>;
+        readonly deactivate: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: Record<string, never>;
+        }, "authorized", false, false, undefined, undefined>>;
+        readonly reactivate: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: Record<string, never>;
+        }, "authorized", false, false, undefined, undefined>>;
+        readonly delete: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: Record<string, never>;
+        }, "authorized", false, false, undefined, undefined>>;
+        readonly provision: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            directory: string;
+            externalId: string;
+            email: string;
+            name: string;
+            givenName?: string | undefined;
+            familyName?: string | undefined;
+            active: boolean;
+        }, {
+            readonly mode: 'value';
+            readonly value: {
+                user: string;
+                created: boolean;
+                adopted: boolean;
+            };
+        }, "authorized", true, false, undefined, undefined>>;
+        readonly deprovision: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            directory: string;
+            externalId: string;
+        }, {
+            readonly mode: 'value';
+            readonly value: Record<string, never>;
+        }, "authorized", true, false, undefined, undefined>>;
         readonly recordProfile: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
             email?: string | undefined;
             displayName?: string | undefined;

package/dist/schema/modules/user/classes/user.js

@@ -1,21 +1,52 @@
-import { K, classIcon, nodeClass } from '@astrale-os/sdk/schema';
+import { classIcon, nodeClass, property } from '@astrale-os/sdk/schema';
 import { UserRound } from '@astrale-os/sdk/schema/icons';
-import { z } from 'zod';
-import { invite, recordProfile } from '../functions/index.js';
-import { userDisplayName, userEmail } from '../types/index.js';
-// Correlation for Admin-owned creation; never an authentication credential.
-const creationKey = z.string().min(1).max(512).optional();
+import { attributesProperty } from '../../../types/index.js';
+import { create, deactivate, deprovision, invite, provision, reactivate, remove, update, updateProfile, } from '../functions/index.js';
+// Seams L-SHELL-1…5: the relaxations and members existing accounts and callers still need.
+import { LEGACY_ACCOUNT_PROPERTIES_OPTIONAL, LEGACY_USER_EXTENDS, LEGACY_USER_INHERITANCE, LEGACY_USER_READ, legacyAccountProperties, legacyAccountStateProperties, legacyRecordProfile, legacyUserName, } from '../legacy/index.js';
+const text = (maxLength) => ({ type: 'string', minLength: 1, maxLength });
+/**
+ * The account of one person in the workspace. Only Shell writes it, through its methods: the Class
+ * declares no write rule. An account reads by `user.reader` or by its holder (U7); every Path
+ * walks through it.
+ */
 export const User = nodeClass({
     icon: classIcon.lucide(UserRound),
-    // Domains that depend on Shell extend it with the accounts they own.
-    inheritance: 'open',
-    policies: { read: true },
-    extends: [K.classes.Identity],
+    inheritance: LEGACY_USER_INHERITANCE,
+    abstract: false,
+    description: 'The account of one person in the workspace.',
+    extends: LEGACY_USER_EXTENDS,
     properties: {
-        creationKey,
-        // Named apart from any profile a Domain extending User declares (`email`, `displayName`…).
-        claimedEmail: userEmail.optional(),
-        claimedName: userDisplayName.optional(),
+        // astrale-disable-next-line NODE-INHERITED -- L-SHELL-2: Named.name until stored accounts have it
+        name: legacyUserName,
+        // Written in lower case; it binds the first sign-in to the account (U8).
+        email: property({ type: 'string', minLength: 3, maxLength: 320 }, LEGACY_ACCOUNT_PROPERTIES_OPTIONAL),
+        givenName: property(text(100), { required: false }),
+        familyName: property(text(100), { required: false }),
+        // The WorkOS directory that provides the account, and its id there. Absent: a local account.
+        directory: property(text(200), { required: false }),
+        externalId: property(text(200), { required: false }),
+        // Free JSON a Domain or an admin attaches to the account (AM11).
+        attributes: attributesProperty(),
+        ...legacyAccountProperties,
+        ...legacyAccountStateProperties,
+    },
+    // L-SHELL-19: no unique constraint and an open read, as Domains built against the released
+    // Shell expect.
+    policies: {
+        read: LEGACY_USER_READ,
+        traverse: true,
+    },
+    methods: {
+        create,
+        invite,
+        update,
+        updateProfile,
+        deactivate,
+        reactivate,
+        delete: remove,
+        provision,
+        deprovision,
+        recordProfile: legacyRecordProfile,
     },
-    methods: { invite, recordProfile },
 });

package/dist/schema/modules/user/functions/create-user.js

@@ -0,0 +1,21 @@
+import { method } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+import { atomicRoles } from '../../role/index.js';
+import { hasRole } from '../../../policies/index.js';
+import { attributesInput } from '../../../types/index.js';
+import { accountEmailInput, nodeReference, personName } from '../types/index.js';
+/** Create the account of an email, or return the one that already has it (U1). */
+export const create = method({
+    static: true,
+    description: 'Create the account of an email, or return the account that already has it.',
+    auth: 'authorized',
+    input: z.strictObject({
+        email: accountEmailInput,
+        name: personName,
+        givenName: personName.optional(),
+        familyName: personName.optional(),
+        attributes: attributesInput.optional(),
+    }),
+    output: z.object({ user: nodeReference, created: z.boolean() }),
+    policy: ({ check, ref }) => check(hasRole, ref(atomicRoles['user.writer'])),
+});

package/dist/schema/modules/user/functions/deactivate-user.js

@@ -0,0 +1,12 @@
+import { method } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+import { atomicRoles } from '../../role/index.js';
+import { hasRole } from '../../../policies/index.js';
+/** Deactivate this account: it can no longer sign in (U2, U4, U5). */
+export const deactivate = method({
+    description: 'Deactivate this account: it can no longer sign in (U2, U4, U5).',
+    auth: 'authorized',
+    input: z.strictObject({}),
+    output: z.object({}),
+    policy: ({ check, ref }) => check(hasRole, ref(atomicRoles['user.writer'])),
+});

package/dist/schema/modules/user/functions/delete-user.js

@@ -0,0 +1,12 @@
+import { method } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+import { atomicRoles } from '../../role/index.js';
+import { hasRole } from '../../../policies/index.js';
+/** Delete this deactivated account and its memberships (U4, U6). */
+export const remove = method({
+    description: 'Delete this deactivated account and its memberships (U4, U6).',
+    auth: 'authorized',
+    input: z.strictObject({}),
+    output: z.object({}),
+    policy: ({ check, ref }) => check(hasRole, ref(atomicRoles['user.writer'])),
+});

package/dist/schema/modules/user/functions/deprovision-user.js

@@ -0,0 +1,14 @@
+import { method } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+import { atomicRoles } from '../../role/index.js';
+import { hasRole } from '../../../policies/index.js';
+import { directoryId, externalId } from '../types/index.js';
+/** The directory deleted the account: it stays, frozen, with its history . */
+export const deprovision = method({
+    static: true,
+    description: 'Freeze the account a directory deleted, keeping it and its history.',
+    auth: 'authorized',
+    input: z.strictObject({ directory: directoryId, externalId }),
+    output: z.object({}),
+    policy: ({ check, ref }) => check(hasRole, ref(atomicRoles['directory.provisioner'])),
+});

package/dist/schema/modules/user/functions/index.js

@@ -1,2 +1,9 @@
+export { create } from './create-user.js';
 export { invite } from './invite-user.js';
-export { recordProfile } from './record-profile.js';
+export { update } from './update-user.js';
+export { updateProfile } from './update-profile.js';
+export { deactivate } from './deactivate-user.js';
+export { reactivate } from './reactivate-user.js';
+export { remove } from './delete-user.js';
+export { provision } from './provision-user.js';
+export { deprovision } from './deprovision-user.js';

package/dist/schema/modules/user/functions/invite-user.js

@@ -1,12 +1,31 @@
 import { method, path } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
-import { ownsClass, administersShellClass } from '../../../policies/index.js';
-import { User } from '../classes/index.js';
+import { PROFILE_NAMES, atomicRoles } from '../../role/index.js';
+import { hasRole } from '../../../policies/index.js';
+import { User } from '../classes/user.js';
+import { legacyInviteFields, legacyInviteOwnerAdmission } from '../legacy/index.js';
 import { invitationSummary } from '../types/index.js';
+/**
+ * Grant an account a profile, `member` by default, and have Admin send its invitation to the email
+ * the account holds. Only a holder of `workspace.admin` grants `admin`.
+ *
+ * @deprecated The invitation of Admin and 1Pact before durable invitations: it answers at once and
+ * keeps no invitation (L-SHELL-18). Replaced by `Invitation.send`, a durable run that keeps an
+ * `Invitation` until it is accepted, cancelled or expired. Removal: Shell major (delivery step 5),
+ * once Admin (step 2) and 1Pact (step 4) call `Invitation.send`.
+ */
 export const invite = method({
     static: true,
+    description: 'Grant an account its profile and have Admin send its invitation.',
     auth: 'authorized',
-    input: z.object({ user: path(() => User), email: z.string().min(3).max(320) }),
+    input: z.strictObject({
+        user: path(() => User),
+        profile: z.enum(PROFILE_NAMES).optional(),
+        // Seam L-SHELL-6: the `{ user, email }` form of callers older than profiles.
+        ...legacyInviteFields,
+    }),
     output: invitationSummary,
-    policy: ({ anyOf, check, input }) => anyOf(check(administersShellClass, input.user), check(ownsClass, input.user)),
+    policy: (context) => context.anyOf(context.check(hasRole, context.ref(atomicRoles['user.writer'])), 
+    // Seam L-SHELL-9: a Domain that extends User invites the accounts of its own Class.
+    legacyInviteOwnerAdmission(context, context.input.user)),
 });

package/dist/schema/modules/user/functions/provision-user.js

@@ -0,0 +1,25 @@
+import { method } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+import { atomicRoles } from '../../role/index.js';
+import { hasRole } from '../../../policies/index.js';
+import { accountEmailInput, directoryId, externalId, nodeReference, personName, } from '../types/index.js';
+/**
+ * Write the account a directory provides: create it, adopt the account of its email (A2), or update
+ * it. Replaying the same event changes nothing (A3); a conflict refuses it whole (A4).
+ */
+export const provision = method({
+    static: true,
+    description: 'Create, adopt or update the account a directory provides.',
+    auth: 'authorized',
+    input: z.strictObject({
+        directory: directoryId,
+        externalId,
+        email: accountEmailInput,
+        name: personName,
+        givenName: personName.optional(),
+        familyName: personName.optional(),
+        active: z.boolean(),
+    }),
+    output: z.object({ user: nodeReference, created: z.boolean(), adopted: z.boolean() }),
+    policy: ({ check, ref }) => check(hasRole, ref(atomicRoles['directory.provisioner'])),
+});