@astrale-domains/shell 0.1.6 → 0.1.8

package/dist/schema/schema.d.ts

@@ -1,22 +1,120 @@
 import { KernelSchema, schema } from '@astrale-os/sdk/schema';
 export declare const ORIGIN: 'shell.astrale.ai';
 declare const classes: {
+    readonly member_of_group: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+        readonly depth: 0;
+        readonly abstract: false;
+        readonly extends: readonly [];
+        readonly properties: never;
+        readonly source: {
+            readonly as: "member";
+            readonly accepts: readonly (() => {
+                readonly kind: 'node';
+                readonly abstract: never;
+                readonly depth: never;
+                readonly properties: never;
+                readonly methods: never;
+            })[];
+            readonly outgoing: "0..*";
+        };
+        readonly target: {
+            readonly as: "group";
+            readonly accepts: readonly (() => {
+                readonly kind: 'node';
+                readonly abstract: never;
+                readonly depth: never;
+                readonly properties: never;
+                readonly methods: never;
+            })[];
+            readonly incoming: "0..*";
+        };
+        readonly constraints: Record<never, never>;
+        readonly effectiveProperties: never;
+    }>;
     readonly User: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
         readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
         readonly inheritance: "open";
-        readonly policies: {
-            readonly read: true;
-        };
-        readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">];
+        readonly abstract: false;
+        readonly description: "The account of one person in the workspace.";
+        readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Iconable">];
         readonly properties: {
             readonly creationKey: import("zod").ZodOptional<import("zod").ZodString>;
             readonly claimedEmail: import("zod").ZodOptional<import("zod").ZodString>;
             readonly claimedName: import("zod").ZodOptional<import("zod").ZodString>;
+            readonly suspended: import("zod").ZodOptional<import("zod").ZodBoolean>;
+            readonly directoryActive: import("zod").ZodOptional<import("zod").ZodBoolean>;
+            readonly name: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 100;
+            }, {
+                readonly required: false;
+            }>;
+            readonly email: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                readonly type: "string";
+                readonly minLength: 3;
+                readonly maxLength: 320;
+            }, {
+                readonly required: false;
+            }>;
+            readonly givenName: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                readonly type: 'string';
+                readonly minLength: 1;
+                readonly maxLength: number;
+            }, {
+                readonly required: false;
+            }>;
+            readonly familyName: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                readonly type: 'string';
+                readonly minLength: 1;
+                readonly maxLength: number;
+            }, {
+                readonly required: false;
+            }>;
+            readonly directory: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                readonly type: 'string';
+                readonly minLength: 1;
+                readonly maxLength: number;
+            }, {
+                readonly required: false;
+            }>;
+            readonly externalId: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                readonly type: 'string';
+                readonly minLength: 1;
+                readonly maxLength: number;
+            }, {
+                readonly required: false;
+            }>;
+            readonly attributes: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                readonly type: "object";
+                readonly additionalProperties: true;
+                readonly maxProperties: 64;
+            }, {
+                readonly required: false;
+            }>;
+        };
+        readonly policies: {
+            readonly read: true;
+            readonly traverse: true;
         };
         readonly methods: {
+            readonly create: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                email: string;
+                name: string;
+                givenName?: string | undefined;
+                familyName?: string | undefined;
+                attributes?: Record<string, unknown> | undefined;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    user: string;
+                    created: boolean;
+                };
+            }, "authorized", true, false, undefined, undefined>>;
             readonly invite: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                email?: string | undefined;
                 user: string;
-                email: string;
+                profile?: "admin" | "member" | undefined;
             }, {
                 readonly mode: 'value';
                 readonly value: {
@@ -25,6 +123,59 @@ declare const classes: {
                     state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
                 };
             }, "authorized", true, false, undefined, undefined>>;
+            readonly update: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                name?: string | undefined;
+                email?: string | undefined;
+                givenName?: string | null | undefined;
+                familyName?: string | null | undefined;
+                icon?: string | null | undefined;
+                attributes?: Record<string, unknown> | null | undefined;
+            }, {
+                readonly mode: 'value';
+                readonly value: Record<string, never>;
+            }, "authorized", false, false, undefined, undefined>>;
+            readonly updateProfile: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                name?: string | undefined;
+                icon?: string | null | undefined;
+            }, {
+                readonly mode: 'value';
+                readonly value: Record<string, never>;
+            }, "authorized", false, false, undefined, undefined>>;
+            readonly deactivate: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                readonly mode: 'value';
+                readonly value: Record<string, never>;
+            }, "authorized", false, false, undefined, undefined>>;
+            readonly reactivate: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                readonly mode: 'value';
+                readonly value: Record<string, never>;
+            }, "authorized", false, false, undefined, undefined>>;
+            readonly delete: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                readonly mode: 'value';
+                readonly value: Record<string, never>;
+            }, "authorized", false, false, undefined, undefined>>;
+            readonly provision: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                directory: string;
+                externalId: string;
+                email: string;
+                name: string;
+                givenName?: string | undefined;
+                familyName?: string | undefined;
+                active: boolean;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    user: string;
+                    created: boolean;
+                    adopted: boolean;
+                };
+            }, "authorized", true, false, undefined, undefined>>;
+            readonly deprovision: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                directory: string;
+                externalId: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: Record<string, never>;
+            }, "authorized", true, false, undefined, undefined>>;
             readonly recordProfile: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
                 email?: string | undefined;
                 displayName?: string | undefined;
@@ -34,14 +185,129 @@ declare const classes: {
             }, "authorized", false, false, undefined, undefined>>;
         };
     }>;
+    readonly UserProfile: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+        readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+        readonly inheritance: "final";
+        readonly abstract: false;
+        readonly description: "What others see of a person: name and email.";
+        readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Named">];
+        readonly properties: {
+            givenName: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                readonly type: 'string';
+                readonly minLength: 1;
+                readonly maxLength: number;
+            }, {
+                readonly required: false;
+            }>;
+            familyName: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                readonly type: 'string';
+                readonly minLength: 1;
+                readonly maxLength: number;
+            }, {
+                readonly required: false;
+            }>;
+            email: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                readonly type: "string";
+                readonly minLength: 3;
+                readonly maxLength: 100;
+            }, {
+                readonly required: false;
+            }>;
+        };
+        readonly unique: readonly [readonly ["email"]];
+        readonly policies: {
+            readonly read: ({ anyOf, check, ref, self }: import("@astrale-os/sdk/schema").ClassRuleContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").ClassRuleObject>;
+            readonly traverse: true;
+        };
+    }>;
+    readonly user_profile: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+        readonly depth: 0;
+        readonly abstract: false;
+        readonly extends: readonly [];
+        readonly properties: never;
+        readonly source: {
+            readonly as: "user";
+            readonly accepts: readonly {
+                readonly kind: 'node';
+                readonly abstract: false;
+                readonly depth: 1;
+                readonly properties: "attributes" | "claimedEmail" | "claimedName" | "creationKey" | "directory" | "directoryActive" | "email" | "externalId" | "familyName" | "frozen" | "givenName" | "icon" | "iss" | "name" | "sub" | "suspended";
+                readonly methods: "create" | "deactivate" | "delete" | "deprovision" | "invite" | "provision" | "reactivate" | "recordProfile" | "update" | "updateProfile";
+            }[];
+            readonly outgoing: "0..1";
+        };
+        readonly target: {
+            readonly as: "profile";
+            readonly accepts: readonly {
+                readonly kind: 'node';
+                readonly abstract: false;
+                readonly depth: 1;
+                readonly properties: "email" | "familyName" | "givenName" | "name";
+                readonly methods: never;
+            }[];
+            readonly incoming: "0..1";
+        };
+        readonly constraints: Record<never, never>;
+        readonly effectiveProperties: never;
+    }>;
     readonly Group: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
         readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
         readonly inheritance: "open";
+        readonly abstract: false;
+        readonly description: "A set of accounts and groups; its members hold what it holds.";
+        readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">, import("@astrale-os/sdk/schema").KernelClass<"Iconable">];
+        readonly properties: {
+            directory: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                readonly type: 'string';
+                readonly minLength: 1;
+                readonly maxLength: 200;
+            }, {
+                readonly required: false;
+            }>;
+            externalId: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                readonly type: 'string';
+                readonly minLength: 1;
+                readonly maxLength: 200;
+            }, {
+                readonly required: false;
+            }>;
+            attributes: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                readonly type: "object";
+                readonly additionalProperties: true;
+                readonly maxProperties: 64;
+            }, {
+                readonly required: false;
+            }>;
+        };
         readonly policies: {
             readonly read: true;
+            readonly traverse: true;
         };
-        readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
         readonly methods: {
+            readonly create: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                name: string;
+                description?: string | undefined;
+                icon?: string | null | undefined;
+                attributes?: Record<string, unknown> | undefined;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    group: string;
+                };
+            }, "authorized", true, false, undefined, undefined>>;
+            readonly update: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                name?: string | undefined;
+                description?: string | null | undefined;
+                icon?: string | null | undefined;
+                attributes?: Record<string, unknown> | null | undefined;
+            }, {
+                readonly mode: 'value';
+                readonly value: Record<string, never>;
+            }, "authorized", false, false, undefined, undefined>>;
+            readonly delete: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                readonly mode: 'value';
+                readonly value: Record<string, never>;
+            }, "authorized", false, false, undefined, undefined>>;
             readonly assignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
                 member: string;
                 group: string;
@@ -56,38 +322,202 @@ declare const classes: {
                 readonly mode: 'value';
                 readonly value: Record<string, never>;
             }, "authorized", true, false, undefined, undefined>>;
+            readonly assignMembers: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                members: string[];
+                group: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: Record<string, never>;
+            }, "authorized", true, false, undefined, undefined>>;
+            readonly unassignMembers: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                members: string[];
+                group: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: Record<string, never>;
+            }, "authorized", true, false, undefined, undefined>>;
+            readonly provision: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                directory: string;
+                externalId: string;
+                name: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    group: string;
+                    created: boolean;
+                };
+            }, "authorized", true, false, undefined, undefined>>;
+            readonly deprovision: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                directory: string;
+                externalId: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: Record<string, never>;
+            }, "authorized", true, false, undefined, undefined>>;
         };
     }>;
-    readonly member_of_group: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+    readonly GroupProfile: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+        readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+        readonly inheritance: "final";
+        readonly abstract: false;
+        readonly description: "What others see of a group: name and description.";
+        readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
+        readonly policies: {
+            readonly read: ({ anyOf, check, ref, self }: import("@astrale-os/sdk/schema").ClassRuleContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").ClassRuleObject>;
+            readonly traverse: true;
+        };
+    }>;
+    readonly group_profile: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
         readonly depth: 0;
         readonly abstract: false;
         readonly extends: readonly [];
         readonly properties: never;
         readonly source: {
-            readonly as: "member";
-            readonly accepts: readonly (() => {
+            readonly as: "group";
+            readonly accepts: readonly {
                 readonly kind: 'node';
-                readonly abstract: never;
-                readonly depth: never;
-                readonly properties: never;
-                readonly methods: never;
-            })[];
-            readonly outgoing: "0..*";
+                readonly abstract: false;
+                readonly depth: 1;
+                readonly properties: "attributes" | "description" | "directory" | "externalId" | "frozen" | "icon" | "iss" | "name" | "sub";
+                readonly methods: "assignMember" | "assignMembers" | "create" | "delete" | "deprovision" | "provision" | "unassignMember" | "unassignMembers" | "update";
+            }[];
+            readonly outgoing: "0..1";
         };
         readonly target: {
-            readonly as: "group";
-            readonly accepts: readonly (() => {
+            readonly as: "profile";
+            readonly accepts: readonly {
                 readonly kind: 'node';
-                readonly abstract: never;
-                readonly depth: never;
-                readonly properties: never;
+                readonly abstract: false;
+                readonly depth: 1;
+                readonly properties: "description" | "name";
                 readonly methods: never;
-            })[];
+            }[];
+            readonly incoming: "0..1";
+        };
+        readonly constraints: Record<never, never>;
+        readonly effectiveProperties: never;
+    }>;
+    readonly Invitation: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+        readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+        readonly inheritance: "final";
+        readonly abstract: false;
+        readonly description: "One invitation of an account, until it is accepted, cancelled or expired.";
+        readonly properties: {
+            status: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                readonly type: "string";
+                readonly enum: readonly ["pending", "accepted", "cancelled", "expired"];
+            }, {
+                readonly required?: boolean;
+                readonly description?: string;
+                readonly immutable?: import("@astrale-os/sdk/schema").PropertyImmutability;
+            }>;
+            expiresAt: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                readonly type: "string";
+                readonly minLength: 20;
+                readonly maxLength: 40;
+            }, {
+                readonly required?: boolean;
+                readonly description?: string;
+                readonly immutable?: import("@astrale-os/sdk/schema").PropertyImmutability;
+            }>;
+            execution: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                readonly type: "string";
+                readonly minLength: 1;
+                readonly maxLength: 200;
+            }, {
+                readonly required?: boolean;
+                readonly description?: string;
+                readonly immutable?: import("@astrale-os/sdk/schema").PropertyImmutability;
+            }>;
+            round: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                readonly type: "integer";
+                readonly minimum: 0;
+            }, {
+                readonly required?: boolean;
+                readonly description?: string;
+                readonly immutable?: import("@astrale-os/sdk/schema").PropertyImmutability;
+            }>;
+            email: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                readonly type: "string";
+                readonly minLength: 3;
+                readonly maxLength: 320;
+            }, {
+                readonly required: false;
+            }>;
+        };
+        readonly policies: {
+            readonly read: ({ check, ref }: import("@astrale-os/sdk/schema").ClassRuleContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").ClassRuleObject>;
+            readonly traverse: true;
+        };
+        readonly methods: {
+            readonly send: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                user: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: {
+                    status: "accepted" | "cancelled" | "expired" | "pending";
+                };
+            }, "authorized", true, false, {
+                readonly durable: true;
+            }, undefined>>;
+            readonly resend: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                readonly mode: 'value';
+                readonly value: Record<string, never>;
+            }, "authorized", false, false, undefined, undefined>>;
+            readonly cancel: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                readonly mode: 'value';
+                readonly value: Record<string, never>;
+            }, "authorized", false, false, undefined, undefined>>;
+            readonly accept: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                iss: string;
+                sub: string;
+            }, {
+                readonly mode: 'value';
+                readonly value: Record<string, never>;
+            }, "authorized", false, false, undefined, undefined>>;
+        };
+    }>;
+    readonly invitation_user: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+        readonly depth: 0;
+        readonly abstract: false;
+        readonly extends: readonly [];
+        readonly properties: never;
+        readonly source: {
+            readonly as: "invitation";
+            readonly accepts: readonly {
+                readonly kind: 'node';
+                readonly abstract: false;
+                readonly depth: 0;
+                readonly properties: "email" | "execution" | "expiresAt" | "round" | "status";
+                readonly methods: "accept" | "cancel" | "resend" | "send";
+            }[];
+            readonly outgoing: "0..1";
+        };
+        readonly target: {
+            readonly as: "user";
+            readonly accepts: readonly {
+                readonly kind: 'node';
+                readonly abstract: false;
+                readonly depth: 1;
+                readonly properties: "attributes" | "claimedEmail" | "claimedName" | "creationKey" | "directory" | "directoryActive" | "email" | "externalId" | "familyName" | "frozen" | "givenName" | "icon" | "iss" | "name" | "sub" | "suspended";
+                readonly methods: "create" | "deactivate" | "delete" | "deprovision" | "invite" | "provision" | "reactivate" | "recordProfile" | "update" | "updateProfile";
+            }[];
             readonly incoming: "0..*";
         };
         readonly constraints: Record<never, never>;
         readonly effectiveProperties: never;
     }>;
+    readonly Role: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+        readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+        readonly inheritance: "final";
+        readonly abstract: false;
+        readonly description: "A Role the Shell declares.";
+        readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Role">];
+        readonly policies: {
+            readonly read: ({ anyOf, check, ref, self }: import("@astrale-os/sdk/schema").ClassRuleContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").ClassRuleObject>;
+            readonly traverse: true;
+        };
+    }>;
     readonly Namespace: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
         readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
         readonly policies: {
@@ -150,13 +580,9 @@ declare const classes: {
         readonly extends: readonly [];
         readonly properties: never;
         readonly source: {
-            readonly as: "holder";
-            readonly accepts: readonly (() => {
-                readonly kind: 'node';
-                readonly abstract: never;
-                readonly depth: never;
-                readonly properties: never;
-                readonly methods: never;
+            readonly as: "audience";
+            readonly accepts: readonly (import("@astrale-os/sdk/schema").ClassRef<"Identity"> & {
+                readonly origin: "kernel.astrale.ai";
             })[];
             readonly outgoing: "0..*";
         };
@@ -179,22 +605,120 @@ declare const input: {
         readonly kernel: KernelSchema;
     };
     readonly classes: {
+        readonly member_of_group: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+            readonly depth: 0;
+            readonly abstract: false;
+            readonly extends: readonly [];
+            readonly properties: never;
+            readonly source: {
+                readonly as: "member";
+                readonly accepts: readonly (() => {
+                    readonly kind: 'node';
+                    readonly abstract: never;
+                    readonly depth: never;
+                    readonly properties: never;
+                    readonly methods: never;
+                })[];
+                readonly outgoing: "0..*";
+            };
+            readonly target: {
+                readonly as: "group";
+                readonly accepts: readonly (() => {
+                    readonly kind: 'node';
+                    readonly abstract: never;
+                    readonly depth: never;
+                    readonly properties: never;
+                    readonly methods: never;
+                })[];
+                readonly incoming: "0..*";
+            };
+            readonly constraints: Record<never, never>;
+            readonly effectiveProperties: never;
+        }>;
         readonly User: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly inheritance: "open";
-            readonly policies: {
-                readonly read: true;
-            };
-            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">];
+            readonly abstract: false;
+            readonly description: "The account of one person in the workspace.";
+            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Iconable">];
             readonly properties: {
                 readonly creationKey: import("zod").ZodOptional<import("zod").ZodString>;
                 readonly claimedEmail: import("zod").ZodOptional<import("zod").ZodString>;
                 readonly claimedName: import("zod").ZodOptional<import("zod").ZodString>;
+                readonly suspended: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                readonly directoryActive: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                readonly name: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 100;
+                }, {
+                    readonly required: false;
+                }>;
+                readonly email: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "string";
+                    readonly minLength: 3;
+                    readonly maxLength: 320;
+                }, {
+                    readonly required: false;
+                }>;
+                readonly givenName: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: number;
+                }, {
+                    readonly required: false;
+                }>;
+                readonly familyName: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: number;
+                }, {
+                    readonly required: false;
+                }>;
+                readonly directory: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: number;
+                }, {
+                    readonly required: false;
+                }>;
+                readonly externalId: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: number;
+                }, {
+                    readonly required: false;
+                }>;
+                readonly attributes: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "object";
+                    readonly additionalProperties: true;
+                    readonly maxProperties: 64;
+                }, {
+                    readonly required: false;
+                }>;
+            };
+            readonly policies: {
+                readonly read: true;
+                readonly traverse: true;
             };
             readonly methods: {
+                readonly create: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    email: string;
+                    name: string;
+                    givenName?: string | undefined;
+                    familyName?: string | undefined;
+                    attributes?: Record<string, unknown> | undefined;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        user: string;
+                        created: boolean;
+                    };
+                }, "authorized", true, false, undefined, undefined>>;
                 readonly invite: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    email?: string | undefined;
                     user: string;
-                    email: string;
+                    profile?: "admin" | "member" | undefined;
                 }, {
                     readonly mode: 'value';
                     readonly value: {
@@ -203,6 +727,59 @@ declare const input: {
                         state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
                     };
                 }, "authorized", true, false, undefined, undefined>>;
+                readonly update: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    name?: string | undefined;
+                    email?: string | undefined;
+                    givenName?: string | null | undefined;
+                    familyName?: string | null | undefined;
+                    icon?: string | null | undefined;
+                    attributes?: Record<string, unknown> | null | undefined;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly updateProfile: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    name?: string | undefined;
+                    icon?: string | null | undefined;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly deactivate: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly reactivate: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly delete: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly provision: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    directory: string;
+                    externalId: string;
+                    email: string;
+                    name: string;
+                    givenName?: string | undefined;
+                    familyName?: string | undefined;
+                    active: boolean;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        user: string;
+                        created: boolean;
+                        adopted: boolean;
+                    };
+                }, "authorized", true, false, undefined, undefined>>;
+                readonly deprovision: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    directory: string;
+                    externalId: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", true, false, undefined, undefined>>;
                 readonly recordProfile: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
                     email?: string | undefined;
                     displayName?: string | undefined;
@@ -212,14 +789,129 @@ declare const input: {
                 }, "authorized", false, false, undefined, undefined>>;
             };
         }>;
+        readonly UserProfile: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+            readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+            readonly inheritance: "final";
+            readonly abstract: false;
+            readonly description: "What others see of a person: name and email.";
+            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Named">];
+            readonly properties: {
+                givenName: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: number;
+                }, {
+                    readonly required: false;
+                }>;
+                familyName: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: number;
+                }, {
+                    readonly required: false;
+                }>;
+                email: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "string";
+                    readonly minLength: 3;
+                    readonly maxLength: 100;
+                }, {
+                    readonly required: false;
+                }>;
+            };
+            readonly unique: readonly [readonly ["email"]];
+            readonly policies: {
+                readonly read: ({ anyOf, check, ref, self }: import("@astrale-os/sdk/schema").ClassRuleContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").ClassRuleObject>;
+                readonly traverse: true;
+            };
+        }>;
+        readonly user_profile: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+            readonly depth: 0;
+            readonly abstract: false;
+            readonly extends: readonly [];
+            readonly properties: never;
+            readonly source: {
+                readonly as: "user";
+                readonly accepts: readonly {
+                    readonly kind: 'node';
+                    readonly abstract: false;
+                    readonly depth: 1;
+                    readonly properties: "attributes" | "claimedEmail" | "claimedName" | "creationKey" | "directory" | "directoryActive" | "email" | "externalId" | "familyName" | "frozen" | "givenName" | "icon" | "iss" | "name" | "sub" | "suspended";
+                    readonly methods: "create" | "deactivate" | "delete" | "deprovision" | "invite" | "provision" | "reactivate" | "recordProfile" | "update" | "updateProfile";
+                }[];
+                readonly outgoing: "0..1";
+            };
+            readonly target: {
+                readonly as: "profile";
+                readonly accepts: readonly {
+                    readonly kind: 'node';
+                    readonly abstract: false;
+                    readonly depth: 1;
+                    readonly properties: "email" | "familyName" | "givenName" | "name";
+                    readonly methods: never;
+                }[];
+                readonly incoming: "0..1";
+            };
+            readonly constraints: Record<never, never>;
+            readonly effectiveProperties: never;
+        }>;
         readonly Group: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly inheritance: "open";
+            readonly abstract: false;
+            readonly description: "A set of accounts and groups; its members hold what it holds.";
+            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">, import("@astrale-os/sdk/schema").KernelClass<"Iconable">];
+            readonly properties: {
+                directory: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: 200;
+                }, {
+                    readonly required: false;
+                }>;
+                externalId: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: 200;
+                }, {
+                    readonly required: false;
+                }>;
+                attributes: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "object";
+                    readonly additionalProperties: true;
+                    readonly maxProperties: 64;
+                }, {
+                    readonly required: false;
+                }>;
+            };
             readonly policies: {
                 readonly read: true;
+                readonly traverse: true;
             };
-            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
             readonly methods: {
+                readonly create: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    name: string;
+                    description?: string | undefined;
+                    icon?: string | null | undefined;
+                    attributes?: Record<string, unknown> | undefined;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        group: string;
+                    };
+                }, "authorized", true, false, undefined, undefined>>;
+                readonly update: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    name?: string | undefined;
+                    description?: string | null | undefined;
+                    icon?: string | null | undefined;
+                    attributes?: Record<string, unknown> | null | undefined;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly delete: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
                 readonly assignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
                     member: string;
                     group: string;
@@ -234,38 +926,202 @@ declare const input: {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
                 }, "authorized", true, false, undefined, undefined>>;
+                readonly assignMembers: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    members: string[];
+                    group: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", true, false, undefined, undefined>>;
+                readonly unassignMembers: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    members: string[];
+                    group: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", true, false, undefined, undefined>>;
+                readonly provision: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    directory: string;
+                    externalId: string;
+                    name: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        group: string;
+                        created: boolean;
+                    };
+                }, "authorized", true, false, undefined, undefined>>;
+                readonly deprovision: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    directory: string;
+                    externalId: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", true, false, undefined, undefined>>;
             };
         }>;
-        readonly member_of_group: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+        readonly GroupProfile: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+            readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+            readonly inheritance: "final";
+            readonly abstract: false;
+            readonly description: "What others see of a group: name and description.";
+            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
+            readonly policies: {
+                readonly read: ({ anyOf, check, ref, self }: import("@astrale-os/sdk/schema").ClassRuleContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").ClassRuleObject>;
+                readonly traverse: true;
+            };
+        }>;
+        readonly group_profile: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
             readonly depth: 0;
             readonly abstract: false;
             readonly extends: readonly [];
             readonly properties: never;
             readonly source: {
-                readonly as: "member";
-                readonly accepts: readonly (() => {
+                readonly as: "group";
+                readonly accepts: readonly {
                     readonly kind: 'node';
-                    readonly abstract: never;
-                    readonly depth: never;
-                    readonly properties: never;
-                    readonly methods: never;
-                })[];
-                readonly outgoing: "0..*";
+                    readonly abstract: false;
+                    readonly depth: 1;
+                    readonly properties: "attributes" | "description" | "directory" | "externalId" | "frozen" | "icon" | "iss" | "name" | "sub";
+                    readonly methods: "assignMember" | "assignMembers" | "create" | "delete" | "deprovision" | "provision" | "unassignMember" | "unassignMembers" | "update";
+                }[];
+                readonly outgoing: "0..1";
             };
             readonly target: {
-                readonly as: "group";
-                readonly accepts: readonly (() => {
+                readonly as: "profile";
+                readonly accepts: readonly {
                     readonly kind: 'node';
-                    readonly abstract: never;
-                    readonly depth: never;
-                    readonly properties: never;
+                    readonly abstract: false;
+                    readonly depth: 1;
+                    readonly properties: "description" | "name";
                     readonly methods: never;
-                })[];
+                }[];
+                readonly incoming: "0..1";
+            };
+            readonly constraints: Record<never, never>;
+            readonly effectiveProperties: never;
+        }>;
+        readonly Invitation: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+            readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+            readonly inheritance: "final";
+            readonly abstract: false;
+            readonly description: "One invitation of an account, until it is accepted, cancelled or expired.";
+            readonly properties: {
+                status: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "string";
+                    readonly enum: readonly ["pending", "accepted", "cancelled", "expired"];
+                }, {
+                    readonly required?: boolean;
+                    readonly description?: string;
+                    readonly immutable?: import("@astrale-os/sdk/schema").PropertyImmutability;
+                }>;
+                expiresAt: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "string";
+                    readonly minLength: 20;
+                    readonly maxLength: 40;
+                }, {
+                    readonly required?: boolean;
+                    readonly description?: string;
+                    readonly immutable?: import("@astrale-os/sdk/schema").PropertyImmutability;
+                }>;
+                execution: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 200;
+                }, {
+                    readonly required?: boolean;
+                    readonly description?: string;
+                    readonly immutable?: import("@astrale-os/sdk/schema").PropertyImmutability;
+                }>;
+                round: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                }, {
+                    readonly required?: boolean;
+                    readonly description?: string;
+                    readonly immutable?: import("@astrale-os/sdk/schema").PropertyImmutability;
+                }>;
+                email: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "string";
+                    readonly minLength: 3;
+                    readonly maxLength: 320;
+                }, {
+                    readonly required: false;
+                }>;
+            };
+            readonly policies: {
+                readonly read: ({ check, ref }: import("@astrale-os/sdk/schema").ClassRuleContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").ClassRuleObject>;
+                readonly traverse: true;
+            };
+            readonly methods: {
+                readonly send: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    user: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        status: "accepted" | "cancelled" | "expired" | "pending";
+                    };
+                }, "authorized", true, false, {
+                    readonly durable: true;
+                }, undefined>>;
+                readonly resend: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly cancel: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly accept: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    iss: string;
+                    sub: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+            };
+        }>;
+        readonly invitation_user: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+            readonly depth: 0;
+            readonly abstract: false;
+            readonly extends: readonly [];
+            readonly properties: never;
+            readonly source: {
+                readonly as: "invitation";
+                readonly accepts: readonly {
+                    readonly kind: 'node';
+                    readonly abstract: false;
+                    readonly depth: 0;
+                    readonly properties: "email" | "execution" | "expiresAt" | "round" | "status";
+                    readonly methods: "accept" | "cancel" | "resend" | "send";
+                }[];
+                readonly outgoing: "0..1";
+            };
+            readonly target: {
+                readonly as: "user";
+                readonly accepts: readonly {
+                    readonly kind: 'node';
+                    readonly abstract: false;
+                    readonly depth: 1;
+                    readonly properties: "attributes" | "claimedEmail" | "claimedName" | "creationKey" | "directory" | "directoryActive" | "email" | "externalId" | "familyName" | "frozen" | "givenName" | "icon" | "iss" | "name" | "sub" | "suspended";
+                    readonly methods: "create" | "deactivate" | "delete" | "deprovision" | "invite" | "provision" | "reactivate" | "recordProfile" | "update" | "updateProfile";
+                }[];
                 readonly incoming: "0..*";
             };
             readonly constraints: Record<never, never>;
             readonly effectiveProperties: never;
         }>;
+        readonly Role: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+            readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+            readonly inheritance: "final";
+            readonly abstract: false;
+            readonly description: "A Role the Shell declares.";
+            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Role">];
+            readonly policies: {
+                readonly read: ({ anyOf, check, ref, self }: import("@astrale-os/sdk/schema").ClassRuleContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").ClassRuleObject>;
+                readonly traverse: true;
+            };
+        }>;
         readonly Namespace: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly policies: {
@@ -328,13 +1184,9 @@ declare const input: {
             readonly extends: readonly [];
             readonly properties: never;
             readonly source: {
-                readonly as: "holder";
-                readonly accepts: readonly (() => {
-                    readonly kind: 'node';
-                    readonly abstract: never;
-                    readonly depth: never;
-                    readonly properties: never;
-                    readonly methods: never;
+                readonly as: "audience";
+                readonly accepts: readonly (import("@astrale-os/sdk/schema").ClassRef<"Identity"> & {
+                    readonly origin: "kernel.astrale.ai";
                 })[];
                 readonly outgoing: "0..*";
             };
@@ -368,7 +1220,27 @@ declare const input: {
             }[];
         }, {
             readonly mode: 'value';
-            readonly value: Record<string, never>;
+            readonly value: Record<string, never>;
+        }, "authorized", false, false, undefined, undefined>>;
+        readonly legacyMigrateAccounts: import("@astrale-os/sdk/schema").Function<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: {
+                migrated: number;
+                conflicts: {
+                    user: string;
+                    email: string;
+                }[];
+                profiles: number;
+            };
+        }, "authorized", false, false, undefined, undefined>>;
+        readonly disconnectDirectory: import("@astrale-os/sdk/schema").Function<import("@astrale-os/sdk/schema").CallableProjection<{
+            directory: string;
+        }, {
+            readonly mode: 'value';
+            readonly value: {
+                users: number;
+                groups: number;
+            };
         }, "authorized", false, false, undefined, undefined>>;
     };
     readonly policies: {
@@ -377,17 +1249,35 @@ declare const input: {
         readonly administersShellClass: import("@astrale-os/sdk/schema").Policy;
         readonly usesFunction: import("@astrale-os/sdk/schema").Policy;
         readonly isSelf: import("@astrale-os/sdk/schema").Policy;
+        readonly legacyOwnsMembershipGroup: import("@astrale-os/sdk/schema").Policy;
+        readonly hasRole: import("@astrale-os/sdk/schema").Policy;
+        readonly holdsViewAccess: import("@astrale-os/sdk/schema").Policy;
+        readonly describesSubject: import("@astrale-os/sdk/schema").Policy;
+        readonly isProfileSource: import("@astrale-os/sdk/schema").Policy;
+        readonly describesGroupOfSubject: import("@astrale-os/sdk/schema").Policy;
+        readonly isGroupProfileSource: import("@astrale-os/sdk/schema").Policy;
     };
     readonly views: {
         readonly application: import("@astrale-os/sdk/schema").View;
     };
     readonly core: {
         readonly nodes: {
+            readonly 'workspace.member': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'workspace.admin': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'user.reader': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'user.writer': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'group.reader': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'group.writer': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'directory.provisioner': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'user-profile.reader': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'user-profile.self-writer': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'group-profile.reader': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'os.viewer': import("@astrale-os/sdk/schema").CoreNode;
             readonly admin: import("@astrale-os/sdk/schema").CoreNode;
-            readonly applications: import("@astrale-os/sdk/schema").CoreNode;
             readonly member: import("@astrale-os/sdk/schema").CoreNode;
-            readonly views: import("@astrale-os/sdk/schema").CoreNode;
+            readonly applications: import("@astrale-os/sdk/schema").CoreNode;
             readonly 'view-only': import("@astrale-os/sdk/schema").CoreNode;
+            readonly views: import("@astrale-os/sdk/schema").CoreNode;
         };
     };
 };
@@ -396,22 +1286,120 @@ export declare const ShellSchema: import("@astrale-os/sdk/schema").AuthoredSchem
     readonly name: 'Shell';
     readonly entrypoint: 'application';
     readonly classes: {
+        readonly member_of_group: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+            readonly depth: 0;
+            readonly abstract: false;
+            readonly extends: readonly [];
+            readonly properties: never;
+            readonly source: {
+                readonly as: "member";
+                readonly accepts: readonly (() => {
+                    readonly kind: 'node';
+                    readonly abstract: never;
+                    readonly depth: never;
+                    readonly properties: never;
+                    readonly methods: never;
+                })[];
+                readonly outgoing: "0..*";
+            };
+            readonly target: {
+                readonly as: "group";
+                readonly accepts: readonly (() => {
+                    readonly kind: 'node';
+                    readonly abstract: never;
+                    readonly depth: never;
+                    readonly properties: never;
+                    readonly methods: never;
+                })[];
+                readonly incoming: "0..*";
+            };
+            readonly constraints: Record<never, never>;
+            readonly effectiveProperties: never;
+        }>;
         readonly User: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly inheritance: "open";
-            readonly policies: {
-                readonly read: true;
-            };
-            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">];
+            readonly abstract: false;
+            readonly description: "The account of one person in the workspace.";
+            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Iconable">];
             readonly properties: {
                 readonly creationKey: import("zod").ZodOptional<import("zod").ZodString>;
                 readonly claimedEmail: import("zod").ZodOptional<import("zod").ZodString>;
                 readonly claimedName: import("zod").ZodOptional<import("zod").ZodString>;
+                readonly suspended: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                readonly directoryActive: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                readonly name: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 100;
+                }, {
+                    readonly required: false;
+                }>;
+                readonly email: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "string";
+                    readonly minLength: 3;
+                    readonly maxLength: 320;
+                }, {
+                    readonly required: false;
+                }>;
+                readonly givenName: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: number;
+                }, {
+                    readonly required: false;
+                }>;
+                readonly familyName: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: number;
+                }, {
+                    readonly required: false;
+                }>;
+                readonly directory: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: number;
+                }, {
+                    readonly required: false;
+                }>;
+                readonly externalId: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: number;
+                }, {
+                    readonly required: false;
+                }>;
+                readonly attributes: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "object";
+                    readonly additionalProperties: true;
+                    readonly maxProperties: 64;
+                }, {
+                    readonly required: false;
+                }>;
+            };
+            readonly policies: {
+                readonly read: true;
+                readonly traverse: true;
             };
             readonly methods: {
+                readonly create: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    email: string;
+                    name: string;
+                    givenName?: string | undefined;
+                    familyName?: string | undefined;
+                    attributes?: Record<string, unknown> | undefined;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        user: string;
+                        created: boolean;
+                    };
+                }, "authorized", true, false, undefined, undefined>>;
                 readonly invite: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    email?: string | undefined;
                     user: string;
-                    email: string;
+                    profile?: "admin" | "member" | undefined;
                 }, {
                     readonly mode: 'value';
                     readonly value: {
@@ -420,6 +1408,59 @@ export declare const ShellSchema: import("@astrale-os/sdk/schema").AuthoredSchem
                         state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
                     };
                 }, "authorized", true, false, undefined, undefined>>;
+                readonly update: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    name?: string | undefined;
+                    email?: string | undefined;
+                    givenName?: string | null | undefined;
+                    familyName?: string | null | undefined;
+                    icon?: string | null | undefined;
+                    attributes?: Record<string, unknown> | null | undefined;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly updateProfile: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    name?: string | undefined;
+                    icon?: string | null | undefined;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly deactivate: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly reactivate: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly delete: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly provision: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    directory: string;
+                    externalId: string;
+                    email: string;
+                    name: string;
+                    givenName?: string | undefined;
+                    familyName?: string | undefined;
+                    active: boolean;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        user: string;
+                        created: boolean;
+                        adopted: boolean;
+                    };
+                }, "authorized", true, false, undefined, undefined>>;
+                readonly deprovision: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    directory: string;
+                    externalId: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", true, false, undefined, undefined>>;
                 readonly recordProfile: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
                     email?: string | undefined;
                     displayName?: string | undefined;
@@ -429,14 +1470,129 @@ export declare const ShellSchema: import("@astrale-os/sdk/schema").AuthoredSchem
                 }, "authorized", false, false, undefined, undefined>>;
             };
         }>;
+        readonly UserProfile: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+            readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+            readonly inheritance: "final";
+            readonly abstract: false;
+            readonly description: "What others see of a person: name and email.";
+            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Named">];
+            readonly properties: {
+                givenName: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: number;
+                }, {
+                    readonly required: false;
+                }>;
+                familyName: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: number;
+                }, {
+                    readonly required: false;
+                }>;
+                email: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "string";
+                    readonly minLength: 3;
+                    readonly maxLength: 100;
+                }, {
+                    readonly required: false;
+                }>;
+            };
+            readonly unique: readonly [readonly ["email"]];
+            readonly policies: {
+                readonly read: ({ anyOf, check, ref, self }: import("@astrale-os/sdk/schema").ClassRuleContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").ClassRuleObject>;
+                readonly traverse: true;
+            };
+        }>;
+        readonly user_profile: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+            readonly depth: 0;
+            readonly abstract: false;
+            readonly extends: readonly [];
+            readonly properties: never;
+            readonly source: {
+                readonly as: "user";
+                readonly accepts: readonly {
+                    readonly kind: 'node';
+                    readonly abstract: false;
+                    readonly depth: 1;
+                    readonly properties: "attributes" | "claimedEmail" | "claimedName" | "creationKey" | "directory" | "directoryActive" | "email" | "externalId" | "familyName" | "frozen" | "givenName" | "icon" | "iss" | "name" | "sub" | "suspended";
+                    readonly methods: "create" | "deactivate" | "delete" | "deprovision" | "invite" | "provision" | "reactivate" | "recordProfile" | "update" | "updateProfile";
+                }[];
+                readonly outgoing: "0..1";
+            };
+            readonly target: {
+                readonly as: "profile";
+                readonly accepts: readonly {
+                    readonly kind: 'node';
+                    readonly abstract: false;
+                    readonly depth: 1;
+                    readonly properties: "email" | "familyName" | "givenName" | "name";
+                    readonly methods: never;
+                }[];
+                readonly incoming: "0..1";
+            };
+            readonly constraints: Record<never, never>;
+            readonly effectiveProperties: never;
+        }>;
         readonly Group: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly inheritance: "open";
+            readonly abstract: false;
+            readonly description: "A set of accounts and groups; its members hold what it holds.";
+            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">, import("@astrale-os/sdk/schema").KernelClass<"Iconable">];
+            readonly properties: {
+                directory: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: 200;
+                }, {
+                    readonly required: false;
+                }>;
+                externalId: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: 200;
+                }, {
+                    readonly required: false;
+                }>;
+                attributes: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "object";
+                    readonly additionalProperties: true;
+                    readonly maxProperties: 64;
+                }, {
+                    readonly required: false;
+                }>;
+            };
             readonly policies: {
                 readonly read: true;
+                readonly traverse: true;
             };
-            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
             readonly methods: {
+                readonly create: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    name: string;
+                    description?: string | undefined;
+                    icon?: string | null | undefined;
+                    attributes?: Record<string, unknown> | undefined;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        group: string;
+                    };
+                }, "authorized", true, false, undefined, undefined>>;
+                readonly update: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    name?: string | undefined;
+                    description?: string | null | undefined;
+                    icon?: string | null | undefined;
+                    attributes?: Record<string, unknown> | null | undefined;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly delete: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
                 readonly assignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
                     member: string;
                     group: string;
@@ -451,38 +1607,202 @@ export declare const ShellSchema: import("@astrale-os/sdk/schema").AuthoredSchem
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
                 }, "authorized", true, false, undefined, undefined>>;
+                readonly assignMembers: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    members: string[];
+                    group: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", true, false, undefined, undefined>>;
+                readonly unassignMembers: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    members: string[];
+                    group: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", true, false, undefined, undefined>>;
+                readonly provision: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    directory: string;
+                    externalId: string;
+                    name: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        group: string;
+                        created: boolean;
+                    };
+                }, "authorized", true, false, undefined, undefined>>;
+                readonly deprovision: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    directory: string;
+                    externalId: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", true, false, undefined, undefined>>;
             };
         }>;
-        readonly member_of_group: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+        readonly GroupProfile: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+            readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+            readonly inheritance: "final";
+            readonly abstract: false;
+            readonly description: "What others see of a group: name and description.";
+            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
+            readonly policies: {
+                readonly read: ({ anyOf, check, ref, self }: import("@astrale-os/sdk/schema").ClassRuleContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").ClassRuleObject>;
+                readonly traverse: true;
+            };
+        }>;
+        readonly group_profile: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
             readonly depth: 0;
             readonly abstract: false;
             readonly extends: readonly [];
             readonly properties: never;
             readonly source: {
-                readonly as: "member";
-                readonly accepts: readonly (() => {
+                readonly as: "group";
+                readonly accepts: readonly {
                     readonly kind: 'node';
-                    readonly abstract: never;
-                    readonly depth: never;
-                    readonly properties: never;
-                    readonly methods: never;
-                })[];
-                readonly outgoing: "0..*";
+                    readonly abstract: false;
+                    readonly depth: 1;
+                    readonly properties: "attributes" | "description" | "directory" | "externalId" | "frozen" | "icon" | "iss" | "name" | "sub";
+                    readonly methods: "assignMember" | "assignMembers" | "create" | "delete" | "deprovision" | "provision" | "unassignMember" | "unassignMembers" | "update";
+                }[];
+                readonly outgoing: "0..1";
             };
             readonly target: {
-                readonly as: "group";
-                readonly accepts: readonly (() => {
+                readonly as: "profile";
+                readonly accepts: readonly {
                     readonly kind: 'node';
-                    readonly abstract: never;
-                    readonly depth: never;
-                    readonly properties: never;
+                    readonly abstract: false;
+                    readonly depth: 1;
+                    readonly properties: "description" | "name";
                     readonly methods: never;
-                })[];
+                }[];
+                readonly incoming: "0..1";
+            };
+            readonly constraints: Record<never, never>;
+            readonly effectiveProperties: never;
+        }>;
+        readonly Invitation: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+            readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+            readonly inheritance: "final";
+            readonly abstract: false;
+            readonly description: "One invitation of an account, until it is accepted, cancelled or expired.";
+            readonly properties: {
+                status: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "string";
+                    readonly enum: readonly ["pending", "accepted", "cancelled", "expired"];
+                }, {
+                    readonly required?: boolean;
+                    readonly description?: string;
+                    readonly immutable?: import("@astrale-os/sdk/schema").PropertyImmutability;
+                }>;
+                expiresAt: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "string";
+                    readonly minLength: 20;
+                    readonly maxLength: 40;
+                }, {
+                    readonly required?: boolean;
+                    readonly description?: string;
+                    readonly immutable?: import("@astrale-os/sdk/schema").PropertyImmutability;
+                }>;
+                execution: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 200;
+                }, {
+                    readonly required?: boolean;
+                    readonly description?: string;
+                    readonly immutable?: import("@astrale-os/sdk/schema").PropertyImmutability;
+                }>;
+                round: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                }, {
+                    readonly required?: boolean;
+                    readonly description?: string;
+                    readonly immutable?: import("@astrale-os/sdk/schema").PropertyImmutability;
+                }>;
+                email: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "string";
+                    readonly minLength: 3;
+                    readonly maxLength: 320;
+                }, {
+                    readonly required: false;
+                }>;
+            };
+            readonly policies: {
+                readonly read: ({ check, ref }: import("@astrale-os/sdk/schema").ClassRuleContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").ClassRuleObject>;
+                readonly traverse: true;
+            };
+            readonly methods: {
+                readonly send: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    user: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        status: "accepted" | "cancelled" | "expired" | "pending";
+                    };
+                }, "authorized", true, false, {
+                    readonly durable: true;
+                }, undefined>>;
+                readonly resend: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly cancel: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly accept: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    iss: string;
+                    sub: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+            };
+        }>;
+        readonly invitation_user: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+            readonly depth: 0;
+            readonly abstract: false;
+            readonly extends: readonly [];
+            readonly properties: never;
+            readonly source: {
+                readonly as: "invitation";
+                readonly accepts: readonly {
+                    readonly kind: 'node';
+                    readonly abstract: false;
+                    readonly depth: 0;
+                    readonly properties: "email" | "execution" | "expiresAt" | "round" | "status";
+                    readonly methods: "accept" | "cancel" | "resend" | "send";
+                }[];
+                readonly outgoing: "0..1";
+            };
+            readonly target: {
+                readonly as: "user";
+                readonly accepts: readonly {
+                    readonly kind: 'node';
+                    readonly abstract: false;
+                    readonly depth: 1;
+                    readonly properties: "attributes" | "claimedEmail" | "claimedName" | "creationKey" | "directory" | "directoryActive" | "email" | "externalId" | "familyName" | "frozen" | "givenName" | "icon" | "iss" | "name" | "sub" | "suspended";
+                    readonly methods: "create" | "deactivate" | "delete" | "deprovision" | "invite" | "provision" | "reactivate" | "recordProfile" | "update" | "updateProfile";
+                }[];
                 readonly incoming: "0..*";
             };
             readonly constraints: Record<never, never>;
             readonly effectiveProperties: never;
         }>;
+        readonly Role: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+            readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+            readonly inheritance: "final";
+            readonly abstract: false;
+            readonly description: "A Role the Shell declares.";
+            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Role">];
+            readonly policies: {
+                readonly read: ({ anyOf, check, ref, self }: import("@astrale-os/sdk/schema").ClassRuleContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").ClassRuleObject>;
+                readonly traverse: true;
+            };
+        }>;
         readonly Namespace: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly policies: {
@@ -545,13 +1865,9 @@ export declare const ShellSchema: import("@astrale-os/sdk/schema").AuthoredSchem
             readonly extends: readonly [];
             readonly properties: never;
             readonly source: {
-                readonly as: "holder";
-                readonly accepts: readonly (() => {
-                    readonly kind: 'node';
-                    readonly abstract: never;
-                    readonly depth: never;
-                    readonly properties: never;
-                    readonly methods: never;
+                readonly as: "audience";
+                readonly accepts: readonly (import("@astrale-os/sdk/schema").ClassRef<"Identity"> & {
+                    readonly origin: "kernel.astrale.ai";
                 })[];
                 readonly outgoing: "0..*";
             };
@@ -587,6 +1903,26 @@ export declare const ShellSchema: import("@astrale-os/sdk/schema").AuthoredSchem
             readonly mode: 'value';
             readonly value: Record<string, never>;
         }, "authorized", false, false, undefined, undefined>>;
+        readonly legacyMigrateAccounts: import("@astrale-os/sdk/schema").Function<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: {
+                migrated: number;
+                conflicts: {
+                    user: string;
+                    email: string;
+                }[];
+                profiles: number;
+            };
+        }, "authorized", false, false, undefined, undefined>>;
+        readonly disconnectDirectory: import("@astrale-os/sdk/schema").Function<import("@astrale-os/sdk/schema").CallableProjection<{
+            directory: string;
+        }, {
+            readonly mode: 'value';
+            readonly value: {
+                users: number;
+                groups: number;
+            };
+        }, "authorized", false, false, undefined, undefined>>;
     };
     readonly policies: {
         readonly belongsToGroup: import("@astrale-os/sdk/schema").Policy;
@@ -594,17 +1930,35 @@ export declare const ShellSchema: import("@astrale-os/sdk/schema").AuthoredSchem
         readonly administersShellClass: import("@astrale-os/sdk/schema").Policy;
         readonly usesFunction: import("@astrale-os/sdk/schema").Policy;
         readonly isSelf: import("@astrale-os/sdk/schema").Policy;
+        readonly legacyOwnsMembershipGroup: import("@astrale-os/sdk/schema").Policy;
+        readonly hasRole: import("@astrale-os/sdk/schema").Policy;
+        readonly holdsViewAccess: import("@astrale-os/sdk/schema").Policy;
+        readonly describesSubject: import("@astrale-os/sdk/schema").Policy;
+        readonly isProfileSource: import("@astrale-os/sdk/schema").Policy;
+        readonly describesGroupOfSubject: import("@astrale-os/sdk/schema").Policy;
+        readonly isGroupProfileSource: import("@astrale-os/sdk/schema").Policy;
     };
     readonly views: {
         readonly application: import("@astrale-os/sdk/schema").View;
     };
     readonly core: {
         readonly nodes: {
+            readonly 'workspace.member': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'workspace.admin': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'user.reader': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'user.writer': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'group.reader': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'group.writer': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'directory.provisioner': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'user-profile.reader': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'user-profile.self-writer': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'group-profile.reader': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'os.viewer': import("@astrale-os/sdk/schema").CoreNode;
             readonly admin: import("@astrale-os/sdk/schema").CoreNode;
-            readonly applications: import("@astrale-os/sdk/schema").CoreNode;
             readonly member: import("@astrale-os/sdk/schema").CoreNode;
-            readonly views: import("@astrale-os/sdk/schema").CoreNode;
+            readonly applications: import("@astrale-os/sdk/schema").CoreNode;
             readonly 'view-only': import("@astrale-os/sdk/schema").CoreNode;
+            readonly views: import("@astrale-os/sdk/schema").CoreNode;
         };
     };
 }, {
@@ -615,22 +1969,120 @@ export declare const S: schema.ResolvedDomainOf<import("@astrale-os/sdk/schema")
     readonly name: 'Shell';
     readonly entrypoint: 'application';
     readonly classes: {
+        readonly member_of_group: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+            readonly depth: 0;
+            readonly abstract: false;
+            readonly extends: readonly [];
+            readonly properties: never;
+            readonly source: {
+                readonly as: "member";
+                readonly accepts: readonly (() => {
+                    readonly kind: 'node';
+                    readonly abstract: never;
+                    readonly depth: never;
+                    readonly properties: never;
+                    readonly methods: never;
+                })[];
+                readonly outgoing: "0..*";
+            };
+            readonly target: {
+                readonly as: "group";
+                readonly accepts: readonly (() => {
+                    readonly kind: 'node';
+                    readonly abstract: never;
+                    readonly depth: never;
+                    readonly properties: never;
+                    readonly methods: never;
+                })[];
+                readonly incoming: "0..*";
+            };
+            readonly constraints: Record<never, never>;
+            readonly effectiveProperties: never;
+        }>;
         readonly User: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly inheritance: "open";
-            readonly policies: {
-                readonly read: true;
-            };
-            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">];
+            readonly abstract: false;
+            readonly description: "The account of one person in the workspace.";
+            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Iconable">];
             readonly properties: {
                 readonly creationKey: import("zod").ZodOptional<import("zod").ZodString>;
                 readonly claimedEmail: import("zod").ZodOptional<import("zod").ZodString>;
                 readonly claimedName: import("zod").ZodOptional<import("zod").ZodString>;
+                readonly suspended: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                readonly directoryActive: import("zod").ZodOptional<import("zod").ZodBoolean>;
+                readonly name: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 100;
+                }, {
+                    readonly required: false;
+                }>;
+                readonly email: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "string";
+                    readonly minLength: 3;
+                    readonly maxLength: 320;
+                }, {
+                    readonly required: false;
+                }>;
+                readonly givenName: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: number;
+                }, {
+                    readonly required: false;
+                }>;
+                readonly familyName: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: number;
+                }, {
+                    readonly required: false;
+                }>;
+                readonly directory: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: number;
+                }, {
+                    readonly required: false;
+                }>;
+                readonly externalId: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: number;
+                }, {
+                    readonly required: false;
+                }>;
+                readonly attributes: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "object";
+                    readonly additionalProperties: true;
+                    readonly maxProperties: 64;
+                }, {
+                    readonly required: false;
+                }>;
+            };
+            readonly policies: {
+                readonly read: true;
+                readonly traverse: true;
             };
             readonly methods: {
+                readonly create: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    email: string;
+                    name: string;
+                    givenName?: string | undefined;
+                    familyName?: string | undefined;
+                    attributes?: Record<string, unknown> | undefined;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        user: string;
+                        created: boolean;
+                    };
+                }, "authorized", true, false, undefined, undefined>>;
                 readonly invite: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    email?: string | undefined;
                     user: string;
-                    email: string;
+                    profile?: "admin" | "member" | undefined;
                 }, {
                     readonly mode: 'value';
                     readonly value: {
@@ -639,6 +2091,59 @@ export declare const S: schema.ResolvedDomainOf<import("@astrale-os/sdk/schema")
                         state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
                     };
                 }, "authorized", true, false, undefined, undefined>>;
+                readonly update: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    name?: string | undefined;
+                    email?: string | undefined;
+                    givenName?: string | null | undefined;
+                    familyName?: string | null | undefined;
+                    icon?: string | null | undefined;
+                    attributes?: Record<string, unknown> | null | undefined;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly updateProfile: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    name?: string | undefined;
+                    icon?: string | null | undefined;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly deactivate: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly reactivate: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly delete: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly provision: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    directory: string;
+                    externalId: string;
+                    email: string;
+                    name: string;
+                    givenName?: string | undefined;
+                    familyName?: string | undefined;
+                    active: boolean;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        user: string;
+                        created: boolean;
+                        adopted: boolean;
+                    };
+                }, "authorized", true, false, undefined, undefined>>;
+                readonly deprovision: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    directory: string;
+                    externalId: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", true, false, undefined, undefined>>;
                 readonly recordProfile: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
                     email?: string | undefined;
                     displayName?: string | undefined;
@@ -648,14 +2153,129 @@ export declare const S: schema.ResolvedDomainOf<import("@astrale-os/sdk/schema")
                 }, "authorized", false, false, undefined, undefined>>;
             };
         }>;
+        readonly UserProfile: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+            readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+            readonly inheritance: "final";
+            readonly abstract: false;
+            readonly description: "What others see of a person: name and email.";
+            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Named">];
+            readonly properties: {
+                givenName: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: number;
+                }, {
+                    readonly required: false;
+                }>;
+                familyName: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: number;
+                }, {
+                    readonly required: false;
+                }>;
+                email: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "string";
+                    readonly minLength: 3;
+                    readonly maxLength: 100;
+                }, {
+                    readonly required: false;
+                }>;
+            };
+            readonly unique: readonly [readonly ["email"]];
+            readonly policies: {
+                readonly read: ({ anyOf, check, ref, self }: import("@astrale-os/sdk/schema").ClassRuleContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").ClassRuleObject>;
+                readonly traverse: true;
+            };
+        }>;
+        readonly user_profile: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+            readonly depth: 0;
+            readonly abstract: false;
+            readonly extends: readonly [];
+            readonly properties: never;
+            readonly source: {
+                readonly as: "user";
+                readonly accepts: readonly {
+                    readonly kind: 'node';
+                    readonly abstract: false;
+                    readonly depth: 1;
+                    readonly properties: "attributes" | "claimedEmail" | "claimedName" | "creationKey" | "directory" | "directoryActive" | "email" | "externalId" | "familyName" | "frozen" | "givenName" | "icon" | "iss" | "name" | "sub" | "suspended";
+                    readonly methods: "create" | "deactivate" | "delete" | "deprovision" | "invite" | "provision" | "reactivate" | "recordProfile" | "update" | "updateProfile";
+                }[];
+                readonly outgoing: "0..1";
+            };
+            readonly target: {
+                readonly as: "profile";
+                readonly accepts: readonly {
+                    readonly kind: 'node';
+                    readonly abstract: false;
+                    readonly depth: 1;
+                    readonly properties: "email" | "familyName" | "givenName" | "name";
+                    readonly methods: never;
+                }[];
+                readonly incoming: "0..1";
+            };
+            readonly constraints: Record<never, never>;
+            readonly effectiveProperties: never;
+        }>;
         readonly Group: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly inheritance: "open";
+            readonly abstract: false;
+            readonly description: "A set of accounts and groups; its members hold what it holds.";
+            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">, import("@astrale-os/sdk/schema").KernelClass<"Iconable">];
+            readonly properties: {
+                directory: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: 200;
+                }, {
+                    readonly required: false;
+                }>;
+                externalId: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: 'string';
+                    readonly minLength: 1;
+                    readonly maxLength: 200;
+                }, {
+                    readonly required: false;
+                }>;
+                attributes: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "object";
+                    readonly additionalProperties: true;
+                    readonly maxProperties: 64;
+                }, {
+                    readonly required: false;
+                }>;
+            };
             readonly policies: {
                 readonly read: true;
+                readonly traverse: true;
             };
-            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
             readonly methods: {
+                readonly create: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    name: string;
+                    description?: string | undefined;
+                    icon?: string | null | undefined;
+                    attributes?: Record<string, unknown> | undefined;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        group: string;
+                    };
+                }, "authorized", true, false, undefined, undefined>>;
+                readonly update: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    name?: string | undefined;
+                    description?: string | null | undefined;
+                    icon?: string | null | undefined;
+                    attributes?: Record<string, unknown> | null | undefined;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly delete: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
                 readonly assignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
                     member: string;
                     group: string;
@@ -670,38 +2290,202 @@ export declare const S: schema.ResolvedDomainOf<import("@astrale-os/sdk/schema")
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
                 }, "authorized", true, false, undefined, undefined>>;
+                readonly assignMembers: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    members: string[];
+                    group: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", true, false, undefined, undefined>>;
+                readonly unassignMembers: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    members: string[];
+                    group: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", true, false, undefined, undefined>>;
+                readonly provision: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    directory: string;
+                    externalId: string;
+                    name: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        group: string;
+                        created: boolean;
+                    };
+                }, "authorized", true, false, undefined, undefined>>;
+                readonly deprovision: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    directory: string;
+                    externalId: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", true, false, undefined, undefined>>;
             };
         }>;
-        readonly member_of_group: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+        readonly GroupProfile: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+            readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+            readonly inheritance: "final";
+            readonly abstract: false;
+            readonly description: "What others see of a group: name and description.";
+            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
+            readonly policies: {
+                readonly read: ({ anyOf, check, ref, self }: import("@astrale-os/sdk/schema").ClassRuleContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").ClassRuleObject>;
+                readonly traverse: true;
+            };
+        }>;
+        readonly group_profile: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
             readonly depth: 0;
             readonly abstract: false;
             readonly extends: readonly [];
             readonly properties: never;
             readonly source: {
-                readonly as: "member";
-                readonly accepts: readonly (() => {
+                readonly as: "group";
+                readonly accepts: readonly {
                     readonly kind: 'node';
-                    readonly abstract: never;
-                    readonly depth: never;
-                    readonly properties: never;
-                    readonly methods: never;
-                })[];
-                readonly outgoing: "0..*";
+                    readonly abstract: false;
+                    readonly depth: 1;
+                    readonly properties: "attributes" | "description" | "directory" | "externalId" | "frozen" | "icon" | "iss" | "name" | "sub";
+                    readonly methods: "assignMember" | "assignMembers" | "create" | "delete" | "deprovision" | "provision" | "unassignMember" | "unassignMembers" | "update";
+                }[];
+                readonly outgoing: "0..1";
             };
             readonly target: {
-                readonly as: "group";
-                readonly accepts: readonly (() => {
+                readonly as: "profile";
+                readonly accepts: readonly {
                     readonly kind: 'node';
-                    readonly abstract: never;
-                    readonly depth: never;
-                    readonly properties: never;
+                    readonly abstract: false;
+                    readonly depth: 1;
+                    readonly properties: "description" | "name";
                     readonly methods: never;
-                })[];
+                }[];
+                readonly incoming: "0..1";
+            };
+            readonly constraints: Record<never, never>;
+            readonly effectiveProperties: never;
+        }>;
+        readonly Invitation: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+            readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+            readonly inheritance: "final";
+            readonly abstract: false;
+            readonly description: "One invitation of an account, until it is accepted, cancelled or expired.";
+            readonly properties: {
+                status: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "string";
+                    readonly enum: readonly ["pending", "accepted", "cancelled", "expired"];
+                }, {
+                    readonly required?: boolean;
+                    readonly description?: string;
+                    readonly immutable?: import("@astrale-os/sdk/schema").PropertyImmutability;
+                }>;
+                expiresAt: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "string";
+                    readonly minLength: 20;
+                    readonly maxLength: 40;
+                }, {
+                    readonly required?: boolean;
+                    readonly description?: string;
+                    readonly immutable?: import("@astrale-os/sdk/schema").PropertyImmutability;
+                }>;
+                execution: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "string";
+                    readonly minLength: 1;
+                    readonly maxLength: 200;
+                }, {
+                    readonly required?: boolean;
+                    readonly description?: string;
+                    readonly immutable?: import("@astrale-os/sdk/schema").PropertyImmutability;
+                }>;
+                round: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "integer";
+                    readonly minimum: 0;
+                }, {
+                    readonly required?: boolean;
+                    readonly description?: string;
+                    readonly immutable?: import("@astrale-os/sdk/schema").PropertyImmutability;
+                }>;
+                email: import("@astrale-os/sdk/schema").AuthoredProperty<{
+                    readonly type: "string";
+                    readonly minLength: 3;
+                    readonly maxLength: 320;
+                }, {
+                    readonly required: false;
+                }>;
+            };
+            readonly policies: {
+                readonly read: ({ check, ref }: import("@astrale-os/sdk/schema").ClassRuleContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").ClassRuleObject>;
+                readonly traverse: true;
+            };
+            readonly methods: {
+                readonly send: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    user: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        status: "accepted" | "cancelled" | "expired" | "pending";
+                    };
+                }, "authorized", true, false, {
+                    readonly durable: true;
+                }, undefined>>;
+                readonly resend: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly cancel: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+                readonly accept: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    iss: string;
+                    sub: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", false, false, undefined, undefined>>;
+            };
+        }>;
+        readonly invitation_user: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+            readonly depth: 0;
+            readonly abstract: false;
+            readonly extends: readonly [];
+            readonly properties: never;
+            readonly source: {
+                readonly as: "invitation";
+                readonly accepts: readonly {
+                    readonly kind: 'node';
+                    readonly abstract: false;
+                    readonly depth: 0;
+                    readonly properties: "email" | "execution" | "expiresAt" | "round" | "status";
+                    readonly methods: "accept" | "cancel" | "resend" | "send";
+                }[];
+                readonly outgoing: "0..1";
+            };
+            readonly target: {
+                readonly as: "user";
+                readonly accepts: readonly {
+                    readonly kind: 'node';
+                    readonly abstract: false;
+                    readonly depth: 1;
+                    readonly properties: "attributes" | "claimedEmail" | "claimedName" | "creationKey" | "directory" | "directoryActive" | "email" | "externalId" | "familyName" | "frozen" | "givenName" | "icon" | "iss" | "name" | "sub" | "suspended";
+                    readonly methods: "create" | "deactivate" | "delete" | "deprovision" | "invite" | "provision" | "reactivate" | "recordProfile" | "update" | "updateProfile";
+                }[];
                 readonly incoming: "0..*";
             };
             readonly constraints: Record<never, never>;
             readonly effectiveProperties: never;
         }>;
+        readonly Role: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+            readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+            readonly inheritance: "final";
+            readonly abstract: false;
+            readonly description: "A Role the Shell declares.";
+            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Role">];
+            readonly policies: {
+                readonly read: ({ anyOf, check, ref, self }: import("@astrale-os/sdk/schema").ClassRuleContext) => import("@astrale-os/sdk/schema").PolicyCheckExpression<import("@astrale-os/sdk/schema").PolicyRef, import("@astrale-os/sdk/schema").ClassRuleObject>;
+                readonly traverse: true;
+            };
+        }>;
         readonly Namespace: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly policies: {
@@ -764,13 +2548,9 @@ export declare const S: schema.ResolvedDomainOf<import("@astrale-os/sdk/schema")
             readonly extends: readonly [];
             readonly properties: never;
             readonly source: {
-                readonly as: "holder";
-                readonly accepts: readonly (() => {
-                    readonly kind: 'node';
-                    readonly abstract: never;
-                    readonly depth: never;
-                    readonly properties: never;
-                    readonly methods: never;
+                readonly as: "audience";
+                readonly accepts: readonly (import("@astrale-os/sdk/schema").ClassRef<"Identity"> & {
+                    readonly origin: "kernel.astrale.ai";
                 })[];
                 readonly outgoing: "0..*";
             };
@@ -806,6 +2586,26 @@ export declare const S: schema.ResolvedDomainOf<import("@astrale-os/sdk/schema")
             readonly mode: 'value';
             readonly value: Record<string, never>;
         }, "authorized", false, false, undefined, undefined>>;
+        readonly legacyMigrateAccounts: import("@astrale-os/sdk/schema").Function<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: {
+                migrated: number;
+                conflicts: {
+                    user: string;
+                    email: string;
+                }[];
+                profiles: number;
+            };
+        }, "authorized", false, false, undefined, undefined>>;
+        readonly disconnectDirectory: import("@astrale-os/sdk/schema").Function<import("@astrale-os/sdk/schema").CallableProjection<{
+            directory: string;
+        }, {
+            readonly mode: 'value';
+            readonly value: {
+                users: number;
+                groups: number;
+            };
+        }, "authorized", false, false, undefined, undefined>>;
     };
     readonly policies: {
         readonly belongsToGroup: import("@astrale-os/sdk/schema").Policy;
@@ -813,17 +2613,35 @@ export declare const S: schema.ResolvedDomainOf<import("@astrale-os/sdk/schema")
         readonly administersShellClass: import("@astrale-os/sdk/schema").Policy;
         readonly usesFunction: import("@astrale-os/sdk/schema").Policy;
         readonly isSelf: import("@astrale-os/sdk/schema").Policy;
+        readonly legacyOwnsMembershipGroup: import("@astrale-os/sdk/schema").Policy;
+        readonly hasRole: import("@astrale-os/sdk/schema").Policy;
+        readonly holdsViewAccess: import("@astrale-os/sdk/schema").Policy;
+        readonly describesSubject: import("@astrale-os/sdk/schema").Policy;
+        readonly isProfileSource: import("@astrale-os/sdk/schema").Policy;
+        readonly describesGroupOfSubject: import("@astrale-os/sdk/schema").Policy;
+        readonly isGroupProfileSource: import("@astrale-os/sdk/schema").Policy;
     };
     readonly views: {
         readonly application: import("@astrale-os/sdk/schema").View;
     };
     readonly core: {
         readonly nodes: {
+            readonly 'workspace.member': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'workspace.admin': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'user.reader': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'user.writer': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'group.reader': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'group.writer': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'directory.provisioner': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'user-profile.reader': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'user-profile.self-writer': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'group-profile.reader': import("@astrale-os/sdk/schema").CoreNode;
+            readonly 'os.viewer': import("@astrale-os/sdk/schema").CoreNode;
             readonly admin: import("@astrale-os/sdk/schema").CoreNode;
-            readonly applications: import("@astrale-os/sdk/schema").CoreNode;
             readonly member: import("@astrale-os/sdk/schema").CoreNode;
-            readonly views: import("@astrale-os/sdk/schema").CoreNode;
+            readonly applications: import("@astrale-os/sdk/schema").CoreNode;
             readonly 'view-only': import("@astrale-os/sdk/schema").CoreNode;
+            readonly views: import("@astrale-os/sdk/schema").CoreNode;
         };
     };
 }, {