@astrale-domains/shell 0.1.6 → 0.1.8

package/dist/providers/admin-enrollment/create-admin-enrollment-provider.js

@@ -1,8 +1,9 @@
 import { TransportError } from '@astrale-os/sdk/client';
 import { defineProvider } from '@astrale-os/sdk/integration';
 import { z } from 'zod';
-import { enrollment, InvitationRequestFailure } from '../../integrations/user-invitation/index.js';
+import { enrollment, InvitationRequestFailure, } from '../../integrations/user-invitation/index.js';
 import { decodeAdminInvitationResponse } from './decode-admin-invitation-response.js';
+import { legacySendWithoutProfile } from './legacy/index.js';
 import { readReply } from './read-enrollment-response.js';
 // Environment is a representation boundary, unlike already-admitted handler input.
 const configuration = z.object({ ENROLLMENT_INGRESS_URL: z.string().url() });
@@ -33,7 +34,7 @@ export function enrollmentProvider(environment) {
             }
             // No automatic HTTP retry. A timeout after send has an unknown effect.
             const signal = AbortSignal.any([execution.signal, AbortSignal.timeout(remaining)]);
-            const response = await fetch(audience, {
+            const send = (body) => fetch(audience, {
                 method: 'POST',
                 // Workers reject redirect:error before sending. Manual preserves the refusal:
                 // every 3xx is rejected below, without forwarding the proof to its Location.
@@ -44,7 +45,7 @@ export function enrollmentProvider(environment) {
                     Accept: 'application/json',
                     'Idempotency-Key': input.requestId,
                 },
-                body: JSON.stringify(input),
+                body: JSON.stringify(body),
                 signal,
             }).catch((cause) => {
                 if (!(cause instanceof TypeError) && !(cause instanceof DOMException))
@@ -54,6 +55,8 @@ export function enrollmentProvider(environment) {
                     delivery: 'unknown',
                 });
             });
+            // Seam L-SHELL-15: an Admin older than `profile` refuses the field; send it again without.
+            const response = await legacySendWithoutProfile(input, send);
             if (!response.ok) {
                 await response.body?.cancel();
                 if (response.status === 409)

package/dist/providers/admin-enrollment/legacy/index.js

@@ -0,0 +1 @@
+export { legacySendWithoutProfile } from './send-without-profile.js';

package/dist/providers/admin-enrollment/legacy/send-without-profile.js

@@ -0,0 +1,16 @@
+/**
+ * @deprecated Admin before profiles validates its invitation request strictly and refuses the
+ * `profile` field with 400: the request is sent once more without it, which Admin then admits
+ * (L-SHELL-15). A first 400 has no effect, so resending under the same idempotency key is safe.
+ * Replaced by one request carrying `profile`. Removal: Shell major (delivery step 5), once every
+ * Admin deployment admits `profile` (Admin delivery step 2).
+ */
+export async function legacySendWithoutProfile(request, send) {
+    const response = await send(request);
+    if (request.profile === undefined || (response.status !== 400 && response.status !== 422)) {
+        return response;
+    }
+    await response.body?.cancel();
+    const { profile: _profile, ...legacy } = request;
+    return send(legacy);
+}

package/dist/queries/application/legacy/index.js

@@ -0,0 +1 @@
+export { legacyReadInstalledEntrypoints } from './read-installed-entrypoints.js';

package/dist/queries/application/legacy/read-installed-entrypoints.js

@@ -0,0 +1,47 @@
+import { defineQuery, Query, queryResult, } from '@astrale-os/sdk/query';
+const VIEW_MEMBER = /^view\.([A-Za-z][A-Za-z0-9_]*)$/u;
+/**
+ * @deprecated The catalogue `listEntrypoints` answers (L-SHELL-11). Replaced by the visitor's own
+ * Query (V2). Removal: Shell major (delivery step 5) after 1Pact step 4.
+ *
+ * Every installed Domain entrypoint this authority can read, in origin order. The `of_domain`
+ * locator of a View that has an outgoing `entrypoint` Edge names that View (`view.<name>`), and its
+ * target is the Domain, whose Node carries the origin and the display name.
+ */
+export const legacyReadInstalledEntrypoints = defineQuery()((domain) => {
+    const kernel = domain.dependencies.kernel.classes;
+    return {
+        id: 'shell.application.entrypoints',
+        page: { size: 200 },
+        pagination: { maximumPages: 50 },
+        build: () => {
+            const located = Query.from({ edges: [kernel.of_domain] });
+            return located
+                .expand({ from: located.source, via: [kernel.entrypoint], direction: 'outgoing' })
+                .select({
+                kind: 'edges',
+                binding: located.edge,
+                projection: { edge: 'value', source: 'reference', target: 'value' },
+            });
+        },
+        project(pages) {
+            const entries = [];
+            for (const page of pages) {
+                for (const item of queryResult.edgeItems(page, 'Installed entrypoints')) {
+                    if (item.edge.kind !== 'value' || item.target.kind !== 'value') {
+                        throw new TypeError('Installed entrypoint is not a complete value.');
+                    }
+                    const member = VIEW_MEMBER.exec(String(item.edge.value.props[kernel.of_domain.properties.member.key]));
+                    const props = item.target.value.props;
+                    const origin = props[kernel.Domain.properties.origin.key];
+                    const name = props[kernel.Domain.properties.name.key];
+                    if (member === null || typeof origin !== 'string' || typeof name !== 'string') {
+                        throw new TypeError('Installed entrypoint has no View, origin, or name.');
+                    }
+                    entries.push({ origin, name, view: `${origin}:view.${member[1]}` });
+                }
+            }
+            return entries.sort((left, right) => left.origin.localeCompare(right.origin));
+        },
+    };
+});

package/dist/queries/composition/index.js

@@ -0,0 +1,2 @@
+export { readExtensions } from './read-extensions.js';
+export { readRoleKeys, readRoleNodes } from './read-role-nodes.js';

package/dist/queries/composition/read-extensions.js

@@ -0,0 +1,34 @@
+import { Path } from '@astrale-os/sdk/graph/path';
+import { defineQuery, Query, queryResult, } from '@astrale-os/sdk/query';
+/** The `extends_with` Edges at one frontier of a composition walk, read with Shell's authority. */
+export const readExtensions = defineQuery()((domain) => ({
+    id: 'shell.composition.extensions',
+    page: { size: 256 },
+    pagination: { maximumPages: 16 },
+    build({ identities, direction }) {
+        const walk = Query.from({
+            nodes: [Path.id(identities[0]), ...identities.slice(1).map((id) => Path.id(id))],
+        }).expand({ via: [domain.dependencies.kernel.classes.extends_with], direction });
+        return walk.select({
+            kind: 'edges',
+            binding: walk.edge,
+            projection: { edge: 'reference', source: 'reference', target: 'reference' },
+        });
+    },
+    project(pages) {
+        const extensions = [];
+        for (const page of pages) {
+            for (const item of queryResult.edgeItems(page, 'Shell composition')) {
+                if (item.source.kind !== 'reference' || item.target.kind !== 'reference')
+                    continue;
+                extensions.push({
+                    source: item.source.value.id,
+                    target: item.target.value.id,
+                    sourceClass: item.source.value.class,
+                    targetClass: item.target.value.class,
+                });
+            }
+        }
+        return extensions;
+    },
+}));

package/dist/queries/composition/read-role-nodes.js

@@ -0,0 +1,76 @@
+import { Path } from '@astrale-os/sdk/graph/path';
+import { defineQuery, Query, queryResult, } from '@astrale-os/sdk/query';
+const CORE = 'core.';
+/** Each Core Node of a Kernel Role Class, named by its `of_domain` locator. */
+export const readRoleNodes = defineQuery()((domain) => {
+    const kernel = domain.dependencies.kernel.classes;
+    const member = kernel.of_domain.properties.member.key;
+    const origin = kernel.Domain.properties.origin.key;
+    return {
+        id: 'shell.composition.roles',
+        page: { size: 256 },
+        pagination: { maximumPages: 16 },
+        build: () => {
+            const locator = Query.from({ nodes: [kernel.Role] }).expand({
+                via: [kernel.of_domain],
+                direction: 'outgoing',
+            });
+            return locator.select({
+                kind: 'edges',
+                binding: locator.edge,
+                projection: { edge: 'value', source: 'reference', target: 'value' },
+            });
+        },
+        project(pages) {
+            const byKey = new Map();
+            for (const [id, key] of roleKeys(pages, member, origin))
+                byKey.set(key, id);
+            return { byKey, ids: new Set(byKey.values()) };
+        },
+    };
+});
+/** Each Core Role in pages of `of_domain` Edges: its Node, and `<origin>:<Core key>`. */
+function roleKeys(pages, member, origin) {
+    const keys = new Map();
+    for (const page of pages) {
+        for (const item of queryResult.edgeItems(page, 'Shell Roles')) {
+            if (item.edge.kind !== 'value' || item.source.kind !== 'reference')
+                continue;
+            if (item.target.kind !== 'value')
+                continue;
+            const key = item.edge.value.props[member];
+            const owner = item.target.value.props[origin];
+            if (typeof key !== 'string' || !key.startsWith(CORE) || typeof owner !== 'string')
+                continue;
+            keys.set(item.source.value.id, `${owner}:${key.slice(CORE.length)}`);
+        }
+    }
+    return keys;
+}
+/**
+ * The Core Roles among some Identities, by `<origin>:<Core key>`: what one composition holds, read
+ * without the catalogue of every installed Role.
+ */
+export const readRoleKeys = defineQuery()((domain) => {
+    const kernel = domain.dependencies.kernel.classes;
+    const member = kernel.of_domain.properties.member.key;
+    const origin = kernel.Domain.properties.origin.key;
+    return {
+        id: 'shell.composition.role-keys',
+        page: { size: 256 },
+        pagination: { maximumPages: 16 },
+        build: ({ identities }) => {
+            const locator = Query.from({
+                nodes: [Path.id(identities[0]), ...identities.slice(1).map((id) => Path.id(id))],
+            })
+                .filter({ class: kernel.Role })
+                .expand({ via: [kernel.of_domain], direction: 'outgoing' });
+            return locator.select({
+                kind: 'edges',
+                binding: locator.edge,
+                projection: { edge: 'value', source: 'reference', target: 'value' },
+            });
+        },
+        project: (pages) => roleKeys(pages, member, origin),
+    };
+});

package/dist/queries/group/index.js

@@ -1,2 +1,3 @@
 export { readGroupMembership, } from './read-group-membership.js';
-export { readGroupMembershipEndpoints } from './read-group-membership-endpoints.js';
+export { readGroupMembershipEndpoints, } from './read-group-membership-endpoints.js';
+export { readGroupMembers, readGroupMembersEndpoints, } from './read-group-members.js';

package/dist/queries/group/legacy/index.js

@@ -0,0 +1,3 @@
+export { legacyReadMemberOfGroup } from './read-member-of-group.js';
+export { legacyReadCoreGroups } from './read-core-groups.js';
+export { legacyReadMembersOfGroup } from './read-members-of-group.js';

package/dist/queries/group/legacy/read-core-groups.js

@@ -0,0 +1,46 @@
+import { defineQuery, Query, queryResult, } from '@astrale-os/sdk/query';
+const CORE = 'core.';
+/**
+ * @deprecated Shell's own Core groups, each named by its `of_domain` locator (`core.<name>`)
+ * (L-SHELL-7): the legacy groups a membership write keeps `member_of_group` for. Replaced by the
+ * profile Roles. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export const legacyReadCoreGroups = defineQuery()((domain) => {
+    const kernel = domain.dependencies.kernel.classes;
+    const member = kernel.of_domain.properties.member.key;
+    const origin = kernel.Domain.properties.origin.key;
+    return {
+        id: 'shell.access.core-groups',
+        page: { size: 256 },
+        pagination: { maximumPages: 8 },
+        build: () => {
+            const locator = Query.from({ nodes: [domain.classes.Group] }).expand({
+                via: [kernel.of_domain],
+                direction: 'outgoing',
+            });
+            return locator.select({
+                kind: 'edges',
+                binding: locator.edge,
+                projection: { edge: 'value', source: 'reference', target: 'value' },
+            });
+        },
+        project(pages) {
+            const groups = {};
+            for (const page of pages) {
+                for (const item of queryResult.edgeItems(page, 'Shell Core groups')) {
+                    if (item.edge.kind !== 'value' || item.source.kind !== 'reference')
+                        continue;
+                    if (item.target.kind !== 'value')
+                        continue;
+                    if (item.target.value.props[origin] !== domain.origin)
+                        continue;
+                    const key = item.edge.value.props[member];
+                    if (typeof key === 'string' && key.startsWith(CORE)) {
+                        groups[key.slice(CORE.length)] = item.source.value.id;
+                    }
+                }
+            }
+            return groups;
+        },
+    };
+});

package/dist/queries/group/legacy/read-member-of-group.js

@@ -0,0 +1,24 @@
+import { Query, defineQuery, queryResult } from '@astrale-os/sdk/query';
+/**
+ * @deprecated The legacy `member_of_group` Edge from the member to the group, kept whole as a guard
+ * (L-SHELL-8). Replaced by `readGroupMembership` (`extends_with`). Removal: Shell major (delivery
+ * step 5) after 1Pact step 4.
+ */
+export const legacyReadMemberOfGroup = defineQuery()((domain) => ({
+    id: 'shell.group.membership.legacy',
+    build({ member, group }) {
+        const edges = Query.from({ edges: [domain.classes.member_of_group] });
+        return edges
+            .filter({ binding: edges.source, predicate: { kind: 'identity.equal', identity: member } })
+            .filter({ binding: edges.target, predicate: { kind: 'identity.equal', identity: group } })
+            .select({
+            kind: 'edges',
+            projection: { edge: 'reference', source: 'reference', target: 'reference' },
+        });
+    },
+    pagination: { maximumPages: 2 },
+    project(pages, _input, { ast, complete }) {
+        const present = pages.some((page) => queryResult.edgeItems(page, 'Shell legacy membership').length > 0);
+        return { present, guard: { query: ast, equals: complete } };
+    },
+}));

package/dist/queries/group/legacy/read-members-of-group.js

@@ -0,0 +1,27 @@
+import { Path } from '@astrale-os/sdk/graph/path';
+import { Query, defineQuery, } from '@astrale-os/sdk/query';
+import { canonical, sources, } from '../read-group-members.js';
+/**
+ * @deprecated The legacy `member_of_group` Edges from the members to the group, in one read and
+ * kept whole as one guard (L-SHELL-8). Replaced by `readGroupMembers` (`extends_with`). Removal:
+ * Shell major (delivery step 5) after 1Pact step 4.
+ */
+export const legacyReadMembersOfGroup = defineQuery()((domain) => ({
+    id: 'shell.group.members.legacy',
+    page: { size: 256 },
+    pagination: { maximumPages: 2 },
+    build({ members, group }) {
+        const walk = Query.from({
+            nodes: [Path.id(members[0]), ...members.slice(1).map((id) => Path.id(id))],
+        }).expand({ via: [domain.classes.member_of_group], direction: 'outgoing' });
+        return walk.filter({ predicate: { kind: 'identity.equal', identity: group } }).select({
+            kind: 'edges',
+            binding: walk.edge,
+            projection: { edge: 'reference', source: 'reference', target: 'reference' },
+        });
+    },
+    project: (pages, _input, { ast, complete }) => ({
+        present: sources(pages, 'Shell legacy group members'),
+        guard: { query: ast, equals: canonical(complete) },
+    }),
+}));

package/dist/queries/group/read-group-members.js

@@ -0,0 +1,73 @@
+import { Path } from '@astrale-os/sdk/graph/path';
+import { Query, defineQuery, queryResult, } from '@astrale-os/sdk/query';
+const anchors = (ids) => [Path.id(ids[0]), ...ids.slice(1).map((id) => Path.id(id))];
+/** Every member and the group, in one read whatever the number of members. */
+export const readGroupMembersEndpoints = defineQuery()(() => ({
+    id: 'shell.group.members.endpoints',
+    page: { size: 256 },
+    pagination: { maximumPages: 2 },
+    build: ({ members, group }) => Query.from({ nodes: [...anchors(members), Path.id(group)] }).select({
+        kind: 'nodes',
+        projection: { kind: 'reference' },
+    }),
+    project(pages, input, { ast, complete }) {
+        const visible = new Set(queryResult.completeNodeIds(pages, 'Shell group members'));
+        let groupClass;
+        for (const page of pages) {
+            if (page.kind !== 'nodes')
+                continue;
+            for (const item of page.nodes) {
+                if (item.kind === 'reference' && item.value.id === input.group)
+                    groupClass = item.value.class;
+            }
+        }
+        return {
+            visible,
+            ...(groupClass === undefined ? {} : { groupClass }),
+            // The Kernel takes a guard's Nodes in canonical order.
+            guard: { query: ast, equals: { ...complete, ids: [...complete.ids].sort(order) } },
+        };
+    },
+}));
+/** The `extends_with` Edges from the members to the group: their memberships (G1), in one read. */
+export const readGroupMembers = defineQuery()((domain) => ({
+    id: 'shell.group.members.read',
+    page: { size: 256 },
+    pagination: { maximumPages: 2 },
+    build({ members, group }) {
+        const walk = Query.from({ nodes: anchors(members) }).expand({
+            via: [domain.dependencies.kernel.classes.extends_with],
+            direction: 'outgoing',
+        });
+        return walk.filter({ predicate: { kind: 'identity.equal', identity: group } }).select({
+            kind: 'edges',
+            binding: walk.edge,
+            projection: { edge: 'reference', source: 'reference', target: 'reference' },
+        });
+    },
+    project: (pages, _input, { ast, complete }) => ({
+        present: sources(pages, 'Shell group members'),
+        guard: { query: ast, equals: canonical(complete) },
+    }),
+}));
+/** The members an Edge read finds, by source. */
+export function sources(pages, label) {
+    const found = new Set();
+    for (const page of pages) {
+        for (const item of queryResult.edgeItems(page, label)) {
+            if (item.source.kind === 'reference')
+                found.add(item.source.value.id);
+        }
+    }
+    return found;
+}
+const order = (left, right) => (left < right ? -1 : left > right ? 1 : 0);
+/** A guard's Edges in the Kernel's canonical order: by source, then target, then Class. */
+export function canonical(selection) {
+    if (selection.kind !== 'edge')
+        return selection;
+    const keys = [...selection.keys].sort((left, right) => order(left.source, right.source) ||
+        order(left.target, right.target) ||
+        order(left.class, right.class));
+    return { ...selection, keys };
+}

package/dist/queries/group/read-group-membership-endpoints.js

@@ -1,5 +1,6 @@
 import { Path } from '@astrale-os/sdk/graph/path';
 import { defineQuery, Query, queryResult, } from '@astrale-os/sdk/query';
+/** Both membership endpoints, kept whole as a guard: neither is replaced while Shell decides. */
 export const readGroupMembershipEndpoints = defineQuery()(() => ({
     id: 'shell.group.membership.endpoints',
     page: { size: 2 },
@@ -10,8 +11,18 @@ export const readGroupMembershipEndpoints = defineQuery()(() => ({
     }),
     project(pages, input, { ast, complete }) {
         const ids = queryResult.completeNodeIds(pages, 'Shell membership endpoints');
+        let groupClass;
+        for (const page of pages) {
+            if (page.kind !== 'nodes')
+                continue;
+            for (const item of page.nodes) {
+                if (item.kind === 'reference' && item.value.id === input.group)
+                    groupClass = item.value.class;
+            }
+        }
         return {
             visible: ids.includes(input.member) && ids.includes(input.group),
+            ...(groupClass === undefined ? {} : { groupClass }),
             guard: { query: ast, equals: complete },
         };
     },

package/dist/queries/group/read-group-membership.js

@@ -1,35 +1,20 @@
 import { Query, defineQuery, queryResult, } from '@astrale-os/sdk/query';
+/** The `extends_with` Edge from the member to the group: the membership itself (G1). */
 export const readGroupMembership = defineQuery()((domain) => ({
     id: 'shell.group.membership.read',
     build({ member, group }) {
-        const edges = Query.from({
-            edges: [domain.classes.member_of_group, domain.dependencies.kernel.classes.extends_with],
-        });
+        const edges = Query.from({ edges: [domain.dependencies.kernel.classes.extends_with] });
         return edges
             .filter({ binding: edges.source, predicate: { kind: 'identity.equal', identity: member } })
             .filter({ binding: edges.target, predicate: { kind: 'identity.equal', identity: group } })
             .select({
             kind: 'edges',
-            projection: { edge: 'value', source: 'reference', target: 'reference' },
+            projection: { edge: 'reference', source: 'reference', target: 'reference' },
         });
     },
-    pagination: { maximumPages: 4 },
+    pagination: { maximumPages: 2 },
     project(pages, _input, { ast, complete }) {
-        let membership = false;
-        let authority = false;
-        for (const page of pages) {
-            for (const item of queryResult.edgeItems(page, 'Shell group membership')) {
-                if (item.edge.kind !== 'value')
-                    throw new TypeError('Expected an Edge value.');
-                if (item.edge.value.class === domain.classes.member_of_group.key)
-                    membership = true;
-                else if (item.edge.value.class === domain.dependencies.kernel.classes.extends_with.key) {
-                    authority = true;
-                }
-                else
-                    throw new TypeError('Unexpected Edge Class.');
-            }
-        }
-        return { membership, authority, guard: { query: ast, equals: complete } };
+        const present = pages.some((page) => queryResult.edgeItems(page, 'Shell group membership').length > 0);
+        return { present, guard: { query: ast, equals: complete } };
     },
 }));

package/dist/queries/identity/index.js

@@ -0,0 +1 @@
+export { readIdentities } from './read-identities.js';

package/dist/queries/identity/read-identities.js

@@ -0,0 +1,29 @@
+import { Path } from '@astrale-os/sdk/graph/path';
+import { defineQuery, Query, queryResult, } from '@astrale-os/sdk/query';
+/**
+ * The accounts or groups a selection names that Shell reads, as stored: a Class extent includes a
+ * foreign subclass, and a Node of another Class is left out.
+ */
+export const readIdentities = defineQuery()((domain) => ({
+    id: 'shell.identities.read',
+    page: { size: 256 },
+    pagination: { maximumPages: 16 },
+    build(selection) {
+        const selected = domain.classes[selection.kind];
+        if ('ids' in selection) {
+            const [first, ...others] = selection.ids;
+            return Query.from({ nodes: [Path.id(first), ...others.map((id) => Path.id(id))] })
+                .filter({ class: selected })
+                .select({ kind: 'nodes', projection: { kind: 'value' } });
+        }
+        let query = Query.from({ nodes: [selected] });
+        for (const [name, value] of Object.entries(selection.where)) {
+            const property = selected.properties[name];
+            if (property === undefined)
+                throw new TypeError(`${selection.kind} has no ${name}.`);
+            query = query.filter({ predicate: { kind: 'property.equal', property: property.key, value } });
+        }
+        return query.select({ kind: 'nodes', projection: { kind: 'value' } });
+    },
+    project: (pages) => queryResult.completeNodeValues(pages, 'Shell identities'),
+}));

package/dist/queries/invitation/index.js

@@ -0,0 +1 @@
+export { readInvitation, readPendingInvitations } from './read-invitation.js';

package/dist/queries/invitation/read-invitation.js

@@ -0,0 +1,50 @@
+import { Path } from '@astrale-os/sdk/graph/path';
+import { defineQuery, Query, queryResult, } from '@astrale-os/sdk/query';
+/** An invitation Node as the methods and the run read it. */
+function toInvitation(node, keys) {
+    const props = node.props;
+    const email = props[keys.email.key];
+    return {
+        id: node.id,
+        status: String(props[keys.status.key]),
+        execution: String(props[keys.execution.key]),
+        round: Number(props[keys.round.key] ?? 0),
+        ...(typeof email === 'string' ? { email } : {}),
+    };
+}
+/** One invitation, or undefined when there is none the reader reads. */
+export const readInvitation = defineQuery()((domain) => ({
+    id: 'shell.invitation.read',
+    page: { size: 1 },
+    pagination: { maximumPages: 1 },
+    build: ({ invitation }) => Query.from({ nodes: [Path.id(invitation)] }).select({
+        kind: 'nodes',
+        projection: { kind: 'value' },
+    }),
+    project: (pages) => {
+        const node = queryResult.completeNodeValues(pages, 'Shell invitation')[0];
+        if (node === undefined)
+            return undefined;
+        return toInvitation(node, domain.classes.Invitation.properties);
+    },
+}));
+/** The pending invitations of one account: at most one, unless recorded before that rule. */
+export const readPendingInvitations = defineQuery()((domain) => ({
+    id: 'shell.invitation.pending',
+    page: { size: 64 },
+    pagination: { maximumPages: 1 },
+    build: ({ user }) => Query.from({ nodes: [Path.id(user)] })
+        .expand({ via: [domain.classes.invitation_user], direction: 'incoming' })
+        .filter({ class: domain.classes.Invitation })
+        .filter({
+        predicate: {
+            kind: 'property.equal',
+            property: domain.classes.Invitation.properties.status.key,
+            value: 'pending',
+        },
+    })
+        .select({ kind: 'nodes', projection: { kind: 'value' } }),
+    project: (pages) => queryResult
+        .completeNodeValues(pages, 'Shell pending invitations')
+        .map((node) => toInvitation(node, domain.classes.Invitation.properties)),
+}));

package/dist/queries/profile/index.js

@@ -0,0 +1 @@
+export { readProfile } from './read-profile.js';

package/dist/queries/profile/read-profile.js

@@ -0,0 +1,15 @@
+import { Path } from '@astrale-os/sdk/graph/path';
+import { defineQuery, Query, queryResult, } from '@astrale-os/sdk/query';
+/** The profile Node of one account or group, or undefined for one stored before profiles. */
+export const readProfile = defineQuery()((domain) => ({
+    id: 'shell.profile.read',
+    page: { size: 1 },
+    pagination: { maximumPages: 1 },
+    build: ({ kind, node }) => Query.from({ nodes: [Path.id(node)] })
+        .expand({
+        via: [kind === 'User' ? domain.classes.user_profile : domain.classes.group_profile],
+        direction: 'outgoing',
+    })
+        .select({ kind: 'nodes', projection: { kind: 'value' } }),
+    project: (pages) => queryResult.completeNodeValues(pages, 'Shell profile')[0]?.id,
+}));

package/dist/queries/role/index.js

@@ -0,0 +1 @@
+export { readRoleId, readRoleNode } from './read-role-node.js';

package/dist/queries/role/read-role-node.js

@@ -0,0 +1,21 @@
+import { defineQuery, Query, queryResult, } from '@astrale-os/sdk/query';
+/**
+ * Whether the reader reads one Role Node. A Shell Role reads by its holders and by Kernel
+ * `authority.reader` (R7), so read under a caller's authority it tells whether the Kernel finds the
+ * Role in that caller's live composition, at any depth; Root reads every Role.
+ */
+export const readRoleNode = defineQuery()(() => ({
+    id: 'shell.role.read',
+    page: { size: 1 },
+    pagination: { maximumPages: 1 },
+    build: ({ role }) => Query.from({ nodes: [role] }).select({ kind: 'nodes', projection: { kind: 'value' } }),
+    project: (pages) => queryResult.completeNodeValues(pages, 'Shell Role').length === 1,
+}));
+/** One Role's Node, read by its Core target; nothing when it is not installed. */
+export const readRoleId = defineQuery()(() => ({
+    id: 'shell.role.id',
+    page: { size: 1 },
+    pagination: { maximumPages: 1 },
+    build: ({ role }) => Query.from({ nodes: [role] }).select({ kind: 'nodes', projection: { kind: 'reference' } }),
+    project: (pages) => queryResult.completeNodeIds(pages, 'Shell Role')[0],
+}));

package/dist/queries/user/legacy/index.js

@@ -0,0 +1 @@
+export { legacyReadUserProfile } from './read-user-profile.js';

package/dist/queries/user/legacy/read-user-profile.js

@@ -0,0 +1,27 @@
+import { Path } from '@astrale-os/sdk/graph/path';
+import { defineQuery, Query, queryResult, } from '@astrale-os/sdk/query';
+/**
+ * @deprecated The email and display name one account recorded about itself (L-SHELL-5). Replaced
+ * by the account's `email` and `name`. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export const legacyReadUserProfile = defineQuery()((domain) => {
+    const { claimedEmail: email, claimedName: displayName } = domain.classes.User.properties;
+    return {
+        id: 'shell.user.profile',
+        page: { size: 1 },
+        pagination: { maximumPages: 1 },
+        build: ({ user }) => Query.from({ nodes: [Path.id(user)] }).select({
+            kind: 'nodes',
+            projection: { kind: 'value' },
+        }),
+        project(pages) {
+            const [node] = queryResult.completeNodeValues(pages, 'Shell user profile');
+            const text = (value) => (typeof value === 'string' ? value : undefined);
+            const recorded = {
+                email: text(node?.props[email.key]),
+                displayName: text(node?.props[displayName.key]),
+            };
+            return Object.fromEntries(Object.entries(recorded).filter(([, value]) => value !== undefined));
+        },
+    };
+});