@astrale-domains/shell 0.1.7 → 0.1.9

package/dist/runtime.js

@@ -2,14 +2,14 @@ import { defineRuntime } from '@astrale-os/sdk/runtime';
 // L-SHELL-11: the legacy handler of listEntrypoints, through its owner's facade.
 import { legacyListEntrypoints } from './functions/application/index.js';
 import { disconnectDirectory } from './functions/directory/index.js';
-import { assignMember, create as createGroup, deprovision as deprovisionGroup, provision as provisionGroup, remove as deleteGroup, unassignMember, update as updateGroup, } from './functions/group/index.js';
+import { assignMember, assignMembers, create as createGroup, deprovision as deprovisionGroup, provision as provisionGroup, remove as deleteGroup, unassignMember, unassignMembers, update as updateGroup, } from './functions/group/index.js';
 import { accept as acceptInvitation, cancel as cancelInvitation, resend as resendInvitation, send as sendInvitation, } from './functions/invitation/index.js';
 import { link, rename, unlink } from './functions/namespace/index.js';
 import { create as createUser, deactivate, deprovision as deprovisionUser, invite, 
 // L-SHELL-5, L-SHELL-14: legacy handlers, through their owner's facade.
 legacyMigrateAccounts, legacyRecordProfile, provision as provisionUser, reactivate, remove as deleteUser, update as updateUser, updateProfile, } from './functions/user/index.js';
-// L-SHELL-12: the legacy handler of assignViews, through its owner's facade.
-import { legacyAssignViews } from './functions/view-access/index.js';
+// L-SHELL-12, L-SHELL-20: the legacy handlers of assignViews and the view_access migration.
+import { legacyAssignViews, legacyMigrateViewAccess } from './functions/view-access/index.js';
 import { integrations } from './integrations/index.js';
 import { enrollmentProvider } from './providers/admin-enrollment/index.js';
 const initialize = (environment) => ({
@@ -30,6 +30,8 @@ const functions = [
     deleteGroup,
     assignMember,
     unassignMember,
+    assignMembers,
+    unassignMembers,
     provisionGroup,
     deprovisionGroup,
     disconnectDirectory,
@@ -44,6 +46,7 @@ const functions = [
     legacyListEntrypoints,
     legacyAssignViews,
     legacyMigrateAccounts,
+    legacyMigrateViewAccess,
 ];
 const runtime = defineRuntime()({
     integrations,

package/dist/schema/index.d.ts

@@ -6,5 +6,5 @@ export { Role, atomicRoles, profileRoles, shellRoles, PROFILE_NAMES, type Profil
 export { hasRole } from './policies/index.js';
 export { disconnectDirectory } from './modules/directory/index.js';
 export { Namespace, alias, viewsNamespace } from './modules/namespace/index.js';
-export { view_access, holdsViewAccess } from './modules/view-access/index.js';
+export { legacyViewAccess as view_access, legacyHoldsViewAccess as holdsViewAccess, } from './modules/view-access/index.js';
 export { legacyMemberOfGroup as member_of_group, legacyAdministratorsGroup as adminGroup, legacyMembersGroup as memberGroup, } from './modules/group/index.js';

package/dist/schema/index.js

@@ -5,6 +5,7 @@ export { Role, atomicRoles, profileRoles, shellRoles, PROFILE_NAMES, } from './m
 export { hasRole } from './policies/index.js';
 export { disconnectDirectory } from './modules/directory/index.js';
 export { Namespace, alias, viewsNamespace } from './modules/namespace/index.js';
-export { view_access, holdsViewAccess } from './modules/view-access/index.js';
+// Seam L-SHELL-20: the package root's former names of the Shell's own view_access.
+export { legacyViewAccess as view_access, legacyHoldsViewAccess as holdsViewAccess, } from './modules/view-access/index.js';
 // Seam L-SHELL-16: the package root's former names of the legacy Edge Class and Core groups.
 export { legacyMemberOfGroup as member_of_group, legacyAdministratorsGroup as adminGroup, legacyMembersGroup as memberGroup, } from './modules/group/index.js';

package/dist/schema/legacy/schema.js

@@ -1,19 +1,20 @@
 import { legacyListEntrypoints } from '../modules/application/legacy/index.js';
 import { legacyAdministratorsGroup, legacyApplicationsGroup, legacyBelongsToGroup, legacyMemberOfGroup, legacyMembersGroup, legacyOwnsMembershipGroup, legacyViewOnlyGroup, } from '../modules/group/legacy/index.js';
 import { legacyMigrateAccounts } from '../modules/user/legacy/index.js';
-import { legacyAssignViews } from '../modules/view-access/legacy/index.js';
+import { legacyAssignViews, legacyHoldsViewAccess, legacyMigrateViewAccess, legacyViewAccess, } from '../modules/view-access/legacy/index.js';
 import { legacyAdministersShellClass, legacyIsSelf, legacyOwnsClass, legacyUsesFunction, } from '../policies/legacy/index.js';
 /**
  * @deprecated The declarations the Shell keeps for legacy readers and callers, under their stored
  * names so their keys stay (L-SHELL-7). Each item has its own row: L-SHELL-8, L-SHELL-10,
- * L-SHELL-11, L-SHELL-12, L-SHELL-14. Replaced by the target Schema alone. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ * L-SHELL-11, L-SHELL-12, L-SHELL-14, L-SHELL-20. Replaced by the target Schema alone. Removal: Shell major (delivery step 5) after 1Pact step 4.
  */
 export const legacyShellSchema = {
-    classes: { member_of_group: legacyMemberOfGroup },
+    classes: { member_of_group: legacyMemberOfGroup, view_access: legacyViewAccess },
     functions: {
         listEntrypoints: legacyListEntrypoints,
         assignViews: legacyAssignViews,
         legacyMigrateAccounts,
+        legacyMigrateViewAccess,
     },
     policies: {
         belongsToGroup: legacyBelongsToGroup,
@@ -22,6 +23,7 @@ export const legacyShellSchema = {
         usesFunction: legacyUsesFunction,
         isSelf: legacyIsSelf,
         legacyOwnsMembershipGroup,
+        holdsViewAccess: legacyHoldsViewAccess,
     },
     core: {
         admin: legacyAdministratorsGroup,

package/dist/schema/modules/application/legacy/functions/list-entrypoints.js

@@ -1,7 +1,7 @@
 import { func } from '@astrale-os/sdk/schema';
 import { z } from 'zod';
 import { legacyApplicationsGroup } from '../../../group/legacy/index.js';
-import { profileRoles } from '../../../role/index.js';
+import { atomicRoles } from '../../../role/index.js';
 import { hasRole } from '../../../../policies/index.js';
 import { legacyEntrypointEntry } from '../entrypoint-entry.js';
 /**
@@ -9,13 +9,14 @@ import { legacyEntrypointEntry } from '../entrypoint-entry.js';
  * Shell's own authority (L-SHELL-11). Replaced by the visitor's own Query (V2). Removal: Shell major
  * (delivery step 5) after 1Pact step 4.
  *
- * Its legacy `can_use` holders keep it (AM5): Administrators and Members through `workspace.member`,
- * which the release makes them hold (AM3), and the Applications group itself.
+ * Whoever opens the OS view lists its applications: holders of `os.viewer`, which `workspace.member`
+ * holds through the release, so its legacy `can_use` holders keep it (AM5): Administrators and
+ * Members through their profiles (AM3), and the Applications group itself.
  */
 export const legacyListEntrypoints = func({
     description: 'List the entrypoint View and name of every installed Domain that declares one.',
     auth: 'authorized',
     input: z.strictObject({}),
     output: z.object({ entrypoints: z.array(legacyEntrypointEntry) }),
-    policy: ({ anyOf, check, ref }) => anyOf(check(hasRole, ref(profileRoles['workspace.member'])), check(hasRole, ref(legacyApplicationsGroup))),
+    policy: ({ anyOf, check, ref }) => anyOf(check(hasRole, ref(atomicRoles['os.viewer'])), check(hasRole, ref(legacyApplicationsGroup))),
 });

package/dist/schema/modules/group/classes/group-profile-link.d.ts

@@ -14,7 +14,7 @@ export declare const group_profile: import("@astrale-os/sdk/schema").DirectedEdg
             readonly abstract: false;
             readonly depth: 1;
             readonly properties: "attributes" | "description" | "directory" | "externalId" | "frozen" | "icon" | "iss" | "name" | "sub";
-            readonly methods: "assignMember" | "create" | "delete" | "deprovision" | "provision" | "unassignMember" | "update";
+            readonly methods: "assignMember" | "assignMembers" | "create" | "delete" | "deprovision" | "provision" | "unassignMember" | "unassignMembers" | "update";
         }[];
         readonly outgoing: "0..1";
     };

package/dist/schema/modules/group/classes/group.d.ts

@@ -74,6 +74,20 @@ export declare const Group: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
             readonly mode: 'value';
             readonly value: Record<string, never>;
         }, "authorized", true, false, undefined, undefined>>;
+        readonly assignMembers: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            members: string[];
+            group: string;
+        }, {
+            readonly mode: 'value';
+            readonly value: Record<string, never>;
+        }, "authorized", true, false, undefined, undefined>>;
+        readonly unassignMembers: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+            members: string[];
+            group: string;
+        }, {
+            readonly mode: 'value';
+            readonly value: Record<string, never>;
+        }, "authorized", true, false, undefined, undefined>>;
         readonly provision: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
             directory: string;
             externalId: string;

package/dist/schema/modules/group/classes/group.js

@@ -1,7 +1,7 @@
 import { classIcon, nodeClass, property } from '@astrale-os/sdk/schema';
 import { UsersRound } from '@astrale-os/sdk/schema/icons';
 import { attributesProperty } from '../../../types/index.js';
-import { assignMember, create, deprovision, provision, remove, unassignMember, update, } from '../functions/index.js';
+import { assignMember, assignMembers, create, deprovision, provision, remove, unassignMember, unassignMembers, update, } from '../functions/index.js';
 // Seams L-SHELL-1, L-SHELL-2: the relaxations existing groups and extending Domains still need.
 import { LEGACY_GROUP_EXTENDS, LEGACY_GROUP_INHERITANCE, LEGACY_GROUP_READ, } from '../legacy/index.js';
 const text = { type: 'string', minLength: 1, maxLength: 200 };
@@ -28,5 +28,15 @@ export const Group = nodeClass({
         read: LEGACY_GROUP_READ,
         traverse: true,
     },
-    methods: { create, update, delete: remove, assignMember, unassignMember, provision, deprovision },
+    methods: {
+        create,
+        update,
+        delete: remove,
+        assignMember,
+        unassignMember,
+        assignMembers,
+        unassignMembers,
+        provision,
+        deprovision,
+    },
 });

package/dist/schema/modules/group/functions/assign-members.js

@@ -0,0 +1,17 @@
+import { method } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+import { atomicRoles } from '../../role/index.js';
+import { hasRole } from '../../../policies/index.js';
+import { legacyMembershipOwnerAdmission } from '../legacy/index.js';
+import { groupMembersInput } from '../types/index.js';
+/** Make several accounts or groups members of this group in one call (G1-G3 checked once). */
+export const assignMembers = method({
+    static: true,
+    description: 'Make several accounts or groups members of a group.',
+    auth: 'authorized',
+    input: groupMembersInput,
+    output: z.object({}),
+    policy: (context) => context.anyOf(context.check(hasRole, context.ref(atomicRoles['group.writer'])), context.check(hasRole, context.ref(atomicRoles['directory.provisioner'])), 
+    // Seam L-SHELL-9: a Domain that extends Group manages the members of its own groups.
+    legacyMembershipOwnerAdmission(context, context.input.group)),
+});

package/dist/schema/modules/group/functions/index.js

@@ -3,5 +3,7 @@ export { update } from './update-group.js';
 export { remove } from './delete-group.js';
 export { assignMember } from './assign-member.js';
 export { unassignMember } from './unassign-member.js';
+export { assignMembers } from './assign-members.js';
+export { unassignMembers } from './unassign-members.js';
 export { provision } from './provision-group.js';
 export { deprovision } from './deprovision-group.js';

package/dist/schema/modules/group/functions/unassign-members.js

@@ -0,0 +1,17 @@
+import { method } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+import { atomicRoles } from '../../role/index.js';
+import { hasRole } from '../../../policies/index.js';
+import { legacyMembershipOwnerAdmission } from '../legacy/index.js';
+import { groupMembersInput } from '../types/index.js';
+/** Withdraw several direct members from a group in one call (G2, G3 checked once). */
+export const unassignMembers = method({
+    static: true,
+    description: 'Withdraw several accounts or groups from a group.',
+    auth: 'authorized',
+    input: groupMembersInput,
+    output: z.object({}),
+    policy: (context) => context.anyOf(context.check(hasRole, context.ref(atomicRoles['group.writer'])), context.check(hasRole, context.ref(atomicRoles['directory.provisioner'])), 
+    // Seam L-SHELL-9: a Domain that extends Group manages the members of its own groups.
+    legacyMembershipOwnerAdmission(context, context.input.group)),
+});

package/dist/schema/modules/group/types/group-membership-input.js

@@ -6,3 +6,11 @@ export const groupMembershipInput = z.object({
     member: path(() => User, () => Group),
     group: path(() => Group),
 });
+/**
+ * Several accounts or groups to add to or withdraw from one group, in one call. A Path is not
+ * allowed inside a list, so each member is an exact @NodeId the Action checks.
+ */
+export const groupMembersInput = z.object({
+    members: z.array(z.string().min(2).max(512)).min(1).max(100),
+    group: path(() => Group),
+});

package/dist/schema/modules/group/types/index.js

@@ -1,2 +1,2 @@
-export { groupMembershipInput } from './group-membership-input.js';
+export { groupMembersInput, groupMembershipInput } from './group-membership-input.js';
 export { directoryId, externalId, groupDescription, groupIcon, groupName, nodeReference, } from './group.js';

package/dist/schema/modules/invitation/classes/invitation.js

@@ -5,8 +5,8 @@ import { hasRole } from '../../../policies/index.js';
 import { accept, cancel, resend, send } from '../functions/index.js';
 import { INVITATION_STATUSES } from '../types/index.js';
 /**
- * One invitation of an account, kept by the durable run of `Invitation.send` that it names. The
- * email stays on the account's profile. Only Shell writes it; `user.writer` reads it, so the pending
+ * One invitation of an account, kept by the durable run of `Invitation.send` that it names. An
+ * account has at most one pending invitation. Only Shell writes it; `user.writer` reads it, so the pending
  * invitations are one Query on `status`.
  */
 export const Invitation = nodeClass({
@@ -21,6 +21,8 @@ export const Invitation = nodeClass({
         // The durable run that keeps it, and the number of events it has received (resends).
         execution: property({ type: 'string', minLength: 1, maxLength: 200 }),
         round: property({ type: 'integer', minimum: 0 }),
+        // The email it was sent to, in lower case: a new invitation to the same email resends this one.
+        email: property({ type: 'string', minLength: 3, maxLength: 320 }, { required: false }),
     },
     policies: {
         read: ({ check, ref }) => check(hasRole, ref(atomicRoles['user.writer'])),

package/dist/schema/modules/role/core/roles.d.ts

@@ -19,6 +19,7 @@ export declare const atomicRoles: {
     readonly 'user-profile.reader': import("@astrale-os/sdk/schema").CoreNode;
     readonly 'user-profile.self-writer': import("@astrale-os/sdk/schema").CoreNode;
     readonly 'group-profile.reader': import("@astrale-os/sdk/schema").CoreNode;
+    readonly 'os.viewer': import("@astrale-os/sdk/schema").CoreNode;
 };
 export declare const shellRoles: {
     readonly 'workspace.member': import("@astrale-os/sdk/schema").CoreNode;
@@ -31,6 +32,7 @@ export declare const shellRoles: {
     readonly 'user-profile.reader': import("@astrale-os/sdk/schema").CoreNode;
     readonly 'user-profile.self-writer': import("@astrale-os/sdk/schema").CoreNode;
     readonly 'group-profile.reader': import("@astrale-os/sdk/schema").CoreNode;
+    readonly 'os.viewer': import("@astrale-os/sdk/schema").CoreNode;
 };
 /** The profile a person is given, by its name. */
 export type ProfileName = 'member' | 'admin';

package/dist/schema/modules/role/core/roles.js

@@ -25,6 +25,7 @@ export const atomicRoles = {
     'user-profile.reader': role('user-profile.reader', 'May read the name, email and image of every person.'),
     'user-profile.self-writer': role('user-profile.self-writer', 'May change its own name and image, never its email.'),
     'group-profile.reader': role('group-profile.reader', 'May read the name, description and image of every group.'),
+    'os.viewer': role('os.viewer', 'Opens the OS view and lists its applications.'),
 };
 export const shellRoles = { ...profileRoles, ...atomicRoles };
 export const PROFILE_NAMES = ['member', 'admin'];

package/dist/schema/modules/view-access/index.d.ts

@@ -1,2 +1 @@
-export { view_access } from './classes/index.js';
-export { holdsViewAccess } from './policies/index.js';
+export { legacyHoldsViewAccess, legacyViewAccess } from './legacy/index.js';

package/dist/schema/modules/view-access/index.js

@@ -1,2 +1,2 @@
-export { view_access } from './classes/index.js';
-export { holdsViewAccess } from './policies/index.js';
+// Seam L-SHELL-20: the package root's former names, reached through this module's facade.
+export { legacyHoldsViewAccess, legacyViewAccess } from './legacy/index.js';

package/dist/schema/modules/view-access/legacy/classes/index.d.ts

@@ -0,0 +1 @@
+export { legacyViewAccess } from './view-access.js';

package/dist/schema/modules/view-access/legacy/classes/index.js

@@ -0,0 +1 @@
+export { legacyViewAccess } from './view-access.js';

package/dist/schema/modules/view-access/{classes → legacy/classes}/view-access.d.ts

@@ -1,10 +1,12 @@
 /**
- * A View an Identity lands on without `member`: an account, a group or a Role, and each of their
- * members. It decides navigation, never data: the View's own Domain still guards everything it
- * shows (V1). Only an admin writes it; an admin or its holders read it. Each end detaches with its
- * Node.
+ * @deprecated The Shell's own `view_access` (L-SHELL-20): a View an Identity landed on without
+ * `member`. The Kernel enforces only its own `view_access` (kernel-host 1.0.0-beta.45), so nothing
+ * writes this one any more; it stays declared so stored Edges remain valid until
+ * `legacyMigrateViewAccess` copies them to the Kernel's and deletes them. Replaced by Kernel
+ * `view_access`, which `view.manager` writes. Removal: Shell major (delivery step 5), once the
+ * migration ran on every instance.
  */
-export declare const view_access: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+export declare const legacyViewAccess: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
     readonly depth: 0;
     readonly abstract: false;
     readonly extends: readonly [];

package/dist/schema/modules/view-access/legacy/classes/view-access.js

@@ -0,0 +1,25 @@
+import { K, edgeClass } from '@astrale-os/sdk/schema';
+import { profileRoles } from '../../../role/index.js';
+import { hasRole } from '../../../../policies/index.js';
+import { legacyHoldsViewAccess } from '../policies/holds-view-access.js';
+/**
+ * @deprecated The Shell's own `view_access` (L-SHELL-20): a View an Identity landed on without
+ * `member`. The Kernel enforces only its own `view_access` (kernel-host 1.0.0-beta.45), so nothing
+ * writes this one any more; it stays declared so stored Edges remain valid until
+ * `legacyMigrateViewAccess` copies them to the Kernel's and deletes them. Replaced by Kernel
+ * `view_access`, which `view.manager` writes. Removal: Shell major (delivery step 5), once the
+ * migration ran on every instance.
+ */
+export const legacyViewAccess = edgeClass.directed({
+    inheritance: 'final',
+    abstract: false,
+    description: 'A View this Identity lands on without member.',
+    source: { as: 'audience', accepts: [K.classes.Identity], outgoing: '0..*', onDelete: 'detach' },
+    target: { as: 'view', accepts: [K.classes.View], incoming: '0..*', onDelete: 'detach' },
+    policies: {
+        read: ({ anyOf, check, ref, self }) => anyOf(check(hasRole, ref(profileRoles['workspace.admin'])), check(legacyHoldsViewAccess, self)),
+        traverse: true,
+        create: false,
+        delete: ({ check, ref }) => check(hasRole, ref(profileRoles['workspace.admin'])),
+    },
+});

package/dist/schema/modules/view-access/legacy/functions/assign-views.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @deprecated Give and withdraw Views for each identity, in one write (L-SHELL-12). Replaced by a
+ * Mutation on `view_access`, which only `workspace.admin` holders may write. Removal: Shell major
+ * (delivery step 5) after 1Pact step 4.
+ *
+ * Its legacy `can_use` holders, the Administrators group, hold `workspace.admin` through the release
+ * (AM5), which now admits them.
+ */
+export declare const legacyAssignViews: import("@astrale-os/sdk/schema").Function<import("@astrale-os/sdk/schema").CallableProjection<{
+    assignments: {
+        identity: string;
+        set?: string[] | undefined;
+        unset?: string[] | undefined;
+    }[];
+}, {
+    readonly mode: 'value';
+    readonly value: Record<string, never>;
+}, "authorized", false, false, undefined, undefined>>;

package/dist/schema/modules/view-access/legacy/functions/index.d.ts

@@ -0,0 +1,2 @@
+export { legacyAssignViews } from './assign-views.js';
+export { legacyMigrateViewAccess } from './migrate-view-access.js';

package/dist/schema/modules/view-access/legacy/functions/index.js

@@ -1 +1,2 @@
 export { legacyAssignViews } from './assign-views.js';
+export { legacyMigrateViewAccess } from './migrate-view-access.js';

package/dist/schema/modules/view-access/legacy/functions/migrate-view-access.d.ts

@@ -0,0 +1,13 @@
+/**
+ * @deprecated Copy every Shell `view_access` Edge to the Kernel's `view_access`, the one the
+ * Kernel enforces, and delete the Shell's; running it again changes nothing (L-SHELL-20). Replaced
+ * by nothing: Views are given through the Kernel's Edge. Removal: Shell major (delivery step 5),
+ * once every instance has run it.
+ */
+export declare const legacyMigrateViewAccess: import("@astrale-os/sdk/schema").Function<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+    readonly mode: 'value';
+    readonly value: {
+        copied: number;
+        removed: number;
+    };
+}, "authorized", false, false, undefined, undefined>>;

package/dist/schema/modules/view-access/legacy/functions/migrate-view-access.js

@@ -0,0 +1,22 @@
+import { func } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+import { profileRoles } from '../../../role/index.js';
+import { hasRole } from '../../../../policies/index.js';
+/**
+ * @deprecated Copy every Shell `view_access` Edge to the Kernel's `view_access`, the one the
+ * Kernel enforces, and delete the Shell's; running it again changes nothing (L-SHELL-20). Replaced
+ * by nothing: Views are given through the Kernel's Edge. Removal: Shell major (delivery step 5),
+ * once every instance has run it.
+ */
+export const legacyMigrateViewAccess = func({
+    description: "Move the Views given through the Shell's view_access to the Kernel's.",
+    auth: 'authorized',
+    input: z.strictObject({}),
+    output: z.object({
+        /** Kernel Edges created: the Shell Edges whose Kernel Edge did not exist yet. */
+        copied: z.number().int().min(0),
+        /** Shell Edges deleted, all of them once the copy landed. */
+        removed: z.number().int().min(0),
+    }),
+    policy: ({ check, ref }) => check(hasRole, ref(profileRoles['workspace.admin'])),
+});

package/dist/schema/modules/view-access/legacy/index.d.ts

@@ -0,0 +1,4 @@
+export { legacyViewAccess } from './classes/index.js';
+export { legacyHoldsViewAccess } from './policies/index.js';
+export { legacyAssignViews, legacyMigrateViewAccess } from './functions/index.js';
+export { LEGACY_MAX_ASSIGNED_VIEWS, LEGACY_MAX_ASSIGNMENTS, legacyViewAssignment, } from './view-assignment.js';

package/dist/schema/modules/view-access/legacy/index.js

@@ -1,2 +1,4 @@
-export { legacyAssignViews } from './functions/index.js';
+export { legacyViewAccess } from './classes/index.js';
+export { legacyHoldsViewAccess } from './policies/index.js';
+export { legacyAssignViews, legacyMigrateViewAccess } from './functions/index.js';
 export { LEGACY_MAX_ASSIGNED_VIEWS, LEGACY_MAX_ASSIGNMENTS, legacyViewAssignment, } from './view-assignment.js';

package/dist/schema/modules/view-access/legacy/policies/holds-view-access.d.ts

@@ -0,0 +1,5 @@
+/**
+ * @deprecated The subject is the Shell `view_access` Edge's audience, or extends it (L-SHELL-20).
+ * Replaced by the Kernel's `holdsViewAccess`. Removal: with `legacyViewAccess`.
+ */
+export declare const legacyHoldsViewAccess: import("@astrale-os/sdk/schema").Policy;

package/dist/schema/modules/view-access/legacy/policies/holds-view-access.js

@@ -0,0 +1,8 @@
+import { policy } from '@astrale-os/sdk/schema';
+/**
+ * @deprecated The subject is the Shell `view_access` Edge's audience, or extends it (L-SHELL-20).
+ * Replaced by the Kernel's `holdsViewAccess`. Removal: with `legacyViewAccess`.
+ */
+export const legacyHoldsViewAccess = policy({
+    match: ({ sameNode, subject, source }) => sameNode(subject, source),
+});

package/dist/schema/modules/view-access/legacy/policies/index.d.ts

@@ -0,0 +1 @@
+export { legacyHoldsViewAccess } from './holds-view-access.js';

package/dist/schema/modules/view-access/legacy/policies/index.js

@@ -0,0 +1 @@
+export { legacyHoldsViewAccess } from './holds-view-access.js';

package/dist/schema/modules/view-access/legacy/view-assignment.d.ts

@@ -0,0 +1,21 @@
+import { z } from 'zod';
+/**
+ * @deprecated Bounds of one `assignViews` call within the Kernel's Mutation limits (L-SHELL-12).
+ * Replaced by a Mutation on `view_access`. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export declare const LEGACY_MAX_ASSIGNED_VIEWS = 20;
+/**
+ * @deprecated At most 40 identities in one `assignViews` call (L-SHELL-12). Replaced by a Mutation
+ * on `view_access`. Removal: Shell major (delivery step 5) after 1Pact step 4.
+ */
+export declare const LEGACY_MAX_ASSIGNMENTS = 40;
+/**
+ * @deprecated The Views given to one identity (`set`) and withdrawn from it (`unset`), by @NodeId
+ * (L-SHELL-12). Replaced by a Mutation on `view_access`. Removal: Shell major (delivery step 5)
+ * after 1Pact step 4.
+ */
+export declare const legacyViewAssignment: z.ZodObject<{
+    identity: z.ZodString;
+    set: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    unset: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;