@astrale-domains/shell 0.1.0-beta.34 → 0.1.0-beta.36

package/README.md

@@ -1,8 +1,8 @@
 # Shell Domain
 
 Shell owns two concrete Identity classes, User and Group, the member_of_group relation,
-the admin/member Core groups, three static methods, and one application View. There is
-no Space, setup function, personal home, application catalogue, or public repair method.
+the admin/member/applications Core groups, three static methods, one Domain function, and one
+application View. There is no Space, setup function, personal home, or public repair method.
 
 ## Contracts
 
@@ -12,6 +12,20 @@ no Space, setup function, personal home, application catalogue, or public repair
 | Group.assignMember | `{ member: UserPath \| GroupPath, group: GroupPath }` | `{}` |
 | Group.unassignMember | Same | `{}` |
 
+| Domain function | Input | Output |
+| --- | --- | --- |
+| listApplications | `{}` | `{ applications: { origin }[] }` |
+
+listApplications reads every installed Domain with Shell's own authority (Shell requires `read` on
+Kernel `Domain`), then resolves each Domain's View catalogue with the caller's authority and keeps
+only the Domains that expose at least one View to that caller. Its Policy (`usesFunction`) admits any
+caller whose composed profile holds `can_use` on it, so holding the capability is enough.
+
+The Core `applications` Group carries `can_use` on listApplications and View.resolve. Administrators
+hold listApplications directly (a Core Edge cannot author Kernel `extends_with`); members do not.
+Share it dynamically with `Group.assignMember({ member: user, group: applications })`, which composes
+the profile through `extends_with`; `unassignMember` withdraws it.
+
 User extends Kernel.Identity and owns only optional creationKey correlation.
 Concrete business classes may declare their own displayName/email; Shell never reads or writes them.
 Group extends Kernel.Identity, Named and Descriptable. Authentication remains the

package/dist/application.d.ts

@@ -20,7 +20,7 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
                         user: string;
                         state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
                     };
-                }, "authorized", true, false>>;
+                }, "authorized", true, false, undefined>>;
             };
         }>;
         readonly Group: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
@@ -33,14 +33,14 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
-                }, "authorized", true, false>>;
+                }, "authorized", true, false, undefined>>;
                 readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
                     member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
-                }, "authorized", true, false>>;
+                }, "authorized", true, false, undefined>>;
             };
         }>;
         readonly member_of_group: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
@@ -60,10 +60,21 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
             readonly effectiveProperties: never;
         }>;
     };
+    readonly functions: {
+        readonly listApplications: import("@astrale-os/sdk/schema").Function<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: {
+                applications: {
+                    origin: string;
+                }[];
+            };
+        }, "authorized", false, false, undefined>>;
+    };
     readonly policies: {
         readonly belongsToGroup: import("@astrale-os/sdk/schema").Policy;
         readonly ownsClass: import("@astrale-os/sdk/schema").Policy;
         readonly administersShellClass: import("@astrale-os/sdk/schema").Policy;
+        readonly usesFunction: import("@astrale-os/sdk/schema").Policy;
     };
     readonly views: {
         readonly application: import("@astrale-os/sdk/schema").View;
@@ -71,6 +82,7 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
     readonly core: {
         readonly nodes: {
             readonly admin: import("@astrale-os/sdk/schema").CoreNode;
+            readonly applications: import("@astrale-os/sdk/schema").CoreNode;
             readonly member: import("@astrale-os/sdk/schema").CoreNode;
         };
     };

package/dist/application.js

@@ -13,6 +13,8 @@ const applicationRequirements = requirements({
     functions: KernelRootFunctions,
     classes: [
         { class: K.classes.extends_with, operations: ['create', 'read', 'traverse', 'delete'] },
+        // listApplications reads the installed Domain catalogue as Shell.
+        { class: K.classes.Domain, operations: ['read'] },
     ],
     authority: {
         grant: ['create', 'read', 'update', 'delete', 'traverse', 'use', 'revoke'],
@@ -27,6 +29,8 @@ const applicationRequirements = requirements({
                 S.classes.User.static.methods.invite,
                 S.classes.Group.static.methods.assignMember,
                 S.classes.Group.static.methods.unassignMember,
+                // Core Edges cannot author Kernel extends_with, so administrators hold it directly.
+                S.functions.listApplications,
             ],
             classes: [
                 { class: S.classes.User, operations: ['create', 'read', 'traverse', 'update', 'delete'] },
@@ -54,6 +58,11 @@ const applicationRequirements = requirements({
                 K.classes.View.static.methods.resolve,
             ],
         },
+        {
+            // Shared dynamically: Group.assignMember(user, applications) composes this profile.
+            subject: S.core.nodes.applications,
+            functions: [S.functions.listApplications, K.classes.View.static.methods.resolve],
+        },
     ],
 });
 export const application = defineApplication({

package/dist/functions/application/index.js

@@ -0,0 +1 @@
+export { listApplications } from './list-applications.js';

package/dist/functions/application/list-applications.js

@@ -0,0 +1,19 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { Path } from '@astrale-os/sdk/graph/path';
+import { readInstalledDomainOrigins } from '../../queries/application/index.js';
+/** Catalogues resolved together, so a large instance does not flood the Kernel. */
+const RESOLVE_BATCH = 16;
+export const listApplications = defineAction()('listApplications', async ({ query, kernel }) => {
+    const origins = await query(readInstalledDomainOrigins, {});
+    const applications = [];
+    for (let offset = 0; offset < origins.length; offset += RESOLVE_BATCH) {
+        const batch = origins.slice(offset, offset + RESOLVE_BATCH);
+        // The caller's authority decides which Views it can open.
+        const catalogues = await Promise.all(batch.map((origin) => kernel.caller.viewsFor(Path.domain(origin))));
+        for (const [index, origin] of batch.entries()) {
+            if (catalogues[index].views.length > 0)
+                applications.push({ origin });
+        }
+    }
+    return { applications };
+});

package/dist/queries/application/index.js

@@ -0,0 +1 @@
+export { readInstalledDomainOrigins } from './read-installed-domain-origins.js';

package/dist/queries/application/read-installed-domain-origins.js

@@ -0,0 +1,22 @@
+import { defineQuery, Query, queryResult, } from '@astrale-os/sdk/query';
+/** Every installed Domain origin this authority can read, in origin order. */
+export const readInstalledDomainOrigins = defineQuery()((domain) => ({
+    id: 'shell.application.domain-origins',
+    page: { size: 200 },
+    pagination: { maximumPages: 50 },
+    build: () => Query.from({ nodes: [domain.dependencies.kernel.classes.Domain] }).select({
+        kind: 'nodes',
+        projection: { kind: 'value' },
+    }),
+    project(pages) {
+        return queryResult
+            .completeNodeValues(pages, 'Installed Domains')
+            .map((installed) => {
+            const value = installed.props[domain.dependencies.kernel.classes.Domain.properties.origin.key];
+            if (typeof value !== 'string')
+                throw new TypeError('Installed Domain has no origin.');
+            return value;
+        })
+            .sort((left, right) => left.localeCompare(right));
+    },
+}));

package/dist/runtime.d.ts

@@ -31,7 +31,7 @@ declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDe
                         user: string;
                         state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
                     };
-                }, "authorized", true, false>>;
+                }, "authorized", true, false, undefined>>;
             };
         }>;
         readonly Group: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
@@ -44,14 +44,14 @@ declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDe
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
-                }, "authorized", true, false>>;
+                }, "authorized", true, false, undefined>>;
                 readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
                     member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
-                }, "authorized", true, false>>;
+                }, "authorized", true, false, undefined>>;
             };
         }>;
         readonly member_of_group: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
@@ -71,10 +71,21 @@ declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDe
             readonly effectiveProperties: never;
         }>;
     };
+    readonly functions: {
+        readonly listApplications: import("@astrale-os/sdk/schema").Function<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: {
+                applications: {
+                    origin: string;
+                }[];
+            };
+        }, "authorized", false, false, undefined>>;
+    };
     readonly policies: {
         readonly belongsToGroup: import("@astrale-os/sdk/schema").Policy;
         readonly ownsClass: import("@astrale-os/sdk/schema").Policy;
         readonly administersShellClass: import("@astrale-os/sdk/schema").Policy;
+        readonly usesFunction: import("@astrale-os/sdk/schema").Policy;
     };
     readonly views: {
         readonly application: import("@astrale-os/sdk/schema").View;
@@ -82,6 +93,7 @@ declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDe
     readonly core: {
         readonly nodes: {
             readonly admin: import("@astrale-os/sdk/schema").CoreNode;
+            readonly applications: import("@astrale-os/sdk/schema").CoreNode;
             readonly member: import("@astrale-os/sdk/schema").CoreNode;
         };
     };
@@ -134,7 +146,7 @@ declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDe
                         user: string;
                         state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
                     };
-                }, "authorized", true, false>>;
+                }, "authorized", true, false, undefined>>;
             };
         }>;
         readonly Group: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
@@ -147,14 +159,14 @@ declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDe
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
-                }, "authorized", true, false>>;
+                }, "authorized", true, false, undefined>>;
                 readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
                     member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
-                }, "authorized", true, false>>;
+                }, "authorized", true, false, undefined>>;
             };
         }>;
         readonly member_of_group: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
@@ -174,10 +186,21 @@ declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDe
             readonly effectiveProperties: never;
         }>;
     };
+    readonly functions: {
+        readonly listApplications: import("@astrale-os/sdk/schema").Function<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: {
+                applications: {
+                    origin: string;
+                }[];
+            };
+        }, "authorized", false, false, undefined>>;
+    };
     readonly policies: {
         readonly belongsToGroup: import("@astrale-os/sdk/schema").Policy;
         readonly ownsClass: import("@astrale-os/sdk/schema").Policy;
         readonly administersShellClass: import("@astrale-os/sdk/schema").Policy;
+        readonly usesFunction: import("@astrale-os/sdk/schema").Policy;
     };
     readonly views: {
         readonly application: import("@astrale-os/sdk/schema").View;
@@ -185,6 +208,7 @@ declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDe
     readonly core: {
         readonly nodes: {
             readonly admin: import("@astrale-os/sdk/schema").CoreNode;
+            readonly applications: import("@astrale-os/sdk/schema").CoreNode;
             readonly member: import("@astrale-os/sdk/schema").CoreNode;
         };
     };
@@ -235,7 +259,7 @@ declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDe
                         user: string;
                         state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
                     };
-                }, "authorized", true, false>>;
+                }, "authorized", true, false, undefined>>;
             };
         }>;
         readonly Group: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
@@ -248,14 +272,14 @@ declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDe
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
-                }, "authorized", true, false>>;
+                }, "authorized", true, false, undefined>>;
                 readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
                     member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
-                }, "authorized", true, false>>;
+                }, "authorized", true, false, undefined>>;
             };
         }>;
         readonly member_of_group: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
@@ -275,10 +299,21 @@ declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDe
             readonly effectiveProperties: never;
         }>;
     };
+    readonly functions: {
+        readonly listApplications: import("@astrale-os/sdk/schema").Function<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: {
+                applications: {
+                    origin: string;
+                }[];
+            };
+        }, "authorized", false, false, undefined>>;
+    };
     readonly policies: {
         readonly belongsToGroup: import("@astrale-os/sdk/schema").Policy;
         readonly ownsClass: import("@astrale-os/sdk/schema").Policy;
         readonly administersShellClass: import("@astrale-os/sdk/schema").Policy;
+        readonly usesFunction: import("@astrale-os/sdk/schema").Policy;
     };
     readonly views: {
         readonly application: import("@astrale-os/sdk/schema").View;
@@ -286,6 +321,7 @@ declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDe
     readonly core: {
         readonly nodes: {
             readonly admin: import("@astrale-os/sdk/schema").CoreNode;
+            readonly applications: import("@astrale-os/sdk/schema").CoreNode;
             readonly member: import("@astrale-os/sdk/schema").CoreNode;
         };
     };
@@ -317,7 +353,94 @@ declare const functions: readonly [import("@astrale-os/sdk/workflow").WorkflowDe
             outcomeKnown: import("zod").ZodLiteral<false>;
         }, import("zod/v4/core").$strict>;
     };
-}>];
+}>, import("@astrale-os/sdk/action").ActionDefinition<import("@astrale-os/sdk/schema").AuthoredSchema<"shell.astrale.ai", readonly ["kernel.astrale.ai", import("@astrale-os/sdk/schema").KernelSchema] | readonly ["shell.astrale.ai", {
+    readonly classes: {
+        readonly User: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+            readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">];
+            readonly properties: {
+                readonly creationKey: import("zod").ZodOptional<import("zod").ZodString>;
+            };
+            readonly methods: {
+                readonly invite: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    user: string;
+                    email: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: {
+                        invitationId: string;
+                        user: string;
+                        state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
+                    };
+                }, "authorized", true, false, undefined>>;
+            };
+        }>;
+        readonly Group: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
+            readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
+            readonly extends: readonly [import("@astrale-os/sdk/schema").KernelClass<"Identity">, import("@astrale-os/sdk/schema").KernelClass<"Named">, import("@astrale-os/sdk/schema").KernelClass<"Descriptable">];
+            readonly methods: {
+                readonly assignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
+                    group: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", true, false, undefined>>;
+                readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
+                    member: string;
+                    group: string;
+                }, {
+                    readonly mode: 'value';
+                    readonly value: Record<string, never>;
+                }, "authorized", true, false, undefined>>;
+            };
+        }>;
+        readonly member_of_group: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+            readonly depth: 0;
+            readonly abstract: false;
+            readonly extends: readonly [];
+            readonly properties: never;
+            readonly source: {
+                readonly as: "member";
+                readonly outgoing: "0..*";
+            };
+            readonly target: {
+                readonly as: "group";
+                readonly incoming: "0..*";
+            };
+            readonly constraints: Record<never, never>;
+            readonly effectiveProperties: never;
+        }>;
+    };
+    readonly functions: {
+        readonly listApplications: import("@astrale-os/sdk/schema").Function<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: {
+                applications: {
+                    origin: string;
+                }[];
+            };
+        }, "authorized", false, false, undefined>>;
+    };
+    readonly policies: {
+        readonly belongsToGroup: import("@astrale-os/sdk/schema").Policy;
+        readonly ownsClass: import("@astrale-os/sdk/schema").Policy;
+        readonly administersShellClass: import("@astrale-os/sdk/schema").Policy;
+        readonly usesFunction: import("@astrale-os/sdk/schema").Policy;
+    };
+    readonly views: {
+        readonly application: import("@astrale-os/sdk/schema").View;
+    };
+    readonly core: {
+        readonly nodes: {
+            readonly admin: import("@astrale-os/sdk/schema").CoreNode;
+            readonly applications: import("@astrale-os/sdk/schema").CoreNode;
+            readonly member: import("@astrale-os/sdk/schema").CoreNode;
+        };
+    };
+}, {
+    readonly kernel: "kernel.astrale.ai";
+}]>, "listApplications", Readonly<Record<never, never>>, Readonly<Record<never, never>>>];
 export type ShellRuntime = Runtime<ShellSchema, typeof integrations, typeof initialize, typeof functions>;
 declare const runtime: ShellRuntime;
 export default runtime;

package/dist/runtime.js

@@ -1,4 +1,5 @@
 import { defineRuntime } from '@astrale-os/sdk/runtime';
+import { listApplications } from './functions/application/index.js';
 import { assignMember, unassignMember } from './functions/group/index.js';
 import { invite } from './functions/user/index.js';
 import { integrations } from './integrations/index.js';
@@ -6,7 +7,7 @@ import { enrollmentProvider } from './providers/admin-enrollment/index.js';
 const initialize = (environment) => ({
     providers: { enrollment: enrollmentProvider(environment) },
 });
-const functions = [invite, assignMember, unassignMember];
+const functions = [invite, assignMember, unassignMember, listApplications];
 const runtime = defineRuntime()({
     integrations,
     initialize,

package/dist/schema/index.d.ts

@@ -1,4 +1,5 @@
 export { ShellSchema, S, type Shell, type ShellClasses, type ShellSchemaInput } from './schema.js';
 export { User } from './modules/user/index.js';
 export type { InvitationSummary } from './modules/user/index.js';
-export { Group, member_of_group, adminGroup, memberGroup } from './modules/group/index.js';
+export { Group, member_of_group, adminGroup, applicationsGroup, memberGroup, } from './modules/group/index.js';
+export { listApplications, type ApplicationEntry } from './modules/application/index.js';

package/dist/schema/index.js

@@ -1,3 +1,4 @@
 export { ShellSchema, S } from './schema.js';
 export { User } from './modules/user/index.js';
-export { Group, member_of_group, adminGroup, memberGroup } from './modules/group/index.js';
+export { Group, member_of_group, adminGroup, applicationsGroup, memberGroup, } from './modules/group/index.js';
+export { listApplications } from './modules/application/index.js';

package/dist/schema/modules/application/functions/index.d.ts

@@ -0,0 +1 @@
+export { listApplications } from './list-applications.js';

package/dist/schema/modules/application/functions/index.js

@@ -0,0 +1 @@
+export { listApplications } from './list-applications.js';

package/dist/schema/modules/application/functions/list-applications.d.ts

@@ -0,0 +1,13 @@
+import { type Function as SchemaFunction } from '@astrale-os/sdk/schema';
+/**
+ * Installed Domains that expose at least one View to the caller. Shell reads the Domain catalogue
+ * with its own authority; each catalogue of Views is resolved with the caller's.
+ */
+export declare const listApplications: SchemaFunction<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+    readonly mode: 'value';
+    readonly value: {
+        applications: {
+            origin: string;
+        }[];
+    };
+}, "authorized", false, false, undefined>>;

package/dist/schema/modules/application/functions/list-applications.js

@@ -0,0 +1,16 @@
+import { func } from '@astrale-os/sdk/schema';
+import { z } from 'zod';
+import { usesFunction } from '../../../policies/index.js';
+import { applicationEntry } from '../types/index.js';
+/**
+ * Installed Domains that expose at least one View to the caller. Shell reads the Domain catalogue
+ * with its own authority; each catalogue of Views is resolved with the caller's.
+ */
+export const listApplications = func({
+    description: 'List the installed Domains whose Views the caller can open.',
+    auth: 'authorized',
+    input: z.strictObject({}),
+    output: z.object({ applications: z.array(applicationEntry) }),
+    // Holding can_use is enough: membership of the Applications Group shares it dynamically.
+    policy: ({ check, ref }) => check(usesFunction, ref(() => listApplications)),
+});

package/dist/schema/modules/application/index.d.ts

@@ -0,0 +1,2 @@
+export { listApplications } from './functions/index.js';
+export { applicationEntry, type ApplicationEntry } from './types/index.js';

package/dist/schema/modules/application/index.js

@@ -0,0 +1,2 @@
+export { listApplications } from './functions/index.js';
+export { applicationEntry } from './types/index.js';

package/dist/schema/modules/application/types/application-entry.d.ts

@@ -0,0 +1,5 @@
+import { z } from 'zod';
+export declare const applicationEntry: z.ZodObject<{
+    origin: z.ZodString;
+}, z.core.$strip>;
+export type ApplicationEntry = z.infer<typeof applicationEntry>;

package/dist/schema/modules/application/types/application-entry.js

@@ -0,0 +1,2 @@
+import { z } from 'zod';
+export const applicationEntry = z.object({ origin: z.string().min(1) });

package/dist/schema/modules/application/types/index.d.ts

@@ -0,0 +1 @@
+export { applicationEntry, type ApplicationEntry } from './application-entry.js';

package/dist/schema/modules/application/types/index.js

@@ -0,0 +1 @@
+export { applicationEntry } from './application-entry.js';

package/dist/schema/modules/group/classes/group.d.ts

@@ -8,13 +8,13 @@ export declare const Group: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
         }, {
             readonly mode: 'value';
             readonly value: Record<string, never>;
-        }, "authorized", true, false>>;
+        }, "authorized", true, false, undefined>>;
         readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
             member: string;
             group: string;
         }, {
             readonly mode: 'value';
             readonly value: Record<string, never>;
-        }, "authorized", true, false>>;
+        }, "authorized", true, false, undefined>>;
     };
 }>;

package/dist/schema/modules/group/core/applications-group.d.ts

@@ -0,0 +1 @@
+export declare const applicationsGroup: import("@astrale-os/sdk/schema").CoreNode;

package/dist/schema/modules/group/core/applications-group.js

@@ -0,0 +1,6 @@
+import { K, core } from '@astrale-os/sdk/schema';
+import { Group } from '../classes/group.js';
+export const applicationsGroup = core.node(() => Group, {
+    [K.classes.Named.properties.name.key]: 'Applications',
+    [K.classes.Descriptable.properties.description.key]: 'May list the installed applications they can open.',
+});

package/dist/schema/modules/group/core/index.d.ts

@@ -1,2 +1,3 @@
 export { adminGroup } from './administrators-group.js';
+export { applicationsGroup } from './applications-group.js';
 export { memberGroup } from './members-group.js';

package/dist/schema/modules/group/core/index.js

@@ -1,2 +1,3 @@
 export { adminGroup } from './administrators-group.js';
+export { applicationsGroup } from './applications-group.js';
 export { memberGroup } from './members-group.js';

package/dist/schema/modules/group/index.d.ts

@@ -1,3 +1,3 @@
 export { Group, member_of_group } from './classes/index.js';
-export { adminGroup, memberGroup } from './core/index.js';
+export { adminGroup, applicationsGroup, memberGroup } from './core/index.js';
 export { belongsToGroup } from './policies/index.js';

package/dist/schema/modules/group/index.js

@@ -1,3 +1,3 @@
 export { Group, member_of_group } from './classes/index.js';
-export { adminGroup, memberGroup } from './core/index.js';
+export { adminGroup, applicationsGroup, memberGroup } from './core/index.js';
 export { belongsToGroup } from './policies/index.js';

package/dist/schema/modules/user/classes/user.d.ts

@@ -16,6 +16,6 @@ export declare const User: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
                 user: string;
                 state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
             };
-        }, "authorized", true, false>>;
+        }, "authorized", true, false, undefined>>;
     };
 }>;

package/dist/schema/policies/index.js

@@ -1,2 +1,3 @@
 export { ownsClass } from './owns-class.js';
 export { administersShellClass } from './administers-shell-class.js';
+export { usesFunction } from './uses-function.js';

package/dist/schema/policies/uses-function.js

@@ -0,0 +1,5 @@
+import { K, policy } from '@astrale-os/sdk/schema';
+/** The subject may use the object Function: its own or a composed Identity holds can_use on it. */
+export const usesFunction = policy({
+    match: ({ edge, subject, object }) => edge({ source: subject, class: () => K.classes.can_use, target: object }),
+});

package/dist/schema/schema.d.ts

@@ -18,7 +18,7 @@ declare const classes: {
                     user: string;
                     state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
                 };
-            }, "authorized", true, false>>;
+            }, "authorized", true, false, undefined>>;
         };
     }>;
     readonly Group: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
@@ -31,14 +31,14 @@ declare const classes: {
             }, {
                 readonly mode: 'value';
                 readonly value: Record<string, never>;
-            }, "authorized", true, false>>;
+            }, "authorized", true, false, undefined>>;
             readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
                 member: string;
                 group: string;
             }, {
                 readonly mode: 'value';
                 readonly value: Record<string, never>;
-            }, "authorized", true, false>>;
+            }, "authorized", true, false, undefined>>;
         };
     }>;
     readonly member_of_group: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
@@ -81,7 +81,7 @@ declare const input: {
                         user: string;
                         state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
                     };
-                }, "authorized", true, false>>;
+                }, "authorized", true, false, undefined>>;
             };
         }>;
         readonly Group: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
@@ -94,14 +94,14 @@ declare const input: {
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
-                }, "authorized", true, false>>;
+                }, "authorized", true, false, undefined>>;
                 readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
                     member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
-                }, "authorized", true, false>>;
+                }, "authorized", true, false, undefined>>;
             };
         }>;
         readonly member_of_group: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
@@ -121,10 +121,21 @@ declare const input: {
             readonly effectiveProperties: never;
         }>;
     };
+    readonly functions: {
+        readonly listApplications: import("@astrale-os/sdk/schema").Function<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: {
+                applications: {
+                    origin: string;
+                }[];
+            };
+        }, "authorized", false, false, undefined>>;
+    };
     readonly policies: {
         readonly belongsToGroup: import("@astrale-os/sdk/schema").Policy;
         readonly ownsClass: import("@astrale-os/sdk/schema").Policy;
         readonly administersShellClass: import("@astrale-os/sdk/schema").Policy;
+        readonly usesFunction: import("@astrale-os/sdk/schema").Policy;
     };
     readonly views: {
         readonly application: import("@astrale-os/sdk/schema").View;
@@ -132,6 +143,7 @@ declare const input: {
     readonly core: {
         readonly nodes: {
             readonly admin: import("@astrale-os/sdk/schema").CoreNode;
+            readonly applications: import("@astrale-os/sdk/schema").CoreNode;
             readonly member: import("@astrale-os/sdk/schema").CoreNode;
         };
     };
@@ -156,7 +168,7 @@ export declare const ShellSchema: import("@astrale-os/sdk/schema").AuthoredSchem
                         user: string;
                         state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
                     };
-                }, "authorized", true, false>>;
+                }, "authorized", true, false, undefined>>;
             };
         }>;
         readonly Group: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
@@ -169,14 +181,14 @@ export declare const ShellSchema: import("@astrale-os/sdk/schema").AuthoredSchem
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
-                }, "authorized", true, false>>;
+                }, "authorized", true, false, undefined>>;
                 readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
                     member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
-                }, "authorized", true, false>>;
+                }, "authorized", true, false, undefined>>;
             };
         }>;
         readonly member_of_group: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
@@ -196,10 +208,21 @@ export declare const ShellSchema: import("@astrale-os/sdk/schema").AuthoredSchem
             readonly effectiveProperties: never;
         }>;
     };
+    readonly functions: {
+        readonly listApplications: import("@astrale-os/sdk/schema").Function<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: {
+                applications: {
+                    origin: string;
+                }[];
+            };
+        }, "authorized", false, false, undefined>>;
+    };
     readonly policies: {
         readonly belongsToGroup: import("@astrale-os/sdk/schema").Policy;
         readonly ownsClass: import("@astrale-os/sdk/schema").Policy;
         readonly administersShellClass: import("@astrale-os/sdk/schema").Policy;
+        readonly usesFunction: import("@astrale-os/sdk/schema").Policy;
     };
     readonly views: {
         readonly application: import("@astrale-os/sdk/schema").View;
@@ -207,6 +230,7 @@ export declare const ShellSchema: import("@astrale-os/sdk/schema").AuthoredSchem
     readonly core: {
         readonly nodes: {
             readonly admin: import("@astrale-os/sdk/schema").CoreNode;
+            readonly applications: import("@astrale-os/sdk/schema").CoreNode;
             readonly member: import("@astrale-os/sdk/schema").CoreNode;
         };
     };
@@ -233,7 +257,7 @@ export declare const S: schema.ResolvedDomainOf<import("@astrale-os/sdk/schema")
                         user: string;
                         state: "accepted" | "cancelled" | "completed" | "expired" | "failed" | "pending" | "registered" | "registering";
                     };
-                }, "authorized", true, false>>;
+                }, "authorized", true, false, undefined>>;
             };
         }>;
         readonly Group: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
@@ -246,14 +270,14 @@ export declare const S: schema.ResolvedDomainOf<import("@astrale-os/sdk/schema")
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
-                }, "authorized", true, false>>;
+                }, "authorized", true, false, undefined>>;
                 readonly unassignMember: import("@astrale-os/sdk/schema").Method<import("@astrale-os/sdk/schema").CallableProjection<{
                     member: string;
                     group: string;
                 }, {
                     readonly mode: 'value';
                     readonly value: Record<string, never>;
-                }, "authorized", true, false>>;
+                }, "authorized", true, false, undefined>>;
             };
         }>;
         readonly member_of_group: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
@@ -273,10 +297,21 @@ export declare const S: schema.ResolvedDomainOf<import("@astrale-os/sdk/schema")
             readonly effectiveProperties: never;
         }>;
     };
+    readonly functions: {
+        readonly listApplications: import("@astrale-os/sdk/schema").Function<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: {
+                applications: {
+                    origin: string;
+                }[];
+            };
+        }, "authorized", false, false, undefined>>;
+    };
     readonly policies: {
         readonly belongsToGroup: import("@astrale-os/sdk/schema").Policy;
         readonly ownsClass: import("@astrale-os/sdk/schema").Policy;
         readonly administersShellClass: import("@astrale-os/sdk/schema").Policy;
+        readonly usesFunction: import("@astrale-os/sdk/schema").Policy;
     };
     readonly views: {
         readonly application: import("@astrale-os/sdk/schema").View;
@@ -284,6 +319,7 @@ export declare const S: schema.ResolvedDomainOf<import("@astrale-os/sdk/schema")
     readonly core: {
         readonly nodes: {
             readonly admin: import("@astrale-os/sdk/schema").CoreNode;
+            readonly applications: import("@astrale-os/sdk/schema").CoreNode;
             readonly member: import("@astrale-os/sdk/schema").CoreNode;
         };
     };

package/dist/schema/schema.js

@@ -1,17 +1,22 @@
 import { defineSchema, KernelSchema, schema } from '@astrale-os/sdk/schema';
-import { Group, member_of_group, adminGroup, memberGroup, belongsToGroup, } from './modules/group/index.js';
+import { listApplications } from './modules/application/index.js';
+import { Group, member_of_group, adminGroup, applicationsGroup, memberGroup, belongsToGroup, } from './modules/group/index.js';
 import { User } from './modules/user/index.js';
-import { ownsClass, administersShellClass } from './policies/index.js';
+import { ownsClass, administersShellClass, usesFunction } from './policies/index.js';
 import { applicationView } from './views/index.js';
 export const ORIGIN = 'shell.astrale.ai';
 const dependencies = { kernel: KernelSchema };
 const classes = { User, Group, member_of_group };
-const policies = { belongsToGroup, ownsClass, administersShellClass };
+const functions = { listApplications };
+const policies = { belongsToGroup, ownsClass, administersShellClass, usesFunction };
 const views = { application: applicationView };
-const core = { nodes: { admin: adminGroup, member: memberGroup } };
+const core = {
+    nodes: { admin: adminGroup, applications: applicationsGroup, member: memberGroup },
+};
 const input = {
     dependencies,
     classes,
+    functions,
     policies,
     views,
     core,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-domains/shell",
-  "version": "0.1.0-beta.34",
+  "version": "0.1.0-beta.36",
   "description": "Astrale Shell Domain schema and remote product implementation",
   "license": "Apache-2.0",
   "repository": {
@@ -58,7 +58,7 @@
   },
   "devDependencies": {
     "@astrale-os/ox": "0.1.4",
-    "@astrale-os/sdk": "0.6.0-beta.0",
+    "@astrale-os/sdk": "0.6.0-beta.4",
     "@astrale/typescript-config": "npm:@jsr/astrale__typescript-config@~2.0.0",
     "@types/node": "26.2.0",
     "happy-dom": "20.11.2",
@@ -67,7 +67,7 @@
     "vitest": "5.0.1"
   },
   "peerDependencies": {
-    "@astrale-os/sdk": ">=0.6.0-beta.0 <1.0.0"
+    "@astrale-os/sdk": ">=0.6.0-beta.4 <1.0.0"
   },
   "devEngines": {
     "runtime": {