@astrale-domains/shell 0.1.0-beta.41 → 0.1.0-beta.42

package/README.md

@@ -23,10 +23,13 @@ not listed. Shell requires `read` on Kernel `Domain` and `of_domain`, and `trave
 and `View`. Its `usesFunction` Policy admits any caller whose composed profile holds `can_use`
 on the Function, so holding the capability is enough.
 
-The Core `applications` Group carries `can_use` on listEntrypoints and View.resolve. Administrators
-hold both directly (a Core Edge cannot author Kernel `extends_with`); members do not.
-Share them dynamically with `Group.assignMember({ member: user, group: applications })`, which
-composes the profile through `extends_with`; `unassignMember` withdraws it.
+The workspace opens only once listEntrypoints answers, so every profile that admits a person to
+the workspace holds it. Administrators and members hold both listEntrypoints and View.resolve
+directly (a Core Edge cannot author Kernel `extends_with`): an invited person, whom Admin assigns
+to Core member, can open the workspace. The Core `applications` Group carries the same two
+capabilities for Identities outside Members. Share them dynamically with
+`Group.assignMember({ member: identity, group: applications })`, which composes the profile through
+`extends_with`; `unassignMember` withdraws it.
 
 User extends Kernel.Identity and owns only optional creationKey correlation.
 Concrete business classes may declare their own displayName/email; Shell never reads or writes them.
@@ -89,7 +92,8 @@ Kernel E2E evidence, not a handler test, qualifies this behavior.
 The Shell principal requests all Kernel root functions, the required extends_with operations,
 and the declared grant/revoke authority. Core admin receives the full declared Shell profile,
 including invite, assignMember and unassignMember so humans inheriting admin can call those methods.
-Core member receives Introspect, Query, Mutate and View.resolve, not blanket class-read grants.
+Core member receives Download, Introspect, Query, Mutate, View.resolve and listEntrypoints, not
+blanket class-read grants.
 The Domain definition's requirements, including Core Identity capabilities in requirements.core, are owned by domain.ts and materialized by installation,
 never by invitation handlers.
 

package/dist/domain.js

@@ -60,10 +60,12 @@ const domainRequirements = requirements({
                 K.functions.query,
                 K.functions.mutate,
                 K.classes.View.static.methods.resolve,
+                // The workspace opens only on this catalogue: an invited member must be able to read it.
+                S.functions.listEntrypoints,
             ],
         },
         {
-            // Shared dynamically: Group.assignMember(user, applications) composes this profile.
+            // For Identities outside Members: Group.assignMember(identity, applications) composes it.
             subject: S.core.nodes.applications,
             functions: [S.functions.listEntrypoints, K.classes.View.static.methods.resolve],
         },

package/dist/schema/modules/application/functions/list-entrypoints.js

@@ -11,6 +11,6 @@ export const listEntrypoints = func({
     auth: 'authorized',
     input: z.strictObject({}),
     output: z.object({ entrypoints: z.array(entrypointEntry) }),
-    // Holding can_use is enough: membership of the Applications Group shares it dynamically.
+    // Holding can_use is enough: Core admin and member hold it; the Applications Group shares it.
     policy: ({ check, ref }) => check(usesFunction, ref(() => listEntrypoints)),
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-domains/shell",
-  "version": "0.1.0-beta.41",
+  "version": "0.1.0-beta.42",
   "description": "Astrale Shell Domain schema and remote product implementation",
   "license": "Apache-2.0",
   "repository": {
@@ -58,8 +58,8 @@
   },
   "devDependencies": {
     "@astrale-os/ox": "0.1.4",
-    "@astrale-os/sdk": "0.6.0-beta.25",
-    "@astrale-os/shell-react": ">=0.6.0-beta.1 <1.0.0",
+    "@astrale-os/sdk": "0.6.0-beta.28",
+    "@astrale-os/shell-react": ">=0.6.0-beta.2 <1.0.0",
     "@astrale-os/ui": "1.0.0-beta.32",
     "@astrale/typescript-config": "npm:@jsr/astrale__typescript-config@~2.0.0",
     "@testing-library/dom": "10.4.1",
@@ -76,7 +76,7 @@
     "vitest": "5.0.1"
   },
   "peerDependencies": {
-    "@astrale-os/sdk": ">=0.6.0-beta.25 <1.0.0"
+    "@astrale-os/sdk": ">=0.6.0-beta.28 <1.0.0"
   },
   "devEngines": {
     "runtime": {