@astrale-os/shell-react 0.3.2-beta.5 → 0.3.2-beta.7

package/CHANGELOG.md

@@ -0,0 +1,210 @@
+# Changelog
+
+## [0.3.2-beta.7](https://github.com/astrale-os/shell/compare/shell-react-v0.3.2-beta.6...shell-react-v0.3.2-beta.7) (2026-08-29)
+
+
+### Features
+
+* **runtime:** enforce declared iframe requirements ([#129](https://github.com/astrale-os/shell/issues/129)) ([7b8d84a](https://github.com/astrale-os/shell/commit/7b8d84a1189e95c94c2de9f1759b6510a5467813))
+* **shell:** adopt flat identity authentication ([#114](https://github.com/astrale-os/shell/issues/114)) ([f267a79](https://github.com/astrale-os/shell/commit/f267a79cd8bd58c29379c4be91b481c5dd20f1cf))
+
+
+### Bug Fixes
+
+* **domain:** publish visibility-free Shell bundle ([#131](https://github.com/astrale-os/shell/issues/131)) ([61f48e5](https://github.com/astrale-os/shell/commit/61f48e56f9b18a0b83d395ce1bae648d2470140c))
+
+## [0.3.2-beta.6](https://github.com/astrale-os/shell/compare/shell-react-v0.3.2-beta.5...shell-react-v0.3.2-beta.6) (2026-08-28)
+
+
+### Bug Fixes
+
+* **domain:** align canonical SDK contracts ([#117](https://github.com/astrale-os/shell/issues/117)) ([78df43d](https://github.com/astrale-os/shell/commit/78df43df4b2878221c7bfc83b32944264b3835e8))
+* surface Domain binding diagnostics ([#125](https://github.com/astrale-os/shell/issues/125)) ([e37b6ca](https://github.com/astrale-os/shell/commit/e37b6ca1634ea5655dafbb2386af2c7198a55fe9))
+
+## [0.3.2-beta.5](https://github.com/astrale-os/shell/compare/shell-react-v0.3.2-beta.4...shell-react-v0.3.2-beta.5) (2026-08-27)
+
+
+### Bug Fixes
+
+* **react:** publish against Shell beta.7 ([#115](https://github.com/astrale-os/shell/issues/115)) ([2e2ad9e](https://github.com/astrale-os/shell/commit/2e2ad9e471b6c39413260f76954432a53be2cb23))
+
+## [0.3.2-beta.4](https://github.com/astrale-os/shell/compare/shell-react-v0.3.2-beta.3...shell-react-v0.3.2-beta.4) (2026-08-26)
+
+
+### Bug Fixes
+
+* **react:** preserve in-flight queries through StrictMode ([#112](https://github.com/astrale-os/shell/issues/112)) ([e5b7cd7](https://github.com/astrale-os/shell/commit/e5b7cd75e001be393d94e168089eb66a1da4bfb2))
+* **shell:** align the published Shell cohort ([#109](https://github.com/astrale-os/shell/issues/109)) ([6c79cb6](https://github.com/astrale-os/shell/commit/6c79cb6f0370aad84565dda27d2af1a5579c18ff))
+
+## [0.3.2-beta.3](https://github.com/astrale-os/shell/compare/shell-react-v0.3.2-beta.2...shell-react-v0.3.2-beta.3) (2026-08-26)
+
+
+### Bug Fixes
+
+* **deploy:** consume current SDK toolchain ([#96](https://github.com/astrale-os/shell/issues/96)) ([73956a0](https://github.com/astrale-os/shell/commit/73956a05a2c9e107afedfa7b1878716644074bc1))
+* **deps:** consume cloudflare adapter beta.44 ([#101](https://github.com/astrale-os/shell/issues/101)) ([7e9f214](https://github.com/astrale-os/shell/commit/7e9f214fe06979d5e1a7f4ca3b00cf431ab50944))
+
+## [0.3.2-beta.2](https://github.com/astrale-os/shell/compare/shell-react-v0.3.2-beta.1...shell-react-v0.3.2-beta.2) (2026-08-25)
+
+
+### Bug Fixes
+
+* retain sandboxed View proof boundaries ([#80](https://github.com/astrale-os/shell/issues/80)) ([7de8800](https://github.com/astrale-os/shell/commit/7de8800dc42106bd4aa0f8a6340117d17c51d195))
+
+## [0.3.2-beta.1](https://github.com/astrale-os/shell/compare/shell-react-v0.3.2-beta...shell-react-v0.3.2-beta.1) (2026-08-25)
+
+
+### Features
+
+* **react:** bind projected recipes to domain context ([#72](https://github.com/astrale-os/shell/issues/72)) ([1d963dc](https://github.com/astrale-os/shell/commit/1d963dc33e98ec7c4b1cece467c9b2428e07aeea))
+
+
+### Bug Fixes
+
+* **packages:** keep install guards private ([#71](https://github.com/astrale-os/shell/issues/71)) ([20a34ee](https://github.com/astrale-os/shell/commit/20a34eeafea868f31663b3076928c3528f4e1aec))
+
+## [0.3.2-beta](https://github.com/astrale-os/shell/compare/shell-react-v0.3.1...shell-react-v0.3.2-beta) (2026-08-24)
+
+
+### Bug Fixes
+
+* **deps:** align Shell packages with SDK beta.22 ([#65](https://github.com/astrale-os/shell/issues/65)) ([18db939](https://github.com/astrale-os/shell/commit/18db93958e64678f9c000e258c12a97525fa95ef))
+* **deps:** require Shell 0.4.2 beta ([#70](https://github.com/astrale-os/shell/issues/70)) ([b6ec3b3](https://github.com/astrale-os/shell/commit/b6ec3b39cd8ab571e7a3e64092e896ac8e14cd62))
+* qualify the Shell release cohort ([8f837e1](https://github.com/astrale-os/shell/commit/8f837e1bf14600db18b96da6de7878f34321332c))
+* qualify the Shell release cohort ([efb23d7](https://github.com/astrale-os/shell/commit/efb23d71088a407209a01cec33e5571d86ecde51))
+* **release:** preserve SDK dependency ownership ([#62](https://github.com/astrale-os/shell/issues/62)) ([5199f73](https://github.com/astrale-os/shell/commit/5199f7358a64cfb1163ebb6d13c94a8b8080bcc1))
+
+## [0.3.1](https://github.com/astrale-os/shell/compare/shell-react-v0.3.0...shell-react-v0.3.1) (2026-08-24)
+
+
+### Bug Fixes
+
+* **release:** qualify published sdk runtime context ([b1411a0](https://github.com/astrale-os/shell/commit/b1411a01710bab785b31c02c81ea09bc902f4e42))
+
+## [0.3.0](https://github.com/astrale-os/shell/compare/shell-react-v0.2.9...shell-react-v0.3.0) (2026-08-24)
+
+
+### ⚠ BREAKING CHANGES
+
+* adopt path-only invocation
+
+### Features
+
+* adopt kernel client session vocabulary ([95877b2](https://github.com/astrale-os/shell/commit/95877b25e6d672fe69f14b28ac9fa712b0649a76))
+* adopt Kernel Client Session vocabulary ([ac61164](https://github.com/astrale-os/shell/commit/ac61164bba8540931ad7c0c2cf68be95fb3336c0))
+* adopt Kernel V2 at the Shell client boundary ([6654ef7](https://github.com/astrale-os/shell/commit/6654ef7989691664af777824be2c97a2906b4008))
+* adopt path-only invocation ([afef6f4](https://github.com/astrale-os/shell/commit/afef6f4c970b3b01bb69f758f163cc9fa2b14641))
+* complete kernel v2 shell migration ([82a2d36](https://github.com/astrale-os/shell/commit/82a2d36ae804ddbfd06fa59afb6a290128c28a82))
+* **domain:** deploy Shell through default adapter ([43bc418](https://github.com/astrale-os/shell/commit/43bc418952666d7aac26194134c2776b58c355e7))
+* **domain:** publish @astrale-domains/shell ([905488b](https://github.com/astrale-os/shell/commit/905488b647e73793eb18ec50e5b06f763b7630e8))
+* migrate shell packages to kernel beta.2 ([62ea4a2](https://github.com/astrale-os/shell/commit/62ea4a2ff5c1b149a94a3969985debd8d791e3f3))
+* **runtime:** add graph-first React view runtime ([40ed99f](https://github.com/astrale-os/shell/commit/40ed99f03b2c2067f209b1be85d1667e6dc904f2))
+* **runtime:** add graph-first React View runtime ([702fe44](https://github.com/astrale-os/shell/commit/702fe44a1687af992a46afac16efed87dfc6e057))
+* **shell:** author graph operations with direct node targets ([a189028](https://github.com/astrale-os/shell/commit/a189028cee3d5f14678325c713b9439487c9e224))
+* **shell:** author graph operations with node targets ([97f0599](https://github.com/astrale-os/shell/commit/97f05997bb34e8935349dbb6f5b9e55a2432cca3))
+
+
+### Bug Fixes
+
+* adopt current Shell domain bindings ([121c7be](https://github.com/astrale-os/shell/commit/121c7bea57ad1bf4cedbab90ed8cba8f59955f06))
+* adopt source cohort domain bindings ([bf79155](https://github.com/astrale-os/shell/commit/bf7915555d7152b2e70127b54a1e8b4fdc269b04))
+* adopt the official kernel cohort ([#47](https://github.com/astrale-os/shell/issues/47)) ([c15a5b0](https://github.com/astrale-os/shell/commit/c15a5b0d8c9f4c3f6dd49bf122cfea09c4af42da))
+* align shell with current kernel client ([5351dc8](https://github.com/astrale-os/shell/commit/5351dc85beafdcca8f74817e032e3aab0edf0397))
+* align Shell with current Kernel cohort ([d1abeaf](https://github.com/astrale-os/shell/commit/d1abeaf2a418e7e6bf89ea85512cd0e8942d407b))
+* **domain:** align deployment with current SDK ([7a5fbae](https://github.com/astrale-os/shell/commit/7a5fbae7283aac0bb9f1aebd7b7bb0a753a1ba15))
+* **domain:** use the published SDK boundary ([2e494c6](https://github.com/astrale-os/shell/commit/2e494c6f8b4d3d25c71bbe51b37436fd35d6c42a))
+* lock shell to current beta cohort ([8350423](https://github.com/astrale-os/shell/commit/8350423f2be37208396bd6ab37e43c102d73bb9e))
+
+## [0.2.9](https://github.com/astrale-os/shell/compare/shell-react-v0.2.8...shell-react-v0.2.9) (2026-07-18)
+
+
+### Features
+
+* **windows:** support resolved iframe sandbox policies ([#30](https://github.com/astrale-os/shell/issues/30)) ([9c6c2e9](https://github.com/astrale-os/shell/commit/9c6c2e999115819227c7400bbb4f1edaf7b7b40d))
+
+
+### Bug Fixes
+
+* **core:** keep managed iframes above workspace surfaces ([#28](https://github.com/astrale-os/shell/issues/28)) ([2ab656a](https://github.com/astrale-os/shell/commit/2ab656a46bcb342850a5703c82d82eea9bfbd958))
+
+## [0.2.8](https://github.com/astrale-os/shell/compare/shell-react-v0.2.7...shell-react-v0.2.8) (2026-07-15)
+
+
+### Features
+
+* **shell:** expose domain search through useDomains ([13dbe0c](https://github.com/astrale-os/shell/commit/13dbe0c769886080fbc0da62dbe82868d27e8aaf))
+* **shell:** expose domain search through useDomains ([bb3076a](https://github.com/astrale-os/shell/commit/bb3076aa1788ec8d1e6f4155014bac3ed0f93783))
+
+
+### Bug Fixes
+
+* **react:** resolve canonical function bindings ([52be852](https://github.com/astrale-os/shell/commit/52be8529ca37aeac3878dfd198f76e3b81d37d25))
+* **react:** resolve canonical function bindings ([db8f0ab](https://github.com/astrale-os/shell/commit/db8f0abbc6b3d43063a9450a1bfbb911f1d7aa1d))
+
+## [0.2.7](https://github.com/astrale-os/shell/compare/shell-react-v0.2.6...shell-react-v0.2.7) (2026-07-12)
+
+
+### Features
+
+* **shell:** resolve views and reject failed intents ([0cf741e](https://github.com/astrale-os/shell/commit/0cf741ec5279ca003b97f39b4b5cbe5c71099ab3))
+
+## [0.2.6](https://github.com/astrale-os/shell/compare/shell-react-v0.2.5...shell-react-v0.2.6) (2026-07-12)
+
+
+### Features
+
+* **shell-react:** add fire-and-forget intent emitter ([850e0e2](https://github.com/astrale-os/shell/commit/850e0e20f44e2475c0859c6690ea8f6f24131768))
+
+## [0.2.5](https://github.com/astrale-os/shell/compare/shell-react-v0.2.4...shell-react-v0.2.5) (2026-07-12)
+
+
+### Bug Fixes
+
+* preserve virtual session capabilities ([#19](https://github.com/astrale-os/shell/issues/19)) ([792993f](https://github.com/astrale-os/shell/commit/792993f070e0f07069876068a14e324e2d446589))
+
+## [0.2.4](https://github.com/astrale-os/shell/compare/shell-react-v0.2.3...shell-react-v0.2.4) (2026-07-12)
+
+
+### Bug Fixes
+
+* **react:** keep endpoint envelopes cardinality-stable ([432dd7e](https://github.com/astrale-os/shell/commit/432dd7eb3b495b305bec6acedbcb888fe96e627c))
+
+## [0.2.3](https://github.com/astrale-os/shell/compare/shell-react-v0.2.2...shell-react-v0.2.3) (2026-07-12)
+
+
+### Bug Fixes
+
+* **deps:** require edge-cardinality kernel client ([83283a9](https://github.com/astrale-os/shell/commit/83283a9c794427946e527d549f5346eacc787c19))
+
+## [0.2.2](https://github.com/astrale-os/shell/compare/shell-react-v0.2.1...shell-react-v0.2.2) (2026-07-12)
+
+
+### Features
+
+* **react:** adopt typed domain class handles ([c63ab05](https://github.com/astrale-os/shell/commit/c63ab053e0fa48a54e2690a58b932b54029afd8b))
+
+## [0.2.1](https://github.com/astrale-os/shell/compare/shell-react-v0.2.0...shell-react-v0.2.1) (2026-07-11)
+
+
+### Bug Fixes
+
+* explicit .js specifiers + nodenext so dist loads under Node's native ESM loader ([#10](https://github.com/astrale-os/shell/issues/10)) ([2f8616f](https://github.com/astrale-os/shell/commit/2f8616ff8b5bf00e2dab9229fd6afd3dbfdce8ce))
+
+## [0.2.0](https://github.com/astrale-os/shell/compare/shell-react-v0.1.0...shell-react-v0.2.0) (2026-07-09)
+
+
+### ⚠ BREAKING CHANGES
+
+* **core:** removed CreateKernelClientAdapterOpts.mintIdentity — the delegation mint is always self per the kernel invariant, so delegationMintVia covers it. createShell({ mintIdentity }) is unchanged (the facade still honors it for the identity-credential mint subject).
+
+* **core:** legacy-ops cutover — get/mutate doors, bounded contexts, auth collapse, shell-react ([#7](https://github.com/astrale-os/shell/issues/7)) ([0119b0f](https://github.com/astrale-os/shell/commit/0119b0f64e152bd1765facce880a533401a3e65e))
+
+
+### Features
+
+* use shell domain schema ([6ca1be8](https://github.com/astrale-os/shell/commit/6ca1be82aece4cd2925c1b4587e65b797686e804))
+
+
+### Bug Fixes
+
+* require published shell schema entrypoints ([92aa701](https://github.com/astrale-os/shell/commit/92aa70117dbfa10bc4dc2133e1c0c322a21a571e))

package/dist/application/apps/app-host.d.ts

@@ -1,7 +1,7 @@
 import type { Key } from '@astrale-os/sdk/schema';
 import type { App, HostCapabilities, ResolvedView } from '@astrale-os/shell';
 import type { CSSProperties, ReactNode } from 'react';
-import type { SandboxPolicy, ViewHostHandle } from '../../window/host.js';
+import type { ViewHostHandle } from '../../window/host.js';
 import type { WindowState } from '../../window/lifecycle/states.js';
 export type AppHostFallbackState = WindowState | {
     readonly phase: 'opening';
@@ -13,7 +13,6 @@ export interface AppHostProps {
     /** Override the installed Domain entry View. */
     view?: ResolvedView;
     capabilities?: HostCapabilities;
-    sandbox?: SandboxPolicy;
     fallback?: (state: AppHostFallbackState) => ReactNode;
     className?: string;
     style?: CSSProperties;

package/dist/application/apps/app-host.js

@@ -35,5 +35,5 @@ export const AppHost = forwardRef(function AppHost(props, ref) {
     const view = props.view ?? opened;
     if (view === null || view === undefined)
         return box(fallback?.({ phase: 'no-view' }) ?? null);
-    return (_jsx(ViewHost, { ref: ref, view: view, capabilities: props.capabilities, sandbox: props.sandbox, fallback: fallback ? (state) => fallback(state) : undefined, className: className, style: style }));
+    return (_jsx(ViewHost, { ref: ref, view: view, capabilities: props.capabilities, fallback: fallback ? (state) => fallback(state) : undefined, className: className, style: style }));
 });

package/dist/components/boundaries.d.ts

@@ -34,7 +34,7 @@ export declare class ViewErrorBoundary extends Component<ViewErrorBoundaryProps,
     render(): ReactNode;
 }
 export declare function defaultViewLoading(): ReactElement;
-export declare function defaultViewError(_error: unknown, retry: () => void): ReactElement;
+export declare function defaultViewError(error: unknown, retry: () => void): ReactElement;
 export declare function ConnectionBoundary(props: {
     readonly children: ReactNode;
     readonly fallback?: (status: ReturnType<typeof useConnection>) => ReactNode;

package/dist/components/boundaries.js

@@ -41,8 +41,9 @@ export class ViewErrorBoundary extends Component {
 export function defaultViewLoading() {
     return (_jsx("div", { role: "status", "aria-live": "polite", children: "Loading view\u2026" }));
 }
-export function defaultViewError(_error, retry) {
-    return (_jsxs("section", { role: "alert", children: [_jsx("p", { children: "View could not load." }), _jsx("button", { type: "button", onClick: retry, children: "Retry" })] }));
+export function defaultViewError(error, retry) {
+    const message = error instanceof Error ? error.message : String(error);
+    return (_jsxs("section", { role: "alert", children: [_jsx("p", { children: "View could not load." }), _jsx("p", { children: message }), _jsx("button", { type: "button", onClick: retry, children: "Retry" })] }));
 }
 export function ConnectionBoundary(props) {
     const connection = useConnection();

package/dist/graph/store.js

@@ -10,9 +10,7 @@ export async function resolveGraphStoreScope(shell, knownIdentity) {
         shell.kernel.snapshot(),
     ]);
     return Object.freeze({
-        authority: identity === null
-            ? 'anonymous'
-            : `${identity.issuer}\u0000${identity.subject}\u0000${identity.id}`,
+        authority: identity === null ? 'anonymous' : `${identity.iss}\u0000${identity.sub}\u0000${identity.id}`,
         schemaRevision: snapshot.publication.schema.revision,
     });
 }

package/dist/index.d.ts

@@ -12,7 +12,7 @@ export type { LinkProps, LocationDefinition, MissingPolicy, NavAdapter, NavLocat
 export { SelectionScope, useSelection } from './selection/index.js';
 export type { Selection, SelectionScopeProps } from './selection/index.js';
 export { ViewHost, ViewStage, useCloseGuard, useTargetNode, useTargetPath, useViewsFor, useWindow, useWindowList, useWindows, } from './window/index.js';
-export type { CloseGuard, CloseVerdict, ResolvedView, SandboxPolicy, ViewHostHandle, ViewHostProps, ViewsForResult, WindowListEntry, WindowState, WindowView, } from './window/index.js';
+export type { CloseGuard, CloseVerdict, ResolvedView, ViewHostHandle, ViewHostProps, ViewsForResult, WindowListEntry, WindowState, WindowView, } from './window/index.js';
 export { HostDialog, NestedView, Notify, RequestAccess, useExternalOpen, useHostCapabilities, useHostDialog, useNotify, useOpenView, useRequestAccess, } from './host/index.js';
 export type { ExternalOpenApi, HostDialogApi, NotifyApi, OpenViewApi, RequestAccessApi, } from './host/index.js';
 export { HostCapabilityUnavailableError } from './host/index.js';

package/dist/window/host.d.ts

@@ -1,4 +1,4 @@
-import type { CloseResult, HostCapabilities, MountCredential, ResolvedView, SandboxProfile } from '@astrale-os/shell';
+import type { CloseResult, HostCapabilities, MountCredential, ResolvedView } from '@astrale-os/shell';
 import type { CSSProperties, ReactNode } from 'react';
 import type { WindowState } from './lifecycle/states.js';
 /** Imperative handle on a mounted `ViewHost` (API §10). */
@@ -11,13 +11,10 @@ export interface ViewHostHandle {
     /** The one explicit remount. */
     refresh(): void;
 }
-/** Static iframe sandbox flags, an explicit opt-out, or a policy over the resolved mount. */
-export type SandboxPolicy = SandboxProfile | null | ((view: ResolvedView) => SandboxProfile | null);
 export interface ViewHostProps {
     /** One canonical target paired with one untouched View route. */
     view: ResolvedView;
     capabilities?: HostCapabilities;
-    sandbox?: SandboxPolicy;
     credential?: MountCredential;
     handshakeTimeoutMs?: number;
     delegationTtlSeconds?: number;

package/dist/window/host.js

@@ -32,6 +32,9 @@ export const ViewHost = forwardRef(function ViewHost(props, ref) {
     const [state, setState] = useState(MOUNTING);
     const [refreshNonce, setRefreshNonce] = useState(0);
     const mountKey = viewMountKey(props.view);
+    const latestMountKeyRef = useRef(mountKey);
+    const retirementRef = useRef(null);
+    latestMountKeyRef.current = mountKey;
     const setStateSafe = (next) => {
         if (!aliveRef.current)
             return;
@@ -101,6 +104,20 @@ export const ViewHost = forwardRef(function ViewHost(props, ref) {
                 .finally(() => hub.registry.remove(id));
             slot.release();
         }
+        /** Authority/provenance changes retire the old generation before a replacement may mount. */
+        function forceRetireAndRelease(id, slot) {
+            slot.release();
+            const retirement = shell
+                .close(id, { force: true })
+                .then((result) => {
+                if (result.kind === 'refused') {
+                    throw new Error('Forced View generation retirement was refused.');
+                }
+            })
+                .finally(() => hub.registry.remove(id));
+            retirementRef.current = retirement;
+            void retirement.catch(() => { });
+        }
         /** Stash the live window for adoption, or (on refresh) close it outright. */
         function cleanup() {
             cancelled = true;
@@ -123,8 +140,9 @@ export const ViewHost = forwardRef(function ViewHost(props, ref) {
                 state: live.state,
                 dispose: () => closeAndRelease(live.windowId, slot),
             };
-            if (refreshingRef.current)
-                record.dispose();
+            if (refreshingRef.current || latestMountKeyRef.current !== mountKey) {
+                forceRetireAndRelease(live.windowId, slot);
+            }
             else
                 hub.stashForAdopt(mountKey, record);
         }
@@ -155,36 +173,34 @@ export const ViewHost = forwardRef(function ViewHost(props, ref) {
             }
         }
         async function mountView() {
-            const p = propsRef.current;
-            let sandbox;
-            try {
-                sandbox = typeof p.sandbox === 'function' ? p.sandbox(p.view) : p.sandbox;
-            }
-            catch (err) {
-                if (!cancelled)
-                    crashAndRelease(err);
-                return;
-            }
-            const params = {
-                host: slotRef.current.element,
-                view: p.view,
-                capabilities: p.capabilities ?? {
-                    version: 1,
-                    navigation: {},
-                    actions: {},
-                    browser: {},
-                    access: {},
-                },
-                sandbox,
-                credential: p.credential,
-                ...(p.handshakeTimeoutMs === undefined
-                    ? {}
-                    : { handshakeTimeoutMs: p.handshakeTimeoutMs }),
-                ...(p.delegationTtlSeconds === undefined
-                    ? {}
-                    : { delegationTtlSeconds: p.delegationTtlSeconds }),
-            };
             try {
+                const retirement = retirementRef.current;
+                if (retirement !== null) {
+                    await retirement;
+                    if (retirementRef.current === retirement)
+                        retirementRef.current = null;
+                }
+                if (cancelled)
+                    return;
+                const p = propsRef.current;
+                const params = {
+                    host: slotRef.current.element,
+                    view: p.view,
+                    capabilities: p.capabilities ?? {
+                        version: 1,
+                        navigation: {},
+                        actions: {},
+                        browser: {},
+                        access: {},
+                    },
+                    credential: p.credential,
+                    ...(p.handshakeTimeoutMs === undefined
+                        ? {}
+                        : { handshakeTimeoutMs: p.handshakeTimeoutMs }),
+                    ...(p.delegationTtlSeconds === undefined
+                        ? {}
+                        : { delegationTtlSeconds: p.delegationTtlSeconds }),
+                };
                 const win = await shell.openView(params);
                 // A StrictMode cleanup (or refresh) fired before mount resolved: adopt
                 // then immediately close so no orphan window survives.

package/dist/window/index.d.ts

@@ -1,6 +1,6 @@
 export { ViewStage } from './stage.js';
 export { ViewHost } from './host.js';
-export type { SandboxPolicy, ViewHostProps, ViewHostHandle } from './host.js';
+export type { ViewHostProps, ViewHostHandle } from './host.js';
 export { useWindows, useWindowList } from './hooks/windows.hook.js';
 export type { WindowListEntry } from './hooks/windows.hook.js';
 export { useWindow } from './hooks/window.hook.js';

package/dist/window/lifecycle/mount.js

@@ -13,5 +13,7 @@ export function viewMountKey(view) {
         route.issuer,
         route.etag,
         route.revision,
+        route.iframe?.sandbox?.join('\u001f') ?? '',
+        route.iframe?.allow?.join('\u001f') ?? '',
     ].join('\u0000');
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/shell-react",
-  "version": "0.3.2-beta.5",
+  "version": "0.3.2-beta.7",
   "description": "Astrale shell-react — the React face of the shell (provider, hooks, view components)",
   "license": "Apache-2.0",
   "repository": {
@@ -31,7 +31,7 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@astrale-os/sdk": "0.5.0-beta.51",
+    "@astrale-os/sdk": "0.5.0-beta.77",
     "@testing-library/dom": "^10.4.0",
     "@testing-library/react": "^16.3.0",
     "@types/node": "^26.2.0",

package/src/application/apps/app-host.tsx

@@ -4,7 +4,7 @@ import type { CSSProperties, ReactElement, ReactNode } from 'react'
 
 import { forwardRef, useEffect, useRef, useState } from 'react'
 
-import type { SandboxPolicy, ViewHostHandle } from '../../window/host.js'
+import type { ViewHostHandle } from '../../window/host.js'
 import type { WindowState } from '../../window/lifecycle/states.js'
 
 import { ViewHost } from '../../window/host.js'
@@ -20,7 +20,6 @@ export interface AppHostProps {
   /** Override the installed Domain entry View. */
   view?: ResolvedView
   capabilities?: HostCapabilities
-  sandbox?: SandboxPolicy
   fallback?: (state: AppHostFallbackState) => ReactNode
   className?: string
   style?: CSSProperties
@@ -72,7 +71,6 @@ export const AppHost = forwardRef<ViewHostHandle, AppHostProps>(
         ref={ref}
         view={view}
         capabilities={props.capabilities}
-        sandbox={props.sandbox}
         fallback={fallback ? (state: WindowState) => fallback(state) : undefined}
         className={className}
         style={style}

package/src/components/boundaries.tsx

@@ -75,10 +75,12 @@ export function defaultViewLoading(): ReactElement {
   )
 }
 
-export function defaultViewError(_error: unknown, retry: () => void): ReactElement {
+export function defaultViewError(error: unknown, retry: () => void): ReactElement {
+  const message = error instanceof Error ? error.message : String(error)
   return (
     <section role="alert">
       <p>View could not load.</p>
+      <p>{message}</p>
       <button type="button" onClick={retry}>
         Retry
       </button>

package/src/graph/store.ts

@@ -39,9 +39,7 @@ export async function resolveGraphStoreScope(
   ])
   return Object.freeze({
     authority:
-      identity === null
-        ? 'anonymous'
-        : `${identity.issuer}\u0000${identity.subject}\u0000${identity.id}`,
+      identity === null ? 'anonymous' : `${identity.iss}\u0000${identity.sub}\u0000${identity.id}`,
     schemaRevision: snapshot.publication.schema.revision,
   })
 }

package/src/index.ts

@@ -123,7 +123,6 @@ export type {
   CloseGuard,
   CloseVerdict,
   ResolvedView,
-  SandboxPolicy,
   ViewHostHandle,
   ViewHostProps,
   ViewsForResult,

package/src/window/host.tsx

@@ -4,7 +4,6 @@ import type {
   MountCredential,
   MountParams,
   ResolvedView,
-  SandboxProfile,
   Window,
 } from '@astrale-os/shell'
 import type { CSSProperties, ReactElement, ReactNode } from 'react'
@@ -45,14 +44,10 @@ export interface ViewHostHandle {
   refresh(): void
 }
 
-/** Static iframe sandbox flags, an explicit opt-out, or a policy over the resolved mount. */
-export type SandboxPolicy = SandboxProfile | null | ((view: ResolvedView) => SandboxProfile | null)
-
 export interface ViewHostProps {
   /** One canonical target paired with one untouched View route. */
   view: ResolvedView
   capabilities?: HostCapabilities
-  sandbox?: SandboxPolicy
   credential?: MountCredential
   handshakeTimeoutMs?: number
   delegationTtlSeconds?: number
@@ -96,6 +91,9 @@ export const ViewHost = forwardRef<ViewHostHandle, ViewHostProps>(
     const [refreshNonce, setRefreshNonce] = useState(0)
 
     const mountKey = viewMountKey(props.view)
+    const latestMountKeyRef = useRef(mountKey)
+    const retirementRef = useRef<Promise<void> | null>(null)
+    latestMountKeyRef.current = mountKey
 
     const setStateSafe = (next: WindowState) => {
       if (!aliveRef.current) return
@@ -172,6 +170,21 @@ export const ViewHost = forwardRef<ViewHostHandle, ViewHostProps>(
         slot.release()
       }
 
+      /** Authority/provenance changes retire the old generation before a replacement may mount. */
+      function forceRetireAndRelease(id: string, slot: StageSlot): void {
+        slot.release()
+        const retirement = shell
+          .close(id, { force: true })
+          .then((result) => {
+            if (result.kind === 'refused') {
+              throw new Error('Forced View generation retirement was refused.')
+            }
+          })
+          .finally(() => hub.registry.remove(id))
+        retirementRef.current = retirement
+        void retirement.catch(() => {})
+      }
+
       /** Stash the live window for adoption, or (on refresh) close it outright. */
       function cleanup(): void {
         cancelled = true
@@ -194,8 +207,9 @@ export const ViewHost = forwardRef<ViewHostHandle, ViewHostProps>(
           state: live.state,
           dispose: () => closeAndRelease(live.windowId, slot),
         }
-        if (refreshingRef.current) record.dispose()
-        else hub.stashForAdopt(mountKey, record)
+        if (refreshingRef.current || latestMountKeyRef.current !== mountKey) {
+          forceRetireAndRelease(live.windowId, slot)
+        } else hub.stashForAdopt(mountKey, record)
       }
 
       /** A pre-ready failure must not leave an empty stage slot over the fallback UI. */
@@ -227,35 +241,32 @@ export const ViewHost = forwardRef<ViewHostHandle, ViewHostProps>(
       }
 
       async function mountView(): Promise<void> {
-        const p = propsRef.current
-        let sandbox: SandboxProfile | null | undefined
-        try {
-          sandbox = typeof p.sandbox === 'function' ? p.sandbox(p.view) : p.sandbox
-        } catch (err) {
-          if (!cancelled) crashAndRelease(err)
-          return
-        }
-        const params: MountParams = {
-          host: slotRef.current!.element,
-          view: p.view,
-          capabilities: p.capabilities ?? {
-            version: 1,
-            navigation: {},
-            actions: {},
-            browser: {},
-            access: {},
-          },
-          sandbox,
-          credential: p.credential,
-          ...(p.handshakeTimeoutMs === undefined
-            ? {}
-            : { handshakeTimeoutMs: p.handshakeTimeoutMs }),
-          ...(p.delegationTtlSeconds === undefined
-            ? {}
-            : { delegationTtlSeconds: p.delegationTtlSeconds }),
-        }
-
         try {
+          const retirement = retirementRef.current
+          if (retirement !== null) {
+            await retirement
+            if (retirementRef.current === retirement) retirementRef.current = null
+          }
+          if (cancelled) return
+          const p = propsRef.current
+          const params: MountParams = {
+            host: slotRef.current!.element,
+            view: p.view,
+            capabilities: p.capabilities ?? {
+              version: 1,
+              navigation: {},
+              actions: {},
+              browser: {},
+              access: {},
+            },
+            credential: p.credential,
+            ...(p.handshakeTimeoutMs === undefined
+              ? {}
+              : { handshakeTimeoutMs: p.handshakeTimeoutMs }),
+            ...(p.delegationTtlSeconds === undefined
+              ? {}
+              : { delegationTtlSeconds: p.delegationTtlSeconds }),
+          }
           const win = await shell.openView(params)
           // A StrictMode cleanup (or refresh) fired before mount resolved: adopt
           // then immediately close so no orphan window survives.

package/src/window/index.ts

@@ -3,7 +3,7 @@
 // target-node + close-guard, and the (G5) view-resolution hook.
 export { ViewStage } from './stage.js'
 export { ViewHost } from './host.js'
-export type { SandboxPolicy, ViewHostProps, ViewHostHandle } from './host.js'
+export type { ViewHostProps, ViewHostHandle } from './host.js'
 export { useWindows, useWindowList } from './hooks/windows.hook.js'
 export type { WindowListEntry } from './hooks/windows.hook.js'
 export { useWindow } from './hooks/window.hook.js'

package/src/window/lifecycle/mount.ts

@@ -15,5 +15,7 @@ export function viewMountKey(view: ResolvedView): string {
     route.issuer,
     route.etag,
     route.revision,
+    route.iframe?.sandbox?.join('\u001f') ?? '',
+    route.iframe?.allow?.join('\u001f') ?? '',
   ].join('\u0000')
 }