@astrale-os/shell 0.1.0

package/dist/adapters/iframe.shell-adapter.d.ts

@@ -0,0 +1,10 @@
+import type { ShellAdapter } from '../ports/shell-adapter';
+export type IframeShellAdapterConfig = {
+    /**
+     * Optional class list applied to every iframe created by this adapter.
+     * Useful for consistent styling without leaking styling into the SDK.
+     */
+    readonly className?: string;
+};
+export declare function createIframeShellAdapter(config?: IframeShellAdapterConfig): ShellAdapter;
+//# sourceMappingURL=iframe.shell-adapter.d.ts.map

package/dist/adapters/iframe.shell-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iframe.shell-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/iframe.shell-adapter.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAgB,MAAM,wBAAwB,CAAA;AAExE,MAAM,MAAM,wBAAwB,GAAG;IACrC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC5B,CAAA;AAUD,wBAAgB,wBAAwB,CAAC,MAAM,GAAE,wBAA6B,GAAG,YAAY,CAsC5F"}

package/dist/adapters/iframe.shell-adapter.js

@@ -0,0 +1,55 @@
+const DEFAULT_SANDBOX = {
+    allowScripts: true,
+    allowForms: false,
+    allowPopups: false,
+    allowSameOrigin: false,
+    allowModals: false,
+};
+export function createIframeShellAdapter(config = {}) {
+    return {
+        mount(windowConfig) {
+            if (windowConfig.isolation !== 'sandboxed') {
+                throw new Error(`iframe adapter only supports sandboxed windows, got '${windowConfig.isolation}'`);
+            }
+            const element = document.createElement('iframe');
+            element.dataset.astraleFunctionId = windowConfig.functionId;
+            if (config.className)
+                element.className = config.className;
+            // `sandbox: null` is an explicit opt-out — leave the iframe without a
+            // `sandbox` attribute (only cross-origin isolation applies). Used by
+            // the GUI for first-party trusted views (see trusted-view-origins).
+            if (windowConfig.sandbox !== null) {
+                const profile = windowConfig.sandbox ?? DEFAULT_SANDBOX;
+                element.setAttribute('sandbox', sandboxAttrFor(profile));
+            }
+            element.setAttribute('allow', 'clipboard-read; clipboard-write');
+            element.setAttribute('loading', 'eager');
+            element.setAttribute('referrerpolicy', 'no-referrer');
+            const handle = {
+                element,
+                port: null,
+                origin: '',
+            };
+            return {
+                handle,
+                dispose: () => {
+                    element.remove();
+                },
+            };
+        },
+    };
+}
+function sandboxAttrFor(profile) {
+    const tokens = [];
+    if (profile.allowScripts)
+        tokens.push('allow-scripts');
+    if (profile.allowForms)
+        tokens.push('allow-forms');
+    if (profile.allowPopups)
+        tokens.push('allow-popups');
+    if (profile.allowSameOrigin)
+        tokens.push('allow-same-origin');
+    if (profile.allowModals)
+        tokens.push('allow-modals');
+    return tokens.join(' ');
+}

package/dist/adapters/kernel-client.adapter.d.ts

@@ -0,0 +1,53 @@
+import { type CallOptions, type CredentialInput, type FunctionSchema } from '@astrale-os/kernel-client';
+/**
+ * Low-level kernel adapter — wraps a `ClientSession` (the post-v2 orchestration
+ * layer above `KernelClient`).
+ *
+ * Methods take an explicit credential. The application-layer facade
+ * manages which credential to use.
+ *
+ * Remote-domain redirects are followed transparently: when the kernel
+ * responds with a `redirect` result (pointing at an external worker URL),
+ * the ClientSession mints a worker-scoped delegation credential — for the
+ * audience the kernel carries on the redirect (`CallRedirection.iss`, the
+ * target's own identity) — and re-dials the target URL with it. So
+ * `shell.kernel.call(...)` "just works" for methods whose Function has a
+ * `binding.remoteUrl`.
+ */
+export type KernelClientAdapter = {
+    call(method: string, params: unknown, credential: CredentialInput, opts?: CallOptions): Promise<unknown>;
+    load(schemas: FunctionSchema[]): void;
+    disconnect(): void;
+    readonly url: string;
+};
+export type CreateKernelClientAdapterOpts = {
+    url: string;
+    schema?: FunctionSchema[];
+    requestTimeout?: number;
+    /**
+     * Returns the current base credential. When provided, the adapter wires a
+     * `delegation: { mint }` on the ClientSession so cross-origin redirects
+     * (kernel → worker) are followed with a fresh worker-scoped delegation
+     * minted from the active identity. Without it,
+     * ClientSession falls back to the base credential and workers reject
+     * with `Credential audience mismatch`.
+     */
+    getCredential?: () => CredentialInput;
+    /**
+     * Explicit identity node/path to use as the delegation mint subject. When
+     * omitted, the authenticated caller is resolved via `whoami` (so a cookie-fronted
+     * SPA mints as the logged-in user). Set this only to pin a subject; if set it
+     * MUST match the principal `getCredential()` authenticates as, or
+     * `mintDelegationCredential`'s self-invariant rejects the mint.
+     */
+    mintIdentity?: string;
+    /**
+     * Wire-layer `fetch` shim, forwarded to the underlying `KernelClient`s.
+     * Lets a same-origin SPA inject `credentials:'include'` + refresh-on-401 so
+     * a router can unseal a cookie into a Bearer (the parent holds no token).
+     * Default: global fetch — sandboxed child views never set it.
+     */
+    fetch?: typeof fetch;
+};
+export declare function createKernelClientAdapter(opts: CreateKernelClientAdapterOpts): KernelClientAdapter;
+//# sourceMappingURL=kernel-client.adapter.d.ts.map

package/dist/adapters/kernel-client.adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kernel-client.adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/kernel-client.adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,eAAe,EAEpB,KAAK,cAAc,EACpB,MAAM,2BAA2B,CAAA;AASlC;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,CACF,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO,EACf,UAAU,EAAE,eAAe,EAC3B,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,OAAO,CAAC,CAAA;IACnB,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,IAAI,CAAA;IACrC,UAAU,IAAI,IAAI,CAAA;IAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,cAAc,EAAE,CAAA;IACzB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,eAAe,CAAA;IACrC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CACrB,CAAA;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,6BAA6B,GAClC,mBAAmB,CAgErB"}

package/dist/adapters/kernel-client.adapter.js

@@ -0,0 +1,69 @@
+import {} from '@astrale-os/kernel-client';
+import { ClientSession } from '@astrale-os/kernel-client/session';
+import { identityMethod } from '../domain/identity/path';
+import { createSelfResolver, WHOAMI_PATH } from '../domain/identity/resolve-self';
+export function createKernelClientAdapter(opts) {
+    let session = null;
+    const config = {
+        default: opts.url,
+        // Identity is supplied per-call via `opts.credential`; no picker bound.
+        // No `delegationPolicy` → ClientSession's default `allowAllDelegations`
+        // mints for the audience the kernel carries on the redirect
+        // (`CallRedirection.iss`), which is exactly what the target worker verifies.
+        identity: undefined,
+    };
+    if (opts.schema)
+        config.schema = opts.schema;
+    if (opts.fetch)
+        config.fetch = opts.fetch;
+    if (opts.getCredential) {
+        const getCred = opts.getCredential;
+        const explicitMintIdentity = opts.mintIdentity;
+        const resolveSelf = createSelfResolver();
+        config.delegation = {
+            mint: async (audience, delegation) => {
+                if (!session)
+                    throw new Error('ClientSession not initialised');
+                const s = session;
+                const subject = explicitMintIdentity ??
+                    (await resolveSelf(() => s.call(WHOAMI_PATH, {}, { credential: getCred(), skipDelegation: true })));
+                const result = await s.call(identityMethod(subject, 'mintDelegationCredential'), { audience, delegation, ttl: 3600 }, { credential: getCred(), skipDelegation: true });
+                if (typeof result !== 'string') {
+                    throw new Error(`mintDelegationCredential returned non-string: ${typeof result}`);
+                }
+                return { credential: result, ttl: 3600 };
+            },
+        };
+    }
+    session = new ClientSession(config);
+    const ready = session;
+    return {
+        url: opts.url,
+        call(method, params, credential, callOpts) {
+            const sessionOpts = { credential };
+            if (callOpts?.timeout !== undefined)
+                sessionOpts.timeout = callOpts.timeout;
+            if (callOpts?.signal !== undefined)
+                sessionOpts.signal = callOpts.signal;
+            if (callOpts?.class !== undefined)
+                sessionOpts.class = callOpts.class;
+            if (callOpts?.transport !== undefined)
+                sessionOpts.transport = callOpts.transport;
+            if (callOpts?.protocol !== undefined)
+                sessionOpts.protocol = callOpts.protocol;
+            if (callOpts?.correlationId !== undefined)
+                sessionOpts.correlationId = callOpts.correlationId;
+            if (callOpts?.self !== undefined)
+                sessionOpts.self = callOpts.self;
+            if (callOpts?.url !== undefined)
+                sessionOpts.url = callOpts.url;
+            return ready.call(method, params, sessionOpts);
+        },
+        load(schemas) {
+            ready.registry.load(schemas);
+        },
+        disconnect() {
+            ready.disconnect();
+        },
+    };
+}

package/dist/adapters/message-port.transport.d.ts

@@ -0,0 +1,7 @@
+import type { Transport } from '../ports/transport';
+export type MessagePortTransportConfig = {
+    port: MessagePort;
+    onClose?: () => void;
+};
+export declare function createMessagePortTransport(config: MessagePortTransportConfig): Transport;
+//# sourceMappingURL=message-port.transport.d.ts.map

package/dist/adapters/message-port.transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-port.transport.d.ts","sourceRoot":"","sources":["../../src/adapters/message-port.transport.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAEnD,MAAM,MAAM,0BAA0B,GAAG;IACvC,IAAI,EAAE,WAAW,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,IAAI,CAAA;CACrB,CAAA;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,0BAA0B,GAAG,SAAS,CAyCxF"}

package/dist/adapters/message-port.transport.js

@@ -0,0 +1,42 @@
+export function createMessagePortTransport(config) {
+    const { port, onClose } = config;
+    let closed = false;
+    const handlers = new Set();
+    port.onmessage = (event) => {
+        if (closed)
+            return;
+        const message = event.data;
+        for (const handler of handlers)
+            handler(message);
+    };
+    port.onmessageerror = () => {
+        if (closed)
+            return;
+        close();
+    };
+    port.start();
+    function close() {
+        if (closed)
+            return;
+        closed = true;
+        handlers.clear();
+        try {
+            port.close();
+        }
+        catch {
+            // port may already be closed
+        }
+        onClose?.();
+    }
+    return {
+        send(message) {
+            if (closed)
+                return;
+            port.postMessage(message);
+        },
+        onMessage(handler) {
+            handlers.add(handler);
+        },
+        close,
+    };
+}

package/dist/application/channels/children-channel.d.ts

@@ -0,0 +1,21 @@
+import type { ShellMessage } from '../../domain/message/types';
+import type { Transport } from '../../ports/transport';
+import type { MessageObserver } from './observer';
+import type { MessageOf, MessageType } from './types';
+export interface ChildrenChannel {
+    send(windowId: string, message: ShellMessage): void;
+    on<T extends MessageType>(type: T, handler: (windowId: string, message: MessageOf<T>) => void): () => void;
+    has(windowId: string): boolean;
+    onClose(handler: (windowId: string) => void): () => void;
+}
+export interface ChildrenChannelController extends ChildrenChannel {
+    attach(windowId: string, transport: Transport): void;
+    detach(windowId: string): void;
+    dispose(): void;
+}
+export type ChildrenChannelConfig = {
+    observer: MessageObserver;
+    onDeliveryFailed?: (windowId: string, message: ShellMessage) => void;
+};
+export declare function createChildrenChannel(config: ChildrenChannelConfig): ChildrenChannelController;
+//# sourceMappingURL=children-channel.d.ts.map

package/dist/application/channels/children-channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"children-channel.d.ts","sourceRoot":"","sources":["../../../src/application/channels/children-channel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAErD,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAAA;IACnD,EAAE,CAAC,CAAC,SAAS,WAAW,EACtB,IAAI,EAAE,CAAC,EACP,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,GACzD,MAAM,IAAI,CAAA;IACb,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAA;IAC9B,OAAO,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI,CAAA;CACzD;AAED,MAAM,WAAW,yBAA0B,SAAQ,eAAe;IAChE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,GAAG,IAAI,CAAA;IACpD,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,OAAO,IAAI,IAAI,CAAA;CAChB;AAED,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,eAAe,CAAA;IACzB,gBAAgB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,KAAK,IAAI,CAAA;CACrE,CAAA;AAID,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,yBAAyB,CAmF9F"}

package/dist/application/channels/children-channel.js

@@ -0,0 +1,82 @@
+export function createChildrenChannel(config) {
+    const { observer, onDeliveryFailed } = config;
+    const entries = new Map();
+    const byType = new Map();
+    const closeListeners = new Set();
+    function notifyListeners(windowId, message) {
+        const bucket = byType.get(message.type);
+        if (!bucket || bucket.size === 0)
+            return;
+        for (const listener of bucket) {
+            try {
+                listener(windowId, message);
+            }
+            catch {
+                // one rogue listener must not break siblings
+            }
+        }
+    }
+    return {
+        attach(windowId, transport) {
+            const existing = entries.get(windowId);
+            if (existing)
+                throw new Error(`Child '${windowId}' already attached`);
+            entries.set(windowId, transport);
+            transport.onMessage((message) => {
+                observer.notify('inbound', message);
+                notifyListeners(windowId, message);
+            });
+        },
+        detach(windowId) {
+            const transport = entries.get(windowId);
+            if (!transport)
+                return;
+            entries.delete(windowId);
+            transport.close();
+            // `entries.delete` ran first, so `has(windowId)` is already false here —
+            // a listener replying to the gone child is a best-effort no-op.
+            for (const listener of closeListeners) {
+                try {
+                    listener(windowId);
+                }
+                catch {
+                    // one rogue listener must not break siblings
+                }
+            }
+        },
+        dispose() {
+            for (const transport of entries.values())
+                transport.close();
+            entries.clear();
+        },
+        send(windowId, message) {
+            const transport = entries.get(windowId);
+            if (!transport) {
+                onDeliveryFailed?.(windowId, message);
+                return;
+            }
+            observer.notify('outbound', message);
+            transport.send(message);
+        },
+        on(type, handler) {
+            let bucket = byType.get(type);
+            if (!bucket) {
+                bucket = new Set();
+                byType.set(type, bucket);
+            }
+            bucket.add(handler);
+            return () => {
+                bucket.delete(handler);
+            };
+        },
+        has(windowId) {
+            return entries.has(windowId);
+        },
+        onClose(handler) {
+            closeListeners.add(handler);
+            return () => {
+                closeListeners.delete(handler);
+            };
+        },
+    };
+}

package/dist/application/channels/observer.d.ts

@@ -0,0 +1,9 @@
+import type { ShellMessage } from '../../domain/message/types';
+export type MessageDirection = 'inbound' | 'outbound';
+export type ObserverHandler = (message: ShellMessage, direction: MessageDirection) => void;
+export interface MessageObserver {
+    notify(direction: MessageDirection, message: ShellMessage): void;
+    subscribe(handler: ObserverHandler): () => void;
+}
+export declare function createMessageObserver(): MessageObserver;
+//# sourceMappingURL=observer.d.ts.map

package/dist/application/channels/observer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"observer.d.ts","sourceRoot":"","sources":["../../../src/application/channels/observer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AAE9D,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,UAAU,CAAA;AAErD,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,gBAAgB,KAAK,IAAI,CAAA;AAE1F,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAAA;IAChE,SAAS,CAAC,OAAO,EAAE,eAAe,GAAG,MAAM,IAAI,CAAA;CAChD;AAED,wBAAgB,qBAAqB,IAAI,eAAe,CAqBvD"}

package/dist/application/channels/observer.js

@@ -0,0 +1,23 @@
+export function createMessageObserver() {
+    const handlers = new Set();
+    return {
+        notify(direction, message) {
+            if (handlers.size === 0)
+                return;
+            for (const handler of handlers) {
+                try {
+                    handler(message, direction);
+                }
+                catch {
+                    // one rogue observer must not break siblings
+                }
+            }
+        },
+        subscribe(handler) {
+            handlers.add(handler);
+            return () => {
+                handlers.delete(handler);
+            };
+        },
+    };
+}

package/dist/application/channels/parent-channel.d.ts

@@ -0,0 +1,17 @@
+import type { ShellMessage } from '../../domain/message/types';
+import type { Transport } from '../../ports/transport';
+import type { MessageObserver } from './observer';
+import type { MessageHandler, MessageOf, MessageType } from './types';
+export interface ParentChannel {
+    send(message: ShellMessage): void;
+    on<T extends MessageType>(type: T, handler: MessageHandler<MessageOf<T>>): () => void;
+}
+export interface ParentChannelController extends ParentChannel {
+    dispose(): void;
+}
+export type ParentChannelConfig = {
+    transport: Transport;
+    observer: MessageObserver;
+};
+export declare function createParentChannel(config: ParentChannelConfig): ParentChannelController;
+//# sourceMappingURL=parent-channel.d.ts.map

package/dist/application/channels/parent-channel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parent-channel.d.ts","sourceRoot":"","sources":["../../../src/application/channels/parent-channel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAIrE,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAA;IACjC,EAAE,CAAC,CAAC,SAAS,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAA;CACtF;AAED,MAAM,WAAW,uBAAwB,SAAQ,aAAa;IAC5D,OAAO,IAAI,IAAI,CAAA;CAChB;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,SAAS,CAAA;IACpB,QAAQ,EAAE,eAAe,CAAA;CAC1B,CAAA;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,GAAG,uBAAuB,CAqBxF"}

package/dist/application/channels/parent-channel.js

@@ -0,0 +1,21 @@
+import { createMessageListeners } from './types';
+export function createParentChannel(config) {
+    const { transport, observer } = config;
+    const listeners = createMessageListeners();
+    transport.onMessage((message) => {
+        observer.notify('inbound', message);
+        listeners.dispatch(message);
+    });
+    return {
+        send(message) {
+            observer.notify('outbound', message);
+            transport.send(message);
+        },
+        on(type, handler) {
+            return listeners.on(type, handler);
+        },
+        dispose() {
+            transport.close();
+        },
+    };
+}

package/dist/application/channels/types.d.ts

@@ -0,0 +1,12 @@
+import type { ShellMessage } from '../../domain/message/types';
+export type MessageHandler<M extends ShellMessage = ShellMessage> = (message: M) => void;
+export type MessageType = ShellMessage['type'];
+export type MessageOf<T extends MessageType> = Extract<ShellMessage, {
+    type: T;
+}>;
+export interface MessageListeners {
+    on<T extends MessageType>(type: T, handler: MessageHandler<MessageOf<T>>): () => void;
+    dispatch(message: ShellMessage): void;
+}
+export declare function createMessageListeners(): MessageListeners;
+//# sourceMappingURL=types.d.ts.map

package/dist/application/channels/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/application/channels/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AAE9D,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,YAAY,GAAG,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,IAAI,CAAA;AAExF,MAAM,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;AAE9C,MAAM,MAAM,SAAS,CAAC,CAAC,SAAS,WAAW,IAAI,OAAO,CAAC,YAAY,EAAE;IAAE,IAAI,EAAE,CAAC,CAAA;CAAE,CAAC,CAAA;AAEjF,MAAM,WAAW,gBAAgB;IAC/B,EAAE,CAAC,CAAC,SAAS,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAA;IACrF,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAA;CACtC;AAED,wBAAgB,sBAAsB,IAAI,gBAAgB,CA2BzD"}

package/dist/application/channels/types.js

@@ -0,0 +1,29 @@
+export function createMessageListeners() {
+    const byType = new Map();
+    return {
+        on(type, handler) {
+            let bucket = byType.get(type);
+            if (!bucket) {
+                bucket = new Set();
+                byType.set(type, bucket);
+            }
+            bucket.add(handler);
+            return () => {
+                bucket.delete(handler);
+            };
+        },
+        dispatch(message) {
+            const bucket = byType.get(message.type);
+            if (!bucket || bucket.size === 0)
+                return;
+            for (const handler of bucket) {
+                try {
+                    handler(message);
+                }
+                catch {
+                    // one rogue handler must not break siblings
+                }
+            }
+        },
+    };
+}

package/dist/application/intent/pipeline-runner.d.ts

@@ -0,0 +1,12 @@
+import type { IntentMiddleware } from '../../domain/intent/pipeline';
+import type { IntentMessage } from '../../domain/message/types';
+export interface IntentPipeline {
+    use(middleware: IntentMiddleware): void;
+    run(message: IntentMessage, terminate: () => Promise<void>): Promise<void>;
+}
+/**
+ * Composable middleware runner. Each middleware may transform, short-circuit,
+ * or wrap the call to `next`. `terminate` is the innermost handler (router).
+ */
+export declare function createIntentPipeline(): IntentPipeline;
+//# sourceMappingURL=pipeline-runner.d.ts.map

package/dist/application/intent/pipeline-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pipeline-runner.d.ts","sourceRoot":"","sources":["../../../src/application/intent/pipeline-runner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAE/D,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,UAAU,EAAE,gBAAgB,GAAG,IAAI,CAAA;IACvC,GAAG,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3E;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,cAAc,CAuBrD"}

package/dist/application/intent/pipeline-runner.js

@@ -0,0 +1,27 @@
+/**
+ * Composable middleware runner. Each middleware may transform, short-circuit,
+ * or wrap the call to `next`. `terminate` is the innermost handler (router).
+ */
+export function createIntentPipeline() {
+    const middlewares = [];
+    return {
+        use(middleware) {
+            middlewares.push(middleware);
+        },
+        async run(message, terminate) {
+            let i = -1;
+            const dispatch = async (idx) => {
+                if (idx <= i)
+                    throw new Error('next() called multiple times');
+                i = idx;
+                if (idx === middlewares.length) {
+                    await terminate();
+                    return;
+                }
+                const mw = middlewares[idx];
+                await mw(message, () => dispatch(idx + 1));
+            };
+            await dispatch(0);
+        },
+    };
+}

package/dist/application/intent/request.d.ts

@@ -0,0 +1,34 @@
+import type { IntentRegistry } from '../../domain/message/registries';
+import type { IntentMessage } from '../../domain/message/types';
+import type { ChildrenChannel } from '../channels/children-channel';
+import type { ParentChannel } from '../channels/parent-channel';
+import type { Shell } from '../shell';
+/**
+ * Request/reply over the otherwise fire-and-forget intent transport.
+ *
+ * The child raises `name` with a generated `correlationId` and awaits the
+ * `intentReply` whose payload echoes that id. The reply also re-enters the
+ * child router as an inbound parent intent, but no handler is registered for
+ * `intentReply`, so it is harmlessly dropped there — only this resolver,
+ * matching by `correlationId`, consumes it.
+ *
+ * No timeout by design: callers (e.g. `requestAccess`) wait on a human, and
+ * the parent always replies on every path. A dead parent means the view is
+ * gone too, so a never-resolving promise cannot strand a live view.
+ */
+export declare function requestIntent<K extends keyof IntentRegistry>(parent: ParentChannel, name: K, payload: IntentRegistry[K]['payload']): Promise<IntentRegistry[K]['response']>;
+/**
+ * Parent-side counterpart to `requestIntent`: deliver `result` back to the
+ * originating child window, keyed by the request's `correlationId`. No-op for
+ * a request that carried no `correlationId` (a fire-and-forget intent), or if
+ * the child window has since detached (best-effort, drops silently).
+ */
+export declare function replyToIntent<K extends keyof IntentRegistry>(children: ChildrenChannel, windowId: string, request: IntentMessage<K>, result: IntentRegistry[K]['response']): void;
+/**
+ * View SDK convenience: ask the user (via the root shell) to grant `perms` on
+ * `node` to `identity`. Resolves with the bitmask actually granted (0 if the
+ * user declined or there was no parent to ask). The view typically passes its
+ * own identity (from `whoami`) as `identity`.
+ */
+export declare function requestAccess(shell: Shell, opts: IntentRegistry['requestAccess']['payload']): Promise<IntentRegistry['requestAccess']['response']>;
+//# sourceMappingURL=request.d.ts.map

package/dist/application/intent/request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request.d.ts","sourceRoot":"","sources":["../../../src/application/intent/request.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAA;AACrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC/D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAErC;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,MAAM,cAAc,EAC1D,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,CAAC,EACP,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GACpC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAgBxC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,MAAM,cAAc,EAC1D,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,EACzB,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GACpC,IAAI,CAYN;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,cAAc,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,GAC/C,OAAO,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC,UAAU,CAAC,CAAC,CAStD"}

package/dist/application/intent/request.js

@@ -0,0 +1,70 @@
+import { NO_PERMS } from '@astrale-os/kernel-core/permissions';
+/**
+ * Request/reply over the otherwise fire-and-forget intent transport.
+ *
+ * The child raises `name` with a generated `correlationId` and awaits the
+ * `intentReply` whose payload echoes that id. The reply also re-enters the
+ * child router as an inbound parent intent, but no handler is registered for
+ * `intentReply`, so it is harmlessly dropped there — only this resolver,
+ * matching by `correlationId`, consumes it.
+ *
+ * No timeout by design: callers (e.g. `requestAccess`) wait on a human, and
+ * the parent always replies on every path. A dead parent means the view is
+ * gone too, so a never-resolving promise cannot strand a live view.
+ */
+export function requestIntent(parent, name, payload) {
+    const correlationId = crypto.randomUUID();
+    return new Promise((resolve) => {
+        const off = parent.on('intent', (message) => {
+            if (message.envelope.name !== 'intentReply')
+                return;
+            const reply = message.envelope.payload;
+            if (reply.correlationId !== correlationId)
+                return;
+            off();
+            resolve(reply.result);
+        });
+        parent.send({
+            type: 'intent',
+            version: 1,
+            envelope: { name, payload, sender: { windowId: 'self' }, correlationId },
+        });
+    });
+}
+/**
+ * Parent-side counterpart to `requestIntent`: deliver `result` back to the
+ * originating child window, keyed by the request's `correlationId`. No-op for
+ * a request that carried no `correlationId` (a fire-and-forget intent), or if
+ * the child window has since detached (best-effort, drops silently).
+ */
+export function replyToIntent(children, windowId, request, result) {
+    const correlationId = request.envelope.correlationId;
+    if (!correlationId)
+        return;
+    children.send(windowId, {
+        type: 'intent',
+        version: 1,
+        envelope: {
+            name: 'intentReply',
+            payload: { correlationId, result },
+            sender: { windowId: 'root' },
+        },
+    });
+}
+/**
+ * View SDK convenience: ask the user (via the root shell) to grant `perms` on
+ * `node` to `identity`. Resolves with the bitmask actually granted (0 if the
+ * user declined or there was no parent to ask). The view typically passes its
+ * own identity (from `whoami`) as `identity`.
+ */
+export function requestAccess(shell, opts) {
+    if (!shell.parent)
+        return Promise.resolve({ granted: false, perms: NO_PERMS });
+    // A sandboxed shell's `parent` is a proxy that throws until `init()` resolves;
+    // honour the documented "no parent to ask" fallback instead of surfacing that
+    // opaque rejection to the caller.
+    return requestIntent(shell.parent, 'requestAccess', opts).catch(() => ({
+        granted: false,
+        perms: NO_PERMS,
+    }));
+}