@astrale-os/shell 0.1.0

package/dist/application/windowing/child-init.js

@@ -0,0 +1,101 @@
+import { createKernelClientAdapter } from '../../adapters/kernel-client.adapter';
+import { createMessagePortTransport } from '../../adapters/message-port.transport';
+import { createParentChannel } from '../channels/parent-channel';
+import { createDelegationKernelFacade, } from '../kernel-facade';
+import { INIT_REQUEST_TYPE, isInitResponse } from './protocol';
+const DEFAULT_TIMEOUT = 5_000;
+/** Child-side init: post INIT_REQUEST, receive MessagePort + ctrl:handshake, ack. */
+export function performChildInit(params) {
+    const { parent } = params;
+    const timeoutMs = params.timeoutMs ?? DEFAULT_TIMEOUT;
+    return new Promise((resolve, reject) => {
+        let port = null;
+        const timer = setTimeout(() => {
+            cleanup();
+            reject(new Error(`Shell child init timed out after ${timeoutMs}ms`));
+        }, timeoutMs);
+        function cleanup() {
+            clearTimeout(timer);
+            window.removeEventListener('message', onWindowMessage);
+            if (port)
+                port.onmessage = null;
+        }
+        function onHandshake(handshakePort) {
+            return (ev) => {
+                const msg = ev.data;
+                if (!msg || msg.type !== 'ctrl' || msg.action !== 'handshake')
+                    return;
+                const data = msg.data;
+                handshakePort.postMessage({
+                    type: 'ctrl',
+                    version: 1,
+                    action: 'handshakeAck',
+                    data: { windowId: data.windowId },
+                });
+                cleanup();
+                const initialToken = {
+                    credential: data.delegationToken,
+                    scope: { functionId: data.functionId },
+                    issuedAt: Date.now(),
+                    expiresAt: data.tokenExpiresAt,
+                };
+                let currentToken = initialToken;
+                const adapter = createKernelClientAdapter({
+                    url: data.kernelUrl,
+                    schema: params.schema,
+                    getCredential: () => currentToken.credential,
+                    mintIdentity: data.mintIdentity,
+                });
+                const kernel = createDelegationKernelFacade({
+                    adapter,
+                    initialToken,
+                    url: data.kernelUrl,
+                    mintIdentity: data.mintIdentity,
+                    onTokenChange: (next) => {
+                        currentToken = next;
+                    },
+                });
+                resolve({
+                    windowId: data.windowId,
+                    functionId: data.functionId,
+                    kernelUrl: data.kernelUrl,
+                    targetNodeId: data.targetNodeId,
+                    mintIdentity: data.mintIdentity,
+                    initialToken,
+                    kernel,
+                    parentChannel: (observer) => {
+                        const transport = createMessagePortTransport({ port: handshakePort });
+                        const channel = createParentChannel({ transport, observer });
+                        channel.on('ctrl', (message) => {
+                            if (message.action !== 'tokenRefresh')
+                                return;
+                            const refresh = message;
+                            kernel.setToken({
+                                credential: refresh.data.delegationToken,
+                                scope: { functionId: data.functionId },
+                                issuedAt: Date.now(),
+                                expiresAt: refresh.data.tokenExpiresAt,
+                            });
+                        });
+                        return channel;
+                    },
+                });
+            };
+        }
+        function onWindowMessage(ev) {
+            if (!isInitResponse(ev.data))
+                return;
+            if (ev.source !== parent)
+                return;
+            const [receivedPort] = ev.ports;
+            if (!receivedPort)
+                return;
+            port = receivedPort;
+            port.onmessage = onHandshake(receivedPort);
+            port.start();
+        }
+        window.addEventListener('message', onWindowMessage);
+        // targetOrigin="*" — the parent verifies our event.origin on its side.
+        parent.postMessage({ type: INIT_REQUEST_TYPE, version: 1 }, '*');
+    });
+}

package/dist/application/windowing/handshake.d.ts

@@ -0,0 +1,30 @@
+export type HandshakeParams = {
+    readonly iframe: HTMLIFrameElement;
+    readonly expectedOrigin: string;
+    readonly windowId: string;
+    readonly delegationToken: string;
+    readonly tokenExpiresAt: number;
+    readonly kernelUrl: string;
+    readonly functionId: string;
+    readonly targetNodeId?: string;
+    readonly mintIdentity?: string;
+    readonly timeoutMs: number;
+};
+export type HandshakeError = {
+    code: 'HANDSHAKE_TIMEOUT';
+    message: string;
+} | {
+    code: 'ORIGIN_MISMATCH';
+    message: string;
+    actual: string;
+    expected: string;
+} | {
+    code: 'HANDSHAKE_FAILED';
+    message: string;
+};
+export type HandshakeResult = {
+    readonly port: MessagePort;
+};
+/** Parent-side handshake: wait for INIT_REQUEST, transfer a MessagePort, complete ctrl:handshake. */
+export declare function runParentHandshake(params: HandshakeParams): Promise<HandshakeResult>;
+//# sourceMappingURL=handshake.d.ts.map

package/dist/application/windowing/handshake.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handshake.d.ts","sourceRoot":"","sources":["../../../src/application/windowing/handshake.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAA;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAEjD,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAC3B,CAAA;AAED,qGAAqG;AACrG,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAsEpF"}

package/dist/application/windowing/handshake.js

@@ -0,0 +1,63 @@
+import { INIT_RESPONSE_TYPE, isInitRequest } from './protocol';
+/** Parent-side handshake: wait for INIT_REQUEST, transfer a MessagePort, complete ctrl:handshake. */
+export function runParentHandshake(params) {
+    const { iframe, expectedOrigin, timeoutMs } = params;
+    return new Promise((resolve, reject) => {
+        let port = null;
+        const timer = setTimeout(() => {
+            cleanup();
+            reject({
+                code: 'HANDSHAKE_TIMEOUT',
+                message: `handshake timed out after ${timeoutMs}ms`,
+            });
+        }, timeoutMs);
+        function cleanup() {
+            clearTimeout(timer);
+            window.removeEventListener('message', onInitRequest);
+            if (port)
+                port.onmessage = null;
+        }
+        function onInitRequest(event) {
+            if (event.source !== iframe.contentWindow)
+                return;
+            if (!isInitRequest(event.data))
+                return;
+            if (event.origin !== expectedOrigin) {
+                cleanup();
+                reject({
+                    code: 'ORIGIN_MISMATCH',
+                    message: `expected origin ${expectedOrigin}, got ${event.origin}`,
+                    actual: event.origin,
+                    expected: expectedOrigin,
+                });
+                return;
+            }
+            const channel = new MessageChannel();
+            port = channel.port1;
+            port.onmessage = (ev) => {
+                const msg = ev.data;
+                if (msg && msg.type === 'ctrl' && msg.action === 'handshakeAck') {
+                    cleanup();
+                    resolve({ port: channel.port1 });
+                }
+            };
+            port.start();
+            iframe.contentWindow?.postMessage({ type: INIT_RESPONSE_TYPE, version: 1, windowId: params.windowId }, expectedOrigin, [channel.port2]);
+            port.postMessage({
+                type: 'ctrl',
+                version: 1,
+                action: 'handshake',
+                data: {
+                    delegationToken: params.delegationToken,
+                    tokenExpiresAt: params.tokenExpiresAt,
+                    windowId: params.windowId,
+                    kernelUrl: params.kernelUrl,
+                    functionId: params.functionId,
+                    targetNodeId: params.targetNodeId,
+                    mintIdentity: params.mintIdentity,
+                },
+            });
+        }
+        window.addEventListener('message', onInitRequest);
+    });
+}

package/dist/application/windowing/lifecycle-controller.d.ts

@@ -0,0 +1,10 @@
+import type { WindowState } from '../../domain/window/window';
+import { type LifecycleEvent } from '../../domain/window/lifecycle';
+export interface LifecycleController {
+    register(windowId: string, initial?: WindowState): void;
+    apply(windowId: string, event: LifecycleEvent): WindowState | null;
+    markCrashed(windowId: string): void;
+    remove(windowId: string): void;
+}
+export declare function createLifecycleController(): LifecycleController;
+//# sourceMappingURL=lifecycle-controller.d.ts.map

package/dist/application/windowing/lifecycle-controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle-controller.d.ts","sourceRoot":"","sources":["../../../src/application/windowing/lifecycle-controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAE7D,OAAO,EAAc,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAA;AAE/E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,IAAI,CAAA;IACvD,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,WAAW,GAAG,IAAI,CAAA;IAClE,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,wBAAgB,yBAAyB,IAAI,mBAAmB,CA4B/D"}

package/dist/application/windowing/lifecycle-controller.js

@@ -0,0 +1,30 @@
+import { transition } from '../../domain/window/lifecycle';
+export function createLifecycleController() {
+    const states = new Map();
+    return {
+        register(windowId, initial = 'active') {
+            if (states.has(windowId))
+                return;
+            states.set(windowId, initial);
+        },
+        apply(windowId, event) {
+            const prev = states.get(windowId);
+            if (prev === undefined)
+                return null;
+            const result = transition(prev, event);
+            if (!result.ok)
+                return null;
+            states.set(windowId, result.next);
+            return result.next;
+        },
+        markCrashed(windowId) {
+            const prev = states.get(windowId);
+            if (prev === undefined || prev === 'closed')
+                return;
+            states.set(windowId, 'closed');
+        },
+        remove(windowId) {
+            states.delete(windowId);
+        },
+    };
+}

package/dist/application/windowing/mount-controller.d.ts

@@ -0,0 +1,25 @@
+import type { Window } from '../../domain/window/window';
+import type { KernelClient } from '../../ports/kernel-client';
+import type { ShellAdapter } from '../../ports/shell-adapter';
+import type { ChildrenChannelController } from '../channels/children-channel';
+import type { MountParams, MountedWindow, CloseResult } from '../shell';
+import type { LifecycleController } from './lifecycle-controller';
+export type MountControllerConfig = {
+    adapter: ShellAdapter;
+    kernel: KernelClient;
+    kernelUrl: string;
+    mintIdentity?: string;
+    childrenChannel: ChildrenChannelController;
+    windows: Map<string, Window>;
+    lifecycle: LifecycleController;
+};
+export interface MountController {
+    mount(params: MountParams): Promise<MountedWindow>;
+    close(windowId: string, opts?: {
+        force?: boolean;
+        timeoutMs?: number;
+    }): Promise<CloseResult>;
+    dispose(): Promise<void>;
+}
+export declare function createMountController(config: MountControllerConfig): MountController;
+//# sourceMappingURL=mount-controller.d.ts.map

package/dist/application/windowing/mount-controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mount-controller.d.ts","sourceRoot":"","sources":["../../../src/application/windowing/mount-controller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,KAAK,EAAE,YAAY,EAAgB,MAAM,2BAA2B,CAAA;AAC3E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAA;AAC7E,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,UAAU,CAAA;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAWjE,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,EAAE,YAAY,CAAA;IACrB,MAAM,EAAE,YAAY,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,eAAe,EAAE,yBAAyB,CAAA;IAC1C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,SAAS,EAAE,mBAAmB,CAAA;CAC/B,CAAA;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAAA;IAClD,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAA;IAC7F,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACzB;AAiBD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,eAAe,CAqPpF"}

package/dist/application/windowing/mount-controller.js

@@ -0,0 +1,277 @@
+import { createMessagePortTransport } from '../../adapters/message-port.transport';
+import { runParentHandshake } from './handshake';
+import { createTokenRefresher } from './token-refresh';
+const DEFAULT_HANDSHAKE_TIMEOUT = 5_000;
+const DEFAULT_DELEGATION_TTL = 3_600;
+const DEFAULT_CLOSE_TIMEOUT = 3_000;
+const PARENT_SENDER_ID = '<parent>';
+/** No-op refresher for plain mounts (no token to refresh). */
+const NOOP_REFRESHER = {
+    start: () => { },
+    stop: () => { },
+    forceRefreshNow: () => Promise.resolve(),
+};
+export function createMountController(config) {
+    const { adapter, kernel, kernelUrl, mintIdentity, childrenChannel, windows, lifecycle } = config;
+    // The child iframe is always a DIFFERENT origin from this parent window, so a
+    // relative kernelUrl (e.g. the SPA's same-origin `/api/`) handed across the
+    // handshake would resolve against the iframe's OWN origin and POST to the
+    // wrong host. Absolutize it against the parent's location once so every child
+    // calls THIS origin's kernel. (The parent's own calls keep using the relative
+    // form via its kernel client / fetch.)
+    const childKernelUrl = new URL(kernelUrl, window.location.href).href;
+    const entries = new Map();
+    let seq = 0;
+    let disposed = false;
+    function nextWindowId(functionId) {
+        seq += 1;
+        const slug = functionId.replace(/[^a-z0-9]/gi, '').slice(-8) || 'fn';
+        return `win-${slug}-${seq}`;
+    }
+    async function mint(ttlSeconds) {
+        const credential = await kernel.mintDelegation();
+        return { credential, expiresAt: Date.now() + ttlSeconds * 1_000 };
+    }
+    function originOf(url) {
+        try {
+            return new URL(url, window.location.href).origin;
+        }
+        catch {
+            throw new Error(`Invalid mount url: ${url}`);
+        }
+    }
+    // Plain-iframe mount path — for hosted views that don't speak the shell
+    // protocol. No handshake, no transport, no delegation token, no refresher;
+    // the iframe just renders. `close()` skips the ack request (no channel) and
+    // falls straight to dispose.
+    async function mountPlain(params) {
+        const windowId = nextWindowId(params.functionId);
+        const { handle, dispose: disposeHandle } = adapter.mount({
+            functionId: params.functionId,
+            isolation: 'sandboxed',
+            capabilities: params.capabilities,
+            sandbox: params.sandbox,
+        });
+        if (!(handle.element instanceof HTMLIFrameElement)) {
+            disposeHandle();
+            throw new Error('Shell adapter did not produce an HTMLIFrameElement');
+        }
+        params.host.appendChild(handle.element);
+        handle.element.src = params.url;
+        windows.set(windowId, {
+            windowId,
+            functionId: params.functionId,
+            targetNodeId: params.targetNodeId,
+            isolation: 'sandboxed',
+            state: 'active',
+            delegationToken: null,
+            capabilities: params.capabilities,
+        });
+        lifecycle.register(windowId, 'active');
+        entries.set(windowId, {
+            handle,
+            dispose: disposeHandle,
+            refresher: NOOP_REFRESHER,
+            plain: true,
+        });
+        return {
+            windowId,
+            get window() {
+                return windows.get(windowId);
+            },
+            handle: { element: handle.element },
+            close: (opts) => controller.close(windowId, opts),
+        };
+    }
+    const controller = {
+        async mount(params) {
+            if (disposed)
+                throw new Error('MountController is disposed');
+            // Plain (no-handshake) path: hosted views that don't speak the shell
+            // protocol. Skip mint/handshake/transport/refresher; the iframe still
+            // renders and `close()` falls through to dispose.
+            if (params.handshake === 'none')
+                return mountPlain(params);
+            const ttlSeconds = params.delegationTtlSeconds ?? DEFAULT_DELEGATION_TTL;
+            const handshakeTimeout = params.handshakeTimeoutMs ?? DEFAULT_HANDSHAKE_TIMEOUT;
+            const expectedOrigin = originOf(params.url);
+            const windowId = nextWindowId(params.functionId);
+            // Mint the token and create the iframe in parallel — the iframe
+            // doesn't need the credential until the handshake fires.
+            const [{ credential, expiresAt }, mounted] = await Promise.all([
+                mint(ttlSeconds),
+                Promise.resolve(adapter.mount({
+                    functionId: params.functionId,
+                    isolation: 'sandboxed',
+                    capabilities: params.capabilities,
+                    sandbox: params.sandbox,
+                })),
+            ]);
+            const { handle, dispose: disposeHandle } = mounted;
+            if (!(handle.element instanceof HTMLIFrameElement)) {
+                disposeHandle();
+                throw new Error('Shell adapter did not produce an HTMLIFrameElement');
+            }
+            params.host.appendChild(handle.element);
+            handle.element.src = params.url;
+            let handshakeResult;
+            try {
+                handshakeResult = await runParentHandshake({
+                    iframe: handle.element,
+                    expectedOrigin,
+                    windowId,
+                    delegationToken: credential,
+                    tokenExpiresAt: expiresAt,
+                    kernelUrl: childKernelUrl,
+                    functionId: params.functionId,
+                    targetNodeId: params.targetNodeId,
+                    mintIdentity,
+                    timeoutMs: handshakeTimeout,
+                });
+            }
+            catch (err) {
+                disposeHandle();
+                throw err;
+            }
+            const transport = createMessagePortTransport({
+                port: handshakeResult.port,
+                onClose: () => {
+                    if (!entries.has(windowId))
+                        return;
+                    lifecycle.markCrashed(windowId);
+                    void controller.close(windowId, { force: true }).catch(() => { });
+                },
+            });
+            childrenChannel.attach(windowId, transport);
+            windows.set(windowId, {
+                windowId,
+                functionId: params.functionId,
+                targetNodeId: params.targetNodeId,
+                isolation: 'sandboxed',
+                state: 'active',
+                delegationToken: credential,
+                capabilities: params.capabilities,
+            });
+            lifecycle.register(windowId, 'active');
+            // The live expiry advances on every refresh. The Window store only keeps
+            // the credential, so track expiry here — otherwise `token()` keeps
+            // returning the original expiry and `schedule()` collapses its lead time
+            // to 0, busy-looping `mint()` forever after the first refresh.
+            let currentExpiresAt = expiresAt;
+            const refresher = createTokenRefresher({
+                functionId: params.functionId,
+                token: () => {
+                    const stored = windows.get(windowId);
+                    return {
+                        credential: stored?.delegationToken ?? credential,
+                        expiresAt: currentExpiresAt,
+                        issuedAt: 0,
+                        scope: { functionId: params.functionId },
+                    };
+                },
+                setToken: (next) => {
+                    currentExpiresAt = next.expiresAt;
+                    const stored = windows.get(windowId);
+                    if (stored) {
+                        windows.set(windowId, { ...stored, delegationToken: next.credential });
+                    }
+                    childrenChannel.send(windowId, {
+                        type: 'ctrl',
+                        version: 1,
+                        action: 'tokenRefresh',
+                        data: { delegationToken: next.credential, tokenExpiresAt: next.expiresAt },
+                    });
+                },
+                mint: () => mint(ttlSeconds),
+                onFailure: () => {
+                    void controller.close(windowId, { force: false }).catch(() => { });
+                },
+            });
+            refresher.start();
+            entries.set(windowId, { handle, dispose: disposeHandle, refresher });
+            return {
+                windowId,
+                get window() {
+                    return windows.get(windowId);
+                },
+                handle: { element: handle.element },
+                close: (opts) => controller.close(windowId, opts),
+            };
+        },
+        async close(windowId, opts) {
+            const entry = entries.get(windowId);
+            if (!entry)
+                return { kind: 'noop' };
+            const timeoutMs = opts?.timeoutMs ?? DEFAULT_CLOSE_TIMEOUT;
+            // Plain mounts have no channel to ack a close; always force.
+            if (!opts?.force && !entry.plain) {
+                // Move the window into `closing` so the state machine accepts the
+                // subsequent `closeRefuse`/`forceClose` transition (both are only valid
+                // from `closing`).
+                lifecycle.apply(windowId, { kind: 'requestClose' });
+                const accepted = await requestCloseAck(childrenChannel, windowId, timeoutMs);
+                if (accepted.kind === 'refused') {
+                    lifecycle.apply(windowId, { kind: 'closeRefuse' });
+                    return { kind: 'refused', reason: accepted.reason };
+                }
+            }
+            lifecycle.apply(windowId, { kind: 'forceClose' });
+            entry.refresher.stop();
+            // Drop the entry before detaching: `detach` synchronously closes the
+            // transport, whose `onClose` re-enters `close()`. Removing the entry first
+            // makes that re-entrant call's `entries.has(windowId)` guard short-circuit,
+            // so `entry.dispose()` runs exactly once (adapters need not be idempotent).
+            entries.delete(windowId);
+            childrenChannel.detach(windowId);
+            windows.delete(windowId);
+            entry.dispose();
+            lifecycle.remove(windowId);
+            return { kind: 'closed' };
+        },
+        async dispose() {
+            if (disposed)
+                return;
+            disposed = true;
+            const ids = [...entries.keys()];
+            await Promise.all(ids.map((id) => controller.close(id, { force: true })));
+        },
+    };
+    return controller;
+}
+async function requestCloseAck(children, windowId, timeoutMs) {
+    return new Promise((resolve) => {
+        let settled = false;
+        const off = children.on('intent', (from, message) => {
+            if (from !== windowId)
+                return;
+            if (message.envelope.name === 'closeAck') {
+                settled = true;
+                off();
+                clearTimeout(timer);
+                resolve({ kind: 'ack' });
+            }
+            else if (message.envelope.name === 'closeRefuse') {
+                settled = true;
+                off();
+                clearTimeout(timer);
+                const reason = message.envelope.payload.reason;
+                resolve({ kind: 'refused', reason });
+            }
+        });
+        const timer = setTimeout(() => {
+            if (settled)
+                return;
+            off();
+            resolve({ kind: 'timeout' });
+        }, timeoutMs);
+        children.send(windowId, {
+            type: 'intent',
+            version: 1,
+            envelope: {
+                name: 'willClose',
+                payload: {},
+                sender: { windowId: PARENT_SENDER_ID },
+            },
+        });
+    });
+}

package/dist/application/windowing/protocol.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Out-of-band protocol for window-level postMessage handshake.
+ *
+ * These messages travel over `window.postMessage` (no MessagePort yet).
+ * Once the handshake succeeds, all further communication moves to the
+ * transferred MessagePort.
+ */
+export declare const INIT_REQUEST_TYPE = "astrale-shell/init-request";
+export declare const INIT_RESPONSE_TYPE = "astrale-shell/init-response";
+export type InitRequestMessage = {
+    readonly type: typeof INIT_REQUEST_TYPE;
+    readonly version: 1;
+};
+export type InitResponseMessage = {
+    readonly type: typeof INIT_RESPONSE_TYPE;
+    readonly version: 1;
+    readonly windowId: string;
+};
+export declare function isInitRequest(value: unknown): value is InitRequestMessage;
+export declare function isInitResponse(value: unknown): value is InitResponseMessage;
+//# sourceMappingURL=protocol.d.ts.map

package/dist/application/windowing/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../../src/application/windowing/protocol.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,eAAO,MAAM,iBAAiB,+BAA+B,CAAA;AAC7D,eAAO,MAAM,kBAAkB,gCAAgC,CAAA;AAE/D,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,IAAI,EAAE,OAAO,iBAAiB,CAAA;IACvC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,IAAI,EAAE,OAAO,kBAAkB,CAAA;IACxC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B,CAAA;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,kBAAkB,CAMzE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAM3E"}

package/dist/application/windowing/protocol.js

@@ -0,0 +1,19 @@
+/**
+ * Out-of-band protocol for window-level postMessage handshake.
+ *
+ * These messages travel over `window.postMessage` (no MessagePort yet).
+ * Once the handshake succeeds, all further communication moves to the
+ * transferred MessagePort.
+ */
+export const INIT_REQUEST_TYPE = 'astrale-shell/init-request';
+export const INIT_RESPONSE_TYPE = 'astrale-shell/init-response';
+export function isInitRequest(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        value.type === INIT_REQUEST_TYPE);
+}
+export function isInitResponse(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        value.type === INIT_RESPONSE_TYPE);
+}

package/dist/application/windowing/token-refresh.d.ts

@@ -0,0 +1,19 @@
+import type { DelegationToken } from '../../domain/identity/delegation';
+export type TokenRefreshConfig = {
+    readonly token: () => DelegationToken;
+    readonly setToken: (next: DelegationToken) => void;
+    readonly mint: () => Promise<{
+        credential: string;
+        expiresAt: number;
+    }>;
+    readonly functionId: string;
+    readonly onFailure?: (error: unknown) => void;
+    readonly now?: () => number;
+};
+export interface TokenRefresher {
+    start(): void;
+    stop(): void;
+    forceRefreshNow(): Promise<void>;
+}
+export declare function createTokenRefresher(config: TokenRefreshConfig): TokenRefresher;
+//# sourceMappingURL=token-refresh.d.ts.map

package/dist/application/windowing/token-refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-refresh.d.ts","sourceRoot":"","sources":["../../../src/application/windowing/token-refresh.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAA;AAIvE,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,eAAe,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,IAAI,CAAA;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;IAC7C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B,CAAA;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,IAAI,IAAI,CAAA;IACb,IAAI,IAAI,IAAI,CAAA;IACZ,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACjC;AAID,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,GAAG,cAAc,CAoD/E"}