@astrale-os/shell 0.1.1 → 0.2.0

package/dist/kernel/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/kernel/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACtD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAA;AAE/E;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG,sBAAsB,CAAC,KAAK,CAAC,GAAG;IACzD;;;OAGG;IACH,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;IACjC;;;OAGG;IACH,SAAS,IAAI,MAAM,CAAA;IACnB;;;;;;;;OAQG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB,CAAA"}

package/dist/kernel/credential.d.ts

@@ -0,0 +1,35 @@
+import type { KernelClient } from './client';
+import type { KernelClientAdapter } from './session';
+export type KernelFacadeConfig = {
+    adapter: KernelClientAdapter;
+    credential?: string;
+    getCredential?: () => string;
+    /** Kernel URL — exposed to consumers via `KernelClient.url`. */
+    url: string;
+    /**
+     * Explicit identity node to use as the mint subject. When omitted, the mint
+     * resolves the AUTHENTICATED caller via `whoami` (so a cookie-fronted GUI mints
+     * as the logged-in user, not the kernel root). Set this only to pin a subject.
+     */
+    mintIdentity?: string;
+};
+export interface KernelFacadeController extends KernelClient {
+    dispose(): void;
+}
+export declare function createKernelFacade(config: KernelFacadeConfig): KernelFacadeController;
+export type FacadeParams = {
+    adapter: KernelClientAdapter;
+    getCredential: () => string;
+    url: string;
+    /** Explicit mint subject. When omitted, the authenticated caller is resolved via `whoami`. */
+    mintIdentity?: string;
+};
+/**
+ * Bind the unified kernel surface to a credential thunk and attach the shell
+ * extras. The bound view IS the kernel surface (`.get/.node/.query/.mutate/
+ * .call/…` plus the `auth` control plane), credential-bound via `getCredential`
+ * (invoked per dispatch); `mintDelegation`/`authToken`/`url` layer on top as
+ * the deprecated iframe-ABI aliases over the view's `auth` namespace.
+ */
+export declare function buildCredentialFacade(params: FacadeParams): KernelFacadeController;
+//# sourceMappingURL=credential.d.ts.map

package/dist/kernel/credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.d.ts","sourceRoot":"","sources":["../../src/kernel/credential.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAA;AAC5C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAEpD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,OAAO,EAAE,mBAAmB,CAAA;IAC5B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,MAAM,CAAA;IAC5B,gEAAgE;IAChE,GAAG,EAAE,MAAM,CAAA;IACX;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,WAAW,sBAAuB,SAAQ,YAAY;IAC1D,OAAO,IAAI,IAAI,CAAA;CAChB;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,GAAG,sBAAsB,CAerF;AAED,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,mBAAmB,CAAA;IAC5B,aAAa,EAAE,MAAM,MAAM,CAAA;IAC3B,GAAG,EAAE,MAAM,CAAA;IACX,8FAA8F;IAC9F,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,YAAY,GAAG,sBAAsB,CAwBlF"}

package/dist/kernel/credential.js

@@ -0,0 +1,43 @@
+export function createKernelFacade(config) {
+    const getCredential = config.getCredential ??
+        (() => {
+            if (config.credential === undefined) {
+                throw new Error('KernelFacade requires credential or getCredential');
+            }
+            return config.credential;
+        });
+    return buildCredentialFacade({
+        adapter: config.adapter,
+        getCredential,
+        url: config.url,
+        mintIdentity: config.mintIdentity,
+    });
+}
+/**
+ * Bind the unified kernel surface to a credential thunk and attach the shell
+ * extras. The bound view IS the kernel surface (`.get/.node/.query/.mutate/
+ * .call/…` plus the `auth` control plane), credential-bound via `getCredential`
+ * (invoked per dispatch); `mintDelegation`/`authToken`/`url` layer on top as
+ * the deprecated iframe-ABI aliases over the view's `auth` namespace.
+ */
+export function buildCredentialFacade(params) {
+    const { adapter, getCredential, mintIdentity, url } = params;
+    const view = adapter.boundView(getCredential);
+    // @deprecated iframe ABI — use `shell.kernel.auth.mint()`. Mints an identity
+    // credential for the pinned `mintIdentity`, else the whoami-resolved caller.
+    // No implicit `__system__` fallback — an unresolved principal throws rather
+    // than silently minting a child credential as kernel root.
+    async function mintDelegation() {
+        return view.auth.mint(mintIdentity !== undefined ? { subject: mintIdentity } : undefined);
+    }
+    // @deprecated iframe ABI — use `shell.kernel.auth.credential()`. Shell
+    // credentials are JWT strings; decode the `Uint8Array` arm defensively.
+    function authToken() {
+        const credential = view.auth.credential();
+        return typeof credential === 'string' ? credential : new TextDecoder().decode(credential);
+    }
+    function dispose() {
+        // adapter lifetime is owned by the caller
+    }
+    return Object.assign(view, { mintDelegation, authToken, url, dispose });
+}

package/dist/kernel/delegated.d.ts

@@ -0,0 +1,17 @@
+import type { KernelFacadeController } from './credential';
+import type { DelegationToken } from './delegation/token';
+import type { KernelClientAdapter } from './session';
+export type DelegationKernelFacadeConfig = {
+    adapter: KernelClientAdapter;
+    initialToken: DelegationToken;
+    url: string;
+    onTokenChange?: (token: DelegationToken) => void;
+    mintIdentity?: string;
+};
+export interface DelegationKernelFacadeController extends KernelFacadeController {
+    token(): DelegationToken;
+    setToken(next: DelegationToken): void;
+}
+/** The sandboxed-mode kernel: bound to a delegation token the parent refreshes. */
+export declare function createDelegationKernelFacade(config: DelegationKernelFacadeConfig): DelegationKernelFacadeController;
+//# sourceMappingURL=delegated.d.ts.map

package/dist/kernel/delegated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegated.d.ts","sourceRoot":"","sources":["../../src/kernel/delegated.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAA;AAIpD,MAAM,MAAM,4BAA4B,GAAG;IACzC,OAAO,EAAE,mBAAmB,CAAA;IAC5B,YAAY,EAAE,eAAe,CAAA;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAA;IAChD,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,MAAM,WAAW,gCAAiC,SAAQ,sBAAsB;IAC9E,KAAK,IAAI,eAAe,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CAAA;CACtC;AAED,mFAAmF;AACnF,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,4BAA4B,GACnC,gCAAgC,CA0BlC"}

package/dist/kernel/delegated.js

@@ -0,0 +1,29 @@
+import { buildCredentialFacade } from './credential';
+/** The sandboxed-mode kernel: bound to a delegation token the parent refreshes. */
+export function createDelegationKernelFacade(config) {
+    let token = config.initialToken;
+    const base = buildCredentialFacade({
+        adapter: config.adapter,
+        getCredential: () => token.credential,
+        url: config.url,
+        mintIdentity: config.mintIdentity,
+    });
+    return {
+        ...base,
+        token() {
+            return token;
+        },
+        setToken(next) {
+            if (next.credential === token.credential && next.expiresAt === token.expiresAt)
+                return;
+            token = next;
+            config.onTokenChange?.(next);
+        },
+        // The delegation facade owns its adapter exclusively (created per child in
+        // `performChildInit`), so disposing it must tear the adapter down — unlike
+        // the standalone facade, where the caller owns the adapter's lifetime.
+        dispose() {
+            config.adapter.disconnect();
+        },
+    };
+}

package/dist/{application/windowing/token-refresh.d.ts → kernel/delegation/refresh.d.ts}

@@ -1,4 +1,4 @@
-import type { DelegationToken } from '../../domain/identity/delegation';
+import type { DelegationToken } from './token';
 export type TokenRefreshConfig = {
     readonly token: () => DelegationToken;
     readonly setToken: (next: DelegationToken) => void;
@@ -16,4 +16,4 @@ export interface TokenRefresher {
     forceRefreshNow(): Promise<void>;
 }
 export declare function createTokenRefresher(config: TokenRefreshConfig): TokenRefresher;
-//# sourceMappingURL=token-refresh.d.ts.map
+//# sourceMappingURL=refresh.d.ts.map

package/dist/kernel/delegation/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/kernel/delegation/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAI9C,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,eAAe,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,IAAI,CAAA;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;IAC7C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;CAC5B,CAAA;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,IAAI,IAAI,CAAA;IACb,IAAI,IAAI,IAAI,CAAA;IACZ,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACjC;AAID,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,GAAG,cAAc,CAoD/E"}

package/dist/{application/windowing/token-refresh.js → kernel/delegation/refresh.js}

@@ -1,4 +1,4 @@
-import { REFRESH_WINDOW_MS } from '../../domain/identity/delegation';
+import { REFRESH_WINDOW_MS } from './token';
 const BACKOFF_DELAYS_MS = [1_000, 2_000, 4_000];
 export function createTokenRefresher(config) {
     const now = config.now ?? Date.now;

package/dist/{domain/identity/delegation.d.ts → kernel/delegation/token.d.ts}

@@ -12,4 +12,4 @@ export type TokenState = 'fresh' | 'expiring' | 'expired' | 'refreshing' | 'fail
 export declare const REFRESH_WINDOW_MS = 120000;
 export declare function stateOf(token: DelegationToken, now?: number): TokenState;
 export declare function isExpired(token: DelegationToken, now?: number): boolean;
-//# sourceMappingURL=delegation.d.ts.map
+//# sourceMappingURL=token.d.ts.map

package/dist/kernel/delegation/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../../src/kernel/delegation/token.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,QAAQ,CAAA;AAEnF,kEAAkE;AAClE,eAAO,MAAM,iBAAiB,SAAU,CAAA;AAExC,wBAAgB,OAAO,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,SAAa,GAAG,UAAU,CAI5E;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,eAAe,EAAE,GAAG,SAAa,GAAG,OAAO,CAE3E"}

package/dist/{adapters/kernel-client.adapter.d.ts → kernel/session.d.ts}

@@ -1,10 +1,12 @@
-import { type CallOptions, type CredentialInput, type FunctionSchema } from '@astrale-os/kernel-client';
+import { type CallOptions, type CredentialInput, type FnMap, type FunctionSchema } from '@astrale-os/kernel-client';
+import { type BoundClientSessionView } from '@astrale-os/kernel-client/session';
+type AnyFnMap = FnMap;
 /**
  * Low-level kernel adapter — wraps a `ClientSession` (the post-v2 orchestration
  * layer above `KernelClient`).
  *
- * Methods take an explicit credential. The application-layer facade
- * manages which credential to use.
+ * Methods take an explicit credential. The credential facades manage which
+ * credential to use.
  *
  * Remote-domain redirects are followed transparently: when the kernel
  * responds with a `redirect` result (pointing at an external worker URL),
@@ -16,6 +18,14 @@ import { type CallOptions, type CredentialInput, type FunctionSchema } from '@as
  */
 export type KernelClientAdapter = {
     call(method: string, params: unknown, credential: CredentialInput, opts?: CallOptions): Promise<unknown>;
+    /**
+     * Credential-bound view over the underlying `ClientSession` — the flattened
+     * `BoundClientSessionView` surface (`.get/.node/.children/.query/.mutate/
+     * .createNode/…` graph sugar beside `.call/.stream/.as/…`). `getCredential`
+     * is a thunk invoked per dispatch, so the view tracks the active identity the
+     * same way the per-call `credential` injection did.
+     */
+    boundView(getCredential: () => CredentialInput): BoundClientSessionView<AnyFnMap>;
     load(schemas: FunctionSchema[]): void;
     disconnect(): void;
     readonly url: string;
@@ -33,14 +43,6 @@ export type CreateKernelClientAdapterOpts = {
      * with `Credential audience mismatch`.
      */
     getCredential?: () => CredentialInput;
-    /**
-     * Explicit identity node/path to use as the delegation mint subject. When
-     * omitted, the authenticated caller is resolved via `whoami` (so a cookie-fronted
-     * SPA mints as the logged-in user). Set this only to pin a subject; if set it
-     * MUST match the principal `getCredential()` authenticates as, or
-     * `mintDelegationCredential`'s self-invariant rejects the mint.
-     */
-    mintIdentity?: string;
     /**
      * Wire-layer `fetch` shim, forwarded to the underlying `KernelClient`s.
      * Lets a same-origin SPA inject `credentials:'include'` + refresh-on-401 so
@@ -50,4 +52,5 @@ export type CreateKernelClientAdapterOpts = {
     fetch?: typeof fetch;
 };
 export declare function createKernelClientAdapter(opts: CreateKernelClientAdapterOpts): KernelClientAdapter;
-//# sourceMappingURL=kernel-client.adapter.d.ts.map
+export {};
+//# sourceMappingURL=session.d.ts.map

package/dist/kernel/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/kernel/session.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,KAAK,EACV,KAAK,cAAc,EACpB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,KAAK,sBAAsB,EAI5B,MAAM,mCAAmC,CAAA;AAG1C,KAAK,QAAQ,GAAG,KAAK,CAAA;AAErB;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,CACF,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,OAAO,EACf,UAAU,EAAE,eAAe,EAC3B,IAAI,CAAC,EAAE,WAAW,GACjB,OAAO,CAAC,OAAO,CAAC,CAAA;IACnB;;;;;;OAMG;IACH,SAAS,CAAC,aAAa,EAAE,MAAM,eAAe,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IACjF,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,IAAI,CAAA;IACrC,UAAU,IAAI,IAAI,CAAA;IAClB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,6BAA6B,GAAG;IAC1C,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,cAAc,EAAE,CAAA;IACzB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,MAAM,eAAe,CAAA;IACrC;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;CACrB,CAAA;AAED,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,6BAA6B,GAClC,mBAAmB,CAuDrB"}

package/dist/{adapters/kernel-client.adapter.js → kernel/session.js}

@@ -1,7 +1,5 @@
 import {} from '@astrale-os/kernel-client';
-import { ClientSession } from '@astrale-os/kernel-client/session';
-import { identityMethod } from '../domain/identity/path';
-import { createSelfResolver, WHOAMI_PATH } from '../domain/identity/resolve-self';
+import { ClientSession, delegationMintVia, } from '@astrale-os/kernel-client/session';
 export function createKernelClientAdapter(opts) {
     let session = null;
     const config = {
@@ -18,27 +16,24 @@ export function createKernelClientAdapter(opts) {
         config.fetch = opts.fetch;
     if (opts.getCredential) {
         const getCred = opts.getCredential;
-        const explicitMintIdentity = opts.mintIdentity;
-        const resolveSelf = createSelfResolver();
+        // Cross-origin redirects (kernel → worker) mint a fresh worker-scoped
+        // delegation from the active identity — the blessed self-mint adapter over
+        // `auth.delegate`, with the `skipDelegation` recursion guard baked in.
         config.delegation = {
-            mint: async (audience, delegation) => {
+            mint: delegationMintVia(() => {
                 if (!session)
                     throw new Error('ClientSession not initialised');
-                const s = session;
-                const subject = explicitMintIdentity ??
-                    (await resolveSelf(() => s.call(WHOAMI_PATH, {}, { credential: getCred(), skipDelegation: true })));
-                const result = await s.call(identityMethod(subject, 'mintDelegationCredential'), { audience, delegation, ttl: 3600 }, { credential: getCred(), skipDelegation: true });
-                if (typeof result !== 'string') {
-                    throw new Error(`mintDelegationCredential returned non-string: ${typeof result}`);
-                }
-                return { credential: result, ttl: 3600 };
-            },
+                return session;
+            }, getCred),
         };
     }
     session = new ClientSession(config);
     const ready = session;
     return {
         url: opts.url,
+        boundView(getCredential) {
+            return ready.as(getCredential);
+        },
         call(method, params, credential, callOpts) {
             const sessionOpts = { credential };
             if (callOpts?.timeout !== undefined)

package/dist/message/ctrl.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Control message registry — extensible via declaration merging.
+ */
+export interface CtrlRegistry {
+    handshake: {
+        data: {
+            delegationToken: string;
+            tokenExpiresAt: number;
+            windowId: string;
+            kernelUrl: string;
+            functionId: string;
+            targetNodeId?: string;
+            mintIdentity?: string;
+        };
+    };
+    handshakeAck: {
+        data: {
+            windowId: string;
+        };
+    };
+    tokenRefresh: {
+        data: {
+            delegationToken: string;
+            tokenExpiresAt: number;
+        };
+    };
+}
+export type CtrlMessage<K extends keyof CtrlRegistry = keyof CtrlRegistry> = {
+    readonly type: 'ctrl';
+    readonly version: 1;
+    readonly action: K;
+    readonly data: CtrlRegistry[K]['data'];
+};
+//# sourceMappingURL=ctrl.d.ts.map

package/dist/message/ctrl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ctrl.d.ts","sourceRoot":"","sources":["../../src/message/ctrl.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE;QACT,IAAI,EAAE;YACJ,eAAe,EAAE,MAAM,CAAA;YACvB,cAAc,EAAE,MAAM,CAAA;YACtB,QAAQ,EAAE,MAAM,CAAA;YAChB,SAAS,EAAE,MAAM,CAAA;YACjB,UAAU,EAAE,MAAM,CAAA;YAClB,YAAY,CAAC,EAAE,MAAM,CAAA;YACrB,YAAY,CAAC,EAAE,MAAM,CAAA;SACtB,CAAA;KACF,CAAA;IACD,YAAY,EAAE;QAAE,IAAI,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAA;IAC5C,YAAY,EAAE;QAAE,IAAI,EAAE;YAAE,eAAe,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAA;CAC5E;AAED,MAAM,MAAM,WAAW,CAAC,CAAC,SAAS,MAAM,YAAY,GAAG,MAAM,YAAY,IAAI;IAC3E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAClB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;CACvC,CAAA"}

package/dist/message/error.d.ts

@@ -0,0 +1,9 @@
+export type ErrorCode = 'HANDSHAKE_TIMEOUT' | 'ORIGIN_MISMATCH' | 'WINDOW_UNAVAILABLE' | 'UNSUPPORTED_VERSION' | 'INTENT_NOT_ALLOWED' | 'DELIVERY_FAILED' | 'TOKEN_REFRESH_FAILED' | 'NO_VIEW_AVAILABLE';
+export type ErrorMessage = {
+    readonly type: 'error';
+    readonly version: 1;
+    readonly code: ErrorCode;
+    readonly message: string;
+    readonly context?: unknown;
+};
+//# sourceMappingURL=error.d.ts.map

package/dist/message/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../src/message/error.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,SAAS,GACjB,mBAAmB,GACnB,iBAAiB,GACjB,oBAAoB,GACpB,qBAAqB,GACrB,oBAAoB,GACpB,iBAAiB,GACjB,sBAAsB,GACtB,mBAAmB,CAAA;AAEvB,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAC3B,CAAA"}

package/dist/{application/windowing/protocol.d.ts → message/init.d.ts}

@@ -18,4 +18,4 @@ export type InitResponseMessage = {
 };
 export declare function isInitRequest(value: unknown): value is InitRequestMessage;
 export declare function isInitResponse(value: unknown): value is InitResponseMessage;
-//# sourceMappingURL=protocol.d.ts.map
+//# sourceMappingURL=init.d.ts.map

package/dist/message/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/message/init.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,eAAO,MAAM,iBAAiB,+BAA+B,CAAA;AAC7D,eAAO,MAAM,kBAAkB,gCAAgC,CAAA;AAE/D,MAAM,MAAM,kBAAkB,GAAG;IAC/B,QAAQ,CAAC,IAAI,EAAE,OAAO,iBAAiB,CAAA;IACvC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,IAAI,EAAE,OAAO,kBAAkB,CAAA;IACxC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B,CAAA;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,kBAAkB,CAMzE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAM3E"}

package/dist/{domain/message/registries.d.ts → message/intent.d.ts}

@@ -6,6 +6,10 @@ export interface ViewRef {
 /**
  * Intent registry — extensible via declaration merging.
  *
+ * An entry is EITHER `{ payload; reply }` (the reply-typed convention) OR a bare
+ * payload type (legacy). Read entries through {@link PayloadOf} / {@link ReplyOf}
+ * — never index `[K]['payload']` directly, so bare augmentations keep compiling.
+ *
  * Consumers extend via:
  *   declare module '@astrale-os/shell' {
  *     interface IntentRegistry { ... }
@@ -17,7 +21,7 @@ export interface IntentRegistry {
             nodeId: string;
             viewId?: string;
         };
-        response: {
+        reply: {
             windowId: string;
         };
     };
@@ -25,33 +29,33 @@ export interface IntentRegistry {
         payload: {
             windowId: string;
         };
-        response: void;
+        reply: void;
     };
     focus: {
         payload: {
             nodeId: string;
         };
-        response: void;
+        reply: void;
     };
     willClose: {
         payload: Record<string, never>;
-        response: void;
+        reply: void;
     };
     closeAck: {
         payload: Record<string, never>;
-        response: void;
+        reply: void;
     };
     closeRefuse: {
         payload: {
             reason: string;
         };
-        response: void;
+        reply: void;
     };
     pickView: {
         payload: {
             views: ViewRef[];
         };
-        response: {
+        reply: {
             viewId: string;
         };
     };
@@ -60,7 +64,7 @@ export interface IntentRegistry {
             data: unknown;
             sourceIntent: string;
         };
-        response: void;
+        reply: void;
     };
     /**
      * Hot-swap — parent pushes a new target node to an already-mounted view
@@ -72,7 +76,7 @@ export interface IntentRegistry {
         payload: {
             nodeId: string;
         };
-        response: void;
+        reply: void;
     };
     /**
      * Child → parent: a view asks the user to grant `perms` (a permission
@@ -82,7 +86,7 @@ export interface IntentRegistry {
      * `@<id>`. The root shell (GUI) surfaces a modal, computes the delta vs.
      * what the subject already holds, and — on approval — grants only the
      * missing bits under the GUI user's own credential. `reason` is shown to
-     * the user. `response.perms` is the bitmask actually granted (0 if
+     * the user. `reply.perms` is the bitmask actually granted (0 if
      * declined / nothing was missing).
      *
      * Reaches a handler only from a view mounted as a DIRECT child of the root
@@ -95,7 +99,7 @@ export interface IntentRegistry {
             perms: number;
             reason?: string;
         };
-        response: {
+        reply: {
             granted: boolean;
             perms: number;
         };
@@ -112,34 +116,38 @@ export interface IntentRegistry {
             correlationId: string;
             result: unknown;
         };
-        response: void;
+        reply: void;
     };
 }
 /**
- * Control message registry — extensible via declaration merging.
+ * Payload type for intent `K`. A `{ payload; reply }` entry projects its
+ * `payload`; a bare-payload (legacy) entry IS the payload. Distributes over `K`
+ * (the outer `extends` makes `K` naked) so `PayloadOf<keyof IntentRegistry>` is
+ * the union of per-key payloads, not the union of entries.
  */
-export interface CtrlRegistry {
-    handshake: {
-        data: {
-            delegationToken: string;
-            tokenExpiresAt: number;
-            windowId: string;
-            kernelUrl: string;
-            functionId: string;
-            targetNodeId?: string;
-            mintIdentity?: string;
-        };
-    };
-    handshakeAck: {
-        data: {
-            windowId: string;
-        };
-    };
-    tokenRefresh: {
-        data: {
-            delegationToken: string;
-            tokenExpiresAt: number;
-        };
+export type PayloadOf<K extends keyof IntentRegistry> = K extends keyof IntentRegistry ? IntentRegistry[K] extends {
+    payload: infer P;
+} ? P : IntentRegistry[K] : never;
+/**
+ * Reply type for intent `K` — the value a handler sends back through
+ * `ctx.reply` and a `requestIntent`/`useSendIntent` caller awaits. A
+ * `{ reply }` entry projects its `reply`; every other entry is `void`.
+ * Distributes over `K` (see {@link PayloadOf}).
+ */
+export type ReplyOf<K extends keyof IntentRegistry> = K extends keyof IntentRegistry ? IntentRegistry[K] extends {
+    reply: infer R;
+} ? R : void : never;
+export type IntentEnvelope<K extends keyof IntentRegistry = keyof IntentRegistry> = {
+    readonly name: K;
+    readonly payload: PayloadOf<K>;
+    readonly sender: {
+        readonly windowId: string;
     };
-}
-//# sourceMappingURL=registries.d.ts.map
+    readonly correlationId?: string;
+};
+export type IntentMessage<K extends keyof IntentRegistry = keyof IntentRegistry> = {
+    readonly type: 'intent';
+    readonly version: 1;
+    readonly envelope: IntentEnvelope<K>;
+};
+//# sourceMappingURL=intent.d.ts.map

package/dist/message/intent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"intent.d.ts","sourceRoot":"","sources":["../../src/message/intent.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE;QAAE,OAAO,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,KAAK,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAA;IACnF,KAAK,EAAE;QAAE,OAAO,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,KAAK,EAAE,IAAI,CAAA;KAAE,CAAA;IACrD,KAAK,EAAE;QAAE,OAAO,EAAE;YAAE,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,KAAK,EAAE,IAAI,CAAA;KAAE,CAAA;IACnD,SAAS,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAAC,KAAK,EAAE,IAAI,CAAA;KAAE,CAAA;IAC1D,QAAQ,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAAC,KAAK,EAAE,IAAI,CAAA;KAAE,CAAA;IACzD,WAAW,EAAE;QAAE,OAAO,EAAE;YAAE,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,KAAK,EAAE,IAAI,CAAA;KAAE,CAAA;IACzD,QAAQ,EAAE;QAAE,OAAO,EAAE;YAAE,KAAK,EAAE,OAAO,EAAE,CAAA;SAAE,CAAC;QAAC,KAAK,EAAE;YAAE,MAAM,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAA;IACtE,OAAO,EAAE;QAAE,OAAO,EAAE;YAAE,IAAI,EAAE,OAAO,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,KAAK,EAAE,IAAI,CAAA;KAAE,CAAA;IAC1E;;;;;OAKG;IACH,SAAS,EAAE;QAAE,OAAO,EAAE;YAAE,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,KAAK,EAAE,IAAI,CAAA;KAAE,CAAA;IACvD;;;;;;;;;;;;;OAaG;IACH,aAAa,EAAE;QACb,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAA;QAC3E,KAAK,EAAE;YAAE,OAAO,EAAE,OAAO,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAA;KAC3C,CAAA;IACD;;;;;;OAMG;IACH,WAAW,EAAE;QAAE,OAAO,EAAE;YAAE,aAAa,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,OAAO,CAAA;SAAE,CAAC;QAAC,KAAK,EAAE,IAAI,CAAA;KAAE,CAAA;CAClF;AAED;;;;;GAKG;AACH,MAAM,MAAM,SAAS,CAAC,CAAC,SAAS,MAAM,cAAc,IAAI,CAAC,SAAS,MAAM,cAAc,GAClF,cAAc,CAAC,CAAC,CAAC,SAAS;IAAE,OAAO,EAAE,MAAM,CAAC,CAAA;CAAE,GAC5C,CAAC,GACD,cAAc,CAAC,CAAC,CAAC,GACnB,KAAK,CAAA;AAET;;;;;GAKG;AACH,MAAM,MAAM,OAAO,CAAC,CAAC,SAAS,MAAM,cAAc,IAAI,CAAC,SAAS,MAAM,cAAc,GAChF,cAAc,CAAC,CAAC,CAAC,SAAS;IAAE,KAAK,EAAE,MAAM,CAAC,CAAA;CAAE,GAC1C,CAAC,GACD,IAAI,GACN,KAAK,CAAA;AAET,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,MAAM,cAAc,GAAG,MAAM,cAAc,IAAI;IAClF,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;IAChB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IAC9C,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAChC,CAAA;AAED,MAAM,MAAM,aAAa,CAAC,CAAC,SAAS,MAAM,cAAc,GAAG,MAAM,cAAc,IAAI;IACjF,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC,CAAA;CACrC,CAAA"}

package/dist/message/message.d.ts

@@ -0,0 +1,10 @@
+import type { CtrlMessage } from './ctrl';
+import type { ErrorMessage } from './error';
+import type { IntentMessage } from './intent';
+export type ShellMessage = IntentMessage | CtrlMessage | ErrorMessage;
+export type MessageHandler<M extends ShellMessage = ShellMessage> = (message: M) => void;
+export type MessageType = ShellMessage['type'];
+export type MessageOf<T extends MessageType> = Extract<ShellMessage, {
+    type: T;
+}>;
+//# sourceMappingURL=message.d.ts.map

package/dist/message/message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message.d.ts","sourceRoot":"","sources":["../../src/message/message.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AACzC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAE7C,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,WAAW,GAAG,YAAY,CAAA;AAErE,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,YAAY,GAAG,YAAY,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,IAAI,CAAA;AAExF,MAAM,MAAM,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;AAE9C,MAAM,MAAM,SAAS,CAAC,CAAC,SAAS,WAAW,IAAI,OAAO,CAAC,YAAY,EAAE;IAAE,IAAI,EAAE,CAAC,CAAA;CAAE,CAAC,CAAA"}

package/dist/shell/access.d.ts

@@ -0,0 +1,10 @@
+import type { PayloadOf, ReplyOf } from '../message/intent';
+import type { Shell } from './shell';
+/**
+ * View SDK convenience: ask the user (via the root shell) to grant `perms` on
+ * `node` to `identity`. Resolves with the bitmask actually granted (0 if the
+ * user declined or there was no parent to ask). The view typically passes its
+ * own identity (from `whoami`) as `identity`.
+ */
+export declare function requestAccess(shell: Shell, opts: PayloadOf<'requestAccess'>): Promise<ReplyOf<'requestAccess'>>;
+//# sourceMappingURL=access.d.ts.map

package/dist/shell/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/shell/access.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAIpC;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,KAAK,EACZ,IAAI,EAAE,SAAS,CAAC,eAAe,CAAC,GAC/B,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CASnC"}

package/dist/shell/access.js

@@ -0,0 +1,19 @@
+import { NO_PERMS } from '@astrale-os/kernel-core/permissions';
+import { requestIntent } from '../intent/request';
+/**
+ * View SDK convenience: ask the user (via the root shell) to grant `perms` on
+ * `node` to `identity`. Resolves with the bitmask actually granted (0 if the
+ * user declined or there was no parent to ask). The view typically passes its
+ * own identity (from `whoami`) as `identity`.
+ */
+export function requestAccess(shell, opts) {
+    if (!shell.parent)
+        return Promise.resolve({ granted: false, perms: NO_PERMS });
+    // A sandboxed shell's `parent` is a proxy that throws until `init()` resolves;
+    // honour the documented "no parent to ask" fallback instead of surfacing that
+    // opaque rejection to the caller.
+    return requestIntent(shell.parent, 'requestAccess', opts).catch(() => ({
+        granted: false,
+        perms: NO_PERMS,
+    }));
+}

package/dist/shell/build.d.ts

@@ -0,0 +1,28 @@
+import type { ChildrenChannelController } from '../channel/children';
+import type { MessageObserver } from '../channel/observer';
+import type { ParentChannel } from '../channel/parent';
+import type { IntentPipeline } from '../intent/pipeline';
+import type { LocalIntentHandler } from '../intent/router';
+import type { KernelClient } from '../kernel/client';
+import type { IntentRegistry } from '../message/intent';
+import type { LifecycleController } from '../window/lifecycle/states';
+import type { MountController } from '../window/mount/mount';
+import type { Window } from '../window/window';
+import type { Shell } from './shell';
+export type FacadeDeps = {
+    parent: ParentChannel | null;
+    childrenChannel: ChildrenChannelController;
+    kernel: KernelClient;
+    pipeline: IntentPipeline;
+    observer: MessageObserver;
+    lifecycle: LifecycleController;
+    windows: Map<string, Window>;
+    getMountController: () => MountController;
+    onIntent: <K extends keyof IntentRegistry>(name: K, handler: LocalIntentHandler<K>) => () => void;
+    targetNodeId?: () => string | undefined;
+    init?: () => Promise<void>;
+    onDispose: () => Promise<void>;
+};
+/** Assemble the Shell object shared by both modes from their wired parts. */
+export declare function buildShellFacade(deps: FacadeDeps): Shell;
+//# sourceMappingURL=build.d.ts.map

package/dist/shell/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/shell/build.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAA;AACpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAC1D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC5D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAIpC,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,aAAa,GAAG,IAAI,CAAA;IAC5B,eAAe,EAAE,yBAAyB,CAAA;IAC1C,MAAM,EAAE,YAAY,CAAA;IACpB,QAAQ,EAAE,cAAc,CAAA;IACxB,QAAQ,EAAE,eAAe,CAAA;IACzB,SAAS,EAAE,mBAAmB,CAAA;IAC9B,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,kBAAkB,EAAE,MAAM,eAAe,CAAA;IACzC,QAAQ,EAAE,CAAC,CAAC,SAAS,MAAM,cAAc,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAA;IACjG,YAAY,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAA;IACvC,IAAI,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC/B,CAAA;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,KAAK,CA+DxD"}