@astrale-os/shell 0.1.1 → 0.3.0

package/src/index.ts

@@ -1,103 +1,95 @@
-// ─── domain/message ─────────────────────────────────────────────────────────
-export type { ErrorCode } from './domain/message/errors'
-export type { IntentRegistry, CtrlRegistry, ViewRef } from './domain/message/registries'
+// ─── message ────────────────────────────────────────────────────────────────
 export type {
-  ShellMessage,
-  IntentMessage,
+  IntentRegistry,
+  ViewRef,
+  PayloadOf,
+  ReplyOf,
   IntentEnvelope,
-  CtrlMessage,
-  ErrorMessage,
-} from './domain/message/types'
-
-// ─── domain/window ──────────────────────────────────────────────────────────
-export type { WindowConfig, WindowCapabilities, SandboxProfile } from './domain/window/config'
-export type { Window, WindowState } from './domain/window/window'
-export { transition as lifecycleTransition } from './domain/window/lifecycle'
-export type { LifecycleEvent, TransitionResult } from './domain/window/lifecycle'
-
-// ─── domain/intent ──────────────────────────────────────────────────────────
-export type { IntentMiddleware } from './domain/intent/pipeline'
-export type { IntentRouter } from './domain/intent/router'
-export { loggingMiddleware } from './domain/intent/middleware/logging'
-export type { LoggingConfig, LoggingEntry, LoggingSink } from './domain/intent/middleware/logging'
-export { capabilitiesMiddleware } from './domain/intent/middleware/capabilities'
-export type {
-  CapabilitiesConfig,
-  CapabilityLookup,
-  CapabilityViolation,
-} from './domain/intent/middleware/capabilities'
-export { rateLimitMiddleware } from './domain/intent/middleware/rate-limit'
-export type { RateLimitConfig, RateLimitViolation } from './domain/intent/middleware/rate-limit'
+  IntentMessage,
+} from './message/intent'
+export type { CtrlRegistry, CtrlMessage } from './message/ctrl'
+export type { ErrorCode, ErrorMessage } from './message/error'
+export type { ShellMessage, MessageHandler } from './message/message'
+export {
+  INIT_REQUEST_TYPE,
+  INIT_RESPONSE_TYPE,
+  isInitRequest,
+  isInitResponse,
+} from './message/init'
+export type { InitRequestMessage, InitResponseMessage } from './message/init'
 
-// ─── domain/identity ────────────────────────────────────────────────────────
-export type { DelegationScope, DelegationToken, TokenState } from './domain/identity/delegation'
-export { stateOf, isExpired } from './domain/identity/delegation'
+// ─── kernel ─────────────────────────────────────────────────────────────────
+export type { KernelClient } from './kernel/client'
+export { createKernelClientAdapter } from './kernel/session'
+export type { KernelClientAdapter, CreateKernelClientAdapterOpts } from './kernel/session'
+export type { DelegationScope, DelegationToken, TokenState } from './kernel/delegation/token'
+export { stateOf, isExpired } from './kernel/delegation/token'
+export { createTokenRefresher } from './kernel/delegation/refresh'
+export type { TokenRefreshConfig, TokenRefresher } from './kernel/delegation/refresh'
 
-// ─── ports ──────────────────────────────────────────────────────────────────
-export type { Transport } from './ports/transport'
-export type { ShellAdapter, WindowHandle } from './ports/shell-adapter'
-export type { KernelClient } from './ports/kernel-client'
+// ─── channel ────────────────────────────────────────────────────────────────
+export type { Transport } from './channel/transport'
+export { createMessagePortTransport } from './channel/message-port'
+export type { MessagePortTransportConfig } from './channel/message-port'
+export type { ParentChannel } from './channel/parent'
+export type { ChildrenChannel } from './channel/children'
+export type { MessageDirection, ObserverHandler } from './channel/observer'
 
-// ─── adapters ───────────────────────────────────────────────────────────────
-export { createKernelClientAdapter } from './adapters/kernel-client.adapter'
+// ─── window ─────────────────────────────────────────────────────────────────
+export type { Window, WindowState } from './window/window'
+export type { WindowConfig, WindowCapabilities, SandboxProfile } from './window/capabilities'
+export { transition as lifecycleTransition } from './window/lifecycle/transition'
+export type { LifecycleEvent, TransitionResult } from './window/lifecycle/transition'
+export type { ShellAdapter, WindowHandle } from './window/embed/adapter'
+export { createIframeShellAdapter } from './window/embed/iframe'
+export type { IframeShellAdapterConfig } from './window/embed/iframe'
 export type {
-  KernelClientAdapter,
-  CreateKernelClientAdapterOpts,
-} from './adapters/kernel-client.adapter'
-export { createMessagePortTransport } from './adapters/message-port.transport'
-export type { MessagePortTransportConfig } from './adapters/message-port.transport'
-export { createIframeShellAdapter } from './adapters/iframe.shell-adapter'
-export type { IframeShellAdapterConfig } from './adapters/iframe.shell-adapter'
-
-// ─── application ────────────────────────────────────────────────────────────
-export type {
-  Shell,
-  ShellConfig,
-  StandaloneConfig,
-  SandboxedConfig,
   MountParams,
+  MountCredential,
   MountedWindow,
   CloseResult,
-  ParentChannel,
-  ChildrenChannel,
-  MessageDirection,
-  MessageHandler,
-  ObserverHandler,
-} from './application/shell'
-export { createShell } from './application/shell'
-
-// ─── application/windowing (advanced / testing) ─────────────────────────────
-export { runParentHandshake } from './application/windowing/handshake'
-export type {
-  HandshakeParams,
-  HandshakeError,
-  HandshakeResult,
-} from './application/windowing/handshake'
-export { performChildInit } from './application/windowing/child-init'
-export type { ChildInitParams, ChildInitResult } from './application/windowing/child-init'
-export { createTokenRefresher } from './application/windowing/token-refresh'
-export type { TokenRefreshConfig, TokenRefresher } from './application/windowing/token-refresh'
+} from './window/mount/params'
+export { runParentHandshake } from './window/mount/handshake'
+export type { HandshakeParams, HandshakeError, HandshakeResult } from './window/mount/handshake'
 
-// ─── application/intent (advanced / testing) ────────────────────────────────
-export { createIntentPipeline } from './application/intent/pipeline-runner'
-export type { IntentPipeline } from './application/intent/pipeline-runner'
-export { createIntentRouter } from './application/intent/router'
+// ─── intent ─────────────────────────────────────────────────────────────────
+export { createIntentPipeline } from './intent/pipeline'
+export type { IntentMiddleware, IntentPipeline } from './intent/pipeline'
+export type { IntentDecision, IntentOrigin, IntentPolicy, IntentContext } from './intent/policy'
+export { createIntentRouter } from './intent/router'
 export type {
+  IntentRouter,
   IntentRouterController,
   IntentRouterConfig,
-  IntentDecision,
-  IntentOrigin,
-  IntentPolicy,
-  IntentContext,
   LocalIntentHandler,
-} from './application/intent/router'
-export { requestIntent, replyToIntent, requestAccess } from './application/intent/request'
+} from './intent/router'
+export { requestIntent, replyToIntent } from './intent/request'
+export { loggingMiddleware } from './intent/middleware/logging'
+export type { LoggingConfig, LoggingEntry, LoggingSink } from './intent/middleware/logging'
+export { capabilitiesMiddleware } from './intent/middleware/capabilities'
+export type {
+  CapabilitiesConfig,
+  CapabilityLookup,
+  CapabilityViolation,
+} from './intent/middleware/capabilities'
+export { rateLimitMiddleware } from './intent/middleware/rate-limit'
+export type { RateLimitConfig, RateLimitViolation } from './intent/middleware/rate-limit'
 
-// ─── Init-request protocol (shared with host pages) ─────────────────────────
-export {
-  INIT_REQUEST_TYPE,
-  INIT_RESPONSE_TYPE,
-  isInitRequest,
-  isInitResponse,
-} from './application/windowing/protocol'
-export type { InitRequestMessage, InitResponseMessage } from './application/windowing/protocol'
+// ─── application (OS plane: shell.user / .spaces / .apps) ───────────────────
+export { createOsNamespaces } from './application/namespaces'
+export type { OsNamespaces, CreateOsNamespacesDeps } from './application/namespaces'
+export type { UserNamespace, UserNode, RoleNode } from './application/user'
+export type { SpacesNamespace, SpaceNode } from './application/spaces'
+export type { AppsNamespace, ApplicationNode } from './application/apps'
+export { openAppSession } from './application/session/open'
+export type { OpenAppSessionDeps } from './application/session/open'
+export { AppSessionRefreshError } from './application/session/session'
+export type { AppSession, AppView, RefreshStep } from './application/session/session'
+
+// ─── shell ──────────────────────────────────────────────────────────────────
+export { createShell } from './shell/create'
+export type { Shell } from './shell/shell'
+export type { ShellConfig, StandaloneConfig, SandboxedConfig } from './shell/config'
+export { requestAccess } from './shell/access'
+export { performChildInit } from './shell/sandboxed/boot'
+export type { ChildInitParams, ChildInitResult } from './shell/sandboxed/boot'

package/src/{domain/intent → intent}/middleware/capabilities.ts

@@ -1,6 +1,5 @@
-import type { IntentRegistry } from '../../message/registries'
-import type { IntentMessage } from '../../message/types'
-import type { WindowCapabilities } from '../../window/config'
+import type { IntentMessage, IntentRegistry } from '../../message/intent'
+import type { WindowCapabilities } from '../../window/capabilities'
 import type { IntentMiddleware } from '../pipeline'
 
 export type CapabilityLookup = (sender: string) => WindowCapabilities | undefined

package/src/{domain/intent → intent}/middleware/logging.ts

@@ -1,4 +1,4 @@
-import type { IntentMessage } from '../../message/types'
+import type { IntentMessage } from '../../message/intent'
 import type { IntentMiddleware } from '../pipeline'
 
 export type LoggingSink = (entry: LoggingEntry) => void

package/src/{domain/intent → intent}/middleware/rate-limit.ts

@@ -1,4 +1,4 @@
-import type { IntentMessage } from '../../message/types'
+import type { IntentMessage } from '../../message/intent'
 import type { IntentMiddleware } from '../pipeline'
 
 export type RateLimitKey = (message: IntentMessage) => string

package/src/{application/intent/pipeline-runner.ts → intent/pipeline.ts}

@@ -1,5 +1,6 @@
-import type { IntentMiddleware } from '../../domain/intent/pipeline'
-import type { IntentMessage } from '../../domain/message/types'
+import type { IntentMessage } from '../message/intent'
+
+export type IntentMiddleware = (message: IntentMessage, next: () => Promise<void>) => Promise<void>
 
 export interface IntentPipeline {
   use(middleware: IntentMiddleware): void

package/src/intent/policy.ts

@@ -0,0 +1,46 @@
+import type { IntentMessage, IntentRegistry } from '../message/intent'
+import type { Window } from '../window/window'
+
+/**
+ * Decision produced by a routing policy: where an inbound intent should go.
+ *
+ *  - `local`: the shell (entry point or sandboxed parent) handles it itself.
+ *  - `parent`: forward upstream (only valid for sandboxed children).
+ *  - `child`: forward to a specific child window.
+ *  - `drop`: discard silently (e.g., handled fully by a middleware).
+ */
+export type IntentDecision<K extends keyof IntentRegistry = keyof IntentRegistry> =
+  | { kind: 'local'; message: IntentMessage<K> }
+  | { kind: 'parent'; message: IntentMessage<K> }
+  | { kind: 'child'; windowId: string; message: IntentMessage<K> }
+  | { kind: 'drop' }
+
+export type IntentOrigin = 'parent' | 'child' | 'self'
+
+export type IntentPolicy = (
+  message: IntentMessage,
+  ctx: IntentContext,
+) => IntentDecision | Promise<IntentDecision>
+
+export interface IntentContext {
+  readonly selfWindowId: string
+  readonly origin: IntentOrigin
+  readonly windows: ReadonlyMap<string, Window>
+  readonly hasParent: boolean
+}
+
+/**
+ * Default policy:
+ *  - intent arrives from a child → handle locally
+ *  - intent arrives from the parent → handle locally
+ *  - intent initiated locally (self) → send up to parent if we have one,
+ *    otherwise keep it local
+ */
+export function defaultPolicy(): IntentPolicy {
+  return (message, ctx) => {
+    if (ctx.origin === 'self') {
+      return ctx.hasParent ? { kind: 'parent', message } : { kind: 'local', message }
+    }
+    return { kind: 'local', message }
+  }
+}

package/src/{application/intent → intent}/request.ts

@@ -1,10 +1,6 @@
-import { NO_PERMS } from '@astrale-os/kernel-core/permissions'
-
-import type { IntentRegistry } from '../../domain/message/registries'
-import type { IntentMessage } from '../../domain/message/types'
-import type { ChildrenChannel } from '../channels/children-channel'
-import type { ParentChannel } from '../channels/parent-channel'
-import type { Shell } from '../shell'
+import type { ChildrenChannel } from '../channel/children'
+import type { ParentChannel } from '../channel/parent'
+import type { IntentMessage, IntentRegistry, PayloadOf, ReplyOf } from '../message/intent'
 
 /**
  * Request/reply over the otherwise fire-and-forget intent transport.
@@ -22,22 +18,26 @@ import type { Shell } from '../shell'
 export function requestIntent<K extends keyof IntentRegistry>(
   parent: ParentChannel,
   name: K,
-  payload: IntentRegistry[K]['payload'],
-): Promise<IntentRegistry[K]['response']> {
+  payload: PayloadOf<K>,
+): Promise<ReplyOf<K>> {
   const correlationId = crypto.randomUUID()
   return new Promise((resolve) => {
     const off = parent.on('intent', (message) => {
       if (message.envelope.name !== 'intentReply') return
-      const reply = message.envelope.payload as IntentRegistry['intentReply']['payload']
+      const reply = message.envelope.payload as PayloadOf<'intentReply'>
       if (reply.correlationId !== correlationId) return
       off()
-      resolve(reply.result as IntentRegistry[K]['response'])
+      resolve(reply.result as ReplyOf<K>)
     })
-    parent.send({
+    // `PayloadOf<K>` is a deferred conditional TS can't reconcile with the
+    // `ShellMessage` union across a generic `K`; the payload is exact, so assert
+    // the concrete message shape.
+    const message: IntentMessage<K> = {
       type: 'intent',
       version: 1,
       envelope: { name, payload, sender: { windowId: 'self' }, correlationId },
-    })
+    }
+    parent.send(message as IntentMessage)
   })
 }
 
@@ -51,7 +51,7 @@ export function replyToIntent<K extends keyof IntentRegistry>(
   children: ChildrenChannel,
   windowId: string,
   request: IntentMessage<K>,
-  result: IntentRegistry[K]['response'],
+  result: ReplyOf<K>,
 ): void {
   const correlationId = request.envelope.correlationId
   if (!correlationId) return
@@ -65,23 +65,3 @@ export function replyToIntent<K extends keyof IntentRegistry>(
     },
   })
 }
-
-/**
- * View SDK convenience: ask the user (via the root shell) to grant `perms` on
- * `node` to `identity`. Resolves with the bitmask actually granted (0 if the
- * user declined or there was no parent to ask). The view typically passes its
- * own identity (from `whoami`) as `identity`.
- */
-export function requestAccess(
-  shell: Shell,
-  opts: IntentRegistry['requestAccess']['payload'],
-): Promise<IntentRegistry['requestAccess']['response']> {
-  if (!shell.parent) return Promise.resolve({ granted: false, perms: NO_PERMS })
-  // A sandboxed shell's `parent` is a proxy that throws until `init()` resolves;
-  // honour the documented "no parent to ask" fallback instead of surfacing that
-  // opaque rejection to the caller.
-  return requestIntent(shell.parent, 'requestAccess', opts).catch(() => ({
-    granted: false,
-    perms: NO_PERMS,
-  }))
-}

package/src/{application/intent → intent}/router.ts

@@ -1,36 +1,15 @@
-import type { IntentRegistry } from '../../domain/message/registries'
-import type { IntentMessage } from '../../domain/message/types'
-import type { Window } from '../../domain/window/window'
-import type { ChildrenChannelController } from '../channels/children-channel'
-import type { ParentChannel } from '../channels/parent-channel'
-import type { IntentPipeline } from './pipeline-runner'
-
-/**
- * Decision produced by a routing policy: where an inbound intent should go.
- *
- *  - `local`: the shell (entry point or sandboxed parent) handles it itself.
- *  - `parent`: forward upstream (only valid for sandboxed children).
- *  - `child`: forward to a specific child window.
- *  - `drop`: discard silently (e.g., handled fully by a middleware).
- */
-export type IntentDecision<K extends keyof IntentRegistry = keyof IntentRegistry> =
-  | { kind: 'local'; message: IntentMessage<K> }
-  | { kind: 'parent'; message: IntentMessage<K> }
-  | { kind: 'child'; windowId: string; message: IntentMessage<K> }
-  | { kind: 'drop' }
-
-export type IntentOrigin = 'parent' | 'child' | 'self'
-
-export type IntentPolicy = (
-  message: IntentMessage,
-  ctx: IntentContext,
-) => IntentDecision | Promise<IntentDecision>
-
-export interface IntentContext {
-  readonly selfWindowId: string
-  readonly origin: IntentOrigin
-  readonly windows: ReadonlyMap<string, Window>
-  readonly hasParent: boolean
+import type { ChildrenChannelController } from '../channel/children'
+import type { ParentChannel } from '../channel/parent'
+import type { IntentMessage, IntentRegistry } from '../message/intent'
+import type { Window } from '../window/window'
+import type { IntentPipeline } from './pipeline'
+import type { IntentDecision, IntentOrigin, IntentPolicy } from './policy'
+
+import { defaultPolicy } from './policy'
+
+/** Minimal dispatch-only router surface (no current in-package implementer). */
+export interface IntentRouter {
+  dispatch<K extends keyof IntentRegistry>(message: IntentMessage<K>): Promise<void>
 }
 
 export type LocalIntentHandler<K extends keyof IntentRegistry = keyof IntentRegistry> = (
@@ -61,22 +40,6 @@ export type IntentRouterConfig = {
   windows: ReadonlyMap<string, Window>
 }
 
-/**
- * Default policy:
- *  - intent arrives from a child → handle locally
- *  - intent arrives from the parent → handle locally
- *  - intent initiated locally (self) → send up to parent if we have one,
- *    otherwise keep it local
- */
-function defaultPolicy(): IntentPolicy {
-  return (message, ctx) => {
-    if (ctx.origin === 'self') {
-      return ctx.hasParent ? { kind: 'parent', message } : { kind: 'local', message }
-    }
-    return { kind: 'local', message }
-  }
-}
-
 /** Return a copy of `message` with a trusted `sender.windowId`. */
 function withSender(message: IntentMessage, windowId: string): IntentMessage {
   return { ...message, envelope: { ...message.envelope, sender: { windowId } } }

package/src/kernel/client.ts

@@ -0,0 +1,33 @@
+import type { FnMap } from '@astrale-os/kernel-client'
+import type { BoundClientSessionView } from '@astrale-os/kernel-client/session'
+
+/**
+ * The shell's kernel handle — the kernel-client `BoundClientSessionView` bound
+ * to this shell's credential. The bound view IS the surface: the graph sugar
+ * (`.get/.node/.children/.query/.mutate/…` over the two kernel doors), dispatch
+ * (`.call/.stream/.as/…`) and the `auth` control plane
+ * (`.auth.mint/.credential/.whoami/…`). The extras below are the deprecated
+ * iframe ABI, kept working until Views adopt `.auth.*`.
+ */
+export type KernelClient = BoundClientSessionView<FnMap> & {
+  /**
+   * @deprecated iframe ABI — use `shell.kernel.auth.mint()`. Despite the name,
+   * mints an *identity* credential for the current principal (v1 misnomer).
+   */
+  mintDelegation(): Promise<string>
+  /**
+   * @deprecated iframe ABI — use `shell.kernel.auth.credential()`. The current
+   * JWT for a raw `fetch()`; auto-refreshed, so read fresh per request.
+   */
+  authToken(): string
+  /**
+   * Kernel envelope endpoint this shell talks to. In same-origin GUI shells this
+   * may be the resolved `/api/` route; direct instance/dev shells usually pass a
+   * full instance endpoint such as `https://example.eu.astrale.ai/api/`.
+   *
+   * Worker REST routes are different audiences. Do not assume `url` is the right
+   * target for a raw stream just because the source credential came from the
+   * kernel.
+   */
+  readonly url: string
+}

package/src/kernel/credential.ts

@@ -0,0 +1,78 @@
+import type { KernelClient } from './client'
+import type { KernelClientAdapter } from './session'
+
+export type KernelFacadeConfig = {
+  adapter: KernelClientAdapter
+  credential?: string
+  getCredential?: () => string
+  /** Kernel URL — exposed to consumers via `KernelClient.url`. */
+  url: string
+  /**
+   * Explicit identity node to use as the mint subject. When omitted, the mint
+   * resolves the AUTHENTICATED caller via `whoami` (so a cookie-fronted GUI mints
+   * as the logged-in user, not the kernel root). Set this only to pin a subject.
+   */
+  mintIdentity?: string
+}
+
+export interface KernelFacadeController extends KernelClient {
+  dispose(): void
+}
+
+export function createKernelFacade(config: KernelFacadeConfig): KernelFacadeController {
+  const getCredential =
+    config.getCredential ??
+    (() => {
+      if (config.credential === undefined) {
+        throw new Error('KernelFacade requires credential or getCredential')
+      }
+      return config.credential
+    })
+  return buildCredentialFacade({
+    adapter: config.adapter,
+    getCredential,
+    url: config.url,
+    mintIdentity: config.mintIdentity,
+  })
+}
+
+export type FacadeParams = {
+  adapter: KernelClientAdapter
+  getCredential: () => string
+  url: string
+  /** Explicit mint subject. When omitted, the authenticated caller is resolved via `whoami`. */
+  mintIdentity?: string
+}
+
+/**
+ * Bind the unified kernel surface to a credential thunk and attach the shell
+ * extras. The bound view IS the kernel surface (`.get/.node/.query/.mutate/
+ * .call/…` plus the `auth` control plane), credential-bound via `getCredential`
+ * (invoked per dispatch); `mintDelegation`/`authToken`/`url` layer on top as
+ * the deprecated iframe-ABI aliases over the view's `auth` namespace.
+ */
+export function buildCredentialFacade(params: FacadeParams): KernelFacadeController {
+  const { adapter, getCredential, mintIdentity, url } = params
+  const view = adapter.boundView(getCredential)
+
+  // @deprecated iframe ABI — use `shell.kernel.auth.mint()`. Mints an identity
+  // credential for the pinned `mintIdentity`, else the whoami-resolved caller.
+  // No implicit `__system__` fallback — an unresolved principal throws rather
+  // than silently minting a child credential as kernel root.
+  async function mintDelegation(): Promise<string> {
+    return view.auth.mint(mintIdentity !== undefined ? { subject: mintIdentity } : undefined)
+  }
+
+  // @deprecated iframe ABI — use `shell.kernel.auth.credential()`. Shell
+  // credentials are JWT strings; decode the `Uint8Array` arm defensively.
+  function authToken(): string {
+    const credential = view.auth.credential()
+    return typeof credential === 'string' ? credential : new TextDecoder().decode(credential)
+  }
+
+  function dispose() {
+    // adapter lifetime is owned by the caller
+  }
+
+  return Object.assign(view, { mintDelegation, authToken, url, dispose })
+}

package/src/kernel/delegated.ts

@@ -0,0 +1,49 @@
+import type { KernelFacadeController } from './credential'
+import type { DelegationToken } from './delegation/token'
+import type { KernelClientAdapter } from './session'
+
+import { buildCredentialFacade } from './credential'
+
+export type DelegationKernelFacadeConfig = {
+  adapter: KernelClientAdapter
+  initialToken: DelegationToken
+  url: string
+  onTokenChange?: (token: DelegationToken) => void
+  mintIdentity?: string
+}
+
+export interface DelegationKernelFacadeController extends KernelFacadeController {
+  token(): DelegationToken
+  setToken(next: DelegationToken): void
+}
+
+/** The sandboxed-mode kernel: bound to a delegation token the parent refreshes. */
+export function createDelegationKernelFacade(
+  config: DelegationKernelFacadeConfig,
+): DelegationKernelFacadeController {
+  let token = config.initialToken
+  const base = buildCredentialFacade({
+    adapter: config.adapter,
+    getCredential: () => token.credential,
+    url: config.url,
+    mintIdentity: config.mintIdentity,
+  })
+
+  return {
+    ...base,
+    token() {
+      return token
+    },
+    setToken(next) {
+      if (next.credential === token.credential && next.expiresAt === token.expiresAt) return
+      token = next
+      config.onTokenChange?.(next)
+    },
+    // The delegation facade owns its adapter exclusively (created per child in
+    // `performChildInit`), so disposing it must tear the adapter down — unlike
+    // the standalone facade, where the caller owns the adapter's lifetime.
+    dispose() {
+      config.adapter.disconnect()
+    },
+  }
+}

package/src/{application/windowing/token-refresh.ts → kernel/delegation/refresh.ts}

@@ -1,6 +1,6 @@
-import type { DelegationToken } from '../../domain/identity/delegation'
+import type { DelegationToken } from './token'
 
-import { REFRESH_WINDOW_MS } from '../../domain/identity/delegation'
+import { REFRESH_WINDOW_MS } from './token'
 
 export type TokenRefreshConfig = {
   readonly token: () => DelegationToken