@astrale-os/shell 0.1.1 → 0.3.0

package/src/{adapters/kernel-client.adapter.ts → kernel/session.ts}

@@ -4,10 +4,12 @@ import {
   type FnMap,
   type FunctionSchema,
 } from '@astrale-os/kernel-client'
-import { ClientSession, type ClientSessionConfig } from '@astrale-os/kernel-client/session'
-
-import { identityMethod } from '../domain/identity/path'
-import { createSelfResolver, WHOAMI_PATH } from '../domain/identity/resolve-self'
+import {
+  type BoundClientSessionView,
+  ClientSession,
+  type ClientSessionConfig,
+  delegationMintVia,
+} from '@astrale-os/kernel-client/session'
 
 // Untyped FnMap — the shell uses string paths, not typed method keys.
 type AnyFnMap = FnMap
@@ -16,8 +18,8 @@ type AnyFnMap = FnMap
  * Low-level kernel adapter — wraps a `ClientSession` (the post-v2 orchestration
  * layer above `KernelClient`).
  *
- * Methods take an explicit credential. The application-layer facade
- * manages which credential to use.
+ * Methods take an explicit credential. The credential facades manage which
+ * credential to use.
  *
  * Remote-domain redirects are followed transparently: when the kernel
  * responds with a `redirect` result (pointing at an external worker URL),
@@ -34,6 +36,14 @@ export type KernelClientAdapter = {
     credential: CredentialInput,
     opts?: CallOptions,
   ): Promise<unknown>
+  /**
+   * Credential-bound view over the underlying `ClientSession` — the flattened
+   * `BoundClientSessionView` surface (`.get/.node/.children/.query/.mutate/
+   * .createNode/…` graph sugar beside `.call/.stream/.as/…`). `getCredential`
+   * is a thunk invoked per dispatch, so the view tracks the active identity the
+   * same way the per-call `credential` injection did.
+   */
+  boundView(getCredential: () => CredentialInput): BoundClientSessionView<AnyFnMap>
   load(schemas: FunctionSchema[]): void
   disconnect(): void
   readonly url: string
@@ -52,14 +62,6 @@ export type CreateKernelClientAdapterOpts = {
    * with `Credential audience mismatch`.
    */
   getCredential?: () => CredentialInput
-  /**
-   * Explicit identity node/path to use as the delegation mint subject. When
-   * omitted, the authenticated caller is resolved via `whoami` (so a cookie-fronted
-   * SPA mints as the logged-in user). Set this only to pin a subject; if set it
-   * MUST match the principal `getCredential()` authenticates as, or
-   * `mintDelegationCredential`'s self-invariant rejects the mint.
-   */
-  mintIdentity?: string
   /**
    * Wire-layer `fetch` shim, forwarded to the underlying `KernelClient`s.
    * Lets a same-origin SPA inject `credentials:'include'` + refresh-on-401 so
@@ -85,27 +87,14 @@ export function createKernelClientAdapter(
   if (opts.fetch) config.fetch = opts.fetch
   if (opts.getCredential) {
     const getCred = opts.getCredential
-    const explicitMintIdentity = opts.mintIdentity
-    const resolveSelf = createSelfResolver()
+    // Cross-origin redirects (kernel → worker) mint a fresh worker-scoped
+    // delegation from the active identity — the blessed self-mint adapter over
+    // `auth.delegate`, with the `skipDelegation` recursion guard baked in.
     config.delegation = {
-      mint: async (audience, delegation) => {
+      mint: delegationMintVia(() => {
         if (!session) throw new Error('ClientSession not initialised')
-        const s = session
-        const subject =
-          explicitMintIdentity ??
-          (await resolveSelf(() =>
-            s.call(WHOAMI_PATH, {}, { credential: getCred(), skipDelegation: true }),
-          ))
-        const result = await s.call(
-          identityMethod(subject, 'mintDelegationCredential'),
-          { audience, delegation, ttl: 3600 },
-          { credential: getCred(), skipDelegation: true },
-        )
-        if (typeof result !== 'string') {
-          throw new Error(`mintDelegationCredential returned non-string: ${typeof result}`)
-        }
-        return { credential: result, ttl: 3600 }
-      },
+        return session
+      }, getCred),
     }
   }
   session = new ClientSession<AnyFnMap>(config)
@@ -114,6 +103,10 @@ export function createKernelClientAdapter(
   return {
     url: opts.url,
 
+    boundView(getCredential) {
+      return ready.as(getCredential)
+    },
+
     call(method, params, credential, callOpts) {
       const sessionOpts: Parameters<typeof ready.call>[2] = { credential }
       if (callOpts?.timeout !== undefined) sessionOpts.timeout = callOpts.timeout

package/src/message/ctrl.ts

@@ -0,0 +1,25 @@
+/**
+ * Control message registry — extensible via declaration merging.
+ */
+export interface CtrlRegistry {
+  handshake: {
+    data: {
+      delegationToken: string
+      tokenExpiresAt: number
+      windowId: string
+      kernelUrl: string
+      functionId: string
+      targetNodeId?: string
+      mintIdentity?: string
+    }
+  }
+  handshakeAck: { data: { windowId: string } }
+  tokenRefresh: { data: { delegationToken: string; tokenExpiresAt: number } }
+}
+
+export type CtrlMessage<K extends keyof CtrlRegistry = keyof CtrlRegistry> = {
+  readonly type: 'ctrl'
+  readonly version: 1
+  readonly action: K
+  readonly data: CtrlRegistry[K]['data']
+}

package/src/{domain/message/errors.ts → message/error.ts}

@@ -7,3 +7,11 @@ export type ErrorCode =
   | 'DELIVERY_FAILED'
   | 'TOKEN_REFRESH_FAILED'
   | 'NO_VIEW_AVAILABLE'
+
+export type ErrorMessage = {
+  readonly type: 'error'
+  readonly version: 1
+  readonly code: ErrorCode
+  readonly message: string
+  readonly context?: unknown
+}

package/src/message/intent.ts

@@ -0,0 +1,98 @@
+export interface ViewRef {
+  readonly viewId: string
+  readonly functionId: string
+  readonly label?: string
+}
+
+/**
+ * Intent registry — extensible via declaration merging.
+ *
+ * An entry is EITHER `{ payload; reply }` (the reply-typed convention) OR a bare
+ * payload type (legacy). Read entries through {@link PayloadOf} / {@link ReplyOf}
+ * — never index `[K]['payload']` directly, so bare augmentations keep compiling.
+ *
+ * Consumers extend via:
+ *   declare module '@astrale-os/shell' {
+ *     interface IntentRegistry { ... }
+ *   }
+ */
+export interface IntentRegistry {
+  open: { payload: { nodeId: string; viewId?: string }; reply: { windowId: string } }
+  close: { payload: { windowId: string }; reply: void }
+  focus: { payload: { nodeId: string }; reply: void }
+  willClose: { payload: Record<string, never>; reply: void }
+  closeAck: { payload: Record<string, never>; reply: void }
+  closeRefuse: { payload: { reason: string }; reply: void }
+  pickView: { payload: { views: ViewRef[] }; reply: { viewId: string } }
+  receive: { payload: { data: unknown; sourceIntent: string }; reply: void }
+  /**
+   * Hot-swap — parent pushes a new target node to an already-mounted view
+   * without remounting. The child reads `targetNodeId` at handshake time
+   * for the initial value; `setTarget` replaces it for the lifetime of the
+   * window.
+   */
+  setTarget: { payload: { nodeId: string }; reply: void }
+  /**
+   * Child → parent: a view asks the user to grant `perms` (a permission
+   * bitmask) on `node` to `identity` (the beneficiary subject). Both `node`
+   * and `identity` are bare node ids (e.g. the view's `targetNodeId`, or
+   * `whoami().id` for "grant to myself") — the root shell addresses them as
+   * `@<id>`. The root shell (GUI) surfaces a modal, computes the delta vs.
+   * what the subject already holds, and — on approval — grants only the
+   * missing bits under the GUI user's own credential. `reason` is shown to
+   * the user. `reply.perms` is the bitmask actually granted (0 if
+   * declined / nothing was missing).
+   *
+   * Reaches a handler only from a view mounted as a DIRECT child of the root
+   * shell — the default intent policy does not bubble past one hop.
+   */
+  requestAccess: {
+    payload: { node: string; identity: string; perms: number; reason?: string }
+    reply: { granted: boolean; perms: number }
+  }
+  /**
+   * Generic correlated reply channel. The default intent transport is
+   * fire-and-forget; `requestIntent()` sends an intent carrying a
+   * `correlationId` and awaits an `intentReply` whose payload echoes it back
+   * with the handler's `result`. Routed to the resolver purely by
+   * `correlationId` — it intentionally matches no local handler.
+   */
+  intentReply: { payload: { correlationId: string; result: unknown }; reply: void }
+}
+
+/**
+ * Payload type for intent `K`. A `{ payload; reply }` entry projects its
+ * `payload`; a bare-payload (legacy) entry IS the payload. Distributes over `K`
+ * (the outer `extends` makes `K` naked) so `PayloadOf<keyof IntentRegistry>` is
+ * the union of per-key payloads, not the union of entries.
+ */
+export type PayloadOf<K extends keyof IntentRegistry> = K extends keyof IntentRegistry
+  ? IntentRegistry[K] extends { payload: infer P }
+    ? P
+    : IntentRegistry[K]
+  : never
+
+/**
+ * Reply type for intent `K` — the value a handler sends back through
+ * `ctx.reply` and a `requestIntent`/`useSendIntent` caller awaits. A
+ * `{ reply }` entry projects its `reply`; every other entry is `void`.
+ * Distributes over `K` (see {@link PayloadOf}).
+ */
+export type ReplyOf<K extends keyof IntentRegistry> = K extends keyof IntentRegistry
+  ? IntentRegistry[K] extends { reply: infer R }
+    ? R
+    : void
+  : never
+
+export type IntentEnvelope<K extends keyof IntentRegistry = keyof IntentRegistry> = {
+  readonly name: K
+  readonly payload: PayloadOf<K>
+  readonly sender: { readonly windowId: string }
+  readonly correlationId?: string
+}
+
+export type IntentMessage<K extends keyof IntentRegistry = keyof IntentRegistry> = {
+  readonly type: 'intent'
+  readonly version: 1
+  readonly envelope: IntentEnvelope<K>
+}

package/src/message/message.ts

@@ -0,0 +1,11 @@
+import type { CtrlMessage } from './ctrl'
+import type { ErrorMessage } from './error'
+import type { IntentMessage } from './intent'
+
+export type ShellMessage = IntentMessage | CtrlMessage | ErrorMessage
+
+export type MessageHandler<M extends ShellMessage = ShellMessage> = (message: M) => void
+
+export type MessageType = ShellMessage['type']
+
+export type MessageOf<T extends MessageType> = Extract<ShellMessage, { type: T }>

package/src/shell/access.ts

@@ -0,0 +1,26 @@
+import { NO_PERMS } from '@astrale-os/kernel-core/permissions'
+
+import type { PayloadOf, ReplyOf } from '../message/intent'
+import type { Shell } from './shell'
+
+import { requestIntent } from '../intent/request'
+
+/**
+ * View SDK convenience: ask the user (via the root shell) to grant `perms` on
+ * `node` to `identity`. Resolves with the bitmask actually granted (0 if the
+ * user declined or there was no parent to ask). The view typically passes its
+ * own identity (from `whoami`) as `identity`.
+ */
+export function requestAccess(
+  shell: Shell,
+  opts: PayloadOf<'requestAccess'>,
+): Promise<ReplyOf<'requestAccess'>> {
+  if (!shell.parent) return Promise.resolve({ granted: false, perms: NO_PERMS })
+  // A sandboxed shell's `parent` is a proxy that throws until `init()` resolves;
+  // honour the documented "no parent to ask" fallback instead of surfacing that
+  // opaque rejection to the caller.
+  return requestIntent(shell.parent, 'requestAccess', opts).catch(() => ({
+    granted: false,
+    perms: NO_PERMS,
+  }))
+}

package/src/shell/build.ts

@@ -0,0 +1,95 @@
+import type { OsNamespaces } from '../application/namespaces'
+import type { ChildrenChannelController } from '../channel/children'
+import type { MessageObserver } from '../channel/observer'
+import type { ParentChannel } from '../channel/parent'
+import type { IntentPipeline } from '../intent/pipeline'
+import type { LocalIntentHandler } from '../intent/router'
+import type { KernelClient } from '../kernel/client'
+import type { IntentRegistry } from '../message/intent'
+import type { LifecycleController } from '../window/lifecycle/states'
+import type { MountController } from '../window/mount/mount'
+import type { Window } from '../window/window'
+import type { Shell } from './shell'
+
+import { createOsNamespaces } from '../application/namespaces'
+
+export type FacadeDeps = {
+  parent: ParentChannel | null
+  childrenChannel: ChildrenChannelController
+  kernel: KernelClient
+  pipeline: IntentPipeline
+  observer: MessageObserver
+  lifecycle: LifecycleController
+  windows: Map<string, Window>
+  getMountController: () => MountController
+  onIntent: <K extends keyof IntentRegistry>(name: K, handler: LocalIntentHandler<K>) => () => void
+  targetNodeId?: () => string | undefined
+  init?: () => Promise<void>
+  onDispose: () => Promise<void>
+}
+
+/** Assemble the Shell object shared by both modes from their wired parts. */
+export function buildShellFacade(deps: FacadeDeps): Shell {
+  let disposed = false
+
+  // The OS namespaces are lazy over the kernel proxy: constructing them touches
+  // no kernel, so the sandboxed shell's "init() first" guard fires only when a
+  // namespace method actually dispatches.
+  let os: OsNamespaces | null = null
+  const osNamespaces = (): OsNamespaces => (os ??= createOsNamespaces(deps.kernel))
+
+  const shell: Shell = {
+    get parent() {
+      return deps.parent
+    },
+    children: deps.childrenChannel,
+    kernel: deps.kernel,
+    windows: deps.windows,
+    get targetNodeId() {
+      return deps.targetNodeId?.()
+    },
+    get user() {
+      return osNamespaces().user
+    },
+    get spaces() {
+      return osNamespaces().spaces
+    },
+    get apps() {
+      return osNamespaces().apps
+    },
+
+    use(middleware) {
+      deps.pipeline.use(middleware)
+      return shell
+    },
+
+    onMessage(handler) {
+      return deps.observer.subscribe(handler)
+    },
+
+    onIntent(name, handler) {
+      return deps.onIntent(name, handler)
+    },
+
+    mount(params) {
+      return deps.getMountController().mount(params)
+    },
+
+    close(windowId, opts) {
+      return deps.getMountController().close(windowId, opts)
+    },
+
+    async init() {
+      if (deps.init) await deps.init()
+      return shell
+    },
+
+    async dispose() {
+      if (disposed) return
+      disposed = true
+      await deps.onDispose()
+    },
+  }
+
+  return shell
+}

package/src/shell/config.ts

@@ -0,0 +1,32 @@
+import type { FunctionSchema } from '@astrale-os/kernel-client'
+
+import type { ShellAdapter } from '../window/embed/adapter'
+
+export type StandaloneConfig = {
+  readonly mode: 'standalone'
+  readonly kernelUrl: string
+  readonly credential?: string
+  readonly getCredential?: () => string
+  readonly mintIdentity?: string
+  readonly schema?: FunctionSchema[]
+  readonly adapter?: ShellAdapter
+  readonly windowId?: string
+  /**
+   * Optional wire-layer `fetch` shim for the kernel transport. A cookie-fronted
+   * SPA passes a wrapper adding `credentials:'include'` + refresh-on-401 and an
+   * empty `credential`, so a router unseals the cookie into a Bearer (the SPA
+   * holds no token). Omit it (the default) for token-based callers — including
+   * every sandboxed child view, which authenticates with a delegation token.
+   */
+  readonly fetch?: typeof fetch
+}
+
+export type SandboxedConfig = {
+  readonly mode: 'sandboxed'
+  readonly schema?: FunctionSchema[]
+  readonly parentWindow?: WindowProxy
+  readonly initTimeoutMs?: number
+  readonly adapter?: ShellAdapter
+}
+
+export type ShellConfig = StandaloneConfig | SandboxedConfig

package/src/shell/create.ts

@@ -0,0 +1,9 @@
+import type { ShellConfig } from './config'
+import type { Shell } from './shell'
+
+import { createSandboxedShell } from './sandboxed/sandboxed'
+import { createStandaloneShell } from './standalone'
+
+export function createShell(config: ShellConfig): Shell {
+  return config.mode === 'standalone' ? createStandaloneShell(config) : createSandboxedShell(config)
+}

package/src/{application/windowing/child-init.ts → shell/sandboxed/boot.ts}

@@ -1,18 +1,18 @@
 import type { FunctionSchema } from '@astrale-os/kernel-client'
 
-import type { DelegationToken } from '../../domain/identity/delegation'
-import type { CtrlMessage } from '../../domain/message/types'
-import type { MessageObserver } from '../channels/observer'
-import type { ParentChannelController } from '../channels/parent-channel'
-
-import { createKernelClientAdapter } from '../../adapters/kernel-client.adapter'
-import { createMessagePortTransport } from '../../adapters/message-port.transport'
-import { createParentChannel } from '../channels/parent-channel'
+import type { MessageObserver } from '../../channel/observer'
+import type { ParentChannelController } from '../../channel/parent'
+import type { DelegationToken } from '../../kernel/delegation/token'
+import type { CtrlMessage } from '../../message/ctrl'
+
+import { createMessagePortTransport } from '../../channel/message-port'
+import { createParentChannel } from '../../channel/parent'
 import {
   createDelegationKernelFacade,
   type DelegationKernelFacadeController,
-} from '../kernel-facade'
-import { INIT_REQUEST_TYPE, isInitResponse } from './protocol'
+} from '../../kernel/delegated'
+import { createKernelClientAdapter } from '../../kernel/session'
+import { INIT_REQUEST_TYPE, isInitResponse } from '../../message/init'
 
 export type ChildInitParams = {
   readonly parent: WindowProxy
@@ -78,7 +78,6 @@ export function performChildInit(params: ChildInitParams): Promise<ChildInitResu
           url: data.kernelUrl,
           schema: params.schema,
           getCredential: () => currentToken.credential,
-          mintIdentity: data.mintIdentity,
         })
         const kernel = createDelegationKernelFacade({
           adapter,

package/src/shell/sandboxed/guarded.ts

@@ -0,0 +1,32 @@
+import type { ParentChannel, ParentChannelController } from '../../channel/parent'
+import type { KernelClient } from '../../kernel/client'
+
+/** Throw the canonical "call init() first" error while `get()` has no state yet. */
+export function requireInit<T>(get: () => T | null): T {
+  const state = get()
+  if (!state) throw new Error('Sandboxed shell not initialized — call shell.init() first')
+  return state
+}
+
+/**
+ * Forward the whole unified kernel surface (graph sugar + `.call/.stream/…` +
+ * the shell extras) to the post-init facade lazily, so the "init() first"
+ * guard applies uniformly to every member without re-declaring each one.
+ */
+export function guardedKernel(require: () => KernelClient): KernelClient {
+  return new Proxy({} as KernelClient, {
+    get(_target, prop) {
+      const kernel = require() as unknown as Record<PropertyKey, unknown>
+      const value = kernel[prop]
+      return typeof value === 'function' ? value.bind(kernel) : value
+    },
+  })
+}
+
+/** Same guard for the parent channel — throws on use until `init()` resolves. */
+export function guardedParent(require: () => ParentChannelController): ParentChannel {
+  return {
+    send: (message) => require().send(message),
+    on: (type, handler) => require().on(type, handler),
+  }
+}

package/src/shell/sandboxed/pending.ts

@@ -0,0 +1,52 @@
+import type { IntentRouterController, LocalIntentHandler } from '../../intent/router'
+import type { IntentRegistry } from '../../message/intent'
+
+/**
+ * Buffer intent subscriptions made before `init()` resolves — the router is
+ * only built once the handshake completes, but consumers want to call
+ * `onIntent` at construction time.
+ */
+export interface PendingIntentSubs {
+  add<K extends keyof IntentRegistry>(name: K, handler: LocalIntentHandler<K>): () => void
+  /** Register the buffered subscriptions on the real router, then drain. */
+  replay(router: IntentRouterController): void
+}
+
+type Entry = {
+  name: string
+  handler: LocalIntentHandler
+  unsubscribed: boolean
+  off?: () => void
+}
+
+export function createPendingIntentSubs(): PendingIntentSubs {
+  const entries: Entry[] = []
+
+  return {
+    add(name, handler) {
+      const entry: Entry = {
+        name: name as string,
+        handler: handler as LocalIntentHandler,
+        unsubscribed: false,
+      }
+      entries.push(entry)
+      return () => {
+        entry.unsubscribed = true
+        // After init, `off` is the router's real disposer (set during replay);
+        // before init, flipping `unsubscribed` is enough (replay skips it).
+        entry.off?.()
+      }
+    },
+
+    replay(router) {
+      // Capture each real disposer so a post-init unsubscribe (via the closure
+      // returned at add time) actually removes the handler from the router
+      // instead of no-op'ing.
+      for (const entry of entries) {
+        if (entry.unsubscribed) continue
+        entry.off = router.onLocal(entry.name as keyof IntentRegistry, entry.handler)
+      }
+      entries.length = 0
+    },
+  }
+}

package/src/shell/sandboxed/sandboxed.ts

@@ -0,0 +1,131 @@
+import type { ParentChannelController } from '../../channel/parent'
+import type { IntentRouterController, LocalIntentHandler } from '../../intent/router'
+import type { KernelFacadeController } from '../../kernel/credential'
+import type { IntentRegistry } from '../../message/intent'
+import type { MountController } from '../../window/mount/mount'
+import type { Window } from '../../window/window'
+import type { SandboxedConfig } from '../config'
+import type { Shell } from '../shell'
+
+import { createChildrenChannel } from '../../channel/children'
+import { createMessageObserver } from '../../channel/observer'
+import { createIntentPipeline } from '../../intent/pipeline'
+import { createIntentRouter } from '../../intent/router'
+import { createLifecycleController } from '../../window/lifecycle/states'
+import { createMountController } from '../../window/mount/mount'
+import { buildShellFacade } from '../build'
+import { performChildInit } from './boot'
+import { guardedKernel, guardedParent, requireInit } from './guarded'
+import { createPendingIntentSubs } from './pending'
+
+/** Trusted sender id stamped on intents arriving from the parent channel. */
+const PARENT_SENDER_ID = '<parent>'
+
+type SandboxedState = {
+  windowId: string
+  kernelUrl: string
+  targetNodeId?: string
+  mintIdentity?: string
+  kernel: KernelFacadeController
+  parent: ParentChannelController
+}
+
+export function createSandboxedShell(config: SandboxedConfig): Shell {
+  const observer = createMessageObserver()
+  const lifecycle = createLifecycleController()
+  const windows = new Map<string, Window>()
+  const childrenChannel = createChildrenChannel({
+    observer,
+    onDeliveryFailed: (toWindowId) => lifecycle.markCrashed(toWindowId),
+  })
+  const pipeline = createIntentPipeline()
+
+  let state: SandboxedState | null = null
+  let router: IntentRouterController | null = null
+  let mountController: MountController | null = null
+
+  const pending = createPendingIntentSubs()
+
+  function subscribeIntent<K extends keyof IntentRegistry>(
+    name: K,
+    handler: LocalIntentHandler<K>,
+  ): () => void {
+    if (router) return router.onLocal(name, handler)
+    return pending.add(name, handler)
+  }
+
+  const requireState = () => requireInit(() => state)
+
+  const kernelProxy = guardedKernel(() => requireState().kernel)
+  const parentProxy = guardedParent(() => requireState().parent)
+
+  function getMountController(): MountController {
+    if (mountController) return mountController
+    if (!config.adapter) {
+      throw new Error('Shell.mount() requires a ShellAdapter in the config')
+    }
+    const current = requireState()
+    mountController = createMountController({
+      adapter: config.adapter,
+      kernel: kernelProxy,
+      kernelUrl: current.kernelUrl,
+      mintIdentity: current.mintIdentity,
+      childrenChannel,
+      windows,
+      lifecycle,
+    })
+    return mountController
+  }
+
+  return buildShellFacade({
+    parent: parentProxy,
+    childrenChannel,
+    kernel: kernelProxy,
+    pipeline,
+    observer,
+    lifecycle,
+    windows,
+    getMountController,
+    targetNodeId: () => state?.targetNodeId,
+    onIntent: subscribeIntent,
+    init: async () => {
+      const result = await performChildInit({
+        parent: config.parentWindow ?? window.parent,
+        timeoutMs: config.initTimeoutMs,
+        schema: config.schema,
+      })
+
+      state = {
+        windowId: result.windowId,
+        kernelUrl: result.kernelUrl,
+        targetNodeId: result.targetNodeId,
+        mintIdentity: result.mintIdentity,
+        kernel: result.kernel,
+        parent: result.parentChannel(observer),
+      }
+
+      router = createIntentRouter({
+        selfWindowId: state.windowId,
+        pipeline,
+        parent: state.parent,
+        children: childrenChannel,
+        windows,
+      })
+
+      childrenChannel.on('intent', (windowId, message) => {
+        void router!.handleInbound('child', message, windowId)
+      })
+      state.parent.on('intent', (message) => {
+        void router!.handleInbound('parent', message, PARENT_SENDER_ID)
+      })
+
+      pending.replay(router)
+    },
+    onDispose: async () => {
+      if (mountController) await mountController.dispose()
+      childrenChannel.dispose()
+      state?.parent.dispose()
+      state?.kernel.dispose()
+    },
+  })
+}