@dxos/plugin-client 0.10.0 → 0.11.0

package/src/containers/ProfileContainer/ProfileContainer.tsx

@@ -5,15 +5,17 @@
 import * as Schema from 'effect/Schema';
 import React, { type ChangeEvent, useCallback, useMemo, useState } from 'react';
 
+import { useOperationInvoker } from '@dxos/app-framework/ui';
 import { debounce } from '@dxos/async';
-import { useClient } from '@dxos/react-client';
-import { type Identity, useIdentity } from '@dxos/react-client/halo';
+import { type Identity } from '@dxos/halo';
+import { useIdentity } from '@dxos/halo-react';
 import { ButtonGroup, Clipboard, Input, useTranslation } from '@dxos/react-ui';
 import { Form, type FormFieldMap, type FormUpdateMeta } from '@dxos/react-ui-form';
 import { EmojiPickerBlock, HuePicker } from '@dxos/react-ui-pickers';
 import { hexToEmoji, hexToHue } from '@dxos/util';
 
 import { meta } from '#meta';
+import { ClientOperation } from '#operations';
 
 // TOOD(burdon): Factor out?
 // TODO(wittjosiah): Integrate annotations with translations.
@@ -27,33 +29,35 @@ const UserProfile = Schema.Struct({
 type UserProfile = Schema.Schema.Type<typeof UserProfile>;
 
 // TODO(thure): Factor out?
-const getDefaultHueValue = (identity: Identity | null) => hexToHue(identity?.identityKey.toHex() ?? '0');
-const getHueValue = (identity: Identity | null) => identity?.profile?.data?.hue || getDefaultHueValue(identity);
-const getDefaultEmojiValue = (identity: Identity | null) => hexToEmoji(identity?.identityKey.toHex() ?? '0');
-const getEmojiValue = (identity: Identity | null) => identity?.profile?.data?.emoji || getDefaultEmojiValue(identity);
+const getDefaultHueValue = (identity?: Identity.Info): string => hexToHue(identity?.identityKey ?? '0');
+const getHueValue = (identity?: Identity.Info): string => identity?.data?.hue || getDefaultHueValue(identity);
+const getDefaultEmojiValue = (identity?: Identity.Info): string => hexToEmoji(identity?.identityKey ?? '0');
+const getEmojiValue = (identity?: Identity.Info): string => identity?.data?.emoji || getDefaultEmojiValue(identity);
 
 export const ProfileContainer = () => {
   const { t } = useTranslation(meta.profile.key);
-  const client = useClient();
+  const { invokePromise } = useOperationInvoker();
   const identity = useIdentity();
-  const [displayName, setDisplayNameDirectly] = useState(identity?.profile?.displayName ?? '');
+  const [displayName, setDisplayNameDirectly] = useState(identity?.displayName ?? '');
   const [emoji, setEmojiDirectly] = useState<string>(getEmojiValue(identity));
   const [hue, setHueDirectly] = useState<string>(getHueValue(identity));
 
   const updateProfile = useMemo(
     () =>
       debounce(
-        (profile: Partial<UserProfile>) =>
-          client.halo.updateProfile({
+        // Merge onto the current profile data so unrelated metadata is preserved.
+        (profile: Partial<UserProfile>, currentData?: Record<string, unknown>) =>
+          invokePromise(ClientOperation.UpdateProfile, {
             displayName: profile.displayName,
             data: {
+              ...currentData,
               emoji: profile.emoji,
               hue: profile.hue,
             },
           }),
         2_000,
       ),
-    [],
+    [invokePromise],
   );
 
   const handleChange = useCallback(
@@ -76,9 +80,9 @@ export const ProfileContainer = () => {
         }
       }
 
-      void updateProfile(profile);
+      void updateProfile(profile, identity?.data);
     },
-    [identity],
+    [identity, updateProfile],
   );
 
   const values = useMemo(
@@ -184,3 +188,5 @@ export const ProfileContainer = () => {
     </Clipboard.Provider>
   );
 };
+
+ProfileContainer.displayName = 'ProfileContainer';

package/src/containers/RecoveryCodeDialog/RecoveryCodeDialog.tsx

@@ -69,3 +69,5 @@ const Code = ({ code }: { code: string }) => {
     </div>
   );
 };
+
+RecoveryCodeDialog.displayName = 'RecoveryCodeDialog';

package/src/containers/RecoveryCredentialsContainer/RecoveryCredentialsContainer.tsx

@@ -5,7 +5,7 @@
 import React from 'react';
 
 import { useOperationInvoker } from '@dxos/app-framework/ui';
-import { useCredentials } from '@dxos/react-client/halo';
+import { useCredentials } from '@dxos/halo-react';
 import { Icon, IconButton, Message, useTranslation } from '@dxos/react-ui';
 import { Form } from '@dxos/react-ui-form';
 import { Listbox } from '@dxos/react-ui-list';
@@ -20,7 +20,7 @@ export const RecoveryCredentialsContainer = () => {
   const { invokePromise } = useOperationInvoker();
   const credentials = useCredentials();
   const recoveryCredentials = credentials.filter(
-    (credential) => credential.subject.assertion['@type'] === 'dxos.halo.credentials.IdentityRecovery',
+    (credential) => credential.type === 'dxos.halo.credentials.IdentityRecovery',
   );
 
   return (
@@ -49,19 +49,15 @@ export const RecoveryCredentialsContainer = () => {
             {recoveryCredentials.length < 1 ? (
               <Message.Root valence='error'>
                 <Message.Title icon='ph--shield-warning--duotone'>{t('no-credentials.title')}</Message.Title>
-                <Message.Content>{t('no-credentials.message')}</Message.Content>
+                <Message.Body>{t('no-credentials.message')}</Message.Body>
               </Message.Root>
             ) : (
               <Listbox.Root>
                 <Listbox.Content classNames='gap-1'>
                   {recoveryCredentials.map((credential, index) => (
-                    <Listbox.Item
-                      key={credential.id?.toHex() ?? index}
-                      id={credential.id?.toHex() ?? `${index}`}
-                      classNames='gap-2'
-                    >
+                    <Listbox.Item key={credential.id ?? index} id={credential.id ?? `${index}`} classNames='gap-2'>
                       <Icon icon='ph--key--regular' />
-                      <Listbox.ItemLabel>{credential.issuanceDate.toLocaleString()}</Listbox.ItemLabel>
+                      <Listbox.ItemLabel>{credential.issuanceDate?.toLocaleString()}</Listbox.ItemLabel>
                     </Listbox.Item>
                   ))}
                 </Listbox.Content>
@@ -73,3 +69,5 @@ export const RecoveryCredentialsContainer = () => {
     </Form.Root>
   );
 };
+
+RecoveryCredentialsContainer.displayName = 'RecoveryCredentialsContainer';

package/src/containers/ResetDialog/ResetDialog.tsx

@@ -60,3 +60,5 @@ export const ResetDialog = ({ mode, onReset, onBeforeReset, capabilityManager }:
     </Dialog.Content>
   );
 };
+
+ResetDialog.displayName = 'ResetDialog';

package/src/containers/UsageContainer/UsageContainer.tsx

@@ -13,7 +13,14 @@ import { useHubHttpClient } from '../../hooks';
 import { UsageView, type UsageViewState } from './UsageView';
 
 /** State + payload kept together so `ready` always carries data (mirrors the discriminated `UsageViewProps`). */
-type UsageFetchState = { state: Exclude<UsageViewState, 'ready'> } | { state: 'ready'; data: GetProfileUsageResponse };
+type UsageFetchState =
+  | {
+      state: Exclude<UsageViewState, 'ready'>;
+    }
+  | {
+      state: 'ready';
+      data: GetProfileUsageResponse;
+    };
 
 /**
  * Fetches rolling-window profile usage from the hub service and renders it.
@@ -46,3 +53,5 @@ export const UsageContainer = () => {
 
   return <UsageView {...fetchState} lastUpdated={lastUpdated} onRefresh={handleRefresh} />;
 };
+
+UsageContainer.displayName = 'UsageContainer';

package/src/containers/UsageContainer/UsageView.stories.tsx

@@ -3,7 +3,6 @@
 //
 
 import { type Meta, type StoryObj } from '@storybook/react-vite';
-import { expect, userEvent, within } from 'storybook/test';
 
 import { type GetProfileUsageResponse } from '@dxos/protocols';
 import { withLayout, withTheme } from '@dxos/react-ui/testing';
@@ -114,14 +113,3 @@ export const Empty: Story = {
 export const Unavailable: Story = {
   args: { state: 'unavailable' },
 };
-
-// Drives the raw-response disclosure: collapsed until toggled, then the JSON viewer appears.
-export const Test: Story = {
-  args: Default.args,
-  play: async () => {
-    const screen = within(document.body);
-    await expect(screen.queryByTestId('usage-raw-json')).toBeNull();
-    await userEvent.click(await screen.findByRole('button', { name: 'Raw JSON' }, { timeout: 10_000 }));
-    await screen.findByTestId('usage-raw-json');
-  },
-};

package/src/containers/UsageContainer/UsageView.tsx

@@ -6,9 +6,8 @@ import * as Schema from 'effect/Schema';
 import React, { useCallback, useMemo, useState } from 'react';
 
 import { type GetProfileUsageResponse, type MeteringLimit, type MeteringUsageItem } from '@dxos/protocols';
-import { IconButton, Message, Status, ToggleIconButton, useTranslation } from '@dxos/react-ui';
+import { Message, Status, useTranslation } from '@dxos/react-ui';
 import { Form, type FormFieldProvider } from '@dxos/react-ui-form';
-import { JsonHighlighter } from '@dxos/react-ui-syntax-highlighter';
 
 import { meta } from '#meta';
 
@@ -214,19 +213,17 @@ export const UsageView = ({ state, data, lastUpdated, onRefresh }: UsageViewProp
       <Form.Viewport scroll>
         <Form.Content>
           <Form.Section title={t('usage-section.title')} description={t('usage-section.description')}>
-            {state === 'loading' ? (
-              <Status indeterminate aria-label={t('usage-section.title')} />
-            ) : message ? (
+            {message ? (
               <Message.Root valence={message.valence}>
                 <Message.Title icon={message.icon}>{t(message.title)}</Message.Title>
-                <Message.Content>{t(message.description)}</Message.Content>
+                <Message.Body>{t(message.description)}</Message.Body>
               </Message.Root>
             ) : (
               <Form.FieldSet fieldProvider={meterFieldProvider} />
             )}
           </Form.Section>
 
-          {state === 'ready' && data && (
+          {/* {state === 'ready' && data && (
             <Form.Section>
               <Form.Row
                 label={
@@ -246,9 +243,9 @@ export const UsageView = ({ state, data, lastUpdated, onRefresh }: UsageViewProp
                 )}
               </Form.Row>
             </Form.Section>
-          )}
+          )} */}
 
-          {state === 'ready' && data && (
+          {/* {state === 'ready' && data && (
             <Form.Section>
               <Form.Row label={t('usage-raw-json.label')}>
                 <ToggleIconButton
@@ -262,9 +259,11 @@ export const UsageView = ({ state, data, lastUpdated, onRefresh }: UsageViewProp
               </Form.Row>
               {rawExpanded && <JsonHighlighter data={data} testId='usage-raw-json' />}
             </Form.Section>
-          )}
+          )} */}
         </Form.Content>
       </Form.Viewport>
     </Form.Root>
   );
 };
+
+UsageView.displayName = 'UsageView';

package/src/halo-services-layer.ts

@@ -0,0 +1,29 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+import * as Layer from 'effect/Layer';
+
+import { Capability } from '@dxos/app-framework';
+import { Identity, Space } from '@dxos/halo';
+
+import { ClientCapabilities } from './types';
+
+/**
+ * Provides the canonical `@dxos/halo` services (`Identity.Service` / `Space.Service`) from the
+ * client-backed capabilities contributed by this plugin. Consumers depend on the halo services
+ * directly and provide this layer, rather than reaching for the capability instances:
+ *
+ * ```ts
+ * yield* Identity.getSnapshot; // requires Identity.Service
+ * // provided by:
+ * effect.pipe(Effect.provide(HaloServicesLayer));
+ * ```
+ *
+ * The layer itself requires `Capability.Service` (the capability manager), which is in scope inside
+ * capability modules and operation handlers.
+ */
+export const HaloServicesLayer: Layer.Layer<Identity.Service | Space.Service, never, Capability.Service> = Layer.merge(
+  Capability.layerWith(ClientCapabilities.IdentityService, (service) => Layer.succeed(Identity.Service, service)),
+  Capability.layerWith(ClientCapabilities.SpaceService, (service) => Layer.succeed(Space.Service, service)),
+);

package/src/index.ts

@@ -3,5 +3,14 @@
 //
 
 export { meta } from './meta';
+export { HaloServicesLayer } from './halo-services-layer';
+export * from './progress';
 export * from './types';
 export { ClientOperation } from './operations';
+export {
+  PasskeyDismissedError,
+  type PasskeyFailure,
+  PasskeyLoginError,
+  PasskeyRejectedError,
+  classifyPasskeyFailure,
+} from './operations/errors';

package/src/operations/definitions.ts

@@ -6,6 +6,7 @@ import * as Schema from 'effect/Schema';
 
 import { Capability } from '@dxos/app-framework';
 import { Operation } from '@dxos/compute';
+import { Identity } from '@dxos/halo';
 import { DXN, IdentityDid, SpaceId } from '@dxos/keys';
 
 import { meta } from '#meta';
@@ -32,11 +33,18 @@ const ProfileSchema = Schema.Struct({
 
 export const CreateIdentity = Operation.make({
   meta: { key: makeKey('createIdentity'), name: 'Create Identity', icon: 'ph--user--regular' },
-  services: [Capability.Service],
+  services: [Capability.Service, Identity.Service],
   input: ProfileSchema,
   output: IdentitySchema,
 });
 
+export const UpdateProfile = Operation.make({
+  meta: { key: makeKey('updateProfile'), name: 'Update Profile', icon: 'ph--user--regular' },
+  services: [Identity.Service],
+  input: ProfileSchema,
+  output: Schema.Void,
+});
+
 export const JoinIdentity = Operation.make({
   meta: { key: makeKey('joinIdentity'), name: 'Join Identity', icon: 'ph--sign-in--regular' },
   services: [Capability.Service],

package/src/operations/errors.test.ts

@@ -0,0 +1,27 @@
+//
+// Copyright 2025 DXOS.org
+//
+
+import { describe, expect, test } from 'vitest';
+
+import { PasskeyDismissedError, classifyPasskeyFailure, toPasskeyAssertionError } from './errors';
+
+describe('passkey errors', () => {
+  // The native (Tauri) bridge rejects with a plain string rather than a DOMException, and
+  // ASAuthorization spells it "canceled" while the web spells it "cancelled".
+  test.each(['ASAuthorizationError: the operation was canceled', 'Prompt cancelled by user'])(
+    'a native dismissal is recognised without a DOMException (%s)',
+    (rejection) => {
+      expect(PasskeyDismissedError.is(toPasskeyAssertionError(rejection))).to.be.true;
+    },
+  );
+
+  // The bug this guards: a failure the classifier doesn't recognise must still reach the user.
+  // A `switch` on the error tag without a default would regress to silence.
+  test.each([new Error('Recovery key not registered.'), 'plain string', undefined, null])(
+    'an unrecognised failure is still reported (%s)',
+    (error) => {
+      expect(classifyPasskeyFailure(error)).to.eq('failed');
+    },
+  );
+});

package/src/operations/errors.ts

@@ -0,0 +1,47 @@
+//
+// Copyright 2025 DXOS.org
+//
+
+import { BaseError } from '@dxos/errors';
+
+/**
+ * The platform prompt produced no assertion. WebAuthn reports a dismissed prompt and
+ * "this device has no passkey for this site" identically, so the two cannot be told apart.
+ */
+export class PasskeyDismissedError extends BaseError.extend('PasskeyDismissedError', 'No passkey was presented') {}
+
+/** The assertion was refused: the passkey is not registered as a recovery credential for any identity. */
+export class PasskeyRejectedError extends BaseError.extend('PasskeyRejectedError', 'Passkey was not accepted') {}
+
+/** Passkey login failed before an assertion could be checked (service unreachable, unusable authenticator response). */
+export class PasskeyLoginError extends BaseError.extend('PasskeyLoginError', 'Passkey login failed') {}
+
+/**
+ * Classify a rejection from the authenticator. WebAuthn reports a dismissed prompt and
+ * "no credential for this site" as the same `NotAllowedError`, so both map to dismissal;
+ * the native (Tauri) bridge rejects with a plain string rather than a `DOMException`.
+ */
+export const toPasskeyAssertionError = (error: unknown): PasskeyDismissedError | PasskeyLoginError => {
+  const name = error instanceof DOMException ? error.name : undefined;
+  if (name === 'NotAllowedError' || name === 'AbortError' || /cancell?ed/i.test(String(error))) {
+    return new PasskeyDismissedError({ cause: error });
+  }
+  return new PasskeyLoginError({ cause: error });
+};
+
+/** Discriminates a passkey login failure so callers can pick a message without matching on error names. */
+export type PasskeyFailure = 'dismissed' | 'rejected' | 'failed';
+
+/**
+ * Classify an error returned by the `RedeemPasskey` operation.
+ * Anything unrecognized is reported as a generic failure rather than swallowed.
+ */
+export const classifyPasskeyFailure = (error: unknown): PasskeyFailure => {
+  if (PasskeyDismissedError.is(error)) {
+    return 'dismissed';
+  }
+  if (PasskeyRejectedError.is(error)) {
+    return 'rejected';
+  }
+  return 'failed';
+};

package/src/operations/index.ts

@@ -5,6 +5,7 @@
 import { OperationHandlerSet } from '@dxos/compute';
 
 export * as ClientOperation from './definitions';
+export * from './errors';
 
 export const ClientOperationHandlerSet = OperationHandlerSet.lazy(
   () => import('./create-agent'),
@@ -17,5 +18,7 @@ export const ClientOperationHandlerSet = OperationHandlerSet.lazy(
   () => import('./redeem-passkey'),
   () => import('./redeem-token'),
   () => import('./reset-storage'),
+  () => import('./resolve-navigation-targets'),
   () => import('./share-identity'),
+  () => import('./update-profile'),
 );

package/src/operations/open-usage.ts

@@ -4,7 +4,7 @@
 
 import * as Effect from 'effect/Effect';
 
-import { LayoutOperation, Paths } from '@dxos/app-toolkit';
+import { GraphPath, LayoutOperation } from '@dxos/app-toolkit';
 import { Operation } from '@dxos/compute';
 
 import { Account } from '../types';
@@ -13,9 +13,9 @@ import { OpenUsage } from './definitions';
 const handler: Operation.WithHandler<typeof OpenUsage> = OpenUsage.pipe(
   Operation.withHandler(
     Effect.fnUntraced(function* () {
-      yield* Operation.invoke(LayoutOperation.SwitchWorkspace, { subject: Paths.getSpacePath(Account.id) });
+      yield* Operation.invoke(LayoutOperation.SwitchWorkspace, { subject: GraphPath.getSpacePath(Account.id) });
       yield* Operation.invoke(LayoutOperation.Open, {
-        subject: [Paths.getSpacePath(Account.id, Account.Usage)],
+        subject: [GraphPath.getSpacePath(Account.id, Account.Usage)],
       });
     }),
   ),

package/src/operations/redeem-passkey.ts

@@ -13,69 +13,99 @@ import { invariant } from '@dxos/invariant';
 
 import { ClientCapabilities } from '../types';
 import { RedeemPasskey } from './definitions';
+import { PasskeyDismissedError, PasskeyLoginError, PasskeyRejectedError, toPasskeyAssertionError } from './errors';
+
+/** Signed challenge presented to EDGE in exchange for admitting this device. */
+type Assertion = {
+  lookupKey: PublicKey;
+  signature: Buffer;
+  clientDataJson: Buffer;
+  authenticatorData: Buffer;
+};
+
+const nativeAssertion = (challenge: string): Effect.Effect<Assertion, PasskeyDismissedError | PasskeyLoginError> =>
+  Effect.gen(function* () {
+    const result = yield* Effect.tryPromise({
+      try: () => NativePasskey.loginNativePasskey({ challenge: Uint8Array.from(Buffer.from(challenge, 'base64')) }),
+      catch: toPasskeyAssertionError,
+    });
+    if (!result?.user_handle || !result.signature) {
+      return yield* Effect.fail(new PasskeyLoginError({ message: 'Native passkey login returned no assertion.' }));
+    }
+
+    return {
+      lookupKey: PublicKey.from(NativePasskey.decodeUrlSafeBase64(result.user_handle)),
+      signature: Buffer.from(NativePasskey.decodeUrlSafeBase64(result.signature)),
+      clientDataJson: Buffer.from(NativePasskey.decodeUrlSafeBase64(result.client_data_json)),
+      authenticatorData: Buffer.from(NativePasskey.decodeUrlSafeBase64(result.authenticator_data)),
+    };
+  });
+
+const webAssertion = (challenge: string): Effect.Effect<Assertion, PasskeyDismissedError | PasskeyLoginError> =>
+  Effect.gen(function* () {
+    if (typeof PublicKeyCredential === 'undefined') {
+      return yield* Effect.fail(new PasskeyLoginError({ message: 'WebAuthn is not available in this browser.' }));
+    }
+
+    const credential = yield* Effect.tryPromise({
+      try: () =>
+        navigator.credentials.get({
+          publicKey: {
+            challenge: Buffer.from(challenge, 'base64'),
+            rpId: location.hostname,
+            userVerification: 'required',
+          },
+        }),
+      catch: toPasskeyAssertionError,
+    });
+    // A null credential means the authenticator resolved without presenting one; same signal as a dismissal.
+    if (
+      !(credential instanceof PublicKeyCredential) ||
+      !(credential.response instanceof AuthenticatorAssertionResponse)
+    ) {
+      return yield* Effect.fail(new PasskeyDismissedError({ message: 'No passkey assertion was returned.' }));
+    }
+
+    const { signature, clientDataJSON, authenticatorData, userHandle } = credential.response;
+    // The user handle carries the lookup key; a passkey created without a resident key has none.
+    if (!userHandle) {
+      return yield* Effect.fail(new PasskeyLoginError({ message: 'Passkey assertion has no user handle.' }));
+    }
+
+    return {
+      lookupKey: PublicKey.from(new Uint8Array(userHandle)),
+      signature: Buffer.from(signature),
+      clientDataJson: Buffer.from(clientDataJSON),
+      authenticatorData: Buffer.from(authenticatorData),
+    };
+  });
 
 const handler: Operation.WithHandler<typeof RedeemPasskey> = RedeemPasskey.pipe(
   Operation.withHandler(
     Effect.fnUntraced(function* () {
       const client = yield* Capability.get(ClientCapabilities.Client);
-      invariant(client.services.services.IdentityService, 'IdentityService not available');
-      const { deviceKey, controlFeedKey, challenge } = yield* Effect.promise(() =>
-        client.services.services.IdentityService!.requestRecoveryChallenge(),
-      );
+      const identityService = client.services.services.IdentityService;
+      invariant(identityService, 'IdentityService not available');
 
-      const { lookupKey, signature, clientDataJson, authenticatorData } = yield* Match.value(
-        NativePasskey.supportsNativePasskeys(),
-      ).pipe(
-        Match.when(true, () =>
-          Effect.gen(function* () {
-            const result = yield* Effect.promise(() =>
-              NativePasskey.loginNativePasskey({ challenge: Uint8Array.from(Buffer.from(challenge, 'base64')) }),
-            );
-            invariant(result, 'Native passkey login returned no result');
-            return {
-              lookupKey: PublicKey.from(NativePasskey.decodeUrlSafeBase64(result.user_handle)),
-              signature: Buffer.from(NativePasskey.decodeUrlSafeBase64(result.signature)),
-              clientDataJson: Buffer.from(NativePasskey.decodeUrlSafeBase64(result.client_data_json)),
-              authenticatorData: Buffer.from(NativePasskey.decodeUrlSafeBase64(result.authenticator_data)),
-            };
-          }),
-        ),
-        Match.orElse(() =>
-          Effect.gen(function* () {
-            const credential = yield* Effect.promise(() =>
-              navigator.credentials.get({
-                publicKey: {
-                  challenge: Buffer.from(challenge, 'base64'),
-                  rpId: location.hostname,
-                  userVerification: 'required',
-                },
-              }),
-            );
-            return {
-              lookupKey: PublicKey.from(new Uint8Array((credential as any).response.userHandle)),
-              signature: Buffer.from((credential as any).response.signature),
-              clientDataJson: Buffer.from((credential as any).response.clientDataJSON),
-              authenticatorData: Buffer.from((credential as any).response.authenticatorData),
-            };
-          }),
-        ),
-      );
+      const { deviceKey, controlFeedKey, challenge } = yield* Effect.tryPromise({
+        try: () => identityService.requestRecoveryChallenge(),
+        catch: PasskeyLoginError.wrap({ message: 'Failed to request a recovery challenge.' }),
+      });
 
-      yield* Effect.promise(() =>
-        client.services.services.IdentityService!.recoverIdentity(
-          {
-            external: {
-              lookupKey,
-              deviceKey,
-              controlFeedKey,
-              signature,
-              clientDataJson,
-              authenticatorData,
-            },
-          },
-          { timeout: RECOVER_IDENTITY_RPC_TIMEOUT },
-        ),
+      const assertion = yield* Match.value(NativePasskey.supportsNativePasskeys()).pipe(
+        Match.when(true, () => nativeAssertion(challenge)),
+        Match.orElse(() => webAssertion(challenge)),
       );
+
+      // EDGE refuses the assertion when the passkey isn't registered as a recovery credential.
+      yield* Effect.tryPromise({
+        try: () =>
+          identityService.recoverIdentity(
+            { external: { ...assertion, deviceKey, controlFeedKey } },
+            { timeout: RECOVER_IDENTITY_RPC_TIMEOUT },
+          ),
+        catch: PasskeyRejectedError.wrap(),
+      });
     }),
   ),
 );

package/src/operations/resolve-navigation-targets.ts

@@ -0,0 +1,71 @@
+//
+// Copyright 2026 DXOS.org
+//
+
+import * as Effect from 'effect/Effect';
+
+import { Capability } from '@dxos/app-framework';
+import { AppCapabilities, AppSpace, NavigationOperation } from '@dxos/app-toolkit';
+import { Operation } from '@dxos/compute';
+import { Database, EID } from '@dxos/echo';
+import { Position } from '@dxos/util';
+
+import { ClientCapabilities } from '../types';
+
+const handler: Operation.WithHandler<typeof NavigationOperation.ResolveNavigationTargets> =
+  NavigationOperation.ResolveNavigationTargets.pipe(
+    Operation.withHandler(
+      Effect.fn(function* ({ query }) {
+        const capabilities = yield* Capability.Service;
+        const client = yield* Capability.get(ClientCapabilities.Client).pipe(
+          Effect.catchAll(() => Effect.succeed(undefined)),
+        );
+
+        // Resolvers read a space database to derive a navigation path, so this handler lives with the
+        // client: it is the only place that can turn a URI's space id into a database to provide. When
+        // the query names a space that is not available, resolve nothing — falling back to the active
+        // space would resolve the id against the wrong database (a ref can reach across spaces). The
+        // active space serves only space-less queries (`dxn:` URIs, local EIDs, no query).
+        const eid = query?.uri ? EID.tryParse(query.uri) : undefined;
+        const spaceId = eid ? EID.getSpaceId(eid) : undefined;
+        const space = client
+          ? spaceId
+            ? client.spaces.get(spaceId)
+            : AppSpace.getActiveSpace(client, capabilities)
+          : undefined;
+
+        // Resolvers require `Database.Service`, and an unbound service is a defect rather than a failure
+        // (so the `catchAll` below would not contain it) — with no space to derive a database from there
+        // is nothing to resolve against, so skip them entirely.
+        if (!space) {
+          return { targets: [] };
+        }
+
+        const resolvers = capabilities.getAll(AppCapabilities.NavigationTargetResolver);
+        const results = yield* Effect.forEach(resolvers, (resolver) =>
+          resolver(query).pipe(Effect.catchAll(() => Effect.succeed([]))),
+        ).pipe(Effect.provide(Database.layer(space.db)));
+
+        // Best-first, as the operation's output promises. Sort is stable, so resolvers that declare no
+        // position keep contribution order; `position` itself is resolver metadata and not returned.
+        // Two resolvers can name the same path (the generic type-section lookup and a type's own
+        // resolver), so paths are deduped keeping the best-placed occurrence.
+        const seen = new Set<string>();
+        return {
+          targets: results
+            .flat()
+            .sort(Position.compare)
+            .filter(({ path }) => {
+              if (seen.has(path)) {
+                return false;
+              }
+              seen.add(path);
+              return true;
+            })
+            .map(({ path, label, type }) => ({ path, label, type })),
+        };
+      }),
+    ),
+  );
+
+export default handler;