@dxos/plugin-client 0.10.0 → 0.11.1

package/dist/lib/chunk-layer-specs.mjs

@@ -0,0 +1,107 @@
+import { Capabilities, Capability } from "@dxos/app-framework";
+import * as Layer from "effect/Layer";
+import { Identity, Space } from "@dxos/halo";
+import { Credential, LayerSpec } from "@dxos/compute";
+import { ClientCapabilities } from "#types";
+import * as Effect from "effect/Effect";
+import { ClientService } from "@dxos/client";
+import { invariant } from "@dxos/invariant";
+import { layerIdentity, layerSpace } from "@dxos/halo-adapter-client";
+import { accessTokenResolverFromEdge, credentialsLayerFromDatabase } from "@dxos/compute-runtime";
+import { Database } from "@dxos/echo";
+//#region src/capabilities/layer-specs.ts
+var __dxlog_file = "/__w/dxos/dxos/packages/plugins/plugin-client/src/capabilities/layer-specs.ts";
+/**
+* Provides the Effect-level {@link ClientService} backed by the
+* {@link ClientCapabilities.Client} capability contributed by the plugin
+* runtime.
+*/
+var ClientLayerSpec = LayerSpec.make({
+	affinity: "application",
+	requires: [Capability.Service],
+	provides: [ClientService]
+}, () => Layer.unwrapEffect(Effect.gen(function* () {
+	const client = yield* Capability.get(ClientCapabilities.Client);
+	return ClientService.fromClient(client);
+}).pipe(Effect.orDie)));
+/**
+* Space-scoped database/feed services resolved from the `Client`'s space
+* registry. One spec for both so the `client.spaces.get` / `waitUntilReady`
+* round-trip only happens once per space slice. Fails hard if the context is
+* missing a `space` id or the client cannot resolve it — both indicate a
+* configuration bug in the layer graph.
+*/
+var DatabaseLayerSpec = LayerSpec.make({
+	affinity: "space",
+	requires: [ClientService],
+	provides: [Database.Service]
+}, (context) => Layer.unwrapEffect(Effect.gen(function* () {
+	invariant(context.space, "space context required for Database layer", {
+		"~LogMeta": "~LogMeta",
+		F: __dxlog_file,
+		L: 67,
+		S: this,
+		A: ["context.space", "'space context required for Database layer'"]
+	});
+	const space = (yield* ClientService).spaces.get(context.space);
+	invariant(space, `space not found on client: ${context.space}`, {
+		"~LogMeta": "~LogMeta",
+		F: __dxlog_file,
+		L: 70,
+		S: this,
+		A: ["space", "`space not found on client: ${context.space}`"]
+	});
+	yield* Effect.promise(() => space.waitUntilReady());
+	return Database.layer(space.db);
+})));
+/**
+* Resolves server-custodied access tokens through EDGE. Application-scoped: the resolver's cache is
+* keyed by token id and is worth sharing across spaces.
+*/
+var AccessTokenResolverLayerSpec = LayerSpec.make({
+	affinity: "application",
+	requires: [Capability.Service],
+	provides: [Credential.AccessTokenResolver]
+}, () => Layer.unwrapEffect(Effect.gen(function* () {
+	const client = yield* Capability.get(ClientCapabilities.Client);
+	return accessTokenResolverFromEdge(() => client.edge.http);
+}).pipe(Effect.orDie)));
+var CredentialsLayerSpec = LayerSpec.make({
+	affinity: "space",
+	requires: [Database.Service, Credential.AccessTokenResolver],
+	provides: [Credential.CredentialsService]
+}, () => credentialsLayerFromDatabase());
+/**
+* The HALO {@link Identity.Service} backed by the client adapter. Application-scoped: it manages
+* the local identity and its devices for the whole client.
+*/
+var IdentityLayerSpec = LayerSpec.make({
+	affinity: "application",
+	requires: [ClientService],
+	provides: [Identity.Service]
+}, () => Layer.unwrapEffect(Effect.gen(function* () {
+	return layerIdentity(yield* ClientService);
+})));
+/**
+* The HALO {@link Space.Service} backed by the client adapter. Application-scoped: its verbs are
+* keyed by {@link SpaceId} and cover every space on the client, not a single space slice.
+*/
+var SpaceLayerSpec = LayerSpec.make({
+	affinity: "application",
+	requires: [ClientService],
+	provides: [Space.Service]
+}, () => Layer.unwrapEffect(Effect.gen(function* () {
+	return layerSpace(yield* ClientService);
+})));
+var layer_specs_default = Capability.makeModule(() => Effect.succeed([
+	Capability.contributes(Capabilities.LayerSpec, ClientLayerSpec),
+	Capability.contributes(Capabilities.LayerSpec, DatabaseLayerSpec),
+	Capability.contributes(Capabilities.LayerSpec, AccessTokenResolverLayerSpec),
+	Capability.contributes(Capabilities.LayerSpec, CredentialsLayerSpec),
+	Capability.contributes(Capabilities.LayerSpec, IdentityLayerSpec),
+	Capability.contributes(Capabilities.LayerSpec, SpaceLayerSpec)
+]));
+//#endregion
+export { layer_specs_default as default };
+
+//# sourceMappingURL=chunk-layer-specs.mjs.map

package/dist/lib/chunk-layer-specs.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk-layer-specs.mjs","names":[],"sources":["../../src/capabilities/layer-specs.ts"],"sourcesContent":["//\n// Copyright 2026 DXOS.org\n//\n\nimport * as Effect from 'effect/Effect';\nimport * as Layer from 'effect/Layer';\n\nimport { Capabilities, Capability } from '@dxos/app-framework';\nimport { ClientService } from '@dxos/client';\nimport { Credential, LayerSpec } from '@dxos/compute';\nimport { accessTokenResolverFromEdge, credentialsLayerFromDatabase } from '@dxos/compute-runtime';\nimport { Database } from '@dxos/echo';\nimport { Identity, Space } from '@dxos/halo';\nimport { layerIdentity, layerSpace } from '@dxos/halo-adapter-client';\nimport { invariant } from '@dxos/invariant';\n\nimport { ClientCapabilities } from '#types';\n\n//\n// Capability Module\n//\n// Contributes the core client/space service layer specs:\n//   - {@link ClientService} (application affinity).\n//   - {@link Database.Service}, {@link Credential.CredentialsService} (space affinity).\n//\n// Specs are declared at module level and resolve the underlying\n// {@link ClientCapabilities.Client} through the Effect layer graph (via\n// {@link Capability.Service}) rather than capturing it from an outer scope.\n//\n\n/**\n * Provides the Effect-level {@link ClientService} backed by the\n * {@link ClientCapabilities.Client} capability contributed by the plugin\n * runtime.\n */\nconst ClientLayerSpec = LayerSpec.make(\n  {\n    affinity: 'application',\n    requires: [Capability.Service],\n    provides: [ClientService],\n  },\n  () =>\n    Layer.unwrapEffect(\n      Effect.gen(function* () {\n        const client = yield* Capability.get(ClientCapabilities.Client);\n        return ClientService.fromClient(client);\n      }).pipe(Effect.orDie),\n    ),\n);\n\n/**\n * Space-scoped database/feed services resolved from the `Client`'s space\n * registry. One spec for both so the `client.spaces.get` / `waitUntilReady`\n * round-trip only happens once per space slice. Fails hard if the context is\n * missing a `space` id or the client cannot resolve it — both indicate a\n * configuration bug in the layer graph.\n */\nconst DatabaseLayerSpec = LayerSpec.make(\n  {\n    affinity: 'space',\n    requires: [ClientService],\n    provides: [Database.Service],\n  },\n  (context) =>\n    Layer.unwrapEffect(\n      Effect.gen(function* () {\n        invariant(context.space, 'space context required for Database layer');\n        const client = yield* ClientService;\n        const space = client.spaces.get(context.space);\n        invariant(space, `space not found on client: ${context.space}`);\n        yield* Effect.promise(() => space.waitUntilReady());\n        return Database.layer(space.db);\n      }),\n    ),\n);\n\n/**\n * Resolves server-custodied access tokens through EDGE. Application-scoped: the resolver's cache is\n * keyed by token id and is worth sharing across spaces.\n */\nconst AccessTokenResolverLayerSpec = LayerSpec.make(\n  {\n    affinity: 'application',\n    requires: [Capability.Service],\n    provides: [Credential.AccessTokenResolver],\n  },\n  () =>\n    Layer.unwrapEffect(\n      Effect.gen(function* () {\n        const client = yield* Capability.get(ClientCapabilities.Client);\n        return accessTokenResolverFromEdge(() => client.edge.http);\n      }).pipe(Effect.orDie),\n    ),\n);\n\nconst CredentialsLayerSpec = LayerSpec.make(\n  {\n    affinity: 'space',\n    requires: [Database.Service, Credential.AccessTokenResolver],\n    provides: [Credential.CredentialsService],\n  },\n  () => credentialsLayerFromDatabase(),\n);\n\n/**\n * The HALO {@link Identity.Service} backed by the client adapter. Application-scoped: it manages\n * the local identity and its devices for the whole client.\n */\nconst IdentityLayerSpec = LayerSpec.make(\n  {\n    affinity: 'application',\n    requires: [ClientService],\n    provides: [Identity.Service],\n  },\n  () =>\n    Layer.unwrapEffect(\n      Effect.gen(function* () {\n        const client = yield* ClientService;\n        return layerIdentity(client);\n      }),\n    ),\n);\n\n/**\n * The HALO {@link Space.Service} backed by the client adapter. Application-scoped: its verbs are\n * keyed by {@link SpaceId} and cover every space on the client, not a single space slice.\n */\nconst SpaceLayerSpec = LayerSpec.make(\n  {\n    affinity: 'application',\n    requires: [ClientService],\n    provides: [Space.Service],\n  },\n  () =>\n    Layer.unwrapEffect(\n      Effect.gen(function* () {\n        const client = yield* ClientService;\n        return layerSpace(client);\n      }),\n    ),\n);\n\nexport default Capability.makeModule(() =>\n  Effect.succeed([\n    Capability.contributes(Capabilities.LayerSpec, ClientLayerSpec),\n    Capability.contributes(Capabilities.LayerSpec, DatabaseLayerSpec),\n    Capability.contributes(Capabilities.LayerSpec, AccessTokenResolverLayerSpec),\n    Capability.contributes(Capabilities.LayerSpec, CredentialsLayerSpec),\n    Capability.contributes(Capabilities.LayerSpec, IdentityLayerSpec),\n    Capability.contributes(Capabilities.LayerSpec, SpaceLayerSpec),\n  ]),\n);\n"],"mappings":";;;;;;;;;;;;;;;;;;AAmCA,IAAM,kBAAkB,UAAU,KAChC;CACE,UAAU;CACV,UAAU,CAAC,WAAW,OAAO;CAC7B,UAAU,CAAC,aAAa;AAC1B,SAEE,MAAM,aACJ,OAAO,IAAI,aAAa;CACtB,MAAM,SAAS,OAAO,WAAW,IAAI,mBAAmB,MAAM;CAC9D,OAAO,cAAc,WAAW,MAAM;AACxC,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,CACtB,CACJ;;;;;;;;AASA,IAAM,oBAAoB,UAAU,KAClC;CACE,UAAU;CACV,UAAU,CAAC,aAAa;CACxB,UAAU,CAAC,SAAS,OAAO;AAC7B,IACC,YACC,MAAM,aACJ,OAAO,IAAI,aAAa;CACtB,UAAU,QAAQ,OAAO,6CAA0C;EAAA,YAAA;EAAA,GAAA;EAAA,GAAA;EAAA,GAAA;EAAA,GAAA,CAAA,iBAAA,6CAAA;CAAA,CAAC;CAEpE,MAAM,SAAQ,OADQ,cAAA,CACD,OAAO,IAAI,QAAQ,KAAK;CAC7C,UAAU,OAAO,8BAA8B,QAAQ,SAAM;EAAA,YAAA;EAAA,GAAA;EAAA,GAAA;EAAA,GAAA;EAAA,GAAA,CAAA,SAAA,+CAAA;CAAA,CAAC;CAC9D,OAAO,OAAO,cAAc,MAAM,eAAe,CAAC;CAClD,OAAO,SAAS,MAAM,MAAM,EAAE;AAChC,CAAC,CACH,CACJ;;;;;AAMA,IAAM,+BAA+B,UAAU,KAC7C;CACE,UAAU;CACV,UAAU,CAAC,WAAW,OAAO;CAC7B,UAAU,CAAC,WAAW,mBAAmB;AAC3C,SAEE,MAAM,aACJ,OAAO,IAAI,aAAa;CACtB,MAAM,SAAS,OAAO,WAAW,IAAI,mBAAmB,MAAM;CAC9D,OAAO,kCAAkC,OAAO,KAAK,IAAI;AAC3D,CAAC,CAAC,CAAC,KAAK,OAAO,KAAK,CACtB,CACJ;AAEA,IAAM,uBAAuB,UAAU,KACrC;CACE,UAAU;CACV,UAAU,CAAC,SAAS,SAAS,WAAW,mBAAmB;CAC3D,UAAU,CAAC,WAAW,kBAAkB;AAC1C,SACM,6BAA6B,CACrC;;;;;AAMA,IAAM,oBAAoB,UAAU,KAClC;CACE,UAAU;CACV,UAAU,CAAC,aAAa;CACxB,UAAU,CAAC,SAAS,OAAO;AAC7B,SAEE,MAAM,aACJ,OAAO,IAAI,aAAa;CAEtB,OAAO,cAAc,OADC,aACK;AAC7B,CAAC,CACH,CACJ;;;;;AAMA,IAAM,iBAAiB,UAAU,KAC/B;CACE,UAAU;CACV,UAAU,CAAC,aAAa;CACxB,UAAU,CAAC,MAAM,OAAO;AAC1B,SAEE,MAAM,aACJ,OAAO,IAAI,aAAa;CAEtB,OAAO,WAAW,OADI,aACE;AAC1B,CAAC,CACH,CACJ;AAEA,IAAA,sBAAe,WAAW,iBACxB,OAAO,QAAQ;CACb,WAAW,YAAY,aAAa,WAAW,eAAe;CAC9D,WAAW,YAAY,aAAa,WAAW,iBAAiB;CAChE,WAAW,YAAY,aAAa,WAAW,4BAA4B;CAC3E,WAAW,YAAY,aAAa,WAAW,oBAAoB;CACnE,WAAW,YAAY,aAAa,WAAW,iBAAiB;CAChE,WAAW,YAAY,aAAa,WAAW,cAAc;AAC/D,CAAC,CACH"}

package/dist/lib/{neutral/chunk-6G4KZLBG.mjs → chunk-meta.mjs}

@@ -1,28 +1,21 @@
-// src/meta.ts
 import { Plugin } from "@dxos/app-framework";
-
-// dx.config.ts
 import { Config2 } from "@dxos/app-framework/config";
 import { trim } from "@dxos/util";
-var dx_config_default = Config2.make({
-  plugin: {
-    key: "org.dxos.plugin.client",
-    name: "Client",
-    author: "DXOS",
-    description: trim`
+//#region dx.config.ts
+var dx_config_default = Config2.make({ plugin: {
+	key: "org.dxos.plugin.client",
+	name: "Client",
+	author: "DXOS",
+	description: trim`
       Core client connectivity and peer-to-peer networking infrastructure.
       Manages identity, authentication, and real-time synchronization across devices.
     `,
-    tags: [
-      "system"
-    ]
-  }
-});
-
-// src/meta.ts
+	tags: ["system"]
+} });
+//#endregion
+//#region src/meta.ts
 var meta = Plugin.getMetaFromConfig(dx_config_default);
+//#endregion
+export { meta as t };
 
-export {
-  meta
-};
-//# sourceMappingURL=chunk-6G4KZLBG.mjs.map
+//# sourceMappingURL=chunk-meta.mjs.map

package/dist/lib/chunk-meta.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk-meta.mjs","names":[],"sources":["../../dx.config.ts","../../src/meta.ts"],"sourcesContent":["//\n// Copyright 2025 DXOS.org\n//\n\nimport { Config2 } from '@dxos/app-framework/config';\nimport { trim } from '@dxos/util';\n\nexport default Config2.make({\n  plugin: {\n    key: 'org.dxos.plugin.client',\n    name: 'Client',\n    author: 'DXOS',\n    description: trim`\n      Core client connectivity and peer-to-peer networking infrastructure.\n      Manages identity, authentication, and real-time synchronization across devices.\n    `,\n    tags: ['system'],\n  },\n});\n","//\n// Copyright 2023 DXOS.org\n//\n\nimport { Plugin } from '@dxos/app-framework';\n\nimport config from '../dx.config';\n\nexport const meta = Plugin.getMetaFromConfig(config);\n"],"mappings":";;;;AAOA,IAAA,oBAAe,QAAQ,KAAK,EAC1B,QAAQ;CACN,KAAK;CACL,MAAM;CACN,QAAQ;CACR,aAAa,IAAI;;;;CAIjB,MAAM,CAAC,QAAQ;AACjB,EACF,CAAC;;;ACVD,IAAa,OAAO,OAAO,kBAAkB,iBAAM"}

package/dist/lib/chunk-migrations.mjs

@@ -0,0 +1,29 @@
+import { Capabilities, Capability } from "@dxos/app-framework";
+import { ClientCapabilities } from "#types";
+import * as Effect from "effect/Effect";
+import { RpcClosedError } from "@dxos/protocols";
+import { log } from "@dxos/log";
+//#region src/capabilities/migrations.ts
+var __dxlog_file = "/__w/dxos/dxos/packages/plugins/plugin-client/src/capabilities/migrations.ts";
+var migrations_default = Capability.makeModule(Effect.fnUntraced(function* () {
+	const registry = yield* Capability.get(Capabilities.AtomRegistry);
+	const client = yield* Capability.get(ClientCapabilities.Client);
+	const migrationsAtom = yield* Capability.atom(ClientCapabilities.Migration);
+	const cancel = registry.subscribe(migrationsAtom, (_migrations) => {
+		const migrations = Array.from(new Set(_migrations.flat()));
+		const spaces = client.spaces.get();
+		Promise.all(spaces.map((space) => space.internal.db.runMigrations(migrations))).catch((err) => {
+			if (!(err instanceof RpcClosedError)) log.catch(err, void 0, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file,
+				L: 29,
+				S: this
+			});
+		});
+	}, { immediate: true });
+	return Capability.contributes(Capabilities.Null, null, () => Effect.sync(() => cancel()));
+}));
+//#endregion
+export { migrations_default as default };
+
+//# sourceMappingURL=chunk-migrations.mjs.map

package/dist/lib/chunk-migrations.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk-migrations.mjs","names":[],"sources":["../../src/capabilities/migrations.ts"],"sourcesContent":["//\n// Copyright 2025 DXOS.org\n//\n\nimport * as Effect from 'effect/Effect';\n\nimport { Capabilities, Capability } from '@dxos/app-framework';\nimport { log } from '@dxos/log';\nimport { RpcClosedError } from '@dxos/protocols';\n\nimport { ClientCapabilities } from '#types';\n\nexport default Capability.makeModule(\n  Effect.fnUntraced(function* () {\n    const registry = yield* Capability.get(Capabilities.AtomRegistry);\n    const client = yield* Capability.get(ClientCapabilities.Client);\n    const migrationsAtom = yield* Capability.atom(ClientCapabilities.Migration);\n\n    // NOTE: Migrations are currently unidirectional and idempotent.\n    const cancel = registry.subscribe(\n      migrationsAtom,\n      (_migrations: any[]) => {\n        const migrations = Array.from(new Set(_migrations.flat()));\n        const spaces = client.spaces.get();\n        // Migrations run fire-and-forget from the subscription callback; an in-flight flush can be\n        // interrupted when the client shuts down, which surfaces as a benign RpcClosedError race.\n        void Promise.all(spaces.map((space: any) => space.internal.db.runMigrations(migrations))).catch((err) => {\n          if (!(err instanceof RpcClosedError)) {\n            log.catch(err);\n          }\n        });\n      },\n      { immediate: true },\n    );\n\n    return Capability.contributes(Capabilities.Null, null, () => Effect.sync(() => cancel()));\n  }),\n);\n"],"mappings":";;;;;;;AAYA,IAAA,qBAAe,WAAW,WACxB,OAAO,WAAW,aAAa;CAC7B,MAAM,WAAW,OAAO,WAAW,IAAI,aAAa,YAAY;CAChE,MAAM,SAAS,OAAO,WAAW,IAAI,mBAAmB,MAAM;CAC9D,MAAM,iBAAiB,OAAO,WAAW,KAAK,mBAAmB,SAAS;CAG1E,MAAM,SAAS,SAAS,UACtB,iBACC,gBAAuB;EACtB,MAAM,aAAa,MAAM,KAAK,IAAI,IAAI,YAAY,KAAK,CAAC,CAAC;EACzD,MAAM,SAAS,OAAO,OAAO,IAAI;EAGjC,QAAa,IAAI,OAAO,KAAK,UAAe,MAAM,SAAS,GAAG,cAAc,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,QAAQ;GACvG,IAAI,EAAE,eAAe,iBACnB,IAAI,MAAM,KAAE,KAAA,GAAA;IAAA,YAAA;IAAA,GAAA;IAAA,GAAA;IAAA,GAAA;GAAA,CAAC;EAEjB,CAAC;CACH,GACA,EAAE,WAAW,KAAK,CACpB;CAEA,OAAO,WAAW,YAAY,aAAa,MAAM,YAAY,OAAO,WAAW,OAAO,CAAC,CAAC;AAC1F,CAAC,CACH"}

package/dist/lib/chunk-navigation-handler.mjs

@@ -0,0 +1,71 @@
+import { d as JoinIdentity, h as RedeemToken } from "./chunk-operations.mjs";
+import { Capabilities, Capability } from "@dxos/app-framework";
+import { meta } from "#meta";
+import { Operation } from "@dxos/compute";
+import { AppCapabilities, LayoutOperation } from "@dxos/app-toolkit";
+import * as Effect from "effect/Effect";
+import { log } from "@dxos/log";
+//#region src/capabilities/navigation-handler/navigation-handler.ts
+var __dxlog_file = "/__w/dxos/dxos/packages/plugins/plugin-client/src/capabilities/navigation-handler/navigation-handler.ts";
+/**
+* NavigationHandler for auth-related URL params.
+* Handles login tokens and device invitation codes.
+*/
+var navigation_handler_default = Capability.makeModule(Effect.fnUntraced(function* ({ invitationProp = "deviceInvitationCode", tokenProp = "token", tokenTypeProp = "type", invitationUrlHandler = true } = {}) {
+	const capabilities = yield* Capability.Service;
+	const operationService = yield* Capability.get(Capabilities.OperationInvoker);
+	const handler = (url) => Effect.gen(function* () {
+		const token = url.searchParams.get(tokenProp);
+		const tokenType = url.searchParams.get(tokenTypeProp);
+		const invitationCode = invitationUrlHandler ? url.searchParams.get(invitationProp) : null;
+		if (token && tokenType === "login") {
+			log("login token received via navigation", void 0, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file,
+				L: 45,
+				S: this
+			});
+			removeQueryParam(tokenProp);
+			removeQueryParam(tokenTypeProp);
+			yield* Operation.invoke(RedeemToken, { token });
+		} else if (invitationCode) {
+			log("device invitation received via navigation", void 0, {
+				"~LogMeta": "~LogMeta",
+				F: __dxlog_file,
+				L: 50,
+				S: this
+			});
+			removeQueryParam(invitationProp);
+			yield* Operation.invoke(JoinIdentity, { invitationCode });
+		}
+	}).pipe(Effect.catchAll((error) => Effect.gen(function* () {
+		log.warn("navigation handler failed", { error }, {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file,
+			L: 57,
+			S: this
+		});
+		yield* Operation.invoke(LayoutOperation.AddToast, {
+			id: `${meta.profile.key}/navigation-failed`,
+			title: ["navigation-failed-toast.title", { ns: meta.profile.key }],
+			description: ["navigation-failed-toast.description", { ns: meta.profile.key }],
+			icon: "ph--warning--regular"
+		}).pipe(Effect.catchAll((toastError) => Effect.sync(() => log.warn("failed to add toast", { toastError }, {
+			"~LogMeta": "~LogMeta",
+			F: __dxlog_file,
+			L: 64,
+			S: this
+		}))));
+	})), Effect.provideService(Capability.Service, capabilities), Effect.provideService(Operation.Service, operationService));
+	return Capability.contributes(AppCapabilities.NavigationHandler, handler);
+}));
+/** Remove a query param from the current browser URL. */
+var removeQueryParam = (key) => {
+	const current = new URL(window.location.href);
+	current.searchParams.delete(key);
+	history.replaceState(null, "", current.pathname + current.search);
+};
+//#endregion
+export { navigation_handler_default as default };
+
+//# sourceMappingURL=chunk-navigation-handler.mjs.map

package/dist/lib/chunk-navigation-handler.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk-navigation-handler.mjs","names":[],"sources":["../../src/capabilities/navigation-handler/navigation-handler.ts"],"sourcesContent":["//\n// Copyright 2025 DXOS.org\n//\n\nimport * as Effect from 'effect/Effect';\n\nimport { Capabilities, Capability } from '@dxos/app-framework';\nimport { AppCapabilities, LayoutOperation } from '@dxos/app-toolkit';\nimport { Operation } from '@dxos/compute';\nimport { log } from '@dxos/log';\n\nimport { meta } from '#meta';\n\nimport { ClientOperation } from '../../operations';\n\nexport type NavigationHandlerOptions = {\n  invitationProp?: string;\n  tokenProp?: string;\n  tokenTypeProp?: string;\n  /** Set false when another plugin (e.g. plugin-onboarding) owns the invitation URL param. */\n  invitationUrlHandler?: boolean;\n};\n\n/**\n * NavigationHandler for auth-related URL params.\n * Handles login tokens and device invitation codes.\n */\nexport default Capability.makeModule(\n  Effect.fnUntraced(function* ({\n    invitationProp = 'deviceInvitationCode',\n    tokenProp = 'token',\n    tokenTypeProp = 'type',\n    invitationUrlHandler = true,\n  }: NavigationHandlerOptions = {}) {\n    const capabilities = yield* Capability.Service;\n    const operationService = yield* Capability.get(Capabilities.OperationInvoker);\n\n    const handler: AppCapabilities.NavigationHandler = (url: URL) =>\n      Effect.gen(function* () {\n        const token = url.searchParams.get(tokenProp);\n        const tokenType = url.searchParams.get(tokenTypeProp);\n        const invitationCode = invitationUrlHandler ? url.searchParams.get(invitationProp) : null;\n\n        if (token && tokenType === 'login') {\n          log('login token received via navigation');\n          removeQueryParam(tokenProp);\n          removeQueryParam(tokenTypeProp);\n          yield* Operation.invoke(ClientOperation.RedeemToken, { token });\n        } else if (invitationCode) {\n          log('device invitation received via navigation');\n          removeQueryParam(invitationProp);\n          yield* Operation.invoke(ClientOperation.JoinIdentity, { invitationCode });\n        }\n      }).pipe(\n        Effect.catchAll((error) =>\n          Effect.gen(function* () {\n            log.warn('navigation handler failed', { error });\n            yield* Operation.invoke(LayoutOperation.AddToast, {\n              id: `${meta.profile.key}/navigation-failed`,\n              title: ['navigation-failed-toast.title', { ns: meta.profile.key }],\n              description: ['navigation-failed-toast.description', { ns: meta.profile.key }],\n              icon: 'ph--warning--regular',\n            }).pipe(\n              Effect.catchAll((toastError) => Effect.sync(() => log.warn('failed to add toast', { toastError }))),\n            );\n          }),\n        ),\n        Effect.provideService(Capability.Service, capabilities),\n        Effect.provideService(Operation.Service, operationService),\n      );\n\n    return Capability.contributes(AppCapabilities.NavigationHandler, handler);\n  }),\n);\n\n/** Remove a query param from the current browser URL. */\nconst removeQueryParam = (key: string) => {\n  const current = new URL(window.location.href);\n  current.searchParams.delete(key);\n  history.replaceState(null, '', current.pathname + current.search);\n};\n"],"mappings":";;;;;;;;;;;;;AA2BA,IAAA,6BAAe,WAAW,WACxB,OAAO,WAAW,WAAW,EAC3B,iBAAiB,wBACjB,YAAY,SACZ,gBAAgB,QAChB,uBAAuB,SACK,CAAC,GAAG;CAChC,MAAM,eAAe,OAAO,WAAW;CACvC,MAAM,mBAAmB,OAAO,WAAW,IAAI,aAAa,gBAAgB;CAE5E,MAAM,WAA8C,QAClD,OAAO,IAAI,aAAa;EACtB,MAAM,QAAQ,IAAI,aAAa,IAAI,SAAS;EAC5C,MAAM,YAAY,IAAI,aAAa,IAAI,aAAa;EACpD,MAAM,iBAAiB,uBAAuB,IAAI,aAAa,IAAI,cAAc,IAAI;EAErF,IAAI,SAAS,cAAc,SAAS;GAClC,IAAI,uCAAoC,KAAA,GAAA;IAAA,YAAA;IAAA,GAAA;IAAA,GAAA;IAAA,GAAA;GAAA,CAAC;GACzC,iBAAiB,SAAS;GAC1B,iBAAiB,aAAa;GAC9B,OAAO,UAAU,OAAO,aAA6B,EAAE,MAAM,CAAC;EAChE,OAAO,IAAI,gBAAgB;GACzB,IAAI,6CAA0C,KAAA,GAAA;IAAA,YAAA;IAAA,GAAA;IAAA,GAAA;IAAA,GAAA;GAAA,CAAC;GAC/C,iBAAiB,cAAc;GAC/B,OAAO,UAAU,OAAO,cAA8B,EAAE,eAAe,CAAC;EAC1E;CACF,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,UACf,OAAO,IAAI,aAAa;EACtB,IAAI,KAAK,6BAA6B,EAAE,MAAM,GAAA;GAAA,YAAA;GAAA,GAAA;GAAA,GAAA;GAAA,GAAA;EAAA,CAAC;EAC/C,OAAO,UAAU,OAAO,gBAAgB,UAAU;GAChD,IAAI,GAAG,KAAK,QAAQ,IAAI;GACxB,OAAO,CAAC,iCAAiC,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC;GACjE,aAAa,CAAC,uCAAuC,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC;GAC7E,MAAM;EACR,CAAC,CAAC,CAAC,KACD,OAAO,UAAU,eAAe,OAAO,WAAW,IAAI,KAAK,uBAAuB,EAAE,WAAW,GAAA;GAAA,YAAA;GAAA,GAAA;GAAA,GAAA;GAAA,GAAA;EAAA,CAAC,CAAC,CAAC,CACpG;CACF,CAAC,CACH,GACA,OAAO,eAAe,WAAW,SAAS,YAAY,GACtD,OAAO,eAAe,UAAU,SAAS,gBAAgB,CAC3D;CAEF,OAAO,WAAW,YAAY,gBAAgB,mBAAmB,OAAO;AAC1E,CAAC,CACH;;AAGA,IAAM,oBAAoB,QAAgB;CACxC,MAAM,UAAU,IAAI,IAAI,OAAO,SAAS,IAAI;CAC5C,QAAQ,aAAa,OAAO,GAAG;CAC/B,QAAQ,aAAa,MAAM,IAAI,QAAQ,WAAW,QAAQ,MAAM;AAClE"}

package/dist/lib/chunk-navigation-target-loader.mjs

@@ -0,0 +1,46 @@
+import { Capability } from "@dxos/app-framework";
+import { meta } from "#meta";
+import { EntityId, SpaceId } from "@dxos/keys";
+import { AppCapabilities, NotFound } from "@dxos/app-toolkit";
+import { ClientCapabilities } from "#types";
+import * as Effect from "effect/Effect";
+import { Context } from "@dxos/context";
+import { Database, EID } from "@dxos/echo";
+//#region src/capabilities/navigation-target-loader.ts
+var __dxlog_file = "/__w/dxos/dxos/packages/plugins/plugin-client/src/capabilities/navigation-target-loader.ts";
+/** Cap on the remote edge existence check so an unreachable edge cannot block navigation. */
+var EDGE_EXISTENCE_TIMEOUT = "3 seconds";
+/**
+* Loads a navigation target by `(spaceId, entityId)` on behalf of the layout plugins, so they can
+* restore a URL-addressed plank without depending on the client for object loading. Loads the object
+* into local ECHO (materializing its graph node) when it exists locally, and otherwise checks remote
+* existence via edge. See {@link AppCapabilities.NavigationTargetLoader}.
+*/
+var navigation_target_loader_default = Capability.makeModule(Effect.fnUntraced(function* () {
+	const client = yield* Capability.get(ClientCapabilities.Client);
+	const checkRemote = NotFound.createEdgeExistenceChecker((spaceId, body) => client.edge.http.execQuery(new Context(void 0, {
+		"~LogMeta": "~LogMeta",
+		F: __dxlog_file,
+		L: 31
+	}), spaceId, body));
+	const loader = {
+		id: meta.profile.key,
+		load: ({ spaceId, entityId }) => Effect.gen(function* () {
+			if (!SpaceId.isValid(spaceId) || !EntityId.isValid(entityId)) return false;
+			const eid = EID.make({
+				spaceId,
+				entityId
+			});
+			const space = client.spaces.get(spaceId);
+			if (space) {
+				if (yield* Effect.promise(() => space.waitUntilReady()).pipe(Effect.flatMap(() => Database.load(space.db.makeRef(eid))), Effect.as(true), Effect.catchAll(() => Effect.succeed(false)))) return true;
+			}
+			return yield* checkRemote(eid).pipe(Effect.timeout(EDGE_EXISTENCE_TIMEOUT), Effect.catchAll(() => Effect.succeed(false)));
+		})
+	};
+	return Capability.contributes(AppCapabilities.NavigationTargetLoader, loader);
+}));
+//#endregion
+export { navigation_target_loader_default as default };
+
+//# sourceMappingURL=chunk-navigation-target-loader.mjs.map

package/dist/lib/chunk-navigation-target-loader.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk-navigation-target-loader.mjs","names":[],"sources":["../../src/capabilities/navigation-target-loader.ts"],"sourcesContent":["//\n// Copyright 2026 DXOS.org\n//\n\nimport * as Effect from 'effect/Effect';\n\nimport { Capability } from '@dxos/app-framework';\nimport { AppCapabilities, NotFound } from '@dxos/app-toolkit';\nimport { Context } from '@dxos/context';\nimport { Database, EID } from '@dxos/echo';\nimport { EntityId, SpaceId } from '@dxos/keys';\n\nimport { meta } from '#meta';\nimport { ClientCapabilities } from '#types';\n\n/** Cap on the remote edge existence check so an unreachable edge cannot block navigation. */\nconst EDGE_EXISTENCE_TIMEOUT = '3 seconds';\n\n/**\n * Loads a navigation target by `(spaceId, entityId)` on behalf of the layout plugins, so they can\n * restore a URL-addressed plank without depending on the client for object loading. Loads the object\n * into local ECHO (materializing its graph node) when it exists locally, and otherwise checks remote\n * existence via edge. See {@link AppCapabilities.NavigationTargetLoader}.\n */\nexport default Capability.makeModule(\n  Effect.fnUntraced(function* () {\n    const client = yield* Capability.get(ClientCapabilities.Client);\n\n    // Remote existence check (does not materialize a local node); reuses the shared edge checker.\n    const checkRemote = NotFound.createEdgeExistenceChecker((spaceId, body) =>\n      client.edge.http.execQuery(new Context(), spaceId, body),\n    );\n\n    const loader: AppCapabilities.NavigationTargetLoader = {\n      id: meta.profile.key,\n      load: ({ spaceId, entityId }) =>\n        Effect.gen(function* () {\n          if (!SpaceId.isValid(spaceId) || !EntityId.isValid(entityId)) {\n            return false;\n          }\n          const eid = EID.make({ spaceId, entityId });\n\n          // Local first: loading the object populates the collection/type-section refs that address\n          // it, so the next graph expansion materializes its node. Wait for the space to be ready so a\n          // cold restore (space not yet loaded when the URL is resolved) still finds it.\n          const space = client.spaces.get(spaceId);\n          if (space) {\n            const loaded = yield* Effect.promise(() => space.waitUntilReady()).pipe(\n              Effect.flatMap(() => Database.load(space.db.makeRef(eid))),\n              Effect.as(true),\n              Effect.catchAll(() => Effect.succeed(false)),\n            );\n            if (loaded) {\n              return true;\n            }\n          }\n\n          // Remote fallback: confirms the object exists somewhere, even if it has not replicated\n          // locally yet (in which case the node cannot render until it does). Bounded so an\n          // unreachable edge cannot hang navigation.\n          return yield* checkRemote(eid).pipe(\n            Effect.timeout(EDGE_EXISTENCE_TIMEOUT),\n            Effect.catchAll(() => Effect.succeed(false)),\n          );\n        }),\n    };\n\n    return Capability.contributes(AppCapabilities.NavigationTargetLoader, loader);\n  }),\n);\n"],"mappings":";;;;;;;;;;;AAgBA,IAAM,yBAAyB;;;;;;;AAQ/B,IAAA,mCAAe,WAAW,WACxB,OAAO,WAAW,aAAa;CAC7B,MAAM,SAAS,OAAO,WAAW,IAAI,mBAAmB,MAAM;CAG9D,MAAM,cAAc,SAAS,4BAA4B,SAAS,SAChE,OAAO,KAAK,KAAK,UAAU,IAAI,QAAO,KAAA,GAAA;EAAA,YAAA;EAAA,GAAA;EAAA,GAAA;CAAA,CAAC,GAAG,SAAS,IAAI,CACzD;CAEA,MAAM,SAAiD;EACrD,IAAI,KAAK,QAAQ;EACjB,OAAO,EAAE,SAAS,eAChB,OAAO,IAAI,aAAa;GACtB,IAAI,CAAC,QAAQ,QAAQ,OAAO,KAAK,CAAC,SAAS,QAAQ,QAAQ,GACzD,OAAO;GAET,MAAM,MAAM,IAAI,KAAK;IAAE;IAAS;GAAS,CAAC;GAK1C,MAAM,QAAQ,OAAO,OAAO,IAAI,OAAO;GACvC,IAAI;QAME,OALkB,OAAO,cAAc,MAAM,eAAe,CAAC,CAAC,CAAC,KACjE,OAAO,cAAc,SAAS,KAAK,MAAM,GAAG,QAAQ,GAAG,CAAC,CAAC,GACzD,OAAO,GAAG,IAAI,GACd,OAAO,eAAe,OAAO,QAAQ,KAAK,CAAC,CAC7C,GAEE,OAAO;GAAA;GAOX,OAAO,OAAO,YAAY,GAAG,CAAC,CAAC,KAC7B,OAAO,QAAQ,sBAAsB,GACrC,OAAO,eAAe,OAAO,QAAQ,KAAK,CAAC,CAC7C;EACF,CAAC;CACL;CAEA,OAAO,WAAW,YAAY,gBAAgB,wBAAwB,MAAM;AAC9E,CAAC,CACH"}

package/dist/lib/chunk-open-usage.mjs

@@ -0,0 +1,14 @@
+import { f as OpenUsage } from "./chunk-operations.mjs";
+import { Account } from "./types.mjs";
+import { Operation } from "@dxos/compute";
+import { GraphPath, LayoutOperation } from "@dxos/app-toolkit";
+import * as Effect from "effect/Effect";
+//#region src/operations/open-usage.ts
+var handler = OpenUsage.pipe(Operation.withHandler(Effect.fnUntraced(function* () {
+	yield* Operation.invoke(LayoutOperation.SwitchWorkspace, { subject: GraphPath.getSpacePath(Account.id) });
+	yield* Operation.invoke(LayoutOperation.Open, { subject: [GraphPath.getSpacePath(Account.id, Account.Usage)] });
+})));
+//#endregion
+export { handler as default };
+
+//# sourceMappingURL=chunk-open-usage.mjs.map

package/dist/lib/chunk-open-usage.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk-open-usage.mjs","names":[],"sources":["../../src/operations/open-usage.ts"],"sourcesContent":["//\n// Copyright 2026 DXOS.org\n//\n\nimport * as Effect from 'effect/Effect';\n\nimport { GraphPath, LayoutOperation } from '@dxos/app-toolkit';\nimport { Operation } from '@dxos/compute';\n\nimport { Account } from '../types';\nimport { OpenUsage } from './definitions';\n\nconst handler: Operation.WithHandler<typeof OpenUsage> = OpenUsage.pipe(\n  Operation.withHandler(\n    Effect.fnUntraced(function* () {\n      yield* Operation.invoke(LayoutOperation.SwitchWorkspace, { subject: GraphPath.getSpacePath(Account.id) });\n      yield* Operation.invoke(LayoutOperation.Open, {\n        subject: [GraphPath.getSpacePath(Account.id, Account.Usage)],\n      });\n    }),\n  ),\n);\n\nexport default handler;\n"],"mappings":";;;;;;AAYA,IAAM,UAAmD,UAAU,KACjE,UAAU,YACR,OAAO,WAAW,aAAa;CAC7B,OAAO,UAAU,OAAO,gBAAgB,iBAAiB,EAAE,SAAS,UAAU,aAAa,QAAQ,EAAE,EAAE,CAAC;CACxG,OAAO,UAAU,OAAO,gBAAgB,MAAM,EAC5C,SAAS,CAAC,UAAU,aAAa,QAAQ,IAAI,QAAQ,KAAK,CAAC,EAC7D,CAAC;AACH,CAAC,CACH,CACF"}

package/dist/lib/chunk-operation-handler.mjs

@@ -0,0 +1,11 @@
+import { Capabilities, Capability } from "@dxos/app-framework";
+import * as Effect from "effect/Effect";
+import { ClientOperationHandlerSet } from "#operations";
+//#region src/capabilities/operation-handler.ts
+var operation_handler_default = Capability.makeModule(Effect.fnUntraced(function* () {
+	return Capability.contributes(Capabilities.OperationHandler, ClientOperationHandlerSet);
+}));
+//#endregion
+export { operation_handler_default as default };
+
+//# sourceMappingURL=chunk-operation-handler.mjs.map

package/dist/lib/chunk-operation-handler.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk-operation-handler.mjs","names":[],"sources":["../../src/capabilities/operation-handler.ts"],"sourcesContent":["//\n// Copyright 2025 DXOS.org\n//\n\nimport * as Effect from 'effect/Effect';\n\nimport { Capabilities, Capability } from '@dxos/app-framework';\nimport type { OperationHandlerSet } from '@dxos/compute';\n\nimport { ClientOperationHandlerSet } from '#operations';\n\nexport default Capability.makeModule<OperationHandlerSet.OperationHandlerSet>(\n  Effect.fnUntraced(function* () {\n    return Capability.contributes(Capabilities.OperationHandler, ClientOperationHandlerSet);\n  }),\n);\n"],"mappings":";;;;AAWA,IAAA,4BAAe,WAAW,WACxB,OAAO,WAAW,aAAa;CAC7B,OAAO,WAAW,YAAY,aAAa,kBAAkB,yBAAyB;AACxF,CAAC,CACH"}

package/dist/lib/chunk-operations.mjs

@@ -0,0 +1,212 @@
+import { Capability } from "@dxos/app-framework";
+import { Identity } from "@dxos/halo";
+import * as Schema from "effect/Schema";
+import { meta } from "#meta";
+import { DXN, IdentityDid, SpaceId } from "@dxos/keys";
+import { Operation, OperationHandlerSet } from "@dxos/compute";
+import { BaseError } from "@dxos/errors";
+//#region \0rolldown/runtime.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+//#region src/operations/definitions.ts
+var definitions_exports = /* @__PURE__ */ __exportAll({
+	CreateAgent: () => CreateAgent,
+	CreateIdentity: () => CreateIdentity,
+	CreatePasskey: () => CreatePasskey,
+	CreateRecoveryCode: () => CreateRecoveryCode,
+	JoinIdentity: () => JoinIdentity,
+	OpenUsage: () => OpenUsage,
+	RecoverIdentity: () => RecoverIdentity,
+	RedeemPasskey: () => RedeemPasskey,
+	RedeemToken: () => RedeemToken,
+	ResetStorage: () => ResetStorage,
+	ShareIdentity: () => ShareIdentity,
+	UpdateProfile: () => UpdateProfile
+});
+var makeKey = (name) => DXN.make(`${meta.profile.key}.operation.${name}`);
+var IdentitySchema = Schema.Struct({
+	identityDid: IdentityDid,
+	spaceId: Schema.optional(SpaceId),
+	profile: Schema.optional(Schema.Struct({
+		displayName: Schema.optional(Schema.String),
+		avatarCid: Schema.optional(Schema.String),
+		data: Schema.optional(Schema.Record({
+			key: Schema.String,
+			value: Schema.Any
+		}))
+	}))
+});
+var ProfileSchema = Schema.Struct({
+	displayName: Schema.optional(Schema.String),
+	avatarCid: Schema.optional(Schema.String),
+	data: Schema.optional(Schema.Record({
+		key: Schema.String,
+		value: Schema.Any
+	}))
+});
+var CreateIdentity = Operation.make({
+	meta: {
+		key: makeKey("createIdentity"),
+		name: "Create Identity",
+		icon: "ph--user--regular"
+	},
+	services: [Capability.Service, Identity.Service],
+	input: ProfileSchema,
+	output: IdentitySchema
+});
+var UpdateProfile = Operation.make({
+	meta: {
+		key: makeKey("updateProfile"),
+		name: "Update Profile",
+		icon: "ph--user--regular"
+	},
+	services: [Identity.Service],
+	input: ProfileSchema,
+	output: Schema.Void
+});
+var JoinIdentity = Operation.make({
+	meta: {
+		key: makeKey("joinIdentity"),
+		name: "Join Identity",
+		icon: "ph--sign-in--regular"
+	},
+	services: [Capability.Service],
+	input: Schema.Struct({ invitationCode: Schema.optional(Schema.String) }),
+	output: Schema.Void
+});
+var ShareIdentity = Operation.make({
+	meta: {
+		key: makeKey("shareIdentity"),
+		name: "Share Identity",
+		icon: "ph--share-network--regular"
+	},
+	services: [Capability.Service],
+	input: Schema.Void,
+	output: Schema.Void
+});
+var OpenUsage = Operation.make({
+	meta: {
+		key: makeKey("openUsage"),
+		name: "Open Usage",
+		icon: "ph--chart-bar--regular"
+	},
+	services: [Capability.Service],
+	input: Schema.Void,
+	output: Schema.Void
+});
+var RecoverIdentity = Operation.make({
+	meta: {
+		key: makeKey("recoverIdentity"),
+		name: "Recover Identity",
+		icon: "ph--key--regular"
+	},
+	services: [Capability.Service],
+	input: Schema.Void,
+	output: Schema.Void
+});
+var ResetStorage = Operation.make({
+	meta: {
+		key: makeKey("resetStorage"),
+		name: "Reset Storage",
+		icon: "ph--warning--regular"
+	},
+	services: [Capability.Service],
+	input: Schema.Struct({ mode: Schema.optional(Schema.String) }),
+	output: Schema.Void
+});
+var CreateAgent = Operation.make({
+	meta: {
+		key: makeKey("createAgent"),
+		name: "Create Agent",
+		icon: "ph--brain--regular"
+	},
+	services: [Capability.Service],
+	input: Schema.Void,
+	output: Schema.Void
+});
+var CreateRecoveryCode = Operation.make({
+	meta: {
+		key: makeKey("createRecoveryCode"),
+		name: "Create Recovery Code",
+		icon: "ph--key--regular"
+	},
+	services: [Capability.Service],
+	input: Schema.Void,
+	output: Schema.Void
+});
+var CreatePasskey = Operation.make({
+	meta: {
+		key: makeKey("createPasskey"),
+		name: "Create Passkey",
+		icon: "ph--key--regular"
+	},
+	services: [Capability.Service],
+	input: Schema.Void,
+	output: Schema.Void
+});
+var RedeemPasskey = Operation.make({
+	meta: {
+		key: makeKey("redeemPasskey"),
+		name: "Redeem Passkey",
+		icon: "ph--key--regular"
+	},
+	services: [Capability.Service],
+	input: Schema.Void,
+	output: Schema.Void
+});
+var RedeemToken = Operation.make({
+	meta: {
+		key: makeKey("redeemToken"),
+		name: "Redeem Token",
+		icon: "ph--lock--regular"
+	},
+	services: [Capability.Service],
+	input: Schema.Struct({ token: Schema.String }),
+	output: Schema.Void
+});
+//#endregion
+//#region src/operations/errors.ts
+/**
+* The platform prompt produced no assertion. WebAuthn reports a dismissed prompt and
+* "this device has no passkey for this site" identically, so the two cannot be told apart.
+*/
+var PasskeyDismissedError = class extends BaseError.extend("PasskeyDismissedError", "No passkey was presented") {};
+/** The assertion was refused: the passkey is not registered as a recovery credential for any identity. */
+var PasskeyRejectedError = class extends BaseError.extend("PasskeyRejectedError", "Passkey was not accepted") {};
+/** Passkey login failed before an assertion could be checked (service unreachable, unusable authenticator response). */
+var PasskeyLoginError = class extends BaseError.extend("PasskeyLoginError", "Passkey login failed") {};
+/**
+* Classify a rejection from the authenticator. WebAuthn reports a dismissed prompt and
+* "no credential for this site" as the same `NotAllowedError`, so both map to dismissal;
+* the native (Tauri) bridge rejects with a plain string rather than a `DOMException`.
+*/
+var toPasskeyAssertionError = (error) => {
+	const name = error instanceof DOMException ? error.name : void 0;
+	if (name === "NotAllowedError" || name === "AbortError" || /cancell?ed/i.test(String(error))) return new PasskeyDismissedError({ cause: error });
+	return new PasskeyLoginError({ cause: error });
+};
+/**
+* Classify an error returned by the `RedeemPasskey` operation.
+* Anything unrecognized is reported as a generic failure rather than swallowed.
+*/
+var classifyPasskeyFailure = (error) => {
+	if (PasskeyDismissedError.is(error)) return "dismissed";
+	if (PasskeyRejectedError.is(error)) return "rejected";
+	return "failed";
+};
+//#endregion
+//#region src/operations/index.ts
+var ClientOperationHandlerSet = OperationHandlerSet.lazy(() => import("./chunk-create-agent.mjs"), () => import("./chunk-create-identity.mjs"), () => import("./chunk-create-passkey.mjs"), () => import("./chunk-create-recovery-code.mjs"), () => import("./chunk-join-identity.mjs"), () => import("./chunk-open-usage.mjs"), () => import("./chunk-recover-identity.mjs"), () => import("./chunk-redeem-passkey.mjs"), () => import("./chunk-redeem-token.mjs"), () => import("./chunk-reset-storage.mjs"), () => import("./chunk-resolve-navigation-targets.mjs"), () => import("./chunk-share-identity.mjs"), () => import("./chunk-update-profile.mjs"));
+//#endregion
+export { ShareIdentity as _, classifyPasskeyFailure as a, CreateIdentity as c, JoinIdentity as d, OpenUsage as f, ResetStorage as g, RedeemToken as h, PasskeyRejectedError as i, CreatePasskey as l, RedeemPasskey as m, PasskeyDismissedError as n, toPasskeyAssertionError as o, RecoverIdentity as p, PasskeyLoginError as r, CreateAgent as s, ClientOperationHandlerSet as t, CreateRecoveryCode as u, UpdateProfile as v, definitions_exports as y };
+
+//# sourceMappingURL=chunk-operations.mjs.map

package/dist/lib/chunk-operations.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk-operations.mjs","names":[],"sources":["../../src/operations/definitions.ts","../../src/operations/errors.ts","../../src/operations/index.ts"],"sourcesContent":["//\n// Copyright 2025 DXOS.org\n//\n\nimport * as Schema from 'effect/Schema';\n\nimport { Capability } from '@dxos/app-framework';\nimport { Operation } from '@dxos/compute';\nimport { Identity } from '@dxos/halo';\nimport { DXN, IdentityDid, SpaceId } from '@dxos/keys';\n\nimport { meta } from '#meta';\n\nconst makeKey = (name: string) => DXN.make(`${meta.profile.key}.operation.${name}`);\n\nconst IdentitySchema = Schema.Struct({\n  identityDid: IdentityDid,\n  spaceId: Schema.optional(SpaceId),\n  profile: Schema.optional(\n    Schema.Struct({\n      displayName: Schema.optional(Schema.String),\n      avatarCid: Schema.optional(Schema.String),\n      data: Schema.optional(Schema.Record({ key: Schema.String, value: Schema.Any })),\n    }),\n  ),\n});\n\nconst ProfileSchema = Schema.Struct({\n  displayName: Schema.optional(Schema.String),\n  avatarCid: Schema.optional(Schema.String),\n  data: Schema.optional(Schema.Record({ key: Schema.String, value: Schema.Any })),\n});\n\nexport const CreateIdentity = Operation.make({\n  meta: { key: makeKey('createIdentity'), name: 'Create Identity', icon: 'ph--user--regular' },\n  services: [Capability.Service, Identity.Service],\n  input: ProfileSchema,\n  output: IdentitySchema,\n});\n\nexport const UpdateProfile = Operation.make({\n  meta: { key: makeKey('updateProfile'), name: 'Update Profile', icon: 'ph--user--regular' },\n  services: [Identity.Service],\n  input: ProfileSchema,\n  output: Schema.Void,\n});\n\nexport const JoinIdentity = Operation.make({\n  meta: { key: makeKey('joinIdentity'), name: 'Join Identity', icon: 'ph--sign-in--regular' },\n  services: [Capability.Service],\n  input: Schema.Struct({\n    invitationCode: Schema.optional(Schema.String),\n  }),\n  output: Schema.Void,\n});\n\nexport const ShareIdentity = Operation.make({\n  meta: {\n    key: makeKey('shareIdentity'),\n    name: 'Share Identity',\n    icon: 'ph--share-network--regular',\n  },\n  services: [Capability.Service],\n  input: Schema.Void,\n  output: Schema.Void,\n});\n\nexport const OpenUsage = Operation.make({\n  meta: {\n    key: makeKey('openUsage'),\n    name: 'Open Usage',\n    icon: 'ph--chart-bar--regular',\n  },\n  services: [Capability.Service],\n  input: Schema.Void,\n  output: Schema.Void,\n});\n\nexport const RecoverIdentity = Operation.make({\n  meta: { key: makeKey('recoverIdentity'), name: 'Recover Identity', icon: 'ph--key--regular' },\n  services: [Capability.Service],\n  input: Schema.Void,\n  output: Schema.Void,\n});\n\nexport const ResetStorage = Operation.make({\n  meta: { key: makeKey('resetStorage'), name: 'Reset Storage', icon: 'ph--warning--regular' },\n  services: [Capability.Service],\n  input: Schema.Struct({\n    mode: Schema.optional(Schema.String),\n  }),\n  output: Schema.Void,\n});\n\nexport const CreateAgent = Operation.make({\n  meta: { key: makeKey('createAgent'), name: 'Create Agent', icon: 'ph--brain--regular' },\n  services: [Capability.Service],\n  input: Schema.Void,\n  output: Schema.Void,\n});\n\nexport const CreateRecoveryCode = Operation.make({\n  meta: {\n    key: makeKey('createRecoveryCode'),\n    name: 'Create Recovery Code',\n    icon: 'ph--key--regular',\n  },\n  services: [Capability.Service],\n  input: Schema.Void,\n  output: Schema.Void,\n});\n\nexport const CreatePasskey = Operation.make({\n  meta: { key: makeKey('createPasskey'), name: 'Create Passkey', icon: 'ph--key--regular' },\n  services: [Capability.Service],\n  input: Schema.Void,\n  output: Schema.Void,\n});\n\nexport const RedeemPasskey = Operation.make({\n  meta: { key: makeKey('redeemPasskey'), name: 'Redeem Passkey', icon: 'ph--key--regular' },\n  services: [Capability.Service],\n  input: Schema.Void,\n  output: Schema.Void,\n});\n\nexport const RedeemToken = Operation.make({\n  meta: { key: makeKey('redeemToken'), name: 'Redeem Token', icon: 'ph--lock--regular' },\n  services: [Capability.Service],\n  input: Schema.Struct({\n    token: Schema.String,\n  }),\n  output: Schema.Void,\n});\n","//\n// Copyright 2025 DXOS.org\n//\n\nimport { BaseError } from '@dxos/errors';\n\n/**\n * The platform prompt produced no assertion. WebAuthn reports a dismissed prompt and\n * \"this device has no passkey for this site\" identically, so the two cannot be told apart.\n */\nexport class PasskeyDismissedError extends BaseError.extend('PasskeyDismissedError', 'No passkey was presented') {}\n\n/** The assertion was refused: the passkey is not registered as a recovery credential for any identity. */\nexport class PasskeyRejectedError extends BaseError.extend('PasskeyRejectedError', 'Passkey was not accepted') {}\n\n/** Passkey login failed before an assertion could be checked (service unreachable, unusable authenticator response). */\nexport class PasskeyLoginError extends BaseError.extend('PasskeyLoginError', 'Passkey login failed') {}\n\n/**\n * Classify a rejection from the authenticator. WebAuthn reports a dismissed prompt and\n * \"no credential for this site\" as the same `NotAllowedError`, so both map to dismissal;\n * the native (Tauri) bridge rejects with a plain string rather than a `DOMException`.\n */\nexport const toPasskeyAssertionError = (error: unknown): PasskeyDismissedError | PasskeyLoginError => {\n  const name = error instanceof DOMException ? error.name : undefined;\n  if (name === 'NotAllowedError' || name === 'AbortError' || /cancell?ed/i.test(String(error))) {\n    return new PasskeyDismissedError({ cause: error });\n  }\n  return new PasskeyLoginError({ cause: error });\n};\n\n/** Discriminates a passkey login failure so callers can pick a message without matching on error names. */\nexport type PasskeyFailure = 'dismissed' | 'rejected' | 'failed';\n\n/**\n * Classify an error returned by the `RedeemPasskey` operation.\n * Anything unrecognized is reported as a generic failure rather than swallowed.\n */\nexport const classifyPasskeyFailure = (error: unknown): PasskeyFailure => {\n  if (PasskeyDismissedError.is(error)) {\n    return 'dismissed';\n  }\n  if (PasskeyRejectedError.is(error)) {\n    return 'rejected';\n  }\n  return 'failed';\n};\n","//\n// Copyright 2025 DXOS.org\n//\n\nimport { OperationHandlerSet } from '@dxos/compute';\n\nexport * as ClientOperation from './definitions';\nexport * from './errors';\n\nexport const ClientOperationHandlerSet = OperationHandlerSet.lazy(\n  () => import('./create-agent'),\n  () => import('./create-identity'),\n  () => import('./create-passkey'),\n  () => import('./create-recovery-code'),\n  () => import('./join-identity'),\n  () => import('./open-usage'),\n  () => import('./recover-identity'),\n  () => import('./redeem-passkey'),\n  () => import('./redeem-token'),\n  () => import('./reset-storage'),\n  () => import('./resolve-navigation-targets'),\n  () => import('./share-identity'),\n  () => import('./update-profile'),\n);\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAaA,IAAM,WAAW,SAAiB,IAAI,KAAK,GAAG,KAAK,QAAQ,IAAI,aAAa,MAAM;AAElF,IAAM,iBAAiB,OAAO,OAAO;CACnC,aAAa;CACb,SAAS,OAAO,SAAS,OAAO;CAChC,SAAS,OAAO,SACd,OAAO,OAAO;EACZ,aAAa,OAAO,SAAS,OAAO,MAAM;EAC1C,WAAW,OAAO,SAAS,OAAO,MAAM;EACxC,MAAM,OAAO,SAAS,OAAO,OAAO;GAAE,KAAK,OAAO;GAAQ,OAAO,OAAO;EAAI,CAAC,CAAC;CAChF,CAAC,CACH;AACF,CAAC;AAED,IAAM,gBAAgB,OAAO,OAAO;CAClC,aAAa,OAAO,SAAS,OAAO,MAAM;CAC1C,WAAW,OAAO,SAAS,OAAO,MAAM;CACxC,MAAM,OAAO,SAAS,OAAO,OAAO;EAAE,KAAK,OAAO;EAAQ,OAAO,OAAO;CAAI,CAAC,CAAC;AAChF,CAAC;AAED,IAAa,iBAAiB,UAAU,KAAK;CAC3C,MAAM;EAAE,KAAK,QAAQ,gBAAgB;EAAG,MAAM;EAAmB,MAAM;CAAoB;CAC3F,UAAU,CAAC,WAAW,SAAS,SAAS,OAAO;CAC/C,OAAO;CACP,QAAQ;AACV,CAAC;AAED,IAAa,gBAAgB,UAAU,KAAK;CAC1C,MAAM;EAAE,KAAK,QAAQ,eAAe;EAAG,MAAM;EAAkB,MAAM;CAAoB;CACzF,UAAU,CAAC,SAAS,OAAO;CAC3B,OAAO;CACP,QAAQ,OAAO;AACjB,CAAC;AAED,IAAa,eAAe,UAAU,KAAK;CACzC,MAAM;EAAE,KAAK,QAAQ,cAAc;EAAG,MAAM;EAAiB,MAAM;CAAuB;CAC1F,UAAU,CAAC,WAAW,OAAO;CAC7B,OAAO,OAAO,OAAO,EACnB,gBAAgB,OAAO,SAAS,OAAO,MAAM,EAC/C,CAAC;CACD,QAAQ,OAAO;AACjB,CAAC;AAED,IAAa,gBAAgB,UAAU,KAAK;CAC1C,MAAM;EACJ,KAAK,QAAQ,eAAe;EAC5B,MAAM;EACN,MAAM;CACR;CACA,UAAU,CAAC,WAAW,OAAO;CAC7B,OAAO,OAAO;CACd,QAAQ,OAAO;AACjB,CAAC;AAED,IAAa,YAAY,UAAU,KAAK;CACtC,MAAM;EACJ,KAAK,QAAQ,WAAW;EACxB,MAAM;EACN,MAAM;CACR;CACA,UAAU,CAAC,WAAW,OAAO;CAC7B,OAAO,OAAO;CACd,QAAQ,OAAO;AACjB,CAAC;AAED,IAAa,kBAAkB,UAAU,KAAK;CAC5C,MAAM;EAAE,KAAK,QAAQ,iBAAiB;EAAG,MAAM;EAAoB,MAAM;CAAmB;CAC5F,UAAU,CAAC,WAAW,OAAO;CAC7B,OAAO,OAAO;CACd,QAAQ,OAAO;AACjB,CAAC;AAED,IAAa,eAAe,UAAU,KAAK;CACzC,MAAM;EAAE,KAAK,QAAQ,cAAc;EAAG,MAAM;EAAiB,MAAM;CAAuB;CAC1F,UAAU,CAAC,WAAW,OAAO;CAC7B,OAAO,OAAO,OAAO,EACnB,MAAM,OAAO,SAAS,OAAO,MAAM,EACrC,CAAC;CACD,QAAQ,OAAO;AACjB,CAAC;AAED,IAAa,cAAc,UAAU,KAAK;CACxC,MAAM;EAAE,KAAK,QAAQ,aAAa;EAAG,MAAM;EAAgB,MAAM;CAAqB;CACtF,UAAU,CAAC,WAAW,OAAO;CAC7B,OAAO,OAAO;CACd,QAAQ,OAAO;AACjB,CAAC;AAED,IAAa,qBAAqB,UAAU,KAAK;CAC/C,MAAM;EACJ,KAAK,QAAQ,oBAAoB;EACjC,MAAM;EACN,MAAM;CACR;CACA,UAAU,CAAC,WAAW,OAAO;CAC7B,OAAO,OAAO;CACd,QAAQ,OAAO;AACjB,CAAC;AAED,IAAa,gBAAgB,UAAU,KAAK;CAC1C,MAAM;EAAE,KAAK,QAAQ,eAAe;EAAG,MAAM;EAAkB,MAAM;CAAmB;CACxF,UAAU,CAAC,WAAW,OAAO;CAC7B,OAAO,OAAO;CACd,QAAQ,OAAO;AACjB,CAAC;AAED,IAAa,gBAAgB,UAAU,KAAK;CAC1C,MAAM;EAAE,KAAK,QAAQ,eAAe;EAAG,MAAM;EAAkB,MAAM;CAAmB;CACxF,UAAU,CAAC,WAAW,OAAO;CAC7B,OAAO,OAAO;CACd,QAAQ,OAAO;AACjB,CAAC;AAED,IAAa,cAAc,UAAU,KAAK;CACxC,MAAM;EAAE,KAAK,QAAQ,aAAa;EAAG,MAAM;EAAgB,MAAM;CAAoB;CACrF,UAAU,CAAC,WAAW,OAAO;CAC7B,OAAO,OAAO,OAAO,EACnB,OAAO,OAAO,OAChB,CAAC;CACD,QAAQ,OAAO;AACjB,CAAC;;;;;;;AC3HD,IAAa,wBAAb,cAA2C,UAAU,OAAO,yBAAyB,0BAA0B,CAAC,CAAC,CAAC;;AAGlH,IAAa,uBAAb,cAA0C,UAAU,OAAO,wBAAwB,0BAA0B,CAAC,CAAC,CAAC;;AAGhH,IAAa,oBAAb,cAAuC,UAAU,OAAO,qBAAqB,sBAAsB,CAAC,CAAC,CAAC;;;;;;AAOtG,IAAa,2BAA2B,UAA8D;CACpG,MAAM,OAAO,iBAAiB,eAAe,MAAM,OAAO,KAAA;CAC1D,IAAI,SAAS,qBAAqB,SAAS,gBAAgB,cAAc,KAAK,OAAO,KAAK,CAAC,GACzF,OAAO,IAAI,sBAAsB,EAAE,OAAO,MAAM,CAAC;CAEnD,OAAO,IAAI,kBAAkB,EAAE,OAAO,MAAM,CAAC;AAC/C;;;;;AASA,IAAa,0BAA0B,UAAmC;CACxE,IAAI,sBAAsB,GAAG,KAAK,GAChC,OAAO;CAET,IAAI,qBAAqB,GAAG,KAAK,GAC/B,OAAO;CAET,OAAO;AACT;;;ACrCA,IAAa,4BAA4B,oBAAoB,WACrD,OAAO,mCACP,OAAO,sCACP,OAAO,qCACP,OAAO,2CACP,OAAO,oCACP,OAAO,iCACP,OAAO,uCACP,OAAO,qCACP,OAAO,mCACP,OAAO,oCACP,OAAO,iDACP,OAAO,qCACP,OAAO,6BACf"}

package/dist/lib/chunk-progress.mjs

@@ -0,0 +1,10 @@
+import { meta } from "#meta";
+//#region src/progress/progress-keys.ts
+/** Stable progress-monitor key for automerge document replication in a space. */
+var createSpaceReplicationProgressKey = (spaceId) => `${meta.profile.key}:space:${spaceId}#replication`;
+/** Stable progress-monitor key for ECHO feed block replication in a space. */
+var createSpaceFeedReplicationProgressKey = (spaceId) => `${meta.profile.key}:space:${spaceId}#feeds`;
+//#endregion
+export { createSpaceReplicationProgressKey as n, createSpaceFeedReplicationProgressKey as t };
+
+//# sourceMappingURL=chunk-progress.mjs.map

package/dist/lib/chunk-progress.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"chunk-progress.mjs","names":[],"sources":["../../src/progress/progress-keys.ts"],"sourcesContent":["//\n// Copyright 2026 DXOS.org\n//\n\nimport { type SpaceId } from '@dxos/keys';\n\nimport { meta } from '#meta';\n\n/** Stable progress-monitor key for automerge document replication in a space. */\nexport const createSpaceReplicationProgressKey = (spaceId: SpaceId): string =>\n  `${meta.profile.key}:space:${spaceId}#replication`;\n\n/** Stable progress-monitor key for ECHO feed block replication in a space. */\nexport const createSpaceFeedReplicationProgressKey = (spaceId: SpaceId): string =>\n  `${meta.profile.key}:space:${spaceId}#feeds`;\n"],"mappings":";;;AASA,IAAa,qCAAqC,YAChD,GAAG,KAAK,QAAQ,IAAI,SAAS,QAAQ;;AAGvC,IAAa,yCAAyC,YACpD,GAAG,KAAK,QAAQ,IAAI,SAAS,QAAQ"}