@dxos/plugin-client 0.12.0-next-73daef452f1464b62efdbca75fb0067c1066f264 → 0.14.0

package/dist/lib/Account.mjs

@@ -1,23 +1,42 @@
 import { t as __exportAll } from "./chunk-rolldown-runtime.mjs";
+import { getEnvString } from "@dxos/config";
+import * as GraphPath from "@dxos/app-toolkit/GraphPath";
 //#region src/types/Account.ts
 var Account_exports = /* @__PURE__ */ __exportAll({
 	Account: () => Account,
+	Contacts: () => Contacts,
 	Devices: () => Devices,
 	Invitations: () => Invitations,
 	Profile: () => Profile,
 	Security: () => Security,
 	Usage: () => Usage,
-	id: () => id
+	getHubUrl: () => getHubUrl,
+	id: () => id,
+	isAuthEnabled: () => isAuthEnabled,
+	path: () => path,
+	workspacePath: () => workspacePath
 });
-var _id = "dxos.org.plugin.client.account";
-var id = `!${_id}`;
-var Profile = `${_id}.profile`;
-var Devices = `${_id}.devices`;
-var Security = `${_id}.security`;
-var Account = `${_id}.account`;
-var Invitations = `${_id}.invitations`;
-var Usage = `${_id}.usage`;
+/** Pinned (non-space) workspace ID anchoring the account's graph subtree, and its URL workspace token. */
+var id = "dxos:account";
+/** Panel ids, relative to the account workspace they hang off. Each is also its own singleton URL key. */
+var Profile = "profile";
+var Devices = "devices";
+var Contacts = "contacts";
+var Security = "security";
+var Account = "account";
+var Invitations = "invitations";
+var Usage = "usage";
+/** The account's own workspace path. */
+var workspacePath = GraphPath.getSpacePath(id);
+/** A panel's qualified path, which its surface matches on. */
+var path = (panel) => GraphPath.getSpacePath(id, panel);
+/**
+* The hub backing accounts, or `undefined` where none is configured.
+*/
+var getHubUrl = (config) => getEnvString(config, "DX_HUB_URL");
+/** Whether this profile has an account service to authenticate against. */
+var isAuthEnabled = (config) => !!getHubUrl(config);
 //#endregion
-export { Account, Devices, Invitations, Profile, Security, Usage, id, Account_exports as t };
+export { Account, Contacts, Devices, Invitations, Profile, Security, Usage, getHubUrl, id, isAuthEnabled, path, Account_exports as t, workspacePath };
 
 //# sourceMappingURL=Account.mjs.map

package/dist/lib/Account.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"Account.mjs","names":[],"sources":["../../src/types/Account.ts"],"sourcesContent":["//\n// Copyright 2024 DXOS.org\n//\n\n// TODO(wittjosiah): Cannot use slashes in ids until we have a router which decouples ids from url paths.\nconst _id = 'dxos.org.plugin.client.account';\n// TODO(wittjosiah): This is a hack to prevent the previous deck from being set for pinned items.\n//  Ideally this should be worked into the data model in a generic way.\nexport const id = `!${_id}`;\n\nexport const Profile = `${_id}.profile`;\nexport const Devices = `${_id}.devices`;\nexport const Security = `${_id}.security`;\nexport const Account = `${_id}.account`;\nexport const Invitations = `${_id}.invitations`;\nexport const Usage = `${_id}.usage`;\n"],"mappings":";;;;;;;;;;;AAKA,IAAM,MAAM;AAGZ,IAAa,KAAK,IAAI;AAEtB,IAAa,UAAU,GAAG,IAAI;AAC9B,IAAa,UAAU,GAAG,IAAI;AAC9B,IAAa,WAAW,GAAG,IAAI;AAC/B,IAAa,UAAU,GAAG,IAAI;AAC9B,IAAa,cAAc,GAAG,IAAI;AAClC,IAAa,QAAQ,GAAG,IAAI"}
+{"version":3,"file":"Account.mjs","names":[],"sources":["../../src/types/Account.ts"],"sourcesContent":["//\n// Copyright 2024 DXOS.org\n//\n\nimport * as GraphPath from '@dxos/app-toolkit/GraphPath';\nimport { type Config, getEnvString } from '@dxos/config';\n\n/** Pinned (non-space) workspace ID anchoring the account's graph subtree, and its URL workspace token. */\nexport const id = 'dxos:account';\n\n/** Panel ids, relative to the account workspace they hang off. Each is also its own singleton URL key. */\nexport const Profile = 'profile';\nexport const Devices = 'devices';\nexport const Contacts = 'contacts';\nexport const Security = 'security';\nexport const Account = 'account';\nexport const Invitations = 'invitations';\nexport const Usage = 'usage';\n\n/** The account's own workspace path. */\nexport const workspacePath = GraphPath.getSpacePath(id);\n\n/** A panel's qualified path, which its surface matches on. */\nexport const path = (panel: string): string => GraphPath.getSpacePath(id, panel);\n\n/**\n * The hub backing accounts, or `undefined` where none is configured.\n */\nexport const getHubUrl = (config?: Config): string | undefined => getEnvString(config, 'DX_HUB_URL');\n\n/** Whether this profile has an account service to authenticate against. */\nexport const isAuthEnabled = (config?: Config): boolean => !!getHubUrl(config);\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAQA,IAAa,KAAK;;AAGlB,IAAa,UAAU;AACvB,IAAa,UAAU;AACvB,IAAa,WAAW;AACxB,IAAa,WAAW;AACxB,IAAa,UAAU;AACvB,IAAa,cAAc;AAC3B,IAAa,QAAQ;;AAGrB,IAAa,gBAAgB,UAAU,aAAa,EAAE;;AAGtD,IAAa,QAAQ,UAA0B,UAAU,aAAa,IAAI,KAAK;;;;AAK/E,IAAa,aAAa,WAAwC,aAAa,QAAQ,YAAY;;AAGnG,IAAa,iBAAiB,WAA6B,CAAC,CAAC,UAAU,MAAM"}

package/dist/lib/CliLogin.mjs

@@ -0,0 +1,78 @@
+import { t as __exportAll } from "./chunk-rolldown-runtime.mjs";
+//#region src/types/CliLogin.ts
+var CliLogin_exports = /* @__PURE__ */ __exportAll({
+	CALLBACK_PARAM: () => CALLBACK_PARAM,
+	CALLBACK_PATH: () => CALLBACK_PATH,
+	INVITATION_CODE_PARAM: () => INVITATION_CODE_PARAM,
+	RESPONSE_STATE_PARAM: () => RESPONSE_STATE_PARAM,
+	STATE_PARAM: () => STATE_PARAM,
+	createAuthorizeUrl: () => createAuthorizeUrl,
+	createCallbackUrl: () => createCallbackUrl,
+	createState: () => createState,
+	isValidState: () => isValidState,
+	parseCallback: () => parseCallback
+});
+/**
+* Contract between `dx account login --method composer` and the Composer page that approves it.
+*
+* The CLI opens `<composer>/?cliLogin=<callback>&cliLoginState=<state>`; once the user approves,
+* Composer creates a device invitation and hands its code to `<callback>?invitationCode=…&state=…`.
+* Both sides import this module so the parameter names cannot drift apart.
+*/
+/** Query param carrying the CLI's loopback callback URL. */
+var CALLBACK_PARAM = "cliLogin";
+/** Query param carrying the CLI's one-time state, shown on both sides so the user can match them. */
+var STATE_PARAM = "cliLoginState";
+/** Callback query params written by Composer. */
+var INVITATION_CODE_PARAM = "invitationCode";
+var RESPONSE_STATE_PARAM = "state";
+/** Path the CLI's loopback server answers on. */
+var CALLBACK_PATH = "/cli-login";
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+]);
+/**
+* Parses a callback URL, accepting only plain-HTTP loopback targets.
+*
+* The invitation code is a bearer credential for the identity, so it may only ever be delivered to
+* this machine: a link crafted by someone else then admits nothing, because the victim's own
+* loopback port has nobody listening for it (the same rule the hub applies to passkey callbacks).
+*/
+var parseCallback = (value) => {
+	if (!value) return;
+	try {
+		const url = new URL(value);
+		return url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname) && url.pathname === "/cli-login" ? url : void 0;
+	} catch {
+		return;
+	}
+};
+/** The state is short and human-comparable, so it doubles as the code the user matches by eye. */
+var isValidState = (value) => !!value && /^[A-Z0-9]{4}-[A-Z0-9]{4}$/.test(value);
+var STATE_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+/** Generates a state token in the `XXXX-XXXX` form {@link isValidState} accepts. */
+var createState = () => {
+	const bytes = crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(8));
+	const chars = Array.from(bytes, (byte) => STATE_ALPHABET[byte % 32]);
+	return `${chars.slice(0, 4).join("")}-${chars.slice(4).join("")}`;
+};
+/** URL the CLI opens: Composer's origin with the callback and state attached. */
+var createAuthorizeUrl = (composerUrl, callback, state) => {
+	const url = new URL(composerUrl);
+	url.searchParams.set(CALLBACK_PARAM, callback);
+	url.searchParams.set(STATE_PARAM, state);
+	return url;
+};
+/** URL Composer calls back on, carrying the invitation code and echoing the state. */
+var createCallbackUrl = (callback, invitationCode, state) => {
+	const url = new URL(callback);
+	url.searchParams.set(INVITATION_CODE_PARAM, invitationCode);
+	url.searchParams.set(RESPONSE_STATE_PARAM, state);
+	return url;
+};
+//#endregion
+export { CALLBACK_PARAM, CALLBACK_PATH, INVITATION_CODE_PARAM, RESPONSE_STATE_PARAM, STATE_PARAM, createAuthorizeUrl, createCallbackUrl, createState, isValidState, parseCallback, CliLogin_exports as t };
+
+//# sourceMappingURL=CliLogin.mjs.map

package/dist/lib/CliLogin.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"CliLogin.mjs","names":[],"sources":["../../src/types/CliLogin.ts"],"sourcesContent":["//\n// Copyright 2026 DXOS.org\n//\n\n// @import-as-namespace\n\n/**\n * Contract between `dx account login --method composer` and the Composer page that approves it.\n *\n * The CLI opens `<composer>/?cliLogin=<callback>&cliLoginState=<state>`; once the user approves,\n * Composer creates a device invitation and hands its code to `<callback>?invitationCode=…&state=…`.\n * Both sides import this module so the parameter names cannot drift apart.\n */\n\n/** Query param carrying the CLI's loopback callback URL. */\nexport const CALLBACK_PARAM = 'cliLogin';\n\n/** Query param carrying the CLI's one-time state, shown on both sides so the user can match them. */\nexport const STATE_PARAM = 'cliLoginState';\n\n/** Callback query params written by Composer. */\nexport const INVITATION_CODE_PARAM = 'invitationCode';\nexport const RESPONSE_STATE_PARAM = 'state';\n\n/** Path the CLI's loopback server answers on. */\nexport const CALLBACK_PATH = '/cli-login';\n\nconst LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);\n\n/**\n * Parses a callback URL, accepting only plain-HTTP loopback targets.\n *\n * The invitation code is a bearer credential for the identity, so it may only ever be delivered to\n * this machine: a link crafted by someone else then admits nothing, because the victim's own\n * loopback port has nobody listening for it (the same rule the hub applies to passkey callbacks).\n */\nexport const parseCallback = (value: string | null | undefined): URL | undefined => {\n  if (!value) {\n    return undefined;\n  }\n  try {\n    const url = new URL(value);\n    return url.protocol === 'http:' && LOOPBACK_HOSTS.has(url.hostname) && url.pathname === CALLBACK_PATH\n      ? url\n      : undefined;\n  } catch {\n    return undefined;\n  }\n};\n\n/** The state is short and human-comparable, so it doubles as the code the user matches by eye. */\nexport const isValidState = (value: string | null | undefined): value is string =>\n  !!value && /^[A-Z0-9]{4}-[A-Z0-9]{4}$/.test(value);\n\nconst STATE_ALPHABET = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';\n\n/** Generates a state token in the `XXXX-XXXX` form {@link isValidState} accepts. */\nexport const createState = (): string => {\n  const bytes = crypto.getRandomValues(new Uint8Array(8));\n  const chars = Array.from(bytes, (byte) => STATE_ALPHABET[byte % STATE_ALPHABET.length]);\n  return `${chars.slice(0, 4).join('')}-${chars.slice(4).join('')}`;\n};\n\n/** URL the CLI opens: Composer's origin with the callback and state attached. */\nexport const createAuthorizeUrl = (composerUrl: string, callback: string, state: string): URL => {\n  const url = new URL(composerUrl);\n  url.searchParams.set(CALLBACK_PARAM, callback);\n  url.searchParams.set(STATE_PARAM, state);\n  return url;\n};\n\n/** URL Composer calls back on, carrying the invitation code and echoing the state. */\nexport const createCallbackUrl = (callback: URL, invitationCode: string, state: string): URL => {\n  const url = new URL(callback);\n  url.searchParams.set(INVITATION_CODE_PARAM, invitationCode);\n  url.searchParams.set(RESPONSE_STATE_PARAM, state);\n  return url;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAeA,IAAa,iBAAiB;;AAG9B,IAAa,cAAc;;AAG3B,IAAa,wBAAwB;AACrC,IAAa,uBAAuB;;AAGpC,IAAa,gBAAgB;AAE7B,IAAM,iCAAiB,IAAI,IAAI;CAAC;CAAa;CAAa;AAAO,CAAC;;;;;;;;AASlE,IAAa,iBAAiB,UAAsD;CAClF,IAAI,CAAC,OACH;CAEF,IAAI;EACF,MAAM,MAAM,IAAI,IAAI,KAAK;EACzB,OAAO,IAAI,aAAa,WAAW,eAAe,IAAI,IAAI,QAAQ,KAAK,IAAI,aAAA,eACvE,MACA,KAAA;CACN,QAAQ;EACN;CACF;AACF;;AAGA,IAAa,gBAAgB,UAC3B,CAAC,CAAC,SAAS,4BAA4B,KAAK,KAAK;AAEnD,IAAM,iBAAiB;;AAGvB,IAAa,oBAA4B;CACvC,MAAM,QAAQ,OAAO,gCAAgB,IAAI,WAAW,CAAC,CAAC;CACtD,MAAM,QAAQ,MAAM,KAAK,QAAQ,SAAS,eAAe,OAAO,GAAsB;CACtF,OAAO,GAAG,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE;AAChE;;AAGA,IAAa,sBAAsB,aAAqB,UAAkB,UAAuB;CAC/F,MAAM,MAAM,IAAI,IAAI,WAAW;CAC/B,IAAI,aAAa,IAAI,gBAAgB,QAAQ;CAC7C,IAAI,aAAa,IAAI,aAAa,KAAK;CACvC,OAAO;AACT;;AAGA,IAAa,qBAAqB,UAAe,gBAAwB,UAAuB;CAC9F,MAAM,MAAM,IAAI,IAAI,QAAQ;CAC5B,IAAI,aAAa,IAAI,uBAAuB,cAAc;CAC1D,IAAI,aAAa,IAAI,sBAAsB,KAAK;CAChD,OAAO;AACT"}

package/dist/lib/ClientCapabilities.mjs

@@ -5,9 +5,14 @@ import { meta } from "#meta";
 var ClientCapabilities_exports = /* @__PURE__ */ __exportAll({
 	AccountCache: () => AccountCache,
 	Client: () => Client,
+	Config: () => Config,
+	EdgeHttpClient: () => EdgeHttpClient,
 	HubHttpClient: () => HubHttpClient,
+	Hypergraph: () => Hypergraph,
 	IdentityService: () => IdentityService,
+	InitializeTimeout: () => InitializeTimeout,
 	Migration: () => Migration,
+	OnIdentityDeleted: () => OnIdentityDeleted,
 	Schema: () => Schema,
 	SchemaRegistered: () => SchemaRegistered,
 	SpaceService: () => SpaceService
@@ -15,6 +20,12 @@ var ClientCapabilities_exports = /* @__PURE__ */ __exportAll({
 var Client = Capability.makeSingleton()(`${meta.profile.key}.capability.client`);
 var Schema = Capability.make()(`${meta.profile.key}.capability.schema`);
 /**
+* The effective `initializeTimeout` the client capability resolved. Consumers that wait on
+* `client.waitUntilInitialized()` bound themselves by this rather than the default, so a host that
+* widens the client's initialization budget does not have its layers time out underneath it.
+*/
+var InitializeTimeout = Capability.makeSingleton()(`${meta.profile.key}.capability.initializeTimeout`);
+/**
 * Ordering marker for modules that create typed objects: requiring `Schema` only orders after the
 * schema PROVIDERS, which says nothing about `SchemaDefs`, the fellow consumer that registers them.
 * `true` rather than `void` — the loader reads an `undefined` implementation as not contributed.
@@ -22,8 +33,21 @@ var Schema = Capability.make()(`${meta.profile.key}.capability.schema`);
 var SchemaRegistered = Capability.makeSingleton()(`${meta.profile.key}.capability.schemaRegistered`);
 var Migration = Capability.make()(`${meta.profile.key}.capability.migration`);
 var AccountCache = Capability.makeSingleton()(`${meta.profile.key}.capability.accountCache`);
+var OnIdentityDeleted = Capability.make()(`${meta.profile.key}.capability.onIdentityDeleted`);
 var HubHttpClient = Capability.makeSingleton()(`${meta.profile.key}.capability.hubHttpClient`);
 /**
+* The client's runtime configuration, for consumers that need a config value (e.g. the EDGE URL)
+* without depending on `@dxos/client`. Contributed once the client has initialized.
+*/
+var Config = Capability.makeSingleton()(`${meta.profile.key}.capability.config`);
+/**
+* The EDGE HTTP client, for consumers that call EDGE endpoints without depending on `@dxos/client`.
+* Absent when the config names no EDGE URL.
+*/
+var EdgeHttpClient = Capability.makeSingleton()(`${meta.profile.key}.capability.edgeHttpClient`);
+/** The cross-space ECHO graph, for imperative consumers that must find a space's database by id. */
+var Hypergraph = Capability.makeSingleton()(`${meta.profile.key}.capability.hypergraph`);
+/**
 * The HALO Identity service instance, for imperative (non-React, non-Effect-layer) consumers
 * that need identity access without depending on `@dxos/client`.
 */
@@ -31,6 +55,6 @@ var IdentityService = Capability.makeSingleton()(`${meta.profile.key}.capability
 /** The HALO Space service instance, for imperative consumers. */
 var SpaceService = Capability.makeSingleton()(`${meta.profile.key}.capability.spaceService`);
 //#endregion
-export { AccountCache, Client, HubHttpClient, IdentityService, Migration, Schema, SchemaRegistered, SpaceService, ClientCapabilities_exports as t };
+export { AccountCache, Client, Config, EdgeHttpClient, HubHttpClient, Hypergraph, IdentityService, InitializeTimeout, Migration, OnIdentityDeleted, Schema, SchemaRegistered, SpaceService, ClientCapabilities_exports as t };
 
 //# sourceMappingURL=ClientCapabilities.mjs.map

package/dist/lib/ClientCapabilities.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ClientCapabilities.mjs","names":[],"sources":["../../src/types/ClientCapabilities.ts"],"sourcesContent":["//\n// Copyright 2025 DXOS.org\n//\n\nimport type * as Atom from 'effect/unstable/reactivity/Atom';\n\nimport * as Capability from '@dxos/app-framework/Capability';\n// Aliased: unwrapping the enclosing `namespace` put these in the same scope as the\n// capabilities named after them.\nimport { type Client as Client$ } from '@dxos/client';\nimport { type Type, type Migration as Migration$ } from '@dxos/echo';\nimport { type HubHttpClient as HubHttpClient$ } from '@dxos/edge-client';\nimport { type Identity as Identity$, type Space as Space$ } from '@dxos/halo';\n\nimport { meta } from '#meta';\n\nimport { type AccountCache as AccountCacheType } from './AccountCache';\n\nexport const Client = Capability.makeSingleton<Client$>()(`${meta.profile.key}.capability.client`);\nexport const Schema = Capability.make<Type.AnyEntity[]>()(`${meta.profile.key}.capability.schema`);\n/**\n * Ordering marker for modules that create typed objects: requiring `Schema` only orders after the\n * schema PROVIDERS, which says nothing about `SchemaDefs`, the fellow consumer that registers them.\n * `true` rather than `void` — the loader reads an `undefined` implementation as not contributed.\n */\nexport const SchemaRegistered = Capability.makeSingleton<true>()(`${meta.profile.key}.capability.schemaRegistered`);\nexport const Migration = Capability.make<Migration$.Migration[]>()(`${meta.profile.key}.capability.migration`);\nexport const AccountCache = Capability.makeSingleton<Atom.Writable<AccountCacheType>>()(\n  `${meta.profile.key}.capability.accountCache`,\n);\nexport const HubHttpClient = Capability.makeSingleton<HubHttpClient$>()(`${meta.profile.key}.capability.hubHttpClient`);\n\n/**\n * The HALO Identity service instance, for imperative (non-React, non-Effect-layer) consumers\n * that need identity access without depending on `@dxos/client`.\n */\nexport const IdentityService = Capability.makeSingleton<Identity$.ServiceApi>()(\n  `${meta.profile.key}.capability.identityService`,\n);\n/** The HALO Space service instance, for imperative consumers. */\nexport const SpaceService = Capability.makeSingleton<Space$.ServiceApi>()(\n  `${meta.profile.key}.capability.spaceService`,\n);\n"],"mappings":";;;;;;;;;;;;;;AAkBA,IAAa,SAAS,WAAW,cAAuB,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,mBAAmB;AACjG,IAAa,SAAS,WAAW,KAAuB,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,mBAAmB;;;;;;AAMjG,IAAa,mBAAmB,WAAW,cAAoB,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,6BAA6B;AAClH,IAAa,YAAY,WAAW,KAA6B,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,sBAAsB;AAC7G,IAAa,eAAe,WAAW,cAA+C,CAAC,CACrF,GAAG,KAAK,QAAQ,IAAI,yBACtB;AACA,IAAa,gBAAgB,WAAW,cAA8B,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,0BAA0B;;;;;AAMtH,IAAa,kBAAkB,WAAW,cAAoC,CAAC,CAC7E,GAAG,KAAK,QAAQ,IAAI,4BACtB;;AAEA,IAAa,eAAe,WAAW,cAAiC,CAAC,CACvE,GAAG,KAAK,QAAQ,IAAI,yBACtB"}
+{"version":3,"file":"ClientCapabilities.mjs","names":[],"sources":["../../src/types/ClientCapabilities.ts"],"sourcesContent":["//\n// Copyright 2025 DXOS.org\n//\n\nimport type * as Effect from 'effect/Effect';\nimport type * as Atom from 'effect/reactivity/Atom';\n\nimport * as Capability from '@dxos/app-framework/Capability';\n// Aliased: unwrapping the enclosing `namespace` put these in the same scope as the\n// capabilities named after them.\nimport { type Client as Client$ } from '@dxos/client';\nimport { type Config as Config$ } from '@dxos/config';\nimport { type Type, type Hypergraph as Hypergraph$, type Migration as Migration$ } from '@dxos/echo';\nimport { type EdgeHttpClient as EdgeHttpClient$, type HubHttpClient as HubHttpClient$ } from '@dxos/edge-client';\nimport { type Identity as Identity$, type Space as Space$ } from '@dxos/halo';\n\nimport { meta } from '#meta';\n\nimport { type AccountCache as AccountCacheType } from './AccountCache.ts';\n\nexport const Client = Capability.makeSingleton<Client$>()(`${meta.profile.key}.capability.client`);\nexport const Schema = Capability.make<Type.AnyEntity[]>()(`${meta.profile.key}.capability.schema`);\n/**\n * The effective `initializeTimeout` the client capability resolved. Consumers that wait on\n * `client.waitUntilInitialized()` bound themselves by this rather than the default, so a host that\n * widens the client's initialization budget does not have its layers time out underneath it.\n */\nexport const InitializeTimeout = Capability.makeSingleton<number>()(`${meta.profile.key}.capability.initializeTimeout`);\n/**\n * Ordering marker for modules that create typed objects: requiring `Schema` only orders after the\n * schema PROVIDERS, which says nothing about `SchemaDefs`, the fellow consumer that registers them.\n * `true` rather than `void` — the loader reads an `undefined` implementation as not contributed.\n */\nexport const SchemaRegistered = Capability.makeSingleton<true>()(`${meta.profile.key}.capability.schemaRegistered`);\nexport const Migration = Capability.make<Migration$.Migration[]>()(`${meta.profile.key}.capability.migration`);\nexport const AccountCache = Capability.makeSingleton<Atom.Writable<AccountCacheType>>()(\n  `${meta.profile.key}.capability.accountCache`,\n);\n/**\n * Runs after the local identity is deleted in place, before the flow that brings in the next one.\n * `target` names that flow — `deviceInvitation` or `recoverIdentity` — and is absent for a plain\n * logout, which leaves the app with no identity for a contributor (e.g. onboarding) to resolve.\n */\nexport type OnIdentityDeleted = (params: { target?: string }) => Effect.Effect<void, Error>;\nexport const OnIdentityDeleted = Capability.make<OnIdentityDeleted>()(\n  `${meta.profile.key}.capability.onIdentityDeleted`,\n);\nexport const HubHttpClient = Capability.makeSingleton<HubHttpClient$>()(`${meta.profile.key}.capability.hubHttpClient`);\n\n/**\n * The client's runtime configuration, for consumers that need a config value (e.g. the EDGE URL)\n * without depending on `@dxos/client`. Contributed once the client has initialized.\n */\nexport const Config = Capability.makeSingleton<Config$>()(`${meta.profile.key}.capability.config`);\n/**\n * The EDGE HTTP client, for consumers that call EDGE endpoints without depending on `@dxos/client`.\n * Absent when the config names no EDGE URL.\n */\nexport const EdgeHttpClient = Capability.makeSingleton<EdgeHttpClient$>()(\n  `${meta.profile.key}.capability.edgeHttpClient`,\n);\n/** The cross-space ECHO graph, for imperative consumers that must find a space's database by id. */\nexport const Hypergraph = Capability.makeSingleton<Hypergraph$.Hypergraph>()(\n  `${meta.profile.key}.capability.hypergraph`,\n);\n\n/**\n * The HALO Identity service instance, for imperative (non-React, non-Effect-layer) consumers\n * that need identity access without depending on `@dxos/client`.\n */\nexport const IdentityService = Capability.makeSingleton<Identity$.ServiceApi>()(\n  `${meta.profile.key}.capability.identityService`,\n);\n/** The HALO Space service instance, for imperative consumers. */\nexport const SpaceService = Capability.makeSingleton<Space$.ServiceApi>()(\n  `${meta.profile.key}.capability.spaceService`,\n);\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAoBA,IAAa,SAAS,WAAW,cAAuB,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,mBAAmB;AACjG,IAAa,SAAS,WAAW,KAAuB,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,mBAAmB;;;;;;AAMjG,IAAa,oBAAoB,WAAW,cAAsB,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,8BAA8B;;;;;;AAMtH,IAAa,mBAAmB,WAAW,cAAoB,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,6BAA6B;AAClH,IAAa,YAAY,WAAW,KAA6B,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,sBAAsB;AAC7G,IAAa,eAAe,WAAW,cAA+C,CAAC,CACrF,GAAG,KAAK,QAAQ,IAAI,yBACtB;AAOA,IAAa,oBAAoB,WAAW,KAAwB,CAAC,CACnE,GAAG,KAAK,QAAQ,IAAI,8BACtB;AACA,IAAa,gBAAgB,WAAW,cAA8B,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,0BAA0B;;;;;AAMtH,IAAa,SAAS,WAAW,cAAuB,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,mBAAmB;;;;;AAKjG,IAAa,iBAAiB,WAAW,cAA+B,CAAC,CACvE,GAAG,KAAK,QAAQ,IAAI,2BACtB;;AAEA,IAAa,aAAa,WAAW,cAAsC,CAAC,CAC1E,GAAG,KAAK,QAAQ,IAAI,uBACtB;;;;;AAMA,IAAa,kBAAkB,WAAW,cAAoC,CAAC,CAC7E,GAAG,KAAK,QAAQ,IAAI,4BACtB;;AAEA,IAAa,eAAe,WAAW,cAAiC,CAAC,CACvE,GAAG,KAAK,QAAQ,IAAI,yBACtB"}

package/dist/lib/ClientEvents.mjs

@@ -5,7 +5,7 @@ import * as ActivationEvent from "@dxos/app-framework/ActivationEvent";
 var ClientEvents_exports = /* @__PURE__ */ __exportAll({
 	IdentityCreated: () => IdentityCreated,
 	Initialized: () => Initialized,
-	SpacesReady: () => SpacesReady
+	SpacesAvailable: () => SpacesAvailable
 });
 /**
 * Runtime event: `client.initialize()` (forked off the startup pass) has completed. Modules
@@ -14,8 +14,12 @@ var ClientEvents_exports = /* @__PURE__ */ __exportAll({
 */
 var Initialized = ActivationEvent.make(`${meta.profile.key}.event.initialized`);
 var IdentityCreated = ActivationEvent.make(`${meta.profile.key}.event.identityCreated`);
-var SpacesReady = ActivationEvent.make(`${meta.profile.key}.event.spacesReady`);
+/**
+* Runtime event: the space list is observable. The spaces themselves may still be opening, so a
+* module that reads a space's properties waits for that space rather than for this.
+*/
+var SpacesAvailable = ActivationEvent.make(`${meta.profile.key}.event.spacesAvailable`);
 //#endregion
-export { IdentityCreated, Initialized, SpacesReady, ClientEvents_exports as t };
+export { IdentityCreated, Initialized, SpacesAvailable, ClientEvents_exports as t };
 
 //# sourceMappingURL=ClientEvents.mjs.map

package/dist/lib/ClientEvents.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ClientEvents.mjs","names":[],"sources":["../../src/types/ClientEvents.ts"],"sourcesContent":["//\n// Copyright 2025 DXOS.org\n//\n\nimport * as ActivationEvent from '@dxos/app-framework/ActivationEvent';\n\nimport { meta } from '#meta';\n\n/**\n * Runtime event: `client.initialize()` (forked off the startup pass) has completed. Modules\n * whose activation bodies need an initialized client (sync `halo`/`spaces` reads) ride this\n * instead of the startup dependency pass, which no longer implies initialization.\n */\nexport const Initialized = ActivationEvent.make(`${meta.profile.key}.event.initialized`);\nexport const IdentityCreated = ActivationEvent.make(`${meta.profile.key}.event.identityCreated`);\nexport const SpacesReady = ActivationEvent.make(`${meta.profile.key}.event.spacesReady`);\n"],"mappings":";;;;;;;;;;;;;;AAaA,IAAa,cAAc,gBAAgB,KAAK,GAAG,KAAK,QAAQ,IAAI,mBAAmB;AACvF,IAAa,kBAAkB,gBAAgB,KAAK,GAAG,KAAK,QAAQ,IAAI,uBAAuB;AAC/F,IAAa,cAAc,gBAAgB,KAAK,GAAG,KAAK,QAAQ,IAAI,mBAAmB"}
+{"version":3,"file":"ClientEvents.mjs","names":[],"sources":["../../src/types/ClientEvents.ts"],"sourcesContent":["//\n// Copyright 2025 DXOS.org\n//\n\nimport * as ActivationEvent from '@dxos/app-framework/ActivationEvent';\n\nimport { meta } from '#meta';\n\n/**\n * Runtime event: `client.initialize()` (forked off the startup pass) has completed. Modules\n * whose activation bodies need an initialized client (sync `halo`/`spaces` reads) ride this\n * instead of the startup dependency pass, which no longer implies initialization.\n */\nexport const Initialized = ActivationEvent.make(`${meta.profile.key}.event.initialized`);\nexport const IdentityCreated = ActivationEvent.make(`${meta.profile.key}.event.identityCreated`);\n/**\n * Runtime event: the space list is observable. The spaces themselves may still be opening, so a\n * module that reads a space's properties waits for that space rather than for this.\n */\nexport const SpacesAvailable = ActivationEvent.make(`${meta.profile.key}.event.spacesAvailable`);\n"],"mappings":";;;;;;;;;;;;;;AAaA,IAAa,cAAc,gBAAgB,KAAK,GAAG,KAAK,QAAQ,IAAI,mBAAmB;AACvF,IAAa,kBAAkB,gBAAgB,KAAK,GAAG,KAAK,QAAQ,IAAI,uBAAuB;;;;;AAK/F,IAAa,kBAAkB,gBAAgB,KAAK,GAAG,KAAK,QAAQ,IAAI,uBAAuB"}

package/dist/lib/{chunk-definitions.mjs → ClientOperation.mjs}

@@ -1,11 +1,11 @@
 import { t as __exportAll } from "./chunk-rolldown-runtime.mjs";
 import * as Capability from "@dxos/app-framework/Capability";
 import { Identity } from "@dxos/halo";
-import * as Operation from "@dxos/compute/Operation";
 import * as Schema from "effect/Schema";
+import * as Operation from "@dxos/compute/Operation";
 import { DXN, IdentityDid, SpaceId } from "@dxos/keys";
-//#region src/operations/definitions.ts
-var definitions_exports = /* @__PURE__ */ __exportAll({
+//#region src/types/ClientOperation.ts
+var ClientOperation_exports = /* @__PURE__ */ __exportAll({
 	CreateAgent: () => CreateAgent,
 	CreateIdentity: () => CreateIdentity,
 	CreatePasskey: () => CreatePasskey,
@@ -102,7 +102,11 @@ var ResetStorage = Operation.make({
 		icon: "ph--warning--regular"
 	},
 	services: [Capability.Service],
-	input: Schema.Struct({ mode: Schema.optional(Schema.String) }),
+	input: Schema.Struct({
+		mode: Schema.optional(Schema.String),
+		/** Device invitation to accept once the identity is deleted (`join-new-identity` only). */
+		invitationCode: Schema.optional(Schema.String)
+	}),
 	output: Schema.Void
 });
 var CreateAgent = Operation.make({
@@ -163,7 +167,7 @@ var RevokeRecoveryCredential = Operation.make({
 	* `PublicKey.from` silently drops non-hex characters rather than rejecting them, so an
 	* unvalidated string would decode to some other key instead of failing.
 	*/
-lookupKey: Schema.String.check(Schema.isPattern(/^[0-9a-fA-F]{64}$/)) }),
+lookupKey: Schema.String.check(Schema.isPattern(/^[0-9a-fA-F]{64}$/u)) }),
 	output: Schema.Void
 });
 var RedeemPasskey = Operation.make({
@@ -187,6 +191,6 @@ var RedeemToken = Operation.make({
 	output: Schema.Void
 });
 //#endregion
-export { GrantServiceAccess as a, RecoverIdentity as c, ResetStorage as d, RevokeRecoveryCredential as f, definitions_exports as h, CreateRecoveryCode as i, RedeemPasskey as l, UpdateProfile as m, CreateIdentity as n, JoinIdentity as o, ShareIdentity as p, CreatePasskey as r, OpenUsage as s, CreateAgent as t, RedeemToken as u };
+export { CreateAgent, CreateIdentity, CreatePasskey, CreateRecoveryCode, GrantServiceAccess, JoinIdentity, OpenUsage, RecoverIdentity, RedeemPasskey, RedeemToken, ResetStorage, RevokeRecoveryCredential, ShareIdentity, UpdateProfile, ClientOperation_exports as t };
 
-//# sourceMappingURL=chunk-definitions.mjs.map
+//# sourceMappingURL=ClientOperation.mjs.map

package/dist/lib/ClientOperation.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ClientOperation.mjs","names":[],"sources":["../../src/types/ClientOperation.ts"],"sourcesContent":["//\n// Copyright 2025 DXOS.org\n//\n\n// @import-as-namespace\n\nimport * as Schema from 'effect/Schema';\n\nimport * as Capability from '@dxos/app-framework/Capability';\nimport * as Operation from '@dxos/compute/Operation';\nimport { Identity } from '@dxos/halo';\nimport { DXN, IdentityDid, SpaceId } from '@dxos/keys';\n\nconst IdentitySchema = Schema.Struct({\n  identityDid: IdentityDid,\n  spaceId: Schema.optional(SpaceId),\n  profile: Schema.optional(\n    Schema.Struct({\n      displayName: Schema.optional(Schema.String),\n      avatarCid: Schema.optional(Schema.String),\n      data: Schema.optional(Schema.Record(Schema.String, Schema.Any)),\n    }),\n  ),\n});\n\nconst ProfileSchema = Schema.Struct({\n  displayName: Schema.optional(Schema.String),\n  avatarCid: Schema.optional(Schema.String),\n  data: Schema.optional(Schema.Record(Schema.String, Schema.Any)),\n});\n\nexport const CreateIdentity = Operation.make({\n  meta: {\n    key: DXN.make('org.dxos.operation.client.createIdentity'),\n    name: 'Create Identity',\n    icon: 'ph--user--regular',\n  },\n  services: [Capability.Service, Identity.Service],\n  input: ProfileSchema,\n  output: IdentitySchema,\n});\n\nexport const UpdateProfile = Operation.make({\n  meta: {\n    key: DXN.make('org.dxos.operation.client.updateProfile'),\n    name: 'Update Profile',\n    icon: 'ph--user--regular',\n  },\n  services: [Identity.Service],\n  input: ProfileSchema,\n  output: Schema.Void,\n});\n\nexport const JoinIdentity = Operation.make({\n  meta: {\n    key: DXN.make('org.dxos.operation.client.joinIdentity'),\n    name: 'Join Identity',\n    icon: 'ph--sign-in--regular',\n  },\n  services: [Capability.Service],\n  input: Schema.Struct({\n    invitationCode: Schema.optional(Schema.String),\n  }),\n  output: Schema.Void,\n});\n\nexport const ShareIdentity = Operation.make({\n  meta: {\n    key: DXN.make('org.dxos.operation.client.shareIdentity'),\n    name: 'Share Identity',\n    icon: 'ph--share-network--regular',\n  },\n  services: [Capability.Service],\n  input: Schema.Void,\n  output: Schema.Void,\n});\n\nexport const OpenUsage = Operation.make({\n  meta: {\n    key: DXN.make('org.dxos.operation.client.openUsage'),\n    name: 'Open Usage',\n    icon: 'ph--chart-bar--regular',\n  },\n  services: [Capability.Service],\n  input: Schema.Void,\n  output: Schema.Void,\n});\n\nexport const RecoverIdentity = Operation.make({\n  meta: {\n    key: DXN.make('org.dxos.operation.client.recoverIdentity'),\n    name: 'Recover Identity',\n    icon: 'ph--key--regular',\n  },\n  services: [Capability.Service],\n  input: Schema.Void,\n  output: Schema.Void,\n});\n\nexport const ResetStorage = Operation.make({\n  meta: {\n    key: DXN.make('org.dxos.operation.client.resetStorage'),\n    name: 'Reset Storage',\n    icon: 'ph--warning--regular',\n  },\n  services: [Capability.Service],\n  input: Schema.Struct({\n    mode: Schema.optional(Schema.String),\n    /** Device invitation to accept once the identity is deleted (`join-new-identity` only). */\n    invitationCode: Schema.optional(Schema.String),\n  }),\n  output: Schema.Void,\n});\n\nexport const CreateAgent = Operation.make({\n  meta: {\n    key: DXN.make('org.dxos.operation.client.createAgent'),\n    name: 'Create Agent',\n    icon: 'ph--brain--regular',\n  },\n  services: [Capability.Service],\n  input: Schema.Void,\n  output: Schema.Void,\n});\n\nexport const GrantServiceAccess = Operation.make({\n  meta: {\n    key: DXN.make('org.dxos.operation.client.grantServiceAccess'),\n    name: 'Grant Service Access',\n    icon: 'ph--key--regular',\n  },\n  services: [Identity.Service],\n  input: Schema.Struct({\n    /** Target server name (e.g. `hub.dxos.network`). */\n    serverName: Schema.String,\n    /** Capabilities to grant (e.g. `['composer:beta']`). */\n    capabilities: Schema.Array(Schema.String),\n  }),\n  output: Schema.Void,\n});\n\nexport const CreateRecoveryCode = Operation.make({\n  meta: {\n    key: DXN.make('org.dxos.operation.client.createRecoveryCode'),\n    name: 'Create Recovery Code',\n    icon: 'ph--key--regular',\n  },\n  services: [Capability.Service, Identity.Service],\n  input: Schema.Void,\n  output: Schema.Void,\n});\n\nexport const CreatePasskey = Operation.make({\n  meta: {\n    key: DXN.make('org.dxos.operation.client.createPasskey'),\n    name: 'Create Passkey',\n    icon: 'ph--key--regular',\n  },\n  services: [Capability.Service, Identity.Service],\n  input: Schema.Void,\n  output: Schema.Void,\n});\n\nexport const RevokeRecoveryCredential = Operation.make({\n  meta: {\n    key: DXN.make('org.dxos.operation.client.revokeRecoveryCredential'),\n    name: 'Revoke Recovery Credential',\n    icon: 'ph--key--regular',\n  },\n  services: [Capability.Service, Identity.Service],\n  input: Schema.Struct({\n    /**\n     * Lookup key of the credential to revoke, as hex. Constrained to a full key because\n     * `PublicKey.from` silently drops non-hex characters rather than rejecting them, so an\n     * unvalidated string would decode to some other key instead of failing.\n     */\n    lookupKey: Schema.String.check(Schema.isPattern(/^[0-9a-fA-F]{64}$/u)),\n  }),\n  output: Schema.Void,\n});\n\nexport const RedeemPasskey = Operation.make({\n  meta: {\n    key: DXN.make('org.dxos.operation.client.redeemPasskey'),\n    name: 'Redeem Passkey',\n    icon: 'ph--key--regular',\n  },\n  services: [Capability.Service, Identity.Service],\n  input: Schema.Void,\n  output: Schema.Void,\n});\n\nexport const RedeemToken = Operation.make({\n  meta: {\n    key: DXN.make('org.dxos.operation.client.redeemToken'),\n    name: 'Redeem Token',\n    icon: 'ph--lock--regular',\n  },\n  services: [Capability.Service, Identity.Service],\n  input: Schema.Struct({\n    token: Schema.String,\n  }),\n  output: Schema.Void,\n});\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAaA,IAAM,iBAAiB,OAAO,OAAO;CACnC,aAAa;CACb,SAAS,OAAO,SAAS,OAAO;CAChC,SAAS,OAAO,SACd,OAAO,OAAO;EACZ,aAAa,OAAO,SAAS,OAAO,MAAM;EAC1C,WAAW,OAAO,SAAS,OAAO,MAAM;EACxC,MAAM,OAAO,SAAS,OAAO,OAAO,OAAO,QAAQ,OAAO,GAAG,CAAC;CAChE,CAAC,CACH;AACF,CAAC;AAED,IAAM,gBAAgB,OAAO,OAAO;CAClC,aAAa,OAAO,SAAS,OAAO,MAAM;CAC1C,WAAW,OAAO,SAAS,OAAO,MAAM;CACxC,MAAM,OAAO,SAAS,OAAO,OAAO,OAAO,QAAQ,OAAO,GAAG,CAAC;AAChE,CAAC;AAED,IAAa,iBAAiB,UAAU,KAAK;CAC3C,MAAM;EACJ,KAAK,IAAI,KAAK,0CAA0C;EACxD,MAAM;EACN,MAAM;CACR;CACA,UAAU,CAAC,WAAW,SAAS,SAAS,OAAO;CAC/C,OAAO;CACP,QAAQ;AACV,CAAC;AAED,IAAa,gBAAgB,UAAU,KAAK;CAC1C,MAAM;EACJ,KAAK,IAAI,KAAK,yCAAyC;EACvD,MAAM;EACN,MAAM;CACR;CACA,UAAU,CAAC,SAAS,OAAO;CAC3B,OAAO;CACP,QAAQ,OAAO;AACjB,CAAC;AAED,IAAa,eAAe,UAAU,KAAK;CACzC,MAAM;EACJ,KAAK,IAAI,KAAK,wCAAwC;EACtD,MAAM;EACN,MAAM;CACR;CACA,UAAU,CAAC,WAAW,OAAO;CAC7B,OAAO,OAAO,OAAO,EACnB,gBAAgB,OAAO,SAAS,OAAO,MAAM,EAC/C,CAAC;CACD,QAAQ,OAAO;AACjB,CAAC;AAED,IAAa,gBAAgB,UAAU,KAAK;CAC1C,MAAM;EACJ,KAAK,IAAI,KAAK,yCAAyC;EACvD,MAAM;EACN,MAAM;CACR;CACA,UAAU,CAAC,WAAW,OAAO;CAC7B,OAAO,OAAO;CACd,QAAQ,OAAO;AACjB,CAAC;AAED,IAAa,YAAY,UAAU,KAAK;CACtC,MAAM;EACJ,KAAK,IAAI,KAAK,qCAAqC;EACnD,MAAM;EACN,MAAM;CACR;CACA,UAAU,CAAC,WAAW,OAAO;CAC7B,OAAO,OAAO;CACd,QAAQ,OAAO;AACjB,CAAC;AAED,IAAa,kBAAkB,UAAU,KAAK;CAC5C,MAAM;EACJ,KAAK,IAAI,KAAK,2CAA2C;EACzD,MAAM;EACN,MAAM;CACR;CACA,UAAU,CAAC,WAAW,OAAO;CAC7B,OAAO,OAAO;CACd,QAAQ,OAAO;AACjB,CAAC;AAED,IAAa,eAAe,UAAU,KAAK;CACzC,MAAM;EACJ,KAAK,IAAI,KAAK,wCAAwC;EACtD,MAAM;EACN,MAAM;CACR;CACA,UAAU,CAAC,WAAW,OAAO;CAC7B,OAAO,OAAO,OAAO;EACnB,MAAM,OAAO,SAAS,OAAO,MAAM;;EAEnC,gBAAgB,OAAO,SAAS,OAAO,MAAM;CAC/C,CAAC;CACD,QAAQ,OAAO;AACjB,CAAC;AAED,IAAa,cAAc,UAAU,KAAK;CACxC,MAAM;EACJ,KAAK,IAAI,KAAK,uCAAuC;EACrD,MAAM;EACN,MAAM;CACR;CACA,UAAU,CAAC,WAAW,OAAO;CAC7B,OAAO,OAAO;CACd,QAAQ,OAAO;AACjB,CAAC;AAED,IAAa,qBAAqB,UAAU,KAAK;CAC/C,MAAM;EACJ,KAAK,IAAI,KAAK,8CAA8C;EAC5D,MAAM;EACN,MAAM;CACR;CACA,UAAU,CAAC,SAAS,OAAO;CAC3B,OAAO,OAAO,OAAO;;EAEnB,YAAY,OAAO;;EAEnB,cAAc,OAAO,MAAM,OAAO,MAAM;CAC1C,CAAC;CACD,QAAQ,OAAO;AACjB,CAAC;AAED,IAAa,qBAAqB,UAAU,KAAK;CAC/C,MAAM;EACJ,KAAK,IAAI,KAAK,8CAA8C;EAC5D,MAAM;EACN,MAAM;CACR;CACA,UAAU,CAAC,WAAW,SAAS,SAAS,OAAO;CAC/C,OAAO,OAAO;CACd,QAAQ,OAAO;AACjB,CAAC;AAED,IAAa,gBAAgB,UAAU,KAAK;CAC1C,MAAM;EACJ,KAAK,IAAI,KAAK,yCAAyC;EACvD,MAAM;EACN,MAAM;CACR;CACA,UAAU,CAAC,WAAW,SAAS,SAAS,OAAO;CAC/C,OAAO,OAAO;CACd,QAAQ,OAAO;AACjB,CAAC;AAED,IAAa,2BAA2B,UAAU,KAAK;CACrD,MAAM;EACJ,KAAK,IAAI,KAAK,oDAAoD;EAClE,MAAM;EACN,MAAM;CACR;CACA,UAAU,CAAC,WAAW,SAAS,SAAS,OAAO;CAC/C,OAAO,OAAO,OAAO;;;;;;AAMnB,WAAW,OAAO,OAAO,MAAM,OAAO,UAAU,oBAAoB,CAAC,EACvE,CAAC;CACD,QAAQ,OAAO;AACjB,CAAC;AAED,IAAa,gBAAgB,UAAU,KAAK;CAC1C,MAAM;EACJ,KAAK,IAAI,KAAK,yCAAyC;EACvD,MAAM;EACN,MAAM;CACR;CACA,UAAU,CAAC,WAAW,SAAS,SAAS,OAAO;CAC/C,OAAO,OAAO;CACd,QAAQ,OAAO;AACjB,CAAC;AAED,IAAa,cAAc,UAAU,KAAK;CACxC,MAAM;EACJ,KAAK,IAAI,KAAK,uCAAuC;EACrD,MAAM;EACN,MAAM;CACR;CACA,UAAU,CAAC,WAAW,SAAS,SAAS,OAAO;CAC/C,OAAO,OAAO,OAAO,EACnB,OAAO,OAAO,OAChB,CAAC;CACD,QAAQ,OAAO;AACjB,CAAC"}

package/dist/lib/ClientOptions.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ClientOptions.mjs","names":[],"sources":["../../src/types/ClientOptions.ts"],"sourcesContent":["//\n// Copyright 2023 DXOS.org\n//\n\nimport type * as Effect from 'effect/Effect';\n\nimport * as Capability from '@dxos/app-framework/Capability';\nimport { type Client, type ClientOptions } from '@dxos/client';\n\nexport type ClientPluginOptions = ClientOptions & {\n  /**\n   * A client to adopt instead of constructing one, so a host can start `initialize()` at entry\n   * rather than when activation reaches this lazily-imported module. `@synchronized`, so the\n   * plugin's own call joins it; lifecycle stays with the plugin, which destroys it on teardown.\n   */\n  client?: Client;\n\n  /**\n   * Whether the navigation handler consumes invitation codes from URL query params.\n   * Disable when another plugin (e.g. plugin-onboarding) owns the invitation URL flow.\n   * @default true\n   */\n  invitationUrlHandler?: boolean;\n\n  /**\n   * Base origin for the invitation link.\n   */\n  shareableLinkOrigin?: string;\n\n  /**\n   * Surface the identity-swapping actions kept for testing: join another identity by device\n   * invitation, or restore one from a recovery code. Both wipe local storage before they run, so\n   * an app whose onboarding gate offers the same flows on a clean profile should pass the inverse\n   * of that gate's condition rather than expose them to real users.\n   * @default false\n   */\n  identityTestActions?: boolean;\n\n  /**\n   * Path for the invitation link.\n   */\n  invitationPath?: string;\n\n  /**\n   * Query parameter for the invitation code.\n   */\n  invitationProp?: string;\n\n  /**\n   * Run after the client has been initialized.\n   * Plugin context is provided so capabilities are accessible.\n   */\n  onClientInitialized?: (params: { client: Client }) => Effect.Effect<void, Error | never, Capability.Service | never>;\n\n  /**\n   * Called when the forked `client.initialize()` fails or exceeds `initializeTimeout`.\n   *\n   * The initialization runs outside the render tree, so nothing surfaces a failure on its own —\n   * consumers suspended on the client simply keep waiting. Apps supply this to raise it as a\n   * fatal error (Composer shows the reset dialog).\n   */\n  onClientInitializationError?: (params: {\n    error: unknown;\n  }) => Effect.Effect<void, Error | never, Capability.Service | never>;\n\n  /**\n   * Bounds the wait on `client.initialize()` before `onClientInitializationError` fires.\n   * @default INITIALIZE_TIMEOUT\n   */\n  initializeTimeout?: number;\n\n  /**\n   * Gate the contributed `ClientService` on initialization, so resolving it yields a client whose\n   * `halo`/`spaces`/`services` getters are safe to touch.\n   *\n   * For imperative hosts (the CLI): a command body runs straight through, so an ungated service\n   * hands it a client whose getters still throw `Client not initialized`. Leave it off in the app,\n   * where the forked initialization is the point — React consumers suspend on the client instead,\n   * and blocking the service would stall the boot waterfall.\n   *\n   * @default false\n   */\n  awaitInitialization?: boolean;\n\n  /**\n   * Called when spaces are ready.\n   * Plugin context is provided so capabilities are accessible.\n   */\n  onSpacesReady?: (params: { client: Client }) => Effect.Effect<void, Error | never, Capability.Service | never>;\n\n  /**\n   * Called when the client is reset.\n   * Plugin context is provided so capabilities are accessible.\n   */\n  onReset?: (params: { target?: string }) => Effect.Effect<void, Error | never, Capability.Service | never>;\n};\n"],"mappings":""}
+{"version":3,"file":"ClientOptions.mjs","names":[],"sources":["../../src/types/ClientOptions.ts"],"sourcesContent":["//\n// Copyright 2023 DXOS.org\n//\n\n// @import-as-namespace\n\nimport type * as Effect from 'effect/Effect';\n\nimport * as Capability from '@dxos/app-framework/Capability';\nimport { type Client, type ClientOptions } from '@dxos/client';\n\nexport type ClientPluginOptions = ClientOptions & {\n  /**\n   * A client to adopt instead of constructing one, so a host can start `initialize()` at entry\n   * rather than when activation reaches this lazily-imported module. `@synchronized`, so the\n   * plugin's own call joins it; lifecycle stays with the plugin, which destroys it on teardown.\n   */\n  client?: Client;\n\n  /**\n   * Whether the navigation handler consumes invitation codes from URL query params.\n   * Disable when another plugin (e.g. plugin-onboarding) owns the invitation URL flow.\n   * @default true\n   */\n  invitationUrlHandler?: boolean;\n\n  /**\n   * Base origin for the invitation link.\n   */\n  shareableLinkOrigin?: string;\n\n  /**\n   * Surface the identity-swapping actions kept for testing: join another identity by device\n   * invitation, or restore one from a recovery code. Both wipe local storage before they run, so\n   * an app whose onboarding gate offers the same flows on a clean profile should pass the inverse\n   * of that gate's condition rather than expose them to real users.\n   * @default false\n   */\n  identityTestActions?: boolean;\n\n  /**\n   * Path for the invitation link.\n   */\n  invitationPath?: string;\n\n  /**\n   * Query parameter for the invitation code.\n   */\n  invitationProp?: string;\n\n  /**\n   * Run after the client has been initialized.\n   * Plugin context is provided so capabilities are accessible.\n   */\n  onClientInitialized?: (params: { client: Client }) => Effect.Effect<void, Error | never, Capability.Service | never>;\n\n  /**\n   * Called when the forked `client.initialize()` fails or exceeds `initializeTimeout`.\n   *\n   * The initialization runs outside the render tree, so nothing surfaces a failure on its own —\n   * consumers suspended on the client simply keep waiting. Apps supply this to raise it as a\n   * fatal error (Composer shows the reset dialog).\n   */\n  onClientInitializationError?: (params: {\n    error: unknown;\n  }) => Effect.Effect<void, Error | never, Capability.Service | never>;\n\n  /**\n   * Bounds the wait on `client.initialize()` before `onClientInitializationError` fires.\n   * @default INITIALIZE_TIMEOUT\n   */\n  initializeTimeout?: number;\n\n  /**\n   * Gate the contributed `ClientService` on initialization, so resolving it yields a client whose\n   * `halo`/`spaces`/`services` getters are safe to touch.\n   *\n   * For imperative hosts (the CLI): a command body runs straight through, so an ungated service\n   * hands it a client whose getters still throw `Client not initialized`. Leave it off in the app,\n   * where the forked initialization is the point — React consumers suspend on the client instead,\n   * and blocking the service would stall the boot waterfall.\n   *\n   * @default false\n   */\n  awaitInitialization?: boolean;\n\n  /**\n   * Called when spaces are ready.\n   * Plugin context is provided so capabilities are accessible.\n   */\n  onSpacesAvailable?: (params: { client: Client }) => Effect.Effect<void, Error | never, Capability.Service | never>;\n};\n"],"mappings":""}

package/dist/lib/PasskeyError.mjs

@@ -1,42 +1,99 @@
 import { t as __exportAll } from "./chunk-rolldown-runtime.mjs";
-import { BaseError } from "@dxos/errors";
+import * as Effect from "effect/Effect";
+import { BaseError, isCancellation } from "@dxos/errors";
+import * as Duration from "effect/Duration";
+import { log } from "@dxos/log";
+import * as NativePasskey from "@dxos/app-toolkit/NativePasskey";
 //#region src/types/PasskeyError.ts
 var PasskeyError_exports = /* @__PURE__ */ __exportAll({
 	Dismissed: () => Dismissed,
 	LoginFailed: () => LoginFailed,
+	NATIVE_PROMPT_TIMEOUT: () => NATIVE_PROMPT_TIMEOUT,
+	RegistrationFailed: () => RegistrationFailed,
 	Rejected: () => Rejected,
+	TimedOut: () => TimedOut,
+	Unavailable: () => Unavailable,
 	classify: () => classify,
-	fromAssertion: () => fromAssertion
+	fromAssertion: () => fromAssertion,
+	fromRegistration: () => fromRegistration,
+	report: () => report,
+	timeoutNativePrompt: () => timeoutNativePrompt
 });
+var __dxlog_file = "/__w/dxos/dxos/packages/plugins/plugin-client/src/types/PasskeyError.ts";
 /**
 * The platform prompt produced no assertion. WebAuthn reports a dismissed prompt and
 * "this device has no passkey for this site" identically, so the two cannot be told apart.
 */
-var Dismissed = class extends BaseError.extend("PasskeyDismissedError", "No passkey was presented") {};
+var Dismissed = class extends BaseError.extend("PasskeyDismissedError", "No passkey was presented") {
+	/** Marks a dismissal as a cancellation so a generic reporter (the process runtime) can see it too. */
+	cancellation = true;
+};
 /** The assertion was refused: the passkey is not registered as a recovery credential for any identity. */
 var Rejected = class extends BaseError.extend("PasskeyRejectedError", "Passkey was not accepted") {};
 /** Passkey login failed before an assertion could be checked (service unreachable, unusable authenticator response). */
 var LoginFailed = class extends BaseError.extend("PasskeyLoginError", "Passkey login failed") {};
+/** Creating a passkey failed for a reason other than the user dismissing the prompt. */
+var RegistrationFailed = class extends BaseError.extend("PasskeyRegistrationError", "Passkey could not be created") {};
+/** The native prompt never answered. The bridge cannot cancel it, so its sheet may still be on screen. */
+var TimedOut = class extends BaseError.extend("PasskeyTimedOutError", "The passkey prompt did not respond") {};
+/** This host cannot complete a passkey request, so none was started. */
+var Unavailable = class extends BaseError.extend("PasskeyUnavailableError", "Passkeys are not available in this build") {};
+/** Longest a native prompt may stay unanswered; the WebAuthn ceremony ceiling. */
+var NATIVE_PROMPT_TIMEOUT = Duration.minutes(5);
+/** Abandon a native passkey call that never answers. */
+var timeoutNativePrompt = (effect, duration = NATIVE_PROMPT_TIMEOUT) => Effect.timeoutOrElse(effect, {
+	duration,
+	orElse: () => Effect.fail(new TimedOut())
+});
+/**
+* What the macOS bridge rejects with for every `ASAuthorizationError`, a cancel included: it collapses
+* each into one plain string per ceremony, so a cancel cannot be told apart from a failure.
+*/
+var NATIVE_BRIDGE_REJECTIONS = ["Registration failed", "Login failed"];
 /**
-* Classify a rejection from the authenticator. WebAuthn reports a dismissed prompt and
-* "no credential for this site" as the same `NotAllowedError`, so both map to dismissal;
-* the native (Tauri) bridge rejects with a plain string rather than a `DOMException`.
+* Whether the authenticator rejected because the prompt was dismissed. WebAuthn reports a dismissed
+* prompt and "no credential for this site" as the same `NotAllowedError`; the macOS bridge's generic
+* rejections are just as ambiguous, so both read as dismissals.
 */
-var fromAssertion = (error) => {
+var isDismissal = (error) => {
+	if (NativePasskey.isNativePasskeyError(error)) return error.cancelled;
 	const name = error instanceof DOMException ? error.name : void 0;
-	if (name === "NotAllowedError" || name === "AbortError" || /cancell?ed/i.test(String(error))) return new Dismissed({ cause: error });
-	return new LoginFailed({ cause: error });
+	return name === "NotAllowedError" || name === "AbortError" || NATIVE_BRIDGE_REJECTIONS.includes(String(error)) || /cancell?ed/i.test(String(error));
 };
+/** Classify a rejection from the authenticator while logging in. */
+var fromAssertion = (error) => isDismissal(error) ? new Dismissed({ cause: error }) : new LoginFailed({ cause: error });
+/** Classify a rejection from the authenticator while creating a passkey. */
+var fromRegistration = (error) => isDismissal(error) ? new Dismissed({ cause: error }) : new RegistrationFailed({ cause: error });
 /**
-* Classify an error returned by the `RedeemPasskey` operation.
+* Classify an error returned by the `RedeemPasskey` or `CreatePasskey` operation.
 * Anything unrecognized is reported as a generic failure rather than swallowed.
 */
 var classify = (error) => {
-	if (Dismissed.is(error)) return "dismissed";
+	if (Dismissed.is(error) || isCancellation(error)) return "dismissed";
 	if (Rejected.is(error)) return "rejected";
 	return "failed";
 };
+/**
+* Report a failed redemption and classify it for the UI. A dismissed prompt is the user closing a
+* dialog, so it reports at `info` — at `error` it swamps the production error stream (DX-1281).
+*/
+var report = (error) => {
+	const failure = classify(error);
+	if (failure === "dismissed") log.info("passkey prompt dismissed", { error }, {
+		"~LogMeta": "~LogMeta",
+		F: __dxlog_file,
+		L: 116,
+		S: void 0
+	});
+	else log.catch(error, void 0, {
+		"~LogMeta": "~LogMeta",
+		F: __dxlog_file,
+		L: 118,
+		S: void 0
+	});
+	return failure;
+};
 //#endregion
-export { Dismissed, LoginFailed, Rejected, classify, fromAssertion, PasskeyError_exports as t };
+export { Dismissed, LoginFailed, NATIVE_PROMPT_TIMEOUT, RegistrationFailed, Rejected, TimedOut, Unavailable, classify, fromAssertion, fromRegistration, report, PasskeyError_exports as t, timeoutNativePrompt };
 
 //# sourceMappingURL=PasskeyError.mjs.map

package/dist/lib/PasskeyError.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"PasskeyError.mjs","names":[],"sources":["../../src/types/PasskeyError.ts"],"sourcesContent":["//\n// Copyright 2025 DXOS.org\n//\n\n// @import-as-namespace\n\nimport { BaseError } from '@dxos/errors';\n\n/**\n * The platform prompt produced no assertion. WebAuthn reports a dismissed prompt and\n * \"this device has no passkey for this site\" identically, so the two cannot be told apart.\n */\nexport class Dismissed extends BaseError.extend('PasskeyDismissedError', 'No passkey was presented') {}\n\n/** The assertion was refused: the passkey is not registered as a recovery credential for any identity. */\nexport class Rejected extends BaseError.extend('PasskeyRejectedError', 'Passkey was not accepted') {}\n\n/** Passkey login failed before an assertion could be checked (service unreachable, unusable authenticator response). */\nexport class LoginFailed extends BaseError.extend('PasskeyLoginError', 'Passkey login failed') {}\n\n/** Every way a passkey login can fail, as `ConfigError.ConfigError` names its own union. */\nexport type PasskeyError = Dismissed | Rejected | LoginFailed;\n\n/** Discriminates a passkey login failure so callers can pick a message without matching on error names. */\nexport type Failure = 'dismissed' | 'rejected' | 'failed';\n\n/**\n * Classify a rejection from the authenticator. WebAuthn reports a dismissed prompt and\n * \"no credential for this site\" as the same `NotAllowedError`, so both map to dismissal;\n * the native (Tauri) bridge rejects with a plain string rather than a `DOMException`.\n */\nexport const fromAssertion = (error: unknown): Dismissed | LoginFailed => {\n  const name = error instanceof DOMException ? error.name : undefined;\n  if (name === 'NotAllowedError' || name === 'AbortError' || /cancell?ed/i.test(String(error))) {\n    return new Dismissed({ cause: error });\n  }\n  return new LoginFailed({ cause: error });\n};\n\n/**\n * Classify an error returned by the `RedeemPasskey` operation.\n * Anything unrecognized is reported as a generic failure rather than swallowed.\n */\nexport const classify = (error: unknown): Failure => {\n  if (Dismissed.is(error)) {\n    return 'dismissed';\n  }\n  if (Rejected.is(error)) {\n    return 'rejected';\n  }\n  return 'failed';\n};\n"],"mappings":";;;;;;;;;;;;;;AAYA,IAAa,YAAb,cAA+B,UAAU,OAAO,yBAAyB,0BAA0B,CAAC,CAAC,CAAC;;AAGtG,IAAa,WAAb,cAA8B,UAAU,OAAO,wBAAwB,0BAA0B,CAAC,CAAC,CAAC;;AAGpG,IAAa,cAAb,cAAiC,UAAU,OAAO,qBAAqB,sBAAsB,CAAC,CAAC,CAAC;;;;;;AAahG,IAAa,iBAAiB,UAA4C;CACxE,MAAM,OAAO,iBAAiB,eAAe,MAAM,OAAO,KAAA;CAC1D,IAAI,SAAS,qBAAqB,SAAS,gBAAgB,cAAc,KAAK,OAAO,KAAK,CAAC,GACzF,OAAO,IAAI,UAAU,EAAE,OAAO,MAAM,CAAC;CAEvC,OAAO,IAAI,YAAY,EAAE,OAAO,MAAM,CAAC;AACzC;;;;;AAMA,IAAa,YAAY,UAA4B;CACnD,IAAI,UAAU,GAAG,KAAK,GACpB,OAAO;CAET,IAAI,SAAS,GAAG,KAAK,GACnB,OAAO;CAET,OAAO;AACT"}
+{"version":3,"file":"PasskeyError.mjs","names":[],"sources":["../../src/types/PasskeyError.ts"],"sourcesContent":["//\n// Copyright 2025 DXOS.org\n//\n\n// @import-as-namespace\n\nimport * as Duration from 'effect/Duration';\nimport * as Effect from 'effect/Effect';\n\nimport * as NativePasskey from '@dxos/app-toolkit/NativePasskey';\nimport { BaseError, type Cancellation, isCancellation } from '@dxos/errors';\nimport { log } from '@dxos/log';\n\n/**\n * The platform prompt produced no assertion. WebAuthn reports a dismissed prompt and\n * \"this device has no passkey for this site\" identically, so the two cannot be told apart.\n */\nexport class Dismissed\n  extends BaseError.extend('PasskeyDismissedError', 'No passkey was presented')\n  implements Cancellation\n{\n  /** Marks a dismissal as a cancellation so a generic reporter (the process runtime) can see it too. */\n  readonly cancellation = true as const;\n}\n\n/** The assertion was refused: the passkey is not registered as a recovery credential for any identity. */\nexport class Rejected extends BaseError.extend('PasskeyRejectedError', 'Passkey was not accepted') {}\n\n/** Passkey login failed before an assertion could be checked (service unreachable, unusable authenticator response). */\nexport class LoginFailed extends BaseError.extend('PasskeyLoginError', 'Passkey login failed') {}\n\n/** Creating a passkey failed for a reason other than the user dismissing the prompt. */\nexport class RegistrationFailed extends BaseError.extend('PasskeyRegistrationError', 'Passkey could not be created') {}\n\n/** The native prompt never answered. The bridge cannot cancel it, so its sheet may still be on screen. */\nexport class TimedOut extends BaseError.extend('PasskeyTimedOutError', 'The passkey prompt did not respond') {}\n\n/** This host cannot complete a passkey request, so none was started. */\nexport class Unavailable extends BaseError.extend(\n  'PasskeyUnavailableError',\n  'Passkeys are not available in this build',\n) {}\n\n/** Every way a passkey ceremony can fail, as `ConfigError.ConfigError` names its own union. */\nexport type PasskeyError = Dismissed | Rejected | LoginFailed | RegistrationFailed | TimedOut | Unavailable;\n\n/** Longest a native prompt may stay unanswered; the WebAuthn ceremony ceiling. */\nexport const NATIVE_PROMPT_TIMEOUT = Duration.minutes(5);\n\n/** Abandon a native passkey call that never answers. */\nexport const timeoutNativePrompt = <A, E, R>(\n  effect: Effect.Effect<A, E, R>,\n  duration: Duration.Input = NATIVE_PROMPT_TIMEOUT,\n): Effect.Effect<A, E | TimedOut, R> =>\n  Effect.timeoutOrElse(effect, { duration, orElse: () => Effect.fail(new TimedOut()) });\n\n/** Discriminates a passkey failure so callers can pick a message without matching on error names. */\nexport type Failure = 'dismissed' | 'rejected' | 'failed';\n\n/**\n * What the macOS bridge rejects with for every `ASAuthorizationError`, a cancel included: it collapses\n * each into one plain string per ceremony, so a cancel cannot be told apart from a failure.\n */\n// TODO(wittjosiah): Patch tauri-plugin-macos-passkey to pass `ASAuthorizationError.code` through so only a\n//   cancel (1001) reads as a dismissal; today a domain-association failure is silenced along with it.\nconst NATIVE_BRIDGE_REJECTIONS = ['Registration failed', 'Login failed'];\n\n/**\n * Whether the authenticator rejected because the prompt was dismissed. WebAuthn reports a dismissed\n * prompt and \"no credential for this site\" as the same `NotAllowedError`; the macOS bridge's generic\n * rejections are just as ambiguous, so both read as dismissals.\n */\nconst isDismissal = (error: unknown): boolean => {\n  if (NativePasskey.isNativePasskeyError(error)) {\n    return error.cancelled;\n  }\n\n  const name = error instanceof DOMException ? error.name : undefined;\n  return (\n    name === 'NotAllowedError' ||\n    name === 'AbortError' ||\n    NATIVE_BRIDGE_REJECTIONS.includes(String(error)) ||\n    /cancell?ed/i.test(String(error))\n  );\n};\n\n/** Classify a rejection from the authenticator while logging in. */\nexport const fromAssertion = (error: unknown): Dismissed | LoginFailed =>\n  isDismissal(error) ? new Dismissed({ cause: error }) : new LoginFailed({ cause: error });\n\n/** Classify a rejection from the authenticator while creating a passkey. */\nexport const fromRegistration = (error: unknown): Dismissed | RegistrationFailed =>\n  isDismissal(error) ? new Dismissed({ cause: error }) : new RegistrationFailed({ cause: error });\n\n/**\n * Classify an error returned by the `RedeemPasskey` or `CreatePasskey` operation.\n * Anything unrecognized is reported as a generic failure rather than swallowed.\n */\nexport const classify = (error: unknown): Failure => {\n  if (Dismissed.is(error) || isCancellation(error)) {\n    return 'dismissed';\n  }\n  if (Rejected.is(error)) {\n    return 'rejected';\n  }\n  return 'failed';\n};\n\n/**\n * Report a failed redemption and classify it for the UI. A dismissed prompt is the user closing a\n * dialog, so it reports at `info` — at `error` it swamps the production error stream (DX-1281).\n */\nexport const report = (error: unknown): Failure => {\n  const failure = classify(error);\n  if (failure === 'dismissed') {\n    log.info('passkey prompt dismissed', { error });\n  } else {\n    log.catch(error);\n  }\n\n  return failure;\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,IAAa,YAAb,cACU,UAAU,OAAO,yBAAyB,0BAA0B,CAAA,CAE9E;;CAEE,eAAwB;AAC1B;;AAGA,IAAa,WAAb,cAA8B,UAAU,OAAO,wBAAwB,0BAA0B,CAAC,CAAC,CAAC;;AAGpG,IAAa,cAAb,cAAiC,UAAU,OAAO,qBAAqB,sBAAsB,CAAC,CAAC,CAAC;;AAGhG,IAAa,qBAAb,cAAwC,UAAU,OAAO,4BAA4B,8BAA8B,CAAC,CAAC,CAAC;;AAGtH,IAAa,WAAb,cAA8B,UAAU,OAAO,wBAAwB,oCAAoC,CAAC,CAAC,CAAC;;AAG9G,IAAa,cAAb,cAAiC,UAAU,OACzC,2BACA,0CACF,CAAC,CAAC,CAAC;;AAMH,IAAa,wBAAwB,SAAS,QAAQ,CAAC;;AAGvD,IAAa,uBACX,QACA,WAA2B,0BAE3B,OAAO,cAAc,QAAQ;CAAE;CAAU,cAAc,OAAO,KAAK,IAAI,SAAS,CAAC;AAAE,CAAC;;;;;AAWtF,IAAM,2BAA2B,CAAC,uBAAuB,cAAc;;;;;;AAOvE,IAAM,eAAe,UAA4B;CAC/C,IAAI,cAAc,qBAAqB,KAAK,GAC1C,OAAO,MAAM;CAGf,MAAM,OAAO,iBAAiB,eAAe,MAAM,OAAO,KAAA;CAC1D,OACE,SAAS,qBACT,SAAS,gBACT,yBAAyB,SAAS,OAAO,KAAK,CAAC,KAC/C,cAAc,KAAK,OAAO,KAAK,CAAC;AAEpC;;AAGA,IAAa,iBAAiB,UAC5B,YAAY,KAAK,IAAI,IAAI,UAAU,EAAE,OAAO,MAAM,CAAC,IAAI,IAAI,YAAY,EAAE,OAAO,MAAM,CAAC;;AAGzF,IAAa,oBAAoB,UAC/B,YAAY,KAAK,IAAI,IAAI,UAAU,EAAE,OAAO,MAAM,CAAC,IAAI,IAAI,mBAAmB,EAAE,OAAO,MAAM,CAAC;;;;;AAMhG,IAAa,YAAY,UAA4B;CACnD,IAAI,UAAU,GAAG,KAAK,KAAK,eAAe,KAAK,GAC7C,OAAO;CAET,IAAI,SAAS,GAAG,KAAK,GACnB,OAAO;CAET,OAAO;AACT;;;;;AAMA,IAAa,UAAU,UAA4B;CACjD,MAAM,UAAU,SAAS,KAAK;CAC9B,IAAI,YAAY,aACd,IAAI,KAAK,4BAA4B,EAAE,MAAM,GAAA;EAAA,YAAA;EAAA,GAAA;EAAA,GAAA;EAAA,GAAA,KAAA;CAAA,CAAC;MAE9C,IAAI,MAAM,OAAI,KAAA,GAAA;EAAA,YAAA;EAAA,GAAA;EAAA,GAAA;EAAA,GAAA,KAAA;CAAA,CAAC;CAGjB,OAAO;AACT"}